[rdkb][common][bsp][Refactor and sync wifi from openwrt]

[Description]
21170dd [MAC80211][misc][refactor hostapd mtk patches]
2dac0c5 [MAC80211][mt76][update mt76 patches]
3fd51ef [MAC80211][misc][Filogic 880 alpha release preparation]
f1fbea3 [MAC80211][mtk][fix patch error]
3f10075 [MAC80211][core][Fix color aging not being queued]
947ae1b [MAC80211][hostapd][Add channel information for hostapd reload]
ea2c0ec [MAC80211][hostapd][Fix ZWDFS issue in BW 160]
d275cfa [MAC80211][core][Fix BSS Color bitmap crash on prplmesh image]
164b554 [MAC80211][mt76][Update beacon size limitation for 11v]
31f601f [MAC80211][mt76][add relay_close()]

[Release-log]

Change-Id: I1620c0a2c96e37f1b115772f73ba5ffd3a01f734
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0001-hostapd-mtk-Add-neighbor-report-and-BSS-Termination-.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0001-hostapd-mtk-Add-neighbor-report-and-BSS-Termination-.patch
index fb7c63f..0c0e3c6 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0001-hostapd-mtk-Add-neighbor-report-and-BSS-Termination-.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0001-hostapd-mtk-Add-neighbor-report-and-BSS-Termination-.patch
@@ -1,7 +1,7 @@
-From cd52509a69c3ba34d9b4146664140fd1ff712aa9 Mon Sep 17 00:00:00 2001
+From d76ef3ce86c91a33baa763014c8a991faa4fae4a Mon Sep 17 00:00:00 2001
 From: "howard.hsu" <howard-yh.hsu@mediatek.com>
 Date: Wed, 19 Jan 2022 19:18:07 +0800
-Subject: [PATCH 01/15] hostapd: mtk: Add neighbor report and BSS Termination
+Subject: [PATCH 01/24] hostapd: mtk: Add neighbor report and BSS Termination
  for MBO certification
 
 1. Add hostapd_neighbor_count() and hostapd_neighbor_insert_buffer ()
@@ -32,7 +32,7 @@
  9 files changed, 252 insertions(+), 5 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index a2584920c..c2a282227 100644
+index a258492..c2a2822 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -1338,6 +1338,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
@@ -48,7 +48,7 @@
  		ret = hostapd_set_iface(hapd->iconf, hapd->conf, cmd, value);
  		if (ret)
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index d7a0c7c80..4a20eb4e1 100644
+index d7a0c7c..4a20eb4 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -170,6 +170,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
@@ -60,7 +60,7 @@
  
  
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 39b26d602..a87563265 100644
+index 39b26d6..a875632 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -558,6 +558,7 @@ struct hostapd_bss_config {
@@ -72,7 +72,7 @@
  	/* IEEE 802.11u - Interworking */
  	int interworking;
 diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
-index 96209ce7e..18bae5c8b 100644
+index 96209ce..18bae5c 100644
 --- a/src/ap/ctrl_iface_ap.c
 +++ b/src/ap/ctrl_iface_ap.c
 @@ -1203,6 +1203,10 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
@@ -115,7 +115,7 @@
  	if (pos) {
  		unsigned int mbo_reason, cell_pref, reassoc_delay;
 diff --git a/src/ap/gas_serv.c b/src/ap/gas_serv.c
-index 90f15778b..5845ff857 100644
+index 90f1577..5845ff8 100644
 --- a/src/ap/gas_serv.c
 +++ b/src/ap/gas_serv.c
 @@ -19,6 +19,7 @@
@@ -183,7 +183,7 @@
  #ifdef CONFIG_FILS
  		if (info_id == ANQP_FILS_REALM_INFO &&
 diff --git a/src/ap/gas_serv.h b/src/ap/gas_serv.h
-index 1528af4af..d0241f23c 100644
+index 1528af4..d0241f2 100644
 --- a/src/ap/gas_serv.h
 +++ b/src/ap/gas_serv.h
 @@ -40,6 +40,8 @@
@@ -196,7 +196,7 @@
   * First 15 Hotspot 2.0 vendor specific ANQP-elements can be included in the
   * optimized bitmap.
 diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
-index 52f25eb7a..9254d09fd 100644
+index 52f25eb..9254d09 100644
 --- a/src/ap/neighbor_db.c
 +++ b/src/ap/neighbor_db.c
 @@ -89,6 +89,38 @@ int hostapd_neighbor_show(struct hostapd_data *hapd, char *buf, size_t buflen)
@@ -330,7 +330,7 @@
 +}
 +#endif
 diff --git a/src/ap/neighbor_db.h b/src/ap/neighbor_db.h
-index 992671b62..a1ddc075b 100644
+index 992671b..a1ddc07 100644
 --- a/src/ap/neighbor_db.h
 +++ b/src/ap/neighbor_db.h
 @@ -24,4 +24,13 @@ int hostapd_neighbor_remove(struct hostapd_data *hapd, const u8 *bssid,
@@ -348,7 +348,7 @@
 +#endif
  #endif /* NEIGHBOR_DB_H */
 diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
-index 3ea92af2d..4349e1df2 100644
+index 3ea92af..4349e1d 100644
 --- a/src/ap/wnm_ap.c
 +++ b/src/ap/wnm_ap.c
 @@ -20,6 +20,7 @@
@@ -471,5 +471,5 @@
  
  	return 0;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0002-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0002-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
index 3f20768..df95c34 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0002-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0002-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
@@ -1,14 +1,14 @@
-From 2a08e4acbe0ff6f6af42df8262178cf153c8868d Mon Sep 17 00:00:00 2001
+From d4795ed4b051c4d9d9ee130a353bbe629f2f230a Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 20 Sep 2022 19:33:45 +0800
-Subject: [PATCH 02/15] hostapd: mtk: print sae groups by hostapd ctrl
+Subject: [PATCH 02/24] hostapd: mtk: print sae groups by hostapd ctrl
 
 ---
  hostapd/ctrl_iface.c | 13 +++++++++++++
  1 file changed, 13 insertions(+)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index c2a282227..bc690c526 100644
+index c2a2822..bc690c5 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -1412,6 +1412,19 @@ static int hostapd_ctrl_iface_get(struct hostapd_data *hapd, char *cmd,
@@ -32,5 +32,5 @@
  
  	return -1;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0003-hostapd-mtk-add-support-for-runtime-set-in-band-disc.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0003-hostapd-mtk-add-support-for-runtime-set-in-band-disc.patch
index 18d5970..686d6e8 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0003-hostapd-mtk-add-support-for-runtime-set-in-band-disc.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0003-hostapd-mtk-add-support-for-runtime-set-in-band-disc.patch
@@ -1,7 +1,7 @@
-From b2253861a02b5ae8074f36e0a417e05a207891b9 Mon Sep 17 00:00:00 2001
+From 7f31f81b12c13bd0748c2c2149da3319d4b7572a Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 31 May 2022 21:15:54 +0800
-Subject: [PATCH 03/15] hostapd: mtk: add support for runtime set in-band
+Subject: [PATCH 03/24] hostapd: mtk: add support for runtime set in-band
  discovery
 
 Usage:
@@ -21,7 +21,7 @@
  5 files changed, 98 insertions(+), 4 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index bc690c526..bb8c74fd3 100644
+index bc690c5..bb8c74f 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -826,6 +826,69 @@ static int hostapd_ctrl_iface_send_qos_map_conf(struct hostapd_data *hapd,
@@ -105,7 +105,7 @@
  		reply_len = hostapd_ctrl_iface_get_config(hapd, reply,
  							  reply_size);
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index 85c41d0c3..db2125805 100644
+index 85c41d0..db21258 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -642,6 +642,24 @@ static int hostapd_cli_cmd_wps_config(struct wpa_ctrl *ctrl, int argc,
@@ -143,7 +143,7 @@
  };
  
 diff --git a/src/ap/beacon.c b/src/ap/beacon.c
-index 814e86efe..1a26f11ff 100644
+index 814e86e..1a26f11 100644
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
 @@ -1497,6 +1497,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
@@ -166,7 +166,7 @@
  						  &params->fd_frame_tmpl_len);
  
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 1fa7dd8e0..c695263bf 100644
+index 1fa7dd8..c695263 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -4498,9 +4498,10 @@ static int nl80211_fils_discovery(struct i802_bss *bss, struct nl_msg *msg,
@@ -195,7 +195,7 @@
  #endif /* CONFIG_FILS */
  
 diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
-index 0568a7909..c4bf3ad35 100644
+index 0568a79..c4bf3ad 100644
 --- a/src/drivers/nl80211_copy.h
 +++ b/src/drivers/nl80211_copy.h
 @@ -7379,6 +7379,7 @@ enum nl80211_fils_discovery_attributes {
@@ -207,5 +207,5 @@
  	/* keep last */
  	__NL80211_FILS_DISCOVERY_ATTR_LAST,
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0004-hostapd-mtk-Add-mtk_vendor.h.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0004-hostapd-mtk-Add-mtk_vendor.h.patch
index 5b1a853..1f5d0cb 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0004-hostapd-mtk-Add-mtk_vendor.h.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0004-hostapd-mtk-Add-mtk_vendor.h.patch
@@ -1,7 +1,7 @@
-From 514ffcc16d420fade1b28478cd785e7709878bc7 Mon Sep 17 00:00:00 2001
+From c52b9a7ad6817c8d7efbf0525cceb007e8bda9a8 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 30 May 2022 15:04:57 +0800
-Subject: [PATCH 04/15] hostapd: mtk: Add mtk_vendor.h
+Subject: [PATCH 04/24] hostapd: mtk: Add mtk_vendor.h
 
 ---
  src/common/mtk_vendor.h | 195 ++++++++++++++++++++++++++++++++++++++++
@@ -10,7 +10,7 @@
 
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
 new file mode 100644
-index 000000000..528387fa5
+index 0000000..528387f
 --- /dev/null
 +++ b/src/common/mtk_vendor.h
 @@ -0,0 +1,195 @@
@@ -210,5 +210,5 @@
 +};
 +#endif /* MTK_VENDOR_H */
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0005-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0005-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
index 317a678..4527d83 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0005-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0005-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
@@ -1,7 +1,7 @@
-From f3df970bcf111eb0912f639ac32c0c145e381f95 Mon Sep 17 00:00:00 2001
+From a2022c1b617c259a37eac7e8a76667df122f8040 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 30 May 2022 16:31:34 +0800
-Subject: [PATCH 05/15] hostapd: mtk: Support EDCCA hostapd configuration
+Subject: [PATCH 05/24] hostapd: mtk: Support EDCCA hostapd configuration
 
 edcca_enable and edcca_compensation and implement edcca related handlers.
 ---
@@ -20,7 +20,7 @@
  12 files changed, 415 insertions(+), 7 deletions(-)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 24018f721..b5024ccd5 100644
+index 24018f7..b5024cc 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4755,6 +4755,38 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -63,7 +63,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index bb8c74fd3..9c70d5419 100644
+index bb8c74f..9c70d54 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -598,6 +598,19 @@ static const char * pbc_status_str(enum pbc_status status)
@@ -213,7 +213,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 4a20eb4e1..344585aee 100644
+index 4a20eb4..344585a 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -294,6 +294,9 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -235,7 +235,7 @@
  	wpabuf_free(conf->civic);
  
