diff --git a/recipes-wifi/atenl/files/ated.sh b/recipes-wifi/atenl/files/ated.sh
index 9037054..9046136 100644
--- a/recipes-wifi/atenl/files/ated.sh
+++ b/recipes-wifi/atenl/files/ated.sh
@@ -108,6 +108,10 @@
             SOC_start_idx="0"
             SOC_end_idx="1"
             is_connac3="1"
+        elif [ ! -z "$(head -c 2 ${eeprom_file} | hexdump | grep "7993")" ]; then
+            SOC_start_idx="0"
+            SOC_end_idx="1"
+            is_connac3="1"
         else
             echo "Interface Conversion Failed!"
             echo "Please use iwpriv <phy0/phy1/..> set <...> or configure the sku of your board manually by the following commands"
@@ -131,6 +135,10 @@
             echo "      echo STARTIDX=0 >> ${ated_file}"
             echo "      echo ENDIDX=1 >> ${ated_file}"
             echo "      echo IS_CONNAC3=1 >> ${ated_file}"
+            echo "For Griffin:"
+            echo "      echo STARTIDX=0 >> ${interface_file}"
+            echo "      echo ENDIDX=1 >> ${interface_file}"
+            echo "      echo IS_CONNAC3=1 >> ${interface_file}"
             exit 0
         fi
         record_config "STARTIDX" ${SOC_start_idx} ${ated_file}
diff --git a/recipes-wifi/atenl/files/iwpriv.sh b/recipes-wifi/atenl/files/iwpriv.sh
index a4257f1..9b73fe8 100644
--- a/recipes-wifi/atenl/files/iwpriv.sh
+++ b/recipes-wifi/atenl/files/iwpriv.sh
@@ -118,6 +118,10 @@
             SOC_start_idx="0"
             SOC_end_idx="1"
             is_connac3="1"
+        elif [ ! -z "$(head -c 2 ${eeprom_file} | hexdump | grep "7993")" ]; then
+            SOC_start_idx="0"
+            SOC_end_idx="1"
+            is_connac3="1"
         else
             echo "Interface Conversion Failed!"
             echo "Please use iwpriv <phy0/phy1/..> set <...> or configure the sku of your board manually by the following commands"
@@ -141,6 +145,10 @@
             echo "      echo STARTIDX=0 >> ${interface_file}"
             echo "      echo ENDIDX=1 >> ${interface_file}"
             echo "      echo IS_CONNAC3=1 >> ${interface_file}"
+            echo "For Griffin:"
+            echo "      echo STARTIDX=0 >> ${interface_file}"
+            echo "      echo ENDIDX=1 >> ${interface_file}"
+            echo "      echo IS_CONNAC3=1 >> ${interface_file}"
             exit 0
         fi
         record_config "STARTIDX" ${SOC_start_idx} ${interface_file}
@@ -198,10 +206,8 @@
 function change_band_idx {
     local new_idx=$1
     local new_phy_idx=$phy_idx
-
     local old_idx=$(get_config "ATECTRLBANDIDX" ${iwpriv_file})
 
-
     if [[ ${interface_ori} == "ra"* ]]; then
         if [ -z "${old_idx}" ] || [ "${old_idx}" != "${new_idx}" ]; then
             if [ "${new_idx}" = "0" ]; then
@@ -243,7 +249,7 @@
         echo "tx_length"
     elif [ "$1" = "ATETXMCS" ]; then
         echo "tx_rate_idx"
-    elif [ "$1" = "ATEVHTNSS" ]; then
+    elif [ "$1" = "ATEVHTNSS" ] || [ "$1" = "ATETXNSS" ]; then
         echo "tx_rate_nss"
     elif [ "$1" = "ATETXLDPC" ]; then
         echo "tx_rate_ldpc"
@@ -1105,7 +1111,7 @@
 
             skip=1
             ;;
-        "ATETXCNT"|"ATETXLEN"|"ATETXMCS"|"ATEVHTNSS"|"ATETXLDPC"|"ATETXSTBC"| \
+        "ATETXCNT"|"ATETXLEN"|"ATETXMCS"|"ATEVHTNSS"|"ATETXNSS"|"ATETXLDPC"|"ATETXSTBC"| \
         "ATEPKTTXTIME"|"ATEIPG"|"ATEDUTYCYCLE"|"ATETXFREQOFFSET")
             cmd_new=$(simple_convert ${cmd})
             if [ "${param_new}" = "undefined" ]; then
diff --git a/recipes-wifi/atenl/files/src/atenl.h b/recipes-wifi/atenl/files/src/atenl.h
index a6695c9..6f4f0f5 100644
--- a/recipes-wifi/atenl/files/src/atenl.h
+++ b/recipes-wifi/atenl/files/src/atenl.h
@@ -285,7 +285,10 @@
 	MT_EE_EAGLE_BAND_SEL_2GHZ,
 	MT_EE_EAGLE_BAND_SEL_5GHZ,
 	MT_EE_EAGLE_BAND_SEL_6GHZ,
-	MT_EE_EAGLE_BAND_SEL_5GHZ_6GHZ,
+	MT_EE_EAGLE_BAND_SEL_5GHZ_LOW,
+	MT_EE_EAGLE_BAND_SEL_5GHZ_HIGH,
+	MT_EE_EAGLE_BAND_SEL_6GHZ_LOW,
+	MT_EE_EAGLE_BAND_SEL_6GHZ_HIGH,
 };
 
 #define MT_EE_WIFI_CONF				0x190
@@ -391,39 +394,67 @@
 	PREK_CLEAN_DPD,
 };
 
+#define MT7916_EEPROM_CHIP_ID		0x7916
+
+/* Wi-Fi6 device id */
+#define MT7915_DEVICE_ID		0x7915
+#define MT7915_DEVICE_ID_2		0x7916
+#define MT7916_DEVICE_ID		0x7906
+#define MT7916_DEVICE_ID_2		0x790a
+#define MT7981_DEVICE_ID		0x7981
+#define MT7986_DEVICE_ID		0x7986
+
+/* Wi-Fi7 device id */
+#define MT7996_DEVICE_ID		0x7990
+#define MT7996_DEVICE_ID_2		0x7991
+#define MT7992_DEVICE_ID		0x7992
+#define MT7992_DEVICE_ID_2		0x799a
+#define MT7990_DEVICE_ID		0x7993
+#define MT7990_DEVICE_ID_2		0x799b
+
 static inline bool is_mt7915(struct atenl *an)
 {
-	return an->chip_id == 0x7915;
+	return an->chip_id == MT7915_DEVICE_ID;
 }
 
 static inline bool is_mt7916(struct atenl *an)
 {
-	return (an->chip_id == 0x7916) || (an->chip_id == 0x7906);
+	/* Merlin is special case:
+	 * pcie id is 0x7906/0x790a but eeprom chip id use 0x7916,
+	 * since 0x7916 is already used by the second pcie of Harrier.
+	 */
+	return (an->chip_id == MT7916_EEPROM_CHIP_ID) ||
+	       (an->chip_id == MT7916_DEVICE_ID);
 }
 
 static inline bool is_mt7981(struct atenl *an)
 {
-	return an->chip_id == 0x7981;
+	return an->chip_id == MT7981_DEVICE_ID;
 }
 
 static inline bool is_mt7986(struct atenl *an)
 {
-	return an->chip_id == 0x7986;
+	return an->chip_id == MT7986_DEVICE_ID;
 }
 
 static inline bool is_mt7996(struct atenl *an)
 {
-	return an->chip_id == 0x7990;
+	return an->chip_id == MT7996_DEVICE_ID;
 }
 
 static inline bool is_mt7992(struct atenl *an)
 {
-	return an->chip_id == 0x7992;
+	return an->chip_id == MT7992_DEVICE_ID;
 }
 
+static inline bool is_mt7990(struct atenl *an)
+{
+	return an->chip_id == MT7990_DEVICE_ID;
+}
+
 static inline bool is_connac3(struct atenl *an)
 {
-	return is_mt7996(an) || is_mt7992(an);
+	return is_mt7996(an) || is_mt7992(an) || is_mt7990(an);
 }
 
 int atenl_eth_init(struct atenl *an);
@@ -435,6 +466,7 @@
 int atenl_nl_check_mtd(struct atenl *an);
 int atenl_nl_write_eeprom(struct atenl *an, u32 offset, u8 *val, int len);
 int atenl_nl_write_efuse_all(struct atenl *an);
+int atenl_nl_write_ext_eeprom_all(struct atenl *an);
 int atenl_nl_update_buffer_mode(struct atenl *an);
 int atenl_nl_set_state(struct atenl *an, u8 band,
 		       enum mt76_testmode_state state);
diff --git a/recipes-wifi/atenl/files/src/eeprom.c b/recipes-wifi/atenl/files/src/eeprom.c
index b3a652a..6dd4113 100644
--- a/recipes-wifi/atenl/files/src/eeprom.c
+++ b/recipes-wifi/atenl/files/src/eeprom.c
@@ -151,6 +151,8 @@
 		/* TODO: parse info if required */
 	} else if (is_mt7992(an)) {
 		/* TODO: parse info if required */
+	} else if (is_mt7990(an)) {
+		/* TODO: parse info if required */
 	}
 }
 
@@ -158,19 +160,20 @@
 atenl_eeprom_init_max_size(struct atenl *an)
 {
 	switch (an->chip_id) {
-	case 0x7915:
+	case MT7915_DEVICE_ID:
 		an->eeprom_size = 3584;
 		an->eeprom_prek_offs = 0x62;
 		break;
-	case 0x7906:
-	case 0x7916:
-	case 0x7981:
-	case 0x7986:
+	case MT7916_EEPROM_CHIP_ID:
+	case MT7916_DEVICE_ID:
+	case MT7981_DEVICE_ID:
+	case MT7986_DEVICE_ID:
 		an->eeprom_size = 4096;
 		an->eeprom_prek_offs = 0x19a;
 		break;
-	case 0x7990:
-	case 0x7992:
+	case MT7996_DEVICE_ID:
+	case MT7992_DEVICE_ID:
+	case MT7990_DEVICE_ID:
 		an->eeprom_size = 7680;
 		an->eeprom_prek_offs = 0x1a5;
 	default:
@@ -255,20 +258,21 @@
 			case MT_EE_EAGLE_BAND_SEL_2GHZ:
 				anb->cap = BAND_TYPE_2G;
 				break;
+			case MT_EE_EAGLE_BAND_SEL_5GHZ_LOW:
+			case MT_EE_EAGLE_BAND_SEL_5GHZ_HIGH:
 			case MT_EE_EAGLE_BAND_SEL_5GHZ:
 				anb->cap = BAND_TYPE_5G;
 				break;
+			case MT_EE_EAGLE_BAND_SEL_6GHZ_LOW:
+			case MT_EE_EAGLE_BAND_SEL_6GHZ_HIGH:
 			case MT_EE_EAGLE_BAND_SEL_6GHZ:
 				anb->cap = BAND_TYPE_6G;
 				break;
-			case MT_EE_EAGLE_BAND_SEL_5GHZ_6GHZ:
-				anb->cap = BAND_TYPE_5G_6G;
-				break;
 			default:
 				break;
 			}
 		}
-	} else if (is_mt7992(an)) {
+	} else if (is_mt7992(an) || is_mt7990(an)) {
 		struct atenl_band *anb;
 		u8 val, band_sel;
 		u8 band_sel_mask[2] = {EAGLE_BAND_SEL(0), EAGLE_BAND_SEL(1)};
@@ -284,15 +288,16 @@
 			case MT_EE_EAGLE_BAND_SEL_2GHZ:
 				anb->cap = BAND_TYPE_2G;
 				break;
+			case MT_EE_EAGLE_BAND_SEL_5GHZ_LOW:
+			case MT_EE_EAGLE_BAND_SEL_5GHZ_HIGH:
 			case MT_EE_EAGLE_BAND_SEL_5GHZ:
 				anb->cap = BAND_TYPE_5G;
 				break;
+			case MT_EE_EAGLE_BAND_SEL_6GHZ_LOW:
+			case MT_EE_EAGLE_BAND_SEL_6GHZ_HIGH:
 			case MT_EE_EAGLE_BAND_SEL_6GHZ:
 				anb->cap = BAND_TYPE_6G;
 				break;
-			case MT_EE_EAGLE_BAND_SEL_5GHZ_6GHZ:
-				anb->cap = BAND_TYPE_5G_6G;
-				break;
 			default:
 				break;
 			}
@@ -304,7 +309,7 @@
 atenl_eeprom_init_antenna_cap(struct atenl *an)
 {
 	switch (an->chip_id) {
-	case 0x7915:
+	case MT7915_DEVICE_ID:
 		if (an->anb[0].cap == BAND_TYPE_2G_5G)
 			an->anb[0].chainmask = 0xf;
 		else {
@@ -312,28 +317,34 @@
 			an->anb[1].chainmask = 0xc;
 		}
 		break;
-	case 0x7906:
-	case 0x7916:
+	case MT7916_EEPROM_CHIP_ID:
+	case MT7916_DEVICE_ID:
 		an->anb[0].chainmask = 0x3;
 		an->anb[1].chainmask = 0x3;
 		break;
-	case 0x7981:
+	case MT7981_DEVICE_ID:
 		an->anb[0].chainmask = 0x3;
 		an->anb[1].chainmask = 0x7;
 		break;
-	case 0x7986:
+	case MT7986_DEVICE_ID:
 		an->anb[0].chainmask = 0xf;
 		an->anb[1].chainmask = 0xf;
 		break;
-	case 0x7990:
+	case MT7996_DEVICE_ID:
+		/* TODO: handle 4T5R */
 		an->anb[0].chainmask = 0xf;
 		an->anb[1].chainmask = 0xf;
 		an->anb[2].chainmask = 0xf;
 		break;
-	case 0x7992:
+	case MT7992_DEVICE_ID:
+		/* TODO: handle BE7200 2i5i 5T5R */
 		an->anb[0].chainmask = 0xf;
 		an->anb[1].chainmask = 0xf;
 		break;
+	case MT7990_DEVICE_ID:
+		an->anb[0].chainmask = 0x3;
+		an->anb[1].chainmask = 0x7;
+		break;
 	default:
 		break;
 	}
@@ -484,7 +495,7 @@
 	return ret;
 }
 
-/* Update all eeprom values to driver before writing efuse */
+/* Update all eeprom values to driver before writing efuse or ext eeprom */
 static void
 atenl_eeprom_sync_to_driver(struct atenl *an)
 {
@@ -548,6 +559,9 @@
 			} else if (!strncmp(s, "to efuse", 8)) {
 				atenl_eeprom_sync_to_driver(an);
 				atenl_nl_write_efuse_all(an);
+			} else if (!strncmp(s, "to ext", 6)) {
+				atenl_eeprom_sync_to_driver(an);
+				atenl_nl_write_ext_eeprom_all(an);
 			}
 		} else if (!strncmp(s, "read", 4)) {
 			u32 offset;
diff --git a/recipes-wifi/atenl/files/src/nl.c b/recipes-wifi/atenl/files/src/nl.c
index baf2944..9982231 100644
--- a/recipes-wifi/atenl/files/src/nl.c
+++ b/recipes-wifi/atenl/files/src/nl.c
@@ -1305,6 +1305,36 @@
 	return 0;
 }
 
+int atenl_nl_write_ext_eeprom_all(struct atenl *an)
+{
+	struct atenl_nl_priv nl_priv = {};
+	struct nl_msg *msg;
+	void *ptr;
+
+	if (unl_genl_init(&nl_priv.unl, "nl80211") < 0) {
+		atenl_err("Failed to connect to nl80211\n");
+		return 2;
+	}
+
+	msg = unl_genl_msg(&nl_priv.unl, NL80211_CMD_TESTMODE, false);
+	nla_put_u32(msg, NL80211_ATTR_WIPHY, get_band_val(an, 0, phy_idx));
+
+	ptr = nla_nest_start(msg, NL80211_ATTR_TESTDATA);
+	if (!ptr)
+		return -ENOMEM;
+
+	nla_put_u8(msg, MT76_TM_ATTR_EEPROM_ACTION,
+		   MT76_TM_EEPROM_ACTION_WRITE_TO_EXT_EEPROM);
+
+	nla_nest_end(msg, ptr);
+
+	unl_genl_request(&nl_priv.unl, msg, NULL, NULL);
+
+	unl_free(&nl_priv.unl);
+
+	return 0;
+}
+
 int atenl_nl_update_buffer_mode(struct atenl *an)
 {
 	struct atenl_nl_priv nl_priv = {};
diff --git a/recipes-wifi/atenl/files/src/nl.h b/recipes-wifi/atenl/files/src/nl.h
index b580a01..bd0aee7 100644
--- a/recipes-wifi/atenl/files/src/nl.h
+++ b/recipes-wifi/atenl/files/src/nl.h
@@ -267,11 +267,13 @@
  * 	eeprom data block
  * @MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE: send updated eeprom data to fw
  * @MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE: write eeprom data back to efuse
+ * @MT76_TM_EEPROM_ACTION_WRITE_TO_EXT_EEPROM: write eeprom data back to external eeprom
  */
 enum mt76_testmode_eeprom_action {
 	MT76_TM_EEPROM_ACTION_UPDATE_DATA,
 	MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE,
 	MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE,
+	MT76_TM_EEPROM_ACTION_WRITE_TO_EXT_EEPROM,
 
 	/* keep last */
 	NUM_MT76_TM_EEPROM_ACTION,
diff --git a/recipes-wifi/hostapd/files/hostapd.uc b/recipes-wifi/hostapd/files/hostapd.uc
index 19b1490..6d56655 100644
--- a/recipes-wifi/hostapd/files/hostapd.uc
+++ b/recipes-wifi/hostapd/files/hostapd.uc
@@ -22,6 +22,14 @@
 	eap_sim_db: true,
 };
 
+hostapd.data.iface_fields = {
+	ft_iface: true,
+	upnp_iface: true,
+	snoop_iface: true,
+	bridge: true,
+	iapp_interface: true,
+};
+
 function iface_remove(cfg)
 {
 	if (!cfg || !cfg.bss || !cfg.bss[0] || !cfg.bss[0].ifname)
@@ -243,6 +251,16 @@
 	pending.next();
 }
 
+function iface_macaddr_init(phydev, config, macaddr_list)
+{
+	let macaddr_data = {
+		num_global: config.num_global_macaddr ?? 1,
+		mbssid: config.mbssid ?? 0,
+	};
+
+	return phydev.macaddr_init(macaddr_list, macaddr_data);
+}
+
 function iface_restart(phydev, config, old_config)
 {
 	let phy = phydev.name;
@@ -260,7 +278,7 @@
 		return;
 	}
 
-	phydev.macaddr_init(iface_config_macaddr_list(config));
+	iface_macaddr_init(phydev, config, iface_config_macaddr_list(config));
 	for (let i = 0; i < length(config.bss); i++) {
 		let bss = config.bss[i];
 		if (bss.default_macaddr)
@@ -328,9 +346,24 @@
 	return new_cfg;
 }
 
+function bss_ifindex_list(config)
+{
+	config = filter(config, (line) => !!hostapd.data.iface_fields[split(line, "=")[0]]);
+
+	return join(",", map(config, (line) => {
+		try {
+			let file = "/sys/class/net/" + split(line, "=")[1] + "/ifindex";
+			let val = trim(readfile(file));
+			return val;
+		} catch (e) {
+			return "";
+		}
+	}));
+}
+
 function bss_config_hash(config)
 {
-	return hostapd.sha1(remove_file_fields(config) + "");
+	return hostapd.sha1(remove_file_fields(config) + bss_ifindex_list(config));
 }
 
 function bss_find_existing(config, prev_config, prev_hash)
@@ -514,11 +547,7 @@
 	}
 
 	// Step 6: assign BSSID for newly created interfaces
-	let macaddr_data = {
-		num_global: config.num_global_macaddr ?? 1,
-		mbssid: config.mbssid ?? 0,
-	};
-	macaddr_list = phydev.macaddr_init(macaddr_list, macaddr_data);
+	macaddr_list = iface_macaddr_init(phydev, config, macaddr_list);
 	for (let i = 0; i < length(config.bss); i++) {
 		if (bss_list[i])
 			continue;
@@ -689,7 +718,7 @@
 
 		if (val[0] == "#num_global_macaddr" ||
 		    val[0] == "mbssid")
-			config[val[0]] = int(val[1]);
+			config[substr(val[0], 1)] = int(val[1]);
 
 		if (val[0] == "#single_hw")
 			config["single_hw"] = int(val[1]);
@@ -940,13 +969,13 @@
 		hostapd.udebug_set(null);
 		hostapd.ubus.disconnect();
 	},
-	bss_add: function(name, obj) {
+	bss_add: function(phy, name, obj) {
 		bss_event("add", name);
 	},
-	bss_reload: function(name, obj, reconf) {
+	bss_reload: function(phy, name, obj, reconf) {
 		bss_event("reload", name, { reconf: reconf != 0 });
 	},
-	bss_remove: function(name, obj) {
+	bss_remove: function(phy, name, obj) {
 		bss_event("remove", name);
 	}
 };
diff --git a/recipes-wifi/hostapd/files/openwrt_script/hostapd.sh b/recipes-wifi/hostapd/files/openwrt_script/hostapd.sh
index 40266db..9ffb465 100644
--- a/recipes-wifi/hostapd/files/openwrt_script/hostapd.sh
+++ b/recipes-wifi/hostapd/files/openwrt_script/hostapd.sh
@@ -120,6 +120,8 @@
 	config_add_int rssi_reject_assoc_rssi
 	config_add_int rssi_ignore_probe_request
 	config_add_int maxassoc
+	config_add_int reg_power_type
+	config_add_boolean stationary_ap
 
 	config_add_string acs_chan_bias
 	config_add_array hostapd_options
@@ -139,7 +141,7 @@
 	json_get_vars country country3 country_ie beacon_int:100 doth require_mode legacy_rates \
 		acs_chan_bias local_pwr_constraint spectrum_mgmt_required airtime_mode cell_density \
 		rts_threshold beacon_rate rssi_reject_assoc_rssi rssi_ignore_probe_request maxassoc \
-		mbssid:0
+		mbssid:0 band reg_power_type stationary_ap
 
 	hostapd_set_log_options base_cfg
 
@@ -242,6 +244,14 @@
 	[ -n "$maxassoc" ] && append base_cfg "iface_max_num_sta=$maxassoc" "$N"
 	[ "$mbssid" -gt 0 ] && [ "$mbssid" -le 2 ] && append base_cfg "mbssid=$mbssid" "$N"
 
+	[ "$band" = "6g" ] && {
+		set_default reg_power_type 0
+		append base_cfg "he_6ghz_reg_pwr_type=$reg_power_type" "$N"
+	}
+
+	set_default stationary_ap 1
+	append base_cfg "stationary_ap=$stationary_ap" "$N"
+
 	json_get_values opts hostapd_options
 	for val in $opts; do
 		append base_cfg "$val" "$N"
@@ -376,8 +386,8 @@
 	config_add_array radius_auth_req_attr
 	config_add_array radius_acct_req_attr
 
-	config_add_int eap_server
-	config_add_string eap_user_file ca_cert server_cert private_key private_key_passwd server_id
+	config_add_int eap_server radius_server_auth_port
+	config_add_string eap_user_file ca_cert server_cert private_key private_key_passwd server_id radius_server_clients
 
 	config_add_boolean fils
 	config_add_string fils_dhcp
@@ -437,7 +447,7 @@
 	if [ -z "$iw_anqp_3gpp_cell_net_conf" ]; then
 		iw_anqp_3gpp_cell_net_conf="$1"
 	else
-		iw_anqp_3gpp_cell_net_conf="$iw_anqp_3gpp_cell_net_conf:$1"
+		iw_anqp_3gpp_cell_net_conf="$iw_anqp_3gpp_cell_net_conf;$1"
 	fi
 }
 
@@ -571,7 +581,7 @@
 		multi_ap multi_ap_backhaul_ssid multi_ap_backhaul_key skip_inactivity_poll \
 		ppsk airtime_bss_weight airtime_bss_limit airtime_sta_weight \
 		multicast_to_unicast_all proxy_arp per_sta_vif \
-		eap_server eap_user_file ca_cert server_cert private_key private_key_passwd server_id \
+		eap_server eap_user_file ca_cert server_cert private_key private_key_passwd server_id radius_server_clients radius_server_auth_port \
 		vendor_elements fils ocv apup
 
 	set_default fils 0
@@ -1151,6 +1161,8 @@
 		[ -n "$private_key" ] && append bss_conf "private_key=$private_key" "$N"
 		[ -n "$private_key_passwd" ] && append bss_conf "private_key_passwd=$private_key_passwd" "$N"
 		[ -n "$server_id" ] && append bss_conf "server_id=$server_id" "$N"
+		[ -n "$radius_server_clients" ] && append bss_conf "radius_server_clients=$radius_server_clients" "$N"
+		[ -n "$radius_server_auth_port" ] && append bss_conf "radius_server_auth_port=$radius_server_auth_port" "$N"
 	fi
 
 	set_default multicast_to_unicast_all 0
diff --git a/recipes-wifi/hostapd/files/src-2.10.3/src/ap/ubus.c b/recipes-wifi/hostapd/files/src-2.10.3/src/ap/ubus.c
index 8689494..2256720 100644
--- a/recipes-wifi/hostapd/files/src-2.10.3/src/ap/ubus.c
+++ b/recipes-wifi/hostapd/files/src-2.10.3/src/ap/ubus.c
@@ -1783,6 +1783,7 @@
 
 	blob_buf_init(&b, 0);
 	blobmsg_add_macaddr(&b, "address", addr);
+	blobmsg_add_string(&b, "ifname", hapd->conf->iface);
 	if (req->mgmt_frame)
 		blobmsg_add_macaddr(&b, "target", req->mgmt_frame->da);
 	if (req->ssi_signal)
@@ -1857,6 +1858,7 @@
 
 	blob_buf_init(&b, 0);
 	blobmsg_add_macaddr(&b, "address", addr);
+	blobmsg_add_string(&b, "ifname", hapd->conf->iface);
 
 	ubus_notify(ctx, &hapd->ubus.obj, type, b.head, -1);
 }
@@ -1869,6 +1871,9 @@
 
 	blob_buf_init(&b, 0);
 	blobmsg_add_macaddr(&b, "address", sta->addr);
+	if (sta->vlan_id)
+		blobmsg_add_u32(&b, "vlan", sta->vlan_id);
+	blobmsg_add_string(&b, "ifname", hapd->conf->iface);
 	if (auth_alg)
 		blobmsg_add_string(&b, "auth-alg", auth_alg);
 
@@ -2004,3 +2009,31 @@
 	return ureq.resp;
 #endif
 }
+
+#ifdef CONFIG_APUP
+void hostapd_ubus_notify_apup_newpeer(
+	struct hostapd_data *hapd, const u8 *addr, const char *ifname)
+{
+	if (!hapd->ubus.obj.has_subscribers)
+		return;
+
+	blob_buf_init(&b, 0);
+	blobmsg_add_macaddr(&b, "address", addr);
+	blobmsg_add_string(&b, "ifname", ifname);
+
+	ubus_notify(ctx, &hapd->ubus.obj, "apup-newpeer", b.head, -1);
+}
+#endif // def CONFIG_APUP
+
+void hostapd_ubus_notify_csa(struct hostapd_data *hapd, int freq)
+{
+	if (!hapd->ubus.obj.has_subscribers)
+		return;
+
+	blob_buf_init(&b, 0);
+	blobmsg_add_string(&b, "ifname", hapd->conf->iface);
+	blobmsg_add_u32(&b, "freq", freq);
+	blobmsg_printf(&b, "bssid", MACSTR, MAC2STR(hapd->conf->bssid));
+
+	ubus_notify(ctx, &hapd->ubus.obj, "channel-switch", b.head, -1);
+}
diff --git a/recipes-wifi/hostapd/files/src-2.10.3/src/ap/ubus.h b/recipes-wifi/hostapd/files/src-2.10.3/src/ap/ubus.h
index 22767d6..055a18c 100644
--- a/recipes-wifi/hostapd/files/src-2.10.3/src/ap/ubus.h
+++ b/recipes-wifi/hostapd/files/src-2.10.3/src/ap/ubus.h
@@ -8,8 +8,6 @@
 #ifndef __HOSTAPD_UBUS_H
 #define __HOSTAPD_UBUS_H
 
-#include "sta_info.h"
-
 enum hostapd_ubus_event_type {
 	HOSTAPD_UBUS_PROBE_REQ,
 	HOSTAPD_UBUS_AUTH_REQ,
@@ -70,6 +68,12 @@
 	const u8 *candidate_list, u16 candidate_list_len);
 void hostapd_ubus_notify_authorized(struct hostapd_data *hapd, struct sta_info *sta,
 				    const char *auth_alg);
+void hostapd_ubus_notify_csa(struct hostapd_data *hapd, int freq);
+
+#ifdef CONFIG_APUP
+void hostapd_ubus_notify_apup_newpeer(
+	struct hostapd_data *hapd, const u8 *addr, const char *ifname);
+#endif // def CONFIG_APUP
 
 #else
 
@@ -152,6 +156,11 @@
 {
 }
 
+static inline void
+hostapd_ubus_notify_csa(struct hostapd_data *hapd, int freq)
+{
+}
+
 #endif
 
 #endif
diff --git a/recipes-wifi/hostapd/files/src-2.10.3/src/ap/ucode.c b/recipes-wifi/hostapd/files/src-2.10.3/src/ap/ucode.c
index 68fb450..a5630d7 100644
--- a/recipes-wifi/hostapd/files/src-2.10.3/src/ap/ucode.c
+++ b/recipes-wifi/hostapd/files/src-2.10.3/src/ap/ucode.c
@@ -3,7 +3,7 @@
 #include "utils/includes.h"
 #include "utils/common.h"
 #include "utils/ucode.h"
-#include "hostapd.h"
+#include "sta_info.h"
 #include "beacon.h"
 #include "hw_features.h"
 #include "ap_drv_ops.h"
@@ -259,6 +259,7 @@
 
 	hostapd_setup_bss(hapd, hapd == iface->bss[0], true);
 	hostapd_ucode_update_interfaces();
+	hostapd_owe_update_trans(iface);
 
 done:
 	ret = 0;
@@ -379,6 +380,7 @@
 	conf->bss[idx] = NULL;
 	ret = hostapd_ucode_bss_get_uval(hapd);
 	hostapd_ucode_update_interfaces();
+	hostapd_owe_update_trans(iface);
 	goto out;
 
 deinit_ctrl:
@@ -531,10 +533,12 @@
 		return NULL;
 
 #define UPDATE_VAL(field, name)							\
-	if ((intval = ucv_int64_get(ucv_object_get(info, name, NULL))) &&	\
-		!errno && intval != conf->field) do {				\
-		conf->field = intval;						\
-		changed = true;							\
+	do {									\
+		intval = ucv_int64_get(ucv_object_get(info, name, NULL));	\
+		if (!errno && intval != conf->field) {				\
+			conf->field = intval;					\
+			changed = true;						\
+		}								\
 	} while(0)
 
 	conf = iface->conf;
@@ -607,6 +611,7 @@
 
 		ieee802_11_set_beacon(hapd);
 	}
+	hostapd_owe_update_trans(iface);
 
 	return ucv_boolean_new(true);
 }
@@ -698,6 +703,7 @@
 	hostapd_ubus_add_bss(hapd);
 
 	hostapd_ucode_update_interfaces();
+	hostapd_owe_update_trans(hapd->iface);
 out:
 	if (interfaces->ctrl_iface_init)
 		interfaces->ctrl_iface_init(hapd);
@@ -770,48 +776,52 @@
 	wpa_ucode_registry_remove(iface_registry, iface->ucode.idx);
 }
 
-void hostapd_ucode_add_bss(struct hostapd_data *hapd)
+void hostapd_ucode_bss_cb(struct hostapd_data *hapd, const char *type)
 {
 	uc_value_t *val;
 
-	if (wpa_ucode_call_prepare("bss_add"))
+	if (wpa_ucode_call_prepare(type))
 		return;
 
 	val = hostapd_ucode_bss_get_uval(hapd);
+	uc_value_push(ucv_get(ucv_string_new(hapd->iface->phy)));
 	uc_value_push(ucv_get(ucv_string_new(hapd->conf->iface)));
 	uc_value_push(ucv_get(val));
-	ucv_put(wpa_ucode_call(2));
+	ucv_put(wpa_ucode_call(3));
 	ucv_gc(vm);
 }
 
-void hostapd_ucode_reload_bss(struct hostapd_data *hapd)
+void hostapd_ucode_free_bss(struct hostapd_data *hapd)
 {
 	uc_value_t *val;
 
-	if (wpa_ucode_call_prepare("bss_reload"))
+	val = wpa_ucode_registry_remove(bss_registry, hapd->ucode.idx);
+	if (!val)
 		return;
 
-	val = hostapd_ucode_bss_get_uval(hapd);
-	uc_value_push(ucv_get(ucv_string_new(hapd->conf->iface)));
+	hapd->ucode.idx = 0;
+	if (wpa_ucode_call_prepare("bss_remove"))
+		return;
+
+	uc_value_push(ucv_string_new(hapd->conf->iface));
 	uc_value_push(ucv_get(val));
 	ucv_put(wpa_ucode_call(2));
 	ucv_gc(vm);
 }
 
-void hostapd_ucode_free_bss(struct hostapd_data *hapd)
+#ifdef CONFIG_APUP
+void hostapd_ucode_apup_newpeer(struct hostapd_data *hapd, const char *ifname)
 {
 	uc_value_t *val;
 
-	val = wpa_ucode_registry_remove(bss_registry, hapd->ucode.idx);
-	if (!val)
-		return;
-
-	hapd->ucode.idx = 0;
-	if (wpa_ucode_call_prepare("bss_remove"))
+	if (wpa_ucode_call_prepare("apup_newpeer"))
 		return;
 
-	uc_value_push(ucv_string_new(hapd->conf->iface));
+	val = hostapd_ucode_bss_get_uval(hapd);
+	uc_value_push(ucv_get(ucv_string_new(hapd->conf->iface))); // BSS ifname
 	uc_value_push(ucv_get(val));
+	uc_value_push(ucv_get(ucv_string_new(ifname))); // APuP peer ifname
 	ucv_put(wpa_ucode_call(2));
 	ucv_gc(vm);
 }
+#endif // def CONFIG_APUP
diff --git a/recipes-wifi/hostapd/files/src-2.10.3/src/ap/ucode.h b/recipes-wifi/hostapd/files/src-2.10.3/src/ap/ucode.h
index d00b787..2f7bcd6 100644
--- a/recipes-wifi/hostapd/files/src-2.10.3/src/ap/ucode.h
+++ b/recipes-wifi/hostapd/files/src-2.10.3/src/ap/ucode.h
@@ -23,9 +23,12 @@
 
 void hostapd_ucode_free(void);
 void hostapd_ucode_free_iface(struct hostapd_iface *iface);
-void hostapd_ucode_add_bss(struct hostapd_data *hapd);
 void hostapd_ucode_free_bss(struct hostapd_data *hapd);
-void hostapd_ucode_reload_bss(struct hostapd_data *hapd);
+void hostapd_ucode_bss_cb(struct hostapd_data *hapd, const char *type);
+
+#ifdef CONFIG_APUP
+void hostapd_ucode_apup_newpeer(struct hostapd_data *hapd, const char *ifname);
+#endif // def CONFIG_APUP
 
 #else
 
@@ -39,10 +42,7 @@
 static inline void hostapd_ucode_free_iface(struct hostapd_iface *iface)
 {
 }
-static inline void hostapd_ucode_reload_bss(struct hostapd_data *hapd)
-{
-}
-static inline void hostapd_ucode_add_bss(struct hostapd_data *hapd)
+static inline void hostapd_ucode_bss_cb(struct hostapd_data *hapd, const char *type)
 {
 }
 static inline void hostapd_ucode_free_bss(struct hostapd_data *hapd)
@@ -51,4 +51,19 @@
 
 #endif
 
+static inline void hostapd_ucode_create_bss(struct hostapd_data *hapd)
+{
+	hostapd_ucode_bss_cb(hapd, "bss_create");
+}
+
+static inline void hostapd_ucode_add_bss(struct hostapd_data *hapd)
+{
+	hostapd_ucode_bss_cb(hapd, "bss_add");
+}
+
+static inline void hostapd_ucode_reload_bss(struct hostapd_data *hapd)
+{
+	hostapd_ucode_bss_cb(hapd, "bss_reload");
+}
+
 #endif
diff --git a/recipes-wifi/hostapd/files/src-2.10.3/src/utils/build_features.h b/recipes-wifi/hostapd/files/src-2.10.3/src/utils/build_features.h
index 553769e..cc88315 100644
--- a/recipes-wifi/hostapd/files/src-2.10.3/src/utils/build_features.h
+++ b/recipes-wifi/hostapd/files/src-2.10.3/src/utils/build_features.h
@@ -15,6 +15,10 @@
 	if (!strcmp(feat, "11ax"))
 		return 1;
 #endif
+#ifdef CONFIG_IEEE80211BE
+	if (!strcmp(feat, "11be"))
+		return 1;
+#endif
 #ifdef CONFIG_IEEE80211R
 	if (!strcmp(feat, "11r"))
 		return 1;
diff --git a/recipes-wifi/hostapd/files/wifi-detect.uc b/recipes-wifi/hostapd/files/wifi-detect.uc
index bbaae18..8fef4f6 100644
--- a/recipes-wifi/hostapd/files/wifi-detect.uc
+++ b/recipes-wifi/hostapd/files/wifi-detect.uc
@@ -79,6 +79,9 @@
 		return;
 
 	for (let phy in phys) {
+		if (!phy)
+			continue;
+
 		let name = phy.wiphy_name;
 		let path = phy_path(name);
 		let info = {
@@ -110,6 +113,7 @@
 			if (band.vht_capa > 0)
 				band_info.vht = true;
 			let he_phy_cap = 0;
+			let eht_phy_cap = 0;
 
 			for (let ift in band.iftype_data) {
 				if (!ift.he_cap_phy)
@@ -117,9 +121,15 @@
 
 				band_info.he = true;
 				he_phy_cap |= ift.he_cap_phy[0];
+
+				/* if (!ift.eht_cap_phy) */
+				/*	continue; */
+
 				/* TODO: EHT */
 				/* FIXME: hardcode */
 				band_info.eht = true;
+				eht_phy_cap = 2;
+				/* eht_phy_cap |= ift.eht_cap_phy[0]; */
 			}
 
 			if (band_name == "6G" && band_info.eht)
@@ -149,12 +159,11 @@
 				if (band_info.vht)
 					push(modes, "VHT40")
 			}
-			if (he_phy_cap & 0x2) {
+			if (he_phy_cap & 2)
 				push(modes, "HE40");
 
-				if (band_info.eht)
-					push(modes, "EHT40");
-			}
+			if (eht_phy_cap && he_phy_cap & 2)
+				push(modes, "EHT40");
 
 			for (let freq in band.freqs) {
 				if (freq.disabled)
@@ -168,21 +177,25 @@
 
 			if (band_name == "2G")
 				continue;
+
+			if (he_phy_cap & 4)
+				push(modes, "HE40");
+			if (eht_phy_cap && he_phy_cap & 4)
+				push(modes, "EHT40");
 			if (band_info.vht)
 				push(modes, "VHT80");
-			if (he_phy_cap & 4) {
+			if (he_phy_cap & 4)
 				push(modes, "HE80");
-				if (band_info.eht)
-					push(modes, "EHT80");
-			}
+			if (eht_phy_cap && he_phy_cap & 4)
+				push(modes, "EHT80");
 			if ((band.vht_capa >> 2) & 0x3)
 				push(modes, "VHT160");
-			if (he_phy_cap & 0x18) {
+			if (he_phy_cap & 0x18)
 				push(modes, "HE160");
-				if (band_info.eht)
-					push(modes, "EHT160");
-			}
-			if (band_name == "6G" && band_info.eht)
+			if (eht_phy_cap && he_phy_cap & 0x18)
+				push(modes, "EHT160");
+
+			if (eht_phy_cap & 2)
 				push(modes, "EHT320");
 		}
 
diff --git a/recipes-wifi/hostapd/files/wpa_supplicant.uc b/recipes-wifi/hostapd/files/wpa_supplicant.uc
index 2ccb21c..c70b0b3 100644
--- a/recipes-wifi/hostapd/files/wpa_supplicant.uc
+++ b/recipes-wifi/hostapd/files/wpa_supplicant.uc
@@ -68,7 +68,7 @@
 	return { config: config };
 }
 
-function set_config(phy_name, config_list)
+function set_config(phy_name, num_global_macaddr, config_list)
 {
 	let phy = wpas.data.config[phy_name];
 
@@ -77,6 +77,8 @@
 		wpas.data.config[phy_name] = phy;
 	}
 
+	phy.num_global_macaddr = num_global_macaddr;
+
 	let values = [];
 	for (let config in config_list)
 		push(values, [ config.iface, prepare_config(config) ]);
@@ -99,7 +101,7 @@
 	}
 
 	let macaddr_list = wpas.data.macaddr_list[phy_name];
-	phydev.macaddr_init(macaddr_list);
+	phydev.macaddr_init(macaddr_list, { num_global: phy.num_global_macaddr });
 
 	for (let ifname in phy.data)
 		iface_start(phydev, phy.data[ifname]);
@@ -185,6 +187,7 @@
 	config_set: {
 		args: {
 			phy: "",
+			num_global_macaddr: 0,
 			config: [],
 			defer: true,
 		},
@@ -195,7 +198,7 @@
 			wpas.printf(`Set new config for phy ${req.args.phy}`);
 			try {
 				if (req.args.config)
-					set_config(req.args.phy, req.args.config);
+					set_config(req.args.phy, req.args.num_global_macaddr, req.args.config);
 
 				if (!req.args.defer)
 					start_pending(req.args.phy);
@@ -281,6 +284,7 @@
 		msg.ch_width = status.ch_width;
 		msg.bw320_offset = status.bw320_offset;
 		msg.band_idx = status.band_idx;
+		msg.punct_bitmap = status.punct_bitmap;
 		break;
 	default:
 		return;
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch
index e4da7ad..288c032 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch
@@ -1,7 +1,7 @@
-From bb24b3476e4f4eef8a283159d62af7d9736dbcf5 Mon Sep 17 00:00:00 2001
+From 943c075154f8b6569f9c0fc2ecc39742ba652bce Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 19 Sep 2023 11:21:23 +0800
-Subject: [PATCH 001/199] mtk: Revert "wifi: mt76: mt7996: fill txd by host
+Subject: [PATCH 001/223] mtk: Revert "wifi: mt76: mt7996: fill txd by host
  driver"
 
 This reverts commit 325a0c4931990d553487024c4f76c776492bdcc2.
@@ -10,10 +10,10 @@
  1 file changed, 9 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index bc7111a7..3afdd7eb 100644
+index 4706ddef..29297c07 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -938,8 +938,11 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -958,8 +958,11 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  		return id;
  
  	pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb);
@@ -27,7 +27,7 @@
  
  	txp = (struct mt76_connac_txp_common *)(txwi + MT_TXD_SIZE);
  	for (i = 0; i < nbuf; i++) {
-@@ -956,8 +959,10 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -976,8 +979,10 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	}
  	txp->fw.nbuf = nbuf;
  
@@ -41,5 +41,5 @@
  	if (!key)
  		txp->fw.flags |= cpu_to_le16(MT_CT_INFO_NONE_CIPHER_FRAME);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0011-mtk-mt76-mt7996-fix-amsdu-information.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0002-mtk-mt76-mt7996-fix-amsdu-information.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0011-mtk-mt76-mt7996-fix-amsdu-information.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0002-mtk-mt76-mt7996-fix-amsdu-information.patch
index 0afd075..238dab3 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0011-mtk-mt76-mt7996-fix-amsdu-information.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0002-mtk-mt76-mt7996-fix-amsdu-information.patch
@@ -1,13 +1,14 @@
-From aff4c26706fa1403abca8067cd0073db88c9f6cf Mon Sep 17 00:00:00 2001
+From afaacba412a34baf39e58b27003d4d09516a15c2 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 17 May 2024 15:28:06 +0800
-Subject: [PATCH 011/199] mtk: mt76: mt7996: fix amsdu information
+Subject: [PATCH 002/223] mtk: mt76: mt7996: fix amsdu information
 
 The amsdu information is common information for all bands so maintain
 it by main phy instead of calculating by each phy.
 Without this patch, the statistics of tx_amsdu_cnt and tx_amsdu would
 be incorrect.
 
+Change-Id: Iac324d9dd63ceb3a55b51c0210e3e547e20a71cb
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt76.h           |  3 ++-
@@ -16,10 +17,10 @@
  3 files changed, 11 insertions(+), 20 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 5c9d6c64..45039377 100644
+index 19c4f11c..063c45d2 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -916,6 +916,7 @@ struct mt76_dev {
+@@ -931,6 +931,7 @@ struct mt76_dev {
  	};
  };
  
@@ -27,7 +28,7 @@
  /* per-phy stats.  */
  struct mt76_mib_stats {
  	u32 ack_fail_cnt;
-@@ -975,7 +976,7 @@ struct mt76_mib_stats {
+@@ -990,7 +991,7 @@ struct mt76_mib_stats {
  	u32 rx_vec_queue_overflow_drop_cnt;
  	u32 rx_ba_cnt;
  
@@ -68,10 +69,10 @@
  
  	return 0;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 109a74a9..503e92c0 100644
+index 29297c07..cfcfc3ea 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2103,10 +2103,19 @@ void mt7996_mac_update_stats(struct mt7996_phy *phy)
+@@ -2114,10 +2114,19 @@ void mt7996_mac_update_stats(struct mt7996_phy *phy)
  {
  	struct mt76_mib_stats *mib = &phy->mib;
  	struct mt7996_dev *dev = phy->dev;
@@ -91,7 +92,7 @@
  	cnt = mt76_rr(dev, MT_MIB_RSCR1(band_idx));
  	mib->fcs_err_cnt += cnt;
  
-@@ -2212,12 +2221,6 @@ void mt7996_mac_update_stats(struct mt7996_phy *phy)
+@@ -2223,12 +2232,6 @@ void mt7996_mac_update_stats(struct mt7996_phy *phy)
  	cnt = mt76_rr(dev, MT_MIB_BSCR17(band_idx));
  	mib->tx_bf_fb_cpl_cnt += cnt;
  
@@ -105,5 +106,5 @@
  	cnt = mt76_rr(dev, MT_MIB_BTSCR5(band_idx));
  	mib->rts_cnt += cnt;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0002-mtk-mt76-mt7996-use-hweight16-to-get-correct-tx_ant.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0002-mtk-mt76-mt7996-use-hweight16-to-get-correct-tx_ant.patch
deleted file mode 100644
index af32ef5..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0002-mtk-mt76-mt7996-use-hweight16-to-get-correct-tx_ant.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 30225c66317a43f8e881300f2e431d8b6bf54985 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Wed, 10 Apr 2024 14:05:12 +0800
-Subject: [PATCH 002/199] mtk: mt76: mt7996: use hweight16 to get correct
- tx_ant
-
-The chainmask is u16 so using hweight8 cannot get correct tx_ant.
-
-Without this patch, the tx_ant of band 2 would be -1 and lead to
-the following issue:
-BUG: KASAN: stack-out-of-bounds in mt7996_mcu_add_sta+0x12e0/0x16e0 [mt7996e]
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7996/mcu.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 3590e43f..73c3cc2d 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -1653,7 +1653,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- {
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_phy *phy = mvif->phy;
--	int tx_ant = hweight8(phy->mt76->chainmask) - 1;
-+	int tx_ant = hweight16(phy->mt76->chainmask) - 1;
- 	struct sta_rec_bf *bf;
- 	struct tlv *tlv;
- 	static const u8 matrix[4][4] = {
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0014-mtk-mt76-mt7996-add-preamble-puncture-support-for-mt.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0003-mtk-mt76-mt7996-add-preamble-puncture-support-for-mt.patch
similarity index 84%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0014-mtk-mt76-mt7996-add-preamble-puncture-support-for-mt.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0003-mtk-mt76-mt7996-add-preamble-puncture-support-for-mt.patch
index 26f0118..d87a708 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0014-mtk-mt76-mt7996-add-preamble-puncture-support-for-mt.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0003-mtk-mt76-mt7996-add-preamble-puncture-support-for-mt.patch
@@ -1,7 +1,7 @@
-From 2ee799d7d81869c1eb1d3a332bd223670c2523e5 Mon Sep 17 00:00:00 2001
+From d03a551a2fc9723b1b26c254bdc64694f271068f Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Thu, 18 Apr 2024 11:16:24 +0800
-Subject: [PATCH 014/199] mtk: mt76: mt7996: add preamble puncture support for
+Subject: [PATCH 003/223] mtk: mt76: mt7996: add preamble puncture support for
  mt7996
 
 Add support configure preamble puncture feature through mcu commands.
@@ -19,10 +19,10 @@
  6 files changed, 61 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 4242d436..a7cb33d2 100644
+index 1b0e80df..200eace5 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1283,6 +1283,7 @@ enum {
+@@ -1288,6 +1288,7 @@ enum {
  	MCU_UNI_CMD_CHANNEL_SWITCH = 0x34,
  	MCU_UNI_CMD_THERMAL = 0x35,
  	MCU_UNI_CMD_VOW = 0x37,
@@ -31,7 +31,7 @@
  	MCU_UNI_CMD_RRO = 0x57,
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 5e969732..a47b578c 100644
+index f6a010b6..f3744be6 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -389,6 +389,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -40,13 +40,13 @@
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER);
 +	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_PUNCT);
  
- 	if (!mdev->dev->of_node ||
- 	    !of_property_read_bool(mdev->dev->of_node,
+ 	if (mt7996_has_background_radar(phy->dev) &&
+ 	    (!mdev->dev->of_node ||
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 2b094b33..8d2b0ee7 100644
+index 343e6c4b..334cc8c5 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -415,6 +415,11 @@ static int mt7996_config(struct ieee80211_hw *hw, u32 changed)
+@@ -394,6 +394,11 @@ static int mt7996_config(struct ieee80211_hw *hw, u32 changed)
  	int ret;
  
  	if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
@@ -55,14 +55,14 @@
 +		if (ret)
 +			return ret;
 +
- 		ieee80211_stop_queues(hw);
- 		ret = mt7996_set_channel(phy);
+ 		ret = mt76_update_channel(phy->mt76);
  		if (ret)
+ 			return ret;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 3816b5a5..e01457de 100644
+index 5ac35af1..40915d1d 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4553,3 +4553,43 @@ int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode)
+@@ -4573,3 +4573,43 @@ int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode)
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(CP_SUPPORT),
  				 &cp_mode, sizeof(cp_mode), true);
  }
@@ -128,10 +128,10 @@
  #define MT7996_PATCH_SCRAMBLE_KEY	GENMASK(15, 8)
  #define MT7996_PATCH_AES_KEY		GENMASK(7, 0)
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 177cfff3..58fa6b45 100644
+index ad10329d..17dfbdc8 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -237,6 +237,9 @@ struct mt7996_phy {
+@@ -270,6 +270,9 @@ struct mt7996_phy {
  	struct mt76_channel_state state_ts;
  
  	bool has_aux_rx;
@@ -141,7 +141,7 @@
  };
  
  struct mt7996_dev {
-@@ -614,6 +617,7 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
+@@ -665,6 +668,7 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
  				     struct ieee80211_vif *vif,
  				     struct ieee80211_sta *sta);
  int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode);
@@ -150,5 +150,5 @@
  void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0003-mtk-mt76-mt7996-fix-MBSS.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0003-mtk-mt76-mt7996-fix-MBSS.patch
deleted file mode 100644
index 6042e11..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0003-mtk-mt76-mt7996-fix-MBSS.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From d62e705d71d755dd420564e09f1686f908fd9c98 Mon Sep 17 00:00:00 2001
-From: Rex Lu <rex.lu@mediatek.com>
-Date: Thu, 18 Apr 2024 14:19:21 +0800
-Subject: [PATCH 003/199] mtk: mt76: mt7996: fix MBSS
-
-Refactor 11v mbss unicmd flow
-case1(disable->enable) : when we enable 11v MBSS, we have to add 11v mbss tlv(UNI_BSS_INFO_11V_MBSSID)
-case2(enable->disable) : when we diable 11v MBSS, we should clear 11v mbss tlv (UNI_BSS_INFO_11V_MBSSID-> all value to zero) first,
-otherwise it will cause PSE opration ERR and trigger L1SER. After clear 11v mbss tlv,we have to reset UNI_BSS_INFO_BASIC(from 11v MBSS mode to legacy mode)
-
-Signed-off-by: Rex Lu <rex.lu@mediatek.com>
----
- mt7996/mcu.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 73c3cc2d..6d5bbe5b 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -822,7 +822,7 @@ mt7996_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
- 	struct bss_info_uni_mbssid *mbssid;
- 	struct tlv *tlv;
- 
--	if (!vif->bss_conf.bssid_indicator)
-+	if (!vif->bss_conf.bssid_indicator && enable)
- 		return;
- 
- 	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_11V_MBSSID, sizeof(*mbssid));
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0015-mtk-mt76-mt7996-add-driver-support-for-wpa3-ocv-and-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0004-mtk-mt76-mt7996-add-driver-support-for-wpa3-ocv-and-.patch
similarity index 70%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0015-mtk-mt76-mt7996-add-driver-support-for-wpa3-ocv-and-.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0004-mtk-mt76-mt7996-add-driver-support-for-wpa3-ocv-and-.patch
index 5bebed3..75bae50 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0015-mtk-mt76-mt7996-add-driver-support-for-wpa3-ocv-and-.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0004-mtk-mt76-mt7996-add-driver-support-for-wpa3-ocv-and-.patch
@@ -1,7 +1,7 @@
-From 1dc23dac31d10114a55409bd7e29fb1710b6b3ff Mon Sep 17 00:00:00 2001
+From 7952f4e661b7aff18120e0ad39a28e0a73e7ea31 Mon Sep 17 00:00:00 2001
 From: mtk23510 <rudra.shahi@mediatek.com>
 Date: Fri, 24 Mar 2023 19:18:53 +0800
-Subject: [PATCH 015/199] mtk: mt76: mt7996: add driver support for wpa3 ocv
+Subject: [PATCH 004/223] mtk: mt76: mt7996: add driver support for wpa3 ocv
  and bp mt76
 
 Signed-off-by: mtk23510 <rudra.shahi@mediatek.com>
@@ -10,7 +10,7 @@
  1 file changed, 2 insertions(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index a47b578c..2d7f42f7 100644
+index f3744be6..9bf38083 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -391,6 +391,8 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -19,9 +19,9 @@
  
 +	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION);
 +	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_PROTECTION);
- 	if (!mdev->dev->of_node ||
- 	    !of_property_read_bool(mdev->dev->of_node,
- 				   "mediatek,disable-radar-background"))
+ 	if (mt7996_has_background_radar(phy->dev) &&
+ 	    (!mdev->dev->of_node ||
+ 	     !of_property_read_bool(mdev->dev->of_node,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0004-mtk-mt76-mt7996-fix-HE-and-EHT-phy-cap.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0004-mtk-mt76-mt7996-fix-HE-and-EHT-phy-cap.patch
deleted file mode 100644
index e29be50..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0004-mtk-mt76-mt7996-fix-HE-and-EHT-phy-cap.patch
+++ /dev/null
@@ -1,138 +0,0 @@
-From 184f146afaddb73c3fd0afc60338f5ed73d5b450 Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Tue, 12 Mar 2024 09:07:52 +0800
-Subject: [PATCH 004/199] mtk: mt76: mt7996: fix HE and EHT phy cap
-
----
- mt7996/init.c | 65 ++++++++++++++++++++++++++++++++++-----------------
- 1 file changed, 43 insertions(+), 22 deletions(-)
-
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 283df84f..a98dcb40 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -1011,8 +1011,6 @@ mt7996_set_stream_he_txbf_caps(struct mt7996_phy *phy,
- 		return;
- 
- 	elem->phy_cap_info[3] |= IEEE80211_HE_PHY_CAP3_SU_BEAMFORMER;
--	if (vif == NL80211_IFTYPE_AP)
--		elem->phy_cap_info[4] |= IEEE80211_HE_PHY_CAP4_MU_BEAMFORMER;
- 
- 	c = FIELD_PREP(IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
- 		       sts - 1) |
-@@ -1020,6 +1018,11 @@ mt7996_set_stream_he_txbf_caps(struct mt7996_phy *phy,
- 		       sts - 1);
- 	elem->phy_cap_info[5] |= c;
- 
-+	if (vif != NL80211_IFTYPE_AP)
-+		return;
-+
-+	elem->phy_cap_info[4] |= IEEE80211_HE_PHY_CAP4_MU_BEAMFORMER;
-+
- 	c = IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |
- 	    IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB;
- 	elem->phy_cap_info[6] |= c;
-@@ -1179,7 +1182,6 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
- 		IEEE80211_EHT_MAC_CAP0_OM_CONTROL;
- 
- 	eht_cap_elem->phy_cap_info[0] =
--		IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ |
- 		IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
- 		IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
- 		IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE;
-@@ -1193,30 +1195,36 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
- 		u8_encode_bits(u8_get_bits(val, GENMASK(2, 1)),
- 			       IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK) |
- 		u8_encode_bits(val,
--			       IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK) |
--		u8_encode_bits(val,
--			       IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK);
-+			       IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK);
- 
- 	eht_cap_elem->phy_cap_info[2] =
- 		u8_encode_bits(sts - 1, IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK) |
--		u8_encode_bits(sts - 1, IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK) |
--		u8_encode_bits(sts - 1, IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK);
-+		u8_encode_bits(sts - 1, IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK);
-+
-+	if (band == NL80211_BAND_6GHZ) {
-+		eht_cap_elem->phy_cap_info[0] |=
-+			IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ;
-+
-+		eht_cap_elem->phy_cap_info[1] |=
-+			u8_encode_bits(val,
-+				       IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK);
-+
-+		eht_cap_elem->phy_cap_info[2] |=
-+			u8_encode_bits(sts - 1,
-+				       IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK);
-+	}
- 
- 	eht_cap_elem->phy_cap_info[3] =
- 		IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
- 		IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
- 		IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
--		IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
--		IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
--		IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
--		IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK;
-+		IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK;
- 
- 	eht_cap_elem->phy_cap_info[4] =
- 		u8_encode_bits(min_t(int, sts - 1, 2),
- 			       IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK);
- 
- 	eht_cap_elem->phy_cap_info[5] =
--		IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
- 		u8_encode_bits(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US,
- 			       IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK) |
- 		u8_encode_bits(u8_get_bits(0x11, GENMASK(1, 0)),
-@@ -1230,14 +1238,6 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
- 			       IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK) |
- 		u8_encode_bits(val, IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK);
- 
--	eht_cap_elem->phy_cap_info[7] =
--		IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
--		IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
--		IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ |
--		IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
--		IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ |
--		IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ;
--
- 	val = u8_encode_bits(nss, IEEE80211_EHT_MCS_NSS_RX) |
- 	      u8_encode_bits(nss, IEEE80211_EHT_MCS_NSS_TX);
- #define SET_EHT_MAX_NSS(_bw, _val) do {				\
-@@ -1248,8 +1248,29 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
- 
- 	SET_EHT_MAX_NSS(80, val);
- 	SET_EHT_MAX_NSS(160, val);
--	SET_EHT_MAX_NSS(320, val);
-+	if (band == NL80211_BAND_6GHZ)
-+		SET_EHT_MAX_NSS(320, val);
- #undef SET_EHT_MAX_NSS
-+
-+	if (iftype != NL80211_IFTYPE_AP)
-+		return;
-+
-+	eht_cap_elem->phy_cap_info[3] |=
-+		IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
-+		IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK;
-+
-+	eht_cap_elem->phy_cap_info[7] =
-+		IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
-+		IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
-+		IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
-+		IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ;
-+
-+	if (band != NL80211_BAND_6GHZ)
-+		return;
-+
-+	eht_cap_elem->phy_cap_info[7] |=
-+		IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ |
-+		IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ;
- }
- 
- static void
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0005-mtk-mt76-mt7996-adjust-Beamformee-SS-capability.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0005-mtk-mt76-mt7996-adjust-Beamformee-SS-capability.patch
deleted file mode 100644
index 9d4cf83..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0005-mtk-mt76-mt7996-adjust-Beamformee-SS-capability.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 070859af14a0c57a521e9efc5d4ae275666679d9 Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Tue, 27 Feb 2024 14:50:20 +0800
-Subject: [PATCH 005/199] mtk: mt76: mt7996: adjust Beamformee SS capability
-
-This commit includes two changes to adjust beamformee ss capability.
-First, configure the beamformee ss capability for mt7992 chipsets.
-Second, no matter how many antenna numbers is set, always set the
-maximum capability of Beamformee SS that chipsets support.
-
-Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
----
- mt7996/init.c | 23 +++++++++++++++++------
- 1 file changed, 17 insertions(+), 6 deletions(-)
-
-diff --git a/mt7996/init.c b/mt7996/init.c
-index a98dcb40..7d8d1e7b 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -941,8 +941,12 @@ void mt7996_set_stream_vht_txbf_caps(struct mt7996_phy *phy)
- 	cap = &phy->mt76->sband_5g.sband.vht_cap.cap;
- 
- 	*cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
--		IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE |
--		FIELD_PREP(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK, sts - 1);
-+		IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
-+
-+	if (is_mt7996(phy->mt76->dev))
-+		*cap |= FIELD_PREP(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK, 3);
-+	else
-+		*cap |= FIELD_PREP(IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK, 4);
- 
- 	*cap &= ~(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK |
- 		  IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
-@@ -987,9 +991,15 @@ mt7996_set_stream_he_txbf_caps(struct mt7996_phy *phy,
- 	    IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO;
- 	elem->phy_cap_info[2] |= c;
- 
--	c = IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE |
--	    IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_4 |
--	    IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_4;
-+	c = IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE;
-+
-+	if (is_mt7996(phy->mt76->dev))
-+		c |= IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_4 |
-+		     IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_4;
-+	else
-+		c |= IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_5 |
-+		     IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_5;
-+
- 	elem->phy_cap_info[4] |= c;
- 
- 	/* do not support NG16 due to spec D4.0 changes subcarrier idx */
-@@ -1186,7 +1196,8 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
- 		IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
- 		IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE;
- 
--	val = max_t(u8, sts - 1, 3);
-+	/* Set the maximum capability regardless of the antenna configuration. */
-+	val = is_mt7992(phy->mt76->dev) ? 4 : 3;
- 	eht_cap_elem->phy_cap_info[0] |=
- 		u8_encode_bits(u8_get_bits(val, BIT(0)),
- 			       IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK);
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0016-mtk-mt76-mt7996-enable-ser-query.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0005-mtk-mt76-mt7996-enable-ser-query.patch
similarity index 71%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0016-mtk-mt76-mt7996-enable-ser-query.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0005-mtk-mt76-mt7996-enable-ser-query.patch
index 26d632b..39445e5 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0016-mtk-mt76-mt7996-enable-ser-query.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0005-mtk-mt76-mt7996-enable-ser-query.patch
@@ -1,7 +1,7 @@
-From 60bf48a22df088e5d26f0433b6f28621d73f7240 Mon Sep 17 00:00:00 2001
+From c82a6b8993fa1785998459d79e9ba213e41fc4f7 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 30 Oct 2023 20:19:41 +0800
-Subject: [PATCH 016/199] mtk: mt76: mt7996: enable ser query
+Subject: [PATCH 005/223] mtk: mt76: mt7996: enable ser query
 
 Do not return -EINVAL when action is UNI_CMD_SER_QUERY for user
 to dump SER information from FW.
@@ -12,10 +12,10 @@
  1 file changed, 2 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index e01457de..0c300b81 100644
+index 40915d1d..a384d44a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3868,6 +3868,8 @@ int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 val, u8 band)
+@@ -3888,6 +3888,8 @@ int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 val, u8 band)
  	};
  
  	switch (action) {
@@ -25,5 +25,5 @@
  		req.set.mask = cpu_to_le32(val);
  		break;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0018-mtk-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0006-mtk-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
similarity index 73%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0018-mtk-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0006-mtk-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
index 19d0b38..5e522ef 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0018-mtk-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0006-mtk-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
@@ -1,21 +1,22 @@
-From 805f8428e1f5d7fc4d466d66c9104588df0c65c5 Mon Sep 17 00:00:00 2001
+From 9fbf0e20ece646083ad41f9a59aef3e1f295d00d Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Fri, 17 Nov 2023 11:01:04 +0800
-Subject: [PATCH 018/199] mtk: mt76: mt7996: Fix TGax HE-4.51.1_24G fail
+Subject: [PATCH 006/223] mtk: mt76: mt7996: Fix TGax HE-4.51.1_24G fail
 
 According to sta capability to decide to enable/disable wed pao when create ppe entry.
 without this patch, TGax HE-4.51.1_24G will test fail
 
+Change-Id: Ic51473fcc24757887f0f9f81a31b6f01dee2c845
 Signed-off-by: mtk27745 <rex.lu@mediatek.com>
 ---
  mt7996/main.c | 7 ++++++-
  1 file changed, 6 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 40281c5b..cbe8b009 100644
+index 334cc8c5..f8c07b34 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -1467,7 +1467,12 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1444,7 +1444,12 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->mtk_wdma.queue = 0;
  	path->mtk_wdma.wcid = msta->wcid.idx;
  
@@ -30,5 +31,5 @@
  
  	return 0;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0006-mtk-mt76-mt7996-add-support-for-IEEE-802.11-fragment.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0006-mtk-mt76-mt7996-add-support-for-IEEE-802.11-fragment.patch
deleted file mode 100644
index d9f38b2..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0006-mtk-mt76-mt7996-add-support-for-IEEE-802.11-fragment.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From f875fc2725a26aee415ffde4ba0822f69403bdf2 Mon Sep 17 00:00:00 2001
-From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
-Date: Fri, 12 Jul 2024 16:05:50 +0800
-Subject: [PATCH 006/199] mtk: mt76: mt7996: add support for IEEE 802.11
- fragmentation
-
-Add fragment index into TXD.DW2 to support IEEE 802.11 fragmentation.
-
-Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
----
- mt76_connac3_mac.h |  7 +++++++
- mt7996/mac.c       | 13 +++++++++++--
- 2 files changed, 18 insertions(+), 2 deletions(-)
-
-diff --git a/mt76_connac3_mac.h b/mt76_connac3_mac.h
-index 353e6606..3fc94bd7 100644
---- a/mt76_connac3_mac.h
-+++ b/mt76_connac3_mac.h
-@@ -197,6 +197,13 @@ enum tx_mgnt_type {
- 	MT_TX_ADDBA,
- };
- 
-+enum tx_frag_idx {
-+	MT_TX_FRAG_NONE,
-+	MT_TX_FRAG_FIRST,
-+	MT_TX_FRAG_MID,
-+	MT_TX_FRAG_LAST
-+};
-+
- #define MT_CT_INFO_APPLY_TXD		BIT(0)
- #define MT_CT_INFO_COPY_HOST_TXD_ALL	BIT(1)
- #define MT_CT_INFO_MGMT_FRAME		BIT(2)
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 3afdd7eb..b3f9591f 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -746,7 +746,7 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 	bool multicast = is_multicast_ether_addr(hdr->addr1);
- 	u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
--	__le16 fc = hdr->frame_control;
-+	__le16 fc = hdr->frame_control, sc = hdr->seq_ctrl;
- 	u8 fc_type, fc_stype;
- 	u32 val;
- 
-@@ -780,6 +780,15 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
- 	val = FIELD_PREP(MT_TXD2_FRAME_TYPE, fc_type) |
- 	      FIELD_PREP(MT_TXD2_SUB_TYPE, fc_stype);
- 
-+	if (ieee80211_has_morefrags(fc) && ieee80211_is_first_frag(sc))
-+		val |= FIELD_PREP(MT_TXD2_FRAG, MT_TX_FRAG_FIRST);
-+	else if (ieee80211_has_morefrags(fc) && !ieee80211_is_first_frag(sc))
-+		val |= FIELD_PREP(MT_TXD2_FRAG, MT_TX_FRAG_MID);
-+	else if (!ieee80211_has_morefrags(fc) && !ieee80211_is_first_frag(sc))
-+		val |= FIELD_PREP(MT_TXD2_FRAG, MT_TX_FRAG_LAST);
-+	else
-+		val |= FIELD_PREP(MT_TXD2_FRAG, MT_TX_FRAG_NONE);
-+
- 	txwi[2] |= cpu_to_le32(val);
- 
- 	txwi[3] |= cpu_to_le32(FIELD_PREP(MT_TXD3_BCM, multicast));
-@@ -789,7 +798,7 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
- 	}
- 
- 	if (info->flags & IEEE80211_TX_CTL_INJECTED) {
--		u16 seqno = le16_to_cpu(hdr->seq_ctrl);
-+		u16 seqno = le16_to_cpu(sc);
- 
- 		if (ieee80211_is_back_req(hdr->frame_control)) {
- 			struct ieee80211_bar *bar;
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0007-mtk-mt76-mt7996-add-support-for-different-variants.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0007-mtk-mt76-mt7996-add-support-for-different-variants.patch
new file mode 100644
index 0000000..b38735e
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0007-mtk-mt76-mt7996-add-support-for-different-variants.patch
@@ -0,0 +1,216 @@
+From f63be84654b80990d87723a8e6292b92952633aa Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 20 Jul 2023 17:27:22 +0800
+Subject: [PATCH 007/223] mtk: mt76: mt7996: add support for different variants
+
+Add fem type (2i5i, 2i5e, 2e5e, ...)
+Add Kite default bin for each fem type since loading wrong default bin
+will fail to setup interface
+Add eeprom fem type check
+
+Add adie 7976c efuse check
+Efuse offset 0x470 will be set to 0xc after final test if 7976c adie is used
+Chip manufactoring factories may transfer, which leads to different adie chip versions,
+so we add this efuse check to avoid 7976c recognition failure.
+
+GPIO ADie Combination of BE5040 should be considered as don't care
+instead of 0
+
+Only check eeprom chip id when fem type (= MT7996_FEM_UNSET) is not determined yet
+Without this fix, mt7996_check_eeprom will return EINVAL in mt7996_eeprom_check_fw_mode
+
+Align the naming rule of the default eeprom bin
+efem: XX_DEFAULT
+ifem: XX_DEFAULT_INT
+mixed fem: XX_DEFAULT_MIX
+
+Change-Id: I98caec6675670e3d1c0ee953bef2aeb71c3cf74e
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7996/eeprom.c | 29 ++++++++++++++++++++++++++++-
+ mt7996/eeprom.h |  1 +
+ mt7996/init.c   |  2 +-
+ mt7996/mcu.c    |  3 +++
+ mt7996/mt7996.h | 16 ++++++++++++++++
+ 5 files changed, 49 insertions(+), 2 deletions(-)
+
+diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
+index da94751d..77dd6b20 100644
+--- a/mt7996/eeprom.c
++++ b/mt7996/eeprom.c
+@@ -9,14 +9,33 @@
+ 
+ static int mt7996_check_eeprom(struct mt7996_dev *dev)
+ {
++#define FEM_INT				0
++#define FEM_EXT				3
+ 	u8 *eeprom = dev->mt76.eeprom.data;
++	u8 i, fem[__MT_MAX_BAND], fem_type;
+ 	u16 val = get_unaligned_le16(eeprom);
+ 
++	for (i = 0; i < __MT_MAX_BAND; i++)
++		fem[i] = eeprom[MT_EE_WIFI_CONF + 6 + i] & MT_EE_WIFI_PA_LNA_CONFIG;
++
+ 	switch (val) {
+ 	case 0x7990:
+ 		return is_mt7996(&dev->mt76) ? 0 : -EINVAL;
+ 	case 0x7992:
+-		return is_mt7992(&dev->mt76) ? 0 : -EINVAL;
++		if (dev->fem_type == MT7996_FEM_UNSET)
++			return is_mt7992(&dev->mt76) ? 0 : -EINVAL;
++
++		if (fem[0] == FEM_EXT && fem[1] == FEM_EXT)
++			fem_type = MT7996_FEM_EXT;
++		else if (fem[0] == FEM_INT && fem[1] == FEM_INT)
++			fem_type = MT7996_FEM_INT;
++		else if (fem[0] == FEM_INT && fem[1] == FEM_EXT)
++			fem_type = MT7996_FEM_MIX;
++		else
++			return -EINVAL;
++
++		return (is_mt7992(&dev->mt76) ? 0 : -EINVAL) |
++		       (dev->fem_type == fem_type ? 0 : -EINVAL);
+ 	default:
+ 		return -EINVAL;
+ 	}
+@@ -31,6 +50,8 @@ static char *mt7996_eeprom_name(struct mt7996_dev *dev)
+ 			if (dev->var.fem == MT7996_FEM_INT)
+ 				return MT7992_EEPROM_DEFAULT_23_INT;
+ 			return MT7992_EEPROM_DEFAULT_23;
++		case MT7992_VAR_TYPE_24:
++			return MT7992_EEPROM_DEFAULT_24;
+ 		case MT7992_VAR_TYPE_44:
+ 		default:
+ 			if (dev->var.fem == MT7996_FEM_INT)
+@@ -46,6 +67,8 @@ static char *mt7996_eeprom_name(struct mt7996_dev *dev)
+ 			if (dev->var.fem == MT7996_FEM_INT)
+ 				return MT7996_EEPROM_DEFAULT_233_INT;
+ 			return MT7996_EEPROM_DEFAULT_233;
++		case MT7996_VAR_TYPE_404:
++			return MT7996_EEPROM_DEFAULT_404;
+ 		case MT7996_VAR_TYPE_444:
+ 		default:
+ 			if (dev->var.fem == MT7996_FEM_INT)
+@@ -317,6 +340,10 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
+ {
+ 	int ret;
+ 
++	ret = mt7996_get_chip_sku(dev);
++	if (ret)
++		return ret;
++
+ 	ret = mt7996_eeprom_load(dev);
+ 	if (ret < 0)
+ 		return ret;
+diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
+index 7a771ca2..8074a0ae 100644
+--- a/mt7996/eeprom.h
++++ b/mt7996/eeprom.h
+@@ -29,6 +29,7 @@ enum mt7996_eeprom_field {
+ #define MT_EE_WIFI_CONF0_BAND_SEL		GENMASK(2, 0)
+ #define MT_EE_WIFI_CONF1_BAND_SEL		GENMASK(5, 3)
+ #define MT_EE_WIFI_CONF2_BAND_SEL		GENMASK(2, 0)
++#define MT_EE_WIFI_PA_LNA_CONFIG		GENMASK(1, 0)
+ 
+ #define MT_EE_WIFI_CONF1_TX_PATH_BAND0		GENMASK(5, 3)
+ #define MT_EE_WIFI_CONF2_TX_PATH_BAND1		GENMASK(2, 0)
+diff --git a/mt7996/init.c b/mt7996/init.c
+index 9bf38083..3a6f4f28 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -906,7 +906,7 @@ static int mt7996_variant_type_init(struct mt7996_dev *dev)
+ 		else if (u32_get_bits(val, MT_PAD_GPIO_ADIE_COMB_7992))
+ 			var_type = MT7992_VAR_TYPE_44;
+ 		else
+-			return -EINVAL;
++			var_type = MT7992_VAR_TYPE_24;
+ 		break;
+ 	default:
+ 		return -EINVAL;
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index a384d44a..dd428570 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -18,6 +18,9 @@
+ 		case MT7992_VAR_TYPE_23:			\
+ 			_fw = MT7992_##name##_23;		\
+ 			break;					\
++		case MT7992_VAR_TYPE_24:			\
++			_fw = MT7992_##name##_24;		\
++			break;					\
+ 		default:					\
+ 			_fw = MT7992_##name;			\
+ 		}						\
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index 17dfbdc8..1dd618c2 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -49,16 +49,23 @@
+ #define MT7992_FIRMWARE_DSP_23		"mediatek/mt7996/mt7992_dsp_23.bin"
+ #define MT7992_ROM_PATCH_23		"mediatek/mt7996/mt7992_rom_patch_23.bin"
+ 
++#define MT7992_FIRMWARE_WA_24		"mediatek/mt7996/mt7992_wa_24.bin"
++#define MT7992_FIRMWARE_WM_24		"mediatek/mt7996/mt7992_wm_24.bin"
++#define MT7992_FIRMWARE_DSP_24		"mediatek/mt7996/mt7992_dsp_24.bin"
++#define MT7992_ROM_PATCH_24		"mediatek/mt7996/mt7992_rom_patch_24.bin"
++
+ #define MT7996_EEPROM_DEFAULT		"mediatek/mt7996/mt7996_eeprom.bin"
+ #define MT7996_EEPROM_DEFAULT_INT	"mediatek/mt7996/mt7996_eeprom_2i5i6i.bin"
+ #define MT7996_EEPROM_DEFAULT_233	"mediatek/mt7996/mt7996_eeprom_233.bin"
+ #define MT7996_EEPROM_DEFAULT_233_INT	"mediatek/mt7996/mt7996_eeprom_233_2i5i6i.bin"
++#define MT7996_EEPROM_DEFAULT_404	"mediatek/mt7996/mt7996_eeprom_dual_404.bin"
+ 
+ #define MT7992_EEPROM_DEFAULT		"mediatek/mt7996/mt7992_eeprom.bin"
+ #define MT7992_EEPROM_DEFAULT_INT	"mediatek/mt7996/mt7992_eeprom_2i5i.bin"
+ #define MT7992_EEPROM_DEFAULT_MIX	"mediatek/mt7996/mt7992_eeprom_2i5e.bin"
+ #define MT7992_EEPROM_DEFAULT_23	"mediatek/mt7996/mt7992_eeprom_23.bin"
+ #define MT7992_EEPROM_DEFAULT_23_INT	"mediatek/mt7996/mt7992_eeprom_23_2i5i.bin"
++#define MT7992_EEPROM_DEFAULT_24	"mediatek/mt7996/mt7992_eeprom_24_2i5i.bin"
+ 
+ #define MT7996_EEPROM_SIZE		7680
+ #define MT7996_EEPROM_BLOCK_SIZE	16
+@@ -117,11 +124,13 @@ enum mt7996_ram_type {
+ enum mt7996_var_type {
+ 	MT7996_VAR_TYPE_444,
+ 	MT7996_VAR_TYPE_233,
++	MT7996_VAR_TYPE_404,
+ };
+ 
+ enum mt7992_var_type {
+ 	MT7992_VAR_TYPE_44,
+ 	MT7992_VAR_TYPE_23,
++	MT7992_VAR_TYPE_24,
+ };
+ 
+ enum mt7996_fem_type {
+@@ -294,6 +303,9 @@ struct mt7996_dev {
+ 	struct cfg80211_chan_def rdd2_chandef;
+ 	struct mt7996_phy *rdd2_phy;
+ 
++	u8 chip_sku;
++	u8 fem_type;
++
+ 	u16 chainmask;
+ 	u8 chainshift[__MT_MAX_BAND];
+ 	u32 hif_idx;
+@@ -445,6 +457,9 @@ mt7996_band_valid(struct mt7996_dev *dev, u8 band)
+ 	if (is_mt7992(&dev->mt76))
+ 		return band <= MT_BAND1;
+ 
++	if (dev->var.type == MT7996_VAR_TYPE_404 && band == MT_BAND1)
++		return false;
++
+ 	return band <= MT_BAND2;
+ }
+ 
+@@ -492,6 +507,7 @@ int mt7996_init_tx_queues(struct mt7996_phy *phy, int idx,
+ 			  int n_desc, int ring_base, struct mtk_wed_device *wed);
+ void mt7996_init_txpower(struct mt7996_phy *phy);
+ int mt7996_txbf_init(struct mt7996_dev *dev);
++int mt7996_get_chip_sku(struct mt7996_dev *dev);
+ void mt7996_reset(struct mt7996_dev *dev);
+ int mt7996_run(struct ieee80211_hw *hw);
+ int mt7996_mcu_init(struct mt7996_dev *dev);
+-- 
+2.45.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0007-mtk-mt76-mt7996-set-rx-path-when-channel-switch.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0007-mtk-mt76-mt7996-set-rx-path-when-channel-switch.patch
deleted file mode 100644
index 3e1400f..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0007-mtk-mt76-mt7996-set-rx-path-when-channel-switch.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From a76084f12577a97b1b06db539a2e928845e5a9ff Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Fri, 26 Jul 2024 15:55:01 +0800
-Subject: [PATCH 007/199] mtk: mt76: mt7996: set rx path when channel switch
-
-When scanning, driver need to send this tag to fw to notify scanning is
-start or stop. FW would stop mac tx when scanning is started and resume
-mac tx when scanning is done. Without this tag, hw needs more time to
-resume traffic when scanning is done.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7996/main.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/mt7996/main.c b/mt7996/main.c
-index 7c97140d..15d880ef 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -307,6 +307,10 @@ int mt7996_set_channel(struct mt7996_phy *phy)
- 	if (ret)
- 		goto out;
- 
-+	ret = mt7996_mcu_set_chan_info(phy, UNI_CHANNEL_RX_PATH);
-+	if (ret)
-+		goto out;
-+
- 	ret = mt7996_dfs_init_radar_detector(phy);
- 	mt7996_mac_cca_stats_reset(phy);
- 
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0020-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0008-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch
similarity index 71%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0020-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0008-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch
index 81fecd3..5cb744f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0020-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0008-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch
@@ -1,7 +1,7 @@
-From 1879c122435092c63eb0e8156f6e75d8e147fa13 Mon Sep 17 00:00:00 2001
+From 49c81a4e339f9646fb32faa00935e88ea8c91ec5 Mon Sep 17 00:00:00 2001
 From: "fancy.liu" <fancy.liu@mediatek.com>
 Date: Tue, 14 Nov 2023 10:13:24 +0800
-Subject: [PATCH 020/199] mtk: mt76: mt7996: ACS channel time too long on duty
+Subject: [PATCH 008/223] mtk: mt76: mt7996: ACS channel time too long on duty
  channel
 
 Step and issue:
@@ -41,26 +41,26 @@
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 6d47b26d..9df9109f 100644
+index 303f4385..dc1ef40d 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -928,6 +928,7 @@ void mt76_set_channel(struct mt76_phy *phy)
- 	struct cfg80211_chan_def *chandef = &hw->conf.chandef;
- 	bool offchannel = hw->conf.flags & IEEE80211_CONF_OFFCHANNEL;
+@@ -927,6 +927,7 @@ int mt76_set_channel(struct mt76_phy *phy, struct cfg80211_chan_def *chandef,
+ 	struct mt76_dev *dev = phy->dev;
  	int timeout = HZ / 5;
-+	unsigned long was_scanning = ieee80211_get_scanning(hw);
+ 	int ret;
++	unsigned long was_scanning = ieee80211_get_scanning(phy->hw);
  
- 	wait_event_timeout(dev->tx_wait, !mt76_has_tx_pending(phy), timeout);
- 	mt76_update_survey(phy);
-@@ -942,7 +943,7 @@ void mt76_set_channel(struct mt76_phy *phy)
+ 	cancel_delayed_work_sync(&phy->mac_work);
+ 
+@@ -948,7 +949,7 @@ int mt76_set_channel(struct mt76_phy *phy, struct cfg80211_chan_def *chandef,
  	if (!offchannel)
  		phy->main_chan = chandef->chan;
  
 -	if (chandef->chan != phy->main_chan)
 +	if (chandef->chan != phy->main_chan || was_scanning)
  		memset(phy->chan_state, 0, sizeof(*phy->chan_state));
- }
- EXPORT_SYMBOL_GPL(mt76_set_channel);
+ 	mt76_worker_enable(&dev->tx_worker);
+ 
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0008-mtk-mt76-mt7996-set-station-s-wmm-index-to-3.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0008-mtk-mt76-mt7996-set-station-s-wmm-index-to-3.patch
deleted file mode 100644
index 81739b6..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0008-mtk-mt76-mt7996-set-station-s-wmm-index-to-3.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From ce5a75d5fb6414c0ccc0c461f0ff2bb09501275e Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Fri, 19 Jul 2024 11:50:21 +0800
-Subject: [PATCH 008/199] mtk: mt76: mt7996: set station's wmm index to 3
-
-According to HW design, the AP's WMM index is 0 and the station's wmm
-index is 3.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7996/main.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/mt7996/main.c b/mt7996/main.c
-index 15d880ef..2b094b33 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -206,7 +206,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
- 	mvif->mt76.omac_idx = idx;
- 	mvif->phy = phy;
- 	mvif->mt76.band_idx = band_idx;
--	mvif->mt76.wmm_idx = vif->type != NL80211_IFTYPE_AP;
-+	mvif->mt76.wmm_idx = vif->type == NL80211_IFTYPE_AP ? 0 : 3;
- 
- 	ret = mt7996_mcu_add_dev_info(phy, vif, true);
- 	if (ret)
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0021-mtk-mt76-mt7996-Fixed-null-pointer-dereference-issue.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0009-mtk-mt76-mt7996-Fixed-null-pointer-dereference-issue.patch
similarity index 75%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0021-mtk-mt76-mt7996-Fixed-null-pointer-dereference-issue.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0009-mtk-mt76-mt7996-Fixed-null-pointer-dereference-issue.patch
index 31a8dd2..cb70b1b 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0021-mtk-mt76-mt7996-Fixed-null-pointer-dereference-issue.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0009-mtk-mt76-mt7996-Fixed-null-pointer-dereference-issue.patch
@@ -1,7 +1,7 @@
-From 7384dd7ed2828f0681ce1d765007d3f1976e8760 Mon Sep 17 00:00:00 2001
+From 6f5c66458edeadf97bd3f6acf55a3a9318b86d83 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 26 Oct 2023 10:08:10 +0800
-Subject: [PATCH 021/199] mtk: mt76: mt7996: Fixed null pointer dereference
+Subject: [PATCH 009/223] mtk: mt76: mt7996: Fixed null pointer dereference
  issue
 
 ---
@@ -9,10 +9,10 @@
  1 file changed, 7 insertions(+)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index cbe8b009..72232994 100644
+index f8c07b34..f18c0a08 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -1083,9 +1083,16 @@ static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
+@@ -1060,9 +1060,16 @@ static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
  				 struct ieee80211_sta *sta,
  				 u32 changed)
  {
@@ -30,5 +30,5 @@
  	ieee80211_queue_work(hw, &dev->rc_work);
  }
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0009-mtk-mt76-mt7996-fix-rxd-checksum-offload-offset.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0009-mtk-mt76-mt7996-fix-rxd-checksum-offload-offset.patch
deleted file mode 100644
index c5c0717..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0009-mtk-mt76-mt7996-fix-rxd-checksum-offload-offset.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 1d799d5548538dcf501f7fb99b1f529ef001b4c8 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Fri, 26 Jul 2024 09:27:45 +0800
-Subject: [PATCH 009/199] mtk: mt76: mt7996: fix rxd checksum offload offset
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt76_connac3_mac.h | 4 ++--
- mt7996/mac.c       | 4 ++--
- 2 files changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/mt76_connac3_mac.h b/mt76_connac3_mac.h
-index 3fc94bd7..db0c29e6 100644
---- a/mt76_connac3_mac.h
-+++ b/mt76_connac3_mac.h
-@@ -28,8 +28,6 @@ enum {
- #define MT_RXD0_MESH			BIT(18)
- #define MT_RXD0_MHCP			BIT(19)
- #define MT_RXD0_NORMAL_ETH_TYPE_OFS	GENMASK(22, 16)
--#define MT_RXD0_NORMAL_IP_SUM		BIT(23)
--#define MT_RXD0_NORMAL_UDP_TCP_SUM	BIT(24)
- 
- #define MT_RXD0_SW_PKT_TYPE_MASK	GENMASK(31, 16)
- #define MT_RXD0_SW_PKT_TYPE_MAP		0x380F
-@@ -80,6 +78,8 @@ enum {
- #define MT_RXD3_NORMAL_BEACON_UC	BIT(21)
- #define MT_RXD3_NORMAL_CO_ANT		BIT(22)
- #define MT_RXD3_NORMAL_FCS_ERR		BIT(24)
-+#define MT_RXD3_NORMAL_IP_SUM		BIT(26)
-+#define MT_RXD3_NORMAL_UDP_TCP_SUM	BIT(27)
- #define MT_RXD3_NORMAL_VLAN2ETH		BIT(31)
- 
- /* RXD DW4 */
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index b3f9591f..109a74a9 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -435,7 +435,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
- 	u32 rxd2 = le32_to_cpu(rxd[2]);
- 	u32 rxd3 = le32_to_cpu(rxd[3]);
- 	u32 rxd4 = le32_to_cpu(rxd[4]);
--	u32 csum_mask = MT_RXD0_NORMAL_IP_SUM | MT_RXD0_NORMAL_UDP_TCP_SUM;
-+	u32 csum_mask = MT_RXD3_NORMAL_IP_SUM | MT_RXD3_NORMAL_UDP_TCP_SUM;
- 	u32 csum_status = *(u32 *)skb->cb;
- 	u32 mesh_mask = MT_RXD0_MESH | MT_RXD0_MHCP;
- 	bool is_mesh = (rxd0 & mesh_mask) == mesh_mask;
-@@ -497,7 +497,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
- 	if (!sband->channels)
- 		return -EINVAL;
- 
--	if ((rxd0 & csum_mask) == csum_mask &&
-+	if ((rxd3 & csum_mask) == csum_mask &&
- 	    !(csum_status & (BIT(0) | BIT(2) | BIT(3))))
- 		skb->ip_summed = CHECKSUM_UNNECESSARY;
- 
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0010-mtk-mt76-add-sanity-check-to-prevent-kernel-crash.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0010-mtk-mt76-add-sanity-check-to-prevent-kernel-crash.patch
new file mode 100644
index 0000000..46ba8c2
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0010-mtk-mt76-add-sanity-check-to-prevent-kernel-crash.patch
@@ -0,0 +1,39 @@
+From 8fb1feae687645a1c48070f2eebc44fcb7db080d Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Mon, 30 Oct 2023 11:06:19 +0800
+Subject: [PATCH 010/223] mtk: mt76: add sanity check to prevent kernel crash
+
+wcid may not be initialized when mac80211 calls mt76.tx and it would lead to
+kernel crash.
+
+Change-Id: I90004271c6e91620c6991195dd332780ce28380e
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ tx.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/tx.c b/tx.c
+index 7521e739..2634c5bc 100644
+--- a/tx.c
++++ b/tx.c
+@@ -352,8 +352,16 @@ mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
+ 	if ((info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) ||
+ 	    (info->control.flags & IEEE80211_TX_CTRL_SCAN_TX))
+ 		head = &wcid->tx_offchannel;
+-	else
++	else {
++		if (!wcid->tx_pending.prev || !wcid->tx_pending.next) {
++			dev_warn(phy->dev->dev, "Un-initialized STA %pM wcid %d in mt76_tx\n",
++				 sta->addr, wcid->idx);
++
++			ieee80211_free_txskb(phy->hw, skb);
++			return;
++		}
+ 		head = &wcid->tx_pending;
++	}
+ 
+ 	spin_lock_bh(&head->lock);
+ 	__skb_queue_tail(head, skb);
+-- 
+2.45.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0010-mtk-mt76-mt7996-fix-EHT-Beamforming-capability-check.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0010-mtk-mt76-mt7996-fix-EHT-Beamforming-capability-check.patch
deleted file mode 100644
index 95afaf1..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0010-mtk-mt76-mt7996-fix-EHT-Beamforming-capability-check.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 18583c512c569a45767cbdb3b93dcb688158bfe6 Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Fri, 28 Jun 2024 11:05:26 +0800
-Subject: [PATCH 010/199] mtk: mt76: mt7996: fix EHT Beamforming capability
- check
-
----
- mt7996/mcu.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 6d5bbe5b..39963a36 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -1429,10 +1429,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
- 
- 		if (bfee)
- 			return vif->bss_conf.eht_su_beamformee &&
--			       EHT_PHY(CAP0_SU_BEAMFORMEE, pe->phy_cap_info[0]);
-+			       EHT_PHY(CAP0_SU_BEAMFORMER, pe->phy_cap_info[0]);
- 		else
- 			return vif->bss_conf.eht_su_beamformer &&
--			       EHT_PHY(CAP0_SU_BEAMFORMER, pe->phy_cap_info[0]);
-+			       EHT_PHY(CAP0_SU_BEAMFORMEE, pe->phy_cap_info[0]);
- 	}
- 
- 	if (sta->deflink.he_cap.has_he) {
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0023-mtk-mt76-mt7996-add-firmware-WA-s-coredump.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0011-mtk-mt76-mt7996-add-firmware-WA-s-coredump.patch
similarity index 95%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0023-mtk-mt76-mt7996-add-firmware-WA-s-coredump.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0011-mtk-mt76-mt7996-add-firmware-WA-s-coredump.patch
index dfa716b..804e1c3 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0023-mtk-mt76-mt7996-add-firmware-WA-s-coredump.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0011-mtk-mt76-mt7996-add-firmware-WA-s-coredump.patch
@@ -1,8 +1,9 @@
-From 107e29828372478e61e6f01f96148ab89c164c82 Mon Sep 17 00:00:00 2001
+From 744e6ef280817a9010606e2d36573cc9206e8457 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Fri, 19 May 2023 14:16:50 +0800
-Subject: [PATCH 023/199] mtk: mt76: mt7996: add firmware WA's coredump.
+Subject: [PATCH 011/223] mtk: mt76: mt7996: add firmware WA's coredump.
 
+Change-Id: I51f115b4ae15bc0f871f93652570d72511dbf880
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
  mt7996/coredump.c | 180 ++++++++++++++++++++++++++++++----------------
@@ -428,10 +429,10 @@
  	return NULL;
  }
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 503e92c0..00396c82 100644
+index cfcfc3ea..dafc86f8 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2007,28 +2007,25 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2018,28 +2018,25 @@ void mt7996_mac_reset_work(struct work_struct *work)
  }
  
  /* firmware coredump */
@@ -464,7 +465,7 @@
  	if (!mem_region || !crash_data->memdump_buf_len) {
  		mutex_unlock(&dev->dump_mutex);
  		goto skip_memdump;
-@@ -2038,6 +2035,9 @@ void mt7996_mac_dump_work(struct work_struct *work)
+@@ -2049,6 +2046,9 @@ void mt7996_mac_dump_work(struct work_struct *work)
  	buf_len = crash_data->memdump_buf_len;
  
  	/* dumping memory content... */
@@ -474,7 +475,7 @@
  	memset(buf, 0, buf_len);
  	for (i = 0; i < num; i++) {
  		if (mem_region->len > buf_len) {
-@@ -2054,6 +2054,7 @@ void mt7996_mac_dump_work(struct work_struct *work)
+@@ -2065,6 +2065,7 @@ void mt7996_mac_dump_work(struct work_struct *work)
  		mt7996_memcpy_fromio(dev, buf, mem_region->start,
  				     mem_region->len);
  
@@ -482,7 +483,7 @@
  		hdr->start = mem_region->start;
  		hdr->len = mem_region->len;
  
-@@ -2070,8 +2071,20 @@ void mt7996_mac_dump_work(struct work_struct *work)
+@@ -2081,8 +2082,20 @@ void mt7996_mac_dump_work(struct work_struct *work)
  	mutex_unlock(&dev->dump_mutex);
  
  skip_memdump:
@@ -506,10 +507,10 @@
  }
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index ae01a4eb..da92b33e 100644
+index dd428570..46fb3a03 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2707,6 +2707,8 @@ static int mt7996_load_patch(struct mt7996_dev *dev)
+@@ -2719,6 +2719,8 @@ static int mt7996_load_patch(struct mt7996_dev *dev)
  
  	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
  		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
@@ -518,7 +519,7 @@
  
  	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
  		struct mt7996_patch_sec *sec;
-@@ -2833,6 +2835,9 @@ static int __mt7996_load_ram(struct mt7996_dev *dev, const char *fw_type,
+@@ -2845,6 +2847,9 @@ static int __mt7996_load_ram(struct mt7996_dev *dev, const char *fw_type,
  	}
  
  	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
@@ -529,10 +530,10 @@
  		 fw_type, hdr->fw_ver, hdr->build_date);
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 16cefeac..7c2e6894 100644
+index 1dd618c2..602f367d 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -84,6 +84,8 @@
+@@ -94,6 +94,8 @@
  #define MT7996_CRIT_TEMP		110
  #define MT7996_MAX_TEMP			120
  
@@ -541,15 +542,15 @@
  #define MT7996_RRO_MAX_SESSION		1024
  #define MT7996_RRO_WINDOW_MAX_LEN	1024
  #define MT7996_RRO_ADDR_ELEM_LEN	128
-@@ -127,6 +129,7 @@ enum mt7996_ram_type {
+@@ -119,6 +121,7 @@ enum mt7996_ram_type {
  	MT7996_RAM_TYPE_WM,
  	MT7996_RAM_TYPE_WA,
  	MT7996_RAM_TYPE_DSP,
 +	__MT7996_RAM_TYPE_MAX,
  };
  
- enum mt7996_txq_id {
-@@ -320,9 +323,11 @@ struct mt7996_dev {
+ enum mt7996_var_type {
+@@ -328,9 +331,11 @@ struct mt7996_dev {
  	struct mutex dump_mutex;
  #ifdef CONFIG_DEV_COREDUMP
  	struct {
@@ -563,7 +564,7 @@
  	struct list_head sta_rc_list;
  	struct list_head twt_list;
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index cf12c5e0..4c20a67d 100644
+index 06e307b5..3450a2fc 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -597,7 +597,8 @@ enum offs_rev {
@@ -576,7 +577,7 @@
  
  #define MT_SWDEF_BASE				0x00401400
  
-@@ -714,11 +715,15 @@ enum offs_rev {
+@@ -716,11 +717,15 @@ enum offs_rev {
  #define MT_WF_PHYRX_CSD_BAND_RXTD12_IRPI_SW_CLR		BIT(29)
  
  /* CONN MCU EXCP CON */
@@ -593,5 +594,5 @@
  
  /* CONN AFE CTL CON */
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0012-mtk-mt76-mt7996-add-beacon_int_min_gcd-to-support-di.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0012-mtk-mt76-mt7996-add-beacon_int_min_gcd-to-support-di.patch
deleted file mode 100644
index c8c218a..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0012-mtk-mt76-mt7996-add-beacon_int_min_gcd-to-support-di.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 0230f41ebd90270be685fc813d23a150afbfc823 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Fri, 19 Apr 2024 11:01:21 +0800
-Subject: [PATCH 012/199] mtk: mt76: mt7996: add beacon_int_min_gcd to support
- different beacon interval
-
-When beacon_int_min_gcd is zero, all beacon intervals for different
-interfaces should be same. If beacon_int_min_gcd is larger than zero,
-all beacon intervals for different interfaces should be larger or
-equal than beacon_int_min_gcd.
-
-Without this patch, set beacon fail when different interfaces use
-different beacon interval.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7996/init.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 7d8d1e7b..5e969732 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -42,6 +42,7 @@ static const struct ieee80211_iface_combination if_comb[] = {
- 				       BIT(NL80211_CHAN_WIDTH_40) |
- 				       BIT(NL80211_CHAN_WIDTH_80) |
- 				       BIT(NL80211_CHAN_WIDTH_160),
-+		.beacon_int_min_gcd = 100,
- 	}
- };
- 
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0024-mtk-mt76-mt7996-for-build-pass.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0012-mtk-mt76-mt7996-for-build-pass.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0024-mtk-mt76-mt7996-for-build-pass.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0012-mtk-mt76-mt7996-for-build-pass.patch
index b790e63..cee8d38 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0024-mtk-mt76-mt7996-for-build-pass.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0012-mtk-mt76-mt7996-for-build-pass.patch
@@ -1,8 +1,9 @@
-From 2b0fed32f1dcb4b51cc061816ece60647e497af8 Mon Sep 17 00:00:00 2001
+From 5ef8895f1b5e8684b4f81ce52bffa28e629d966b Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 3 Nov 2022 00:27:17 +0800
-Subject: [PATCH 024/199] mtk: mt76: mt7996: for build pass
+Subject: [PATCH 012/223] mtk: mt76: mt7996: for build pass
 
+Change-Id: Ieb44c33ee6e6a2e6058c1ef528404c1a1cbcfdaf
 ---
  debugfs.c         | 3 +++
  dma.c             | 2 +-
@@ -45,7 +46,7 @@
  			goto free_frag;
  
 diff --git a/mcu.c b/mcu.c
-index a8cafa39..fa4b0544 100644
+index 3353012e..2bcce21f 100644
 --- a/mcu.c
 +++ b/mcu.c
 @@ -4,6 +4,7 @@
@@ -57,7 +58,7 @@
  struct sk_buff *
  __mt76_mcu_msg_alloc(struct mt76_dev *dev, const void *data,
 diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index d50d9678..18176e78 100644
+index 4e350f27..c2090378 100644
 --- a/mt7615/mcu.c
 +++ b/mt7615/mcu.c
 @@ -10,6 +10,7 @@
@@ -69,7 +70,7 @@
  static bool prefer_offload_fw = true;
  module_param(prefer_offload_fw, bool, 0644);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 4dce03dd..a1deeacd 100644
+index 77f3e92d..07f52dd6 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -4,6 +4,7 @@
@@ -81,7 +82,7 @@
  int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
  {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 71236fe7..3c1a8fd4 100644
+index 72c8e574..b04a960b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -6,6 +6,7 @@
@@ -108,19 +109,19 @@
  
  	mt7996_dma_enable(dev, false);
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index f38629e3..bd02eb00 100644
+index 77dd6b20..21379ce0 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -138,6 +138,7 @@ static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_dev *dev)
+@@ -249,6 +249,7 @@ static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_phy *phy,
  	if (ret)
  		return ret;
  
 +	cap = 0x4b249248;	/* internal hardcode */
  	if (cap) {
- 		dev->has_eht = !(cap & MODE_HE_ONLY);
- 		dev->wtbl_size_group = u32_get_bits(cap, WTBL_SIZE_GROUP);
+ 		u8 band_offs = phy->mt76->band_idx * 3;
+ 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index da92b33e..88c42de7 100644
+index 46fb3a03..623d19f1 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -5,6 +5,7 @@
@@ -132,5 +133,5 @@
  #include "mcu.h"
  #include "mac.h"
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0013-mtk-mt76-adjust-beamform-mcu-cmd-configuration-for-m.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0013-mtk-mt76-adjust-beamform-mcu-cmd-configuration-for-m.patch
deleted file mode 100644
index 28511c6..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0013-mtk-mt76-adjust-beamform-mcu-cmd-configuration-for-m.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 46245bf2b1adb748f52772cb7550c85733aa6db7 Mon Sep 17 00:00:00 2001
-From: Howard Hsu <howard-yh.hsu@mediatek.com>
-Date: Mon, 18 Mar 2024 11:13:56 +0800
-Subject: [PATCH 013/199] mtk: mt76: adjust beamform mcu cmd configuration for
- mt7992
-
-Adjust the correct beamform mcu cmd configuration for mt7992 chipsets.
-
-Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
----
- mt7996/mcu.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 39963a36..3816b5a5 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -3923,8 +3923,9 @@ int mt7996_mcu_set_txbf(struct mt7996_dev *dev, u8 action)
- 
- 		tlv = mt7996_mcu_add_uni_tlv(skb, action, sizeof(*req_mod_en));
- 		req_mod_en = (struct bf_mod_en_ctrl *)tlv;
--		req_mod_en->bf_num = 3;
--		req_mod_en->bf_bitmap = GENMASK(2, 0);
-+		req_mod_en->bf_num = mt7996_band_valid(dev, MT_BAND2) ? 3 : 2;
-+		req_mod_en->bf_bitmap = mt7996_band_valid(dev, MT_BAND2) ?
-+					GENMASK(2, 0) : GENMASK(1, 0);
- 		break;
- 	}
- 	default:
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0025-mtk-mt76-mt7996-add-debug-tool.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0013-mtk-mt76-mt7996-add-debug-tool.patch
similarity index 99%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0025-mtk-mt76-mt7996-add-debug-tool.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0013-mtk-mt76-mt7996-add-debug-tool.patch
index 239b093..7288efd 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0025-mtk-mt76-mt7996-add-debug-tool.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0013-mtk-mt76-mt7996-add-debug-tool.patch
@@ -1,7 +1,7 @@
-From ecccabe4621048b66cb36ceba76497cde04a8ec1 Mon Sep 17 00:00:00 2001
+From 1e463d48da75799dd89a9ba28eb37e1e18c4a40b Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 24 Mar 2023 14:02:32 +0800
-Subject: [PATCH 025/199] mtk: mt76: mt7996: add debug tool
+Subject: [PATCH 013/223] mtk: mt76: mt7996: add debug tool
 
 Add PSM bit in sta_info
 
@@ -50,6 +50,11 @@
 The fw_wm_info is used to dump fw status when wm crash. When wm crash,
 we are not able to use any mcu command.
 
+Change-Id: Ie10390b01f17db893dbfbf3221bf63a4bd1fe38f
+Change-Id: I4483f9f506ecbdbb49c2ceb99ec76c32b930c67e
+Change-Id: I00c760b31009142848e32b1249d305800585e7fd
+Change-Id: Ifddd4db86982d39f2d39d198b8f5d3e7028983c2
+Change-Id: I591b558a9eec2fbd46d166c9bb1580a94e22072c
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -77,10 +82,10 @@
  create mode 100644 mt7996/mtk_mcu.h
 
 diff --git a/mt76.h b/mt76.h
-index 45039377..beba1d91 100644
+index 063c45d2..f50f2117 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -403,6 +403,8 @@ struct mt76_txwi_cache {
+@@ -409,6 +409,8 @@ struct mt76_txwi_cache {
  		struct sk_buff *skb;
  		void *ptr;
  	};
@@ -392,10 +397,10 @@
  	hdr.timestamp = cpu_to_le32(mt76_rr(dev, MT_LPON_FRCR(0)));
  	hdr.len = *(__le16 *)data;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 00396c82..52ea6796 100644
+index dafc86f8..d1d45c98 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -945,6 +945,9 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -956,6 +956,9 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	id = mt76_token_consume(mdev, &t);
  	if (id < 0)
  		return id;
@@ -406,10 +411,10 @@
  	pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb);
  	memset(txwi_ptr, 0, MT_TXD_SIZE);
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 7c2e6894..bb7536ff 100644
+index 602f367d..6c889427 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -362,6 +362,7 @@ struct mt7996_dev {
+@@ -370,6 +370,7 @@ struct mt7996_dev {
  	u8 fw_debug_wa;
  	u8 fw_debug_bin;
  	u16 fw_debug_seq;
@@ -417,10 +422,10 @@
  
  	struct dentry *debugfs_dir;
  	struct rchan *relay_fwlog;
-@@ -374,6 +375,17 @@ struct mt7996_dev {
- 	spinlock_t reg_lock;
- 
- 	u8 wtbl_size_group;
+@@ -386,6 +387,17 @@ struct mt7996_dev {
+ 		u8 type:4;
+ 		u8 fem:4;
+ 	} var;
 +
 +#ifdef CONFIG_MTK_DEBUG
 +	u16 wlan_idx;
@@ -435,7 +440,7 @@
  };
  
  enum {
-@@ -670,6 +682,7 @@ u32 mt7996_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -700,6 +712,7 @@ u32 mt7996_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  
  #ifdef CONFIG_MTK_DEBUG
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir);
@@ -2737,7 +2742,7 @@
 +#endif
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
 new file mode 100644
-index 00000000..64952a73
+index 00000000..d1f3d16c
 --- /dev/null
 +++ b/mt7996/mtk_debugfs.c
 @@ -0,0 +1,2506 @@
@@ -3089,7 +3094,7 @@
 +		[MT7996_FEM_MIX] = "mixed FEM",
 +	};
 +
-+	seq_printf(s, "Version: 4.3.24.7\n");
++	seq_printf(s, "Version: 4.3.24.8\n");
 +
 +	if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 +		return 0;
@@ -5420,5 +5425,5 @@
  	return ret;
  }
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0026-mtk-mt76-mt7996-add-check-for-hostapd-config-he_ldpc.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0014-mtk-mt76-mt7996-add-check-for-hostapd-config-he_ldpc.patch
similarity index 77%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0026-mtk-mt76-mt7996-add-check-for-hostapd-config-he_ldpc.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0014-mtk-mt76-mt7996-add-check-for-hostapd-config-he_ldpc.patch
index 27625e6..d381689 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0026-mtk-mt76-mt7996-add-check-for-hostapd-config-he_ldpc.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0014-mtk-mt76-mt7996-add-check-for-hostapd-config-he_ldpc.patch
@@ -1,7 +1,7 @@
-From 57e5d3d3887af43a399f747f96e7a185bc726229 Mon Sep 17 00:00:00 2001
+From ef0c8f78bad493731f96c1c6c3659f106a99040a Mon Sep 17 00:00:00 2001
 From: "Allen.Ye" <allen.ye@mediatek.com>
 Date: Thu, 8 Jun 2023 17:32:33 +0800
-Subject: [PATCH 026/199] mtk: mt76: mt7996: add check for hostapd config
+Subject: [PATCH 014/223] mtk: mt76: mt7996: add check for hostapd config
  he_ldpc
 
 Add check for hostapd config he_ldpc.
@@ -9,16 +9,18 @@
 
 Add check for STA LDPC cap, if STA only have BCC we should not overwrite the phy_cap with config he_ldpc.
 
+Change-Id: Ibe7e40ec1dbb40bd3f3d96741e9933ec00b50df0
+Change-Id: I6d6f59df8897e3c00f2e0a1e3c6e5701e31c5e4b
 Signed-off-by: Allen.Ye <allen.ye@mediatek.com>
 ---
  mt7996/mcu.c | 12 +++++++++---
  1 file changed, 9 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 88c42de7..4ff1af78 100644
+index 623d19f1..cefd4fad 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1188,7 +1188,8 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
+@@ -1198,7 +1198,8 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
  }
  
  static void
@@ -28,7 +30,7 @@
  {
  	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
  	struct ieee80211_he_mcs_nss_supp mcs_map;
-@@ -1208,6 +1209,11 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1218,6 +1219,11 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  		he->he_phy_cap[i] = elem->phy_cap_info[i];
  	}
  
@@ -40,7 +42,7 @@
  	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
  	switch (sta->deflink.bandwidth) {
  	case IEEE80211_STA_RX_BW_160:
-@@ -2113,7 +2119,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2123,7 +2129,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	 * update sta_rec_he here.
  	 */
  	if (changed)
@@ -49,7 +51,7 @@
  
  	/* sta_rec_ra accommodates BW, NSS and only MCS range format
  	 * i.e 0-{7,8,9} for VHT.
-@@ -2204,7 +2210,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2216,7 +2222,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  		/* starec amsdu */
  		mt7996_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
  		/* starec he */
@@ -59,5 +61,5 @@
  		mt7996_mcu_sta_he_6g_tlv(skb, sta);
  		/* starec eht */
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0027-mtk-mt76-mt7996-add-basic-testmode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0015-mtk-mt76-mt7996-add-basic-testmode-support.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0027-mtk-mt76-mt7996-add-basic-testmode-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0015-mtk-mt76-mt7996-add-basic-testmode-support.patch
index 3337917..aecd31a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0027-mtk-mt76-mt7996-add-basic-testmode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0015-mtk-mt76-mt7996-add-basic-testmode-support.patch
@@ -1,7 +1,7 @@
-From c051b319e725ca566a990b375c089bf74d53e021 Mon Sep 17 00:00:00 2001
+From 7f3e6ce10b137781002b339ab16c2bf078313c41 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Wed, 28 Dec 2022 22:24:25 +0800
-Subject: [PATCH 027/199] mtk: mt76: mt7996: add basic testmode support
+Date: Thu, 26 Sep 2024 14:54:11 +0800
+Subject: [PATCH 015/223] mtk: mt76: mt7996: add basic testmode support
 
 Add testmode eeprom buffer mode support
 
@@ -14,6 +14,8 @@
 
 edcca return err in testmode; therefore, bypass it when we are in testmode idle state or testmode bf is on
 
+Change-Id: I0e09e7f5bc0fb9aa4e4ec906a0f5f169bcc261cb
+Change-Id: I849b11b4ccdecd2b7b525b29801c02b5207bbf91
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  eeprom.c          |   6 +-
@@ -21,25 +23,25 @@
  mt76.h            |  36 +++
  mt76_connac_mcu.h |   2 +
  mt7996/Makefile   |   1 +
- mt7996/eeprom.c   |  37 ++-
+ mt7996/eeprom.c   |  86 +++++-
  mt7996/eeprom.h   |   1 +
  mt7996/init.c     |   8 +
  mt7996/mac.c      |   3 +-
- mt7996/main.c     |  27 ++
- mt7996/mcu.c      |  59 +++-
+ mt7996/main.c     |  35 +++
+ mt7996/mcu.c      |  53 +++-
  mt7996/mcu.h      |  33 +++
- mt7996/mt7996.h   |  27 +-
+ mt7996/mt7996.h   |  27 ++
  mt7996/testmode.c | 740 ++++++++++++++++++++++++++++++++++++++++++++++
  mt7996/testmode.h | 299 +++++++++++++++++++
  testmode.c        | 126 ++++++--
  testmode.h        |  87 +++++-
  tools/fields.c    | 102 ++++++-
- 18 files changed, 1547 insertions(+), 50 deletions(-)
+ 18 files changed, 1602 insertions(+), 46 deletions(-)
  create mode 100644 mt7996/testmode.c
  create mode 100644 mt7996/testmode.h
 
 diff --git a/eeprom.c b/eeprom.c
-index 0bc66cc1..a0047d79 100644
+index ab4fab11..6bd2cc1a 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -94,8 +94,10 @@ int mt76_get_of_data_from_mtd(struct mt76_dev *dev, void *eep, int offset, int l
@@ -56,7 +58,7 @@
  
  out_put_node:
 diff --git a/mac80211.c b/mac80211.c
-index 9df9109f..7e4ee83f 100644
+index dc1ef40d..5d9512d4 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -846,7 +846,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
@@ -70,10 +72,10 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index beba1d91..27635c49 100644
+index f50f2117..f6ffccac 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -704,14 +704,21 @@ struct mt76_testmode_ops {
+@@ -718,14 +718,21 @@ struct mt76_testmode_ops {
  	int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
@@ -95,7 +97,7 @@
  	u32 tx_count;
  	u16 tx_mpdu_len;
  
-@@ -721,6 +728,7 @@ struct mt76_testmode_data {
+@@ -735,6 +742,7 @@ struct mt76_testmode_data {
  	u8 tx_rate_sgi;
  	u8 tx_rate_ldpc;
  	u8 tx_rate_stbc;
@@ -103,7 +105,7 @@
  	u8 tx_ltf;
  
  	u8 tx_antenna_mask;
-@@ -730,6 +738,9 @@ struct mt76_testmode_data {
+@@ -744,6 +752,9 @@ struct mt76_testmode_data {
  	u32 tx_time;
  	u32 tx_ipg;
  
@@ -113,7 +115,7 @@
  	u32 freq_offset;
  
  	u8 tx_power[4];
-@@ -744,7 +755,16 @@ struct mt76_testmode_data {
+@@ -758,7 +769,16 @@ struct mt76_testmode_data {
  	struct {
  		u64 packets[__MT_RXQ_MAX];
  		u64 fcs_error[__MT_RXQ_MAX];
@@ -130,7 +132,7 @@
  };
  
  struct mt76_vif {
-@@ -1453,6 +1473,22 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
+@@ -1466,6 +1486,22 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
  int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
  int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len);
  
@@ -154,10 +156,10 @@
  {
  #ifdef CONFIG_NL80211_TESTMODE
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index a7cb33d2..57e0e9de 100644
+index 200eace5..873f59f7 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1279,12 +1279,14 @@ enum {
+@@ -1284,12 +1284,14 @@ enum {
  	MCU_UNI_CMD_EFUSE_CTRL = 0x2d,
  	MCU_UNI_CMD_RA = 0x2f,
  	MCU_UNI_CMD_MURU = 0x31,
@@ -184,7 +186,7 @@
  
  mt7996e-y += mtk_debugfs.o mtk_mcu.o
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index bd02eb00..e2790109 100644
+index 21379ce0..cb4fb702 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -6,6 +6,11 @@
@@ -207,63 +209,110 @@
 +		return MT7996_EEPROM_DEFAULT_TM;
 +
  	switch (mt76_chip(&dev->mt76)) {
- 	case 0x7990:
- 		if (dev->chip_sku == MT7996_SKU_404)
-@@ -92,21 +100,36 @@ out:
+ 	case 0x7992:
+ 		switch (dev->var.type) {
+@@ -171,6 +179,8 @@ mt7996_eeprom_check_or_use_default(struct mt7996_dev *dev, bool use_default)
+ 	dev_warn(dev->mt76.dev, "eeprom load fail, use default bin\n");
+ 	memcpy(eeprom, fw->data, MT7996_EEPROM_SIZE);
+ 	dev->flash_mode = true;
++	dev->eeprom_mode = DEFAULT_BIN_MODE;
++	eeprom[MT_EE_TESTMODE_EN] = dev->testmode_enable;
+ 
+ out:
+ 	release_firmware(fw);
+@@ -178,20 +188,84 @@ out:
  	return ret;
  }
  
 -static int mt7996_eeprom_load(struct mt7996_dev *dev)
-+int mt7996_eeprom_check_fw_mode(struct mt7996_dev *dev)
++static int
++mt7996_eeprom_load_bin(struct mt7996_dev *dev)
  {
-+	u8 *eeprom;
+-	bool use_default = false;
++	u8 *eeprom = dev->mt76.eeprom.data;
++	const struct firmware *fw = NULL;
  	int ret;
  
-+	/* load eeprom in flash or bin file mode to determine fw mode */
- 	ret = mt76_eeprom_init(&dev->mt76, MT7996_EEPROM_SIZE);
- 	if (ret < 0)
+-	ret = mt76_eeprom_init(&dev->mt76, MT7996_EEPROM_SIZE);
+-	if (ret < 0)
++	ret = request_firmware(&fw, dev->mt76.bin_file_name, dev->mt76.dev);
++	if (ret)
  		return ret;
  
- 	if (ret) {
- 		dev->flash_mode = true;
--	} else {
--		u8 free_block_num;
--		u32 block_num, i;
--		u32 eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;
-+		eeprom = dev->mt76.eeprom.data;
-+		/* testmode enable priority: eeprom field > module parameter */
-+		dev->testmode_enable = !mt7996_check_eeprom(dev) ? eeprom[MT_EE_TESTMODE_EN] :
-+								   testmode_enable;
+-	if (ret && !mt7996_check_eeprom(dev)) {
+-		dev->flash_mode = true;
++	if (!fw || !fw->data) {
++		dev_err(dev->mt76.dev, "Invalid bin %s\n", dev->mt76.bin_file_name);
++		ret = -EINVAL;
+ 		goto out;
+ 	}
+ 
++	memcpy(eeprom, fw->data, MT7996_EEPROM_SIZE);
++	dev->flash_mode = true;
++
++out:
++	release_firmware(fw);
++	return ret;
++}
++
++static int mt7996_eeprom_load_flash(struct mt7996_dev *dev)
++{
++	int ret = 1;
++
++	/* return > 0 for load success, return 0 for load failed, return < 0 for no memory */
++	dev->bin_file_mode = mt76_check_bin_file_mode(&dev->mt76);
++	if (dev->bin_file_mode) {
++		dev->mt76.eeprom.size = MT7996_EEPROM_SIZE;
++		dev->mt76.eeprom.data = devm_kzalloc(dev->mt76.dev, dev->mt76.eeprom.size,
++						     GFP_KERNEL);
++		if (!dev->mt76.eeprom.data)
++			return -ENOMEM;
++
++		if (mt7996_eeprom_load_bin(dev))
++			return 0;
++	} else {
++		ret = mt76_eeprom_init(&dev->mt76, MT7996_EEPROM_SIZE);
 +	}
 +
++	if (mt7996_check_eeprom(dev))
++		return 0;
++
++	return ret;
++}
++
++int mt7996_eeprom_check_fw_mode(struct mt7996_dev *dev)
++{
++	u8 *eeprom;
++	int ret;
++
++	dev->testmode_enable = testmode_enable;
++
++	/* load eeprom in flash or bin file mode to determine fw mode */
++	ret = mt7996_eeprom_load_flash(dev);
++	if (ret <= 0)
++		goto out;
++
++	dev->flash_mode = true;
++	dev->eeprom_mode = dev->bin_file_mode ? BIN_FILE_MODE : FLASH_MODE;
++	eeprom = dev->mt76.eeprom.data;
++	/* testmode enable priority: eeprom field > module parameter */
++	dev->testmode_enable = eeprom[MT_EE_TESTMODE_EN];
++
++out:
 +	return ret;
 +}
 +
 +static int mt7996_eeprom_load(struct mt7996_dev *dev)
 +{
++	bool use_default = false;
 +	int ret;
-+	u8 free_block_num;
-+	u32 block_num, i;
-+	u32 eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;
- 
++
 +	/* flash or bin file mode eeprom is loaded before mcu init */
-+	if (!dev->flash_mode) {
- 		ret = mt7996_mcu_get_eeprom_free_block(dev, &free_block_num);
- 		if (ret < 0)
- 			return ret;
-@@ -118,8 +141,8 @@ static int mt7996_eeprom_load(struct mt7996_dev *dev)
- 		/* read eeprom data from efuse */
- 		block_num = DIV_ROUND_UP(MT7996_EEPROM_SIZE, eeprom_blk_size);
- 		for (i = 0; i < block_num; i++) {
--			ret = mt7996_mcu_get_eeprom(dev, i * eeprom_blk_size);
--			if (ret < 0)
-+			ret = mt7996_mcu_get_eeprom(dev, i * eeprom_blk_size, NULL);
-+			if (ret && ret != -EINVAL)
- 				return ret;
- 		}
- 	}
+ 	if (!dev->flash_mode) {
+ 		u32 eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;
+ 		u32 block_num = DIV_ROUND_UP(MT7996_EEPROM_SIZE, eeprom_blk_size);
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 72c38ad3..de3ff4e2 100644
+index 8074a0ae..7f7a718f 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -14,6 +14,7 @@ enum mt7996_eeprom_field {
@@ -275,10 +324,10 @@
  	MT_EE_RATE_DELTA_2G =	0x1400,
  	MT_EE_RATE_DELTA_5G =	0x147d,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index f80fba28..ed7c7040 100644
+index 3a6f4f28..dc736a2d 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -971,6 +971,10 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
+@@ -983,6 +983,10 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
  
  	set_bit(MT76_STATE_INITIALIZED, &dev->mphy.state);
  
@@ -289,7 +338,7 @@
  	ret = mt7996_mcu_init(dev);
  	if (ret)
  		return ret;
-@@ -1420,6 +1424,10 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1436,6 +1440,10 @@ int mt7996_register_device(struct mt7996_dev *dev)
  
  	mt7996_init_wiphy(hw, &dev->mt76.mmio.wed);
  
@@ -301,21 +350,21 @@
  				   ARRAY_SIZE(mt76_rates));
  	if (ret)
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 52ea6796..a0fcd8aa 100644
+index d1d45c98..d73644f6 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -685,7 +685,8 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
+@@ -686,7 +686,8 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
  				     *info);
  	}
  
--	if (rxv && mode >= MT_PHY_TYPE_HE_SU && !(status->flag & RX_FLAG_8023))
-+	if (rxv && mode >= MT_PHY_TYPE_HE_SU && mode < MT_PHY_TYPE_EHT_SU &&
-+	    !(status->flag & RX_FLAG_8023))
- 		mt76_connac3_mac_decode_he_radiotap(skb, rxv, mode);
- 
- 	if (!status->wcid || !ieee80211_is_data_qos(fc) || hw_aggr)
+-	if (rxv && !(status->flag & RX_FLAG_8023)) {
++	if (rxv && !(status->flag & RX_FLAG_8023) &&
++	    (mode >= MT_PHY_TYPE_HE_SU && mode < MT_PHY_TYPE_EHT_SU)) {
+ 		switch (status->encoding) {
+ 		case RX_ENC_EHT:
+ 			mt76_connac3_mac_decode_eht_radiotap(skb, rxv, mode);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 72232994..be50f7f3 100644
+index f18c0a08..b7ae6e1a 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -23,6 +23,18 @@ static bool mt7996_dev_running(struct mt7996_dev *dev)
@@ -346,9 +395,31 @@
  	mt7996_mac_enable_nf(dev, phy->mt76->band_idx);
  
  	ret = mt7996_mcu_set_rts_thresh(phy, 0x92b);
-@@ -303,6 +317,11 @@ int mt7996_set_channel(struct mt7996_phy *phy)
+@@ -188,6 +202,10 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
  
- 	mt76_set_channel(phy->mt76);
+ 	mutex_lock(&dev->mt76.mutex);
+ 
++	if (vif->type == NL80211_IFTYPE_MONITOR &&
++	    is_zero_ether_addr(vif->addr))
++		phy->monitor_vif = vif;
++
+ 	mvif->mt76.idx = __ffs64(~dev->mt76.vif_mask);
+ 	if (mvif->mt76.idx >= mt7996_max_interface_num(dev)) {
+ 		ret = -ENOSPC;
+@@ -266,6 +284,10 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+ 
+ 	mt7996_mcu_add_sta(dev, vif, NULL, false, false);
+ 	mt7996_mcu_add_bss_info(phy, vif, false);
++
++	if (vif == phy->monitor_vif)
++		phy->monitor_vif = NULL;
++
+ 	mt7996_mcu_add_dev_info(phy, vif, false);
+ 
+ 	rcu_assign_pointer(dev->mt76.wcid[idx], NULL);
+@@ -288,6 +310,11 @@ int mt7996_set_channel(struct mt76_phy *mphy)
+ 	struct mt7996_phy *phy = mphy->priv;
+ 	int ret;
  
 +	if (mt76_testmode_enabled(phy->mt76) || phy->mt76->test.bf_en) {
 +		mt7996_tm_update_channel(phy);
@@ -358,7 +429,7 @@
  	ret = mt7996_mcu_set_chan_info(phy, UNI_CHANNEL_SWITCH);
  	if (ret)
  		goto out;
-@@ -415,6 +434,12 @@ static int mt7996_config(struct ieee80211_hw *hw, u32 changed)
+@@ -394,6 +421,12 @@ static int mt7996_config(struct ieee80211_hw *hw, u32 changed)
  	int ret;
  
  	if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
@@ -371,7 +442,7 @@
  		ret = mt7996_mcu_set_pp_en(phy, PP_USR_MODE,
  					   phy->mt76->chandef.punctured);
  		if (ret)
-@@ -1531,6 +1556,8 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -1508,6 +1541,8 @@ const struct ieee80211_ops mt7996_ops = {
  	.sta_set_decap_offload = mt7996_sta_set_decap_offload,
  	.add_twt_setup = mt7996_mac_add_twt_setup,
  	.twt_teardown_request = mt7996_twt_teardown_request,
@@ -381,10 +452,10 @@
  	.sta_add_debugfs = mt7996_sta_add_debugfs,
  #endif
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 4ff1af78..61b46370 100644
+index cefd4fad..214a39d5 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2868,8 +2868,12 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
+@@ -2880,8 +2880,12 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
  {
  	int ret;
  
@@ -399,12 +470,9 @@
  	if (ret)
  		return ret;
  
-@@ -3560,17 +3564,9 @@ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
- 				 &req, sizeof(req), true);
- }
+@@ -3574,15 +3578,7 @@ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
  
--int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset)
-+int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf)
+ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len)
  {
 -	struct {
 -		u8 _rsv[4];
@@ -419,26 +487,15 @@
  		.tag = cpu_to_le16(UNI_EFUSE_ACCESS),
  		.len = cpu_to_le16(sizeof(req) - 4),
  		.addr = cpu_to_le32(round_down(offset,
-@@ -3579,6 +3575,7 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset)
- 	struct sk_buff *skb;
- 	bool valid;
- 	int ret;
-+	u8 *buf = read_buf;
+@@ -3604,6 +3600,7 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_l
  
- 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
- 					MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL),
-@@ -3589,7 +3586,9 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset)
- 	valid = le32_to_cpu(*(__le32 *)(skb->data + 16));
- 	if (valid) {
- 		u32 addr = le32_to_cpu(*(__le32 *)(skb->data + 12));
--		u8 *buf = (u8 *)dev->mt76.eeprom.data + addr;
+ 		if (!buf)
+ 			buf = (u8 *)dev->mt76.eeprom.data + addr;
 +
-+		if (!buf)
-+			buf = (u8 *)dev->mt76.eeprom.data + addr;
+ 		if (!buf_len || buf_len > MT7996_EEPROM_BLOCK_SIZE)
+ 			buf_len = MT7996_EEPROM_BLOCK_SIZE;
  
- 		skb_pull(skb, 48);
- 		memcpy(buf, skb->data, MT7996_EEPROM_BLOCK_SIZE);
-@@ -4612,3 +4611,37 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
+@@ -4630,3 +4627,37 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(PP),
  				 &req, sizeof(req), false);
  }
@@ -530,36 +587,38 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index bb7536ff..1e1e638a 100644
+index 6c889427..5f911515 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -32,21 +32,25 @@
+@@ -32,6 +32,7 @@
  #define MT7996_FIRMWARE_WA		"mediatek/mt7996/mt7996_wa.bin"
  #define MT7996_FIRMWARE_WM		"mediatek/mt7996/mt7996_wm.bin"
  #define MT7996_FIRMWARE_DSP		"mediatek/mt7996/mt7996_dsp.bin"
 +#define MT7996_FIRMWARE_WM_TM		"mediatek/mt7996/mt7996_wm_tm.bin"
  #define MT7996_ROM_PATCH		"mediatek/mt7996/mt7996_rom_patch.bin"
  
+ #define MT7996_FIRMWARE_WA_233		"mediatek/mt7996/mt7996_wa_233.bin"
+@@ -42,16 +43,19 @@
  #define MT7992_FIRMWARE_WA		"mediatek/mt7996/mt7992_wa.bin"
  #define MT7992_FIRMWARE_WM		"mediatek/mt7996/mt7992_wm.bin"
  #define MT7992_FIRMWARE_DSP		"mediatek/mt7996/mt7992_dsp.bin"
 +#define MT7992_FIRMWARE_WM_TM		"mediatek/mt7996/mt7992_wm_tm.bin"
  #define MT7992_ROM_PATCH		"mediatek/mt7996/mt7992_rom_patch.bin"
  
- #define MT7992_FIRMWARE_WA_24		"mediatek/mt7996/mt7992_wa_24.bin"
- #define MT7992_FIRMWARE_WM_24		"mediatek/mt7996/mt7992_wm_24.bin"
- #define MT7992_FIRMWARE_DSP_24		"mediatek/mt7996/mt7992_dsp_24.bin"
-+#define MT7992_FIRMWARE_WM_TM_24	"mediatek/mt7996/mt7992_wm_tm_24.bin"
- #define MT7992_ROM_PATCH_24		"mediatek/mt7996/mt7992_rom_patch_24.bin"
- 
  #define MT7992_FIRMWARE_WA_23		"mediatek/mt7996/mt7992_wa_23.bin"
  #define MT7992_FIRMWARE_WM_23		"mediatek/mt7996/mt7992_wm_23.bin"
  #define MT7992_FIRMWARE_DSP_23		"mediatek/mt7996/mt7992_dsp_23.bin"
 +#define MT7992_FIRMWARE_WM_TM_23	"mediatek/mt7996/mt7992_wm_tm_23.bin"
  #define MT7992_ROM_PATCH_23		"mediatek/mt7996/mt7992_rom_patch_23.bin"
  
+ #define MT7992_FIRMWARE_WA_24		"mediatek/mt7996/mt7992_wa_24.bin"
+ #define MT7992_FIRMWARE_WM_24		"mediatek/mt7996/mt7992_wm_24.bin"
+ #define MT7992_FIRMWARE_DSP_24		"mediatek/mt7996/mt7992_dsp_24.bin"
++#define MT7992_FIRMWARE_WM_TM_24	"mediatek/mt7996/mt7992_wm_tm_24.bin"
+ #define MT7992_ROM_PATCH_24		"mediatek/mt7996/mt7992_rom_patch_24.bin"
+ 
  #define MT7996_EEPROM_DEFAULT		"mediatek/mt7996/mt7996_eeprom.bin"
-@@ -127,6 +131,7 @@ enum mt7992_sku_type {
+@@ -119,6 +123,7 @@ struct mt7996_dfs_pattern;
  
  enum mt7996_ram_type {
  	MT7996_RAM_TYPE_WM,
@@ -567,7 +626,16 @@
  	MT7996_RAM_TYPE_WA,
  	MT7996_RAM_TYPE_DSP,
  	__MT7996_RAM_TYPE_MAX,
-@@ -277,6 +282,21 @@ struct mt7996_phy {
+@@ -258,6 +263,8 @@ struct mt7996_phy {
+ 
+ 	struct ieee80211_sband_iftype_data iftype[NUM_NL80211_BANDS][NUM_NL80211_IFTYPES];
+ 
++	struct ieee80211_vif *monitor_vif;
++
+ 	struct thermal_cooling_device *cdev;
+ 	u8 cdev_state;
+ 	u8 throttle_state;
+@@ -285,6 +292,21 @@ struct mt7996_phy {
  
  	u8 pp_mode;
  	u16 punct_bitmap;
@@ -589,7 +657,7 @@
  };
  
  struct mt7996_dev {
-@@ -357,6 +377,8 @@ struct mt7996_dev {
+@@ -365,6 +387,8 @@ struct mt7996_dev {
  		spinlock_t lock;
  	} wed_rro;
  