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a87563265..4ac469910 100644
+index a875632..4ac4699 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1154,8 +1154,37 @@ struct hostapd_config {
@@ -277,7 +277,7 @@
  static inline enum oper_chan_width
  hostapd_get_oper_chwidth(struct hostapd_config *conf)
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 0c7aee276..25e967d1b 100644
+index 0c7aee2..25e967d 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1015,3 +1015,27 @@ int hostapd_drv_dpp_listen(struct hostapd_data *hapd, bool enable)
@@ -309,7 +309,7 @@
 +	return hapd->driver->get_edcca(hapd->drv_priv, mode, value);
 +}
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index b4fb766ee..70a99f406 100644
+index b4fb766..70a99f4 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -138,7 +138,10 @@ int hostapd_drv_do_acs(struct hostapd_data *hapd);
@@ -325,7 +325,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index 65487ac28..3bb38fec3 100644
+index 65487ac..3bb38fe 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
 @@ -2296,6 +2296,13 @@ dfs_offload:
@@ -343,7 +343,7 @@
  		   iface->bss[0]->conf->iface);
  	if (iface->interfaces && iface->interfaces->terminate_on_error > 0)
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 528387fa5..70561263c 100644
+index 528387f..7056126 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -29,14 +29,21 @@ enum mtk_vendor_attr_edcca_ctrl {
@@ -375,7 +375,7 @@
  	[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
  	[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 1d2b1b265..35599741c 100644
+index 1d2b1b2..3559974 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -4676,6 +4676,10 @@ struct wpa_driver_ops {
@@ -390,7 +390,7 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index c695263bf..6d4a4dbbe 100644
+index c695263..6d4a4db 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -35,6 +35,8 @@
@@ -578,7 +578,7 @@
 +	.get_edcca = nl80211_get_edcca,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 6e40d5556..13e5d248c 100644
+index 6e40d55..13e5d24 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -181,6 +181,7 @@ struct wpa_driver_nl80211_data {
@@ -590,7 +590,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 7ede0d030..732ae292d 100644
+index 7ede0d0..732ae29 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -18,6 +18,7 @@
@@ -615,5 +615,5 @@
  
  			wpa_printf(MSG_DEBUG, "nl80211: Supported vendor command: vendor_id=0x%x subcmd=%u",
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0006-hostapd-mtk-Add-hostapd-MU-SET-GET-control.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0006-hostapd-mtk-Add-hostapd-MU-SET-GET-control.patch
index 07e0d6d..4378628 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0006-hostapd-mtk-Add-hostapd-MU-SET-GET-control.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0006-hostapd-mtk-Add-hostapd-MU-SET-GET-control.patch
@@ -1,7 +1,7 @@
-From 4919444a2dc29c019ec92321109603763c732071 Mon Sep 17 00:00:00 2001
+From 927adcab2218b9fe76c7c12c89ef4604ae530639 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Tue, 9 Aug 2022 10:23:44 -0700
-Subject: [PATCH 06/15] hostapd: mtk: Add hostapd MU SET/GET control
+Subject: [PATCH 06/24] hostapd: mtk: Add hostapd MU SET/GET control
 
 ---
  hostapd/config_file.c             |   9 +++
@@ -20,7 +20,7 @@
  13 files changed, 251 insertions(+)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index b5024ccd5..cd27d0890 100644
+index b5024cc..62e8b33 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -3661,6 +3661,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -40,7 +40,7 @@
  	} else if (os_strcmp(buf, "max_listen_interval") == 0) {
  		bss->max_listen_interval = atoi(pos);
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 9c70d5419..5f71aeea9 100644
+index 9c70d54..c72f336 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3441,6 +3441,63 @@ hostapd_ctrl_iface_get_edcca(struct hostapd_data *hapd, char *cmd, char *buf,
@@ -120,7 +120,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index db2125805..0d364773b 100644
+index db21258..e16a1dc 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -1380,6 +1380,20 @@ static int hostapd_cli_cmd_driver_flags(struct wpa_ctrl *ctrl, int argc,
@@ -156,7 +156,7 @@
  	{ "dpp_qr_code", hostapd_cli_cmd_dpp_qr_code, NULL,
  	  "report a scanned DPP URI from a QR Code" },
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 344585aee..0e1f192cf 100644
+index 344585a..d4fc191 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -280,6 +280,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -168,7 +168,7 @@
  
  	/* The third octet of the country string uses an ASCII space character
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 4ac469910..0616c30bb 100644
+index 4ac4699..37779b7 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1115,6 +1115,7 @@ struct hostapd_config {
@@ -180,7 +180,7 @@
  
  	/* VHT enable/disable config from CHAN_SWITCH */
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 25e967d1b..4598737a3 100644
+index 25e967d..60b9fc0 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1039,3 +1039,17 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value)
@@ -202,7 +202,7 @@
 +	return hapd->driver->mu_dump(hapd->drv_priv, mu_onoff);
 +}
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index 70a99f406..bca39c502 100644
+index 70a99f4..185d5f3 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -142,6 +142,8 @@ int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd);
@@ -215,7 +215,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index 3bb38fec3..44a378aa9 100644
+index 3bb38fe..71d7bfa 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
 @@ -2302,6 +2302,8 @@ dfs_offload:
@@ -228,7 +228,7 @@
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 70561263c..69a46dfbb 100644
+index 7056126..ef8618e 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -10,6 +10,8 @@ enum mtk_nl80211_vendor_subcmds {
@@ -261,7 +261,7 @@
  #define ETH_ALEN 6
  
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 35599741c..4cd7505db 100644
+index 3559974..fa5ad45 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -1623,6 +1623,11 @@ struct wpa_driver_ap_params {
@@ -292,7 +292,7 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 6d4a4dbbe..f8b3f40c2 100644
+index 6d4a4db..0523aab 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -12304,6 +12304,114 @@ fail:
@@ -420,7 +420,7 @@
  	.dpp_listen = nl80211_dpp_listen,
  #endif /* CONFIG_DPP */
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 13e5d248c..57f02497e 100644
+index 13e5d24..1dd984c 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -182,6 +182,7 @@ struct wpa_driver_nl80211_data {
@@ -432,7 +432,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 732ae292d..cc146d9fc 100644
+index 732ae29..cc11891 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -1056,6 +1056,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
@@ -446,5 +446,5 @@
  			}
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0007-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-c.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0007-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-c.patch
index 8ca8c55..b33c599 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0007-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-c.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0007-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-c.patch
@@ -1,7 +1,7 @@
-From 00a1908f92e31d6d85edc877c98387a9fdb737af Mon Sep 17 00:00:00 2001
+From 1ed9156c654c1affb51bf1bfa2cc5be8f9b7c465 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 2 Sep 2022 01:03:23 +0800
-Subject: [PATCH 07/15] hostapd: mtk: Add three wire PTA ctrl hostapd vendor
+Subject: [PATCH 07/24] hostapd: mtk: Add three wire PTA ctrl hostapd vendor
  command
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -20,7 +20,7 @@
  11 files changed, 93 insertions(+)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index cd27d0890..df9c1e7a7 100644
+index 62e8b33..6e526eb 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4796,6 +4796,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -35,7 +35,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 0e1f192cf..9249a6bb8 100644
+index d4fc191..1a1a059 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -297,6 +297,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -47,7 +47,7 @@
  	return conf;
  }
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 0616c30bb..0c370e75b 100644
+index 37779b7..f1be7ae 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1158,6 +1158,19 @@ struct hostapd_config {
@@ -71,7 +71,7 @@
  
  enum edcca_mode {
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 4598737a3..a1d83e4ee 100644
+index 60b9fc0..973b44e 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1053,3 +1053,14 @@ int hostapd_drv_mu_dump(struct hostapd_data *hapd, u8 *mu_onoff)
@@ -90,7 +90,7 @@
 +	return hapd->driver->three_wire_ctrl(hapd->drv_priv, hapd->iconf->three_wire_enable);
 +}
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index bca39c502..5ba62978c 100644
+index 185d5f3..51d7b3b 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -144,6 +144,7 @@ int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
@@ -102,7 +102,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index 44a378aa9..c972b15ea 100644
+index 71d7bfa..77e7eb4 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
 @@ -2304,6 +2304,8 @@ dfs_offload:
@@ -115,7 +115,7 @@
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 69a46dfbb..ee5a4f436 100644
+index ef8618e..ed47487 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -13,6 +13,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -149,7 +149,7 @@
  	MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
  
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 4cd7505db..9ca19af81 100644
+index fa5ad45..6c4c70c 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -4693,6 +4693,14 @@ struct wpa_driver_ops {
@@ -168,7 +168,7 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index f8b3f40c2..92882cb73 100644
+index 0523aab..568c704 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -12637,6 +12637,38 @@ static int nl80211_get_edcca(void *priv, const u8 mode, u8 *value)
@@ -217,7 +217,7 @@
 +	.three_wire_ctrl = nl80211_enable_three_wire,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 57f02497e..9fe7811b9 100644
+index 1dd984c..35fd4d2 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -183,6 +183,7 @@ struct wpa_driver_nl80211_data {
@@ -229,7 +229,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index cc146d9fc..04bc54e77 100644
+index cc11891..dc2d7b1 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -1059,6 +1059,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
@@ -243,5 +243,5 @@
  			}
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0008-hostapd-mtk-Add-hostapd-iBF-control.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0008-hostapd-mtk-Add-hostapd-iBF-control.patch
index fc38b4f..d2f7b2f 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0008-hostapd-mtk-Add-hostapd-iBF-control.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0008-hostapd-mtk-Add-hostapd-iBF-control.patch
@@ -1,7 +1,7 @@
-From 508e76ba51d47394a1b01ba7b9f3c1f25db0aa39 Mon Sep 17 00:00:00 2001
+From 0d84da530a21971ee7a3572c8ce559d53b5eb138 Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:41:51 -0700
-Subject: [PATCH 08/15] hostapd: mtk: Add hostapd iBF control
+Subject: [PATCH 08/24] hostapd: mtk: Add hostapd iBF control
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
@@ -21,7 +21,7 @@
  13 files changed, 224 insertions(+), 1 deletion(-)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index df9c1e7a7..63c9d40be 100644
+index 6e526eb..579193f 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4800,6 +4800,9 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -35,7 +35,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 5f71aeea9..c881d3717 100644
+index c72f336..5590100 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3498,6 +3498,30 @@ hostapd_ctrl_iface_get_mu(struct hostapd_data *hapd, char *buf,
@@ -79,7 +79,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index 0d364773b..c2a123a8c 100644
+index e16a1dc..1f7013e 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -1586,6 +1586,13 @@ static int hostapd_cli_cmd_driver(struct wpa_ctrl *ctrl, int argc, char *argv[])
@@ -106,7 +106,7 @@
  };
  
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 9249a6bb8..7a96cb8b2 100644
+index 1a1a059..df90814 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -298,6 +298,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -118,7 +118,7 @@
  	return conf;
  }
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 0c370e75b..a9e3d2aeb 100644
+index f1be7ae..be30b51 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1159,6 +1159,7 @@ struct hostapd_config {
@@ -138,7 +138,7 @@
  static inline enum oper_chan_width
  hostapd_get_oper_chwidth(struct hostapd_config *conf)
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index a1d83e4ee..60ae8253b 100644
+index 973b44e..bec9798 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1064,3 +1064,17 @@ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd)
@@ -161,7 +161,7 @@
 +}
 \ No newline at end of file
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index 5ba62978c..ab9aedcee 100644
+index 51d7b3b..30b0322 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -145,6 +145,8 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
@@ -174,7 +174,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index c972b15ea..da7f7d87b 100644
+index 77e7eb4..e83298e 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
 @@ -2306,6 +2306,8 @@ dfs_offload:
@@ -187,7 +187,7 @@
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index ee5a4f436..4050cf886 100644
+index ed47487..7b7aeaa 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -13,7 +13,8 @@ enum mtk_nl80211_vendor_subcmds {
@@ -240,7 +240,7 @@
  #define CSI_MAX_COUNT 256
  #define ETH_ALEN 6
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 9ca19af81..71ded617f 100644
+index 6c4c70c..913a194 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -1628,6 +1628,11 @@ struct wpa_driver_ap_params {
@@ -277,7 +277,7 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 92882cb73..5c2a291ca 100644
+index 568c704..ff257eb 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -12670,6 +12670,112 @@ static int nl80211_enable_three_wire(void *priv, const u8 three_wire_enable)
@@ -401,7 +401,7 @@
 +	.ibf_dump = nl80211_ibf_dump,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 9fe7811b9..607592ceb 100644
+index 35fd4d2..92e5ad6 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -184,6 +184,7 @@ struct wpa_driver_nl80211_data {
@@ -413,7 +413,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 04bc54e77..9ecc0ff9a 100644
+index dc2d7b1..83b4c5e 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -1062,6 +1062,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
@@ -427,5 +427,5 @@
  			}
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0009-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0009-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated.patch
index daf82b0..097f4e7 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0009-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0009-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated.patch
@@ -1,7 +1,7 @@
-From 1d4ef2662fb22f96c6db3730f35879d1be55db3d Mon Sep 17 00:00:00 2001
+From 571a9efc9c8ed7ccd4460f487ccbb2c8c9c6cb97 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 22 Sep 2022 16:08:09 +0800
-Subject: [PATCH 09/15] hostapd: mtk: Do not include HE capab IE if associated
+Subject: [PATCH 09/24] hostapd: mtk: Do not include HE capab IE if associated
  sta's HE capab IE is invalid
 
 ---
@@ -9,7 +9,7 @@
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
-index d92178379..098793ef3 100644
+index d921783..098793e 100644
 --- a/src/ap/ieee802_11.c
 +++ b/src/ap/ieee802_11.c
 @@ -5192,7 +5192,8 @@ static u16 send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
@@ -23,5 +23,5 @@
  		p = hostapd_eid_he_operation(hapd, p);
  		p = hostapd_eid_cca(hapd, p);
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch
index 7ec986a..54289c7 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch
@@ -1,7 +1,7 @@
-From 6828156c206701f5a0e5d30afcc514f452ce0ada Mon Sep 17 00:00:00 2001
+From c628c4257fb1b7eb0e3689d82c7b4bee5ae5d892 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 20 Feb 2023 14:55:49 +0800
-Subject: [PATCH 10/16] hostapd: mtk: Add DFS detection mode
+Subject: [PATCH 10/24] hostapd: mtk: Add DFS detection mode
 
 Add DFS detection mode for testing radar detection rate.
 If DFS detection mode is on, AP will not switch channels when receiving
@@ -17,7 +17,7 @@
  4 files changed, 50 insertions(+)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 63c9d40..cd15349 100644
+index 579193f..8a61726 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4803,6 +4803,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -32,7 +32,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index c881d37..0b4c234 100644
+index 5590100..fcbc4ae 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3522,6 +3522,26 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
@@ -73,7 +73,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a9e3d2a..77f6169 100644
+index be30b51..d3a9fb0 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1160,6 +1160,7 @@ struct hostapd_config {
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch
index 1d8baf8..4246599 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch
@@ -1,7 +1,7 @@
-From 88dd3df28e3736af4cca0daf4f7d19ab888ea6c4 Mon Sep 17 00:00:00 2001
+From 7027df47dfc72e52763c90ecce524606e61a5384 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 20 Feb 2023 14:56:55 +0800
-Subject: [PATCH 11/16] hostapd: mtk: Add DFS offchan channel switch
+Subject: [PATCH 11/24] hostapd: mtk: Add DFS offchan channel switch
 
 Add DFS background chain channel switch command for testing purpose.
 This feature is implemented via hostapd_cli command.
@@ -16,7 +16,7 @@
  3 files changed, 96 insertions(+), 16 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 0b4c234..6ea1573 100644
+index fcbc4ae..37a1b2a 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3542,6 +3542,76 @@ hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
index 7db3ae2..01346dc 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
@@ -1,7 +1,7 @@
-From d0128fc60d38ce4f20f8368bdc5ea9ed19a329b7 Mon Sep 17 00:00:00 2001
+From 1e8a42f893d138b7ca29d4758d1528545e88d657 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 16 Dec 2022 03:57:11 +0800
-Subject: [PATCH 12/16] hostapd: mtk: Add amsdu set get ctrl
+Subject: [PATCH 12/24] hostapd: mtk: Add amsdu set get ctrl
 
 ---
  hostapd/config_file.c             |   9 +++
@@ -20,7 +20,7 @@
  13 files changed, 207 insertions(+), 1 deletion(-)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index cd15349..10ea525 100644
+index 8a61726..017c21e 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4807,6 +4807,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -40,7 +40,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 6ea1573..0ad8451 100644
+index 37a1b2a..61c9e80 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3612,6 +3612,30 @@ hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
@@ -84,7 +84,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index c2a123a..30b3392 100644
+index 1f7013e..0da18e2 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -1593,6 +1593,13 @@ static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
@@ -111,7 +111,7 @@
  };
  
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 7a96cb8..85ad5e4 100644
+index df90814..24fc0f5 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -299,6 +299,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -123,7 +123,7 @@
  	return conf;
  }
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 77f6169..a9ac396 100644
+index d3a9fb0..ce0d84c 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1161,6 +1161,7 @@ struct hostapd_config {
@@ -135,7 +135,7 @@
  
  enum three_wire_mode {
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 60ae825..1a82f23 100644
+index bec9798..342a7a8 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1077,4 +1077,18 @@ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
@@ -159,7 +159,7 @@
  }
 \ No newline at end of file
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index ab9aedc..4406666 100644
+index 30b0322..79fef71 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -147,6 +147,8 @@ int hostapd_drv_mu_dump(struct hostapd_data *hapd, u8 *mu_onoff);
@@ -172,7 +172,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index da7f7d8..a18e744 100644
+index e83298e..42e8ed7 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
 @@ -2308,6 +2308,8 @@ dfs_offload:
@@ -185,7 +185,7 @@
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 4050cf8..0999ea9 100644
+index 7b7aeaa..97c5a47 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -167,7 +167,6 @@ enum mtk_vendor_attr_wireless_ctrl {
@@ -220,7 +220,7 @@
  	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
  
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 71ded61..265d86d 100644
+index 913a194..3e034d7 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -4720,6 +4720,15 @@ struct wpa_driver_ops {
@@ -240,7 +240,7 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 5c2a291..d91b29c 100644
+index ff257eb..6c65901 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -12776,6 +12776,118 @@ fail:
@@ -370,7 +370,7 @@
 +	.amsdu_dump = nl80211_dump_amsdu,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 607592c..e570224 100644
+index 92e5ad6..21d48cc 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -185,6 +185,7 @@ struct wpa_driver_nl80211_data {
@@ -382,7 +382,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 9ecc0ff..fcfa68b 100644
+index 83b4c5e..06a52db 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -1065,6 +1065,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
index 4df0ba6..a35ed64 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
@@ -1,7 +1,7 @@
-From ebbf23ac8c19224b34523e8b9820e32f0789fe11 Mon Sep 17 00:00:00 2001
+From a8f35d893f1f3a9688b2dd52b68a9784e2778201 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 12 Jan 2023 15:18:19 +0800
-Subject: [PATCH 13/16] hostapd: mtk: Add he_ldpc configuration
+Subject: [PATCH 13/24] hostapd: mtk: Add he_ldpc configuration
 
 ---
  hostapd/config_file.c        | 2 ++
@@ -13,7 +13,7 @@
  6 files changed, 19 insertions(+)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 10ea525..4237a5c 100644
+index 017c21e..649618b 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -3508,6 +3508,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -42,7 +42,7 @@
  #he_bss_color=1
  
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 85ad5e4..b283de6 100644
+index 24fc0f5..4e46a62 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -268,6 +268,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -54,7 +54,7 @@
  		HE_OPERATION_RTS_THRESHOLD_OFFSET;
  	/* Set default basic MCS/NSS set to single stream MCS 0-7 */
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a9ac396..b8b20a7 100644
+index ce0d84c..7aeb176 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -929,6 +929,7 @@ struct hostapd_bss_config {
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
index f0d25c6..0bd08ef 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
@@ -1,7 +1,7 @@
-From bb5cb086162828392a04820063ad7997d8ae26d7 Mon Sep 17 00:00:00 2001
+From 8d6637b3e04d1d3a41d739a7e824e11f39a05fca Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 17 Jan 2023 13:25:18 +0800
-Subject: [PATCH 14/16] hostapd: mtk: Add the broadcast destination address of
+Subject: [PATCH 14/24] hostapd: mtk: Add the broadcast destination address of
  Probe Response frame on 6 GHz
 
 According to IEEE 802.11ax 26.17.2.3.2,
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
index 5fcd0c5..bbd0743 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
@@ -1,7 +1,7 @@
-From 1db373190399a907b27141c199841aeafd4643da Mon Sep 17 00:00:00 2001
+From 60b1edabde3e0f9e3e09cc4b9646e146c0c3e92a Mon Sep 17 00:00:00 2001
 From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
 Date: Tue, 24 Jan 2023 19:06:44 +0800
-Subject: [PATCH 15/16] hostapd: mtk: Add vendor command attribute for RTS BW
+Subject: [PATCH 15/24] hostapd: mtk: Add vendor command attribute for RTS BW
  signaling.
 
 Signed-off-by: himanshu.goyal <himanshu.goyal@mediatek.com>
@@ -10,7 +10,7 @@
  1 file changed, 1 insertion(+)
 
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 0999ea9..fb12895 100644
+index 97c5a47..62d79cb 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -169,6 +169,7 @@ enum mtk_vendor_attr_wireless_ctrl {
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
index 33fea78..63b0bae 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
@@ -1,7 +1,7 @@
-From efa1d271d28c84b8ca77ffc3ca7cb75e727088a0 Mon Sep 17 00:00:00 2001
+From 4cf61c8d0aa99d1e15afafe6c9f0eab24814f615 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 13 Feb 2023 11:03:53 +0800
-Subject: [PATCH 16/16] hostapd: mtk: 6G band does not require DFS
+Subject: [PATCH 16/24] hostapd: mtk: 6G band does not require DFS
 
 ---
  src/ap/dfs.c | 1 +
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch
index 265c37a..0e2327b 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch
@@ -1,8 +1,8 @@
-From f6bfd9a4a6c0d08e0dec9311873c9e863a07c9a8 Mon Sep 17 00:00:00 2001
+From c0b5c3ba905d10495f1f035fd93bbdd5295d60ea Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 20 Feb 2023 11:01:18 +0800
-Subject: [PATCH] hostapd: mtk: Fix sending wrong VHT operation IE in CSA while
- using ZWDFS
+Subject: [PATCH 17/24] hostapd: mtk: Fix sending wrong VHT operation IE in CSA
+ while using ZWDFS
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch
index db3c813..027aab4 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch
@@ -1,7 +1,7 @@
-From 3337e7b4f75a66e53e1320e49deba2b58a8a80b0 Mon Sep 17 00:00:00 2001
+From a96e3398373b64bca5e33c8eb1a6d289bb07837b Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 20 Feb 2023 10:51:47 +0800
-Subject: [PATCH 18/19] hostapd: mtk: Add sta-assisted DFS state update
+Subject: [PATCH 18/24] hostapd: mtk: Add sta-assisted DFS state update
  mechanism
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -119,7 +119,7 @@
  #define AP_CSA_FINISHED "AP-CSA-FINISHED "
  
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 265d86d..b5de0e6 100644
+index 3e034d7..82daef0 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -5317,6 +5317,20 @@ enum wpa_event_type {
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch
index 8340fd9..a29ec33 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch
@@ -1,7 +1,8 @@
-From 83ab1a9cc51225095842d3c62bf75cf4efe63075 Mon Sep 17 00:00:00 2001
+From 61b475daa5dbf9802932657943d1322cb5c8f5b3 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 20 Feb 2023 16:58:20 +0800
-Subject: [PATCH] hostapd: mtk: Fix auto ht issue when switching to DFS channel
+Subject: [PATCH 19/24] hostapd: mtk: Fix auto ht issue when switching to DFS
+ channel
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -9,7 +10,7 @@
  1 file changed, 6 insertions(+), 6 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 0ad8451..407790f 100644
+index 61c9e80..c33b7a4 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -2698,6 +2698,12 @@ static int hostapd_ctrl_iface_chan_switch(struct hostapd_iface *iface,
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0020-hostapd-mtk-Mark-DFS-channel-as-available-for-CSA.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0020-hostapd-mtk-Mark-DFS-channel-as-available-for-CSA.patch
index 1fe5c88..6e9e315 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0020-hostapd-mtk-Mark-DFS-channel-as-available-for-CSA.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0020-hostapd-mtk-Mark-DFS-channel-as-available-for-CSA.patch
@@ -1,7 +1,7 @@
-From 3e9500a42a41e8cd7c2d7bc20aba96e1e17161fb Mon Sep 17 00:00:00 2001
+From 4cfadfd4c22232fc973e81a70039324b3db383ab Mon Sep 17 00:00:00 2001
 From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
 Date: Fri, 3 Mar 2023 12:45:42 +0800
-Subject: [PATCH] hostapd: mtk: Mark DFS channel as available for CSA.
+Subject: [PATCH 20/24] hostapd: mtk: Mark DFS channel as available for CSA.
 