@@ -598,7 +666,7 @@
  	bool ibf;
  	u8 fw_debug_wm;
  	u8 fw_debug_wa;
-@@ -472,6 +494,7 @@ mt7996_band_valid(struct mt7996_dev *dev, u8 band)
+@@ -502,6 +526,7 @@ mt7996_has_background_radar(struct mt7996_dev *dev)
  extern const struct ieee80211_ops mt7996_ops;
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
@@ -606,7 +674,7 @@
  
  struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
  				     void __iomem *mem_base, u32 device_id);
-@@ -481,6 +504,7 @@ u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif);
+@@ -511,6 +536,7 @@ u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif);
  int mt7996_register_device(struct mt7996_dev *dev);
  void mt7996_unregister_device(struct mt7996_dev *dev);
  int mt7996_eeprom_init(struct mt7996_dev *dev);
@@ -614,16 +682,7 @@
  int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
  int mt7996_eeprom_get_target_power(struct mt7996_dev *dev,
  				   struct ieee80211_channel *chan);
-@@ -533,7 +557,7 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
- int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif,
- 			       struct ieee80211_sta *sta, void *data, u32 field);
- int mt7996_mcu_set_eeprom(struct mt7996_dev *dev);
--int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset);
-+int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf);
- int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num);
- int mt7996_mcu_get_chip_config(struct mt7996_dev *dev, u32 *cap);
- int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 set, u8 band);
-@@ -568,6 +592,7 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
+@@ -598,6 +624,7 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
  void mt7996_mcu_exit(struct mt7996_dev *dev);
  int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag);
  int mt7996_mcu_wed_rro_reset_sessions(struct mt7996_dev *dev, u16 id);
@@ -633,7 +692,7 @@
  {
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
 new file mode 100644
-index 00000000..98eebcee
+index 00000000..58f0ad26
 --- /dev/null
 +++ b/mt7996/testmode.c
 @@ -0,0 +1,740 @@
@@ -1324,7 +1383,7 @@
 +		req.addr = cpu_to_le32(i);
 +		memcpy(req.data, eeprom + i, MT76_TM_EEPROM_BLOCK_SIZE);
 +
-+		ret = mt7996_mcu_get_eeprom(dev, i, read_buf);
++		ret = mt7996_mcu_get_eeprom(dev, i, read_buf, sizeof(read_buf));
 +		if (ret < 0)
 +			return ret;
 +
@@ -1950,7 +2009,7 @@
  
  	if (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_POWER)) {
 diff --git a/testmode.h b/testmode.h
-index 5e2792d8..96872e8c 100644
+index 1b0bcae8..2873c903 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -5,7 +5,8 @@
@@ -2105,7 +2164,7 @@
   */
  enum mt76_testmode_tx_mode {
  	MT76_TM_TX_MODE_CCK,
-@@ -187,12 +251,33 @@ enum mt76_testmode_tx_mode {
+@@ -187,10 +251,31 @@ enum mt76_testmode_tx_mode {
  	MT76_TM_TX_MODE_HE_EXT_SU,
  	MT76_TM_TX_MODE_HE_TB,
  	MT76_TM_TX_MODE_HE_MU,
@@ -2136,8 +2195,6 @@
 +	MT76_TM_EEPROM_ACTION_MAX = NUM_MT76_TM_EEPROM_ACTION - 1,
 +};
 +
- extern const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS];
- 
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
 index e3f69089..055f90f3 100644
@@ -2355,5 +2412,5 @@
  
  const struct tm_field msg_field = {
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0028-mtk-mt76-mt7996-add-testmode-pre-calibration-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0016-mtk-mt76-mt7996-add-testmode-pre-calibration-support.patch
similarity index 96%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0028-mtk-mt76-mt7996-add-testmode-pre-calibration-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0016-mtk-mt76-mt7996-add-testmode-pre-calibration-support.patch
index 6ec0d14..7bfffde 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0028-mtk-mt76-mt7996-add-testmode-pre-calibration-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0016-mtk-mt76-mt7996-add-testmode-pre-calibration-support.patch
@@ -1,9 +1,10 @@
-From e003b705dbccb31a9150c04de3bfcb5e2d2e8a0b Mon Sep 17 00:00:00 2001
+From 3d599c8f98348aa22fde6d3fc9b0536467a6378c Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 31 Mar 2023 11:27:24 +0800
-Subject: [PATCH 028/199] mtk: mt76: mt7996: add testmode pre-calibration
+Subject: [PATCH 016/223] mtk: mt76: mt7996: add testmode pre-calibration
  support
 
+Change-Id: If8a6cc02fa20e35f079c826e0571e8c04c3f9c7e
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mac80211.c        |  21 ---
@@ -21,7 +22,7 @@
  12 files changed, 632 insertions(+), 23 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 7e4ee83f..5b02fa35 100644
+index 5d9512d4..1d2477d6 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -6,27 +6,6 @@
@@ -53,10 +54,10 @@
  	CHAN2G(1, 2412),
  	CHAN2G(2, 2417),
 diff --git a/mt76.h b/mt76.h
-index 27635c49..362243f6 100644
+index f6ffccac..8666ec2f 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -23,6 +23,27 @@
+@@ -24,6 +24,27 @@
  #include "util.h"
  #include "testmode.h"
  
@@ -84,7 +85,7 @@
  #define MT_MCU_RING_SIZE	32
  #define MT_RX_BUF_SIZE		2048
  #define MT_SKB_HEAD_LEN		256
-@@ -707,6 +728,7 @@ struct mt76_testmode_ops {
+@@ -721,6 +742,7 @@ struct mt76_testmode_ops {
  	void (*reset_rx_stats)(struct mt76_phy *phy);
  	void (*tx_stop)(struct mt76_phy *phy);
  	int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
@@ -93,10 +94,10 @@
  
  #define MT_TM_FW_RX_COUNT	BIT(0)
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 57e0e9de..f994a2b3 100644
+index 873f59f7..c7fa7b26 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1053,8 +1053,10 @@ enum {
+@@ -1058,8 +1058,10 @@ enum {
  	MCU_UNI_EVENT_RDD_REPORT = 0x11,
  	MCU_UNI_EVENT_ROC = 0x27,
  	MCU_UNI_EVENT_TX_DONE = 0x2d,
@@ -108,7 +109,7 @@
  	MCU_UNI_EVENT_PER_STA_INFO = 0x6d,
  	MCU_UNI_EVENT_ALL_STA_INFO = 0x6e,
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index e2790109..80b9f6f9 100644
+index cb4fb702..31b8fd1a 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -12,6 +12,42 @@ static bool testmode_enable;
@@ -154,8 +155,8 @@
  static int mt7996_check_eeprom(struct mt7996_dev *dev)
  {
  #define FEM_INT				0
-@@ -74,6 +110,36 @@ static char *mt7996_eeprom_name(struct mt7996_dev *dev)
- 	}
+@@ -156,6 +192,36 @@ static bool mt7996_eeprom_variant_valid(struct mt7996_dev *dev, const u8 *def)
+ 	return true;
  }
  
 +int
@@ -189,10 +190,10 @@
 +}
 +
  static int
- mt7996_eeprom_load_default(struct mt7996_dev *dev)
+ mt7996_eeprom_check_or_use_default(struct mt7996_dev *dev, bool use_default)
  {
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index de3ff4e2..849b8bca 100644
+index 7f7a718f..c1cad4f9 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -14,6 +14,7 @@ enum mt7996_eeprom_field {
@@ -257,10 +258,10 @@
  #define MT_EE_WIFI_CONF2_TX_PATH_BAND1		GENMASK(2, 0)
  #define MT_EE_WIFI_CONF2_TX_PATH_BAND2		GENMASK(5, 3)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 61b46370..75f143e2 100644
+index 214a39d5..08534fec 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -715,6 +715,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -725,6 +725,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	case MCU_UNI_EVENT_WED_RRO:
  		mt7996_mcu_wed_rro_event(dev, skb);
  		break;
@@ -273,10 +274,10 @@
  		break;
  	}
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 1e1e638a..c01a2145 100644
+index 5f911515..54b81c1e 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -389,6 +389,9 @@ struct mt7996_dev {
+@@ -399,6 +399,9 @@ struct mt7996_dev {
  	struct dentry *debugfs_dir;
  	struct rchan *relay_fwlog;
  
@@ -286,7 +287,7 @@
  	struct {
  		u16 table_mask;
  		u8 n_agrt;
-@@ -509,6 +512,7 @@ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
+@@ -541,6 +544,7 @@ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
  int mt7996_eeprom_get_target_power(struct mt7996_dev *dev,
  				   struct ieee80211_channel *chan);
  s8 mt7996_eeprom_get_power_delta(struct mt7996_dev *dev, int band);
@@ -294,7 +295,7 @@
  int mt7996_dma_init(struct mt7996_dev *dev);
  void mt7996_dma_reset(struct mt7996_dev *dev, bool force);
  void mt7996_dma_prefetch(struct mt7996_dev *dev);
-@@ -593,6 +597,9 @@ void mt7996_mcu_exit(struct mt7996_dev *dev);
+@@ -625,6 +629,9 @@ void mt7996_mcu_exit(struct mt7996_dev *dev);
  int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag);
  int mt7996_mcu_wed_rro_reset_sessions(struct mt7996_dev *dev, u16 id);
  int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
@@ -305,7 +306,7 @@
  static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
  {
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 98eebcee..a756ee10 100644
+index 58f0ad26..6969cba6 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
 @@ -7,6 +7,8 @@
@@ -857,7 +858,7 @@
  		err = -EINVAL;
  
 diff --git a/testmode.h b/testmode.h
-index 96872e8c..d6601cdc 100644
+index 2873c903..3348d0d5 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -220,6 +220,14 @@ enum mt76_testmode_state {
@@ -895,5 +896,5 @@
  
  static const char * const testmode_tx_mode[] = {
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0029-mtk-mt76-mt7996-add-normal-mode-pre-calibration-supp.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0017-mtk-mt76-mt7996-add-normal-mode-pre-calibration-supp.patch
similarity index 90%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0029-mtk-mt76-mt7996-add-normal-mode-pre-calibration-supp.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0017-mtk-mt76-mt7996-add-normal-mode-pre-calibration-supp.patch
index f3b6ac5..aa08101 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0029-mtk-mt76-mt7996-add-normal-mode-pre-calibration-supp.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0017-mtk-mt76-mt7996-add-normal-mode-pre-calibration-supp.patch
@@ -1,7 +1,7 @@
-From 9785970113aee510f38ef39577cb9e0154694e36 Mon Sep 17 00:00:00 2001
+From 2d4b4838473a1a02b793b9ba214f03640419f5ba Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 1 Mar 2023 12:12:51 +0800
-Subject: [PATCH 029/199] mtk: mt76: mt7996: add normal mode pre-calibration
+Subject: [PATCH 017/223] mtk: mt76: mt7996: add normal mode pre-calibration
  support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -16,10 +16,10 @@
  7 files changed, 188 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f994a2b3..0d30aff3 100644
+index c7fa7b26..a7d7ecce 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1289,6 +1289,7 @@ enum {
+@@ -1294,6 +1294,7 @@ enum {
  	MCU_UNI_CMD_PP = 0x38,
  	MCU_UNI_CMD_FIXED_RATE_TABLE = 0x40,
  	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
@@ -28,12 +28,12 @@
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
  	MCU_UNI_CMD_PER_STA_INFO = 0x6d,
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 80b9f6f9..454df971 100644
+index 31b8fd1a..5ff52577 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -356,6 +356,10 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
- 			return ret;
- 	}
+@@ -489,6 +489,10 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
+ 	if (ret < 0)
+ 		return ret;
  
 +	ret = mt7996_eeprom_load_precal(dev);
 +	if (ret)
@@ -43,7 +43,7 @@
  	if (ret < 0)
  		return ret;
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 849b8bca..58179c0c 100644
+index c1cad4f9..b3b9b854 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -25,6 +25,8 @@ enum mt7996_eeprom_field {
@@ -56,10 +56,10 @@
  
  #define MT_EE_WIFI_CONF0_TX_PATH		GENMASK(2, 0)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index ed7c7040..2749a5d7 100644
+index dc736a2d..a34e034d 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -987,6 +987,12 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
+@@ -1003,6 +1003,12 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
  	if (ret < 0)
  		return ret;
  
@@ -73,12 +73,12 @@
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7996_WTBL_STA);
  	if (idx)
 diff --git a/mt7996/main.c b/mt7996/main.c
-index be50f7f3..253bb2e3 100644
+index b7ae6e1a..9ff9ae0e 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -317,6 +317,12 @@ int mt7996_set_channel(struct mt7996_phy *phy)
- 
- 	mt76_set_channel(phy->mt76);
+@@ -310,6 +310,12 @@ int mt7996_set_channel(struct mt76_phy *mphy)
+ 	struct mt7996_phy *phy = mphy->priv;
+ 	int ret;
  
 +	if (dev->flash_mode) {
 +		ret = mt7996_mcu_apply_tx_dpd(phy);
@@ -90,10 +90,10 @@
  		mt7996_tm_update_channel(phy);
  		goto out;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 75f143e2..7c5e94f8 100644
+index 08534fec..b15075ab 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3634,6 +3634,172 @@ int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num)
+@@ -3650,6 +3650,172 @@ int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num)
  	return 0;
  }
  
@@ -267,10 +267,10 @@
  {
  #define NIC_CAP	3
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index c01a2145..1744998d 100644
+index 54b81c1e..8770839c 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -597,6 +597,9 @@ void mt7996_mcu_exit(struct mt7996_dev *dev);
+@@ -629,6 +629,9 @@ void mt7996_mcu_exit(struct mt7996_dev *dev);
  int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag);
  int mt7996_mcu_wed_rro_reset_sessions(struct mt7996_dev *dev, u16 id);
  int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
@@ -281,5 +281,5 @@
  void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb);
  #endif
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0017-mtk-mt76-mt7996-set-key-flag-IEEE80211_KEY_FLAG_GENE.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0017-mtk-mt76-mt7996-set-key-flag-IEEE80211_KEY_FLAG_GENE.patch
deleted file mode 100644
index 8044c01..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0017-mtk-mt76-mt7996-set-key-flag-IEEE80211_KEY_FLAG_GENE.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From ad30c992771e60b4150511435ea4f8935b978f02 Mon Sep 17 00:00:00 2001
-From: Michael-CY Lee <michael-cy.lee@mediatek.com>
-Date: Thu, 18 Apr 2024 17:21:22 +0800
-Subject: [PATCH 017/199] mtk: mt76: mt7996: set key flag
- 'IEEE80211_KEY_FLAG_GENERATE_MMIE' for other ciphers
-
-When beacon protection is enabled, FW checks MMIE tag & length in the
-beacon in every cipher mode. Therefore mt76 needs to set the flag
-'IEEE80211_KEY_GENERATE_MMIE' on so that MAC80211 generates and initializes
-MMIE for us.
-
-Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
----
- mt7996/main.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/mt7996/main.c b/mt7996/main.c
-index 8d2b0ee7..40281c5b 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -364,14 +364,14 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
- 	case WLAN_CIPHER_SUITE_SMS4:
- 		break;
- 	case WLAN_CIPHER_SUITE_AES_CMAC:
--		wcid_keyidx = &wcid->hw_key_idx2;
--		key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIE;
--		fallthrough;
- 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
- 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
- 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
--		if (key->keyidx == 6 || key->keyidx == 7)
-+		if (key->keyidx == 6 || key->keyidx == 7) {
-+			wcid_keyidx = &wcid->hw_key_idx2;
-+			key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIE;
- 			break;
-+		}
- 		fallthrough;
- 	case WLAN_CIPHER_SUITE_WEP40:
- 	case WLAN_CIPHER_SUITE_WEP104:
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0030-mtk-mt76-mt7996-enable-SCS-feature-for-mt7996-driver.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0018-mtk-mt76-mt7996-enable-SCS-feature-for-mt7996-driver.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0030-mtk-mt76-mt7996-enable-SCS-feature-for-mt7996-driver.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0018-mtk-mt76-mt7996-enable-SCS-feature-for-mt7996-driver.patch
index 145e845..6d0dee2 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0030-mtk-mt76-mt7996-enable-SCS-feature-for-mt7996-driver.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0018-mtk-mt76-mt7996-enable-SCS-feature-for-mt7996-driver.patch
@@ -1,7 +1,7 @@
-From b884ffbff5630ccb06b2b9212b47b8c5cf56bb47 Mon Sep 17 00:00:00 2001
+From 503baaaad8a49fcdcc2030a8eddacfec35c167b0 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 8 May 2023 09:03:50 +0800
-Subject: [PATCH 030/199] mtk: mt76: mt7996: enable SCS feature for mt7996
+Subject: [PATCH 018/223] mtk: mt76: mt7996: enable SCS feature for mt7996
  driver
 
 Enable Smart Carrier Sense algorithn by default to improve performance
@@ -20,10 +20,10 @@
  8 files changed, 148 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 0d30aff3..ea60e19c 100644
+index a7d7ecce..fcacd546 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1274,6 +1274,7 @@ enum {
+@@ -1279,6 +1279,7 @@ enum {
  	MCU_UNI_CMD_GET_STAT_INFO = 0x23,
  	MCU_UNI_CMD_SNIFFER = 0x24,
  	MCU_UNI_CMD_SR = 0x25,
@@ -32,10 +32,10 @@
  	MCU_UNI_CMD_SET_DBDC_PARMS = 0x28,
  	MCU_UNI_CMD_TXPOWER = 0x2b,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 2749a5d7..7e813960 100644
+index a34e034d..0a8e929a 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -1416,6 +1416,7 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1432,6 +1432,7 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	dev->mt76.phy.priv = &dev->phy;
  	INIT_WORK(&dev->rc_work, mt7996_mac_sta_rc_work);
  	INIT_DELAYED_WORK(&dev->mphy.mac_work, mt7996_mac_work);
@@ -44,10 +44,10 @@
  	INIT_LIST_HEAD(&dev->twt_list);
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index a0fcd8aa..fd8bce0e 100644
+index d73644f6..789caa44 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1804,6 +1804,7 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
+@@ -1815,6 +1815,7 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
  		cancel_delayed_work_sync(&phy2->mt76->mac_work);
  	if (phy3)
  		cancel_delayed_work_sync(&phy3->mt76->mac_work);
@@ -55,7 +55,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
  	for (i = 0; i < 10; i++) {
-@@ -1839,6 +1840,7 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
+@@ -1850,6 +1851,7 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
  		ieee80211_queue_delayed_work(phy3->mt76->hw,
  					     &phy3->mt76->mac_work,
  					     MT7996_WATCHDOG_TIME);
@@ -64,7 +64,7 @@
  
  void mt7996_mac_reset_work(struct work_struct *work)
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 253bb2e3..22acd04e 100644
+index 9ff9ae0e..a1c3874c 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -81,11 +81,17 @@ int mt7996_run(struct ieee80211_hw *hw)
@@ -85,7 +85,7 @@
  	if (!running)
  		mt7996_mac_reset_counters(phy);
  
-@@ -113,6 +119,7 @@ static void mt7996_stop(struct ieee80211_hw *hw)
+@@ -113,6 +119,7 @@ static void mt7996_stop(struct ieee80211_hw *hw, bool suspend)
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  
  	cancel_delayed_work_sync(&phy->mt76->mac_work);
@@ -94,10 +94,10 @@
  	mutex_lock(&dev->mt76.mutex);
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 7c5e94f8..8f725307 100644
+index b15075ab..98edae2c 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4816,3 +4816,108 @@ int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 da
+@@ -4832,3 +4832,108 @@ int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 da
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(TXPOWER),
  				 &req, sizeof(req), false);
  }
@@ -224,10 +224,10 @@
  #define MT7996_PATCH_SCRAMBLE_KEY	GENMASK(15, 8)
  #define MT7996_PATCH_AES_KEY		GENMASK(7, 0)
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 1744998d..d5050d6d 100644
+index 8770839c..6cb6c724 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -233,6 +233,16 @@ struct mt7996_hif {
+@@ -243,6 +243,16 @@ struct mt7996_hif {
  	int irq;
  };
  
@@ -244,7 +244,7 @@
  struct mt7996_wed_rro_addr {
  	u32 head_low;
  	u32 head_high : 4;
-@@ -283,6 +293,8 @@ struct mt7996_phy {
+@@ -293,6 +303,8 @@ struct mt7996_phy {
  	u8 pp_mode;
  	u16 punct_bitmap;
  
@@ -253,7 +253,7 @@
  #ifdef CONFIG_NL80211_TESTMODE
  	struct {
  		u32 *reg_backup;
-@@ -329,6 +341,7 @@ struct mt7996_dev {
+@@ -339,6 +351,7 @@ struct mt7996_dev {
  	struct work_struct rc_work;
  	struct work_struct dump_work;
  	struct work_struct reset_work;
@@ -261,7 +261,7 @@
  	wait_queue_head_t reset_wait;
  	struct {
  		u32 state;
-@@ -603,6 +616,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy);
+@@ -635,6 +648,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy);
  #ifdef CONFIG_NL80211_TESTMODE
  void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb);
  #endif
@@ -271,7 +271,7 @@
  static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
  {
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 64952a73..8c576bac 100644
+index d1f3d16c..1807a744 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2429,6 +2429,16 @@ static int mt7996_token_read(struct seq_file *s, void *data)
@@ -300,5 +300,5 @@
  	return 0;
  }
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0019-mtk-mt76-mt7996-add-support-for-different-variants.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0019-mtk-mt76-mt7996-add-support-for-different-variants.patch
deleted file mode 100644
index 3b06798..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0019-mtk-mt76-mt7996-add-support-for-different-variants.patch
+++ /dev/null
@@ -1,325 +0,0 @@
-From 56eef7fe97e8010ac211973868ab9f5753fb56d3 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Thu, 20 Jul 2023 17:27:22 +0800
-Subject: [PATCH 019/199] mtk: mt76: mt7996: add support for different variants
-
-Add fem type (2i5i, 2i5e, 2e5e, ...)
-Add Kite default bin for each fem type since loading wrong default bin
-will fail to setup interface
-Add eeprom fem type check
-
-Add adie 7976c efuse check
-Efuse offset 0x470 will be set to 0xc after final test if 7976c adie is used
-Chip manufactoring factories may transfer, which leads to different adie chip versions,
-so we add this efuse check to avoid 7976c recognition failure.
-
-GPIO ADie Combination of BE5040 should be considered as don't care
-instead of 0
-
-Only check eeprom chip id when fem type (= MT7996_FEM_UNSET) is not determined yet
-Without this fix, mt7996_check_eeprom will return EINVAL in mt7996_eeprom_check_fw_mode
-
-Align the naming rule of the default eeprom bin
-efem: XX_DEFAULT
-ifem: XX_DEFAULT_INT
-mixed fem: XX_DEFAULT_MIX
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt7996/eeprom.c | 40 +++++++++++++++++++++++++++++--
- mt7996/eeprom.h |  1 +
- mt7996/init.c   | 63 +++++++++++++++++++++++++++++++++++++++++++++++++
- mt7996/mcu.c    |  7 +++++-
- mt7996/mt7996.h | 43 ++++++++++++++++++++++++++++++---
- mt7996/regs.h   |  7 ++++++
- 6 files changed, 155 insertions(+), 6 deletions(-)
-
-diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 4a823711..f38629e3 100644
---- a/mt7996/eeprom.c
-+++ b/mt7996/eeprom.c
-@@ -9,14 +9,33 @@
- 
- static int mt7996_check_eeprom(struct mt7996_dev *dev)
- {
-+#define FEM_INT				0
-+#define FEM_EXT				3
- 	u8 *eeprom = dev->mt76.eeprom.data;
-+	u8 i, fem[__MT_MAX_BAND], fem_type;
- 	u16 val = get_unaligned_le16(eeprom);
- 
-+	for (i = 0; i < __MT_MAX_BAND; i++)
-+		fem[i] = eeprom[MT_EE_WIFI_CONF + 6 + i] & MT_EE_WIFI_PA_LNA_CONFIG;
-+
- 	switch (val) {
- 	case 0x7990:
- 		return is_mt7996(&dev->mt76) ? 0 : -EINVAL;
- 	case 0x7992:
--		return is_mt7992(&dev->mt76) ? 0 : -EINVAL;
-+		if (dev->fem_type == MT7996_FEM_UNSET)
-+			return is_mt7992(&dev->mt76) ? 0 : -EINVAL;
-+
-+		if (fem[0] == FEM_EXT && fem[1] == FEM_EXT)
-+			fem_type = MT7996_FEM_EXT;
-+		else if (fem[0] == FEM_INT && fem[1] == FEM_INT)
-+			fem_type = MT7996_FEM_INT;
-+		else if (fem[0] == FEM_INT && fem[1] == FEM_EXT)
-+			fem_type = MT7996_FEM_MIX;
-+		else
-+			return -EINVAL;
-+
-+		return (is_mt7992(&dev->mt76) ? 0 : -EINVAL) |
-+		       (dev->fem_type == fem_type ? 0 : -EINVAL);
- 	default:
- 		return -EINVAL;
- 	}
-@@ -26,9 +45,22 @@ static char *mt7996_eeprom_name(struct mt7996_dev *dev)
- {
- 	switch (mt76_chip(&dev->mt76)) {
- 	case 0x7990:
-+		if (dev->chip_sku == MT7996_SKU_404)
-+			return MT7996_EEPROM_DEFAULT_404;
- 		return MT7996_EEPROM_DEFAULT;
- 	case 0x7992:
--		return MT7992_EEPROM_DEFAULT;
-+		if (dev->chip_sku == MT7992_SKU_23) {
-+			if (dev->fem_type == MT7996_FEM_INT)
-+				return MT7992_EEPROM_DEFAULT_23_INT;
-+			return MT7992_EEPROM_DEFAULT_23;
-+		} else if (dev->chip_sku == MT7992_SKU_44) {
-+			if (dev->fem_type == MT7996_FEM_INT)
-+				return MT7992_EEPROM_DEFAULT_INT;
-+			else if (dev->fem_type == MT7996_FEM_MIX)
-+				return MT7992_EEPROM_DEFAULT_MIX;
-+			return MT7992_EEPROM_DEFAULT;
-+		}
-+		return MT7992_EEPROM_DEFAULT_24;
- 	default:
- 		return MT7996_EEPROM_DEFAULT;
- 	}
-@@ -219,6 +251,10 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
- {
- 	int ret;
- 
-+	ret = mt7996_get_chip_sku(dev);
-+	if (ret)
-+		return ret;
-+
- 	ret = mt7996_eeprom_load(dev);
- 	if (ret < 0) {
- 		if (ret != -EINVAL)
-diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 412d6e2f..72c38ad3 100644
---- a/mt7996/eeprom.h
-+++ b/mt7996/eeprom.h
-@@ -29,6 +29,7 @@ enum mt7996_eeprom_field {
- #define MT_EE_WIFI_CONF0_BAND_SEL		GENMASK(2, 0)
- #define MT_EE_WIFI_CONF1_BAND_SEL		GENMASK(5, 3)
- #define MT_EE_WIFI_CONF2_BAND_SEL		GENMASK(2, 0)
-+#define MT_EE_WIFI_PA_LNA_CONFIG		GENMASK(1, 0)
- 
- #define MT_EE_WIFI_CONF1_TX_PATH_BAND0		GENMASK(5, 3)
- #define MT_EE_WIFI_CONF2_TX_PATH_BAND1		GENMASK(2, 0)
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 2d7f42f7..f80fba28 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -887,6 +887,65 @@ out:
- #endif
- }
- 
-+int mt7996_get_chip_sku(struct mt7996_dev *dev)
-+{
-+#define MT7976C_CHIP_VER	0x8a10
-+#define MT7976C_HL_CHIP_VER	0x8b00
-+#define MT7976C_PS_CHIP_VER	0x8c10
-+#define MT7976C_EFUSE_OFFSET	0x470
-+#define MT7976C_EFUSE_VALUE	0xc
-+	u32 regval, val = mt76_rr(dev, MT_PAD_GPIO);
-+	u16 adie_chip_id, adie_chip_ver;
-+	u8 adie_comb, adie_num, adie_idx = 0;
-+
-+	switch (mt76_chip(&dev->mt76)) {
-+	case 0x7990:
-+		adie_comb = FIELD_GET(MT_PAD_GPIO_ADIE_COMB, val);
-+		if (adie_comb <= 1)
-+			dev->chip_sku = MT7996_SKU_444;
-+		else
-+			dev->chip_sku = MT7996_SKU_404;
-+		break;
-+	case 0x7992:
-+		adie_comb = FIELD_GET(MT_PAD_GPIO_ADIE_COMB_7992, val);
-+		adie_num = FIELD_GET(MT_PAD_GPIO_ADIE_NUM_7992, val);
-+		adie_idx = !adie_num;
-+		if (adie_num)
-+			dev->chip_sku = MT7992_SKU_23;
-+		else if (adie_comb)
-+			dev->chip_sku = MT7992_SKU_44;
-+		else
-+			dev->chip_sku = MT7992_SKU_24;
-+		break;
-+	default:
-+		return -EINVAL;
-+	}
-+
-+	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state)) {
-+		u8 buf[MT7996_EEPROM_BLOCK_SIZE];
-+		u8 idx = MT7976C_EFUSE_OFFSET % MT7996_EEPROM_BLOCK_SIZE;
-+		bool is_7976c;
-+
-+		mt7996_mcu_rf_regval(dev, MT_ADIE_CHIP_ID(adie_idx), &regval, false);
-+		adie_chip_id = FIELD_GET(MT_ADIE_CHIP_ID_MASK, regval);
-+		adie_chip_ver = FIELD_GET(MT_ADIE_VERSION_MASK, regval);
-+		mt7996_mcu_get_eeprom(dev, MT7976C_EFUSE_OFFSET, buf);
-+		is_7976c = (adie_chip_ver == MT7976C_CHIP_VER) ||
-+			   (adie_chip_ver == MT7976C_HL_CHIP_VER) ||
-+			   (adie_chip_ver == MT7976C_PS_CHIP_VER) ||
-+			   (buf[idx] == MT7976C_EFUSE_VALUE);
-+		if (adie_chip_id == 0x7975 || (adie_chip_id == 0x7976 && is_7976c) ||
-+		    adie_chip_id == 0x7979)
-+			dev->fem_type = MT7996_FEM_INT;
-+		else if (adie_chip_id == 0x7977 && adie_comb == 1)
-+			dev->fem_type = MT7996_FEM_MIX;
-+		else
-+			dev->fem_type = MT7996_FEM_EXT;
-+	}
-+
-+	return 0;
-+}
-+
- static int mt7996_init_hardware(struct mt7996_dev *dev)
- {
- 	int ret, idx;
-@@ -902,6 +961,10 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
- 	INIT_LIST_HEAD(&dev->wed_rro.poll_list);
- 	spin_lock_init(&dev->wed_rro.lock);
- 
-+	ret = mt7996_get_chip_sku(dev);
-+	if (ret)
-+		return ret;
-+
- 	ret = mt7996_dma_init(dev);
- 	if (ret)
- 		return ret;
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 0c300b81..ae01a4eb 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -14,7 +14,12 @@
- 	char *_fw;						\
- 	switch (mt76_chip(&(_dev)->mt76)) {			\
- 	case 0x7992:						\
--		_fw = MT7992_##name;				\
-+		if ((_dev)->chip_sku == MT7992_SKU_23)		\
-+			_fw = MT7992_##name##_23;		\
-+		else if ((_dev)->chip_sku == MT7992_SKU_24)	\
-+			_fw = MT7992_##name##_24;		\
-+		else						\
-+			_fw = MT7992_##name;			\
- 		break;						\
- 	case 0x7990:						\
- 	default:						\
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 58fa6b45..16cefeac 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -39,8 +39,24 @@
- #define MT7992_FIRMWARE_DSP		"mediatek/mt7996/mt7992_dsp.bin"
- #define MT7992_ROM_PATCH		"mediatek/mt7996/mt7992_rom_patch.bin"
- 
-+#define MT7992_FIRMWARE_WA_24		"mediatek/mt7996/mt7992_wa_24.bin"
-+#define MT7992_FIRMWARE_WM_24		"mediatek/mt7996/mt7992_wm_24.bin"
-+#define MT7992_FIRMWARE_DSP_24		"mediatek/mt7996/mt7992_dsp_24.bin"
-+#define MT7992_ROM_PATCH_24		"mediatek/mt7996/mt7992_rom_patch_24.bin"
-+
-+#define MT7992_FIRMWARE_WA_23		"mediatek/mt7996/mt7992_wa_23.bin"
-+#define MT7992_FIRMWARE_WM_23		"mediatek/mt7996/mt7992_wm_23.bin"
-+#define MT7992_FIRMWARE_DSP_23		"mediatek/mt7996/mt7992_dsp_23.bin"
-+#define MT7992_ROM_PATCH_23		"mediatek/mt7996/mt7992_rom_patch_23.bin"
-+
- #define MT7996_EEPROM_DEFAULT		"mediatek/mt7996/mt7996_eeprom.bin"
--#define MT7992_EEPROM_DEFAULT		"mediatek/mt7996/mt7992_eeprom.bin"
-+#define MT7996_EEPROM_DEFAULT_404	"mediatek/mt7996/mt7996_eeprom_dual_404.bin"
-+#define MT7992_EEPROM_DEFAULT		"mediatek/mt7996/mt7992_eeprom_2e5e.bin"
-+#define MT7992_EEPROM_DEFAULT_INT	"mediatek/mt7996/mt7992_eeprom_2i5i.bin"
-+#define MT7992_EEPROM_DEFAULT_MIX	"mediatek/mt7996/mt7992_eeprom_2i5e.bin"
-+#define MT7992_EEPROM_DEFAULT_24	"mediatek/mt7996/mt7992_eeprom_24_2i5i.bin"
-+#define MT7992_EEPROM_DEFAULT_23	"mediatek/mt7996/mt7992_eeprom_23_2e5e.bin"
-+#define MT7992_EEPROM_DEFAULT_23_INT	"mediatek/mt7996/mt7992_eeprom_23_2i5i.bin"
- #define MT7996_EEPROM_SIZE		7680
- #define MT7996_EEPROM_BLOCK_SIZE	16
- #define MT7996_TOKEN_SIZE		16384
-@@ -89,6 +105,24 @@ struct mt7996_sta;
- struct mt7996_dfs_pulse;
- struct mt7996_dfs_pattern;
- 
-+enum mt7996_fem_type {
-+	MT7996_FEM_UNSET,
-+	MT7996_FEM_EXT,
-+	MT7996_FEM_INT,
-+	MT7996_FEM_MIX,
-+};
-+
-+enum mt7996_sku_type {
-+	MT7996_SKU_404,
-+	MT7996_SKU_444,
-+};
-+
-+enum mt7992_sku_type {
-+	MT7992_SKU_23,
-+	MT7992_SKU_24,
-+	MT7992_SKU_44,
-+};
-+
- enum mt7996_ram_type {
- 	MT7996_RAM_TYPE_WM,
- 	MT7996_RAM_TYPE_WA,
-@@ -261,6 +295,9 @@ struct mt7996_dev {
- 	struct cfg80211_chan_def rdd2_chandef;
- 	struct mt7996_phy *rdd2_phy;
- 
-+	u8 chip_sku;
-+	u8 fem_type;
-+
- 	u16 chainmask;
- 	u8 chainshift[__MT_MAX_BAND];
- 	u32 hif_idx;
-@@ -409,8 +446,7 @@ mt7996_band_valid(struct mt7996_dev *dev, u8 band)
- 		return band <= MT_BAND1;
- 
- 	/* tri-band support */
--	if (band <= MT_BAND2 &&
--	    mt76_get_field(dev, MT_PAD_GPIO, MT_PAD_GPIO_ADIE_COMB) <= 1)
-+	if (band <= MT_BAND2 && dev->chip_sku)
- 		return true;
- 
- 	return band == MT_BAND0 || band == MT_BAND2;
-@@ -441,6 +477,7 @@ int mt7996_init_tx_queues(struct mt7996_phy *phy, int idx,
- 			  int n_desc, int ring_base, struct mtk_wed_device *wed);
- void mt7996_init_txpower(struct mt7996_phy *phy);
- int mt7996_txbf_init(struct mt7996_dev *dev);
-+int mt7996_get_chip_sku(struct mt7996_dev *dev);
- void mt7996_reset(struct mt7996_dev *dev);
- int mt7996_run(struct ieee80211_hw *hw);
- int mt7996_mcu_init(struct mt7996_dev *dev);
-diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 47b429d8..cf12c5e0 100644
---- a/mt7996/regs.h
-+++ b/mt7996/regs.h
-@@ -662,6 +662,13 @@ enum offs_rev {
- 
- #define MT_PAD_GPIO				0x700056f0
- #define MT_PAD_GPIO_ADIE_COMB			GENMASK(16, 15)
-+#define MT_PAD_GPIO_ADIE_COMB_7992		GENMASK(17, 16)
-+#define MT_PAD_GPIO_ADIE_NUM_7992		BIT(15)
-+
-+/* ADIE */
-+#define MT_ADIE_CHIP_ID(_idx)                  (0x0f00002c + ((_idx) << 28))
-+#define MT_ADIE_VERSION_MASK                   GENMASK(15, 0)
-+#define MT_ADIE_CHIP_ID_MASK                   GENMASK(31, 16)
- 
- #define MT_HW_REV				0x70010204
- #define MT_HW_REV1				0x8a00
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0031-mtk-mt76-mt7996-add-txpower-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0019-mtk-mt76-mt7996-add-txpower-support.patch
similarity index 95%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0031-mtk-mt76-mt7996-add-txpower-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0019-mtk-mt76-mt7996-add-txpower-support.patch
index 9fbc955..9c4eeda 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0031-mtk-mt76-mt7996-add-txpower-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0019-mtk-mt76-mt7996-add-txpower-support.patch
@@ -1,7 +1,7 @@
-From bfa596387e89377dec2121b5548b44b419463fb0 Mon Sep 17 00:00:00 2001
+From 5d3b2dafbf6b343983b999b19e94ad175c374bd3 Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Fri, 24 Mar 2023 23:35:30 +0800
-Subject: [PATCH 031/199] mtk: mt76: mt7996: add txpower support
+Subject: [PATCH 019/223] mtk: mt76: mt7996: add txpower support
 
 Add single sku and default enable sku.
 
@@ -15,6 +15,7 @@
 
 Fix wrong power value when user set limit close to path table limit.
 
+Change-Id: I5738cd3730f041f1f42d582e2b62d39b70861376
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Signed-off-by: Allen Ye <allen.ye@mediatek.com>
 ---
@@ -35,10 +36,10 @@
  14 files changed, 725 insertions(+), 27 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index a0047d79..11efe293 100644
+index 6bd2cc1a..85935dea 100644
 --- a/eeprom.c
 +++ b/eeprom.c
-@@ -305,9 +305,10 @@ mt76_apply_array_limit(s8 *pwr, size_t pwr_len, const __be32 *data,
+@@ -320,9 +320,10 @@ mt76_apply_array_limit(s8 *pwr, size_t pwr_len, const __be32 *data,
  static void
  mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
  			     const __be32 *data, size_t len, s8 target_power,
@@ -50,7 +51,7 @@
  
  	if (!data)
  		return;
-@@ -319,7 +320,7 @@ mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
+@@ -334,7 +335,7 @@ mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
  			break;
  
  		mt76_apply_array_limit(pwr + pwr_len * i, pwr_len, data + 1,
@@ -59,7 +60,7 @@
  		if (--cur > 0)
  			continue;
  
-@@ -335,6 +336,7 @@ mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
+@@ -350,6 +351,7 @@ mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
  s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  			      struct ieee80211_channel *chan,
  			      struct mt76_power_limits *dest,
@@ -67,7 +68,7 @@
  			      s8 target_power)
  {
  	struct mt76_dev *dev = phy->dev;
-@@ -342,16 +344,20 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+@@ -357,16 +359,20 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  	const __be32 *val;
  	char name[16];
  	u32 mcs_rates = dev->drv->mcs_rates;
@@ -91,7 +92,7 @@
  
  	if (!IS_ENABLED(CONFIG_OF))
  		return target_power;
-@@ -397,12 +403,44 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+@@ -412,12 +418,44 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  	val = mt76_get_of_array(np, "rates-mcs", &len, mcs_rates + 1);
  	mt76_apply_multi_array_limit(dest->mcs[0], ARRAY_SIZE(dest->mcs[0]),
  				     ARRAY_SIZE(dest->mcs), val, len,
@@ -140,10 +141,10 @@
  	return max_power;
  }
 diff --git a/mt76.h b/mt76.h
-index 362243f6..2236bc6b 100644
+index 8666ec2f..ac2de858 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1064,6 +1064,14 @@ struct mt76_power_limits {
+@@ -1079,6 +1079,14 @@ struct mt76_power_limits {
  	s8 eht[16][16];
  };
  
@@ -158,7 +159,7 @@
  struct mt76_ethtool_worker_info {
  	u64 *data;
  	int idx;
-@@ -1678,6 +1686,7 @@ mt76_find_channel_node(struct device_node *np, struct ieee80211_channel *chan);
+@@ -1694,6 +1702,7 @@ mt76_find_channel_node(struct device_node *np, struct ieee80211_channel *chan);
  s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  			      struct ieee80211_channel *chan,
  			      struct mt76_power_limits *dest,
@@ -167,10 +168,10 @@
  
  static inline bool mt76_queue_is_rx(struct mt76_dev *dev, struct mt76_queue *q)
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index a1deeacd..33cbf4c2 100644
+index 07f52dd6..c7145074 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -2158,7 +2158,7 @@ mt76_connac_mcu_rate_txpower_band(struct mt76_phy *phy,
+@@ -2160,7 +2160,7 @@ mt76_connac_mcu_rate_txpower_band(struct mt76_phy *phy,
  			sar_power = mt76_get_sar_power(phy, &chan, reg_power);
  
  			mt76_get_rate_power_limits(phy, &chan, limits,
@@ -180,10 +181,10 @@
  			tx_power_tlv.last_msg = ch_list[idx] == last_ch;
  			sku_tlbv.channel = ch_list[idx];
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 454df971..17485bfc 100644
+index 5ff52577..b091e30c 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -408,3 +408,37 @@ s8 mt7996_eeprom_get_power_delta(struct mt7996_dev *dev, int band)
+@@ -541,3 +541,37 @@ s8 mt7996_eeprom_get_power_delta(struct mt7996_dev *dev, int band)
  
  	return val & MT_EE_RATE_DELTA_SIGN ? delta : -delta;
  }
@@ -222,10 +223,10 @@
 +	[SKU_EHT3x996_484] = 16,
 +};
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 58179c0c..b19ff068 100644
+index b3b9b854..f3a9618b 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
-@@ -125,4 +125,46 @@ mt7996_get_channel_group_6g(int channel)
+@@ -127,4 +127,46 @@ mt7996_get_channel_group_6g(int channel)
  	return DIV_ROUND_UP(channel - 29, 32);
  }
  
@@ -273,7 +274,7 @@
 +
  #endif
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 7e813960..3b816070 100644
+index 0a8e929a..994d74cc 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -297,7 +297,12 @@ static void __mt7996_init_txpower(struct mt7996_phy *phy,
@@ -311,7 +312,7 @@
  	}
  }
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 22acd04e..5a6ba6a6 100644
+index a1c3874c..e65b5bd7 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -85,6 +85,21 @@ int mt7996_run(struct ieee80211_hw *hw)
@@ -337,10 +338,10 @@
  
  	ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 8f725307..3b4c45bb 100644
+index 98edae2c..59a24478 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4668,9 +4668,31 @@ int mt7996_mcu_wed_rro_reset_sessions(struct mt7996_dev *dev, u16 id)
+@@ -4684,9 +4684,31 @@ int mt7996_mcu_wed_rro_reset_sessions(struct mt7996_dev *dev, u16 id)
  				 sizeof(req), true);
  }
  
@@ -372,7 +373,7 @@
  	struct mt7996_dev *dev = phy->dev;
  	struct mt76_phy *mphy = phy->mt76;
  	struct ieee80211_hw *hw = mphy->hw;
-@@ -4690,13 +4712,22 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
+@@ -4706,13 +4728,22 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
  		.band_idx = phy->mt76->band_idx,
  	};
  	struct mt76_power_limits la = {};
@@ -400,7 +401,7 @@
  
  	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
  				 sizeof(req) + MT7996_SKU_PATH_NUM);
-@@ -4726,6 +4757,34 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
+@@ -4742,6 +4773,34 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
  	/* padding */
  	skb_put_zero(skb, MT7996_SKU_PATH_NUM - MT7996_SKU_RATE_NUM);
  
@@ -456,10 +457,10 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index d5050d6d..ff7edcd8 100644
+index 6cb6c724..a1a30b33 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -295,6 +295,9 @@ struct mt7996_phy {
+@@ -305,6 +305,9 @@ struct mt7996_phy {
  
  	struct mt7996_scs_ctrl scs_ctrl;
  
@@ -469,7 +470,7 @@
  #ifdef CONFIG_NL80211_TESTMODE
  	struct {
  		u32 *reg_backup;
-@@ -616,6 +619,7 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy);
+@@ -648,6 +651,7 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy);
  #ifdef CONFIG_NL80211_TESTMODE
  void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb);
  #endif
@@ -478,7 +479,7 @@
  void mt7996_mcu_scs_sta_poll(struct work_struct *work);
  
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 8c576bac..3558641c 100644
+index 1807a744..ad89eccd 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2439,6 +2439,364 @@ mt7996_scs_enable_set(void *data, u64 val)
@@ -998,10 +999,10 @@
  
  #endif
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 4c20a67d..8ec1dc1c 100644
+index 3450a2fc..539e799c 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
-@@ -693,24 +693,29 @@ enum offs_rev {
+@@ -695,24 +695,29 @@ enum offs_rev {
  						 ((_wf) << 16) + (ofs))
  #define MT_WF_PHYRX_CSD_IRPI(_band, _wf)	MT_WF_PHYRX_CSD(_band, _wf, 0x1000)
  
@@ -1043,5 +1044,5 @@
  #define MT_WF_PHYRX_CSD_BAND_RXTD12_IRPI_SW_CLR		BIT(29)
  
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0032-mtk-mt76-mt7996-add-binfile-mode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0020-mtk-mt76-mt7996-add-binfile-mode-support.patch
similarity index 71%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0032-mtk-mt76-mt7996-add-binfile-mode-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0020-mtk-mt76-mt7996-add-binfile-mode-support.patch
index b3430bf..c4f105c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0032-mtk-mt76-mt7996-add-binfile-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0020-mtk-mt76-mt7996-add-binfile-mode-support.patch
@@ -1,7 +1,7 @@
-From e6e4969b4c1ae6f9a1fc9ac9744ca6eb76400a51 Mon Sep 17 00:00:00 2001
+From edd667417d5bf86af2b0c04679782614a6b8ef8f Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 31 Mar 2023 11:36:34 +0800
-Subject: [PATCH 032/199] mtk: mt76: mt7996: add binfile mode support
+Subject: [PATCH 020/223] mtk: mt76: mt7996: add binfile mode support
 
 Fix binfile cannot sync precal data to atenl
 Binfile is viewed as efuse mode in atenl, so atenl does not allocate
@@ -11,19 +11,21 @@
 
 Align upstream
 
+Change-Id: I06369a46f75c0707d9ababd8ade70d79a89b1a1c
+Change-Id: I4c8fd2b0a9956d2ee961b70cd28973e2e9410aca
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
- eeprom.c             |  25 +++++++++++
- mt76.h               |   3 ++
- mt7996/eeprom.c      | 103 ++++++++++++++++++++++++++++++++++++++++---
- mt7996/eeprom.h      |   7 +++
- mt7996/mt7996.h      |   3 ++
- mt7996/mtk_debugfs.c |  41 +++++++++++++++++
- testmode.h           |   2 +-
- 7 files changed, 178 insertions(+), 6 deletions(-)
+ eeprom.c             | 25 +++++++++++++++
+ mt76.h               |  3 ++
+ mt7996/eeprom.c      | 76 ++++++++++++++++++++++++++++++++++++++------
+ mt7996/eeprom.h      |  7 ++++
+ mt7996/mt7996.h      |  3 ++
+ mt7996/mtk_debugfs.c | 41 ++++++++++++++++++++++++
+ testmode.h           |  2 +-
+ 7 files changed, 147 insertions(+), 10 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 11efe293..3da94926 100644
+index 85935dea..4eb27782 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -161,6 +161,31 @@ static int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int len)
@@ -59,10 +61,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index 2236bc6b..d4a0f006 100644
+index ac2de858..924f273b 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -958,6 +958,8 @@ struct mt76_dev {
+@@ -973,6 +973,8 @@ struct mt76_dev {
  		struct mt76_usb usb;
  		struct mt76_sdio sdio;
  	};
@@ -71,7 +73,7 @@
  };
  
  #define MT76_MAX_AMSDU_NUM 8
-@@ -1231,6 +1233,7 @@ void mt76_eeprom_override(struct mt76_phy *phy);
+@@ -1246,6 +1248,7 @@ void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_data_from_mtd(struct mt76_dev *dev, void *eep, int offset, int len);
  int mt76_get_of_data_from_nvmem(struct mt76_dev *dev, void *eep,
  				const char *cell_name, int len);
@@ -80,7 +82,7 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 17485bfc..5dc55646 100644
+index b091e30c..111fe401 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -82,10 +82,17 @@ static int mt7996_check_eeprom(struct mt7996_dev *dev)
@@ -103,8 +105,8 @@
 +	}
  
  	switch (mt76_chip(&dev->mt76)) {
- 	case 0x7990:
-@@ -152,7 +159,10 @@ mt7996_eeprom_load_default(struct mt7996_dev *dev)
+ 	case 0x7992:
+@@ -234,7 +241,10 @@ mt7996_eeprom_check_or_use_default(struct mt7996_dev *dev, bool use_default)
  		return ret;
  
  	if (!fw || !fw->data) {
@@ -116,75 +118,32 @@
  		ret = -EINVAL;
  		goto out;
  	}
-@@ -166,18 +176,45 @@ out:
- 	return ret;
- }
- 
-+static int mt7996_eeprom_load_flash(struct mt7996_dev *dev)
-+{
-+	int ret = 1;
-+
-+	/* return > 0 for load success, return 0 for load failed, return < 0 for non memory */
-+	dev->bin_file_mode = mt76_check_bin_file_mode(&dev->mt76);
-+	if (dev->bin_file_mode) {
-+		dev->mt76.eeprom.size = MT7996_EEPROM_SIZE;
-+		dev->mt76.eeprom.data = devm_kzalloc(dev->mt76.dev, dev->mt76.eeprom.size,
-+						     GFP_KERNEL);
-+		if (!dev->mt76.eeprom.data)
-+			return -ENOMEM;
-+
-+		if (mt7996_eeprom_load_default(dev))
-+			return 0;
-+
-+		if (mt7996_check_eeprom(dev))
-+			return 0;
-+	} else {
-+		ret = mt76_eeprom_init(&dev->mt76, MT7996_EEPROM_SIZE);
-+	}
-+
-+	return ret;
-+}
-+
- int mt7996_eeprom_check_fw_mode(struct mt7996_dev *dev)
- {
- 	u8 *eeprom;
- 	int ret;
- 
- 	/* load eeprom in flash or bin file mode to determine fw mode */
--	ret = mt76_eeprom_init(&dev->mt76, MT7996_EEPROM_SIZE);
-+	ret = mt7996_eeprom_load_flash(dev);
-+
- 	if (ret < 0)
- 		return ret;
- 
- 	if (ret) {
- 		dev->flash_mode = true;
-+		dev->eeprom_mode = dev->bin_file_mode ? BIN_FILE_MODE : FLASH_MODE;
- 		eeprom = dev->mt76.eeprom.data;
- 		/* testmode enable priority: eeprom field > module parameter */
- 		dev->testmode_enable = !mt7996_check_eeprom(dev) ? eeprom[MT_EE_TESTMODE_EN] :
-@@ -211,6 +248,7 @@ static int mt7996_eeprom_load(struct mt7996_dev *dev)
- 			if (ret && ret != -EINVAL)
- 				return ret;
+@@ -369,6 +379,7 @@ static int mt7996_eeprom_load(struct mt7996_dev *dev)
+ 				goto out;
+ 			}
  		}
 +		dev->eeprom_mode = EFUSE_MODE;
  	}
  
- 	return mt7996_check_eeprom(dev);
-@@ -337,6 +375,59 @@ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy)
+ out:
+@@ -477,22 +488,69 @@ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy)
  	return mt7996_eeprom_parse_band_config(phy);
  }
  
+-int mt7996_eeprom_init(struct mt7996_dev *dev)
 +static int
 +mt7996_eeprom_load_precal_binfile(struct mt7996_dev *dev, u32 offs, u32 size)
-+{
+ {
 +	const struct firmware *fw = NULL;
-+	int ret;
-+
+ 	int ret;
+ 
+-	ret = mt7996_get_chip_sku(dev);
 +	ret = request_firmware(&fw, dev->mt76.bin_file_name, dev->mt76.dev);
-+	if (ret)
-+		return ret;
-+
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = mt7996_eeprom_load(dev);
+-	if (ret < 0)
 +	if (!fw || !fw->data) {
 +		dev_err(dev->mt76.dev, "Invalid bin (bin file mode), load precal fail\n");
 +		ret = -EINVAL;
@@ -223,28 +182,30 @@
 +
 +	ret = mt76_get_of_data_from_mtd(mdev, dev->cal, offs, size);
 +	if (!ret)
-+		return ret;
-+
+ 		return ret;
+ 
+-	ret = mt7996_eeprom_load_precal(dev);
 +	return mt76_get_of_data_from_nvmem(mdev, dev->cal, "precal", size);
 +}
 +
- int mt7996_eeprom_init(struct mt7996_dev *dev)
- {
- 	int ret;
-@@ -351,6 +442,8 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
- 			return ret;
++int mt7996_eeprom_init(struct mt7996_dev *dev)
++{
++	int ret;
++
++	ret = mt7996_eeprom_load(dev);
+ 	if (ret)
+ 		return ret;
  
- 		dev_warn(dev->mt76.dev, "eeprom load fail, use default bin\n");
-+		dev->bin_file_mode = false;
-+		dev->eeprom_mode = DEFAULT_BIN_MODE;
- 		ret = mt7996_eeprom_load_default(dev);
- 		if (ret)
- 			return ret;
++	mt7996_eeprom_load_precal(dev);
++
+ 	ret = mt7996_eeprom_parse_hw_cap(dev, &dev->phy);
+ 	if (ret < 0)
+ 		return ret;
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index b19ff068..8f0f87b6 100644
+index f3a9618b..e90180a0 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
-@@ -102,6 +102,13 @@ enum mt7996_eeprom_band {
+@@ -104,6 +104,13 @@ enum mt7996_eeprom_band {
  	MT_EE_BAND_SEL_6GHZ,
  };
  
@@ -259,10 +220,10 @@
  mt7996_get_channel_group_5g(int channel)
  {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index ff7edcd8..3abb932d 100644
+index a1a30b33..efb4e74c 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -394,6 +394,8 @@ struct mt7996_dev {
+@@ -404,6 +404,8 @@ struct mt7996_dev {
  	} wed_rro;
  
  	bool testmode_enable;
@@ -271,7 +232,7 @@
  
  	bool ibf;
  	u8 fw_debug_wm;
-@@ -522,6 +524,7 @@ irqreturn_t mt7996_irq_handler(int irq, void *dev_instance);
+@@ -554,6 +556,7 @@ irqreturn_t mt7996_irq_handler(int irq, void *dev_instance);
  u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif);
  int mt7996_register_device(struct mt7996_dev *dev);
  void mt7996_unregister_device(struct mt7996_dev *dev);
@@ -280,7 +241,7 @@
  int mt7996_eeprom_check_fw_mode(struct mt7996_dev *dev);
  int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 3558641c..c096fb6c 100644
+index ad89eccd..078ff279 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2797,6 +2797,44 @@ static const struct file_operations mt7996_txpower_path_fops = {
@@ -339,7 +300,7 @@
  				    mt7996_wtbl_read);
  
 diff --git a/testmode.h b/testmode.h
-index d6601cdc..5d677f8c 100644
+index 3348d0d5..6d79832a 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -16,7 +16,7 @@
@@ -352,5 +313,5 @@
   * @MT76_TM_ATTR_BAND_IDX: band idx of the chip (u8)
   *
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0033-mtk-mt76-mt7996-add-testmode-ZWDFS-verification-supp.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0021-mtk-mt76-mt7996-add-testmode-ZWDFS-verification-supp.patch
similarity index 98%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0033-mtk-mt76-mt7996-add-testmode-ZWDFS-verification-supp.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0021-mtk-mt76-mt7996-add-testmode-ZWDFS-verification-supp.patch
index 7496e93..3178946 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0033-mtk-mt76-mt7996-add-testmode-ZWDFS-verification-supp.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0021-mtk-mt76-mt7996-add-testmode-ZWDFS-verification-supp.patch
@@ -1,7 +1,7 @@
-From e758524d7b6b53da37a6ab7d392896bf34901b46 Mon Sep 17 00:00:00 2001
+From 0ae2d7c2cf18d4ca07b05c7ea14fc0c2ea9e5ad7 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 22 Mar 2023 11:19:52 +0800
-Subject: [PATCH 033/199] mtk: mt76: mt7996: add testmode ZWDFS verification
+Subject: [PATCH 021/223] mtk: mt76: mt7996: add testmode ZWDFS verification
  support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -15,10 +15,10 @@
  6 files changed, 326 insertions(+), 12 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index d4a0f006..0cf5d573 100644
+index 924f273b..2805d758 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -787,6 +787,14 @@ struct mt76_testmode_data {
+@@ -801,6 +801,14 @@ struct mt76_testmode_data {
  	} cfg;
  
  	u8 aid;
@@ -34,10 +34,10 @@
  
  struct mt76_vif {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 3abb932d..70aafb29 100644
+index efb4e74c..1fe681cf 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -287,6 +287,7 @@ struct mt7996_phy {
+@@ -297,6 +297,7 @@ struct mt7996_phy {
  
  	struct mt76_mib_stats mib;
  	struct mt76_channel_state state_ts;
@@ -46,7 +46,7 @@
  	bool has_aux_rx;
  
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index a756ee10..836211f9 100644
+index 6969cba6..c4874eb3 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
 @@ -17,6 +17,12 @@ enum {
@@ -486,5 +486,5 @@
  	FIELD_NESTED_RO(STATS, stats, "",
  			.print_extra = print_extra_stats),
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0022-mtk-mt76-add-sanity-check-to-prevent-kernel-crash.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0022-mtk-mt76-add-sanity-check-to-prevent-kernel-crash.patch
deleted file mode 100644
index feb14a6..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0022-mtk-mt76-add-sanity-check-to-prevent-kernel-crash.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From 8c9cbc14f8956087c0262f0e9e943689a6b6b00a Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 30 Oct 2023 11:06:19 +0800
-Subject: [PATCH 022/199] mtk: mt76: add sanity check to prevent kernel crash
-
-wcid may not be initialized when mac80211 calls mt76.tx and it would lead to
-kernel crash.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- tx.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/tx.c b/tx.c
-index 5cf6edee..ab42f69b 100644
---- a/tx.c
-+++ b/tx.c
-@@ -345,6 +345,14 @@ mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
- 
- 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, phy->band_idx);
- 
-+	if (!wcid->tx_pending.prev || !wcid->tx_pending.next) {
-+		dev_warn(phy->dev->dev, "Un-initialized STA %pM wcid %d in mt76_tx\n",
-+			 sta->addr, wcid->idx);
-+
-+		ieee80211_free_txskb(phy->hw, skb);
-+		return;
-+	}
-+
- 	spin_lock_bh(&wcid->tx_pending.lock);
- 	__skb_queue_tail(&wcid->tx_pending, skb);
- 	spin_unlock_bh(&wcid->tx_pending.lock);
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0034-mtk-mt76-mt7996-support-eagle-ZWDFS-on-iFEM.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0022-mtk-mt76-mt7996-support-eagle-ZWDFS-on-iFEM.patch
similarity index 86%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0034-mtk-mt76-mt7996-support-eagle-ZWDFS-on-iFEM.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0022-mtk-mt76-mt7996-support-eagle-ZWDFS-on-iFEM.patch
index f4a098a..4bc7d88 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0034-mtk-mt76-mt7996-support-eagle-ZWDFS-on-iFEM.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0022-mtk-mt76-mt7996-support-eagle-ZWDFS-on-iFEM.patch
@@ -1,7 +1,7 @@
-From e6fcd98cab30ba065534890cdb5f0775db054fcd Mon Sep 17 00:00:00 2001
+From 0ed31af01bf9c0f5f040222fabee17af063f9eb8 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 5 Jul 2023 10:00:17 +0800
-Subject: [PATCH 034/199] mtk: mt76: mt7996: support eagle ZWDFS on iFEM
+Subject: [PATCH 022/223] mtk: mt76: mt7996: support eagle ZWDFS on iFEM
 
 Fix the case that control channel is not first chan during first
 interface setup.
@@ -15,10 +15,10 @@
  3 files changed, 67 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 5a6ba6a6..5b1984ac 100644
+index e65b5bd7..ad4cd5dd 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -1448,6 +1448,61 @@ mt7996_twt_teardown_request(struct ieee80211_hw *hw,
+@@ -1433,6 +1433,61 @@ mt7996_twt_teardown_request(struct ieee80211_hw *hw,
  	mutex_unlock(&dev->mt76.mutex);
  }
  
@@ -80,7 +80,7 @@
  static int
  mt7996_set_radar_background(struct ieee80211_hw *hw,
  			    struct cfg80211_chan_def *chandef)
-@@ -1456,6 +1511,7 @@ mt7996_set_radar_background(struct ieee80211_hw *hw,
+@@ -1441,6 +1496,7 @@ mt7996_set_radar_background(struct ieee80211_hw *hw,
  	struct mt7996_dev *dev = phy->dev;
  	int ret = -EINVAL;
  	bool running;
@@ -88,7 +88,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
  
-@@ -1468,13 +1524,14 @@ mt7996_set_radar_background(struct ieee80211_hw *hw,
+@@ -1453,13 +1509,14 @@ mt7996_set_radar_background(struct ieee80211_hw *hw,
  		goto out;
  	}
  
@@ -105,7 +105,7 @@
  		ret = mt7996_mcu_rdd_background_enable(phy, NULL);
  		if (ret)
  			goto out;
-@@ -1483,7 +1540,9 @@ mt7996_set_radar_background(struct ieee80211_hw *hw,
+@@ -1468,7 +1525,9 @@ mt7996_set_radar_background(struct ieee80211_hw *hw,
  			goto update_phy;
  	}
  
@@ -117,10 +117,10 @@
  		goto out;
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 3b4c45bb..8ac7adf6 100644
+index 59a24478..7ef6bb1f 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -372,12 +372,14 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -382,12 +382,14 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
  	if (!mphy)
  		return;
  
@@ -138,10 +138,10 @@
  }
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 70aafb29..439c57f4 100644
+index 1fe681cf..2ec72496 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -397,6 +397,7 @@ struct mt7996_dev {
+@@ -407,6 +407,7 @@ struct mt7996_dev {
  	bool testmode_enable;
  	bool bin_file_mode;
  	u8 eeprom_mode;
@@ -150,5 +150,5 @@
  	bool ibf;
  	u8 fw_debug_wm;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0023-mtk-mt76-mt7996-refactor-eeprom-loading-flow-for-sku.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0023-mtk-mt76-mt7996-refactor-eeprom-loading-flow-for-sku.patch
new file mode 100644
index 0000000..b8a0ee1
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0023-mtk-mt76-mt7996-refactor-eeprom-loading-flow-for-sku.patch
@@ -0,0 +1,151 @@
+From f23ac5fb50b0764391e2aebeab3c748eb46a5dbf Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 11 Mar 2024 10:43:03 +0800
+Subject: [PATCH 023/223] mtk: mt76: mt7996: refactor eeprom loading flow for
+ sku checking
+
+Add eeprom sku checking mechanism to avoid using the
+wrong eeprom in flash/binfile mode
+The fields listed below will be checked by comparing the loaded eeprom to the default bin
+1. FEM type
+2. MAC address (warning for using default MAC address)
+3. RF path & streams
+   (to distinguish cases such as BE7200 4i5i, BE6500 3i5i, and BE5040 2i3i)
+
+1. Reset eeprom content before loading efuse
+   eeprom array might contain incomplete data read from flash or
+   binfile, which is not overwritten since this block is invalid
+   in efuse.
+2. Remove testmode default bin since it is unnecessary
+   Not used in logan. Directly load normal mode default bin is fine.
+   Also, this way is better since we don't need to put testmode default
+   eeprom for each sku (especially kite's sku) in our SDK.
+3. Set testmode_en field for default bin mode for consistency sake
+
+1.
+Fix efuse mode txpower = 0 issue
+This fix might be changed if fw supports efuse merge for buffer mode = EE_MODE_EFUSE
+2.
+Add Eagle BE19000 ifem default bin, add Eagle default bin bootstrip
+
+Change-Id: If1905086f2a876a593d07f23a5facad35067f94a
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7996/eeprom.c      | 37 +++----------------------------------
+ mt7996/mcu.c         |  2 +-
+ mt7996/mtk_debugfs.c |  3 +--
+ 3 files changed, 5 insertions(+), 37 deletions(-)
+
+diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
+index 111fe401..da30be33 100644
+--- a/mt7996/eeprom.c
++++ b/mt7996/eeprom.c
+@@ -50,33 +50,14 @@ const u32 dpd_6g_bw320_ch_num = ARRAY_SIZE(dpd_6g_ch_list_bw320);
+ 
+ static int mt7996_check_eeprom(struct mt7996_dev *dev)
+ {
+-#define FEM_INT				0
+-#define FEM_EXT				3
+ 	u8 *eeprom = dev->mt76.eeprom.data;
+-	u8 i, fem[__MT_MAX_BAND], fem_type;
+ 	u16 val = get_unaligned_le16(eeprom);
+ 
+-	for (i = 0; i < __MT_MAX_BAND; i++)
+-		fem[i] = eeprom[MT_EE_WIFI_CONF + 6 + i] & MT_EE_WIFI_PA_LNA_CONFIG;
+-
+ 	switch (val) {
+ 	case 0x7990:
+ 		return is_mt7996(&dev->mt76) ? 0 : -EINVAL;
+ 	case 0x7992:
+-		if (dev->fem_type == MT7996_FEM_UNSET)
+-			return is_mt7992(&dev->mt76) ? 0 : -EINVAL;
+-
+-		if (fem[0] == FEM_EXT && fem[1] == FEM_EXT)
+-			fem_type = MT7996_FEM_EXT;
+-		else if (fem[0] == FEM_INT && fem[1] == FEM_INT)
+-			fem_type = MT7996_FEM_INT;
+-		else if (fem[0] == FEM_INT && fem[1] == FEM_EXT)
+-			fem_type = MT7996_FEM_MIX;
+-		else
+-			return -EINVAL;
+-
+-		return (is_mt7992(&dev->mt76) ? 0 : -EINVAL) |
+-		       (dev->fem_type == fem_type ? 0 : -EINVAL);
++		return is_mt7992(&dev->mt76) ? 0 : -EINVAL;
+ 	default:
+ 		return -EINVAL;
+ 	}
+@@ -84,16 +65,6 @@ static int mt7996_check_eeprom(struct mt7996_dev *dev)
+ 
+ const char *mt7996_eeprom_name(struct mt7996_dev *dev)
+ {
+-	if (dev->bin_file_mode)
+-		return dev->mt76.bin_file_name;
+-
+-	if (dev->testmode_enable) {
+-		if (is_mt7992(&dev->mt76))
+-			return MT7992_EEPROM_DEFAULT_TM;
+-		else
+-			return MT7996_EEPROM_DEFAULT_TM;
+-	}
+-
+ 	switch (mt76_chip(&dev->mt76)) {
+ 	case 0x7992:
+ 		switch (dev->var.type) {
+@@ -241,10 +212,7 @@ mt7996_eeprom_check_or_use_default(struct mt7996_dev *dev, bool use_default)
+ 		return ret;
+ 
+ 	if (!fw || !fw->data) {
+-		if (dev->bin_file_mode)
+-			dev_err(dev->mt76.dev, "Invalid bin (bin file mode)\n");
+-		else
+-			dev_err(dev->mt76.dev, "Invalid default bin\n");
++		dev_err(dev->mt76.dev, "Invalid default bin\n");
+ 		ret = -EINVAL;
+ 		goto out;
+ 	}
+@@ -254,6 +222,7 @@ mt7996_eeprom_check_or_use_default(struct mt7996_dev *dev, bool use_default)
+ 
+ 	dev_warn(dev->mt76.dev, "eeprom load fail, use default bin\n");
+ 	memcpy(eeprom, fw->data, MT7996_EEPROM_SIZE);
++	dev->bin_file_mode = false;
+ 	dev->flash_mode = true;
+ 	dev->eeprom_mode = DEFAULT_BIN_MODE;
+ 	eeprom[MT_EE_TESTMODE_EN] = dev->testmode_enable;
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 7ef6bb1f..1d4655ed 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -3522,7 +3522,7 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
+ 				 &req, sizeof(req), true);
+ }
+ 
+-static int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
++int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
+ {
+ #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
+ #define PAGE_IDX_MASK		GENMASK(4, 2)
+diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
+index 078ff279..60ec6bd4 100644
+--- a/mt7996/mtk_debugfs.c
++++ b/mt7996/mtk_debugfs.c
+@@ -340,7 +340,6 @@ static int mt7996_dump_version(struct seq_file *s, void *data)
+ 	u16 adie_chip_id, adie_chip_ver;
+ 	int adie_idx;
+ 	static const char * const fem_type[] = {
+-		[MT7996_FEM_UNSET] = "N/A",
+ 		[MT7996_FEM_EXT] = "eFEM",
+ 		[MT7996_FEM_INT] = "iFEM",
+ 		[MT7996_FEM_MIX] = "mixed FEM",
+@@ -2826,7 +2825,7 @@ static int mt7996_show_eeprom_mode(struct seq_file *s, void *data)
+ 			seq_printf(s, "   flash mode\n");
+ 		break;
+ 	case BIN_FILE_MODE:
+-		seq_printf(s, "   bin file mode\n   filename = %s\n", mt7996_eeprom_name(dev));
++		seq_printf(s, "   bin file mode\n   filename = %s\n", dev->mt76.bin_file_name);
+ 		break;
+ 	default:
+ 		break;
+-- 
+2.45.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0036-mtk-mt76-mt7996-add-vendor-commands-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0024-mtk-mt76-mt7996-add-vendor-commands-support.patch
similarity index 97%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0036-mtk-mt76-mt7996-add-vendor-commands-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0024-mtk-mt76-mt7996-add-vendor-commands-support.patch
index 99e6cf8..77a5a5c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0036-mtk-mt76-mt7996-add-vendor-commands-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0024-mtk-mt76-mt7996-add-vendor-commands-support.patch
@@ -1,7 +1,7 @@
-From 77147d23626a24c3f3dff7a5afb57fc155a8e092 Mon Sep 17 00:00:00 2001
+From 4ae9d91e5d5faa7600dfa6fefc331e582d74b5c9 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 13 Dec 2022 15:17:43 +0800
-Subject: [PATCH 036/199] mtk: mt76: mt7996: add vendor commands support
+Subject: [PATCH 024/223] mtk: mt76: mt7996: add vendor commands support
 
 mtk: wifi: mt76: fix muru_onoff as all enabled by default
 
@@ -38,7 +38,7 @@
  mt76_connac_mcu.h |   2 +
  mt7996/Makefile   |   3 +-
  mt7996/init.c     |   9 +
- mt7996/mac.c      |   4 +
+ mt7996/mac.c      |   5 +
  mt7996/main.c     |   4 +
  mt7996/mcu.c      |  37 ++-
  mt7996/mcu.h      |  14 +
@@ -47,15 +47,15 @@
  mt7996/mtk_mcu.h  |  15 +
  mt7996/vendor.c   | 805 ++++++++++++++++++++++++++++++++++++++++++++++
  mt7996/vendor.h   | 153 +++++++++
- 12 files changed, 1180 insertions(+), 6 deletions(-)
+ 12 files changed, 1181 insertions(+), 6 deletions(-)
  create mode 100644 mt7996/vendor.c
  create mode 100644 mt7996/vendor.h
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index ea60e19c..5a1b4d0d 100644
+index fcacd546..e9afc27b 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1264,6 +1264,7 @@ enum {
+@@ -1269,6 +1269,7 @@ enum {
  	MCU_UNI_CMD_REG_ACCESS = 0x0d,
  	MCU_UNI_CMD_CHIP_CONFIG = 0x0e,
  	MCU_UNI_CMD_POWER_CTRL = 0x0f,
@@ -63,7 +63,7 @@
  	MCU_UNI_CMD_RX_HDR_TRANS = 0x12,
  	MCU_UNI_CMD_SER = 0x13,
  	MCU_UNI_CMD_TWT = 0x14,
-@@ -1296,6 +1297,7 @@ enum {
+@@ -1301,6 +1302,7 @@ enum {
  	MCU_UNI_CMD_PER_STA_INFO = 0x6d,
  	MCU_UNI_CMD_ALL_STA_INFO = 0x6e,
  	MCU_UNI_CMD_ASSERT_DUMP = 0x6f,
@@ -90,7 +90,7 @@
  mt7996e-$(CONFIG_DEV_COREDUMP) += coredump.o
  mt7996e-$(CONFIG_NL80211_TESTMODE) += testmode.o
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 3b816070..0cf054df 100644
+index 994d74cc..703c7af0 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -380,6 +380,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -101,7 +101,7 @@
  
  	hw->sta_data_size = sizeof(struct mt7996_sta);
  	hw->vif_data_size = sizeof(struct mt7996_vif);
-@@ -631,6 +632,10 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
+@@ -632,6 +633,10 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
  	if (ret)
  		goto error;
  
@@ -112,7 +112,7 @@
  	ret = mt76_register_phy(mphy, true, mt76_rates,
  				ARRAY_SIZE(mt76_rates));
  	if (ret)
-@@ -1447,6 +1452,10 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1463,6 +1468,10 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	dev->mt76.test_ops = &mt7996_testmode_ops;
  #endif
  
@@ -124,13 +124,14 @@
  				   ARRAY_SIZE(mt76_rates));
  	if (ret)
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index fd8bce0e..f0c0db75 100644
+index 789caa44..05d02af1 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -679,6 +679,10 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
- 			if (ieee80211_has_a4(fc) && is_mesh && status->amsdu)
+@@ -680,6 +680,11 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
  				*qos &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;
  		}
+ 		skb_set_mac_header(skb, (unsigned char *)hdr - skb->data);
++
 +#ifdef CONFIG_MTK_VENDOR
 +		if (phy->amnt_ctrl.enable && !ieee80211_is_beacon(fc))
 +			mt7996_vendor_amnt_fill_rx(phy, skb);
@@ -139,10 +140,10 @@
  		status->flag |= RX_FLAG_8023;
  		mt7996_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 5b1984ac..a51fc696 100644
+index ad4cd5dd..67eab3df 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -764,6 +764,10 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -749,6 +749,10 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	mt7996_mac_wtbl_update(dev, idx,
  			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
  
@@ -154,10 +155,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 7542953f..a08b24f6 100644
+index 1d4655ed..808ea178 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1378,6 +1378,8 @@ static void
+@@ -1388,6 +1388,8 @@ static void
  mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
  {
@@ -166,7 +167,7 @@
  	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
-@@ -1389,11 +1391,14 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1399,11 +1401,14 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
  
  	muru = (struct sta_rec_muru *)tlv;
@@ -186,7 +187,7 @@
  
  	if (sta->deflink.vht_cap.vht_supported)
  		muru->mimo_dl.vht_mu_bfee =
-@@ -4966,3 +4971,25 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
+@@ -4998,3 +5003,25 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
  	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(SCS),
  				 &req, sizeof(req), false);
  }
@@ -247,10 +248,10 @@
  };
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 2994c1a5..f0604368 100644
+index 2ec72496..a559c76f 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -258,6 +258,34 @@ struct mt7996_wed_rro_session_id {
+@@ -267,6 +267,34 @@ struct mt7996_wed_rro_session_id {
  	u16 id;
  };
  
@@ -285,7 +286,7 @@
  struct mt7996_phy {
  	struct mt76_phy *mt76;
  	struct mt7996_dev *dev;
-@@ -300,6 +328,8 @@ struct mt7996_phy {
+@@ -309,6 +337,8 @@ struct mt7996_phy {
  	bool sku_limit_en;
  	bool sku_path_en;
  
@@ -294,7 +295,7 @@
  #ifdef CONFIG_NL80211_TESTMODE
  	struct {
  		u32 *reg_backup;
-@@ -314,6 +344,10 @@ struct mt7996_phy {
+@@ -323,6 +353,10 @@ struct mt7996_phy {
  		u8 spe_idx;
  	} test;
  #endif
@@ -305,7 +306,7 @@
  };
  
  struct mt7996_dev {
-@@ -740,6 +774,25 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+@@ -771,6 +805,25 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  			 bool hif2, int *irq);
  u32 mt7996_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  
@@ -1424,5 +1425,5 @@
 +
 +#endif
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0037-mtk-mt76-mt7996-add-debugfs-for-fw-coredump.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0025-mtk-mt76-mt7996-add-debugfs-for-fw-coredump.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0037-mtk-mt76-mt7996-add-debugfs-for-fw-coredump.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0025-mtk-mt76-mt7996-add-debugfs-for-fw-coredump.patch
index 29bd31f..fa9b52b 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0037-mtk-mt76-mt7996-add-debugfs-for-fw-coredump.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0025-mtk-mt76-mt7996-add-debugfs-for-fw-coredump.patch
@@ -1,7 +1,7 @@
-From 1fd0460d51166d09eb2a6b7551479724665b88b8 Mon Sep 17 00:00:00 2001
+From 63a51fd94d291a40f0514580c8f75f5e80d80886 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Fri, 19 May 2023 14:56:07 +0800
-Subject: [PATCH 037/199] mtk: mt76: mt7996: add debugfs for fw coredump.
+Subject: [PATCH 025/223] mtk: mt76: mt7996: add debugfs for fw coredump.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
@@ -64,10 +64,10 @@
  	desc += scnprintf(buff + desc, bufsz - desc,
  			  "\nlet's dump firmware SER statistics...\n");
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index f0c0db75..d9e8e751 100644
+index 05d02af1..e9f3942f 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2089,15 +2089,36 @@ void mt7996_mac_dump_work(struct work_struct *work)
+@@ -2101,15 +2101,36 @@ void mt7996_mac_dump_work(struct work_struct *work)
  	struct mt7996_dev *dev;
  
  	dev = container_of(work, struct mt7996_dev, dump_work);
@@ -107,7 +107,7 @@
  void mt7996_reset(struct mt7996_dev *dev)
  {
  	if (!dev->recovery.hw_init_done)
-@@ -2115,6 +2136,7 @@ void mt7996_reset(struct mt7996_dev *dev)
+@@ -2127,6 +2148,7 @@ void mt7996_reset(struct mt7996_dev *dev)
  
  		mt7996_irq_disable(dev, MT_INT_MCU_CMD);
  		queue_work(dev->mt76.wq, &dev->dump_work);
@@ -132,11 +132,11 @@
  	UNI_CMD_SER_ENABLE = 1,
  	UNI_CMD_SER_SET,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index f0604368..ce54080a 100644
+index a559c76f..edd2ce33 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -138,6 +138,14 @@ enum mt7996_ram_type {
- 	__MT7996_RAM_TYPE_MAX,
+@@ -147,6 +147,14 @@ enum mt7996_fem_type {
+ 	MT7996_FEM_MIX,
  };
  
 +enum mt7996_coredump_state {
@@ -150,7 +150,7 @@
  enum mt7996_txq_id {
  	MT7996_TXQ_FWDL = 16,
  	MT7996_TXQ_MCU_WM,
-@@ -393,6 +401,7 @@ struct mt7996_dev {
+@@ -402,6 +410,7 @@ struct mt7996_dev {
  
  	/* protects coredump data */
  	struct mutex dump_mutex;
@@ -158,7 +158,7 @@
  #ifdef CONFIG_DEV_COREDUMP
  	struct {
  		struct mt7996_crash_data *crash_data[__MT7996_RAM_TYPE_MAX];
-@@ -580,6 +589,7 @@ void mt7996_init_txpower(struct mt7996_phy *phy);
+@@ -611,6 +620,7 @@ void mt7996_init_txpower(struct mt7996_phy *phy);
  int mt7996_txbf_init(struct mt7996_dev *dev);
  int mt7996_get_chip_sku(struct mt7996_dev *dev);
  void mt7996_reset(struct mt7996_dev *dev);
@@ -167,5 +167,5 @@
  int mt7996_mcu_init(struct mt7996_dev *dev);
  int mt7996_mcu_init_firmware(struct mt7996_dev *dev);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0038-mtk-mt76-mt7996-Add-mt7992-coredump-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0026-mtk-mt76-mt7996-Add-mt7992-coredump-support.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0038-mtk-mt76-mt7996-Add-mt7992-coredump-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0026-mtk-mt76-mt7996-Add-mt7992-coredump-support.patch
index 4f8a8b5..68f5e09 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0038-mtk-mt76-mt7996-Add-mt7992-coredump-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0026-mtk-mt76-mt7996-Add-mt7992-coredump-support.patch
@@ -1,11 +1,12 @@
-From 52bdf0e4a54de52c7223a99e950cda7e9c823f69 Mon Sep 17 00:00:00 2001
+From b421656ce76c53eb44a3e43d8399bb614109ad85 Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Mon, 25 Dec 2023 15:17:49 +0800
-Subject: [PATCH 038/199] mtk: mt76: mt7996: Add mt7992 coredump support
+Subject: [PATCH 026/223] mtk: mt76: mt7996: Add mt7992 coredump support
 
 1. Add mt7992 coredump support
 2. fixed if new ic have not support coredump, it may cause crash when remove module
 
+Change-Id: I2ae5425aac6be8ff69a2c411e796be308b558b6b
 Signed-off-by: Rex Lu <rex.lu@mediatek.com>
 ---
  mt7996/coredump.c | 80 ++++++++++++++++++++++++++++++++++++++---------
@@ -146,10 +147,10 @@
  }
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index ce54080a..01a5abdf 100644
+index edd2ce33..c011e8ec 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -229,6 +229,7 @@ struct mt7996_vif {
+@@ -238,6 +238,7 @@ struct mt7996_vif {
  struct mt7996_crash_data {
  	guid_t guid;
  	struct timespec64 timestamp;
@@ -158,5 +159,5 @@
  	u8 *memdump_buf;
  	size_t memdump_buf_len;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0039-mtk-mt76-mt7996-add-support-for-runtime-set-in-band-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0027-mtk-mt76-mt7996-add-support-for-runtime-set-in-band-.patch
similarity index 81%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0039-mtk-mt76-mt7996-add-support-for-runtime-set-in-band-.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0027-mtk-mt76-mt7996-add-support-for-runtime-set-in-band-.patch
index 51039d9..cec3aec 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0039-mtk-mt76-mt7996-add-support-for-runtime-set-in-band-.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0027-mtk-mt76-mt7996-add-support-for-runtime-set-in-band-.patch
@@ -1,7 +1,7 @@
-From 532677abd25d3412eb0ac4da432ab2ef59a532f3 Mon Sep 17 00:00:00 2001
+From 83a6bd94bc5c54c1ddb9fb2db0c2746d3bb5812e Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 6 Jun 2023 16:57:10 +0800
-Subject: [PATCH 039/199] mtk: mt76: mt7996: add support for runtime set
+Subject: [PATCH 027/223] mtk: mt76: mt7996: add support for runtime set
  in-band discovery
 
 with this patch, AP can runtime set inband discovery via hostapd_cli
@@ -17,10 +17,10 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index a08b24f6..40860f9f 100644
+index 808ea178..eb065ffc 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2612,8 +2612,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+@@ -2624,8 +2624,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
  	if (IS_ERR(rskb))
  		return PTR_ERR(rskb);
  
@@ -30,7 +30,7 @@
  		interval = vif->bss_conf.fils_discovery.max_interval;
  		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
  	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-@@ -2648,7 +2647,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+@@ -2660,7 +2659,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
  	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
  	discov->tx_interval = interval;
  	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
@@ -40,5 +40,5 @@
  
  	buf = (u8 *)tlv + sizeof(*discov);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0040-mtk-mt76-mt7996-add-support-spatial-reuse-debug-comm.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0028-mtk-mt76-mt7996-add-support-spatial-reuse-debug-comm.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0040-mtk-mt76-mt7996-add-support-spatial-reuse-debug-comm.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0028-mtk-mt76-mt7996-add-support-spatial-reuse-debug-comm.patch
index 6bbd559..d09b064 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0040-mtk-mt76-mt7996-add-support-spatial-reuse-debug-comm.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0028-mtk-mt76-mt7996-add-support-spatial-reuse-debug-comm.patch
@@ -1,7 +1,7 @@
-From cb8632560f8055d6af142932abf723d54af5c25e Mon Sep 17 00:00:00 2001
+From a3f223f025ce2abc2dc0e42ab835a8cc5ef6d65a Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 10 Jul 2023 11:47:29 +0800
-Subject: [PATCH 040/199] mtk: mt76: mt7996: add support spatial reuse debug
+Subject: [PATCH 028/223] mtk: mt76: mt7996: add support spatial reuse debug
  commands
 
 This commit adds the following debug commands in debugfs:
@@ -16,6 +16,7 @@
 To learn more details of these commands, please check:
 https://wiki.mediatek.inc/display/APKB/mt76+Phy+feature+debug+Cheetsheet#mt76PhyfeaturedebugCheetsheet-SpatialReuse
 
+Change-Id: I5bf83013ea2788dfc93caaaef08486a4f97a3649
 ---
  mt76_connac_mcu.h    |   1 +
  mt7996/main.c        |   6 +++
@@ -27,10 +28,10 @@
  7 files changed, 270 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 5a1b4d0d..726f5e9d 100644
+index e9afc27b..dd63d4a0 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1051,6 +1051,7 @@ enum {
+@@ -1056,6 +1056,7 @@ enum {
  	MCU_UNI_EVENT_BSS_BEACON_LOSS = 0x0c,
  	MCU_UNI_EVENT_SCAN_DONE = 0x0e,
  	MCU_UNI_EVENT_RDD_REPORT = 0x11,
@@ -39,7 +40,7 @@
  	MCU_UNI_EVENT_TX_DONE = 0x2d,
  	MCU_UNI_EVENT_BF = 0x33,
 diff --git a/mt7996/main.c b/mt7996/main.c
-index a51fc696..f7819a85 100644
+index 67eab3df..6203e800 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -6,6 +6,9 @@
@@ -63,10 +64,10 @@
  						dev->dbg.sku_disable ? 0 : phy->sku_limit_en);
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 40860f9f..362af7aa 100644
+index eb065ffc..78462729 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -717,6 +717,14 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -727,6 +727,14 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	case MCU_UNI_EVENT_WED_RRO:
  		mt7996_mcu_wed_rro_event(dev, skb);
  		break;
@@ -82,10 +83,10 @@
  	case MCU_UNI_EVENT_TESTMODE_CTRL:
  		mt7996_tm_rf_test_event(dev, skb);
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 01a5abdf..20fa4221 100644
+index c011e8ec..356935b2 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -357,6 +357,10 @@ struct mt7996_phy {
+@@ -366,6 +366,10 @@ struct mt7996_phy {
  	spinlock_t amnt_lock;
  	struct mt7996_air_monitor_ctrl amnt_ctrl;
  #endif
@@ -96,7 +97,7 @@
  };
  
  struct mt7996_dev {
-@@ -807,6 +811,8 @@ enum edcca_bw_id {
+@@ -838,6 +842,8 @@ enum edcca_bw_id {
  #ifdef CONFIG_MTK_DEBUG
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir);
  int mt7996_mcu_muru_dbg_info(struct mt7996_dev *dev, u16 item, u8 val);
@@ -106,10 +107,10 @@
  
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 053005dd..06dc794e 100644
+index 60ec6bd4..13ea6274 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -2835,6 +2835,83 @@ static int mt7996_show_eeprom_mode(struct seq_file *s, void *data)
+@@ -2834,6 +2834,83 @@ static int mt7996_show_eeprom_mode(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -193,7 +194,7 @@
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -2915,6 +2992,11 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -2914,6 +2991,11 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
  	debugfs_create_file("scs_enable", 0200, dir, phy, &fops_scs_enable);
  
@@ -393,5 +394,5 @@
  
  #endif
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0041-mtk-mt76-mt7996-Establish-BA-in-VO-queue.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0029-mtk-mt76-mt7996-Establish-BA-in-VO-queue.patch
similarity index 65%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0041-mtk-mt76-mt7996-Establish-BA-in-VO-queue.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0029-mtk-mt76-mt7996-Establish-BA-in-VO-queue.patch
index 9a0dd2a..800f01f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0041-mtk-mt76-mt7996-Establish-BA-in-VO-queue.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0029-mtk-mt76-mt7996-Establish-BA-in-VO-queue.patch
@@ -1,17 +1,17 @@
-From c8d8e7a0cc7d030616f27bd5cbb0cb9c8e51b746 Mon Sep 17 00:00:00 2001
+From 836be9f533e2d5441088435050d0400711311301 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 1 Aug 2023 16:02:28 +0800
-Subject: [PATCH 041/199] mtk: mt76: mt7996: Establish BA in VO queue
+Subject: [PATCH 029/223] mtk: mt76: mt7996: Establish BA in VO queue
 
 ---
  mt7996/mac.c | 2 --
  1 file changed, 2 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index d9e8e751..8226e443 100644
+index e9f3942f..428ccb1a 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1041,8 +1041,6 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
+@@ -1053,8 +1053,6 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
  		return;
  
  	tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
@@ -21,5 +21,5 @@
  	if (is_8023) {
  		fc = IEEE80211_FTYPE_DATA |
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0042-mtk-mt76-mt7996-report-tx-and-rx-byte-to-tpt_led.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0030-mtk-mt76-mt7996-report-tx-and-rx-byte-to-tpt_led.patch
similarity index 80%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0042-mtk-mt76-mt7996-report-tx-and-rx-byte-to-tpt_led.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0030-mtk-mt76-mt7996-report-tx-and-rx-byte-to-tpt_led.patch
index daa1f6b..009845a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0042-mtk-mt76-mt7996-report-tx-and-rx-byte-to-tpt_led.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0030-mtk-mt76-mt7996-report-tx-and-rx-byte-to-tpt_led.patch
@@ -1,17 +1,17 @@
-From 495a443a1a4b9411c9926dbea98a3e54c0afc81c Mon Sep 17 00:00:00 2001
+From ccc0d8ca18a2fa4039f664f3806146aca97fd5a2 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Sat, 12 Aug 2023 04:17:22 +0800
-Subject: [PATCH 042/199] mtk: mt76: mt7996: report tx and rx byte to tpt_led
+Subject: [PATCH 030/223] mtk: mt76: mt7996: report tx and rx byte to tpt_led
 
 ---
  mt7996/mcu.c | 15 +++++++++++----
  1 file changed, 11 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 362af7aa..548f6660 100644
+index 78462729..9e6f4d13 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -525,6 +525,8 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -535,6 +535,8 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  		u8 ac;
  		u16 wlan_idx;
  		struct mt76_wcid *wcid;
@@ -20,7 +20,7 @@
  
  		switch (le16_to_cpu(res->tag)) {
  		case UNI_ALL_STA_TXRX_RATE:
-@@ -544,11 +546,16 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -554,11 +556,16 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  			if (!wcid)
  				break;
  
@@ -42,5 +42,5 @@
  			break;
  		case UNI_ALL_STA_TXRX_MSDU_COUNT:
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0043-mtk-mt76-mt7996-support-dup-wtbl.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0031-mtk-mt76-mt7996-support-dup-wtbl.patch
similarity index 82%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0043-mtk-mt76-mt7996-support-dup-wtbl.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0031-mtk-mt76-mt7996-support-dup-wtbl.patch
index b3afa44..482a4b3 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0043-mtk-mt76-mt7996-support-dup-wtbl.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0031-mtk-mt76-mt7996-support-dup-wtbl.patch
@@ -1,8 +1,9 @@
-From bd575b80c7fb5acfb16c3180f0f7cea4a07eff42 Mon Sep 17 00:00:00 2001
+From 17af6c5607c9b5191323d600c1fa7456b8741830 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Sep 2023 00:52:46 +0800
-Subject: [PATCH 043/199] mtk: mt76: mt7996: support dup wtbl
+Subject: [PATCH 031/223] mtk: mt76: mt7996: support dup wtbl
 
+Change-Id: I14ba41ace8341c23c1cfb6e9c4fbb2d5e93a5714
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mt7996/init.c    |  1 +
@@ -11,10 +12,10 @@
  3 files changed, 25 insertions(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 0cf054df..0201d9fc 100644
+index 703c7af0..3421326a 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -688,6 +688,7 @@ static void mt7996_init_work(struct work_struct *work)
+@@ -689,6 +689,7 @@ static void mt7996_init_work(struct work_struct *work)
  	mt7996_mcu_set_eeprom(dev);
  	mt7996_mac_init(dev);
  	mt7996_txbf_init(dev);
@@ -23,10 +24,10 @@
  
  void mt7996_wfsys_reset(struct mt7996_dev *dev)
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 20fa4221..9ec2090b 100644
+index 356935b2..7bc5504e 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -813,6 +813,7 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir);
+@@ -844,6 +844,7 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir);
  int mt7996_mcu_muru_dbg_info(struct mt7996_dev *dev, u16 item, u8 val);
  int mt7996_mcu_set_sr_enable(struct mt7996_phy *phy, u8 action, u64 val, bool set);
  void mt7996_mcu_rx_sr_event(struct mt7996_dev *dev, struct sk_buff *skb);
@@ -67,5 +68,5 @@
 +}
  #endif
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0044-mtk-mt76-try-more-times-when-send-message-timeout.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0032-mtk-mt76-try-more-times-when-send-message-timeout.patch
similarity index 68%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0044-mtk-mt76-try-more-times-when-send-message-timeout.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0032-mtk-mt76-try-more-times-when-send-message-timeout.patch
index 6b7f250..cf35c3d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0044-mtk-mt76-try-more-times-when-send-message-timeout.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0032-mtk-mt76-try-more-times-when-send-message-timeout.patch
@@ -1,14 +1,16 @@
-From 9344da8ab6885e336d0fbc7c90f59feeb580362d Mon Sep 17 00:00:00 2001
+From 6a7e30cf77280b1eb10fd17347ba33759f0d9148 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Nov 2023 11:10:10 +0800
-Subject: [PATCH 044/199] mtk: mt76: try more times when send message timeout.
+Subject: [PATCH 032/223] mtk: mt76: try more times when send message timeout.
 
+Change-Id: Ib7c01e6c9f74f68d8404a3d8bada9e5a10c4e232
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
  dma.c        |  7 ++++--
- mcu.c        | 65 ++++++++++++++++++++++++++++++++++++----------------
- mt7996/mac.c | 37 ++++++++++--------------------
- 3 files changed, 62 insertions(+), 47 deletions(-)
+ mcu.c        | 70 +++++++++++++++++++++++++++-------------------------
+ mt7996/mac.c | 37 +++++++++------------------
+ mt7996/mcu.c |  1 +
+ 4 files changed, 54 insertions(+), 61 deletions(-)
 
 diff --git a/dma.c b/dma.c
 index 56044639..66c000ef 100644
@@ -38,7 +40,7 @@
  
  static int
 diff --git a/mcu.c b/mcu.c
-index fa4b0544..2926f715 100644
+index 2bcce21f..fed363d0 100644
 --- a/mcu.c
 +++ b/mcu.c
 @@ -4,6 +4,7 @@
@@ -49,22 +51,33 @@
  #include <linux/moduleparam.h>
  
  struct sk_buff *
-@@ -74,35 +75,59 @@ int mt76_mcu_skb_send_and_get_msg(struct mt76_dev *dev, struct sk_buff *skb,
- 				  int cmd, bool wait_resp,
+@@ -75,7 +76,7 @@ int mt76_mcu_skb_send_and_get_msg(struct mt76_dev *dev, struct sk_buff *skb,
  				  struct sk_buff **ret_skb)
  {
-+#define MT76_MSG_MAX_RETRY_CNT 3
- 	unsigned long expires;
--	int ret, seq;
-+	int ret, seq, retry_cnt;
+ 	unsigned int retry = 0;
+-	struct sk_buff *orig_skb = NULL;
 +	struct sk_buff *skb_tmp;
-+	bool retry = wait_resp && is_mt7996(dev);
+ 	unsigned long expires;
+ 	int ret, seq;
  
- 	if (ret_skb)
- 		*ret_skb = NULL;
+@@ -84,48 +85,49 @@ int mt76_mcu_skb_send_and_get_msg(struct mt76_dev *dev, struct sk_buff *skb,
  
  	mutex_lock(&dev->mcu.mutex);
+ 
+-	if (dev->mcu_ops->mcu_skb_prepare_msg) {
+-		orig_skb = skb;
+-		ret = dev->mcu_ops->mcu_skb_prepare_msg(dev, skb, cmd, &seq);
+-		if (ret < 0)
++	while (retry < dev->mcu_ops->max_retry) {
++		skb_tmp = mt76_mcu_msg_alloc(dev, skb->data, skb->len);
++		if (!skb_tmp)
+ 			goto out;
+-	}
 -
+-retry:
+-	/* orig skb might be needed for retry, mcu_skb_send_msg consumes it */
+-	if (orig_skb)
+-		skb_get(orig_skb);
 -	ret = dev->mcu_ops->mcu_skb_send_msg(dev, skb, cmd, &seq);
 -	if (ret < 0)
 -		goto out;
@@ -72,22 +85,33 @@
 -	if (!wait_resp) {
 -		ret = 0;
 -		goto out;
-+	retry_cnt = retry ? MT76_MSG_MAX_RETRY_CNT : 1;
-+	while (retry_cnt) {
-+		skb_tmp = mt76_mcu_msg_alloc(dev, skb->data, skb->len);
-+		if (!skb_tmp)
-+			goto out;
-+
-+		if (retry && retry_cnt < MT76_MSG_MAX_RETRY_CNT) {
+-	}
+-
+-	expires = jiffies + dev->mcu.timeout;
+ 
+-	do {
+-		skb = mt76_mcu_get_response(dev, expires);
+-		if (!skb && !test_bit(MT76_MCU_RESET, &dev->phy.state) &&
+-		    orig_skb && retry++ < dev->mcu_ops->max_retry) {
++		if (wait_resp && retry) {
 +			if (test_bit(MT76_MCU_RESET, &dev->phy.state))
 +				usleep_range(200000, 500000);
-+			dev_err(dev->dev, "send message %08x timeout, try again.\n", cmd);
-+		}
-+
+ 			dev_err(dev->dev, "Retry message %08x (seq %d)\n",
+ 				cmd, seq);
+-			skb = orig_skb;
+-			goto retry;
+ 		}
+ 
+-		ret = dev->mcu_ops->mcu_parse_response(dev, cmd, skb, seq);
+-		if (!ret && ret_skb)
+-			*ret_skb = skb;
+-		else
+-			dev_kfree_skb(skb);
+-	} while (ret == -EAGAIN);
 +		ret = dev->mcu_ops->mcu_skb_send_msg(dev, skb_tmp, cmd, &seq);
 +		if (ret < 0 && ret != -EAGAIN)
 +			goto out;
-+
+ 
 +		if (!wait_resp) {
 +			ret = 0;
 +			goto out;
@@ -110,30 +134,20 @@
 +				goto out;
 +		} while (ret == -EAGAIN);
 +
-+		retry_cnt--;
- 	}
++		retry++;
++	}
  
--	expires = jiffies + dev->mcu.timeout;
--
--	do {
--		skb = mt76_mcu_get_response(dev, expires);
--		ret = dev->mcu_ops->mcu_parse_response(dev, cmd, skb, seq);
--		if (!ret && ret_skb)
--			*ret_skb = skb;
--		else
--			dev_kfree_skb(skb);
--	} while (ret == -EAGAIN);
--
  out:
+-	dev_kfree_skb(orig_skb);
 +	dev_kfree_skb(skb);
  	mutex_unlock(&dev->mcu.mutex);
  
  	return ret;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 8226e443..503a562a 100644
+index 428ccb1a..3c9ee0c8 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1793,13 +1793,24 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
+@@ -1805,13 +1805,24 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
  	phy3 = mt7996_phy3(dev);
  	dev->recovery.hw_full_reset = true;
  
@@ -159,7 +173,7 @@
  	cancel_work_sync(&dev->wed_rro.work);
  	cancel_delayed_work_sync(&dev->mphy.mac_work);
  	if (phy2)
-@@ -1902,16 +1913,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1914,16 +1925,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	set_bit(MT76_MCU_RESET, &dev->mphy.state);
  	wake_up(&dev->mt76.mcu.wait);
  
@@ -176,7 +190,7 @@
  	mt76_worker_disable(&dev->mt76.tx_worker);
  	mt76_for_each_q_rx(&dev->mt76, i) {
  		if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
-@@ -1922,8 +1923,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1934,8 +1935,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	}
  	napi_disable(&dev->mt76.tx_napi);
  
@@ -185,7 +199,7 @@
  	mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_STOPPED);
  
  	if (mt7996_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) {
-@@ -1996,20 +1995,8 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2008,20 +2007,8 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	if (phy3)
  		ieee80211_wake_queues(phy3->mt76->hw);
  
@@ -206,6 +220,18 @@
  	dev_info(dev->mt76.dev,"\n%s L1 SER recovery completed.",
  		 wiphy_name(dev->mt76.hw->wiphy));
  }
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 9e6f4d13..08234b3a 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -3139,6 +3139,7 @@ int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
+ int mt7996_mcu_init(struct mt7996_dev *dev)
+ {
+ 	static const struct mt76_mcu_ops mt7996_mcu_ops = {
++		.max_retry = 3,
+ 		.headroom = sizeof(struct mt76_connac2_mcu_txd), /* reuse */
+ 		.mcu_skb_send_msg = mt7996_mcu_send_message,
+ 		.mcu_parse_response = mt7996_mcu_parse_response,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0045-mtk-mt76-mt7996-add-SER-overlap-handle.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0033-mtk-mt76-mt7996-add-SER-overlap-handle.patch
similarity index 61%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0045-mtk-mt76-mt7996-add-SER-overlap-handle.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0033-mtk-mt76-mt7996-add-SER-overlap-handle.patch
index d574613..b422e69 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0045-mtk-mt76-mt7996-add-SER-overlap-handle.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0033-mtk-mt76-mt7996-add-SER-overlap-handle.patch
@@ -1,35 +1,20 @@
-From 4a53b4dbb4c727e79752c35c588cb6ebb82d072a Mon Sep 17 00:00:00 2001
+From 0b6f875816c6849eaadae1cbf974ee1327af04f2 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 21 Nov 2023 09:55:46 +0800
-Subject: [PATCH 045/199] mtk: mt76: mt7996: add SER overlap handle
+Subject: [PATCH 033/223] mtk: mt76: mt7996: add SER overlap handle
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
- mcu.c           |  3 ++-
  mt7996/mac.c    | 11 +++++++++++
  mt7996/mcu.c    |  8 ++++++++
  mt7996/mt7996.h |  2 ++
- 4 files changed, 23 insertions(+), 1 deletion(-)
+ 3 files changed, 21 insertions(+)
 
-diff --git a/mcu.c b/mcu.c
-index 2926f715..a7afa2d7 100644
---- a/mcu.c
-+++ b/mcu.c
-@@ -94,7 +94,8 @@ int mt76_mcu_skb_send_and_get_msg(struct mt76_dev *dev, struct sk_buff *skb,
- 		if (retry && retry_cnt < MT76_MSG_MAX_RETRY_CNT) {
- 			if (test_bit(MT76_MCU_RESET, &dev->phy.state))
- 				usleep_range(200000, 500000);
--			dev_err(dev->dev, "send message %08x timeout, try again.\n", cmd);
-+			dev_err(dev->dev, "send message %08x timeout, try again(%d).\n",
-+				cmd, (MT76_MSG_MAX_RETRY_CNT - retry_cnt));
- 		}
- 
- 		ret = dev->mcu_ops->mcu_skb_send_msg(dev, skb_tmp, cmd, &seq);
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 503a562a..63408421 100644
+index 3c9ee0c8..2ce9e839 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1894,6 +1894,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1906,6 +1906,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
@@ -37,7 +22,7 @@
  	dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.",
  		 wiphy_name(dev->mt76.hw->wiphy));
  
-@@ -1911,6 +1912,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1923,6 +1924,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
  
  	set_bit(MT76_RESET, &dev->mphy.state);
  	set_bit(MT76_MCU_RESET, &dev->mphy.state);
@@ -48,7 +33,7 @@
  	wake_up(&dev->mt76.mcu.wait);
  
  	mt76_worker_disable(&dev->mt76.tx_worker);
-@@ -2106,6 +2111,9 @@ void mt7996_coredump(struct mt7996_dev *dev, u8 state)
+@@ -2118,6 +2123,9 @@ void mt7996_coredump(struct mt7996_dev *dev, u8 state)
  
  void mt7996_reset(struct mt7996_dev *dev)
  {
@@ -58,7 +43,7 @@
  	if (!dev->recovery.hw_init_done)
  		return;
  
-@@ -2125,6 +2133,9 @@ void mt7996_reset(struct mt7996_dev *dev)
+@@ -2137,6 +2145,9 @@ void mt7996_reset(struct mt7996_dev *dev)
  		return;
  	}
  
@@ -69,10 +54,10 @@
  	wake_up(&dev->reset_wait);
  }
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 548f6660..49a55bd3 100644
+index 08234b3a..2a647b7b 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -246,6 +246,14 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+@@ -256,6 +256,14 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
  	u32 val;
  	u8 seq;
  
@@ -88,10 +73,10 @@
  
  	seq = ++dev->mt76.mcu.msg_seq & 0xf;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 9ec2090b..47a316e1 100644
+index 7bc5504e..22d44542 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -397,6 +397,8 @@ struct mt7996_dev {
+@@ -406,6 +406,8 @@ struct mt7996_dev {
  	wait_queue_head_t reset_wait;
  	struct {
  		u32 state;
@@ -101,5 +86,5 @@
  		u32 wm_reset_count;
  		bool hw_full_reset:1;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0046-mtk-mt76-mt7996-kite-default-1-pcie-setting.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0034-mtk-mt76-mt7996-kite-default-1-pcie-setting.patch
similarity index 90%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0046-mtk-mt76-mt7996-kite-default-1-pcie-setting.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0034-mtk-mt76-mt7996-kite-default-1-pcie-setting.patch
index a42d9e3..46316e8 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0046-mtk-mt76-mt7996-kite-default-1-pcie-setting.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0034-mtk-mt76-mt7996-kite-default-1-pcie-setting.patch
@@ -1,7 +1,7 @@
-From 3557ff32b5eb1d0625c2e0427946629d631788a4 Mon Sep 17 00:00:00 2001
+From 7077356d80d23d074c2271e5d96697a8d02ad297 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 13 Jul 2023 16:36:36 +0800
-Subject: [PATCH 046/199] mtk: mt76: mt7996: kite default 1-pcie setting
+Subject: [PATCH 034/223] mtk: mt76: mt7996: kite default 1-pcie setting
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -52,5 +52,5 @@
  	if (ret)
  		return ret;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0035-mtk-mt76-mt7996-refactor-eeprom-loading-flow-for-sku.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0035-mtk-mt76-mt7996-refactor-eeprom-loading-flow-for-sku.patch
deleted file mode 100644
index 8444a8e..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0035-mtk-mt76-mt7996-refactor-eeprom-loading-flow-for-sku.patch
+++ /dev/null
@@ -1,468 +0,0 @@
-From 13b9c0e271c358a45444d35e97ad4080c3933e78 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Mon, 11 Mar 2024 10:43:03 +0800
-Subject: [PATCH 035/199] mtk: mt76: mt7996: refactor eeprom loading flow for
- sku checking
-
-Add eeprom sku checking mechanism to avoid using the
-wrong eeprom in flash/binfile mode
-The fields listed below will be checked by comparing the loaded eeprom to the default bin
-1. FEM type
-2. MAC address (warning for using default MAC address)
-3. RF path & streams
-   (to distinguish cases such as BE7200 4i5i, BE6500 3i5i, and BE5040 2i3i)
-
-1. Reset eeprom content before loading efuse
-   eeprom array might contain incomplete data read from flash or
-   binfile, which is not overwritten since this block is invalid
-   in efuse.
-2. Remove testmode default bin since it is unnecessary
-   Not used in logan. Directly load normal mode default bin is fine.
-   Also, this way is better since we don't need to put testmode default
-   eeprom for each sku (especially kite's sku) in our SDK.
-3. Set testmode_en field for default bin mode for consistency sake
-
-1.
-Fix efuse mode txpower = 0 issue
-This fix might be changed if fw supports efuse merge for buffer mode = EE_MODE_EFUSE
-2.
-Add Eagle BE19000 ifem default bin, add Eagle default bin bootstrip
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt7996/eeprom.c      | 207 ++++++++++++++++++++++++-------------------
- mt7996/eeprom.h      |  32 +++++++
- mt7996/mcu.c         |  18 +---
- mt7996/mt7996.h      |   1 +
- mt7996/mtk_debugfs.c |   2 +-
- 5 files changed, 150 insertions(+), 110 deletions(-)
-
-diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 5dc55646..f4641321 100644
---- a/mt7996/eeprom.c
-+++ b/mt7996/eeprom.c
-@@ -50,54 +50,84 @@ const u32 dpd_6g_bw320_ch_num = ARRAY_SIZE(dpd_6g_ch_list_bw320);
- 
- static int mt7996_check_eeprom(struct mt7996_dev *dev)
- {
--#define FEM_INT				0
--#define FEM_EXT				3
- 	u8 *eeprom = dev->mt76.eeprom.data;
--	u8 i, fem[__MT_MAX_BAND], fem_type;
- 	u16 val = get_unaligned_le16(eeprom);
- 
--	for (i = 0; i < __MT_MAX_BAND; i++)
--		fem[i] = eeprom[MT_EE_WIFI_CONF + 6 + i] & MT_EE_WIFI_PA_LNA_CONFIG;
--
- 	switch (val) {
- 	case 0x7990:
- 		return is_mt7996(&dev->mt76) ? 0 : -EINVAL;
- 	case 0x7992:
--		if (dev->fem_type == MT7996_FEM_UNSET)
--			return is_mt7992(&dev->mt76) ? 0 : -EINVAL;
--
--		if (fem[0] == FEM_EXT && fem[1] == FEM_EXT)
--			fem_type = MT7996_FEM_EXT;
--		else if (fem[0] == FEM_INT && fem[1] == FEM_INT)
--			fem_type = MT7996_FEM_INT;
--		else if (fem[0] == FEM_INT && fem[1] == FEM_EXT)
--			fem_type = MT7996_FEM_MIX;
--		else
--			return -EINVAL;
--
--		return (is_mt7992(&dev->mt76) ? 0 : -EINVAL) |
--		       (dev->fem_type == fem_type ? 0 : -EINVAL);
-+		return is_mt7992(&dev->mt76) ? 0 : -EINVAL;
- 	default:
- 		return -EINVAL;
- 	}
- }
- 
--const char *mt7996_eeprom_name(struct mt7996_dev *dev)
-+static int mt7996_check_eeprom_sku(struct mt7996_dev *dev, const u8 *dflt)
- {
--	if (dev->bin_file_mode)
--		return dev->mt76.bin_file_name;
-+#define FEM_INT				0
-+#define FEM_EXT				3
-+	u8 *eeprom = dev->mt76.eeprom.data;
-+	u8 i, fem[__MT_MAX_BAND], fem_type;
-+	u16 mac_addr[__MT_MAX_BAND] = {MT_EE_MAC_ADDR, MT_EE_MAC_ADDR2, MT_EE_MAC_ADDR3};
-+	int max_band = is_mt7996(&dev->mt76) ? __MT_MAX_BAND : 2;
-+
-+	if (dev->fem_type == MT7996_FEM_UNSET)
-+		return -EINVAL;
-+
-+	/* FEM type */
-+	for (i = 0; i < max_band; i++)
-+		fem[i] = eeprom[MT_EE_WIFI_CONF + 6 + i] & MT_EE_WIFI_PA_LNA_CONFIG;
-+
-+	if (fem[0] == FEM_EXT && fem[1] == FEM_EXT)
-+		fem_type = MT7996_FEM_EXT;
-+	else if (fem[0] == FEM_INT && fem[1] == FEM_INT)
-+		fem_type = MT7996_FEM_INT;
-+	else if (fem[0] == FEM_INT && fem[1] == FEM_EXT)
-+		fem_type = MT7996_FEM_MIX;
-+	else
-+		return -EINVAL;
- 
--	if (dev->testmode_enable) {
--		if (is_mt7992(&dev->mt76))
--			return MT7992_EEPROM_DEFAULT_TM;
--		else
--			return MT7996_EEPROM_DEFAULT_TM;
-+	if (dev->fem_type != fem_type)
-+		return -EINVAL;
-+
-+	/* RF path & stream */
-+	for (i = 0; i < max_band; i++) {
-+		u8 path, rx_path, nss;
-+		u8 dflt_path, dflt_rx_path, dflt_nss;
-+
-+		/* MAC address */
-+		if (ether_addr_equal(eeprom + mac_addr[i], dflt + mac_addr[i]))
-+			dev_warn(dev->mt76.dev,
-+				 "Currently using default MAC address for band %d\n", i);
-+
-+		mt7996_parse_eeprom_stream(eeprom, i, &path, &rx_path, &nss);
-+		mt7996_parse_eeprom_stream(dflt, i, &dflt_path, &dflt_rx_path, &dflt_nss);
-+		if (path > dflt_path || rx_path > dflt_rx_path || nss > dflt_nss) {
-+			dev_err(dev->mt76.dev,
-+				"Invalid path/stream configuration for band %d\n", i);
-+			return -EINVAL;
-+		} else if (path < dflt_path || rx_path < dflt_rx_path || nss < dflt_nss) {
-+			dev_warn(dev->mt76.dev,
-+				 "Restricted path/stream configuration for band %d\n", i);
-+			dev_warn(dev->mt76.dev,
-+				 "path: %u/%u, rx_path: %u/%u, nss: %u/%u\n",
-+				 path, dflt_path, rx_path, dflt_rx_path, nss, dflt_nss);
-+		}
- 	}
- 
-+	return 0;
-+}
-+
-+const char *mt7996_eeprom_name(struct mt7996_dev *dev)
-+{
- 	switch (mt76_chip(&dev->mt76)) {
- 	case 0x7990:
- 		if (dev->chip_sku == MT7996_SKU_404)
- 			return MT7996_EEPROM_DEFAULT_404;
-+
-+		if (dev->fem_type == MT7996_FEM_INT)
-+			return MT7996_EEPROM_DEFAULT_INT;
- 		return MT7996_EEPROM_DEFAULT;
- 	case 0x7992:
- 		if (dev->chip_sku == MT7992_SKU_23) {
-@@ -148,21 +178,18 @@ mt7996_get_dpd_per_band_size(struct mt7996_dev *dev, enum nl80211_band band)
- }
- 
- static int
--mt7996_eeprom_load_default(struct mt7996_dev *dev)
-+mt7996_eeprom_load_bin(struct mt7996_dev *dev)
- {
- 	u8 *eeprom = dev->mt76.eeprom.data;
- 	const struct firmware *fw = NULL;
- 	int ret;
- 
--	ret = request_firmware(&fw, mt7996_eeprom_name(dev), dev->mt76.dev);
-+	ret = request_firmware(&fw, dev->mt76.bin_file_name, dev->mt76.dev);
- 	if (ret)
- 		return ret;
- 
- 	if (!fw || !fw->data) {
--		if (dev->bin_file_mode)
--			dev_err(dev->mt76.dev, "Invalid bin (bin file mode)\n");
--		else
--			dev_err(dev->mt76.dev, "Invalid default bin\n");
-+		dev_err(dev->mt76.dev, "Invalid bin %s\n", dev->mt76.bin_file_name);
- 		ret = -EINVAL;
- 		goto out;
- 	}
-@@ -180,7 +207,7 @@ static int mt7996_eeprom_load_flash(struct mt7996_dev *dev)
- {
- 	int ret = 1;
- 
--	/* return > 0 for load success, return 0 for load failed, return < 0 for non memory */
-+	/* return > 0 for load success, return 0 for load failed, return < 0 for no memory */
- 	dev->bin_file_mode = mt76_check_bin_file_mode(&dev->mt76);
- 	if (dev->bin_file_mode) {
- 		dev->mt76.eeprom.size = MT7996_EEPROM_SIZE;
-@@ -189,15 +216,15 @@ static int mt7996_eeprom_load_flash(struct mt7996_dev *dev)
- 		if (!dev->mt76.eeprom.data)
- 			return -ENOMEM;
- 
--		if (mt7996_eeprom_load_default(dev))
--			return 0;
--
--		if (mt7996_check_eeprom(dev))
-+		if (mt7996_eeprom_load_bin(dev))
- 			return 0;
- 	} else {
- 		ret = mt76_eeprom_init(&dev->mt76, MT7996_EEPROM_SIZE);
- 	}
- 
-+	if (mt7996_check_eeprom(dev))
-+		return 0;
-+
- 	return ret;
- }
- 
-@@ -206,30 +233,30 @@ int mt7996_eeprom_check_fw_mode(struct mt7996_dev *dev)
- 	u8 *eeprom;
- 	int ret;
- 
-+	dev->testmode_enable = testmode_enable;
-+
- 	/* load eeprom in flash or bin file mode to determine fw mode */
- 	ret = mt7996_eeprom_load_flash(dev);
-+	if (ret <= 0)
-+		goto out;
- 
--	if (ret < 0)
--		return ret;
--
--	if (ret) {
--		dev->flash_mode = true;
--		dev->eeprom_mode = dev->bin_file_mode ? BIN_FILE_MODE : FLASH_MODE;
--		eeprom = dev->mt76.eeprom.data;
--		/* testmode enable priority: eeprom field > module parameter */
--		dev->testmode_enable = !mt7996_check_eeprom(dev) ? eeprom[MT_EE_TESTMODE_EN] :
--								   testmode_enable;
--	}
-+	dev->flash_mode = true;
-+	dev->eeprom_mode = dev->bin_file_mode ? BIN_FILE_MODE : FLASH_MODE;
-+	eeprom = dev->mt76.eeprom.data;
-+	/* testmode enable priority: eeprom field > module parameter */
-+	dev->testmode_enable = eeprom[MT_EE_TESTMODE_EN];
- 
-+out:
- 	return ret;
- }
- 
- static int mt7996_eeprom_load(struct mt7996_dev *dev)
- {
-+	const struct firmware *fw = NULL;
- 	int ret;
--	u8 free_block_num;
- 	u32 block_num, i;
- 	u32 eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;
-+	u8 free_block_num, *eeprom = dev->mt76.eeprom.data;
- 
- 	/* flash or bin file mode eeprom is loaded before mcu init */
- 	if (!dev->flash_mode) {
-@@ -239,19 +266,49 @@ static int mt7996_eeprom_load(struct mt7996_dev *dev)
- 
- 		/* efuse info isn't enough */
- 		if (free_block_num >= 59)
--			return -EINVAL;
-+			goto dflt;
-+
-+		memset(eeprom, 0, MT7996_EEPROM_SIZE);
-+		/* check if efuse contains valid eeprom data */
-+		if (mt7996_mcu_get_eeprom(dev, 0, NULL) ||
-+		    mt7996_check_eeprom(dev))
-+			goto dflt;
- 
- 		/* read eeprom data from efuse */
- 		block_num = DIV_ROUND_UP(MT7996_EEPROM_SIZE, eeprom_blk_size);
--		for (i = 0; i < block_num; i++) {
-+		for (i = 1; i < block_num; i++) {
- 			ret = mt7996_mcu_get_eeprom(dev, i * eeprom_blk_size, NULL);
- 			if (ret && ret != -EINVAL)
--				return ret;
-+				goto dflt;
- 		}
- 		dev->eeprom_mode = EFUSE_MODE;
- 	}
- 
--	return mt7996_check_eeprom(dev);
-+dflt:
-+	ret = request_firmware(&fw, mt7996_eeprom_name(dev), dev->mt76.dev);
-+	if (ret)
-+		return ret;
-+
-+	if (!fw || !fw->data) {
-+		dev_err(dev->mt76.dev, "Invalid default bin\n");
-+		ret = -EINVAL;
-+		goto out;
-+	}
-+
-+	if (dev->eeprom_mode && !mt7996_check_eeprom_sku(dev, fw->data)) {
-+		ret = 0;
-+		goto out;
-+	}
-+
-+	memcpy(eeprom, fw->data, MT7996_EEPROM_SIZE);
-+	dev->bin_file_mode = false;
-+	dev->flash_mode = true;
-+	dev->eeprom_mode = DEFAULT_BIN_MODE;
-+	eeprom[MT_EE_TESTMODE_EN] = dev->testmode_enable;
-+	dev_warn(dev->mt76.dev, "eeprom load fail, use default bin\n");
-+out:
-+	release_firmware(fw);
-+	return ret;
- }
- 
- static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_dev *dev)
-@@ -323,32 +380,7 @@ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy)
- 	int max_path = 5, max_nss = 4;
- 	int ret;
- 
--	switch (band_idx) {
--	case MT_BAND1:
--		path = FIELD_GET(MT_EE_WIFI_CONF2_TX_PATH_BAND1,
--				 eeprom[MT_EE_WIFI_CONF + 2]);
--		rx_path = FIELD_GET(MT_EE_WIFI_CONF3_RX_PATH_BAND1,
--				    eeprom[MT_EE_WIFI_CONF + 3]);
--		nss = FIELD_GET(MT_EE_WIFI_CONF5_STREAM_NUM_BAND1,
--				eeprom[MT_EE_WIFI_CONF + 5]);
--		break;
--	case MT_BAND2:
--		path = FIELD_GET(MT_EE_WIFI_CONF2_TX_PATH_BAND2,
--				 eeprom[MT_EE_WIFI_CONF + 2]);
--		rx_path = FIELD_GET(MT_EE_WIFI_CONF4_RX_PATH_BAND2,
--				    eeprom[MT_EE_WIFI_CONF + 4]);
--		nss = FIELD_GET(MT_EE_WIFI_CONF5_STREAM_NUM_BAND2,
--				eeprom[MT_EE_WIFI_CONF + 5]);
--		break;
--	default:
--		path = FIELD_GET(MT_EE_WIFI_CONF1_TX_PATH_BAND0,
--				 eeprom[MT_EE_WIFI_CONF + 1]);
--		rx_path = FIELD_GET(MT_EE_WIFI_CONF3_RX_PATH_BAND0,
--				    eeprom[MT_EE_WIFI_CONF + 3]);
--		nss = FIELD_GET(MT_EE_WIFI_CONF4_STREAM_NUM_BAND0,
--				eeprom[MT_EE_WIFI_CONF + 4]);
--		break;
--	}
-+	mt7996_parse_eeprom_stream(eeprom, band_idx, &path, &rx_path, &nss);
- 
- 	if (!path || path > max_path)
- 		path = max_path;
-@@ -437,17 +469,8 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
- 		return ret;
- 
- 	ret = mt7996_eeprom_load(dev);
--	if (ret < 0) {
--		if (ret != -EINVAL)
--			return ret;
--
--		dev_warn(dev->mt76.dev, "eeprom load fail, use default bin\n");
--		dev->bin_file_mode = false;
--		dev->eeprom_mode = DEFAULT_BIN_MODE;
--		ret = mt7996_eeprom_load_default(dev);
--		if (ret)
--			return ret;
--	}
-+	if (ret)
-+		return ret;
- 
- 	ret = mt7996_eeprom_load_precal(dev);
- 	if (ret)
-diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 8f0f87b6..03a4fd07 100644
---- a/mt7996/eeprom.h
-+++ b/mt7996/eeprom.h
-@@ -132,6 +132,38 @@ mt7996_get_channel_group_6g(int channel)
- 	return DIV_ROUND_UP(channel - 29, 32);
- }
- 
-+static inline void
-+mt7996_parse_eeprom_stream(const u8 *eep, int band_idx,
-+			   u8 *path, u8 *rx_path, u8 *nss)
-+{
-+	switch (band_idx) {
-+	case MT_BAND1:
-+		*path = FIELD_GET(MT_EE_WIFI_CONF2_TX_PATH_BAND1,
-+				  eep[MT_EE_WIFI_CONF + 2]);
-+		*rx_path = FIELD_GET(MT_EE_WIFI_CONF3_RX_PATH_BAND1,
-+				     eep[MT_EE_WIFI_CONF + 3]);
-+		*nss = FIELD_GET(MT_EE_WIFI_CONF5_STREAM_NUM_BAND1,
-+				 eep[MT_EE_WIFI_CONF + 5]);
-+		break;
-+	case MT_BAND2:
-+		*path = FIELD_GET(MT_EE_WIFI_CONF2_TX_PATH_BAND2,
-+				  eep[MT_EE_WIFI_CONF + 2]);
-+		*rx_path = FIELD_GET(MT_EE_WIFI_CONF4_RX_PATH_BAND2,
-+				     eep[MT_EE_WIFI_CONF + 4]);
-+		*nss = FIELD_GET(MT_EE_WIFI_CONF5_STREAM_NUM_BAND2,
-+				 eep[MT_EE_WIFI_CONF + 5]);
-+		break;
-+	default:
-+		*path = FIELD_GET(MT_EE_WIFI_CONF1_TX_PATH_BAND0,
-+				  eep[MT_EE_WIFI_CONF + 1]);
-+		*rx_path = FIELD_GET(MT_EE_WIFI_CONF3_RX_PATH_BAND0,
-+				     eep[MT_EE_WIFI_CONF + 3]);
-+		*nss = FIELD_GET(MT_EE_WIFI_CONF4_STREAM_NUM_BAND0,
-+				 eep[MT_EE_WIFI_CONF + 4]);
-+		break;
-+	}
-+}
-+
- enum mt7996_sku_rate_group {
- 	SKU_CCK,
- 	SKU_OFDM,
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 8ac7adf6..7542953f 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -3510,7 +3510,7 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
- 				 &req, sizeof(req), true);
- }
- 
--static int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
-+int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
- {
- #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
- #define PAGE_IDX_MASK		GENMASK(4, 2)
-@@ -3555,22 +3555,6 @@ static int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
- 	return 0;
- }
- 
--int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
--{
--	struct mt7996_mcu_eeprom req = {
--		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
--		.len = cpu_to_le16(sizeof(req) - 4),
--		.buffer_mode = EE_MODE_EFUSE,
--		.format = EE_FORMAT_WHOLE
--	};
--
--	if (dev->flash_mode)
--		return mt7996_mcu_set_eeprom_flash(dev);
--
--	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(EFUSE_CTRL),
--				 &req, sizeof(req), true);
--}
--
- int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf)
- {
- 	struct mt7996_mcu_eeprom_info req = {
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 439c57f4..2994c1a5 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -54,6 +54,7 @@
- #define MT7992_ROM_PATCH_23		"mediatek/mt7996/mt7992_rom_patch_23.bin"
- 
- #define MT7996_EEPROM_DEFAULT		"mediatek/mt7996/mt7996_eeprom.bin"
-+#define MT7996_EEPROM_DEFAULT_INT	"mediatek/mt7996/mt7996_eeprom_2i5i6i.bin"
- #define MT7996_EEPROM_DEFAULT_404	"mediatek/mt7996/mt7996_eeprom_dual_404.bin"
- #define MT7992_EEPROM_DEFAULT		"mediatek/mt7996/mt7992_eeprom_2e5e.bin"
- #define MT7992_EEPROM_DEFAULT_INT	"mediatek/mt7996/mt7992_eeprom_2i5i.bin"
-diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index c096fb6c..053005dd 100644
---- a/mt7996/mtk_debugfs.c
-+++ b/mt7996/mtk_debugfs.c
-@@ -2826,7 +2826,7 @@ static int mt7996_show_eeprom_mode(struct seq_file *s, void *data)
- 			seq_printf(s, "   flash mode\n");
- 		break;
- 	case BIN_FILE_MODE:
--		seq_printf(s, "   bin file mode\n   filename = %s\n", mt7996_eeprom_name(dev));
-+		seq_printf(s, "   bin file mode\n   filename = %s\n", dev->mt76.bin_file_name);
- 		break;
- 	default:
- 		break;
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0047-mtk-mt76-mt7996-support-BF-MIMO-debug-commands.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0035-mtk-mt76-mt7996-support-BF-MIMO-debug-commands.patch
similarity index 98%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0047-mtk-mt76-mt7996-support-BF-MIMO-debug-commands.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0035-mtk-mt76-mt7996-support-BF-MIMO-debug-commands.patch
index 707dbde..c04e36f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0047-mtk-mt76-mt7996-support-BF-MIMO-debug-commands.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0035-mtk-mt76-mt7996-support-BF-MIMO-debug-commands.patch
@@ -1,7 +1,7 @@
-From 8f94ecaccf64cd36ad869a3c4d6fcc56648c12a4 Mon Sep 17 00:00:00 2001
+From 3330075935bef71cea064ce4bf0d4453fdc2301a Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 3 Jan 2023 09:42:07 +0800
-Subject: [PATCH 047/199] mtk: mt76: mt7996: support BF/MIMO debug commands
+Subject: [PATCH 035/223] mtk: mt76: mt7996: support BF/MIMO debug commands
 
 This commit includes the following commands:
 1. starec_bf_read
@@ -17,6 +17,8 @@
 Fw gerrit change:
 https://gerrit.mediatek.inc/c/neptune/firmware/bora/wifi/core/+/8218143
 
+Change-Id: Id6cbaf16e4e6f63238a495ac9f45744e1dd38e9b
+Change-Id: I7ece7399370f2bd22d2564029025baeda27057a5
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -29,10 +31,10 @@
  6 files changed, 989 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 49a55bd3..c47dee02 100644
+index 2a647b7b..baf71b0a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -744,6 +744,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -754,6 +754,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	case MCU_UNI_EVENT_TESTMODE_CTRL:
  		mt7996_tm_rf_test_event(dev, skb);
  		break;
@@ -62,10 +64,10 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 47a316e1..8935ef22 100644
+index 22d44542..8d986dee 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -816,6 +816,11 @@ int mt7996_mcu_muru_dbg_info(struct mt7996_dev *dev, u16 item, u8 val);
+@@ -847,6 +847,11 @@ int mt7996_mcu_muru_dbg_info(struct mt7996_dev *dev, u16 item, u8 val);
  int mt7996_mcu_set_sr_enable(struct mt7996_phy *phy, u8 action, u64 val, bool set);
  void mt7996_mcu_rx_sr_event(struct mt7996_dev *dev, struct sk_buff *skb);
  int mt7996_mcu_set_dup_wtbl(struct mt7996_dev *dev);
@@ -78,10 +80,10 @@
  
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 06dc794e..b3cc8119 100644
+index 13ea6274..51449df4 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -2997,6 +2997,15 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -2996,6 +2996,15 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  	debugfs_create_file("sr_stats", 0400, dir, phy, &mt7996_sr_stats_fops);
  	debugfs_create_file("sr_scene_cond", 0400, dir, phy, &mt7996_sr_scene_cond_fops);
  
@@ -1084,5 +1086,5 @@
  
  enum {
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0048-mtk-mt76-mt7996-add-build-the-following-MURU-mcu-com.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0036-mtk-mt76-mt7996-add-build-the-following-MURU-mcu-com.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0048-mtk-mt76-mt7996-add-build-the-following-MURU-mcu-com.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0036-mtk-mt76-mt7996-add-build-the-following-MURU-mcu-com.patch
index 0914922..1a3d22e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0048-mtk-mt76-mt7996-add-build-the-following-MURU-mcu-com.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0036-mtk-mt76-mt7996-add-build-the-following-MURU-mcu-com.patch
@@ -1,13 +1,14 @@
-From 721ea64eb33f3708435f86501121602666d2caec Mon Sep 17 00:00:00 2001
+From e4a6bac2e1b29a00396adc9bdd1b276eb3e0ee4a Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 13 Jun 2023 14:49:02 +0800
-Subject: [PATCH 048/199] mtk: mt76: mt7996: add build the following MURU mcu
+Subject: [PATCH 036/223] mtk: mt76: mt7996: add build the following MURU mcu
  command tlvs
 
 It includes the following tlvs:
 1. MURU tlv id 0x10, 0x33, 0xC8, 0xC9, 0xCA, 0xCC, 0xCD
 2. BF tlv id 0x1c
 
+Change-Id: I0ae5cbed5b4370d39a6cfca50721873845659006
 ---
  mt7996/mcu.h         |   1 +
  mt7996/mt7996.h      |   3 ++
@@ -29,10 +30,10 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 8935ef22..45ce7db7 100644
+index 8d986dee..ed998c0e 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -821,6 +821,9 @@ void mt7996_mcu_rx_bf_event(struct mt7996_dev *dev, struct sk_buff *skb);
+@@ -852,6 +852,9 @@ void mt7996_mcu_rx_bf_event(struct mt7996_dev *dev, struct sk_buff *skb);
  int mt7996_mcu_set_muru_fixed_rate_enable(struct mt7996_dev *dev, u8 action, int val);
  int mt7996_mcu_set_muru_fixed_rate_parameter(struct mt7996_dev *dev, u8 action, void *para);
  int mt7996_mcu_set_txbf_snd_info(struct mt7996_phy *phy, void *para);
@@ -43,10 +44,10 @@
  
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index b3cc8119..0e029d5d 100644
+index 51449df4..1c4e2c90 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -2912,6 +2912,127 @@ mt7996_sr_scene_cond_show(struct seq_file *file, void *data)
+@@ -2911,6 +2911,127 @@ mt7996_sr_scene_cond_show(struct seq_file *file, void *data)
  }
  DEFINE_SHOW_ATTRIBUTE(mt7996_sr_scene_cond);
  
@@ -174,7 +175,7 @@
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -3006,6 +3127,8 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -3005,6 +3126,8 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  	debugfs_create_file("bf_fbk_rpt", 0600, dir, phy, &fops_bf_fbk_rpt);
  	debugfs_create_file("pfmu_tag_read", 0600, dir, phy, &fops_bf_pfmu_tag_read);
  
@@ -296,5 +297,5 @@
  struct bf_pfmu_tag {
  	__le16 tag;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0049-mtk-mt76-mt7996-add-cert-patch.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0037-mtk-mt76-mt7996-add-cert-patch.patch
similarity index 96%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0049-mtk-mt76-mt7996-add-cert-patch.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0037-mtk-mt76-mt7996-add-cert-patch.patch
index 9a2f167..3e626f4 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0049-mtk-mt76-mt7996-add-cert-patch.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0037-mtk-mt76-mt7996-add-cert-patch.patch
@@ -1,7 +1,7 @@
-From 737ee81737fcefd3abbab0bb628fa9db193b1b34 Mon Sep 17 00:00:00 2001
+From d55504a4ab7bd47bcc4c26859eda52302c4855a7 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 14 Aug 2023 13:36:58 +0800
-Subject: [PATCH 049/199] mtk: mt76: mt7996: add cert patch
+Subject: [PATCH 037/223] mtk: mt76: mt7996: add cert patch
 
 This patch includes TGac and TGax
 
@@ -26,6 +26,7 @@
 Logan set the band_bitmap to 7 in Wi-Fi 7 regardless of whether the UCC
 command specifies an interface.
 