 ---
  hostapd/ctrl_iface.c   | 10 ++++++++++
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support-for-hostapd.patch
similarity index 99%
rename from recipes-wifi/hostapd/files/patches-2.10.3/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support.patch
rename to recipes-wifi/hostapd/files/patches-2.10.3/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support-for-hostapd.patch
index 8d59a0f..a9e802d 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support-for-hostapd.patch
@@ -1,7 +1,7 @@
-From 8cbdb9a59e3bbe8804f909b13ce6df6e2777c3da Mon Sep 17 00:00:00 2001
+From 832350b2c16a9ad2f65c32d32584e7cdb06b074a Mon Sep 17 00:00:00 2001
 From: mtk20656 <chank.chen@mediatek.com>
 Date: Thu, 2 Mar 2023 10:51:43 +0800
-Subject: [PATCH] hostapd: mtk: add 11v_mbss and ema support for hostapd
+Subject: [PATCH 21/24] hostapd: mtk: add 11v_mbss and ema support for hostapd
 
 Signed-off-by: mtk20656 <chank.chen@mediatek.com>
 ---
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0022-hostapd-mtk-Add-available-color-bitmap.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0022-hostapd-mtk-Add-available-color-bitmap.patch
index 9bbbf87..a0065f3 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0022-hostapd-mtk-Add-available-color-bitmap.patch
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0022-hostapd-mtk-Add-available-color-bitmap.patch
@@ -1,7 +1,7 @@
-From e7790a1bceca6b7612f29b00c429cf23f5dd9e3a Mon Sep 17 00:00:00 2001
+From 46c88d8e3c513c04891913c77de179de9e7f36cd Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Thu, 26 Jan 2023 09:16:00 +0800
-Subject: [PATCH] hostapd: mtk: Add available color bitmap
+Subject: [PATCH 22/24] hostapd: mtk: Add available color bitmap
 
 Signed-off-by: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 ---
@@ -17,10 +17,10 @@
  9 files changed, 192 insertions(+), 1 deletion(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 0ad8451..b0d5ded 100644
+index 9ba6992..e1e9270 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -3635,6 +3635,76 @@ hostapd_ctrl_iface_get_amsdu(struct hostapd_data *hapd, char *buf,
+@@ -3645,6 +3645,76 @@ hostapd_ctrl_iface_get_amsdu(struct hostapd_data *hapd, char *buf,
  	return ret;
  }
  
@@ -97,7 +97,7 @@
  
  static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
  					      char *buf, char *reply,
-@@ -4202,6 +4272,10 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+@@ -4212,6 +4282,10 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
  		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
  	} else if (os_strncmp(buf, "GET_AMSDU", 9) == 0) {
  		reply_len = hostapd_ctrl_iface_get_amsdu(hapd, reply, reply_size);
@@ -109,7 +109,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index 30b3392..b6cf52e 100644
+index 6231e51..aad7aa5 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -1578,6 +1578,20 @@ static int hostapd_cli_cmd_reload_wpa_psk(struct wpa_ctrl *ctrl, int argc,
@@ -145,7 +145,7 @@
  	{ "driver", hostapd_cli_cmd_driver, NULL,
  	  "<driver sub command> [<hex formatted data>] = send driver command data" },
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 1a82f23..decffdd 100644
+index 342a7a8..40b9a20 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1091,4 +1091,12 @@ int hostapd_drv_amsdu_dump(struct hostapd_data *hapd, u8 *amsdu)
@@ -164,7 +164,7 @@
 +	return hapd->driver->get_aval_color_bmp(hapd->drv_priv, aval_color_bmp);
 +}
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index 4406666..61c1360 100644
+index 79fef71..136a3ac 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -149,6 +149,8 @@ int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd);
@@ -177,7 +177,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 0999ea9..f2afb2e 100644
+index 62d79cb..a99e6f2 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -15,6 +15,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -188,7 +188,7 @@
  };
  
  enum mtk_vendor_attr_edcca_ctrl {
-@@ -252,6 +253,16 @@ ibf_dump_policy[NUM_MTK_VENDOR_ATTRS_IBF_DUMP] = {
+@@ -253,6 +254,16 @@ ibf_dump_policy[NUM_MTK_VENDOR_ATTRS_IBF_DUMP] = {
  	[MTK_VENDOR_ATTR_IBF_DUMP_ENABLE] = { .type = NLA_U8 },
  };
  
@@ -206,10 +206,10 @@
  #define CSI_MAX_COUNT 256
  #define ETH_ALEN 6
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index b07aaf3..266c630 100644
+index 36f465c..7f6392f 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -4736,6 +4736,14 @@ struct wpa_driver_ops {
+@@ -4771,6 +4771,14 @@ struct wpa_driver_ops {
  	 */
  	int (*amsdu_ctrl)(void *priv, u8 amsdu);
  	int (*amsdu_dump)(void *priv, u8 *amsdu);
@@ -225,10 +225,10 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 6702384..c8771f7 100644
+index 3753409..f9a8763 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -12433,6 +12433,71 @@ static int nl80211_dpp_listen(void *priv, bool enable)
+@@ -12485,6 +12485,71 @@ static int nl80211_dpp_listen(void *priv, bool enable)
  }
  #endif /* CONFIG_DPP */
  
@@ -300,14 +300,14 @@
  
  #ifdef CONFIG_TESTING_OPTIONS
  
-@@ -13073,4 +13138,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.start_disabled = nl80211_start_disabled,
+@@ -13096,4 +13161,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.ibf_dump = nl80211_ibf_dump,
  	.amsdu_ctrl = nl80211_enable_amsdu,
  	.amsdu_dump = nl80211_dump_amsdu,
 +	.get_aval_color_bmp = nl80211_get_aval_color_bmp,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index e570224..b90c8fa 100644
+index 21d48cc..72c7abd 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -186,6 +186,7 @@ struct wpa_driver_nl80211_data {
@@ -319,10 +319,10 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index fcfa68b..c3c7b41 100644
+index d8078bc..e7c6f39 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
-@@ -1068,6 +1068,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+@@ -1092,6 +1092,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
  				case MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL:
  					drv->mtk_wireless_vendor_cmd_avail = 1;
  					break;
@@ -333,5 +333,5 @@
  			}
  