+Change-Id: I9c2a04efa733a6de5c37a21ea71d9715edc27ddb
 Signed-off-by: ye he <ye.he@mediatek.com>
 Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 ---
@@ -41,7 +42,7 @@
  9 files changed, 779 insertions(+), 7 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 63408421..90e8e7b1 100644
+index 2ce9e839..484f91aa 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -10,6 +10,7 @@
@@ -52,7 +53,7 @@
  
  #define to_rssi(field, rcpi)	((FIELD_GET(field, rcpi) - 220) / 2)
  
-@@ -2284,6 +2285,14 @@ void mt7996_mac_update_stats(struct mt7996_phy *phy)
+@@ -2296,6 +2297,14 @@ void mt7996_mac_update_stats(struct mt7996_phy *phy)
  	}
  }
  
@@ -68,10 +69,10 @@
  {
  	struct mt7996_dev *dev = container_of(work, struct mt7996_dev, rc_work);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index f7819a85..39318595 100644
+index 6203e800..dc00cc2f 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -617,6 +617,7 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -602,6 +602,7 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		       bool beacon, bool mcast)
  {
  	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
@@ -79,7 +80,7 @@
  	struct mt76_phy *mphy = hw->priv;
  	u16 rate;
  	u8 i, idx;
-@@ -626,6 +627,9 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -611,6 +612,9 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	if (beacon) {
  		struct mt7996_phy *phy = mphy->priv;
  
@@ -89,7 +90,7 @@
  		/* odd index for driver, even index for firmware */
  		idx = MT7996_BEACON_RATES_TBL + 2 * phy->mt76->band_idx;
  		if (phy->beacon_rate != rate)
-@@ -753,6 +757,10 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -738,6 +742,10 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	u8 band_idx = mvif->phy->mt76->band_idx;
  	int ret, idx;
  
@@ -100,7 +101,7 @@
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7996_WTBL_STA);
  	if (idx < 0)
  		return -ENOSPC;
-@@ -778,7 +786,28 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -763,7 +771,28 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
@@ -131,10 +132,10 @@
  
  void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index c47dee02..ae894ac9 100644
+index baf71b0a..bfedfa3a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1352,6 +1352,10 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1362,6 +1362,10 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  {
  	struct sta_rec_vht *vht;
  	struct tlv *tlv;
@@ -145,7 +146,7 @@
  
  	/* For 6G band, this tlv is necessary to let hw work normally */
  	if (!sta->deflink.he_6ghz_capa.capa && !sta->deflink.vht_cap.vht_supported)
-@@ -1363,6 +1367,9 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1373,6 +1377,9 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
  	vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
  	vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
@@ -155,7 +156,7 @@
  }
  
  static void
-@@ -4443,6 +4450,27 @@ int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val)
+@@ -4476,6 +4483,27 @@ int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val)
  				 &req, sizeof(req), true);
  }
  
@@ -183,7 +184,7 @@
  int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable)
  {
  	struct {
-@@ -5010,6 +5038,18 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -5043,6 +5071,18 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  	val = FIELD_GET(RATE_CFG_VAL, *((u32 *)data));
  
  	switch (mode) {
@@ -239,10 +240,10 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 45ce7db7..00d7991b 100644
+index ed998c0e..a81e275d 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -354,6 +354,7 @@ struct mt7996_phy {
+@@ -363,6 +363,7 @@ struct mt7996_phy {
  	} test;
  #endif
  #ifdef CONFIG_MTK_VENDOR
@@ -250,7 +251,7 @@
  	spinlock_t amnt_lock;
  	struct mt7996_air_monitor_ctrl amnt_ctrl;
  #endif
-@@ -482,6 +483,9 @@ struct mt7996_dev {
+@@ -495,6 +496,9 @@ struct mt7996_dev {
  	} dbg;
  	const struct mt7996_dbg_reg_desc *dbg_reg;
  #endif
@@ -260,7 +261,7 @@
  };
  
  enum {
-@@ -679,6 +683,7 @@ void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb);
+@@ -710,6 +714,7 @@ void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb);
  int mt7996_mcu_get_tx_power_info(struct mt7996_phy *phy, u8 category, void *event);
  int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable);
  void mt7996_mcu_scs_sta_poll(struct work_struct *work);
@@ -268,7 +269,7 @@
  
  static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
  {
-@@ -797,6 +802,10 @@ void mt7996_vendor_register(struct mt7996_phy *phy);
+@@ -828,6 +833,10 @@ void mt7996_vendor_register(struct mt7996_phy *phy);
  void mt7996_vendor_amnt_fill_rx(struct mt7996_phy *phy, struct sk_buff *skb);
  int mt7996_vendor_amnt_sta_remove(struct mt7996_phy *phy,
  				  struct ieee80211_sta *sta);
@@ -279,7 +280,7 @@
  #endif
  
  int mt7996_mcu_edcca_enable(struct mt7996_phy *phy, bool enable);
-@@ -824,6 +833,10 @@ int mt7996_mcu_set_txbf_snd_info(struct mt7996_phy *phy, void *para);
+@@ -855,6 +864,10 @@ int mt7996_mcu_set_txbf_snd_info(struct mt7996_phy *phy, void *para);
  int mt7996_mcu_set_muru_cmd(struct mt7996_dev *dev, u16 action, int val);
  int mt7996_mcu_muru_set_prot_frame_thr(struct mt7996_dev *dev, u32 val);
  int mt7996_mcu_set_bypass_smthint(struct mt7996_phy *phy, u8 val);
@@ -1109,5 +1110,5 @@
 +
 +#endif
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0050-mtk-mt76-mt7996-add-testmode-bf-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0038-mtk-mt76-mt7996-add-testmode-bf-support.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0050-mtk-mt76-mt7996-add-testmode-bf-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0038-mtk-mt76-mt7996-add-testmode-bf-support.patch
index 0ea2133..189f568 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0050-mtk-mt76-mt7996-add-testmode-bf-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0038-mtk-mt76-mt7996-add-testmode-bf-support.patch
@@ -1,7 +1,7 @@
-From 9d99ad5cd521b8cc92e3fd1d48803cb5b211e281 Mon Sep 17 00:00:00 2001
+From 9cbfa34669e0afeabd5b880c3421258540f66356 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 6 Apr 2023 16:40:28 +0800
-Subject: [PATCH 050/199] mtk: mt76: mt7996: add testmode bf support
+Subject: [PATCH 038/223] mtk: mt76: mt7996: add testmode bf support
 
 Add iTest additional bf command
 
@@ -18,6 +18,7 @@
 Add testmode ibf 5T5R support for Kite BE7200 2i5i
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Change-Id: Id528088e029c507d3c9fdb92ddaa99a2e38d9eb3
 ---
  mt76.h               |   5 +
  mt76_connac_mcu.h    |   4 +-
@@ -26,20 +27,20 @@
  mt7996/mt7996.h      |  12 +-
  mt7996/mtk_debugfs.c |   6 +-
  mt7996/mtk_mcu.c     | 143 +++++++-
- mt7996/mtk_mcu.h     | 441 +++++++++++++++++++++++-
+ mt7996/mtk_mcu.h     | 441 ++++++++++++++++++++++-
  mt7996/regs.h        |   3 +
- mt7996/testmode.c    | 796 +++++++++++++++++++++++++++++++++++++++++--
- mt7996/testmode.h    |  19 ++
+ mt7996/testmode.c    | 812 +++++++++++++++++++++++++++++++++++++++++--
+ mt7996/testmode.h    |  19 +
  testmode.c           |  62 ++++
  testmode.h           |  53 +++
  tools/fields.c       |  37 ++
- 14 files changed, 1576 insertions(+), 59 deletions(-)
+ 14 files changed, 1590 insertions(+), 61 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 0cf5d573..36e8834e 100644
+index 2805d758..7beefc59 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -760,6 +760,11 @@ struct mt76_testmode_data {
+@@ -774,6 +774,11 @@ struct mt76_testmode_data {
  	u32 tx_time;
  	u32 tx_ipg;
  
@@ -52,10 +53,10 @@
  	bool ebf;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 726f5e9d..6be7e6a6 100644
+index dd63d4a0..db152167 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -488,7 +488,8 @@ struct sta_rec_bf {
+@@ -493,7 +493,8 @@ struct sta_rec_bf {
  	bool codebook75_mu;
  
  	u8 he_ltf;
@@ -65,7 +66,7 @@
  } __packed;
  
  struct sta_rec_bfee {
-@@ -1291,6 +1292,7 @@ enum {
+@@ -1296,6 +1297,7 @@ enum {
  	MCU_UNI_CMD_VOW = 0x37,
  	MCU_UNI_CMD_PP = 0x38,
  	MCU_UNI_CMD_FIXED_RATE_TABLE = 0x40,
@@ -74,10 +75,10 @@
  	MCU_UNI_CMD_PRECAL_RESULT = 0x47,
  	MCU_UNI_CMD_RRO = 0x57,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index ae894ac9..43604ebc 100644
+index bfedfa3a..c0bd2d13 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1073,7 +1073,12 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -1083,7 +1083,12 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  	bss->hw_bss_idx = idx;
  
  	if (vif->type == NL80211_IFTYPE_MONITOR) {
@@ -91,7 +92,7 @@
  		return 0;
  	}
  
-@@ -4100,7 +4105,6 @@ int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 val, u8 band)
+@@ -4133,7 +4138,6 @@ int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 val, u8 band)
  int mt7996_mcu_set_txbf(struct mt7996_dev *dev, u8 action)
  {
  #define MT7996_BF_MAX_SIZE	sizeof(union bf_tag_tlv)
@@ -171,10 +172,10 @@
  	CMD_BAND_NONE,
  	CMD_BAND_24G,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 00d7991b..1b774f5e 100644
+index a81e275d..32a0ffd8 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -486,6 +486,14 @@ struct mt7996_dev {
+@@ -499,6 +499,14 @@ struct mt7996_dev {
  #ifdef CONFIG_MTK_VENDOR
  	bool cert_mode;
  #endif
@@ -189,7 +190,7 @@
  };
  
  enum {
-@@ -825,7 +833,7 @@ int mt7996_mcu_muru_dbg_info(struct mt7996_dev *dev, u16 item, u8 val);
+@@ -856,7 +864,7 @@ int mt7996_mcu_muru_dbg_info(struct mt7996_dev *dev, u16 item, u8 val);
  int mt7996_mcu_set_sr_enable(struct mt7996_phy *phy, u8 action, u64 val, bool set);
  void mt7996_mcu_rx_sr_event(struct mt7996_dev *dev, struct sk_buff *skb);
  int mt7996_mcu_set_dup_wtbl(struct mt7996_dev *dev);
@@ -198,7 +199,7 @@
  void mt7996_mcu_rx_bf_event(struct mt7996_dev *dev, struct sk_buff *skb);
  int mt7996_mcu_set_muru_fixed_rate_enable(struct mt7996_dev *dev, u8 action, int val);
  int mt7996_mcu_set_muru_fixed_rate_parameter(struct mt7996_dev *dev, u8 action, void *para);
-@@ -837,10 +845,12 @@ int mt7996_mcu_set_rfeature_trig_type(struct mt7996_phy *phy, u8 enable, u8 trig
+@@ -868,10 +876,12 @@ int mt7996_mcu_set_rfeature_trig_type(struct mt7996_phy *phy, u8 enable, u8 trig
  void mt7996_mcu_set_ppdu_tx_type(struct mt7996_phy *phy, u8 ppdu_type);
  void mt7996_mcu_set_nusers_ofdma(struct mt7996_phy *phy, u8 type, u8 ofdma_user_cnt);
  void mt7996_mcu_set_cert(struct mt7996_phy *phy, u8 type);
@@ -212,10 +213,10 @@
 +
  #endif
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 0e029d5d..05cfc6ab 100644
+index 1c4e2c90..a59e3a18 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -2917,7 +2917,7 @@ mt7996_starec_bf_read_set(void *data, u64 wlan_idx)
+@@ -2916,7 +2916,7 @@ mt7996_starec_bf_read_set(void *data, u64 wlan_idx)
  {
  	struct mt7996_phy *phy = data;
  
@@ -224,7 +225,7 @@
  }
  DEFINE_DEBUGFS_ATTRIBUTE(fops_starec_bf_read, NULL,
  			 mt7996_starec_bf_read_set, "%lld\n");
-@@ -2961,7 +2961,7 @@ mt7996_bf_fbk_rpt_set(void *data, u64 wlan_idx)
+@@ -2960,7 +2960,7 @@ mt7996_bf_fbk_rpt_set(void *data, u64 wlan_idx)
  {
  	struct mt7996_phy *phy = data;
  
@@ -233,7 +234,7 @@
  }
  DEFINE_DEBUGFS_ATTRIBUTE(fops_bf_fbk_rpt, NULL,
  			 mt7996_bf_fbk_rpt_set, "%lld\n");
-@@ -2971,7 +2971,7 @@ mt7996_bf_pfmu_tag_read_set(void *data, u64 wlan_idx)
+@@ -2970,7 +2970,7 @@ mt7996_bf_pfmu_tag_read_set(void *data, u64 wlan_idx)
  {
  	struct mt7996_phy *phy = data;
  
@@ -899,7 +900,7 @@
  	__le16 wlan_idx0;
  	__le16 wlan_idx1;
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 8ec1dc1c..263737c5 100644
+index 539e799c..f55d4a94 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -326,6 +326,9 @@ enum offs_rev {
@@ -913,22 +914,28 @@
  #define MT_WF_RMAC_BASE(_band)			__BASE(WF_RMAC_BASE, (_band))
  #define MT_WF_RMAC(_band, ofs)			(MT_WF_RMAC_BASE(_band) + (ofs))
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 836211f9..5cec1eef 100644
+index c4874eb3..bace3afe 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -23,6 +23,7 @@ enum {
+@@ -23,6 +23,10 @@ enum {
  	TM_CHANGED_IPI_THRESHOLD,
  	TM_CHANGED_IPI_PERIOD,
  	TM_CHANGED_IPI_RESET,
 +	TM_CHANGED_TXBF_ACT,
++	TM_CHANGED_TX_ANTENNA,
++	TM_CHANGED_TX_RATE_NSS,
++	TM_CHANGED_TX_RATE_IDX,
  
  	/* must be last */
  	NUM_TM_CHANGED
-@@ -41,25 +42,31 @@ static const u8 tm_change_map[] = {
+@@ -41,25 +45,34 @@ static const u8 tm_change_map[] = {
  	[TM_CHANGED_IPI_THRESHOLD] = MT76_TM_ATTR_IPI_THRESHOLD,
  	[TM_CHANGED_IPI_PERIOD] = MT76_TM_ATTR_IPI_PERIOD,
  	[TM_CHANGED_IPI_RESET] = MT76_TM_ATTR_IPI_RESET,
 +	[TM_CHANGED_TXBF_ACT] = MT76_TM_ATTR_TXBF_ACT,
++	[TM_CHANGED_TX_ANTENNA] = MT76_TM_ATTR_TX_ANTENNA,
++	[TM_CHANGED_TX_RATE_NSS] = MT76_TM_ATTR_TX_RATE_NSS,
++	[TM_CHANGED_TX_RATE_IDX] = MT76_TM_ATTR_TX_RATE_IDX,
  };
  
  static void mt7996_tm_ipi_work(struct work_struct *work);
@@ -965,7 +972,7 @@
  	};
  
  	if (width >= ARRAY_SIZE(width_to_bw))
-@@ -68,26 +75,26 @@ static u32 mt7996_tm_bw_mapping(enum nl80211_chan_width width, enum bw_mapping_m
+@@ -68,26 +81,26 @@ static u32 mt7996_tm_bw_mapping(enum nl80211_chan_width width, enum bw_mapping_m
  	return width_to_bw[width][method];
  }
  
@@ -1006,7 +1013,18 @@
  }
  
  static int
-@@ -239,7 +246,7 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
+@@ -162,8 +175,8 @@ static void
+ mt7996_tm_set_antenna(struct mt7996_phy *phy, u32 func_idx)
+ {
+ #define SPE_INDEX_MASK		BIT(31)
+-#define TX_ANTENNA_MASK		GENMASK(3, 0)
+-#define RX_ANTENNA_MASK		GENMASK(20, 16)		/* RX antenna mask at most 5 bit */
++#define TX_ANTENNA_MASK		GENMASK(4, 0)
++#define RX_ANTENNA_MASK		GENMASK(20, 16)
+ 	struct mt7996_dev *dev = phy->dev;
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	u32 antenna_mask;
+@@ -239,7 +252,7 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
  		INIT_DELAYED_WORK(&phy->ipi_work, mt7996_tm_ipi_work);
  }
  
@@ -1015,7 +1033,7 @@
  mt7996_tm_update_channel(struct mt7996_phy *phy)
  {
  #define CHAN_FREQ_BW_80P80_TAG		(SET_ID(CHAN_FREQ) | BIT(16))
-@@ -303,7 +310,8 @@ mt7996_tm_set_tx_frames(struct mt7996_phy *phy, bool en)
+@@ -303,7 +316,8 @@ mt7996_tm_set_tx_frames(struct mt7996_phy *phy, bool en)
  		mt7996_tm_set(dev, SET_ID(MAC_HEADER), FRAME_CONTROL);
  		mt7996_tm_set(dev, SET_ID(SEQ_CTRL), 0);
  		mt7996_tm_set(dev, SET_ID(TX_COUNT), td->tx_count);
@@ -1025,7 +1043,7 @@
  		mt7996_tm_set(dev, SET_ID(TX_RATE), td->tx_rate_idx);
  
  		if (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_POWER))
-@@ -331,7 +339,8 @@ mt7996_tm_set_tx_frames(struct mt7996_phy *phy, bool en)
+@@ -331,7 +345,8 @@ mt7996_tm_set_tx_frames(struct mt7996_phy *phy, bool en)
  
  		mt7996_tm_set(dev, SET_ID(MAX_PE), 2);
  		mt7996_tm_set(dev, SET_ID(HW_TX_MODE), 0);
@@ -1035,7 +1053,7 @@
  
  		/* trigger firmware to start TX */
  		mt7996_tm_set(dev, SET_ID(COMMAND), RF_CMD(START_TX));
-@@ -373,7 +382,8 @@ mt7996_tm_set_rx_frames(struct mt7996_phy *phy, bool en)
+@@ -373,7 +388,8 @@ mt7996_tm_set_rx_frames(struct mt7996_phy *phy, bool en)
  			return;
  		}
  
@@ -1045,7 +1063,7 @@
  
  		if (td->tx_rate_mode >= MT76_TM_TX_MODE_HE_MU) {
  			if (td->aid)
-@@ -381,7 +391,8 @@ mt7996_tm_set_rx_frames(struct mt7996_phy *phy, bool en)
+@@ -381,7 +397,8 @@ mt7996_tm_set_rx_frames(struct mt7996_phy *phy, bool en)
  			else
  				ret = mt7996_tm_set(dev, SET_ID(RX_MU_AID), RX_MU_DISABLE);
  		}
@@ -1055,7 +1073,7 @@
  		mt7996_tm_set(dev, SET_ID(GI), td->tx_rate_sgi);
  		mt7996_tm_set_antenna(phy, SET_ID(RX_PATH));
  		mt7996_tm_set(dev, SET_ID(MAX_PE), 2);
-@@ -405,7 +416,8 @@ mt7996_tm_set_tx_cont(struct mt7996_phy *phy, bool en)
+@@ -405,7 +422,8 @@ mt7996_tm_set_tx_cont(struct mt7996_phy *phy, bool en)
  
  	if (en) {
  		mt7996_tm_update_channel(phy);
@@ -1065,7 +1083,7 @@
  		mt7996_tm_set(dev, SET_ID(TX_RATE), td->tx_rate_idx);
  		/* fix payload is OFDM */
  		mt7996_tm_set(dev, SET_ID(CONT_WAVE_MODE), CONT_WAVE_MODE_OFDM);
-@@ -1047,6 +1059,730 @@ mt7996_tm_set_ipi(struct mt7996_phy *phy)
+@@ -1047,6 +1065,728 @@ mt7996_tm_set_ipi(struct mt7996_phy *phy)
  	return 0;
  }
  
@@ -1196,6 +1214,7 @@
 +		if (nss == 5) {
 +			td->tx_rate_mode = MT76_TM_TX_MODE_VHT;
 +			td->tx_rate_idx = 7;
++			td->tx_rate_nss = 4;
 +		}
 +	} else {
 +		if (td->is_txbf_dut) {
@@ -1496,8 +1515,8 @@
 +static int
 +mt7996_tm_txbf_profile_update_all(struct mt7996_phy *phy, u16 *val)
 +{
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	u8 nss = hweight8(td->tx_antenna_mask);
++	struct mt7996_dev *dev = phy->dev;
++	u8 nss = hweight16(phy->mt76->chainmask);
 +	u16 pfmu_idx = val[0];
 +	u16 subc_id = val[1];
 +	u16 angle11 = val[2];
@@ -1529,7 +1548,7 @@
 +		phi31 = (s16)(angle41 - angle31);
 +	}
 +
-+	pfmu_data = (s16 *)phy->dev->test.txbf_pfmu_data;
++	pfmu_data = (s16 *)dev->test.txbf_pfmu_data;
 +	pfmu_data += offs;
 +
 +	if (subc_id < 32)
@@ -1544,7 +1563,6 @@
 +		pfmu_data[4] = cpu_to_le16(phi41);
 +
 +	if (subc_id == MT7996_TXBF_SUBCAR_NUM - 1) {
-+		struct mt7996_dev *dev = phy->dev;
 +		struct mt7996_tm_bf_req req = {
 +			.pfmu_data_all = {
 +				.tag = cpu_to_le16(BF_PROFILE_WRITE_20M_ALL_5X5),
@@ -1644,8 +1662,6 @@
 +		if (!td->bf_ever_en) {
 +			mt7996_tm_set_rx_frames(phy, false);
 +			mt7996_tm_set_tx_frames(phy, false);
-+			td->ibf = false;
-+			td->ebf = false;
 +
 +			if (update)
 +				mt7996_tm_txbf_apply_tx(phy, 1, 0, 0, 0);
@@ -1796,12 +1812,20 @@
  static void
  mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
  {
-@@ -1086,6 +1822,8 @@ mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
+@@ -1086,6 +1826,16 @@ mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
  		mt7996_tm_set_ipi(phy);
  	if (changed & BIT(TM_CHANGED_IPI_RESET))
  		mt7996_tm_ipi_hist_ctrl(phy, NULL, RDD_SET_IPI_HIST_RESET);
 +	if (changed & BIT(TM_CHANGED_TXBF_ACT))
 +		mt7996_tm_set_txbf(phy);
++	if (changed & BIT(TM_CHANGED_TX_ANTENNA)) {
++		mt7996_tm_set_antenna(phy, SET_ID(TX_PATH));
++		mt7996_tm_set_antenna(phy, SET_ID(RX_PATH));
++	}
++	if (changed & BIT(TM_CHANGED_TX_RATE_NSS))
++		mt7996_tm_set(dev, SET_ID(NSS), td->tx_rate_nss);
++	if (changed & BIT(TM_CHANGED_TX_RATE_IDX))
++		mt7996_tm_set(dev, SET_ID(TX_RATE), td->tx_rate_idx);
  }
  
  static int
@@ -1849,7 +1873,7 @@
  	__le32 func_data;
  	u8 band_idx;
 diff --git a/testmode.c b/testmode.c
-index 69147f86..b9f71097 100644
+index 69147f86..9a7559bf 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -462,6 +462,44 @@ out:
@@ -1867,7 +1891,7 @@
 +	struct nlattr *cur;
 +	u16 tmp_val[PARAM_UNIT_5X5], *val = td->txbf_param;
 +	int idx, rem, ret, i = 0;
-+	int param_len = td->tx_antenna_mask == 31 ? PARAM_UNIT_5X5 : PARAM_UNIT;
++	int param_len = hweight16(phy->chainmask) == 5 ? PARAM_UNIT_5X5 : PARAM_UNIT;
 +
 +	memset(td->txbf_param, 0, sizeof(td->txbf_param));
 +	nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
@@ -1929,10 +1953,10 @@
  		err = dev->test_ops->set_params(phy, tb, state);
  		if (err)
 diff --git a/testmode.h b/testmode.h
-index 5d677f8c..bda7624a 100644
+index 6d79832a..794a74f9 100644
 --- a/testmode.h
 +++ b/testmode.h
-@@ -286,6 +286,59 @@ enum mt76_testmode_eeprom_action {
+@@ -286,4 +286,57 @@ enum mt76_testmode_eeprom_action {
  	MT76_TM_EEPROM_ACTION_MAX = NUM_MT76_TM_EEPROM_ACTION - 1,
  };
  
@@ -1989,8 +2013,6 @@
 +	MT76_TM_TXBF_ACT_MAX = NUM_MT76_TM_TXBF_ACT - 1,
 +};
 +
- extern const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS];
- 
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
 index 77696ce7..f793d1a5 100644
@@ -2055,5 +2077,5 @@
  	FIELD(u8, OFF_CH_SCAN_CENTER_CH, "offchan_center_ch"),
  	FIELD_ENUM(OFF_CH_SCAN_BW, "offchan_bw", testmode_offchan_bw),
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0051-mtk-mt76-mt7996-add-zwdfs-cert-mode.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0039-mtk-mt76-mt7996-add-zwdfs-cert-mode.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0051-mtk-mt76-mt7996-add-zwdfs-cert-mode.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0039-mtk-mt76-mt7996-add-zwdfs-cert-mode.patch
index 37a4316..7e6ac6a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0051-mtk-mt76-mt7996-add-zwdfs-cert-mode.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0039-mtk-mt76-mt7996-add-zwdfs-cert-mode.patch
@@ -1,7 +1,7 @@
-From 65c9dfe452ee272a2d9c1005cde421def099e478 Mon Sep 17 00:00:00 2001
+From fe038594fb92fae539bf05f86022953810e4e1e6 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 22 Sep 2023 12:33:06 +0800
-Subject: [PATCH 051/199] mtk: mt76: mt7996: add zwdfs cert mode
+Subject: [PATCH 039/223] mtk: mt76: mt7996: add zwdfs cert mode
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -13,10 +13,10 @@
  5 files changed, 100 insertions(+), 12 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 43604ebc..0db30af9 100644
+index c0bd2d13..9e548100 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4499,18 +4499,7 @@ int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable)
+@@ -4532,18 +4532,7 @@ int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable)
  int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
  		       u8 rx_sel, u8 val)
  {
@@ -36,7 +36,7 @@
  		.tag = cpu_to_le16(UNI_RDD_CTRL_PARM),
  		.len = cpu_to_le16(sizeof(req) - 4),
  		.ctrl = cmd,
-@@ -4523,6 +4512,37 @@ int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
+@@ -4556,6 +4545,37 @@ int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
  				 &req, sizeof(req), true);
  }
  
@@ -100,10 +100,10 @@
  	u8 _rsv[4];
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 1b774f5e..5cdc42bf 100644
+index 32a0ffd8..e406dc87 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -523,8 +523,11 @@ enum mt7996_rdd_cmd {
+@@ -536,8 +536,11 @@ enum mt7996_rdd_cmd {
  	RDD_READ_PULSE,
  	RDD_RESUME_BF,
  	RDD_IRQ_OFF,
@@ -115,7 +115,7 @@
  static inline struct mt7996_phy *
  mt7996_hw_phy(struct ieee80211_hw *hw)
  {
-@@ -666,6 +669,8 @@ int mt7996_mcu_set_thermal_protect(struct mt7996_phy *phy, bool enable);
+@@ -697,6 +700,8 @@ int mt7996_mcu_set_thermal_protect(struct mt7996_phy *phy, bool enable);
  int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy);
  int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
  		       u8 rx_sel, u8 val);
@@ -217,5 +217,5 @@
  	BW_SIGNALING_DISABLE,
  	BW_SIGNALING_STATIC,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0052-mtk-mt76-mt7996-add-channel-68-96.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0040-mtk-mt76-mt7996-add-channel-68-96.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0052-mtk-mt76-mt7996-add-channel-68-96.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0040-mtk-mt76-mt7996-add-channel-68-96.patch
index df5e1bf..a97824b 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0052-mtk-mt76-mt7996-add-channel-68-96.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0040-mtk-mt76-mt7996-add-channel-68-96.patch
@@ -1,7 +1,7 @@
-From 6c7bf3990d1a6ff13007178a2624e55fbaf6d823 Mon Sep 17 00:00:00 2001
+From 1836ddf781e91b41f66a1add7110bd24d133817c Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 11 Sep 2023 14:43:07 +0800
-Subject: [PATCH 052/199] mtk: mt76: mt7996: add channel 68 & 96
+Subject: [PATCH 040/223] mtk: mt76: mt7996: add channel 68 & 96
 
 ---
  mac80211.c        |  9 +++++++++
@@ -13,7 +13,7 @@
  6 files changed, 82 insertions(+), 9 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 5b02fa35..6a5201f6 100644
+index 1d2477d6..ee5aa608 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -34,6 +34,15 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
@@ -33,7 +33,7 @@
  	CHAN5G(104, 5520),
  	CHAN5G(108, 5540),
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index f4641321..8a0f6d39 100644
+index da30be33..b71961d9 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -18,6 +18,17 @@ const struct ieee80211_channel dpd_2g_ch_list_bw20[] = {
@@ -62,7 +62,7 @@
  const u32 dpd_5g_bw160_ch_num = ARRAY_SIZE(dpd_5g_ch_list_bw160);
  const u32 dpd_6g_bw160_ch_num = ARRAY_SIZE(dpd_6g_ch_list_bw160);
  const u32 dpd_6g_bw320_ch_num = ARRAY_SIZE(dpd_6g_ch_list_bw320);
-@@ -168,8 +180,8 @@ mt7996_get_dpd_per_band_size(struct mt7996_dev *dev, enum nl80211_band band)
+@@ -191,8 +203,8 @@ mt7996_get_dpd_per_band_size(struct mt7996_dev *dev, enum nl80211_band band)
  	if (band == NL80211_BAND_2GHZ)
  		dpd_size = dpd_2g_bw20_ch_num * DPD_PER_CH_BW20_SIZE;
  	else if (band == NL80211_BAND_5GHZ)
@@ -73,7 +73,7 @@
  	else
  		dpd_size = mphy->sband_6g.sband.n_channels * DPD_PER_CH_BW20_SIZE +
  			   (dpd_6g_bw160_ch_num + dpd_6g_bw320_ch_num) * DPD_PER_CH_GT_BW20_SIZE;
-@@ -431,6 +443,39 @@ out:
+@@ -481,6 +493,39 @@ out:
  	return ret;
  }
  
@@ -114,7 +114,7 @@
  {
  	struct mt76_dev *mdev = &dev->mt76;
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 03a4fd07..9a15b446 100644
+index e90180a0..782d847b 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -67,6 +67,8 @@ enum mt7996_eeprom_field {
@@ -127,10 +127,10 @@
  extern const u32 dpd_5g_bw160_ch_num;
  extern const struct ieee80211_channel dpd_6g_ch_list_bw160[];
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 0db30af9..cf94d39c 100644
+index 9e548100..54a84966 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3769,7 +3769,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3802,7 +3802,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  		chan_list_size = mphy->sband_5g.sband.n_channels;
  		base_offset += dpd_size_2g;
  		if (bw == NL80211_CHAN_WIDTH_160) {
@@ -140,7 +140,7 @@
  			per_chan_size = DPD_PER_CH_GT_BW20_SIZE;
  			cal_id = RF_DPD_FLAT_5G_MEM_CAL;
  			chan_list = dpd_5g_ch_list_bw160;
-@@ -3778,6 +3779,9 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3811,6 +3812,9 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  			/* apply (center channel - 2)'s dpd cal data for bw 40/80 channels */
  			channel -= 2;
  		}
@@ -150,7 +150,7 @@
  		break;
  	case NL80211_BAND_6GHZ:
  		dpd_mask = MT_EE_WIFI_CAL_DPD_6G;
-@@ -3817,6 +3821,10 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3850,6 +3854,10 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  	if (idx == chan_list_size)
  		return -EINVAL;
  
@@ -162,10 +162,10 @@
  
  	for (i = 0; i < per_chan_size / MT_EE_CAL_UNIT; i++) {
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 5cec1eef..95d3bde0 100644
+index bace3afe..6de49afc 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -531,6 +531,11 @@ mt7996_tm_dpd_prek_send_req(struct mt7996_phy *phy, struct mt7996_tm_req *req,
+@@ -537,6 +537,11 @@ mt7996_tm_dpd_prek_send_req(struct mt7996_phy *phy, struct mt7996_tm_req *req,
  	memcpy(&chandef_backup, chandef, sizeof(struct cfg80211_chan_def));
  
  	for (i = 0; i < channel_size; i++) {
@@ -177,7 +177,7 @@
  		memcpy(chandef->chan, &chan_list[i], sizeof(struct ieee80211_channel));
  		chandef->width = width;
  
-@@ -612,7 +617,8 @@ mt7996_tm_dpd_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
+@@ -618,7 +623,8 @@ mt7996_tm_dpd_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
  						  NL80211_CHAN_WIDTH_20, RF_DPD_FLAT_5G_CAL);
  		if (ret)
  			return ret;
@@ -187,7 +187,7 @@
  		wait_event_timeout(mdev->mcu.wait,
  				   dev->cur_prek_offset == wait_on_prek_offset, 30 * HZ);
  
-@@ -868,6 +874,7 @@ mt7996_tm_get_center_chan(struct mt7996_phy *phy, struct cfg80211_chan_def *chan
+@@ -874,6 +880,7 @@ mt7996_tm_get_center_chan(struct mt7996_phy *phy, struct cfg80211_chan_def *chan
  	const struct ieee80211_channel *chan = mphy->sband_5g.sband.channels;
  	u32 bitmap, i, offset, width_mhz, size = mphy->sband_5g.sband.n_channels;
  	u16 first_control = 0, control_chan = chandef->chan->hw_value;
@@ -195,7 +195,7 @@
  
  	bitmap = mt7996_tm_bw_mapping(chandef->width, BW_MAP_NL_TO_CONTROL_BITMAP_5G);
  	if (!bitmap)
-@@ -877,7 +884,9 @@ mt7996_tm_get_center_chan(struct mt7996_phy *phy, struct cfg80211_chan_def *chan
+@@ -883,7 +890,9 @@ mt7996_tm_get_center_chan(struct mt7996_phy *phy, struct cfg80211_chan_def *chan
  	offset = width_mhz / 10 - 2;
  
  	for (i = 0; i < size; i++) {
@@ -206,7 +206,7 @@
  			continue;
  
  		if (control_chan >= chan[i].hw_value)
-@@ -886,7 +895,7 @@ mt7996_tm_get_center_chan(struct mt7996_phy *phy, struct cfg80211_chan_def *chan
+@@ -892,7 +901,7 @@ mt7996_tm_get_center_chan(struct mt7996_phy *phy, struct cfg80211_chan_def *chan
  			break;
  	}
  
@@ -233,5 +233,5 @@
  enum bw_mapping_method {
  	BW_MAP_NL_TO_FW,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0053-mtk-mt76-mt7996-add-kite-testmode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0041-mtk-mt76-mt7996-add-kite-testmode-support.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0053-mtk-mt76-mt7996-add-kite-testmode-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0041-mtk-mt76-mt7996-add-kite-testmode-support.patch
index febce5f..88296a5 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0053-mtk-mt76-mt7996-add-kite-testmode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0041-mtk-mt76-mt7996-add-kite-testmode-support.patch
@@ -1,7 +1,7 @@
-From 4c17654079c3618e0e0e480d54f305c4460b3af4 Mon Sep 17 00:00:00 2001
+From fa32fd17aed1561a48cff42344e06d5ebf5a736d Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 12 Oct 2023 16:17:33 +0800
-Subject: [PATCH 053/199] mtk: mt76: mt7996: add kite testmode support
+Subject: [PATCH 041/223] mtk: mt76: mt7996: add kite testmode support
 
 Add Kite testmode support
 1. avoid entering connac 2 testmode flow in kite
@@ -18,7 +18,7 @@
  6 files changed, 202 insertions(+), 122 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 8a0f6d39..0d50d313 100644
+index b71961d9..7575dcb9 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -29,12 +29,39 @@ const struct ieee80211_channel dpd_5g_skip_ch_list[] = {
@@ -74,8 +74,8 @@
  static int mt7996_check_eeprom(struct mt7996_dev *dev)
  {
  	u8 *eeprom = dev->mt76.eeprom.data;
-@@ -159,36 +180,6 @@ const char *mt7996_eeprom_name(struct mt7996_dev *dev)
- 	}
+@@ -182,36 +203,6 @@ static bool mt7996_eeprom_variant_valid(struct mt7996_dev *dev, const u8 *def)
+ 	return true;
  }
  
 -int
@@ -109,10 +109,10 @@
 -}
 -
  static int
- mt7996_eeprom_load_bin(struct mt7996_dev *dev)
+ mt7996_eeprom_check_or_use_default(struct mt7996_dev *dev, bool use_default)
  {
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 9a15b446..fa9c31e7 100644
+index 782d847b..c3c248ca 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -45,36 +45,69 @@ enum mt7996_eeprom_field {
@@ -210,10 +210,10 @@
  #define RF_DPD_FLAT_CAL				BIT(28)
  #define RF_PRE_CAL				BIT(29)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index cf94d39c..3a7f9df8 100644
+index 54a84966..87322283 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3738,13 +3738,11 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3771,13 +3771,11 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  	enum nl80211_chan_width bw = chandef->width;
  	const struct ieee80211_channel *chan_list;
  	u32 cal_id, chan_list_size, base_offset = 0, offs = MT_EE_DO_PRE_CAL;
@@ -229,7 +229,7 @@
  
  	switch (band) {
  	case NL80211_BAND_2GHZ:
-@@ -3760,27 +3758,35 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3793,27 +3791,35 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  			return 0;
  		cal_id = RF_DPD_FLAT_CAL;
  		chan_list = dpd_2g_ch_list_bw20;
@@ -271,7 +271,7 @@
  			return 0;
  		break;
  	case NL80211_BAND_6GHZ:
-@@ -3788,20 +3794,27 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3821,20 +3827,27 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  		cal_id = RF_DPD_FLAT_6G_CAL;
  		chan_list = mphy->sband_6g.sband.channels;
  		chan_list_size = mphy->sband_6g.sband.n_channels;
@@ -304,7 +304,7 @@
  		} else if (bw > NL80211_CHAN_WIDTH_20) {
  			/* apply (center channel - 2)'s dpd cal data for bw 40/80 channels */
  			channel -= 2;
-@@ -3821,9 +3834,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3854,9 +3867,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  	if (idx == chan_list_size)
  		return -EINVAL;
  
@@ -317,10 +317,10 @@
  	cal += MT_EE_CAL_GROUP_SIZE + base_offset + idx * per_chan_size;
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 5cdc42bf..516129b0 100644
+index e406dc87..981f496e 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -194,6 +194,19 @@ struct mt7996_twt_flow {
+@@ -203,6 +203,19 @@ struct mt7996_twt_flow {
  
  DECLARE_EWMA(avg_signal, 10, 8)
  
@@ -340,7 +340,7 @@
  struct mt7996_sta {
  	struct mt76_wcid wcid; /* must be first */
  
-@@ -463,6 +476,10 @@ struct mt7996_dev {
+@@ -472,6 +485,10 @@ struct mt7996_dev {
  
  	void *cal;
  	u32 cur_prek_offset;
@@ -351,7 +351,7 @@
  
  	struct {
  		u16 table_mask;
-@@ -599,7 +616,6 @@ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
+@@ -630,7 +647,6 @@ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
  int mt7996_eeprom_get_target_power(struct mt7996_dev *dev,
  				   struct ieee80211_channel *chan);
  s8 mt7996_eeprom_get_power_delta(struct mt7996_dev *dev, int band);
@@ -360,10 +360,10 @@
  void mt7996_dma_reset(struct mt7996_dev *dev, bool force);
  void mt7996_dma_prefetch(struct mt7996_dev *dev);
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 95d3bde0..9fa4edcd 100644
+index 6de49afc..5c0eb3cb 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -434,7 +434,7 @@ mt7996_tm_set_tx_cont(struct mt7996_phy *phy, bool en)
+@@ -440,7 +440,7 @@ mt7996_tm_set_tx_cont(struct mt7996_phy *phy, bool en)
  static int
  mt7996_tm_group_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
  {
@@ -372,7 +372,7 @@
  	u32 i, group_size, dpd_size, size, offs, *pre_cal;
  	int ret = 0;
  	struct mt7996_dev *dev = phy->dev;
-@@ -462,6 +462,9 @@ mt7996_tm_group_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
+@@ -468,6 +468,9 @@ mt7996_tm_group_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
  	dpd_size = MT_EE_CAL_DPD_SIZE;
  	size = group_size + dpd_size;
  	offs = MT_EE_DO_PRE_CAL;
@@ -382,7 +382,7 @@
  
  	switch (state) {
  	case MT76_TM_STATE_GROUP_PREK:
-@@ -476,13 +479,10 @@ mt7996_tm_group_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
+@@ -482,13 +485,10 @@ mt7996_tm_group_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
  		wait_event_timeout(mdev->mcu.wait, dev->cur_prek_offset == group_size,
  				   30 * HZ);
  
@@ -399,7 +399,7 @@
  		break;
  	case MT76_TM_STATE_GROUP_PREK_DUMP:
  		pre_cal = (u32 *)dev->cal;
-@@ -520,10 +520,12 @@ mt7996_tm_dpd_prek_send_req(struct mt7996_phy *phy, struct mt7996_tm_req *req,
+@@ -526,10 +526,12 @@ mt7996_tm_dpd_prek_send_req(struct mt7996_phy *phy, struct mt7996_tm_req *req,
  	struct mt76_phy *mphy = phy->mt76;
  	struct cfg80211_chan_def chandef_backup, *chandef = &mphy->chandef;
  	struct ieee80211_channel chan_backup;
@@ -413,7 +413,7 @@
  
  	req->rf_test.op.rf.param.cal_param.func_data = cpu_to_le32(func_data);
  
-@@ -533,7 +535,7 @@ mt7996_tm_dpd_prek_send_req(struct mt7996_phy *phy, struct mt7996_tm_req *req,
+@@ -539,7 +541,7 @@ mt7996_tm_dpd_prek_send_req(struct mt7996_phy *phy, struct mt7996_tm_req *req,
  	for (i = 0; i < channel_size; i++) {
  		if (chan_list[i].band == NL80211_BAND_5GHZ &&
  		    chan_list[i].hw_value >= dpd_5g_skip_ch_list[0].hw_value &&
@@ -422,7 +422,7 @@
  			continue;
  
  		memcpy(chandef->chan, &chan_list[i], sizeof(struct ieee80211_channel));
-@@ -602,11 +604,11 @@ mt7996_tm_dpd_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
+@@ -608,11 +610,11 @@ mt7996_tm_dpd_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
  	switch (state) {
  	case MT76_TM_STATE_DPD_2G:
  		ret = mt7996_tm_dpd_prek_send_req(phy, &req, dpd_2g_ch_list_bw20,
@@ -438,7 +438,7 @@
  
  		do_precal = MT_EE_WIFI_CAL_DPD_2G;
  		break;
-@@ -617,18 +619,27 @@ mt7996_tm_dpd_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
+@@ -623,18 +625,27 @@ mt7996_tm_dpd_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
  						  NL80211_CHAN_WIDTH_20, RF_DPD_FLAT_5G_CAL);
  		if (ret)
  			return ret;
@@ -474,7 +474,7 @@
  
  		do_precal = MT_EE_WIFI_CAL_DPD_5G;
  		break;
-@@ -639,27 +650,37 @@ mt7996_tm_dpd_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
+@@ -645,27 +656,37 @@ mt7996_tm_dpd_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
  						  NL80211_CHAN_WIDTH_20, RF_DPD_FLAT_6G_CAL);
  		if (ret)
  			return ret;
@@ -523,7 +523,7 @@
  
  		do_precal = MT_EE_WIFI_CAL_DPD_6G;
  		break;
-@@ -732,9 +753,9 @@ mt7996_tm_dump_precal(struct mt76_phy *mphy, struct sk_buff *msg, int flag, int
+@@ -738,9 +759,9 @@ mt7996_tm_dump_precal(struct mt76_phy *mphy, struct sk_buff *msg, int flag, int
  	eeprom = dev->mt76.eeprom.data;
  	offs = MT_EE_DO_PRE_CAL;
  
@@ -536,7 +536,7 @@
  
  	switch (type) {
  	case PREK_SYNC_ALL:
-@@ -810,9 +831,9 @@ mt7996_tm_re_cal_event(struct mt7996_dev *dev, struct mt7996_tm_rf_test_result *
+@@ -816,9 +837,9 @@ mt7996_tm_re_cal_event(struct mt7996_dev *dev, struct mt7996_tm_rf_test_result *
  	u8 *pre_cal;
  
  	pre_cal = dev->cal;
@@ -550,7 +550,7 @@
  	cal_idx = le32_to_cpu(data->cal_idx);
  	cal_type = le32_to_cpu(data->cal_type);
 diff --git a/testmode.c b/testmode.c
-index b9f71097..f1d162ce 100644
+index 9a7559bf..a1744755 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -37,6 +37,11 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -608,5 +608,5 @@
  
  	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0054-mtk-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for-CERT.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0042-mtk-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for-CERT.patch
similarity index 82%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0054-mtk-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for-CERT.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0042-mtk-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for-CERT.patch
index 15588fe..7c54397 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0054-mtk-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for-CERT.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0042-mtk-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for-CERT.patch
@@ -1,7 +1,7 @@
-From 3c7126f27c9a7a68514c4eb134203576db47cd82 Mon Sep 17 00:00:00 2001
+From 86493d14f89cf1c6916bdac4fe2ecfc1b20c84e6 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Tue, 14 Nov 2023 11:27:06 +0800
-Subject: [PATCH 054/199] mtk: mt76: mt7996: assign DEAUTH to ALTX queue for
+Subject: [PATCH 042/223] mtk: mt76: mt7996: assign DEAUTH to ALTX queue for
  CERT
 
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 10 insertions(+)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 90e8e7b1..bcddff23 100644
+index 484f91aa..f78591ff 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -747,6 +747,8 @@ static void
+@@ -759,6 +759,8 @@ static void
  mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
  			    struct sk_buff *skb, struct ieee80211_key_conf *key)
  {
@@ -22,7 +22,7 @@
  	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-@@ -756,6 +758,14 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
+@@ -768,6 +770,14 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
  	u8 fc_type, fc_stype;
  	u32 val;
  
@@ -38,5 +38,5 @@
  	    mgmt->u.action.category == WLAN_CATEGORY_BACK &&
  	    mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ)
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0055-mtk-mt76-mt7996-add-no_beacon-vendor-command-for-cer.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0043-mtk-mt76-mt7996-add-no_beacon-vendor-command-for-cer.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0055-mtk-mt76-mt7996-add-no_beacon-vendor-command-for-cer.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0043-mtk-mt76-mt7996-add-no_beacon-vendor-command-for-cer.patch
index 6741fd5..3197335 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0055-mtk-mt76-mt7996-add-no_beacon-vendor-command-for-cer.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0043-mtk-mt76-mt7996-add-no_beacon-vendor-command-for-cer.patch
@@ -1,7 +1,7 @@
-From 04adadf07c93529a7b3b0c5e5bccd6bc99c97d8f Mon Sep 17 00:00:00 2001
+From d75372c3491e32a67af73ce130cd36f03af82d51 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Nov 2023 22:42:09 +0800
-Subject: [PATCH 055/199] mtk: mt76: mt7996: add no_beacon vendor command for
+Subject: [PATCH 043/223] mtk: mt76: mt7996: add no_beacon vendor command for
  cert
 
 Add the vendor command to disable/enable beacon
@@ -12,6 +12,7 @@
 0: enable beacon
 1: disable beacon
 
+Change-Id: Ia16707317135aeb02d6a5f6d50983e5174cc9e77
 Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
 ---
  mt7996/mcu.c    | 11 +++++++++++
@@ -21,10 +22,10 @@
  4 files changed, 65 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 3a7f9df8..7b520a90 100644
+index 87322283..9431f878 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -5103,4 +5103,15 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -5136,4 +5136,15 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  		break;
  	}
  }
@@ -41,10 +42,10 @@
 +}
  #endif
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 516129b0..34886128 100644
+index 981f496e..f6e7fbdd 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -835,6 +835,7 @@ void mt7996_set_wireless_amsdu(struct ieee80211_hw *hw, u8 en);
+@@ -866,6 +866,7 @@ void mt7996_set_wireless_amsdu(struct ieee80211_hw *hw, u8 en);
  void mt7996_mcu_set_mimo(struct mt7996_phy *phy);
  int mt7996_set_muru_cfg(struct mt7996_phy *phy, u8 action, u8 val);
  int mt7996_mcu_set_muru_cfg(struct mt7996_phy *phy, void *data);
@@ -149,5 +150,5 @@
  
  #endif
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0056-mtk-mt76-mt7996-add-adie-efuse-merge-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0044-mtk-mt76-mt7996-add-adie-efuse-merge-support.patch
similarity index 81%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0056-mtk-mt76-mt7996-add-adie-efuse-merge-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0044-mtk-mt76-mt7996-add-adie-efuse-merge-support.patch
index bc5a4a9..099e068 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0056-mtk-mt76-mt7996-add-adie-efuse-merge-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0044-mtk-mt76-mt7996-add-adie-efuse-merge-support.patch
@@ -1,22 +1,23 @@
-From 81d008c8fcfaa851414ee63242d9ea4c0eb888df Mon Sep 17 00:00:00 2001
+From 031841be718eb6736dec9c52744664433ed2a34e Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 24 Nov 2023 09:49:08 +0800
-Subject: [PATCH 056/199] mtk: mt76: mt7996: add adie efuse merge support
+Subject: [PATCH 044/223] mtk: mt76: mt7996: add adie efuse merge support
 
 Merge adie-dependent parameters in efuse into eeprom after FT.
 Note that Eagle BE14000 is not considered yet.
 Add efuse dump command.
 
+Change-Id: Ib088b90147c75d7437f40dd3569e3584c6ff9ab0
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mt7996/debugfs.c  |  41 +++++++++++++
  mt7996/eeprom.c   | 144 ++++++++++++++++++++++++++++++++++++++++++++++
- mt7996/mcu.c      |   6 +-
+ mt7996/main.c     |   4 +-
  mt7996/testmode.c |   8 ++-
- 4 files changed, 195 insertions(+), 4 deletions(-)
+ 4 files changed, 193 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 1f4bad62..58879695 100644
+index 1f4bad62..70a97d29 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -881,6 +881,46 @@ DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_muru_disable,
@@ -35,7 +36,7 @@
 +	u32 block_num;
 +
 +	mdev->otp.size = MT7996_EEPROM_SIZE;
-+	if (is_mt7996(&dev->mt76) && dev->chip_sku == MT7996_SKU_444)
++	if (is_mt7996(&dev->mt76) && dev->chip_sku == MT7996_VAR_TYPE_444)
 +		mdev->otp.size += 3 * MT_EE_CAL_UNIT;
 +
 +	if (!mdev->otp.data) {
@@ -75,10 +76,10 @@
  	if (phy->mt76->cap.has_5ghz) {
  		debugfs_create_u32("dfs_hw_pattern", 0400, dir,
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 0d50d313..8cdd6d96 100644
+index 7575dcb9..be87afe8 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -496,6 +496,146 @@ static int mt7996_eeprom_load_precal(struct mt7996_dev *dev)
+@@ -546,6 +546,146 @@ static int mt7996_eeprom_load_precal(struct mt7996_dev *dev)
  	return mt76_get_of_data_from_nvmem(mdev, dev->cal, "precal", size);
  }
  
@@ -147,7 +148,7 @@
 +		eep_offs[0] = eep_offs_list[adie_id];
 +
 +		/* adie 1 */
-+		if (dev->chip_sku != MT7996_SKU_404) {
++		if (dev->chip_sku != MT7996_VAR_TYPE_404) {
 +			adie_offs[1] = adie_offs_list[ADIE_7977];
 +			eep_offs[1] = eep_offs_list[ADIE_7977];
 +		}
@@ -159,10 +160,10 @@
 +	case 0x7992:
 +		adie_base = adie_base_7992;
 +		/* adie 0 */
-+		if (dev->chip_sku == MT7992_SKU_44 &&
++		if (dev->chip_sku == MT7992_VAR_TYPE_44 &&
 +		    dev->fem_type != MT7996_FEM_EXT)
 +			adie_id = ADIE_7975;
-+		else if (dev->chip_sku == MT7992_SKU_24)
++		else if (dev->chip_sku == MT7992_VAR_TYPE_24)
 +			adie_id = ADIE_7978;
 +		else
 +			adie_id = ADIE_7976;
@@ -170,10 +171,10 @@
 +		eep_offs[0] = eep_offs_list[adie_id];
 +
 +		/* adie 1 */
-+		if (dev->chip_sku == MT7992_SKU_44 &&
++		if (dev->chip_sku == MT7992_VAR_TYPE_44 &&
 +		    dev->fem_type != MT7996_FEM_INT)
 +			adie_id = ADIE_7977;
-+		else if (dev->chip_sku != MT7992_SKU_23)
++		else if (dev->chip_sku != MT7992_VAR_TYPE_23)
 +			adie_id = ADIE_7979;
 +		else
 +			break;
@@ -199,7 +200,7 @@
 +			if (adie_offs[band][i] == MT_EE_END_OFFSET)
 +				break;
 +
-+			if (is_mt7996(&dev->mt76) && dev->chip_sku == MT7996_SKU_444 &&
++			if (is_mt7996(&dev->mt76) && dev->chip_sku == MT7996_VAR_TYPE_444 &&
 +			    band == MT_BAND1)
 +				eep_offset -= MT_EE_7977BN_OFFSET;
 +
@@ -225,9 +226,9 @@
  int mt7996_eeprom_init(struct mt7996_dev *dev)
  {
  	int ret;
-@@ -512,6 +652,10 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
- 	if (ret)
- 		return ret;
+@@ -556,6 +696,10 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
+ 
+ 	mt7996_eeprom_load_precal(dev);
  
 +	ret = mt7996_apply_cal_free_data(dev);
 +	if (ret)
@@ -236,42 +237,31 @@
  	ret = mt7996_eeprom_parse_hw_cap(dev, &dev->phy);
  	if (ret < 0)
  		return ret;
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 7b520a90..1c98d179 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -3609,7 +3609,7 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf)
- 	};
- 	struct sk_buff *skb;
- 	bool valid;
--	int ret;
-+	int ret = 0;
- 	u8 *buf = read_buf;
- 
- 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
-@@ -3627,11 +3627,13 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf)
- 
- 		skb_pull(skb, 48);
- 		memcpy(buf, skb->data, MT7996_EEPROM_BLOCK_SIZE);
-+	} else {
-+		ret = -EINVAL;
- 	}
- 
- 	dev_kfree_skb(skb);
- 
--	return 0;
-+	return ret;
- }
- 
- int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num)
+diff --git a/mt7996/main.c b/mt7996/main.c
+index dc00cc2f..ea4679dd 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -1485,10 +1485,10 @@ mt7996_background_radar_handle_7975_ifem(struct ieee80211_hw *hw,
+ 	switch (mt76_chip(&dev->mt76)) {
+ 	case 0x7990:
+ 		is_ifem_adie = dev->fem_type == MT7996_FEM_INT &&
+-			       dev->chip_sku != MT7996_SKU_233;
++			       dev->chip_sku != MT7996_VAR_TYPE_233;
+ 		break;
+ 	case 0x7992:
+-		is_ifem_adie = dev->chip_sku == MT7992_SKU_44 &&
++		is_ifem_adie = dev->chip_sku == MT7992_VAR_TYPE_44 &&
+ 			       dev->fem_type != MT7996_FEM_EXT;
+ 		break;
+ 	default:
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 9fa4edcd..784a8bea 100644
+index 5c0eb3cb..5a8b6d0a 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -2116,8 +2116,12 @@ mt7996_tm_write_back_to_efuse(struct mt7996_dev *dev)
+@@ -2128,8 +2128,12 @@ mt7996_tm_write_back_to_efuse(struct mt7996_dev *dev)
  		memcpy(req.data, eeprom + i, MT76_TM_EEPROM_BLOCK_SIZE);
  
- 		ret = mt7996_mcu_get_eeprom(dev, i, read_buf);
+ 		ret = mt7996_mcu_get_eeprom(dev, i, read_buf, sizeof(read_buf));
 -		if (ret < 0)
 -			return ret;
 +		if (ret) {
@@ -284,5 +274,5 @@
  		if (!memcmp(req.data, read_buf, MT76_TM_EEPROM_BLOCK_SIZE))
  			continue;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0045-mtk-mt76-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0045-mtk-mt76-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch
new file mode 100644
index 0000000..1cebf18
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0045-mtk-mt76-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch
@@ -0,0 +1,88 @@
+From 9c8447672f6bb36113eccf7064f91b11ea980825 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Tue, 5 Dec 2023 16:48:33 +0800
+Subject: [PATCH 045/223] mtk: mt76: mt7996: add Eagle 2adie TBTC (BE14000)
+ support
+
+Add fwdl/default eeprom load support for Eagle 2 adie TBTC
+
+Add Eagle 2adie TBTC efuse merge
+Add Eagle 2adie TBTC group prek size
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Change-Id: I53479ad22aec81ba3f3028aa0aada86b175379f8
+---
+ mt7996/eeprom.c |  6 ++++--
+ mt7996/eeprom.h | 12 ++++++++++++
+ mt7996/mt7996.h |  1 +
+ 3 files changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
+index be87afe8..f1c29e8d 100644
+--- a/mt7996/eeprom.c
++++ b/mt7996/eeprom.c
+@@ -500,6 +500,8 @@ static void mt7996_eeprom_init_precal(struct mt7996_dev *dev)
+ 	switch (mt76_chip(&dev->mt76)) {
+ 	case 0x7990:
+ 		dev->prek.rev = mt7996_prek_rev;
++		if (dev->chip_sku == MT7996_VAR_TYPE_233)
++			dev->prek.rev = mt7996_prek_rev_233;
+ 		/* 5g & 6g bw 80 dpd channel list is not used */
+ 		dev->prek.dpd_ch_num[DPD_CH_NUM_BW320_6G] = ARRAY_SIZE(dpd_6g_ch_list_bw320);
+ 		break;
+@@ -603,7 +605,7 @@ static int mt7996_apply_cal_free_data(struct mt7996_dev *dev)
+ 	case 0x7990:
+ 		adie_base = adie_base_7996;
+ 		/* adie 0 */
+-		if (dev->fem_type == MT7996_FEM_INT)
++		if (dev->fem_type == MT7996_FEM_INT && dev->chip_sku != MT7996_VAR_TYPE_233)
+ 			adie_id = ADIE_7975;
+ 		else
+ 			adie_id = ADIE_7976;
+@@ -611,7 +613,7 @@ static int mt7996_apply_cal_free_data(struct mt7996_dev *dev)
+ 		eep_offs[0] = eep_offs_list[adie_id];
+ 
+ 		/* adie 1 */
+-		if (dev->chip_sku != MT7996_VAR_TYPE_404) {
++		if (dev->chip_sku == MT7996_VAR_TYPE_444) {
+ 			adie_offs[1] = adie_offs_list[ADIE_7977];
+ 			eep_offs[1] = eep_offs_list[ADIE_7977];
+ 		}
+diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
+index c3c248ca..788c33c8 100644
+--- a/mt7996/eeprom.h
++++ b/mt7996/eeprom.h
+@@ -70,6 +70,18 @@ static const u32 mt7996_prek_rev[] = {
+ 	[DPD_OTFG0_SIZE] =			2 * MT_EE_CAL_UNIT,
+ };
+ 
++static const u32 mt7996_prek_rev_233[] = {
++	[GROUP_SIZE_2G] =			4 * MT_EE_CAL_UNIT,
++	[GROUP_SIZE_5G] =			44 * MT_EE_CAL_UNIT,
++	[GROUP_SIZE_6G] =			100 * MT_EE_CAL_UNIT,
++	[ADCDCOC_SIZE_2G] =			4 * 4,
++	[ADCDCOC_SIZE_5G] =			4 * 4,
++	[ADCDCOC_SIZE_6G] =			4 * 5,
++	[DPD_LEGACY_SIZE] =			4 * MT_EE_CAL_UNIT,
++	[DPD_MEM_SIZE] =			13 * MT_EE_CAL_UNIT,
++	[DPD_OTFG0_SIZE] =			2 * MT_EE_CAL_UNIT,
++};
++
+ /* kite 2/5g config */
+ static const u32 mt7992_prek_rev[] = {
+ 	[GROUP_SIZE_2G] =			4 * MT_EE_CAL_UNIT,
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index f6e7fbdd..81639a45 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -38,6 +38,7 @@
+ #define MT7996_FIRMWARE_WA_233		"mediatek/mt7996/mt7996_wa_233.bin"
+ #define MT7996_FIRMWARE_WM_233		"mediatek/mt7996/mt7996_wm_233.bin"
+ #define MT7996_FIRMWARE_DSP_233		MT7996_FIRMWARE_DSP
++#define MT7996_FIRMWARE_WM_TM_233	"mediatek/mt7996/mt7996_wm_tm_233.bin"
+ #define MT7996_ROM_PATCH_233		"mediatek/mt7996/mt7996_rom_patch_233.bin"
+ 
+ #define MT7992_FIRMWARE_WA		"mediatek/mt7996/mt7992_wa.bin"
+-- 
+2.45.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0046-mtk-mt76-mt7996-add-background-radar-hw-cap-check.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0046-mtk-mt76-mt7996-add-background-radar-hw-cap-check.patch
new file mode 100644
index 0000000..7809621
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0046-mtk-mt76-mt7996-add-background-radar-hw-cap-check.patch
@@ -0,0 +1,44 @@
+From 4a0688cf495714841635247e4859335402f3118f Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 22 Dec 2023 17:27:10 +0800
+Subject: [PATCH 046/223] mtk: mt76: mt7996: add background radar hw cap check
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7996/debugfs.c | 5 +++++
+ mt7996/mt7996.h  | 3 ++-
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
+index 70a97d29..07970e1a 100644
+--- a/mt7996/debugfs.c
++++ b/mt7996/debugfs.c
+@@ -262,6 +262,11 @@ mt7996_rdd_monitor(struct seq_file *s, void *data)
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+ 
++	if (!mt7996_has_background_radar(dev)) {
++		seq_puts(s, "no background radar capability\n");
++		goto out;
++	}
++
+ 	if (!cfg80211_chandef_valid(chandef)) {
+ 		ret = -EINVAL;
+ 		goto out;
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index 81639a45..142c390d 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -619,7 +619,8 @@ mt7996_has_background_radar(struct mt7996_dev *dev)
+ 			return false;
+ 		break;
+ 	case 0x7992:
+-		if (dev->var.type == MT7992_VAR_TYPE_23)
++		if (dev->var.type == MT7992_VAR_TYPE_23 ||
++		    dev->var.type == MT7992_VAR_TYPE_24)
+ 			return false;
+ 		break;
+ 	default:
+-- 
+2.45.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0059-mtk-mt76-mt7996-add-fallback-in-case-of-missing-prec.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0047-mtk-mt76-mt7996-add-fallback-in-case-of-missing-prec.patch
similarity index 69%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0059-mtk-mt76-mt7996-add-fallback-in-case-of-missing-prec.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0047-mtk-mt76-mt7996-add-fallback-in-case-of-missing-prec.patch
index d918499..0b7ad11 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0059-mtk-mt76-mt7996-add-fallback-in-case-of-missing-prec.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0047-mtk-mt76-mt7996-add-fallback-in-case-of-missing-prec.patch
@@ -1,7 +1,7 @@
-From 7235c5d6995ae047f9223fe077ae753fb439dfed Mon Sep 17 00:00:00 2001
+From f516af1b0691dcf72ad4a38ce5e6c06cb94ed9be Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 19 Mar 2024 17:33:49 +0800
-Subject: [PATCH 059/199] mtk: mt76: mt7996: add fallback in case of missing
+Subject: [PATCH 047/223] mtk: mt76: mt7996: add fallback in case of missing
  precal data
 
 Align Wi-Fi 6 upstream changes
@@ -9,16 +9,16 @@
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
- mt7996/eeprom.c | 30 +++++++++++++++++++++---------
+ mt7996/eeprom.c | 26 ++++++++++++++++++++------
  mt7996/init.c   |  2 +-
  mt7996/main.c   |  2 +-
- 3 files changed, 23 insertions(+), 11 deletions(-)
+ 3 files changed, 22 insertions(+), 8 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index fb4d031f..dffcd09d 100644
+index f1c29e8d..3ec146d0 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -490,17 +490,31 @@ static int mt7996_eeprom_load_precal(struct mt7996_dev *dev)
+@@ -535,17 +535,31 @@ static int mt7996_eeprom_load_precal(struct mt7996_dev *dev)
  	size = MT_EE_CAL_GROUP_SIZE + MT_EE_CAL_DPD_SIZE;
  
  	dev->cal = devm_kzalloc(mdev->dev, size, GFP_KERNEL);
@@ -41,7 +41,8 @@
  	if (!ret)
 -		return ret;
 +		return 0;
-+
+ 
+-	return mt76_get_of_data_from_nvmem(mdev, dev->cal, "precal", size);
 +	ret = mt76_get_of_data_from_nvmem(mdev, dev->cal, "precal", size);
 +	if (!ret)
 +		return 0;
@@ -50,28 +51,16 @@
 +	dev_warn(dev->mt76.dev, "Failed to load precal data: %d\n", ret);
 +	devm_kfree(dev->mt76.dev, dev->cal);
 +	dev->cal = NULL;
- 
--	return mt76_get_of_data_from_nvmem(mdev, dev->cal, "precal", size);
++
 +	return ret;
  }
  
  static int mt7996_apply_cal_free_data(struct mt7996_dev *dev)
-@@ -655,9 +669,7 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
- 	if (ret)
- 		return ret;
- 
--	ret = mt7996_eeprom_load_precal(dev);
--	if (ret)
--		return ret;
-+	mt7996_eeprom_load_precal(dev);
- 
- 	ret = mt7996_apply_cal_free_data(dev);
- 	if (ret)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index ade07db7..8b642ecc 100644
+index 3421326a..eac00df0 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -1011,7 +1011,7 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
+@@ -1021,7 +1021,7 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
  	if (ret < 0)
  		return ret;
  
@@ -81,12 +70,12 @@
  		if (ret)
  			return ret;
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 39318595..3bc9dc15 100644
+index ea4679dd..f02f447e 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -345,7 +345,7 @@ int mt7996_set_channel(struct mt7996_phy *phy)
- 
- 	mt76_set_channel(phy->mt76);
+@@ -338,7 +338,7 @@ int mt7996_set_channel(struct mt76_phy *mphy)
+ 	struct mt7996_phy *phy = mphy->priv;
+ 	int ret;
  
 -	if (dev->flash_mode) {
 +	if (dev->cal) {
@@ -94,5 +83,5 @@
  		if (ret)
  			goto out;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0048-mtk-mt76-mt7996-add-kite-part-number-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0048-mtk-mt76-mt7996-add-kite-part-number-support.patch
new file mode 100644
index 0000000..d349a87
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0048-mtk-mt76-mt7996-add-kite-part-number-support.patch
@@ -0,0 +1,26 @@
+From 7251f2a0f7d1f5eda27611ff658328c2fe8edbf1 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Wed, 27 Mar 2024 17:50:16 +0800
+Subject: [PATCH 048/223] mtk: mt76: mt7996: add kite part number support
+
+Change-Id: Ib06648398f18b47c324e18b476a57444d929608f
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7996/eeprom.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
+index 3ec146d0..f9bd4d91 100644
+--- a/mt7996/eeprom.c
++++ b/mt7996/eeprom.c
+@@ -372,7 +372,6 @@ static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_phy *phy,
+ 	if (ret)
+ 		return ret;
+ 
+-	cap = 0x4b249248;	/* internal hardcode */
+ 	if (cap) {
+ 		u8 band_offs = phy->mt76->band_idx * 3;
+ 
+-- 
+2.45.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0061-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0049-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
similarity index 95%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0061-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0049-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
index c73d2e3..49c9419 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0061-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0049-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
@@ -1,10 +1,11 @@
-From 397ea73910dc301f6fcaa4e96ecb59108c79c126 Mon Sep 17 00:00:00 2001
+From 4389fa86ef5bed621b9ced29ca66351819397575 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Feb 2023 19:49:22 +0800
-Subject: [PATCH 061/199] mtk: wifi: mt76: revert page_poll for kernel 5.4
+Subject: [PATCH 049/223] mtk: wifi: mt76: revert page_poll for kernel 5.4
 
 This reverts commit e8c10835cf062c577ddf426913788c39d30b4bd7.
 
+Change-Id: I4e5764fc545087f691fb4c2f43e7a9cefd1e1657
 ---
  dma.c         | 75 ++++++++++++++++++++++++++-------------------------
  mac80211.c    | 56 --------------------------------------
@@ -204,7 +205,7 @@
  
  	if (mtk_wed_device_active(&dev->mmio.wed))
 diff --git a/mac80211.c b/mac80211.c
-index 6a5201f6..5f85bf1d 100644
+index ee5aa608..78e9a1ae 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -566,47 +566,6 @@ void mt76_unregister_phy(struct mt76_phy *phy)
@@ -255,7 +256,7 @@
  struct mt76_dev *
  mt76_alloc_device(struct device *pdev, unsigned int size,
  		  const struct ieee80211_ops *ops,
-@@ -1812,21 +1771,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
+@@ -1826,21 +1785,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  }
  EXPORT_SYMBOL_GPL(mt76_ethtool_worker);
  
@@ -278,10 +279,10 @@
  {
  	struct ieee80211_hw *hw = phy->hw;
 diff --git a/mt76.h b/mt76.h
-index 36e8834e..fbcd5ea9 100644
+index 7beefc59..e06d5aaa 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -251,7 +251,7 @@ struct mt76_queue {
+@@ -252,7 +252,7 @@ struct mt76_queue {
  
  	dma_addr_t desc_dma;
  	struct sk_buff *rx_head;
@@ -290,7 +291,7 @@
  };
  
  struct mt76_mcu_ops {
-@@ -1600,7 +1600,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
+@@ -1616,7 +1616,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
  	return usb_bulk_msg(udev, pipe, data, len, actual_len, timeout);
  }
  
@@ -298,7 +299,7 @@
  void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  			 struct mt76_sta_stats *stats, bool eht);
  int mt76_skb_adjust_pad(struct sk_buff *skb, int pad);
-@@ -1758,25 +1757,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
+@@ -1774,25 +1773,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
  struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
  			  struct mt76_txwi_cache *r, dma_addr_t phys);
@@ -325,10 +326,10 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 2624edbb..1b9ef1de 100644
+index d18ea5d4..8cb09d1b 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1402,22 +1402,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
+@@ -1421,22 +1421,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
  			   struct ieee80211_vif *vif,
  			   u32 sset, u8 *data)
  {
@@ -357,7 +358,7 @@
  }
  
  static void mt7915_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
-@@ -1445,7 +1442,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1464,7 +1461,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  		.idx = mvif->mt76.idx,
  	};
  	/* See mt7915_ampdu_stat_read_phy, etc */
@@ -366,7 +367,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
  
-@@ -1557,12 +1554,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1576,12 +1573,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  		return;
  
  	ei += wi.worker_stat_count;
@@ -383,7 +384,7 @@
  
  static void
 diff --git a/usb.c b/usb.c
-index 58ff0682..0ca3b069 100644
+index f9e67b8c..47e43fdb 100644
 --- a/usb.c
 +++ b/usb.c
 @@ -318,27 +318,29 @@ mt76u_set_endpoints(struct usb_interface *intf,
@@ -614,5 +615,5 @@
  
  	return -ENOMEM;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0062-mtk-mt76-rework-wed-rx-flow.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0050-mtk-mt76-rework-wed-rx-flow.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0062-mtk-mt76-rework-wed-rx-flow.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0050-mtk-mt76-rework-wed-rx-flow.patch
index a71e2b3..051af09 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0062-mtk-mt76-rework-wed-rx-flow.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0050-mtk-mt76-rework-wed-rx-flow.patch
@@ -1,8 +1,9 @@
-From 48f648333182ff895faa99cbad65d1f9baeb6f55 Mon Sep 17 00:00:00 2001
+From c21fcd823cc877e39068a92ffa440b7ad7f4bb45 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Feb 2023 13:37:23 +0800
-Subject: [PATCH 062/199] mtk: mt76: rework wed rx flow
+Subject: [PATCH 050/223] mtk: mt76: rework wed rx flow
 
+Change-Id: Icd787345c811cb5ad30d9c7c1c5f9e5298bd3be6
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
  dma.c           | 125 +++++++++++++++++++++++++++++++-----------------
@@ -259,7 +260,7 @@
  					 DMA_FROM_DEVICE);
  			skb_free_frag(buf);
 diff --git a/mac80211.c b/mac80211.c
-index 5f85bf1d..3e054d9d 100644
+index 78e9a1ae..b08a9388 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -596,7 +596,6 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
@@ -279,10 +280,10 @@
  	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
  		skb_queue_head_init(&dev->rx_skb[i]);
 diff --git a/mt76.h b/mt76.h
-index fbcd5ea9..92b59dd6 100644
+index e06d5aaa..260e198a 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -205,6 +205,7 @@ struct mt76_queue_entry {
+@@ -206,6 +206,7 @@ struct mt76_queue_entry {
  	};
  	union {
  		struct mt76_txwi_cache *txwi;
@@ -290,7 +291,7 @@
  		struct urb *urb;
  		int buf_sz;
  	};
-@@ -420,12 +421,16 @@ struct mt76_txwi_cache {
+@@ -426,12 +427,16 @@ struct mt76_txwi_cache {
  	struct list_head list;
  	dma_addr_t dma_addr;
  
@@ -312,15 +313,15 @@
  };
  
  struct mt76_rx_tid {
-@@ -512,6 +517,7 @@ struct mt76_driver_ops {
+@@ -524,6 +529,7 @@ struct mt76_driver_ops {
  	u16 txwi_size;
  	u16 token_size;
  	u8 mcs_rates;
 +	u16 rx_token_size;
  
  	void (*update_survey)(struct mt76_phy *phy);
- 
-@@ -876,7 +882,6 @@ struct mt76_dev {
+ 	int (*set_channel)(struct mt76_phy *phy);
+@@ -891,7 +897,6 @@ struct mt76_dev {
  
  	struct ieee80211_hw *hw;
  
@@ -328,7 +329,7 @@
  	spinlock_t lock;
  	spinlock_t cc_lock;
  
-@@ -1562,8 +1567,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1576,8 +1581,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -339,7 +340,7 @@
  void mt76_free_pending_rxwi(struct mt76_dev *dev);
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
-@@ -1754,9 +1759,9 @@ struct mt76_txwi_cache *
+@@ -1770,9 +1775,9 @@ struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
@@ -352,7 +353,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index d6ecd698..c8511867 100644
+index 44e112b8..9741e1d2 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -714,7 +714,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
@@ -373,7 +374,7 @@
  		.tx_complete_skb = mt76_connac_tx_complete_skb,
  		.rx_skb = mt7915_queue_rx_skb,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index a30d08eb..f1e2c93a 100644
+index ac0b1f0e..bcfec0b0 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -62,6 +62,7 @@
@@ -385,10 +386,10 @@
  #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
  #define MT7915_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
 diff --git a/tx.c b/tx.c
-index ab42f69b..46dae6e0 100644
+index 2634c5bc..5734979f 100644
 --- a/tx.c
 +++ b/tx.c
-@@ -851,16 +851,16 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
+@@ -869,16 +869,16 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
  EXPORT_SYMBOL_GPL(mt76_token_consume);
  
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
@@ -409,7 +410,7 @@
  	}
  	spin_unlock_bh(&dev->rx_token_lock);
  
-@@ -897,15 +897,15 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
+@@ -915,15 +915,15 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
  }
  EXPORT_SYMBOL_GPL(mt76_token_release);
  
@@ -537,5 +538,5 @@
  		}
  
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0063-mtk-mt76-change-wed-token-init-size-to-adapt-wed3.0.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0051-mtk-mt76-change-wed-token-init-size-to-adapt-wed3.0.patch
similarity index 77%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0063-mtk-mt76-change-wed-token-init-size-to-adapt-wed3.0.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0051-mtk-mt76-change-wed-token-init-size-to-adapt-wed3.0.patch
index 15d941a..3466f9a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0063-mtk-mt76-change-wed-token-init-size-to-adapt-wed3.0.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0051-mtk-mt76-change-wed-token-init-size-to-adapt-wed3.0.patch
@@ -1,7 +1,7 @@
-From 18702f417ad4d5757cda5ea88924cac918e25592 Mon Sep 17 00:00:00 2001
+From f0d346f6709ddea1982ee44a69ee2c3da0d86b75 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Wed, 19 Apr 2023 17:13:41 +0800
-Subject: [PATCH 063/199] mtk: mt76: change wed token init size to adapt wed3.0
+Subject: [PATCH 051/223] mtk: mt76: change wed token init size to adapt wed3.0
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 ---
@@ -9,10 +9,10 @@
  1 file changed, 7 insertions(+), 3 deletions(-)
 
 diff --git a/tx.c b/tx.c
-index 46dae6e0..e2795067 100644
+index 5734979f..a78ab2c8 100644
 --- a/tx.c
 +++ b/tx.c
-@@ -827,12 +827,16 @@ EXPORT_SYMBOL_GPL(__mt76_set_tx_blocked);
+@@ -845,12 +845,16 @@ EXPORT_SYMBOL_GPL(__mt76_set_tx_blocked);
  
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
  {
@@ -33,5 +33,5 @@
  
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0064-mtk-mt76-add-random-early-drop-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0052-mtk-mt76-add-random-early-drop-support.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0064-mtk-mt76-add-random-early-drop-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0052-mtk-mt76-add-random-early-drop-support.patch
index aac1628..891c45a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0064-mtk-mt76-add-random-early-drop-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0052-mtk-mt76-add-random-early-drop-support.patch
@@ -1,7 +1,7 @@
-From a95ba55c6e8e2662d7278f0530f3aa75c4f4a798 Mon Sep 17 00:00:00 2001
+From 7a0d06e95d36c4d9f0b7bb8ae2adac2e2c7ec831 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 19 Apr 2023 18:32:41 +0800
-Subject: [PATCH 064/199] mtk: mt76: add random early drop support
+Subject: [PATCH 052/223] mtk: mt76: add random early drop support
 
 ---
  mt7996/debugfs.c     |  1 +
@@ -15,7 +15,7 @@
  8 files changed, 167 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 6d119467..3301701a 100644
+index 07970e1a..e328a056 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -633,6 +633,7 @@ mt7996_tx_stats_show(struct seq_file *file, void *data)
@@ -27,10 +27,10 @@
  	mt7996_txbf_stat_read_phy(phy, file);
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index bcddff23..0c2fee66 100644
+index f78591ff..1c0c2796 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1179,6 +1179,13 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+@@ -1191,6 +1191,13 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
  
  			wcid->stats.tx_retries += tx_retries;
  			wcid->stats.tx_failed += tx_failed;
@@ -45,10 +45,10 @@
  		}
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 9bef1274..7fa44f84 100644
+index 9431f878..70e1984a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3150,8 +3150,8 @@ int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
+@@ -3157,8 +3157,8 @@ int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -59,7 +59,7 @@
  }
  
  int mt7996_mcu_init(struct mt7996_dev *dev)
-@@ -3183,6 +3183,83 @@ out:
+@@ -3191,6 +3191,83 @@ out:
  	skb_queue_purge(&dev->mt76.mcu.res_q);
  }
  
@@ -167,10 +167,10 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 784fb3db..d40f95cd 100644
+index 142c390d..8d222a0c 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -355,6 +355,7 @@ struct mt7996_phy {
+@@ -356,6 +356,7 @@ struct mt7996_phy {
  	u16 punct_bitmap;
  
  	struct mt7996_scs_ctrl scs_ctrl;
@@ -178,7 +178,7 @@
  
  	bool sku_limit_en;
  	bool sku_path_en;
-@@ -724,6 +725,7 @@ int mt7996_mcu_rf_regval(struct mt7996_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -728,6 +729,7 @@ int mt7996_mcu_rf_regval(struct mt7996_dev *dev, u32 regidx, u32 *val, bool set)
  int mt7996_mcu_set_hdr_trans(struct mt7996_dev *dev, bool hdr_trans);
  int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val);
  int mt7996_mcu_wa_cmd(struct mt7996_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
@@ -186,7 +186,7 @@
  int mt7996_mcu_fw_log_2_host(struct mt7996_dev *dev, u8 type, u8 ctrl);
  int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
  int mt7996_mcu_trigger_assert(struct mt7996_dev *dev);
-@@ -897,11 +899,12 @@ void mt7996_mcu_set_ppdu_tx_type(struct mt7996_phy *phy, u8 ppdu_type);
+@@ -901,11 +903,12 @@ void mt7996_mcu_set_ppdu_tx_type(struct mt7996_phy *phy, u8 ppdu_type);
  void mt7996_mcu_set_nusers_ofdma(struct mt7996_phy *phy, u8 type, u8 ofdma_user_cnt);
  void mt7996_mcu_set_cert(struct mt7996_phy *phy, u8 type);
  void mt7996_tm_update_channel(struct mt7996_phy *phy);
@@ -201,10 +201,10 @@
 -
  #endif
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 05cfc6ab..1f754796 100644
+index a59e3a18..c1671e68 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -3033,6 +3033,27 @@ static int mt7996_muru_prot_thr_set(void *data, u64 val)
+@@ -3032,6 +3032,27 @@ static int mt7996_muru_prot_thr_set(void *data, u64 val)
  DEFINE_DEBUGFS_ATTRIBUTE(fops_muru_prot_thr, NULL,
  			 mt7996_muru_prot_thr_set, "%lld\n");
  
@@ -232,7 +232,7 @@
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -3109,6 +3130,8 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -3108,6 +3129,8 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  				    mt7996_wtbl_read);
  
  	debugfs_create_devm_seqfile(dev->mt76.dev, "token", dir, mt7996_token_read);
@@ -312,5 +312,5 @@
  
  #endif
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0065-mtk-mt76-mt7996-reset-addr_elem-when-delete-ba.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0053-mtk-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0065-mtk-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0053-mtk-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
index 1b13961..ac96abf 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0065-mtk-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0053-mtk-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
@@ -1,7 +1,7 @@
-From 8b4350b46fa5bc77a6e4314261b540b0ebd99f43 Mon Sep 17 00:00:00 2001
+From 82dd1101ce064f18bdcc47c7ef5779c407440bae Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 18 May 2023 15:01:47 +0800
-Subject: [PATCH 065/199] mtk: mt76: mt7996: reset addr_elem when delete ba
+Subject: [PATCH 053/223] mtk: mt76: mt7996: reset addr_elem when delete ba
 
 The old addr element info may be used when the signature is not equel to
 0xff, and sta will find error SDP cause the SDP/SDL=0 issue.
@@ -10,6 +10,8 @@
 Due to fw change the cmd format.
 https://gerrit.mediatek.inc/c/neptune/firmware/bora/wifi/custom/+/7969193
 
+Change-Id: I12fb27e28b2c0310f824e66af6103b4ceba3503e
+Change-Id: I456a5d3eb2320a2c40cf57247ba63083a6d50b2e
 Signed-off-by: mtk27745 <rex.lu@mediatek.com>
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 ---
@@ -18,10 +20,10 @@
  2 files changed, 47 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index 92b59dd6..f2052cf7 100644
+index 260e198a..2798f9e5 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -447,6 +447,7 @@ struct mt76_rx_tid {
+@@ -453,6 +453,7 @@ struct mt76_rx_tid {
  	u16 nframes;
  
  	u8 num;
@@ -87,5 +89,5 @@
  	UNI_MIB_OBSS_AIRTIME = 26,
  	UNI_MIB_NON_WIFI_TIME = 27,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0066-mtk-mt76-change-pcie0-R5-to-pcie1-to-get-6G-ICS.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0054-mtk-mt76-change-pcie0-R5-to-pcie1-to-get-6G-ICS.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0066-mtk-mt76-change-pcie0-R5-to-pcie1-to-get-6G-ICS.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0054-mtk-mt76-change-pcie0-R5-to-pcie1-to-get-6G-ICS.patch
index d021759..599e161 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0066-mtk-mt76-change-pcie0-R5-to-pcie1-to-get-6G-ICS.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0054-mtk-mt76-change-pcie0-R5-to-pcie1-to-get-6G-ICS.patch
@@ -1,8 +1,9 @@
-From 84de1f40cbb93804a270e3d70824ccf8e8e5f1e7 Mon Sep 17 00:00:00 2001
+From 161b4dc2bb1f3d69b57f195fbab8fc8f6dfbe2bc Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Fri, 6 Oct 2023 14:01:41 +0800
-Subject: [PATCH 066/199] mtk: mt76: change pcie0 R5 to pcie1 to get 6G ICS
+Subject: [PATCH 054/223] mtk: mt76: change pcie0 R5 to pcie1 to get 6G ICS
 
+Change-Id: I23a94e3e4b797b513a303b13e4c50e0a0d72bffb
 ---
  mt7996/dma.c  | 4 ++++
  mt7996/init.c | 6 ++----
@@ -25,7 +26,7 @@
  				       MT_RXQ_ID(MT_RXQ_BAND2),
  				       MT7996_RX_RING_SIZE,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 8b642ecc..6563974d 100644
+index eac00df0..f493a373 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -651,10 +651,8 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
@@ -42,7 +43,7 @@
  
  	return 0;
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 928a9663..7940621b 100644
+index 40e45fb2..11470645 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -527,12 +527,15 @@ static void mt7996_irq_tasklet(struct tasklet_struct *t)
@@ -63,5 +64,5 @@
  		mt76_wr(dev, MT_INT_MASK_CSR, 0);
  		if (dev->hif2)
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0067-mtk-mt76-add-SER-support-for-wed3.0.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0055-mtk-mt76-add-SER-support-for-wed3.0.patch
similarity index 79%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0067-mtk-mt76-add-SER-support-for-wed3.0.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0055-mtk-mt76-add-SER-support-for-wed3.0.patch
index 11a6537..1020992 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0067-mtk-mt76-add-SER-support-for-wed3.0.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0055-mtk-mt76-add-SER-support-for-wed3.0.patch
@@ -1,8 +1,9 @@
-From b8b41987d94d7fca7bcf9f6b7204e62528322ecc Mon Sep 17 00:00:00 2001
+From ce0ee1b6c2ae27eb6416b6eaa0191e09170e900c Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Tue, 23 May 2023 12:06:29 +0800
-Subject: [PATCH 067/199] mtk: mt76: add SER support for wed3.0
+Subject: [PATCH 055/223] mtk: mt76: add SER support for wed3.0
 
+Change-Id: I2711b9dc336fca9a1ae32a8fbf27810a7e27b1e3
 ---
  dma.c         | 5 +++--
  mt7996/mmio.c | 1 +
@@ -25,7 +26,7 @@
  		mt76_dma_rx_fill(dev, q, false);
  	}
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 7940621b..0d25c5ff 100644
+index 11470645..55d83f1d 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -297,6 +297,7 @@ out:
@@ -37,5 +38,5 @@
  
  int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0068-mtk-mt76-find-rx-token-by-physical-address.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0056-mtk-mt76-find-rx-token-by-physical-address.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0068-mtk-mt76-find-rx-token-by-physical-address.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0056-mtk-mt76-find-rx-token-by-physical-address.patch
index 1c5a1fb..3e66d5f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0068-mtk-mt76-find-rx-token-by-physical-address.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0056-mtk-mt76-find-rx-token-by-physical-address.patch
@@ -1,12 +1,13 @@
-From d19b337c221ed6c72d9733c3206bcd6f24b3a774 Mon Sep 17 00:00:00 2001
+From a0322640da7756faf08c31cf93d69a61f766c545 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Wed, 19 Jul 2023 10:55:09 +0800
-Subject: [PATCH 068/199] mtk: mt76: find rx token by physical address
+Subject: [PATCH 056/223] mtk: mt76: find rx token by physical address
 
 The token id in RxDMAD may be incorrect when it is not the last frame in
 WED HW. Lookup correct token id by physical address in sdp0.
 Add len == 0 check to drop garbage frames
 
+Change-Id: I4cd90294ad24990826075e92a710cc4e301dcbb7
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  dma.c | 27 +++++++++++++++++++++++++--
@@ -60,5 +61,5 @@
  
  		if (q->rx_head)
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0057-mtk-mt76-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0057-mtk-mt76-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch
deleted file mode 100644
index 98b83ee..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0057-mtk-mt76-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch
+++ /dev/null
@@ -1,168 +0,0 @@
-From 0a01643db7a700b8d78b3a1b33944bcf0fb4185d Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Tue, 5 Dec 2023 16:48:33 +0800
-Subject: [PATCH 057/199] mtk: mt76: mt7996: add Eagle 2adie TBTC (BE14000)
- support
-
-Add fwdl/default eeprom load support for Eagle 2 adie TBTC
-
-Add Eagle 2adie TBTC efuse merge
-Add Eagle 2adie TBTC group prek size
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt7996/eeprom.c | 11 +++++++++--
- mt7996/eeprom.h | 12 ++++++++++++
- mt7996/init.c   |  5 +++++
- mt7996/mcu.c    |  5 +++++
- mt7996/mt7996.h |  9 +++++++++
- mt7996/regs.h   |  1 +
- 6 files changed, 41 insertions(+), 2 deletions(-)
-
-diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 8cdd6d96..fb4d031f 100644
---- a/mt7996/eeprom.c
-+++ b/mt7996/eeprom.c
-@@ -158,6 +158,11 @@ const char *mt7996_eeprom_name(struct mt7996_dev *dev)
- 	case 0x7990:
- 		if (dev->chip_sku == MT7996_SKU_404)
- 			return MT7996_EEPROM_DEFAULT_404;
-+		else if (dev->chip_sku == MT7996_SKU_233 &&
-+			 dev->fem_type == MT7996_FEM_INT)
-+			return MT7996_EEPROM_DEFAULT_233_INT;
-+		else if (dev->chip_sku == MT7996_SKU_233)
-+			return MT7996_EEPROM_DEFAULT_233;
- 
- 		if (dev->fem_type == MT7996_FEM_INT)
- 			return MT7996_EEPROM_DEFAULT_INT;
-@@ -450,6 +455,8 @@ static void mt7996_eeprom_init_precal(struct mt7996_dev *dev)
- 	switch (mt76_chip(&dev->mt76)) {
- 	case 0x7990:
- 		dev->prek.rev = mt7996_prek_rev;
-+		if (dev->chip_sku == MT7996_SKU_233)
-+			dev->prek.rev = mt7996_prek_rev_233;
- 		/* 5g & 6g bw 80 dpd channel list is not used */
- 		dev->prek.dpd_ch_num[DPD_CH_NUM_BW320_6G] = ARRAY_SIZE(dpd_6g_ch_list_bw320);
- 		break;
-@@ -553,7 +560,7 @@ static int mt7996_apply_cal_free_data(struct mt7996_dev *dev)
- 	case 0x7990:
- 		adie_base = adie_base_7996;
- 		/* adie 0 */
--		if (dev->fem_type == MT7996_FEM_INT)
-+		if (dev->fem_type == MT7996_FEM_INT && dev->chip_sku != MT7996_SKU_233)
- 			adie_id = ADIE_7975;
- 		else
- 			adie_id = ADIE_7976;
-@@ -561,7 +568,7 @@ static int mt7996_apply_cal_free_data(struct mt7996_dev *dev)
- 		eep_offs[0] = eep_offs_list[adie_id];
- 
- 		/* adie 1 */
--		if (dev->chip_sku != MT7996_SKU_404) {
-+		if (dev->chip_sku == MT7996_SKU_444) {
- 			adie_offs[1] = adie_offs_list[ADIE_7977];
- 			eep_offs[1] = eep_offs_list[ADIE_7977];
- 		}
-diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index fa9c31e7..43c9783c 100644
---- a/mt7996/eeprom.h
-+++ b/mt7996/eeprom.h
-@@ -70,6 +70,18 @@ static const u32 mt7996_prek_rev[] = {
- 	[DPD_OTFG0_SIZE] =			2 * MT_EE_CAL_UNIT,
- };
- 
-+static const u32 mt7996_prek_rev_233[] = {
-+	[GROUP_SIZE_2G] =			4 * MT_EE_CAL_UNIT,
-+	[GROUP_SIZE_5G] =			44 * MT_EE_CAL_UNIT,
-+	[GROUP_SIZE_6G] =			100 * MT_EE_CAL_UNIT,
-+	[ADCDCOC_SIZE_2G] =			4 * 4,
-+	[ADCDCOC_SIZE_5G] =			4 * 4,
-+	[ADCDCOC_SIZE_6G] =			4 * 5,
-+	[DPD_LEGACY_SIZE] =			4 * MT_EE_CAL_UNIT,
-+	[DPD_MEM_SIZE] =			13 * MT_EE_CAL_UNIT,
-+	[DPD_OTFG0_SIZE] =			2 * MT_EE_CAL_UNIT,
-+};
-+
- /* kite 2/5g config */
- static const u32 mt7992_prek_rev[] = {
- 	[GROUP_SIZE_2G] =			4 * MT_EE_CAL_UNIT,
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 0201d9fc..342f15fb 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -918,6 +918,11 @@ int mt7996_get_chip_sku(struct mt7996_dev *dev)
- 
- 	switch (mt76_chip(&dev->mt76)) {
- 	case 0x7990:
-+		if (FIELD_GET(MT_PAD_GPIO_2ADIE_TBTC, val)) {
-+			dev->chip_sku = MT7996_SKU_233;
-+			break;
-+		}
-+
- 		adie_comb = FIELD_GET(MT_PAD_GPIO_ADIE_COMB, val);
- 		if (adie_comb <= 1)
- 			dev->chip_sku = MT7996_SKU_444;
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 1c98d179..9bef1274 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -23,6 +23,11 @@
- 			_fw = MT7992_##name;			\
- 		break;						\
- 	case 0x7990:						\
-+		if ((_dev)->chip_sku == MT7996_SKU_233)		\
-+			_fw = MT7996_##name##_233;		\
-+		else						\
-+			_fw = MT7996_##name;			\
-+		break;						\
- 	default:						\
- 		_fw = MT7996_##name;				\
- 		break;						\
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 34886128..294818b4 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -35,6 +35,12 @@
- #define MT7996_FIRMWARE_WM_TM		"mediatek/mt7996/mt7996_wm_tm.bin"
- #define MT7996_ROM_PATCH		"mediatek/mt7996/mt7996_rom_patch.bin"
- 
-+#define MT7996_FIRMWARE_WA_233		"mediatek/mt7996/mt7996_wa_233.bin"
-+#define MT7996_FIRMWARE_WM_233		"mediatek/mt7996/mt7996_wm_233.bin"
-+#define MT7996_FIRMWARE_DSP_233		MT7996_FIRMWARE_DSP
-+#define MT7996_FIRMWARE_WM_TM_233	"mediatek/mt7996/mt7996_wm_tm_233.bin"
-+#define MT7996_ROM_PATCH_233		"mediatek/mt7996/mt7996_rom_patch_233.bin"
-+
- #define MT7992_FIRMWARE_WA		"mediatek/mt7996/mt7992_wa.bin"
- #define MT7992_FIRMWARE_WM		"mediatek/mt7996/mt7992_wm.bin"
- #define MT7992_FIRMWARE_DSP		"mediatek/mt7996/mt7992_dsp.bin"
-@@ -55,6 +61,8 @@
- 
- #define MT7996_EEPROM_DEFAULT		"mediatek/mt7996/mt7996_eeprom.bin"
- #define MT7996_EEPROM_DEFAULT_INT	"mediatek/mt7996/mt7996_eeprom_2i5i6i.bin"
-+#define MT7996_EEPROM_DEFAULT_233	"mediatek/mt7996/mt7996_eeprom_233.bin"
-+#define MT7996_EEPROM_DEFAULT_233_INT	"mediatek/mt7996/mt7996_eeprom_233_2i5i6i.bin"
- #define MT7996_EEPROM_DEFAULT_404	"mediatek/mt7996/mt7996_eeprom_dual_404.bin"
- #define MT7992_EEPROM_DEFAULT		"mediatek/mt7996/mt7992_eeprom_2e5e.bin"
- #define MT7992_EEPROM_DEFAULT_INT	"mediatek/mt7996/mt7992_eeprom_2i5i.bin"
-@@ -122,6 +130,7 @@ enum mt7996_fem_type {
- enum mt7996_sku_type {
- 	MT7996_SKU_404,
- 	MT7996_SKU_444,
-+	MT7996_SKU_233,
- };
- 
- enum mt7992_sku_type {
-diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 263737c5..91159c63 100644
---- a/mt7996/regs.h
-+++ b/mt7996/regs.h
-@@ -666,6 +666,7 @@ enum offs_rev {
- 
- #define MT_PAD_GPIO				0x700056f0
- #define MT_PAD_GPIO_ADIE_COMB			GENMASK(16, 15)
-+#define MT_PAD_GPIO_2ADIE_TBTC			BIT(19)
- #define MT_PAD_GPIO_ADIE_COMB_7992		GENMASK(17, 16)
- #define MT_PAD_GPIO_ADIE_NUM_7992		BIT(15)
- 
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0069-mtk-mt76-mt7996-add-dma-mask-limitation.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0057-mtk-mt76-mt7996-add-dma-mask-limitation.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0069-mtk-mt76-mt7996-add-dma-mask-limitation.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0057-mtk-mt76-mt7996-add-dma-mask-limitation.patch
index 1a394f6..b38d794 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0069-mtk-mt76-mt7996-add-dma-mask-limitation.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0057-mtk-mt76-mt7996-add-dma-mask-limitation.patch
@@ -1,7 +1,7 @@
-From 71b485441f2bc88349b4d69022965c85560ae52b Mon Sep 17 00:00:00 2001
+From 8509256a66d237ebf813fc1ddd9d2a913465c02b Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 20 Jul 2023 10:25:50 +0800
-Subject: [PATCH 069/199] mtk: mt76: mt7996: add dma mask limitation
+Subject: [PATCH 057/223] mtk: mt76: mt7996: add dma mask limitation
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 ---
@@ -53,5 +53,5 @@
  			mt76_put_rxwi(dev, r);
  			goto unmap;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0058-mtk-mt76-mt7996-add-background-radar-hw-cap-check.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0058-mtk-mt76-mt7996-add-background-radar-hw-cap-check.patch
deleted file mode 100644
index be8bf16..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0058-mtk-mt76-mt7996-add-background-radar-hw-cap-check.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From bfb5a104b7f24c396a444916d3755122b916153e Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Fri, 22 Dec 2023 17:27:10 +0800
-Subject: [PATCH 058/199] mtk: mt76: mt7996: add background radar hw cap check
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt7996/debugfs.c |  5 +++++
- mt7996/init.c    |  7 ++++---
- mt7996/mt7996.h  | 20 ++++++++++++++++++++
- 3 files changed, 29 insertions(+), 3 deletions(-)
-
-diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 58879695..6d119467 100644
---- a/mt7996/debugfs.c
-+++ b/mt7996/debugfs.c
-@@ -262,6 +262,11 @@ mt7996_rdd_monitor(struct seq_file *s, void *data)
- 
- 	mutex_lock(&dev->mt76.mutex);
- 
-+	if (!mt7996_get_background_radar_cap(dev)) {
-+		seq_puts(s, "no background radar capability\n");
-+		goto out;
-+	}
-+
- 	if (!cfg80211_chandef_valid(chandef)) {
- 		ret = -EINVAL;
- 		goto out;
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 342f15fb..ade07db7 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -406,9 +406,10 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
- 
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION);
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_PROTECTION);
--	if (!mdev->dev->of_node ||
--	    !of_property_read_bool(mdev->dev->of_node,
--				   "mediatek,disable-radar-background"))
-+	if (mt7996_get_background_radar_cap(phy->dev) &&
-+	    (!mdev->dev->of_node ||
-+	     !of_property_read_bool(mdev->dev->of_node,
-+				    "mediatek,disable-radar-background")))
- 		wiphy_ext_feature_set(wiphy,
- 				      NL80211_EXT_FEATURE_RADAR_BACKGROUND);
- 
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 294818b4..784fb3db 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -606,6 +606,26 @@ mt7996_band_valid(struct mt7996_dev *dev, u8 band)
- 	return band == MT_BAND0 || band == MT_BAND2;
- }
- 
-+static inline bool
-+mt7996_get_background_radar_cap(struct mt7996_dev *dev)
-+{
-+	switch (mt76_chip(&dev->mt76)) {
-+	case 0x7990:
-+		if (dev->chip_sku == MT7996_SKU_233)
-+			return 0;
-+		break;
-+	case 0x7992:
-+		if (dev->chip_sku == MT7992_SKU_23 ||
-+		    dev->chip_sku == MT7992_SKU_24)
-+			return 0;
-+		break;
-+	default:
-+		break;
-+	}
-+
-+	return 1;
-+}
-+
- extern const struct ieee80211_ops mt7996_ops;
- extern struct pci_driver mt7996_pci_driver;
- extern struct pci_driver mt7996_hif_driver;
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0070-mtk-mt76-mt7996-add-per-bss-statistic-info.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0058-mtk-mt76-mt7996-add-per-bss-statistic-info.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0070-mtk-mt76-mt7996-add-per-bss-statistic-info.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0058-mtk-mt76-mt7996-add-per-bss-statistic-info.patch
index 38d9ef7..dfae6e1 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0070-mtk-mt76-mt7996-add-per-bss-statistic-info.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0058-mtk-mt76-mt7996-add-per-bss-statistic-info.patch
@@ -1,7 +1,7 @@
-From 05a99ecc4978355bccc95be925a2b479754b193c Mon Sep 17 00:00:00 2001
+From 663d6e60f6a431146594178ffbbbf7fd54180c38 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Fri, 18 Aug 2023 10:17:08 +0800
-Subject: [PATCH 070/199] mtk: mt76: mt7996: add per bss statistic info
+Subject: [PATCH 058/223] mtk: mt76: mt7996: add per bss statistic info
 
 Whenever WED is enabled, unicast traffic might run through HW path.
 As a result, we need to count them using WM event.
@@ -22,7 +22,7 @@
  3 files changed, 37 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 6563974d..9d918268 100644
+index f493a373..f6cddac1 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -403,6 +403,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -34,7 +34,7 @@
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION);
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_PROTECTION);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 3bc9dc15..d26c55ed 100644
+index f02f447e..dcf1fc38 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -265,6 +265,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
@@ -46,10 +46,10 @@
  
  	mt7996_mac_wtbl_update(dev, idx,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 7fa44f84..061461fb 100644
+index 70e1984a..8b84c9dc 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -524,6 +524,27 @@ mt7996_mcu_update_tx_gi(struct rate_info *rate, struct all_sta_trx_rate *mcu_rat
+@@ -529,6 +529,27 @@ mt7996_mcu_update_tx_gi(struct rate_info *rate, struct all_sta_trx_rate *mcu_rat
  	return 0;
  }
  
@@ -77,7 +77,7 @@
  static void
  mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  {
-@@ -539,7 +560,7 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -544,7 +565,7 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  		u16 wlan_idx;
  		struct mt76_wcid *wcid;
  		struct mt76_phy *mphy;
@@ -86,7 +86,7 @@
  
  		switch (le16_to_cpu(res->tag)) {
  		case UNI_ALL_STA_TXRX_RATE:
-@@ -567,6 +588,9 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -572,6 +593,9 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  				wcid->stats.tx_bytes += tx_bytes;
  				wcid->stats.rx_bytes += rx_bytes;
  
@@ -96,7 +96,7 @@
  				ieee80211_tpt_led_trig_tx(mphy->hw, tx_bytes);
  				ieee80211_tpt_led_trig_rx(mphy->hw, rx_bytes);
  			}
-@@ -578,10 +602,16 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -583,10 +607,16 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  			if (!wcid)
  				break;
  
@@ -118,5 +118,5 @@
  		default:
  			break;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0071-mtk-mt76-mt7996-do-not-report-netdev-stats-on-monito.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0059-mtk-mt76-mt7996-do-not-report-netdev-stats-on-monito.patch
similarity index 77%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0071-mtk-mt76-mt7996-do-not-report-netdev-stats-on-monito.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0059-mtk-mt76-mt7996-do-not-report-netdev-stats-on-monito.patch
index 72d71ff..7cede7a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0071-mtk-mt76-mt7996-do-not-report-netdev-stats-on-monito.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0059-mtk-mt76-mt7996-do-not-report-netdev-stats-on-monito.patch
@@ -1,7 +1,7 @@
-From 5d4625368dbd91070333a90e6e779d09cd6d3ca8 Mon Sep 17 00:00:00 2001
+From 4fa8ea3f212978e36a7b9489505545f655d7e3e1 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 26 Oct 2023 17:27:43 +0800
-Subject: [PATCH 071/199] mtk: mt76: mt7996: do not report netdev stats on
+Subject: [PATCH 059/223] mtk: mt76: mt7996: do not report netdev stats on
  monitor vif
 
 This fixes the following NULL pointer crash when enabling monitor mode:
@@ -13,16 +13,17 @@
 [  205.613935]  napi_threaded_poll+0x80/0xe8
 [  205.617934]  kthread+0x124/0x128
 
+Change-Id: I66f2449401888255bf8d3edddc1d9f20bd8ba3e7
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mt7996/mcu.c | 3 +++
  1 file changed, 3 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 061461fb..9d96218b 100644
+index 8b84c9dc..6b7a5372 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -540,6 +540,9 @@ static inline void __mt7996_stat_to_netdev(struct mt76_phy *mphy,
+@@ -545,6 +545,9 @@ static inline void __mt7996_stat_to_netdev(struct mt76_phy *mphy,
  				   drv_priv);
  		wdev = ieee80211_vif_to_wdev(vif);
  
@@ -33,5 +34,5 @@
  		dev_sw_netstats_rx_add(wdev->netdev, rx_packets, rx_bytes);
  	}
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0060-mtk-mt76-mt7996-add-kite-part-number-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0060-mtk-mt76-mt7996-add-kite-part-number-support.patch
deleted file mode 100644
index 04ce43c..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0060-mtk-mt76-mt7996-add-kite-part-number-support.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From 32201406775dc530ae7f62a0f0bdc0af09b69dd8 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Wed, 27 Mar 2024 17:50:16 +0800
-Subject: [PATCH 060/199] mtk: mt76: mt7996: add kite part number support
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt7996/eeprom.c | 35 +++++++++++++++++++++++------------
- 1 file changed, 23 insertions(+), 12 deletions(-)
-
-diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index dffcd09d..c4714982 100644
---- a/mt7996/eeprom.c
-+++ b/mt7996/eeprom.c
-@@ -319,26 +319,39 @@ out:
- 	return ret;
- }
- 
--static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_dev *dev)
-+static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_phy *phy,
-+					    u8 *path, u8 *rx_path, u8 *nss)
- {
- #define MODE_HE_ONLY		BIT(0)
-+#define STREAM_MASK		GENMASK(2, 0)
-+#define STREAM_OFFSET		1
-+#define TX_PATH_OFFSET		10
-+#define RX_PATH_OFFSET		19
- #define WTBL_SIZE_GROUP		GENMASK(31, 28)
-+#define GET_STREAM_CAP(offs)	({				\
-+	typeof(offs) _offs = (offs);				\
-+	((cap & (STREAM_MASK << _offs)) >> _offs);		\
-+})
-+	struct mt7996_dev *dev = phy->dev;
- 	u32 cap = 0;
- 	int ret;
-+	u8 band_offs = phy->mt76->band_idx * hweight8(STREAM_MASK);
- 
- 	ret = mt7996_mcu_get_chip_config(dev, &cap);
- 	if (ret)
- 		return ret;
- 
--	cap = 0x4b249248;	/* internal hardcode */
-+	dev->has_eht = true;
- 	if (cap) {
- 		dev->has_eht = !(cap & MODE_HE_ONLY);
- 		dev->wtbl_size_group = u32_get_bits(cap, WTBL_SIZE_GROUP);
-+		*nss = min_t(u8, *nss, GET_STREAM_CAP(STREAM_OFFSET + band_offs));
-+		*path = min_t(u8, *path, GET_STREAM_CAP(TX_PATH_OFFSET + band_offs));
-+		*rx_path = min_t(u8, *rx_path, GET_STREAM_CAP(RX_PATH_OFFSET + band_offs));
- 	}
- 
--	if (dev->wtbl_size_group < 2 || dev->wtbl_size_group > 4 ||
--	    is_mt7992(&dev->mt76))
--		dev->wtbl_size_group = 2; /* set default */
-+	if (dev->wtbl_size_group < 2 || dev->wtbl_size_group > 4)
-+		dev->wtbl_size_group = is_mt7996(&dev->mt76) ? 4 : 2;	/* set default */
- 
- 	return 0;
- }
-@@ -382,13 +395,15 @@ static int mt7996_eeprom_parse_band_config(struct mt7996_phy *phy)
- 
- int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy)
- {
-+	struct mt76_phy *mphy = phy->mt76;
- 	u8 path, rx_path, nss, band_idx = phy->mt76->band_idx;
- 	u8 *eeprom = dev->mt76.eeprom.data;
--	struct mt76_phy *mphy = phy->mt76;
--	int max_path = 5, max_nss = 4;
--	int ret;
-+	int ret, max_path = 5, max_nss = 4;
- 
- 	mt7996_parse_eeprom_stream(eeprom, band_idx, &path, &rx_path, &nss);
-+	ret = mt7996_eeprom_parse_efuse_hw_cap(phy, &path, &rx_path, &nss);
-+	if (ret)
-+		return ret;
- 
- 	if (!path || path > max_path)
- 		path = max_path;
-@@ -408,10 +423,6 @@ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy)
- 		dev->chainshift[band_idx + 1] = dev->chainshift[band_idx] +
- 						hweight16(mphy->chainmask);
- 
--	ret = mt7996_eeprom_parse_efuse_hw_cap(dev);
--	if (ret)
--		return ret;
--
- 	return mt7996_eeprom_parse_band_config(phy);
- }
- 
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0072-mtk-mt76-mt7996-add-support-for-HW-ATF.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0060-mtk-mt76-mt7996-add-support-for-HW-ATF.patch
similarity index 95%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0072-mtk-mt76-mt7996-add-support-for-HW-ATF.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0060-mtk-mt76-mt7996-add-support-for-HW-ATF.patch
index 3cc57cb..3c7f0bd 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0072-mtk-mt76-mt7996-add-support-for-HW-ATF.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0060-mtk-mt76-mt7996-add-support-for-HW-ATF.patch
@@ -1,7 +1,7 @@
-From bf2d3c5764a6c6377cf9d806b4320ae4fdb5afa5 Mon Sep 17 00:00:00 2001
+From e8d00b434ed9f3e4ac5bc4aa5486331bd948a4c3 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Mon, 11 Sep 2023 16:35:15 +0800
-Subject: [PATCH 072/199] mtk: mt76: mt7996: add support for HW-ATF
+Subject: [PATCH 060/223] mtk: mt76: mt7996: add support for HW-ATF
 
 ---
  mt7996/debugfs.c |  90 ++++++++++++++++
@@ -13,7 +13,7 @@
  6 files changed, 475 insertions(+), 26 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 3301701a..3b58b8ba 100644
+index e328a056..0ef8fee6 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -927,6 +927,91 @@ static const struct file_operations mt7996_efuse_ops = {
@@ -121,7 +121,7 @@
  	if (phy->mt76->cap.has_5ghz) {
  		debugfs_create_u32("dfs_hw_pattern", 0400, dir,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 9d918268..440c4b7c 100644
+index f6cddac1..ac0ef6c1 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -575,6 +575,37 @@ int mt7996_txbf_init(struct mt7996_dev *dev)
@@ -175,7 +175,7 @@
  	ret = mt7996_init_debugfs(phy);
  	if (ret)
  		goto error;
-@@ -1483,6 +1520,12 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1493,6 +1530,12 @@ int mt7996_register_device(struct mt7996_dev *dev)
  
  	dev->recovery.hw_init_done = true;
  
@@ -189,7 +189,7 @@
  	if (ret)
  		goto error;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 0c2fee66..dfc68a19 100644
+index 1c0c2796..094d6420 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -103,6 +103,7 @@ static void mt7996_mac_sta_poll(struct mt7996_dev *dev)
@@ -220,10 +220,10 @@
  
  		/* get signal strength of resp frames (CTS/BA/ACK) */
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 9d96218b..4bcc415f 100644
+index 6b7a5372..6b78357d 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2225,34 +2225,37 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2230,34 +2230,37 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  }
  
  static int
@@ -285,7 +285,7 @@
  }
  
  int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-@@ -2311,7 +2314,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2318,7 +2321,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  		mt7996_mcu_sta_bfee_tlv(dev, skb, vif, sta);
  	}
  
@@ -294,7 +294,7 @@
  	if (ret) {
  		dev_kfree_skb(skb);
  		return ret;
-@@ -5188,6 +5191,218 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
+@@ -5214,6 +5217,218 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
  				 &req, sizeof(req), false);
  }
  
@@ -526,10 +526,10 @@
  	UNI_VOW_RX_AT_AIRTIME_CLR_EN = 0x0e,
  	UNI_VOW_RED_ENABLE = 0x18,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index d40f95cd..a933e739 100644
+index 8d222a0c..ed38a8ab 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -115,6 +115,12 @@
+@@ -117,6 +117,12 @@
  #define MT7996_RX_MSDU_PAGE_SIZE	(128 + \
  					 SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
  
@@ -542,7 +542,7 @@
  struct mt7996_vif;
  struct mt7996_sta;
  struct mt7996_dfs_pulse;
-@@ -216,6 +222,81 @@ enum mt7996_dpd_ch_num {
+@@ -217,6 +223,81 @@ enum mt7996_dpd_ch_num {
  	DPD_CH_NUM_TYPE_MAX,
  };
  
@@ -624,7 +624,7 @@
  struct mt7996_sta {
  	struct mt76_wcid wcid; /* must be first */
  
-@@ -235,6 +316,8 @@ struct mt7996_sta {
+@@ -236,6 +317,8 @@ struct mt7996_sta {
  		u8 flowid_mask;
  		struct mt7996_twt_flow flow[MT7996_MAX_STA_TWT_AGRT];
  	} twt;
@@ -633,15 +633,15 @@
  };
  
  struct mt7996_vif {
-@@ -500,6 +583,7 @@ struct mt7996_dev {
- 
- 	u8 wtbl_size_group;
+@@ -505,6 +588,7 @@ struct mt7996_dev {
+ 		u8 fem:4;
+ 	} var;
  
 +	struct mt7996_vow_ctrl vow;
  #ifdef CONFIG_MTK_DEBUG
  	u16 wlan_idx;
  	struct {
-@@ -740,10 +824,12 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy);
+@@ -744,10 +828,12 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy);
  #ifdef CONFIG_NL80211_TESTMODE
  void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb);
  #endif
@@ -655,7 +655,7 @@
  
  static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
  {
-@@ -793,6 +879,14 @@ static inline u16 mt7996_rx_chainmask(struct mt7996_phy *phy)
+@@ -797,6 +883,14 @@ static inline u16 mt7996_rx_chainmask(struct mt7996_phy *phy)
  	return tx_chainmask | (BIT(fls(tx_chainmask)) * phy->has_aux_rx);
  }
  
@@ -671,5 +671,5 @@
  u32 mt7996_mac_wtbl_lmac_addr(struct mt7996_dev *dev, u16 wcid, u8 dw);
  bool mt7996_mac_wtbl_update(struct mt7996_dev *dev, int idx, u32 mask);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0073-mtk-mt76-mt7996-add-SER0.5-support-w-wed3.0.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0061-mtk-mt76-mt7996-add-SER0.5-support-w-wed3.0.patch
similarity index 95%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0073-mtk-mt76-mt7996-add-SER0.5-support-w-wed3.0.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0061-mtk-mt76-mt7996-add-SER0.5-support-w-wed3.0.patch
index dae5c07..fb1f214 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0073-mtk-mt76-mt7996-add-SER0.5-support-w-wed3.0.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0061-mtk-mt76-mt7996-add-SER0.5-support-w-wed3.0.patch
@@ -1,8 +1,9 @@
-From 73693f3833455addeaa13764ba39917f4fe8e171 Mon Sep 17 00:00:00 2001
+From 23ce8e7268d891e3d762e1058986a5850258c89b Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 12 Oct 2023 10:04:54 +0800
-Subject: [PATCH 073/199] mtk: mt76: mt7996: add SER0.5 support w/ wed3.0
+Subject: [PATCH 061/223] mtk: mt76: mt7996: add SER0.5 support w/ wed3.0
 
+Change-Id: I9b26cdbea6e8ee158a153fd153c2dea77b494f2f
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 ---
  dma.c           |   9 ++--
@@ -71,10 +72,10 @@
  		mt76_wed_dma_setup(dev, q, true);
  }
 diff --git a/mt76.h b/mt76.h
-index f2052cf7..1236ddb4 100644
+index 2798f9e5..8bf37558 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -301,7 +301,7 @@ struct mt76_queue_ops {
+@@ -305,7 +305,7 @@ struct mt76_queue_ops {
  
  	void (*kick)(struct mt76_dev *dev, struct mt76_queue *q);
  
@@ -83,7 +84,7 @@
  };
  
  enum mt76_phy_type {
-@@ -1742,8 +1742,13 @@ static inline bool mt76_queue_is_wed_rro_ind(struct mt76_queue *q)
+@@ -1758,8 +1758,13 @@ static inline bool mt76_queue_is_wed_rro_ind(struct mt76_queue *q)
  static inline bool mt76_queue_is_wed_rro_data(struct mt76_queue *q)
  {
  	return mt76_queue_is_wed_rro(q) &&
@@ -99,7 +100,7 @@
  }
  
  static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
-@@ -1752,7 +1757,8 @@ static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
+@@ -1768,7 +1773,8 @@ static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
  		return false;
  
  	return FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX ||
@@ -172,7 +173,7 @@
  	mt7996_dma_enable(dev, !force);
  }
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 440c4b7c..3b1f4273 100644
+index ac0ef6c1..b0c307fb 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -737,11 +737,91 @@ void mt7996_wfsys_reset(struct mt7996_dev *dev)
@@ -322,10 +323,10 @@
  #else
  	return 0;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index dfc68a19..be3fea21 100644
+index 094d6420..d58177ec 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1761,6 +1761,31 @@ mt7996_mac_restart(struct mt7996_dev *dev)
+@@ -1773,6 +1773,31 @@ mt7996_mac_restart(struct mt7996_dev *dev)
  	if (ret)
  		goto out;
  
@@ -358,10 +359,10 @@
  	ret = mt7996_mcu_set_eeprom(dev);
  	if (ret)
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index a933e739..f0288cca 100644
+index ed38a8ab..674f9de1 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -719,6 +719,7 @@ extern const struct mt76_testmode_ops mt7996_testmode_ops;
+@@ -723,6 +723,7 @@ extern const struct mt76_testmode_ops mt7996_testmode_ops;
  struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
  				     void __iomem *mem_base, u32 device_id);
  void mt7996_wfsys_reset(struct mt7996_dev *dev);
@@ -392,5 +393,5 @@
  		mtk_wed_device_ind_rx_ring_setup(q->wed, q->regs);
  		break;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0074-mtk-mt76-mt7996-support-backaward-compatiable.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0062-mtk-mt76-mt7996-support-backaward-compatiable.patch
similarity index 90%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0074-mtk-mt76-mt7996-support-backaward-compatiable.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0062-mtk-mt76-mt7996-support-backaward-compatiable.patch
index 45101c3..2313758 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0074-mtk-mt76-mt7996-support-backaward-compatiable.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0062-mtk-mt76-mt7996-support-backaward-compatiable.patch
@@ -1,7 +1,7 @@
-From f5504bc5f7c41c0d8f1c944dd34cf22f284ed1c8 Mon Sep 17 00:00:00 2001
+From 8078f6868b60b6468958fd0990c5a697e1ac12df Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Fri, 6 Oct 2023 20:59:42 +0800
-Subject: [PATCH 074/199] mtk: mt76: mt7996: support backaward compatiable
+Subject: [PATCH 062/223] mtk: mt76: mt7996: support backaward compatiable
 
 revert upstream wed trigger mode to polling mode
 
@@ -11,6 +11,8 @@
 [Release-log]
 N/A
 
+Change-Id: Ifd40df7094052b13e26f42f09908f6404917ad8e
+Change-Id: I337f41aa80758d00b4c8e7a5cc4d6faeb6f0a4a2
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 Signed-off-by: mtk27745 <rex.lu@mediatek.com>
 Signed-off-by: Rex Lu <rex.lu@mediatek.com>
@@ -25,10 +27,10 @@
  7 files changed, 24 insertions(+), 17 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 1236ddb4..e3c209ff 100644
+index 8bf37558..e7901e57 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -53,6 +53,8 @@
+@@ -54,6 +54,8 @@
  
  #define MT76_TOKEN_FREE_THR	64
  
@@ -38,10 +40,10 @@
  #define MT_QFLAG_WED_TYPE	GENMASK(4, 2)
  #define MT_QFLAG_WED		BIT(5)
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index be3fea21..1792726c 100644
+index d58177ec..0c5fa02d 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1774,7 +1774,7 @@ mt7996_mac_restart(struct mt7996_dev *dev)
+@@ -1786,7 +1786,7 @@ mt7996_mac_restart(struct mt7996_dev *dev)
  		}
  
  		mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
@@ -50,7 +52,7 @@
  		mt7996_irq_enable(dev, wed_irq_mask);
  		mt7996_irq_disable(dev, 0);
  	}
-@@ -2006,6 +2006,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2018,6 +2018,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
  
  		mtk_wed_device_start_hw_rro(&dev->mt76.mmio.wed, wed_irq_mask,
  					    true);
@@ -59,10 +61,10 @@
  		mt7996_irq_disable(dev, 0);
  	}
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 4bcc415f..46611191 100644
+index 6b78357d..be273181 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3257,7 +3257,7 @@ static int mt7996_mcu_wa_red_config(struct mt7996_dev *dev)
+@@ -3265,7 +3265,7 @@ static int mt7996_mcu_wa_red_config(struct mt7996_dev *dev)
  
  	if (!mtk_wed_device_active(&dev->mt76.mmio.wed))
  		req.token_per_src[RED_TOKEN_SRC_CNT - 1] =
@@ -72,7 +74,7 @@
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET),
  				 &req, sizeof(req), false);
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 0d25c5ff..35573003 100644
+index 55d83f1d..ee9ba3ff 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -14,7 +14,7 @@
@@ -123,10 +125,10 @@
  #else
  	return 0;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index f0288cca..6254604f 100644
+index 674f9de1..1e17c291 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -74,6 +74,7 @@
+@@ -76,6 +76,7 @@
  #define MT7996_EEPROM_BLOCK_SIZE	16
  #define MT7996_TOKEN_SIZE		16384
  #define MT7996_HW_TOKEN_SIZE		8192
@@ -202,5 +204,5 @@
  }
  EXPORT_SYMBOL_GPL(mt76_wed_offload_disable);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0075-mtk-mt76-mt7996-add-wed-support-for-mt7992.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0063-mtk-mt76-mt7996-add-wed-support-for-mt7992.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0075-mtk-mt76-mt7996-add-wed-support-for-mt7992.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0063-mtk-mt76-mt7996-add-wed-support-for-mt7992.patch
index dde0b77..54343e8 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0075-mtk-mt76-mt7996-add-wed-support-for-mt7992.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0063-mtk-mt76-mt7996-add-wed-support-for-mt7992.patch
@@ -1,21 +1,22 @@
-From 3d75798a66a4bedb6b42cf28b7c79ed8076b263b Mon Sep 17 00:00:00 2001
+From efbc1e62252f25b9af9e812cd8a8ba61a9e043d0 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Fri, 8 Sep 2023 11:57:39 +0800
-Subject: [PATCH 075/199] mtk: mt76: mt7996: add wed support for mt7992
+Subject: [PATCH 063/223] mtk: mt76: mt7996: add wed support for mt7992
 
 Fix incomplete WED initialization for Kite band-1 RX ring.
 
+Change-Id: I2da06c9f1412f8392d1b55feea3ad8ff48ff90ad
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt7996/dma.c    | 91 +++++++++++++++++++++++++++++++++----------------
- mt7996/init.c   | 12 +++++++
+ mt7996/init.c   | 22 ++++++++++++
  mt7996/mac.c    |  4 +++
  mt7996/mmio.c   | 49 ++++++++++++++++++--------
  mt7996/mt7996.h | 10 +++++-
  mt7996/pci.c    | 10 ++++--
  mt7996/regs.h   | 14 +++++++-
- 7 files changed, 142 insertions(+), 48 deletions(-)
+ 7 files changed, 152 insertions(+), 48 deletions(-)
 
 diff --git a/mt7996/dma.c b/mt7996/dma.c
 index d9e1b17f..d62dc8ba 100644
@@ -166,7 +167,7 @@
  		if (mt7996_band_valid(dev, MT_BAND2)) {
  			/* rx rro data queue for band2 */
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 3b1f4273..f682423a 100644
+index b0c307fb..04c15432 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -815,6 +815,7 @@ void mt7996_rro_hw_init(struct mt7996_dev *dev)
@@ -195,11 +196,28 @@
  	ptr = dmam_alloc_coherent(dev->mt76.dma_dev,
  				  MT7996_RRO_WINDOW_MAX_LEN * sizeof(*addr),
  				  &dev->wed_rro.session.phy_addr,
+@@ -922,6 +934,16 @@ static void mt7996_wed_rro_free(struct mt7996_dev *dev)
+ 				   dev->wed_rro.addr_elem[i].phy_addr);
+ 	}
+ 
++	for (i = 0; i < ARRAY_SIZE(dev->wed_rro.msdu_pg); i++) {
++		if (!dev->wed_rro.msdu_pg[i].ptr)
++			continue;
++
++		dmam_free_coherent(dev->mt76.dma_dev,
++				   MT7996_RRO_MSDU_PG_SIZE_PER_CR,
++				   dev->wed_rro.msdu_pg[i].ptr,
++				   dev->wed_rro.msdu_pg[i].phy_addr);
++	}
++
+ 	if (!dev->wed_rro.session.ptr)
+ 		return;
+ 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 1792726c..1f3445bb 100644
+index 0c5fa02d..9f94f530 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2004,6 +2004,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2016,6 +2016,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
  
  		mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
  
@@ -211,7 +229,7 @@
  					    true);
  
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 35573003..bfe92ceb 100644
+index ee9ba3ff..82968bc2 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -313,7 +313,8 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
@@ -303,10 +321,10 @@
  		dev->mt76.rx_token_size = MT7996_TOKEN_SIZE + wed->wlan.rx_npkt;
  	}
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 6254604f..834e8fc0 100644
+index 1e17c291..7d0f7dda 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -122,6 +122,10 @@
+@@ -124,6 +124,10 @@
  #define MT7996_DRR_STA_AC2_QNTM_MASK	GENMASK(18, 16)
  #define MT7996_DRR_STA_AC3_QNTM_MASK	GENMASK(22, 20)
  
@@ -317,7 +335,7 @@
  struct mt7996_vif;
  struct mt7996_sta;
  struct mt7996_dfs_pulse;
-@@ -181,7 +185,7 @@ enum mt7996_rxq_id {
+@@ -182,7 +186,7 @@ enum mt7996_rxq_id {
  	MT7996_RXQ_BAND1 = 5, /* for mt7992 */
  	MT7996_RXQ_BAND2 = 5,
  	MT7996_RXQ_RRO_BAND0 = 8,
@@ -326,7 +344,7 @@
  	MT7996_RXQ_RRO_BAND2 = 6,
  	MT7996_RXQ_MSDU_PG_BAND0 = 10,
  	MT7996_RXQ_MSDU_PG_BAND1 = 11,
-@@ -547,6 +551,10 @@ struct mt7996_dev {
+@@ -548,6 +552,10 @@ struct mt7996_dev {
  			void *ptr;
  			dma_addr_t phy_addr;
  		} session;
@@ -374,7 +392,7 @@
  			goto free_wed_or_irq_vector;
  
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 91159c63..e6427a35 100644
+index f55d4a94..2ad8c069 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -77,6 +77,8 @@ enum offs_rev {
@@ -426,5 +444,5 @@
  #define MT_INT_RX_DONE_RRO_IND			BIT(11)
  #define MT_INT_RX_DONE_MSDU_PG_BAND0		BIT(18)
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0076-mtk-mt76-add-2pcie-one-wed-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0064-mtk-mt76-add-2pcie-one-wed-support.patch
similarity index 95%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0076-mtk-mt76-add-2pcie-one-wed-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0064-mtk-mt76-add-2pcie-one-wed-support.patch
index 0930043..897e666 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0076-mtk-mt76-add-2pcie-one-wed-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0064-mtk-mt76-add-2pcie-one-wed-support.patch
@@ -1,7 +1,7 @@
-From 52d7db874a75d9efdbec2f42bdff2ce917e6dd01 Mon Sep 17 00:00:00 2001
+From b6233b7c81cac3c7bc5147cf78ec403feb20e4a3 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Wed, 13 Sep 2023 17:35:43 +0800
-Subject: [PATCH 076/199] mtk: mt76: add 2pcie one wed support
+Subject: [PATCH 064/223] mtk: mt76: add 2pcie one wed support
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 ---
@@ -54,7 +54,7 @@
  			dev->mt76.q_rx[MT_RXQ_TXFREE_BAND0].wed = wed;
  
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index bfe92ceb..4baae0e9 100644
+index 82968bc2..1251382b 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -375,10 +375,10 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
@@ -99,10 +99,10 @@
  //#define WF_WFDMA_MCU_DMA0_BASE                                 0x02000
  #define WF_WFDMA_MCU_DMA0_BASE                                 0x54000000
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 1f754796..06c0db3f 100644
+index c1671e68..5a140f51 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -558,14 +558,22 @@ mt7996_show_dma_info(struct seq_file *s, struct mt7996_dev *dev)
+@@ -557,14 +557,22 @@ mt7996_show_dma_info(struct seq_file *s, struct mt7996_dev *dev)
  		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING4_CTRL0_ADDR);
  	dump_dma_rx_ring_info(s, dev, "R5:Data1(MAC2H)", "Both",
  		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING5_CTRL0_ADDR);
@@ -129,7 +129,7 @@
  	dump_dma_rx_ring_info(s, dev, "R10:MSDU_PG0(MAC2H)", "Both",
  		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING10_CTRL0_ADDR);
  	dump_dma_rx_ring_info(s, dev, "R11:MSDU_PG1(MAC2H)", "Both",
-@@ -583,15 +591,18 @@ mt7996_show_dma_info(struct seq_file *s, struct mt7996_dev *dev)
+@@ -582,15 +590,18 @@ mt7996_show_dma_info(struct seq_file *s, struct mt7996_dev *dev)
  			WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING21_CTRL0_ADDR);
  		dump_dma_tx_ring_info(s, dev, "T22:TXD?(H2WA)", "AP",
  			WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING22_CTRL0_ADDR);
@@ -152,7 +152,7 @@
  
  	/* MCU DMA information */
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index e6427a35..cbd71706 100644
+index 2ad8c069..87bf0012 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -411,6 +411,7 @@ enum offs_rev {
@@ -172,5 +172,5 @@
  
  #define MT_WFDMA_EXT_CSR_HIF_MISC		MT_WFDMA_EXT_CSR(0x44)
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0077-mtk-mt76-mt7996-Remove-wed-rro-ring-add-napi-at-init.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0065-mtk-mt76-mt7996-Remove-wed-rro-ring-add-napi-at-init.patch
similarity index 86%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0077-mtk-mt76-mt7996-Remove-wed-rro-ring-add-napi-at-init.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0065-mtk-mt76-mt7996-Remove-wed-rro-ring-add-napi-at-init.patch
index afa7f1a..62a315a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0077-mtk-mt76-mt7996-Remove-wed-rro-ring-add-napi-at-init.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0065-mtk-mt76-mt7996-Remove-wed-rro-ring-add-napi-at-init.patch
@@ -1,7 +1,7 @@
-From 04d9010a357a8d1d98aefd5263fbf8d27bc19d06 Mon Sep 17 00:00:00 2001
+From 3f8b5805f40b73b389e3355b61b76595fbff5b45 Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Mon, 6 Nov 2023 10:16:34 +0800
-Subject: [PATCH 077/199] mtk: mt76: mt7996: Remove wed rro ring add napi at
+Subject: [PATCH 065/223] mtk: mt76: mt7996: Remove wed rro ring add napi at
  init state
 
 without this patch. rro ring will add napi at initial state. once rro ring add napi, it will have chance to be used by host driver. if host driver accessed the ring data, it will cause some issue.
@@ -27,5 +27,5 @@
  		mt76_dma_rx_fill(dev, &dev->q_rx[i], false);
  		napi_enable(&dev->napi[i]);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0078-mtk-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0066-mtk-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch
similarity index 76%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0078-mtk-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0066-mtk-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch
index 987c14a..5d3a194 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0078-mtk-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0066-mtk-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch
@@ -1,7 +1,7 @@
-From a606926ce504162a64ebab655645fb39e2035f0e Mon Sep 17 00:00:00 2001
+From b6003ba133a517cea454233c6b951ea8acaf7cc0 Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Wed, 29 Nov 2023 13:56:52 +0800
-Subject: [PATCH 078/199] mtk: mt76: mt7996: Remove wed_stop during L1 SER
+Subject: [PATCH 066/223] mtk: mt76: mt7996: Remove wed_stop during L1 SER
 
 Align logan L1 SER flow. During L1 SER, didn't need to close wed interrupt.
 