 -- 
-2.39.0
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0023-hostapd-mtk-Add-channel-information-for-hostapd-relo.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0023-hostapd-mtk-Add-channel-information-for-hostapd-relo.patch
new file mode 100644
index 0000000..b03656e
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0023-hostapd-mtk-Add-channel-information-for-hostapd-relo.patch
@@ -0,0 +1,79 @@
+From 6435612049c0a21a30ea835a31d07b6c14b3b248 Mon Sep 17 00:00:00 2001
+From: Michael Lee <michael-cy.lee@mediatek.com>
+Date: Wed, 22 Mar 2023 13:59:29 +0800
+Subject: [PATCH 23/24] hostapd: mtk: Add channel information for hostapd
+ reload
+
+Add center channel, operating class, and bandwidth into the UPDATE
+command when wpa_supplciant reloads hostapd.
+Hostapd can correctly update its channel information.
+
+Signed-off-by: Michael Lee <michael-cy.lee@mediatek.com>
+---
+ hostapd/ctrl_iface.c            | 11 +++++++++++
+ wpa_supplicant/wpa_supplicant.c | 17 ++++++++++++++---
+ 2 files changed, 25 insertions(+), 3 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index e1e9270..4c5d494 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -170,6 +170,17 @@ static struct hostapd_config *hostapd_ctrl_iface_config_read(const char *fname)
+ 			conf->hw_mode = atoi(val);
+ 		else if ((val = get_option(opt, "ieee80211n=")))
+ 			conf->ieee80211n = atoi(val);
++		else if ((val = get_option(opt, "center_segment0=")))
++			hostapd_set_oper_centr_freq_seg0_idx(conf, atoi(val));
++		else if ((val = get_option(opt, "center_segment1=")))
++			hostapd_set_oper_centr_freq_seg1_idx(conf, atoi(val));
++		else if ((val = get_option(opt, "op_class="))) {
++			enum oper_chan_width ch_width;
++
++			conf->op_class = atoi(val);
++			ch_width = op_class_to_ch_width(conf->op_class);
++			hostapd_set_oper_chwidth(conf, ch_width);
++		}
+ 		else
+ 			break;
+ 	}
+diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
+index 270da46..4930f7a 100644
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -150,9 +150,10 @@ static int hostapd_reload(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
+ 	char buf[256];
+ 	size_t len = sizeof(buf);
+ 	enum hostapd_hw_mode hw_mode;
+-	u8 channel;
++	u8 channel, center_segment0, center_segment1, op_class;
+ 	int sec_chan = 0;
+ 	int ret;
++	struct wpa_channel_info ci;
+ 
+ 	if (!bss)
+ 		return -1;
+@@ -165,9 +166,19 @@ static int hostapd_reload(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
+ 			sec_chan = -1;
+ 	}
+ 
++	ret = wpa_drv_channel_info(wpa_s, &ci);
++	if (ret)
++		return -1;
++
++	ieee80211_freq_to_chan(ci.center_frq1, &center_segment0);
++	ieee80211_freq_to_chan(ci.center_frq2, &center_segment1);
++	ieee80211_chaninfo_to_channel(ci.frequency, ci.chanwidth, sec_chan,
++				      &op_class, &channel);
+ 	hw_mode = ieee80211_freq_to_chan(bss->freq, &channel);
+-	if (asprintf(&cmd, "UPDATE channel=%d sec_chan=%d hw_mode=%d",
+-		     channel, sec_chan, hw_mode) < 0)
++	if (asprintf(&cmd, "UPDATE channel=%d center_segment0=%d "
++		     "center_segment1=%d sec_chan=%d hw_mode=%d op_class=%d",
++		     channel, center_segment0, center_segment1, sec_chan,
++		     hw_mode, op_class) < 0)
+ 		return -1;
+ 
+ 	ret = wpa_ctrl_request(wpa_s->hostapd, cmd, os_strlen(cmd), buf, &len, NULL);
+-- 
+2.18.0
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0024-hostapd-mtk-Fix-ZWDFS-issue-in-BW-160.patch b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0024-hostapd-mtk-Fix-ZWDFS-issue-in-BW-160.patch
new file mode 100644
index 0000000..e914686
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/mtk-0024-hostapd-mtk-Fix-ZWDFS-issue-in-BW-160.patch
@@ -0,0 +1,210 @@
+From 3a119f804f87e8535908c772d3c7251bc6bfa524 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Mar 2023 16:08:30 +0800
+Subject: [PATCH 24/24] hostapd: mtk: Fix ZWDFS issue in BW 160
+
+When background radar is enabled and bandwidth is set to 160, AP will
+fail to startup due to the lack of non-DFS channel.
+Under this circumstance, AP should perform CAC itself, and the background
+chain could also perform CAC simultaneously.
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ src/ap/dfs.c | 98 ++++++++++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 79 insertions(+), 19 deletions(-)
+
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index d082fe0..d688ecb 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -69,15 +69,22 @@ static int dfs_get_used_n_chans(struct hostapd_iface *iface, int *seg1)
+ static int dfs_channel_available(struct hostapd_channel_data *chan,
+ 				 enum dfs_channel_type type)
+ {
++	int dfs_status = chan->flag & HOSTAPD_CHAN_DFS_MASK;
++
++	if (chan->flag & HOSTAPD_CHAN_DISABLED)
++		return -1;
++
+ 	if (type == DFS_NO_CAC_YET) {
+ 		/* Select only radar channel where CAC has not been
+ 		 * performed yet
+ 		 */
+-		if ((chan->flag & HOSTAPD_CHAN_RADAR) &&
+-		    (chan->flag & HOSTAPD_CHAN_DFS_MASK) ==
+-		     HOSTAPD_CHAN_DFS_USABLE)
++		if (!(chan->flag & HOSTAPD_CHAN_RADAR))
++			return 0;
++
++		if (dfs_status == HOSTAPD_CHAN_DFS_USABLE)
+ 			return 1;
+-		return 0;
++
++		return -1;
+ 	}
+ 
+ 	/*
+@@ -86,16 +93,14 @@ static int dfs_channel_available(struct hostapd_channel_data *chan,
+ 	 * channel for CSA, unless they are available for immediate use.
+ 	 */
+ 	if (type == DFS_AVAILABLE && (chan->flag & HOSTAPD_CHAN_RADAR) &&
+-	    ((chan->flag & HOSTAPD_CHAN_DFS_MASK) !=
+-	     HOSTAPD_CHAN_DFS_AVAILABLE))
+-		return 0;
++	    (dfs_status != HOSTAPD_CHAN_DFS_AVAILABLE))
++		return -1;
+ 
+-	if (chan->flag & HOSTAPD_CHAN_DISABLED)
+-		return 0;
+ 	if ((chan->flag & HOSTAPD_CHAN_RADAR) &&
+-	    ((chan->flag & HOSTAPD_CHAN_DFS_MASK) ==
+-	     HOSTAPD_CHAN_DFS_UNAVAILABLE))
+-		return 0;
++	    ((dfs_status == HOSTAPD_CHAN_DFS_UNAVAILABLE) ||
++	    (dfs_status == HOSTAPD_CHAN_DFS_UNKNOWN)))
++		return -1;
++
+ 	return 1;
+ }
+ 
+@@ -167,7 +172,7 @@ static int dfs_chan_range_available(struct hostapd_hw_modes *mode,
+ 				    enum dfs_channel_type type)
+ {
+ 	struct hostapd_channel_data *first_chan, *chan;
+-	int i;
++	int i, available = 0, ret = 0;
+ 	u32 bw = num_chan_to_bw(num_chans);
+ 
+ 	if (first_chan_idx + num_chans > mode->num_channels) {
+@@ -203,14 +208,17 @@ static int dfs_chan_range_available(struct hostapd_hw_modes *mode,
+ 			return 0;
+ 		}
+ 
+-		if (!dfs_channel_available(chan, type)) {
++		ret = dfs_channel_available(chan, type);
++		if (ret < 0) {
+ 			wpa_printf(MSG_DEBUG, "DFS: channel not available %d",
+ 				   first_chan->freq + i * 20);
+ 			return 0;
+ 		}
++
++		available |= ret;
+ 	}
+ 
+-	return 1;
++	return available;
+ }
+ 
+ 
+@@ -826,8 +834,12 @@ static unsigned int dfs_get_cac_time(struct hostapd_iface *iface,
+  */
+ int hostapd_handle_dfs(struct hostapd_iface *iface)
+ {
++	struct hostapd_channel_data *channel;
+ 	int res, n_chans, n_chans1, start_chan_idx, start_chan_idx1;
+-	int skip_radar = 0;
++	int sec = 0, skip_radar = 0;
++	u8 cf1 = 0, cf2 = 0;
++	bool use_radar_background = dfs_use_radar_background(iface);
++	enum dfs_channel_type channel_type = DFS_NO_CAC_YET;
+ 
+ 	if (is_6ghz_freq(iface->freq))
+ 		return 1;
+@@ -890,7 +902,7 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
+ 	/* Finally start CAC */
+ 	hostapd_set_state(iface, HAPD_IFACE_DFS);
+ 	wpa_printf(MSG_DEBUG, "DFS start CAC on %d MHz%s", iface->freq,
+-		   dfs_use_radar_background(iface) ? " (background)" : "");
++		   use_radar_background ? " (background)" : "");
+ 	wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_CAC_START
+ 		"freq=%d chan=%d sec_chan=%d, width=%d, seg0=%d, seg1=%d, cac_time=%ds",
+ 		iface->freq,
+@@ -900,6 +912,16 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
+ 		hostapd_get_oper_centr_freq_seg1_idx(iface->conf),
+ 		iface->dfs_cac_ms / 1000);
+ 
++	if (use_radar_background) {
++		channel = dfs_get_valid_channel(iface, &sec, &cf1, &cf2, DFS_AVAILABLE);
++		/*
++		 * AP cannot get any random available channel.
++		 * Let AP and dedicated radar chain both perform CAC.
++		 */
++		if (!channel)
++			use_radar_background = false;
++	}
++
+ 	res = hostapd_start_dfs_cac(
+ 		iface, iface->conf->hw_mode, iface->freq, iface->conf->channel,
+ 		iface->conf->ieee80211n, iface->conf->ieee80211ac,
+@@ -908,14 +930,14 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
+ 		hostapd_get_oper_chwidth(iface->conf),
+ 		hostapd_get_oper_centr_freq_seg0_idx(iface->conf),
+ 		hostapd_get_oper_centr_freq_seg1_idx(iface->conf),
+-		dfs_use_radar_background(iface));
++		use_radar_background);
+ 
+ 	if (res) {
+ 		wpa_printf(MSG_ERROR, "DFS start_dfs_cac() failed, %d", res);
+ 		return -1;
+ 	}
+ 
+-	if (dfs_use_radar_background(iface)) {
++	if (use_radar_background) {
+ 		/* Cache background radar parameters. */
+ 		iface->radar_background.channel = iface->conf->channel;
+ 		iface->radar_background.secondary_channel =
+@@ -936,6 +958,35 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
+ 
+ 		iface->radar_background.temp_ch = 1;
+ 		return 1;
++	} else if (dfs_use_radar_background(iface)) {
++		if (iface->dfs_domain == HOSTAPD_DFS_REGION_ETSI)
++			channel_type = DFS_ANY_CHANNEL;
++
++		channel = dfs_get_valid_channel(iface, &sec, &cf1, &cf2, channel_type);
++
++		if (!channel ||
++		    (channel->chan == iface->conf->channel &&
++		    cf1 == hostapd_get_oper_centr_freq_seg0_idx(iface->conf) &&
++		    cf2 == hostapd_get_oper_centr_freq_seg1_idx(iface->conf))) {
++			wpa_printf(MSG_ERROR, "Background radar could not get valid channel\n");
++			iface->radar_background.channel = -1;
++			return 0;
++		}
++
++		hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
++				      channel->freq, channel->chan,
++				      iface->conf->ieee80211n,
++				      iface->conf->ieee80211ac,
++				      iface->conf->ieee80211ax,
++				      iface->conf->ieee80211be,
++				      sec, hostapd_get_oper_chwidth(iface->conf),
++				      cf1, cf2, true);
++
++		iface->radar_background.channel = channel->chan;
++		iface->radar_background.freq = channel->freq;
++		iface->radar_background.secondary_channel = sec;
++		iface->radar_background.centr_freq_seg0_idx = cf1;
++		iface->radar_background.centr_freq_seg1_idx = cf2;
+ 	}
+ 
+ 	return 0;
+@@ -1185,6 +1236,15 @@ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
+ 				hostapd_setup_interface_complete(iface, 0);
+ 				iface->cac_started = 0;
+ 			}
++
++			/*
++			 * When background radar is enabled but the CAC completion
++			 * is not received from the background chain.
++			 * Then, reset radar background chain.
++			 */
++			if (dfs_use_radar_background(iface) &&
++			    iface->radar_background.channel == -1)
++				hostpad_dfs_update_background_chain(iface);
+ 		}
+ 	} else if (hostapd_dfs_is_background_event(iface, freq)) {
+ 		iface->radar_background.cac_started = 0;
+-- 
+2.18.0
+
diff --git a/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc b/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
index 283b55c..1265b34 100644
--- a/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
+++ b/recipes-wifi/hostapd/files/patches-2.10.3/patches.inc
@@ -82,7 +82,9 @@
     file://mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch \
     file://mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch \
     file://mtk-0020-hostapd-mtk-Mark-DFS-channel-as-available-for-CSA.patch \
-    file://mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support.patch \
+    file://mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support-for-hostapd.patch \
     file://mtk-0022-hostapd-mtk-Add-available-color-bitmap.patch \
+    file://mtk-0023-hostapd-mtk-Add-channel-information-for-hostapd-relo.patch \
+    file://mtk-0024-hostapd-mtk-Fix-ZWDFS-issue-in-BW-160.patch \
     file://mtk-0100-hostapd-mtk-update-eht-operation-elem.patch \
     "
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0001-hostapd-mtk-Add-neighbor-report-and-BSS-Termination-.patch b/recipes-wifi/hostapd/files/patches/mtk-0001-hostapd-mtk-Add-neighbor-report-and-BSS-Termination-.patch
index fb7c63f..0c0e3c6 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0001-hostapd-mtk-Add-neighbor-report-and-BSS-Termination-.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0001-hostapd-mtk-Add-neighbor-report-and-BSS-Termination-.patch
@@ -1,7 +1,7 @@
-From cd52509a69c3ba34d9b4146664140fd1ff712aa9 Mon Sep 17 00:00:00 2001
+From d76ef3ce86c91a33baa763014c8a991faa4fae4a Mon Sep 17 00:00:00 2001
 From: "howard.hsu" <howard-yh.hsu@mediatek.com>
 Date: Wed, 19 Jan 2022 19:18:07 +0800
-Subject: [PATCH 01/15] hostapd: mtk: Add neighbor report and BSS Termination
+Subject: [PATCH 01/24] hostapd: mtk: Add neighbor report and BSS Termination
  for MBO certification
 
 1. Add hostapd_neighbor_count() and hostapd_neighbor_insert_buffer ()
@@ -32,7 +32,7 @@
  9 files changed, 252 insertions(+), 5 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index a2584920c..c2a282227 100644
+index a258492..c2a2822 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -1338,6 +1338,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
@@ -48,7 +48,7 @@
  		ret = hostapd_set_iface(hapd->iconf, hapd->conf, cmd, value);
  		if (ret)
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index d7a0c7c80..4a20eb4e1 100644
+index d7a0c7c..4a20eb4 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -170,6 +170,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
@@ -60,7 +60,7 @@
  