@@ -11,10 +11,10 @@
  1 file changed, 6 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 1f3445bb..25f036bd 100644
+index 9f94f530..c72f70db 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1947,12 +1947,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1959,12 +1959,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.",
  		 wiphy_name(dev->mt76.hw->wiphy));
  
@@ -28,5 +28,5 @@
  	if (phy2)
  		ieee80211_stop_queues(phy2->mt76->hw);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0079-mtk-mt76-mt7996-Refactor-rro-del-ba-command-format.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0067-mtk-mt76-mt7996-Refactor-rro-del-ba-command-format.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0079-mtk-mt76-mt7996-Refactor-rro-del-ba-command-format.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0067-mtk-mt76-mt7996-Refactor-rro-del-ba-command-format.patch
index 74173c9..c3dbca6 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0079-mtk-mt76-mt7996-Refactor-rro-del-ba-command-format.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0067-mtk-mt76-mt7996-Refactor-rro-del-ba-command-format.patch
@@ -1,11 +1,12 @@
-From 10e60d0f16d93912198c3903e5aa114e78fc527f Mon Sep 17 00:00:00 2001
+From 1dbc5ac676194b3b46685104dc3fdc9f4b2dc06a Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Wed, 29 Nov 2023 15:51:04 +0800
-Subject: [PATCH 079/199] mtk: mt76: mt7996: Refactor rro del ba command format
+Subject: [PATCH 067/223] mtk: mt76: mt7996: Refactor rro del ba command format
 
 1. remove unused struct
 2. refactor upstream del ba command format
 
+Change-Id: Iab75446a54dd0bf3aa95dc80f32d7d80b6f7fc8b
 Signed-off-by: Rex Lu <rex.lu@mediatek.com>
 ---
  mt7996/mcu.h | 50 +++-----------------------------------------------
@@ -80,5 +81,5 @@
  	UNI_MIB_OBSS_AIRTIME = 26,
  	UNI_MIB_NON_WIFI_TIME = 27,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0080-mtk-mt76-mt7996-get-airtime-and-RSSI-via-MCU-command.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0068-mtk-mt76-mt7996-get-airtime-and-RSSI-via-MCU-command.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0080-mtk-mt76-mt7996-get-airtime-and-RSSI-via-MCU-command.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0068-mtk-mt76-mt7996-get-airtime-and-RSSI-via-MCU-command.patch
index e0171ea..cb7b351 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0080-mtk-mt76-mt7996-get-airtime-and-RSSI-via-MCU-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0068-mtk-mt76-mt7996-get-airtime-and-RSSI-via-MCU-command.patch
@@ -1,13 +1,14 @@
-From ef1bc404cc98a3ab556f1efa25debc81008e91ec Mon Sep 17 00:00:00 2001
+From 5b0810ecadc01482ef25b7e063ebe69f42e39a8e Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Fri, 17 Nov 2023 18:08:06 +0800
-Subject: [PATCH 080/199] mtk: mt76: mt7996: get airtime and RSSI via MCU
+Subject: [PATCH 068/223] mtk: mt76: mt7996: get airtime and RSSI via MCU
  commands
 
 Direct access to WTBL for airtime and RSSI may cause synchronization issue with FW.
 Moreover, frequent access to WTBL, whenever TX-Free-Done event is received, leads to heavy CPU overheads.
 Therefore, indirect access to WTBL, through FW, with lower frequence is performed.
 
+Change-Id: I978e7432603742fae9c753f055ff3087cf6b632c
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Signed-off-by: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 ---
@@ -23,10 +24,10 @@
  9 files changed, 336 insertions(+), 142 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index e3c209ff..8f3541e2 100644
+index e7901e57..aad7f557 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -332,11 +332,13 @@ struct mt76_sta_stats {
+@@ -336,11 +336,13 @@ struct mt76_sta_stats {
  	u32 tx_packets;		/* unit: MSDU */
  	u32 tx_retries;
  	u32 tx_failed;
@@ -40,7 +41,7 @@
  };
  
  enum mt76_wcid_flags {
-@@ -1326,6 +1328,22 @@ static inline int mt76_decr(int val, int size)
+@@ -1339,6 +1341,22 @@ static inline int mt76_decr(int val, int size)
  
  u8 mt76_ac_to_hwq(u8 ac);
  
@@ -64,10 +65,10 @@
  mtxq_to_txq(struct mt76_txq *mtxq)
  {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 6be7e6a6..f4574aaa 100644
+index db152167..adecb0ed 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1382,11 +1382,23 @@ enum {
+@@ -1387,11 +1387,23 @@ enum {
  	UNI_OFFLOAD_OFFLOAD_BMC_RPY_DETECT,
  };
  
@@ -93,7 +94,7 @@
  	UNI_ALL_STA_GI_MODE,
  	UNI_ALL_STA_TXRX_MSDU_COUNT,
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 3b58b8ba..8f8608fa 100644
+index 0ef8fee6..e46a0fb9 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -979,12 +979,11 @@ mt7996_airtime_read(struct seq_file *s, void *data)
@@ -135,7 +136,7 @@
  	rcu_read_unlock();
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 25f036bd..06a86146 100644
+index c72f70db..8b753148 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -12,8 +12,6 @@
@@ -258,7 +259,7 @@
  void mt7996_mac_enable_rtscts(struct mt7996_dev *dev,
  			      struct ieee80211_vif *vif, bool enable)
  {
-@@ -1209,8 +1103,6 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+@@ -1221,8 +1115,6 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
  		}
  	}
  
@@ -267,7 +268,7 @@
  	if (wake)
  		mt76_set_tx_blocked(&dev->mt76, false);
  
-@@ -2379,31 +2271,42 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+@@ -2391,31 +2283,42 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  
  void mt7996_mac_work(struct work_struct *work)
  {
@@ -324,10 +325,10 @@
  	ieee80211_queue_delayed_work(mphy->hw, &mphy->mac_work,
  				     MT7996_WATCHDOG_TIME);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 46611191..c7f9a56d 100644
+index be273181..db877d75 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -563,7 +563,8 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -568,7 +568,8 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  		u16 wlan_idx;
  		struct mt76_wcid *wcid;
  		struct mt76_phy *mphy;
@@ -337,7 +338,7 @@
  
  		switch (le16_to_cpu(res->tag)) {
  		case UNI_ALL_STA_TXRX_RATE:
-@@ -584,7 +585,7 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -589,7 +590,7 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  				break;
  
  			mphy = mt76_dev_phy(&dev->mt76, wcid->phy_idx);
@@ -346,7 +347,7 @@
  				tx_bytes = le32_to_cpu(res->adm_stat[i].tx_bytes[ac]);
  				rx_bytes = le32_to_cpu(res->adm_stat[i].rx_bytes[ac]);
  
-@@ -616,6 +617,24 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -621,6 +622,24 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  			__mt7996_stat_to_netdev(mphy, wcid, 0, 0,
  						tx_packets, rx_packets);
  			break;
@@ -371,7 +372,7 @@
  		default:
  			break;
  		}
-@@ -2244,8 +2263,6 @@ mt7996_mcu_sta_init_vow(struct mt7996_phy *phy, struct mt7996_sta *msta)
+@@ -2249,8 +2268,6 @@ mt7996_mcu_sta_init_vow(struct mt7996_phy *phy, struct mt7996_sta *msta)
  	vow->drr_quantum[IEEE80211_AC_VI] = VOW_DRR_QUANTUM_IDX1;
  	vow->drr_quantum[IEEE80211_AC_BE] = VOW_DRR_QUANTUM_IDX2;
  	vow->drr_quantum[IEEE80211_AC_BK] = VOW_DRR_QUANTUM_IDX2;
@@ -380,7 +381,7 @@
  
  	ret = mt7996_mcu_set_vow_drr_ctrl(phy, msta, VOW_DRR_CTRL_STA_BSS_GROUP);
  	if (ret)
-@@ -4842,9 +4859,139 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val)
+@@ -4868,9 +4885,139 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val)
  				 sizeof(req), true);
  }
  
@@ -522,7 +523,7 @@
  	struct {
  		u8 _rsv[4];
  
-@@ -4855,7 +5002,7 @@ int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag)
+@@ -4881,7 +5028,7 @@ int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag)
  		.len = cpu_to_le16(sizeof(req) - 4),
  	};
  
@@ -574,10 +575,10 @@
  } __packed;
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 834e8fc0..b0b61b12 100644
+index 7d0f7dda..f6d3bd19 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -126,6 +126,8 @@
+@@ -128,6 +128,8 @@
  #define MT7996_RRO_MSDU_PG_CR_CNT 8
  #define MT7996_RRO_MSDU_PG_SIZE_PER_CR 0x10000
  
@@ -586,7 +587,7 @@
  struct mt7996_vif;
  struct mt7996_sta;
  struct mt7996_dfs_pulse;
-@@ -298,8 +300,6 @@ struct mt7996_vow_sta_ctrl {
+@@ -299,8 +301,6 @@ struct mt7996_vow_sta_ctrl {
  	bool paused;
  	u8 bss_grp_idx;
  	u8 drr_quantum[IEEE80211_NUM_ACS];
@@ -595,7 +596,7 @@
  };
  
  struct mt7996_sta {
-@@ -308,7 +308,6 @@ struct mt7996_sta {
+@@ -309,7 +309,6 @@ struct mt7996_sta {
  	struct mt7996_vif *vif;
  
  	struct list_head rc_list;
@@ -603,7 +604,7 @@
  
  	int ack_signal;
  	struct ewma_avg_signal avg_ack_signal;
-@@ -405,6 +404,21 @@ struct mt7996_air_monitor_ctrl {
+@@ -406,6 +405,21 @@ struct mt7996_air_monitor_ctrl {
  };
  #endif
  
@@ -625,7 +626,7 @@
  struct mt7996_phy {
  	struct mt76_phy *mt76;
  	struct mt7996_dev *dev;
-@@ -600,6 +614,7 @@ struct mt7996_dev {
+@@ -605,6 +619,7 @@ struct mt7996_dev {
  		u32 fw_dbg_module;
  		u8 fw_dbg_lv;
  		u32 bcn_total_cnt[__MT_MAX_BAND];
@@ -633,7 +634,7 @@
  	} dbg;
  	const struct mt7996_dbg_reg_desc *dbg_reg;
  #endif
-@@ -825,7 +840,10 @@ int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
+@@ -829,7 +844,10 @@ int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
  int mt7996_mcu_trigger_assert(struct mt7996_dev *dev);
  void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
  void mt7996_mcu_exit(struct mt7996_dev *dev);
@@ -646,10 +647,10 @@
  int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
  int mt7996_mcu_get_tx_power_info(struct mt7996_phy *phy, u8 category, void *event);
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 06c0db3f..275beb48 100644
+index 5a140f51..4ce4ac0d 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -3065,6 +3065,69 @@ mt7996_vow_drr_dbg(void *data, u64 val)
+@@ -3064,6 +3064,69 @@ mt7996_vow_drr_dbg(void *data, u64 val)
  DEFINE_DEBUGFS_ATTRIBUTE(fops_vow_drr_dbg, NULL,
  			 mt7996_vow_drr_dbg, "%lld\n");
  
@@ -719,7 +720,7 @@
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -3163,6 +3226,14 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -3162,6 +3225,14 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  
  	debugfs_create_file("muru_prot_thr", 0200, dir, phy, &fops_muru_prot_thr);
  
@@ -735,7 +736,7 @@
  }
  
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index cbd71706..a001d9fd 100644
+index 87bf0012..96438cca 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -122,6 +122,8 @@ enum offs_rev {
@@ -748,5 +749,5 @@
  #define MT_PLE_BASE				0x820c0000
  #define MT_PLE(ofs)				(MT_PLE_BASE + (ofs))
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0081-mtk-mt76-mt7996-add-support-for-WMM-PBC-configuratio.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0069-mtk-mt76-mt7996-add-support-for-WMM-PBC-configuratio.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0081-mtk-mt76-mt7996-add-support-for-WMM-PBC-configuratio.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0069-mtk-mt76-mt7996-add-support-for-WMM-PBC-configuratio.patch
index 549d7e0..364a360 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0081-mtk-mt76-mt7996-add-support-for-WMM-PBC-configuratio.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0069-mtk-mt76-mt7996-add-support-for-WMM-PBC-configuratio.patch
@@ -1,12 +1,13 @@
-From 3b97fa94c4e5a839ac9e31b63e07090b22e84330 Mon Sep 17 00:00:00 2001
+From 33a4c8e5ec36b3265e10e324e141e26b5941848f Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Thu, 4 Jan 2024 09:47:00 +0800
-Subject: [PATCH 081/199] mtk: mt76: mt7996: add support for WMM PBC
+Subject: [PATCH 069/223] mtk: mt76: mt7996: add support for WMM PBC
  configuration
 
 Query per-AC-queue packet statistics from WA, and determine if multi-AC transmission is ongoing.
 If it is, enable WMM mode in WA. Otherwise, disable WMM mode.
 
+Change-Id: I1852a45dc0e64780af5f091fd749ceab59697dbb
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt76_connac_mcu.h |  2 ++
@@ -18,10 +19,10 @@
  6 files changed, 105 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f4574aaa..c8eedf36 100644
+index adecb0ed..c9cea5bb 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1037,6 +1037,7 @@ enum {
+@@ -1042,6 +1042,7 @@ enum {
  	MCU_EXT_EVENT_ASSERT_DUMP = 0x23,
  	MCU_EXT_EVENT_RDD_REPORT = 0x3a,
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
@@ -29,7 +30,7 @@
  	MCU_EXT_EVENT_WA_TX_STAT = 0x74,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
  	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
-@@ -1236,6 +1237,7 @@ enum {
+@@ -1241,6 +1242,7 @@ enum {
  	MCU_EXT_CMD_TXDPD_CAL = 0x60,
  	MCU_EXT_CMD_CAL_CACHE = 0x67,
  	MCU_EXT_CMD_RED_ENABLE = 0x68,
@@ -38,10 +39,10 @@
  	MCU_EXT_CMD_SET_RADAR_TH = 0x7c,
  	MCU_EXT_CMD_SET_RDD_PATTERN = 0x7d,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index f682423a..7c273f9c 100644
+index 04c15432..6d5e4c40 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -1536,6 +1536,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1556,6 +1556,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	INIT_WORK(&dev->dump_work, mt7996_mac_dump_work);
  	mutex_init(&dev->dump_mutex);
  
@@ -51,10 +52,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 06a86146..099e97ef 100644
+index 8b753148..bc0f0020 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2298,6 +2298,10 @@ void mt7996_mac_work(struct work_struct *work)
+@@ -2310,6 +2310,10 @@ void mt7996_mac_work(struct work_struct *work)
  					mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_ADM_STAT);
  					mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_MSDU_COUNT);
  				}
@@ -66,10 +67,10 @@
  			           test_bit(MT76_STATE_RUNNING, &mdev->phys[i]->state))
  				break;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index c7f9a56d..28cedb60 100644
+index db877d75..47f8a7cd 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -669,6 +669,82 @@ mt7996_mcu_rx_thermal_notify(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -674,6 +674,82 @@ mt7996_mcu_rx_thermal_notify(struct mt7996_dev *dev, struct sk_buff *skb)
  	phy->throttle_state = n->duty_percent;
  }
  
@@ -152,7 +153,7 @@
  static void
  mt7996_mcu_rx_ext_event(struct mt7996_dev *dev, struct sk_buff *skb)
  {
-@@ -678,6 +754,8 @@ mt7996_mcu_rx_ext_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -683,6 +759,8 @@ mt7996_mcu_rx_ext_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_FW_LOG_2_HOST:
  		mt7996_mcu_rx_log_message(dev, skb);
  		break;
@@ -192,11 +193,11 @@
  	MCU_WA_PARAM_RED_CONFIG = 0x40,
  };
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index b0b61b12..fb1d1d84 100644
+index f6d3bd19..ba3a639b 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -607,6 +607,9 @@ struct mt7996_dev {
- 	u8 wtbl_size_group;
+@@ -612,6 +612,9 @@ struct mt7996_dev {
+ 	} var;
  
  	struct mt7996_vow_ctrl vow;
 +
@@ -205,7 +206,7 @@
  #ifdef CONFIG_MTK_DEBUG
  	u16 wlan_idx;
  	struct {
-@@ -858,6 +861,7 @@ int mt7996_mcu_set_band_confg(struct mt7996_phy *phy, u16 option, bool enable);
+@@ -862,6 +865,7 @@ int mt7996_mcu_set_band_confg(struct mt7996_phy *phy, u16 option, bool enable);
  int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy, struct mt7996_sta *msta,
  	                        enum vow_drr_ctrl_id id);
  int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy);
@@ -214,5 +215,5 @@
  static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
  {
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0082-mtk-mt76-mt7996-eagle-support-extra-option_type.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0070-mtk-mt76-mt7996-eagle-support-extra-option_type.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0082-mtk-mt76-mt7996-eagle-support-extra-option_type.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0070-mtk-mt76-mt7996-eagle-support-extra-option_type.patch
index 9b0e560..1118304 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0082-mtk-mt76-mt7996-eagle-support-extra-option_type.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0070-mtk-mt76-mt7996-eagle-support-extra-option_type.patch
@@ -1,7 +1,7 @@
-From b464b7e32093adb25adb0949df6debcb5c60780e Mon Sep 17 00:00:00 2001
+From 3ae943ca695746f6ff54a926d73a1a6b94d6411c Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Thu, 1 Feb 2024 10:32:42 +0800
-Subject: [PATCH 082/199] mtk: mt76: mt7996: eagle support extra option_type
+Subject: [PATCH 070/223] mtk: mt76: mt7996: eagle support extra option_type
 
 1. eagle + mt7988d option_type 2 support
 2. eagle single pcie support
@@ -10,6 +10,8 @@
 
 (cherry picked from commit 31d64e0f571eb06ed67f4916bc12fbcfe1263c47)
 
+Change-Id: I1c8fa6769aa0b192b32738aec0b14c86572a493b
+Change-Id: Ib8e741b3c9eba3c796704351259f926c1e4e9d69
 Signed-off-by: Rex Lu <rex.lu@mediatek.com>
 ---
  mt7996/dma.c    | 51 +++++++++++++++++++++++++++++++++----
@@ -109,7 +111,7 @@
  		mt76_wr(dev, MT_WFDMA0_PAUSE_RX_Q_45_TH + hif1_ofs, 0xc000c);
  		mt76_wr(dev, MT_WFDMA0_PAUSE_RX_Q_67_TH + hif1_ofs, 0x10008);
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 7c273f9c..910ffccf 100644
+index 6d5e4c40..96b209e6 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -513,7 +513,7 @@ static void mt7996_mac_init_basic_rates(struct mt7996_dev *dev)
@@ -203,7 +205,7 @@
  	}
  
  	mphy = mt76_alloc_phy(&dev->mt76, sizeof(*phy), &mt7996_ops, band);
-@@ -1060,6 +1096,9 @@ int mt7996_get_chip_sku(struct mt7996_dev *dev)
+@@ -1076,6 +1112,9 @@ static int mt7996_variant_fem_init(struct mt7996_dev *dev)
  static int mt7996_init_hardware(struct mt7996_dev *dev)
  {
  	int ret, idx;
@@ -214,10 +216,10 @@
  	mt76_wr(dev, MT_INT_SOURCE_CSR, ~0);
  	if (is_mt7992(&dev->mt76)) {
 diff --git a/mt7996/main.c b/mt7996/main.c
-index d26c55ed..534a476a 100644
+index dcf1fc38..a53eaa55 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -1610,8 +1610,19 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1595,8 +1595,19 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
  
@@ -240,7 +242,7 @@
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index fb1d1d84..d17b169a 100644
+index ba3a639b..eb9a5634 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -8,6 +8,7 @@
@@ -251,7 +253,7 @@
  #include "../mt76_connac.h"
  #include "regs.h"
  
-@@ -350,6 +351,8 @@ struct mt7996_hif {
+@@ -351,6 +352,8 @@ struct mt7996_hif {
  	struct device *dev;
  	void __iomem *regs;
  	int irq;
@@ -260,7 +262,7 @@
  };
  
  struct mt7996_scs_ctrl {
-@@ -580,6 +583,8 @@ struct mt7996_dev {
+@@ -581,6 +584,8 @@ struct mt7996_dev {
  	u8 eeprom_mode;
  	u32 bg_nxt_freq;
  
@@ -290,7 +292,7 @@
  	list_add(&hif->list, &hif_list);
  	spin_unlock_bh(&hif_lock);
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index a001d9fd..a0e4b3e1 100644
+index 96438cca..3a1568c3 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -435,6 +435,7 @@ enum offs_rev {
@@ -320,5 +322,5 @@
  #define MT_PCIE_RECOG_ID_MASK			GENMASK(30, 0)
  #define MT_PCIE_RECOG_ID_SEM			BIT(31)
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0083-mtk-mt76-mt7996-support-enable-disable-thermal-prote.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0071-mtk-mt76-mt7996-support-enable-disable-thermal-prote.patch
similarity index 87%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0083-mtk-mt76-mt7996-support-enable-disable-thermal-prote.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0071-mtk-mt76-mt7996-support-enable-disable-thermal-prote.patch
index f6331d2..c5deee4 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0083-mtk-mt76-mt7996-support-enable-disable-thermal-prote.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0071-mtk-mt76-mt7996-support-enable-disable-thermal-prote.patch
@@ -1,7 +1,7 @@
-From 49d072013ef5a88ca6040d18085885773967d5d4 Mon Sep 17 00:00:00 2001
+From 93cd3c23453725f003318b5556ad09b56e3995a6 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 27 Jul 2023 19:35:32 +0800
-Subject: [PATCH 083/199] mtk: mt76: mt7996: support enable/disable thermal
+Subject: [PATCH 071/223] mtk: mt76: mt7996: support enable/disable thermal
  protection mechanism
 
 This commit adds a new debugfs thermal_enable to enable/disable thermal
@@ -24,7 +24,7 @@
  3 files changed, 47 insertions(+)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 534a476a..8c93297a 100644
+index a53eaa55..e5b32d33 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -91,6 +91,7 @@ int mt7996_run(struct ieee80211_hw *hw)
@@ -36,10 +36,10 @@
  	ret = mt7996_mcu_set_tx_power_ctrl(phy, UNI_TXPOWER_SKU_POWER_LIMIT_CTRL,
  						dev->dbg.sku_disable ? 0 : phy->sku_limit_en);
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index d17b169a..6e96194b 100644
+index eb9a5634..94735872 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -489,6 +489,7 @@ struct mt7996_phy {
+@@ -490,6 +490,7 @@ struct mt7996_phy {
  #ifdef CONFIG_MTK_DEBUG
  	bool sr_enable:1;
  	bool enhanced_sr_enable:1;
@@ -48,10 +48,10 @@
  };
  
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 275beb48..66ab74d2 100644
+index 4ce4ac0d..196038d4 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -3128,6 +3128,49 @@ mt7996_show_rro_mib(struct seq_file *s, void *data)
+@@ -3127,6 +3127,49 @@ mt7996_show_rro_mib(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -101,7 +101,7 @@
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -3234,6 +3277,8 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -3233,6 +3276,8 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  					    mt7996_show_rro_mib);
  	}
  
@@ -111,5 +111,5 @@
  }
  
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0084-mtk-mt76-mt7996-support-thermal-recal-debug-command.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0072-mtk-mt76-mt7996-support-thermal-recal-debug-command.patch
similarity index 86%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0084-mtk-mt76-mt7996-support-thermal-recal-debug-command.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0072-mtk-mt76-mt7996-support-thermal-recal-debug-command.patch
index e560caf..6115142 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0084-mtk-mt76-mt7996-support-thermal-recal-debug-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0072-mtk-mt76-mt7996-support-thermal-recal-debug-command.patch
@@ -1,7 +1,7 @@
-From 857348ab99cd5ba83f73c4da02c70f2004b6f10b Mon Sep 17 00:00:00 2001
+From 3ee40687fd7064508306f1008c14433ccf7253d4 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 4 Jan 2024 19:53:37 +0800
-Subject: [PATCH 084/199] mtk: mt76: mt7996: support thermal recal debug
+Subject: [PATCH 072/223] mtk: mt76: mt7996: support thermal recal debug
  command
 
 Add support thermal recal debug command.
@@ -14,6 +14,7 @@
 1 = enable
 2 = manual trigger
 
+Change-Id: Ief064633dd7ab0faeb298ac3902ca1b399e70365
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
  mt76_connac_mcu.h    |  1 +
@@ -23,10 +24,10 @@
  4 files changed, 40 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index c8eedf36..1589a716 100644
+index c9cea5bb..11a1224a 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1297,6 +1297,7 @@ enum {
+@@ -1302,6 +1302,7 @@ enum {
  	MCU_UNI_CMD_TESTMODE_TRX_PARAM = 0x42,
  	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
  	MCU_UNI_CMD_PRECAL_RESULT = 0x47,
@@ -35,10 +36,10 @@
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
  	MCU_UNI_CMD_PER_STA_INFO = 0x6d,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 6e96194b..0e6b7595 100644
+index 94735872..82ff4e99 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1033,6 +1033,7 @@ void mt7996_mcu_set_cert(struct mt7996_phy *phy, u8 type);
+@@ -1037,6 +1037,7 @@ void mt7996_mcu_set_cert(struct mt7996_phy *phy, u8 type);
  void mt7996_tm_update_channel(struct mt7996_phy *phy);
  
  int mt7996_mcu_set_vow_drr_dbg(struct mt7996_dev *dev, u32 val);
@@ -47,10 +48,10 @@
  
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 66ab74d2..cc1224ed 100644
+index 196038d4..bc9a0f04 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -3171,6 +3171,22 @@ out:
+@@ -3170,6 +3170,22 @@ out:
  DEFINE_DEBUGFS_ATTRIBUTE(fops_thermal_enable, mt7996_thermal_enable_get,
  			 mt7996_thermal_enable_set, "%lld\n");
  
@@ -73,7 +74,7 @@
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -3278,6 +3294,7 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -3277,6 +3293,7 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  	}
  
  	debugfs_create_file("thermal_enable", 0600, dir, phy, &fops_thermal_enable);
@@ -112,5 +113,5 @@
 +}
  #endif
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0085-mtk-mt76-mt7996-add-kite-two-pcie-with-two-wed-suppo.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0073-mtk-mt76-mt7996-add-kite-two-pcie-with-two-wed-suppo.patch
similarity index 96%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0085-mtk-mt76-mt7996-add-kite-two-pcie-with-two-wed-suppo.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0073-mtk-mt76-mt7996-add-kite-two-pcie-with-two-wed-suppo.patch
index ddb26a5..0f9bedd 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0085-mtk-mt76-mt7996-add-kite-two-pcie-with-two-wed-suppo.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0073-mtk-mt76-mt7996-add-kite-two-pcie-with-two-wed-suppo.patch
@@ -1,7 +1,7 @@
-From 343d81213790ba2a9928ee104067f5a18bbeacca Mon Sep 17 00:00:00 2001
+From 4f6f8ddf1d26b8dac9d405f6c73457adab2660cc Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Tue, 19 Mar 2024 13:16:12 +0800
-Subject: [PATCH 085/199] mtk: mt76: mt7996: add kite two pcie with two wed
+Subject: [PATCH 073/223] mtk: mt76: mt7996: add kite two pcie with two wed
  support
 
 Signed-off-by: Rex Lu <rex.lu@mediatek.com>
@@ -131,7 +131,7 @@
  				       MT_RXQ_ID(MT_RXQ_BAND1_WA),
  				       MT7996_RX_MCU_RING_SIZE,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 910ffccf..1e4e6e78 100644
+index 96b209e6..48798711 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -527,39 +527,46 @@ void mt7996_mac_init(struct mt7996_dev *dev)
@@ -222,10 +222,10 @@
  				wed = &dev->mt76.mmio.wed_hif2;
  			}
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 8c93297a..a37aac43 100644
+index e5b32d33..3a274ba7 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -1611,7 +1611,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1596,7 +1596,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
  
@@ -234,7 +234,7 @@
  		switch (dev->option_type) {
  		case 2:
  			/* eagle + 7988d */
-@@ -1619,7 +1619,8 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1604,7 +1604,8 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  				wed = &dev->mt76.mmio.wed_hif2;
  			break;
  		default:
@@ -245,7 +245,7 @@
  			break;
  		}
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 4baae0e9..d4739fea 100644
+index 1251382b..14c70915 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -336,10 +336,16 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
@@ -310,7 +310,7 @@
  		if (ret < 0)
  			goto free_wed_or_irq_vector;
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index a0e4b3e1..e1893517 100644
+index 3a1568c3..a0b57e59 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -525,6 +525,7 @@ enum offs_rev {
@@ -322,5 +322,5 @@
  #define MT_INT_RX_TXFREE_EXT			BIT(26)
  #define MT_INT_MCU_CMD				BIT(29)
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0086-mtk-mt76-add-support-to-enable-index-FW-log-for-Cons.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0074-mtk-mt76-add-support-to-enable-index-FW-log-for-Cons.patch
similarity index 95%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0086-mtk-mt76-add-support-to-enable-index-FW-log-for-Cons.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0074-mtk-mt76-add-support-to-enable-index-FW-log-for-Cons.patch
index 58d48b8..7ab34bf 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0086-mtk-mt76-add-support-to-enable-index-FW-log-for-Cons.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0074-mtk-mt76-add-support-to-enable-index-FW-log-for-Cons.patch
@@ -1,7 +1,7 @@
-From 575f1d50cf1917a498582fa07f352c7723f01e8d Mon Sep 17 00:00:00 2001
+From ec4ace4cb79cc70a766eaf648b56b9db3836a254 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Thu, 11 Jan 2024 08:55:13 +0800
-Subject: [PATCH 086/199] mtk: mt76: add support to enable index FW log for
+Subject: [PATCH 074/223] mtk: mt76: add support to enable index FW log for
  ConsysPlanet
 
 Add support to enable and record index FW log, which is the input for ConsysPlanet, via mt76-test command.
@@ -25,6 +25,7 @@
 - Driver Log: log message printed at driver layer
 	- Location: /tmp/log/clog_(timestamp)/WIFI_KERNEL_(timestamp).clog
 
+Change-Id: I5d72c844e920cdcbaed4c65f734de8f041e6f384
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt7996/debugfs.c  |  90 +++++++++++++++++--
@@ -38,7 +39,7 @@
  8 files changed, 295 insertions(+), 69 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 8f8608fa..7395f6df 100644
+index e46a0fb9..7e8e91ca 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -430,8 +430,8 @@ create_buf_file_cb(const char *filename, struct dentry *parent, umode_t mode,
@@ -168,10 +169,10 @@
  	return true;
  }
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 099e97ef..564f080d 100644
+index bc0f0020..4ea44f8d 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2279,11 +2279,9 @@ void mt7996_mac_work(struct work_struct *work)
+@@ -2291,11 +2291,9 @@ void mt7996_mac_work(struct work_struct *work)
  	mutex_lock(&mdev->mutex);
  
  	mt76_update_survey(mphy);
@@ -184,7 +185,7 @@
  		mt7996_mac_update_stats(phy);
  
  		/* Update DEV-wise information only in
-@@ -2302,6 +2300,12 @@ void mt7996_mac_work(struct work_struct *work)
+@@ -2314,6 +2312,12 @@ void mt7996_mac_work(struct work_struct *work)
  				if (mt7996_mcu_wa_cmd(phy->dev, MCU_WA_PARAM_CMD(QUERY), MCU_WA_PARAM_BSS_ACQ_PKT_CNT,
  				                      BSS_ACQ_PKT_CNT_BSS_BITMAP_ALL | BSS_ACQ_PKT_CNT_READ_CLR, 0))
  					dev_err(mdev->dev, "Failed to query per-AC-queue packet counts.\n");
@@ -198,10 +199,10 @@
  			           test_bit(MT76_STATE_RUNNING, &mdev->phys[i]->state))
  				break;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 28cedb60..8cc907f9 100644
+index 47f8a7cd..d559df86 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -400,6 +400,7 @@ static void
+@@ -405,6 +405,7 @@ static void
  mt7996_mcu_rx_log_message(struct mt7996_dev *dev, struct sk_buff *skb)
  {
  #define UNI_EVENT_FW_LOG_FORMAT 0
@@ -209,7 +210,7 @@
  	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
  	const char *data = (char *)&rxd[1] + 4, *type;
  	struct tlv *tlv = (struct tlv *)data;
-@@ -411,7 +412,8 @@ mt7996_mcu_rx_log_message(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -416,7 +417,8 @@ mt7996_mcu_rx_log_message(struct mt7996_dev *dev, struct sk_buff *skb)
  		goto out;
  	}
  
@@ -219,7 +220,7 @@
  		return;
  
  	data += sizeof(*tlv) + 4;
-@@ -3187,6 +3189,36 @@ int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level)
+@@ -3194,6 +3196,36 @@ int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level)
  				 sizeof(data), false);
  }
  
@@ -279,10 +280,10 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 0e6b7595..d5162885 100644
+index 82ff4e99..4e99830f 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -592,9 +592,11 @@ struct mt7996_dev {
+@@ -593,9 +593,11 @@ struct mt7996_dev {
  	u8 fw_debug_bin;
  	u16 fw_debug_seq;
  	bool fw_debug_muru_disable;
@@ -294,7 +295,7 @@
  
  	void *cal;
  	u32 cur_prek_offset;
-@@ -846,6 +848,7 @@ int mt7996_mcu_wa_cmd(struct mt7996_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
+@@ -850,6 +852,7 @@ int mt7996_mcu_wa_cmd(struct mt7996_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
  int mt7996_mcu_red_config(struct mt7996_dev *dev, bool enable);
  int mt7996_mcu_fw_log_2_host(struct mt7996_dev *dev, u8 type, u8 ctrl);
  int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
@@ -624,5 +625,5 @@
  
  #endif
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0087-mtk-mt76-mt7996-implement-and-switch-to-hw-scan-call.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0075-mtk-mt76-mt7996-implement-and-switch-to-hw-scan-call.patch
similarity index 84%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0087-mtk-mt76-mt7996-implement-and-switch-to-hw-scan-call.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0075-mtk-mt76-mt7996-implement-and-switch-to-hw-scan-call.patch
index 452ba1f..9977a88 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0087-mtk-mt76-mt7996-implement-and-switch-to-hw-scan-call.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0075-mtk-mt76-mt7996-implement-and-switch-to-hw-scan-call.patch
@@ -1,7 +1,7 @@
-From c2213afbe5f0c0b36ba7fb19c2bd9f04cea01cc9 Mon Sep 17 00:00:00 2001
+From 953012de13153dbc078b6fe3cc64d6d44e2d251f Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 3 Nov 2023 21:44:45 +0800
-Subject: [PATCH 087/199] mtk: mt76: mt7996: implement and switch to hw scan
+Subject: [PATCH 075/223] mtk: mt76: mt7996: implement and switch to hw scan
  callbacks
 
 To support MLO, hw_scan callbacks are mandatory. However, the
@@ -13,6 +13,7 @@
 request should be unicast.
 This works for ML probe request, which should be unicast.
 
+Change-Id: Ic096b10e4a82211be4c5c435d3e34e0a76ea3b9e
 Co-developed-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Co-developed-by: Peter Chiu <chui-hao.chiu@mediatek.com>
@@ -23,13 +24,14 @@
  mt76.h          |   2 +
  mt7996/init.c   |   5 ++
  mt7996/mac.c    | 141 ++++++++++++++++++++++++++++++++++++++++++++++++
- mt7996/main.c   |  95 ++++++++++++++++++++++++++++----
+ mt7996/main.c   | 100 +++++++++++++++++++++++++++++++---
  mt7996/mcu.c    |   3 +-
+ mt7996/mmio.c   |   2 +-
  mt7996/mt7996.h |  11 +++-
- 7 files changed, 248 insertions(+), 12 deletions(-)
+ 8 files changed, 256 insertions(+), 11 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 3e054d9d..032a13a5 100644
+index b08a9388..cad85f19 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -820,7 +820,7 @@ bool mt76_has_tx_pending(struct mt76_phy *phy)
@@ -50,20 +52,20 @@
  void mt76_update_survey_active_time(struct mt76_phy *phy, ktime_t time)
  {
 diff --git a/mt76.h b/mt76.h
-index 8f3541e2..6a7752ef 100644
+index aad7f557..36e92dfe 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1469,6 +1469,8 @@ void mt76_release_buffered_frames(struct ieee80211_hw *hw,
- 				  enum ieee80211_frame_release_type reason,
+@@ -1483,6 +1483,8 @@ void mt76_release_buffered_frames(struct ieee80211_hw *hw,
  				  bool more_data);
  bool mt76_has_tx_pending(struct mt76_phy *phy);
+ int mt76_update_channel(struct mt76_phy *phy);
 +struct mt76_channel_state *
 +mt76_channel_state(struct mt76_phy *phy, struct ieee80211_channel *c);
- void mt76_set_channel(struct mt76_phy *phy);
  void mt76_update_survey(struct mt76_phy *phy);
  void mt76_update_survey_active_time(struct mt76_phy *phy, ktime_t time);
+ int mt76_get_survey(struct ieee80211_hw *hw, int idx,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 1e4e6e78..2b396d94 100644
+index 48798711..a188fa1d 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -459,6 +459,9 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -84,7 +86,7 @@
  
  	ret = mt7996_eeprom_parse_hw_cap(dev, phy);
  	if (ret)
-@@ -1574,6 +1578,7 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1594,6 +1598,7 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	dev->mt76.phy.priv = &dev->phy;
  	INIT_WORK(&dev->rc_work, mt7996_mac_sta_rc_work);
  	INIT_DELAYED_WORK(&dev->mphy.mac_work, mt7996_mac_work);
@@ -93,10 +95,10 @@
  	INIT_LIST_HEAD(&dev->sta_rc_list);
  	INIT_LIST_HEAD(&dev->twt_list);
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 564f080d..7578cbb0 100644
+index 4ea44f8d..5c29fe7f 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2693,3 +2693,144 @@ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
+@@ -2705,3 +2705,144 @@ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
  	dev->twt.table_mask &= ~BIT(flow->table_id);
  	dev->twt.n_agrt--;
  }
@@ -242,7 +244,7 @@
 +	ieee80211_queue_delayed_work(hw, &phy->scan_work, duration);
 +}
 diff --git a/mt7996/main.c b/mt7996/main.c
-index a37aac43..c640fb61 100644
+index 3a274ba7..475763e4 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -312,6 +312,8 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
@@ -265,14 +267,15 @@
  	dev->mt76.vif_mask &= ~BIT_ULL(mvif->mt76.idx);
  	phy->omac_mask &= ~BIT_ULL(mvif->mt76.omac_idx);
  	mutex_unlock(&dev->mt76.mutex);
-@@ -335,7 +341,33 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+@@ -335,11 +341,44 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
  	mt76_wcid_cleanup(&dev->mt76, &msta->wcid);
  }
  
--int mt7996_set_channel(struct mt7996_phy *phy)
+-int mt7996_set_channel(struct mt76_phy *mphy)
 +static void ___mt7996_set_channel(struct mt7996_phy *phy,
 +				 struct cfg80211_chan_def *chandef)
-+{
+ {
+-	struct mt7996_phy *phy = mphy->priv;
 +	struct mt76_dev *mdev = phy->mt76->dev;
 +	struct mt76_phy *mphy = phy->mt76;
 +	bool offchannel = phy->scan_chan != NULL;
@@ -297,19 +300,21 @@
 +
 +static int __mt7996_set_channel(struct mt7996_phy *phy,
 +				struct cfg80211_chan_def *chandef)
- {
- 	struct mt7996_dev *dev = phy->dev;
++{
++	struct mt7996_dev *dev = phy->dev;
  	int ret;
-@@ -345,7 +377,7 @@ int mt7996_set_channel(struct mt7996_phy *phy)
- 	mutex_lock(&dev->mt76.mutex);
- 	set_bit(MT76_RESET, &phy->mt76->state);
  
--	mt76_set_channel(phy->mt76);
++	cancel_delayed_work_sync(&phy->mt76->mac_work);
++
++	mutex_lock(&dev->mt76.mutex);
++	set_bit(MT76_RESET, &phy->mt76->state);
++
 +	___mt7996_set_channel(phy, chandef);
- 
++
  	if (dev->cal) {
  		ret = mt7996_mcu_apply_tx_dpd(phy);
-@@ -385,6 +417,19 @@ out:
+ 		if (ret)
+@@ -372,6 +411,19 @@ out:
  	return ret;
  }
  
@@ -329,20 +334,18 @@
  static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
  			  struct ieee80211_vif *vif, struct ieee80211_sta *sta,
  			  struct ieee80211_key_conf *key)
-@@ -481,11 +526,7 @@ static int mt7996_config(struct ieee80211_hw *hw, u32 changed)
+@@ -468,9 +520,7 @@ static int mt7996_config(struct ieee80211_hw *hw, u32 changed)
  		if (ret)
  			return ret;
  
--		ieee80211_stop_queues(hw);
--		ret = mt7996_set_channel(phy);
+-		ret = mt76_update_channel(phy->mt76);
 -		if (ret)
 -			return ret;
--		ieee80211_wake_queues(hw);
 +		mt7996_set_channel(phy, &hw->conf.chandef);
  	}
  
  	if (changed & (IEEE80211_CONF_CHANGE_POWER |
-@@ -1652,6 +1693,42 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1637,6 +1687,42 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  
  #endif
  
@@ -385,7 +388,7 @@
  const struct ieee80211_ops mt7996_ops = {
  	.add_chanctx = ieee80211_emulate_add_chanctx,
  	.remove_chanctx = ieee80211_emulate_remove_chanctx,
-@@ -1674,8 +1751,8 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -1659,8 +1745,8 @@ const struct ieee80211_ops mt7996_ops = {
  	.ampdu_action = mt7996_ampdu_action,
  	.set_rts_threshold = mt7996_set_rts_threshold,
  	.wake_tx_queue = mt76_wake_tx_queue,
@@ -397,24 +400,37 @@
  	.get_txpower = mt76_get_txpower,
  	.channel_switch_beacon = mt7996_channel_switch_beacon,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 8cc907f9..214c157c 100644
+index d559df86..746fc223 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3778,7 +3778,8 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
+@@ -3786,7 +3786,8 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
  	if (phy->mt76->hw->conf.flags & IEEE80211_CONF_MONITOR)
  		req.switch_reason = CH_SWITCH_NORMAL;
- 	else if (phy->mt76->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL ||
+ 	else if (phy->mt76->offchannel ||
 -		 phy->mt76->hw->conf.flags & IEEE80211_CONF_IDLE)
 +		 phy->mt76->hw->conf.flags & IEEE80211_CONF_IDLE ||
 +		 phy->scan_chan)
  		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
  	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
  					  NL80211_IFTYPE_AP))
+diff --git a/mt7996/mmio.c b/mt7996/mmio.c
+index 14c70915..1fcca23c 100644
+--- a/mt7996/mmio.c
++++ b/mt7996/mmio.c
+@@ -657,7 +657,7 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
+ 		.sta_add = mt7996_mac_sta_add,
+ 		.sta_remove = mt7996_mac_sta_remove,
+ 		.update_survey = mt7996_update_channel,
+-		.set_channel = mt7996_set_channel,
++		// .set_channel = mt7996_set_channel,
+ 	};
+ 	struct mt7996_dev *dev;
+ 	struct mt76_dev *mdev;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index d5162885..f94cb496 100644
+index 4e99830f..87b166aa 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -459,6 +459,13 @@ struct mt7996_phy {
+@@ -460,6 +460,13 @@ struct mt7996_phy {
  	u8 pp_mode;
  	u16 punct_bitmap;
  
@@ -428,16 +444,16 @@
  	struct mt7996_scs_ctrl scs_ctrl;
  	u32 red_drop;
  
-@@ -807,7 +814,7 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+@@ -811,7 +818,7 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
  			    struct ieee80211_he_obss_pd *he_obss_pd);
  int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  			     struct ieee80211_sta *sta, bool changed);
--int mt7996_set_channel(struct mt7996_phy *phy);
+-int mt7996_set_channel(struct mt76_phy *mphy);
 +int mt7996_set_channel(struct mt7996_phy *phy, struct cfg80211_chan_def *chandef);
  int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag);
  int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif);
  int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
-@@ -965,6 +972,8 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+@@ -969,6 +976,8 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  			 struct sk_buff *skb, u32 *info);
  bool mt7996_rx_check(struct mt76_dev *mdev, void *data, int len);
  void mt7996_stats_work(struct work_struct *work);
@@ -447,5 +463,5 @@
  int mt7996_dfs_init_radar_detector(struct mt7996_phy *phy);
  void mt7996_set_stream_he_eht_caps(struct mt7996_phy *phy);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0088-mtk-mt76-mt7996-implement-and-switch-to-chanctx-call.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0076-mtk-mt76-mt7996-implement-and-switch-to-chanctx-call.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0088-mtk-mt76-mt7996-implement-and-switch-to-chanctx-call.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0076-mtk-mt76-mt7996-implement-and-switch-to-chanctx-call.patch
index be4a016..0a5ab02 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0088-mtk-mt76-mt7996-implement-and-switch-to-chanctx-call.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0076-mtk-mt76-mt7996-implement-and-switch-to-chanctx-call.patch
@@ -1,13 +1,14 @@
-From f51442617a3575a1af73981d95316811e8488e3f Mon Sep 17 00:00:00 2001
+From f6889bcb95884df285d628c93b78fe28a5008262 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Nov 2023 16:17:11 +0800
-Subject: [PATCH 088/199] mtk: mt76: mt7996: implement and switch to chanctx
+Subject: [PATCH 076/223] mtk: mt76: mt7996: implement and switch to chanctx
  callbacks
 
 To support MLO, chanctx callbacks are mandatory, since one VIF (MLD) could
 operate on multiple channels (links).
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
+Change-Id: Ie4530a3bc2ac9e51045184d5aecca14118177042
 Co-developed-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -20,7 +21,7 @@
  5 files changed, 211 insertions(+), 18 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 2b396d94..d18db618 100644
+index a188fa1d..7afbd46a 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -384,6 +384,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -71,7 +72,7 @@
  	ret = mt7996_thermal_init(phy);
  	if (ret)
  		goto error;
-@@ -1609,6 +1629,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1629,6 +1649,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -81,10 +82,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 7578cbb0..fc6e383b 100644
+index 5c29fe7f..7cfc25ba 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2785,7 +2785,10 @@ void mt7996_scan_work(struct work_struct *work)
+@@ -2797,7 +2797,10 @@ void mt7996_scan_work(struct work_struct *work)
  		mt7996_scan_complete(phy, false);
  		mutex_unlock(&phy->dev->mt76.mutex);
  
@@ -96,7 +97,7 @@
  
  		return;
  	}
-@@ -2797,7 +2800,10 @@ void mt7996_scan_work(struct work_struct *work)
+@@ -2809,7 +2812,10 @@ void mt7996_scan_work(struct work_struct *work)
  		phy->scan_chan = NULL;
  		mutex_unlock(&phy->dev->mt76.mutex);
  
@@ -109,7 +110,7 @@
  		ieee80211_queue_delayed_work(hw, &phy->scan_work, HZ / 10);
  
 diff --git a/mt7996/main.c b/mt7996/main.c
-index c640fb61..f7910abe 100644
+index 475763e4..cbd64681 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -76,6 +76,11 @@ int mt7996_run(struct ieee80211_hw *hw)
@@ -124,7 +125,7 @@
  	ret = mt7996_mcu_set_thermal_throttling(phy, MT7996_THERMAL_THROTTLE_MAX);
  	if (ret)
  		goto out;
-@@ -514,21 +519,6 @@ static int mt7996_config(struct ieee80211_hw *hw, u32 changed)
+@@ -508,21 +513,6 @@ static int mt7996_config(struct ieee80211_hw *hw, u32 changed)
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  	int ret;
  
@@ -146,7 +147,7 @@
  	if (changed & (IEEE80211_CONF_CHANGE_POWER |
  		       IEEE80211_CONF_CHANGE_CHANNEL)) {
  		ret = mt7996_mcu_set_txpower_sku(phy);
-@@ -1729,6 +1719,158 @@ mt7996_cancel_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+@@ -1723,6 +1713,158 @@ mt7996_cancel_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
  	mutex_unlock(&phy->dev->mt76.mutex);
  }
  
@@ -305,7 +306,7 @@
  const struct ieee80211_ops mt7996_ops = {
  	.add_chanctx = ieee80211_emulate_add_chanctx,
  	.remove_chanctx = ieee80211_emulate_remove_chanctx,
-@@ -1783,4 +1925,10 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -1777,4 +1919,10 @@ const struct ieee80211_ops mt7996_ops = {
  	.net_fill_forward_path = mt7996_net_fill_forward_path,
  	.net_setup_tc = mt76_wed_net_setup_tc,
  #endif
@@ -317,10 +318,10 @@
 +	.switch_vif_chanctx = mt7996_switch_vif_chanctx,
  };
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 214c157c..7faf0916 100644
+index 746fc223..ba53c3fc 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -5296,7 +5296,7 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
+@@ -5322,7 +5322,7 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
  		.bitmap = cpu_to_le16(bitmap),
  	};
  
@@ -330,10 +331,10 @@
  		return 0;
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index f94cb496..3597bbbf 100644
+index 87b166aa..07790257 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -333,6 +333,8 @@ struct mt7996_vif {
+@@ -334,6 +334,8 @@ struct mt7996_vif {
  
  	struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS];
  	struct cfg80211_bitrate_mask bitrate_mask;
@@ -342,7 +343,7 @@
  };
  
  /* crash-dump */
-@@ -422,6 +424,14 @@ struct mt7996_rro_ba_session {
+@@ -423,6 +425,14 @@ struct mt7996_rro_ba_session {
  	u32 last_in_rxtime :12;
  };
  
@@ -357,7 +358,7 @@
  struct mt7996_phy {
  	struct mt76_phy *mt76;
  	struct mt7996_dev *dev;
-@@ -465,6 +475,7 @@ struct mt7996_phy {
+@@ -466,6 +476,7 @@ struct mt7996_phy {
  	struct cfg80211_scan_request *scan_req;
  	struct ieee80211_vif *scan_vif;
  	int scan_chan_idx;
@@ -365,8 +366,8 @@
  
  	struct mt7996_scs_ctrl scs_ctrl;
  	u32 red_drop;
-@@ -753,6 +764,12 @@ mt7996_get_background_radar_cap(struct mt7996_dev *dev)
- 	return 1;
+@@ -757,6 +768,12 @@ mt7996_has_background_radar(struct mt7996_dev *dev)
+ 	return true;
  }
  
 +static inline struct mt7996_chanctx *
@@ -379,5 +380,5 @@
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0089-mtk-mt76-mt7996-use-.sta_state-to-replace-.sta_add-a.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0077-mtk-mt76-mt7996-use-.sta_state-to-replace-.sta_add-a.patch
similarity index 72%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0089-mtk-mt76-mt7996-use-.sta_state-to-replace-.sta_add-a.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0077-mtk-mt76-mt7996-use-.sta_state-to-replace-.sta_add-a.patch
index e6cbe6c..0508cee 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0089-mtk-mt76-mt7996-use-.sta_state-to-replace-.sta_add-a.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0077-mtk-mt76-mt7996-use-.sta_state-to-replace-.sta_add-a.patch
@@ -1,7 +1,7 @@
-From 29120502dfe63ff9cde7c6445b34019fd9729cd4 Mon Sep 17 00:00:00 2001
+From 2819a489bf4d70e8407cdc07d2d77b3b40441669 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 8 Nov 2023 18:52:26 +0800
-Subject: [PATCH 089/199] mtk: mt76: mt7996: use .sta_state to replace .sta_add
+Subject: [PATCH 077/223] mtk: mt76: mt7996: use .sta_state to replace .sta_add
  and .sta_remove
 
 MAC80211 mostly uses MLD address through TX path, and leaves the header
@@ -13,18 +13,19 @@
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
+Change-Id: I8a0faef919843f2c7d5ff3256702a3bf8384ea60
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
- mt7996/main.c   | 53 ++++++++++++++++++++-----------------------------
+ mt7996/main.c   | 55 +++++++++++++++++++++----------------------------
  mt7996/mmio.c   |  1 +
  mt7996/mt7996.h |  2 ++
- 3 files changed, 24 insertions(+), 32 deletions(-)
+ 3 files changed, 26 insertions(+), 32 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index f7910abe..0580b9ff 100644
+index cbd64681..5edfbc4b 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -788,7 +788,7 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -782,7 +782,7 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	u8 band_idx = mvif->phy->mt76->band_idx;
@@ -33,7 +34,7 @@
  
  #ifdef CONFIG_MTK_VENDOR
  	struct mt7996_phy *phy = &dev->phy;
-@@ -806,23 +806,10 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -800,23 +800,10 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	msta->wcid.phy_idx = band_idx;
  	msta->wcid.tx_info |= MT_WCID_TX_INFO_SET;
  
@@ -57,25 +58,27 @@
  #ifdef CONFIG_MTK_VENDOR
  	switch (band_idx) {
  	case MT_BAND1:
-@@ -843,6 +830,25 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -837,6 +824,27 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	return 0;
  }
  
-+void mt7996_mac_sta_assoc(struct mt76_dev *mdev, struct ieee80211_vif *vif,
-+			  struct ieee80211_sta *sta)
++int mt7996_mac_sta_event(struct mt76_dev *mdev, struct ieee80211_vif *vif,
++			 struct ieee80211_sta *sta, enum mt76_sta_event ev)
 +{
 +	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
 +	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
 +
 +	mutex_lock(&dev->mt76.mutex);
 +
-+	mt7996_mac_wtbl_update(dev, msta->wcid.idx,
-+			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
++	if (ev == MT76_STA_EVENT_ASSOC) {
++		mt7996_mac_wtbl_update(dev, msta->wcid.idx,
++				       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
 +
-+	mt7996_mcu_add_sta(dev, vif, sta, true, true);
-+	mt7996_mcu_add_rate_ctrl(dev, vif, sta, false);
++		mt7996_mcu_add_sta(dev, vif, sta, true, true);
++		mt7996_mcu_add_rate_ctrl(dev, vif, sta, false);
 +
-+	ewma_avg_signal_init(&msta->avg_ack_signal);
++		ewma_avg_signal_init(&msta->avg_ack_signal);
++	}
 +
 +	mutex_unlock(&dev->mt76.mutex);
 +}
@@ -83,7 +86,7 @@
  void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  			   struct ieee80211_sta *sta)
  {
-@@ -962,22 +968,6 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -956,22 +964,6 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	return ret;
  }
  
@@ -106,7 +109,7 @@
  static int
  mt7996_get_stats(struct ieee80211_hw *hw,
  		 struct ieee80211_low_level_stats *stats)
-@@ -1885,8 +1875,7 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -1879,8 +1871,7 @@ const struct ieee80211_ops mt7996_ops = {
  	.conf_tx = mt7996_conf_tx,
  	.configure_filter = mt7996_configure_filter,
  	.bss_info_changed = mt7996_bss_info_changed,
@@ -117,30 +120,30 @@
  	.sta_rc_update = mt7996_sta_rc_update,
  	.set_key = mt7996_set_key,
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index d4739fea..b94155c4 100644
+index 1fcca23c..8ac1b12a 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -655,6 +655,7 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
  		.rx_check = mt7996_rx_check,
  		.rx_poll_complete = mt7996_rx_poll_complete,
  		.sta_add = mt7996_mac_sta_add,
-+		.sta_assoc = mt7996_mac_sta_assoc,
++		.sta_event = mt7996_mac_sta_event,
  		.sta_remove = mt7996_mac_sta_remove,
  		.update_survey = mt7996_update_channel,
- 	};
+ 		// .set_channel = mt7996_set_channel,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 3597bbbf..75073a1b 100644
+index 07790257..7d416f30 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -967,6 +967,8 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+@@ -971,6 +971,8 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
  void mt7996_mac_set_coverage_class(struct mt7996_phy *phy);
  int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta);
-+void mt7996_mac_sta_assoc(struct mt76_dev *mdev, struct ieee80211_vif *vif,
-+			  struct ieee80211_sta *sta);
++int mt7996_mac_sta_event(struct mt76_dev *mdev, struct ieee80211_vif *vif,
++			 struct ieee80211_sta *sta, enum mt76_sta_event ev);
  void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  			   struct ieee80211_sta *sta);
  void mt7996_mac_work(struct work_struct *work);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0090-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0078-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0090-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0078-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch
index d7ad06b..8e80fdc 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0090-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0078-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch
@@ -1,7 +1,7 @@
-From 737e6a82f962447ef85055ebb32c07568fc8c722 Mon Sep 17 00:00:00 2001
+From 2aa446d88555e199c973a8b46ece2749a7aff2b4 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 24 Nov 2023 11:31:55 +0800
-Subject: [PATCH 090/199] mtk: mt76: mt7996: switch to per-link data structure
+Subject: [PATCH 078/223] mtk: mt76: mt7996: switch to per-link data structure
  of vif
 
 Introduce struct mt7996_bss_conf, data structure for per-link BSS.
@@ -22,7 +22,7 @@
  7 files changed, 463 insertions(+), 363 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 7395f6df..5d4d69ea 100644
+index 7e8e91ca..792ace03 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -726,7 +726,7 @@ static void
@@ -71,7 +71,7 @@
  	char buf[100];
  	int ret;
 diff --git a/mt7996/init.c b/mt7996/init.c
-index d18db618..86bb0661 100644
+index 7afbd46a..f5bff109 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -630,11 +630,11 @@ static int mt7996_vow_init(struct mt7996_phy *phy)
@@ -89,10 +89,10 @@
  		return ret;
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index fc6e383b..5fbcfc74 100644
+index 7cfc25ba..8f743125 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -900,8 +900,9 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -912,8 +912,9 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  
  	if (vif) {
  		struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -103,7 +103,7 @@
  	}
  
  	txp->fw.token = cpu_to_le16(id);
-@@ -1515,12 +1516,15 @@ static void
+@@ -1527,12 +1528,15 @@ static void
  mt7996_update_vif_beacon(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
  	struct ieee80211_hw *hw = priv;
@@ -120,7 +120,7 @@
  		break;
  	default:
  		break;
-@@ -2237,6 +2241,8 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+@@ -2249,6 +2253,8 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  	struct mt7996_dev *dev = container_of(work, struct mt7996_dev, rc_work);
  	struct ieee80211_sta *sta;
  	struct ieee80211_vif *vif;
@@ -129,7 +129,7 @@
  	struct mt7996_sta *msta;
  	u32 changed;
  	LIST_HEAD(list);
-@@ -2253,14 +2259,16 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+@@ -2265,14 +2271,16 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  
  		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
  		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
@@ -148,7 +148,7 @@
  						   RATE_PARAM_MMPS_UPDATE);
  
  		spin_lock_bh(&dev->mt76.sta_poll_lock);
-@@ -2643,7 +2651,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+@@ -2655,7 +2663,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  
  		flow->sched = true;
  		flow->start_tsf = mt7996_mac_twt_sched_list_add(dev, flow);
@@ -157,7 +157,7 @@
  		div_u64_rem(curr_tsf - flow->start_tsf, interval, &rem);
  		flow_tsf = curr_tsf + interval - rem;
  		twt_agrt->twt = cpu_to_le64(flow_tsf);
-@@ -2652,7 +2660,8 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+@@ -2664,7 +2672,8 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  	}
  	flow->tsf = le64_to_cpu(twt_agrt->twt);
  
@@ -167,7 +167,7 @@
  		goto unlock;
  
  	setup_cmd = TWT_SETUP_CMD_ACCEPT;
-@@ -2674,6 +2683,7 @@ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
+@@ -2686,6 +2695,7 @@ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
  				  u8 flowid)
  {
  	struct mt7996_twt_flow *flow;
@@ -175,7 +175,7 @@
  
  	lockdep_assert_held(&dev->mt76.mutex);
  
-@@ -2684,8 +2694,7 @@ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
+@@ -2696,8 +2706,7 @@ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
  		return;
  
  	flow = &msta->twt.flow[flowid];
@@ -186,7 +186,7 @@
  
  	list_del_init(&flow->list);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 0580b9ff..8a32ec69 100644
+index 5edfbc4b..8d919dd0 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -205,29 +205,30 @@ static int get_omac_idx(enum nl80211_iftype type, u64 mask)
@@ -361,7 +361,7 @@
  }
  
  static void ___mt7996_set_channel(struct mt7996_phy *phy,
-@@ -445,6 +452,8 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+@@ -439,6 +446,8 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
  	struct mt7996_sta *msta = sta ? (struct mt7996_sta *)sta->drv_priv :
  				  &mvif->sta;
  	struct mt76_wcid *wcid = &msta->wcid;
@@ -370,7 +370,7 @@
  	u8 *wcid_keyidx = &wcid->hw_key_idx;
  	int idx = key->keyidx;
  	int err = 0;
-@@ -486,9 +495,11 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+@@ -480,9 +489,11 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
  
  	mutex_lock(&dev->mt76.mutex);
  
@@ -385,7 +385,7 @@
  	}
  
  	if (cmd == SET_KEY) {
-@@ -502,9 +513,9 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+@@ -496,9 +507,9 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
  	mt76_wcid_key_setup(&dev->mt76, wcid, key);
  
  	if (key->keyidx == 6 || key->keyidx == 7)
@@ -397,7 +397,7 @@
  					 MCU_WMWA_UNI_CMD(STA_REC_UPDATE),
  					 &msta->wcid, cmd);
  out:
-@@ -551,7 +562,9 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -545,7 +556,9 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	       unsigned int link_id, u16 queue,
  	       const struct ieee80211_tx_queue_params *params)
  {
@@ -407,7 +407,7 @@
  	static const u8 mq_to_aci[] = {
  		[IEEE80211_AC_VO] = 3,
  		[IEEE80211_AC_VI] = 2,
-@@ -559,10 +572,15 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -553,10 +566,15 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		[IEEE80211_AC_BK] = 1,
  	};
  
@@ -424,7 +424,7 @@
  	return 0;
  }
  
-@@ -623,22 +641,20 @@ static void mt7996_configure_filter(struct ieee80211_hw *hw,
+@@ -617,22 +635,20 @@ static void mt7996_configure_filter(struct ieee80211_hw *hw,
  }
  
  static void
@@ -451,7 +451,7 @@
  		break;
  	default:
  		break;
-@@ -646,16 +662,15 @@ mt7996_update_bss_color(struct ieee80211_hw *hw,
+@@ -640,16 +656,15 @@ mt7996_update_bss_color(struct ieee80211_hw *hw,
  }
  
  static u8
@@ -472,7 +472,7 @@
  
  	if (beacon) {
  		struct mt7996_phy *phy = mphy->priv;
-@@ -676,23 +691,22 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -670,23 +685,22 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		if ((mt76_rates[i].hw_value & GENMASK(7, 0)) == idx)
  			return MT7996_BASIC_RATES_TBL + 2 * i;
  
@@ -502,7 +502,7 @@
  	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_POS0(band), mu[0]);
  	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_POS1(band), mu[1]);
  	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_POS2(band), mu[2]);
-@@ -704,20 +718,22 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+@@ -698,20 +712,22 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
  				    struct ieee80211_bss_conf *info,
  				    u64 changed)
  {
@@ -528,7 +528,7 @@
  				   !!(changed & BSS_CHANGED_BSSID));
  	}
  
-@@ -729,42 +745,42 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+@@ -723,42 +739,42 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
  
  		if (slottime != phy->slottime) {
  			phy->slottime = slottime;
@@ -584,7 +584,7 @@
  
  	mutex_unlock(&dev->mt76.mutex);
  }
-@@ -775,9 +791,14 @@ mt7996_channel_switch_beacon(struct ieee80211_hw *hw,
+@@ -769,9 +785,14 @@ mt7996_channel_switch_beacon(struct ieee80211_hw *hw,
  			     struct cfg80211_chan_def *chandef)
  {
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
@@ -600,7 +600,7 @@
  	mutex_unlock(&dev->mt76.mutex);
  }
  
-@@ -787,7 +808,8 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -781,7 +802,8 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -610,7 +610,7 @@
  	int idx;
  
  #ifdef CONFIG_MTK_VENDOR
-@@ -807,7 +829,7 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -801,7 +823,7 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	msta->wcid.tx_info |= MT_WCID_TX_INFO_SET;
  
  #ifdef CONFIG_MTK_VENDOR
@@ -619,8 +619,8 @@
  #endif
  
  #ifdef CONFIG_MTK_VENDOR
-@@ -834,15 +856,20 @@ void mt7996_mac_sta_assoc(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 			  struct ieee80211_sta *sta)
+@@ -828,7 +850,10 @@ int mt7996_mac_sta_event(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 			 struct ieee80211_sta *sta, enum mt76_sta_event ev)
  {
  	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
 +	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -630,19 +630,20 @@
  
  	mutex_lock(&dev->mt76.mutex);
  
- 	mt7996_mac_wtbl_update(dev, msta->wcid.idx,
- 			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
- 
--	mt7996_mcu_add_sta(dev, vif, sta, true, true);
--	mt7996_mcu_add_rate_ctrl(dev, vif, sta, false);
-+	conf = link_conf_dereference_protected(vif, 0);
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	mt7996_mcu_add_sta(dev, conf, mconf, sta, true, true);
-+	mt7996_mcu_add_rate_ctrl(dev, conf, mconf, sta, false);
+@@ -836,8 +861,10 @@ int mt7996_mac_sta_event(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 		mt7996_mac_wtbl_update(dev, msta->wcid.idx,
+ 				       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
  
- 	ewma_avg_signal_init(&msta->avg_ack_signal);
+-		mt7996_mcu_add_sta(dev, vif, sta, true, true);
+-		mt7996_mcu_add_rate_ctrl(dev, vif, sta, false);
++		conf = link_conf_dereference_protected(vif, 0);
++		mconf = mconf_dereference_protected(mvif, 0);
++		mt7996_mcu_add_sta(dev, conf, mconf, sta, true, true);
++		mt7996_mcu_add_rate_ctrl(dev, conf, mconf, sta, false);
  
-@@ -853,10 +880,15 @@ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 		ewma_avg_signal_init(&msta->avg_ack_signal);
+ 	}
+@@ -849,10 +876,15 @@ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  			   struct ieee80211_sta *sta)
  {
  	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
@@ -659,7 +660,7 @@
  
  	mt7996_mac_wtbl_update(dev, msta->wcid.idx,
  			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
-@@ -988,7 +1020,7 @@ mt7996_get_stats(struct ieee80211_hw *hw,
+@@ -984,7 +1016,7 @@ mt7996_get_stats(struct ieee80211_hw *hw,
  	return 0;
  }
  
@@ -668,7 +669,7 @@
  {
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
-@@ -1000,8 +1032,8 @@ u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif)
+@@ -996,8 +1028,8 @@ u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif)
  
  	lockdep_assert_held(&dev->mt76.mutex);
  
@@ -679,7 +680,7 @@
  	/* TSF software read */
  	mt76_rmw(dev, MT_LPON_TCR(phy->mt76->band_idx, n), MT_LPON_TCR_SW_MODE,
  		 MT_LPON_TCR_SW_READ);
-@@ -1016,10 +1048,12 @@ mt7996_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+@@ -1012,10 +1044,12 @@ mt7996_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
  {
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
@@ -693,7 +694,7 @@
  	mutex_unlock(&dev->mt76.mutex);
  
  	return ret;
-@@ -1032,6 +1066,7 @@ mt7996_set_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1028,6 +1062,7 @@ mt7996_set_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
@@ -701,7 +702,7 @@
  	union {
  		u64 t64;
  		u32 t32[2];
-@@ -1040,8 +1075,9 @@ mt7996_set_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1036,8 +1071,9 @@ mt7996_set_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  	mutex_lock(&dev->mt76.mutex);
  
@@ -713,7 +714,7 @@
  	mt76_wr(dev, MT_LPON_UTTR0(phy->mt76->band_idx), tsf.t32[0]);
  	mt76_wr(dev, MT_LPON_UTTR1(phy->mt76->band_idx), tsf.t32[1]);
  	/* TSF software overwrite */
-@@ -1058,6 +1094,7 @@ mt7996_offset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1054,6 +1090,7 @@ mt7996_offset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
@@ -721,7 +722,7 @@
  	union {
  		u64 t64;
  		u32 t32[2];
-@@ -1066,8 +1103,9 @@ mt7996_offset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1062,8 +1099,9 @@ mt7996_offset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  	mutex_lock(&dev->mt76.mutex);
  
@@ -733,7 +734,7 @@
  	mt76_wr(dev, MT_LPON_UTTR0(phy->mt76->band_idx), tsf.t32[0]);
  	mt76_wr(dev, MT_LPON_UTTR1(phy->mt76->band_idx), tsf.t32[1]);
  	/* TSF software adjust*/
-@@ -1183,7 +1221,7 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
+@@ -1179,7 +1217,7 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
  static void mt7996_sta_rc_work(void *data, struct ieee80211_sta *sta)
  {
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
@@ -742,7 +743,7 @@
  	u32 *changed = data;
  
  	spin_lock_bh(&dev->mt76.sta_poll_lock);
-@@ -1219,9 +1257,13 @@ mt7996_set_bitrate_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1215,9 +1253,13 @@ mt7996_set_bitrate_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  	struct mt7996_dev *dev = phy->dev;
@@ -757,7 +758,7 @@
  
  	/* if multiple rates across different preambles are given we can
  	 * reconfigure this info with all peers using sta_rec command with
-@@ -1243,14 +1285,20 @@ static void mt7996_sta_set_4addr(struct ieee80211_hw *hw,
+@@ -1239,14 +1281,20 @@ static void mt7996_sta_set_4addr(struct ieee80211_hw *hw,
  				 bool enabled)
  {
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
@@ -779,7 +780,7 @@
  }
  
  static void mt7996_sta_set_decap_offload(struct ieee80211_hw *hw,
-@@ -1259,14 +1307,20 @@ static void mt7996_sta_set_decap_offload(struct ieee80211_hw *hw,
+@@ -1255,14 +1303,20 @@ static void mt7996_sta_set_decap_offload(struct ieee80211_hw *hw,
  					 bool enabled)
  {
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
@@ -801,7 +802,7 @@
  }
  
  static const char mt7996_gstrings_stats[][ETH_GSTRING_LEN] = {
-@@ -1399,7 +1453,7 @@ static void mt7996_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
+@@ -1395,7 +1449,7 @@ static void mt7996_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
  	struct mt76_ethtool_worker_info *wi = wi_data;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
  
@@ -810,7 +811,7 @@
  		return;
  
  	mt76_ethtool_worker(wi, &msta->wcid.stats, true);
-@@ -1413,15 +1467,17 @@ void mt7996_get_et_stats(struct ieee80211_hw *hw,
+@@ -1409,15 +1463,17 @@ void mt7996_get_et_stats(struct ieee80211_hw *hw,
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -829,7 +830,7 @@
  
  	mt7996_mac_update_stats(phy);
  
-@@ -1627,6 +1683,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1623,6 +1679,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  			     struct net_device_path *path)
  {
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -837,7 +838,7 @@
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
-@@ -1656,7 +1713,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1652,7 +1709,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->type = DEV_PATH_MTK_WDMA;
  	path->dev = ctx->dev;
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
@@ -846,7 +847,7 @@
  	path->mtk_wdma.queue = 0;
  	path->mtk_wdma.wcid = msta->wcid.idx;
  
-@@ -1788,6 +1845,7 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1784,6 +1841,7 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	struct mt7996_chanctx *ctx = mt7996_chanctx_get(conf);
  	struct mt7996_phy *phy = ctx->phy;
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -854,7 +855,7 @@
  
  	wiphy_info(hw->wiphy, "Assign VIF (addr: %pM, type: %d, link_id: %d) to channel context: %d MHz\n",
  		    vif->addr, vif->type, link_conf->link_id,
-@@ -1795,7 +1853,8 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1791,7 +1849,8 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  	mutex_lock(&phy->dev->mt76.mutex);
  
@@ -864,7 +865,7 @@
  	ctx->nbss_assigned++;
  
  	mutex_unlock(&phy->dev->mt76.mutex);
-@@ -1811,6 +1870,7 @@ mt7996_unassign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1807,6 +1866,7 @@ mt7996_unassign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	struct mt7996_chanctx *ctx = mt7996_chanctx_get(conf);
  	struct mt7996_phy *phy = ctx->phy;
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -872,7 +873,7 @@
  
  	wiphy_info(hw->wiphy, "Remove VIF (addr: %pM, type: %d, link_id: %d) from channel context: %d MHz\n",
  		   vif->addr, vif->type, link_conf->link_id,
-@@ -1822,7 +1882,8 @@ mt7996_unassign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1818,7 +1878,8 @@ mt7996_unassign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	if (test_bit(MT76_SCANNING, &phy->mt76->state))
  		mt7996_scan_complete(phy, true);
  
@@ -883,10 +884,10 @@
  
  	mutex_unlock(&phy->dev->mt76.mutex);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 7faf0916..1e0fca2d 100644
+index ba53c3fc..b2eed253 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -117,12 +117,12 @@ mt7996_mcu_get_sta_nss(u16 mcs_map)
+@@ -122,12 +122,12 @@ mt7996_mcu_get_sta_nss(u16 mcs_map)
  }
  
  static void
@@ -904,7 +905,7 @@
  	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
  
  	for (nss = 0; nss < max_nss; nss++) {
-@@ -922,8 +922,7 @@ mt7996_mcu_add_uni_tlv(struct sk_buff *skb, u16 tag, u16 len)
+@@ -927,8 +927,7 @@ mt7996_mcu_add_uni_tlv(struct sk_buff *skb, u16 tag, u16 len)
  }
  
  static void
@@ -914,7 +915,7 @@
  {
  	static const u8 rlm_ch_band[] = {
  		[NL80211_BAND_2GHZ] = 1,
-@@ -953,8 +952,7 @@ mt7996_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+@@ -958,8 +957,7 @@ mt7996_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
  }
  
  static void
@@ -924,7 +925,7 @@
  {
  	struct bss_ra_tlv *ra;
  	struct tlv *tlv;
-@@ -966,7 +964,7 @@ mt7996_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+@@ -971,7 +969,7 @@ mt7996_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
  }
  
  static void
@@ -933,7 +934,7 @@
  		      struct mt7996_phy *phy)
  {
  #define DEFAULT_HE_PE_DURATION		4
-@@ -975,16 +973,16 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+@@ -980,16 +978,16 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
  	struct bss_info_uni_he *he;
  	struct tlv *tlv;
  
@@ -953,7 +954,7 @@
  	if (!he->he_rts_thres)
  		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
  
-@@ -994,13 +992,13 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+@@ -999,13 +997,13 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
  }
  
  static void
@@ -969,7 +970,7 @@
  		return;
  
  	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_11V_MBSSID, sizeof(*mbssid));
-@@ -1008,23 +1006,21 @@ mt7996_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+@@ -1013,23 +1011,21 @@ mt7996_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
  	mbssid = (struct bss_info_uni_mbssid *)tlv;
  
  	if (enable) {
@@ -997,7 +998,7 @@
  
  	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_RATE, sizeof(*bmc));
  
-@@ -1048,9 +1044,9 @@ mt7996_mcu_bss_txcmd_tlv(struct sk_buff *skb, bool en)
+@@ -1053,9 +1049,9 @@ mt7996_mcu_bss_txcmd_tlv(struct sk_buff *skb, bool en)
  }
  
  static void
@@ -1009,7 +1010,7 @@
  	struct bss_mld_tlv *mld;
  	struct tlv *tlv;
  
-@@ -1058,33 +1054,30 @@ mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
+@@ -1063,33 +1059,30 @@ mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
  
  	mld = (struct bss_mld_tlv *)tlv;
  	mld->group_mld_id = 0xff;
@@ -1050,7 +1051,7 @@
  	struct {
  		struct {
  			u8 band;
-@@ -1109,9 +1102,6 @@ mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+@@ -1114,9 +1107,6 @@ mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_vif *vif,
  		.entry_add = true,
  	};
  
@@ -1060,7 +1061,7 @@
  	if (enable)
  		memcpy(req.addr, addr, ETH_ALEN);
  
-@@ -1120,10 +1110,8 @@ mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+@@ -1125,10 +1115,8 @@ mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_vif *vif,
  }
  
  static void
@@ -1072,7 +1073,7 @@
  	struct bss_ifs_time_tlv *ifs_time;
  	struct tlv *tlv;
  	bool is_2ghz = phy->mt76->chandef.chan->band == NL80211_BAND_2GHZ;
-@@ -1149,12 +1137,13 @@ mt7996_mcu_bss_ifs_timing_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
+@@ -1154,12 +1142,13 @@ mt7996_mcu_bss_ifs_timing_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
  
  static int
  mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
@@ -1088,7 +1089,7 @@
  	struct cfg80211_chan_def *chandef = &phy->chandef;
  	struct mt76_connac_bss_basic_tlv *bss;
  	u32 type = CONNECTION_INFRA_AP;
-@@ -1171,8 +1160,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -1176,8 +1165,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  		if (enable) {
  			rcu_read_lock();
  			if (!sta)
@@ -1098,7 +1099,7 @@
  			/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
  			if (sta) {
  				struct mt76_wcid *wcid;
-@@ -1195,18 +1183,17 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -1200,18 +1188,17 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*bss));
  
  	bss = (struct mt76_connac_bss_basic_tlv *)tlv;
@@ -1122,7 +1123,7 @@
  	bss->hw_bss_idx = idx;
  
  	if (vif->type == NL80211_IFTYPE_MONITOR) {
-@@ -1219,9 +1206,9 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -1224,9 +1211,9 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  		return 0;
  	}
  
@@ -1135,7 +1136,7 @@
  	bss->phymode = mt76_connac_get_phy_mode(phy, vif,
  						chandef->chan->band, NULL);
  	bss->phymode_ext = mt76_connac_get_phy_mode_ext(phy, vif,
-@@ -1248,63 +1235,64 @@ __mt7996_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
+@@ -1253,63 +1240,64 @@ __mt7996_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
  }
  
  int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
@@ -1219,7 +1220,7 @@
  
  	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
  				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
-@@ -1346,12 +1334,12 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
+@@ -1351,12 +1339,12 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  			 bool enable)
  {
  	struct mt7996_sta *msta = (struct mt7996_sta *)params->sta->drv_priv;
@@ -1234,7 +1235,7 @@
  }
  
  int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
-@@ -1359,13 +1347,14 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
+@@ -1364,13 +1352,14 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
  			 bool enable)
  {
  	struct mt7996_sta *msta = (struct mt7996_sta *)params->sta->drv_priv;
@@ -1252,7 +1253,7 @@
  		      struct ieee80211_sta *sta)
  {
  	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
-@@ -1386,9 +1375,9 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+@@ -1391,9 +1380,9 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
  		he->he_phy_cap[i] = elem->phy_cap_info[i];
  	}
  
@@ -1264,7 +1265,7 @@
  				 IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD);
  
  	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
-@@ -1396,16 +1385,16 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+@@ -1401,16 +1390,16 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
@@ -1284,7 +1285,7 @@
  					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
  					  le16_to_cpu(mcs_map.rx_mcs_80));
  		break;
-@@ -1496,7 +1485,7 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1501,7 +1490,7 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct tlv *tlv;
  #ifdef CONFIG_MTK_VENDOR
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
@@ -1293,7 +1294,7 @@
  #endif
  
  	/* For 6G band, this tlv is necessary to let hw work normally */
-@@ -1553,25 +1542,26 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1558,25 +1547,26 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  
  static void
  mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
@@ -1329,7 +1330,7 @@
  			       !!(phy->muru_onoff & MUMIMO_DL);
  	muru->cfg.mimo_ul_en = !!(phy->muru_onoff & MUMIMO_UL);
  	muru->cfg.ofdma_dl_en = !!(phy->muru_onoff & OFDMA_DL);
-@@ -1612,13 +1602,14 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1617,13 +1607,14 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  }
  
  static inline bool
@@ -1347,7 +1348,7 @@
  		return false;
  
  	if (!bfee && sts < 2)
-@@ -1629,10 +1620,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+@@ -1634,10 +1625,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
  		struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
  
  		if (bfee)
@@ -1360,7 +1361,7 @@
  			       EHT_PHY(CAP0_SU_BEAMFORMEE, pe->phy_cap_info[0]);
  	}
  
-@@ -1640,10 +1631,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+@@ -1645,10 +1636,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
  		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
  
  		if (bfee)
@@ -1373,7 +1374,7 @@
  			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
  	}
  
-@@ -1651,10 +1642,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+@@ -1656,10 +1647,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
  		u32 cap = sta->deflink.vht_cap.cap;
  
  		if (bfee)
@@ -1386,7 +1387,7 @@
  			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
  	}
  
-@@ -1850,10 +1841,10 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+@@ -1855,10 +1846,10 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  
  static void
  mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
@@ -1400,7 +1401,7 @@
  	int tx_ant = hweight16(phy->mt76->chainmask) - 1;
  	struct sta_rec_bf *bf;
  	struct tlv *tlv;
-@@ -1868,7 +1859,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1873,7 +1864,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
  		return;
  
@@ -1409,7 +1410,7 @@
  	if (!ebf && !dev->ibf)
  		return;
  
-@@ -1880,9 +1871,9 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1885,9 +1876,9 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	 * ht: iBF only, since mac80211 lacks of eBF support
  	 */
  	if (sta->deflink.eht_cap.has_eht && ebf)
@@ -1421,7 +1422,7 @@
  	else if (sta->deflink.vht_cap.vht_supported)
  		mt7996_mcu_sta_bfer_vht(sta, phy, bf, ebf);
  	else if (sta->deflink.ht_cap.ht_supported)
-@@ -1921,10 +1912,10 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1926,10 +1917,10 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  
  static void
  mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
@@ -1435,7 +1436,7 @@
  	int tx_ant = hweight8(phy->mt76->antenna_mask) - 1;
  	struct sta_rec_bfee *bfee;
  	struct tlv *tlv;
-@@ -1933,7 +1924,7 @@ mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1938,7 +1929,7 @@ mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
  		return;
  
@@ -1444,7 +1445,7 @@
  		return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
-@@ -2055,17 +2046,17 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
+@@ -2060,17 +2051,17 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
  				     MCU_WM_UNI_CMD(RA), true);
  }
  
@@ -1465,7 +1466,7 @@
  					      &msta->wcid,
  					      MT7996_STA_UPDATE_MAX_SIZE);
  	if (IS_ERR(skb))
-@@ -2097,12 +2088,13 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif
+@@ -2102,12 +2093,13 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif
  }
  
  static int
@@ -1483,7 +1484,7 @@
  	enum nl80211_band band = chandef->chan->band;
  	struct sta_phy_uni phy = {};
  	int ret, nrates = 0;
-@@ -2144,7 +2136,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
+@@ -2149,7 +2141,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
  
  	/* fixed single rate */
  	if (nrates == 1) {
@@ -1492,7 +1493,7 @@
  						 RATE_PARAM_FIXED_MCS);
  		if (ret)
  			return ret;
-@@ -2166,7 +2158,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
+@@ -2171,7 +2163,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
  		else
  			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
  
@@ -1501,7 +1502,7 @@
  						 RATE_PARAM_FIXED_GI);
  		if (ret)
  			return ret;
-@@ -2174,7 +2166,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
+@@ -2179,7 +2171,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
  
  	/* fixed HE_LTF */
  	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
@@ -1510,7 +1511,7 @@
  						 RATE_PARAM_FIXED_HE_LTF);
  		if (ret)
  			return ret;
-@@ -2185,13 +2177,14 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
+@@ -2190,13 +2182,14 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
  
  static void
  mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
@@ -1529,7 +1530,7 @@
  	enum nl80211_band band = chandef->chan->band;
  	struct sta_rec_ra_uni *ra;
  	struct tlv *tlv;
-@@ -2203,7 +2196,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+@@ -2208,7 +2201,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  
  	ra->valid = true;
  	ra->auto_rate = true;
@@ -1538,7 +1539,7 @@
  	ra->channel = chandef->chan->hw_value;
  	ra->bw = (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_320) ?
  		 CMD_CBW_320MHZ : sta->deflink.bandwidth;
-@@ -2242,7 +2235,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+@@ -2247,7 +2240,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  			cap |= STA_CAP_TX_STBC;
  		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
  			cap |= STA_CAP_RX_STBC;
@@ -1547,7 +1548,7 @@
  		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
  			cap |= STA_CAP_LDPC;
  
-@@ -2268,7 +2261,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+@@ -2273,7 +2266,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  			cap |= STA_CAP_VHT_TX_STBC;
  		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
  			cap |= STA_CAP_VHT_RX_STBC;
@@ -1556,7 +1557,7 @@
  		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
  			cap |= STA_CAP_VHT_LDPC;
  
-@@ -2289,15 +2282,16 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+@@ -2294,15 +2287,16 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  	memset(ra->rx_rcpi, INIT_RCPI, sizeof(ra->rx_rcpi));
  }
  
@@ -1576,7 +1577,7 @@
  					      &msta->wcid,
  					      MT7996_STA_UPDATE_MAX_SIZE);
  	if (IS_ERR(skb))
-@@ -2308,26 +2302,27 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2313,26 +2307,27 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	 * update sta_rec_he here.
  	 */
  	if (changed)
@@ -1609,7 +1610,7 @@
  	int ret;
  
  	/* Assignment of STA BSS group index aligns FW.
-@@ -2344,20 +2339,22 @@ mt7996_mcu_sta_init_vow(struct mt7996_phy *phy, struct mt7996_sta *msta)
+@@ -2349,20 +2344,22 @@ mt7996_mcu_sta_init_vow(struct mt7996_phy *phy, struct mt7996_sta *msta)
  	vow->drr_quantum[IEEE80211_AC_BE] = VOW_DRR_QUANTUM_IDX2;
  	vow->drr_quantum[IEEE80211_AC_BK] = VOW_DRR_QUANTUM_IDX2;
  
@@ -1637,7 +1638,7 @@
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct ieee80211_link_sta *link_sta;
  	struct mt7996_sta *msta;
-@@ -2367,7 +2364,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2373,7 +2370,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mvif->sta;
  	link_sta = sta ? &sta->deflink : NULL;
  
@@ -1646,7 +1647,7 @@
  					      &msta->wcid,
  					      MT7996_STA_UPDATE_MAX_SIZE);
  	if (IS_ERR(skb))
-@@ -2390,7 +2387,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2397,7 +2394,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  		/* starec hdrt mode */
  		mt7996_mcu_sta_hdrt_tlv(dev, skb);
  		/* starec bfer */
@@ -1655,7 +1656,7 @@
  		/* starec ht */
  		mt7996_mcu_sta_ht_tlv(skb, sta);
  		/* starec vht */
-@@ -2400,18 +2397,18 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2407,18 +2404,18 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  		/* starec amsdu */
  		mt7996_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
  		/* starec he */
@@ -1678,7 +1679,7 @@
  	if (ret) {
  		dev_kfree_skb(skb);
  		return ret;
-@@ -2466,16 +2463,15 @@ mt7996_mcu_sta_key_tlv(struct mt76_wcid *wcid,
+@@ -2473,16 +2470,15 @@ mt7996_mcu_sta_key_tlv(struct mt76_wcid *wcid,
  	return 0;
  }
  
@@ -1698,7 +1699,7 @@
  	if (IS_ERR(skb))
  		return PTR_ERR(skb);
  
-@@ -2486,17 +2482,18 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
+@@ -2493,17 +2489,18 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
  	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
  }
  
@@ -1721,7 +1722,7 @@
  	if (IS_ERR(skb))
  		return PTR_ERR(skb);
  
-@@ -2520,10 +2517,11 @@ static int mt7996_mcu_get_pn(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2527,10 +2524,11 @@ static int mt7996_mcu_get_pn(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	return 0;
  }
  
@@ -1735,7 +1736,7 @@
  	struct mt7996_mcu_bcn_prot_tlv *bcn_prot;
  	struct sk_buff *skb;
  	struct tlv *tlv;
-@@ -2532,7 +2530,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
+@@ -2539,7 +2537,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
  		  sizeof(struct mt7996_mcu_bcn_prot_tlv);
  	int ret;
  
@@ -1744,7 +1745,7 @@
  	if (IS_ERR(skb))
  		return PTR_ERR(skb);
  
-@@ -2540,7 +2538,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
+@@ -2547,7 +2545,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
  
  	bcn_prot = (struct mt7996_mcu_bcn_prot_tlv *)tlv;
  
@@ -1753,7 +1754,7 @@
  	if (ret) {
  		dev_kfree_skb(skb);
  		return ret;
-@@ -2573,10 +2571,10 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
+@@ -2580,10 +2578,10 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
  				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
  }
  int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
@@ -1766,7 +1767,7 @@
  	struct {
  		struct req_hdr {
  			u8 omac_idx;
-@@ -2592,8 +2590,8 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
+@@ -2599,8 +2597,8 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
  		} __packed tlv;
  	} data = {
  		.hdr = {
@@ -1777,7 +1778,7 @@
  		},
  		.tlv = {
  			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
-@@ -2602,16 +2600,16 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
+@@ -2609,16 +2607,16 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
  		},
  	};
  
@@ -1798,7 +1799,7 @@
  			 struct sk_buff *skb,
  			 struct ieee80211_mutable_offsets *offs)
  {
-@@ -2622,7 +2620,7 @@ mt7996_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
+@@ -2629,7 +2627,7 @@ mt7996_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
  	if (!offs->cntdwn_counter_offs[0])
  		return;
  
@@ -1807,7 +1808,7 @@
  
  	tlv = mt7996_mcu_add_uni_tlv(rskb, tag, sizeof(*info));
  
-@@ -2632,14 +2630,15 @@ mt7996_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
+@@ -2639,14 +2637,15 @@ mt7996_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
  
  static void
  mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
@@ -1825,7 +1826,7 @@
  		return;
  
  	tlv = mt7996_mcu_add_uni_tlv(rskb, UNI_BSS_INFO_BCN_MBSSID, sizeof(*mbss));
-@@ -2684,7 +2683,7 @@ mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
+@@ -2691,7 +2690,7 @@ mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
  }
  
  static void
@@ -1834,7 +1835,7 @@
  		       struct sk_buff *rskb, struct sk_buff *skb,
  		       struct bss_bcn_content_tlv *bcn,
  		       struct ieee80211_mutable_offsets *offs)
-@@ -2698,9 +2697,9 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2705,9 +2704,9 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	if (offs->cntdwn_counter_offs[0]) {
  		u16 offset = offs->cntdwn_counter_offs[0];
  
@@ -1846,7 +1847,7 @@
  			bcn->bcc_ie_pos = cpu_to_le16(offset - 3);
  	}
  
-@@ -2712,11 +2711,11 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2719,11 +2718,11 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  }
  
  int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
@@ -1860,7 +1861,7 @@
  	struct ieee80211_mutable_offsets offs;
  	struct ieee80211_tx_info *info;
  	struct sk_buff *skb, *rskb;
-@@ -2724,15 +2723,15 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+@@ -2731,15 +2730,15 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  	struct bss_bcn_content_tlv *bcn;
  	int len;
  
@@ -1879,7 +1880,7 @@
  	if (!skb) {
  		dev_kfree_skb(rskb);
  		return -EINVAL;
-@@ -2755,9 +2754,9 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+@@ -2762,9 +2761,9 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  	if (!en)
  		goto out;
  
@@ -1892,7 +1893,7 @@
  out:
  	dev_kfree_skb(skb);
  	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
-@@ -2765,14 +2764,15 @@ out:
+@@ -2772,14 +2771,15 @@ out:
  }
  
  int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
@@ -1911,7 +1912,7 @@
  	enum nl80211_band band = chandef->chan->band;
  	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
  	struct bss_inband_discovery_tlv *discov;
-@@ -2782,20 +2782,20 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+@@ -2789,20 +2789,20 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
  	u8 *buf, interval;
  	int len;
  
@@ -1937,7 +1938,7 @@
  		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
  	}
  
-@@ -3459,7 +3459,7 @@ int mt7996_mcu_set_hdr_trans(struct mt7996_dev *dev, bool hdr_trans)
+@@ -3467,7 +3467,7 @@ int mt7996_mcu_set_hdr_trans(struct mt7996_dev *dev, bool hdr_trans)
  				     MCU_WM_UNI_CMD(RX_HDR_TRANS), true);
  }
  
@@ -1946,7 +1947,7 @@
  {
  #define MCU_EDCA_AC_PARAM	0
  #define WMM_AIFS_SET		BIT(0)
-@@ -3468,12 +3468,11 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
+@@ -3476,12 +3476,11 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
  #define WMM_TXOP_SET		BIT(3)
  #define WMM_PARAM_SET		(WMM_AIFS_SET | WMM_CW_MIN_SET | \
  				 WMM_CW_MAX_SET | WMM_TXOP_SET)
@@ -1960,7 +1961,7 @@
  	};
  	struct sk_buff *skb;
  	int len = sizeof(hdr) + IEEE80211_NUM_ACS * sizeof(struct edca);
-@@ -3486,7 +3485,7 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
+@@ -3494,7 +3493,7 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
  	skb_put_data(skb, &hdr, sizeof(hdr));
  
  	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
@@ -1969,7 +1970,7 @@
  		struct edca *e;
  		struct tlv *tlv;
  
-@@ -4499,12 +4498,12 @@ mt7996_mcu_set_obss_spr_pd(struct mt7996_phy *phy,
+@@ -4525,12 +4524,12 @@ mt7996_mcu_set_obss_spr_pd(struct mt7996_phy *phy,
  }
  
  static int
@@ -1985,7 +1986,7 @@
  	struct {
  		u8 band_idx;
  		u8 __rsv[3];
-@@ -4576,7 +4575,8 @@ mt7996_mcu_set_obss_spr_bitmap(struct mt7996_phy *phy,
+@@ -4602,7 +4601,8 @@ mt7996_mcu_set_obss_spr_bitmap(struct mt7996_phy *phy,
  				 sizeof(req), true);
  }
  
@@ -1995,7 +1996,7 @@
  			    struct ieee80211_he_obss_pd *he_obss_pd)
  {
  	int ret;
-@@ -4610,7 +4610,7 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+@@ -4636,7 +4636,7 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
  		return ret;
  
  	/* Set SR prohibit */
@@ -2004,7 +2005,7 @@
  	if (ret)
  		return ret;
  
-@@ -4618,16 +4618,16 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+@@ -4644,16 +4644,16 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
  	return mt7996_mcu_set_obss_spr_bitmap(phy, he_obss_pd);
  }
  
@@ -2024,7 +2025,7 @@
  	if (IS_ERR(skb))
  		return PTR_ERR(skb);
  
-@@ -4646,7 +4646,7 @@ int mt7996_mcu_update_bss_color(struct mt7996_dev *dev, struct ieee80211_vif *vi
+@@ -4672,7 +4672,7 @@ int mt7996_mcu_update_bss_color(struct mt7996_dev *dev, struct ieee80211_vif *vi
  #define TWT_AGRT_PROTECT	BIT(2)
  
  int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
@@ -2033,7 +2034,7 @@
  			       struct mt7996_twt_flow *flow,
  			       int cmd)
  {
-@@ -4677,12 +4677,12 @@ int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
+@@ -4703,12 +4703,12 @@ int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
  		.len = cpu_to_le16(sizeof(req) - 4),
  		.tbl_idx = flow->table_id,
  		.cmd = cmd,
@@ -2049,7 +2050,7 @@
  		.start_tsf = cpu_to_le64(flow->tsf),
  		.mantissa = flow->mantissa,
  		.exponent = flow->exp,
-@@ -4813,15 +4813,15 @@ int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev, bool disable
+@@ -4839,15 +4839,15 @@ int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev, bool disable
  
  int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
  				     struct ieee80211_vif *vif,
@@ -2068,7 +2069,7 @@
  					      &msta->wcid,
  					      MT7996_STA_UPDATE_MAX_SIZE);
  	if (IS_ERR(skb))
-@@ -5449,8 +5449,9 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
+@@ -5475,8 +5475,9 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
  				 &req, sizeof(req), false);
  }
  
@@ -2080,7 +2081,7 @@
  {
  	struct mt7996_vow_sta_ctrl *vow = msta ? &msta->vow : NULL;
  	u32 val = 0;
-@@ -5476,9 +5477,9 @@ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy, struct mt7996_sta *msta,
+@@ -5502,9 +5503,9 @@ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy, struct mt7996_sta *msta,
  		.len = cpu_to_le16(sizeof(req) - 4),
  		.wlan_idx = cpu_to_le16(msta ? msta->wcid.idx : 0),
  		.band_idx = phy->mt76->band_idx,
@@ -2092,7 +2093,7 @@
  	};
  
  	switch (id) {
-@@ -5666,7 +5667,7 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -5692,7 +5693,7 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  {
  	u8 mode, val;
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -2101,7 +2102,7 @@
  
  	mode = FIELD_GET(RATE_CFG_MODE, *((u32 *)data));
  	val = FIELD_GET(RATE_CFG_VAL, *((u32 *)data));
-@@ -5697,11 +5698,11 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -5723,11 +5724,11 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  {
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -2116,10 +2117,10 @@
  }
  #endif
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 75073a1b..46964079 100644
+index 7d416f30..be966c18 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -325,18 +325,25 @@ struct mt7996_sta {
+@@ -326,18 +326,25 @@ struct mt7996_sta {
  	struct mt7996_vow_sta_ctrl vow;
  };
  
@@ -2148,7 +2149,7 @@
  /* crash-dump */
  struct mt7996_crash_data {
  	guid_t guid;
-@@ -770,6 +777,13 @@ mt7996_chanctx_get(struct ieee80211_chanctx_conf *ctx)
+@@ -774,6 +781,13 @@ mt7996_chanctx_get(struct ieee80211_chanctx_conf *ctx)
  	return (struct mt7996_chanctx *)&ctx->drv_priv;
  }
  
@@ -2162,7 +2163,7 @@
  extern const struct ieee80211_ops mt7996_ops;
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
-@@ -780,7 +794,7 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
+@@ -784,7 +798,7 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
  void mt7996_wfsys_reset(struct mt7996_dev *dev);
  void mt7996_rro_hw_init(struct mt7996_dev *dev);
  irqreturn_t mt7996_irq_handler(int irq, void *dev_instance);
@@ -2171,7 +2172,7 @@
  int mt7996_register_device(struct mt7996_dev *dev);
  void mt7996_unregister_device(struct mt7996_dev *dev);
  const char *mt7996_eeprom_name(struct mt7996_dev *dev);
-@@ -806,37 +820,47 @@ int mt7996_run(struct ieee80211_hw *hw);
+@@ -810,37 +824,47 @@ int mt7996_run(struct ieee80211_hw *hw);
  int mt7996_mcu_init(struct mt7996_dev *dev);
  int mt7996_mcu_init_firmware(struct mt7996_dev *dev);
  int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
@@ -2231,8 +2232,8 @@
 +			       struct mt7996_bss_conf *mconf,
  			       struct ieee80211_sta *sta, void *data, u32 field);
  int mt7996_mcu_set_eeprom(struct mt7996_dev *dev);
- int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf);
-@@ -851,7 +875,7 @@ int mt7996_mcu_set_radar_th(struct mt7996_dev *dev, int index,
+ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len);
+@@ -855,7 +879,7 @@ int mt7996_mcu_set_radar_th(struct mt7996_dev *dev, int index,
  			    const struct mt7996_dfs_pattern *pattern);
  int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable);
  int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val);
@@ -2241,7 +2242,7 @@
  int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch);
  int mt7996_mcu_get_temperature(struct mt7996_phy *phy);
  int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state);
-@@ -891,8 +915,9 @@ void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb);
+@@ -895,8 +919,9 @@ void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb);
  int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable);
  void mt7996_mcu_scs_sta_poll(struct work_struct *work);
  int mt7996_mcu_set_band_confg(struct mt7996_phy *phy, u16 option, bool enable);
@@ -2253,7 +2254,7 @@
  int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy);
  void mt7996_mcu_wmm_pbc_work(struct work_struct *work);
  
-@@ -1001,13 +1026,16 @@ void mt7996_update_channel(struct mt76_phy *mphy);
+@@ -1005,13 +1030,16 @@ void mt7996_update_channel(struct mt76_phy *mphy);
  int mt7996_init_debugfs(struct mt7996_phy *phy);
  void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int len);
  bool mt7996_debugfs_rx_log(struct mt7996_dev *dev, const void *data, int len);
@@ -2273,10 +2274,10 @@
  int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode);
  int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 784a8bea..bf55b430 100644
+index 5a8b6d0a..042da4e4 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -223,6 +223,7 @@ static void
+@@ -229,6 +229,7 @@ static void
  mt7996_tm_init(struct mt7996_phy *phy, bool en)
  {
  	struct mt7996_dev *dev = phy->dev;
@@ -2284,7 +2285,7 @@
  	u8 rf_test_mode = en ? RF_OPER_RF_TEST : RF_OPER_NORMAL;
  
  	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
-@@ -234,8 +235,8 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
+@@ -240,8 +241,8 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
  
  	mt7996_tm_rf_switch_mode(dev, rf_test_mode);
  
@@ -2295,7 +2296,7 @@
  
  	mt7996_tm_set(dev, SET_ID(BAND_IDX), phy->mt76->band_idx);
  
-@@ -1179,13 +1180,13 @@ mt7996_tm_txbf_init(struct mt7996_phy *phy, u16 *val)
+@@ -1185,13 +1186,13 @@ mt7996_tm_txbf_init(struct mt7996_phy *phy, u16 *val)
  	mt7996_tm_set_mac_addr(dev, td->addr[2], SET_ID(BSSID));
  
  	/* bss idx & omac idx should be set to band idx for ibf cal */
@@ -2316,5 +2317,5 @@
  	if (td->ibf) {
  		if (td->is_txbf_dut) {
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0091-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0079-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch
similarity index 90%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0091-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0079-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch
index 8dcbc38..f88fbcf 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0091-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0079-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch
@@ -1,27 +1,28 @@
-From bb417654387169098f02664031be303d1f1a7f16 Mon Sep 17 00:00:00 2001
+From ca4c360d853ec0678da7b08c9b524334b931eeda Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 27 Nov 2023 10:43:34 +0800
-Subject: [PATCH 091/199] mtk: mt76: mt7996: switch to per-link data structure
+Subject: [PATCH 079/223] mtk: mt76: mt7996: switch to per-link data structure
  of sta
 
 Introduce struct mt7996_link_sta, data structure for per-link STA.
 Note that mt7996_sta now represents a peer legacy or MLD device.
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
+Change-Id: I3929a2e3d1bd092581175f60fb900690f22b57d6
 Co-developed-by: Bo Jiao <Bo.Jiao@mediatek.com>
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mt7996/debugfs.c  |  20 ++-
  mt7996/mac.c      | 109 ++++++------
- mt7996/main.c     | 223 +++++++++++++++---------
+ mt7996/main.c     | 220 +++++++++++++++---------
  mt7996/mcu.c      | 430 ++++++++++++++++++++++++----------------------
  mt7996/mt7996.h   |  44 +++--
  mt7996/testmode.c |   6 +-
- 6 files changed, 461 insertions(+), 371 deletions(-)
+ 6 files changed, 461 insertions(+), 368 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 5d4d69ea..62658dbc 100644
+index 792ace03..786bdc38 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -726,14 +726,15 @@ static void
@@ -96,7 +97,7 @@
  	phy.ltf = cpu_to_le16(ltf);
  	phy.ldpc = phy.ldpc ? 7 : 0;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 5fbcfc74..fbe6c0bd 100644
+index 8f743125..8b682842 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -54,7 +54,7 @@ static const struct mt7996_dfs_radar_spec jp_radar_specs = {
@@ -161,7 +162,7 @@
  				      &dev->mt76.sta_poll_list);
  		spin_unlock_bh(&dev->mt76.sta_poll_lock);
  	}
-@@ -586,7 +585,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
+@@ -588,7 +587,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
  #endif
  	} else {
  		status->flag |= RX_FLAG_8023;
@@ -170,7 +171,7 @@
  				     *info);
  	}
  
-@@ -945,6 +944,7 @@ static void
+@@ -957,6 +956,7 @@ static void
  mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
  {
  	struct mt7996_sta *msta;
@@ -178,7 +179,7 @@
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  	bool is_8023 = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP;
  	u16 fc, tid;
-@@ -973,7 +973,8 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
+@@ -985,7 +985,8 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
  		return;
  
  	msta = (struct mt7996_sta *)sta->drv_priv;
@@ -188,7 +189,7 @@
  		ieee80211_start_tx_ba_session(sta, tid, 0);
  }
  
-@@ -1051,7 +1052,7 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+@@ -1063,7 +1064,7 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
  		 */
  		info = le32_to_cpu(*cur_info);
  		if (info & MT_TXFREE_INFO_PAIR) {
@@ -197,7 +198,7 @@
  			u16 idx;
  
  			idx = FIELD_GET(MT_TXFREE_INFO_WLAN_ID, info);
-@@ -1060,10 +1061,10 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+@@ -1072,10 +1073,10 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
  			if (!sta)
  				continue;
  
@@ -211,7 +212,7 @@
  					      &mdev->sta_poll_list);
  			spin_unlock_bh(&mdev->sta_poll_lock);
  			continue;
-@@ -1268,7 +1269,7 @@ out:
+@@ -1280,7 +1281,7 @@ out:
  
  static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
  {
@@ -220,7 +221,7 @@
  	struct mt76_wcid *wcid;
  	__le32 *txs_data = data;
  	u16 wcidx;
-@@ -1289,16 +1290,15 @@ static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
+@@ -1301,16 +1302,15 @@ static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
  	if (!wcid)
  		goto out;
  
@@ -240,7 +241,7 @@
  	spin_unlock_bh(&dev->mt76.sta_poll_lock);
  
  out:
-@@ -2242,8 +2242,9 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+@@ -2254,8 +2254,9 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  	struct ieee80211_sta *sta;
  	struct ieee80211_vif *vif;
  	struct ieee80211_bss_conf *conf;
@@ -251,7 +252,7 @@
  	u32 changed;
  	LIST_HEAD(list);
  
-@@ -2251,24 +2252,25 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+@@ -2263,24 +2264,25 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  	list_splice_init(&dev->sta_rc_list, &list);
  
  	while (!list_empty(&list)) {
@@ -286,7 +287,7 @@
  						   RATE_PARAM_MMPS_UPDATE);
  
  		spin_lock_bh(&dev->mt76.sta_poll_lock);
-@@ -2561,7 +2563,7 @@ static int mt7996_mac_check_twt_req(struct ieee80211_twt_setup *twt)
+@@ -2573,7 +2575,7 @@ static int mt7996_mac_check_twt_req(struct ieee80211_twt_setup *twt)
  }
  
  static bool
@@ -295,7 +296,7 @@
  			   struct ieee80211_twt_params *twt_agrt)
  {
  	u16 type = le16_to_cpu(twt_agrt->req_type);
-@@ -2572,10 +2574,10 @@ mt7996_mac_twt_param_equal(struct mt7996_sta *msta,
+@@ -2584,10 +2586,10 @@ mt7996_mac_twt_param_equal(struct mt7996_sta *msta,
  	for (i = 0; i < MT7996_MAX_STA_TWT_AGRT; i++) {
  		struct mt7996_twt_flow *f;
  
@@ -308,7 +309,7 @@
  		if (f->duration == twt_agrt->min_twt_dur &&
  		    f->mantissa == twt_agrt->mantissa &&
  		    f->exp == exp &&
-@@ -2594,6 +2596,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+@@ -2606,6 +2608,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  {
  	enum ieee80211_twt_setup_cmd setup_cmd = TWT_SETUP_CMD_REJECT;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
@@ -316,7 +317,7 @@
  	struct ieee80211_twt_params *twt_agrt = (void *)twt->params;
  	u16 req_type = le16_to_cpu(twt_agrt->req_type);
  	enum ieee80211_twt_setup_cmd sta_setup_cmd;
-@@ -2605,11 +2608,12 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+@@ -2617,11 +2620,12 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  		goto out;
  
  	mutex_lock(&dev->mt76.mutex);
@@ -330,7 +331,7 @@
  		goto unlock;
  
  	if (twt_agrt->min_twt_dur < MT7996_MIN_TWT_DUR) {
-@@ -2618,10 +2622,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+@@ -2630,10 +2634,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  		goto unlock;
  	}
  
@@ -343,7 +344,7 @@
  	twt_agrt->req_type &= ~cpu_to_le16(IEEE80211_TWT_REQTYPE_FLOWID);
  	twt_agrt->req_type |= le16_encode_bits(flowid,
  					       IEEE80211_TWT_REQTYPE_FLOWID);
-@@ -2630,10 +2634,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+@@ -2642,10 +2646,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  	exp = FIELD_GET(IEEE80211_TWT_REQTYPE_WAKE_INT_EXP, req_type);
  	sta_setup_cmd = FIELD_GET(IEEE80211_TWT_REQTYPE_SETUP_CMD, req_type);
  
@@ -356,7 +357,7 @@
  	flow->table_id = table_id;
  	flow->id = flowid;
  	flow->duration = twt_agrt->min_twt_dur;
-@@ -2651,7 +2655,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+@@ -2663,7 +2667,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  
  		flow->sched = true;
  		flow->start_tsf = mt7996_mac_twt_sched_list_add(dev, flow);
@@ -365,7 +366,7 @@
  		div_u64_rem(curr_tsf - flow->start_tsf, interval, &rem);
  		flow_tsf = curr_tsf + interval - rem;
  		twt_agrt->twt = cpu_to_le64(flow_tsf);
-@@ -2660,13 +2664,13 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+@@ -2672,13 +2676,13 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  	}
  	flow->tsf = le64_to_cpu(twt_agrt->twt);
  
@@ -381,7 +382,7 @@
  	dev->twt.n_agrt++;
  
  unlock:
-@@ -2679,26 +2683,25 @@ out:
+@@ -2691,26 +2695,25 @@ out:
  }
  
  void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
@@ -414,7 +415,7 @@
  	dev->twt.table_mask &= ~BIT(flow->table_id);
  	dev->twt.n_agrt--;
  }
-@@ -2711,7 +2714,7 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
+@@ -2723,7 +2726,7 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
  	struct cfg80211_scan_request *req = phy->scan_req;
  	struct ieee80211_vif *vif = phy->scan_vif;
  	struct mt7996_vif *mvif;
@@ -423,7 +424,7 @@
  	struct ieee80211_tx_info *info;
  	struct sk_buff *skb;
  
-@@ -2719,7 +2722,6 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
+@@ -2731,7 +2734,6 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
  		return;
  
  	mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -431,7 +432,7 @@
  
  	skb = ieee80211_probereq_get(hw, vif->addr,
  				     ssid->ssid, ssid->ssid_len, req->ie_len);
-@@ -2752,7 +2754,8 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
+@@ -2764,7 +2766,8 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
  	}
  
  	local_bh_disable();
@@ -442,7 +443,7 @@
  
  	rcu_read_unlock();
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 8a32ec69..e071c5fa 100644
+index 8d919dd0..98afb057 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -229,6 +229,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
@@ -537,7 +538,7 @@
  
  	mutex_unlock(&dev->mt76.mutex);
  }
-@@ -451,10 +455,10 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+@@ -445,10 +449,10 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_sta *msta = sta ? (struct mt7996_sta *)sta->drv_priv :
  				  &mvif->sta;
@@ -550,7 +551,7 @@
  	int idx = key->keyidx;
  	int err = 0;
  
-@@ -468,6 +472,12 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+@@ -462,6 +466,12 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
  	    !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
  		return -EOPNOTSUPP;
  
@@ -563,7 +564,7 @@
  	/* fall back to sw encryption for unsupported ciphers */
  	switch (key->cipher) {
  	case WLAN_CIPHER_SUITE_TKIP:
-@@ -490,16 +500,13 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+@@ -484,16 +494,13 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
  	case WLAN_CIPHER_SUITE_WEP40:
  	case WLAN_CIPHER_SUITE_WEP104:
  	default:
@@ -582,7 +583,7 @@
  	}
  
  	if (cmd == SET_KEY) {
-@@ -510,14 +517,14 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+@@ -504,14 +511,14 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
  		goto out;
  	}
  
@@ -600,7 +601,7 @@
  out:
  	mutex_unlock(&dev->mt76.mutex);
  
-@@ -720,25 +727,27 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+@@ -714,25 +721,27 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
  {
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_bss_conf *mconf;
@@ -631,7 +632,7 @@
  
  	if (changed & BSS_CHANGED_ERP_SLOT) {
  		int slottime = info->use_short_slot ? 9 : 20;
-@@ -809,6 +818,7 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -803,6 +812,7 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_bss_conf *mconf = mconf_dereference_protected(mvif, 0);
@@ -639,7 +640,7 @@
  	u8 band_idx = mconf->phy->mt76->band_idx;
  	int idx;
  
-@@ -820,13 +830,16 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -814,13 +824,16 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (idx < 0)
  		return -ENOSPC;
  
@@ -662,7 +663,7 @@
  
  #ifdef CONFIG_MTK_VENDOR
  	mt7996_vendor_amnt_sta_remove(mconf->phy, sta);
-@@ -859,19 +872,25 @@ void mt7996_mac_sta_assoc(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -853,7 +866,9 @@ int mt7996_mac_sta_event(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
  	struct mt7996_bss_conf *mconf;
@@ -672,29 +673,28 @@
  
  	mutex_lock(&dev->mt76.mutex);
  
--	mt7996_mac_wtbl_update(dev, msta->wcid.idx,
--			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
--
- 	conf = link_conf_dereference_protected(vif, 0);
- 	mconf = mconf_dereference_protected(mvif, 0);
--	mt7996_mcu_add_sta(dev, conf, mconf, sta, true, true);
--	mt7996_mcu_add_rate_ctrl(dev, conf, mconf, sta, false);
-+	link_sta = link_sta_dereference_protected(sta, 0);
-+	mlink = mlink_dereference_protected(msta, 0);
+@@ -863,10 +878,17 @@ int mt7996_mac_sta_event(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  
--	ewma_avg_signal_init(&msta->avg_ack_signal);
-+	mt7996_mac_wtbl_update(dev, mlink->wcid.idx,
-+			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
+ 		conf = link_conf_dereference_protected(vif, 0);
+ 		mconf = mconf_dereference_protected(mvif, 0);
+-		mt7996_mcu_add_sta(dev, conf, mconf, sta, true, true);
+-		mt7996_mcu_add_rate_ctrl(dev, conf, mconf, sta, false);
++		link_sta = link_sta_dereference_protected(sta, 0);
++		mlink = mlink_dereference_protected(msta, 0);
 +
-+	mt7996_mcu_add_sta(dev, conf, mconf, link_sta, mlink, true, true);
-+	mt7996_mcu_add_rate_ctrl(dev, conf, mconf, link_sta, mlink, false);
-+	mlink->wcid.tx_info |= MT_WCID_TX_INFO_SET;
++		mt7996_mac_wtbl_update(dev, mlink->wcid.idx,
++				       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
+ 
+-		ewma_avg_signal_init(&msta->avg_ack_signal);
++		mt7996_mcu_add_sta(dev, conf, mconf, link_sta, mlink, true, true);
++		mt7996_mcu_add_rate_ctrl(dev, conf, mconf, link_sta, mlink, false);
++		mlink->wcid.tx_info |= MT_WCID_TX_INFO_SET;
 +
-+	ewma_avg_signal_init(&mlink->avg_ack_signal);
++		ewma_avg_signal_init(&mlink->avg_ack_signal);
+ 	}
  
  	mutex_unlock(&dev->mt76.mutex);
- }
-@@ -883,25 +902,31 @@ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -879,25 +901,31 @@ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
  	struct mt7996_bss_conf *mconf;
@@ -734,7 +734,7 @@
  }
  
  static void mt7996_tx(struct ieee80211_hw *hw,
-@@ -913,19 +938,22 @@ static void mt7996_tx(struct ieee80211_hw *hw,
+@@ -909,19 +937,22 @@ static void mt7996_tx(struct ieee80211_hw *hw,
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  	struct ieee80211_vif *vif = info->control.vif;
  	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
@@ -761,7 +761,7 @@
  	}
  
  	mt76_tx(mphy, control->sta, wcid, skb);
-@@ -952,6 +980,7 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -948,6 +979,7 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	struct ieee80211_sta *sta = params->sta;
  	struct ieee80211_txq *txq = sta->txq[params->tid];
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
@@ -769,7 +769,7 @@
  	u16 tid = params->tid;
  	u16 ssn = params->ssn;
  	struct mt76_txq *mtxq;
-@@ -963,14 +992,15 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -959,14 +991,15 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	mtxq = (struct mt76_txq *)txq->drv_priv;
  
  	mutex_lock(&dev->mt76.mutex);
@@ -787,7 +787,7 @@
  		ret = mt7996_mcu_add_rx_ba(dev, params, false);
  		break;
  	case IEEE80211_AMPDU_TX_OPERATIONAL:
-@@ -981,16 +1011,16 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -977,16 +1010,16 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	case IEEE80211_AMPDU_TX_STOP_FLUSH:
  	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
  		mtxq->aggr = false;
@@ -807,7 +807,7 @@
  		ret = mt7996_mcu_add_tx_ba(dev, params, false);
  		ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
  		break;
-@@ -1169,10 +1199,19 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
+@@ -1165,10 +1198,19 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
  				  struct ieee80211_sta *sta,
  				  struct station_info *sinfo)
  {
@@ -817,18 +817,18 @@
 -	struct rate_info *txrate = &msta->wcid.rate;
 +	struct mt7996_link_sta *mlink;
 +	struct rate_info *txrate;
- 
++
 +	/* TODO: support per-link rate report */
 +	mutex_lock(&dev->mt76.mutex);
 +	mlink = mlink_dereference_protected(msta, 0);
 +	if (!mlink)
 +		goto out;
-+
+ 
 +	txrate = &mlink->wcid.rate;
  	if (txrate->legacy || txrate->flags) {
  		if (txrate->legacy) {
  			sinfo->txrate.legacy = txrate->legacy;
-@@ -1191,44 +1230,52 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
+@@ -1187,44 +1229,52 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
  	sinfo->txrate.flags = txrate->flags;
  	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
  
@@ -892,7 +892,7 @@
  }
  
  static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
-@@ -1242,7 +1289,7 @@ static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
+@@ -1238,7 +1288,7 @@ static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
  
  	if (!msta->vif) {
  		dev_warn(dev->mt76.dev, "Un-initialized STA %pM wcid %d in rc_work\n",
@@ -901,7 +901,7 @@
  		return;
  	}
  
-@@ -1288,16 +1335,18 @@ static void mt7996_sta_set_4addr(struct ieee80211_hw *hw,
+@@ -1284,16 +1334,18 @@ static void mt7996_sta_set_4addr(struct ieee80211_hw *hw,
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
  	struct mt7996_bss_conf *mconf;
@@ -923,7 +923,7 @@
  	mutex_unlock(&dev->mt76.mutex);
  }
  
-@@ -1310,16 +1359,18 @@ static void mt7996_sta_set_decap_offload(struct ieee80211_hw *hw,
+@@ -1306,16 +1358,18 @@ static void mt7996_sta_set_decap_offload(struct ieee80211_hw *hw,
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
  	struct mt7996_bss_conf *mconf;
@@ -945,7 +945,7 @@
  	mutex_unlock(&dev->mt76.mutex);
  }
  
-@@ -1452,11 +1503,12 @@ static void mt7996_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
+@@ -1448,11 +1502,12 @@ static void mt7996_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
  {
  	struct mt76_ethtool_worker_info *wi = wi_data;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
@@ -959,7 +959,7 @@
  }
  
  static
-@@ -1559,10 +1611,12 @@ mt7996_twt_teardown_request(struct ieee80211_hw *hw,
+@@ -1555,10 +1610,12 @@ mt7996_twt_teardown_request(struct ieee80211_hw *hw,
  			    u8 flowid)
  {
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
@@ -973,7 +973,7 @@
  	mutex_unlock(&dev->mt76.mutex);
  }
  
-@@ -1685,6 +1739,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1681,6 +1738,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_bss_conf *mconf = &mvif->deflink;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
@@ -981,7 +981,7 @@
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
-@@ -1707,7 +1762,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1703,7 +1761,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
  
@@ -990,7 +990,7 @@
  		return -EIO;
  
  	path->type = DEV_PATH_MTK_WDMA;
-@@ -1715,11 +1770,11 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1711,11 +1769,11 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
  	path->mtk_wdma.bss = mconf->mt76.idx;
  	path->mtk_wdma.queue = 0;
@@ -1005,10 +1005,10 @@
  		path->mtk_wdma.amsdu = 0;
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 1e0fca2d..20b84c93 100644
+index b2eed253..ced769b4 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -117,13 +117,13 @@ mt7996_mcu_get_sta_nss(u16 mcs_map)
+@@ -122,13 +122,13 @@ mt7996_mcu_get_sta_nss(u16 mcs_map)
  }
  
  static void
@@ -1024,7 +1024,7 @@
  
  	for (nss = 0; nss < max_nss; nss++) {
  		int mcs;
-@@ -166,11 +166,11 @@ mt7996_mcu_set_sta_he_mcs(struct ieee80211_sta *sta,
+@@ -171,11 +171,11 @@ mt7996_mcu_set_sta_he_mcs(struct ieee80211_sta *sta,
  }
  
  static void
@@ -1040,7 +1040,7 @@
  
  	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
  		switch (mcs_map & 0x3) {
-@@ -192,13 +192,13 @@ mt7996_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
+@@ -197,13 +197,13 @@ mt7996_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
  }
  
  static void
@@ -1057,7 +1057,7 @@
  }
  
  static int
-@@ -531,14 +531,14 @@ static inline void __mt7996_stat_to_netdev(struct mt76_phy *mphy,
+@@ -536,14 +536,14 @@ static inline void __mt7996_stat_to_netdev(struct mt76_phy *mphy,
  					   u32 tx_bytes, u32 rx_bytes,
  					   u32 tx_packets, u32 rx_packets)
  {
@@ -1075,7 +1075,7 @@
  				   drv_priv);
  		wdev = ieee80211_vif_to_wdev(vif);
  
-@@ -1236,10 +1236,10 @@ __mt7996_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
+@@ -1241,10 +1241,10 @@ __mt7996_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
  
  int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
  			    struct ieee80211_bss_conf *conf,
@@ -1088,7 +1088,7 @@
  	struct mt7996_dev *dev = phy->dev;
  	struct sk_buff *skb;
  
-@@ -1255,7 +1255,7 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
+@@ -1260,7 +1260,7 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
  
  	/* bss_basic must be first */
  	mt7996_mcu_bss_basic_tlv(skb, conf, mconf, NULL, phy->mt76,
@@ -1097,7 +1097,7 @@
  	mt7996_mcu_bss_sec_tlv(skb, mconf);
  
  	if (vif->type == NL80211_IFTYPE_MONITOR)
-@@ -1335,9 +1335,10 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
+@@ -1340,9 +1340,10 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  {
  	struct mt7996_sta *msta = (struct mt7996_sta *)params->sta->drv_priv;
  	struct mt7996_bss_conf *mconf = mconf_dereference_protected(msta->vif, 0);
@@ -1109,7 +1109,7 @@
  
  	return mt7996_mcu_sta_ba(dev, &mconf->mt76, params, enable, true);
  }
-@@ -1355,15 +1356,15 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
+@@ -1360,15 +1361,15 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
  static void
  mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
  		      struct mt7996_bss_conf *mconf,
@@ -1128,7 +1128,7 @@
  		return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_V2, sizeof(*he));
-@@ -1380,21 +1381,21 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
+@@ -1385,21 +1386,21 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
  		u8p_replace_bits(&he->he_phy_cap[1], conf->he_ldpc,
  				 IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD);
  
@@ -1155,7 +1155,7 @@
  					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
  					  le16_to_cpu(mcs_map.rx_mcs_80));
  		break;
-@@ -1404,24 +1405,25 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
+@@ -1409,24 +1410,25 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
  }
  
  static void
@@ -1186,7 +1186,7 @@
  	struct ieee80211_vif *vif = container_of((void *)msta->vif,
  						 struct ieee80211_vif, drv_priv);
  	struct ieee80211_eht_mcs_nss_supp *mcs_map;
-@@ -1429,11 +1431,11 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1434,11 +1436,11 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct sta_rec_eht *eht;
  	struct tlv *tlv;
  
@@ -1201,7 +1201,7 @@
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT, sizeof(*eht));
  
-@@ -1444,7 +1446,7 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1449,7 +1451,7 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
  
  	if (vif->type != NL80211_IFTYPE_STATION &&
@@ -1210,7 +1210,7 @@
  	     (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G |
  	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
  	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
-@@ -1460,44 +1462,44 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1465,44 +1467,44 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  }
  
  static void
@@ -1266,7 +1266,7 @@
  #ifdef CONFIG_MTK_VENDOR
  	vht->rts_bw_sig = phy->rts_bw_sig;
  #endif
-@@ -1505,9 +1507,10 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1510,9 +1512,10 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  
  static void
  mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
@@ -1279,7 +1279,7 @@
  	struct sta_rec_amsdu *amsdu;
  	struct tlv *tlv;
  
-@@ -1516,16 +1519,16 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1521,16 +1524,16 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	    vif->type != NL80211_IFTYPE_AP)
  		return;
  
@@ -1299,7 +1299,7 @@
  	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
  		amsdu->max_mpdu_size =
  			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
-@@ -1544,10 +1547,10 @@ static void
+@@ -1549,10 +1552,10 @@ static void
  mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  			struct ieee80211_bss_conf *conf,
  			struct mt7996_bss_conf *mconf,
@@ -1312,7 +1312,7 @@
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
  
-@@ -1567,11 +1570,11 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1572,11 +1575,11 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	muru->cfg.ofdma_dl_en = !!(phy->muru_onoff & OFDMA_DL);
  	muru->cfg.ofdma_ul_en = !!(phy->muru_onoff & OFDMA_UL);
  
@@ -1327,7 +1327,7 @@
  		return;
  
  	muru->mimo_dl.partial_bw_dl_mimo =
-@@ -1604,7 +1607,7 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1609,7 +1612,7 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  static inline bool
  mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
  			struct mt7996_bss_conf *mconf,
@@ -1336,7 +1336,7 @@
  {
  	int sts = hweight16(phy->mt76->chainmask);
  
-@@ -1615,8 +1618,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
+@@ -1620,8 +1623,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
  	if (!bfee && sts < 2)
  		return false;
  
@@ -1347,7 +1347,7 @@
  		struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
  
  		if (bfee)
-@@ -1627,8 +1630,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
+@@ -1632,8 +1635,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
  			       EHT_PHY(CAP0_SU_BEAMFORMEE, pe->phy_cap_info[0]);
  	}
  
@@ -1358,7 +1358,7 @@
  
  		if (bfee)
  			return conf->he_su_beamformee &&
-@@ -1638,8 +1641,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
+@@ -1643,8 +1646,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
  			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
  	}
  
@@ -1369,7 +1369,7 @@
  
  		if (bfee)
  			return conf->vht_su_beamformee &&
-@@ -1662,10 +1665,10 @@ mt7996_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
+@@ -1667,10 +1670,10 @@ mt7996_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
  }
  
  static void
@@ -1383,7 +1383,7 @@
  	u8 n = 0;
  
  	bf->tx_mode = MT_PHY_TYPE_HT;
-@@ -1687,10 +1690,11 @@ mt7996_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
+@@ -1692,10 +1695,11 @@ mt7996_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
  }
  
  static void
@@ -1398,7 +1398,7 @@
  	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
  	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
  	u8 nss_mcs = mt7996_mcu_get_sta_nss(mcs_map);
-@@ -1711,23 +1715,24 @@ mt7996_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
+@@ -1716,23 +1720,24 @@ mt7996_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
  		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  		bf->ibf_ncol = bf->ncol;
  
@@ -1428,7 +1428,7 @@
  	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
  	const struct ieee80211_sta_he_cap *vc =
  		mt76_connac_get_he_phy_cap(phy->mt76, vif);
-@@ -1752,7 +1757,7 @@ mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+@@ -1757,7 +1762,7 @@ mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  	bf->ibf_ncol = bf->ncol;
  
@@ -1437,7 +1437,7 @@
  		return;
  
  	/* go over for 160MHz and 80p80 */
-@@ -1784,10 +1789,11 @@ mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+@@ -1789,10 +1794,11 @@ mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  }
  
  static void
@@ -1452,7 +1452,7 @@
  	struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
  	struct ieee80211_eht_mcs_nss_supp *eht_nss = &pc->eht_mcs_nss_supp;
  	const struct ieee80211_sta_eht_cap *vc =
-@@ -1810,10 +1816,10 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+@@ -1815,10 +1821,10 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  	bf->ibf_ncol = bf->ncol;
  
@@ -1465,7 +1465,7 @@
  	case IEEE80211_STA_RX_BW_160:
  		snd_dim = EHT_PHY(CAP2_SOUNDING_DIM_160MHZ_MASK, ve->phy_cap_info[2]);
  		sts = EHT_PHY(CAP1_BEAMFORMEE_SS_160MHZ_MASK, pe->phy_cap_info[1]);
-@@ -1842,7 +1848,7 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+@@ -1847,7 +1853,7 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  static void
  mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  			struct ieee80211_bss_conf *conf, struct mt7996_bss_conf *mconf,
@@ -1474,7 +1474,7 @@
  {
  	struct mt7996_phy *phy = mconf->phy;
  	int tx_ant = hweight16(phy->mt76->chainmask) - 1;
-@@ -1856,10 +1862,10 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1861,10 +1867,10 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	};
  	bool ebf;
  
@@ -1487,7 +1487,7 @@
  	if (!ebf && !dev->ibf)
  		return;
  
-@@ -1870,23 +1876,23 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1875,23 +1881,23 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	 * vht: support eBF and iBF
  	 * ht: iBF only, since mac80211 lacks of eBF support
  	 */
@@ -1522,7 +1522,7 @@
  		bf->ibf_timeout = 0x48;
  	else
  		bf->ibf_timeout = 0x18;
-@@ -1896,7 +1902,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1901,7 +1907,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	else
  		bf->mem_20m = matrix[bf->nrow][bf->ncol];
  
@@ -1531,7 +1531,7 @@
  	case IEEE80211_STA_RX_BW_160:
  	case IEEE80211_STA_RX_BW_80:
  		bf->mem_total = bf->mem_20m * 2;
-@@ -1913,7 +1919,8 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1918,7 +1924,8 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  static void
  mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  			struct ieee80211_bss_conf *conf,
@@ -1541,7 +1541,7 @@
  {
  	struct mt7996_phy *phy = mconf->phy;
  	int tx_ant = hweight8(phy->mt76->antenna_mask) - 1;
-@@ -1921,22 +1928,22 @@ mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1926,22 +1933,22 @@ mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
  	u8 nrow = 0;
  
@@ -1570,7 +1570,7 @@
  
  		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
  				 pc->cap);
-@@ -1973,25 +1980,24 @@ mt7996_mcu_sta_hdrt_tlv(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -1978,25 +1985,24 @@ mt7996_mcu_sta_hdrt_tlv(struct mt7996_dev *dev, struct sk_buff *skb)
  static void
  mt7996_mcu_sta_hdr_trans_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  			     struct ieee80211_vif *vif,
@@ -1601,7 +1601,7 @@
  	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
  	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
  		hdr_trans->to_ds = true;
-@@ -2048,16 +2054,17 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
+@@ -2053,16 +2059,17 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
  
  int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
  			       struct mt7996_bss_conf *mconf,
@@ -1622,7 +1622,7 @@
  					      MT7996_STA_UPDATE_MAX_SIZE);
  	if (IS_ERR(skb))
  		return PTR_ERR(skb);
-@@ -2076,7 +2083,7 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
+@@ -2081,7 +2088,7 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
  			ra->phy = *phy;
  		break;
  	case RATE_PARAM_MMPS_UPDATE:
@@ -1631,7 +1631,7 @@
  		break;
  	default:
  		break;
-@@ -2091,7 +2098,8 @@ static int
+@@ -2096,7 +2103,8 @@ static int
  mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
  			       struct ieee80211_bss_conf *conf,
  			       struct mt7996_bss_conf *mconf,
@@ -1641,7 +1641,7 @@
  {
  	struct cfg80211_chan_def *chandef = &mconf->phy->mt76->chandef;
  	struct cfg80211_bitrate_mask *mask = &mconf->bitrate_mask;
-@@ -2115,11 +2123,11 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
+@@ -2120,11 +2128,11 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
  		}								\
  	} while (0)
  
@@ -1656,7 +1656,7 @@
  		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
  	} else {
  		nrates = hweight32(mask->control[band].legacy);
-@@ -2136,8 +2144,8 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
+@@ -2141,8 +2149,8 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
  
  	/* fixed single rate */
  	if (nrates == 1) {
@@ -1667,7 +1667,7 @@
  		if (ret)
  			return ret;
  	}
-@@ -2145,29 +2153,28 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
+@@ -2150,29 +2158,28 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
  	/* fixed GI */
  	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
  	    mask->control[band].he_gi != GENMASK(7, 0)) {
@@ -1703,7 +1703,7 @@
  		if (ret)
  			return ret;
  	}
-@@ -2179,7 +2186,7 @@ static void
+@@ -2184,7 +2191,7 @@ static void
  mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  			     struct ieee80211_bss_conf *conf,
  			     struct mt7996_bss_conf *mconf,
@@ -1712,7 +1712,7 @@
  {
  #define INIT_RCPI 180
  	struct mt76_phy *mphy = mconf->phy->mt76;
-@@ -2188,20 +2195,20 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+@@ -2193,20 +2200,20 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  	enum nl80211_band band = chandef->chan->band;
  	struct sta_rec_ra_uni *ra;
  	struct tlv *tlv;
@@ -1739,7 +1739,7 @@
  
  	if (supp_rate) {
  		supp_rate &= mask->control[band].legacy;
-@@ -2221,60 +2228,60 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+@@ -2226,60 +2233,60 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  		}
  	}
  
@@ -1820,7 +1820,7 @@
  					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
  	}
  	ra->sta_cap = cpu_to_le32(cap);
-@@ -2285,14 +2292,14 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+@@ -2290,14 +2297,14 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  			     struct ieee80211_bss_conf *conf,
  			     struct mt7996_bss_conf *mconf,
@@ -1838,7 +1838,7 @@
  					      MT7996_STA_UPDATE_MAX_SIZE);
  	if (IS_ERR(skb))
  		return PTR_ERR(skb);
-@@ -2302,26 +2309,27 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+@@ -2307,26 +2314,27 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  	 * update sta_rec_he here.
  	 */
  	if (changed)
@@ -1871,7 +1871,7 @@
  	u8 omac_idx = mconf->mt76.omac_idx;
  	int ret;
  
-@@ -2339,33 +2347,28 @@ mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf, struct mt7996_sta *msta)
+@@ -2344,34 +2352,29 @@ mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf, struct mt7996_sta *msta)
  	vow->drr_quantum[IEEE80211_AC_BE] = VOW_DRR_QUANTUM_IDX2;
  	vow->drr_quantum[IEEE80211_AC_BK] = VOW_DRR_QUANTUM_IDX2;
  