  
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 39b26d602..a87563265 100644
+index 39b26d6..a875632 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -558,6 +558,7 @@ struct hostapd_bss_config {
@@ -72,7 +72,7 @@
  	/* IEEE 802.11u - Interworking */
  	int interworking;
 diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
-index 96209ce7e..18bae5c8b 100644
+index 96209ce..18bae5c 100644
 --- a/src/ap/ctrl_iface_ap.c
 +++ b/src/ap/ctrl_iface_ap.c
 @@ -1203,6 +1203,10 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
@@ -115,7 +115,7 @@
  	if (pos) {
  		unsigned int mbo_reason, cell_pref, reassoc_delay;
 diff --git a/src/ap/gas_serv.c b/src/ap/gas_serv.c
-index 90f15778b..5845ff857 100644
+index 90f1577..5845ff8 100644
 --- a/src/ap/gas_serv.c
 +++ b/src/ap/gas_serv.c
 @@ -19,6 +19,7 @@
@@ -183,7 +183,7 @@
  #ifdef CONFIG_FILS
  		if (info_id == ANQP_FILS_REALM_INFO &&
 diff --git a/src/ap/gas_serv.h b/src/ap/gas_serv.h
-index 1528af4af..d0241f23c 100644
+index 1528af4..d0241f2 100644
 --- a/src/ap/gas_serv.h
 +++ b/src/ap/gas_serv.h
 @@ -40,6 +40,8 @@
@@ -196,7 +196,7 @@
   * First 15 Hotspot 2.0 vendor specific ANQP-elements can be included in the
   * optimized bitmap.
 diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
-index 52f25eb7a..9254d09fd 100644
+index 52f25eb..9254d09 100644
 --- a/src/ap/neighbor_db.c
 +++ b/src/ap/neighbor_db.c
 @@ -89,6 +89,38 @@ int hostapd_neighbor_show(struct hostapd_data *hapd, char *buf, size_t buflen)
@@ -330,7 +330,7 @@
 +}
 +#endif
 diff --git a/src/ap/neighbor_db.h b/src/ap/neighbor_db.h
-index 992671b62..a1ddc075b 100644
+index 992671b..a1ddc07 100644
 --- a/src/ap/neighbor_db.h
 +++ b/src/ap/neighbor_db.h
 @@ -24,4 +24,13 @@ int hostapd_neighbor_remove(struct hostapd_data *hapd, const u8 *bssid,
@@ -348,7 +348,7 @@
 +#endif
  #endif /* NEIGHBOR_DB_H */
 diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
-index 3ea92af2d..4349e1df2 100644
+index 3ea92af..4349e1d 100644
 --- a/src/ap/wnm_ap.c
 +++ b/src/ap/wnm_ap.c
 @@ -20,6 +20,7 @@
@@ -471,5 +471,5 @@
  
  	return 0;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0002-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch b/recipes-wifi/hostapd/files/patches/mtk-0002-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
index 3f20768..df95c34 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0002-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0002-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
@@ -1,14 +1,14 @@
-From 2a08e4acbe0ff6f6af42df8262178cf153c8868d Mon Sep 17 00:00:00 2001
+From d4795ed4b051c4d9d9ee130a353bbe629f2f230a Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 20 Sep 2022 19:33:45 +0800
-Subject: [PATCH 02/15] hostapd: mtk: print sae groups by hostapd ctrl
+Subject: [PATCH 02/24] hostapd: mtk: print sae groups by hostapd ctrl
 
 ---
  hostapd/ctrl_iface.c | 13 +++++++++++++
  1 file changed, 13 insertions(+)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index c2a282227..bc690c526 100644
+index c2a2822..bc690c5 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -1412,6 +1412,19 @@ static int hostapd_ctrl_iface_get(struct hostapd_data *hapd, char *cmd,
@@ -32,5 +32,5 @@
  
  	return -1;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0003-hostapd-mtk-add-support-for-runtime-set-in-band-disc.patch b/recipes-wifi/hostapd/files/patches/mtk-0003-hostapd-mtk-add-support-for-runtime-set-in-band-disc.patch
index 18d5970..686d6e8 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0003-hostapd-mtk-add-support-for-runtime-set-in-band-disc.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0003-hostapd-mtk-add-support-for-runtime-set-in-band-disc.patch
@@ -1,7 +1,7 @@
-From b2253861a02b5ae8074f36e0a417e05a207891b9 Mon Sep 17 00:00:00 2001
+From 7f31f81b12c13bd0748c2c2149da3319d4b7572a Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 31 May 2022 21:15:54 +0800
-Subject: [PATCH 03/15] hostapd: mtk: add support for runtime set in-band
+Subject: [PATCH 03/24] hostapd: mtk: add support for runtime set in-band
  discovery
 
 Usage:
@@ -21,7 +21,7 @@
  5 files changed, 98 insertions(+), 4 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index bc690c526..bb8c74fd3 100644
+index bc690c5..bb8c74f 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -826,6 +826,69 @@ static int hostapd_ctrl_iface_send_qos_map_conf(struct hostapd_data *hapd,
@@ -105,7 +105,7 @@
  		reply_len = hostapd_ctrl_iface_get_config(hapd, reply,
  							  reply_size);
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index 85c41d0c3..db2125805 100644
+index 85c41d0..db21258 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -642,6 +642,24 @@ static int hostapd_cli_cmd_wps_config(struct wpa_ctrl *ctrl, int argc,
@@ -143,7 +143,7 @@
  };
  
 diff --git a/src/ap/beacon.c b/src/ap/beacon.c
-index 814e86efe..1a26f11ff 100644
+index 814e86e..1a26f11 100644
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
 @@ -1497,6 +1497,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
@@ -166,7 +166,7 @@
  						  &params->fd_frame_tmpl_len);
  
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 1fa7dd8e0..c695263bf 100644
+index 1fa7dd8..c695263 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -4498,9 +4498,10 @@ static int nl80211_fils_discovery(struct i802_bss *bss, struct nl_msg *msg,
@@ -195,7 +195,7 @@
  #endif /* CONFIG_FILS */
  
 diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
-index 0568a7909..c4bf3ad35 100644
+index 0568a79..c4bf3ad 100644
 --- a/src/drivers/nl80211_copy.h
 +++ b/src/drivers/nl80211_copy.h
 @@ -7379,6 +7379,7 @@ enum nl80211_fils_discovery_attributes {
@@ -207,5 +207,5 @@
  	/* keep last */
  	__NL80211_FILS_DISCOVERY_ATTR_LAST,
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0004-hostapd-mtk-Add-mtk_vendor.h.patch b/recipes-wifi/hostapd/files/patches/mtk-0004-hostapd-mtk-Add-mtk_vendor.h.patch
index 5b1a853..1f5d0cb 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0004-hostapd-mtk-Add-mtk_vendor.h.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0004-hostapd-mtk-Add-mtk_vendor.h.patch
@@ -1,7 +1,7 @@
-From 514ffcc16d420fade1b28478cd785e7709878bc7 Mon Sep 17 00:00:00 2001
+From c52b9a7ad6817c8d7efbf0525cceb007e8bda9a8 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 30 May 2022 15:04:57 +0800
-Subject: [PATCH 04/15] hostapd: mtk: Add mtk_vendor.h
+Subject: [PATCH 04/24] hostapd: mtk: Add mtk_vendor.h
 
 ---
  src/common/mtk_vendor.h | 195 ++++++++++++++++++++++++++++++++++++++++
@@ -10,7 +10,7 @@
 
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
 new file mode 100644
-index 000000000..528387fa5
+index 0000000..528387f
 --- /dev/null
 +++ b/src/common/mtk_vendor.h
 @@ -0,0 +1,195 @@
@@ -210,5 +210,5 @@
 +};
 +#endif /* MTK_VENDOR_H */
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0005-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch b/recipes-wifi/hostapd/files/patches/mtk-0005-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
index 317a678..4527d83 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0005-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0005-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
@@ -1,7 +1,7 @@
-From f3df970bcf111eb0912f639ac32c0c145e381f95 Mon Sep 17 00:00:00 2001
+From a2022c1b617c259a37eac7e8a76667df122f8040 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 30 May 2022 16:31:34 +0800
-Subject: [PATCH 05/15] hostapd: mtk: Support EDCCA hostapd configuration
+Subject: [PATCH 05/24] hostapd: mtk: Support EDCCA hostapd configuration
 
 edcca_enable and edcca_compensation and implement edcca related handlers.
 ---
@@ -20,7 +20,7 @@
  12 files changed, 415 insertions(+), 7 deletions(-)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 24018f721..b5024ccd5 100644
+index 24018f7..b5024cc 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4755,6 +4755,38 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -63,7 +63,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index bb8c74fd3..9c70d5419 100644
+index bb8c74f..9c70d54 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -598,6 +598,19 @@ static const char * pbc_status_str(enum pbc_status status)
@@ -213,7 +213,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 4a20eb4e1..344585aee 100644
+index 4a20eb4..344585a 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -294,6 +294,9 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -235,7 +235,7 @@
  	wpabuf_free(conf->civic);
  
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a87563265..4ac469910 100644
+index a875632..4ac4699 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1154,8 +1154,37 @@ struct hostapd_config {
@@ -277,7 +277,7 @@
  static inline enum oper_chan_width
  hostapd_get_oper_chwidth(struct hostapd_config *conf)
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 0c7aee276..25e967d1b 100644
+index 0c7aee2..25e967d 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1015,3 +1015,27 @@ int hostapd_drv_dpp_listen(struct hostapd_data *hapd, bool enable)
@@ -309,7 +309,7 @@
 +	return hapd->driver->get_edcca(hapd->drv_priv, mode, value);
 +}
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index b4fb766ee..70a99f406 100644
+index b4fb766..70a99f4 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -138,7 +138,10 @@ int hostapd_drv_do_acs(struct hostapd_data *hapd);
@@ -325,7 +325,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index 65487ac28..3bb38fec3 100644
+index 65487ac..3bb38fe 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
 @@ -2296,6 +2296,13 @@ dfs_offload:
@@ -343,7 +343,7 @@
  		   iface->bss[0]->conf->iface);
  	if (iface->interfaces && iface->interfaces->terminate_on_error > 0)
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 528387fa5..70561263c 100644
+index 528387f..7056126 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -29,14 +29,21 @@ enum mtk_vendor_attr_edcca_ctrl {
@@ -375,7 +375,7 @@
  	[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
  	[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 1d2b1b265..35599741c 100644
+index 1d2b1b2..3559974 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -4676,6 +4676,10 @@ struct wpa_driver_ops {
@@ -390,7 +390,7 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index c695263bf..6d4a4dbbe 100644
+index c695263..6d4a4db 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -35,6 +35,8 @@
@@ -578,7 +578,7 @@
 +	.get_edcca = nl80211_get_edcca,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 6e40d5556..13e5d248c 100644
+index 6e40d55..13e5d24 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -181,6 +181,7 @@ struct wpa_driver_nl80211_data {
@@ -590,7 +590,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 7ede0d030..732ae292d 100644
+index 7ede0d0..732ae29 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -18,6 +18,7 @@
@@ -615,5 +615,5 @@
  
  			wpa_printf(MSG_DEBUG, "nl80211: Supported vendor command: vendor_id=0x%x subcmd=%u",
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0006-hostapd-mtk-Add-hostapd-MU-SET-GET-control.patch b/recipes-wifi/hostapd/files/patches/mtk-0006-hostapd-mtk-Add-hostapd-MU-SET-GET-control.patch
index 07e0d6d..4378628 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0006-hostapd-mtk-Add-hostapd-MU-SET-GET-control.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0006-hostapd-mtk-Add-hostapd-MU-SET-GET-control.patch
@@ -1,7 +1,7 @@
-From 4919444a2dc29c019ec92321109603763c732071 Mon Sep 17 00:00:00 2001
+From 927adcab2218b9fe76c7c12c89ef4604ae530639 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Tue, 9 Aug 2022 10:23:44 -0700
-Subject: [PATCH 06/15] hostapd: mtk: Add hostapd MU SET/GET control
+Subject: [PATCH 06/24] hostapd: mtk: Add hostapd MU SET/GET control
 
 ---
  hostapd/config_file.c             |   9 +++
@@ -20,7 +20,7 @@
  13 files changed, 251 insertions(+)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index b5024ccd5..cd27d0890 100644
+index b5024cc..62e8b33 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -3661,6 +3661,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -40,7 +40,7 @@
  	} else if (os_strcmp(buf, "max_listen_interval") == 0) {
  		bss->max_listen_interval = atoi(pos);
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 9c70d5419..5f71aeea9 100644
+index 9c70d54..c72f336 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3441,6 +3441,63 @@ hostapd_ctrl_iface_get_edcca(struct hostapd_data *hapd, char *cmd, char *buf,
@@ -120,7 +120,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index db2125805..0d364773b 100644
+index db21258..e16a1dc 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -1380,6 +1380,20 @@ static int hostapd_cli_cmd_driver_flags(struct wpa_ctrl *ctrl, int argc,
@@ -156,7 +156,7 @@
  	{ "dpp_qr_code", hostapd_cli_cmd_dpp_qr_code, NULL,
  	  "report a scanned DPP URI from a QR Code" },
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 344585aee..0e1f192cf 100644
+index 344585a..d4fc191 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -280,6 +280,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -168,7 +168,7 @@
  
  	/* The third octet of the country string uses an ASCII space character
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 4ac469910..0616c30bb 100644
+index 4ac4699..37779b7 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1115,6 +1115,7 @@ struct hostapd_config {
@@ -180,7 +180,7 @@
  
  	/* VHT enable/disable config from CHAN_SWITCH */
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 25e967d1b..4598737a3 100644
+index 25e967d..60b9fc0 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1039,3 +1039,17 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value)
@@ -202,7 +202,7 @@
 +	return hapd->driver->mu_dump(hapd->drv_priv, mu_onoff);
 +}
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index 70a99f406..bca39c502 100644
+index 70a99f4..185d5f3 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -142,6 +142,8 @@ int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd);
@@ -215,7 +215,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index 3bb38fec3..44a378aa9 100644
+index 3bb38fe..71d7bfa 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
 @@ -2302,6 +2302,8 @@ dfs_offload:
@@ -228,7 +228,7 @@
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 70561263c..69a46dfbb 100644
+index 7056126..ef8618e 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -10,6 +10,8 @@ enum mtk_nl80211_vendor_subcmds {
@@ -261,7 +261,7 @@
  #define ETH_ALEN 6
  
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 35599741c..4cd7505db 100644
+index 3559974..fa5ad45 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -1623,6 +1623,11 @@ struct wpa_driver_ap_params {
@@ -292,7 +292,7 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 6d4a4dbbe..f8b3f40c2 100644
+index 6d4a4db..0523aab 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -12304,6 +12304,114 @@ fail:
@@ -420,7 +420,7 @@
  	.dpp_listen = nl80211_dpp_listen,
  #endif /* CONFIG_DPP */
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 13e5d248c..57f02497e 100644
+index 13e5d24..1dd984c 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -182,6 +182,7 @@ struct wpa_driver_nl80211_data {
@@ -432,7 +432,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 732ae292d..cc146d9fc 100644
+index 732ae29..cc11891 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -1056,6 +1056,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
@@ -446,5 +446,5 @@
  			}
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0007-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-c.patch b/recipes-wifi/hostapd/files/patches/mtk-0007-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-c.patch
index 8ca8c55..b33c599 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0007-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-c.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0007-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-c.patch
@@ -1,7 +1,7 @@
-From 00a1908f92e31d6d85edc877c98387a9fdb737af Mon Sep 17 00:00:00 2001
+From 1ed9156c654c1affb51bf1bfa2cc5be8f9b7c465 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 2 Sep 2022 01:03:23 +0800
-Subject: [PATCH 07/15] hostapd: mtk: Add three wire PTA ctrl hostapd vendor
+Subject: [PATCH 07/24] hostapd: mtk: Add three wire PTA ctrl hostapd vendor
  command
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -20,7 +20,7 @@
  11 files changed, 93 insertions(+)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index cd27d0890..df9c1e7a7 100644
+index 62e8b33..6e526eb 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4796,6 +4796,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -35,7 +35,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 0e1f192cf..9249a6bb8 100644
+index d4fc191..1a1a059 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -297,6 +297,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -47,7 +47,7 @@
  	return conf;
  }
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 0616c30bb..0c370e75b 100644
+index 37779b7..f1be7ae 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1158,6 +1158,19 @@ struct hostapd_config {
@@ -71,7 +71,7 @@
  
  enum edcca_mode {
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 4598737a3..a1d83e4ee 100644
+index 60b9fc0..973b44e 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1053,3 +1053,14 @@ int hostapd_drv_mu_dump(struct hostapd_data *hapd, u8 *mu_onoff)
@@ -90,7 +90,7 @@
 +	return hapd->driver->three_wire_ctrl(hapd->drv_priv, hapd->iconf->three_wire_enable);
 +}
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index bca39c502..5ba62978c 100644
+index 185d5f3..51d7b3b 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -144,6 +144,7 @@ int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
@@ -102,7 +102,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index 44a378aa9..c972b15ea 100644
+index 71d7bfa..77e7eb4 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
 @@ -2304,6 +2304,8 @@ dfs_offload:
@@ -115,7 +115,7 @@
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 69a46dfbb..ee5a4f436 100644
+index ef8618e..ed47487 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -13,6 +13,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -149,7 +149,7 @@
  	MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
  
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 4cd7505db..9ca19af81 100644
+index fa5ad45..6c4c70c 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -4693,6 +4693,14 @@ struct wpa_driver_ops {
@@ -168,7 +168,7 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index f8b3f40c2..92882cb73 100644
+index 0523aab..568c704 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -12637,6 +12637,38 @@ static int nl80211_get_edcca(void *priv, const u8 mode, u8 *value)
@@ -217,7 +217,7 @@
 +	.three_wire_ctrl = nl80211_enable_three_wire,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 57f02497e..9fe7811b9 100644
+index 1dd984c..35fd4d2 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -183,6 +183,7 @@ struct wpa_driver_nl80211_data {
@@ -229,7 +229,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index cc146d9fc..04bc54e77 100644
+index cc11891..dc2d7b1 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -1059,6 +1059,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
@@ -243,5 +243,5 @@
  			}
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0008-hostapd-mtk-Add-hostapd-iBF-control.patch b/recipes-wifi/hostapd/files/patches/mtk-0008-hostapd-mtk-Add-hostapd-iBF-control.patch
index fc38b4f..d2f7b2f 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0008-hostapd-mtk-Add-hostapd-iBF-control.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0008-hostapd-mtk-Add-hostapd-iBF-control.patch
@@ -1,7 +1,7 @@
-From 508e76ba51d47394a1b01ba7b9f3c1f25db0aa39 Mon Sep 17 00:00:00 2001
+From 0d84da530a21971ee7a3572c8ce559d53b5eb138 Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:41:51 -0700
-Subject: [PATCH 08/15] hostapd: mtk: Add hostapd iBF control
+Subject: [PATCH 08/24] hostapd: mtk: Add hostapd iBF control
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
@@ -21,7 +21,7 @@
  13 files changed, 224 insertions(+), 1 deletion(-)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index df9c1e7a7..63c9d40be 100644
+index 6e526eb..579193f 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4800,6 +4800,9 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -35,7 +35,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 5f71aeea9..c881d3717 100644
+index c72f336..5590100 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3498,6 +3498,30 @@ hostapd_ctrl_iface_get_mu(struct hostapd_data *hapd, char *buf,
@@ -79,7 +79,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index 0d364773b..c2a123a8c 100644
+index e16a1dc..1f7013e 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -1586,6 +1586,13 @@ static int hostapd_cli_cmd_driver(struct wpa_ctrl *ctrl, int argc, char *argv[])
@@ -106,7 +106,7 @@
  };
  
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 9249a6bb8..7a96cb8b2 100644
+index 1a1a059..df90814 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -298,6 +298,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -118,7 +118,7 @@
  	return conf;
  }
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 0c370e75b..a9e3d2aeb 100644
+index f1be7ae..be30b51 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1159,6 +1159,7 @@ struct hostapd_config {
@@ -138,7 +138,7 @@
  static inline enum oper_chan_width
  hostapd_get_oper_chwidth(struct hostapd_config *conf)
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index a1d83e4ee..60ae8253b 100644
+index 973b44e..bec9798 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1064,3 +1064,17 @@ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd)
@@ -161,7 +161,7 @@
 +}
 \ No newline at end of file
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index 5ba62978c..ab9aedcee 100644
+index 51d7b3b..30b0322 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -145,6 +145,8 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
@@ -174,7 +174,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index c972b15ea..da7f7d87b 100644
+index 77e7eb4..e83298e 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
 @@ -2306,6 +2306,8 @@ dfs_offload:
@@ -187,7 +187,7 @@
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index ee5a4f436..4050cf886 100644
+index ed47487..7b7aeaa 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -13,7 +13,8 @@ enum mtk_nl80211_vendor_subcmds {
@@ -240,7 +240,7 @@
  #define CSI_MAX_COUNT 256
  #define ETH_ALEN 6
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 9ca19af81..71ded617f 100644
+index 6c4c70c..913a194 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -1628,6 +1628,11 @@ struct wpa_driver_ap_params {
@@ -277,7 +277,7 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 92882cb73..5c2a291ca 100644
+index 568c704..ff257eb 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -12670,6 +12670,112 @@ static int nl80211_enable_three_wire(void *priv, const u8 three_wire_enable)
@@ -401,7 +401,7 @@
 +	.ibf_dump = nl80211_ibf_dump,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 9fe7811b9..607592ceb 100644
+index 35fd4d2..92e5ad6 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -184,6 +184,7 @@ struct wpa_driver_nl80211_data {
@@ -413,7 +413,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 04bc54e77..9ecc0ff9a 100644
+index dc2d7b1..83b4c5e 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -1062,6 +1062,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
@@ -427,5 +427,5 @@
  			}
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0009-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated.patch b/recipes-wifi/hostapd/files/patches/mtk-0009-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated.patch
index daf82b0..097f4e7 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0009-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0009-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated.patch
@@ -1,7 +1,7 @@
-From 1d4ef2662fb22f96c6db3730f35879d1be55db3d Mon Sep 17 00:00:00 2001
+From 571a9efc9c8ed7ccd4460f487ccbb2c8c9c6cb97 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 22 Sep 2022 16:08:09 +0800
-Subject: [PATCH 09/15] hostapd: mtk: Do not include HE capab IE if associated
+Subject: [PATCH 09/24] hostapd: mtk: Do not include HE capab IE if associated
  sta's HE capab IE is invalid
 
 ---
@@ -9,7 +9,7 @@
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
-index d92178379..098793ef3 100644
+index d921783..098793e 100644
 --- a/src/ap/ieee802_11.c
 +++ b/src/ap/ieee802_11.c
 @@ -5192,7 +5192,8 @@ static u16 send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
@@ -23,5 +23,5 @@
  		p = hostapd_eid_he_operation(hapd, p);
  		p = hostapd_eid_cca(hapd, p);
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch b/recipes-wifi/hostapd/files/patches/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch
index 7ec986a..54289c7 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch
@@ -1,7 +1,7 @@
-From 6828156c206701f5a0e5d30afcc514f452ce0ada Mon Sep 17 00:00:00 2001
+From c628c4257fb1b7eb0e3689d82c7b4bee5ae5d892 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 20 Feb 2023 14:55:49 +0800
-Subject: [PATCH 10/16] hostapd: mtk: Add DFS detection mode
+Subject: [PATCH 10/24] hostapd: mtk: Add DFS detection mode
 