@@ -1901,6 +1901,7 @@
 -	struct ieee80211_link_sta *link_sta;
 -	struct mt7996_sta *msta;
  	struct sk_buff *skb;
+ 	int conn_state;
  	int ret;
  
 -	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mvif->sta;
@@ -1912,7 +1913,7 @@
  					      MT7996_STA_UPDATE_MAX_SIZE);
  	if (IS_ERR(skb))
  		return PTR_ERR(skb);
-@@ -2378,37 +2381,37 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+@@ -2385,37 +2388,37 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  		goto out;
  
  	/* starec hdr trans */
@@ -1963,7 +1964,7 @@
  	if (ret) {
  		dev_kfree_skb(skb);
  		return ret;
-@@ -2484,16 +2487,16 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
+@@ -2491,16 +2494,16 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
  
  static int mt7996_mcu_get_pn(struct mt7996_dev *dev,
  			     struct ieee80211_bss_conf *conf,
@@ -1983,7 +1984,7 @@
  	if (IS_ERR(skb))
  		return PTR_ERR(skb);
  
-@@ -2520,6 +2523,7 @@ static int mt7996_mcu_get_pn(struct mt7996_dev *dev,
+@@ -2527,6 +2530,7 @@ static int mt7996_mcu_get_pn(struct mt7996_dev *dev,
  int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
  			       struct ieee80211_bss_conf *conf,
  			       struct mt7996_bss_conf *mconf,
@@ -1991,7 +1992,7 @@
  			       struct ieee80211_key_conf *key)
  {
  	struct mt7996_mcu_bcn_prot_tlv *bcn_prot;
-@@ -2538,7 +2542,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
+@@ -2545,7 +2549,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
  
  	bcn_prot = (struct mt7996_mcu_bcn_prot_tlv *)tlv;
  
@@ -2000,7 +2001,7 @@
  	if (ret) {
  		dev_kfree_skb(skb);
  		return ret;
-@@ -4814,21 +4818,18 @@ int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev, bool disable
+@@ -4840,21 +4844,18 @@ int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev, bool disable
  int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
  				     struct ieee80211_vif *vif,
  				     struct mt7996_bss_conf *mconf,
@@ -2025,7 +2026,7 @@
  	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
  				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
  }
-@@ -5017,7 +5018,7 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
+@@ -5043,7 +5044,7 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
  	switch (tag) {
  	case UNI_PER_STA_RSSI:
  		for (i = 0; i < sta_num; ++i) {
@@ -2034,7 +2035,7 @@
  			struct mt76_phy *phy;
  			s8 rssi[4];
  			u8 *rcpi;
-@@ -5031,10 +5032,10 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
+@@ -5057,10 +5058,10 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
  				rssi[2] = to_rssi(MT_PRXV_RCPI0, rcpi[2]);
  				rssi[3] = to_rssi(MT_PRXV_RCPI0, rcpi[3]);
  
@@ -2049,7 +2050,7 @@
  			} else {
  				ret = -EINVAL;
  				dev_err(dev->dev, "Failed to update RSSI for "
-@@ -5056,7 +5057,7 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
+@@ -5082,7 +5083,7 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
  {
  	u16 sta_list[PER_STA_INFO_MAX_NUM];
  	LIST_HEAD(sta_poll_list);
@@ -2058,7 +2059,7 @@
  	int i, ret;
  	bool empty = false;
  
-@@ -5076,13 +5077,13 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
+@@ -5102,13 +5103,13 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
  				empty = true;
  				break;
  			}
@@ -2076,7 +2077,7 @@
  		}
  
  		ret = mt7996_mcu_get_per_sta_info(dev, UNI_PER_STA_RSSI,
-@@ -5372,10 +5373,18 @@ int mt7996_mcu_set_scs_stats(struct mt7996_phy *phy)
+@@ -5398,10 +5399,18 @@ int mt7996_mcu_set_scs_stats(struct mt7996_phy *phy)
  void mt7996_sta_rssi_work(void *data, struct ieee80211_sta *sta)
  {
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
@@ -2097,7 +2098,7 @@
  }
  
  void mt7996_mcu_scs_sta_poll(struct work_struct *work)
-@@ -5451,9 +5460,10 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
+@@ -5477,9 +5486,10 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
  
  int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
  				struct mt7996_bss_conf *mconf,
@@ -2110,7 +2111,7 @@
  	u32 val = 0;
  	struct {
  		u8 __rsv1[4];
-@@ -5475,11 +5485,11 @@ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
+@@ -5501,11 +5511,11 @@ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
  	} __packed req = {
  		.tag = cpu_to_le16(UNI_VOW_DRR_CTRL),
  		.len = cpu_to_le16(sizeof(req) - 4),
@@ -2126,10 +2127,10 @@
  
  	switch (id) {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 46964079..1732ff36 100644
+index be966c18..d86e24e3 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -303,10 +303,10 @@ struct mt7996_vow_sta_ctrl {
+@@ -304,10 +304,10 @@ struct mt7996_vow_sta_ctrl {
  	u8 drr_quantum[IEEE80211_NUM_ACS];
  };
  
@@ -2142,7 +2143,7 @@
  
  	struct list_head rc_list;
  
-@@ -325,6 +325,13 @@ struct mt7996_sta {
+@@ -326,6 +326,13 @@ struct mt7996_sta {
  	struct mt7996_vow_sta_ctrl vow;
  };
  
@@ -2156,7 +2157,7 @@
  struct mt7996_bss_conf {
  	struct mt76_vif mt76; /* must be first */
  
-@@ -784,6 +791,13 @@ mconf_dereference_protected(struct mt7996_vif *mvif, u8 link_id)
+@@ -788,6 +795,13 @@ mconf_dereference_protected(struct mt7996_vif *mvif, u8 link_id)
  					 lockdep_is_held(&mvif->dev->mt76.mutex));
  }
  
@@ -2170,7 +2171,7 @@
  extern const struct ieee80211_ops mt7996_ops;
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
-@@ -828,10 +842,12 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
+@@ -832,10 +846,12 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
  			    struct mt7996_bss_conf *mconf, bool enable);
  int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
  			    struct ieee80211_bss_conf *conf,
@@ -2186,7 +2187,7 @@
  int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  			 struct ieee80211_ampdu_params *params,
  			 bool add);
-@@ -853,7 +869,8 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy,
+@@ -857,7 +873,8 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy,
  int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  			     struct ieee80211_bss_conf *conf,
  			     struct mt7996_bss_conf *mconf,
@@ -2196,7 +2197,7 @@
  int mt7996_set_channel(struct mt7996_phy *phy, struct cfg80211_chan_def *chandef);
  int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag);
  int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct mt7996_bss_conf *mconf);
-@@ -861,7 +878,9 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
+@@ -865,7 +882,9 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
  				   void *data, u16 version);
  int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
  			       struct mt7996_bss_conf *mconf,
@@ -2205,9 +2206,9 @@
 +			       struct mt7996_link_sta *mlink, void *data,
 +			       u32 field);
  int mt7996_mcu_set_eeprom(struct mt7996_dev *dev);
- int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf);
+ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len);
  int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num);
-@@ -917,7 +936,8 @@ void mt7996_mcu_scs_sta_poll(struct work_struct *work);
+@@ -921,7 +940,8 @@ void mt7996_mcu_scs_sta_poll(struct work_struct *work);
  int mt7996_mcu_set_band_confg(struct mt7996_phy *phy, u16 option, bool enable);
  int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
  				struct mt7996_bss_conf *mconf,
@@ -2217,7 +2218,7 @@
  int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy);
  void mt7996_mcu_wmm_pbc_work(struct work_struct *work);
  
-@@ -984,7 +1004,7 @@ void mt7996_mac_reset_counters(struct mt7996_phy *phy);
+@@ -988,7 +1008,7 @@ void mt7996_mac_reset_counters(struct mt7996_phy *phy);
  void mt7996_mac_cca_stats_reset(struct mt7996_phy *phy);
  void mt7996_mac_enable_nf(struct mt7996_dev *dev, u8 band);
  void mt7996_mac_enable_rtscts(struct mt7996_dev *dev,
@@ -2226,7 +2227,7 @@
  void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
  			   struct sk_buff *skb, struct mt76_wcid *wcid,
  			   struct ieee80211_key_conf *key, int pid,
-@@ -1002,8 +1022,7 @@ void mt7996_mac_dump_work(struct work_struct *work);
+@@ -1006,8 +1026,7 @@ void mt7996_mac_dump_work(struct work_struct *work);
  void mt7996_mac_sta_rc_work(struct work_struct *work);
  void mt7996_mac_update_stats(struct mt7996_phy *phy);
  void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
@@ -2236,7 +2237,7 @@
  void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  			      struct ieee80211_sta *sta,
  			      struct ieee80211_twt_setup *twt);
-@@ -1032,11 +1051,12 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
+@@ -1036,11 +1055,12 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
  int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
  			       struct ieee80211_bss_conf *conf,
  			       struct mt7996_bss_conf *mconf,
@@ -2251,10 +2252,10 @@
  int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
  #ifdef CONFIG_MAC80211_DEBUGFS
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index bf55b430..ba17f947 100644
+index 042da4e4..be224373 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -235,8 +235,8 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
+@@ -241,8 +241,8 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
  
  	mt7996_tm_rf_switch_mode(dev, rf_test_mode);
  
@@ -2265,7 +2266,7 @@
  
  	mt7996_tm_set(dev, SET_ID(BAND_IDX), phy->mt76->band_idx);
  
-@@ -1186,7 +1186,7 @@ mt7996_tm_txbf_init(struct mt7996_phy *phy, u16 *val)
+@@ -1192,7 +1192,7 @@ mt7996_tm_txbf_init(struct mt7996_phy *phy, u16 *val)
  	phy->omac_mask |= BIT_ULL(mvif->deflink.mt76.omac_idx);
  
  	mt7996_mcu_add_dev_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, true);
@@ -2275,5 +2276,5 @@
  	if (td->ibf) {
  		if (td->is_txbf_dut) {
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0092-mtk-mt76-extend-wcid-and-sta-flow-for-MLO-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0080-mtk-mt76-extend-wcid-and-sta-flow-for-MLO-support.patch
similarity index 78%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0092-mtk-mt76-extend-wcid-and-sta-flow-for-MLO-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0080-mtk-mt76-extend-wcid-and-sta-flow-for-MLO-support.patch
index 5ca3404..1e46e08 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0092-mtk-mt76-extend-wcid-and-sta-flow-for-MLO-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0080-mtk-mt76-extend-wcid-and-sta-flow-for-MLO-support.patch
@@ -1,12 +1,13 @@
-From f9ceb3601873e92e296383b3f8f124cf7d84e6fe Mon Sep 17 00:00:00 2001
+From 9e98b6657ff1144c273e85a2b0b04c05c813443b Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 29 Nov 2023 11:04:50 +0800
-Subject: [PATCH 092/199] mtk: mt76: extend wcid and sta flow for MLO support
+Subject: [PATCH 080/223] mtk: mt76: extend wcid and sta flow for MLO support
 
 Add link related info to wcid, and split sta connection flow of common
 parts for MLO supported chipsets.
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
+Change-Id: Ibe6854ba471516ae64b94bed32c5e9ac1f5fc1c3
 Co-developed-by: Bo Jiao <Bo.Jiao@mediatek.com>
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -15,10 +16,10 @@
  1 file changed, 7 insertions(+), 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 032a13a5..49834afe 100644
+index cad85f19..ec73fe00 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1368,6 +1368,9 @@ mt76_sta_add(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1393,6 +1393,9 @@ mt76_sta_add(struct mt76_phy *phy, struct ieee80211_vif *vif,
  	if (ret)
  		goto out;
  
@@ -28,7 +29,7 @@
  	for (i = 0; i < ARRAY_SIZE(sta->txq); i++) {
  		struct mt76_txq *mtxq;
  
-@@ -1397,12 +1400,15 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
+@@ -1422,12 +1425,15 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
  	struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;
  	int i, idx = wcid->idx;
  
@@ -46,5 +47,5 @@
  
  	mt76_wcid_mask_clear(dev->wcid_mask, idx);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0093-mtk-mt76-mt7996-enable-MLO-capability.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0081-mtk-mt76-mt7996-enable-MLO-capability.patch
similarity index 92%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0093-mtk-mt76-mt7996-enable-MLO-capability.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0081-mtk-mt76-mt7996-enable-MLO-capability.patch
index ee007e2..ff5469a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0093-mtk-mt76-mt7996-enable-MLO-capability.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0081-mtk-mt76-mt7996-enable-MLO-capability.patch
@@ -1,7 +1,7 @@
-From 208cd15d45360f69c2811bed72b2715c83632b3b Mon Sep 17 00:00:00 2001
+From e58436183460b0f31ba597c8dba7b839101f494f Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 30 Nov 2023 16:31:17 +0800
-Subject: [PATCH 093/199] mtk: mt76: mt7996: enable MLO capability
+Subject: [PATCH 081/223] mtk: mt76: mt7996: enable MLO capability
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
@@ -12,10 +12,10 @@
  2 files changed, 42 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index c4714982..cd93a3c2 100644
+index f9bd4d91..8272ead2 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -390,6 +390,12 @@ static int mt7996_eeprom_parse_band_config(struct mt7996_phy *phy)
+@@ -422,6 +422,12 @@ static int mt7996_eeprom_parse_band_config(struct mt7996_phy *phy)
  		break;
  	}
  
@@ -29,7 +29,7 @@
  }
  
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 86bb0661..2fe869c9 100644
+index f5bff109..cedadefc 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -35,7 +35,7 @@ static const struct ieee80211_iface_combination if_comb[] = {
@@ -100,5 +100,5 @@
  
  static void
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0094-mtk-mt76-mt7996-support-multi-link-vif-links-and-MLO.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0082-mtk-mt76-mt7996-support-multi-link-vif-links-and-MLO.patch
similarity index 92%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0094-mtk-mt76-mt7996-support-multi-link-vif-links-and-MLO.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0082-mtk-mt76-mt7996-support-multi-link-vif-links-and-MLO.patch
index db2ebfa..7d6ed45 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0094-mtk-mt76-mt7996-support-multi-link-vif-links-and-MLO.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0082-mtk-mt76-mt7996-support-multi-link-vif-links-and-MLO.patch
@@ -1,7 +1,7 @@
-From db6f06e9685bd4297e87b10b6f2550b4430e3b0a Mon Sep 17 00:00:00 2001
+From 59199b2eabeb1d8ce11bf644c4ecd565a385c663 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 23 Nov 2023 18:22:11 +0800
-Subject: [PATCH 094/199] mtk: mt76: mt7996: support multi-link vif links and
+Subject: [PATCH 082/223] mtk: mt76: mt7996: support multi-link vif links and
  MLO bss callbacks
 
 Rework add/remove interface functions to add/remove bss_conf functions,
@@ -18,7 +18,7 @@
  3 files changed, 267 insertions(+), 66 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index e071c5fa..3abae2fe 100644
+index 98afb057..dc7ee54c 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -205,6 +205,38 @@ static int get_omac_idx(enum nl80211_iftype type, u64 mask)
@@ -284,7 +284,7 @@
  
  	mutex_unlock(&dev->mt76.mutex);
  }
-@@ -720,10 +821,31 @@ mt7996_update_mu_group(struct ieee80211_hw *hw, struct ieee80211_bss_conf *conf,
+@@ -714,10 +815,31 @@ mt7996_update_mu_group(struct ieee80211_hw *hw, struct ieee80211_bss_conf *conf,
  	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_POS3(band), mu[3]);
  }
  
@@ -320,7 +320,7 @@
  {
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_bss_conf *mconf;
-@@ -739,7 +861,6 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+@@ -733,7 +855,6 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
  	 * and then peer references bss_info_rfch to set bandwidth cap.
  	 */
  	if ((changed & BSS_CHANGED_BSSID && !is_zero_ether_addr(info->bssid)) ||
@@ -328,7 +328,7 @@
  	    (changed & BSS_CHANGED_BEACON_ENABLED && info->enable_beacon)) {
  		mt7996_mcu_add_bss_info(phy, info, mconf, mlink, true);
  		mt7996_mcu_add_sta(dev, info, mconf, NULL, mlink, true,
-@@ -1082,7 +1203,7 @@ mt7996_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+@@ -1081,7 +1202,7 @@ mt7996_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
  	u64 ret;
  
  	mutex_lock(&dev->mt76.mutex);
@@ -337,7 +337,7 @@
  	ret = __mt7996_get_tsf(hw, mconf);
  	mutex_unlock(&dev->mt76.mutex);
  
-@@ -1105,7 +1226,7 @@ mt7996_set_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1104,7 +1225,7 @@ mt7996_set_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  	mutex_lock(&dev->mt76.mutex);
  
@@ -346,7 +346,7 @@
  	n = mconf->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
  					       : mconf->mt76.omac_idx;
  	mt76_wr(dev, MT_LPON_UTTR0(phy->mt76->band_idx), tsf.t32[0]);
-@@ -1133,7 +1254,7 @@ mt7996_offset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1132,7 +1253,7 @@ mt7996_offset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  	mutex_lock(&dev->mt76.mutex);
  
@@ -355,7 +355,7 @@
  	n = mconf->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
  					       : mconf->mt76.omac_idx;
  	mt76_wr(dev, MT_LPON_UTTR0(phy->mt76->band_idx), tsf.t32[0]);
-@@ -1308,7 +1429,7 @@ mt7996_set_bitrate_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1307,7 +1428,7 @@ mt7996_set_bitrate_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	u32 changed = IEEE80211_RC_SUPP_RATES_CHANGED;
  
  	mutex_lock(&dev->mt76.mutex);
@@ -364,7 +364,7 @@
  	mconf->bitrate_mask = *mask;
  	mutex_unlock(&dev->mt76.mutex);
  
-@@ -1528,7 +1649,7 @@ void mt7996_get_et_stats(struct ieee80211_hw *hw,
+@@ -1527,7 +1648,7 @@ void mt7996_get_et_stats(struct ieee80211_hw *hw,
  	int i, ei = 0;
  
  	mutex_lock(&dev->mt76.mutex);
@@ -373,7 +373,7 @@
  	wi.idx = mconf->mt76.idx,
  
  	mt7996_mac_update_stats(phy);
-@@ -1901,6 +2022,8 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1900,6 +2021,8 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	struct mt7996_phy *phy = ctx->phy;
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_bss_conf *mconf;
@@ -382,7 +382,7 @@
  
  	wiphy_info(hw->wiphy, "Assign VIF (addr: %pM, type: %d, link_id: %d) to channel context: %d MHz\n",
  		    vif->addr, vif->type, link_conf->link_id,
-@@ -1908,10 +2031,24 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1907,10 +2030,24 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  	mutex_lock(&phy->dev->mt76.mutex);
  
@@ -408,7 +408,7 @@
  	mutex_unlock(&phy->dev->mt76.mutex);
  
  	return 0;
-@@ -1937,7 +2074,7 @@ mt7996_unassign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1936,7 +2073,7 @@ mt7996_unassign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	if (test_bit(MT76_SCANNING, &phy->mt76->state))
  		mt7996_scan_complete(phy, true);
  
@@ -417,7 +417,7 @@
  	mconf->chanctx = NULL;
  	ctx->nbss_assigned--;
  
-@@ -1977,6 +2114,54 @@ mt7996_switch_vif_chanctx(struct ieee80211_hw *hw,
+@@ -1976,6 +2113,54 @@ mt7996_switch_vif_chanctx(struct ieee80211_hw *hw,
  	return mt7996_set_channel(phy, &new_ctx->chandef);
  }
  
@@ -472,7 +472,7 @@
  const struct ieee80211_ops mt7996_ops = {
  	.add_chanctx = ieee80211_emulate_add_chanctx,
  	.remove_chanctx = ieee80211_emulate_remove_chanctx,
-@@ -1990,7 +2175,8 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -1989,7 +2174,8 @@ const struct ieee80211_ops mt7996_ops = {
  	.config = mt7996_config,
  	.conf_tx = mt7996_conf_tx,
  	.configure_filter = mt7996_configure_filter,
@@ -482,17 +482,17 @@
  	.sta_state = mt76_sta_state,
  	.sta_pre_rcu_remove = mt76_sta_pre_rcu_remove,
  	.sta_rc_update = mt7996_sta_rc_update,
-@@ -2036,4 +2222,5 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -2035,4 +2221,5 @@ const struct ieee80211_ops mt7996_ops = {
  	.assign_vif_chanctx = mt7996_assign_vif_chanctx,
  	.unassign_vif_chanctx = mt7996_unassign_vif_chanctx,
  	.switch_vif_chanctx = mt7996_switch_vif_chanctx,
 +	.change_vif_links = mt7996_change_vif_links,
  };
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 20b84c93..d3e244ee 100644
+index ced769b4..081e9ca9 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1047,15 +1047,23 @@ static void
+@@ -1052,15 +1052,23 @@ static void
  mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
  		       struct mt7996_bss_conf *mconf)
  {
@@ -520,7 +520,7 @@
  }
  
  static void
-@@ -1136,13 +1144,11 @@ mt7996_mcu_bss_ifs_timing_tlv(struct sk_buff *skb, struct mt7996_phy *phy)
+@@ -1141,13 +1149,11 @@ mt7996_mcu_bss_ifs_timing_tlv(struct sk_buff *skb, struct mt7996_phy *phy)
  }
  
  static int
@@ -538,7 +538,7 @@
  	struct ieee80211_vif *vif = conf->vif;
  	struct cfg80211_chan_def *chandef = &phy->chandef;
  	struct mt76_connac_bss_basic_tlv *bss;
-@@ -1254,8 +1260,7 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
+@@ -1259,8 +1265,7 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
  		return PTR_ERR(skb);
  
  	/* bss_basic must be first */
@@ -549,10 +549,10 @@
  
  	if (vif->type == NL80211_IFTYPE_MONITOR)
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 1732ff36..09b1088e 100644
+index d86e24e3..9b9b1f8f 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -341,6 +341,9 @@ struct mt7996_bss_conf {
+@@ -342,6 +342,9 @@ struct mt7996_bss_conf {
  	struct cfg80211_bitrate_mask bitrate_mask;
  
  	struct mt7996_chanctx *chanctx;
@@ -562,7 +562,7 @@
  };
  
  struct mt7996_vif {
-@@ -349,6 +352,10 @@ struct mt7996_vif {
+@@ -350,6 +353,10 @@ struct mt7996_vif {
  
  	struct mt7996_sta sta;
  	struct mt7996_dev *dev;
@@ -573,7 +573,7 @@
  };
  
  /* crash-dump */
-@@ -550,6 +557,8 @@ struct mt7996_dev {
+@@ -551,6 +558,8 @@ struct mt7996_dev {
  	u16 chainmask;
  	u8 chainshift[__MT_MAX_BAND];
  	u32 hif_idx;
@@ -583,5 +583,5 @@
  	struct work_struct init_work;
  	struct work_struct rc_work;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0095-mtk-mt76-mt7996-support-multi-link-sta-links-and-MLO.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0083-mtk-mt76-mt7996-support-multi-link-sta-links-and-MLO.patch
similarity index 90%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0095-mtk-mt76-mt7996-support-multi-link-sta-links-and-MLO.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0083-mtk-mt76-mt7996-support-multi-link-sta-links-and-MLO.patch
index 1338a68..19b0be2 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0095-mtk-mt76-mt7996-support-multi-link-sta-links-and-MLO.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0083-mtk-mt76-mt7996-support-multi-link-sta-links-and-MLO.patch
@@ -1,7 +1,7 @@
-From 9fb46d0e65f5f37975a71ad433db8290ee586566 Mon Sep 17 00:00:00 2001
+From 62e749b2b89a799e0d137983f4dabc1eeb3ebad8 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 29 Nov 2023 10:12:39 +0800
-Subject: [PATCH 095/199] mtk: mt76: mt7996: support multi-link sta links and
+Subject: [PATCH 083/223] mtk: mt76: mt7996: support multi-link sta links and
  MLO sta callbacks
 
 Rework add_sta functions to add_link_sta functions, and support
@@ -12,17 +12,17 @@
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
- mt7996/main.c   | 309 +++++++++++++++++++++++++++++++++++++-----------
+ mt7996/main.c   | 318 +++++++++++++++++++++++++++++++++++++-----------
  mt7996/mcu.c    | 117 ++++++++++++++++++
  mt7996/mcu.h    |  29 +++++
  mt7996/mt7996.h |   7 ++
- 4 files changed, 396 insertions(+), 66 deletions(-)
+ 4 files changed, 400 insertions(+), 71 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 3abae2fe..e850942f 100644
+index dc7ee54c..106e8534 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -932,42 +932,234 @@ mt7996_channel_switch_beacon(struct ieee80211_hw *hw,
+@@ -926,42 +926,234 @@ mt7996_channel_switch_beacon(struct ieee80211_hw *hw,
  	mutex_unlock(&dev->mt76.mutex);
  }
  
@@ -277,8 +277,8 @@
  	case MT_BAND1:
  		phy = mt7996_phy2(dev);
  		break;
-@@ -990,28 +1182,11 @@ void mt7996_mac_sta_assoc(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 			  struct ieee80211_sta *sta)
+@@ -984,69 +1176,26 @@ int mt7996_mac_sta_event(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 			 struct ieee80211_sta *sta, enum mt76_sta_event ev)
  {
  	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
 -	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -288,27 +288,37 @@
 -	struct ieee80211_bss_conf *conf;
 -	struct ieee80211_link_sta *link_sta;
 +	unsigned long add = sta->valid_links ?: BIT(0);
++	int ret = 0;
  
  	mutex_lock(&dev->mt76.mutex);
  
--	conf = link_conf_dereference_protected(vif, 0);
--	mconf = mconf_dereference_protected(mvif, 0);
--	link_sta = link_sta_dereference_protected(sta, 0);
--	mlink = mlink_dereference_protected(msta, 0);
+-	if (ev == MT76_STA_EVENT_ASSOC) {
+-		mt7996_mac_wtbl_update(dev, msta->wcid.idx,
+-				       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
 -
--	mt7996_mac_wtbl_update(dev, mlink->wcid.idx,
--			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
+-		conf = link_conf_dereference_protected(vif, 0);
+-		mconf = mconf_dereference_protected(mvif, 0);
+-		link_sta = link_sta_dereference_protected(sta, 0);
+-		mlink = mlink_dereference_protected(msta, 0);
 -
--	mt7996_mcu_add_sta(dev, conf, mconf, link_sta, mlink, true, true);
--	mt7996_mcu_add_rate_ctrl(dev, conf, mconf, link_sta, mlink, false);
--	mlink->wcid.tx_info |= MT_WCID_TX_INFO_SET;
+-		mt7996_mac_wtbl_update(dev, mlink->wcid.idx,
+-				       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
+-
+-		mt7996_mcu_add_sta(dev, conf, mconf, link_sta, mlink, true, true);
+-		mt7996_mcu_add_rate_ctrl(dev, conf, mconf, link_sta, mlink, false);
+-		mlink->wcid.tx_info |= MT_WCID_TX_INFO_SET;
 -
--	ewma_avg_signal_init(&mlink->avg_ack_signal);
-+	mt7996_mac_sta_add_links(dev, vif, sta, add, true);
+-		ewma_avg_signal_init(&mlink->avg_ack_signal);
+-	}
++	if (ev == MT76_STA_EVENT_ASSOC)
++		ret = mt7996_mac_sta_add_links(dev, vif, sta, add, true);
  
  	mutex_unlock(&dev->mt76.mutex);
++
++	return ret;
  }
-@@ -1020,34 +1195,9 @@ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 
+ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  			   struct ieee80211_sta *sta)
  {
  	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
@@ -345,7 +355,7 @@
  }
  
  static void mt7996_tx(struct ieee80211_hw *hw,
-@@ -2162,6 +2312,32 @@ mt7996_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2161,6 +2310,32 @@ mt7996_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	return ret;
  }
  
@@ -378,17 +388,17 @@
  const struct ieee80211_ops mt7996_ops = {
  	.add_chanctx = ieee80211_emulate_add_chanctx,
  	.remove_chanctx = ieee80211_emulate_remove_chanctx,
-@@ -2223,4 +2399,5 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -2222,4 +2397,5 @@ const struct ieee80211_ops mt7996_ops = {
  	.unassign_vif_chanctx = mt7996_unassign_vif_chanctx,
  	.switch_vif_chanctx = mt7996_switch_vif_chanctx,
  	.change_vif_links = mt7996_change_vif_links,
 +	.change_sta_links = mt7996_change_sta_links,
  };
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index d3e244ee..7138230e 100644
+index 081e9ca9..96d4d5b0 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2426,6 +2426,123 @@ out:
+@@ -2433,6 +2433,123 @@ out:
  				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
  }
  
@@ -553,10 +563,10 @@
  	__le16 tag;
  	__le16 len;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 09b1088e..4775e1f8 100644
+index 9b9b1f8f..f6933418 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -330,6 +330,8 @@ struct mt7996_sta {
+@@ -331,6 +331,8 @@ struct mt7996_sta {
  	struct mt7996_link_sta __rcu *link[IEEE80211_MLD_MAX_NUM_LINKS];
  
  	struct mt7996_vif *vif;
@@ -565,7 +575,7 @@
  };
  
  struct mt7996_bss_conf {
-@@ -857,6 +859,9 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+@@ -861,6 +863,9 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  		       struct mt7996_bss_conf *mconf,
  		       struct ieee80211_link_sta *link_sta,
  		       struct mt7996_link_sta *mlink, bool enable, bool newly);
@@ -575,7 +585,7 @@
  int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  			 struct ieee80211_ampdu_params *params,
  			 bool add);
-@@ -880,6 +885,8 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+@@ -884,6 +889,8 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  			     struct mt7996_bss_conf *mconf,
  			     struct ieee80211_link_sta *link_sta,
  			     struct mt7996_link_sta *mlink, bool changed);
@@ -585,5 +595,5 @@
  int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag);
  int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct mt7996_bss_conf *mconf);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0096-mtk-mt76-mt7996-introduce-mt7996_band_phy-for-ch-ban.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0084-mtk-mt76-mt7996-introduce-mt7996_band_phy-for-ch-ban.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0096-mtk-mt76-mt7996-introduce-mt7996_band_phy-for-ch-ban.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0084-mtk-mt76-mt7996-introduce-mt7996_band_phy-for-ch-ban.patch
index 4a5208f..96da326 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0096-mtk-mt76-mt7996-introduce-mt7996_band_phy-for-ch-ban.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0084-mtk-mt76-mt7996-introduce-mt7996_band_phy-for-ch-ban.patch
@@ -1,7 +1,7 @@
-From 05433210ece4bbeee342650a8c4ea98c8e1c823c Mon Sep 17 00:00:00 2001
+From a77bf1528855525590647055a6d5c4b760946efc Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 1 Dec 2023 16:01:53 +0800
-Subject: [PATCH 096/199] mtk: mt76: mt7996: introduce mt7996_band_phy() for ch
+Subject: [PATCH 084/223] mtk: mt76: mt7996: introduce mt7996_band_phy() for ch
  band and phy mapping
 
 For MLO devices, one ieee80211_hw can be mapped to several bands, and
@@ -16,7 +16,7 @@
  2 files changed, 112 insertions(+), 59 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index e850942f..ab99f1cf 100644
+index 106e8534..ae1b2875 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -41,9 +41,8 @@ static void mt7996_testmode_disable_all(struct mt7996_dev *dev)
@@ -152,7 +152,7 @@
  	return ret;
  }
 @@ -143,18 +152,29 @@ static int mt7996_start(struct ieee80211_hw *hw)
- static void mt7996_stop(struct ieee80211_hw *hw)
+ static void mt7996_stop(struct ieee80211_hw *hw, bool suspend)
  {
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
 -	struct mt7996_phy *phy = mt7996_hw_phy(hw);
@@ -187,7 +187,7 @@
  }
  
  static inline int get_free_idx(u32 mask, u8 start, u8 end)
-@@ -2061,7 +2081,7 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2059,7 +2079,7 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	       struct ieee80211_scan_request *hw_req)
  {
  	struct cfg80211_scan_request *req = &hw_req->req;
@@ -196,7 +196,7 @@
  
  	mutex_lock(&phy->dev->mt76.mutex);
  	if (WARN_ON(phy->scan_req || phy->scan_chan)) {
-@@ -2083,19 +2103,30 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2081,19 +2101,30 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  static void
  mt7996_cancel_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
  {
@@ -234,11 +234,11 @@
  	int ret;
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 4775e1f8..d5b61a2e 100644
+index f6933418..38b924b5 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -789,6 +789,28 @@ mt7996_get_background_radar_cap(struct mt7996_dev *dev)
- 	return 1;
+@@ -793,6 +793,28 @@ mt7996_has_background_radar(struct mt7996_dev *dev)
+ 	return true;
  }
  
 +static inline struct mt7996_phy *
@@ -267,5 +267,5 @@
  mt7996_chanctx_get(struct ieee80211_chanctx_conf *ctx)
  {
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0097-mtk-mt76-mt7996-rework-ieee80211_ops-callbacks-for-l.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0085-mtk-mt76-mt7996-rework-ieee80211_ops-callbacks-for-l.patch
similarity index 92%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0097-mtk-mt76-mt7996-rework-ieee80211_ops-callbacks-for-l.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0085-mtk-mt76-mt7996-rework-ieee80211_ops-callbacks-for-l.patch
index 5e2b865..f87ae95 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0097-mtk-mt76-mt7996-rework-ieee80211_ops-callbacks-for-l.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0085-mtk-mt76-mt7996-rework-ieee80211_ops-callbacks-for-l.patch
@@ -1,7 +1,7 @@
-From 874f7bc5d6481d84d3d38f0a598ca791dc9755d8 Mon Sep 17 00:00:00 2001
+From 088cb092b3a6b3387d2d6f7ee5100ac803ff626a Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 1 Dec 2023 17:26:43 +0800
-Subject: [PATCH 097/199] mtk: mt76: mt7996: rework ieee80211_ops callbacks for
+Subject: [PATCH 085/223] mtk: mt76: mt7996: rework ieee80211_ops callbacks for
  link consideration
 
 Extend ieee80211 callback functions to support multi-link operation.
@@ -15,10 +15,10 @@
  1 file changed, 204 insertions(+), 109 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index ab99f1cf..6148c834 100644
+index ae1b2875..580cb2a5 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -572,7 +572,6 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+@@ -566,7 +566,6 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
  			  struct ieee80211_key_conf *key)
  {
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
@@ -26,7 +26,7 @@
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_sta *msta = sta ? (struct mt7996_sta *)sta->drv_priv :
  				  &mvif->sta;
-@@ -582,70 +581,77 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+@@ -576,70 +575,77 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
  	u8 *wcid_keyidx;
  	int idx = key->keyidx;
  	int err = 0;
@@ -159,7 +159,7 @@
  out:
  	mutex_unlock(&dev->mt76.mutex);
  
-@@ -701,7 +707,11 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -695,7 +701,11 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	};
  
  	mutex_lock(&dev->mt76.mutex);
@@ -172,7 +172,7 @@
  
  	/* firmware uses access class index */
  	mconf->queue_params[mq_to_aci[queue]] = *params;
-@@ -844,19 +854,26 @@ mt7996_update_mu_group(struct ieee80211_hw *hw, struct ieee80211_bss_conf *conf,
+@@ -838,19 +848,26 @@ mt7996_update_mu_group(struct ieee80211_hw *hw, struct ieee80211_bss_conf *conf,
  static void mt7996_vif_cfg_changed(struct ieee80211_hw *hw,
  				   struct ieee80211_vif *vif, u64 changed)
  {
@@ -206,7 +206,7 @@
  	}
  
  	mutex_unlock(&dev->mt76.mutex);
-@@ -875,8 +892,13 @@ static void mt7996_link_info_changed(struct ieee80211_hw *hw,
+@@ -869,8 +886,13 @@ static void mt7996_link_info_changed(struct ieee80211_hw *hw,
  
  	mutex_lock(&dev->mt76.mutex);
  
@@ -222,7 +222,7 @@
  	/* station mode uses BSSID to map the wlan entry to a peer,
  	 * and then peer references bss_info_rfch to set bandwidth cap.
  	 */
-@@ -932,6 +954,7 @@ static void mt7996_link_info_changed(struct ieee80211_hw *hw,
+@@ -926,6 +948,7 @@ static void mt7996_link_info_changed(struct ieee80211_hw *hw,
  	if (changed & BSS_CHANGED_MU_GROUPS)
  		mt7996_update_mu_group(hw, info, mconf);
  
@@ -230,7 +230,7 @@
  	mutex_unlock(&dev->mt76.mutex);
  }
  
-@@ -942,13 +965,22 @@ mt7996_channel_switch_beacon(struct ieee80211_hw *hw,
+@@ -936,13 +959,22 @@ mt7996_channel_switch_beacon(struct ieee80211_hw *hw,
  {
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -258,7 +258,7 @@
  	mutex_unlock(&dev->mt76.mutex);
  }
  
-@@ -1220,34 +1252,74 @@ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -1218,34 +1250,74 @@ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	mt7996_mac_sta_remove_links(dev, vif, sta, rem);
  }
  
@@ -345,7 +345,7 @@
  }
  
  static int mt7996_set_rts_threshold(struct ieee80211_hw *hw, u32 val)
-@@ -1283,7 +1355,7 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1281,7 +1353,7 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	mtxq = (struct mt76_txq *)txq->drv_priv;
  
  	mutex_lock(&dev->mt76.mutex);
@@ -354,7 +354,7 @@
  	switch (action) {
  	case IEEE80211_AMPDU_RX_START:
  		mt76_rx_aggr_start(&dev->mt76, &mlink->wcid, tid, ssn,
-@@ -1498,7 +1570,7 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
+@@ -1496,7 +1568,7 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
  
  	/* TODO: support per-link rate report */
  	mutex_lock(&dev->mt76.mutex);
@@ -363,7 +363,7 @@
  	if (!mlink)
  		goto out;
  
-@@ -1558,7 +1630,7 @@ static void mt7996_sta_rc_work(void *data, struct ieee80211_sta *sta)
+@@ -1556,7 +1628,7 @@ static void mt7996_sta_rc_work(void *data, struct ieee80211_sta *sta)
  	u32 *changed = data;
  
  	rcu_read_lock();
@@ -372,7 +372,7 @@
  
  	spin_lock_bh(&dev->mt76.sta_poll_lock);
  	mlink->changed |= *changed;
-@@ -1625,19 +1697,26 @@ static void mt7996_sta_set_4addr(struct ieee80211_hw *hw,
+@@ -1623,19 +1695,26 @@ static void mt7996_sta_set_4addr(struct ieee80211_hw *hw,
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
@@ -408,7 +408,7 @@
  	mutex_unlock(&dev->mt76.mutex);
  }
  
-@@ -1649,19 +1728,26 @@ static void mt7996_sta_set_decap_offload(struct ieee80211_hw *hw,
+@@ -1647,19 +1726,26 @@ static void mt7996_sta_set_decap_offload(struct ieee80211_hw *hw,
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
@@ -444,7 +444,7 @@
  	mutex_unlock(&dev->mt76.mutex);
  }
  
-@@ -1794,9 +1880,13 @@ static void mt7996_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
+@@ -1792,9 +1878,13 @@ static void mt7996_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
  {
  	struct mt76_ethtool_worker_info *wi = wi_data;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
@@ -460,7 +460,7 @@
  		return;
  
  	mt76_ethtool_worker(wi, &mlink->wcid.stats, true);
-@@ -2028,12 +2118,13 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -2026,12 +2116,13 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  			     struct net_device_path *path)
  {
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -476,7 +476,7 @@
  
  	if (dev->hif2) {
  		switch (dev->option_type) {
-@@ -2053,6 +2144,10 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -2051,6 +2142,10 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
  
@@ -487,7 +487,7 @@
  	if (mlink->wcid.idx > MT7996_WTBL_STA)
  		return -EIO;
  
-@@ -2385,7 +2480,7 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -2383,7 +2478,7 @@ const struct ieee80211_ops mt7996_ops = {
  	.vif_cfg_changed = mt7996_vif_cfg_changed,
  	.link_info_changed = mt7996_link_info_changed,
  	.sta_state = mt76_sta_state,
@@ -497,5 +497,5 @@
  	.set_key = mt7996_set_key,
  	.ampdu_action = mt7996_ampdu_action,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0098-mtk-mt76-mt7996-rework-TXD-for-multi-link-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0086-mtk-mt76-mt7996-rework-TXD-for-multi-link-support.patch
similarity index 88%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0098-mtk-mt76-mt7996-rework-TXD-for-multi-link-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0086-mtk-mt76-mt7996-rework-TXD-for-multi-link-support.patch
index 120bcda..9b5eeed 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0098-mtk-mt76-mt7996-rework-TXD-for-multi-link-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0086-mtk-mt76-mt7996-rework-TXD-for-multi-link-support.patch
@@ -1,7 +1,7 @@
-From 993bb57ca7933d2de1e8b77693e5d006e6968c4c Mon Sep 17 00:00:00 2001
+From ee502aed06bf89606b05b5ac3e2d89b766de7772 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 4 Dec 2023 11:25:54 +0800
-Subject: [PATCH 098/199] mtk: mt76: mt7996: rework TXD for multi-link support
+Subject: [PATCH 086/223] mtk: mt76: mt7996: rework TXD for multi-link support
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
@@ -14,10 +14,10 @@
  2 files changed, 73 insertions(+), 24 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index fbe6c0bd..b0ad48dd 100644
+index 8b682842..26878e29 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -615,9 +615,8 @@ mt7996_mac_write_txwi_8023(struct mt7996_dev *dev, __le32 *txwi,
+@@ -627,9 +627,8 @@ mt7996_mac_write_txwi_8023(struct mt7996_dev *dev, __le32 *txwi,
  	u32 val;
  
  	if (wcid->sta) {
@@ -28,7 +28,7 @@
  		wmm = sta->wme;
  	}
  
-@@ -727,6 +726,10 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
+@@ -739,6 +738,10 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
  		txwi[3] |= cpu_to_le32(val);
  		txwi[3] &= ~cpu_to_le32(MT_TXD3_HW_AMSDU);
  	}
@@ -39,7 +39,7 @@
  }
  
  void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
-@@ -736,10 +739,12 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+@@ -748,10 +751,12 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
  {
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  	struct ieee80211_vif *vif = info->control.vif;
@@ -53,7 +53,7 @@
  	u16 tx_count = 15;
  	u32 val;
  	bool inband_disc = !!(changed & (BSS_CHANGED_UNSOL_BCAST_PROBE_RESP |
-@@ -747,11 +752,16 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+@@ -759,11 +764,16 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
  	bool beacon = !!(changed & (BSS_CHANGED_BEACON |
  				    BSS_CHANGED_BEACON_ENABLED)) && (!inband_disc);
  
@@ -75,7 +75,7 @@
  	}
  
  	if (inband_disc) {
-@@ -798,7 +808,10 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+@@ -810,7 +820,10 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
  		val |= MT_TXD5_TX_STATUS_HOST;
  	txwi[5] = cpu_to_le32(val);
  
@@ -87,7 +87,7 @@
  	if (is_mt7996(&dev->mt76))
  		val |= FIELD_PREP(MT_TXD6_MSDU_CNT, 1);
  	else
-@@ -817,16 +830,18 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+@@ -829,16 +842,18 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
  			     is_multicast_ether_addr(hdr->addr1);
  		u8 idx = MT7996_BASIC_RATES_TBL;
  
@@ -112,7 +112,7 @@
  		txwi[6] |= cpu_to_le32(val);
  		txwi[3] |= cpu_to_le32(MT_TXD3_BA_DISABLE);
  	}
-@@ -842,17 +857,48 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -854,17 +869,48 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
  	struct ieee80211_key_conf *key = info->control.hw_key;
  	struct ieee80211_vif *vif = info->control.vif;
@@ -163,7 +163,7 @@
  
  	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
  	t->skb = tx_info->skb;
-@@ -897,13 +943,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -909,13 +955,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	if (!is_8023 && ieee80211_is_mgmt(hdr->frame_control))
  		txp->fw.flags |= cpu_to_le16(MT_CT_INFO_MGMT_FRAME);
  
@@ -179,10 +179,10 @@
  	txp->fw.rept_wds_wcid = cpu_to_le16(sta ? wcid->idx : 0xfff);
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index d5b61a2e..72988c9e 100644
+index 38b924b5..bde3bec1 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -831,6 +831,15 @@ mlink_dereference_protected(struct mt7996_sta *msta, u8 link_id)
+@@ -835,6 +835,15 @@ mlink_dereference_protected(struct mt7996_sta *msta, u8 link_id)
  					 lockdep_is_held(&msta->vif->dev->mt76.mutex));
  }
  
@@ -199,5 +199,5 @@
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0099-mtk-mt76-mt7996-rework-TXS-for-multi-link-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0087-mtk-mt76-mt7996-rework-TXS-for-multi-link-support.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0099-mtk-mt76-mt7996-rework-TXS-for-multi-link-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0087-mtk-mt76-mt7996-rework-TXS-for-multi-link-support.patch
index 6ee0a2b..8191d6a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0099-mtk-mt76-mt7996-rework-TXS-for-multi-link-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0087-mtk-mt76-mt7996-rework-TXS-for-multi-link-support.patch
@@ -1,7 +1,7 @@
-From 907d640dec0609331c193539094c3620ae848543 Mon Sep 17 00:00:00 2001
+From 40622f831dbacee3a7b35c3786fd81d0abf733bd Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 4 Dec 2023 11:57:38 +0800
-Subject: [PATCH 099/199] mtk: mt76: mt7996: rework TXS for multi-link support
+Subject: [PATCH 087/223] mtk: mt76: mt7996: rework TXS for multi-link support
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
@@ -25,10 +25,10 @@
  3 files changed, 34 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index b0ad48dd..c910f353 100644
+index 26878e29..92628e17 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1195,7 +1195,7 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
+@@ -1207,7 +1207,7 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
  		struct ieee80211_sta *sta;
  		u8 tid;
  
@@ -37,7 +37,7 @@
  		tid = FIELD_GET(MT_TXS0_TID, txs);
  		ieee80211_refresh_tx_agg_session_timer(sta, tid);
  	}
-@@ -1335,7 +1335,7 @@ static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
+@@ -1347,7 +1347,7 @@ static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
  	if (!wcid->sta)
  		goto out;
  
@@ -47,10 +47,10 @@
  	if (list_empty(&mlink->wcid.poll_list))
  		list_add_tail(&mlink->wcid.poll_list, &dev->mt76.sta_poll_list);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 6148c834..65e244da 100644
+index 580cb2a5..cadfee9f 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -2321,6 +2321,7 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2319,6 +2319,7 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	mconf = mconf_dereference_protected(mvif, link_id);
  	mconf->chanctx = ctx;
  	ctx->nbss_assigned++;
@@ -59,10 +59,10 @@
  	if (mt7996_hw_phy(hw) == phy)
  		mvif->master_link_id = link_id;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 72988c9e..b7e623cb 100644
+index bde3bec1..f83308de 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -358,6 +358,8 @@ struct mt7996_vif {
+@@ -359,6 +359,8 @@ struct mt7996_vif {
  	u8 master_link_id;
  	u8 group_mld_id;
  	u8 mld_remap_id;
@@ -71,7 +71,7 @@
  };
  
  /* crash-dump */
-@@ -840,6 +842,35 @@ wcid_to_mlink(struct mt76_wcid *wcid)
+@@ -844,6 +846,35 @@ wcid_to_mlink(struct mt76_wcid *wcid)
  	return container_of(wcid, struct mt7996_link_sta, wcid);
  }
  
@@ -108,5 +108,5 @@
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0100-mtk-mt76-mt7996-rework-RXD-for-multi-link-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0088-mtk-mt76-mt7996-rework-RXD-for-multi-link-support.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0100-mtk-mt76-mt7996-rework-RXD-for-multi-link-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0088-mtk-mt76-mt7996-rework-RXD-for-multi-link-support.patch
index 2581dc2..ab34986 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0100-mtk-mt76-mt7996-rework-RXD-for-multi-link-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0088-mtk-mt76-mt7996-rework-RXD-for-multi-link-support.patch
@@ -1,7 +1,7 @@
-From ec6837fa5ce9c356989cd027ff518d013beaa665 Mon Sep 17 00:00:00 2001
+From c30c021612cad8eefe3cae1b4cca929ab5a2d7fd Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 4 Dec 2023 14:50:47 +0800
-Subject: [PATCH 100/199] mtk: mt76: mt7996: rework RXD for multi-link support
+Subject: [PATCH 088/223] mtk: mt76: mt7996: rework RXD for multi-link support
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
@@ -13,7 +13,7 @@
  1 file changed, 2 insertions(+), 25 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index c910f353..8d6a153c 100644
+index 92628e17..98cd7e3b 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -51,29 +51,6 @@ static const struct mt7996_dfs_radar_spec jp_radar_specs = {
@@ -60,5 +60,5 @@
  		if (list_empty(&mlink->wcid.poll_list))
  			list_add_tail(&mlink->wcid.poll_list,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0101-mtk-mt76-mt7996-rework-mac-functions-for-multi-link-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0089-mtk-mt76-mt7996-rework-mac-functions-for-multi-link-.patch
similarity index 90%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0101-mtk-mt76-mt7996-rework-mac-functions-for-multi-link-.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0089-mtk-mt76-mt7996-rework-mac-functions-for-multi-link-.patch
index 1e50891..29c724a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0101-mtk-mt76-mt7996-rework-mac-functions-for-multi-link-.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0089-mtk-mt76-mt7996-rework-mac-functions-for-multi-link-.patch
@@ -1,7 +1,7 @@
-From c5aaee0305b927c4e3a5e39bca3d19d3325b2ee8 Mon Sep 17 00:00:00 2001
+From 83a66d966beb9a326c0a75641d21e562306cc8ab Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 4 Dec 2023 18:31:02 +0800
-Subject: [PATCH 101/199] mtk: mt76: mt7996: rework mac functions for
+Subject: [PATCH 089/223] mtk: mt76: mt7996: rework mac functions for
  multi-link support
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
@@ -14,7 +14,7 @@
  1 file changed, 65 insertions(+), 26 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 8d6a153c..6d0506fc 100644
+index 98cd7e3b..c4cd5bc2 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -85,10 +85,11 @@ static int mt7996_reverse_frag0_hdr_trans(struct sk_buff *skb, u16 hdr_gap)
@@ -57,7 +57,7 @@
  		break;
  	case IEEE80211_FCTL_FROMDS:
  		ether_addr_copy(hdr.addr3, eth_hdr->h_source);
-@@ -958,15 +962,21 @@ u32 mt7996_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+@@ -970,15 +974,21 @@ u32 mt7996_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
  }
  
  static void
@@ -81,7 +81,7 @@
  		return;
  
  	tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
-@@ -990,17 +1000,17 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
+@@ -1002,17 +1012,17 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
  		return;
  
  	msta = (struct mt7996_sta *)sta->drv_priv;
@@ -102,7 +102,7 @@
  	__le32 *txwi;
  	u16 wcid_idx;
  
-@@ -1010,11 +1020,10 @@ mt7996_txwi_free(struct mt7996_dev *dev, struct mt76_txwi_cache *t,
+@@ -1022,11 +1032,10 @@ mt7996_txwi_free(struct mt7996_dev *dev, struct mt76_txwi_cache *t,
  
  	txwi = (__le32 *)mt76_get_txwi_ptr(mdev, t);
  	if (sta) {
@@ -115,7 +115,7 @@
  	} else {
  		wcid_idx = le32_get_bits(txwi[9], MT_TXD9_WLAN_IDX);
  	}
-@@ -1069,7 +1078,9 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+@@ -1081,7 +1090,9 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
  		 */
  		info = le32_to_cpu(*cur_info);
  		if (info & MT_TXFREE_INFO_PAIR) {
@@ -126,7 +126,7 @@
  			u16 idx;
  
  			idx = FIELD_GET(MT_TXFREE_INFO_WLAN_ID, info);
-@@ -1078,11 +1089,17 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+@@ -1090,11 +1101,17 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
  			if (!sta)
  				continue;
  
@@ -148,7 +148,7 @@
  			spin_unlock_bh(&mdev->sta_poll_lock);
  			continue;
  		} else if (info & MT_TXFREE_INFO_HEADER) {
-@@ -1118,7 +1135,8 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+@@ -1130,7 +1147,8 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
  			if (!txwi)
  				continue;
  
@@ -158,7 +158,7 @@
  		}
  	}
  
-@@ -1533,19 +1551,29 @@ static void
+@@ -1545,19 +1563,29 @@ static void
  mt7996_update_vif_beacon(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
  	struct ieee80211_hw *hw = priv;
@@ -191,7 +191,7 @@
  }
  
  static void
-@@ -1581,7 +1609,7 @@ void mt7996_tx_token_put(struct mt7996_dev *dev)
+@@ -1593,7 +1621,7 @@ void mt7996_tx_token_put(struct mt7996_dev *dev)
  
  	spin_lock_bh(&dev->mt76.token_lock);
  	idr_for_each_entry(&dev->mt76.token, txwi, id) {
@@ -200,7 +200,7 @@
  		dev->mt76.token_count--;
  	}
  	spin_unlock_bh(&dev->mt76.token_lock);
-@@ -2265,21 +2293,31 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+@@ -2277,21 +2305,31 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  	u32 changed;
  	LIST_HEAD(list);
  
@@ -236,7 +236,7 @@
  
  		if (changed & (IEEE80211_RC_SUPP_RATES_CHANGED |
  			       IEEE80211_RC_NSS_CHANGED |
-@@ -2294,6 +2332,7 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+@@ -2306,6 +2344,7 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  	}
  
  	spin_unlock_bh(&dev->mt76.sta_poll_lock);
@@ -245,5 +245,5 @@
  
  void mt7996_mac_work(struct work_struct *work)
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0102-mtk-mt76-rework-mcu-functions-for-multi-link-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0090-mtk-mt76-rework-mcu-functions-for-multi-link-support.patch
similarity index 84%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0102-mtk-mt76-rework-mcu-functions-for-multi-link-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0090-mtk-mt76-rework-mcu-functions-for-multi-link-support.patch
index d6cf909..646fbf5 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0102-mtk-mt76-rework-mcu-functions-for-multi-link-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0090-mtk-mt76-rework-mcu-functions-for-multi-link-support.patch
@@ -1,11 +1,12 @@
-From 06755ac0b2b1c2e38ce8fbb6da62f966ec7d219a Mon Sep 17 00:00:00 2001
+From d3bc0fc0ebebd8cff5549930cb7b5c336fb2b5f4 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 7 Dec 2023 15:39:03 +0800
-Subject: [PATCH 102/199] mtk: mt76: rework mcu functions for multi-link
+Subject: [PATCH 090/223] mtk: mt76: rework mcu functions for multi-link
  support
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
+Change-Id: I05afbe5a71c12f8d0a5d2132e0ff002361371e4a
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mt76_connac_mcu.c | 10 +++----
@@ -14,7 +15,7 @@
  3 files changed, 56 insertions(+), 26 deletions(-)
 
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 33cbf4c2..de4e0019 100644
+index c7145074..0c89222b 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -370,10 +370,11 @@ void mt76_connac_mcu_bss_omac_tlv(struct sk_buff *skb,
@@ -24,13 +25,13 @@
 -				   struct ieee80211_vif *vif,
 +				   struct ieee80211_bss_conf *conf,
  				   struct ieee80211_link_sta *link_sta,
- 				   bool enable, bool newly)
+ 				   int conn_state, bool newly)
  {
 +	struct ieee80211_vif *vif = conf->vif;
  	struct sta_rec_basic *basic;
  	struct tlv *tlv;
  	int conn_type;
-@@ -393,10 +394,9 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -389,10 +390,9 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  
  	if (!link_sta) {
  		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_BC);
@@ -43,33 +44,33 @@
  			basic->aid = cpu_to_le16(vif->cfg.aid);
  		} else {
  			eth_broadcast_addr(basic->peer_addr);
-@@ -1059,7 +1059,7 @@ int mt76_connac_mcu_sta_cmd(struct mt76_phy *phy,
- 
+@@ -1058,7 +1058,7 @@ int mt76_connac_mcu_sta_cmd(struct mt76_phy *phy,
+ 				    CONN_STATE_DISCONNECT;
  	link_sta = info->sta ? &info->sta->deflink : NULL;
  	if (info->sta || !info->offload_fw)
 -		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif,
 +		mt76_connac_mcu_sta_basic_tlv(dev, skb, &info->vif->bss_conf,
- 					      link_sta, info->enable,
+ 					      link_sta, conn_state,
  					      info->newly);
  	if (info->sta && info->enable)
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 1589a716..226e9a94 100644
+index 11a1224a..ff8a314c 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1923,7 +1923,7 @@ mt76_connac_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
+@@ -1928,7 +1928,7 @@ mt76_connac_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
  int mt76_connac_mcu_set_channel_domain(struct mt76_phy *phy);
  int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif);
  void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
 -				   struct ieee80211_vif *vif,
 +				   struct ieee80211_bss_conf *conf,
  				   struct ieee80211_link_sta *link_sta,
- 				   bool enable, bool newly);
+ 				   int state, bool newly);
  void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 7138230e..1f320a7b 100644
+index 96d4d5b0..7b77cab2 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1169,10 +1169,12 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
+@@ -1174,10 +1174,12 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
  				sta = ieee80211_find_sta(vif, conf->bssid);
  			/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
  			if (sta) {
@@ -85,7 +86,7 @@
  			}
  			rcu_read_unlock();
  		}
-@@ -1306,9 +1308,8 @@ int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct mt7996_bss_conf *mconf)
+@@ -1311,9 +1313,8 @@ int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct mt7996_bss_conf *mconf)
  static int
  mt7996_mcu_sta_ba(struct mt7996_dev *dev, struct mt76_vif *mvif,
  		  struct ieee80211_ampdu_params *params,
@@ -96,7 +97,7 @@
  	struct sta_rec_ba_uni *ba;
  	struct sk_buff *skb;
  	struct tlv *tlv;
-@@ -1338,24 +1339,53 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
+@@ -1343,24 +1344,53 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  			 struct ieee80211_ampdu_params *params,
  			 bool enable)
  {
@@ -159,16 +160,16 @@
  }
  
  static void
-@@ -2379,7 +2409,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
- 		return PTR_ERR(skb);
+@@ -2386,7 +2416,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  
  	/* starec basic */
+ 	conn_state = enable ? CONN_STATE_PORT_SECURE : CONN_STATE_DISCONNECT;
 -	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, link_sta,
 +	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, conf, link_sta,
- 				      enable, newly);
+ 				      conn_state, newly);
  
  	if (!enable)
-@@ -2841,7 +2871,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+@@ -2848,7 +2878,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  			  struct mt7996_bss_conf *mconf, int en)
  {
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
@@ -177,7 +178,7 @@
  	struct ieee80211_mutable_offsets offs;
  	struct ieee80211_tx_info *info;
  	struct sk_buff *skb, *rskb;
-@@ -2857,7 +2887,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+@@ -2864,7 +2894,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  	if (IS_ERR(rskb))
  		return PTR_ERR(rskb);
  
@@ -186,7 +187,7 @@
  	if (!skb) {
  		dev_kfree_skb(rskb);
  		return -EINVAL;
-@@ -2895,9 +2925,9 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+@@ -2902,9 +2932,9 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
  {
  #define OFFLOAD_TX_MODE_SU	BIT(0)
  #define OFFLOAD_TX_MODE_MU	BIT(1)
@@ -198,7 +199,7 @@
  	struct cfg80211_chan_def *chandef = &mconf->phy->mt76->chandef;
  	enum nl80211_band band = chandef->chan->band;
  	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
-@@ -5155,7 +5185,7 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
+@@ -5181,7 +5211,7 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
  				rssi[3] = to_rssi(MT_PRXV_RCPI0, rcpi[3]);
  
  				mlink = container_of(wcid, struct mt7996_link_sta, wcid);
@@ -208,5 +209,5 @@
  				ewma_avg_signal_add(&mlink->avg_ack_signal, -mlink->ack_signal);
  			} else {
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0103-mtk-mt76-rework-connac-helpers.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0091-mtk-mt76-rework-connac-helpers.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0103-mtk-mt76-rework-connac-helpers.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0091-mtk-mt76-rework-connac-helpers.patch
index 59c3a83..b1e017c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0103-mtk-mt76-rework-connac-helpers.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0091-mtk-mt76-rework-connac-helpers.patch
@@ -1,7 +1,7 @@
-From 7ee1d3297a47a4e1d14fef747bee991dadd6298b Mon Sep 17 00:00:00 2001
+From 2e58003c154277e36f759a53975c61cbecb9af02 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 11 Dec 2023 18:45:00 +0800
-Subject: [PATCH 103/199] mtk: mt76: rework connac helpers
+Subject: [PATCH 091/223] mtk: mt76: rework connac helpers
 
 Rework connac helpers related to rate and phymode.
 This is a preliminary patch to add MLO support for mt7996 chipsets.
@@ -33,7 +33,7 @@
  bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
  			       __le32 *txs_data);
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index b841bf62..c1e9ba0f 100644
+index a72551ba..e58570c2 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
 @@ -291,12 +291,11 @@ EXPORT_SYMBOL_GPL(mt76_connac_init_tx_queues);
@@ -51,8 +51,8 @@
 +	struct cfg80211_chan_def *chandef = &mphy->chandef;
  	u8 nss = 0, mode = 0, band = chandef->chan->band;
  	int rateidx = 0, mcast_rate;
- 
-@@ -304,14 +303,14 @@ u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy,
+ 	int offset = 0;
+@@ -305,14 +304,14 @@ u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy,
  		goto legacy;
  
  	if (is_mt7921(mphy->dev)) {
@@ -69,7 +69,7 @@
  
  		__bitrate_mask_check(he_mcs, HE_SU);
  		__bitrate_mask_check(vht_mcs, VHT);
-@@ -323,11 +322,11 @@ u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy,
+@@ -324,11 +323,11 @@ u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy,
  		}
  	}
  
@@ -82,8 +82,8 @@
 +		rateidx = ffs(conf->basic_rates) - 1;
  
  legacy:
- 	rateidx = mt76_calculate_default_rate(mphy, vif, rateidx);
-@@ -561,7 +560,7 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
+ 	if (band != NL80211_BAND_2GHZ)
+@@ -581,7 +580,7 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
  		struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  		bool multicast = ieee80211_is_data(hdr->frame_control) &&
  				 is_multicast_ether_addr(hdr->addr1);
@@ -93,10 +93,10 @@
  		u32 val = MT_TXD6_FIXED_BW;
  
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index de4e0019..ab7cf4a6 100644
+index 0c89222b..e4e6c0d3 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -1366,7 +1366,7 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1368,7 +1368,7 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
  }
  EXPORT_SYMBOL_GPL(mt76_connac_get_phy_mode);
  
@@ -105,7 +105,7 @@
  				enum nl80211_band band)
  {
  	const struct ieee80211_sta_eht_cap *eht_cap;
-@@ -1377,9 +1377,9 @@ u8 mt76_connac_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1379,9 +1379,9 @@ u8 mt76_connac_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
  		mode |= PHY_MODE_AX_6G;
  
  	sband = phy->hw->wiphy->bands[band];
@@ -118,10 +118,10 @@
  
  	switch (band) {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 226e9a94..f6a0d328 100644
+index ff8a314c..1dcd1696 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -2036,7 +2036,7 @@ mt76_connac_get_eht_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif);
+@@ -2041,7 +2041,7 @@ mt76_connac_get_eht_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif);
  u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
  			    enum nl80211_band band,
  			    struct ieee80211_link_sta *sta);
@@ -131,10 +131,10 @@
  
  int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
 diff --git a/mt7925/main.c b/mt7925/main.c
-index 8c0768bf..c1b1cd8a 100644
+index 791c8b00..147b71e7 100644
 --- a/mt7925/main.c
 +++ b/mt7925/main.c
-@@ -793,7 +793,7 @@ mt7925_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -806,7 +806,7 @@ mt7925_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	u16 rate;
  	u8 i, idx, ht;
  
@@ -144,10 +144,10 @@
  
  	if (beacon && ht) {
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 65e244da..1ea81d62 100644
+index cadfee9f..68234032 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -808,7 +808,7 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_bss_conf *conf,
+@@ -802,7 +802,7 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_bss_conf *conf,
  	u16 rate;
  	u8 i, idx;
  
@@ -157,10 +157,10 @@
  	if (beacon) {
  		struct mt7996_phy *phy = mphy->priv;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 1f320a7b..bf7231cd 100644
+index 7b77cab2..edaf8814 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1219,7 +1219,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
+@@ -1224,7 +1224,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
  	bss->dtim_period = conf->dtim_period;
  	bss->phymode = mt76_connac_get_phy_mode(phy, vif,
  						chandef->chan->band, NULL);
@@ -170,5 +170,5 @@
  
  	return 0;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0104-mtk-mt76-mt7996-handle-mapping-for-hw-and-phy.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0092-mtk-mt76-mt7996-handle-mapping-for-hw-and-phy.patch
similarity index 80%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0104-mtk-mt76-mt7996-handle-mapping-for-hw-and-phy.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0092-mtk-mt76-mt7996-handle-mapping-for-hw-and-phy.patch
index 4d17271..2214557 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0104-mtk-mt76-mt7996-handle-mapping-for-hw-and-phy.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0092-mtk-mt76-mt7996-handle-mapping-for-hw-and-phy.patch
@@ -1,7 +1,7 @@
-From 55f4ab5ef60b32bb44395dc818b0dbc55fb7d81a Mon Sep 17 00:00:00 2001
+From eb1ff9f088a5f55389f499e53b63b5f183025a61 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 5 Dec 2023 13:56:51 +0800
-Subject: [PATCH 104/199] mtk: mt76: mt7996: handle mapping for hw and phy
+Subject: [PATCH 092/223] mtk: mt76: mt7996: handle mapping for hw and phy
 
 We've used mt7996_band_phy() to do mapping from ieee80211_hw to mt7996_phy,
 and this patch is a temporal workaround for opposite direction.
@@ -12,11 +12,11 @@
  mac80211.c    | 11 ++++++++++-
  mt76.h        | 10 ++++++++++
  mt7996/mac.c  |  7 +++++--
- mt7996/main.c | 41 ++++++++++++++++++++++++++++++-----------
- 4 files changed, 55 insertions(+), 14 deletions(-)
+ mt7996/main.c | 45 +++++++++++++++++++++++++++++++++++----------
+ 4 files changed, 60 insertions(+), 13 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 49834afe..bf7ead01 100644
+index ec73fe00..03632279 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -823,9 +823,13 @@ EXPORT_SYMBOL_GPL(mt76_has_tx_pending);
@@ -45,7 +45,7 @@
  	return &msband->chan[idx];
  }
  EXPORT_SYMBOL_GPL(mt76_channel_state);
-@@ -1073,7 +1082,7 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -1098,7 +1107,7 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
  	}
  
  	*sta = wcid_to_sta(mstat.wcid);
@@ -55,10 +55,10 @@
  
  static void
 diff --git a/mt76.h b/mt76.h
-index 6a7752ef..f037284a 100644
+index 36e92dfe..9fa411cb 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -829,6 +829,7 @@ struct mt76_vif {
+@@ -843,6 +843,7 @@ struct mt76_vif {
  struct mt76_phy {
  	struct ieee80211_hw *hw;
  	struct mt76_dev *dev;
@@ -66,7 +66,7 @@
  	void *priv;
  
  	unsigned long state;
-@@ -1308,6 +1309,15 @@ mt76_phy_hw(struct mt76_dev *dev, u8 phy_idx)
+@@ -1321,6 +1322,15 @@ mt76_phy_hw(struct mt76_dev *dev, u8 phy_idx)
  	return mt76_dev_phy(dev, phy_idx)->hw;
  }
  
@@ -83,10 +83,10 @@
  mt76_get_txwi_ptr(struct mt76_dev *dev, struct mt76_txwi_cache *t)
  {
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 6d0506fc..c0c0df2f 100644
+index c4cd5bc2..f9aa0e57 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2382,7 +2382,10 @@ void mt7996_mac_work(struct work_struct *work)
+@@ -2394,7 +2394,10 @@ void mt7996_mac_work(struct work_struct *work)
  
  	mt76_tx_status_check(mdev, false);
  
@@ -98,7 +98,7 @@
  				     MT7996_WATCHDOG_TIME);
  }
  
-@@ -2801,7 +2804,7 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
+@@ -2813,7 +2816,7 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
  	skb_set_queue_mapping(skb, IEEE80211_AC_VO);
  
  	rcu_read_lock();
@@ -108,10 +108,10 @@
  				      NULL)) {
  		rcu_read_unlock();
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 1ea81d62..331dd4d4 100644
+index 68234032..01c736a9 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -173,6 +173,7 @@ static void mt7996_stop(struct ieee80211_hw *hw)
+@@ -173,6 +173,7 @@ static void mt7996_stop(struct ieee80211_hw *hw, bool suspend)
  		mutex_lock(&dev->mt76.mutex);
  		mt7996_mcu_set_radio_en(phy, false);
  		clear_bit(MT76_STATE_RUNNING, &phy->mt76->state);
@@ -119,20 +119,23 @@
  		mutex_unlock(&dev->mt76.mutex);
  	}
  }
-@@ -545,9 +546,10 @@ out:
- 	clear_bit(MT76_RESET, &phy->mt76->state);
- 	mutex_unlock(&dev->mt76.mutex);
+@@ -542,7 +543,14 @@ static int __mt7996_set_channel(struct mt7996_phy *phy,
+ 	phy->noise = 0;
  
--	mt76_txq_schedule_all(phy->mt76);
+ out:
+-	ieee80211_queue_delayed_work(mphy->hw, &mphy->mac_work,
++	clear_bit(MT76_RESET, &phy->mt76->state);
++	mutex_unlock(&dev->mt76.mutex);
++
 +	if (phy->mt76 == phy->mt76->main_phy)
 +		mt76_txq_schedule_all(phy->mt76);
- 
--	ieee80211_queue_delayed_work(phy->mt76->hw,
++
 +	ieee80211_queue_delayed_work(mt76_main_hw(phy->mt76),
- 				     &phy->mt76->mac_work,
++				     &phy->mt76->mac_work,
  				     MT7996_WATCHDOG_TIME);
  
-@@ -558,11 +560,11 @@ int mt7996_set_channel(struct mt7996_phy *phy, struct cfg80211_chan_def *chandef
+ 	return ret;
+@@ -552,11 +560,11 @@ int mt7996_set_channel(struct mt7996_phy *phy, struct cfg80211_chan_def *chandef
  {
  	int ret;
  
@@ -146,7 +149,7 @@
  
  	return 0;
  }
-@@ -735,6 +737,7 @@ static void mt7996_configure_filter(struct ieee80211_hw *hw,
+@@ -729,6 +737,7 @@ static void mt7996_configure_filter(struct ieee80211_hw *hw,
  			MT_WF_RFCR1_DROP_CFEND |
  			MT_WF_RFCR1_DROP_CFACK;
  	u32 flags = 0;
@@ -154,7 +157,7 @@
  
  #define MT76_FILTER(_flag, _hw) do {					\
  		flags |= *total_flags & FIF_##_flag;			\
-@@ -768,12 +771,26 @@ static void mt7996_configure_filter(struct ieee80211_hw *hw,
+@@ -762,12 +771,26 @@ static void mt7996_configure_filter(struct ieee80211_hw *hw,
  			     MT_WF_RFCR_DROP_NDPA);
  
  	*total_flags = flags;
@@ -186,7 +189,7 @@
  
  	mutex_unlock(&dev->mt76.mutex);
  }
-@@ -2190,7 +2207,7 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2188,7 +2211,7 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	phy->scan_chan_idx = 0;
  	mutex_unlock(&phy->dev->mt76.mutex);
  
@@ -195,7 +198,7 @@
  
  	return 0;
  }
-@@ -2207,7 +2224,8 @@ mt7996_cancel_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+@@ -2205,7 +2228,8 @@ mt7996_cancel_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
  			continue;
  
  		phy = mt7996_band_phy(hw, band);
@@ -205,7 +208,7 @@
  			continue;
  
  		cancel_delayed_work_sync(&phy->scan_work);
-@@ -2228,6 +2246,7 @@ mt7996_add_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *conf)
+@@ -2226,6 +2250,7 @@ mt7996_add_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *conf)
  	wiphy_info(hw->wiphy, "%s: add %u\n", __func__, conf->def.chan->hw_value);
  	mutex_lock(&phy->dev->mt76.mutex);
  
@@ -214,5 +217,5 @@
  		mutex_unlock(&phy->dev->mt76.mutex);
  		return -ENOSPC;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0105-mtk-mt76-mt7996-handle-mapping-for-hw-and-vif.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0093-mtk-mt76-mt7996-handle-mapping-for-hw-and-vif.patch
similarity index 86%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0105-mtk-mt76-mt7996-handle-mapping-for-hw-and-vif.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0093-mtk-mt76-mt7996-handle-mapping-for-hw-and-vif.patch
index 8848e51..fed2615 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0105-mtk-mt76-mt7996-handle-mapping-for-hw-and-vif.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0093-mtk-mt76-mt7996-handle-mapping-for-hw-and-vif.patch
@@ -1,7 +1,7 @@
-From 1172c92c354a6816dc112dae33ec473682f627a6 Mon Sep 17 00:00:00 2001
+From d1ceb708475e11cf159886d4c9e6ce78c4d3030d Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 8 Dec 2023 18:08:13 +0800
-Subject: [PATCH 105/199] mtk: mt76: mt7996: handle mapping for hw and vif
+Subject: [PATCH 093/223] mtk: mt76: mt7996: handle mapping for hw and vif
 
 We have several temporal workarounds for ieee80211_hw and mt76_phy
 mappings. For legacy MBSS cases, we also need a method to do the
@@ -37,10 +37,10 @@
  	ieee80211_tx_status_ext(hw, &status);
  	spin_unlock_bh(&dev->rx_lock);
 diff --git a/mac80211.c b/mac80211.c
-index bf7ead01..5f0c310f 100644
+index 03632279..b1af346a 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1509,7 +1509,7 @@ void mt76_wcid_cleanup(struct mt76_dev *dev, struct mt76_wcid *wcid)
+@@ -1546,7 +1546,7 @@ void mt76_wcid_cleanup(struct mt76_dev *dev, struct mt76_wcid *wcid)
  	spin_unlock_bh(&phy->tx_lock);
  
  	while ((skb = __skb_dequeue(&list)) != NULL) {
@@ -50,10 +50,10 @@
  	}
  }
 diff --git a/mt76.h b/mt76.h
-index f037284a..c51df8e5 100644
+index 9fa411cb..2dea07a3 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -554,6 +554,9 @@ struct mt76_driver_ops {
+@@ -567,6 +567,9 @@ struct mt76_driver_ops {
  
  	void (*sta_remove)(struct mt76_dev *dev, struct ieee80211_vif *vif,
  			   struct ieee80211_sta *sta);
@@ -63,7 +63,7 @@
  };
  
  struct mt76_channel_state {
-@@ -1588,14 +1591,21 @@ static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
+@@ -1602,14 +1605,21 @@ extern const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS];
  
  /* internal */
  static inline struct ieee80211_hw *
@@ -88,10 +88,10 @@
  }
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index c0c0df2f..5417e741 100644
+index f9aa0e57..a48e4f44 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2845,13 +2845,23 @@ static void mt7996_scan_check_sta(void *data, struct ieee80211_sta *sta)
+@@ -2857,13 +2857,23 @@ static void mt7996_scan_check_sta(void *data, struct ieee80211_sta *sta)
  void mt7996_scan_work(struct work_struct *work)
  {
  	struct mt7996_phy *phy = container_of(work, struct mt7996_phy, scan_work.work);
@@ -116,7 +116,7 @@
  	if (phy->scan_chan_idx >= req->n_channels) {
  		mt7996_scan_complete(phy, false);
  		mutex_unlock(&phy->dev->mt76.mutex);
-@@ -2911,3 +2921,15 @@ void mt7996_scan_work(struct work_struct *work)
+@@ -2923,3 +2933,15 @@ void mt7996_scan_work(struct work_struct *work)
  
  	ieee80211_queue_delayed_work(hw, &phy->scan_work, duration);
  }
@@ -133,7 +133,7 @@
 +	}
 +}
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 331dd4d4..1251213e 100644
+index 01c736a9..cabd5729 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -444,6 +444,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
@@ -145,10 +145,10 @@
  
  	ret = mt7996_add_bss_conf(phy, vif, &vif->bss_conf);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index bf7231cd..8a04035e 100644
+index edaf8814..e7ee970b 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2948,11 +2948,11 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+@@ -2955,11 +2955,11 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
  
  	if (changed & BSS_CHANGED_FILS_DISCOVERY) {
  		interval = conf->fils_discovery.max_interval;
@@ -163,22 +163,22 @@
  
  	if (!skb) {
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index b94155c4..58db5204 100644
+index 8ac1b12a..ee5ee5a5 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
-@@ -658,6 +658,7 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
- 		.sta_assoc = mt7996_mac_sta_assoc,
+@@ -659,6 +659,7 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
  		.sta_remove = mt7996_mac_sta_remove,
  		.update_survey = mt7996_update_channel,
+ 		// .set_channel = mt7996_set_channel,
 +		.get_hw = mt7996_get_hw,
  	};
  	struct mt7996_dev *dev;
  	struct mt76_dev *mdev;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index b7e623cb..3b24643a 100644
+index f83308de..9dd4d478 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -354,6 +354,7 @@ struct mt7996_vif {
+@@ -355,6 +355,7 @@ struct mt7996_vif {
  
  	struct mt7996_sta sta;
  	struct mt7996_dev *dev;
@@ -186,7 +186,7 @@
  
  	u8 master_link_id;
  	u8 group_mld_id;
-@@ -901,6 +902,8 @@ int mt7996_init_tx_queues(struct mt7996_phy *phy, int idx,
+@@ -905,6 +906,8 @@ int mt7996_init_tx_queues(struct mt7996_phy *phy, int idx,
  void mt7996_init_txpower(struct mt7996_phy *phy);
  int mt7996_txbf_init(struct mt7996_dev *dev);
  int mt7996_get_chip_sku(struct mt7996_dev *dev);
@@ -196,7 +196,7 @@
  void mt7996_coredump(struct mt7996_dev *dev, u8 state);
  int mt7996_run(struct ieee80211_hw *hw);
 diff --git a/tx.c b/tx.c
-index e2795067..6580833e 100644
+index a78ab2c8..95c84dab 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -76,7 +76,7 @@ mt76_tx_status_unlock(struct mt76_dev *dev, struct sk_buff_head *list)
@@ -218,5 +218,5 @@
  		if (status.sta && (wcid->rate.flags || wcid->rate.legacy)) {
  			rs.rate_idx = wcid->rate;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0106-mtk-mt76-mt7996-rework-scanning-parts-for-MLD-STA-su.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0094-mtk-mt76-mt7996-rework-scanning-parts-for-MLD-STA-su.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0106-mtk-mt76-mt7996-rework-scanning-parts-for-MLD-STA-su.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0094-mtk-mt76-mt7996-rework-scanning-parts-for-MLD-STA-su.patch
index 99899b8..8dc2209 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0106-mtk-mt76-mt7996-rework-scanning-parts-for-MLD-STA-su.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0094-mtk-mt76-mt7996-rework-scanning-parts-for-MLD-STA-su.patch
@@ -1,7 +1,7 @@
-From b05defbe38b85f93a74c115830c06d975c8cb67e Mon Sep 17 00:00:00 2001
+From 2dd9be1a2d916ec0ca58ec933f55154db6a40bf9 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 13 Dec 2023 16:58:31 +0800
-Subject: [PATCH 106/199] mtk: mt76: mt7996: rework scanning parts for MLD STA
+Subject: [PATCH 094/223] mtk: mt76: mt7996: rework scanning parts for MLD STA
  support
 
 During the first scanning, the STA VIF is still a legacy interface,
@@ -9,6 +9,7 @@
 here to let the legacy interface be abled to scan all bands.
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
+Change-Id: Iff7f98918eb52e9510eaa9b55e2fa769f8b7039d
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mt7996/mac.c  | 44 +++++++++++++++++++++++---------------------
@@ -16,10 +17,10 @@
  2 files changed, 57 insertions(+), 22 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 5417e741..36d2e0b3 100644
+index a48e4f44..a30b7dfa 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2769,23 +2769,40 @@ static void
+@@ -2781,23 +2781,40 @@ static void
  mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
  		       const u8 *dst)
  {
@@ -63,7 +64,7 @@
  
  	if (is_unicast_ether_addr(dst)) {
  		struct ieee80211_hdr_3addr *hdr =
-@@ -2803,36 +2820,21 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
+@@ -2815,36 +2832,21 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
  
  	skb_set_queue_mapping(skb, IEEE80211_AC_VO);
  
@@ -104,10 +105,10 @@
  {
  	bool *has_sta = data;
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 1251213e..9c5e31b7 100644
+index cabd5729..9ce7c6fb 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -2189,12 +2189,28 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -2193,12 +2193,28 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  
  #endif
  
@@ -136,7 +137,7 @@
  
  	mutex_lock(&phy->dev->mt76.mutex);
  	if (WARN_ON(phy->scan_req || phy->scan_chan)) {
-@@ -2202,10 +2218,23 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2206,10 +2222,23 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		return -EBUSY;
  	}
  
@@ -161,7 +162,7 @@
  	mutex_unlock(&phy->dev->mt76.mutex);
  
  	ieee80211_queue_delayed_work(mt76_main_hw(phy->mt76), &phy->scan_work, 0);
-@@ -2216,6 +2245,7 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2220,6 +2249,7 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  static void
  mt7996_cancel_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
  {
@@ -169,7 +170,7 @@
  	int band;
  
  	for (band = 0; band < NUM_NL80211_BANDS; band++) {
-@@ -2233,6 +2263,9 @@ mt7996_cancel_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+@@ -2237,6 +2267,9 @@ mt7996_cancel_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
  
  		mutex_lock(&phy->dev->mt76.mutex);
  		mt7996_scan_complete(phy, true);
@@ -180,5 +181,5 @@
  	}
  }
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0107-mtk-mt76-mt7996-implement-mld-address-translation.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0095-mtk-mt76-mt7996-implement-mld-address-translation.patch
similarity index 90%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0107-mtk-mt76-mt7996-implement-mld-address-translation.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0095-mtk-mt76-mt7996-implement-mld-address-translation.patch
index 0062ff5..0045fb2 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0107-mtk-mt76-mt7996-implement-mld-address-translation.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0095-mtk-mt76-mt7996-implement-mld-address-translation.patch
@@ -1,7 +1,7 @@
-From b864635477ddfa6095f9268c94e4ab9410c51f43 Mon Sep 17 00:00:00 2001
+From e5e8751f543d8558637b4b8438f1f2f518effc2b Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 7 Dec 2023 16:31:56 +0800
-Subject: [PATCH 107/199] mtk: mt76: mt7996: implement mld address translation
+Subject: [PATCH 095/223] mtk: mt76: mt7996: implement mld address translation
 
 Do the MLD to link address translation for EAPOL and management frames
 in driver.
@@ -18,10 +18,10 @@
  2 files changed, 66 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 36d2e0b3..a306ad71 100644
+index a30b7dfa..9c256655 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -898,6 +898,26 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -910,6 +910,26 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key,
  				      pid, qid, 0);
  
@@ -49,10 +49,10 @@
  	for (i = 0; i < nbuf; i++) {
  		u16 len;
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 9c5e31b7..d897a361 100644
+index 9ce7c6fb..75e571b0 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -1312,14 +1312,56 @@ static void mt7996_tx(struct ieee80211_hw *hw,
+@@ -1316,14 +1316,56 @@ static void mt7996_tx(struct ieee80211_hw *hw,
  
  	rcu_read_lock();
  	if (mvif && msta) {
@@ -112,7 +112,7 @@
  
  		mconf = rcu_dereference(mvif->link[link_id]);
  		mlink = rcu_dereference(msta->link[link_id]);
-@@ -1337,6 +1379,7 @@ static void mt7996_tx(struct ieee80211_hw *hw,
+@@ -1341,6 +1383,7 @@ static void mt7996_tx(struct ieee80211_hw *hw,
  	}
  
  	mt76_tx(mphy, control->sta, wcid, skb);
@@ -121,5 +121,5 @@
  }
  
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0108-mtk-mt76-mt7996-use-BSS_CHANGED_TXPOWER-for-txpower-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0096-mtk-mt76-mt7996-use-BSS_CHANGED_TXPOWER-for-txpower-.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0108-mtk-mt76-mt7996-use-BSS_CHANGED_TXPOWER-for-txpower-.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0096-mtk-mt76-mt7996-use-BSS_CHANGED_TXPOWER-for-txpower-.patch
index 624ea79..455160b 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0108-mtk-mt76-mt7996-use-BSS_CHANGED_TXPOWER-for-txpower-.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0096-mtk-mt76-mt7996-use-BSS_CHANGED_TXPOWER-for-txpower-.patch
@@ -1,7 +1,7 @@
-From f0996fb23e5b67edf0e25d31c90f938b7c9759c6 Mon Sep 17 00:00:00 2001
+From bb16725ec128a46c3205d1cb67f152799bc58bb6 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 27 Feb 2024 18:07:11 +0800
-Subject: [PATCH 108/199] mtk: mt76: mt7996: use BSS_CHANGED_TXPOWER for
+Subject: [PATCH 096/223] mtk: mt76: mt7996: use BSS_CHANGED_TXPOWER for
  txpower setting
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
@@ -15,7 +15,7 @@
  4 files changed, 9 insertions(+), 13 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index d897a361..fd0df974 100644
+index 75e571b0..5c2bc2b0 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -665,14 +665,6 @@ static int mt7996_config(struct ieee80211_hw *hw, u32 changed)
@@ -43,7 +43,7 @@
  out:
  	mutex_unlock(&dev->mt76.mutex);
  }
-@@ -1611,7 +1606,6 @@ mt7996_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
+@@ -1615,7 +1610,6 @@ mt7996_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
  	mt76_set_stream_caps(phy->mt76, true);
  	mt7996_set_stream_vht_txbf_caps(phy);
  	mt7996_set_stream_he_eht_caps(phy);
@@ -52,10 +52,10 @@
  	mutex_unlock(&dev->mt76.mutex);
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 8a04035e..bf128637 100644
+index e7ee970b..d9edba0c 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -5310,7 +5310,8 @@ mt7996_update_max_txpower_cur(struct mt7996_phy *phy, int tx_power)
+@@ -5336,7 +5336,8 @@ mt7996_update_max_txpower_cur(struct mt7996_phy *phy, int tx_power)
  		mphy->txpower_cur = e2p_power_limit;
  }
  
@@ -65,7 +65,7 @@
  {
  #define TX_POWER_LIMIT_TABLE_RATE	0
  #define TX_POWER_LIMIT_TABLE_PATH	1
-@@ -5339,7 +5340,7 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
+@@ -5365,7 +5366,7 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
  
  	if (hw->conf.power_level == INT_MIN)
  		hw->conf.power_level = 127;
@@ -75,10 +75,10 @@
  	if (phy->sku_limit_en) {
  		txpower_limit = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 3b24643a..fbb85177 100644
+index 9dd4d478..ba954623 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -980,7 +980,8 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch);
+@@ -984,7 +984,8 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch);
  int mt7996_mcu_get_temperature(struct mt7996_phy *phy);
  int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state);
  int mt7996_mcu_set_thermal_protect(struct mt7996_phy *phy, bool enable);
@@ -89,10 +89,10 @@
  		       u8 rx_sel, u8 val);
  int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev,
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index ba17f947..0565ebc9 100644
+index be224373..799e443c 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -1830,7 +1830,7 @@ mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
+@@ -1834,7 +1834,7 @@ mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
  		mt7996_tm_update_channel(phy);
  		mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(SKU_POWER_LIMIT), td->sku_en);
  		mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(BACKOFF_POWER_LIMIT), td->sku_en);
@@ -102,5 +102,5 @@
  	if (changed & BIT(TM_CHANGED_TX_LENGTH)) {
  		mt7996_tm_set(dev, SET_ID(TX_LEN), td->tx_mpdu_len);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0109-mtk-mt76-mt7996-temp-support-for-single-wiphy.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0097-mtk-mt76-mt7996-temp-support-for-single-wiphy.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0109-mtk-mt76-mt7996-temp-support-for-single-wiphy.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0097-mtk-mt76-mt7996-temp-support-for-single-wiphy.patch
index 1f5c5df..ee07409 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0109-mtk-mt76-mt7996-temp-support-for-single-wiphy.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0097-mtk-mt76-mt7996-temp-support-for-single-wiphy.patch
@@ -1,11 +1,12 @@
-From dd73bdd0c88aa8f1fcf133d903d257286911047c Mon Sep 17 00:00:00 2001
+From 0764c048b72deb7ee2f988a4c6f708c661182f81 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 28 Mar 2024 18:50:04 +0800
-Subject: [PATCH 109/199] mtk: mt76: mt7996: temp support for single wiphy
+Subject: [PATCH 097/223] mtk: mt76: mt7996: temp support for single wiphy
 
 Add temporal single wiphy for simultaneously supporting MLD and legacy
 interfaces.
 
+Change-Id: I21cda8d1e35aff924aa028d2554ae966be263717
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mac80211.c      |  9 -----
@@ -18,7 +19,7 @@
  7 files changed, 86 insertions(+), 80 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 5f0c310f..bc463437 100644
+index b1af346a..a98fe4fb 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -823,13 +823,9 @@ EXPORT_SYMBOL_GPL(mt76_has_tx_pending);
@@ -48,10 +49,10 @@
  }
  EXPORT_SYMBOL_GPL(mt76_channel_state);
 diff --git a/mt76.h b/mt76.h
-index c51df8e5..b1f22e6a 100644
+index 2dea07a3..b65a6b0a 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -831,8 +831,8 @@ struct mt76_vif {
+@@ -845,8 +845,8 @@ struct mt76_vif {
  
  struct mt76_phy {
  	struct ieee80211_hw *hw;
@@ -61,7 +62,7 @@
  	void *priv;
  
  	unsigned long state;
-@@ -1312,15 +1312,6 @@ mt76_phy_hw(struct mt76_dev *dev, u8 phy_idx)
+@@ -1325,15 +1325,6 @@ mt76_phy_hw(struct mt76_dev *dev, u8 phy_idx)
  	return mt76_dev_phy(dev, phy_idx)->hw;
  }
  
@@ -78,10 +79,10 @@
  mt76_get_txwi_ptr(struct mt76_dev *dev, struct mt76_txwi_cache *t)
  {
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index cd93a3c2..c4714982 100644
+index 8272ead2..f9bd4d91 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -390,12 +390,6 @@ static int mt7996_eeprom_parse_band_config(struct mt7996_phy *phy)
+@@ -422,12 +422,6 @@ static int mt7996_eeprom_parse_band_config(struct mt7996_phy *phy)
  		break;
  	}
  
@@ -95,7 +96,7 @@
  }
  
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 2fe869c9..f75aa568 100644
+index cedadefc..f26687df 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -19,13 +19,13 @@ static const struct ieee80211_iface_limit if_limits[] = {
@@ -153,7 +154,7 @@
  	mt7996_unregister_thermal(phy);
  
  	mphy = phy->dev->mt76.phys[band];
-@@ -1677,6 +1684,12 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1697,6 +1704,12 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -166,7 +167,7 @@
  	ieee80211_queue_work(mt76_hw(dev), &dev->init_work);
  
  	dev->recovery.hw_init_done = true;
-@@ -1706,11 +1719,11 @@ error:
+@@ -1726,11 +1739,11 @@ error:
  void mt7996_unregister_device(struct mt7996_dev *dev)
  {
  	cancel_work_sync(&dev->wed_rro.work);
@@ -181,10 +182,10 @@
  	mt7996_mcu_exit(dev);
  	mt7996_tx_token_put(dev);
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index a306ad71..24df5bb5 100644
+index 9c256655..f5725b3c 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2402,10 +2402,7 @@ void mt7996_mac_work(struct work_struct *work)
+@@ -2414,10 +2414,7 @@ void mt7996_mac_work(struct work_struct *work)
  
  	mt76_tx_status_check(mdev, false);
  
@@ -197,7 +198,7 @@
  }
  
 diff --git a/mt7996/main.c b/mt7996/main.c
-index fd0df974..7424bebf 100644
+index 5c2bc2b0..d9cd7df1 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -140,6 +140,10 @@ static int mt7996_start(struct ieee80211_hw *hw)
@@ -211,7 +212,7 @@
  	flush_work(&dev->init_work);
  
  	mutex_lock(&dev->mt76.mutex);
-@@ -154,6 +158,10 @@ static void mt7996_stop(struct ieee80211_hw *hw)
+@@ -154,6 +158,10 @@ static void mt7996_stop(struct ieee80211_hw *hw, bool suspend)
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	int band;
  
@@ -222,7 +223,7 @@
  	cancel_delayed_work_sync(&dev->scs_work);
  
  	for (band = 0; band < NUM_NL80211_BANDS; band++) {
-@@ -173,7 +181,6 @@ static void mt7996_stop(struct ieee80211_hw *hw)
+@@ -173,7 +181,6 @@ static void mt7996_stop(struct ieee80211_hw *hw, bool suspend)
  		mutex_lock(&dev->mt76.mutex);
  		mt7996_mcu_set_radio_en(phy, false);
  		clear_bit(MT76_STATE_RUNNING, &phy->mt76->state);
@@ -302,7 +303,7 @@
  		tmp->rxfilter = phy->rxfilter;
  		mt76_wr(dev, MT_WF_RFCR(tmp->mt76->band_idx), phy->rxfilter);
  
-@@ -1580,9 +1588,11 @@ static int
+@@ -1584,9 +1592,11 @@ static int
  mt7996_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
  {
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
@@ -317,7 +318,7 @@
  
  	if (!tx_ant || tx_ant != rx_ant || ffs(tx_ant) > max_nss)
  		return -EINVAL;
-@@ -1592,20 +1602,34 @@ mt7996_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
+@@ -1596,20 +1606,34 @@ mt7996_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
  
  	mutex_lock(&dev->mt76.mutex);
  
@@ -364,7 +365,7 @@
  
  	mutex_unlock(&dev->mt76.mutex);
  
-@@ -2261,7 +2285,7 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2265,7 +2289,7 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  	if (vif->type == NL80211_IFTYPE_STATION && !ieee80211_vif_is_mld(vif) &&
  	    (phy->mt76 != mvif->deflink.phy->mt76)) {
@@ -373,7 +374,7 @@
  		mt7996_remove_bss_conf(vif, &vif->bss_conf, &mvif->deflink);
  
  		ret = mt7996_add_bss_conf(phy, vif, &vif->bss_conf);
-@@ -2274,7 +2298,7 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2278,7 +2302,7 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	set_bit(MT76_SCANNING, &phy->mt76->state);
  	mutex_unlock(&phy->dev->mt76.mutex);
  
@@ -382,7 +383,7 @@
  
  	return 0;
  }
-@@ -2282,7 +2306,7 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2286,7 +2310,7 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  static void
  mt7996_cancel_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
  {
@@ -391,7 +392,7 @@
  	int band;
  
  	for (band = 0; band < NUM_NL80211_BANDS; band++) {
-@@ -2292,17 +2316,16 @@ mt7996_cancel_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+@@ -2296,17 +2320,16 @@ mt7996_cancel_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
  			continue;
  
  		phy = mt7996_band_phy(hw, band);
@@ -413,7 +414,7 @@
  		mutex_unlock(&phy->dev->mt76.mutex);
  	}
  }
-@@ -2317,7 +2340,6 @@ mt7996_add_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *conf)
+@@ -2321,7 +2344,6 @@ mt7996_add_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *conf)
  	wiphy_info(hw->wiphy, "%s: add %u\n", __func__, conf->def.chan->hw_value);
  	mutex_lock(&phy->dev->mt76.mutex);
  
@@ -422,10 +423,10 @@
  		mutex_unlock(&phy->dev->mt76.mutex);
  		return -ENOSPC;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index fbb85177..9a47ad04 100644
+index ba954623..66908ad2 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -795,21 +795,19 @@ mt7996_get_background_radar_cap(struct mt7996_dev *dev)
+@@ -799,21 +799,19 @@ mt7996_has_background_radar(struct mt7996_dev *dev)
  static inline struct mt7996_phy *
  mt7996_band_phy(struct ieee80211_hw *hw, enum nl80211_band band)
  {
@@ -454,5 +455,5 @@
  	return phy->priv;
  }
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0110-mtk-mt76-mt7996-implement-ieee80211_ops-for-link-deb.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0098-mtk-mt76-mt7996-implement-ieee80211_ops-for-link-deb.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0110-mtk-mt76-mt7996-implement-ieee80211_ops-for-link-deb.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0098-mtk-mt76-mt7996-implement-ieee80211_ops-for-link-deb.patch
index 718b6e8..3023032 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0110-mtk-mt76-mt7996-implement-ieee80211_ops-for-link-deb.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0098-mtk-mt76-mt7996-implement-ieee80211_ops-for-link-deb.patch
@@ -1,7 +1,7 @@
-From 4ac5eeaefbbc6353b211d703e83ebfdc98c9bc9b Mon Sep 17 00:00:00 2001
+From 063ce389fe9a412cb67f97ca6d0d5143dddb22ca Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 29 Dec 2023 18:37:41 +0800
-Subject: [PATCH 110/199] mtk: mt76: mt7996: implement ieee80211_ops for link
+Subject: [PATCH 098/223] mtk: mt76: mt7996: implement ieee80211_ops for link
  debugfs
 
 Add .link_sta_add_debugfs and .link_add_debugfs for per-link STA and BSS
@@ -18,7 +18,7 @@
  5 files changed, 214 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 62658dbc..fe8fea5d 100644
+index 786bdc38..ab8732dd 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -1294,4 +1294,205 @@ void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -228,10 +228,10 @@
 +}
  #endif
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 24df5bb5..3b3aa01b 100644
+index f5725b3c..b8cf557b 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2378,10 +2378,10 @@ void mt7996_mac_work(struct work_struct *work)
+@@ -2390,10 +2390,10 @@ void mt7996_mac_work(struct work_struct *work)
  				mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_RATE);
  				mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_AIRTIME);
  				mt7996_mcu_get_rssi(mdev);
@@ -245,10 +245,10 @@
  				if (mt7996_mcu_wa_cmd(phy->dev, MCU_WA_PARAM_CMD(QUERY), MCU_WA_PARAM_BSS_ACQ_PKT_CNT,
  				                      BSS_ACQ_PKT_CNT_BSS_BITMAP_ALL | BSS_ACQ_PKT_CNT_READ_CLR, 0))
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 7424bebf..17f4901f 100644
+index d9cd7df1..fe5bfd72 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -2625,6 +2625,8 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -2629,6 +2629,8 @@ const struct ieee80211_ops mt7996_ops = {
  	CFG80211_TESTMODE_DUMP(mt76_testmode_dump)
  #ifdef CONFIG_MAC80211_DEBUGFS
  	.sta_add_debugfs = mt7996_sta_add_debugfs,
@@ -258,10 +258,10 @@
  	.set_radar_background = mt7996_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index bf128637..2884af9d 100644
+index d9edba0c..9359a251 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -616,8 +616,10 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -621,8 +621,10 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  			wcid->stats.tx_packets += tx_packets;
  			wcid->stats.rx_packets += rx_packets;
  
@@ -275,10 +275,10 @@
  		case UNI_ALL_STA_TXRX_AIRTIME:
  			wlan_idx = le16_to_cpu(res->airtime[i].wlan_idx);
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 9a47ad04..294c46f6 100644
+index 66908ad2..c94853f2 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1142,6 +1142,11 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
+@@ -1146,6 +1146,11 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
  #ifdef CONFIG_MAC80211_DEBUGFS
  void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
@@ -291,5 +291,5 @@
  int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  			 bool hif2, int *irq);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0111-mtk-mt76-mt7996-support-multi-link-channel-switch.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0099-mtk-mt76-mt7996-support-multi-link-channel-switch.patch
similarity index 83%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0111-mtk-mt76-mt7996-support-multi-link-channel-switch.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0099-mtk-mt76-mt7996-support-multi-link-channel-switch.patch
index 3f696d9..a58349a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0111-mtk-mt76-mt7996-support-multi-link-channel-switch.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0099-mtk-mt76-mt7996-support-multi-link-channel-switch.patch
@@ -1,7 +1,7 @@
-From 56f1336c11dd0627e8e79951c16713cc35463733 Mon Sep 17 00:00:00 2001
+From 70a14f12eef8b505890f654876a7f89432070bbf Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 19 Jan 2024 14:04:03 +0800
-Subject: [PATCH 111/199] mtk: mt76: mt7996: support multi-link channel switch
+Subject: [PATCH 099/223] mtk: mt76: mt7996: support multi-link channel switch
 
 mtk: wifi: mt76: mt7996: remove the limitation of radar detect width for mlo
 
@@ -27,10 +27,10 @@
  4 files changed, 22 insertions(+), 7 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index bc463437..5e4935f2 100644
+index a98fe4fb..a2b111c0 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1787,7 +1787,7 @@ enum mt76_dfs_state mt76_phy_dfs_state(struct mt76_phy *phy)
+@@ -1801,7 +1801,7 @@ enum mt76_dfs_state mt76_phy_dfs_state(struct mt76_phy *phy)
  	    test_bit(MT76_SCANNING, &phy->state))
  		return MT_DFS_STATE_DISABLED;
  
@@ -40,10 +40,10 @@
  		    (phy->chandef.chan->flags & IEEE80211_CHAN_RADAR))
  			return MT_DFS_STATE_ACTIVE;
 diff --git a/mt76.h b/mt76.h
-index b1f22e6a..c6dda4a8 100644
+index b65a6b0a..bc263bd4 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -847,6 +847,7 @@ struct mt76_phy {
+@@ -862,6 +862,7 @@ struct mt76_phy {
  
  	struct mt76_channel_state *chan_state;
  	enum mt76_dfs_state dfs_state;
@@ -52,10 +52,10 @@
  
  	u32 aggr_stats[32];
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 17f4901f..7012aa96 100644
+index fe5bfd72..e3f30b23 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -2139,7 +2139,7 @@ static int
+@@ -2143,7 +2143,7 @@ static int
  mt7996_set_radar_background(struct ieee80211_hw *hw,
  			    struct cfg80211_chan_def *chandef)
  {
@@ -64,7 +64,7 @@
  	struct mt7996_dev *dev = phy->dev;
  	int ret = -EINVAL;
  	bool running;
-@@ -2354,6 +2354,7 @@ mt7996_add_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *conf)
+@@ -2358,6 +2358,7 @@ mt7996_add_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *conf)
  	}
  
  	phy->chanctx = ctx;
@@ -72,7 +72,7 @@
  	mutex_unlock(&phy->dev->mt76.mutex);
  
  	if (!mt76_testmode_enabled(phy->mt76) && !phy->mt76->test.bf_en) {
-@@ -2381,8 +2382,10 @@ mt7996_remove_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *co
+@@ -2385,8 +2386,10 @@ mt7996_remove_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *co
  
  	mutex_lock(&phy->dev->mt76.mutex);
  	ctx->assigned = false;
@@ -84,7 +84,7 @@
  	mutex_unlock(&phy->dev->mt76.mutex);
  }
  
-@@ -2394,8 +2397,10 @@ mt7996_change_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *co
+@@ -2398,8 +2401,10 @@ mt7996_change_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *co
  	struct mt7996_phy *phy = ctx->phy;
  
  	wiphy_info(hw->wiphy, "%s: change %u, 0x%x\n", __func__, conf->def.chan->hw_value, changed);
@@ -96,7 +96,7 @@
  
  		mt7996_set_channel(phy, &ctx->chandef);
  	}
-@@ -2493,6 +2498,7 @@ mt7996_switch_vif_chanctx(struct ieee80211_hw *hw,
+@@ -2497,6 +2502,7 @@ mt7996_switch_vif_chanctx(struct ieee80211_hw *hw,
  	mutex_lock(&phy->dev->mt76.mutex);
  
  	phy->chanctx = new_ctx;
@@ -105,10 +105,10 @@
  	new_ctx->chandef = vifs->new_ctx->def;
  	new_ctx->phy = phy;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 2884af9d..7b0d631e 100644
+index 9359a251..d897098e 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -357,10 +357,18 @@ int mt7996_mcu_wa_cmd(struct mt7996_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
+@@ -362,10 +362,18 @@ int mt7996_mcu_wa_cmd(struct mt7996_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
  static void
  mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -129,7 +129,7 @@
  }
  
  static void
-@@ -475,7 +483,7 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -480,7 +488,7 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
  		case UNI_EVENT_IE_COUNTDOWN_CSA:
  			ieee80211_iterate_active_interfaces_atomic(mphy->hw,
  					IEEE80211_IFACE_ITER_RESUME_ALL,
@@ -139,5 +139,5 @@
  		case UNI_EVENT_IE_COUNTDOWN_BCC:
  			ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0112-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0100-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch
similarity index 87%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0112-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0100-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch
index a9b41f9..d5ed3fd 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0112-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0100-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch
@@ -1,7 +1,7 @@
-From 43de0e905d116dc16cf7cacadeddcc352695913d Mon Sep 17 00:00:00 2001
+From 8e4e5598fe8695f1234e35849916b1a3fcc862f5 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Thu, 22 Feb 2024 11:09:10 +0800
-Subject: [PATCH 112/199] mtk: mt76: mt7996: ACS channel time too long on duty
+Subject: [PATCH 100/223] mtk: mt76: mt7996: ACS channel time too long on duty
  channel
 
 This problem happens in SW scan and was already fixed.
@@ -15,7 +15,7 @@
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 7012aa96..c4eba315 100644
+index e3f30b23..6fad94b8 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -499,6 +499,7 @@ static void ___mt7996_set_channel(struct mt7996_phy *phy,
@@ -36,5 +36,5 @@
  }
  
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0113-mtk-mt76-mt7996-add-beacon-monitoring-in-driver-for-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0101-mtk-mt76-mt7996-add-beacon-monitoring-in-driver-for-.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0113-mtk-mt76-mt7996-add-beacon-monitoring-in-driver-for-.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0101-mtk-mt76-mt7996-add-beacon-monitoring-in-driver-for-.patch
index 3989bb4..66d8cff 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0113-mtk-mt76-mt7996-add-beacon-monitoring-in-driver-for-.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0101-mtk-mt76-mt7996-add-beacon-monitoring-in-driver-for-.patch
@@ -1,7 +1,7 @@
-From c3e35c17c5b42dd2332864d6bed15398f47d76eb Mon Sep 17 00:00:00 2001
+From cad5f671fef13c087e4e38058944cac48fecf479 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 20 Feb 2024 10:08:01 +0800
-Subject: [PATCH 113/199] mtk: mt76: mt7996: add beacon monitoring in driver
+Subject: [PATCH 101/223] mtk: mt76: mt7996: add beacon monitoring in driver
  for mlo
 
 Add beacon monitoring in driver since mac80211 does not
@@ -27,6 +27,9 @@
 5. Add address sanity check before sending nullfunc.
 6. Add cancel_delayed_work in more place.
 
+Change-Id: I52211987abd6309bbb23dc648af3f377adf8982a
+Change-Id: I3e79716609e8a8a53199e8558c07711df2f4bd47
+Change-Id: Ifff48bc6d64050dce29da19461933a13bc99b255
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mt7996/mac.c    | 217 +++++++++++++++++++++++++++++++++++++++++++++++-
@@ -35,7 +38,7 @@
  3 files changed, 290 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 3b3aa01b..803f7ce3 100644
+index b8cf557b..1cf84fe5 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -559,6 +559,32 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
@@ -69,9 +72,9 @@
 +				}
 +			}
  		}
- #ifdef CONFIG_MTK_VENDOR
- 		if (phy->amnt_ctrl.enable && !ieee80211_is_beacon(fc))
-@@ -709,7 +735,8 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
+ 		skb_set_mac_header(skb, (unsigned char *)hdr - skb->data);
+ 
+@@ -721,7 +747,8 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
  	}
  
  	if (ieee80211_vif_is_mld(info->control.vif) &&
@@ -81,7 +84,7 @@
  		txwi[5] |= cpu_to_le32(MT_TXD5_FL);
  }
  
-@@ -1194,6 +1221,10 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
+@@ -1206,6 +1233,10 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
  	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) == 0) {
  		skb = mt76_tx_status_skb_get(mdev, wcid, pid, &list);
  		if (skb) {
@@ -92,7 +95,7 @@
  			info = IEEE80211_SKB_CB(skb);
  			if (!(txs & MT_TXS0_ACK_ERROR_MASK))
  				info->flags |= IEEE80211_TX_STAT_ACK;
-@@ -1203,6 +1234,18 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
+@@ -1215,6 +1246,18 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
  				!!(info->flags & IEEE80211_TX_STAT_ACK);
  
  			info->status.rates[0].idx = -1;
@@ -111,7 +114,7 @@
  		}
  	}
  
-@@ -2941,6 +2984,178 @@ void mt7996_scan_work(struct work_struct *work)
+@@ -2953,6 +2996,178 @@ void mt7996_scan_work(struct work_struct *work)
  	ieee80211_queue_delayed_work(hw, &phy->scan_work, duration);
  }
  
@@ -291,7 +294,7 @@
  		   struct ieee80211_hw **hw)
  {
 diff --git a/mt7996/main.c b/mt7996/main.c
-index c4eba315..155318b3 100644
+index 6fad94b8..67948343 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -452,6 +452,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
@@ -320,7 +323,7 @@
  	for_each_set_bit(link_id, &rem, IEEE80211_MLD_MAX_NUM_LINKS) {
  		struct mt7996_bss_conf *mconf =
  			mconf_dereference_protected(mvif, link_id);
-@@ -2584,6 +2589,61 @@ out:
+@@ -2588,6 +2593,61 @@ out:
  	return ret;
  }
  
@@ -382,7 +385,7 @@
  const struct ieee80211_ops mt7996_ops = {
  	.add_chanctx = ieee80211_emulate_add_chanctx,
  	.remove_chanctx = ieee80211_emulate_remove_chanctx,
-@@ -2640,6 +2700,7 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -2644,6 +2704,7 @@ const struct ieee80211_ops mt7996_ops = {
  	.net_fill_forward_path = mt7996_net_fill_forward_path,
  	.net_setup_tc = mt76_wed_net_setup_tc,
  #endif
@@ -391,10 +394,10 @@
  	.remove_chanctx = mt7996_remove_chanctx,
  	.change_chanctx = mt7996_change_chanctx,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 294c46f6..40ee8949 100644
+index c94853f2..2a638a4a 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -129,6 +129,10 @@
+@@ -131,6 +131,10 @@
  
  #define to_rssi(field, rcpi)	((FIELD_GET(field, rcpi) - 220) / 2)
  
@@ -405,7 +408,7 @@
  struct mt7996_vif;
  struct mt7996_sta;
  struct mt7996_dfs_pulse;
-@@ -361,6 +365,14 @@ struct mt7996_vif {
+@@ -362,6 +366,14 @@ struct mt7996_vif {
  	u8 mld_remap_id;
  
  	u8 band_to_link[__MT_MAX_BAND];
@@ -420,7 +423,7 @@
  };
  
  /* crash-dump */
-@@ -1117,6 +1129,7 @@ bool mt7996_rx_check(struct mt76_dev *mdev, void *data, int len);
+@@ -1121,6 +1133,7 @@ bool mt7996_rx_check(struct mt76_dev *mdev, void *data, int len);
  void mt7996_stats_work(struct work_struct *work);
  void mt7996_scan_work(struct work_struct *work);
  void mt7996_scan_complete(struct mt7996_phy *phy, bool aborted);
@@ -429,5 +432,5 @@
  int mt7996_dfs_init_radar_detector(struct mt7996_phy *phy);
  void mt7996_set_stream_he_eht_caps(struct mt7996_phy *phy);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0114-mtk-mt76-mt7996-support-band_idx-option-for-set_mu-g.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0102-mtk-mt76-mt7996-support-band_idx-option-for-set_mu-g.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0114-mtk-mt76-mt7996-support-band_idx-option-for-set_mu-g.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0102-mtk-mt76-mt7996-support-band_idx-option-for-set_mu-g.patch
index 014431b..95329b4 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0114-mtk-mt76-mt7996-support-band_idx-option-for-set_mu-g.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0102-mtk-mt76-mt7996-support-band_idx-option-for-set_mu-g.patch
@@ -1,12 +1,13 @@
-From efb6ebd878b7926828f0315622fcbdf98abe6b6b Mon Sep 17 00:00:00 2001
+From 7b4305017b499ad805701f6022ed92b1e5746aa2 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 4 Mar 2024 16:21:16 +0800
-Subject: [PATCH 114/199] mtk: mt76: mt7996: support band_idx option for
+Subject: [PATCH 102/223] mtk: mt76: mt7996: support band_idx option for
  set_mu/get_mu vendor command
 
 The vendor command set_mu and get_mu should be executed with band_idx.
 With band_idx, driver can access the corrsponding phy by band_idx.
 
+Change-Id: Id33d5efd3752e767fc11e852836d9939e4d6a088
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
  mt7996/mcu.c    | 26 +++++++++++++++++++-------
@@ -16,10 +17,10 @@
  4 files changed, 56 insertions(+), 12 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 7b0d631e..598f32ba 100644
+index d897098e..48837d41 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -5838,12 +5838,23 @@ int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy)
+@@ -5864,12 +5864,23 @@ int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy)
  #ifdef CONFIG_MTK_VENDOR
  void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -45,7 +46,7 @@
  
  	switch (mode) {
  	case RATE_PARAM_FIXED_OFDMA:
-@@ -5859,13 +5870,14 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -5885,13 +5896,14 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  			phy->muru_onoff |= MUMIMO_UL;
  		break;
  	case RATE_PARAM_AUTO_MU:
@@ -174,5 +175,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_MU_CTRL,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0115-mtk-mt76-mt7996-tmp-disable-VOW.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0103-mtk-mt76-mt7996-tmp-disable-VOW.patch
similarity index 76%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0115-mtk-mt76-mt7996-tmp-disable-VOW.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0103-mtk-mt76-mt7996-tmp-disable-VOW.patch
index dfb76e0..6682f9b 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0115-mtk-mt76-mt7996-tmp-disable-VOW.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0103-mtk-mt76-mt7996-tmp-disable-VOW.patch
@@ -1,7 +1,7 @@
-From 3ba122ebb3462395d26d4f8f55dab510a49f5b5e Mon Sep 17 00:00:00 2001
+From ab265243158a3d44bd5c0a55d0e92bd6decbb3e2 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 20 Mar 2024 22:56:44 +0800
-Subject: [PATCH 115/199] mtk: mt76: mt7996: tmp disable VOW
+Subject: [PATCH 103/223] mtk: mt76: mt7996: tmp disable VOW
 
 FW will return failed when legacy 5G station connects after legacy 2G
 station, need to check.
@@ -12,10 +12,10 @@
  1 file changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 598f32ba..340b6637 100644
+index 48837d41..54b0272c 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2369,6 +2369,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+@@ -2374,6 +2374,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  	return mt7996_mcu_add_rate_ctrl_fixed(dev, conf, mconf, link_sta, mlink);
  }
  
@@ -23,7 +23,7 @@
  static int
  mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf,
  			struct mt7996_link_sta *mlink)
-@@ -2402,6 +2403,7 @@ mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf,
+@@ -2407,6 +2408,7 @@ mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf,
  
  	return mt7996_mcu_set_vow_drr_ctrl(phy, mconf, mlink, VOW_DRR_CTRL_STA_ALL);
  }
@@ -31,16 +31,16 @@
  
  int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  		       struct mt7996_bss_conf *mconf,
-@@ -2410,7 +2412,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
- {
+@@ -2416,7 +2418,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  	struct ieee80211_vif *vif = conf->vif;
  	struct sk_buff *skb;
+ 	int conn_state;
 -	int ret;
 +	// int ret;
  
  	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
  					      &mlink->wcid,
-@@ -2456,11 +2458,13 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+@@ -2463,11 +2465,13 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  		mt7996_mcu_sta_bfee_tlv(dev, skb, conf, mconf, link_sta);
  	}
  
@@ -55,5 +55,5 @@
  	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
  				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0116-mtk-mt76-mt7996-enable-ampdu-limit-to-avoid-BA-bound.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0104-mtk-mt76-mt7996-enable-ampdu-limit-to-avoid-BA-bound.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0116-mtk-mt76-mt7996-enable-ampdu-limit-to-avoid-BA-bound.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0104-mtk-mt76-mt7996-enable-ampdu-limit-to-avoid-BA-bound.patch
index ea0d36e..1e446d4 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0116-mtk-mt76-mt7996-enable-ampdu-limit-to-avoid-BA-bound.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0104-mtk-mt76-mt7996-enable-ampdu-limit-to-avoid-BA-bound.patch
@@ -1,7 +1,7 @@
-From af0b14e475466b4f353c20af228c381c695ec3f9 Mon Sep 17 00:00:00 2001
+From bd12a6bbc6783a69d6ab5630b7b7ffda53da88d5 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 1 Apr 2024 17:00:21 +0800
-Subject: [PATCH 116/199] mtk: mt76: mt7996: enable ampdu limit to avoid BA
+Subject: [PATCH 104/223] mtk: mt76: mt7996: enable ampdu limit to avoid BA
  bound issue
 
 [Description]
@@ -25,6 +25,7 @@
 [Release-log]
 N/A
 
+Change-Id: I64ea1d5df012c1eb9462391e5e9c20658ed7f4fe
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt76_connac_mcu.h |  1 +
@@ -33,10 +34,10 @@
  3 files changed, 95 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f6a0d328..6e3324f5 100644
+index 1dcd1696..f6b472ef 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -829,6 +829,7 @@ enum {
+@@ -834,6 +834,7 @@ enum {
  	STA_REC_KEY_V3 = 0x27,
  	STA_REC_HDRT = 0x28,
  	STA_REC_HDR_TRANS = 0x2B,
@@ -45,10 +46,10 @@
  };
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 340b6637..f97acfb2 100644
+index 54b0272c..8034c8ab 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1344,6 +1344,85 @@ mt7996_mcu_sta_ba(struct mt7996_dev *dev, struct mt76_vif *mvif,
+@@ -1349,6 +1349,85 @@ mt7996_mcu_sta_ba(struct mt7996_dev *dev, struct mt76_vif *mvif,
  				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
  }
  
@@ -134,7 +135,7 @@
  /** starec & wtbl **/
  int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  			 struct ieee80211_ampdu_params *params,
-@@ -1353,6 +1432,7 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
+@@ -1358,6 +1437,7 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
  	unsigned long valid_links = sta->valid_links ?: BIT(0);
  	unsigned int link_id;
@@ -142,7 +143,7 @@
  
  	for_each_set_bit(link_id, &valid_links, IEEE80211_MLD_MAX_NUM_LINKS) {
  		struct mt7996_link_sta *mlink =
-@@ -1368,6 +1448,12 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
+@@ -1373,6 +1453,12 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  					&mlink->wcid, enable, true);
  		if (ret)
  			return ret;
@@ -182,5 +183,5 @@
  
  #define MT7996_MAX_BEACON_SIZE		1338
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0117-mtk-mt76-mt7996-Fix-get_txpower-wrong-result-in-sing.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0105-mtk-mt76-mt7996-Fix-get_txpower-wrong-result-in-sing.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0117-mtk-mt76-mt7996-Fix-get_txpower-wrong-result-in-sing.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0105-mtk-mt76-mt7996-Fix-get_txpower-wrong-result-in-sing.patch
index 082b6a7..d147e2f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0117-mtk-mt76-mt7996-Fix-get_txpower-wrong-result-in-sing.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0105-mtk-mt76-mt7996-Fix-get_txpower-wrong-result-in-sing.patch
@@ -1,7 +1,7 @@
-From cae948de0db9841b932562c2283331155ff182f0 Mon Sep 17 00:00:00 2001
+From 67c0e729c31b13fc348746b398857c353e43dab1 Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Mon, 8 Apr 2024 16:56:09 +0800
-Subject: [PATCH 117/199] mtk: mt76: mt7996: Fix get_txpower wrong result in
+Subject: [PATCH 105/223] mtk: mt76: mt7996: Fix get_txpower wrong result in
  single wiphy and legacy mode
 
 Fix get_txpower wrong result in single wiphy and legacy mode.
@@ -9,12 +9,13 @@
 
 Temporarily use link 0 bss due to mac80211 didn't pass link id here.
 
+Change-Id: I306897ded276b0e5aee191339f18f0f25ca322f2
 ---
  mt7996/main.c | 28 +++++++++++++++++++++++++++-
  1 file changed, 27 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 155318b3..7e56f4b0 100644
+index 67948343..b7096901 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -982,6 +982,32 @@ out:
@@ -50,7 +51,7 @@
  static void
  mt7996_channel_switch_beacon(struct ieee80211_hw *hw,
  			     struct ieee80211_vif *vif,
-@@ -2669,7 +2695,7 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -2673,7 +2699,7 @@ const struct ieee80211_ops mt7996_ops = {
  	.hw_scan = mt7996_hw_scan,
  	.cancel_hw_scan = mt7996_cancel_hw_scan,
  	.release_buffered_frames = mt76_release_buffered_frames,
@@ -60,5 +61,5 @@
  	.get_stats = mt7996_get_stats,
  	.get_et_sset_count = mt7996_get_et_sset_count,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0118-mtk-mt76-mt7996-Add-connac3-csi-feature.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0106-mtk-mt76-mt7996-Add-connac3-csi-feature.patch
similarity index 96%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0118-mtk-mt76-mt7996-Add-connac3-csi-feature.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0106-mtk-mt76-mt7996-Add-connac3-csi-feature.patch
index 27c74b7..e7146ca 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0118-mtk-mt76-mt7996-Add-connac3-csi-feature.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0106-mtk-mt76-mt7996-Add-connac3-csi-feature.patch
@@ -1,7 +1,7 @@
-From 3b007db9f040c663de6308f0cb1b9b603f1811c5 Mon Sep 17 00:00:00 2001
+From c16fd657d9955992ab12c22ac068c7f9d0035ed3 Mon Sep 17 00:00:00 2001
 From: mtk20656 <chank.chen@mediatek.com>
 Date: Sat, 20 Jan 2024 12:03:24 +0800
-Subject: [PATCH 118/199] mtk: mt76: mt7996: Add connac3 csi feature.
+Subject: [PATCH 106/223] mtk: mt76: mt7996: Add connac3 csi feature.
 
 1. format align to wifi6.
 2. add bw320 support.
@@ -9,6 +9,8 @@
 
 Fix csi bug with single wiphy design.
 
+Change-Id: If37ac6de4781c3673671707ee3ee243dda8163f8
+Change-Id: I7761e2883bb08939917432df075062fb78de3bee
 Signed-off-by: mtk20656 <chank.chen@mediatek.com>
 ---
  mt76_connac_mcu.h |   2 +
@@ -22,10 +24,10 @@
  8 files changed, 951 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 6e3324f5..1852e512 100644
+index f6b472ef..11c147cd 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1061,6 +1061,7 @@ enum {
+@@ -1066,6 +1066,7 @@ enum {
  	MCU_UNI_EVENT_THERMAL = 0x35,
  	MCU_UNI_EVENT_NIC_CAPAB = 0x43,
  	MCU_UNI_EVENT_TESTMODE_CTRL = 0x46,
@@ -33,7 +35,7 @@
  	MCU_UNI_EVENT_WED_RRO = 0x57,
  	MCU_UNI_EVENT_PER_STA_INFO = 0x6d,
  	MCU_UNI_EVENT_ALL_STA_INFO = 0x6e,
-@@ -1298,6 +1299,7 @@ enum {
+@@ -1303,6 +1304,7 @@ enum {
  	MCU_UNI_CMD_TESTMODE_TRX_PARAM = 0x42,
  	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
  	MCU_UNI_CMD_PRECAL_RESULT = 0x47,
@@ -42,7 +44,7 @@
  	MCU_UNI_CMD_RRO = 0x57,
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index f75aa568..a1941869 100644
+index f26687df..211ad40c 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -807,6 +807,24 @@ error:
@@ -82,10 +84,10 @@
  
  	mphy = phy->dev->mt76.phys[band];
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 7e56f4b0..b94af2f6 100644
+index b7096901..32a37936 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -1302,6 +1302,9 @@ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -1306,6 +1306,9 @@ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
  	unsigned long rem = sta->valid_links ?: BIT(0);
  
@@ -96,10 +98,10 @@
  }
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index f97acfb2..c59dbbea 100644
+index 8034c8ab..56bb32a0 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -653,6 +653,263 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -658,6 +658,263 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	}
  }
  
@@ -363,7 +365,7 @@
  static void
  mt7996_mcu_rx_thermal_notify(struct mt7996_dev *dev, struct sk_buff *skb)
  {
-@@ -896,6 +1153,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -901,6 +1158,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	case MCU_UNI_EVENT_BF:
  		mt7996_mcu_rx_bf_event(dev, skb);
  		break;
@@ -375,7 +377,7 @@
  #endif
  	default:
  		break;
-@@ -5980,4 +6242,207 @@ void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -6006,4 +6268,207 @@ void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  
  	mt7996_mcu_add_beacon(hw, &vif->bss_conf, &mvif->deflink, val);
  }
@@ -698,10 +700,10 @@
 +
  #endif
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 40ee8949..f0492078 100644
+index 2a638a4a..eb38427b 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -445,6 +445,47 @@ struct mt7996_air_monitor_ctrl {
+@@ -446,6 +446,47 @@ struct mt7996_air_monitor_ctrl {
  	struct mt7996_air_monitor_group group[MT7996_AIR_MONITOR_MAX_GROUP];
  	struct mt7996_air_monitor_entry entry[MT7996_AIR_MONITOR_MAX_ENTRY];
  };
@@ -749,7 +751,7 @@
  #endif
  
  struct mt7996_rro_ba_session {
-@@ -541,6 +582,18 @@ struct mt7996_phy {
+@@ -542,6 +583,18 @@ struct mt7996_phy {
  	u8 rts_bw_sig;
  	spinlock_t amnt_lock;
  	struct mt7996_air_monitor_ctrl amnt_ctrl;
@@ -768,7 +770,7 @@
  #endif
  #ifdef CONFIG_MTK_DEBUG
  	bool sr_enable:1;
-@@ -1176,6 +1229,8 @@ void mt7996_mcu_set_mimo(struct mt7996_phy *phy);
+@@ -1180,6 +1233,8 @@ void mt7996_mcu_set_mimo(struct mt7996_phy *phy);
  int mt7996_set_muru_cfg(struct mt7996_phy *phy, u8 action, u8 val);
  int mt7996_mcu_set_muru_cfg(struct mt7996_phy *phy, void *data);
  void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
@@ -1128,5 +1130,5 @@
  
  #endif
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0119-mtk-mt76-mt7996-add-more-debug-info-for-MLO.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0107-mtk-mt76-mt7996-add-more-debug-info-for-MLO.patch
similarity index 98%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0119-mtk-mt76-mt7996-add-more-debug-info-for-MLO.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0107-mtk-mt76-mt7996-add-more-debug-info-for-MLO.patch
index 772fb37..a1f4a1f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0119-mtk-mt76-mt7996-add-more-debug-info-for-MLO.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0107-mtk-mt76-mt7996-add-more-debug-info-for-MLO.patch
@@ -1,8 +1,9 @@
-From 9fe070ee29d4d63044a27782e643cd3dad8a8669 Mon Sep 17 00:00:00 2001
+From 7aa62c926e4323d8a19bac3c286903ec3d266503 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 22 Apr 2024 11:06:48 +0800
-Subject: [PATCH 119/199] mtk: mt76: mt7996: add more debug info for MLO
+Subject: [PATCH 107/223] mtk: mt76: mt7996: add more debug info for MLO
 
+Change-Id: Id61889262c153f28fca8f209319137d86e8b9c36
 ---
  mt76_connac_mcu.c    |    1 +
  mt76_connac_mcu.h    |    1 +
@@ -19,10 +20,10 @@
  12 files changed, 1856 insertions(+), 18 deletions(-)
 
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index ab7cf4a6..8d1036e1 100644
+index e4e6c0d3..b62a1ac8 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -432,6 +432,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -428,6 +428,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  	}
  
  	memcpy(basic->peer_addr, link_sta->addr, ETH_ALEN);
@@ -31,10 +32,10 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_basic_tlv);
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 1852e512..870417f3 100644
+index 11c147cd..86a2fdf8 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1295,6 +1295,7 @@ enum {
+@@ -1300,6 +1300,7 @@ enum {
  	MCU_UNI_CMD_THERMAL = 0x35,
  	MCU_UNI_CMD_VOW = 0x37,
  	MCU_UNI_CMD_PP = 0x38,
@@ -43,7 +44,7 @@
  	MCU_UNI_CMD_TESTMODE_TRX_PARAM = 0x42,
  	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index fe8fea5d..63b8887d 100644
+index ab8732dd..db41e378 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -314,15 +314,17 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
@@ -126,7 +127,7 @@
  	if (is_fwlog) {
  		if (dev->relay_fwlog)
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 803f7ce3..6462c64c 100644
+index 1cf84fe5..cd139111 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -331,6 +331,10 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
@@ -151,7 +152,7 @@
  	if (hdr_trans && ieee80211_has_morefrags(fc)) {
  		if (mt7996_reverse_frag0_hdr_trans(skb, hdr_gap))
  			return -EINVAL;
-@@ -982,6 +990,13 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -994,6 +1002,13 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	tx_info->buf[1].skip_unmap = true;
  	tx_info->nbuf = MT_CT_DMA_BUF_NUM;
  
@@ -166,7 +167,7 @@
  }
  
 diff --git a/mt7996/main.c b/mt7996/main.c
-index b94af2f6..fa9486e4 100644
+index 32a37936..0c5ddda1 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -433,6 +433,9 @@ static int mt7996_add_bss_conf(struct mt7996_phy *phy,
@@ -216,7 +217,7 @@
  	for_each_set_bit(link_id, &add, IEEE80211_MLD_MAX_NUM_LINKS) {
  		struct mt7996_bss_conf *mconf =
  			mconf_dereference_protected(mvif, link_id);
-@@ -2556,6 +2568,7 @@ mt7996_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2560,6 +2572,7 @@ mt7996_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	unsigned int link_id;
  	int ret = 0;
  
@@ -224,7 +225,7 @@
  	if (old_links == new_links)
  		return 0;
  
-@@ -2601,6 +2614,7 @@ mt7996_change_sta_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2605,6 +2618,7 @@ mt7996_change_sta_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	unsigned long rem = old_links & ~new_links;
  	int ret = 0;
  
@@ -233,10 +234,10 @@
  
  	if (rem)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index c59dbbea..0b02b76b 100644
+index 56bb32a0..956bd396 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -333,6 +333,10 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+@@ -338,6 +338,10 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
  		mcu_txd->s2d_index = MCU_S2D_H2N;
  
  exit:
@@ -247,7 +248,7 @@
  	if (wait_seq)
  		*wait_seq = seq;
  
-@@ -1120,6 +1124,10 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -1125,6 +1129,10 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
  {
  	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
  
@@ -258,7 +259,7 @@
  	switch (rxd->eid) {
  	case MCU_UNI_EVENT_FW_LOG_2_HOST:
  		mt7996_mcu_rx_log_message(dev, skb);
-@@ -1336,6 +1344,8 @@ mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+@@ -1341,6 +1349,8 @@ mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
  	}
  
  	mld->own_mld_id = mconf->own_mld_id;
@@ -267,7 +268,7 @@
  }
  
  static void
-@@ -1487,6 +1497,10 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
+@@ -1492,6 +1502,10 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
  	}
  
  	memcpy(bss->bssid, conf->bssid, ETH_ALEN);
@@ -278,16 +279,16 @@
  	bss->bcn_interval = cpu_to_le16(conf->beacon_int);
  	bss->dtim_period = conf->dtim_period;
  	bss->phymode = mt76_connac_get_phy_mode(phy, vif,
-@@ -2771,6 +2785,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
- 	/* starec basic */
+@@ -2778,6 +2792,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+ 	conn_state = enable ? CONN_STATE_PORT_SECURE : CONN_STATE_DISCONNECT;
  	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, conf, link_sta,
- 				      enable, newly);
-+	mlo_dbg(mconf->phy, "link=%u, newly=%d, en=%d\n",
-+		mlink->wcid.link_id, newly, enable);
+ 				      conn_state, newly);
++	mlo_dbg(mconf->phy, "link=%u, newly=%d, conn_state=%d\n",
++		mlink->wcid.link_id, newly, conn_state);
  
  	if (!enable)
  		goto out;
-@@ -2853,12 +2869,16 @@ mt7996_mcu_sta_mld_setup_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -2860,12 +2876,16 @@ mt7996_mcu_sta_mld_setup_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	mld_setup->link_num = hweight16(sta->valid_links);
  
  	mld_setup_link = (struct mld_setup_link *)mld_setup->link_info;
@@ -304,7 +305,7 @@
  		mld_setup_link++;
  	}
  }
-@@ -3122,6 +3142,8 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
+@@ -3129,6 +3149,8 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
  		return mt7996_mcu_muar_config(phy, conf, mconf, false, enable);
  
  	memcpy(data.tlv.omac_addr, conf->addr, ETH_ALEN);
@@ -313,7 +314,7 @@
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WMWA_UNI_CMD(DEV_INFO_UPDATE),
  				 &data, sizeof(data), true);
  }
-@@ -3226,6 +3248,11 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+@@ -3233,6 +3255,11 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  			      BSS_CHANGED_BEACON);
  
  	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
@@ -345,10 +346,10 @@
  	UNI_CMD_SR_ENABLE = 0x1,
  	UNI_CMD_SR_ENABLE_SD,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index f0492078..ff13d00e 100644
+index eb38427b..00023a5e 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -737,6 +737,14 @@ struct mt7996_dev {
+@@ -742,6 +742,14 @@ struct mt7996_dev {
  		u8 fw_dbg_lv;
  		u32 bcn_total_cnt[__MT_MAX_BAND];
  		u32 sid;
@@ -363,7 +364,7 @@
  	} dbg;
  	const struct mt7996_dbg_reg_desc *dbg_reg;
  #endif
-@@ -935,6 +943,8 @@ mt7996_get_link_wcid(struct mt7996_dev *dev, u16 idx, u8 band_idx)
+@@ -939,6 +947,8 @@ mt7996_get_link_wcid(struct mt7996_dev *dev, u16 idx, u8 band_idx)
  	return &mlink->wcid;
  }
  
@@ -372,7 +373,7 @@
  extern const struct ieee80211_ops mt7996_ops;
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
-@@ -1266,6 +1276,18 @@ void mt7996_tm_update_channel(struct mt7996_phy *phy);
+@@ -1270,6 +1280,18 @@ void mt7996_tm_update_channel(struct mt7996_phy *phy);
  
  int mt7996_mcu_set_vow_drr_dbg(struct mt7996_dev *dev, u32 val);
  int mt7996_mcu_thermal_debug(struct mt7996_dev *dev, u8 mode, u8 action);
@@ -1061,10 +1062,10 @@
 +
  #endif
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index cc1224ed..c7f5b56e 100644
+index bc9a0f04..f9c5b238 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -3187,6 +3187,1038 @@ mt7996_thermal_recal_set(void *data, u64 val)
+@@ -3186,6 +3186,1038 @@ mt7996_thermal_recal_set(void *data, u64 val)
  DEFINE_DEBUGFS_ATTRIBUTE(fops_thermal_recal, NULL,
  			 mt7996_thermal_recal_set, "%llu\n");
  
@@ -2103,7 +2104,7 @@
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -3295,6 +4327,24 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -3294,6 +4326,24 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  
  	debugfs_create_file("thermal_enable", 0600, dir, phy, &fops_thermal_enable);
  	debugfs_create_file("thermal_recal", 0200, dir, dev, &fops_thermal_recal);
@@ -2224,5 +2225,5 @@
  	int i;
  
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0120-mtk-mt76-add-internal-debug-tool.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0108-mtk-mt76-add-internal-debug-tool.patch
similarity index 99%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0120-mtk-mt76-add-internal-debug-tool.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0108-mtk-mt76-add-internal-debug-tool.patch
index 99adad3..37f7759 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0120-mtk-mt76-add-internal-debug-tool.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0108-mtk-mt76-add-internal-debug-tool.patch
@@ -1,7 +1,7 @@
-From a63950272ed7934e2777155cb8ea06bb82d75c33 Mon Sep 17 00:00:00 2001
+From 9ba1059c52cbf12123e8b3531291623e692fe1d9 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 22 Apr 2024 12:22:05 +0800
-Subject: [PATCH 120/199] mtk: mt76: add internal debug tool
+Subject: [PATCH 108/223] mtk: mt76: add internal debug tool
 
 Add the following DebugFS knobs:
 - reset_counter: reset TX/RX statistical counters in FW, WTBL, and MT76.
@@ -49,6 +49,10 @@
 Because Kite only supports 512 STAs, the number of AC_QUEUE_EMPTY CRs is less than that of Eagle.
 Consequently, some related macros have to be revised to prevent reading wrong CRs.
 
+Change-Id: I22331b413b0583c4209f733ad197369fa8939d97
+Change-Id: Ic01c288fda25886a9c384441704cb7a9f86f6209
+Change-Id: I3515144170aad82c23d38a6eedad8843f818058d
+Change-Id: Iea052180b469e8ae8ba759ddb4bcf028fce3dace
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -83,7 +87,7 @@
 -mt7996e-y += mtk_debugfs.o mtk_mcu.o
 +mt7996e-y += mtk_debugfs.o mtk_mcu.o mtk_debugfs_i.o
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 63b8887d..2c553cf3 100644
+index db41e378..7e545f61 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -1118,8 +1118,12 @@ int mt7996_init_debugfs(struct mt7996_phy *phy)
@@ -101,7 +105,7 @@
  #ifdef CONFIG_MTK_DEBUG
  	debugfs_create_u16("wlan_idx", 0600, dir, &dev->wlan_idx);
 diff --git a/mt7996/init.c b/mt7996/init.c
-index a1941869..057d20db 100644
+index 211ad40c..1d31e96a 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -886,6 +886,10 @@ void mt7996_rro_hw_init(struct mt7996_dev *dev)
@@ -116,7 +120,7 @@
  		mt76_clear(dev, WF_RRO_AXI_MST_CFG, WF_RRO_AXI_MST_CFG_DIDX_OK);
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 6462c64c..c6816ab5 100644
+index cd139111..2e27e3b3 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -334,6 +334,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
@@ -127,7 +131,7 @@
  #endif
  	hw_aggr = status->aggr;
  	memset(status, 0, sizeof(*status));
-@@ -995,6 +996,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1007,6 +1008,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  		mt7996_packet_log_to_host(dev, txwi, MT_TXD_SIZE, PKT_BIN_DEBUG_TXD, 0);
  	if (dev->dbg.dump_tx_pkt)
  		mt7996_packet_log_to_host(dev, t->skb->data, t->skb->len, PKT_BIN_DEBUG_TX, 0);
@@ -136,10 +140,10 @@
  
  	return 0;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index ff13d00e..ef544957 100644
+index 00023a5e..e23ed8e7 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -101,6 +101,7 @@
+@@ -103,6 +103,7 @@
  
  #define MT7996_BUILD_TIME_LEN		24
  
@@ -147,7 +151,7 @@
  #define MT7996_RRO_MAX_SESSION		1024
  #define MT7996_RRO_WINDOW_MAX_LEN	1024
  #define MT7996_RRO_ADDR_ELEM_LEN	128
-@@ -688,6 +689,9 @@ struct mt7996_dev {
+@@ -689,6 +690,9 @@ struct mt7996_dev {
  		struct work_struct work;
  		struct list_head poll_list;
  		spinlock_t lock;
@@ -157,7 +161,7 @@
  	} wed_rro;
  
  	bool testmode_enable;
-@@ -744,7 +748,11 @@ struct mt7996_dev {
+@@ -749,7 +753,11 @@ struct mt7996_dev {
  		bool dump_tx_pkt:1;
  		bool dump_rx_pkt:1;
  		bool dump_rx_raw:1;
@@ -169,7 +173,7 @@
  	} dbg;
  	const struct mt7996_dbg_reg_desc *dbg_reg;
  #endif
-@@ -1288,6 +1296,10 @@ enum {
+@@ -1292,6 +1300,10 @@ enum {
  };
  
  void mt7996_packet_log_to_host(struct mt7996_dev *dev, const void *data, int len, int type, int des_len);
@@ -1900,5 +1904,5 @@
 +
 +#endif
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0121-mtk-mt76-mt7996-add-linux-tracing-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0109-mtk-mt76-mt7996-add-linux-tracing-support.patch
similarity index 92%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0121-mtk-mt76-mt7996-add-linux-tracing-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0109-mtk-mt76-mt7996-add-linux-tracing-support.patch
index 70831fd..9705ef9 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0121-mtk-mt76-mt7996-add-linux-tracing-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0109-mtk-mt76-mt7996-add-linux-tracing-support.patch
@@ -1,10 +1,11 @@
-From 5ef5041a7200a4e3877df4c3533bd3c5e2038615 Mon Sep 17 00:00:00 2001
+From 72119323570a647a238c6d3dfb2c07c190e062c4 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 7 Sep 2022 12:13:20 +0800
-Subject: [PATCH 121/199] mtk: mt76: mt7996: add linux tracing support
+Subject: [PATCH 109/223] mtk: mt76: mt7996: add linux tracing support
 
 Add static tracepoint support for besra.
 
+Change-Id: I3209ba360b49c28e49c7cf464ea130aeba993ef7
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  agg-rx.c              |   2 +
@@ -40,7 +41,7 @@
  	if (!tid->started) {
  		if (sn_less)
 diff --git a/mac80211.c b/mac80211.c
-index 5e4935f2..dc91e827 100644
+index a2b111c0..75674462 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -5,6 +5,7 @@
@@ -51,7 +52,7 @@
  
  static const struct ieee80211_channel mt76_channels_2ghz[] = {
  	CHAN2G(1, 2412),
-@@ -1307,6 +1308,7 @@ void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
+@@ -1332,6 +1333,7 @@ void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  
  		mt76_check_ccmp_pn(skb);
  		skb_shinfo(skb)->frag_list = NULL;
@@ -59,7 +60,7 @@
  		mt76_rx_convert(dev, skb, &hw, &sta);
  		ieee80211_rx_list(hw, sta, skb, &list);
  
-@@ -1316,6 +1318,7 @@ void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
+@@ -1341,6 +1343,7 @@ void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  			nskb = nskb->next;
  			skb->next = NULL;
  
@@ -78,7 +79,7 @@
 -mt7996e-y += mtk_debugfs.o mtk_mcu.o mtk_debugfs_i.o
 +mt7996e-y += mtk_debugfs.o mtk_mcu.o mtk_debugfs_i.o trace.o
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index c6816ab5..6ba07156 100644
+index 2e27e3b3..1c0d3676 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -11,6 +11,7 @@
@@ -98,16 +99,16 @@
  	if (!test_bit(MT76_STATE_RUNNING, &mphy->state))
  		return -EINVAL;
  
-@@ -609,6 +612,8 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
- 	    !(status->flag & RX_FLAG_8023))
- 		mt76_connac3_mac_decode_he_radiotap(skb, rxv, mode);
+@@ -621,6 +624,8 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
+ 		}
+ 	}
  
 +	trace_mt7996_fill_rx_done(phy, status->seqno, hdr_gap);
 +
  	if (!status->wcid || !ieee80211_is_data_qos(fc) || hw_aggr)
  		return 0;
  
-@@ -998,6 +1003,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1010,6 +1015,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  		mt7996_packet_log_to_host(dev, t->skb->data, t->skb->len, PKT_BIN_DEBUG_TX, 0);
  	mt7996_dump_bmac_txd_info(NULL, dev, (__le32 *)txwi, true, false);
  #endif
@@ -116,7 +117,7 @@
  	return 0;
  }
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 0b02b76b..1cc08a30 100644
+index 956bd396..d1aa19cb 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -10,6 +10,7 @@
@@ -127,7 +128,7 @@
  
  #define fw_name(_dev, name, ...)	({			\
  	char *_fw;						\
-@@ -305,6 +306,9 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+@@ -310,6 +311,9 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
  		else if (cmd & __MCU_CMD_FIELD_WM)
  			uni_txd->s2d_index = MCU_S2D_H2N;
  
@@ -137,7 +138,7 @@
  		goto exit;
  	}
  
-@@ -332,6 +336,8 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+@@ -337,6 +341,8 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
  	else
  		mcu_txd->s2d_index = MCU_S2D_H2N;
  
@@ -146,7 +147,7 @@
  exit:
  #ifdef CONFIG_MTK_DEBUG
  	if (dev->dbg.dump_mcu_pkt)
-@@ -1177,6 +1183,8 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -1182,6 +1188,8 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb)
  {
  	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
  
@@ -390,5 +391,5 @@
  
  #undef TRACE_INCLUDE_PATH
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0122-mtk-mt76-temp-changes-for-SQC-period.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0110-mtk-mt76-temp-changes-for-SQC-period.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0122-mtk-mt76-temp-changes-for-SQC-period.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0110-mtk-mt76-temp-changes-for-SQC-period.patch
index 335413f..7d25362 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0122-mtk-mt76-temp-changes-for-SQC-period.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0110-mtk-mt76-temp-changes-for-SQC-period.patch
@@ -1,7 +1,7 @@
-From 59bc821a3e6440f117f8e864e468a1c297be482a Mon Sep 17 00:00:00 2001
+From 1ee4eb8cb63f275f929b3f7aabbdb0df66ed1f2f Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Fri, 9 Jun 2023 14:11:30 +0800
-Subject: [PATCH 122/199] mtk: mt76: temp changes for SQC period
+Subject: [PATCH 110/223] mtk: mt76: temp changes for SQC period
 
 mtk: wifi: mt76: mt7996: For SQC test Disable single sku
 
@@ -17,6 +17,8 @@
 
 mtk: wifi: mt76: mt7996: add SER flow log for debug during the SQC period.
 
+Change-Id: I052e7284b3f6adfa4414e64445fa1f24f92fc8a7
+Change-Id: If68052b181c63d989ce3173bb5b19168e662e540
 Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
 Signed-off-by: mtk27745 <rex.lu@mediatek.com>
 ---
@@ -115,10 +117,10 @@
  
  void mt7996_dma_cleanup(struct mt7996_dev *dev)
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 6ba07156..fc83cea1 100644
+index 1c0d3676..ac61869d 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1980,6 +1980,9 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1992,6 +1992,9 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	if (phy3)
  		ieee80211_stop_queues(phy3->mt76->hw);
  
@@ -128,7 +130,7 @@
  	set_bit(MT76_RESET, &dev->mphy.state);
  	set_bit(MT76_MCU_RESET, &dev->mphy.state);
  	if (phy2)
-@@ -1989,6 +1992,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2001,6 +2004,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	wake_up(&dev->mt76.mcu.wait);
  
  	mt76_worker_disable(&dev->mt76.tx_worker);
@@ -139,7 +141,7 @@
  	mt76_for_each_q_rx(&dev->mt76, i) {
  		if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
  		    mt76_queue_is_wed_rro(&dev->mt76.q_rx[i]))
-@@ -1998,14 +2005,30 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2010,14 +2017,30 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	}
  	napi_disable(&dev->mt76.tx_napi);
  
@@ -170,7 +172,7 @@
  		mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_INIT);
  		mt7996_wait_reset_state(dev, MT_MCU_CMD_RECOVERY_DONE);
  	}
-@@ -2016,6 +2039,9 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2028,6 +2051,9 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	/* enable DMA Tx/Tx and interrupt */
  	mt7996_dma_start(dev, false, false);
  
@@ -180,7 +182,7 @@
  	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
  		u32 wed_irq_mask = MT_INT_RRO_RX_DONE | MT_INT_TX_DONE_BAND2 |
  				   dev->mt76.mmio.irqmask;
-@@ -2042,6 +2068,9 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2054,6 +2080,9 @@ void mt7996_mac_reset_work(struct work_struct *work)
  				     MT_INT_TX_RX_DONE_EXT);
  	}
  
@@ -191,10 +193,10 @@
  	clear_bit(MT76_RESET, &dev->mphy.state);
  	if (phy2)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 1cc08a30..a88beb36 100644
+index d1aa19cb..d56630e9 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3850,11 +3850,11 @@ int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
+@@ -3857,11 +3857,11 @@ int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
  		return ret;
  
  	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
@@ -209,10 +211,10 @@
  		return ret;
  
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index c7f5b56e..0820e0d0 100644
+index f9c5b238..0cf48193 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -4298,6 +4298,7 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -4297,6 +4297,7 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  	debugfs_create_file("red", 0200, dir, dev, &fops_red_config);
  	debugfs_create_file("vow_drr_dbg", 0200, dir, dev, &fops_vow_drr_dbg);
  
@@ -221,5 +223,5 @@
  	debugfs_create_file("scs_enable", 0200, dir, phy, &fops_scs_enable);
  
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0123-mtk-mt76-mt7996-remain-multiple-wiphy-model-for-test.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0111-mtk-mt76-mt7996-remain-multiple-wiphy-model-for-test.patch
similarity index 90%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0123-mtk-mt76-mt7996-remain-multiple-wiphy-model-for-test.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0111-mtk-mt76-mt7996-remain-multiple-wiphy-model-for-test.patch
index 7c5f0e4..4ac10cb 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0123-mtk-mt76-mt7996-remain-multiple-wiphy-model-for-test.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0111-mtk-mt76-mt7996-remain-multiple-wiphy-model-for-test.patch
@@ -1,7 +1,7 @@
-From f4f602099ba8cfdf81172f1d3789d810439cc174 Mon Sep 17 00:00:00 2001
+From 2437744f9744acc7ca65d991906a17f7f5d123d5 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 22 Apr 2024 16:49:48 +0800
-Subject: [PATCH 123/199] mtk: mt76: mt7996: remain multiple wiphy model for
+Subject: [PATCH 111/223] mtk: mt76: mt7996: remain multiple wiphy model for
  testmode
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -12,7 +12,7 @@
  3 files changed, 22 insertions(+), 14 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 057d20db..9da12f07 100644
+index 1d31e96a..c5c12ba0 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -795,9 +795,11 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
@@ -43,7 +43,7 @@
  #ifdef CONFIG_MTK_VENDOR
  	mt7996_unregister_csi(phy);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index fa9486e4..f52bb2f9 100644
+index 0c5ddda1..0b62858b 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -140,8 +140,8 @@ static int mt7996_start(struct ieee80211_hw *hw)
@@ -57,7 +57,7 @@
  		return -1;
  
  	flush_work(&dev->init_work);
-@@ -158,8 +158,8 @@ static void mt7996_stop(struct ieee80211_hw *hw)
+@@ -158,8 +158,8 @@ static void mt7996_stop(struct ieee80211_hw *hw, bool suspend)
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	int band;
  
@@ -82,10 +82,10 @@
  	mvif->dev = dev;
  	mvif->hw = hw;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index ef544957..827c24bf 100644
+index e23ed8e7..b8699b65 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -876,16 +876,15 @@ mt7996_get_background_radar_cap(struct mt7996_dev *dev)
+@@ -880,16 +880,15 @@ mt7996_has_background_radar(struct mt7996_dev *dev)
  static inline struct mt7996_phy *
  mt7996_band_phy(struct ieee80211_hw *hw, enum nl80211_band band)
  {
@@ -107,5 +107,5 @@
  	if (!phy)
  		return NULL;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0124-mtk-mt76-mt7996-enable-ibf-capability-for-mt7992.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0112-mtk-mt76-mt7996-enable-ibf-capability-for-mt7992.patch
similarity index 77%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0124-mtk-mt76-mt7996-enable-ibf-capability-for-mt7992.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0112-mtk-mt76-mt7996-enable-ibf-capability-for-mt7992.patch
index 14ec534..e28f39c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0124-mtk-mt76-mt7996-enable-ibf-capability-for-mt7992.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0112-mtk-mt76-mt7996-enable-ibf-capability-for-mt7992.patch
@@ -1,22 +1,23 @@
-From a0cf73079cf52808d6b4196d433d62aebd751c16 Mon Sep 17 00:00:00 2001
+From 349f51f541c02b1a3f72cce4e2f70110a0f39252 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 23 Apr 2024 09:19:25 +0800
-Subject: [PATCH 124/199] mtk: mt76: mt7996: enable ibf capability for mt7992
+Subject: [PATCH 112/223] mtk: mt76: mt7996: enable ibf capability for mt7992
 
 For the specific sku of mt7992, it supports both ibf and ebf
 functionality. The firmware algorithm may decide which type is better
 according to the station's beamform capability.
 
+Change-Id: I4b38ddf5059b5eafd5fc4cacb1add2a6d0ea3836
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
  mt7996/mcu.c | 7 ++++++-
  1 file changed, 6 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index a88beb36..28123fb7 100644
+index d56630e9..f9ed473a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2265,6 +2265,8 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -2270,6 +2270,8 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  			struct ieee80211_bss_conf *conf, struct mt7996_bss_conf *mconf,
  			struct ieee80211_link_sta *link_sta)
  {
@@ -25,7 +26,7 @@
  	struct mt7996_phy *phy = mconf->phy;
  	int tx_ant = hweight16(phy->mt76->chainmask) - 1;
  	struct sta_rec_bf *bf;
-@@ -2302,7 +2304,10 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -2307,7 +2309,10 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	else
  		return;
  
@@ -38,5 +39,5 @@
  	bf->ibf_dbw = link_sta->bandwidth;
  	bf->ibf_nrow = tx_ant;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0125-mtk-mt76-remove-the-limitation-for-legacy-AP-sacn.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0113-mtk-mt76-remove-the-limitation-for-legacy-AP-sacn.patch
similarity index 77%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0125-mtk-mt76-remove-the-limitation-for-legacy-AP-sacn.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0113-mtk-mt76-remove-the-limitation-for-legacy-AP-sacn.patch
index cc53fd1..f991a92 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0125-mtk-mt76-remove-the-limitation-for-legacy-AP-sacn.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0113-mtk-mt76-remove-the-limitation-for-legacy-AP-sacn.patch
@@ -1,7 +1,7 @@
-From 6ae8ff7998348080caa661a1e31c36febd3443ee Mon Sep 17 00:00:00 2001
+From da809c32e3531e217dbf22a9c5c372999c4642cb Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Thu, 2 May 2024 15:40:21 +0800
-Subject: [PATCH 125/199] mtk: mt76: remove the limitation for legacy AP sacn
+Subject: [PATCH 113/223] mtk: mt76: remove the limitation for legacy AP sacn
 
 The limitation was used to prevent resource conflict in multiple wiphys
 architecture. It becomes single wiphy and the limitation seems to be
@@ -10,16 +10,17 @@
 Furthermore, legacy APs need to scan due to features like ACS, so remove
 the limitations
 
+Change-Id: I319823e5cf06c9bcce3bb55c6e7b51a5f18b85da
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt7996/mac.c | 7 -------
  1 file changed, 7 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index fc83cea1..bba16975 100644
+index ac61869d..901c70e5 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2968,13 +2968,6 @@ void mt7996_scan_work(struct work_struct *work)
+@@ -2980,13 +2980,6 @@ void mt7996_scan_work(struct work_struct *work)
  	bool has_sta = false, active_scan = false;
  
  	mutex_lock(&phy->dev->mt76.mutex);
@@ -34,5 +35,5 @@
  	if (phy->scan_chan_idx >= req->n_channels) {
  		mt7996_scan_complete(phy, false);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0126-mtk-mt76-add-support-for-get_survey-in-single-wiphy-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0114-mtk-mt76-add-support-for-get_survey-in-single-wiphy-.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0126-mtk-mt76-add-support-for-get_survey-in-single-wiphy-.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0114-mtk-mt76-add-support-for-get_survey-in-single-wiphy-.patch
index 34d5ad6..02216b8 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0126-mtk-mt76-add-support-for-get_survey-in-single-wiphy-.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0114-mtk-mt76-add-support-for-get_survey-in-single-wiphy-.patch
@@ -1,7 +1,7 @@
-From 749af4a20ff5d2fb111346a1251fc2aab471986c Mon Sep 17 00:00:00 2001
+From be22e24f74bc54660f8034e345dfadcae73b2101 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Thu, 2 May 2024 15:22:22 +0800
-Subject: [PATCH 126/199] mtk: mt76: add support for get_survey in single wiphy
+Subject: [PATCH 114/223] mtk: mt76: add support for get_survey in single wiphy
  architecture
 
 ---
@@ -9,10 +9,10 @@
  1 file changed, 35 insertions(+), 10 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index dc91e827..589c37af 100644
+index 75674462..f986d5fd 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -912,19 +912,44 @@ int mt76_get_survey(struct ieee80211_hw *hw, int idx,
+@@ -937,19 +937,44 @@ int mt76_get_survey(struct ieee80211_hw *hw, int idx,
  	if (idx == 0 && dev->drv->update_survey)
  		mt76_update_survey(phy);
  
@@ -68,5 +68,5 @@
  		goto out;
  	}
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0127-mtk-mt76-mt7996-add-critical-update-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0115-mtk-mt76-mt7996-add-critical-update-support.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0127-mtk-mt76-mt7996-add-critical-update-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0115-mtk-mt76-mt7996-add-critical-update-support.patch
index 66e1603..397fde1 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0127-mtk-mt76-mt7996-add-critical-update-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0115-mtk-mt76-mt7996-add-critical-update-support.patch
@@ -1,7 +1,7 @@
-From 8a5fc9a07ebf08ffdd31d05beaa2d399b67f6a10 Mon Sep 17 00:00:00 2001
+From d4e9a9535f8f51d6a4adabee9efc1a61b0798490 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 23 Apr 2024 15:22:24 +0800
-Subject: [PATCH 127/199] mtk: mt76: mt7996: add critical update support
+Subject: [PATCH 115/223] mtk: mt76: mt7996: add critical update support
 
 Add critical update support
 modification: wmm configuration
@@ -17,6 +17,8 @@
 Also, modify the bpcc check since channel switch will add the bpcc twice
 (before CSA and after CSA).
 
+Change-Id: Ibf92803d444ad672dd235f3584eec25a385082f4
+Change-Id: Id6ecd3de03bee0c2f412dd4dd1a57783c5d65fcf
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -28,10 +30,10 @@
  5 files changed, 208 insertions(+), 30 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 870417f3..57cae8ae 100644
+index 86a2fdf8..0a4bf9b7 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1380,6 +1380,8 @@ enum {
+@@ -1385,6 +1385,8 @@ enum {
  	UNI_BSS_INFO_OFFLOAD = 25,
  	UNI_BSS_INFO_MLD = 26,
  	UNI_BSS_INFO_PM_DISABLE = 27,
@@ -41,7 +43,7 @@
  
  enum {
 diff --git a/mt7996/main.c b/mt7996/main.c
-index f52bb2f9..0d25d763 100644
+index 0b62858b..9a265710 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -370,6 +370,7 @@ static int mt7996_add_bss_conf(struct mt7996_phy *phy,
@@ -118,7 +120,7 @@
  	mutex_unlock(&dev->mt76.mutex);
  }
  
-@@ -2534,32 +2561,54 @@ mt7996_switch_vif_chanctx(struct ieee80211_hw *hw,
+@@ -2538,32 +2565,54 @@ mt7996_switch_vif_chanctx(struct ieee80211_hw *hw,
  			  int n_vifs,
  			  enum ieee80211_chanctx_switch_mode mode)
  {
@@ -193,10 +195,10 @@
  
  static int
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 28123fb7..ea69b66f 100644
+index f9ed473a..ea399a0b 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -370,6 +370,7 @@ mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
+@@ -375,6 +375,7 @@ mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  	struct mt76_phy *mphy = (struct mt76_phy *)priv;
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct ieee80211_bss_conf *link_conf;
@@ -204,7 +206,7 @@
  	int link_id, band_idx = mphy->band_idx;
  
  	link_id = mvif->band_to_link[band_idx];
-@@ -378,7 +379,16 @@ mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
+@@ -383,7 +384,16 @@ mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  	if (!link_conf || !link_conf->csa_active || vif->type == NL80211_IFTYPE_STATION)
  		return;
  
@@ -221,7 +223,7 @@
  }
  
  static void
-@@ -3235,6 +3245,93 @@ mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
+@@ -3242,6 +3252,93 @@ mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
  	}
  }
  
@@ -315,7 +317,7 @@
  static void
  mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  		       struct sk_buff *rskb, struct sk_buff *skb,
-@@ -3315,6 +3412,8 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+@@ -3322,6 +3419,8 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  	mt7996_mcu_beacon_cont(dev, conf, rskb, skb, bcn, &offs);
  	mt7996_mcu_beacon_mbss(rskb, skb, conf, bcn, &offs);
  	mt7996_mcu_beacon_cntdwn(conf, rskb, skb, &offs);
@@ -369,10 +371,10 @@
  					 MT7996_BEACON_UPDATE_SIZE)
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 827c24bf..78226f7b 100644
+index b8699b65..4815cf7b 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -351,6 +351,7 @@ struct mt7996_bss_conf {
+@@ -352,6 +352,7 @@ struct mt7996_bss_conf {
  
  	u8 link_id;
  	u8 own_mld_id;
@@ -380,7 +382,7 @@
  };
  
  struct mt7996_vif {
-@@ -365,6 +366,9 @@ struct mt7996_vif {
+@@ -366,6 +367,9 @@ struct mt7996_vif {
  	u8 group_mld_id;
  	u8 mld_remap_id;
  
@@ -391,5 +393,5 @@
  
  	/* for beacon monitoring */
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0128-mtk-mt76-mt7996-Add-support-for-EMLSR.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0116-mtk-mt76-mt7996-Add-support-for-EMLSR.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0128-mtk-mt76-mt7996-Add-support-for-EMLSR.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0116-mtk-mt76-mt7996-Add-support-for-EMLSR.patch
index 8c0318f..d3ced0b 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0128-mtk-mt76-mt7996-Add-support-for-EMLSR.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0116-mtk-mt76-mt7996-Add-support-for-EMLSR.patch
@@ -1,12 +1,13 @@
-From 060df153443363c797ddfe40e3190c931bc4879a Mon Sep 17 00:00:00 2001
+From 05cc12c0f48dae0a560f1eca2ad2a49f80f614bf Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 Date: Tue, 7 May 2024 15:47:23 +0800
-Subject: [PATCH 128/199] mtk: mt76: mt7996: Add support for EMLSR
+Subject: [PATCH 116/223] mtk: mt76: mt7996: Add support for EMLSR
 
 1. Register the EMLSR capability
 2. Set the EML capability of the station to firmware
 3. Process the EML Operating Mode Notification frame
 
+Change-Id: I0584c29abcc1956ae17f481639744ee8252e8adb
 Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 ---
  mt76_connac_mcu.h |  8 ++++++
@@ -18,10 +19,10 @@
  6 files changed, 166 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 57cae8ae..d72337d4 100644
+index 0a4bf9b7..2daa09cc 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -624,6 +624,13 @@ struct sta_rec_tx_proc {
+@@ -629,6 +629,13 @@ struct sta_rec_tx_proc {
  	__le32 flag;
  } __packed;
  
@@ -35,7 +36,7 @@
  /* wtbl_rec */
  
  struct wtbl_req_hdr {
-@@ -828,6 +835,7 @@ enum {
+@@ -833,6 +840,7 @@ enum {
  	STA_REC_PN_INFO = 0x26,
  	STA_REC_KEY_V3 = 0x27,
  	STA_REC_HDRT = 0x28,
@@ -44,7 +45,7 @@
  	STA_REC_TX_CAP = 0x2f,
  	STA_REC_MAX_NUM
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 9da12f07..2e624def 100644
+index c5c12ba0..c8eb7523 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -64,6 +64,7 @@ static const struct wiphy_iftype_ext_capab mt7996_iftypes_ext_capa[] = {
@@ -56,10 +57,10 @@
  		/* the max number of simultaneous links is defined as the
  		 * maximum number of affiliated APs minus 1.
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index ea69b66f..2a2e6116 100644
+index ea399a0b..76f0bb7e 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2919,9 +2919,10 @@ mt7996_mcu_sta_eht_mld_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -2926,9 +2926,10 @@ mt7996_mcu_sta_eht_mld_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  
  	for (i = 0; i < ARRAY_SIZE(eht_mld->str_cap); i++)
  		eht_mld->str_cap[i] = 0x7;
@@ -71,7 +72,7 @@
  	*/
  }
  
-@@ -6326,6 +6327,63 @@ int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy)
+@@ -6352,6 +6353,63 @@ int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy)
  	                         &req, sizeof(req), true);
  }
  
@@ -136,10 +137,10 @@
  void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 78226f7b..c60262ec 100644
+index 4815cf7b..94121471 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -410,6 +410,23 @@ enum {
+@@ -411,6 +411,23 @@ enum {
  	SCS_ENABLE,
  };
  
@@ -163,7 +164,7 @@
  struct mt7996_wed_rro_addr {
  	u32 head_low;
  	u32 head_high : 4;
-@@ -1226,6 +1243,8 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
+@@ -1230,6 +1247,8 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
  				     struct mt7996_link_sta *mlink);
  int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode);
  int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
@@ -295,5 +296,5 @@
  	MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
  
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0129-mtk-mt76-mt7996-add-max-mpdu-len-capability.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0117-mtk-mt76-mt7996-add-max-mpdu-len-capability.patch
similarity index 74%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0129-mtk-mt76-mt7996-add-max-mpdu-len-capability.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0117-mtk-mt76-mt7996-add-max-mpdu-len-capability.patch
index 36cbb69..120d25a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0129-mtk-mt76-mt7996-add-max-mpdu-len-capability.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0117-mtk-mt76-mt7996-add-max-mpdu-len-capability.patch
@@ -1,21 +1,22 @@
-From 77894f28fb40126d8ffa927787e4258cac597191 Mon Sep 17 00:00:00 2001
+From ce78d5c76700d61fa752c2ac34e53c87ed88f37d Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 9 May 2024 11:16:10 +0800
-Subject: [PATCH 129/199] mtk: mt76: mt7996: add max mpdu len capability
+Subject: [PATCH 117/223] mtk: mt76: mt7996: add max mpdu len capability
 
 Set max mpdu len to 11454 according to hardware capability.
 Without this patch, the max ampdu length would be 3895 and hurt performance.
 
+Change-Id: I78048302f18280078c7024b7670277fefe4e5165
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/init.c | 4 +++-
  1 file changed, 3 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 2e624def..6e20a174 100644
+index c8eb7523..e674361a 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -1519,7 +1519,9 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
+@@ -1539,7 +1539,9 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
  
  	eht_cap_elem->mac_cap_info[0] =
  		IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
@@ -27,5 +28,5 @@
  	eht_cap_elem->phy_cap_info[0] =
  		IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0130-mtk-mt76-mt7996-add-correct-bss_conf-for-legacy-AP-s.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0118-mtk-mt76-mt7996-add-correct-bss_conf-for-legacy-AP-s.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0130-mtk-mt76-mt7996-add-correct-bss_conf-for-legacy-AP-s.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0118-mtk-mt76-mt7996-add-correct-bss_conf-for-legacy-AP-s.patch
index 14ff6d2..86ada93 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0130-mtk-mt76-mt7996-add-correct-bss_conf-for-legacy-AP-s.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0118-mtk-mt76-mt7996-add-correct-bss_conf-for-legacy-AP-s.patch
@@ -1,7 +1,7 @@
-From ee730e834f37a0fa3a70bdce358ef3a163b46399 Mon Sep 17 00:00:00 2001
+From c8d1e3084599c7dbd74dd8408d0786e09851f177 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Fri, 10 May 2024 13:35:56 +0800
-Subject: [PATCH 130/199] mtk: mt76: mt7996: add correct bss_conf for legacy AP
+Subject: [PATCH 118/223] mtk: mt76: mt7996: add correct bss_conf for legacy AP
  scan
 
 If the legacy AP interface is added but not yet started, its bss_conf
@@ -20,16 +20,18 @@
 removed. And if the bss_conf is not exist, or it just be removed, it's
 added and assigned to the scanning phy.
 
+Change-Id: I34ebdbfeabe6aa5c4068de55d7f1eb8e549c0505
+Change-Id: I10bbb34a87f828e43459501709ac6473c920f49f
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt7996/main.c | 21 +++++++++++++--------
  1 file changed, 13 insertions(+), 8 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 0d25d763..990a38a7 100644
+index 9a265710..2b16385d 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -2363,15 +2363,20 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2367,15 +2367,20 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	phy->scan_vif = vif;
  	phy->scan_chan_idx = 0;
  
@@ -59,5 +61,5 @@
  	}
  
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0131-mtk-mt76-mt7996-fix-set-beacon-mcu-command.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0119-mtk-mt76-mt7996-fix-set-beacon-mcu-command.patch
similarity index 86%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0131-mtk-mt76-mt7996-fix-set-beacon-mcu-command.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0119-mtk-mt76-mt7996-fix-set-beacon-mcu-command.patch
index b35ad4b..1b39d7f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0131-mtk-mt76-mt7996-fix-set-beacon-mcu-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0119-mtk-mt76-mt7996-fix-set-beacon-mcu-command.patch
@@ -1,7 +1,7 @@
-From d3c4bfceae589098cb6cba5a3bb9125144df29fb Mon Sep 17 00:00:00 2001
+From 50cf21c286aa55676fa5a341781c5e72aa4758f5 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Tue, 14 May 2024 10:52:43 +0800
-Subject: [PATCH 131/199] mtk: mt76: mt7996: fix set beacon mcu command
+Subject: [PATCH 119/223] mtk: mt76: mt7996: fix set beacon mcu command
 
 When stopping AP, mac80211 frees beacon template before it calls
 driver's stop_ap operation. In other words, on the path of stopping
@@ -12,16 +12,17 @@
 This commit refactors mt7996_mcu_add_beacon() so that FW can be
 correctly informed when disabling AP interface.
 
+Change-Id: I7a381f959e50579266aa1fa4c2a3f9a907f4318e
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt7996/mcu.c | 26 +++++++++++++++-----------
  1 file changed, 15 insertions(+), 11 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 2a2e6116..0a0df745 100644
+index 76f0bb7e..1dcc367e 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3377,7 +3377,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+@@ -3384,7 +3384,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  	struct sk_buff *skb, *rskb;
  	struct tlv *tlv;
  	struct bss_bcn_content_tlv *bcn;
@@ -30,7 +31,7 @@
  
  	if (conf->nontransmitted)
  		return 0;
-@@ -3388,28 +3388,32 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+@@ -3395,28 +3395,32 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  		return PTR_ERR(rskb);
  
  	skb = ieee80211_beacon_get_template(hw, conf->vif, &offs, conf->link_id);
@@ -74,5 +75,5 @@
  	mt7996_mcu_beacon_mbss(rskb, skb, conf, bcn, &offs);
  	mt7996_mcu_beacon_cntdwn(conf, rskb, skb, &offs);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0132-mtk-mt76-fix-incorrect-setting-of-antenna-capability.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0120-mtk-mt76-fix-incorrect-setting-of-antenna-capability.patch
similarity index 77%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0132-mtk-mt76-fix-incorrect-setting-of-antenna-capability.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0120-mtk-mt76-fix-incorrect-setting-of-antenna-capability.patch
index 344d28f..a46553e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0132-mtk-mt76-fix-incorrect-setting-of-antenna-capability.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0120-mtk-mt76-fix-incorrect-setting-of-antenna-capability.patch
@@ -1,23 +1,24 @@
-From c7dfcaacdd6ae91fa75d2dc9c9efb7db4254c4a6 Mon Sep 17 00:00:00 2001
+From 6c2e3e0211da74d06132593d9783e0f62179ee81 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Tue, 14 May 2024 14:12:28 +0800
-Subject: [PATCH 132/199] mtk: mt76: fix incorrect setting of antenna
+Subject: [PATCH 120/223] mtk: mt76: fix incorrect setting of antenna
  capability
 
 Due to current implementation of single-wiphy architecture, only one antenna capability can be set for all PHYs via mt7996_set_antenna().
 Therefore, if antenna capabilities of PHYs are different, some may be set wrong.
 Thus, temporarily make mt7996_set_antenna() dummy.
 
+Change-Id: Ib41f767daf7ff42423bb6e5ec6c5c8c213fba714
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt7996/main.c | 4 ++++
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 990a38a7..0a87cfad 100644
+index 2b16385d..3a85b025 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -1670,6 +1670,10 @@ mt7996_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
+@@ -1674,6 +1674,10 @@ mt7996_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	int band, max_nss = hweight8(hw->wiphy->available_antennas_tx);
  
@@ -29,5 +30,5 @@
  	if (hw != dev->phy.mt76->hw)
  		return 0;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0133-mtk-mt76-mt7996-fix-stop_tx_ba_session-warning.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0121-mtk-mt76-mt7996-fix-stop_tx_ba_session-warning.patch
similarity index 87%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0133-mtk-mt76-mt7996-fix-stop_tx_ba_session-warning.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0121-mtk-mt76-mt7996-fix-stop_tx_ba_session-warning.patch
index f58b151..c1f4116 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0133-mtk-mt76-mt7996-fix-stop_tx_ba_session-warning.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0121-mtk-mt76-mt7996-fix-stop_tx_ba_session-warning.patch
@@ -1,7 +1,7 @@
-From 8bb932b534480f0025fdbd57270b194ed7738e2d Mon Sep 17 00:00:00 2001
+From 6ae2f546b249738b3c1f3ad573dd2ce4d2020558 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 15 May 2024 11:10:17 +0800
-Subject: [PATCH 133/199] mtk: mt76: mt7996: fix stop_tx_ba_session warning
+Subject: [PATCH 121/223] mtk: mt76: mt7996: fix stop_tx_ba_session warning
 
 ---
  mt7996/main.c | 11 +++++++----
@@ -9,7 +9,7 @@
  2 files changed, 13 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 0a87cfad..c7ec01f2 100644
+index 3a85b025..3f93eda0 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1079,7 +1079,8 @@ static void mt7996_remove_link_sta(struct mt7996_dev *dev,
@@ -53,10 +53,10 @@
  }
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 0a0df745..48ff11d9 100644
+index 1dcc367e..d9d29c4e 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1735,6 +1735,9 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
+@@ -1740,6 +1740,9 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  			mconf_dereference_protected(msta->vif, link_id);
  		int ret;
  
@@ -66,7 +66,7 @@
  		if (enable && !params->amsdu)
  			mlink->wcid.amsdu = false;
  
-@@ -1769,6 +1772,9 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
+@@ -1774,6 +1777,9 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
  			mconf_dereference_protected(msta->vif, link_id);
  		int ret;
  
@@ -77,5 +77,5 @@
  					enable, false);
  		if (ret)
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0134-mtk-mt76-mt7996-do-software-link-addr-translation-fo.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0122-mtk-mt76-mt7996-do-software-link-addr-translation-fo.patch
similarity index 88%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0134-mtk-mt76-mt7996-do-software-link-addr-translation-fo.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0122-mtk-mt76-mt7996-do-software-link-addr-translation-fo.patch
index 746cedc..b0c0f55 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0134-mtk-mt76-mt7996-do-software-link-addr-translation-fo.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0122-mtk-mt76-mt7996-do-software-link-addr-translation-fo.patch
@@ -1,7 +1,7 @@
-From 17651c073f135c837ca0b8d0b3e9ab8c4beef67f Mon Sep 17 00:00:00 2001
+From a6b712a367b0e76ac5982f846f096ab936138c16 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 15 May 2024 17:47:33 +0800
-Subject: [PATCH 134/199] mtk: mt76: mt7996: do software link addr translation
+Subject: [PATCH 122/223] mtk: mt76: mt7996: do software link addr translation
  for EAPOL
 
 Previously, we do HW link address translation for EAPOL addr1 and addr2,
@@ -17,6 +17,8 @@
 
 Assign EAPOL's SA/DA to MLD address.
 
+Change-Id: Ibb63beb37f80075da8c0e1535fde74f9710f92f5
+Change-Id: I307146d0f88ecca0f0ea592b9157b6a7e8009fbb
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -25,10 +27,10 @@
  1 file changed, 31 insertions(+), 15 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index bba16975..020203ec 100644
+index 901c70e5..02045b84 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -831,7 +831,8 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+@@ -843,7 +843,8 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
  	txwi[5] = cpu_to_le32(val);
  
  	val = MT_TXD6_DAS;
@@ -38,7 +40,7 @@
  		val |= MT_TXD6_DIS_MAT;
  
  	if (is_mt7996(&dev->mt76))
-@@ -939,23 +940,38 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -951,23 +952,38 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key,
  				      pid, qid, 0);
  
@@ -92,5 +94,5 @@
  	}
  
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0135-mtk-mt76-mt7996-add-per-band-debugfs-folder.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0123-mtk-mt76-mt7996-add-per-band-debugfs-folder.patch
similarity index 90%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0135-mtk-mt76-mt7996-add-per-band-debugfs-folder.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0123-mtk-mt76-mt7996-add-per-band-debugfs-folder.patch
index d82f9b3..933099c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0135-mtk-mt76-mt7996-add-per-band-debugfs-folder.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0123-mtk-mt76-mt7996-add-per-band-debugfs-folder.patch
@@ -1,10 +1,11 @@
-From 84c119a7ad5969f445513f9c5759f8b041620e1f Mon Sep 17 00:00:00 2001
+From bfbeab14fc5c4a9caab56873328caee7fb407721 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 16 May 2024 18:03:19 +0800
-Subject: [PATCH 135/199] mtk: mt76: mt7996: add per-band debugfs folder
+Subject: [PATCH 123/223] mtk: mt76: mt7996: add per-band debugfs folder
 
 Add per-band debugfs folder and  move upstream debugfs knob to it.
 
+Change-Id: I4bafff017c6d1264cffab18a5ac6748cc0661c8f
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/debugfs.c | 43 +++++++++++++++++++++++++++++++------------
@@ -13,7 +14,7 @@
  3 files changed, 42 insertions(+), 18 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 2c553cf3..9d74f659 100644
+index 7e545f61..d2b38efb 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -1073,21 +1073,49 @@ mt7996_airtime_read(struct seq_file *s, void *data)
@@ -89,7 +90,7 @@
  			    &fops_fw_debug_muru_disable);
  
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 6e20a174..01795404 100644
+index e674361a..9a2e51f8 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -787,7 +787,7 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
@@ -101,7 +102,7 @@
  	if (ret)
  		goto error;
  
-@@ -1708,6 +1708,14 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1728,6 +1728,14 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -116,7 +117,7 @@
  	ret = mt7996_register_phy(dev, mt7996_phy2(dev), MT_BAND1);
  	if (ret)
  		return ret;
-@@ -1732,10 +1740,6 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1752,10 +1760,6 @@ int mt7996_register_device(struct mt7996_dev *dev)
  			goto error;
  	}
  
@@ -128,10 +129,10 @@
  	if (ret)
  		goto error;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index c60262ec..08a43e61 100644
+index 94121471..ef41beee 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1226,7 +1226,8 @@ int mt7996_dfs_init_radar_detector(struct mt7996_phy *phy);
+@@ -1230,7 +1230,8 @@ int mt7996_dfs_init_radar_detector(struct mt7996_phy *phy);
  void mt7996_set_stream_he_eht_caps(struct mt7996_phy *phy);
  void mt7996_set_stream_vht_txbf_caps(struct mt7996_phy *phy);
  void mt7996_update_channel(struct mt76_phy *mphy);
@@ -142,5 +143,5 @@
  bool mt7996_debugfs_rx_log(struct mt7996_dev *dev, const void *data, int len);
  int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0136-mtk-mt76-mt7996-move-internal-debugfs-knob-to-per-ba.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0124-mtk-mt76-mt7996-move-internal-debugfs-knob-to-per-ba.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0136-mtk-mt76-mt7996-move-internal-debugfs-knob-to-per-ba.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0124-mtk-mt76-mt7996-move-internal-debugfs-knob-to-per-ba.patch
index b8a705e..0af54d5 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0136-mtk-mt76-mt7996-move-internal-debugfs-knob-to-per-ba.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0124-mtk-mt76-mt7996-move-internal-debugfs-knob-to-per-ba.patch
@@ -1,9 +1,10 @@
-From 729686d815e03189a23d2f0a987289eb34ac7676 Mon Sep 17 00:00:00 2001
+From 4a9412a2376d1a0c1c642cc2dea242b059a7463d Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 16 May 2024 18:04:28 +0800
-Subject: [PATCH 136/199] mtk: mt76: mt7996: move internal debugfs knob to
+Subject: [PATCH 124/223] mtk: mt76: mt7996: move internal debugfs knob to
  per-band folder
 
+Change-Id: I03efc222cd57035aa089babbc94c70e807494763
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/debugfs.c     |   5 +-
@@ -12,7 +13,7 @@
  3 files changed, 44 insertions(+), 81 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 9d74f659..71dc0449 100644
+index d2b38efb..9a62dfda 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -1105,6 +1105,9 @@ int mt7996_init_band_debugfs(struct mt7996_phy *phy)
@@ -35,10 +36,10 @@
  
  	return 0;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 08a43e61..cb35a927 100644
+index ef41beee..21be14d0 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1286,7 +1286,8 @@ enum edcca_bw_id {
+@@ -1290,7 +1290,8 @@ enum edcca_bw_id {
  };
  
  #ifdef CONFIG_MTK_DEBUG
@@ -49,7 +50,7 @@
  int mt7996_mcu_set_sr_enable(struct mt7996_phy *phy, u8 action, u64 val, bool set);
  void mt7996_mcu_rx_sr_event(struct mt7996_dev *dev, struct sk_buff *skb);
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 0820e0d0..59c6db73 100644
+index 0cf48193..06fa83bb 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -14,13 +14,14 @@
@@ -96,7 +97,7 @@
  
  /* AMSDU INFO */
  static int mt7996_amsdu_result_read(struct seq_file *s, void *data)
-@@ -704,10 +688,12 @@ static int mt7996_trinfo_read(struct seq_file *s, void *data)
+@@ -703,10 +687,12 @@ static int mt7996_trinfo_read(struct seq_file *s, void *data)
  }
  
  /* MIB INFO */
@@ -111,7 +112,7 @@
  	u8 bss_nums = BSS_NUM;
  	u32 idx;
  	u32 mac_val, band_offset = 0, band_offset_umib = 0;
-@@ -920,24 +906,7 @@ static int mt7996_mibinfo_read_per_band(struct seq_file *s, int band_idx)
+@@ -919,24 +905,7 @@ static int mt7996_mibinfo_read_per_band(struct seq_file *s, int band_idx)
  
  	return 0;
  }
@@ -137,7 +138,7 @@
  
  /* WTBL INFO */
  static int
-@@ -3036,9 +3005,9 @@ static const struct file_operations fops_muru_fixed_group_rate = {
+@@ -3035,9 +3004,9 @@ static const struct file_operations fops_muru_fixed_group_rate = {
  
  static int mt7996_muru_prot_thr_set(void *data, u64 val)
  {
@@ -149,7 +150,7 @@
  }
  
  DEFINE_DEBUGFS_ATTRIBUTE(fops_muru_prot_thr, NULL,
-@@ -4219,9 +4188,32 @@ mt7996_drr_info(struct seq_file *s, void *data)
+@@ -4218,9 +4187,32 @@ mt7996_drr_info(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -184,7 +185,7 @@
  	u32 device_id = (dev->mt76.rev) >> 16;
  	int i = 0;
  	static const struct mt7996_dbg_reg_desc dbg_reg_s[] = {
-@@ -4246,13 +4238,6 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -4245,13 +4237,6 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  		WTBL_LMAC_DW9 = WTBL_LMAC_DW9_7992;
  	}
  
@@ -198,7 +199,7 @@
  	/* amsdu */
  	debugfs_create_devm_seqfile(dev->mt76.dev, "amsdu_info", dir,
  				    mt7996_amsdu_result_read);
-@@ -4270,24 +4255,12 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -4269,24 +4254,12 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  	debugfs_create_devm_seqfile(dev->mt76.dev, "fw_wm_info", dir,
  				    mt7996_fw_wm_info_read);
  
@@ -223,7 +224,7 @@
  	debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
  				    mt7996_show_eeprom_mode);
  
-@@ -4300,23 +4273,12 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -4299,23 +4272,12 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  
  	dev->dbg.sku_disable = true; /* For SQC */
  	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
@@ -248,7 +249,7 @@
  
  	if (dev->has_rro) {
  		debugfs_create_u32("rro_sid", 0600, dir, &dev->dbg.sid);
-@@ -4326,7 +4288,6 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -4325,7 +4287,6 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  					    mt7996_show_rro_mib);
  	}
  
@@ -256,7 +257,7 @@
  	debugfs_create_file("thermal_recal", 0200, dir, dev, &fops_thermal_recal);
  	debugfs_create_file("reset_counter", 0200, dir, dev, &fops_reset_counter);
  
-@@ -4346,8 +4307,6 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -4345,8 +4306,6 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  	debugfs_create_file("amsdu_para", 0600, dir, dev, &fops_amsdu_para);
  	debugfs_create_devm_seqfile(dev->mt76.dev, "hw_amsdu_info", dir,
  	                            mt7996_hw_amsdu_info_read);
@@ -266,5 +267,5 @@
  
  #endif
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0137-mtk-mt76-mt7996-refactor-amsdu-debugfs.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0125-mtk-mt76-mt7996-refactor-amsdu-debugfs.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0137-mtk-mt76-mt7996-refactor-amsdu-debugfs.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0125-mtk-mt76-mt7996-refactor-amsdu-debugfs.patch
index a05b8ca..5670dc8 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0137-mtk-mt76-mt7996-refactor-amsdu-debugfs.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0125-mtk-mt76-mt7996-refactor-amsdu-debugfs.patch
@@ -1,7 +1,7 @@
-From 48926fde96602e41c02879d7a020f4b24d332f75 Mon Sep 17 00:00:00 2001
+From e7b50308230e874028c65233d5e2f7a7d1ad6479 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 17 May 2024 17:34:03 +0800
-Subject: [PATCH 137/199] mtk: mt76: mt7996: refactor amsdu debugfs
+Subject: [PATCH 125/223] mtk: mt76: mt7996: refactor amsdu debugfs
 
 1. Remove hw_amsdu_info which is duplicated with amsdu_info.
 
@@ -9,13 +9,14 @@
    If amsdu_info read CR directly, the CR would be cleared and the
    mt7996_mac_work cannot get correct value.
 
+Change-Id: Ie83e861f32fa7ede075916f2393df51e39bebbad
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/mtk_debugfs.c | 63 ++++++++++++++++----------------------------
  1 file changed, 22 insertions(+), 41 deletions(-)
 
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 59c6db73..a7cbde3e 100644
+index 06fa83bb..9d8c1942 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -210,28 +210,35 @@ DEFINE_SHOW_ATTRIBUTE(mt7996_agginfo);
@@ -69,7 +70,7 @@
  	return 0;
  }
  
-@@ -3342,30 +3349,6 @@ static const struct file_operations fops_amsdu_para = {
+@@ -3341,30 +3348,6 @@ static const struct file_operations fops_amsdu_para = {
  	.llseek = default_llseek,
  };
  
@@ -100,7 +101,7 @@
  /* PSE INFO */
  static struct bmac_queue_info_t pse_queue_empty_info[] = {
  	{"CPU Q0",  ENUM_UMAC_CPU_PORT_1,     ENUM_UMAC_CTX_Q_0},
-@@ -4305,8 +4288,6 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
+@@ -4304,8 +4287,6 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
  	/* amsdu */
  	debugfs_create_file("amsdu_algo", 0600, dir, dev, &fops_amsdu_algo);
  	debugfs_create_file("amsdu_para", 0600, dir, dev, &fops_amsdu_para);
@@ -110,5 +111,5 @@
  
  #endif
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0138-mtk-mt76-mt7996-trigger-channel-calibration-for-DFS-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0126-mtk-mt76-mt7996-trigger-channel-calibration-for-DFS-.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0138-mtk-mt76-mt7996-trigger-channel-calibration-for-DFS-.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0126-mtk-mt76-mt7996-trigger-channel-calibration-for-DFS-.patch
index 6160525..11e2f62 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0138-mtk-mt76-mt7996-trigger-channel-calibration-for-DFS-.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0126-mtk-mt76-mt7996-trigger-channel-calibration-for-DFS-.patch
@@ -1,13 +1,14 @@
-From 29f282a0ca7e594da0b23db9429c0588408a708e Mon Sep 17 00:00:00 2001
+From 799a94c158a9c9df4586f8efec1cf586a7ad29d9 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 17 May 2024 14:49:50 +0800
-Subject: [PATCH 138/199] mtk: mt76: mt7996: trigger channel calibration for
+Subject: [PATCH 126/223] mtk: mt76: mt7996: trigger channel calibration for
  DFS link after sta is associated
 
 Trigger channel calibration (set channel with switch reason = NORMAL)
 for DFS link after STA is associated.
 Without this patch, 5G link might have high PER during T.P. test
 
+Change-Id: I65ed79767049f4fdd31ac95a93496d1ccdc39699
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mt7996/main.c     | 15 +++++++++++----
@@ -17,7 +18,7 @@
  4 files changed, 18 insertions(+), 10 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index c7ec01f2..40418f7e 100644
+index 3f93eda0..f45f6c02 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -82,12 +82,12 @@ int mt7996_run(struct ieee80211_hw *hw)
@@ -49,7 +50,7 @@
  	if (ret)
  		goto out;
  
-@@ -2732,6 +2732,13 @@ mt7996_event_callback(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2736,6 +2736,13 @@ mt7996_event_callback(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  				next_time = min(next_time,
  						MT7996_MAX_BEACON_LOSS *
  						conf->beacon_int);
@@ -64,10 +65,10 @@
  
  			ieee80211_queue_delayed_work(hw, &mvif->beacon_mon_work,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 48ff11d9..3a950a90 100644
+index d9d29c4e..a6f2c157 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4397,7 +4397,7 @@ int mt7996_mcu_rdd_background_enable(struct mt7996_phy *phy,
+@@ -4405,7 +4405,7 @@ int mt7996_mcu_rdd_background_enable(struct mt7996_phy *phy,
  				  0, region);
  }
  
@@ -76,7 +77,7 @@
  {
  	static const u8 ch_band[] = {
  		[NL80211_BAND_2GHZ] = 0,
-@@ -4408,6 +4408,8 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
+@@ -4416,6 +4416,8 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
  	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
  	int freq1 = chandef->center_freq1;
  	u8 band_idx = phy->mt76->band_idx;
@@ -85,7 +86,7 @@
  	struct {
  		/* fixed field */
  		u8 __rsv[4];
-@@ -4448,8 +4450,7 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
+@@ -4456,8 +4458,7 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
  		 phy->mt76->hw->conf.flags & IEEE80211_CONF_IDLE ||
  		 phy->scan_chan)
  		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
@@ -96,10 +97,10 @@
  	else
  		req.switch_reason = CH_SWITCH_NORMAL;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index cb35a927..259845a1 100644
+index 21be14d0..07c72d2b 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1054,7 +1054,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+@@ -1058,7 +1058,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  int mt7996_mcu_add_mld_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  			   struct ieee80211_sta *sta, unsigned long add);
  int mt7996_set_channel(struct mt7996_phy *phy, struct cfg80211_chan_def *chandef);
@@ -109,10 +110,10 @@
  int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
  				   void *data, u16 version);
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 0565ebc9..8b35d125 100644
+index 799e443c..c68619cb 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -544,7 +544,7 @@ mt7996_tm_dpd_prek_send_req(struct mt7996_phy *phy, struct mt7996_tm_req *req,
+@@ -550,7 +550,7 @@ mt7996_tm_dpd_prek_send_req(struct mt7996_phy *phy, struct mt7996_tm_req *req,
  
  		/* set channel switch reason */
  		mphy->hw->conf.flags |= IEEE80211_CONF_OFFCHANNEL;
@@ -121,7 +122,7 @@
  
  		ret = mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(TESTMODE_CTRL), req,
  					sizeof(*req), false);
-@@ -558,7 +558,7 @@ out:
+@@ -564,7 +564,7 @@ out:
  	mphy->hw->conf.flags &= ~IEEE80211_CONF_OFFCHANNEL;
  	memcpy(chandef, &chandef_backup, sizeof(struct cfg80211_chan_def));
  	memcpy(chandef->chan, &chan_backup, sizeof(struct ieee80211_channel));
@@ -131,5 +132,5 @@
  	return ret;
  }
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0139-mtk-mt76-mt7996-do-not-remove-bss_info-and-starec-wh.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0127-mtk-mt76-mt7996-do-not-remove-bss_info-and-starec-wh.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0139-mtk-mt76-mt7996-do-not-remove-bss_info-and-starec-wh.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0127-mtk-mt76-mt7996-do-not-remove-bss_info-and-starec-wh.patch
index 30c8b37..acef98c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0139-mtk-mt76-mt7996-do-not-remove-bss_info-and-starec-wh.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0127-mtk-mt76-mt7996-do-not-remove-bss_info-and-starec-wh.patch
@@ -1,7 +1,7 @@
-From 525b850e3140488b346601070adbeb5fd163af67 Mon Sep 17 00:00:00 2001
+From ebc64cf0ebe700231a5b94b299abb49b8db88308 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 22 May 2024 18:22:51 +0800
-Subject: [PATCH 139/199] mtk: mt76: mt7996: do not remove bss_info and starec
+Subject: [PATCH 127/223] mtk: mt76: mt7996: do not remove bss_info and starec
  when assign_vif_chanctx
 
 When STA interface re-connect from rootAP, it would unsign/assign vif
@@ -10,13 +10,14 @@
 be cleared. But the hostapd does not remove interface so it would not
 set key again.
 
+Change-Id: Icdd599f163268e7f313589f0ca35a2f220e2b783
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/main.c | 17 +++++++++++++----
  1 file changed, 13 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 40418f7e..2a2112f1 100644
+index f45f6c02..be0864a0 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -338,6 +338,9 @@ static int mt7996_add_bss_conf(struct mt7996_phy *phy,
@@ -29,7 +30,7 @@
  	if (conf != &vif->bss_conf) {
  		mconf = kzalloc(sizeof(*mconf), GFP_KERNEL);
  		if (!mconf)
-@@ -2516,10 +2519,16 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2520,10 +2523,16 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  	mutex_lock(&phy->dev->mt76.mutex);
  
@@ -51,5 +52,5 @@
  	ret = mt7996_add_bss_conf(phy, vif, link_conf);
  	if (ret) {
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0140-mtk-mt76-mt7996-remove-chanctx-in-mt7996_bss_conf.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0128-mtk-mt76-mt7996-remove-chanctx-in-mt7996_bss_conf.patch
similarity index 78%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0140-mtk-mt76-mt7996-remove-chanctx-in-mt7996_bss_conf.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0128-mtk-mt76-mt7996-remove-chanctx-in-mt7996_bss_conf.patch
index d7ff224..30d4ef1 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0140-mtk-mt76-mt7996-remove-chanctx-in-mt7996_bss_conf.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0128-mtk-mt76-mt7996-remove-chanctx-in-mt7996_bss_conf.patch
@@ -1,12 +1,13 @@
-From c684d5b236f67ffb278ffe9c0836df16a5c0eeb7 Mon Sep 17 00:00:00 2001
+From 279a649bea9faaab320a88c2dfeedd83668d059c Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 28 May 2024 09:33:11 +0800
-Subject: [PATCH 140/199] mtk: mt76: mt7996: remove chanctx in mt7996_bss_conf
+Subject: [PATCH 128/223] mtk: mt76: mt7996: remove chanctx in mt7996_bss_conf
 
 Different vif under the same phy cannot use different chanctx.
 So it is better to maintain the chanctx in mt7996_phy.
 Instead of mconf->chanctx, get the chanctx by mconf->phy->chanctx.
 
+Change-Id: Ic66dbd007a7c7b5832161197e695d5c0e1dba522
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/main.c   | 8 +-------
@@ -14,10 +15,10 @@
  2 files changed, 1 insertion(+), 9 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 2a2112f1..4f3b0070 100644
+index be0864a0..2b272cc4 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -2536,8 +2536,6 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2540,8 +2540,6 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		return ret;
  	}
  
@@ -26,7 +27,7 @@
  	ctx->nbss_assigned++;
  	mvif->band_to_link[phy->mt76->band_idx] = link_id;
  
-@@ -2556,8 +2554,6 @@ mt7996_unassign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2560,8 +2558,6 @@ mt7996_unassign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  {
  	struct mt7996_chanctx *ctx = mt7996_chanctx_get(conf);
  	struct mt7996_phy *phy = ctx->phy;
@@ -35,7 +36,7 @@
  
  	wiphy_info(hw->wiphy, "Remove VIF (addr: %pM, type: %d, link_id: %d) from channel context: %d MHz\n",
  		   vif->addr, vif->type, link_conf->link_id,
-@@ -2569,8 +2565,6 @@ mt7996_unassign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2573,8 +2569,6 @@ mt7996_unassign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	if (test_bit(MT76_SCANNING, &phy->mt76->state))
  		mt7996_scan_complete(phy, true);
  
@@ -44,7 +45,7 @@
  	ctx->nbss_assigned--;
  
  	mutex_unlock(&phy->dev->mt76.mutex);
-@@ -2744,7 +2738,7 @@ mt7996_event_callback(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2748,7 +2742,7 @@ mt7996_event_callback(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  				/* trigger calibration for DFS link */
  				if (!cfg80211_reg_can_beacon(hw->wiphy,
@@ -54,10 +55,10 @@
  					mt7996_mcu_set_chan_info(phy, UNI_CHANNEL_SWITCH,
  								 true);
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 259845a1..8f084651 100644
+index 07c72d2b..9f58a793 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -347,8 +347,6 @@ struct mt7996_bss_conf {
+@@ -348,8 +348,6 @@ struct mt7996_bss_conf {
  	struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS];
  	struct cfg80211_bitrate_mask bitrate_mask;
  
@@ -67,5 +68,5 @@
  	u8 own_mld_id;
  	u8 bpcc;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0141-mtk-mt76-mt7996-temporarily-disable-EPCS.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0129-mtk-mt76-mt7996-temporarily-disable-EPCS.patch
similarity index 71%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0141-mtk-mt76-mt7996-temporarily-disable-EPCS.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0129-mtk-mt76-mt7996-temporarily-disable-EPCS.patch
index 98d1f3a..1697db6 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0141-mtk-mt76-mt7996-temporarily-disable-EPCS.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0129-mtk-mt76-mt7996-temporarily-disable-EPCS.patch
@@ -1,20 +1,21 @@
-From 268b885a43ad602ac8166ba9464d6b2673045ae1 Mon Sep 17 00:00:00 2001
+From b10446fafd8688cdcfc358bd7a293cb3cc69aa6c Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Tue, 28 May 2024 15:58:57 +0800
-Subject: [PATCH 141/199] mtk: mt76: mt7996: temporarily disable EPCS
+Subject: [PATCH 129/223] mtk: mt76: mt7996: temporarily disable EPCS
 
 EPCS is not yet ready, so do not claim to support it.
 
+Change-Id: I2b3f9d87b1f3de17da178b9b6eddeaecdb5c14cd
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt7996/init.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 01795404..7cf3a37e 100644
+index 9a2e51f8..32c79bd8 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -1518,7 +1518,7 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
+@@ -1538,7 +1538,7 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
  	eht_cap->has_eht = true;
  
  	eht_cap_elem->mac_cap_info[0] =
@@ -24,5 +25,5 @@
  		u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_11454,
  			       IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0142-mtk-mt76-mt7996-fix-kite-can-t-handle-11v-beacon-on-.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0130-mtk-mt76-mt7996-fix-kite-can-t-handle-11v-beacon-on-.patch
similarity index 87%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0142-mtk-mt76-mt7996-fix-kite-can-t-handle-11v-beacon-on-.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0130-mtk-mt76-mt7996-fix-kite-can-t-handle-11v-beacon-on-.patch
index 8aabd07..b9f377e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0142-mtk-mt76-mt7996-fix-kite-can-t-handle-11v-beacon-on-.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0130-mtk-mt76-mt7996-fix-kite-can-t-handle-11v-beacon-on-.patch
@@ -1,7 +1,7 @@
-From ab5d7deb92a8180b4d236da52863bfe9b7327dca Mon Sep 17 00:00:00 2001
+From f703aab4906d08ae441eb0c710c288db45445cae Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Thu, 30 May 2024 17:39:38 +0800
-Subject: [PATCH 142/199] mtk: mt76: mt7996: fix kite can't handle 11v beacon
+Subject: [PATCH 130/223] mtk: mt76: mt7996: fix kite can't handle 11v beacon
  on sta side
 
 this hw flag SUPPORTS_MULTI_BSSID need to set. otherwise cfg80211_parse_mbssid_data will not handle 11v mbss beacon
@@ -12,7 +12,7 @@
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 7cf3a37e..cc696a69 100644
+index 32c79bd8..001f0d9c 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -48,6 +48,7 @@ static const struct ieee80211_iface_combination if_comb[] = {
@@ -33,5 +33,5 @@
  	ieee80211_hw_set(hw, CONNECTION_MONITOR);
  
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0143-mtk-mt76-mt7996-add-post-channel-switch-for-DFS-chan.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0131-mtk-mt76-mt7996-add-post-channel-switch-for-DFS-chan.patch
similarity index 88%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0143-mtk-mt76-mt7996-add-post-channel-switch-for-DFS-chan.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0131-mtk-mt76-mt7996-add-post-channel-switch-for-DFS-chan.patch
index cd106e8..421aa70 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0143-mtk-mt76-mt7996-add-post-channel-switch-for-DFS-chan.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0131-mtk-mt76-mt7996-add-post-channel-switch-for-DFS-chan.patch
@@ -1,7 +1,7 @@
-From 7b2e80bf62f10469992b8e08c801e9b64f7c775d Mon Sep 17 00:00:00 2001
+From 00ef78d4d0738e36f529950b754e0042bdd57a68 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 21 Feb 2024 13:41:23 +0800
-Subject: [PATCH 143/199] mtk: mt76: mt7996: add post channel switch for DFS
+Subject: [PATCH 131/223] mtk: mt76: mt7996: add post channel switch for DFS
  channel switching
 
 Add post channel switch callback for DFS channel switch support
@@ -17,7 +17,7 @@
  2 files changed, 17 insertions(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index cc696a69..0ee2acfb 100644
+index 001f0d9c..420c23c9 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -451,6 +451,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -29,7 +29,7 @@
  	hw->max_tx_fragments = 4;
  
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 4f3b0070..c8259b86 100644
+index 2b272cc4..485c87f9 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1078,6 +1078,21 @@ fail:
@@ -54,7 +54,7 @@
  static void mt7996_remove_link_sta(struct mt7996_dev *dev,
  				   struct ieee80211_bss_conf *conf,
  				   struct mt7996_bss_conf *mconf,
-@@ -2791,6 +2806,7 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -2795,6 +2810,7 @@ const struct ieee80211_ops mt7996_ops = {
  	.release_buffered_frames = mt76_release_buffered_frames,
  	.get_txpower = mt7996_get_txpower,
  	.channel_switch_beacon = mt7996_channel_switch_beacon,
@@ -63,5 +63,5 @@
  	.get_et_sset_count = mt7996_get_et_sset_count,
  	.get_et_stats = mt7996_get_et_stats,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0144-mtk-mt76-mt7996-update-testmode-bf-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0132-mtk-mt76-mt7996-update-testmode-bf-support.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0144-mtk-mt76-mt7996-update-testmode-bf-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0132-mtk-mt76-mt7996-update-testmode-bf-support.patch
index e6b3a8c..40e7ee1 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0144-mtk-mt76-mt7996-update-testmode-bf-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0132-mtk-mt76-mt7996-update-testmode-bf-support.patch
@@ -1,13 +1,14 @@
-From 90a87564fc0a2fd18c73b290548e6ad299f4b3c9 Mon Sep 17 00:00:00 2001
+From 04a4a2672095e1b0162153655874ba194370ffc2 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 3 Jun 2024 16:40:38 +0800
-Subject: [PATCH 144/199] mtk: mt76: mt7996: update testmode bf support
+Subject: [PATCH 132/223] mtk: mt76: mt7996: update testmode bf support
 
 Fix bssid & omac idx to band idx when testmode is enabled
 
 Add support for per-packet bw & primary channel selection index configuration
 This is used for ibf calibaration of group 9 ~ 13 in Kite
 
+Change-Id: Ib993f75d331b1fa22b7c07197321f91c8dae46ec
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mt76.h            |  3 +++
@@ -19,10 +20,10 @@
  6 files changed, 98 insertions(+), 34 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index c6dda4a8..f544814e 100644
+index bc263bd4..526b6298 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -782,6 +782,9 @@ struct mt76_testmode_data {
+@@ -796,6 +796,9 @@ struct mt76_testmode_data {
  	bool ibf;
  	bool ebf;
  
@@ -33,7 +34,7 @@
  
  	u8 tx_power[4];
 diff --git a/mt7996/main.c b/mt7996/main.c
-index c8259b86..21457a61 100644
+index 485c87f9..f67e1b5d 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -349,16 +349,27 @@ static int mt7996_add_bss_conf(struct mt7996_phy *phy,
@@ -74,10 +75,10 @@
  
  	mconf->own_mld_id = get_own_mld_idx(dev->mld_id_mask, false);
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 8b35d125..b956915e 100644
+index c68619cb..240227a9 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -235,8 +235,10 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
+@@ -241,8 +241,10 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
  
  	mt7996_tm_rf_switch_mode(dev, rf_test_mode);
  
@@ -90,7 +91,7 @@
  
  	mt7996_tm_set(dev, SET_ID(BAND_IDX), phy->mt76->band_idx);
  
-@@ -252,9 +254,11 @@ mt7996_tm_update_channel(struct mt7996_phy *phy)
+@@ -258,9 +260,11 @@ mt7996_tm_update_channel(struct mt7996_phy *phy)
  {
  #define CHAN_FREQ_BW_80P80_TAG		(SET_ID(CHAN_FREQ) | BIT(16))
  	struct mt7996_dev *dev = phy->dev;
@@ -103,7 +104,7 @@
  	static const u8 ch_band[] = {
  		[NL80211_BAND_2GHZ] = 0,
  		[NL80211_BAND_5GHZ] = 1,
-@@ -274,18 +278,37 @@ mt7996_tm_update_channel(struct mt7996_phy *phy)
+@@ -280,18 +284,37 @@ mt7996_tm_update_channel(struct mt7996_phy *phy)
  		mt7996_tm_set(dev, CHAN_FREQ_BW_80P80_TAG, chandef->center_freq2 * 1000);
  	}
  
@@ -147,7 +148,7 @@
  }
  
  static void
-@@ -1179,14 +1202,9 @@ mt7996_tm_txbf_init(struct mt7996_phy *phy, u16 *val)
+@@ -1185,14 +1208,9 @@ mt7996_tm_txbf_init(struct mt7996_phy *phy, u16 *val)
  	mt7996_tm_set_mac_addr(dev, td->addr[1], SET_ID(SA));
  	mt7996_tm_set_mac_addr(dev, td->addr[2], SET_ID(BSSID));
  
@@ -164,7 +165,7 @@
  
  	if (td->ibf) {
  		if (td->is_txbf_dut) {
-@@ -1360,7 +1378,8 @@ mt7996_tm_add_txbf_sta(struct mt7996_phy *phy, u8 pfmu_idx, u8 nr, u8 nc, bool e
+@@ -1367,7 +1385,8 @@ mt7996_tm_add_txbf_sta(struct mt7996_phy *phy, u8 pfmu_idx, u8 nr, u8 nc, bool e
  			.tx_mode = mt7996_tm_rate_mapping(td->tx_rate_mode, RATE_MODE_TO_PHY),
  		},
  	};
@@ -174,7 +175,7 @@
  
  	if ((td->tx_rate_mode == MT76_TM_TX_MODE_HE_SU ||
  	     td->tx_rate_mode == MT76_TM_TX_MODE_EHT_SU) && !td->ibf) {
-@@ -1390,11 +1409,12 @@ mt7996_tm_add_txbf_sta(struct mt7996_phy *phy, u8 pfmu_idx, u8 nr, u8 nc, bool e
+@@ -1397,11 +1416,12 @@ mt7996_tm_add_txbf_sta(struct mt7996_phy *phy, u8 pfmu_idx, u8 nr, u8 nc, bool e
  		}
  	}
  
@@ -189,7 +190,7 @@
  	req.bf.tx_mode = (td->tx_rate_mode == MT76_TM_TX_MODE_EHT_SU) ? 0xf : req.bf.tx_mode;
  
  	if (ebf) {
-@@ -1421,6 +1441,7 @@ mt7996_tm_txbf_profile_update(struct mt7996_phy *phy, u16 *val, bool ebf)
+@@ -1428,6 +1448,7 @@ mt7996_tm_txbf_profile_update(struct mt7996_phy *phy, u16 *val, bool ebf)
  	struct mt7996_dev *dev = phy->dev;
  	struct mt7996_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
  	u8 rate, pfmu_idx = val[0], nc = val[2], nr;
@@ -197,7 +198,7 @@
  	int ret;
  	bool is_atenl = val[5];
  
-@@ -1439,7 +1460,9 @@ mt7996_tm_txbf_profile_update(struct mt7996_phy *phy, u16 *val, bool ebf)
+@@ -1446,7 +1467,9 @@ mt7996_tm_txbf_profile_update(struct mt7996_phy *phy, u16 *val, bool ebf)
  	tag->t1.nr = nr;
  	tag->t1.nc = nc;
  	tag->t1.invalid_prof = true;
@@ -209,7 +210,7 @@
  
  	if (ebf) {
 diff --git a/testmode.c b/testmode.c
-index f1d162ce..f7237cc0 100644
+index a1744755..2834400f 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -25,6 +25,8 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -260,7 +261,7 @@
  	     nla_put_u32(msg, MT76_TM_ATTR_FREQ_OFFSET, td->freq_offset)))
  		goto out;
 diff --git a/testmode.h b/testmode.h
-index bda7624a..ed2068e5 100644
+index 794a74f9..44f9984c 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -37,6 +37,9 @@
@@ -338,5 +339,5 @@
  	[MT76_TM_ATTR_AID] = { .type = NLA_U8 },
  	[MT76_TM_ATTR_RU_ALLOC] = { .type = NLA_U8 },
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0145-mtk-mt76-mt7996-add-mlo-related-debugfs-knob.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0133-mtk-mt76-mt7996-add-mlo-related-debugfs-knob.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0145-mtk-mt76-mt7996-add-mlo-related-debugfs-knob.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0133-mtk-mt76-mt7996-add-mlo-related-debugfs-knob.patch
index a72a37c..819ecfb 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0145-mtk-mt76-mt7996-add-mlo-related-debugfs-knob.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0133-mtk-mt76-mt7996-add-mlo-related-debugfs-knob.patch
@@ -1,7 +1,7 @@
-From 37fd1cdf8fb3c77948c858e7bb258cd02b3cac31 Mon Sep 17 00:00:00 2001
+From 4f2f27ccf6133c9f51f798a872387aa15337b923 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 27 May 2024 19:06:04 +0800
-Subject: [PATCH 145/199] mtk: mt76: mt7996: add mlo related debugfs knob
+Subject: [PATCH 133/223] mtk: mt76: mt7996: add mlo related debugfs knob
 
 Add the following debugfs knob
 Per-bss link info
@@ -21,7 +21,7 @@
  3 files changed, 119 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 71dc0449..6eb395c4 100644
+index 9a62dfda..bafbcda1 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -1330,11 +1330,128 @@ mt7996_queues_show(struct seq_file *s, void *data)
@@ -162,10 +162,10 @@
  	seq_printf(file, "\t\tMPDU Fails: %u (PER: %u.%u%%)\n", stats->tx_failed,
  		   stats->tx_mpdus ? stats->tx_failed * 1000 / stats->tx_mpdus / 10 : 0,
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 21457a61..a85fa935 100644
+index f67e1b5d..915a9f4f 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -2841,6 +2841,7 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -2845,6 +2845,7 @@ const struct ieee80211_ops mt7996_ops = {
  	.sta_add_debugfs = mt7996_sta_add_debugfs,
  	.link_sta_add_debugfs = mt7996_link_sta_add_debugfs,
  	// .link_add_debugfs = mt7996_link_add_debugfs,
@@ -174,10 +174,10 @@
  	.set_radar_background = mt7996_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 8f084651..b5869bb8 100644
+index 9f58a793..984ae79e 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1247,6 +1247,7 @@ int mt7996_mcu_set_eml_omn(struct ieee80211_hw *hw, struct ieee80211_vif *vif, u
+@@ -1251,6 +1251,7 @@ int mt7996_mcu_set_eml_omn(struct ieee80211_hw *hw, struct ieee80211_vif *vif, u
  #ifdef CONFIG_MAC80211_DEBUGFS
  void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
@@ -186,5 +186,5 @@
  				 struct ieee80211_link_sta *link_sta,
  				 struct dentry *dir);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0146-mtk-mt76-mt7996-add-debugfs-knob-to-show-mlo-related.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0134-mtk-mt76-mt7996-add-debugfs-knob-to-show-mlo-related.patch
similarity index 95%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0146-mtk-mt76-mt7996-add-debugfs-knob-to-show-mlo-related.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0134-mtk-mt76-mt7996-add-debugfs-knob-to-show-mlo-related.patch
index a116432..ca24c64 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0146-mtk-mt76-mt7996-add-debugfs-knob-to-show-mlo-related.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0134-mtk-mt76-mt7996-add-debugfs-knob-to-show-mlo-related.patch
@@ -1,7 +1,7 @@
-From e35c211ac14b2189475f945ca9025e444d825c97 Mon Sep 17 00:00:00 2001
+From c2753e78a28cc8efca84dcf1e7d33dff6ccfa528 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 29 May 2024 18:45:50 +0800
-Subject: [PATCH 146/199] mtk: mt76: mt7996: add debugfs knob to show mlo
+Subject: [PATCH 134/223] mtk: mt76: mt7996: add debugfs knob to show mlo
  related table
 
 Add the following debugfs knob
@@ -9,6 +9,7 @@
 - /sys/kernel/debug/ieee80211/phy0/mt76/band0/agg_table
 - /sys/kernel/debug/ieee80211/phy0/mt76/band0/rmac_table
 
+Change-Id: Ia161e56146f7a9e8c5d124e161230d202ae1d0a8
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/debugfs.c       |  3 +-
@@ -18,7 +19,7 @@
  4 files changed, 119 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 6eb395c4..968174e6 100644
+index bafbcda1..240c6d46 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -1107,6 +1107,7 @@ int mt7996_init_band_debugfs(struct mt7996_phy *phy)
@@ -39,10 +40,10 @@
  	}
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index b5869bb8..96d8aae9 100644
+index 984ae79e..8af3c400 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1322,7 +1322,8 @@ void mt7996_packet_log_to_host(struct mt7996_dev *dev, const void *data, int len
+@@ -1326,7 +1326,8 @@ void mt7996_packet_log_to_host(struct mt7996_dev *dev, const void *data, int len
  void mt7996_dump_bmac_rxd_info(struct mt7996_dev *dev, __le32 *rxd);
  void mt7996_dump_bmac_txd_info(struct seq_file *s, struct mt7996_dev *dev,
  			       __le32 *txd, bool is_hif_txd, bool dump_txp);
@@ -199,5 +200,5 @@
 +}
  #endif
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0147-mtk-mt76-mt7996-add-debugfs-knob-to-set-agc.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0135-mtk-mt76-mt7996-add-debugfs-knob-to-set-agc.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0147-mtk-mt76-mt7996-add-debugfs-knob-to-set-agc.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0135-mtk-mt76-mt7996-add-debugfs-knob-to-set-agc.patch
index 41861e6..4aa3e88 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0147-mtk-mt76-mt7996-add-debugfs-knob-to-set-agc.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0135-mtk-mt76-mt7996-add-debugfs-knob-to-set-agc.patch
@@ -1,12 +1,13 @@
-From 8facea1f5154f7a3d246456e0e9e1d16872779a8 Mon Sep 17 00:00:00 2001
+From 4483bcc086666bb2eaf40774c30d35d60911524b Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 31 May 2024 10:55:03 +0800
-Subject: [PATCH 147/199] mtk: mt76: mt7996: add debugfs knob to set agc
+Subject: [PATCH 135/223] mtk: mt76: mt7996: add debugfs knob to set agc
 
 Add the following debugfs knob
 - /sys/kernel/debug/ieee80211/phy0/mt76/mlo_agc_tx
 - /sys/kernel/debug/ieee80211/phy0/mt76/mlo_agc_trig
 
+Change-Id: I7e847be11b3083b6d776e7b00c6089dec3ad1a41
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt76_connac_mcu.h      |   1 +
@@ -17,10 +18,10 @@
  5 files changed, 131 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index d72337d4..f7b1f0d0 100644
+index 2daa09cc..73cf311a 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1312,6 +1312,7 @@ enum {
+@@ -1317,6 +1317,7 @@ enum {
  	MCU_UNI_CMD_THERMAL_CAL = 0x4c,
  	MCU_UNI_CMD_RRO = 0x57,
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
@@ -60,10 +61,10 @@
  #define MT7996_PATCH_SCRAMBLE_KEY	GENMASK(15, 8)
  #define MT7996_PATCH_AES_KEY		GENMASK(7, 0)
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 96d8aae9..cb6a5753 100644
+index 8af3c400..7bb17126 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1324,6 +1324,7 @@ void mt7996_dump_bmac_txd_info(struct seq_file *s, struct mt7996_dev *dev,
+@@ -1328,6 +1328,7 @@ void mt7996_dump_bmac_txd_info(struct seq_file *s, struct mt7996_dev *dev,
  			       __le32 *txd, bool is_hif_txd, bool dump_txp);
  int mt7996_mtk_init_dev_debugfs_internal(struct mt7996_phy *phy, struct dentry *dir);
  int mt7996_mtk_init_band_debugfs_internal(struct mt7996_phy *phy, struct dentry *dir);
@@ -208,5 +209,5 @@
 +}
  #endif
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0148-mtk-mt76-mt7996-set-unused-band-to-UNSPECIFIED-in-ba.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0136-mtk-mt76-mt7996-set-unused-band-to-UNSPECIFIED-in-ba.patch
similarity index 81%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0148-mtk-mt76-mt7996-set-unused-band-to-UNSPECIFIED-in-ba.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0136-mtk-mt76-mt7996-set-unused-band-to-UNSPECIFIED-in-ba.patch
index 1e80e00..9bc37e1 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0148-mtk-mt76-mt7996-set-unused-band-to-UNSPECIFIED-in-ba.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0136-mtk-mt76-mt7996-set-unused-band-to-UNSPECIFIED-in-ba.patch
@@ -1,9 +1,10 @@
-From 946c2a0cd923e411009c541184978747947ebb5a Mon Sep 17 00:00:00 2001
+From c179e8dd87acac5c2a7d04bb7e58722da862fc95 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 5 Jun 2024 10:11:13 +0800
-Subject: [PATCH 148/199] mtk: mt76: mt7996: set unused band to UNSPECIFIED in
+Subject: [PATCH 136/223] mtk: mt76: mt7996: set unused band to UNSPECIFIED in
  band_to_link
 
+Change-Id: I21190c5952a9c2f2a7f5f619f8d1fb23dd127c6f
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/main.c   | 4 ++++
@@ -12,7 +13,7 @@
  3 files changed, 10 insertions(+)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index a85fa935..b6231dff 100644
+index 915a9f4f..9ad4a9d6 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -482,6 +482,8 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
@@ -34,10 +35,10 @@
  	if (!mvif->cs_ready_links)
  		mvif->cs_link_id = link_id;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 3a950a90..40ba5b43 100644
+index a6f2c157..a62b5f9e 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -374,6 +374,9 @@ mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
+@@ -379,6 +379,9 @@ mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  	int link_id, band_idx = mphy->band_idx;
  
  	link_id = mvif->band_to_link[band_idx];
@@ -48,10 +49,10 @@
  
  	if (!link_conf || !link_conf->csa_active || vif->type == NL80211_IFTYPE_STATION)
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index cb6a5753..dc0209de 100644
+index 7bb17126..3ff9cb68 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -962,6 +962,9 @@ mt7996_get_link_wcid(struct mt7996_dev *dev, u16 idx, u8 band_idx)
+@@ -966,6 +966,9 @@ mt7996_get_link_wcid(struct mt7996_dev *dev, u16 idx, u8 band_idx)
  
  	mlink = wcid_to_mlink(wcid);
  	link_id = mlink->sta->vif->band_to_link[band_idx];
@@ -62,5 +63,5 @@
  	if (!mlink)
  		return wcid;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0149-mtk-mt76-mt7996-support-per-link-report-of-bss-color.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0137-mtk-mt76-mt7996-support-per-link-report-of-bss-color.patch
similarity index 79%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0149-mtk-mt76-mt7996-support-per-link-report-of-bss-color.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0137-mtk-mt76-mt7996-support-per-link-report-of-bss-color.patch
index 9e2f7e6..6839514 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0149-mtk-mt76-mt7996-support-per-link-report-of-bss-color.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0137-mtk-mt76-mt7996-support-per-link-report-of-bss-color.patch
@@ -1,21 +1,22 @@
-From bd2464e8ba51bbb00a1b6aabf12041431d57289b Mon Sep 17 00:00:00 2001
+From c481c255433c20d071b76c82d8c4f4372a13fd17 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 5 Jun 2024 19:11:13 +0800
-Subject: [PATCH 149/199] mtk: mt76: mt7996: support per-link report of bss
+Subject: [PATCH 137/223] mtk: mt76: mt7996: support per-link report of bss
  color change
 
 ieee80211_color_change_finish() has been extended for per-link support.
 
+Change-Id: I8bfd562b617773a370fcc3e732d6335ed082a909
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mt7996/mcu.c | 17 ++++++++++++++---
  1 file changed, 14 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 40ba5b43..db388e66 100644
+index a62b5f9e..043f8d5c 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -472,10 +472,21 @@ out:
+@@ -477,10 +477,21 @@ out:
  static void
  mt7996_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -34,12 +35,12 @@
 +	    vif->type == NL80211_IFTYPE_STATION)
  		return;
  
--	ieee80211_color_change_finish(vif);
+-	ieee80211_color_change_finish(vif, 0);
 +	ieee80211_color_change_finish(vif, link_id);
  }
  
  static void
-@@ -511,7 +522,7 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -516,7 +527,7 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
  		case UNI_EVENT_IE_COUNTDOWN_BCC:
  			ieee80211_iterate_active_interfaces_atomic(mphy->hw,
  					IEEE80211_IFACE_ITER_RESUME_ALL,
@@ -49,5 +50,5 @@
  		}
  
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0150-mtk-mt76-mt7996-Fix-inconsistent-QoS-mapping-between.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0138-mtk-mt76-mt7996-Fix-inconsistent-QoS-mapping-between.patch
similarity index 86%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0150-mtk-mt76-mt7996-Fix-inconsistent-QoS-mapping-between.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0138-mtk-mt76-mt7996-Fix-inconsistent-QoS-mapping-between.patch
index f185fed..64030e7 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0150-mtk-mt76-mt7996-Fix-inconsistent-QoS-mapping-between.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0138-mtk-mt76-mt7996-Fix-inconsistent-QoS-mapping-between.patch
@@ -1,7 +1,7 @@
-From ac20b6e9a96c45213a2bbccb051d16e4408f2969 Mon Sep 17 00:00:00 2001
+From 0f060bd8db3e101c30617548032f00adabcd9ffa Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Fri, 7 Jun 2024 13:51:25 +0800
-Subject: [PATCH 150/199] mtk: mt76: mt7996: Fix inconsistent QoS mapping
+Subject: [PATCH 138/223] mtk: mt76: mt7996: Fix inconsistent QoS mapping
  between SW and HW
 
 Fix inconsistent QoS mapping between SW and HW.
@@ -16,6 +16,8 @@
 so it will set zero to fw. Once the value of dscp is 57. mac80211 will correspond to tid 7.
 and fw will correspond to tid 0.
 
+Change-Id: Ied5b9caab869985cbbca55b401805af6787afef3
+Change-Id: I6d9066c6afdfc7bb1c4523e9bc8dec40111abd25
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Signed-off-by: Rex Lu <rex.lu@mediatek.com>
 ---
@@ -26,10 +28,10 @@
  4 files changed, 94 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f7b1f0d0..0244b5aa 100644
+index 73cf311a..1971c7bf 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1262,6 +1262,7 @@ enum {
+@@ -1267,6 +1267,7 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -38,10 +40,10 @@
  
  enum {
 diff --git a/mt7996/main.c b/mt7996/main.c
-index b6231dff..3c12bd52 100644
+index 9ad4a9d6..c1c62d32 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -2365,6 +2365,9 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -2369,6 +2369,9 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  
  	ctx->dev = NULL;
  
@@ -51,7 +53,7 @@
  	return 0;
  }
  
-@@ -2794,6 +2797,33 @@ mt7996_event_callback(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2798,6 +2801,33 @@ mt7996_event_callback(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	}
  }
  
@@ -85,17 +87,17 @@
  const struct ieee80211_ops mt7996_ops = {
  	.add_chanctx = ieee80211_emulate_add_chanctx,
  	.remove_chanctx = ieee80211_emulate_remove_chanctx,
-@@ -2861,4 +2891,5 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -2865,4 +2895,5 @@ const struct ieee80211_ops mt7996_ops = {
  	.switch_vif_chanctx = mt7996_switch_vif_chanctx,
  	.change_vif_links = mt7996_change_vif_links,
  	.change_sta_links = mt7996_change_sta_links,
 +	.set_qos_map = mt7996_set_qos_map,
  };
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index db388e66..51f15928 100644
+index 043f8d5c..edbe9cbe 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -6667,4 +6667,59 @@ int mt7996_mcu_set_csi(struct mt7996_phy *phy, u8 mode,
+@@ -6693,4 +6693,59 @@ int mt7996_mcu_set_csi(struct mt7996_phy *phy, u8 mode,
  		return -EINVAL;
  	}
  }
@@ -156,10 +158,10 @@
 +}
  #endif
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index dc0209de..302ac7bf 100644
+index 3ff9cb68..d97df22f 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -134,6 +134,8 @@
+@@ -136,6 +136,8 @@
  #define MT7996_MAX_PROBE_TIMEOUT	500
  #define MT7996_MAX_PROBE_TRIES		2
  
@@ -168,7 +170,7 @@
  struct mt7996_vif;
  struct mt7996_sta;
  struct mt7996_dfs_pulse;
-@@ -376,6 +378,9 @@ struct mt7996_vif {
+@@ -377,6 +379,9 @@ struct mt7996_vif {
  	void *probe[__MT_MAX_BAND];
  	unsigned long probe_send_time[__MT_MAX_BAND];
  	int probe_send_count[__MT_MAX_BAND];
@@ -178,7 +180,7 @@
  };
  
  /* crash-dump */
-@@ -1333,5 +1338,6 @@ int mt7996_mcu_mlo_agc(struct mt7996_dev *dev, const void *data, int len);
+@@ -1337,5 +1342,6 @@ int mt7996_mcu_mlo_agc(struct mt7996_dev *dev, const void *data, int len);
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  int mt7996_dma_rro_init(struct mt7996_dev *dev);
  #endif /* CONFIG_NET_MEDIATEK_SOC_WED */
@@ -187,5 +189,5 @@
 +			   struct cfg80211_qos_map *usr_qos_map);
  #endif
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0151-mtk-mt76-mt7996-add-support-for-MLD-interface-to-sca.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0139-mtk-mt76-mt7996-add-support-for-MLD-interface-to-sca.patch
similarity index 90%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0151-mtk-mt76-mt7996-add-support-for-MLD-interface-to-sca.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0139-mtk-mt76-mt7996-add-support-for-MLD-interface-to-sca.patch
index 630fdb9..366eea1 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0151-mtk-mt76-mt7996-add-support-for-MLD-interface-to-sca.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0139-mtk-mt76-mt7996-add-support-for-MLD-interface-to-sca.patch
@@ -1,7 +1,7 @@
-From 8a5ed33fbb5d297d74acfc6cc75ee358501aed18 Mon Sep 17 00:00:00 2001
+From 648d4259da57439452141aeaeed96722d96c1c56 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Thu, 30 May 2024 15:26:34 +0800
-Subject: [PATCH 151/199] mtk: mt76: mt7996: add support for MLD interface to
+Subject: [PATCH 139/223] mtk: mt76: mt7996: add support for MLD interface to
  scan
 
 Before queueing a HW scan work, mt7996_hw_scan() should make sure that
@@ -20,16 +20,17 @@
 mt7996_bss_conf is not yet allocated. In such a case we also use the
 default link to scan, and delete it once the scan is finished.
 
+Change-Id: I32a4b9e5f9f1d05993587631f5d1a347af8869cb
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt7996/main.c | 79 +++++++++++++++++++++++++++++++++++++++++++++++++--
  1 file changed, 77 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 3c12bd52..a70fc4d3 100644
+index c1c62d32..5ddf3a1b 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -2375,10 +2375,24 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -2379,10 +2379,24 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  
  void mt7996_scan_complete(struct mt7996_phy *phy, bool aborted)
  {
@@ -55,7 +56,7 @@
  
  	ieee80211_scan_completed(mvif->hw, &info);
  	phy->scan_chan = NULL;
-@@ -2394,6 +2408,7 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2398,6 +2412,7 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	struct cfg80211_scan_request *req = &hw_req->req;
  	struct mt7996_phy *phy = mt7996_band_phy(hw, req->channels[0]->band);
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -63,7 +64,7 @@
  	int ret;
  
  	mutex_lock(&phy->dev->mt76.mutex);
-@@ -2407,7 +2422,7 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2411,7 +2426,7 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	phy->scan_chan_idx = 0;
  
  	if (!ieee80211_vif_is_mld(vif)) {
@@ -72,7 +73,7 @@
  
  		if (mconf && mconf->phy != phy) {
  			mt7996_remove_bss_conf(vif, &vif->bss_conf, &mvif->deflink);
-@@ -2421,6 +2436,66 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2425,6 +2440,66 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  				return ret;
  			}
  		}
@@ -140,5 +141,5 @@
  
  	set_bit(MT76_SCANNING, &phy->mt76->state);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0152-mtk-mt76-mt7996-add-per-link-txpower-config.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0140-mtk-mt76-mt7996-add-per-link-txpower-config.patch
similarity index 84%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0152-mtk-mt76-mt7996-add-per-link-txpower-config.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0140-mtk-mt76-mt7996-add-per-link-txpower-config.patch
index 7dc0c24..71363f4 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0152-mtk-mt76-mt7996-add-per-link-txpower-config.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0140-mtk-mt76-mt7996-add-per-link-txpower-config.patch
@@ -1,7 +1,7 @@
-From e2fe59ea3398bb2c2b00d2333aaa707aed44b37a Mon Sep 17 00:00:00 2001
+From 20c5dfdc5afbb01b853689dd45f1826e9644a87b Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 11 Jun 2024 17:04:00 +0800
-Subject: [PATCH 152/199] mtk: mt76: mt7996: add per-link txpower config
+Subject: [PATCH 140/223] mtk: mt76: mt7996: add per-link txpower config
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -9,7 +9,7 @@
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index a70fc4d3..19a1c7b3 100644
+index 5ddf3a1b..ed64cf06 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1016,7 +1016,7 @@ out:
@@ -31,5 +31,5 @@
  		*dbm = 0;
  		goto out;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0153-mtk-mt76-mt7996-update-TX-RX-rates-via-MCU-command.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0141-mtk-mt76-mt7996-update-TX-RX-rates-via-MCU-command.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0153-mtk-mt76-mt7996-update-TX-RX-rates-via-MCU-command.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0141-mtk-mt76-mt7996-update-TX-RX-rates-via-MCU-command.patch
index 343129f..f23c7ee 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0153-mtk-mt76-mt7996-update-TX-RX-rates-via-MCU-command.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0141-mtk-mt76-mt7996-update-TX-RX-rates-via-MCU-command.patch
@@ -1,7 +1,7 @@
-From 06c0ba03cc9ed39bee42b10a1e22f9aceeb57ecd Mon Sep 17 00:00:00 2001
+From c394984fc5a6e52aa435ead825e617fb3a0e7b81 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Fri, 7 Jun 2024 10:44:45 +0800
-Subject: [PATCH 153/199] mtk: mt76: mt7996: update TX/RX rates via MCU command
+Subject: [PATCH 141/223] mtk: mt76: mt7996: update TX/RX rates via MCU command
 
 Update TX/RX rates via MCU command to address following issues:
 1. TX rate was originally updated via TXS. However in MLO connection, WCID from TXS may not represent the actually used link.
@@ -10,6 +10,7 @@
 Original TX-rate update via TXS is removed.
 Still, RX-rate update via RXD is not removed, because mac80211 requires driver to provide such information for each received frame.
 
+Change-Id: I505f2882ada89770093ed0a31eb73ac4aff8b568
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt76.h        |   1 +
@@ -19,10 +20,10 @@
  4 files changed, 161 insertions(+), 131 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index f544814e..a0fc8b1a 100644
+index 526b6298..de6f2be0 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -370,6 +370,7 @@ struct mt76_wcid {
+@@ -374,6 +374,7 @@ struct mt76_wcid {
  	int inactive_count;
  
  	struct rate_info rate;
@@ -31,10 +32,10 @@
  
  	u16 idx;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 020203ec..484b679b 100644
+index 02045b84..39336832 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1242,15 +1242,12 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
+@@ -1254,15 +1254,12 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
  		       int pid, __le32 *txs_data)
  {
  	struct mt76_sta_stats *stats = &wcid->stats;
@@ -52,7 +53,7 @@
  
  	txs = le32_to_cpu(txs_data[0]);
  
-@@ -1298,105 +1295,23 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
+@@ -1310,105 +1307,23 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
  	}
  
  	txrate = FIELD_GET(MT_TXS0_TX_RATE, txs);
@@ -173,10 +174,10 @@
  		mt76_tx_status_skb_done(mdev, skb, &list);
  	mt76_tx_status_unlock(mdev, &list);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 19a1c7b3..fa60b889 100644
+index ed64cf06..05917cc8 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -1765,32 +1765,24 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
+@@ -1769,32 +1769,24 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
  	struct mt7996_link_sta *mlink;
@@ -220,10 +221,10 @@
  	sinfo->tx_failed = mlink->wcid.stats.tx_failed;
  	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 51f15928..8fd9d450 100644
+index edbe9cbe..ee27b5df 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -532,42 +532,164 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -537,42 +537,164 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
  }
  
  static int
@@ -272,7 +273,7 @@
  	case MT_PHY_TYPE_HE_MU:
 -		if (mcu_rate->tx_gi > NL80211_RATE_INFO_HE_GI_3_2)
 +		tmp_rate.mcs = mcs & GENMASK(3, 0);
-+		if (tmp_rate.mcs > 11 || gi > NL80211_RATE_INFO_HE_GI_3_2)
++		if (tmp_rate.mcs > 13 || gi > NL80211_RATE_INFO_HE_GI_3_2)
  			return -EINVAL;
 -		rate->he_gi = mcu_rate->tx_gi;
 +
@@ -285,7 +286,7 @@
  	case MT_PHY_TYPE_EHT_MU:
 -		if (mcu_rate->tx_gi > NL80211_RATE_INFO_EHT_GI_3_2)
 +		tmp_rate.mcs = mcs & GENMASK(3, 0);
-+		if (tmp_rate.mcs > 13 || gi > NL80211_RATE_INFO_EHT_GI_3_2)
++		if (tmp_rate.mcs > 15 || gi > NL80211_RATE_INFO_EHT_GI_3_2)
  			return -EINVAL;
 -		rate->eht_gi = mcu_rate->tx_gi;
 +
@@ -398,7 +399,7 @@
  static inline void __mt7996_stat_to_netdev(struct mt76_phy *mphy,
  					   struct mt76_wcid *wcid,
  					   u32 tx_bytes, u32 rx_bytes,
-@@ -618,8 +740,8 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -623,8 +745,8 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  			if (!wcid)
  				break;
  
@@ -410,5 +411,5 @@
  		case UNI_ALL_STA_TXRX_ADM_STAT:
  			wlan_idx = le16_to_cpu(res->adm_stat[i].wlan_idx);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0154-mtk-mt76-mt7996-add-link-information-when-dump-stati.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0142-mtk-mt76-mt7996-add-link-information-when-dump-stati.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0154-mtk-mt76-mt7996-add-link-information-when-dump-stati.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0142-mtk-mt76-mt7996-add-link-information-when-dump-stati.patch
index 057f0c4..9ce1f11 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0154-mtk-mt76-mt7996-add-link-information-when-dump-stati.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0142-mtk-mt76-mt7996-add-link-information-when-dump-stati.patch
@@ -1,7 +1,7 @@
-From 4eda4a37c2d5fee71c5f7b4d4a3b5baa57252c14 Mon Sep 17 00:00:00 2001
+From ff2647b012eddbe530dd4b900506911fa91c8329 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 11 Jun 2024 18:09:57 +0800
-Subject: [PATCH 154/199] mtk: mt76: mt7996: add link information when dump
+Subject: [PATCH 142/223] mtk: mt76: mt7996: add link information when dump
  station
 
 Report following per-link information to mac80211:
@@ -12,6 +12,8 @@
 - TX/RX airtime
 - per-link per-antenna average data-frame RSSI to mac80211.
 
+Change-Id: I3a0c5e014dcad4683cf19859e452e771c49d4ba6
+Change-Id: I5c7c282b97ec8a82b0a54ff5e9bbf0858461c832
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
@@ -19,10 +21,10 @@
  1 file changed, 78 insertions(+)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index fa60b889..8c162987 100644
+index 05917cc8..380a6ca0 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -1813,6 +1813,83 @@ out:
+@@ -1817,6 +1817,83 @@ out:
  	mutex_unlock(&dev->mt76.mutex);
  }
  
@@ -106,7 +108,7 @@
  static void mt7996_sta_rc_work(void *data, struct ieee80211_sta *sta)
  {
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-@@ -2932,6 +3009,7 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -2936,6 +3013,7 @@ const struct ieee80211_ops mt7996_ops = {
  	.set_bitrate_mask = mt7996_set_bitrate_mask,
  	.set_coverage_class = mt7996_set_coverage_class,
  	.sta_statistics = mt7996_sta_statistics,
@@ -115,5 +117,5 @@
  	.sta_set_decap_offload = mt7996_sta_set_decap_offload,
  	.add_twt_setup = mt7996_mac_add_twt_setup,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0155-mtk-mt76-mt7996-add-per-link-RX-MPDU-statistics.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0143-mtk-mt76-mt7996-add-per-link-RX-MPDU-statistics.patch
similarity index 81%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0155-mtk-mt76-mt7996-add-per-link-RX-MPDU-statistics.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0143-mtk-mt76-mt7996-add-per-link-RX-MPDU-statistics.patch
index e35f69e..bb0bde1 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0155-mtk-mt76-mt7996-add-per-link-RX-MPDU-statistics.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0143-mtk-mt76-mt7996-add-per-link-RX-MPDU-statistics.patch
@@ -1,10 +1,11 @@
-From c7dcf0304c6cd1d73b1caf2ce0b35f7913d2b69e Mon Sep 17 00:00:00 2001
+From 9e31f71efd5909af8d8916285f0816914fd15bac Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Tue, 23 Jul 2024 16:37:57 +0800
-Subject: [PATCH 155/199] mtk: mt76: mt7996: add per-link RX MPDU statistics
+Subject: [PATCH 143/223] mtk: mt76: mt7996: add per-link RX MPDU statistics
 
 Add per-link RX MPDU total/failed counts.
 
+Change-Id: Ibe9acae34bf9eff17da651ec8c33b6a9a9f6f785
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt76.h            |  2 ++
@@ -15,10 +16,10 @@
  5 files changed, 22 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index a0fc8b1a..f67f0658 100644
+index de6f2be0..ce34cccc 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -336,6 +336,8 @@ struct mt76_sta_stats {
+@@ -340,6 +340,8 @@ struct mt76_sta_stats {
  	/* WED RX */
  	u64 rx_bytes;
  	u32 rx_packets;
@@ -28,10 +29,10 @@
  	u32 rx_drops;
  	u64 rx_airtime;
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 0244b5aa..8de91f62 100644
+index 1971c7bf..931b29eb 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1421,6 +1421,8 @@ enum UNI_ALL_STA_INFO_TAG {
+@@ -1426,6 +1426,8 @@ enum UNI_ALL_STA_INFO_TAG {
  	UNI_ALL_STA_DATA_TX_RETRY_COUNT,
  	UNI_ALL_STA_GI_MODE,
  	UNI_ALL_STA_TXRX_MSDU_COUNT,
@@ -41,10 +42,10 @@
  };
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 484b679b..a0406700 100644
+index 39336832..966cf314 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2408,6 +2408,7 @@ void mt7996_mac_work(struct work_struct *work)
+@@ -2420,6 +2420,7 @@ void mt7996_mac_work(struct work_struct *work)
  					mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_ADM_STAT);
  					mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_MSDU_COUNT);
  				// }
@@ -53,10 +54,10 @@
  				if (mt7996_mcu_wa_cmd(phy->dev, MCU_WA_PARAM_CMD(QUERY), MCU_WA_PARAM_BSS_ACQ_PKT_CNT,
  				                      BSS_ACQ_PKT_CNT_BSS_BITMAP_ALL | BSS_ACQ_PKT_CNT_READ_CLR, 0))
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 8fd9d450..be6b985f 100644
+index ee27b5df..4a99671f 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -803,6 +803,16 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -808,6 +808,16 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  				                               tx_airtime, rx_airtime);
  			}
  			break;
@@ -92,5 +93,5 @@
  } __packed;
  
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0156-mtk-mt76-mt7996-support-link_id-for-mt7996_set_bitra.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0144-mtk-mt76-mt7996-support-link_id-for-mt7996_set_bitra.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0156-mtk-mt76-mt7996-support-link_id-for-mt7996_set_bitra.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0144-mtk-mt76-mt7996-support-link_id-for-mt7996_set_bitra.patch
index 476fb7b..4e9a59b 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0156-mtk-mt76-mt7996-support-link_id-for-mt7996_set_bitra.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0144-mtk-mt76-mt7996-support-link_id-for-mt7996_set_bitra.patch
@@ -1,12 +1,13 @@
-From c310822a0a28c43c4bf4234e76d82e4d1fb47a96 Mon Sep 17 00:00:00 2001
+From cd89b66b8dac6cbb4569d61c7f23b06692410adf Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 7 Jun 2024 13:23:55 +0800
-Subject: [PATCH 156/199] mtk: mt76: mt7996: support link_id for
+Subject: [PATCH 144/223] mtk: mt76: mt7996: support link_id for
  mt7996_set_bitrate_mask
 
 Add support new argument link_id for set_bitrate_mask within
 ieee80211_ops.
 
+Change-Id: Ic164e7e332e273992965bb5f7b89ca2fce1f1e53
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
  mt7996/main.c   | 34 ++++++++++++++++++++++++++--------
@@ -14,10 +15,10 @@
  2 files changed, 31 insertions(+), 8 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 8c162987..71a42199 100644
+index 380a6ca0..118c7d67 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -1895,17 +1895,21 @@ static void mt7996_sta_rc_work(void *data, struct ieee80211_sta *sta)
+@@ -1899,17 +1899,21 @@ static void mt7996_sta_rc_work(void *data, struct ieee80211_sta *sta)
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
  	struct mt7996_link_sta *mlink;
  	struct mt7996_dev *dev = msta->vif->dev;
@@ -42,7 +43,7 @@
  	rcu_read_unlock();
  }
  
-@@ -1917,6 +1921,10 @@ static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
+@@ -1921,6 +1925,10 @@ static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  	struct mt7996_dev *dev = phy->dev;
@@ -53,7 +54,7 @@
  
  	if (!msta->vif) {
  		dev_warn(dev->mt76.dev, "Un-initialized STA %pM wcid %d in rc_work\n",
-@@ -1924,22 +1932,32 @@ static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
+@@ -1928,22 +1936,32 @@ static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
  		return;
  	}
  
@@ -90,7 +91,7 @@
  	mconf->bitrate_mask = *mask;
  	mutex_unlock(&dev->mt76.mutex);
  
-@@ -1951,7 +1969,7 @@ mt7996_set_bitrate_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1955,7 +1973,7 @@ mt7996_set_bitrate_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	 * - multiple rates: if it's not in range format i.e 0-{7,8,9} for VHT
  	 * then multiple MCS setting (MCS 4,5,6) is not supported.
  	 */
@@ -100,10 +101,10 @@
  
  	return 0;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 302ac7bf..49789441 100644
+index d97df22f..ccea70af 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -444,6 +444,11 @@ struct mt7996_wed_rro_session_id {
+@@ -445,6 +445,11 @@ struct mt7996_wed_rro_session_id {
  	u16 id;
  };
  
@@ -116,5 +117,5 @@
  #define MT7996_AIR_MONITOR_MAX_ENTRY	16
  #define MT7996_AIR_MONITOR_MAX_GROUP	(MT7996_AIR_MONITOR_MAX_ENTRY >> 1)
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0157-mtk-mt76-mt7996-add-per-radio-antenna-config.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0145-mtk-mt76-mt7996-add-per-radio-antenna-config.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0157-mtk-mt76-mt7996-add-per-radio-antenna-config.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0145-mtk-mt76-mt7996-add-per-radio-antenna-config.patch
index 5e3b87a..bee539b 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0157-mtk-mt76-mt7996-add-per-radio-antenna-config.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0145-mtk-mt76-mt7996-add-per-radio-antenna-config.patch
@@ -1,10 +1,11 @@
-From 467122289f7c31285d68ae819f22a8bf7b2272ae Mon Sep 17 00:00:00 2001
+From 31c98d0e5f309c927880c4781a4c9323b6d41981 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 11 Jun 2024 17:04:22 +0800
-Subject: [PATCH 157/199] mtk: mt76: mt7996: add per-radio antenna config
+Subject: [PATCH 145/223] mtk: mt76: mt7996: add per-radio antenna config
 
 Add per-radio antenna config
 
+Change-Id: Id82ffe0ebc453e77a16a0a9c04edad8c45ad3079
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mac80211.c      | 19 ++++++++++++++++---
@@ -17,7 +18,7 @@
  7 files changed, 47 insertions(+), 29 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 589c37af..10267019 100644
+index f986d5fd..a555bec2 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -431,8 +431,8 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
@@ -31,7 +32,7 @@
  
  	wiphy->sar_capa = &mt76_sar_capa;
  	phy->frp = devm_kcalloc(dev->dev, wiphy->sar_capa->num_freq_ranges,
-@@ -1710,12 +1710,25 @@ void mt76_sw_scan_complete(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+@@ -1748,12 +1748,25 @@ void mt76_sw_scan_complete(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
  }
  EXPORT_SYMBOL_GPL(mt76_sw_scan_complete);
  
@@ -59,10 +60,10 @@
  	*rx_ant = phy->antenna_mask;
  	mutex_unlock(&dev->mutex);
 diff --git a/mt76.h b/mt76.h
-index f67f0658..728740ef 100644
+index ce34cccc..8e71c2ce 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -862,6 +862,7 @@ struct mt76_phy {
+@@ -877,6 +877,7 @@ struct mt76_phy {
  	struct mt76_sband sband_2g;
  	struct mt76_sband sband_5g;
  	struct mt76_sband sband_6g;
@@ -70,7 +71,7 @@
  
  	u8 macaddr[ETH_ALEN];
  
-@@ -1540,7 +1541,7 @@ int mt76_get_sar_power(struct mt76_phy *phy,
+@@ -1553,7 +1554,7 @@ int mt76_get_sar_power(struct mt76_phy *phy,
  void mt76_csa_check(struct mt76_dev *dev);
  void mt76_csa_finish(struct mt76_dev *dev);
  
@@ -80,10 +81,10 @@
  void mt76_insert_ccmp_hdr(struct sk_buff *skb, u8 key_id);
  int mt76_get_rate(struct mt76_dev *dev,
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index c4714982..e8e1d85a 100644
+index f9bd4d91..72a21fcf 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -378,12 +378,15 @@ static int mt7996_eeprom_parse_band_config(struct mt7996_phy *phy)
+@@ -410,12 +410,15 @@ static int mt7996_eeprom_parse_band_config(struct mt7996_phy *phy)
  	switch (val) {
  	case MT_EE_BAND_SEL_2GHZ:
  		phy->mt76->cap.has_2ghz = true;
@@ -100,7 +101,7 @@
  	default:
  		ret = -EINVAL;
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 0ee2acfb..55eb32cb 100644
+index 420c23c9..18a86afe 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -392,8 +392,10 @@ static void
@@ -171,10 +172,10 @@
  	wiphy->max_scan_ssids = 4;
  	wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 71a42199..b59f72d0 100644
+index 118c7d67..d73fd9d6 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -1701,14 +1701,11 @@ mt7996_set_coverage_class(struct ieee80211_hw *hw, s16 coverage_class)
+@@ -1705,14 +1705,11 @@ mt7996_set_coverage_class(struct ieee80211_hw *hw, s16 coverage_class)
  }
  
  static int
@@ -192,7 +193,7 @@
  
  	/* only allow settings from hw0 */
  	if (hw != dev->phy.mt76->hw)
-@@ -1722,14 +1719,14 @@ mt7996_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
+@@ -1726,14 +1723,14 @@ mt7996_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
  
  	mutex_lock(&dev->mt76.mutex);
  
@@ -211,10 +212,10 @@
  			continue;
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index be6b985f..6af45467 100644
+index 4a99671f..28bccc15 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2430,6 +2430,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -2435,6 +2435,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  #define EBF_MODE	BIT(0)
  #define IBF_MODE	BIT(1)
  	struct mt7996_phy *phy = mconf->phy;
@@ -222,7 +223,7 @@
  	int tx_ant = hweight16(phy->mt76->chainmask) - 1;
  	struct sta_rec_bf *bf;
  	struct tlv *tlv;
-@@ -2468,7 +2469,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -2473,7 +2474,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  
  	bf->bf_cap = ebf ? EBF_MODE : (dev->ibf ? IBF_MODE : 0);
  	if (is_mt7992(&dev->mt76) &&
@@ -232,10 +233,10 @@
  	bf->bw = link_sta->bandwidth;
  	bf->ibf_dbw = link_sta->bandwidth;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 49789441..05bdc437 100644
+index ccea70af..c20206c6 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1173,9 +1173,10 @@ void mt7996_memcpy_fromio(struct mt7996_dev *dev, void *buf, u32 offset,
+@@ -1177,9 +1177,10 @@ void mt7996_memcpy_fromio(struct mt7996_dev *dev, void *buf, u32 offset,
  
  static inline u16 mt7996_rx_chainmask(struct mt7996_phy *phy)
  {
@@ -250,5 +251,5 @@
  	if (cur_nss != max_nss)
  		return tx_chainmask;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0158-mtk-mt76-mt7996-rework-debug-prints.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0146-mtk-mt76-mt7996-rework-debug-prints.patch
similarity index 87%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0158-mtk-mt76-mt7996-rework-debug-prints.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0146-mtk-mt76-mt7996-rework-debug-prints.patch
index 8ed1049..28f11c6 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0158-mtk-mt76-mt7996-rework-debug-prints.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0146-mtk-mt76-mt7996-rework-debug-prints.patch
@@ -1,11 +1,12 @@
-From 4a9819d5ac8cef5b85c089698467053713619f86 Mon Sep 17 00:00:00 2001
+From 28b5dc0783ecf0b3b173c76b9138f769ec6345f3 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 19 Jun 2024 12:04:46 +0800
-Subject: [PATCH 158/199] mtk: mt76: mt7996: rework debug prints
+Subject: [PATCH 146/223] mtk: mt76: mt7996: rework debug prints
 
 Trim debug messages, and move some of them (especially mcu cmd) into
 tracing log.
 
+Change-Id: I1cf15113a43990fdf201722738e32f08b9118b8f
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mt76_connac_mcu.c |  1 -
@@ -16,10 +17,10 @@
  5 files changed, 67 insertions(+), 49 deletions(-)
 
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 8d1036e1..ab7cf4a6 100644
+index b62a1ac8..e4e6c0d3 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -432,7 +432,6 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -428,7 +428,6 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
  	}
  
  	memcpy(basic->peer_addr, link_sta->addr, ETH_ALEN);
@@ -28,10 +29,10 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_basic_tlv);
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index a0406700..960b02dd 100644
+index 966cf314..0a96b5de 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2930,9 +2930,6 @@ void mt7996_scan_work(struct work_struct *work)
+@@ -2942,9 +2942,6 @@ void mt7996_scan_work(struct work_struct *work)
  		return;
  	}
  
@@ -42,7 +43,7 @@
  
  	if (!req->n_ssids ||
 diff --git a/mt7996/main.c b/mt7996/main.c
-index b59f72d0..cff2c527 100644
+index d73fd9d6..647e0e8a 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -297,6 +297,9 @@ static void mt7996_remove_bss_conf(struct ieee80211_vif *vif,
@@ -120,7 +121,7 @@
  		ret = mt7996_add_link_sta(dev, conf, mconf, link_sta, assoc);
  		if (ret)
  			goto error;
-@@ -1457,13 +1465,13 @@ static void mt7996_tx(struct ieee80211_hw *hw,
+@@ -1461,13 +1469,13 @@ static void mt7996_tx(struct ieee80211_hw *hw,
  					rcu_dereference(sta->link[link_id]);
  
  				if (!link_sta) {
@@ -137,7 +138,7 @@
  						goto unlock;
  					}
  				}
-@@ -2495,6 +2503,7 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2499,6 +2507,7 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	struct mt7996_bss_conf *mconf;
  	int ret;
  
@@ -145,7 +146,7 @@
  	mutex_lock(&phy->dev->mt76.mutex);
  	if (WARN_ON(phy->scan_req || phy->scan_chan)) {
  		mutex_unlock(&phy->dev->mt76.mutex);
-@@ -2624,7 +2633,7 @@ mt7996_add_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *conf)
+@@ -2628,7 +2637,7 @@ mt7996_add_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *conf)
  	struct mt7996_chanctx *ctx = mt7996_chanctx_get(conf);
  	int ret;
  
@@ -154,7 +155,7 @@
  	mutex_lock(&phy->dev->mt76.mutex);
  
  	if (ctx->assigned) {
-@@ -2663,7 +2672,7 @@ mt7996_remove_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *co
+@@ -2667,7 +2676,7 @@ mt7996_remove_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *co
  	struct mt7996_chanctx *ctx = mt7996_chanctx_get(conf);
  	struct mt7996_phy *phy = ctx->phy;
  
@@ -163,7 +164,7 @@
  	cancel_delayed_work_sync(&phy->scan_work);
  	cancel_delayed_work_sync(&phy->mt76->mac_work);
  
-@@ -2683,13 +2692,14 @@ mt7996_change_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *co
+@@ -2687,13 +2696,14 @@ mt7996_change_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *co
  	struct mt7996_chanctx *ctx = mt7996_chanctx_get(conf);
  	struct mt7996_phy *phy = ctx->phy;
  
@@ -179,7 +180,7 @@
  	}
  }
  
-@@ -2705,9 +2715,8 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2709,9 +2719,8 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	u8 link_id = link_conf->link_id;
  	int ret;
  
@@ -191,7 +192,7 @@
  
  	mutex_lock(&phy->dev->mt76.mutex);
  
-@@ -2747,9 +2756,8 @@ mt7996_unassign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2751,9 +2760,8 @@ mt7996_unassign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	struct mt7996_chanctx *ctx = mt7996_chanctx_get(conf);
  	struct mt7996_phy *phy = ctx->phy;
  
@@ -203,7 +204,7 @@
  	cancel_delayed_work_sync(&phy->scan_work);
  
  	mutex_lock(&phy->dev->mt76.mutex);
-@@ -2778,9 +2786,15 @@ mt7996_switch_vif_chanctx(struct ieee80211_hw *hw,
+@@ -2782,9 +2790,15 @@ mt7996_switch_vif_chanctx(struct ieee80211_hw *hw,
  		if (vifs[i].old_ctx == vifs[i].new_ctx)
  			continue;
  
@@ -222,7 +223,7 @@
  
  		mutex_lock(&dev->mt76.mutex);
  
-@@ -2830,7 +2844,7 @@ mt7996_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2834,7 +2848,7 @@ mt7996_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	unsigned int link_id;
  	int ret = 0;
  
@@ -231,7 +232,7 @@
  	if (old_links == new_links)
  		return 0;
  
-@@ -2876,7 +2890,7 @@ mt7996_change_sta_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2880,7 +2894,7 @@ mt7996_change_sta_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	unsigned long rem = old_links & ~new_links;
  	int ret = 0;
  
@@ -241,10 +242,10 @@
  
  	if (rem)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 6af45467..f848e3b7 100644
+index 28bccc15..6149f227 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -382,7 +382,6 @@ mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
+@@ -387,7 +387,6 @@ mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  	if (!link_conf || !link_conf->csa_active || vif->type == NL80211_IFTYPE_STATION)
  		return;
  
@@ -252,7 +253,7 @@
  	mvif->cs_ready_links = 0;
  	mvif->cs_link_id = IEEE80211_LINK_UNSPECIFIED;
  	ieee80211_csa_finish(vif, link_id);
-@@ -1508,8 +1507,8 @@ mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+@@ -1513,8 +1512,8 @@ mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
  	}
  
  	mld->own_mld_id = mconf->own_mld_id;
@@ -263,7 +264,7 @@
  }
  
  static void
-@@ -1662,8 +1661,8 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
+@@ -1667,8 +1666,8 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
  
  	memcpy(bss->bssid, conf->bssid, ETH_ALEN);
  
@@ -274,7 +275,7 @@
  
  	bss->bcn_interval = cpu_to_le16(conf->beacon_int);
  	bss->dtim_period = conf->dtim_period;
-@@ -1802,8 +1801,6 @@ mt7996_mcu_sta_tx_cap(struct mt7996_dev *dev, struct mt76_vif *mvif,
+@@ -1807,8 +1806,6 @@ mt7996_mcu_sta_tx_cap(struct mt7996_dev *dev, struct mt76_vif *mvif,
  	tx_cap = (struct sta_rec_tx_cap *)tlv;
  	tx_cap->ampdu_limit_en = true;
  
@@ -283,18 +284,18 @@
  	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
  				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
  }
-@@ -2961,8 +2958,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
- 	/* starec basic */
+@@ -2968,8 +2965,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+ 	conn_state = enable ? CONN_STATE_PORT_SECURE : CONN_STATE_DISCONNECT;
  	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, conf, link_sta,
- 				      enable, newly);
--	mlo_dbg(mconf->phy, "link=%u, newly=%d, en=%d\n",
--		mlink->wcid.link_id, newly, enable);
-+	mt76_trace(vif, "link=%u, wcid=%u, newly=%d, en=%d\n",
-+		   mlink->wcid.link_id, mlink->wcid.idx, newly, enable);
+ 				      conn_state, newly);
+-	mlo_dbg(mconf->phy, "link=%u, newly=%d, conn_state=%d\n",
+-		mlink->wcid.link_id, newly, conn_state);
++	mt76_trace(vif, "link=%u, wcid=%u, newly=%d, conn_state=%d\n",
++		   mlink->wcid.link_id, mlink->wcid.idx, newly, conn_state);
  
  	if (!enable)
  		goto out;
-@@ -3022,6 +3019,8 @@ mt7996_mcu_sta_mld_setup_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -3029,6 +3026,8 @@ mt7996_mcu_sta_mld_setup_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
  	unsigned long valid_links = sta->valid_links;
  	unsigned int link_id;
@@ -303,7 +304,7 @@
  
  	mlink = mlink_dereference_protected(msta, msta->pri_link);
  	if (!mlink)
-@@ -3045,15 +3044,16 @@ mt7996_mcu_sta_mld_setup_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -3052,15 +3051,16 @@ mt7996_mcu_sta_mld_setup_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	mld_setup->link_num = hweight16(sta->valid_links);
  
  	mld_setup_link = (struct mld_setup_link *)mld_setup->link_info;
@@ -323,7 +324,7 @@
  		link_id, mld_setup_link->wcid, mld_setup_link->bss_idx);
  		mld_setup_link++;
  	}
-@@ -3319,8 +3319,8 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
+@@ -3326,8 +3326,8 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
  		return mt7996_mcu_muar_config(phy, conf, mconf, false, enable);
  
  	memcpy(data.tlv.omac_addr, conf->addr, ETH_ALEN);
@@ -334,7 +335,7 @@
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WMWA_UNI_CMD(DEV_INFO_UPDATE),
  				 &data, sizeof(data), true);
  }
-@@ -6533,10 +6533,10 @@ int mt7996_mcu_set_eml_omn(struct ieee80211_hw *hw,
+@@ -6559,10 +6559,10 @@ int mt7996_mcu_set_eml_omn(struct ieee80211_hw *hw,
  		}
  	}
  
@@ -350,10 +351,10 @@
  	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
  			MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 05bdc437..612e849c 100644
+index c20206c6..d56d9715 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -982,7 +982,15 @@ mt7996_get_link_wcid(struct mt7996_dev *dev, u16 idx, u8 band_idx)
+@@ -986,7 +986,15 @@ mt7996_get_link_wcid(struct mt7996_dev *dev, u16 idx, u8 band_idx)
  	return &mlink->wcid;
  }
  
@@ -371,5 +372,5 @@
  extern const struct ieee80211_ops mt7996_ops;
  extern struct pci_driver mt7996_pci_driver;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0159-mtk-mt76-mt7996-support-configure-trigger-frame-type.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0147-mtk-mt76-mt7996-support-configure-trigger-frame-type.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0159-mtk-mt76-mt7996-support-configure-trigger-frame-type.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0147-mtk-mt76-mt7996-support-configure-trigger-frame-type.patch
index 4c0667b..c77006d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0159-mtk-mt76-mt7996-support-configure-trigger-frame-type.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0147-mtk-mt76-mt7996-support-configure-trigger-frame-type.patch
@@ -1,7 +1,7 @@
-From f3d7abe8218a285c098f88267034f5625fe3df3a Mon Sep 17 00:00:00 2001
+From 4ea48c70592eb0d0907dddfeffc11686e42328d0 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 7 May 2024 10:00:09 +0800
-Subject: [PATCH 159/199] mtk: mt76: mt7996: support configure trigger frame
+Subject: [PATCH 147/223] mtk: mt76: mt7996: support configure trigger frame
  type
 
 Support receiving an nl80211 subcmd
@@ -13,6 +13,7 @@
 The purpose of this commit is for WiFi 7 R1 cert UL-RU and UL-MU test
 cases.
 
+Change-Id: Iaf9b276b852bcfe3f5e0123db8d5dc77cc136a81
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
  mt7996/mtk_mcu.c | 1 +
@@ -84,5 +85,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0160-mtk-mt76-mt7996-support-configure-coding-type-for-wi.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0148-mtk-mt76-mt7996-support-configure-coding-type-for-wi.patch
similarity index 92%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0160-mtk-mt76-mt7996-support-configure-coding-type-for-wi.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0148-mtk-mt76-mt7996-support-configure-coding-type-for-wi.patch
index b3e6aa7..0833a39 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0160-mtk-mt76-mt7996-support-configure-coding-type-for-wi.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0148-mtk-mt76-mt7996-support-configure-coding-type-for-wi.patch
@@ -1,7 +1,7 @@
-From 750c99749949677a385774085cce922986eda7a2 Mon Sep 17 00:00:00 2001
+From 5838cde9b267f8792119865a8224308b569899b0 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 7 Jun 2024 13:24:04 +0800
-Subject: [PATCH 160/199] mtk: mt76: mt7996: support configure coding type for
+Subject: [PATCH 148/223] mtk: mt76: mt7996: support configure coding type for
  wifi7 r1 cert
 
 This commit includes two changes for WiFi7 cert fix rate test cases.
@@ -17,6 +17,8 @@
 cert_mode to determine whether we are currently using multiple user
 space commands to fix the partial rate.
 
+Change-Id: I8fbeb1ce639922c0a224eb5b9e849fbdcf50272d
+Change-Id: Ifb75c34a767ab6ad5597237e70a3673586fcb499
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
  mt7996/mac.c     | 10 ++++++++++
@@ -29,10 +31,10 @@
  7 files changed, 82 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 960b02dd..c59cc7cc 100644
+index 0a96b5de..19484081 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2373,6 +2373,16 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+@@ -2385,6 +2385,16 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  		if (changed & IEEE80211_RC_SMPS_CHANGED)
  			mt7996_mcu_set_fixed_field(dev, mconf, link_sta, mlink, NULL,
  						   RATE_PARAM_MMPS_UPDATE);
@@ -50,10 +52,10 @@
  		spin_lock_bh(&dev->mt76.sta_poll_lock);
  	}
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index f848e3b7..eeff5e9e 100644
+index 6149f227..94746005 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2659,6 +2659,7 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
+@@ -2664,6 +2664,7 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
  	case RATE_PARAM_FIXED_MCS:
  	case RATE_PARAM_FIXED_GI:
  	case RATE_PARAM_FIXED_HE_LTF:
@@ -61,7 +63,7 @@
  		if (phy)
  			ra->phy = *phy;
  		break;
-@@ -2884,6 +2885,12 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+@@ -2889,6 +2890,12 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  	if (IS_ERR(skb))
  		return PTR_ERR(skb);
  
@@ -87,10 +89,10 @@
  #ifdef CONFIG_MTK_VENDOR
  	RATE_PARAM_FIXED_MIMO = 30,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 612e849c..ae792719 100644
+index d56d9715..0b3df44a 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -516,6 +516,8 @@ struct csi_data {
+@@ -517,6 +517,8 @@ struct csi_data {
  
  	struct list_head node;
  };
@@ -99,7 +101,7 @@
  #endif
  
  struct mt7996_rro_ba_session {
-@@ -786,7 +788,8 @@ struct mt7996_dev {
+@@ -791,7 +793,8 @@ struct mt7996_dev {
  	const struct mt7996_dbg_reg_desc *dbg_reg;
  #endif
  #ifdef CONFIG_MTK_VENDOR
@@ -232,5 +234,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0161-mtk-mt76-mt7996-record-RSSI-and-SNR.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0149-mtk-mt76-mt7996-record-RSSI-and-SNR.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0161-mtk-mt76-mt7996-record-RSSI-and-SNR.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0149-mtk-mt76-mt7996-record-RSSI-and-SNR.patch
index cea127b..21983e5 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0161-mtk-mt76-mt7996-record-RSSI-and-SNR.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0149-mtk-mt76-mt7996-record-RSSI-and-SNR.patch
@@ -1,13 +1,14 @@
-From b823f8980320ec23f5a95a1eadd6d93425f1c070 Mon Sep 17 00:00:00 2001
+From bd67084cff9aa21fe1b714ebcfe771aad0286e11 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Thu, 13 Jun 2024 17:27:03 +0800
-Subject: [PATCH 161/199] mtk: mt76: mt7996: record RSSI and SNR
+Subject: [PATCH 149/223] mtk: mt76: mt7996: record RSSI and SNR
 
 RSSI and SNR information were incomplete.
 - RSSI: per-antenna ACK-frame RSSI was not reported.
 - SNR: unavailable.
 Therefore, get and record these signal statuses in order to show them for debugging purposes.
 
+Change-Id: I8997b8433f5af6769792e158ebf03a7f54eb3210
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt7996/mac.c    |  9 +++++-
@@ -17,7 +18,7 @@
  4 files changed, 70 insertions(+), 32 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index c59cc7cc..017e3465 100644
+index 19484081..c341a553 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -493,6 +493,13 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
@@ -34,7 +35,7 @@
  		/* RXD Group 5 - C-RXV */
  		if (rxd1 & MT_RXD1_NORMAL_GROUP_5) {
  			rxd += 24;
-@@ -2413,7 +2420,7 @@ void mt7996_mac_work(struct work_struct *work)
+@@ -2425,7 +2432,7 @@ void mt7996_mac_work(struct work_struct *work)
  			if (i == mphy->band_idx) {
  				mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_RATE);
  				mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_AIRTIME);
@@ -44,10 +45,10 @@
  					mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_ADM_STAT);
  					mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_MSDU_COUNT);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index eeff5e9e..54295414 100644
+index 94746005..db975daa 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -5791,14 +5791,15 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val)
+@@ -5817,14 +5817,15 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val)
  }
  
  int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
@@ -65,7 +66,7 @@
  	struct {
  		u8 __rsv1;
  		u8 unsolicit;
-@@ -5837,23 +5838,18 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
+@@ -5863,23 +5864,18 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
  	switch (tag) {
  	case UNI_PER_STA_RSSI:
  		for (i = 0; i < sta_num; ++i) {
@@ -99,7 +100,7 @@
  				ewma_avg_signal_add(&mlink->avg_ack_signal, -mlink->ack_signal);
  			} else {
  				ret = -EINVAL;
-@@ -5862,6 +5858,21 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
+@@ -5888,6 +5884,21 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
  			}
  		}
  		break;
@@ -121,7 +122,7 @@
  	default:
  		ret = -EINVAL;
  		dev_err(dev->dev, "Unknown UNI_PER_STA_INFO_TAG: %d\n", tag);
-@@ -5872,7 +5883,7 @@ out:
+@@ -5898,7 +5909,7 @@ out:
  	return ret;
  }
  
@@ -130,7 +131,7 @@
  {
  	u16 sta_list[PER_STA_INFO_MAX_NUM];
  	LIST_HEAD(sta_poll_list);
-@@ -5897,8 +5908,8 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
+@@ -5923,8 +5934,8 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
  				break;
  			}
  			mlink = list_first_entry(&sta_poll_list,
@@ -141,7 +142,7 @@
  			list_del_init(&mlink->wcid.poll_list);
  			spin_unlock_bh(&dev->sta_poll_lock);
  
-@@ -5906,16 +5917,23 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
+@@ -5932,16 +5943,23 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
  		}
  
  		ret = mt7996_mcu_get_per_sta_info(dev, UNI_PER_STA_RSSI,
@@ -202,10 +203,10 @@
  } __packed;
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index ae792719..8d27ae5d 100644
+index 0b3df44a..ee43c9e0 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -317,9 +317,15 @@ struct mt7996_link_sta {
+@@ -318,9 +318,15 @@ struct mt7996_link_sta {
  
  	struct list_head rc_list;
  
@@ -221,7 +222,7 @@
  	unsigned long changed;
  
  	struct mt76_connac_sta_key_conf bip;
-@@ -1126,7 +1132,7 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
+@@ -1130,7 +1136,7 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
  void mt7996_mcu_exit(struct mt7996_dev *dev);
  int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
  	                        u16 sta_num, u16 *sta_list);
@@ -231,5 +232,5 @@
  int mt7996_mcu_wed_rro_reset_sessions(struct mt7996_dev *dev, u16 id);
  int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0162-mtk-mt76-mt7996-support-find-the-mt7996_phy-by-link_.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0150-mtk-mt76-mt7996-support-find-the-mt7996_phy-by-link_.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0162-mtk-mt76-mt7996-support-find-the-mt7996_phy-by-link_.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0150-mtk-mt76-mt7996-support-find-the-mt7996_phy-by-link_.patch
index 239e33b..1045b99 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0162-mtk-mt76-mt7996-support-find-the-mt7996_phy-by-link_.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0150-mtk-mt76-mt7996-support-find-the-mt7996_phy-by-link_.patch
@@ -1,7 +1,7 @@
-From a2a53b70dec62aa8f7afb02d135c2af76423e1e8 Mon Sep 17 00:00:00 2001
+From 5538043f91de86efa859432e4473f020bdcd23c3 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 20 Jun 2024 10:55:07 +0800
-Subject: [PATCH 162/199] mtk: mt76: mt7996: support find the mt7996_phy by
+Subject: [PATCH 150/223] mtk: mt76: mt7996: support find the mt7996_phy by
  link_id for vendor command
 
 Add support to find the corresponding phy by link_id. This commit is for
@@ -11,6 +11,8 @@
 
 Fix the way to find the band_idx if WiFi7 AP is non-MLD mode.
 
+Change-Id: Iee16822ac76f5feecd0d7c6996f5b6d800d6cf44
+Change-Id: Iac6380de23107135acc7b2b03cc448e3b50cd45c
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
  mt7996/mt7996.h      |  5 +++--
@@ -20,10 +22,10 @@
  4 files changed, 30 insertions(+), 18 deletions(-)
 
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 8d27ae5d..42c1e287 100644
+index ee43c9e0..b0d9b0bd 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1326,11 +1326,12 @@ int mt7996_mcu_set_txbf_internal(struct mt7996_phy *phy, u8 action, int idx, boo
+@@ -1330,11 +1330,12 @@ int mt7996_mcu_set_txbf_internal(struct mt7996_phy *phy, u8 action, int idx, boo
  void mt7996_mcu_rx_bf_event(struct mt7996_dev *dev, struct sk_buff *skb);
  int mt7996_mcu_set_muru_fixed_rate_enable(struct mt7996_dev *dev, u8 action, int val);
  int mt7996_mcu_set_muru_fixed_rate_parameter(struct mt7996_dev *dev, u8 action, void *para);
@@ -39,10 +41,10 @@
  void mt7996_mcu_set_nusers_ofdma(struct mt7996_phy *phy, u8 type, u8 ofdma_user_cnt);
  void mt7996_mcu_set_cert(struct mt7996_phy *phy, u8 type);
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index a7cbde3e..9bd35c91 100644
+index 9d8c1942..f13f09e1 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -2929,7 +2929,7 @@ mt7996_bf_txsnd_info_set(struct file *file,
+@@ -2928,7 +2928,7 @@ mt7996_bf_txsnd_info_set(struct file *file,
  	else
  		buf[count] = '\0';
  
@@ -179,5 +181,5 @@
  			return err;
  	} else if (tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_ACK_PLCY]) {
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0163-mtk-mt76-mt7996-workaround-for-get_tsf-crash-issue.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0151-mtk-mt76-mt7996-workaround-for-get_tsf-crash-issue.patch
similarity index 81%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0163-mtk-mt76-mt7996-workaround-for-get_tsf-crash-issue.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0151-mtk-mt76-mt7996-workaround-for-get_tsf-crash-issue.patch
index 3093ae7..0b8ea2c 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0163-mtk-mt76-mt7996-workaround-for-get_tsf-crash-issue.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0151-mtk-mt76-mt7996-workaround-for-get_tsf-crash-issue.patch
@@ -1,17 +1,17 @@
-From 2788ac3b4b7c0484faea6207a86e37c827262c89 Mon Sep 17 00:00:00 2001
+From 2f3676a2b60827dfd02540af2e0325e50161ff6a Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Mon, 24 Jun 2024 11:09:50 +0800
-Subject: [PATCH 163/199] mtk: mt76: mt7996: workaround for get_tsf crash issue
+Subject: [PATCH 151/223] mtk: mt76: mt7996: workaround for get_tsf crash issue
 
 ---
  mt7996/main.c | 15 ++++++++++++---
  1 file changed, 12 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index cff2c527..443b3962 100644
+index 647e0e8a..455beb74 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -1630,11 +1630,20 @@ mt7996_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+@@ -1634,11 +1634,20 @@ mt7996_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	struct mt7996_bss_conf *mconf;
@@ -36,5 +36,5 @@
  
  	return ret;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0164-mtk-mt76-add-debugfs-for-tx-drop-counters.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0152-mtk-mt76-add-debugfs-for-tx-drop-counters.patch
similarity index 86%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0164-mtk-mt76-add-debugfs-for-tx-drop-counters.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0152-mtk-mt76-add-debugfs-for-tx-drop-counters.patch
index af71cc8..b753114 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0164-mtk-mt76-add-debugfs-for-tx-drop-counters.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0152-mtk-mt76-add-debugfs-for-tx-drop-counters.patch
@@ -1,8 +1,9 @@
-From a56b55265b3e813f7b803b242094a9a9a77cd3a4 Mon Sep 17 00:00:00 2001
+From e126a0d9cd5d6a25caf5db58a5cc5edb6b22cc16 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 13 Jun 2024 17:47:13 +0800
-Subject: [PATCH 164/199] mtk: mt76: add debugfs for tx drop counters
+Subject: [PATCH 152/223] mtk: mt76: add debugfs for tx drop counters
 
+Change-Id: I1d375169cca29fb58544edfbd235ef3e058a130a
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  dma.c                | 22 +++++++++---
@@ -86,7 +87,7 @@
  				tx_info.info, tx_info.skb, t);
  
 diff --git a/mac80211.c b/mac80211.c
-index 10267019..5402366e 100644
+index a555bec2..93ff77be 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -417,6 +417,7 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
@@ -106,10 +107,10 @@
  	init_waitqueue_head(&dev->tx_wait);
  
 diff --git a/mt76.h b/mt76.h
-index 728740ef..ee118ee5 100644
+index 8e71c2ce..8e78ba86 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -835,6 +835,31 @@ struct mt76_vif {
+@@ -849,6 +849,31 @@ struct mt76_vif {
  	struct ieee80211_chanctx_conf *ctx;
  };
  
@@ -141,7 +142,7 @@
  struct mt76_phy {
  	struct ieee80211_hw *hw;
  	struct ieee80211_hw *ori_hw;
-@@ -891,6 +916,7 @@ struct mt76_phy {
+@@ -906,6 +931,7 @@ struct mt76_phy {
  		bool al;
  		u8 pin;
  	} leds;
@@ -149,7 +150,7 @@
  };
  
  struct mt76_dev {
-@@ -995,6 +1021,7 @@ struct mt76_dev {
+@@ -1010,6 +1036,7 @@ struct mt76_dev {
  	};
  
  	const char *bin_file_name;
@@ -158,10 +159,10 @@
  
  #define MT76_MAX_AMSDU_NUM 8
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 017e3465..0f282f16 100644
+index c341a553..a78ebefc 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -897,11 +897,15 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -909,11 +909,15 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	u8 *txwi = (u8 *)txwi_ptr;
  	u8 link_id;
  
@@ -179,7 +180,7 @@
  
  	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mvif->sta;
  	if (ieee80211_is_data_qos(hdr->frame_control) && sta->mlo) {
-@@ -927,15 +931,19 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -939,15 +943,19 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	}
  
  	mconf = rcu_dereference(mvif->link[wcid->link_id]);
@@ -201,7 +202,7 @@
  #ifdef CONFIG_MTK_DEBUG
  	t->jiffies = jiffies;
  #endif
-@@ -957,8 +965,10 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -969,8 +977,10 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  
  		conf = rcu_dereference(vif->link_conf[wcid->link_id]);
  		link_sta = rcu_dereference(sta->link[wcid->link_id]);
@@ -214,10 +215,10 @@
  		dma_sync_single_for_cpu(mdev->dma_dev, tx_info->buf[1].addr,
  					tx_info->buf[1].len, DMA_TO_DEVICE);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 443b3962..553345e8 100644
+index 455beb74..8fb68880 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -1423,11 +1423,13 @@ static void mt7996_tx(struct ieee80211_hw *hw,
+@@ -1427,11 +1427,13 @@ static void mt7996_tx(struct ieee80211_hw *hw,
  		      struct sk_buff *skb)
  {
  	struct mt76_phy *mphy;
@@ -231,7 +232,7 @@
  
  	if (control->sta) {
  		msta = (struct mt7996_sta *)control->sta->drv_priv;
-@@ -1499,14 +1501,18 @@ static void mt7996_tx(struct ieee80211_hw *hw,
+@@ -1503,14 +1505,18 @@ static void mt7996_tx(struct ieee80211_hw *hw,
  		mphy = mconf->phy->mt76;
  		wcid = &mlink->wcid;
  	} else {
@@ -253,10 +254,10 @@
  }
  
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 9bd35c91..759b9d8f 100644
+index f13f09e1..d15d403b 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -4163,6 +4163,83 @@ out:
+@@ -4162,6 +4162,83 @@ out:
  	return ret;
  }
  
@@ -340,7 +341,7 @@
  /* DRR */
  static int
  mt7996_drr_info(struct seq_file *s, void *data)
-@@ -4288,6 +4365,9 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
+@@ -4287,6 +4364,9 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
  	/* amsdu */
  	debugfs_create_file("amsdu_algo", 0600, dir, dev, &fops_amsdu_algo);
  	debugfs_create_file("amsdu_para", 0600, dir, dev, &fops_amsdu_para);
@@ -351,12 +352,12 @@
  
  #endif
 diff --git a/tx.c b/tx.c
-index 6580833e..5e6e433f 100644
+index 95c84dab..c9fda966 100644
 --- a/tx.c
 +++ b/tx.c
-@@ -331,8 +331,14 @@ mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
- {
+@@ -335,8 +335,14 @@ mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	struct sk_buff_head *head;
  
 +	spin_lock_bh(&phy->tx_dbg_stats.lock);
 +	phy->tx_dbg_stats.tx_from_mac80211++;
@@ -369,17 +370,17 @@
  		return;
  	}
  
-@@ -349,6 +355,9 @@ mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
- 		dev_warn(phy->dev->dev, "Un-initialized STA %pM wcid %d in mt76_tx\n",
- 			 sta->addr, wcid->idx);
+@@ -357,6 +363,9 @@ mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
+ 			dev_warn(phy->dev->dev, "Un-initialized STA %pM wcid %d in mt76_tx\n",
+ 				 sta->addr, wcid->idx);
  
-+		spin_lock_bh(&phy->tx_dbg_stats.lock);
-+		phy->tx_dbg_stats.tx_drop[MT_TX_DROP_WCID_NOT_INIT]++;
-+		spin_unlock_bh(&phy->tx_dbg_stats.lock);
- 		ieee80211_free_txskb(phy->hw, skb);
- 		return;
- 	}
-@@ -380,6 +389,8 @@ mt76_txq_dequeue(struct mt76_phy *phy, struct mt76_txq *mtxq)
++			spin_lock_bh(&phy->tx_dbg_stats.lock);
++			phy->tx_dbg_stats.tx_drop[MT_TX_DROP_WCID_NOT_INIT]++;
++			spin_unlock_bh(&phy->tx_dbg_stats.lock);
+ 			ieee80211_free_txskb(phy->hw, skb);
+ 			return;
+ 		}
+@@ -390,6 +399,8 @@ mt76_txq_dequeue(struct mt76_phy *phy, struct mt76_txq *mtxq)
  	info = IEEE80211_SKB_CB(skb);
  	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, phy->band_idx);
  
@@ -388,14 +389,14 @@
  	return skb;
  }
  
-@@ -617,6 +628,7 @@ mt76_txq_schedule_pending_wcid(struct mt76_phy *phy, struct mt76_wcid *wcid)
+@@ -628,6 +639,7 @@ mt76_txq_schedule_pending_wcid(struct mt76_phy *phy, struct mt76_wcid *wcid,
  		q = phy->q_tx[qid];
- 		if (mt76_txq_stopped(q)) {
+ 		if (mt76_txq_stopped(q) || test_bit(MT76_RESET, &phy->state)) {
  			ret = -1;
 +			phy->tx_dbg_stats.tx_drop[MT_TX_DROP_STOPPED_QUEUE]++;
  			break;
  		}
  
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0165-mtk-mt76-add-debugfs-for-rx-drop-counters.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0153-mtk-mt76-add-debugfs-for-rx-drop-counters.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0165-mtk-mt76-add-debugfs-for-rx-drop-counters.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0153-mtk-mt76-add-debugfs-for-rx-drop-counters.patch
index 925e4bd..a78ee58 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0165-mtk-mt76-add-debugfs-for-rx-drop-counters.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0153-mtk-mt76-add-debugfs-for-rx-drop-counters.patch
@@ -1,8 +1,9 @@
-From 99a027c431faf039052d0d157807469231f037dc Mon Sep 17 00:00:00 2001
+From b230d11d8c61d395043c5463a780f7bcabfc7196 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 23 May 2024 02:33:47 +0800
-Subject: [PATCH 165/199] mtk: mt76: add debugfs for rx drop counters
+Subject: [PATCH 153/223] mtk: mt76: add debugfs for rx drop counters
 
+Change-Id: I23c494a80095c680cfe7765b5898fb044a4b73da
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  agg-rx.c             |  9 +++++
@@ -233,7 +234,7 @@
  
  #endif
 diff --git a/mac80211.c b/mac80211.c
-index 5402366e..d5f842db 100644
+index 93ff77be..6190822c 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -418,6 +418,7 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
@@ -264,7 +265,7 @@
  		return;
  	}
  
-@@ -1055,6 +1062,7 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -1080,6 +1087,7 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
  {
  	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  	struct ieee80211_hdr *hdr = mt76_skb_get_hdr(skb);
@@ -272,7 +273,7 @@
  	struct mt76_rx_status mstat;
  
  	mstat = *((struct mt76_rx_status *)skb->cb);
-@@ -1101,7 +1109,12 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -1126,7 +1134,12 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
  	}
  
  	*sta = wcid_to_sta(mstat.wcid);
@@ -287,10 +288,10 @@
  
  static void
 diff --git a/mt76.h b/mt76.h
-index ee118ee5..f2d12b89 100644
+index 8e78ba86..62ae2662 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -187,6 +187,34 @@ enum mt76_dfs_state {
+@@ -188,6 +188,34 @@ enum mt76_dfs_state {
  	MT_DFS_STATE_ACTIVE,
  };
  
@@ -325,7 +326,7 @@
  struct mt76_queue_buf {
  	dma_addr_t addr;
  	u16 len:15,
-@@ -255,6 +283,8 @@ struct mt76_queue {
+@@ -256,6 +284,8 @@ struct mt76_queue {
  	dma_addr_t desc_dma;
  	struct sk_buff *rx_head;
  	struct page_frag_cache rx_page;
@@ -334,7 +335,7 @@
  };
  
  struct mt76_mcu_ops {
-@@ -860,6 +890,14 @@ struct mt76_tx_debug {
+@@ -874,6 +904,14 @@ struct mt76_tx_debug {
  	spinlock_t lock;
  };
  
@@ -349,7 +350,7 @@
  struct mt76_phy {
  	struct ieee80211_hw *hw;
  	struct ieee80211_hw *ori_hw;
-@@ -917,6 +955,7 @@ struct mt76_phy {
+@@ -932,6 +970,7 @@ struct mt76_phy {
  		u8 pin;
  	} leds;
  	struct mt76_tx_debug tx_dbg_stats;
@@ -358,10 +359,10 @@
  
  struct mt76_dev {
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 0f282f16..2f37d31c 100644
+index a78ebefc..ee505a55 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1410,9 +1410,11 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+@@ -1422,9 +1422,11 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  			 struct sk_buff *skb, u32 *info)
  {
  	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
@@ -373,7 +374,7 @@
  
  	type = le32_get_bits(rxd[0], MT_RXD0_PKT_TYPE);
  	if (type != PKT_TYPE_NORMAL) {
-@@ -1447,12 +1449,23 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+@@ -1459,12 +1461,23 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  		dev_kfree_skb(skb);
  		break;
  	case PKT_TYPE_NORMAL:
@@ -398,10 +399,10 @@
  		break;
  	}
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 759b9d8f..b16ea5fe 100644
+index d15d403b..422518f5 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -4240,6 +4240,84 @@ out:
+@@ -4239,6 +4239,84 @@ out:
  }
  DEFINE_SHOW_ATTRIBUTE(mt7996_tx_drop);
  
@@ -486,7 +487,7 @@
  /* DRR */
  static int
  mt7996_drr_info(struct seq_file *s, void *data)
-@@ -4368,6 +4446,7 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
+@@ -4367,6 +4445,7 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
  
  	/* Drop counters */
  	debugfs_create_file("tx_drop_stats", 0400, dir, dev, &mt7996_tx_drop_fops);
@@ -495,5 +496,5 @@
  
  #endif
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0166-mtk-mt76-mt7996-add-support-for-remain-on-channel-op.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0154-mtk-mt76-mt7996-add-support-for-remain-on-channel-op.patch
similarity index 92%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0166-mtk-mt76-mt7996-add-support-for-remain-on-channel-op.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0154-mtk-mt76-mt7996-add-support-for-remain-on-channel-op.patch
index 000a95f..f68f239 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0166-mtk-mt76-mt7996-add-support-for-remain-on-channel-op.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0154-mtk-mt76-mt7996-add-support-for-remain-on-channel-op.patch
@@ -1,7 +1,7 @@
-From 17fa174e1a5da3fc24454f6b5e4e014b93b0165d Mon Sep 17 00:00:00 2001
+From 78e6f75e8e5114ed78257bf708655084fe36dcd1 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Fri, 7 Jun 2024 15:24:00 +0800
-Subject: [PATCH 166/199] mtk: mt76: mt7996: add support for remain-on-channel
+Subject: [PATCH 154/223] mtk: mt76: mt7996: add support for remain-on-channel
  operation
 
 Remain-on-channel operation allows interface to temporarily leave the
@@ -17,6 +17,7 @@
 3. The MLd STA can remain on full-band channels even if it does not have
    connection on that band. In such case, the default link is used.
 
+Change-Id: Idefe2623133ada2646612e2f13452257ca83b992
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt7996/init.c   |   4 ++
@@ -25,7 +26,7 @@
  3 files changed, 181 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 55eb32cb..5f38374f 100644
+index 18a86afe..fe2958f5 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -498,6 +498,8 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -45,7 +46,7 @@
  
  	ret = mt7996_eeprom_parse_hw_cap(dev, phy);
  	if (ret)
-@@ -1676,6 +1679,7 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1696,6 +1699,7 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	INIT_WORK(&dev->rc_work, mt7996_mac_sta_rc_work);
  	INIT_DELAYED_WORK(&dev->mphy.mac_work, mt7996_mac_work);
  	INIT_DELAYED_WORK(&dev->phy.scan_work, mt7996_scan_work);
@@ -54,7 +55,7 @@
  	INIT_LIST_HEAD(&dev->sta_rc_list);
  	INIT_LIST_HEAD(&dev->twt_list);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 553345e8..35a77609 100644
+index 8fb68880..ff4ef55d 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -505,6 +505,7 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
@@ -74,7 +75,7 @@
  	int timeout = HZ / 5;
  	unsigned long was_scanning = ieee80211_get_scanning(mphy->hw);
  
-@@ -2520,7 +2521,8 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2524,7 +2525,8 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  	mt76_vif_dbg(vif, "trigger scan on mt76 band %u\n", phy->mt76->band_idx);
  	mutex_lock(&phy->dev->mt76.mutex);
@@ -84,7 +85,7 @@
  		mutex_unlock(&phy->dev->mt76.mutex);
  		return -EBUSY;
  	}
-@@ -2641,6 +2643,170 @@ mt7996_cancel_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+@@ -2645,6 +2647,170 @@ mt7996_cancel_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
  	}
  }
  
@@ -255,7 +256,7 @@
  static int
  mt7996_add_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *conf)
  {
-@@ -2689,6 +2855,7 @@ mt7996_remove_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *co
+@@ -2693,6 +2859,7 @@ mt7996_remove_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *co
  
  	mt76_dbg(hw, "remove %u\n", conf->def.chan->hw_value);
  	cancel_delayed_work_sync(&phy->scan_work);
@@ -263,7 +264,7 @@
  	cancel_delayed_work_sync(&phy->mt76->mac_work);
  
  	mutex_lock(&phy->dev->mt76.mutex);
-@@ -2774,6 +2941,7 @@ mt7996_unassign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2778,6 +2945,7 @@ mt7996_unassign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	mt76_vif_dbg(vif, "remove link %u from %d MHz\n",
  		     link_conf->link_id, conf->def.chan->center_freq);
  	cancel_delayed_work_sync(&phy->scan_work);
@@ -271,7 +272,7 @@
  
  	mutex_lock(&phy->dev->mt76.mutex);
  
-@@ -3036,6 +3204,8 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -3040,6 +3208,8 @@ const struct ieee80211_ops mt7996_ops = {
  	.wake_tx_queue = mt76_wake_tx_queue,
  	.hw_scan = mt7996_hw_scan,
  	.cancel_hw_scan = mt7996_cancel_hw_scan,
@@ -281,10 +282,10 @@
  	.get_txpower = mt7996_get_txpower,
  	.channel_switch_beacon = mt7996_channel_switch_beacon,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 42c1e287..3ee8156c 100644
+index b0d9b0bd..251a3c70 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -597,6 +597,10 @@ struct mt7996_phy {
+@@ -598,6 +598,10 @@ struct mt7996_phy {
  	struct mt7996_scs_ctrl scs_ctrl;
  	u32 red_drop;
  
@@ -295,7 +296,7 @@
  	bool sku_limit_en;
  	bool sku_path_en;
  
-@@ -1249,6 +1253,7 @@ bool mt7996_rx_check(struct mt76_dev *mdev, void *data, int len);
+@@ -1253,6 +1257,7 @@ bool mt7996_rx_check(struct mt76_dev *mdev, void *data, int len);
  void mt7996_stats_work(struct work_struct *work);
  void mt7996_scan_work(struct work_struct *work);
  void mt7996_scan_complete(struct mt7996_phy *phy, bool aborted);
@@ -304,5 +305,5 @@
  int mt76_dfs_start_rdd(struct mt7996_dev *dev, bool force);
  int mt7996_dfs_init_radar_detector(struct mt7996_phy *phy);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0167-mtk-mt76-mt7996-rework-the-setting-flow-of-starec-RA.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0155-mtk-mt76-mt7996-rework-the-setting-flow-of-starec-RA.patch
similarity index 93%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0167-mtk-mt76-mt7996-rework-the-setting-flow-of-starec-RA.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0155-mtk-mt76-mt7996-rework-the-setting-flow-of-starec-RA.patch
index 29f9510..4cb45ec 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0167-mtk-mt76-mt7996-rework-the-setting-flow-of-starec-RA.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0155-mtk-mt76-mt7996-rework-the-setting-flow-of-starec-RA.patch
@@ -1,7 +1,7 @@
-From 6b95665d9e183c522e051a18177afe8b91ea817c Mon Sep 17 00:00:00 2001
+From 6d567ce5c36ea5a0c26cb2b55063bbc383adbca7 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 26 Jun 2024 19:09:46 +0800
-Subject: [PATCH 167/199] mtk: mt76: mt7996: rework the setting flow of starec
+Subject: [PATCH 155/223] mtk: mt76: mt7996: rework the setting flow of starec
  RA and MLD tags
 
 1. STA_REC_RA and STA_REC_MLD tags need to be set when newly is true,
@@ -10,6 +10,7 @@
 
 2. This patch also tries to fix random EAPOL timeout issue.
 
+Change-Id: Icffce3a25d0290b42c84c5ff94bbb5e6762f1f9d
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mt7996/main.c   |   4 --
@@ -19,7 +20,7 @@
  4 files changed, 83 insertions(+), 113 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 35a77609..b5d45d19 100644
+index ff4ef55d..103902b7 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1318,10 +1318,6 @@ mt7996_mac_sta_add_links(struct mt7996_dev *dev, struct ieee80211_vif *vif,
@@ -34,10 +35,10 @@
  error:
  	mt7996_mac_sta_remove_links(dev, vif, sta, add);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 54295414..9b3c6e3d 100644
+index db975daa..bad8e030 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2911,6 +2911,77 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+@@ -2916,6 +2916,77 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  	return mt7996_mcu_add_rate_ctrl_fixed(dev, conf, mconf, link_sta, mlink);
  }
  
@@ -115,7 +116,7 @@
  #if 0
  static int
  mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf,
-@@ -2978,6 +3049,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+@@ -2985,6 +3056,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  
  	/* tag order is in accordance with firmware dependency. */
  	if (link_sta) {
@@ -124,7 +125,7 @@
  		/* starec hdrt mode */
  		mt7996_mcu_sta_hdrt_tlv(dev, skb);
  		/* starec bfer */
-@@ -2987,7 +3060,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+@@ -2994,7 +3067,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  		/* starec vht */
  		mt7996_mcu_sta_vht_tlv(skb, link_sta);
  		/* starec uapsd */
@@ -133,7 +134,7 @@
  		/* starec amsdu */
  		mt7996_mcu_sta_amsdu_tlv(dev, skb, vif, link_sta, mlink);
  		/* starec he */
-@@ -3000,6 +3073,12 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+@@ -3007,6 +3080,12 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  		mt7996_mcu_sta_muru_tlv(dev, skb, conf, mconf, link_sta);
  		/* starec bfee */
  		mt7996_mcu_sta_bfee_tlv(dev, skb, conf, mconf, link_sta);
@@ -146,7 +147,7 @@
  	}
  
  #if 0
-@@ -3014,112 +3093,6 @@ out:
+@@ -3021,112 +3100,6 @@ out:
  				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
  }
  
@@ -274,10 +275,10 @@
  
  #define MT7996_MAX_BEACON_SIZE		1338
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 3ee8156c..1e507b1c 100644
+index 251a3c70..edd9c7c9 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1083,8 +1083,6 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+@@ -1087,8 +1087,6 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  			     struct mt7996_bss_conf *mconf,
  			     struct ieee80211_link_sta *link_sta,
  			     struct mt7996_link_sta *mlink, bool changed);
@@ -287,5 +288,5 @@
  int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag, bool sta);
  int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct mt7996_bss_conf *mconf);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0168-mtk-mt76-mt7996-Fix-NULL-pointer-crash-when-mac-tx-f.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0156-mtk-mt76-mt7996-Fix-NULL-pointer-crash-when-mac-tx-f.patch
similarity index 74%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0168-mtk-mt76-mt7996-Fix-NULL-pointer-crash-when-mac-tx-f.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0156-mtk-mt76-mt7996-Fix-NULL-pointer-crash-when-mac-tx-f.patch
index e14d128..36029cf 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0168-mtk-mt76-mt7996-Fix-NULL-pointer-crash-when-mac-tx-f.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0156-mtk-mt76-mt7996-Fix-NULL-pointer-crash-when-mac-tx-f.patch
@@ -1,7 +1,7 @@
-From 8f1b477c5734b3e46dd8d6795c784ef58d553d74 Mon Sep 17 00:00:00 2001
+From 59aecb430cc995720c5fa10353fb68372952f0df Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Thu, 27 Jun 2024 14:54:38 +0800
-Subject: [PATCH 168/199] mtk: mt76: mt7996: Fix NULL pointer crash when mac tx
+Subject: [PATCH 156/223] mtk: mt76: mt7996: Fix NULL pointer crash when mac tx
  free with a msta that has been removed.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 2f37d31c..12cc60cb 100644
+index ee505a55..3cd034cd 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1200,7 +1200,7 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+@@ -1212,7 +1212,7 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
  				struct mt7996_link_sta *mlink =
  					rcu_dereference(msta->link[link_id]);
  
@@ -23,5 +23,5 @@
  			}
  			spin_unlock_bh(&mdev->sta_poll_lock);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0169-mtk-mt76-mt7996-update-adie-efuse-merge-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0157-mtk-mt76-mt7996-update-adie-efuse-merge-support.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0169-mtk-mt76-mt7996-update-adie-efuse-merge-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0157-mtk-mt76-mt7996-update-adie-efuse-merge-support.patch
index 8def00e..40f9db6 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0169-mtk-mt76-mt7996-update-adie-efuse-merge-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0157-mtk-mt76-mt7996-update-adie-efuse-merge-support.patch
@@ -1,22 +1,23 @@
-From a6bd94f22e1b58c4248e433889071b4e0bd1f283 Mon Sep 17 00:00:00 2001
+From b930141330014c5e7402fe75bd05e2f2a9705a81 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 14 Jun 2024 10:14:31 +0800
-Subject: [PATCH 169/199] mtk: mt76: mt7996: update adie efuse merge support
+Subject: [PATCH 157/223] mtk: mt76: mt7996: update adie efuse merge support
 
 Refactor efuse merge due to FW supporting the efuse merge mcu command
 
+Change-Id: I99f3c3577826f505e402c884cc1f4815f519d2bc
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
- mt7996/eeprom.c | 144 -----------------------------------------
- mt7996/mcu.c    | 167 +++++++++++++++++++++++++++++++++++++++++++++++-
+ mt7996/eeprom.c | 144 --------------------------------------------
+ mt7996/mcu.c    | 155 +++++++++++++++++++++++++++++++++++++++++++++++-
  mt7996/mcu.h    |   1 +
- 3 files changed, 167 insertions(+), 145 deletions(-)
+ 3 files changed, 153 insertions(+), 147 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index e8e1d85a..fb0f2953 100644
+index 72a21fcf..327a36b2 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -531,146 +531,6 @@ fail:
+@@ -564,146 +564,6 @@ fail:
  	return ret;
  }
  
@@ -77,7 +78,7 @@
 -	case 0x7990:
 -		adie_base = adie_base_7996;
 -		/* adie 0 */
--		if (dev->fem_type == MT7996_FEM_INT && dev->chip_sku != MT7996_SKU_233)
+-		if (dev->fem_type == MT7996_FEM_INT && dev->chip_sku != MT7996_VAR_TYPE_233)
 -			adie_id = ADIE_7975;
 -		else
 -			adie_id = ADIE_7976;
@@ -85,7 +86,7 @@
 -		eep_offs[0] = eep_offs_list[adie_id];
 -
 -		/* adie 1 */
--		if (dev->chip_sku == MT7996_SKU_444) {
+-		if (dev->chip_sku == MT7996_VAR_TYPE_444) {
 -			adie_offs[1] = adie_offs_list[ADIE_7977];
 -			eep_offs[1] = eep_offs_list[ADIE_7977];
 -		}
@@ -97,10 +98,10 @@
 -	case 0x7992:
 -		adie_base = adie_base_7992;
 -		/* adie 0 */
--		if (dev->chip_sku == MT7992_SKU_44 &&
+-		if (dev->chip_sku == MT7992_VAR_TYPE_44 &&
 -		    dev->fem_type != MT7996_FEM_EXT)
 -			adie_id = ADIE_7975;
--		else if (dev->chip_sku == MT7992_SKU_24)
+-		else if (dev->chip_sku == MT7992_VAR_TYPE_24)
 -			adie_id = ADIE_7978;
 -		else
 -			adie_id = ADIE_7976;
@@ -108,10 +109,10 @@
 -		eep_offs[0] = eep_offs_list[adie_id];
 -
 -		/* adie 1 */
--		if (dev->chip_sku == MT7992_SKU_44 &&
+-		if (dev->chip_sku == MT7992_VAR_TYPE_44 &&
 -		    dev->fem_type != MT7996_FEM_INT)
 -			adie_id = ADIE_7977;
--		else if (dev->chip_sku != MT7992_SKU_23)
+-		else if (dev->chip_sku != MT7992_VAR_TYPE_23)
 -			adie_id = ADIE_7979;
 -		else
 -			break;
@@ -137,7 +138,7 @@
 -			if (adie_offs[band][i] == MT_EE_END_OFFSET)
 -				break;
 -
--			if (is_mt7996(&dev->mt76) && dev->chip_sku == MT7996_SKU_444 &&
+-			if (is_mt7996(&dev->mt76) && dev->chip_sku == MT7996_VAR_TYPE_444 &&
 -			    band == MT_BAND1)
 -				eep_offset -= MT_EE_7977BN_OFFSET;
 -
@@ -163,7 +164,7 @@
  int mt7996_eeprom_init(struct mt7996_dev *dev)
  {
  	int ret;
-@@ -685,10 +545,6 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
+@@ -714,10 +574,6 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
  
  	mt7996_eeprom_load_precal(dev);
  
@@ -175,14 +176,13 @@
  	if (ret < 0)
  		return ret;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 9b3c6e3d..08c92eb3 100644
+index bad8e030..9194886b 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4595,7 +4595,151 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag, bool sta)
+@@ -4603,6 +4603,150 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag, bool sta)
  				 &req, sizeof(req), true);
  }
  
--int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
 +static int mt7996_mcu_set_cal_free_data(struct mt7996_dev *dev)
 +{
 +#define MT_EE_CAL_FREE_MAX_SIZE		30
@@ -238,7 +238,7 @@
 +	case 0x7990:
 +		adie_base = adie_base_7996;
 +		/* adie 0 */
-+		if (dev->fem_type == MT7996_FEM_INT && dev->chip_sku != MT7996_SKU_233)
++		if (dev->fem_type == MT7996_FEM_INT && dev->chip_sku != MT7996_VAR_TYPE_233)
 +			adie_id = ADIE_7975;
 +		else
 +			adie_id = ADIE_7976;
@@ -246,7 +246,7 @@
 +		eep_offs[0] = eep_offs_list[adie_id];
 +
 +		/* adie 1 */
-+		if (dev->chip_sku == MT7996_SKU_444) {
++		if (dev->chip_sku == MT7996_VAR_TYPE_444) {
 +			adie_offs[1] = adie_offs_list[ADIE_7977];
 +			eep_offs[1] = eep_offs_list[ADIE_7977];
 +		}
@@ -258,10 +258,10 @@
 +	case 0x7992:
 +		adie_base = adie_base_7992;
 +		/* adie 0 */
-+		if (dev->chip_sku == MT7992_SKU_44 &&
++		if (dev->chip_sku == MT7992_VAR_TYPE_44 &&
 +		    dev->fem_type != MT7996_FEM_EXT)
 +			adie_id = ADIE_7975;
-+		else if (dev->chip_sku == MT7992_SKU_24)
++		else if (dev->chip_sku == MT7992_VAR_TYPE_24)
 +			adie_id = ADIE_7978;
 +		else
 +			adie_id = ADIE_7976;
@@ -269,10 +269,10 @@
 +		eep_offs[0] = eep_offs_list[adie_id];
 +
 +		/* adie 1 */
-+		if (dev->chip_sku == MT7992_SKU_44 &&
++		if (dev->chip_sku == MT7992_VAR_TYPE_44 &&
 +		    dev->fem_type != MT7996_FEM_INT)
 +			adie_id = ADIE_7977;
-+		else if (dev->chip_sku != MT7992_SKU_23)
++		else if (dev->chip_sku != MT7992_VAR_TYPE_23)
 +			adie_id = ADIE_7979;
 +		else
 +			break;
@@ -311,7 +311,7 @@
 +			if (adie_offs[band][i] == MT_EE_END_OFFSET)
 +				break;
 +
-+			if (is_mt7996(&dev->mt76) && dev->chip_sku == MT7996_SKU_444 &&
++			if (is_mt7996(&dev->mt76) && dev->chip_sku == MT7996_VAR_TYPE_444 &&
 +			    band == MT_BAND1)
 +				eep_offset -= MT_EE_7977BN_OFFSET;
 +
@@ -327,38 +327,30 @@
 +	return 0;
 +}
 +
-+int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
+ int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
  {
  #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
- #define PAGE_IDX_MASK		GENMASK(4, 2)
-@@ -4640,6 +4784,27 @@ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
- 	return 0;
- }
- 
-+int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
-+{
-+	struct mt7996_mcu_eeprom req = {
-+		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
-+		.len = cpu_to_le16(sizeof(req) - 4),
-+		.buffer_mode = EE_MODE_EFUSE,
-+		.format = EE_FORMAT_WHOLE
-+	};
+@@ -4656,12 +4800,17 @@ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
+ 		.buffer_mode = EE_MODE_EFUSE,
+ 		.format = EE_FORMAT_WHOLE
+ 	};
 +	int ret;
-+
-+	if (dev->flash_mode)
+ 
+ 	if (dev->flash_mode)
+-		return mt7996_mcu_set_eeprom_flash(dev);
 +		ret = mt7996_mcu_set_eeprom_flash(dev);
 +	else
 +		ret = mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(EFUSE_CTRL),
 +					&req, sizeof(req), true);
 +	if (ret)
 +		return ret;
-+
+ 
+-	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(EFUSE_CTRL),
+-				 &req, sizeof(req), true);
 +	return mt7996_mcu_set_cal_free_data(dev);
-+}
-+
- int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf)
- {
- 	struct mt7996_mcu_eeprom_info req = {
+ }
+ 
+ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len)
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
 index 05b29c90..d99e9a60 100644
 --- a/mt7996/mcu.h
@@ -372,5 +364,5 @@
  
  enum {
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0170-mtk-mt76-mt7996-support-handle-link_id-in-ap_wireles.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0158-mtk-mt76-mt7996-support-handle-link_id-in-ap_wireles.patch
similarity index 97%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0170-mtk-mt76-mt7996-support-handle-link_id-in-ap_wireles.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0158-mtk-mt76-mt7996-support-handle-link_id-in-ap_wireles.patch
index f98bc73..27a87a7 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0170-mtk-mt76-mt7996-support-handle-link_id-in-ap_wireles.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0158-mtk-mt76-mt7996-support-handle-link_id-in-ap_wireles.patch
@@ -1,7 +1,7 @@
-From e7b25f87fa76aef0603209472187e9cadfbaada6 Mon Sep 17 00:00:00 2001
+From e2ca291d9edba04731cbec32d52ad00c13e5d1c9 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 14 Jun 2024 14:54:44 +0800
-Subject: [PATCH 170/199] mtk: mt76: mt7996: support handle link_id in
+Subject: [PATCH 158/223] mtk: mt76: mt7996: support handle link_id in
  ap_wireless vendor cmd
 
 Add support handle link_id in ap_wireless vendor command. The link_id is
@@ -11,6 +11,7 @@
 This commit also refactor some functions, changing the parameter from
 phy to dev since phy is not required.
 
+Change-Id: I8d86ca45d2417d155114f27b13e7172565264e3f
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
  mt7996/mt7996.h  | 12 +++++------
@@ -20,10 +21,10 @@
  4 files changed, 73 insertions(+), 44 deletions(-)
 
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 1e507b1c..00cd0b61 100644
+index edd9c7c9..c122989d 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1300,8 +1300,8 @@ int mt7996_vendor_amnt_sta_remove(struct mt7996_phy *phy,
+@@ -1304,8 +1304,8 @@ int mt7996_vendor_amnt_sta_remove(struct mt7996_phy *phy,
  				  struct ieee80211_sta *sta);
  void mt7996_set_wireless_amsdu(struct ieee80211_hw *hw, u8 en);
  void mt7996_mcu_set_mimo(struct mt7996_phy *phy);
@@ -34,7 +35,7 @@
  void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
  int mt7996_mcu_set_csi(struct mt7996_phy *phy, u8 mode,
  		       u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
-@@ -1332,12 +1332,12 @@ int mt7996_mcu_set_muru_fixed_rate_parameter(struct mt7996_dev *dev, u8 action,
+@@ -1336,12 +1336,12 @@ int mt7996_mcu_set_muru_fixed_rate_parameter(struct mt7996_dev *dev, u8 action,
  int mt7996_mcu_set_txbf_snd_info(struct mt7996_dev *dev, void *para);
  int mt7996_mcu_set_muru_cmd(struct mt7996_dev *dev, u16 action, int val);
  int mt7996_mcu_muru_set_prot_frame_thr(struct mt7996_dev *dev, u32 val);
@@ -323,5 +324,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0171-mtk-mt76-mt7996-fix-incorrect-indexing-of-MIB-FW-eve.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0159-mtk-mt76-mt7996-fix-incorrect-indexing-of-MIB-FW-eve.patch
similarity index 86%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0171-mtk-mt76-mt7996-fix-incorrect-indexing-of-MIB-FW-eve.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0159-mtk-mt76-mt7996-fix-incorrect-indexing-of-MIB-FW-eve.patch
index 03262f4..9941a17 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0171-mtk-mt76-mt7996-fix-incorrect-indexing-of-MIB-FW-eve.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0159-mtk-mt76-mt7996-fix-incorrect-indexing-of-MIB-FW-eve.patch
@@ -1,21 +1,22 @@
-From 96ef7f1ebdc990ecd0e547710c0929aa7d885a68 Mon Sep 17 00:00:00 2001
+From 2986830e53280e7c49ef3893108a631d19d88023 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Fri, 28 Jun 2024 18:03:41 +0800
-Subject: [PATCH 171/199] mtk: mt76: mt7996: fix incorrect indexing of MIB FW
+Subject: [PATCH 159/223] mtk: mt76: mt7996: fix incorrect indexing of MIB FW
  event
 
 When porting channel state reporting from Wi-Fi 6 to Wi-Fi 7 codebase, indexing of FW event of MIB data was not properly handled.
 
+Change-Id: I4fbc68505d072c0f393d20c625aa58c66934f557
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt7996/mcu.c | 45 +++++++++++++++++++++++++++++----------------
  1 file changed, 29 insertions(+), 16 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 08c92eb3..bb4f6170 100644
+index 9194886b..723a7ad9 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -5106,6 +5106,13 @@ int mt7996_mcu_get_chip_config(struct mt7996_dev *dev, u32 *cap)
+@@ -5116,6 +5116,13 @@ int mt7996_mcu_get_chip_config(struct mt7996_dev *dev, u32 *cap)
  
  int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch)
  {
@@ -29,7 +30,7 @@
  	struct {
  		struct {
  			u8 band;
-@@ -5115,16 +5122,15 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch)
+@@ -5125,16 +5132,15 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch)
  			__le16 tag;
  			__le16 len;
  			__le32 offs;
@@ -51,7 +52,7 @@
  	};
  	struct mt76_channel_state *state = phy->mt76->chan_state;
  	struct mt76_channel_state *state_ts = &phy->state_ts;
-@@ -5133,7 +5139,7 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch)
+@@ -5143,7 +5149,7 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch)
  	struct sk_buff *skb;
  	int i, ret;
  
@@ -60,7 +61,7 @@
  		req.data[i].tag = cpu_to_le16(UNI_CMD_MIB_DATA);
  		req.data[i].len = cpu_to_le16(sizeof(req.data[i]));
  		req.data[i].offs = cpu_to_le32(offs[i]);
-@@ -5152,17 +5158,24 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch)
+@@ -5162,17 +5168,24 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch)
  		goto out;
  
  #define __res_u64(s) le64_to_cpu(res[s].data)
@@ -95,5 +96,5 @@
  
  	dev_kfree_skb(skb);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0172-mtk-mt76-mt7996-support-muru-dbg-info-debug-commands.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0160-mtk-mt76-mt7996-support-muru-dbg-info-debug-commands.patch
similarity index 84%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0172-mtk-mt76-mt7996-support-muru-dbg-info-debug-commands.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0160-mtk-mt76-mt7996-support-muru-dbg-info-debug-commands.patch
index 9cda995..1f278bd 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0172-mtk-mt76-mt7996-support-muru-dbg-info-debug-commands.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0160-mtk-mt76-mt7996-support-muru-dbg-info-debug-commands.patch
@@ -1,7 +1,7 @@
-From 75b59026efecf9c1f6a9486537566121ea3f9055 Mon Sep 17 00:00:00 2001
+From ef4a19e3bb7aebd2ceb745cefc45fd7000db2014 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 3 Jun 2024 15:18:05 +0800
-Subject: [PATCH 172/199] mtk: mt76: mt7996: support muru dbg info debug
+Subject: [PATCH 160/223] mtk: mt76: mt7996: support muru dbg info debug
  commands
 
 Support enable muru debug functionality by debugfs.
@@ -10,16 +10,17 @@
 
 The purpose of this commit is for WiFi 7 R1 cert UL-MU test cases.
 
+Change-Id: Id7877a3c6d4e45585bfe14885b2eaea2620dfd5b
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
  mt7996/mtk_debugfs.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
  1 file changed, 44 insertions(+)
 
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index b16ea5fe..b698c68a 100644
+index 422518f5..02a6ee81 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -4326,6 +4326,48 @@ mt7996_drr_info(struct seq_file *s, void *data)
+@@ -4325,6 +4325,48 @@ mt7996_drr_info(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -68,7 +69,7 @@
  void mt7996_mtk_init_band_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	/* agg */
-@@ -4447,6 +4489,8 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
+@@ -4446,6 +4488,8 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
  	/* Drop counters */
  	debugfs_create_file("tx_drop_stats", 0400, dir, dev, &mt7996_tx_drop_fops);
  	debugfs_create_file("rx_drop_stats", 0400, dir, dev, &mt7996_rx_drop_fops);
@@ -78,5 +79,5 @@
  
  #endif
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0173-mtk-mt76-mt7996-add-kite-if_comb.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0161-mtk-mt76-mt7996-add-kite-if_comb.patch
similarity index 92%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0173-mtk-mt76-mt7996-add-kite-if_comb.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0161-mtk-mt76-mt7996-add-kite-if_comb.patch
index e41cb4b..d4a1f0d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0173-mtk-mt76-mt7996-add-kite-if_comb.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0161-mtk-mt76-mt7996-add-kite-if_comb.patch
@@ -1,7 +1,7 @@
-From 4e90d97cde027ac38e6f88649d4e028c96999e2e Mon Sep 17 00:00:00 2001
+From fe7a769deaeb995f9657dc160ec670192464e8e4 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 3 Jul 2024 10:34:39 +0800
-Subject: [PATCH 173/199] mtk: mt76: mt7996: add kite if_comb
+Subject: [PATCH 161/223] mtk: mt76: mt7996: add kite if_comb
 
 Add Kite (dual band) if_comb
 
@@ -11,7 +11,7 @@
  1 file changed, 30 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 5f38374f..f923ce66 100644
+index fe2958f5..18847ff5 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -46,6 +46,22 @@ static const struct ieee80211_iface_combination if_comb[] = {
@@ -64,5 +64,5 @@
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BSS_COLOR);
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0174-mtk-mt76-mt7996-change-source-of-per-WCID-TX-MPDU-st.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0162-mtk-mt76-mt7996-change-source-of-per-WCID-TX-MPDU-st.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0174-mtk-mt76-mt7996-change-source-of-per-WCID-TX-MPDU-st.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0162-mtk-mt76-mt7996-change-source-of-per-WCID-TX-MPDU-st.patch
index 9d80ebd..33c0bc7 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0174-mtk-mt76-mt7996-change-source-of-per-WCID-TX-MPDU-st.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0162-mtk-mt76-mt7996-change-source-of-per-WCID-TX-MPDU-st.patch
@@ -1,11 +1,12 @@
-From ddada5f035de7b87e15de8a87ba1c2491d87edfd Mon Sep 17 00:00:00 2001
+From ce85a854c7b07de8cb560417a038a2c9870c61e5 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Mon, 17 Jun 2024 17:16:19 +0800
-Subject: [PATCH 174/199] mtk: mt76: mt7996: change source of per-WCID TX MPDU
+Subject: [PATCH 162/223] mtk: mt76: mt7996: change source of per-WCID TX MPDU
  statistics
 
 Change source of per-WCID TX MPDU statistics from TX-free-done event to PPDU TXS, because WCID from TX-free-done event may not represent the actually used link.
 
+Change-Id: If4276b3cc779f79f29c7354c9ac2140a2fd8d852
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt76.h             |  1 +
@@ -14,10 +15,10 @@
  3 files changed, 33 insertions(+), 23 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index f2d12b89..feb7bf16 100644
+index 62ae2662..c3b71cc3 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -360,6 +360,7 @@ struct mt76_sta_stats {
+@@ -364,6 +364,7 @@ struct mt76_sta_stats {
  	u64 tx_bytes;
  	/* WED TX */
  	u32 tx_packets;		/* unit: MSDU */
@@ -42,10 +43,10 @@
  #define MT_CT_INFO_COPY_HOST_TXD_ALL	BIT(1)
  #define MT_CT_INFO_MGMT_FRAME		BIT(2)
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 12cc60cb..97cd5e23 100644
+index 3cd034cd..87e671a3 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1206,19 +1206,9 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+@@ -1218,19 +1218,9 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
  			spin_unlock_bh(&mdev->sta_poll_lock);
  			continue;
  		} else if (info & MT_TXFREE_INFO_HEADER) {
@@ -65,7 +66,7 @@
  			if (FIELD_GET(MT_TXFREE_INFO_STAT, info) == 2) {
  				struct mt7996_phy *mphy =
  					__mt7996_phy(dev, wcid->phy_idx);
-@@ -1256,9 +1246,10 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+@@ -1268,9 +1258,10 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
  
  static bool
  mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
@@ -78,7 +79,7 @@
  	struct mt76_dev *mdev = &dev->mt76;
  	struct ieee80211_tx_info *info;
  	struct sk_buff_head list;
-@@ -1270,8 +1261,9 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
+@@ -1282,8 +1273,9 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
  
  	mt76_tx_status_lock(mdev, &list);
  
@@ -90,7 +91,7 @@
  		skb = mt76_tx_status_skb_get(mdev, wcid, pid, &list);
  		if (skb) {
  			struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-@@ -1300,6 +1292,15 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
+@@ -1312,6 +1304,15 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
  				mvif->probe_send_count[wcid->phy_idx] = 0;
  			}
  		}
@@ -106,7 +107,7 @@
  	}
  
  	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && wcid->sta) {
-@@ -1331,6 +1332,7 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
+@@ -1343,6 +1344,7 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
  
  	if (skb)
  		mt76_tx_status_skb_done(mdev, skb, &list);
@@ -114,7 +115,7 @@
  	mt76_tx_status_unlock(mdev, &list);
  
  	return !!skb;
-@@ -1338,13 +1340,13 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
+@@ -1350,13 +1352,13 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
  
  static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
  {
@@ -131,7 +132,7 @@
  	pid = le32_get_bits(txs_data[3], MT_TXS3_PID);
  
  	if (pid < MT_PACKET_ID_NO_SKB)
-@@ -1359,17 +1361,19 @@ static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
+@@ -1371,17 +1373,19 @@ static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
  	if (!wcid)
  		goto out;
  
@@ -158,5 +159,5 @@
  	rcu_read_unlock();
  }
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0175-mtk-mt76-mt7996-update-preamble-puncture-support-for.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0163-mtk-mt76-mt7996-update-preamble-puncture-support-for.patch
similarity index 88%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0175-mtk-mt76-mt7996-update-preamble-puncture-support-for.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0163-mtk-mt76-mt7996-update-preamble-puncture-support-for.patch
index 2896b57..b8184c9 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0175-mtk-mt76-mt7996-update-preamble-puncture-support-for.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0163-mtk-mt76-mt7996-update-preamble-puncture-support-for.patch
@@ -1,7 +1,7 @@
-From 88307d7d8ce98e7d072f6f4592fe2c5c0162080d Mon Sep 17 00:00:00 2001
+From 8908556d4135d7aee178baa3bfb9d3025d1611d9 Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Tue, 28 May 2024 15:31:39 +0800
-Subject: [PATCH 175/199] mtk: mt76: mt7996: update preamble puncture support
+Subject: [PATCH 163/223] mtk: mt76: mt7996: update preamble puncture support
  for mt7996
 
 Add pp station mode support. Current fw only support one bitmap on a band.
@@ -10,6 +10,9 @@
 same bitmap setting.
 Current PP_DSCB_CTRL cmd only use bitmap value in fw implementation.
 
+Change-Id: I93fe7d37d6d0945b92c11e0ff9ee8a35340ddaf2
+Change-Id: I93f61b8bcaa79808745850921b0c18d187bc7113
+Change-Id: I04f1746ad52fef57720e8531d861078934c139c2
 Signed-off-by: Allen Ye <allen.ye@mediatek.com>
 ---
  mt76_connac_mcu.h |   1 +
@@ -20,10 +23,10 @@
  5 files changed, 165 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 8de91f62..c1becf7e 100644
+index 931b29eb..cc644edf 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1071,6 +1071,7 @@ enum {
+@@ -1076,6 +1076,7 @@ enum {
  	MCU_UNI_EVENT_TESTMODE_CTRL = 0x46,
  	MCU_UNI_EVENT_CSI_REPORT = 0x4A,
  	MCU_UNI_EVENT_WED_RRO = 0x57,
@@ -32,7 +35,7 @@
  	MCU_UNI_EVENT_ALL_STA_INFO = 0x6e,
  };
 diff --git a/mt7996/main.c b/mt7996/main.c
-index b5d45d19..032ef5f3 100644
+index 103902b7..562137a5 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1241,6 +1241,12 @@ static int mt7996_add_link_sta(struct mt7996_dev *dev,
@@ -48,7 +51,7 @@
  	ewma_avg_signal_init(&mlink->avg_ack_signal);
  
  	return 0;
-@@ -2840,6 +2846,10 @@ mt7996_add_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *conf)
+@@ -2844,6 +2850,10 @@ mt7996_add_chanctx(struct ieee80211_hw *hw, struct ieee80211_chanctx_conf *conf)
  	if (ret)
  		return ret;
  
@@ -59,7 +62,7 @@
  	return mt7996_set_channel(phy, &ctx->chandef);
  }
  
-@@ -2960,6 +2970,7 @@ mt7996_switch_vif_chanctx(struct ieee80211_hw *hw,
+@@ -2964,6 +2974,7 @@ mt7996_switch_vif_chanctx(struct ieee80211_hw *hw,
  	struct mt7996_chanctx *new_ctx;
  	struct mt7996_phy *phy;
  	int i, ret = 0;
@@ -67,7 +70,7 @@
  
  	for (i = 0; i < n_vifs; i++) {
  		if (vifs[i].old_ctx == vifs[i].new_ctx)
-@@ -3002,6 +3013,17 @@ mt7996_switch_vif_chanctx(struct ieee80211_hw *hw,
+@@ -3006,6 +3017,17 @@ mt7996_switch_vif_chanctx(struct ieee80211_hw *hw,
  
  		mutex_unlock(&dev->mt76.mutex);
  
@@ -86,10 +89,10 @@
  		if (ret)
  			goto out;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index bb4f6170..adb71bf5 100644
+index 723a7ad9..fce92046 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1280,6 +1280,39 @@ mt7996_mcu_wed_rro_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -1285,6 +1285,39 @@ mt7996_mcu_wed_rro_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	}
  }
  
@@ -129,7 +132,7 @@
  static void
  mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
  {
-@@ -1305,6 +1338,9 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -1310,6 +1343,9 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	case MCU_UNI_EVENT_WED_RRO:
  		mt7996_mcu_wed_rro_event(dev, skb);
  		break;
@@ -139,7 +142,7 @@
  #ifdef CONFIG_MTK_DEBUG
  	case MCU_UNI_EVENT_SR:
  		mt7996_mcu_rx_sr_event(dev, skb);
-@@ -6274,7 +6310,8 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
+@@ -6284,7 +6320,8 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
  		u8 force_bitmap_ctrl;
  		u8 auto_mode;
  		__le16 bitmap;
@@ -149,7 +152,7 @@
  	} __packed req = {
  		.tag = cpu_to_le16(UNI_CMD_PP_EN_CTRL),
  		.len = cpu_to_le16(sizeof(req) - 4),
-@@ -6284,6 +6321,7 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
+@@ -6294,6 +6331,7 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
  		.force_bitmap_ctrl = (mode == PP_USR_MODE) ? 2 : 0,
  		.auto_mode = pp_auto,
  		.bitmap = cpu_to_le16(bitmap),
@@ -157,7 +160,7 @@
  	};
  
  	if (phy->chanctx->chandef.chan->band == NL80211_BAND_2GHZ ||
-@@ -6300,6 +6338,73 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
+@@ -6310,6 +6348,73 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
  				 &req, sizeof(req), false);
  }
  
@@ -284,10 +287,10 @@
  	UNI_CMD_SCS_SEND_DATA,
  	UNI_CMD_SCS_SET_PD_THR_RANGE = 2,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 00cd0b61..f31d3f36 100644
+index c122989d..58151ed0 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1276,6 +1276,8 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
+@@ -1280,6 +1280,8 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
  				     struct mt7996_link_sta *mlink);
  int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode);
  int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
@@ -297,5 +300,5 @@
  			   struct ieee80211_sta *sta, struct mt7996_eml_omn *eml_omn);
  #ifdef CONFIG_MAC80211_DEBUGFS
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0176-mtk-mt76-Add-dynamic-pp-vendor-and-debug-pp-algo-cmd.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0164-mtk-mt76-Add-dynamic-pp-vendor-and-debug-pp-algo-cmd.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0176-mtk-mt76-Add-dynamic-pp-vendor-and-debug-pp-algo-cmd.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0164-mtk-mt76-Add-dynamic-pp-vendor-and-debug-pp-algo-cmd.patch
index 7b2b8de..f0528a9 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0176-mtk-mt76-Add-dynamic-pp-vendor-and-debug-pp-algo-cmd.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0164-mtk-mt76-Add-dynamic-pp-vendor-and-debug-pp-algo-cmd.patch
@@ -1,7 +1,7 @@
-From a2ca9b9f2be2bd336db4c3e6a2f6693d6e2236b4 Mon Sep 17 00:00:00 2001
+From fdf267776932e3bab7c0d87f2c9c8a96ac9a4e0f Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Tue, 28 May 2024 15:39:06 +0800
-Subject: [PATCH 176/199] mtk: mt76: Add dynamic pp vendor and debug pp algo
+Subject: [PATCH 164/223] mtk: mt76: Add dynamic pp vendor and debug pp algo
  cmd support
 
 Add dynamic pp vendor and debug pp algo cmd support.
@@ -13,6 +13,8 @@
 mt76 just ignore the event. Once the sta connect to ap, the sta part would
 send a new fw cmd to update the pp bitmap.
 
+Change-Id: I3574940a3f4165f136df8e07a819a32a5bc02b41
+Change-Id: I1e9955ac0cecafa481fe851502880f6ea1a44469
 Signed-off-by: Allen Ye <allen.ye@mediatek.com>
 ---
  mt7996/mcu.c         |  70 ++++++++++++++++++++++++++++-
@@ -24,10 +26,10 @@
  6 files changed, 205 insertions(+), 30 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index adb71bf5..00bc675e 100644
+index fce92046..77d3b2c8 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1280,6 +1280,39 @@ mt7996_mcu_wed_rro_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -1285,6 +1285,39 @@ mt7996_mcu_wed_rro_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	}
  }
  
@@ -67,7 +69,7 @@
  static void
  mt7996_mcu_pp_event(struct mt7996_dev *dev, struct sk_buff *skb)
  {
-@@ -1306,9 +1339,13 @@ mt7996_mcu_pp_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -1311,9 +1344,13 @@ mt7996_mcu_pp_event(struct mt7996_dev *dev, struct sk_buff *skb)
  		if (phy->punct_bitmap == report_bitmap)
  			return;
  
@@ -83,7 +85,7 @@
  		break;
  	}
  }
-@@ -6405,6 +6442,35 @@ int mt7996_mcu_set_pp_sta_dscb(struct mt7996_phy *phy,
+@@ -6415,6 +6452,35 @@ int mt7996_mcu_set_pp_sta_dscb(struct mt7996_phy *phy,
  				 &req, sizeof(req), false);
  }
  
@@ -183,10 +185,10 @@
  	UNI_CMD_SCS_SEND_DATA,
  	UNI_CMD_SCS_SET_PD_THR_RANGE = 2,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index f31d3f36..74c32827 100644
+index 58151ed0..755b4cf0 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1278,6 +1278,7 @@ int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode);
+@@ -1282,6 +1282,7 @@ int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode);
  int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
  int mt7996_mcu_set_pp_sta_dscb(struct mt7996_phy *phy, struct cfg80211_chan_def *chandef,
  			       u8 omac_idx);
@@ -194,7 +196,7 @@
  int mt7996_mcu_set_eml_omn(struct ieee80211_hw *hw, struct ieee80211_vif *vif, u8 link_id,
  			   struct ieee80211_sta *sta, struct mt7996_eml_omn *eml_omn);
  #ifdef CONFIG_MAC80211_DEBUGFS
-@@ -1307,6 +1308,7 @@ int mt7996_mcu_set_muru_cfg(struct mt7996_dev *dev, void *data);
+@@ -1311,6 +1312,7 @@ int mt7996_mcu_set_muru_cfg(struct mt7996_dev *dev, void *data);
  void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
  int mt7996_mcu_set_csi(struct mt7996_phy *phy, u8 mode,
  		       u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
@@ -203,10 +205,10 @@
  
  int mt7996_mcu_edcca_enable(struct mt7996_phy *phy, bool enable);
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index b698c68a..093f3c69 100644
+index 02a6ee81..2ded5f79 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -4368,6 +4368,18 @@ static const struct file_operations fops_muru_dbg_info = {
+@@ -4367,6 +4367,18 @@ static const struct file_operations fops_muru_dbg_info = {
  	.llseek = default_llseek,
  };
  
@@ -225,7 +227,7 @@
  void mt7996_mtk_init_band_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	/* agg */
-@@ -4390,6 +4402,8 @@ void mt7996_mtk_init_band_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -4389,6 +4401,8 @@ void mt7996_mtk_init_band_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  
  	debugfs_create_file("thermal_enable", 0600, dir, phy, &fops_thermal_enable);
  	debugfs_create_file("scs_enable", 0200, dir, phy, &fops_scs_enable);
@@ -421,5 +423,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_PP_CTRL,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0177-mtk-mt76-mt7996-disable-MAT-and-set-force-link-for-4.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0165-mtk-mt76-mt7996-disable-MAT-and-set-force-link-for-4.patch
similarity index 80%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0177-mtk-mt76-mt7996-disable-MAT-and-set-force-link-for-4.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0165-mtk-mt76-mt7996-disable-MAT-and-set-force-link-for-4.patch
index 64389e3..8d58295 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0177-mtk-mt76-mt7996-disable-MAT-and-set-force-link-for-4.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0165-mtk-mt76-mt7996-disable-MAT-and-set-force-link-for-4.patch
@@ -1,7 +1,7 @@
-From 554f2dd335deaf511b9261603a3e6c62f1183639 Mon Sep 17 00:00:00 2001
+From 05542b2127e52eae086612d666891b8f84f357e9 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Mon, 8 Jul 2024 11:05:31 +0800
-Subject: [PATCH 177/199] mtk: mt76: mt7996: disable MAT and set force-link for
+Subject: [PATCH 165/223] mtk: mt76: mt7996: disable MAT and set force-link for
  4-addr NULL func data frame
 
 This is a temporary solution to solve a WDS connection problem.
@@ -13,16 +13,17 @@
 
 Disabling MAT can prevent the connection problem.
 
+Change-Id: Ie62f8cc5e0ace41a24e61a4dc8127387a1703650
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt7996/mac.c | 6 ++++++
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 97cd5e23..a8985a3b 100644
+index 87e671a3..1f225756 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -759,6 +759,12 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
+@@ -771,6 +771,12 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
  	    (multicast || unlikely(skb->protocol == cpu_to_be16(ETH_P_PAE)) ||
  	     info->flags & IEEE80211_TX_CTL_INJECTED))
  		txwi[5] |= cpu_to_le32(MT_TXD5_FL);
@@ -36,5 +37,5 @@
  
  void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0178-mtk-mt76-mt7996-add-per-STA-TX-MSDU-failed-and-retri.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0166-mtk-mt76-mt7996-add-per-STA-TX-MSDU-failed-and-retri.patch
similarity index 88%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0178-mtk-mt76-mt7996-add-per-STA-TX-MSDU-failed-and-retri.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0166-mtk-mt76-mt7996-add-per-STA-TX-MSDU-failed-and-retri.patch
index eb0dbbc..8433a4e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0178-mtk-mt76-mt7996-add-per-STA-TX-MSDU-failed-and-retri.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0166-mtk-mt76-mt7996-add-per-STA-TX-MSDU-failed-and-retri.patch
@@ -1,11 +1,12 @@
-From c9cc947b2922dde53c71ce871ac869039d740999 Mon Sep 17 00:00:00 2001
+From e785b2395e3f293ce49ddab807fee0f3bda779d6 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Thu, 4 Jul 2024 14:00:16 +0800
-Subject: [PATCH 178/199] mtk: mt76: mt7996: add per-STA TX MSDU failed and
+Subject: [PATCH 166/223] mtk: mt76: mt7996: add per-STA TX MSDU failed and
  retried counts
 
 Record per-STA TX MSDU failed and retried counts for debugging.
 
+Change-Id: I888a86a8d858ff80d16fbb590229cb35ae07ce19
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt76.h            |  2 ++
@@ -17,10 +18,10 @@
  6 files changed, 68 insertions(+), 59 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index feb7bf16..fa4a3e70 100644
+index c3b71cc3..27c990df 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -360,6 +360,8 @@ struct mt76_sta_stats {
+@@ -364,6 +364,8 @@ struct mt76_sta_stats {
  	u64 tx_bytes;
  	/* WED TX */
  	u32 tx_packets;		/* unit: MSDU */
@@ -30,10 +31,10 @@
  	u32 tx_retries;
  	u32 tx_failed;
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index c1becf7e..545de4ae 100644
+index cc644edf..302567e3 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1402,6 +1402,8 @@ enum {
+@@ -1407,6 +1407,8 @@ enum {
  	UNI_OFFLOAD_OFFLOAD_BMC_RPY_DETECT,
  };
  
@@ -42,7 +43,7 @@
  enum UNI_PER_STA_INFO_TAG {
  	UNI_PER_STA_RSSI,
  	UNI_PER_STA_CONTENTION_RX_RATE,
-@@ -1411,6 +1413,7 @@ enum UNI_PER_STA_INFO_TAG {
+@@ -1416,6 +1418,7 @@ enum UNI_PER_STA_INFO_TAG {
  	UNI_PER_STA_TX_CNT,
  	UNI_PER_STA_TID_SN_GET,
  	UNI_PER_STA_TID_SN_SET,
@@ -51,10 +52,10 @@
  };
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index a8985a3b..fae24cad 100644
+index 1f225756..8c68e08e 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2431,6 +2431,43 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+@@ -2443,6 +2443,43 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  	rcu_read_unlock();
  }
  
@@ -98,7 +99,7 @@
  void mt7996_mac_work(struct work_struct *work)
  {
  	struct mt76_phy *mphy = (struct mt76_phy *)container_of(work, struct mt76_phy,
-@@ -2453,7 +2490,7 @@ void mt7996_mac_work(struct work_struct *work)
+@@ -2465,7 +2502,7 @@ void mt7996_mac_work(struct work_struct *work)
  			if (i == mphy->band_idx) {
  				mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_RATE);
  				mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_AIRTIME);
@@ -108,10 +109,10 @@
  					mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_ADM_STAT);
  					mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_MSDU_COUNT);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 00bc675e..857d2826 100644
+index 77d3b2c8..3fcc7fac 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -6017,7 +6017,6 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val)
+@@ -6027,7 +6027,6 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val)
  int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
  				u16 sta_num, u16 *sta_list)
  {
@@ -119,7 +120,7 @@
  	struct mt7996_mcu_per_sta_info_event *res;
  	struct mt7996_link_sta *mlink;
  	struct mt76_wcid *wcid;
-@@ -6097,6 +6096,23 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
+@@ -6107,6 +6106,23 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
  			}
  		}
  		break;
@@ -143,7 +144,7 @@
  	default:
  		ret = -EINVAL;
  		dev_err(dev->dev, "Unknown UNI_PER_STA_INFO_TAG: %d\n", tag);
-@@ -6107,62 +6123,6 @@ out:
+@@ -6117,62 +6133,6 @@ out:
  	return ret;
  }
  
@@ -233,10 +234,10 @@
  } __packed;
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 74c32827..8b00b05b 100644
+index 755b4cf0..a02e976a 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1134,7 +1134,6 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
+@@ -1138,7 +1138,6 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
  void mt7996_mcu_exit(struct mt7996_dev *dev);
  int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
  	                        u16 sta_num, u16 *sta_list);
@@ -245,5 +246,5 @@
  int mt7996_mcu_wed_rro_reset_sessions(struct mt7996_dev *dev, u16 id);
  int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0179-mtk-mt76-mt7996-fill-in-sn-into-txd-for-MLD-multicas.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0167-mtk-mt76-mt7996-fill-in-sn-into-txd-for-MLD-multicas.patch
similarity index 75%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0179-mtk-mt76-mt7996-fill-in-sn-into-txd-for-MLD-multicas.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0167-mtk-mt76-mt7996-fill-in-sn-into-txd-for-MLD-multicas.patch
index 15c49bd..00e7840 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0179-mtk-mt76-mt7996-fill-in-sn-into-txd-for-MLD-multicas.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0167-mtk-mt76-mt7996-fill-in-sn-into-txd-for-MLD-multicas.patch
@@ -1,19 +1,20 @@
-From 112a2fd7458a1ee1a23b236c024bbc858b9d935e Mon Sep 17 00:00:00 2001
+From 261d876ae90ba658963a1aae901a4f513e56684e Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 15 Jul 2024 11:42:47 +0800
-Subject: [PATCH 179/199] mtk: mt76: mt7996: fill in sn into txd for MLD
+Subject: [PATCH 167/223] mtk: mt76: mt7996: fill in sn into txd for MLD
  multicast packet
 
+Change-Id: I09d3dd71aee227f7b8ef06756064b0d4079e7d54
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/mac.c | 9 +++++++--
  1 file changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index fae24cad..c91c550d 100644
+index 8c68e08e..1952cb0c 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -681,6 +681,7 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
+@@ -693,6 +693,7 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
  	bool multicast = is_multicast_ether_addr(hdr->addr1);
  	u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
  	__le16 fc = hdr->frame_control, sc = hdr->seq_ctrl;
@@ -21,7 +22,7 @@
  	u8 fc_type, fc_stype;
  	u32 val;
  
-@@ -739,9 +740,13 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
+@@ -751,9 +752,13 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
  		txwi[3] |= cpu_to_le32(MT_TXD3_REM_TX_COUNT);
  	}
  
@@ -38,5 +39,5 @@
  			struct ieee80211_bar *bar;
  
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0180-mtk-mt76-mt7996-fix-potential-null-pointer.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0168-mtk-mt76-mt7996-fix-potential-null-pointer.patch
similarity index 82%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0180-mtk-mt76-mt7996-fix-potential-null-pointer.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0168-mtk-mt76-mt7996-fix-potential-null-pointer.patch
index d82d6f0..418c92e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0180-mtk-mt76-mt7996-fix-potential-null-pointer.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0168-mtk-mt76-mt7996-fix-potential-null-pointer.patch
@@ -1,10 +1,12 @@
-From 0468bbdacaddcec089088bbb16e0d4b402d52aaa Mon Sep 17 00:00:00 2001
+From 4de8ef89ddae7299fbf92927aaa6bf226e10bef0 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 9 Jul 2024 14:54:39 +0800
-Subject: [PATCH 180/199] mtk: mt76: mt7996: fix potential null pointer
+Subject: [PATCH 168/223] mtk: mt76: mt7996: fix potential null pointer
 
 Fix more parts that might have null pointer access.
 
+Change-Id: Iba945d07cb0b5816cf6cd48f1148edefd9a02d1e
+Change-Id: I7fc4c0b8bc5eda41fa142560995ffc327c188b7f
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -14,10 +16,10 @@
  3 files changed, 16 insertions(+)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index c91c550d..657a19c1 100644
+index 1952cb0c..1a3c661f 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1115,6 +1115,9 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb,
+@@ -1127,6 +1127,9 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb,
  
  	msta = (struct mt7996_sta *)sta->drv_priv;
  	mlink = rcu_dereference(msta->link[msta->pri_link]);
@@ -28,7 +30,7 @@
  		ieee80211_start_tx_ba_session(sta, tid, 0);
  }
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 032ef5f3..ff0b9c0e 100644
+index 562137a5..c95e7e35 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -518,9 +518,12 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
@@ -63,7 +65,7 @@
  		mt7996_remove_link_sta(dev, conf, mconf, link_sta, mlink, last_link);
  	}
  }
-@@ -1415,6 +1423,8 @@ mt7996_sta_pre_rcu_remove(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1419,6 +1427,8 @@ mt7996_sta_pre_rcu_remove(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		struct mt7996_link_sta *mlink =
  			mlink_dereference_protected(msta, link_id);
  
@@ -73,10 +75,10 @@
  	}
  	spin_unlock_bh(&dev->mt76.status_lock);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 857d2826..4310d35b 100644
+index 3fcc7fac..856168f6 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3027,6 +3027,9 @@ mt7996_mcu_sta_mld_setup_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -3032,6 +3032,9 @@ mt7996_mcu_sta_mld_setup_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  		mlink = mlink_dereference_protected(msta, link_id);
  		mconf = mconf_dereference_protected(msta->vif, link_id);
  
@@ -87,5 +89,5 @@
  		mld_setup_link->bss_idx = mconf->mt76.idx;
  		mt76_trace(vif, "link_id(%d) wcid(%d) bss_idx(%d)\n",
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0181-mtk-mt76-mt7996-Fix-legacy-action-frame-wrong-addres.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0169-mtk-mt76-mt7996-Fix-legacy-action-frame-wrong-addres.patch
similarity index 77%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0181-mtk-mt76-mt7996-Fix-legacy-action-frame-wrong-addres.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0169-mtk-mt76-mt7996-Fix-legacy-action-frame-wrong-addres.patch
index e6819c5..01f7688 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0181-mtk-mt76-mt7996-Fix-legacy-action-frame-wrong-addres.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0169-mtk-mt76-mt7996-Fix-legacy-action-frame-wrong-addres.patch
@@ -1,22 +1,23 @@
-From 6d35d91b55b55134d3fca5a9f913121b2b8058eb Mon Sep 17 00:00:00 2001
+From 9134d34ad3ad49037980ec5e37437753dc583a4b Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Wed, 17 Jul 2024 11:36:11 +0800
-Subject: [PATCH 181/199] mtk: mt76: mt7996: Fix legacy action frame wrong
+Subject: [PATCH 169/223] mtk: mt76: mt7996: Fix legacy action frame wrong
  address translation
 
 For non-associated STA send unicast ANQP request, AP should use unicast
 to response, so mt76 sould tell fw not translate frames of this type.
 
+Change-Id: Ie39964538d2b8bcf5a00566b6874e4e4341a4ad4
 Signed-off-by: Allen Ye <allen.ye@mediatek.com>
 ---
  mt7996/mac.c | 8 ++++++--
  1 file changed, 6 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 657a19c1..e571bbfa 100644
+index 1a3c661f..406a1275 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -671,7 +671,8 @@ mt7996_mac_write_txwi_8023(struct mt7996_dev *dev, __le32 *txwi,
+@@ -683,7 +683,8 @@ mt7996_mac_write_txwi_8023(struct mt7996_dev *dev, __le32 *txwi,
  
  static void
  mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
@@ -26,7 +27,7 @@
  {
  	struct mt76_phy *mphy =
  		mt76_dev_phy(&dev->mt76, le32_get_bits(txwi[1], MT_TXD1_TGID));
-@@ -770,6 +771,9 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
+@@ -782,6 +783,9 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
  		txwi[5] |= cpu_to_le32(MT_TXD5_FL);
  		txwi[6] |= cpu_to_le32(MT_TXD6_DIS_MAT);
  	}
@@ -36,7 +37,7 @@
  }
  
  void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
-@@ -863,7 +867,7 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+@@ -875,7 +879,7 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
  	if (is_8023)
  		mt7996_mac_write_txwi_8023(dev, txwi, skb, wcid);
  	else
@@ -46,5 +47,5 @@
  	if (txwi[1] & cpu_to_le32(MT_TXD1_FIXED_RATE)) {
  		struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0182-mtk-mt76-mt7996-add-AP-affiliated-link-removal-suppo.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0170-mtk-mt76-mt7996-add-AP-affiliated-link-removal-suppo.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0182-mtk-mt76-mt7996-add-AP-affiliated-link-removal-suppo.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0170-mtk-mt76-mt7996-add-AP-affiliated-link-removal-suppo.patch
index b35da7b..1819f12 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0182-mtk-mt76-mt7996-add-AP-affiliated-link-removal-suppo.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0170-mtk-mt76-mt7996-add-AP-affiliated-link-removal-suppo.patch
@@ -1,11 +1,12 @@
-From e61df790cc5ef66271a12e14af49f48ad097f7a6 Mon Sep 17 00:00:00 2001
+From a025d78199c2a329723707c689075c34d7c780e5 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 31 May 2024 18:14:59 +0800
-Subject: [PATCH 182/199] mtk: mt76: mt7996: add AP affiliated link removal
+Subject: [PATCH 170/223] mtk: mt76: mt7996: add AP affiliated link removal
  support
 
 Add support for ap link removal of MLD reconfiguration.
 
+Change-Id: I27a611dcf6698f89f6a3a67f893a166d2afe6b1f
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mt76_connac_mcu.h |   3 +
@@ -16,10 +17,10 @@
  5 files changed, 367 insertions(+), 12 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 545de4ae..fd1bf1d1 100644
+index 302567e3..4976d944 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1074,6 +1074,7 @@ enum {
+@@ -1079,6 +1079,7 @@ enum {
  	MCU_UNI_EVENT_PP = 0x5a,
  	MCU_UNI_EVENT_PER_STA_INFO = 0x6d,
  	MCU_UNI_EVENT_ALL_STA_INFO = 0x6e,
@@ -27,7 +28,7 @@
  };
  
  #define MCU_UNI_CMD_EVENT			BIT(1)
-@@ -1319,6 +1320,7 @@ enum {
+@@ -1324,6 +1325,7 @@ enum {
  	MCU_UNI_CMD_ALL_STA_INFO = 0x6e,
  	MCU_UNI_CMD_ASSERT_DUMP = 0x6f,
  	MCU_UNI_CMD_PTA_3WIRE_CTRL = 0x78,
@@ -35,7 +36,7 @@
  };
  
  enum {
-@@ -1393,6 +1395,7 @@ enum {
+@@ -1398,6 +1400,7 @@ enum {
  	UNI_BSS_INFO_PM_DISABLE = 27,
  	UNI_BSS_INFO_BCN_CRIT_UPDATE = 32,
  	UNI_BSS_INFO_BCN_STA_PROF_CSA = 37,
@@ -44,7 +45,7 @@
  
  enum {
 diff --git a/mt7996/main.c b/mt7996/main.c
-index ff0b9c0e..fc6f4ef9 100644
+index c95e7e35..6ad4558b 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -319,6 +319,21 @@ static void mt7996_remove_bss_conf(struct ieee80211_vif *vif,
@@ -145,7 +146,7 @@
  	mt76_wcid_cleanup(&dev->mt76, &mlink->wcid);
  	mt76_wcid_mask_clear(dev->mt76.wcid_mask, mlink->wcid.idx);
  	mt76_wcid_mask_clear(dev->mt76.wcid_phy_mask, mlink->wcid.idx);
-@@ -3104,9 +3146,15 @@ mt7996_change_sta_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -3108,9 +3150,15 @@ mt7996_change_sta_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	mt76_vif_dbg(vif, "STA %pM old=0x%x, new=0x%x\n", sta->addr, old_links, new_links);
  	mutex_lock(&dev->mt76.mutex);
  
@@ -163,10 +164,10 @@
  	if (ret)
  		goto remove;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 4310d35b..662e4f02 100644
+index 856168f6..417c38a3 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1350,6 +1350,48 @@ mt7996_mcu_pp_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -1355,6 +1355,48 @@ mt7996_mcu_pp_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	}
  }
  
@@ -215,7 +216,7 @@
  static void
  mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
  {
-@@ -1378,6 +1420,9 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -1383,6 +1425,9 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	case MCU_UNI_EVENT_PP:
  		mt7996_mcu_pp_event(dev, skb);
  		break;
@@ -225,7 +226,7 @@
  #ifdef CONFIG_MTK_DEBUG
  	case MCU_UNI_EVENT_SR:
  		mt7996_mcu_rx_sr_event(dev, skb);
-@@ -3169,6 +3214,44 @@ out:
+@@ -3176,6 +3221,44 @@ out:
  				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
  }
  
@@ -270,7 +271,7 @@
  int mt7996_mcu_teardown_mld_sta(struct mt7996_dev *dev,
  				struct mt7996_bss_conf *mconf,
  				struct mt7996_link_sta *mlink)
-@@ -3381,6 +3464,51 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
+@@ -3388,6 +3471,51 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
  				 &data, sizeof(data), true);
  }
  
@@ -322,7 +323,7 @@
  static void
  mt7996_mcu_beacon_cntdwn(struct ieee80211_bss_conf *conf, struct sk_buff *rskb,
  			 struct sk_buff *skb,
-@@ -3575,6 +3703,94 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+@@ -3582,6 +3710,94 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  		mt7996_packet_log_to_host(dev, skb->data, skb->len, PKT_BIN_DEBUG_TX, 0);
  }
  
@@ -417,7 +418,7 @@
  int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  			  struct ieee80211_bss_conf *conf,
  			  struct mt7996_bss_conf *mconf, int en)
-@@ -3628,6 +3844,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+@@ -3635,6 +3851,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  	mt7996_mcu_beacon_cntdwn(conf, rskb, skb, &offs);
  	mt7996_mcu_beacon_sta_prof_csa(rskb, conf, &offs);
  	mt7996_mcu_beacon_crit_update(rskb, skb, conf, mconf, &offs);
@@ -547,10 +548,10 @@
  	u8 _rsv[4];
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 8b00b05b..6f9f82b7 100644
+index a02e976a..a7655a61 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1083,6 +1083,8 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+@@ -1087,6 +1087,8 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  			     struct mt7996_bss_conf *mconf,
  			     struct ieee80211_link_sta *link_sta,
  			     struct mt7996_link_sta *mlink, bool changed);
@@ -560,5 +561,5 @@
  int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag, bool sta);
  int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct mt7996_bss_conf *mconf);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0183-mtk-mt76-mt7996-add-support-for-AP-A-TTLM.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0171-mtk-mt76-mt7996-add-support-for-AP-A-TTLM.patch
similarity index 92%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0183-mtk-mt76-mt7996-add-support-for-AP-A-TTLM.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0171-mtk-mt76-mt7996-add-support-for-AP-A-TTLM.patch
index 62f46d7..4365a84 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0183-mtk-mt76-mt7996-add-support-for-AP-A-TTLM.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0171-mtk-mt76-mt7996-add-support-for-AP-A-TTLM.patch
@@ -1,7 +1,7 @@
-From 35f9165b9c803d17bdf96668001f64461b9fa3e2 Mon Sep 17 00:00:00 2001
+From 54aea6e753436bff0a258c753d2b8da3daea72f8 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Fri, 28 Jun 2024 13:45:15 +0800
-Subject: [PATCH 183/199] mtk: mt76: mt7996: add support for AP A-TTLM
+Subject: [PATCH 171/223] mtk: mt76: mt7996: add support for AP A-TTLM
 
 This add support for AP A-TTLM support by following actions
 1. request at2lm resource to FW and get switch time TSF value
@@ -9,6 +9,7 @@
    switch time erxpired and AT2LM end
 3. provide TTLM offset to FW if TTLM needs count down.
 
+Change-Id: Iea8e8e767d09a8bb2aa8ee1d0252e35be239417d
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt76_connac_mcu.h |   1 +
@@ -19,10 +20,10 @@
  5 files changed, 214 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index fd1bf1d1..01dbe0e5 100644
+index 4976d944..18758ff2 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1396,6 +1396,7 @@ enum {
+@@ -1401,6 +1401,7 @@ enum {
  	UNI_BSS_INFO_BCN_CRIT_UPDATE = 32,
  	UNI_BSS_INFO_BCN_STA_PROF_CSA = 37,
  	UNI_BSS_INFO_BCN_ML_RECONF = 38,
@@ -31,10 +32,10 @@
  
  enum {
 diff --git a/mt7996/main.c b/mt7996/main.c
-index fc6f4ef9..0e5e9a51 100644
+index 6ad4558b..c6cb5104 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -3167,6 +3167,19 @@ out:
+@@ -3171,6 +3171,19 @@ out:
  	return ret;
  }
  
@@ -54,17 +55,17 @@
  static void
  mt7996_event_callback(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		      const struct ieee80211_event *event)
-@@ -3327,4 +3340,5 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -3331,4 +3344,5 @@ const struct ieee80211_ops mt7996_ops = {
  	.change_vif_links = mt7996_change_vif_links,
  	.change_sta_links = mt7996_change_sta_links,
  	.set_qos_map = mt7996_set_qos_map,
 +	.set_attlm = mt7996_set_attlm,
  };
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 662e4f02..ce2168e8 100644
+index 417c38a3..0e8e2c06 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1362,6 +1362,22 @@ mt7996_mcu_mld_reconf_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
+@@ -1367,6 +1367,22 @@ mt7996_mcu_mld_reconf_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  	ieee80211_links_removed(vif, le16_to_cpu(reconf->link_bitmap));
  }
  
@@ -87,7 +88,7 @@
  static void
  mt7996_mcu_mld_event(struct mt7996_dev *dev, struct sk_buff *skb)
  {
-@@ -1376,9 +1392,15 @@ mt7996_mcu_mld_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -1381,9 +1397,15 @@ mt7996_mcu_mld_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	len = skb->len;
  
  	while (len > 0 && le16_to_cpu(tlv->len) <= len) {
@@ -104,7 +105,7 @@
  			ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
  					IEEE80211_IFACE_ITER_RESUME_ALL,
  					mt7996_mcu_mld_reconf_finish, &data);
-@@ -3509,6 +3531,91 @@ mt7996_mcu_mld_reconf(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -3516,6 +3538,91 @@ mt7996_mcu_mld_reconf(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_WM_UNI_CMD(MLD), true);
  }
  
@@ -196,7 +197,7 @@
  static void
  mt7996_mcu_beacon_cntdwn(struct ieee80211_bss_conf *conf, struct sk_buff *rskb,
  			 struct sk_buff *skb,
-@@ -3791,6 +3898,48 @@ mt7996_mcu_beacon_ml_reconf(struct mt7996_dev *dev,
+@@ -3798,6 +3905,48 @@ mt7996_mcu_beacon_ml_reconf(struct mt7996_dev *dev,
  	}
  }
  
@@ -245,7 +246,7 @@
  int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  			  struct ieee80211_bss_conf *conf,
  			  struct mt7996_bss_conf *mconf, int en)
-@@ -3845,6 +3994,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+@@ -3852,6 +4001,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  	mt7996_mcu_beacon_sta_prof_csa(rskb, conf, &offs);
  	mt7996_mcu_beacon_crit_update(rskb, skb, conf, mconf, &offs);
  	mt7996_mcu_beacon_ml_reconf(dev, conf, rskb, skb, &offs);
@@ -339,10 +340,10 @@
  };
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 6f9f82b7..2ee46583 100644
+index a7655a61..15c4e557 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1154,6 +1154,8 @@ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
+@@ -1158,6 +1158,8 @@ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
  				enum vow_drr_ctrl_id id);
  int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy);
  void mt7996_mcu_wmm_pbc_work(struct work_struct *work);
@@ -352,5 +353,5 @@
  static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
  {
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0184-mtk-mt76-mt7996-leave-ps-when-4-address-is-establish.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0172-mtk-mt76-mt7996-leave-ps-when-4-address-is-establish.patch
similarity index 84%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0184-mtk-mt76-mt7996-leave-ps-when-4-address-is-establish.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0172-mtk-mt76-mt7996-leave-ps-when-4-address-is-establish.patch
index de63b5e..f7fb35f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0184-mtk-mt76-mt7996-leave-ps-when-4-address-is-establish.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0172-mtk-mt76-mt7996-leave-ps-when-4-address-is-establish.patch
@@ -1,7 +1,7 @@
-From 68822b5e5ef48ad096a57a2366b231b7ee9af9c6 Mon Sep 17 00:00:00 2001
+From 4b29092cc31d34967152a3062966d987fc5352eb Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 18 Jul 2024 10:29:22 +0800
-Subject: [PATCH 184/199] mtk: mt76: mt7996: leave ps when 4 address is
+Subject: [PATCH 172/223] mtk: mt76: mt7996: leave ps when 4 address is
  established
 
 Because the 4 address non-amsdu packet does not have bssid field, the
@@ -9,6 +9,7 @@
 leave PS mode due to HW design. Wake up non-setup link when receiving
 4 address null data to prevent this issue.
 
+Change-Id: I94308432b73e647363fd0e2db281c54becdf1ec8
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt76_connac_mcu.h |  1 +
@@ -19,10 +20,10 @@
  5 files changed, 30 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 01dbe0e5..eb738f4f 100644
+index 18758ff2..69c8389f 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -838,6 +838,7 @@ enum {
+@@ -843,6 +843,7 @@ enum {
  	STA_REC_EML_OP = 0x29,
  	STA_REC_HDR_TRANS = 0x2B,
  	STA_REC_TX_CAP = 0x2f,
@@ -31,10 +32,10 @@
  };
  
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 0e5e9a51..8398151d 100644
+index c6cb5104..21d65f78 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -2077,6 +2077,9 @@ static void mt7996_sta_set_4addr(struct ieee80211_hw *hw,
+@@ -2081,6 +2081,9 @@ static void mt7996_sta_set_4addr(struct ieee80211_hw *hw,
  			clear_bit(MT_WCID_FLAG_4ADDR, &mlink->wcid.flags);
  
  		mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, mlink);
@@ -45,10 +46,10 @@
  	mutex_unlock(&dev->mt76.mutex);
  }
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index ce2168e8..0af0ca82 100644
+index 0e8e2c06..b47aa7d6 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -6247,6 +6247,24 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
+@@ -6257,6 +6257,24 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
  				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
  }
  
@@ -91,10 +92,10 @@
  	__le16 tag;
  	__le16 len;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 2ee46583..c1823759 100644
+index 15c4e557..21019bc2 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1277,6 +1277,8 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
+@@ -1281,6 +1281,8 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
  				     struct ieee80211_vif *vif,
  				     struct mt7996_bss_conf *mconf,
  				     struct mt7996_link_sta *mlink);
@@ -104,5 +105,5 @@
  int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
  int mt7996_mcu_set_pp_sta_dscb(struct mt7996_phy *phy, struct cfg80211_chan_def *chandef,
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0185-mtk-mt76-mt7996-add-debugfs-knob-to-set-and-dump-txo.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0173-mtk-mt76-mt7996-add-debugfs-knob-to-set-and-dump-txo.patch
similarity index 95%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0185-mtk-mt76-mt7996-add-debugfs-knob-to-set-and-dump-txo.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0173-mtk-mt76-mt7996-add-debugfs-knob-to-set-and-dump-txo.patch
index 222353c..687d1ff 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0185-mtk-mt76-mt7996-add-debugfs-knob-to-set-and-dump-txo.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0173-mtk-mt76-mt7996-add-debugfs-knob-to-set-and-dump-txo.patch
@@ -1,9 +1,10 @@
-From 32991b1ffa0cefe38be1adc97c2effb4a27bcc28 Mon Sep 17 00:00:00 2001
+From c8d33542d7f89e4404f932beb1883093f4c723a1 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 17 Jul 2024 16:57:24 +0800
-Subject: [PATCH 185/199] mtk: mt76: mt7996: add debugfs knob to set and dump
+Subject: [PATCH 173/223] mtk: mt76: mt7996: add debugfs knob to set and dump
  txop
 
+Change-Id: Iaf4fa82556c9ee4433de29f1ebe125e91c743284
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/mtk_debug_i.h   |   8 ++++
@@ -152,5 +153,5 @@
  	/* MLO related Table */
  	debugfs_create_file("mat_table", 0400, dir, dev, &mt7996_mat_table_fops);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0186-mtk-mt76-mt7996-add-mcu-command-to-set-bssid-mapping.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0174-mtk-mt76-mt7996-add-mcu-command-to-set-bssid-mapping.patch
similarity index 87%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0186-mtk-mt76-mt7996-add-mcu-command-to-set-bssid-mapping.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0174-mtk-mt76-mt7996-add-mcu-command-to-set-bssid-mapping.patch
index 1530414..9d09a4f 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0186-mtk-mt76-mt7996-add-mcu-command-to-set-bssid-mapping.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0174-mtk-mt76-mt7996-add-mcu-command-to-set-bssid-mapping.patch
@@ -1,13 +1,14 @@
-From 073ba6d0288ea53059ec280b7789a2cbf25ba03f Mon Sep 17 00:00:00 2001
+From 848a43638c737f72cf30a53b855f0f09ee7be729 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 22 Jul 2024 10:47:45 +0800
-Subject: [PATCH 186/199] mtk: mt76: mt7996: add mcu command to set bssid
+Subject: [PATCH 174/223] mtk: mt76: mt7996: add mcu command to set bssid
  mapping address
 
 When receiving 4 address non-amsdu packet, there is no bssid in the address
 field. Set mcu command to use A1 as bssid when receiving 4 address non-amsdu
 packet.
 
+Change-Id: I599c9ea5a1a7cecc206b099ea13c583d71fd274b
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/init.c   |  7 +++++++
@@ -17,7 +18,7 @@
  4 files changed, 35 insertions(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index f923ce66..25f772af 100644
+index 18847ff5..d7a1d7cd 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -539,6 +539,9 @@ mt7996_mac_init_band(struct mt7996_dev *dev, u8 band)
@@ -42,10 +43,10 @@
  
  static void mt7996_mac_init_basic_rates(struct mt7996_dev *dev)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 0af0ca82..ead9ff4f 100644
+index b47aa7d6..dc1af0be 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -6117,6 +6117,32 @@ int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
+@@ -6127,6 +6127,32 @@ int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -91,10 +92,10 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index c1823759..e1e1160a 100644
+index 21019bc2..b9b52d17 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1108,6 +1108,7 @@ int mt7996_mcu_set_radar_th(struct mt7996_dev *dev, int index,
+@@ -1112,6 +1112,7 @@ int mt7996_mcu_set_radar_th(struct mt7996_dev *dev, int index,
  			    const struct mt7996_dfs_pattern *pattern);
  int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable);
  int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val);
@@ -103,5 +104,5 @@
  int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch);
  int mt7996_mcu_get_temperature(struct mt7996_phy *phy);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0187-mtk-mt76-mt7996-Temporary-fix-init-txpwoer-for-singl.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0175-mtk-mt76-mt7996-Temporary-fix-init-txpwoer-for-singl.patch
similarity index 87%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0187-mtk-mt76-mt7996-Temporary-fix-init-txpwoer-for-singl.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0175-mtk-mt76-mt7996-Temporary-fix-init-txpwoer-for-singl.patch
index 2941c99..ebf90c9 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0187-mtk-mt76-mt7996-Temporary-fix-init-txpwoer-for-singl.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0175-mtk-mt76-mt7996-Temporary-fix-init-txpwoer-for-singl.patch
@@ -1,18 +1,19 @@
-From 3cc44ab9e52f4c5543dcf0e0dc7cd6364aa36b3d Mon Sep 17 00:00:00 2001
+From ece67fdae758e7e94b3a00148e9d205c8cff3228 Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Mon, 22 Jul 2024 19:33:07 +0800
-Subject: [PATCH 187/199] mtk: mt76: mt7996: Temporary fix init txpwoer for
+Subject: [PATCH 175/223] mtk: mt76: mt7996: Temporary fix init txpwoer for
  single wiphy
 
 This patch can be removed after the real single wiphy finished.
 
+Change-Id: I6eaaa33c0cd1b212bb0ddffb6b42f44c8b3a71f9
 Signed-off-by: Allen Ye <allen.ye@mediatek.com>
 ---
  mt7996/init.c | 21 +++++++++++++++------
  1 file changed, 15 insertions(+), 6 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 25f772af..e0cbcaaa 100644
+index d7a1d7cd..64c28ba4 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -373,15 +373,24 @@ static void __mt7996_init_txpower(struct mt7996_phy *phy,
@@ -47,5 +48,5 @@
  
  static void
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0188-mtk-mt76-mt7996-Add-lpi-support-with-sku_idx-and-enh.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0176-mtk-mt76-mt7996-Add-lpi-support-with-sku_idx-and-enh.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0188-mtk-mt76-mt7996-Add-lpi-support-with-sku_idx-and-enh.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0176-mtk-mt76-mt7996-Add-lpi-support-with-sku_idx-and-enh.patch
index 64f6af0..50c352a 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0188-mtk-mt76-mt7996-Add-lpi-support-with-sku_idx-and-enh.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0176-mtk-mt76-mt7996-Add-lpi-support-with-sku_idx-and-enh.patch
@@ -1,7 +1,7 @@
-From 5a12177572a884d35a44d9988aa8777ef4bc52d2 Mon Sep 17 00:00:00 2001
+From b6751afce073f71139c40e17b05b25950b037a28 Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Fri, 12 Jul 2024 16:58:57 +0800
-Subject: [PATCH 188/199] mtk: mt76: mt7996: Add lpi support with sku_idx and
+Subject: [PATCH 176/223] mtk: mt76: mt7996: Add lpi support with sku_idx and
  enhancement
 
 Add lpi support with sku_idx and enhancement.
@@ -10,6 +10,7 @@
 3. Add lpi mode mamangement from enhancement that use 1T to transmit mgmt
 from in 80 MHz.
 
+Change-Id: I2ca15f6a6dd11976c65347fca88abcb3ac66097d
 Signed-off-by: Allen Ye <allen.ye@mediatek.com>
 ---
  eeprom.c             |  13 +++--
@@ -29,10 +30,10 @@
  14 files changed, 286 insertions(+), 30 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 3da94926..888e2d92 100644
+index 4eb27782..469af710 100644
 --- a/eeprom.c
 +++ b/eeprom.c
-@@ -218,8 +218,9 @@ static bool mt76_string_prop_find(struct property *prop, const char *str)
+@@ -233,8 +233,9 @@ static bool mt76_string_prop_find(struct property *prop, const char *str)
  }
  
  struct device_node *
@@ -43,7 +44,7 @@
  	struct device_node *np = dev->dev->of_node;
  	const char *const region_names[] = {
  		[NL80211_DFS_UNSET] = "ww",
-@@ -229,6 +230,7 @@ mt76_find_power_limits_node(struct mt76_dev *dev)
+@@ -244,6 +245,7 @@ mt76_find_power_limits_node(struct mt76_dev *dev)
  	};
  	struct device_node *cur, *fallback = NULL;
  	const char *region_name = NULL;
@@ -51,7 +52,7 @@
  
  	if (dev->region < ARRAY_SIZE(region_names))
  		region_name = region_names[dev->region];
-@@ -237,15 +239,20 @@ mt76_find_power_limits_node(struct mt76_dev *dev)
+@@ -252,15 +254,20 @@ mt76_find_power_limits_node(struct mt76_dev *dev)
  	if (!np)
  		return NULL;
  
@@ -72,7 +73,7 @@
  		if (mt76_string_prop_find(country, dev->alpha2) ||
  		    mt76_string_prop_find(regd, region_name)) {
  			of_node_put(np);
-@@ -322,7 +329,7 @@ mt76_apply_array_limit(s8 *pwr, size_t pwr_len, const __be32 *data,
+@@ -337,7 +344,7 @@ mt76_apply_array_limit(s8 *pwr, size_t pwr_len, const __be32 *data,
  
  	for (i = 0; i < pwr_len; i++) {
  		pwr[i] = min_t(s8, target_power,
@@ -81,7 +82,7 @@
  		*max_power = max(*max_power, pwr[i]);
  	}
  }
-@@ -387,7 +394,7 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+@@ -402,7 +409,7 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  	if (!IS_ENABLED(CONFIG_OF))
  		return target_power;
  
@@ -91,10 +92,10 @@
  		return target_power;
  
 diff --git a/mt76.h b/mt76.h
-index fa4a3e70..1858f542 100644
+index 27c990df..14f409ba 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -933,6 +933,7 @@ struct mt76_phy {
+@@ -948,6 +948,7 @@ struct mt76_phy {
  	u8 macaddr[ETH_ALEN];
  
  	int txpower_cur;
@@ -102,7 +103,7 @@
  	u8 antenna_mask;
  	u16 chainmask;
  
-@@ -1047,6 +1048,10 @@ struct mt76_dev {
+@@ -1062,6 +1063,10 @@ struct mt76_dev {
  
  	u32 rxfilter;
  
@@ -113,7 +114,7 @@
  #ifdef CONFIG_NL80211_TESTMODE
  	const struct mt76_testmode_ops *test_ops;
  	struct {
-@@ -1810,7 +1815,7 @@ mt76_mcu_skb_send_msg(struct mt76_dev *dev, struct sk_buff *skb, int cmd,
+@@ -1826,7 +1831,7 @@ mt76_mcu_skb_send_msg(struct mt76_dev *dev, struct sk_buff *skb, int cmd,
  void mt76_set_irq_mask(struct mt76_dev *dev, u32 addr, u32 clear, u32 set);
  
  struct device_node *
@@ -146,7 +147,7 @@
  #define MT_CT_INFO_COPY_HOST_TXD_ALL	BIT(1)
  #define MT_CT_INFO_MGMT_FRAME		BIT(2)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index e0cbcaaa..f1b9b0e0 100644
+index 64c28ba4..b63316b4 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -347,7 +347,7 @@ static void __mt7996_init_txpower(struct mt7996_phy *phy,
@@ -159,10 +160,10 @@
  		struct ieee80211_channel *chan = &sband->channels[i];
  		int target_power = mt7996_eeprom_get_target_power(dev, chan);
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index e571bbfa..32f5b859 100644
+index 406a1275..295bff24 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -885,8 +885,13 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+@@ -897,8 +897,13 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
  		}
  
  		val = FIELD_PREP(MT_TXD6_TX_RATE, idx) | MT_TXD6_FIXED_BW;
@@ -177,7 +178,7 @@
  		txwi[3] |= cpu_to_le32(MT_TXD3_BA_DISABLE);
  	}
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 8398151d..4b48a870 100644
+index 21d65f78..2b92b686 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -878,6 +878,7 @@ static u8
@@ -207,10 +208,10 @@
  out:
  	mutex_unlock(&dev->mt76.mutex);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index ead9ff4f..0439157c 100644
+index dc1af0be..c6b6f405 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -6310,7 +6310,7 @@ int mt7996_mcu_set_fixed_rate_table(struct mt7996_phy *phy, u8 table_idx,
+@@ -6320,7 +6320,7 @@ int mt7996_mcu_set_fixed_rate_table(struct mt7996_phy *phy, u8 table_idx,
  
  	if (beacon) {
  		req.spe_idx_sel = SPE_IXD_SELECT_TXD;
@@ -219,7 +220,7 @@
  		phy->beacon_rate = rate_idx;
  	} else {
  		req.spe_idx_sel = SPE_IXD_SELECT_BMC_WTBL;
-@@ -6593,14 +6593,29 @@ mt7996_update_max_txpower_cur(struct mt7996_phy *phy, int tx_power)
+@@ -6603,14 +6603,29 @@ mt7996_update_max_txpower_cur(struct mt7996_phy *phy, int tx_power)
  		mphy->txpower_cur = e2p_power_limit;
  }
  
@@ -251,7 +252,7 @@
  	struct tx_power_limit_table_ctrl {
  		u8 __rsv1[4];
  
-@@ -6621,9 +6636,9 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
+@@ -6631,9 +6646,9 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
  	struct sk_buff *skb;
  	int i, ret, txpower_limit;
  
@@ -264,7 +265,7 @@
  
  	if (phy->sku_limit_en) {
  		txpower_limit = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
-@@ -6642,7 +6657,36 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
+@@ -6652,7 +6667,36 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
  	skb_put_data(skb, &req, sizeof(req));
  	/* cck and ofdm */
  	skb_put_data(skb, &la.cck, sizeof(la.cck));
@@ -302,7 +303,7 @@
  	/* ht20 */
  	skb_put_data(skb, &la.mcs[0], 8);
  	/* ht40 */
-@@ -6679,8 +6723,41 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
+@@ -6689,8 +6733,41 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
  
  	skb_put_data(skb, &req, sizeof(req));
  	skb_put_data(skb, &la_path.cck, sizeof(la_path.cck));
@@ -346,7 +347,7 @@
  
  	for (i = 0; i < 32; i++) {
  		bool bf = i % 2;
-@@ -6694,6 +6771,31 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
+@@ -6704,6 +6781,31 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
  				     MCU_WM_UNI_CMD(TXPOWER), true);
  }
  
@@ -391,10 +392,10 @@
  };
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index e1e1160a..67ac7a91 100644
+index b9b52d17..8b7486a1 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1115,7 +1115,7 @@ int mt7996_mcu_get_temperature(struct mt7996_phy *phy);
+@@ -1119,7 +1119,7 @@ int mt7996_mcu_get_temperature(struct mt7996_phy *phy);
  int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state);
  int mt7996_mcu_set_thermal_protect(struct mt7996_phy *phy, bool enable);
  int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
@@ -403,7 +404,7 @@
  int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
  		       u8 rx_sel, u8 val);
  int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev,
-@@ -1315,6 +1315,7 @@ void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
+@@ -1319,6 +1319,7 @@ void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
  int mt7996_mcu_set_csi(struct mt7996_phy *phy, u8 mode,
  		       u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
  int mt7996_vendor_pp_bitmap_update(struct mt7996_phy *phy, u16 bitmap);
@@ -412,10 +413,10 @@
  
  int mt7996_mcu_edcca_enable(struct mt7996_phy *phy, bool enable);
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 093f3c69..fa8de2db 100644
+index 2ded5f79..78450935 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -2509,7 +2509,7 @@ mt7996_get_txpower_info(struct file *file, char __user *user_buf,
+@@ -2508,7 +2508,7 @@ mt7996_get_txpower_info(struct file *file, char __user *user_buf,
  	len += scnprintf(buf + len, size - len,
  			 "    Theraml Compensation Value: %d\n",
  			 basic_info->thermal_compensate_value);
@@ -424,7 +425,7 @@
  	len += scnprintf(buf + len, size - len,
  			 "    RegDB:  %s\n",
  			 !np ? "enable" : "disable");
-@@ -4505,6 +4505,7 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
+@@ -4504,6 +4504,7 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
  	debugfs_create_file("rx_drop_stats", 0400, dir, dev, &mt7996_rx_drop_fops);
  
  	debugfs_create_file("muru_dbg", 0200, dir, dev, &fops_muru_dbg_info);
@@ -433,10 +434,10 @@
  
  #endif
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index b956915e..cf9ec9ac 100644
+index 240227a9..1674e129 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -1853,7 +1853,7 @@ mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
+@@ -1857,7 +1857,7 @@ mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
  		mt7996_tm_update_channel(phy);
  		mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(SKU_POWER_LIMIT), td->sku_en);
  		mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(BACKOFF_POWER_LIMIT), td->sku_en);
@@ -643,5 +644,5 @@
  
  #endif
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0189-mtk-mt76-mt7996-Add-Triggered-Uplink-Access-Optimiza.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0177-mtk-mt76-mt7996-Add-Triggered-Uplink-Access-Optimiza.patch
similarity index 96%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0189-mtk-mt76-mt7996-Add-Triggered-Uplink-Access-Optimiza.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0177-mtk-mt76-mt7996-Add-Triggered-Uplink-Access-Optimiza.patch
index 16d8cae..53d656d 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0189-mtk-mt76-mt7996-Add-Triggered-Uplink-Access-Optimiza.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0177-mtk-mt76-mt7996-Add-Triggered-Uplink-Access-Optimiza.patch
@@ -1,11 +1,12 @@
-From c21cbc5f70b521cf05abb63c63d9a753076adb24 Mon Sep 17 00:00:00 2001
+From 80c870cb7dc5faa9b045a1a44322fc07f5f8aed3 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 2 Jul 2024 10:06:26 +0800
-Subject: [PATCH 189/199] mtk: mt76: mt7996: Add Triggered Uplink Access
+Subject: [PATCH 177/223] mtk: mt76: mt7996: Add Triggered Uplink Access
  Optimization support
 
 Add TUAO feature, which is a subset of SCS procedure support.
 
+Change-Id: I7932b147d399e39e4b91f5dd97edea6f307122d3
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
  mt7996/init.c    | 25 ++++++++++-----
@@ -17,7 +18,7 @@
  6 files changed, 173 insertions(+), 7 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index f1b9b0e0..2f43c0ff 100644
+index b63316b4..ae86c0eb 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -62,7 +62,14 @@ static const struct ieee80211_iface_combination if_comb_7992[] = {
@@ -59,7 +60,7 @@
  		.eml_capabilities = IEEE80211_EML_CAP_EMLSR_SUPP,
  		.mld_capa_and_ops = 2,
  		/* the max number of simultaneous links is defined as the
-@@ -1573,6 +1580,10 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
+@@ -1593,6 +1600,10 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
  		u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_11454,
  			       IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK);
  
@@ -71,10 +72,10 @@
  		IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
  		IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 67ac7a91..fa884316 100644
+index 8b7486a1..8f8cd7ae 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -524,6 +524,9 @@ struct csi_data {
+@@ -525,6 +525,9 @@ struct csi_data {
  };
  
  int mt7996_set_coding_type(struct ieee80211_hw *hw, u8 coding_type, u8 link_id);
@@ -305,5 +306,5 @@
  	MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
  
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0190-mtk-mt76-mt7996-add-per-band-token-limit.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0178-mtk-mt76-mt7996-add-per-band-token-limit.patch
similarity index 82%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0190-mtk-mt76-mt7996-add-per-band-token-limit.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0178-mtk-mt76-mt7996-add-per-band-token-limit.patch
index 78737b8..883ab46 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0190-mtk-mt76-mt7996-add-per-band-token-limit.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0178-mtk-mt76-mt7996-add-per-band-token-limit.patch
@@ -1,13 +1,15 @@
-From 08bab29bc70a7b21150167f2ae502d8e5538c743 Mon Sep 17 00:00:00 2001
+From 0d130b8ba58d84007b12bd6984b94b756c5d6d3b Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 30 Jul 2024 19:49:39 +0800
-Subject: [PATCH 190/199] mtk: mt76: mt7996: add per-band token limit
+Subject: [PATCH 178/223] mtk: mt76: mt7996: add per-band token limit
 
 Add a threshold for per-band token count.
 The bands use the same token pool so a band cannot transmit if
 the other band occupy too many tokens. With this patch, we can
 prevent a band from interfering with the other band.
 
+Change-Id: I53ba83b2144c7576274b0f4b736f201a6ab79b0c
+Change-Id: Ic3974b881fb099f0749ebf97c690141c234b6d1e
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt76.h               |  6 +++++-
@@ -19,10 +21,10 @@
  6 files changed, 40 insertions(+), 7 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 1858f542..e5e5529d 100644
+index 14f409ba..5d7b8c4c 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -462,6 +462,7 @@ struct mt76_txwi_cache {
+@@ -468,6 +468,7 @@ struct mt76_txwi_cache {
  	dma_addr_t dma_addr;
  
  	unsigned long jiffies;
@@ -30,7 +32,7 @@
  
  	struct sk_buff *skb;
  };
-@@ -960,6 +961,7 @@ struct mt76_phy {
+@@ -975,6 +976,7 @@ struct mt76_phy {
  	} leds;
  	struct mt76_tx_debug tx_dbg_stats;
  	struct mt76_rx_debug rx_dbg_stats;
@@ -38,7 +40,7 @@
  };
  
  struct mt76_dev {
-@@ -1009,6 +1011,7 @@ struct mt76_dev {
+@@ -1024,6 +1026,7 @@ struct mt76_dev {
  	u16 wed_token_count;
  	u16 token_count;
  	u16 token_size;
@@ -46,7 +48,7 @@
  
  	spinlock_t rx_token_lock;
  	struct idr rx_token;
-@@ -1879,7 +1882,8 @@ static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
+@@ -1895,7 +1898,8 @@ static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
  
  struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
@@ -57,10 +59,10 @@
  struct mt76_rxwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 2f43c0ff..bad4b1b7 100644
+index ae86c0eb..6e8791c8 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -1770,6 +1770,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1790,6 +1790,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -70,10 +72,10 @@
  	if (ret)
  		goto error;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 32f5b859..f9344f28 100644
+index 295bff24..ac51e27d 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -959,7 +959,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -971,7 +971,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
  	t->skb = tx_info->skb;
  
@@ -82,7 +84,7 @@
  	if (id < 0) {
  		mdev->tx_dbg_stats.tx_drop[MT_TX_DROP_GET_TOKEN_FAIL]++;
  		return id;
-@@ -1683,8 +1683,11 @@ void mt7996_tx_token_put(struct mt7996_dev *dev)
+@@ -1695,8 +1695,11 @@ void mt7996_tx_token_put(struct mt7996_dev *dev)
  
  	spin_lock_bh(&dev->mt76.token_lock);
  	idr_for_each_entry(&dev->mt76.token, txwi, id) {
@@ -95,10 +97,10 @@
  	spin_unlock_bh(&dev->mt76.token_lock);
  	idr_destroy(&dev->mt76.token);
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index fa884316..04832b0c 100644
+index 8f8cd7ae..38f62d89 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -76,6 +76,7 @@
+@@ -78,6 +78,7 @@
  #define MT7996_TOKEN_SIZE		16384
  #define MT7996_HW_TOKEN_SIZE		8192
  #define MT7996_SW_TOKEN_SIZE		15360
@@ -107,10 +109,10 @@
  #define MT7996_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
  #define MT7996_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index fa8de2db..a4703b07 100644
+index 78450935..96a4a514 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -2401,7 +2401,7 @@ static int mt7996_sta_info(struct seq_file *s, void *data)
+@@ -2400,7 +2400,7 @@ static int mt7996_sta_info(struct seq_file *s, void *data)
  static int mt7996_token_read(struct seq_file *s, void *data)
  {
  	struct mt7996_dev *dev = dev_get_drvdata(s->private);
@@ -119,7 +121,7 @@
  	struct mt76_txwi_cache *txwi;
  
  	seq_printf(s, "Token from host:\n");
-@@ -2410,8 +2410,18 @@ static int mt7996_token_read(struct seq_file *s, void *data)
+@@ -2409,8 +2409,18 @@ static int mt7996_token_read(struct seq_file *s, void *data)
  		seq_printf(s, "%4d (pending time %u ms)\n", msdu_id,
  			   jiffies_to_msecs(jiffies - txwi->jiffies));
  	}
@@ -140,10 +142,10 @@
  	return 0;
  }
 diff --git a/tx.c b/tx.c
-index 5e6e433f..c965f0e3 100644
+index c9fda966..9bf43124 100644
 --- a/tx.c
 +++ b/tx.c
-@@ -837,20 +837,29 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
+@@ -855,20 +855,29 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  }
  EXPORT_SYMBOL_GPL(__mt76_set_tx_blocked);
  
@@ -176,7 +178,7 @@
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	if (mtk_wed_device_active(&dev->mmio.wed) &&
  	    token >= dev->mmio.wed.wlan.token_start)
-@@ -860,6 +869,7 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
+@@ -878,6 +887,7 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
  	if (dev->token_count >= dev->token_size - MT76_TOKEN_FREE_THR)
  		__mt76_set_tx_blocked(dev, true);
  
@@ -184,7 +186,7 @@
  	spin_unlock_bh(&dev->token_lock);
  
  	return token;
-@@ -893,7 +903,10 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
+@@ -911,7 +921,10 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
  
  	txwi = idr_remove(&dev->token, token);
  	if (txwi) {
@@ -196,5 +198,5 @@
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  		if (mtk_wed_device_active(&dev->mmio.wed) &&
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0179-mtk-mt76-sync-with-upstream-changes.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0179-mtk-mt76-sync-with-upstream-changes.patch
new file mode 100644
index 0000000..07714b3
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0179-mtk-mt76-sync-with-upstream-changes.patch
@@ -0,0 +1,27 @@
+From dd6e1e68ae6daf98e724d37d7fb099f2b825b094 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Wed, 31 Jul 2024 11:19:53 +0800
+Subject: [PATCH 179/223] mtk: mt76: sync with upstream changes
+
+Change-Id: I0d1b5ad073e0e2b6f74fca5e800f0b3365151814
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7996/mcu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index c6b6f405..47f8b5cc 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -426,7 +426,7 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
+ 						&dev->rdd2_chandef,
+ 						GFP_ATOMIC);
+ 	} else {
+-		ieee80211_radar_detected(mphy->hw);
++		ieee80211_radar_detected(mphy->hw, NULL);
+ 	}
+ 	dev->hw_pattern++;
+ }
+-- 
+2.45.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0192-mtk-mt76-mt7996-record-per-antenna-average-data-fram.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0180-mtk-mt76-mt7996-record-per-antenna-average-data-fram.patch
similarity index 88%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0192-mtk-mt76-mt7996-record-per-antenna-average-data-fram.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0180-mtk-mt76-mt7996-record-per-antenna-average-data-fram.patch
index bdf7dfa..7d1b622 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0192-mtk-mt76-mt7996-record-per-antenna-average-data-fram.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0180-mtk-mt76-mt7996-record-per-antenna-average-data-fram.patch
@@ -1,7 +1,7 @@
-From a73d892b561967d17374cc3e04ec2b8d097062b4 Mon Sep 17 00:00:00 2001
+From a8a7baa9433713f20bd0e8f6f78972097d0f0820 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Thu, 1 Aug 2024 09:11:02 +0800
-Subject: [PATCH 192/199] mtk: mt76: mt7996: record per-antenna average
+Subject: [PATCH 180/223] mtk: mt76: mt7996: record per-antenna average
  data-frame RSSI
 
 Record per-antenna average data-frame RSSI.
@@ -14,7 +14,7 @@
  3 files changed, 13 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index f9344f28..27b4e99f 100644
+index ac51e27d..58b462e8 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -494,10 +494,17 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
@@ -36,7 +36,7 @@
  
  		/* RXD Group 5 - C-RXV */
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 59353603..29b2583d 100644
+index 2b92b686..ed0f9154 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1230,7 +1230,7 @@ static int mt7996_add_link_sta(struct mt7996_dev *dev,
@@ -59,10 +59,10 @@
  
  	return 0;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 04832b0c..65a88e58 100644
+index 38f62d89..59f0be0a 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -320,6 +320,8 @@ struct mt7996_link_sta {
+@@ -321,6 +321,8 @@ struct mt7996_link_sta {
  
  	s8 chain_signal[IEEE80211_MAX_CHAINS];
  	int signal;
@@ -72,5 +72,5 @@
  	s8 chain_ack_signal[IEEE80211_MAX_CHAINS];
  	int ack_signal;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0193-mtk-mt76-mt7996-remove-default-bss_conf-when-link-be.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0181-mtk-mt76-mt7996-remove-default-bss_conf-when-link-be.patch
similarity index 71%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0193-mtk-mt76-mt7996-remove-default-bss_conf-when-link-be.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0181-mtk-mt76-mt7996-remove-default-bss_conf-when-link-be.patch
index 4a10a4e..e78c343 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0193-mtk-mt76-mt7996-remove-default-bss_conf-when-link-be.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0181-mtk-mt76-mt7996-remove-default-bss_conf-when-link-be.patch
@@ -1,19 +1,20 @@
-From c163bc7222a263f342dbef0568f2bd09044135be Mon Sep 17 00:00:00 2001
+From f8be713871266a7834ad070e6ed737ddc51aeb92 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Mon, 5 Aug 2024 14:54:43 +0800
-Subject: [PATCH 193/199] mtk: mt76: mt7996: remove default bss_conf when link
+Subject: [PATCH 181/223] mtk: mt76: mt7996: remove default bss_conf when link
  becomes MLD
 
+Change-Id: I192aab47adfa038f0ca9320cd5840f1e624a618d
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt7996/main.c | 6 ++++++
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 29b2583d..76dbb2f3 100644
+index ed0f9154..7678059b 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -3124,6 +3124,12 @@ mt7996_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -3128,6 +3128,12 @@ mt7996_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	}
  
  	if (!old_links) {
@@ -27,5 +28,5 @@
  		dev->mld_id_mask |= BIT_ULL(mvif->group_mld_id);
  
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0194-mtk-mt76-mt7996-pass-vif-cfg.assoc-to-mt7996_mac_sta.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0182-mtk-mt76-mt7996-pass-vif-cfg.assoc-to-mt7996_mac_sta.patch
similarity index 76%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0194-mtk-mt76-mt7996-pass-vif-cfg.assoc-to-mt7996_mac_sta.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0182-mtk-mt76-mt7996-pass-vif-cfg.assoc-to-mt7996_mac_sta.patch
index 8d59550..c7a101e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0194-mtk-mt76-mt7996-pass-vif-cfg.assoc-to-mt7996_mac_sta.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0182-mtk-mt76-mt7996-pass-vif-cfg.assoc-to-mt7996_mac_sta.patch
@@ -1,23 +1,24 @@
-From a1517eb6d1c93a2dc4155916497fbe27c3a21b9d Mon Sep 17 00:00:00 2001
+From 582927a3040724713a313cd346dd8f63c907c044 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Mon, 5 Aug 2024 14:55:10 +0800
-Subject: [PATCH 194/199] mtk: mt76: mt7996: pass vif->cfg.assoc to
+Subject: [PATCH 182/223] mtk: mt76: mt7996: pass vif->cfg.assoc to
  mt7996_mac_sta_add_links
 
 Link management functions might leverage mt7996_change_sta_links to
 update sta's links, so the 'assoc' argument of mt7996_mac_sta_add_links()
 should be dynamic decieded by vif->cfg.assoc.
 
+Change-Id: I89028f7f705384c26bc0ba35820d6478abf0c359
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt7996/main.c | 4 +++-
  1 file changed, 3 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 76dbb2f3..6826f319 100644
+index 7678059b..7d4352c7 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -3157,6 +3157,7 @@ mt7996_change_sta_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -3161,6 +3161,7 @@ mt7996_change_sta_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	unsigned long add = new_links & ~old_links;
  	unsigned long rem = old_links & ~new_links;
  	int ret = 0;
@@ -25,7 +26,7 @@
  
  	mt76_vif_dbg(vif, "STA %pM old=0x%x, new=0x%x\n", sta->addr, old_links, new_links);
  	mutex_lock(&dev->mt76.mutex);
-@@ -3170,7 +3171,8 @@ mt7996_change_sta_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -3174,7 +3175,8 @@ mt7996_change_sta_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		/* 	goto remove; */
  	}
  
@@ -36,5 +37,5 @@
  		goto remove;
  
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0195-mtk-mt76-mt7996-separate-hwrro-from-wed.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0183-mtk-mt76-mt7996-separate-hwrro-from-wed.patch
similarity index 96%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0195-mtk-mt76-mt7996-separate-hwrro-from-wed.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0183-mtk-mt76-mt7996-separate-hwrro-from-wed.patch
index 29f0504..a037dff 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0195-mtk-mt76-mt7996-separate-hwrro-from-wed.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0183-mtk-mt76-mt7996-separate-hwrro-from-wed.patch
@@ -1,7 +1,7 @@
-From 8b65a89860eb0fcd914382b4297efa262f4c158c Mon Sep 17 00:00:00 2001
+From 1d7510d986c174a852a91d51415019538c4bd95b Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Tue, 6 Aug 2024 10:06:10 +0800
-Subject: [PATCH 195/199] mtk: mt76: mt7996: separate hwrro from wed
+Subject: [PATCH 183/223] mtk: mt76: mt7996: separate hwrro from wed
 
 1. separate hwrro from wed
 2. support mt7996/mt7992 run hwrro 3.0 without wed
@@ -223,7 +223,7 @@
  #define MT_DMA_WED_IND_REASON		GENMASK(15, 12)
  
 diff --git a/mac80211.c b/mac80211.c
-index d5f842db..d81bf667 100644
+index 6190822c..d87aba36 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -732,6 +732,7 @@ static void mt76_rx_release_amsdu(struct mt76_phy *phy, enum mt76_rxq_id q)
@@ -246,10 +246,10 @@
  }
  
 diff --git a/mt76.h b/mt76.h
-index e5e5529d..58e9b0b7 100644
+index 5d7b8c4c..50d52776 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -276,6 +276,7 @@ struct mt76_queue {
+@@ -277,6 +277,7 @@ struct mt76_queue {
  
  	u8 buf_offset;
  	u16 flags;
@@ -257,7 +257,7 @@
  
  	struct mtk_wed_device *wed;
  	u32 wed_regs;
-@@ -329,6 +330,9 @@ struct mt76_queue_ops {
+@@ -333,6 +334,9 @@ struct mt76_queue_ops {
  	void (*tx_cleanup)(struct mt76_dev *dev, struct mt76_queue *q,
  			   bool flush);
  
@@ -267,7 +267,7 @@
  	void (*rx_cleanup)(struct mt76_dev *dev, struct mt76_queue *q);
  
  	void (*kick)(struct mt76_dev *dev, struct mt76_queue *q);
-@@ -472,6 +476,7 @@ struct mt76_rxwi_cache {
+@@ -478,6 +482,7 @@ struct mt76_rxwi_cache {
  	dma_addr_t dma_addr;
  
  	void *ptr;
@@ -275,7 +275,7 @@
  };
  
  struct mt76_rx_tid {
-@@ -578,6 +583,10 @@ struct mt76_driver_ops {
+@@ -591,6 +596,10 @@ struct mt76_driver_ops {
  	void (*rx_skb)(struct mt76_dev *dev, enum mt76_rxq_id q,
  		       struct sk_buff *skb, u32 *info);
  
@@ -286,7 +286,7 @@
  	void (*rx_poll_complete)(struct mt76_dev *dev, enum mt76_rxq_id q);
  
  	void (*sta_ps)(struct mt76_dev *dev, struct ieee80211_sta *sta,
-@@ -1306,6 +1315,7 @@ static inline int mt76_wed_dma_setup(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -1321,6 +1330,7 @@ static inline int mt76_wed_dma_setup(struct mt76_dev *dev, struct mt76_queue *q,
  #define mt76_tx_queue_skb(dev, ...)	(dev)->mt76.queue_ops->tx_queue_skb(&((dev)->mphy), __VA_ARGS__)
  #define mt76_queue_rx_reset(dev, ...)	(dev)->mt76.queue_ops->rx_reset(&((dev)->mt76), __VA_ARGS__)
  #define mt76_queue_tx_cleanup(dev, ...)	(dev)->mt76.queue_ops->tx_cleanup(&((dev)->mt76), __VA_ARGS__)
@@ -294,7 +294,7 @@
  #define mt76_queue_rx_cleanup(dev, ...)	(dev)->mt76.queue_ops->rx_cleanup(&((dev)->mt76), __VA_ARGS__)
  #define mt76_queue_kick(dev, ...)	(dev)->mt76.queue_ops->kick(&((dev)->mt76), __VA_ARGS__)
  #define mt76_queue_reset(dev, ...)	(dev)->mt76.queue_ops->reset_q(&((dev)->mt76), __VA_ARGS__)
-@@ -1871,13 +1881,8 @@ static inline bool mt76_queue_is_wed_rro_msdu_pg(struct mt76_queue *q)
+@@ -1887,13 +1897,8 @@ static inline bool mt76_queue_is_wed_rro_msdu_pg(struct mt76_queue *q)
  
  static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
  {
@@ -482,7 +482,7 @@
  
  	if (!force)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index bad4b1b7..0e647356 100644
+index 6e8791c8..ddceddff 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -931,7 +931,6 @@ void mt7996_wfsys_reset(struct mt7996_dev *dev)
@@ -608,7 +608,7 @@
  	for (i = 0; i < ARRAY_SIZE(dev->wed_rro.ba_bitmap); i++) {
  		if (!dev->wed_rro.ba_bitmap[i].ptr)
  			continue;
-@@ -1138,12 +1131,10 @@ static void mt7996_wed_rro_free(struct mt7996_dev *dev)
+@@ -1148,12 +1141,10 @@ static void mt7996_wed_rro_free(struct mt7996_dev *dev)
  			   sizeof(struct mt7996_wed_rro_addr),
  			   dev->wed_rro.session.ptr,
  			   dev->wed_rro.session.phy_addr);
@@ -621,15 +621,15 @@
  	struct mt7996_dev *dev;
  	LIST_HEAD(list);
  
-@@ -1186,7 +1177,6 @@ reset:
+@@ -1196,7 +1187,6 @@ reset:
  out:
  		kfree(e);
  	}
 -#endif
  }
  
- int mt7996_get_chip_sku(struct mt7996_dev *dev)
-@@ -1828,6 +1818,10 @@ void mt7996_unregister_device(struct mt7996_dev *dev)
+ static int mt7996_variant_type_init(struct mt7996_dev *dev)
+@@ -1848,6 +1838,10 @@ void mt7996_unregister_device(struct mt7996_dev *dev)
  	mt7996_mcu_exit(dev);
  	mt7996_tx_token_put(dev);
  	mt7996_dma_cleanup(dev);
@@ -641,10 +641,10 @@
  
  	mt76_free_device(&dev->mt76);
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 27b4e99f..c0f282d1 100644
+index 58b462e8..b0b664e7 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1505,6 +1505,387 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+@@ -1517,6 +1517,387 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  	}
  }
  
@@ -1032,7 +1032,7 @@
  void mt7996_mac_cca_stats_reset(struct mt7996_phy *phy)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -2040,6 +2421,9 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2052,6 +2433,9 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	dev_info(dev->mt76.dev,"%s L1 SER dma start done.",
  		 wiphy_name(dev->mt76.hw->wiphy));
  
@@ -1042,7 +1042,7 @@
  	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
  		u32 wed_irq_mask = MT_INT_RRO_RX_DONE | MT_INT_TX_DONE_BAND2 |
  				   dev->mt76.mmio.irqmask;
-@@ -2049,10 +2433,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2061,10 +2445,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
  
  		mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
  
@@ -1054,7 +1054,7 @@
  					    true);
  
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 58db5204..4d9cb9ff 100644
+index ee5ee5a5..c84c1bbb 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -654,6 +654,8 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
@@ -1064,13 +1064,13 @@
 +		.rx_rro_ind_process = mt7996_rro_rx_process,
 +		.rx_rro_fill_msdu_pg = mt7996_rro_fill_msdu_page,
  		.sta_add = mt7996_mac_sta_add,
- 		.sta_assoc = mt7996_mac_sta_assoc,
+ 		.sta_event = mt7996_mac_sta_event,
  		.sta_remove = mt7996_mac_sta_remove,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 65a88e58..3aedaf5a 100644
+index 59f0be0a..b115e7dd 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -102,6 +102,7 @@
+@@ -104,6 +104,7 @@
  
  #define MT7996_BUILD_TIME_LEN		24
  
@@ -1078,7 +1078,7 @@
  #define MT7996_RRO_MSDU_PG_HASH_SIZE	127
  #define MT7996_RRO_MAX_SESSION		1024
  #define MT7996_RRO_WINDOW_MAX_LEN	1024
-@@ -532,6 +533,33 @@ int mt7996_mcu_set_muru_qos_cfg(struct mt7996_dev *dev, u16 wlan_idx, u8 dir,
+@@ -533,6 +534,33 @@ int mt7996_mcu_set_muru_qos_cfg(struct mt7996_dev *dev, u16 wlan_idx, u8 dir,
  				u8 scs_id, u8 req_type, u8 *qos_ie, u8 qos_ie_len);
  #endif
  
@@ -1112,7 +1112,7 @@
  struct mt7996_rro_ba_session {
  	u32 ack_sn         :12;
  	u32 win_sz         :3;
-@@ -547,6 +575,26 @@ struct mt7996_rro_ba_session {
+@@ -548,6 +576,26 @@ struct mt7996_rro_ba_session {
  	u32 last_in_rxtime :12;
  };
  
@@ -1139,7 +1139,7 @@
  struct mt7996_chanctx {
  	struct cfg80211_chan_def chandef;
  	struct mt7996_phy *phy;
-@@ -1257,6 +1305,11 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1261,6 +1309,11 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  void mt7996_tx_token_put(struct mt7996_dev *dev);
  void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  			 struct sk_buff *skb, u32 *info);
@@ -1174,7 +1174,7 @@
  	mt7996_wfsys_reset(dev);
  	hif2 = mt7996_pci_init_hif2(pdev);
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index e1893517..0ea055ba 100644
+index a0b57e59..e86d5df3 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -561,6 +561,7 @@ enum offs_rev {
@@ -1186,5 +1186,5 @@
  						 MT_INT_RX(MT_RXQ_MSDU_PAGE_BAND1) |	\
  						 MT_INT_RX(MT_RXQ_MSDU_PAGE_BAND2))
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0196-mtk-mt76-mt7996-ignore-vif.dormant_links-in-mt7996_c.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0184-mtk-mt76-mt7996-ignore-vif.dormant_links-in-mt7996_c.patch
similarity index 79%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0196-mtk-mt76-mt7996-ignore-vif.dormant_links-in-mt7996_c.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0184-mtk-mt76-mt7996-ignore-vif.dormant_links-in-mt7996_c.patch
index f6d2576..858e4c2 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0196-mtk-mt76-mt7996-ignore-vif.dormant_links-in-mt7996_c.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0184-mtk-mt76-mt7996-ignore-vif.dormant_links-in-mt7996_c.patch
@@ -1,22 +1,23 @@
-From bdbcaf57e4e62a9ff8425677384e3da49497c170 Mon Sep 17 00:00:00 2001
+From 986d45c9ebf4793cababd01b338ff9a6b90ba449 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Mon, 5 Aug 2024 14:56:19 +0800
-Subject: [PATCH 196/199] mtk: mt76: mt7996: ignore vif.dormant_links in
+Subject: [PATCH 184/223] mtk: mt76: mt7996: ignore vif.dormant_links in
  mt7996_change_vif_links
 
 The dormant links are disabled for reasons like TTLM, and might become
 active in the near future, so we do not remove their bss_conf here.
 
+Change-Id: Ida947815bce7bfc3fb9772175ac105eb82ff16c1
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt7996/main.c | 5 +++--
  1 file changed, 3 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 6826f319..3892fd27 100644
+index 7d4352c7..a7c2043f 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -3102,11 +3102,12 @@ mt7996_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -3106,11 +3106,12 @@ mt7996_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -32,5 +33,5 @@
  		return 0;
  
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0197-mtk-mt76-mt7996-add-Adv-TTLM-support-for-STA.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0185-mtk-mt76-mt7996-add-Adv-TTLM-support-for-STA.patch
similarity index 90%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0197-mtk-mt76-mt7996-add-Adv-TTLM-support-for-STA.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0185-mtk-mt76-mt7996-add-Adv-TTLM-support-for-STA.patch
index 04f64a9..7a046ae 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0197-mtk-mt76-mt7996-add-Adv-TTLM-support-for-STA.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0185-mtk-mt76-mt7996-add-Adv-TTLM-support-for-STA.patch
@@ -1,13 +1,14 @@
-From aea601b0b41e150228aa152da2930778f0e10942 Mon Sep 17 00:00:00 2001
+From cbe2fdac92d74596b378fbdc027434210d31d88b Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Mon, 5 Aug 2024 15:03:55 +0800
-Subject: [PATCH 197/199] mtk: mt76: mt7996: add Adv-TTLM support for STA
+Subject: [PATCH 185/223] mtk: mt76: mt7996: add Adv-TTLM support for STA
 
 1. add the handling for valid_link and TTLM changing in vif_cfg_changed
    callback.
 2. send peer-mld request for default mapping and Adv-TTLM. Neg-TTLM will
    be supported in further commit.
 
+Change-Id: I067331888f0cdb27826ca36cacb3897096835d94
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt76_connac_mcu.h |  1 +
@@ -18,10 +19,10 @@
  5 files changed, 92 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index eb738f4f..97d4c2ad 100644
+index 69c8389f..68d7c31d 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1322,6 +1322,7 @@ enum {
+@@ -1327,6 +1327,7 @@ enum {
  	MCU_UNI_CMD_ASSERT_DUMP = 0x6f,
  	MCU_UNI_CMD_PTA_3WIRE_CTRL = 0x78,
  	MCU_UNI_CMD_MLD = 0x82,
@@ -30,7 +31,7 @@
  
  enum {
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 3892fd27..7be2a38a 100644
+index a7c2043f..290dff6e 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -957,6 +957,9 @@ static void mt7996_vif_cfg_changed(struct ieee80211_hw *hw,
@@ -44,10 +45,10 @@
  }
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 03c671f6..7096b8a0 100644
+index 47f8b5cc..265f39a6 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3616,6 +3616,70 @@ int mt7996_mcu_mld_set_attlm(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -3623,6 +3623,70 @@ int mt7996_mcu_mld_set_attlm(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	return ret;
  }
  
@@ -152,10 +153,10 @@
  	u8 _rsv[4];
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 3aedaf5a..7866c706 100644
+index b115e7dd..1e52377a 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1211,6 +1211,8 @@ int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy);
+@@ -1215,6 +1215,8 @@ int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy);
  void mt7996_mcu_wmm_pbc_work(struct work_struct *work);
  int mt7996_mcu_mld_set_attlm(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  			     u16 disabled_links, u16 switch_time, u32 duration);
@@ -165,5 +166,5 @@
  static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
  {
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0198-mtk-mt76-mt7996-Add-AFC-and-lpi-power-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0186-mtk-mt76-mt7996-Add-AFC-and-lpi-power-support.patch
similarity index 94%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0198-mtk-mt76-mt7996-Add-AFC-and-lpi-power-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0186-mtk-mt76-mt7996-Add-AFC-and-lpi-power-support.patch
index 347774e..ddc45f4 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0198-mtk-mt76-mt7996-Add-AFC-and-lpi-power-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0186-mtk-mt76-mt7996-Add-AFC-and-lpi-power-support.patch
@@ -1,7 +1,7 @@
-From bdbfbe8865914946cbce6c901224785cf5cd7d3c Mon Sep 17 00:00:00 2001
+From 4f43eb23f373930534372c1b82787f2da37c940d Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Thu, 1 Aug 2024 11:25:03 +0800
-Subject: [PATCH 198/199] mtk: mt76: mt7996: Add AFC and lpi power support
+Subject: [PATCH 186/223] mtk: mt76: mt7996: Add AFC and lpi power support
 
 This patch receiving and storing the power table from hostapd vendor cmd.
 The power table would be use to compare the sku table in standard power
@@ -25,6 +25,8 @@
 Add the bf on value offset logic. The offset is antenna/beamform gain
 offset = 10 * (log(num of ant) - log(num of NSS)).
 
+Change-Id: Ibc6e9adb149bec02d3443d6e0309c9ac122a925b
+Change-Id: Ic24ee5f95eb5c11d1031428ee1d4f3fc9ff39e11
 Signed-off-by: Allen Ye <allen.ye@mediatek.com>
 ---
  mt76.h               |   2 +
@@ -39,10 +41,10 @@
  9 files changed, 429 insertions(+), 25 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 58e9b0b7..4b473123 100644
+index 50d52776..a465785f 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1063,6 +1063,8 @@ struct mt76_dev {
+@@ -1078,6 +1078,8 @@ struct mt76_dev {
  	bool lpi_psd;
  	bool lpi_bcn_enhance;
  	bool mgmt_pwr_enhance;
@@ -52,10 +54,10 @@
  #ifdef CONFIG_NL80211_TESTMODE
  	const struct mt76_testmode_ops *test_ops;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index c0f282d1..60223bea 100644
+index b0b664e7..5d40b8f1 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -896,7 +896,7 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+@@ -908,7 +908,7 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
  		if (mcast)
  			val |= MT_TXD6_DIS_MAT;
  		if (dev->mt76.phys[band_idx]->cap.has_6ghz &&
@@ -65,7 +67,7 @@
  			val |= FIELD_PREP(MT_TXD6_BW, FW_CDBW_80MHZ);
  		txwi[6] |= cpu_to_le32(val);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 7be2a38a..58e02083 100644
+index 290dff6e..812d8269 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -891,7 +891,7 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_bss_conf *conf,
@@ -78,10 +80,10 @@
  
  		/* odd index for driver, even index for firmware */
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 7096b8a0..48bdbf73 100644
+index 265f39a6..725f2f31 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -6374,7 +6374,8 @@ int mt7996_mcu_set_fixed_rate_table(struct mt7996_phy *phy, u8 table_idx,
+@@ -6384,7 +6384,8 @@ int mt7996_mcu_set_fixed_rate_table(struct mt7996_phy *phy, u8 table_idx,
  
  	if (beacon) {
  		req.spe_idx_sel = SPE_IXD_SELECT_TXD;
@@ -91,7 +93,7 @@
  		phy->beacon_rate = rate_idx;
  	} else {
  		req.spe_idx_sel = SPE_IXD_SELECT_BMC_WTBL;
-@@ -6657,6 +6658,126 @@ mt7996_update_max_txpower_cur(struct mt7996_phy *phy, int tx_power)
+@@ -6667,6 +6668,126 @@ mt7996_update_max_txpower_cur(struct mt7996_phy *phy, int tx_power)
  		mphy->txpower_cur = e2p_power_limit;
  }
  
@@ -218,7 +220,7 @@
  bool mt7996_is_psd_country(char *country)
  {
  	char psd_country_list[][3] = {"US", "KR", "BR", "CL", "MY", ""};
-@@ -6704,15 +6825,22 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
+@@ -6714,15 +6835,22 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
  		txpower_setting = 127;
  	txpower_limit = mt7996_get_power_bound(phy, txpower_setting);
  
@@ -246,7 +248,7 @@
  	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
  				 sizeof(req) + MT7996_SKU_PATH_NUM);
  	if (!skb)
-@@ -6725,7 +6853,7 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
+@@ -6735,7 +6863,7 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
  	/* FW would compensate for PSD countries
  	 * driver doesn't need to do it
  	 */
@@ -255,7 +257,7 @@
  	    !mt7996_is_psd_country(dev->mt76.alpha2)) {
  		switch (mphy->chandef.width) {
  		case NL80211_CHAN_WIDTH_20:
-@@ -6791,7 +6919,7 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
+@@ -6801,7 +6929,7 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
  	/* FW would NOT compensate in the case of BF backoff table
  	 * driver needs to compensate for LPI PSD
  	 */
@@ -264,7 +266,7 @@
  		switch (mphy->chandef.width) {
  		case NL80211_CHAN_WIDTH_20:
  			skb_put_data(skb, &la_path.ru[5], sizeof(la_path.ofdm));
-@@ -6853,13 +6981,53 @@ int mt7996_mcu_set_lpi_psd(struct mt7996_phy *phy, u8 enable)
+@@ -6863,13 +6991,53 @@ int mt7996_mcu_set_lpi_psd(struct mt7996_phy *phy, u8 enable)
  		.tag = cpu_to_le16(UNI_BAND_CONFIG_LPI_CTRL),
  		.len = cpu_to_le16(sizeof(req) - 4),
  		.lpi_enable = enable,
@@ -470,10 +472,10 @@
  	UNI_CMD_ACCESS_REG_BASIC = 0x0,
  	UNI_CMD_ACCESS_RF_REG_BASIC,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 7866c706..e8571e9f 100644
+index 1e52377a..b841cc2a 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1170,6 +1170,8 @@ int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state);
+@@ -1174,6 +1174,8 @@ int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state);
  int mt7996_mcu_set_thermal_protect(struct mt7996_phy *phy, bool enable);
  int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
  			       int txpower_setting);
@@ -483,10 +485,10 @@
  		       u8 rx_sel, u8 val);
  int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev,
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index a4703b07..63e63a33 100644
+index 96a4a514..5338d0bd 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -2523,6 +2523,11 @@ mt7996_get_txpower_info(struct file *file, char __user *user_buf,
+@@ -2522,6 +2522,11 @@ mt7996_get_txpower_info(struct file *file, char __user *user_buf,
  	len += scnprintf(buf + len, size - len,
  			 "    RegDB:  %s\n",
  			 !np ? "enable" : "disable");
@@ -498,7 +500,7 @@
  	ret = simple_read_from_buffer(user_buf, count, ppos, buf, len);
  
  out:
-@@ -4390,6 +4395,37 @@ static int mt7996_pp_alg_show(struct seq_file *s, void *data)
+@@ -4389,6 +4394,37 @@ static int mt7996_pp_alg_show(struct seq_file *s, void *data)
  }
  DEFINE_SHOW_ATTRIBUTE(mt7996_pp_alg);
  
@@ -536,7 +538,7 @@
  void mt7996_mtk_init_band_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	/* agg */
-@@ -4516,6 +4552,7 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
+@@ -4515,6 +4551,7 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
  
  	debugfs_create_file("muru_dbg", 0200, dir, dev, &fops_muru_dbg_info);
  	debugfs_create_bool("mgmt_pwr_enhance", 0600, dir, &dev->mt76.mgmt_pwr_enhance);
@@ -718,5 +720,5 @@
  
  #endif
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0199-mtk-mt76-do-not-report-ACK-when-TXS-is-lost.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0187-mtk-mt76-do-not-report-ACK-when-TXS-is-lost.patch
similarity index 80%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0199-mtk-mt76-do-not-report-ACK-when-TXS-is-lost.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0187-mtk-mt76-do-not-report-ACK-when-TXS-is-lost.patch
index d99c18f..059a790 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0199-mtk-mt76-do-not-report-ACK-when-TXS-is-lost.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0187-mtk-mt76-do-not-report-ACK-when-TXS-is-lost.patch
@@ -1,7 +1,7 @@
-From 3526fd4180ee45d66f634aa3bef3d86e7ab5bc82 Mon Sep 17 00:00:00 2001
+From 6bd9e4f92817c054a87abc52b59b20219585aff4 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 13 Aug 2024 18:55:00 +0800
-Subject: [PATCH 199/199] mtk: mt76: do not report ACK when TXS is lost
+Subject: [PATCH 187/223] mtk: mt76: do not report ACK when TXS is lost
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -9,7 +9,7 @@
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/tx.c b/tx.c
-index c965f0e3..7712a32e 100644
+index 9bf43124..d002cf6d 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -100,7 +100,8 @@ __mt76_tx_status_skb_done(struct mt76_dev *dev, struct sk_buff *skb, u8 flags,
@@ -23,5 +23,5 @@
  		info->status.rates[0].idx = -1;
  		info->flags |= IEEE80211_TX_STAT_ACK;
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0188-mtk-mt76-mt7996-fix-ldpc-setting.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0188-mtk-mt76-mt7996-fix-ldpc-setting.patch
new file mode 100644
index 0000000..9f0d62e
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0188-mtk-mt76-mt7996-fix-ldpc-setting.patch
@@ -0,0 +1,33 @@
+From 1e59567d865e9e23c193919f8ce2d84e8d4d52f5 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Wed, 28 Aug 2024 13:58:30 +0800
+Subject: [PATCH 188/223] mtk: mt76: mt7996: fix ldpc setting
+
+The non-AP interfaces would not update conf->vht_ldpc so they never set
+STA_CAP_VHT_LDPC even if peer-station support LDPC.
+Check conf->vht_ldpc only if it is using AP interface.
+
+Without this patch, station only uses BCC to transmit packet in VHT mode.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Change-Id: I00574c95a8cded18a3272e5aa27582ab4d618899
+---
+ mt7996/mcu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 725f2f31..b0e9617d 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -2994,7 +2994,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+ 			cap |= STA_CAP_VHT_TX_STBC;
+ 		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
+ 			cap |= STA_CAP_VHT_RX_STBC;
+-		if (conf->vht_ldpc &&
++		if ((conf->vif->type != NL80211_IFTYPE_AP || conf->vht_ldpc) &&
+ 		    (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
+ 			cap |= STA_CAP_VHT_LDPC;
+ 
+-- 
+2.45.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0189-mtk-mt76-mt7996-add-external-eeprom-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0189-mtk-mt76-mt7996-add-external-eeprom-support.patch
new file mode 100644
index 0000000..54d2da6
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0189-mtk-mt76-mt7996-add-external-eeprom-support.patch
@@ -0,0 +1,669 @@
+From 47862d9e7019f0e7524beb819bc875404cf687bd Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 22 Aug 2024 23:22:46 +0800
+Subject: [PATCH 189/223] mtk: mt76: mt7996: add external eeprom support
+
+Add external eeprom support
+For Kite and Griffin, efuse mode is not supported due to the lack of
+space in efuse.
+So, an additional external eeprom is added for user to store their
+golden eeprom.
+
+Note that the FW currently has some issues with writing to the ext
+eeprom, so the write back function of ext eeprom is not yet linked
+to any command.
+A write back command will be added once the FW fixes the issue.
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Change-Id: Ie36469700f9620806e6513ffaf076338841ba7c3
+---
+ debugfs.c            |   2 +
+ mt76.h               |   1 +
+ mt76_connac_mcu.h    |   1 +
+ mt7996/debugfs.c     |  57 ++++++++++++++++++-
+ mt7996/eeprom.c      |  35 +++++++-----
+ mt7996/eeprom.h      |   7 ---
+ mt7996/init.c        |   3 +-
+ mt7996/mcu.c         | 130 ++++++++++++++++++++++++++++++++++---------
+ mt7996/mcu.h         |  35 +++++++++++-
+ mt7996/mt7996.h      |  30 +++++++++-
+ mt7996/mtk_debugfs.c |   3 +
+ mt7996/testmode.c    |  39 ++++++++-----
+ testmode.h           |   2 +
+ 13 files changed, 277 insertions(+), 68 deletions(-)
+
+diff --git a/debugfs.c b/debugfs.c
+index ac5207e5..2ded5c03 100644
+--- a/debugfs.c
++++ b/debugfs.c
+@@ -121,6 +121,8 @@ mt76_register_debugfs_fops(struct mt76_phy *phy,
+ 	debugfs_create_blob("eeprom", 0400, dir, &dev->eeprom);
+ 	if (dev->otp.data)
+ 		debugfs_create_blob("otp", 0400, dir, &dev->otp);
++	if (dev->ext_eeprom.data)
++		debugfs_create_blob("ext_eeprom", 0400, dir, &dev->ext_eeprom);
+ 	debugfs_create_devm_seqfile(dev->dev, "rx-queues", dir,
+ 				    mt76_rx_queues_read);
+ 
+diff --git a/mt76.h b/mt76.h
+index a465785f..c319ba26 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -1065,6 +1065,7 @@ struct mt76_dev {
+ 
+ 	struct debugfs_blob_wrapper eeprom;
+ 	struct debugfs_blob_wrapper otp;
++	struct debugfs_blob_wrapper ext_eeprom;
+ 
+ 	char alpha2[3];
+ 	enum nl80211_dfs_regions region;
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 68d7c31d..25d5f9f9 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1325,6 +1325,7 @@ enum {
+ 	MCU_UNI_CMD_PER_STA_INFO = 0x6d,
+ 	MCU_UNI_CMD_ALL_STA_INFO = 0x6e,
+ 	MCU_UNI_CMD_ASSERT_DUMP = 0x6f,
++	MCU_UNI_CMD_EXT_EEPROM_CTRL  = 0x74,
+ 	MCU_UNI_CMD_PTA_3WIRE_CTRL = 0x78,
+ 	MCU_UNI_CMD_MLD = 0x82,
+ 	MCU_UNI_CMD_PEER_MLD = 0x83,
+diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
+index 240c6d46..d06fb587 100644
+--- a/mt7996/debugfs.c
++++ b/mt7996/debugfs.c
+@@ -972,7 +972,9 @@ mt7996_efuse_get(struct file *file, char __user *user_buf,
+ 		block_num = DIV_ROUND_UP(mdev->otp.size, MT7996_EEPROM_BLOCK_SIZE);
+ 		for (i = 0; i < block_num; i++) {
+ 			buff = mdev->otp.data + i * MT7996_EEPROM_BLOCK_SIZE;
+-			ret = mt7996_mcu_get_eeprom(dev, i * MT7996_EEPROM_BLOCK_SIZE, buff);
++			ret = mt7996_mcu_get_eeprom(dev, i * MT7996_EEPROM_BLOCK_SIZE,
++						    buff, MT7996_EEPROM_BLOCK_SIZE,
++						    EFUSE_MODE);
+ 			if (ret && ret != -EINVAL)
+ 				return ret;
+ 		}
+@@ -989,6 +991,58 @@ static const struct file_operations mt7996_efuse_ops = {
+ 	.llseek = default_llseek,
+ };
+ 
++static ssize_t
++mt7996_ext_eeprom_get(struct file *file, char __user *user_buf,
++		      size_t count, loff_t *ppos)
++{
++	struct mt7996_dev *dev = file->private_data;
++	struct mt76_dev *mdev = &dev->mt76;
++	u8 *buff = mdev->ext_eeprom.data;
++	u32 block_num, block_size = MT7996_EXT_EEPROM_BLOCK_SIZE;
++	int i;
++	ssize_t ret;
++
++	if (!mt7996_has_ext_eeprom(dev)) {
++		dev_info(dev->mt76.dev, "No external eeprom device found\n");
++		return 0;
++	}
++
++	mdev->ext_eeprom.size = MT7996_EEPROM_SIZE;
++
++	if (!mdev->ext_eeprom.data) {
++		mdev->ext_eeprom.data = devm_kzalloc(mdev->dev,
++						     mdev->ext_eeprom.size,
++						     GFP_KERNEL);
++		if (!mdev->ext_eeprom.data)
++			return -ENOMEM;
++
++		block_num = DIV_ROUND_UP(mdev->ext_eeprom.size, block_size);
++		for (i = 0; i < block_num; i++) {
++			u32 buf_len = block_size;
++			u32 offset = i * block_size;
++
++			if (offset + block_size > mdev->ext_eeprom.size)
++				buf_len = mdev->ext_eeprom.size % block_size;
++			buff = mdev->ext_eeprom.data + offset;
++			ret = mt7996_mcu_get_eeprom(dev, offset, buff, buf_len,
++						    EXT_EEPROM_MODE);
++			if (ret && ret != -EINVAL)
++				return ret;
++		}
++	}
++
++	ret = simple_read_from_buffer(user_buf, count, ppos,
++				      mdev->ext_eeprom.data, mdev->ext_eeprom.size);
++
++	return ret;
++}
++
++static const struct file_operations mt7996_ext_eeprom_ops = {
++	.read = mt7996_ext_eeprom_get,
++	.open = simple_open,
++	.llseek = default_llseek,
++};
++
+ static int
+ mt7996_vow_info_read(struct seq_file *s, void *data)
+ {
+@@ -1133,6 +1187,7 @@ int mt7996_init_dev_debugfs(struct mt7996_phy *phy)
+ 				    mt7996_twt_stats);
+ 	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
+ 	debugfs_create_file("otp", 0400, dir, dev, &mt7996_efuse_ops);
++	debugfs_create_file("ext_eeprom", 0400, dir, dev, &mt7996_ext_eeprom_ops);
+ 	debugfs_create_devm_seqfile(dev->mt76.dev, "vow_info", dir,
+ 	                            mt7996_vow_info_read);
+ 	debugfs_create_devm_seqfile(dev->mt76.dev, "airtime", dir,
+diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
+index 327a36b2..db98db21 100644
+--- a/mt7996/eeprom.c
++++ b/mt7996/eeprom.c
+@@ -315,43 +315,52 @@ static int mt7996_eeprom_load(struct mt7996_dev *dev)
+ 
+ 	/* flash or bin file mode eeprom is loaded before mcu init */
+ 	if (!dev->flash_mode) {
+-		u32 eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;
+-		u32 block_num = DIV_ROUND_UP(MT7996_EEPROM_SIZE, eeprom_blk_size);
++		u32 eeprom_blk_size, block_num;
+ 		u8 free_block_num;
+ 		int i;
+ 
+ 		memset(dev->mt76.eeprom.data, 0, MT7996_EEPROM_SIZE);
+-		ret = mt7996_mcu_get_eeprom_free_block(dev, &free_block_num);
+-		if (ret < 0)
+-			return ret;
+-
+-		/* efuse info isn't enough */
+-		if (free_block_num >= 59) {
+-			use_default = true;
+-			goto out;
++		if (!mt7996_has_ext_eeprom(dev)) {
++			/* efuse mode */
++			dev->eeprom_mode = EFUSE_MODE;
++			eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;
++			ret = mt7996_mcu_get_efuse_free_block(dev, &free_block_num);
++			if (ret < 0)
++				return ret;
++
++			/* efuse info isn't enough */
++			if (free_block_num >= 59) {
++				use_default = true;
++				goto out;
++			}
++		} else {
++			/* external eeprom mode */
++			dev->eeprom_mode = EXT_EEPROM_MODE;
++			eeprom_blk_size = MT7996_EXT_EEPROM_BLOCK_SIZE;
+ 		}
+ 
+ 		/* check if eeprom data from fw is valid */
+-		if (mt7996_mcu_get_eeprom(dev, 0, NULL, 0) ||
++		if (mt7996_mcu_get_eeprom(dev, 0, NULL, eeprom_blk_size,
++					  dev->eeprom_mode) ||
+ 		    mt7996_check_eeprom(dev)) {
+ 			use_default = true;
+ 			goto out;
+ 		}
+ 
+ 		/* read eeprom data from fw */
++		block_num = DIV_ROUND_UP(MT7996_EEPROM_SIZE, eeprom_blk_size);
+ 		for (i = 1; i < block_num; i++) {
+ 			u32 len = eeprom_blk_size;
+ 
+ 			if (i == block_num - 1)
+ 				len = MT7996_EEPROM_SIZE % eeprom_blk_size;
+ 			ret = mt7996_mcu_get_eeprom(dev, i * eeprom_blk_size,
+-						    NULL, len);
++						    NULL, len, dev->eeprom_mode);
+ 			if (ret && ret != -EINVAL) {
+ 				use_default = true;
+ 				goto out;
+ 			}
+ 		}
+-		dev->eeprom_mode = EFUSE_MODE;
+ 	}
+ 
+ out:
+diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
+index 788c33c8..15b6620d 100644
+--- a/mt7996/eeprom.h
++++ b/mt7996/eeprom.h
+@@ -151,13 +151,6 @@ enum mt7996_eeprom_band {
+ 	MT_EE_BAND_SEL_6GHZ,
+ };
+ 
+-enum mt7915_eeprom_mode {
+-	DEFAULT_BIN_MODE,
+-	EFUSE_MODE,
+-	FLASH_MODE,
+-	BIN_FILE_MODE,
+-};
+-
+ static inline int
+ mt7996_get_channel_group_5g(int channel)
+ {
+diff --git a/mt7996/init.c b/mt7996/init.c
+index ddceddff..f739afd2 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -1238,7 +1238,8 @@ static int mt7996_variant_fem_init(struct mt7996_dev *dev)
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = mt7996_mcu_get_eeprom(dev, MT7976C_EFUSE_OFFSET, buf, sizeof(buf));
++	ret = mt7996_mcu_get_eeprom(dev, MT7976C_EFUSE_OFFSET, buf, sizeof(buf),
++				    EFUSE_MODE);
+ 	if (ret && ret != -EINVAL)
+ 		return ret;
+ 
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index b0e9617d..01969464 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -5259,7 +5259,7 @@ int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
+ #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
+ #define PAGE_IDX_MASK		GENMASK(4, 2)
+ #define PER_PAGE_SIZE		0x400
+-	struct mt7996_mcu_eeprom req = {
++	struct mt7996_mcu_eeprom_update req = {
+ 		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
+ 		.buffer_mode = EE_MODE_BUFFER
+ 	};
+@@ -5301,7 +5301,7 @@ int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
+ 
+ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
+ {
+-	struct mt7996_mcu_eeprom req = {
++	struct mt7996_mcu_eeprom_update req = {
+ 		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
+ 		.len = cpu_to_le16(sizeof(req) - 4),
+ 		.buffer_mode = EE_MODE_EFUSE,
+@@ -5309,7 +5309,7 @@ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
+ 	};
+ 	int ret;
+ 
+-	if (dev->flash_mode)
++	if (dev->flash_mode || mt7996_has_ext_eeprom(dev))
+ 		ret = mt7996_mcu_set_eeprom_flash(dev);
+ 	else
+ 		ret = mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(EFUSE_CTRL),
+@@ -5320,36 +5320,64 @@ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
+ 	return mt7996_mcu_set_cal_free_data(dev);
+ }
+ 
+-int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len)
++int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len,
++			  enum mt7996_eeprom_mode mode)
+ {
+-	struct mt7996_mcu_eeprom_info req = {
+-		.tag = cpu_to_le16(UNI_EFUSE_ACCESS),
+-		.len = cpu_to_le16(sizeof(req) - 4),
+-		.addr = cpu_to_le32(round_down(offset,
+-				    MT7996_EEPROM_BLOCK_SIZE)),
+-	};
++	struct mt7996_mcu_eeprom_access req;
++	struct mt7996_mcu_eeprom_access_event *event;
+ 	struct sk_buff *skb;
+-	bool valid;
+-	int ret;
++	int ret, cmd;
+ 
+-	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
+-					MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL),
+-					&req, sizeof(req), true, &skb);
++	switch (mode) {
++	case EFUSE_MODE:
++		req.info.tag = cpu_to_le16(UNI_EFUSE_ACCESS);
++		req.info.len = cpu_to_le16(sizeof(req) - 4);
++		req.info.addr = cpu_to_le32(round_down(offset, MT7996_EEPROM_BLOCK_SIZE));
++		cmd = MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL);
++		break;
++	case EXT_EEPROM_MODE:
++		req.info.tag = cpu_to_le16(UNI_EXT_EEPROM_ACCESS);
++		req.info.len = cpu_to_le16(sizeof(req) - 4);
++		req.info.addr = cpu_to_le32(round_down(offset, MT7996_EXT_EEPROM_BLOCK_SIZE));
++		req.eeprom.ext_eeprom.data_len = cpu_to_le32(buf_len);
++		cmd = MCU_WM_UNI_CMD_QUERY(EXT_EEPROM_CTRL);
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	ret = mt76_mcu_send_and_get_msg(&dev->mt76, cmd, &req,
++					sizeof(req), true, &skb);
+ 	if (ret)
+ 		return ret;
+ 
+-	valid = le32_to_cpu(*(__le32 *)(skb->data + 16));
+-	if (valid) {
+-		u32 addr = le32_to_cpu(*(__le32 *)(skb->data + 12));
+-
+-		if (!buf)
+-			buf = (u8 *)dev->mt76.eeprom.data + addr;
++	event = (struct mt7996_mcu_eeprom_access_event *)skb->data;
++	if (event->valid) {
++		u32 addr = le32_to_cpu(event->addr);
++		u32 ret_len = le32_to_cpu(event->eeprom.ext_eeprom.data_len);
+ 
+-		if (!buf_len || buf_len > MT7996_EEPROM_BLOCK_SIZE)
+-			buf_len = MT7996_EEPROM_BLOCK_SIZE;
++		switch (mode) {
++		case EFUSE_MODE:
++			if (!buf)
++				buf = (u8 *)dev->mt76.eeprom.data + addr;
++			if (!buf_len || buf_len > MT7996_EEPROM_BLOCK_SIZE)
++				buf_len = MT7996_EEPROM_BLOCK_SIZE;
+ 
+-		skb_pull(skb, 48);
+-		memcpy(buf, skb->data, buf_len);
++			memcpy(buf, event->eeprom.efuse, buf_len);
++			break;
++		case EXT_EEPROM_MODE:
++			if (!buf)
++				buf = (u8 *)dev->mt76.ext_eeprom.data + addr;
++			if (!buf_len || buf_len > MT7996_EXT_EEPROM_BLOCK_SIZE)
++				buf_len = MT7996_EXT_EEPROM_BLOCK_SIZE;
++
++			memcpy(buf, event->eeprom.ext_eeprom.data,
++			       ret_len < buf_len ? ret_len : buf_len);
++			break;
++		default:
++			ret = -EINVAL;
++			break;
++		}
+ 	} else {
+ 		ret = -EINVAL;
+ 	}
+@@ -5359,7 +5387,57 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_l
+ 	return ret;
+ }
+ 
+-int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num)
++int
++mt7996_mcu_write_ext_eeprom(struct mt7996_dev *dev, u32 offset,
++			    u32 data_len, u8 *write_buf)
++{
++	struct mt7996_mcu_eeprom_access req = {
++		.info.tag = cpu_to_le16(UNI_EXT_EEPROM_ACCESS),
++		.info.len = cpu_to_le16(sizeof(req) - 4 +
++					MT7996_EXT_EEPROM_BLOCK_SIZE),
++	};
++	u32 block_num, block_size = MT7996_EXT_EEPROM_BLOCK_SIZE;
++	u8 *buf = write_buf;
++	int i, ret = -EINVAL;
++	int msg_len = sizeof(req) + block_size;
++
++	if (!mt7996_has_ext_eeprom(dev))
++		return ret;
++
++	if (!buf)
++		buf = (u8 *)dev->mt76.eeprom.data + offset;
++
++	block_num = DIV_ROUND_UP(data_len, block_size);
++	for (i = 0; i < block_num; i++) {
++		struct sk_buff *skb;
++		u32 buf_len = block_size;
++		u32 block_offs = i * block_size;
++
++		if (block_offs + block_size > data_len)
++			buf_len = data_len % block_size;
++
++		req.info.addr = cpu_to_le32(offset + block_offs);
++		req.eeprom.ext_eeprom.data_len = cpu_to_le32(buf_len);
++
++		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, msg_len);
++		if (!skb)
++			return -ENOMEM;
++
++		skb_put_data(skb, &req, sizeof(req));
++		skb_put_data(skb, buf, buf_len);
++
++		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
++					    MCU_WM_UNI_CMD(EXT_EEPROM_CTRL), false);
++		if (ret)
++			return ret;
++
++		buf += buf_len;
++	}
++
++	return 0;
++}
++
++int mt7996_mcu_get_efuse_free_block(struct mt7996_dev *dev, u8 *block_num)
+ {
+ 	struct {
+ 		u8 _rsv[4];
+diff --git a/mt7996/mcu.h b/mt7996/mcu.h
+index 33ba3774..f405b0cd 100644
+--- a/mt7996/mcu.h
++++ b/mt7996/mcu.h
+@@ -161,7 +161,7 @@ struct mt7996_mcu_background_chain_ctrl {
+ 	u8 rsv[2];
+ } __packed;
+ 
+-struct mt7996_mcu_eeprom {
++struct mt7996_mcu_eeprom_update {
+ 	u8 _rsv[4];
+ 
+ 	__le16 tag;
+@@ -171,6 +171,14 @@ struct mt7996_mcu_eeprom {
+ 	__le16 buf_len;
+ } __packed;
+ 
++union eeprom_data {
++	struct {
++		__le32 data_len;
++		DECLARE_FLEX_ARRAY(u8, data);
++	} ext_eeprom;
++	DECLARE_FLEX_ARRAY(u8, efuse);
++} __packed;
++
+ struct mt7996_mcu_eeprom_info {
+ 	u8 _rsv[4];
+ 
+@@ -178,7 +186,26 @@ struct mt7996_mcu_eeprom_info {
+ 	__le16 len;
+ 	__le32 addr;
+ 	__le32 valid;
+-	u8 data[MT7996_EEPROM_BLOCK_SIZE];
++} __packed;
++
++struct mt7996_mcu_eeprom_access {
++	struct mt7996_mcu_eeprom_info info;
++	union eeprom_data eeprom;
++} __packed;
++
++struct mt7996_mcu_eeprom_access_event {
++	u8 _rsv[4];
++
++	__le16 tag;
++	__le16 len;
++	__le32 version;
++	__le32 addr;
++	__le32 valid;
++	__le32 size;
++	__le32 magic_no;
++	__le32 type;
++	__le32 rsv[4];
++	union eeprom_data eeprom;
+ } __packed;
+ 
+ struct mt7996_mcu_phy_rx_info {
+@@ -1091,6 +1118,10 @@ enum {
+ 	UNI_EFUSE_PATCH,
+ };
+ 
++enum {
++	UNI_EXT_EEPROM_ACCESS = 1,
++};
++
+ enum {
+ 	UNI_VOW_DRR_CTRL,
+ 	UNI_VOW_FEATURE_CTRL,
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index b841cc2a..a0f2f251 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -74,7 +74,8 @@
+ #define MT7992_EEPROM_DEFAULT_24	"mediatek/mt7996/mt7992_eeprom_24_2i5i.bin"
+ 
+ #define MT7996_EEPROM_SIZE		7680
+-#define MT7996_EEPROM_BLOCK_SIZE	16
++#define MT7996_EEPROM_BLOCK_SIZE		16
++#define MT7996_EXT_EEPROM_BLOCK_SIZE	1024
+ #define MT7996_TOKEN_SIZE		16384
+ #define MT7996_HW_TOKEN_SIZE		8192
+ #define MT7996_SW_TOKEN_SIZE		15360
+@@ -171,6 +172,14 @@ enum mt7996_fem_type {
+ 	MT7996_FEM_MIX,
+ };
+ 
++enum mt7996_eeprom_mode {
++	DEFAULT_BIN_MODE,
++	EFUSE_MODE,
++	FLASH_MODE,
++	BIN_FILE_MODE,
++	EXT_EEPROM_MODE,
++};
++
+ enum mt7996_coredump_state {
+ 	MT7996_COREDUMP_IDLE = 0,
+ 	MT7996_COREDUMP_MANUAL_WA,
+@@ -973,6 +982,18 @@ mt7996_has_background_radar(struct mt7996_dev *dev)
+ 	return true;
+ }
+ 
++static inline bool
++mt7996_has_ext_eeprom(struct mt7996_dev *dev)
++{
++	switch (mt76_chip(&dev->mt76)) {
++	case 0x7990:
++		return false;
++	case 0x7992:
++	default:
++		return true;
++	}
++}
++
+ static inline struct mt7996_phy *
+ mt7996_band_phy(struct ieee80211_hw *hw, enum nl80211_band band)
+ {
+@@ -1154,8 +1175,11 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
+ 			       struct mt7996_link_sta *mlink, void *data,
+ 			       u32 field);
+ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev);
+-int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len);
+-int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num);
++int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len,
++			  enum mt7996_eeprom_mode mode);
++int mt7996_mcu_get_efuse_free_block(struct mt7996_dev *dev, u8 *block_num);
++int mt7996_mcu_write_ext_eeprom(struct mt7996_dev *dev, u32 offset,
++				u32 data_len, u8 *write_buf);
+ int mt7996_mcu_get_chip_config(struct mt7996_dev *dev, u32 *cap);
+ int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 set, u8 band);
+ int mt7996_mcu_set_txbf(struct mt7996_dev *dev, u8 action);
+diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
+index 5338d0bd..4996774f 100644
+--- a/mt7996/mtk_debugfs.c
++++ b/mt7996/mtk_debugfs.c
+@@ -2829,6 +2829,9 @@ static int mt7996_show_eeprom_mode(struct seq_file *s, void *data)
+ 	case BIN_FILE_MODE:
+ 		seq_printf(s, "   bin file mode\n   filename = %s\n", dev->mt76.bin_file_name);
+ 		break;
++	case EXT_EEPROM_MODE:
++		seq_printf(s, "   external eeprom mode\n");
++		break;
+ 	default:
+ 		break;
+ 	}
+diff --git a/mt7996/testmode.c b/mt7996/testmode.c
+index 1674e129..b3692637 100644
+--- a/mt7996/testmode.c
++++ b/mt7996/testmode.c
+@@ -2138,37 +2138,43 @@ mt7996_tm_write_back_to_efuse(struct mt7996_dev *dev)
+ {
+ 	struct mt7996_mcu_eeprom_info req = {
+ 		.tag = cpu_to_le16(UNI_EFUSE_ACCESS),
+-		.len = cpu_to_le16(sizeof(req) - 4),
++		.len = cpu_to_le16(sizeof(req) - 4 +
++				   MT76_TM_EEPROM_BLOCK_SIZE),
+ 	};
+ 	u8 read_buf[MT76_TM_EEPROM_BLOCK_SIZE], *eeprom = dev->mt76.eeprom.data;
++	int msg_len = sizeof(req) + MT76_TM_EEPROM_BLOCK_SIZE;
+ 	int i, ret = -EINVAL;
+ 
+ 	/* prevent from damaging chip id in efuse */
+ 	if (mt76_chip(&dev->mt76) != get_unaligned_le16(eeprom))
+-		goto out;
++		return ret;
+ 
+ 	for (i = 0; i < MT7996_EEPROM_SIZE; i += MT76_TM_EEPROM_BLOCK_SIZE) {
+-		req.addr = cpu_to_le32(i);
+-		memcpy(req.data, eeprom + i, MT76_TM_EEPROM_BLOCK_SIZE);
++		struct sk_buff *skb;
+ 
+-		ret = mt7996_mcu_get_eeprom(dev, i, read_buf, sizeof(read_buf));
+-		if (ret) {
+-			if (ret != -EINVAL)
+-				return ret;
+-
+-			memset(read_buf, 0, MT76_TM_EEPROM_BLOCK_SIZE);
+-		}
++		memset(read_buf, 0, MT76_TM_EEPROM_BLOCK_SIZE);
++		ret = mt7996_mcu_get_eeprom(dev, i, read_buf, sizeof(read_buf),
++					    EFUSE_MODE);
++		if (ret && ret != -EINVAL)
++			return ret;
+ 
+-		if (!memcmp(req.data, read_buf, MT76_TM_EEPROM_BLOCK_SIZE))
++		if (!memcmp(eeprom + i, read_buf, MT76_TM_EEPROM_BLOCK_SIZE))
+ 			continue;
+ 
+-		ret = mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(EFUSE_CTRL),
+-					&req, sizeof(req), true);
++		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, msg_len);
++		if (!skb)
++			return -ENOMEM;
++
++		req.addr = cpu_to_le32(i);
++		skb_put_data(skb, &req, sizeof(req));
++		skb_put_data(skb, eeprom + i, MT76_TM_EEPROM_BLOCK_SIZE);
++
++		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
++					    MCU_WM_UNI_CMD(EFUSE_CTRL), true);
+ 		if (ret)
+ 			return ret;
+ 	}
+ 
+-out:
+ 	return ret;
+ }
+ 
+@@ -2193,6 +2199,9 @@ mt7996_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
+ 	case MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE:
+ 		ret = mt7996_tm_write_back_to_efuse(dev);
+ 		break;
++	case MT76_TM_EEPROM_ACTION_WRITE_TO_EXT_EEPROM:
++		ret = mt7996_mcu_write_ext_eeprom(dev, 0, MT7996_EEPROM_SIZE, NULL);
++		break;
+ 	default:
+ 		break;
+ 	}
+diff --git a/testmode.h b/testmode.h
+index 44f9984c..8e751bbf 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -281,11 +281,13 @@ enum mt76_testmode_tx_mode {
+  *	eeprom data block
+  * @MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE: send updated eeprom data to fw
+  * @MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE: write eeprom data back to efuse
++ * @MT76_TM_EEPROM_ACTION_WRITE_TO_EXT_EEPROM: write eeprom data back to external eeprom
+  */
+ enum mt76_testmode_eeprom_action {
+ 	MT76_TM_EEPROM_ACTION_UPDATE_DATA,
+ 	MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE,
+ 	MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE,
++	MT76_TM_EEPROM_ACTION_WRITE_TO_EXT_EEPROM,
+ 
+ 	/* keep last */
+ 	NUM_MT76_TM_EEPROM_ACTION,
+-- 
+2.45.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0190-mtk-mt76-mt7996-add-efuse-write-protection.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0190-mtk-mt76-mt7996-add-efuse-write-protection.patch
new file mode 100644
index 0000000..72a2d92
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0190-mtk-mt76-mt7996-add-efuse-write-protection.patch
@@ -0,0 +1,271 @@
+From 617b4824df541129e545daa0015d43d2e625350b Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 29 Aug 2024 09:47:44 +0800
+Subject: [PATCH 190/223] mtk: mt76: mt7996: add efuse write protection
+
+Add efuse write protection in case that the user overwritten
+the FT value stored in efuse.
+Reference change list (Logan):
+https://gerrit.mediatek.inc/c/neptune/wlan_driver/logan/+/9473737
+https://gerrit.mediatek.inc/c/neptune/wlan_driver/logan/+/9497426
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Change-Id: If50d6965da8d9488d44c9da77a4bfca9906da9bc
+---
+ mt7996/mcu.c      |  11 +---
+ mt7996/mt7996.h   |  23 ++++++++
+ mt7996/testmode.c | 135 ++++++++++++++++++++++++++++++++++++++++++----
+ mt7996/testmode.h |   6 +++
+ 4 files changed, 157 insertions(+), 18 deletions(-)
+
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 01969464..b27b74d3 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -5115,13 +5115,6 @@ static int mt7996_mcu_set_cal_free_data(struct mt7996_dev *dev)
+ #define MT_EE_CAL_FREE_MAX_SIZE		30
+ #define MT_EE_7977BN_OFFSET		(0x1200 - 0x500)
+ #define MT_EE_END_OFFSET		0xffff
+-	enum adie_type {
+-		ADIE_7975,
+-		ADIE_7976,
+-		ADIE_7977,
+-		ADIE_7978,
+-		ADIE_7979,
+-	};
+ 	static const u16 adie_offs_list[][MT_EE_CAL_FREE_MAX_SIZE] = {
+ 		[ADIE_7975] = {0x5cd, 0x5cf, 0x5d1, 0x5d3, 0x6c0, 0x6c1, 0x6c2, 0x6c3,
+ 			       0x7a1, 0x7a6, 0x7a8, 0x7aa, -1},
+@@ -5151,10 +5144,10 @@ static int mt7996_mcu_set_cal_free_data(struct mt7996_dev *dev)
+ 			       0x127a, 0x127b, 0x127c, 0x127e, 0x1280, -1},
+ 	};
+ 	static const u16 adie_base_7996[] = {
+-		0x400, 0x1e00, 0x1200
++		EFUSE_BASE_OFFS_ADIE0, EFUSE_BASE_OFFS_ADIE1, EFUSE_BASE_OFFS_ADIE2
+ 	};
+ 	static const u16 adie_base_7992[] = {
+-		0x400, 0x1200, 0x0
++		EFUSE_BASE_OFFS_ADIE0, EFUSE_BASE_OFFS_ADIE1_7992, 0x0
+ 	};
+ 	static const u16 *adie_offs[__MT_MAX_BAND];
+ 	static const u16 *eep_offs[__MT_MAX_BAND];
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index a0f2f251..592b3673 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -180,6 +180,29 @@ enum mt7996_eeprom_mode {
+ 	EXT_EEPROM_MODE,
+ };
+ 
++enum mt7996_ddie_type {
++	DDIE_7996,
++	DDIE_7992,
++	DDIE_TYPE_NUM,
++};
++
++enum mt7996_adie_type {
++	ADIE_7975,
++	ADIE_7976,
++	ADIE_7977,
++	ADIE_7978,
++	ADIE_7979,
++	ADIE_TYPE_NUM,
++};
++
++enum mt7996_efuse_base_offs {
++	EFUSE_BASE_OFFS_DDIE = 0x0,
++	EFUSE_BASE_OFFS_ADIE0 = 0x400,
++	EFUSE_BASE_OFFS_ADIE2 = 0x1200,
++	EFUSE_BASE_OFFS_ADIE1_7992 = 0x1200,
++	EFUSE_BASE_OFFS_ADIE1 = 0x1e00,
++};
++
+ enum mt7996_coredump_state {
+ 	MT7996_COREDUMP_IDLE = 0,
+ 	MT7996_COREDUMP_MANUAL_WA,
+diff --git a/mt7996/testmode.c b/mt7996/testmode.c
+index b3692637..6f9900a6 100644
+--- a/mt7996/testmode.c
++++ b/mt7996/testmode.c
+@@ -2133,6 +2133,127 @@ mt7996_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+ 	return 0;
+ }
+ 
++static bool
++mt7996_tm_efuse_update_is_valid(struct mt7996_dev *dev, u32 offset, u8 *write_buf)
++{
++#define PROT_OFFS_MAX_SIZE	8
++#define EFUSE_PROT_END_OFFSET	0xffff
++#define EFUSE_PROT_ALL_MASK	GENMASK(15, 0)
++	static const struct efuse_region ddie_prot_offs[][PROT_OFFS_MAX_SIZE] = {
++		[DDIE_7996] = {{.start = 0x10, .end = 0x18f, .prot_mask = -1},
++			       {.start = 0x1b0, .end = 0x2bf, .prot_mask = -1},
++			       {.start = 0x2c0, .end = 0x2cf, .prot_mask = GENMASK(15, 6)},
++			       {.start = 0x2d0, .end = 0x2ff, .prot_mask = -1},
++			       {.start = 0x300, .end = 0x30f, .prot_mask = GENMASK(15, 1)},
++			       {.start = 0x310, .end = 0x31f, .prot_mask = GENMASK(15, 1)},
++			       {.start = 0x320, .end = 0x3ff, .prot_mask = -1},
++			       {.start = -1}},
++		[DDIE_7992] = {{.start = 0x10, .end = 0x18f, .prot_mask = -1},
++			       {.start = 0x1b0, .end = 0x3ff, .prot_mask = -1},
++			       {.start = -1}},
++	};
++	static const struct efuse_region adie_prot_offs[][PROT_OFFS_MAX_SIZE] = {
++		[ADIE_7975] = {{.start = 0x5c0, .end = 0x62f, .prot_mask = -1},
++			       {.start = 0x6c0, .end = 0x6ff, .prot_mask = -1},
++			       {.start = 0x7a0, .end = 0x7af, .prot_mask = BIT(1) | BIT(9)},
++			       {.start = 0x7b0, .end = 0x7bf, .prot_mask = -1},
++			       {.start = -1}},
++		[ADIE_7976] = {{.start = 0x0, .end = 0x7f, .prot_mask = -1},
++			       {.start = 0x790, .end = 0x79f,
++				.prot_mask = GENMASK(15, 10) | GENMASK(8, 0)},
++			       {.start = 0x7a0, .end = 0x7af,
++				.prot_mask = BIT(6) | BIT(8) | BIT(10)},
++			       {.start = 0x7b0, .end = 0x7bf, .prot_mask = -1},
++			       {.start = -1}},
++		[ADIE_7977] = {{.start = 0x0, .end = 0x5f, .prot_mask = -1},
++			       {.start = 0x60, .end = 0x6f, .prot_mask = GENMASK(14, 0)},
++			       {.start = 0x70, .end = 0x7f,
++				.prot_mask = GENMASK(15, 14) | GENMASK(12, 0)},
++			       {.start = 0x80, .end = 0x10f, .prot_mask = -1},
++			       {.start = -1}},
++	};
++	static const struct efuse_region *prot_offs;
++	u8 read_buf[MT76_TM_EEPROM_BLOCK_SIZE], *eeprom = dev->mt76.eeprom.data;
++	int ret, i = 0;
++	u16 base;
++
++	if (!write_buf)
++		return false;
++
++	memset(read_buf, 0, MT76_TM_EEPROM_BLOCK_SIZE);
++	ret = mt7996_mcu_get_eeprom(dev, offset, read_buf,
++				    MT76_TM_EEPROM_BLOCK_SIZE, EFUSE_MODE);
++	if (ret && ret != -EINVAL)
++		return false;
++
++	/* no change in this block, so skip it */
++	if (!memcmp(eeprom + offset, read_buf, MT76_TM_EEPROM_BLOCK_SIZE))
++		return false;
++
++	memcpy(write_buf, eeprom + offset, MT76_TM_EEPROM_BLOCK_SIZE);
++
++	switch (mt76_chip(&dev->mt76)) {
++	case 0x7990:
++		if (offset < EFUSE_BASE_OFFS_ADIE0) {
++			base = EFUSE_BASE_OFFS_DDIE;
++			prot_offs = ddie_prot_offs[DDIE_7996];
++		} else if (offset >= EFUSE_BASE_OFFS_ADIE0 &&
++			   offset < EFUSE_BASE_OFFS_ADIE2) {
++			base = EFUSE_BASE_OFFS_ADIE0;
++			if (dev->chip_sku == MT7996_VAR_TYPE_233 ||
++			    dev->fem_type == MT7996_FEM_EXT)
++				prot_offs = adie_prot_offs[ADIE_7976];
++			else
++				prot_offs = adie_prot_offs[ADIE_7975];
++		} else if (offset >= EFUSE_BASE_OFFS_ADIE2 &&
++			   offset < EFUSE_BASE_OFFS_ADIE1) {
++			base = EFUSE_BASE_OFFS_ADIE2;
++			prot_offs = adie_prot_offs[ADIE_7977];
++		} else {
++			base = EFUSE_BASE_OFFS_ADIE1;
++			prot_offs = adie_prot_offs[ADIE_7977];
++		}
++		break;
++	case 0x7992:
++		/* block all the adie region in efuse for kite */
++		if (offset >= EFUSE_BASE_OFFS_ADIE0)
++			return false;
++		base = EFUSE_BASE_OFFS_DDIE;
++		prot_offs = ddie_prot_offs[DDIE_7992];
++		break;
++	default:
++		return false;
++	}
++
++	/* check efuse protection */
++	while (prot_offs[i].start != EFUSE_PROT_END_OFFSET) {
++		if (offset >= prot_offs[i].start + base &&
++		    offset <= prot_offs[i].end + base) {
++			unsigned long prot_mask = prot_offs[i].prot_mask;
++			int j;
++
++			if (prot_mask == EFUSE_PROT_ALL_MASK)
++				return false;
++
++			for_each_set_bit(j, &prot_mask, MT76_TM_EEPROM_BLOCK_SIZE) {
++				if (write_buf[j] != read_buf[j]) {
++					write_buf[j] = read_buf[j];
++					dev_warn(dev->mt76.dev,
++						 "offset %x is invalid to write\n",
++						 offset + j);
++				}
++			}
++			break;
++		}
++		i++;
++	}
++
++	if (!memcmp(read_buf, write_buf, MT76_TM_EEPROM_BLOCK_SIZE))
++		return false;
++
++	return true;
++}
++
+ static int
+ mt7996_tm_write_back_to_efuse(struct mt7996_dev *dev)
+ {
+@@ -2141,8 +2262,9 @@ mt7996_tm_write_back_to_efuse(struct mt7996_dev *dev)
+ 		.len = cpu_to_le16(sizeof(req) - 4 +
+ 				   MT76_TM_EEPROM_BLOCK_SIZE),
+ 	};
+-	u8 read_buf[MT76_TM_EEPROM_BLOCK_SIZE], *eeprom = dev->mt76.eeprom.data;
+ 	int msg_len = sizeof(req) + MT76_TM_EEPROM_BLOCK_SIZE;
++	u8 *eeprom = dev->mt76.eeprom.data;
++	u8 write_buf[MT76_TM_EEPROM_BLOCK_SIZE];
+ 	int i, ret = -EINVAL;
+ 
+ 	/* prevent from damaging chip id in efuse */
+@@ -2152,13 +2274,8 @@ mt7996_tm_write_back_to_efuse(struct mt7996_dev *dev)
+ 	for (i = 0; i < MT7996_EEPROM_SIZE; i += MT76_TM_EEPROM_BLOCK_SIZE) {
+ 		struct sk_buff *skb;
+ 
+-		memset(read_buf, 0, MT76_TM_EEPROM_BLOCK_SIZE);
+-		ret = mt7996_mcu_get_eeprom(dev, i, read_buf, sizeof(read_buf),
+-					    EFUSE_MODE);
+-		if (ret && ret != -EINVAL)
+-			return ret;
+-
+-		if (!memcmp(eeprom + i, read_buf, MT76_TM_EEPROM_BLOCK_SIZE))
++		memset(write_buf, 0, MT76_TM_EEPROM_BLOCK_SIZE);
++		if (!mt7996_tm_efuse_update_is_valid(dev, i, write_buf))
+ 			continue;
+ 
+ 		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, msg_len);
+@@ -2167,7 +2284,7 @@ mt7996_tm_write_back_to_efuse(struct mt7996_dev *dev)
+ 
+ 		req.addr = cpu_to_le32(i);
+ 		skb_put_data(skb, &req, sizeof(req));
+-		skb_put_data(skb, eeprom + i, MT76_TM_EEPROM_BLOCK_SIZE);
++		skb_put_data(skb, write_buf, MT76_TM_EEPROM_BLOCK_SIZE);
+ 
+ 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
+ 					    MCU_WM_UNI_CMD(EFUSE_CTRL), true);
+diff --git a/mt7996/testmode.h b/mt7996/testmode.h
+index 5c720da7..154392dc 100644
+--- a/mt7996/testmode.h
++++ b/mt7996/testmode.h
+@@ -363,4 +363,10 @@ struct mt7996_tm_rdd_ipi_ctrl {
+ 	__le32 tx_assert_time;		/* unit: us */
+ } __packed;
+ 
++struct efuse_region {
++	u16 start;
++	u16 end;
++	u16 prot_mask;
++};
++
+ #endif
+-- 
+2.45.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0191-mtk-mt76-mt7996-fix-the-capability-of-reception-of-E.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0191-mtk-mt76-mt7996-fix-the-capability-of-reception-of-E.patch
new file mode 100644
index 0000000..d5c42df
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0191-mtk-mt76-mt7996-fix-the-capability-of-reception-of-E.patch
@@ -0,0 +1,49 @@
+From eaaf030c560747704321c51c00e275da3d7a8217 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Tue, 3 Sep 2024 15:36:56 +0800
+Subject: [PATCH 191/223] mtk: mt76: mt7996: fix the capability of reception of
+ EHT MU PPDU
+
+This commit includes two changes. First, enable "EHT MU PPDU With 4x
+EHT-LTF And 0.8us GI" in EHT Phy capabilities element since hardware
+can support. Second, fix the value of "Maximum number of supported
+EHT LTFs" in the same element, where the previous setting of 3 in
+Bit 3-4 was incorrect.
+
+Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
+
+---
+ mt7996/init.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/mt7996/init.c b/mt7996/init.c
+index f739afd2..2db4b3b5 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -1636,21 +1636,20 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
+ 		IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK;
+ 
+ 	eht_cap_elem->phy_cap_info[4] =
++		IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
+ 		u8_encode_bits(min_t(int, sts - 1, 2),
+ 			       IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK);
+ 
+ 	eht_cap_elem->phy_cap_info[5] =
+ 		u8_encode_bits(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US,
+ 			       IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK) |
+-		u8_encode_bits(u8_get_bits(0x11, GENMASK(1, 0)),
++		u8_encode_bits(u8_get_bits(1, GENMASK(1, 0)),
+ 			       IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK);
+ 
+ 	val = width == NL80211_CHAN_WIDTH_320 ? 0xf :
+ 	      width == NL80211_CHAN_WIDTH_160 ? 0x7 :
+ 	      width == NL80211_CHAN_WIDTH_80 ? 0x3 : 0x1;
+ 	eht_cap_elem->phy_cap_info[6] =
+-		u8_encode_bits(u8_get_bits(0x11, GENMASK(4, 2)),
+-			       IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK) |
+ 		u8_encode_bits(val, IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK);
+ 
+ 	val = u8_encode_bits(nss, IEEE80211_EHT_MCS_NSS_RX) |
+-- 
+2.45.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0191-mtk-mt76-sync-with-upstream-changes.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0191-mtk-mt76-sync-with-upstream-changes.patch
deleted file mode 100644
index 5b27fbc..0000000
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0191-mtk-mt76-sync-with-upstream-changes.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From ae1bd00dbac3464137f2f595b935babc3bea0137 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Wed, 31 Jul 2024 11:19:53 +0800
-Subject: [PATCH 191/199] mtk: mt76: sync with upstream changes
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- mt7996/main.c | 2 +-
- mt7996/mcu.c  | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/mt7996/main.c b/mt7996/main.c
-index 4b48a870..59353603 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -153,7 +153,7 @@ static int mt7996_start(struct ieee80211_hw *hw)
- 	return ret;
- }
- 
--static void mt7996_stop(struct ieee80211_hw *hw)
-+static void mt7996_stop(struct ieee80211_hw *hw, bool suspend)
- {
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	int band;
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 0439157c..03c671f6 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -421,7 +421,7 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
- 						&dev->rdd2_chandef,
- 						GFP_ATOMIC);
- 	} else {
--		ieee80211_radar_detected(mphy->hw);
-+		ieee80211_radar_detected(mphy->hw, NULL);
- 	}
- 	dev->hw_pattern++;
- }
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0192-mtk-mt76-mt7996-fix-HE-Phy-capability.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0192-mtk-mt76-mt7996-fix-HE-Phy-capability.patch
new file mode 100644
index 0000000..a9f0fad
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0192-mtk-mt76-mt7996-fix-HE-Phy-capability.patch
@@ -0,0 +1,41 @@
+From d46fc9a7335c94d5be16414e8898122d23c74b47 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Wed, 4 Sep 2024 13:44:32 +0800
+Subject: [PATCH 192/223] mtk: mt76: mt7996: fix HE Phy capability
+
+Set HE SU PPDU And HE MU PPDU With 4x HE-LTF And 0.8 us GI within HE PHY
+Capabilities element as 1 since hardware can support.
+
+Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
+
+---
+ mt7996/init.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/mt7996/init.c b/mt7996/init.c
+index 2db4b3b5..6c8a9b48 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -1477,6 +1477,9 @@ mt7996_init_he_caps(struct mt7996_phy *phy, enum nl80211_band band,
+ 	he_cap_elem->phy_cap_info[2] = IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
+ 				       IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ;
+ 
++	he_cap_elem->phy_cap_info[7] =
++			IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI;
++
+ 	switch (iftype) {
+ 	case NL80211_IFTYPE_AP:
+ 		he_cap_elem->mac_cap_info[0] |= IEEE80211_HE_MAC_CAP0_TWT_RES;
+@@ -1516,8 +1519,7 @@ mt7996_init_he_caps(struct mt7996_phy *phy, enum nl80211_band band,
+ 			IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE |
+ 			IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT;
+ 		he_cap_elem->phy_cap_info[7] |=
+-			IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP |
+-			IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI;
++			IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP;
+ 		he_cap_elem->phy_cap_info[8] |=
+ 			IEEE80211_HE_PHY_CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G |
+ 			IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU |
+-- 
+2.45.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0193-mtk-mt76-mt7996-fix-potential-crash-issue-in-mt7996_.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0193-mtk-mt76-mt7996-fix-potential-crash-issue-in-mt7996_.patch
new file mode 100644
index 0000000..089bba0
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0193-mtk-mt76-mt7996-fix-potential-crash-issue-in-mt7996_.patch
@@ -0,0 +1,31 @@
+From e70e972add40eb5db6463cf156ae19b8dc9bc67c Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Thu, 5 Sep 2024 15:46:10 +0800
+Subject: [PATCH 193/223] mtk: mt76: mt7996: fix potential crash issue in
+ mt7996_tx_prepare_skb()
+
+This commit aims to fix potential NULL pointer issue of sta, especially
+when the sta keeps conencting and disconneting.
+
+Change-Id: I4407e2b39dd75f161c9cf4d93c652949ca9ddcf6
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7996/mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mt7996/mac.c b/mt7996/mac.c
+index 5d40b8f1..b6980584 100644
+--- a/mt7996/mac.c
++++ b/mt7996/mac.c
+@@ -947,7 +947,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	}
+ 
+ 	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mvif->sta;
+-	if (ieee80211_is_data_qos(hdr->frame_control) && sta->mlo) {
++	if ((is_8023 || ieee80211_is_data_qos(hdr->frame_control)) && sta && sta->mlo) {
+ 		if (unlikely(tx_info->skb->protocol == cpu_to_be16(ETH_P_PAE))) {
+ 			link_id = msta->pri_link;
+ 		} else {
+-- 
+2.45.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0194-mtk-mt76-mt7996-Fix-call-trace-happened-when-wed-att.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0194-mtk-mt76-mt7996-Fix-call-trace-happened-when-wed-att.patch
new file mode 100644
index 0000000..3c5755d
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0194-mtk-mt76-mt7996-Fix-call-trace-happened-when-wed-att.patch
@@ -0,0 +1,33 @@
+From eccfceec92bda3da9fa815c1ec55b1c74a0f3254 Mon Sep 17 00:00:00 2001
+From: Rex Lu <rex.lu@mediatek.com>
+Date: Fri, 6 Sep 2024 15:32:05 +0800
+Subject: [PATCH 194/223] mtk: mt76: mt7996: Fix call trace happened when wed
+ attach fail
+
+1. when we attech wed0 fail, we will not going to attach wed1
+
+Signed-off-by: Rex Lu <rex.lu@mediatek.com>
+---
+ mt7996/mmio.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/mt7996/mmio.c b/mt7996/mmio.c
+index c84c1bbb..8eff971d 100644
+--- a/mt7996/mmio.c
++++ b/mt7996/mmio.c
+@@ -449,8 +449,11 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+ 		wed->wlan.reset_complete = mt76_wed_reset_complete;
+ 	}
+ 
+-	if (mtk_wed_device_attach(wed))
++	if (mtk_wed_device_attach(wed)) {
++		wed_enable = false;
++		dev->has_rro = false;
+ 		return 0;
++	}
+ 
+ 	*irq = wed->irq;
+ 	dev->mt76.dma_dev = wed->dev;
+-- 
+2.45.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
index 4654ec4..4017397 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
@@ -1,202 +1,197 @@
 #patch patches (come from openwrt/lede/target/linux/mediatek)
 SRC_URI_append = " \
     file://0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch \
-    file://0002-mtk-mt76-mt7996-use-hweight16-to-get-correct-tx_ant.patch \
-    file://0003-mtk-mt76-mt7996-fix-MBSS.patch \
-    file://0004-mtk-mt76-mt7996-fix-HE-and-EHT-phy-cap.patch \
-    file://0005-mtk-mt76-mt7996-adjust-Beamformee-SS-capability.patch \
-    file://0006-mtk-mt76-mt7996-add-support-for-IEEE-802.11-fragment.patch \
-    file://0007-mtk-mt76-mt7996-set-rx-path-when-channel-switch.patch \
-    file://0008-mtk-mt76-mt7996-set-station-s-wmm-index-to-3.patch \
-    file://0009-mtk-mt76-mt7996-fix-rxd-checksum-offload-offset.patch \
-    file://0010-mtk-mt76-mt7996-fix-EHT-Beamforming-capability-check.patch \
-    file://0011-mtk-mt76-mt7996-fix-amsdu-information.patch \
-    file://0012-mtk-mt76-mt7996-add-beacon_int_min_gcd-to-support-di.patch \
-    file://0013-mtk-mt76-adjust-beamform-mcu-cmd-configuration-for-m.patch \
-    file://0014-mtk-mt76-mt7996-add-preamble-puncture-support-for-mt.patch \
-    file://0015-mtk-mt76-mt7996-add-driver-support-for-wpa3-ocv-and-.patch \
-    file://0016-mtk-mt76-mt7996-enable-ser-query.patch \
-    file://0017-mtk-mt76-mt7996-set-key-flag-IEEE80211_KEY_FLAG_GENE.patch \
-    file://0018-mtk-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch \
-    file://0019-mtk-mt76-mt7996-add-support-for-different-variants.patch \
-    file://0020-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch \
-    file://0021-mtk-mt76-mt7996-Fixed-null-pointer-dereference-issue.patch \
-    file://0022-mtk-mt76-add-sanity-check-to-prevent-kernel-crash.patch \
-    file://0023-mtk-mt76-mt7996-add-firmware-WA-s-coredump.patch \
-    file://0024-mtk-mt76-mt7996-for-build-pass.patch \
-    file://0025-mtk-mt76-mt7996-add-debug-tool.patch \
-    file://0026-mtk-mt76-mt7996-add-check-for-hostapd-config-he_ldpc.patch \
-    file://0027-mtk-mt76-mt7996-add-basic-testmode-support.patch \
-    file://0028-mtk-mt76-mt7996-add-testmode-pre-calibration-support.patch \
-    file://0029-mtk-mt76-mt7996-add-normal-mode-pre-calibration-supp.patch \
-    file://0030-mtk-mt76-mt7996-enable-SCS-feature-for-mt7996-driver.patch \
-    file://0031-mtk-mt76-mt7996-add-txpower-support.patch \
-    file://0032-mtk-mt76-mt7996-add-binfile-mode-support.patch \
-    file://0033-mtk-mt76-mt7996-add-testmode-ZWDFS-verification-supp.patch \
-    file://0034-mtk-mt76-mt7996-support-eagle-ZWDFS-on-iFEM.patch \
-    file://0035-mtk-mt76-mt7996-refactor-eeprom-loading-flow-for-sku.patch \
-    file://0036-mtk-mt76-mt7996-add-vendor-commands-support.patch \
-    file://0037-mtk-mt76-mt7996-add-debugfs-for-fw-coredump.patch \
-    file://0038-mtk-mt76-mt7996-Add-mt7992-coredump-support.patch \
-    file://0039-mtk-mt76-mt7996-add-support-for-runtime-set-in-band-.patch \
-    file://0040-mtk-mt76-mt7996-add-support-spatial-reuse-debug-comm.patch \
-    file://0041-mtk-mt76-mt7996-Establish-BA-in-VO-queue.patch \
-    file://0042-mtk-mt76-mt7996-report-tx-and-rx-byte-to-tpt_led.patch \
-    file://0043-mtk-mt76-mt7996-support-dup-wtbl.patch \
-    file://0044-mtk-mt76-try-more-times-when-send-message-timeout.patch \
-    file://0045-mtk-mt76-mt7996-add-SER-overlap-handle.patch \
-    file://0046-mtk-mt76-mt7996-kite-default-1-pcie-setting.patch \
-    file://0047-mtk-mt76-mt7996-support-BF-MIMO-debug-commands.patch \
-    file://0048-mtk-mt76-mt7996-add-build-the-following-MURU-mcu-com.patch \
-    file://0049-mtk-mt76-mt7996-add-cert-patch.patch \
-    file://0050-mtk-mt76-mt7996-add-testmode-bf-support.patch \
-    file://0051-mtk-mt76-mt7996-add-zwdfs-cert-mode.patch \
-    file://0052-mtk-mt76-mt7996-add-channel-68-96.patch \
-    file://0053-mtk-mt76-mt7996-add-kite-testmode-support.patch \
-    file://0054-mtk-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for-CERT.patch \
-    file://0055-mtk-mt76-mt7996-add-no_beacon-vendor-command-for-cer.patch \
-    file://0056-mtk-mt76-mt7996-add-adie-efuse-merge-support.patch \
-    file://0057-mtk-mt76-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch \
-    file://0058-mtk-mt76-mt7996-add-background-radar-hw-cap-check.patch \
-    file://0059-mtk-mt76-mt7996-add-fallback-in-case-of-missing-prec.patch \
-    file://0060-mtk-mt76-mt7996-add-kite-part-number-support.patch \
-    file://0061-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch \
-    file://0062-mtk-mt76-rework-wed-rx-flow.patch \
-    file://0063-mtk-mt76-change-wed-token-init-size-to-adapt-wed3.0.patch \
-    file://0064-mtk-mt76-add-random-early-drop-support.patch \
-    file://0065-mtk-mt76-mt7996-reset-addr_elem-when-delete-ba.patch \
-    file://0066-mtk-mt76-change-pcie0-R5-to-pcie1-to-get-6G-ICS.patch \
-    file://0067-mtk-mt76-add-SER-support-for-wed3.0.patch \
-    file://0068-mtk-mt76-find-rx-token-by-physical-address.patch \
-    file://0069-mtk-mt76-mt7996-add-dma-mask-limitation.patch \
-    file://0070-mtk-mt76-mt7996-add-per-bss-statistic-info.patch \
-    file://0071-mtk-mt76-mt7996-do-not-report-netdev-stats-on-monito.patch \
-    file://0072-mtk-mt76-mt7996-add-support-for-HW-ATF.patch \
-    file://0073-mtk-mt76-mt7996-add-SER0.5-support-w-wed3.0.patch \
-    file://0074-mtk-mt76-mt7996-support-backaward-compatiable.patch \
-    file://0075-mtk-mt76-mt7996-add-wed-support-for-mt7992.patch \
-    file://0076-mtk-mt76-add-2pcie-one-wed-support.patch \
-    file://0077-mtk-mt76-mt7996-Remove-wed-rro-ring-add-napi-at-init.patch \
-    file://0078-mtk-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch \
-    file://0079-mtk-mt76-mt7996-Refactor-rro-del-ba-command-format.patch \
-    file://0080-mtk-mt76-mt7996-get-airtime-and-RSSI-via-MCU-command.patch \
-    file://0081-mtk-mt76-mt7996-add-support-for-WMM-PBC-configuratio.patch \
-    file://0082-mtk-mt76-mt7996-eagle-support-extra-option_type.patch \
-    file://0083-mtk-mt76-mt7996-support-enable-disable-thermal-prote.patch \
-    file://0084-mtk-mt76-mt7996-support-thermal-recal-debug-command.patch \
-    file://0085-mtk-mt76-mt7996-add-kite-two-pcie-with-two-wed-suppo.patch \
-    file://0086-mtk-mt76-add-support-to-enable-index-FW-log-for-Cons.patch \
-    file://0087-mtk-mt76-mt7996-implement-and-switch-to-hw-scan-call.patch \
-    file://0088-mtk-mt76-mt7996-implement-and-switch-to-chanctx-call.patch \
-    file://0089-mtk-mt76-mt7996-use-.sta_state-to-replace-.sta_add-a.patch \
-    file://0090-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch \
-    file://0091-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch \
-    file://0092-mtk-mt76-extend-wcid-and-sta-flow-for-MLO-support.patch \
-    file://0093-mtk-mt76-mt7996-enable-MLO-capability.patch \
-    file://0094-mtk-mt76-mt7996-support-multi-link-vif-links-and-MLO.patch \
-    file://0095-mtk-mt76-mt7996-support-multi-link-sta-links-and-MLO.patch \
-    file://0096-mtk-mt76-mt7996-introduce-mt7996_band_phy-for-ch-ban.patch \
-    file://0097-mtk-mt76-mt7996-rework-ieee80211_ops-callbacks-for-l.patch \
-    file://0098-mtk-mt76-mt7996-rework-TXD-for-multi-link-support.patch \
-    file://0099-mtk-mt76-mt7996-rework-TXS-for-multi-link-support.patch \
-    file://0100-mtk-mt76-mt7996-rework-RXD-for-multi-link-support.patch \
-    file://0101-mtk-mt76-mt7996-rework-mac-functions-for-multi-link-.patch \
-    file://0102-mtk-mt76-rework-mcu-functions-for-multi-link-support.patch \
-    file://0103-mtk-mt76-rework-connac-helpers.patch \
-    file://0104-mtk-mt76-mt7996-handle-mapping-for-hw-and-phy.patch \
-    file://0105-mtk-mt76-mt7996-handle-mapping-for-hw-and-vif.patch \
-    file://0106-mtk-mt76-mt7996-rework-scanning-parts-for-MLD-STA-su.patch \
-    file://0107-mtk-mt76-mt7996-implement-mld-address-translation.patch \
-    file://0108-mtk-mt76-mt7996-use-BSS_CHANGED_TXPOWER-for-txpower-.patch \
-    file://0109-mtk-mt76-mt7996-temp-support-for-single-wiphy.patch \
-    file://0110-mtk-mt76-mt7996-implement-ieee80211_ops-for-link-deb.patch \
-    file://0111-mtk-mt76-mt7996-support-multi-link-channel-switch.patch \
-    file://0112-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch \
-    file://0113-mtk-mt76-mt7996-add-beacon-monitoring-in-driver-for-.patch \
-    file://0114-mtk-mt76-mt7996-support-band_idx-option-for-set_mu-g.patch \
-    file://0115-mtk-mt76-mt7996-tmp-disable-VOW.patch \
-    file://0116-mtk-mt76-mt7996-enable-ampdu-limit-to-avoid-BA-bound.patch \
-    file://0117-mtk-mt76-mt7996-Fix-get_txpower-wrong-result-in-sing.patch \
-    file://0118-mtk-mt76-mt7996-Add-connac3-csi-feature.patch \
-    file://0119-mtk-mt76-mt7996-add-more-debug-info-for-MLO.patch \
-    file://0120-mtk-mt76-add-internal-debug-tool.patch \
-    file://0121-mtk-mt76-mt7996-add-linux-tracing-support.patch \
-    file://0122-mtk-mt76-temp-changes-for-SQC-period.patch \
-    file://0123-mtk-mt76-mt7996-remain-multiple-wiphy-model-for-test.patch \
-    file://0124-mtk-mt76-mt7996-enable-ibf-capability-for-mt7992.patch \
-    file://0125-mtk-mt76-remove-the-limitation-for-legacy-AP-sacn.patch \
-    file://0126-mtk-mt76-add-support-for-get_survey-in-single-wiphy-.patch \
-    file://0127-mtk-mt76-mt7996-add-critical-update-support.patch \
-    file://0128-mtk-mt76-mt7996-Add-support-for-EMLSR.patch \
-    file://0129-mtk-mt76-mt7996-add-max-mpdu-len-capability.patch \
-    file://0130-mtk-mt76-mt7996-add-correct-bss_conf-for-legacy-AP-s.patch \
-    file://0131-mtk-mt76-mt7996-fix-set-beacon-mcu-command.patch \
-    file://0132-mtk-mt76-fix-incorrect-setting-of-antenna-capability.patch \
-    file://0133-mtk-mt76-mt7996-fix-stop_tx_ba_session-warning.patch \
-    file://0134-mtk-mt76-mt7996-do-software-link-addr-translation-fo.patch \
-    file://0135-mtk-mt76-mt7996-add-per-band-debugfs-folder.patch \
-    file://0136-mtk-mt76-mt7996-move-internal-debugfs-knob-to-per-ba.patch \
-    file://0137-mtk-mt76-mt7996-refactor-amsdu-debugfs.patch \
-    file://0138-mtk-mt76-mt7996-trigger-channel-calibration-for-DFS-.patch \
-    file://0139-mtk-mt76-mt7996-do-not-remove-bss_info-and-starec-wh.patch \
-    file://0140-mtk-mt76-mt7996-remove-chanctx-in-mt7996_bss_conf.patch \
-    file://0141-mtk-mt76-mt7996-temporarily-disable-EPCS.patch \
-    file://0142-mtk-mt76-mt7996-fix-kite-can-t-handle-11v-beacon-on-.patch \
-    file://0143-mtk-mt76-mt7996-add-post-channel-switch-for-DFS-chan.patch \
-    file://0144-mtk-mt76-mt7996-update-testmode-bf-support.patch \
-    file://0145-mtk-mt76-mt7996-add-mlo-related-debugfs-knob.patch \
-    file://0146-mtk-mt76-mt7996-add-debugfs-knob-to-show-mlo-related.patch \
-    file://0147-mtk-mt76-mt7996-add-debugfs-knob-to-set-agc.patch \
-    file://0148-mtk-mt76-mt7996-set-unused-band-to-UNSPECIFIED-in-ba.patch \
-    file://0149-mtk-mt76-mt7996-support-per-link-report-of-bss-color.patch \
-    file://0150-mtk-mt76-mt7996-Fix-inconsistent-QoS-mapping-between.patch \
-    file://0151-mtk-mt76-mt7996-add-support-for-MLD-interface-to-sca.patch \
-    file://0152-mtk-mt76-mt7996-add-per-link-txpower-config.patch \
-    file://0153-mtk-mt76-mt7996-update-TX-RX-rates-via-MCU-command.patch \
-    file://0154-mtk-mt76-mt7996-add-link-information-when-dump-stati.patch \
-    file://0155-mtk-mt76-mt7996-add-per-link-RX-MPDU-statistics.patch \
-    file://0156-mtk-mt76-mt7996-support-link_id-for-mt7996_set_bitra.patch \
-    file://0157-mtk-mt76-mt7996-add-per-radio-antenna-config.patch \
-    file://0158-mtk-mt76-mt7996-rework-debug-prints.patch \
-    file://0159-mtk-mt76-mt7996-support-configure-trigger-frame-type.patch \
-    file://0160-mtk-mt76-mt7996-support-configure-coding-type-for-wi.patch \
-    file://0161-mtk-mt76-mt7996-record-RSSI-and-SNR.patch \
-    file://0162-mtk-mt76-mt7996-support-find-the-mt7996_phy-by-link_.patch \
-    file://0163-mtk-mt76-mt7996-workaround-for-get_tsf-crash-issue.patch \
-    file://0164-mtk-mt76-add-debugfs-for-tx-drop-counters.patch \
-    file://0165-mtk-mt76-add-debugfs-for-rx-drop-counters.patch \
-    file://0166-mtk-mt76-mt7996-add-support-for-remain-on-channel-op.patch \
-    file://0167-mtk-mt76-mt7996-rework-the-setting-flow-of-starec-RA.patch \
-    file://0168-mtk-mt76-mt7996-Fix-NULL-pointer-crash-when-mac-tx-f.patch \
-    file://0169-mtk-mt76-mt7996-update-adie-efuse-merge-support.patch \
-    file://0170-mtk-mt76-mt7996-support-handle-link_id-in-ap_wireles.patch \
-    file://0171-mtk-mt76-mt7996-fix-incorrect-indexing-of-MIB-FW-eve.patch \
-    file://0172-mtk-mt76-mt7996-support-muru-dbg-info-debug-commands.patch \
-    file://0173-mtk-mt76-mt7996-add-kite-if_comb.patch \
-    file://0174-mtk-mt76-mt7996-change-source-of-per-WCID-TX-MPDU-st.patch \
-    file://0175-mtk-mt76-mt7996-update-preamble-puncture-support-for.patch \
-    file://0176-mtk-mt76-Add-dynamic-pp-vendor-and-debug-pp-algo-cmd.patch \
-    file://0177-mtk-mt76-mt7996-disable-MAT-and-set-force-link-for-4.patch \
-    file://0178-mtk-mt76-mt7996-add-per-STA-TX-MSDU-failed-and-retri.patch \
-    file://0179-mtk-mt76-mt7996-fill-in-sn-into-txd-for-MLD-multicas.patch \
-    file://0180-mtk-mt76-mt7996-fix-potential-null-pointer.patch \
-    file://0181-mtk-mt76-mt7996-Fix-legacy-action-frame-wrong-addres.patch \
-    file://0182-mtk-mt76-mt7996-add-AP-affiliated-link-removal-suppo.patch \
-    file://0183-mtk-mt76-mt7996-add-support-for-AP-A-TTLM.patch \
-    file://0184-mtk-mt76-mt7996-leave-ps-when-4-address-is-establish.patch \
-    file://0185-mtk-mt76-mt7996-add-debugfs-knob-to-set-and-dump-txo.patch \
-    file://0186-mtk-mt76-mt7996-add-mcu-command-to-set-bssid-mapping.patch \
-    file://0187-mtk-mt76-mt7996-Temporary-fix-init-txpwoer-for-singl.patch \
-    file://0188-mtk-mt76-mt7996-Add-lpi-support-with-sku_idx-and-enh.patch \
-    file://0189-mtk-mt76-mt7996-Add-Triggered-Uplink-Access-Optimiza.patch \
-    file://0190-mtk-mt76-mt7996-add-per-band-token-limit.patch \
-    file://0191-mtk-mt76-sync-with-upstream-changes.patch \
-    file://0192-mtk-mt76-mt7996-record-per-antenna-average-data-fram.patch \
-    file://0193-mtk-mt76-mt7996-remove-default-bss_conf-when-link-be.patch \
-    file://0194-mtk-mt76-mt7996-pass-vif-cfg.assoc-to-mt7996_mac_sta.patch \
-    file://0195-mtk-mt76-mt7996-separate-hwrro-from-wed.patch \
-    file://0196-mtk-mt76-mt7996-ignore-vif.dormant_links-in-mt7996_c.patch \
-    file://0197-mtk-mt76-mt7996-add-Adv-TTLM-support-for-STA.patch \
-    file://0198-mtk-mt76-mt7996-Add-AFC-and-lpi-power-support.patch \
-    file://0199-mtk-mt76-do-not-report-ACK-when-TXS-is-lost.patch \
+    file://0002-mtk-mt76-mt7996-fix-amsdu-information.patch \
+    file://0003-mtk-mt76-mt7996-add-preamble-puncture-support-for-mt.patch \
+    file://0004-mtk-mt76-mt7996-add-driver-support-for-wpa3-ocv-and-.patch \
+    file://0005-mtk-mt76-mt7996-enable-ser-query.patch \
+    file://0006-mtk-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch \
+    file://0007-mtk-mt76-mt7996-add-support-for-different-variants.patch \
+    file://0008-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch \
+    file://0009-mtk-mt76-mt7996-Fixed-null-pointer-dereference-issue.patch \
+    file://0010-mtk-mt76-add-sanity-check-to-prevent-kernel-crash.patch \
+    file://0011-mtk-mt76-mt7996-add-firmware-WA-s-coredump.patch \
+    file://0012-mtk-mt76-mt7996-for-build-pass.patch \
+    file://0013-mtk-mt76-mt7996-add-debug-tool.patch \
+    file://0014-mtk-mt76-mt7996-add-check-for-hostapd-config-he_ldpc.patch \
+    file://0015-mtk-mt76-mt7996-add-basic-testmode-support.patch \
+    file://0016-mtk-mt76-mt7996-add-testmode-pre-calibration-support.patch \
+    file://0017-mtk-mt76-mt7996-add-normal-mode-pre-calibration-supp.patch \
+    file://0018-mtk-mt76-mt7996-enable-SCS-feature-for-mt7996-driver.patch \
+    file://0019-mtk-mt76-mt7996-add-txpower-support.patch \
+    file://0020-mtk-mt76-mt7996-add-binfile-mode-support.patch \
+    file://0021-mtk-mt76-mt7996-add-testmode-ZWDFS-verification-supp.patch \
+    file://0022-mtk-mt76-mt7996-support-eagle-ZWDFS-on-iFEM.patch \
+    file://0023-mtk-mt76-mt7996-refactor-eeprom-loading-flow-for-sku.patch \
+    file://0024-mtk-mt76-mt7996-add-vendor-commands-support.patch \
+    file://0025-mtk-mt76-mt7996-add-debugfs-for-fw-coredump.patch \
+    file://0026-mtk-mt76-mt7996-Add-mt7992-coredump-support.patch \
+    file://0027-mtk-mt76-mt7996-add-support-for-runtime-set-in-band-.patch \
+    file://0028-mtk-mt76-mt7996-add-support-spatial-reuse-debug-comm.patch \
+    file://0029-mtk-mt76-mt7996-Establish-BA-in-VO-queue.patch \
+    file://0030-mtk-mt76-mt7996-report-tx-and-rx-byte-to-tpt_led.patch \
+    file://0031-mtk-mt76-mt7996-support-dup-wtbl.patch \
+    file://0032-mtk-mt76-try-more-times-when-send-message-timeout.patch \
+    file://0033-mtk-mt76-mt7996-add-SER-overlap-handle.patch \
+    file://0034-mtk-mt76-mt7996-kite-default-1-pcie-setting.patch \
+    file://0035-mtk-mt76-mt7996-support-BF-MIMO-debug-commands.patch \
+    file://0036-mtk-mt76-mt7996-add-build-the-following-MURU-mcu-com.patch \
+    file://0037-mtk-mt76-mt7996-add-cert-patch.patch \
+    file://0038-mtk-mt76-mt7996-add-testmode-bf-support.patch \
+    file://0039-mtk-mt76-mt7996-add-zwdfs-cert-mode.patch \
+    file://0040-mtk-mt76-mt7996-add-channel-68-96.patch \
+    file://0041-mtk-mt76-mt7996-add-kite-testmode-support.patch \
+    file://0042-mtk-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for-CERT.patch \
+    file://0043-mtk-mt76-mt7996-add-no_beacon-vendor-command-for-cer.patch \
+    file://0044-mtk-mt76-mt7996-add-adie-efuse-merge-support.patch \
+    file://0045-mtk-mt76-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch \
+    file://0046-mtk-mt76-mt7996-add-background-radar-hw-cap-check.patch \
+    file://0047-mtk-mt76-mt7996-add-fallback-in-case-of-missing-prec.patch \
+    file://0048-mtk-mt76-mt7996-add-kite-part-number-support.patch \
+    file://0049-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch \
+    file://0050-mtk-mt76-rework-wed-rx-flow.patch \
+    file://0051-mtk-mt76-change-wed-token-init-size-to-adapt-wed3.0.patch \
+    file://0052-mtk-mt76-add-random-early-drop-support.patch \
+    file://0053-mtk-mt76-mt7996-reset-addr_elem-when-delete-ba.patch \
+    file://0054-mtk-mt76-change-pcie0-R5-to-pcie1-to-get-6G-ICS.patch \
+    file://0055-mtk-mt76-add-SER-support-for-wed3.0.patch \
+    file://0056-mtk-mt76-find-rx-token-by-physical-address.patch \
+    file://0057-mtk-mt76-mt7996-add-dma-mask-limitation.patch \
+    file://0058-mtk-mt76-mt7996-add-per-bss-statistic-info.patch \
+    file://0059-mtk-mt76-mt7996-do-not-report-netdev-stats-on-monito.patch \
+    file://0060-mtk-mt76-mt7996-add-support-for-HW-ATF.patch \
+    file://0061-mtk-mt76-mt7996-add-SER0.5-support-w-wed3.0.patch \
+    file://0062-mtk-mt76-mt7996-support-backaward-compatiable.patch \
+    file://0063-mtk-mt76-mt7996-add-wed-support-for-mt7992.patch \
+    file://0064-mtk-mt76-add-2pcie-one-wed-support.patch \
+    file://0065-mtk-mt76-mt7996-Remove-wed-rro-ring-add-napi-at-init.patch \
+    file://0066-mtk-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch \
+    file://0067-mtk-mt76-mt7996-Refactor-rro-del-ba-command-format.patch \
+    file://0068-mtk-mt76-mt7996-get-airtime-and-RSSI-via-MCU-command.patch \
+    file://0069-mtk-mt76-mt7996-add-support-for-WMM-PBC-configuratio.patch \
+    file://0070-mtk-mt76-mt7996-eagle-support-extra-option_type.patch \
+    file://0071-mtk-mt76-mt7996-support-enable-disable-thermal-prote.patch \
+    file://0072-mtk-mt76-mt7996-support-thermal-recal-debug-command.patch \
+    file://0073-mtk-mt76-mt7996-add-kite-two-pcie-with-two-wed-suppo.patch \
+    file://0074-mtk-mt76-add-support-to-enable-index-FW-log-for-Cons.patch \
+    file://0075-mtk-mt76-mt7996-implement-and-switch-to-hw-scan-call.patch \
+    file://0076-mtk-mt76-mt7996-implement-and-switch-to-chanctx-call.patch \
+    file://0077-mtk-mt76-mt7996-use-.sta_state-to-replace-.sta_add-a.patch \
+    file://0078-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch \
+    file://0079-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch \
+    file://0080-mtk-mt76-extend-wcid-and-sta-flow-for-MLO-support.patch \
+    file://0081-mtk-mt76-mt7996-enable-MLO-capability.patch \
+    file://0082-mtk-mt76-mt7996-support-multi-link-vif-links-and-MLO.patch \
+    file://0083-mtk-mt76-mt7996-support-multi-link-sta-links-and-MLO.patch \
+    file://0084-mtk-mt76-mt7996-introduce-mt7996_band_phy-for-ch-ban.patch \
+    file://0085-mtk-mt76-mt7996-rework-ieee80211_ops-callbacks-for-l.patch \
+    file://0086-mtk-mt76-mt7996-rework-TXD-for-multi-link-support.patch \
+    file://0087-mtk-mt76-mt7996-rework-TXS-for-multi-link-support.patch \
+    file://0088-mtk-mt76-mt7996-rework-RXD-for-multi-link-support.patch \
+    file://0089-mtk-mt76-mt7996-rework-mac-functions-for-multi-link-.patch \
+    file://0090-mtk-mt76-rework-mcu-functions-for-multi-link-support.patch \
+    file://0091-mtk-mt76-rework-connac-helpers.patch \
+    file://0092-mtk-mt76-mt7996-handle-mapping-for-hw-and-phy.patch \
+    file://0093-mtk-mt76-mt7996-handle-mapping-for-hw-and-vif.patch \
+    file://0094-mtk-mt76-mt7996-rework-scanning-parts-for-MLD-STA-su.patch \
+    file://0095-mtk-mt76-mt7996-implement-mld-address-translation.patch \
+    file://0096-mtk-mt76-mt7996-use-BSS_CHANGED_TXPOWER-for-txpower-.patch \
+    file://0097-mtk-mt76-mt7996-temp-support-for-single-wiphy.patch \
+    file://0098-mtk-mt76-mt7996-implement-ieee80211_ops-for-link-deb.patch \
+    file://0099-mtk-mt76-mt7996-support-multi-link-channel-switch.patch \
+    file://0100-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch \
+    file://0101-mtk-mt76-mt7996-add-beacon-monitoring-in-driver-for-.patch \
+    file://0102-mtk-mt76-mt7996-support-band_idx-option-for-set_mu-g.patch \
+    file://0103-mtk-mt76-mt7996-tmp-disable-VOW.patch \
+    file://0104-mtk-mt76-mt7996-enable-ampdu-limit-to-avoid-BA-bound.patch \
+    file://0105-mtk-mt76-mt7996-Fix-get_txpower-wrong-result-in-sing.patch \
+    file://0106-mtk-mt76-mt7996-Add-connac3-csi-feature.patch \
+    file://0107-mtk-mt76-mt7996-add-more-debug-info-for-MLO.patch \
+    file://0108-mtk-mt76-add-internal-debug-tool.patch \
+    file://0109-mtk-mt76-mt7996-add-linux-tracing-support.patch \
+    file://0110-mtk-mt76-temp-changes-for-SQC-period.patch \
+    file://0111-mtk-mt76-mt7996-remain-multiple-wiphy-model-for-test.patch \
+    file://0112-mtk-mt76-mt7996-enable-ibf-capability-for-mt7992.patch \
+    file://0113-mtk-mt76-remove-the-limitation-for-legacy-AP-sacn.patch \
+    file://0114-mtk-mt76-add-support-for-get_survey-in-single-wiphy-.patch \
+    file://0115-mtk-mt76-mt7996-add-critical-update-support.patch \
+    file://0116-mtk-mt76-mt7996-Add-support-for-EMLSR.patch \
+    file://0117-mtk-mt76-mt7996-add-max-mpdu-len-capability.patch \
+    file://0118-mtk-mt76-mt7996-add-correct-bss_conf-for-legacy-AP-s.patch \
+    file://0119-mtk-mt76-mt7996-fix-set-beacon-mcu-command.patch \
+    file://0120-mtk-mt76-fix-incorrect-setting-of-antenna-capability.patch \
+    file://0121-mtk-mt76-mt7996-fix-stop_tx_ba_session-warning.patch \
+    file://0122-mtk-mt76-mt7996-do-software-link-addr-translation-fo.patch \
+    file://0123-mtk-mt76-mt7996-add-per-band-debugfs-folder.patch \
+    file://0124-mtk-mt76-mt7996-move-internal-debugfs-knob-to-per-ba.patch \
+    file://0125-mtk-mt76-mt7996-refactor-amsdu-debugfs.patch \
+    file://0126-mtk-mt76-mt7996-trigger-channel-calibration-for-DFS-.patch \
+    file://0127-mtk-mt76-mt7996-do-not-remove-bss_info-and-starec-wh.patch \
+    file://0128-mtk-mt76-mt7996-remove-chanctx-in-mt7996_bss_conf.patch \
+    file://0129-mtk-mt76-mt7996-temporarily-disable-EPCS.patch \
+    file://0130-mtk-mt76-mt7996-fix-kite-can-t-handle-11v-beacon-on-.patch \
+    file://0131-mtk-mt76-mt7996-add-post-channel-switch-for-DFS-chan.patch \
+    file://0132-mtk-mt76-mt7996-update-testmode-bf-support.patch \
+    file://0133-mtk-mt76-mt7996-add-mlo-related-debugfs-knob.patch \
+    file://0134-mtk-mt76-mt7996-add-debugfs-knob-to-show-mlo-related.patch \
+    file://0135-mtk-mt76-mt7996-add-debugfs-knob-to-set-agc.patch \
+    file://0136-mtk-mt76-mt7996-set-unused-band-to-UNSPECIFIED-in-ba.patch \
+    file://0137-mtk-mt76-mt7996-support-per-link-report-of-bss-color.patch \
+    file://0138-mtk-mt76-mt7996-Fix-inconsistent-QoS-mapping-between.patch \
+    file://0139-mtk-mt76-mt7996-add-support-for-MLD-interface-to-sca.patch \
+    file://0140-mtk-mt76-mt7996-add-per-link-txpower-config.patch \
+    file://0141-mtk-mt76-mt7996-update-TX-RX-rates-via-MCU-command.patch \
+    file://0142-mtk-mt76-mt7996-add-link-information-when-dump-stati.patch \
+    file://0143-mtk-mt76-mt7996-add-per-link-RX-MPDU-statistics.patch \
+    file://0144-mtk-mt76-mt7996-support-link_id-for-mt7996_set_bitra.patch \
+    file://0145-mtk-mt76-mt7996-add-per-radio-antenna-config.patch \
+    file://0146-mtk-mt76-mt7996-rework-debug-prints.patch \
+    file://0147-mtk-mt76-mt7996-support-configure-trigger-frame-type.patch \
+    file://0148-mtk-mt76-mt7996-support-configure-coding-type-for-wi.patch \
+    file://0149-mtk-mt76-mt7996-record-RSSI-and-SNR.patch \
+    file://0150-mtk-mt76-mt7996-support-find-the-mt7996_phy-by-link_.patch \
+    file://0151-mtk-mt76-mt7996-workaround-for-get_tsf-crash-issue.patch \
+    file://0152-mtk-mt76-add-debugfs-for-tx-drop-counters.patch \
+    file://0153-mtk-mt76-add-debugfs-for-rx-drop-counters.patch \
+    file://0154-mtk-mt76-mt7996-add-support-for-remain-on-channel-op.patch \
+    file://0155-mtk-mt76-mt7996-rework-the-setting-flow-of-starec-RA.patch \
+    file://0156-mtk-mt76-mt7996-Fix-NULL-pointer-crash-when-mac-tx-f.patch \
+    file://0157-mtk-mt76-mt7996-update-adie-efuse-merge-support.patch \
+    file://0158-mtk-mt76-mt7996-support-handle-link_id-in-ap_wireles.patch \
+    file://0159-mtk-mt76-mt7996-fix-incorrect-indexing-of-MIB-FW-eve.patch \
+    file://0160-mtk-mt76-mt7996-support-muru-dbg-info-debug-commands.patch \
+    file://0161-mtk-mt76-mt7996-add-kite-if_comb.patch \
+    file://0162-mtk-mt76-mt7996-change-source-of-per-WCID-TX-MPDU-st.patch \
+    file://0163-mtk-mt76-mt7996-update-preamble-puncture-support-for.patch \
+    file://0164-mtk-mt76-Add-dynamic-pp-vendor-and-debug-pp-algo-cmd.patch \
+    file://0165-mtk-mt76-mt7996-disable-MAT-and-set-force-link-for-4.patch \
+    file://0166-mtk-mt76-mt7996-add-per-STA-TX-MSDU-failed-and-retri.patch \
+    file://0167-mtk-mt76-mt7996-fill-in-sn-into-txd-for-MLD-multicas.patch \
+    file://0168-mtk-mt76-mt7996-fix-potential-null-pointer.patch \
+    file://0169-mtk-mt76-mt7996-Fix-legacy-action-frame-wrong-addres.patch \
+    file://0170-mtk-mt76-mt7996-add-AP-affiliated-link-removal-suppo.patch \
+    file://0171-mtk-mt76-mt7996-add-support-for-AP-A-TTLM.patch \
+    file://0172-mtk-mt76-mt7996-leave-ps-when-4-address-is-establish.patch \
+    file://0173-mtk-mt76-mt7996-add-debugfs-knob-to-set-and-dump-txo.patch \
+    file://0174-mtk-mt76-mt7996-add-mcu-command-to-set-bssid-mapping.patch \
+    file://0175-mtk-mt76-mt7996-Temporary-fix-init-txpwoer-for-singl.patch \
+    file://0176-mtk-mt76-mt7996-Add-lpi-support-with-sku_idx-and-enh.patch \
+    file://0177-mtk-mt76-mt7996-Add-Triggered-Uplink-Access-Optimiza.patch \
+    file://0178-mtk-mt76-mt7996-add-per-band-token-limit.patch \
+    file://0179-mtk-mt76-sync-with-upstream-changes.patch \
+    file://0180-mtk-mt76-mt7996-record-per-antenna-average-data-fram.patch \
+    file://0181-mtk-mt76-mt7996-remove-default-bss_conf-when-link-be.patch \
+    file://0182-mtk-mt76-mt7996-pass-vif-cfg.assoc-to-mt7996_mac_sta.patch \
+    file://0183-mtk-mt76-mt7996-separate-hwrro-from-wed.patch \
+    file://0184-mtk-mt76-mt7996-ignore-vif.dormant_links-in-mt7996_c.patch \
+    file://0185-mtk-mt76-mt7996-add-Adv-TTLM-support-for-STA.patch \
+    file://0186-mtk-mt76-mt7996-Add-AFC-and-lpi-power-support.patch \
+    file://0187-mtk-mt76-do-not-report-ACK-when-TXS-is-lost.patch \
+    file://0188-mtk-mt76-mt7996-fix-ldpc-setting.patch \
+    file://0189-mtk-mt76-mt7996-add-external-eeprom-support.patch \
+    file://0190-mtk-mt76-mt7996-add-efuse-write-protection.patch \
+    file://0191-mtk-mt76-mt7996-fix-the-capability-of-reception-of-E.patch \
+    file://0192-mtk-mt76-mt7996-fix-HE-Phy-capability.patch \
+    file://0193-mtk-mt76-mt7996-fix-potential-crash-issue-in-mt7996_.patch \
+    file://0194-mtk-mt76-mt7996-Fix-call-trace-happened-when-wed-att.patch \
     "
diff --git a/recipes-wifi/linux-mt76/files/patches/0018-wifi-mt76-mt7915-fix-inconsistent-QoS-mapping-betwee.patch b/recipes-wifi/linux-mt76/files/patches/0018-wifi-mt76-mt7915-fix-inconsistent-QoS-mapping-betwee.patch
index 6eed8bd..5f25fc5 100644
--- a/recipes-wifi/linux-mt76/files/patches/0018-wifi-mt76-mt7915-fix-inconsistent-QoS-mapping-betwee.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0018-wifi-mt76-mt7915-fix-inconsistent-QoS-mapping-betwee.patch
@@ -1,4 +1,4 @@
-From 6e6fb69bc4f57d622fae76d8d5a3102b8e98e10f Mon Sep 17 00:00:00 2001
+From 605a40dad37c685a49f2c7985e3a05806d7ac1fc Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Thu, 25 Apr 2024 17:17:13 +0800
 Subject: [PATCH] wifi: mt76: mt7915: fix inconsistent QoS mapping between SW
@@ -10,8 +10,9 @@
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt76_connac_mcu.h |  1 +
- mt7915/main.c     | 51 +++++++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 52 insertions(+)
+ mt7915/main.c     | 59 ++++++++++++++++++++++++++++++++++++++++++++++-
+ mt7915/mt7915.h   |  4 ++++
+ 3 files changed, 63 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
 index 46dcd1c..e0255a2 100644
@@ -26,17 +27,38 @@
  
  enum {
 diff --git a/mt7915/main.c b/mt7915/main.c
-index f40a900..f82d0b1 100644
+index f40a900..71f3ad1 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1619,6 +1619,56 @@ mt7915_set_frag_threshold(struct ieee80211_hw *hw, u32 val)
+@@ -209,7 +209,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+ 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
+ 	struct mt76_txq *mtxq;
+ 	bool ext_phy = phy != &dev->phy;
+-	int idx, ret = 0;
++	int idx, i, ret = 0;
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+ 
+@@ -255,6 +255,12 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+ 	mvif->sta.wcid.tx_info |= MT_WCID_TX_INFO_SET;
+ 	mt76_wcid_init(&mvif->sta.wcid);
+ 
++	/* init Default QoS map, defined in section 2.3 of RFC8325.
++	 * Three most significant bits of DSCP are used as UP.
++	 */
++	for (i = 0; i < IP_DSCP_NUM; ++i)
++		mvif->qos_map[i] = i >> 3;
++
+ 	mt7915_mac_wtbl_update(dev, idx,
+ 			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
+ 
+@@ -1619,6 +1625,56 @@ mt7915_set_frag_threshold(struct ieee80211_hw *hw, u32 val)
  	return 0;
  }
  
 +static int
 +mt7915_set_qos_map(struct ieee80211_vif *vif, struct cfg80211_qos_map *usr_qos_map)
 +{
-+#define IP_DSCP_NUM	64
 +	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
 +	struct {
 +		u8 bss_idx;
@@ -77,6 +99,7 @@
 +			if (dscp < IP_DSCP_NUM && up < IEEE80211_NUM_UPS)
 +				req.qos_map[dscp] = up;
 +		}
++		memcpy(mvif->qos_map, req.qos_map, IP_DSCP_NUM);
 +	}
 +
 +	return mt76_mcu_send_msg(&mvif->phy->dev->mt76, MCU_WA_EXT_CMD(SET_QOS_MAP),
@@ -86,7 +109,7 @@
  static int
  mt7915_set_radar_background(struct ieee80211_hw *hw,
  			    struct cfg80211_chan_def *chandef)
-@@ -1751,6 +1801,7 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1751,6 +1807,7 @@ const struct ieee80211_ops mt7915_ops = {
  	.add_twt_setup = mt7915_mac_add_twt_setup,
  	.twt_teardown_request = mt7915_twt_teardown_request,
  	.set_frag_threshold = mt7915_set_frag_threshold,
@@ -94,6 +117,28 @@
  	CFG80211_TESTMODE_CMD(mt76_testmode_cmd)
  	CFG80211_TESTMODE_DUMP(mt76_testmode_dump)
  #ifdef CONFIG_MAC80211_DEBUGFS
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 74cd8ca..bfac851 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -83,6 +83,8 @@
+ #define MT7915_CRIT_TEMP		110
+ #define MT7915_MAX_TEMP			120
+ 
++#define IP_DSCP_NUM			64
++
+ struct mt7915_vif;
+ struct mt7915_sta;
+ struct mt7915_dfs_pulse;
+@@ -175,6 +177,8 @@ struct mt7915_vif {
+ 
+ 	struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS];
+ 	struct cfg80211_bitrate_mask bitrate_mask;
++	/* QoS map support */
++	u8 qos_map[IP_DSCP_NUM];
+ };
+ 
+ /* crash-dump */
 -- 
 2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/0023-wifi-mt76-mt7915-fix-add-ba-issue-on-tid-not-equal-t.patch b/recipes-wifi/linux-mt76/files/patches/0023-wifi-mt76-mt7915-fix-add-ba-issue-on-tid-not-equal-t.patch
new file mode 100644
index 0000000..b3f81dd
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0023-wifi-mt76-mt7915-fix-add-ba-issue-on-tid-not-equal-t.patch
@@ -0,0 +1,77 @@
+From b5c9fa8bc514d8db22a93c3d4d3e686b9b34a52d Mon Sep 17 00:00:00 2001
+From: Rex Lu <rex.lu@mediatek.com>
+Date: Wed, 21 Aug 2024 20:13:37 +0800
+Subject: [PATCH] wifi: mt76: mt7915: fix add ba issue on tid not equal to zero
+ case
+
+Signed-off-by: Rex Lu <rex.lu@mediatek.com>
+---
+ mt76.h        | 6 ++++++
+ mt7915/main.c | 7 +++++++
+ 2 files changed, 13 insertions(+)
+
+diff --git a/mt76.h b/mt76.h
+index bdc9a9b..592c3cd 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -52,6 +52,8 @@
+ #define MT_WED_RRO_Q_MSDU_PG(_n)	__MT_WED_RRO_Q(MT76_WED_RRO_Q_MSDU_PG, _n)
+ #define MT_WED_RRO_Q_IND	__MT_WED_RRO_Q(MT76_WED_RRO_Q_IND, 0)
+ 
++#define AMPDU_ADDBA_SUCC_SHFT IEEE80211_NUM_TIDS
++
+ struct mt76_dev;
+ struct mt76_phy;
+ struct mt76_wcid;
+@@ -356,6 +358,10 @@ struct mt76_wcid {
+ 	int inactive_count;
+ 
+ 	struct rate_info rate;
++	/*
++	 *Bit 0 - 15: ADDBA of TID n started
++	 *Bit 16 - 31: ADDBA of TID n succeeded
++	 */
+ 	unsigned long ampdu_state;
+ 
+ 	u16 idx;
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 73a7153..35b97db 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -907,12 +907,14 @@ mt7915_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	case IEEE80211_AMPDU_TX_OPERATIONAL:
+ 		mtxq->aggr = true;
+ 		mtxq->send_bar = false;
++		set_bit((tid + AMPDU_ADDBA_SUCC_SHFT), &msta->wcid.ampdu_state);
+ 		ret = mt7915_mcu_add_tx_ba(dev, params, true);
+ 		break;
+ 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
+ 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
+ 		mtxq->aggr = false;
+ 		clear_bit(tid, &msta->wcid.ampdu_state);
++		clear_bit((tid + AMPDU_ADDBA_SUCC_SHFT), &msta->wcid.ampdu_state);
+ 		ret = mt7915_mcu_add_tx_ba(dev, params, false);
+ 		break;
+ 	case IEEE80211_AMPDU_TX_START:
+@@ -922,6 +924,7 @@ mt7915_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	case IEEE80211_AMPDU_TX_STOP_CONT:
+ 		mtxq->aggr = false;
+ 		clear_bit(tid, &msta->wcid.ampdu_state);
++		clear_bit((tid + AMPDU_ADDBA_SUCC_SHFT), &msta->wcid.ampdu_state);
+ 		ret = mt7915_mcu_add_tx_ba(dev, params, false);
+ 		ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+ 		break;
+@@ -1747,6 +1750,10 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+ 	if (msta->wcid.idx > 0xff)
+ 		return -EIO;
+ 
++	if (!test_bit((mvif->qos_map[path->mtk_wdma.tid >> 2] + AMPDU_ADDBA_SUCC_SHFT),
++	    &msta->wcid.ampdu_state))
++		return -EAGAIN;
++
+ 	path->type = DEV_PATH_MTK_WDMA;
+ 	path->dev = ctx->dev;
+ 	path->mtk_wdma.wdma_idx = wed->wdma_idx;
+-- 
+2.45.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch b/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
index 5795382..19efa83 100644
--- a/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
@@ -1,8 +1,8 @@
-From d46a2b30adcdc8bca0f2a5012cd7bd4a3d59051b Mon Sep 17 00:00:00 2001
+From 46dec6692579a5ccd030e2facf62e16a51712ad2 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 15 Dec 2022 19:45:18 +0800
-Subject: [PATCH 1012/1052] wifi: mt76: testmode: add iBF/eBF cal and cert
- commands with golden
+Subject: [PATCH 37/94] wifi: mt76: testmode: add iBF/eBF cal and cert commands
+ with golden
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -25,10 +25,10 @@
  16 files changed, 859 insertions(+), 325 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 15106812..9597f564 100644
+index 62bf468..a2640cf 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -755,6 +755,7 @@ struct mt76_testmode_data {
+@@ -762,6 +762,7 @@ struct mt76_testmode_data {
  
  	struct list_head tm_entry_list;
  	struct mt76_wcid *cur_entry;
@@ -36,7 +36,7 @@
  	u8 entry_num;
  	union {
  		struct mt76_testmode_entry_data ed;
-@@ -783,6 +784,9 @@ struct mt76_testmode_data {
+@@ -790,6 +791,9 @@ struct mt76_testmode_data {
  
  	u8 txbf_act;
  	u16 txbf_param[8];
@@ -47,7 +47,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 2acd7efb..0ce7ecdc 100644
+index 2acd7ef..0ce7ecd 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -2688,6 +2688,7 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
@@ -68,7 +68,7 @@
  		memcpy(bss->bssid, phy->macaddr, ETH_ALEN);
  	}
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index b05e1630..dc75ff1f 100644
+index 7fce115..7bc2834 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -737,8 +737,10 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
@@ -84,7 +84,7 @@
  	txwi[6] |= cpu_to_le32(val);
  #endif
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 2e566710..4a541188 100644
+index 73d176c..73e8ec1 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -205,46 +205,37 @@ static void mt7915_init_bitrate_mask(struct ieee80211_vif *vif)
@@ -101,7 +101,7 @@
 +	struct mt7915_dev *dev = phy->dev;
  	struct mt76_txq *mtxq;
  	bool ext_phy = phy != &dev->phy;
- 	int idx, ret = 0;
+ 	int idx, i, ret = 0;
  
 -	mutex_lock(&dev->mt76.mutex);
 -
@@ -146,7 +146,7 @@
  
  	dev->mt76.vif_mask |= BIT_ULL(mvif->mt76.idx);
  	phy->omac_mask |= BIT_ULL(mvif->mt76.omac_idx);
-@@ -280,7 +271,26 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+@@ -286,7 +277,26 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
  	mt7915_mcu_add_sta(dev, vif, NULL, true);
  	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
  
@@ -175,7 +175,7 @@
  
  	return ret;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 500ecbbb..6f05a081 100644
+index 500ecbb..6f05a08 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -199,6 +199,7 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -254,7 +254,7 @@
  		return -EINVAL;
  	}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 066246bb..de17c579 100644
+index 066246b..de17c57 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -546,10 +546,12 @@ enum {
@@ -448,7 +448,7 @@
  	MURU_SET_ARB_OP_MODE = 14,
  	MURU_SET_PLATFORM_TYPE = 25,
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 730cd338..ed15d711 100644
+index 730cd33..ed15d71 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -133,6 +133,7 @@ static const u32 mt7915_offs[] = {
@@ -468,10 +468,10 @@
  	[AGG_AALCR0]		= 0x028,
  	[AGG_AWSCR0]		= 0x030,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 00f55443..ef92b2ea 100644
+index 1df3d9f..ea284ae 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -325,7 +325,6 @@ struct mt7915_phy {
+@@ -329,7 +329,6 @@ struct mt7915_phy {
  
  		u8 spe_idx;
  
@@ -479,7 +479,7 @@
  		bool bf_ever_en;
  	} test;
  #endif
-@@ -443,7 +442,7 @@ struct mt7915_dev {
+@@ -447,7 +446,7 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -488,7 +488,7 @@
  	struct {
  		void *txbf_phase_cal;
  		void *txbf_pfmu_data;
-@@ -591,6 +590,7 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
+@@ -595,6 +594,7 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
  int mt7915_dma_start(struct mt7915_dev *dev, bool reset, bool wed_reset);
  int mt7915_txbf_init(struct mt7915_dev *dev);
  void mt7915_init_txpower(struct mt7915_phy *phy);
@@ -496,7 +496,7 @@
  void mt7915_reset(struct mt7915_dev *dev);
  int mt7915_run(struct ieee80211_hw *hw);
  int mt7915_mcu_init(struct mt7915_dev *dev);
-@@ -671,10 +671,12 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -675,10 +675,12 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
@@ -511,7 +511,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
  	return is_mt7915(&dev->mt76) ? MT7915_WTBL_SIZE : MT7916_WTBL_SIZE;
-@@ -810,4 +812,10 @@ enum {
+@@ -814,4 +816,10 @@ enum {
  
  #endif
  
@@ -523,7 +523,7 @@
 +
  #endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 54daa736..02fe61a3 100644
+index b94914d..adc4929 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2888,6 +2888,36 @@ mt7915_txpower_level_set(void *data, u64 val)
@@ -576,7 +576,7 @@
  
  	return 0;
 diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
-index 143dae26..7a2d28c7 100644
+index 143dae2..7a2d28c 100644
 --- a/mt7915/mtk_mcu.c
 +++ b/mt7915/mtk_mcu.c
 @@ -1,9 +1,10 @@
@@ -840,7 +840,7 @@
 +}
 +#endif
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 7e9b76b0..4d05e391 100644
+index 7e9b76b..4d05e39 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -61,6 +61,7 @@ enum offs_rev {
@@ -862,7 +862,7 @@
  #define MT_WF_RMAC_BASE(_band)		((_band) ? 0x820f5000 : 0x820e5000)
  #define MT_WF_RMAC(_band, ofs)		(MT_WF_RMAC_BASE(_band) + (ofs))
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index caa35906..faf60146 100644
+index caa3590..faf6014 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -55,6 +55,8 @@ struct reg_band {
@@ -1706,7 +1706,7 @@
  	rateval =  mode << 6 | rate_idx;
  	tx_cont->rateval = cpu_to_le16(rateval);
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 75698261..5aba13cf 100644
+index 7569826..5aba13c 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -311,137 +311,7 @@ struct mt7915_tm_muru {
@@ -1850,7 +1850,7 @@
  
  #endif
 diff --git a/testmode.c b/testmode.c
-index d8fc5d6f..56b92059 100644
+index d8fc5d6..56b9205 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -196,6 +196,7 @@ mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len,
@@ -1862,7 +1862,7 @@
  	memcpy(hdr->addr2, addr[1], ETH_ALEN);
  	memcpy(hdr->addr3, addr[2], ETH_ALEN);
 diff --git a/testmode.h b/testmode.h
-index b39cf511..20fab3ec 100644
+index b39cf51..20fab3e 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -303,7 +303,10 @@ enum mt76_testmode_cfg {
@@ -1890,7 +1890,7 @@
  	/* keep last */
  	NUM_MT76_TM_TXBF_ACT,
 diff --git a/tools/fields.c b/tools/fields.c
-index e2cf4b92..027b8cdb 100644
+index e2cf4b9..027b8cd 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -33,7 +33,10 @@ static const char * const testmode_tx_mode[] = {
@@ -1918,5 +1918,5 @@
  
  static const char * const testmode_offchan_bw[] = {
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch b/recipes-wifi/linux-mt76/files/patches/2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch
index 0653704..b51c053 100644
--- a/recipes-wifi/linux-mt76/files/patches/2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/2000-wifi-mt76-mt7915-wed-add-wed-tx-support.patch
@@ -1,7 +1,7 @@
-From aba91915c426953a680062a8e3528b7ca90054e9 Mon Sep 17 00:00:00 2001
+From daf071f6469272be2b7b61cb227efb7ad57c2ddd Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 10:38:53 +0800
-Subject: [PATCH 2000/2015] wifi: mt76: mt7915: wed: add wed tx support
+Subject: [PATCH 78/94] wifi: mt76: mt7915: wed: add wed tx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -14,7 +14,7 @@
  6 files changed, 14 insertions(+), 8 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 5356c52c..93856347 100644
+index e411032..f2006ea 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -130,6 +130,7 @@ struct mt76_connac_sta_key_conf {
@@ -26,7 +26,7 @@
  struct mt76_connac_fw_txp {
  	__le16 flags;
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index c84b9573..1c8b8732 100644
+index 677c339..543077d 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -878,9 +878,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
@@ -67,10 +67,10 @@
  
  static void
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 8c498683..ff0337a6 100644
+index e3bc373..6f09dda 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1816,14 +1816,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1832,7 +1832,7 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
  
@@ -78,7 +78,8 @@
 +	if (msta->wcid.idx > MT7915_WTBL_STA)
  		return -EIO;
  
- 	path->type = DEV_PATH_MTK_WDMA;
+ 	if (!test_bit((mvif->qos_map[path->mtk_wdma.tid >> 2] + AMPDU_ADDBA_SUCC_SHFT),
+@@ -1843,7 +1843,7 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->dev = ctx->dev;
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
  	path->mtk_wdma.bss = mvif->mt76.idx;
@@ -88,7 +89,7 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index b1b219ce..53648212 100644
+index b1b219c..5364821 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -13,7 +13,7 @@
@@ -109,7 +110,7 @@
  	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
  	if (ret)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 10d48495..d93ab970 100644
+index 7c185a1..94ea3e1 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -62,7 +62,7 @@
@@ -122,7 +123,7 @@
  
  #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
 diff --git a/wed.c b/wed.c
-index f7a3f1b3..47c81a28 100644
+index f7a3f1b..47c81a2 100644
 --- a/wed.c
 +++ b/wed.c
 @@ -187,7 +187,7 @@ void mt76_wed_offload_disable(struct mtk_wed_device *wed)
@@ -135,5 +136,5 @@
  }
  EXPORT_SYMBOL_GPL(mt76_wed_offload_disable);
 -- 
-2.18.0
+2.45.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/patches.inc b/recipes-wifi/linux-mt76/files/patches/patches.inc
index 2dd33c4..b307b8c 100644
--- a/recipes-wifi/linux-mt76/files/patches/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches/patches.inc
@@ -22,6 +22,7 @@
     file://0020-wifi-mt76-mt7915-add-additional-chain-signal-info-to.patch \
     file://0021-wifi-mt76-mt7915-remove-unnecessary-register-setting.patch \
     file://0022-wifi-mt76-mt7915-add-PID-to-only-report-data-frame-T.patch \
+    file://0023-wifi-mt76-mt7915-fix-add-ba-issue-on-tid-not-equal-t.patch \
     file://0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch \
     file://1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch \
     file://1001-wifi-mt76-mt7915-csi-implement-csi-support.patch \
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7916_rom_patch.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7916_rom_patch.bin
index a5da785..2d0b38b 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7916_rom_patch.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7916_rom_patch.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wa.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wa.bin
index 5d7346a..4ff7c6b 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wa.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wa.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wm.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wm.bin
index 5131b34..8a4a8b1 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wm.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7916_wm.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7981_rom_patch.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7981_rom_patch.bin
index 0dea564..8042f8b 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7981_rom_patch.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7981_rom_patch.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wa.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wa.bin
index d61ee36..6fdc391 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wa.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wa.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wm.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wm.bin
index df51f73..205441e 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wm.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wm.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wo.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wo.bin
index e97628e..896ac86 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wo.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7981_wo.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch.bin
index cb017c7..c05daaa 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch_mt7975.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch_mt7975.bin
index 87611a9..6b4744b 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch_mt7975.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_rom_patch_mt7975.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wa.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wa.bin
index 0c4e2d9..9c94c08 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wa.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wa.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm.bin
index 5f3f60e..cb693ca 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm_mt7975.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm_mt7975.bin
index 9e158c8..cad0010 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm_mt7975.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wm_mt7975.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_0.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_0.bin
index d22e70a..f34dbd5 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_0.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_0.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_1.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_1.bin
index 26b5d31..1f0f2ce 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_1.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7986_wo_1.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7990_eeprom.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7990_eeprom.bin
new file mode 100755
index 0000000..32b3e16
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7990_eeprom.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7990_eeprom_2i5i.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7990_eeprom_2i5i.bin
new file mode 100755
index 0000000..f0db071
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7990_eeprom_2i5i.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_eeprom.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_eeprom.bin
new file mode 100644
index 0000000..5d567db
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_eeprom.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_eeprom_23.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_eeprom_23.bin
new file mode 100644
index 0000000..20c5908
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7992_eeprom_23.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/linux-mt76_3.x.bb b/recipes-wifi/linux-mt76/linux-mt76_3.x.bb
index 5cc2c71..927204c 100644
--- a/recipes-wifi/linux-mt76/linux-mt76_3.x.bb
+++ b/recipes-wifi/linux-mt76/linux-mt76_3.x.bb
@@ -23,9 +23,6 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/src:"
 
 require files/patches-${PV}/patches.inc
-SRC_URI_append += " \
-        file://5000-mt76-add-internal-wed_tiny-header-file.patch \
-        "
 
 S = "${WORKDIR}/git"
 
diff --git a/recipes-wifi/linux-mt76/mt76-3x.inc b/recipes-wifi/linux-mt76/mt76-3x.inc
index 76d998a..5e771c1 100644
--- a/recipes-wifi/linux-mt76/mt76-3x.inc
+++ b/recipes-wifi/linux-mt76/mt76-3x.inc
@@ -1 +1 @@
-SRCREV_mt7988 = "6585a4353a51c0e4873b691bbcab251dffc7e2bb"
+SRCREV_mt7988 = "680bc70f161fde0f167e2ae50c771be4775eb50a"
diff --git a/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/ap/ubus.c b/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/ap/ubus.c
index 8689494..2256720 100644
--- a/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/ap/ubus.c
+++ b/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/ap/ubus.c
@@ -1783,6 +1783,7 @@
 
 	blob_buf_init(&b, 0);
 	blobmsg_add_macaddr(&b, "address", addr);
+	blobmsg_add_string(&b, "ifname", hapd->conf->iface);
 	if (req->mgmt_frame)
 		blobmsg_add_macaddr(&b, "target", req->mgmt_frame->da);
 	if (req->ssi_signal)
@@ -1857,6 +1858,7 @@
 
 	blob_buf_init(&b, 0);
 	blobmsg_add_macaddr(&b, "address", addr);
+	blobmsg_add_string(&b, "ifname", hapd->conf->iface);
 
 	ubus_notify(ctx, &hapd->ubus.obj, type, b.head, -1);
 }
@@ -1869,6 +1871,9 @@
 
 	blob_buf_init(&b, 0);
 	blobmsg_add_macaddr(&b, "address", sta->addr);
+	if (sta->vlan_id)
+		blobmsg_add_u32(&b, "vlan", sta->vlan_id);
+	blobmsg_add_string(&b, "ifname", hapd->conf->iface);
 	if (auth_alg)
 		blobmsg_add_string(&b, "auth-alg", auth_alg);
 
@@ -2004,3 +2009,31 @@
 	return ureq.resp;
 #endif
 }
+
+#ifdef CONFIG_APUP
+void hostapd_ubus_notify_apup_newpeer(
+	struct hostapd_data *hapd, const u8 *addr, const char *ifname)
+{
+	if (!hapd->ubus.obj.has_subscribers)
+		return;
+
+	blob_buf_init(&b, 0);
+	blobmsg_add_macaddr(&b, "address", addr);
+	blobmsg_add_string(&b, "ifname", ifname);
+
+	ubus_notify(ctx, &hapd->ubus.obj, "apup-newpeer", b.head, -1);
+}
+#endif // def CONFIG_APUP
+
+void hostapd_ubus_notify_csa(struct hostapd_data *hapd, int freq)
+{
+	if (!hapd->ubus.obj.has_subscribers)
+		return;
+
+	blob_buf_init(&b, 0);
+	blobmsg_add_string(&b, "ifname", hapd->conf->iface);
+	blobmsg_add_u32(&b, "freq", freq);
+	blobmsg_printf(&b, "bssid", MACSTR, MAC2STR(hapd->conf->bssid));
+
+	ubus_notify(ctx, &hapd->ubus.obj, "channel-switch", b.head, -1);
+}
diff --git a/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/ap/ubus.h b/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/ap/ubus.h
index 22767d6..055a18c 100644
--- a/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/ap/ubus.h
+++ b/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/ap/ubus.h
@@ -8,8 +8,6 @@
 #ifndef __HOSTAPD_UBUS_H
 #define __HOSTAPD_UBUS_H
 
-#include "sta_info.h"
-
 enum hostapd_ubus_event_type {
 	HOSTAPD_UBUS_PROBE_REQ,
 	HOSTAPD_UBUS_AUTH_REQ,
@@ -70,6 +68,12 @@
 	const u8 *candidate_list, u16 candidate_list_len);
 void hostapd_ubus_notify_authorized(struct hostapd_data *hapd, struct sta_info *sta,
 				    const char *auth_alg);
+void hostapd_ubus_notify_csa(struct hostapd_data *hapd, int freq);
+
+#ifdef CONFIG_APUP
+void hostapd_ubus_notify_apup_newpeer(
+	struct hostapd_data *hapd, const u8 *addr, const char *ifname);
+#endif // def CONFIG_APUP
 
 #else
 
@@ -152,6 +156,11 @@
 {
 }
 
+static inline void
+hostapd_ubus_notify_csa(struct hostapd_data *hapd, int freq)
+{
+}
+
 #endif
 
 #endif
diff --git a/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/ap/ucode.c b/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/ap/ucode.c
index 68fb450..a5630d7 100644
--- a/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/ap/ucode.c
+++ b/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/ap/ucode.c
@@ -3,7 +3,7 @@
 #include "utils/includes.h"
 #include "utils/common.h"
 #include "utils/ucode.h"
-#include "hostapd.h"
+#include "sta_info.h"
 #include "beacon.h"
 #include "hw_features.h"
 #include "ap_drv_ops.h"
@@ -259,6 +259,7 @@
 
 	hostapd_setup_bss(hapd, hapd == iface->bss[0], true);
 	hostapd_ucode_update_interfaces();
+	hostapd_owe_update_trans(iface);
 
 done:
 	ret = 0;
@@ -379,6 +380,7 @@
 	conf->bss[idx] = NULL;
 	ret = hostapd_ucode_bss_get_uval(hapd);
 	hostapd_ucode_update_interfaces();
+	hostapd_owe_update_trans(iface);
 	goto out;
 
 deinit_ctrl:
@@ -531,10 +533,12 @@
 		return NULL;
 
 #define UPDATE_VAL(field, name)							\
-	if ((intval = ucv_int64_get(ucv_object_get(info, name, NULL))) &&	\
-		!errno && intval != conf->field) do {				\
-		conf->field = intval;						\
-		changed = true;							\
+	do {									\
+		intval = ucv_int64_get(ucv_object_get(info, name, NULL));	\
+		if (!errno && intval != conf->field) {				\
+			conf->field = intval;					\
+			changed = true;						\
+		}								\
 	} while(0)
 
 	conf = iface->conf;
@@ -607,6 +611,7 @@
 
 		ieee802_11_set_beacon(hapd);
 	}
+	hostapd_owe_update_trans(iface);
 
 	return ucv_boolean_new(true);
 }
@@ -698,6 +703,7 @@
 	hostapd_ubus_add_bss(hapd);
 
 	hostapd_ucode_update_interfaces();
+	hostapd_owe_update_trans(hapd->iface);
 out:
 	if (interfaces->ctrl_iface_init)
 		interfaces->ctrl_iface_init(hapd);
@@ -770,48 +776,52 @@
 	wpa_ucode_registry_remove(iface_registry, iface->ucode.idx);
 }
 
-void hostapd_ucode_add_bss(struct hostapd_data *hapd)
+void hostapd_ucode_bss_cb(struct hostapd_data *hapd, const char *type)
 {
 	uc_value_t *val;
 
-	if (wpa_ucode_call_prepare("bss_add"))
+	if (wpa_ucode_call_prepare(type))
 		return;
 
 	val = hostapd_ucode_bss_get_uval(hapd);
+	uc_value_push(ucv_get(ucv_string_new(hapd->iface->phy)));
 	uc_value_push(ucv_get(ucv_string_new(hapd->conf->iface)));
 	uc_value_push(ucv_get(val));
-	ucv_put(wpa_ucode_call(2));
+	ucv_put(wpa_ucode_call(3));
 	ucv_gc(vm);
 }
 
-void hostapd_ucode_reload_bss(struct hostapd_data *hapd)
+void hostapd_ucode_free_bss(struct hostapd_data *hapd)
 {
 	uc_value_t *val;
 
-	if (wpa_ucode_call_prepare("bss_reload"))
+	val = wpa_ucode_registry_remove(bss_registry, hapd->ucode.idx);
+	if (!val)
 		return;
 
-	val = hostapd_ucode_bss_get_uval(hapd);
-	uc_value_push(ucv_get(ucv_string_new(hapd->conf->iface)));
+	hapd->ucode.idx = 0;
+	if (wpa_ucode_call_prepare("bss_remove"))
+		return;
+
+	uc_value_push(ucv_string_new(hapd->conf->iface));
 	uc_value_push(ucv_get(val));
 	ucv_put(wpa_ucode_call(2));
 	ucv_gc(vm);
 }
 
-void hostapd_ucode_free_bss(struct hostapd_data *hapd)
+#ifdef CONFIG_APUP
+void hostapd_ucode_apup_newpeer(struct hostapd_data *hapd, const char *ifname)
 {
 	uc_value_t *val;
 
-	val = wpa_ucode_registry_remove(bss_registry, hapd->ucode.idx);
-	if (!val)
-		return;
-
-	hapd->ucode.idx = 0;
-	if (wpa_ucode_call_prepare("bss_remove"))
+	if (wpa_ucode_call_prepare("apup_newpeer"))
 		return;
 
-	uc_value_push(ucv_string_new(hapd->conf->iface));
+	val = hostapd_ucode_bss_get_uval(hapd);
+	uc_value_push(ucv_get(ucv_string_new(hapd->conf->iface))); // BSS ifname
 	uc_value_push(ucv_get(val));
+	uc_value_push(ucv_get(ucv_string_new(ifname))); // APuP peer ifname
 	ucv_put(wpa_ucode_call(2));
 	ucv_gc(vm);
 }
+#endif // def CONFIG_APUP
diff --git a/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/ap/ucode.h b/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/ap/ucode.h
index d00b787..2f7bcd6 100644
--- a/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/ap/ucode.h
+++ b/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/ap/ucode.h
@@ -23,9 +23,12 @@
 
 void hostapd_ucode_free(void);
 void hostapd_ucode_free_iface(struct hostapd_iface *iface);
-void hostapd_ucode_add_bss(struct hostapd_data *hapd);
 void hostapd_ucode_free_bss(struct hostapd_data *hapd);
-void hostapd_ucode_reload_bss(struct hostapd_data *hapd);
+void hostapd_ucode_bss_cb(struct hostapd_data *hapd, const char *type);
+
+#ifdef CONFIG_APUP
+void hostapd_ucode_apup_newpeer(struct hostapd_data *hapd, const char *ifname);
+#endif // def CONFIG_APUP
 
 #else
 
@@ -39,10 +42,7 @@
 static inline void hostapd_ucode_free_iface(struct hostapd_iface *iface)
 {
 }
-static inline void hostapd_ucode_reload_bss(struct hostapd_data *hapd)
-{
-}
-static inline void hostapd_ucode_add_bss(struct hostapd_data *hapd)
+static inline void hostapd_ucode_bss_cb(struct hostapd_data *hapd, const char *type)
 {
 }
 static inline void hostapd_ucode_free_bss(struct hostapd_data *hapd)
@@ -51,4 +51,19 @@
 
 #endif
 
+static inline void hostapd_ucode_create_bss(struct hostapd_data *hapd)
+{
+	hostapd_ucode_bss_cb(hapd, "bss_create");
+}
+
+static inline void hostapd_ucode_add_bss(struct hostapd_data *hapd)
+{
+	hostapd_ucode_bss_cb(hapd, "bss_add");
+}
+
+static inline void hostapd_ucode_reload_bss(struct hostapd_data *hapd)
+{
+	hostapd_ucode_bss_cb(hapd, "bss_reload");
+}
+
 #endif
diff --git a/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/utils/build_features.h b/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/utils/build_features.h
index 553769e..cc88315 100644
--- a/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/utils/build_features.h
+++ b/recipes-wifi/wpa-supplicant/files/src-2.10.3/src/utils/build_features.h
@@ -15,6 +15,10 @@
 	if (!strcmp(feat, "11ax"))
 		return 1;
 #endif
+#ifdef CONFIG_IEEE80211BE
+	if (!strcmp(feat, "11be"))
+		return 1;
+#endif
 #ifdef CONFIG_IEEE80211R
 	if (!strcmp(feat, "11r"))
 		return 1;