 Add DFS detection mode for testing radar detection rate.
 If DFS detection mode is on, AP will not switch channels when receiving
@@ -17,7 +17,7 @@
  4 files changed, 50 insertions(+)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 63c9d40..cd15349 100644
+index 579193f..8a61726 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4803,6 +4803,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -32,7 +32,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index c881d37..0b4c234 100644
+index 5590100..fcbc4ae 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3522,6 +3522,26 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
@@ -73,7 +73,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a9e3d2a..77f6169 100644
+index be30b51..d3a9fb0 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1160,6 +1160,7 @@ struct hostapd_config {
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch b/recipes-wifi/hostapd/files/patches/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch
index 1d8baf8..4246599 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch
@@ -1,7 +1,7 @@
-From 88dd3df28e3736af4cca0daf4f7d19ab888ea6c4 Mon Sep 17 00:00:00 2001
+From 7027df47dfc72e52763c90ecce524606e61a5384 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 20 Feb 2023 14:56:55 +0800
-Subject: [PATCH 11/16] hostapd: mtk: Add DFS offchan channel switch
+Subject: [PATCH 11/24] hostapd: mtk: Add DFS offchan channel switch
 
 Add DFS background chain channel switch command for testing purpose.
 This feature is implemented via hostapd_cli command.
@@ -16,7 +16,7 @@
  3 files changed, 96 insertions(+), 16 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 0b4c234..6ea1573 100644
+index fcbc4ae..37a1b2a 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3542,6 +3542,76 @@ hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch b/recipes-wifi/hostapd/files/patches/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
index 7db3ae2..01346dc 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
@@ -1,7 +1,7 @@
-From d0128fc60d38ce4f20f8368bdc5ea9ed19a329b7 Mon Sep 17 00:00:00 2001
+From 1e8a42f893d138b7ca29d4758d1528545e88d657 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 16 Dec 2022 03:57:11 +0800
-Subject: [PATCH 12/16] hostapd: mtk: Add amsdu set get ctrl
+Subject: [PATCH 12/24] hostapd: mtk: Add amsdu set get ctrl
 
 ---
  hostapd/config_file.c             |   9 +++
@@ -20,7 +20,7 @@
  13 files changed, 207 insertions(+), 1 deletion(-)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index cd15349..10ea525 100644
+index 8a61726..017c21e 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4807,6 +4807,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -40,7 +40,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 6ea1573..0ad8451 100644
+index 37a1b2a..61c9e80 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3612,6 +3612,30 @@ hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
@@ -84,7 +84,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index c2a123a..30b3392 100644
+index 1f7013e..0da18e2 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -1593,6 +1593,13 @@ static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
@@ -111,7 +111,7 @@
  };
  
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 7a96cb8..85ad5e4 100644
+index df90814..24fc0f5 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -299,6 +299,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -123,7 +123,7 @@
  	return conf;
  }
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 77f6169..a9ac396 100644
+index d3a9fb0..ce0d84c 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1161,6 +1161,7 @@ struct hostapd_config {
@@ -135,7 +135,7 @@
  
  enum three_wire_mode {
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 60ae825..1a82f23 100644
+index bec9798..342a7a8 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1077,4 +1077,18 @@ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
@@ -159,7 +159,7 @@
  }
 \ No newline at end of file
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index ab9aedc..4406666 100644
+index 30b0322..79fef71 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -147,6 +147,8 @@ int hostapd_drv_mu_dump(struct hostapd_data *hapd, u8 *mu_onoff);
@@ -172,7 +172,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index da7f7d8..a18e744 100644
+index e83298e..42e8ed7 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
 @@ -2308,6 +2308,8 @@ dfs_offload:
@@ -185,7 +185,7 @@
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 4050cf8..0999ea9 100644
+index 7b7aeaa..97c5a47 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -167,7 +167,6 @@ enum mtk_vendor_attr_wireless_ctrl {
@@ -220,7 +220,7 @@
  	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
  
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 71ded61..265d86d 100644
+index 913a194..3e034d7 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -4720,6 +4720,15 @@ struct wpa_driver_ops {
@@ -240,7 +240,7 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 5c2a291..d91b29c 100644
+index ff257eb..6c65901 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -12776,6 +12776,118 @@ fail:
@@ -370,7 +370,7 @@
 +	.amsdu_dump = nl80211_dump_amsdu,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 607592c..e570224 100644
+index 92e5ad6..21d48cc 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -185,6 +185,7 @@ struct wpa_driver_nl80211_data {
@@ -382,7 +382,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 9ecc0ff..fcfa68b 100644
+index 83b4c5e..06a52db 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -1065,6 +1065,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch b/recipes-wifi/hostapd/files/patches/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
index 4df0ba6..a35ed64 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
@@ -1,7 +1,7 @@
-From ebbf23ac8c19224b34523e8b9820e32f0789fe11 Mon Sep 17 00:00:00 2001
+From a8f35d893f1f3a9688b2dd52b68a9784e2778201 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 12 Jan 2023 15:18:19 +0800
-Subject: [PATCH 13/16] hostapd: mtk: Add he_ldpc configuration
+Subject: [PATCH 13/24] hostapd: mtk: Add he_ldpc configuration
 
 ---
  hostapd/config_file.c        | 2 ++
@@ -13,7 +13,7 @@
  6 files changed, 19 insertions(+)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 10ea525..4237a5c 100644
+index 017c21e..649618b 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -3508,6 +3508,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -42,7 +42,7 @@
  #he_bss_color=1
  
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 85ad5e4..b283de6 100644
+index 24fc0f5..4e46a62 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -268,6 +268,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -54,7 +54,7 @@
  		HE_OPERATION_RTS_THRESHOLD_OFFSET;
  	/* Set default basic MCS/NSS set to single stream MCS 0-7 */
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a9ac396..b8b20a7 100644
+index ce0d84c..7aeb176 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -929,6 +929,7 @@ struct hostapd_bss_config {
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch b/recipes-wifi/hostapd/files/patches/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
index f0d25c6..0bd08ef 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
@@ -1,7 +1,7 @@
-From bb5cb086162828392a04820063ad7997d8ae26d7 Mon Sep 17 00:00:00 2001
+From 8d6637b3e04d1d3a41d739a7e824e11f39a05fca Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 17 Jan 2023 13:25:18 +0800
-Subject: [PATCH 14/16] hostapd: mtk: Add the broadcast destination address of
+Subject: [PATCH 14/24] hostapd: mtk: Add the broadcast destination address of
  Probe Response frame on 6 GHz
 
 According to IEEE 802.11ax 26.17.2.3.2,
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch b/recipes-wifi/hostapd/files/patches/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
index 5fcd0c5..bbd0743 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
@@ -1,7 +1,7 @@
-From 1db373190399a907b27141c199841aeafd4643da Mon Sep 17 00:00:00 2001
+From 60b1edabde3e0f9e3e09cc4b9646e146c0c3e92a Mon Sep 17 00:00:00 2001
 From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
 Date: Tue, 24 Jan 2023 19:06:44 +0800
-Subject: [PATCH 15/16] hostapd: mtk: Add vendor command attribute for RTS BW
+Subject: [PATCH 15/24] hostapd: mtk: Add vendor command attribute for RTS BW
  signaling.
 
 Signed-off-by: himanshu.goyal <himanshu.goyal@mediatek.com>
@@ -10,7 +10,7 @@
  1 file changed, 1 insertion(+)
 
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 0999ea9..fb12895 100644
+index 97c5a47..62d79cb 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -169,6 +169,7 @@ enum mtk_vendor_attr_wireless_ctrl {
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch b/recipes-wifi/hostapd/files/patches/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
index 33fea78..63b0bae 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
@@ -1,7 +1,7 @@
-From efa1d271d28c84b8ca77ffc3ca7cb75e727088a0 Mon Sep 17 00:00:00 2001
+From 4cf61c8d0aa99d1e15afafe6c9f0eab24814f615 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 13 Feb 2023 11:03:53 +0800
-Subject: [PATCH 16/16] hostapd: mtk: 6G band does not require DFS
+Subject: [PATCH 16/24] hostapd: mtk: 6G band does not require DFS
 
 ---
  src/ap/dfs.c | 1 +
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch b/recipes-wifi/hostapd/files/patches/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch
index 265c37a..0e2327b 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch
@@ -1,8 +1,8 @@
-From f6bfd9a4a6c0d08e0dec9311873c9e863a07c9a8 Mon Sep 17 00:00:00 2001
+From c0b5c3ba905d10495f1f035fd93bbdd5295d60ea Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 20 Feb 2023 11:01:18 +0800
-Subject: [PATCH] hostapd: mtk: Fix sending wrong VHT operation IE in CSA while
- using ZWDFS
+Subject: [PATCH 17/24] hostapd: mtk: Fix sending wrong VHT operation IE in CSA
+ while using ZWDFS
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch b/recipes-wifi/hostapd/files/patches/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch
index db3c813..027aab4 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch
@@ -1,7 +1,7 @@
-From 3337e7b4f75a66e53e1320e49deba2b58a8a80b0 Mon Sep 17 00:00:00 2001
+From a96e3398373b64bca5e33c8eb1a6d289bb07837b Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 20 Feb 2023 10:51:47 +0800
-Subject: [PATCH 18/19] hostapd: mtk: Add sta-assisted DFS state update
+Subject: [PATCH 18/24] hostapd: mtk: Add sta-assisted DFS state update
  mechanism
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -119,7 +119,7 @@
  #define AP_CSA_FINISHED "AP-CSA-FINISHED "
  
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 265d86d..b5de0e6 100644
+index 3e034d7..82daef0 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -5317,6 +5317,20 @@ enum wpa_event_type {
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch b/recipes-wifi/hostapd/files/patches/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch
index 8340fd9..a29ec33 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch
@@ -1,7 +1,8 @@
-From 83ab1a9cc51225095842d3c62bf75cf4efe63075 Mon Sep 17 00:00:00 2001
+From 61b475daa5dbf9802932657943d1322cb5c8f5b3 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 20 Feb 2023 16:58:20 +0800
-Subject: [PATCH] hostapd: mtk: Fix auto ht issue when switching to DFS channel
+Subject: [PATCH 19/24] hostapd: mtk: Fix auto ht issue when switching to DFS
+ channel
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -9,7 +10,7 @@
  1 file changed, 6 insertions(+), 6 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 0ad8451..407790f 100644
+index 61c9e80..c33b7a4 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -2698,6 +2698,12 @@ static int hostapd_ctrl_iface_chan_switch(struct hostapd_iface *iface,
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0020-hostapd-mtk-Mark-DFS-channel-as-available-for-CSA.patch b/recipes-wifi/hostapd/files/patches/mtk-0020-hostapd-mtk-Mark-DFS-channel-as-available-for-CSA.patch
index 1fe5c88..6e9e315 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0020-hostapd-mtk-Mark-DFS-channel-as-available-for-CSA.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0020-hostapd-mtk-Mark-DFS-channel-as-available-for-CSA.patch
@@ -1,7 +1,7 @@
-From 3e9500a42a41e8cd7c2d7bc20aba96e1e17161fb Mon Sep 17 00:00:00 2001
+From 4cfadfd4c22232fc973e81a70039324b3db383ab Mon Sep 17 00:00:00 2001
 From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
 Date: Fri, 3 Mar 2023 12:45:42 +0800
-Subject: [PATCH] hostapd: mtk: Mark DFS channel as available for CSA.
+Subject: [PATCH 20/24] hostapd: mtk: Mark DFS channel as available for CSA.
 
 ---
  hostapd/ctrl_iface.c   | 10 ++++++++++
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support.patch b/recipes-wifi/hostapd/files/patches/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support-for-hostapd.patch
similarity index 99%
rename from recipes-wifi/hostapd/files/patches/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support.patch
rename to recipes-wifi/hostapd/files/patches/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support-for-hostapd.patch
index 8d59a0f..a9e802d 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support-for-hostapd.patch
@@ -1,7 +1,7 @@
-From 8cbdb9a59e3bbe8804f909b13ce6df6e2777c3da Mon Sep 17 00:00:00 2001
+From 832350b2c16a9ad2f65c32d32584e7cdb06b074a Mon Sep 17 00:00:00 2001
 From: mtk20656 <chank.chen@mediatek.com>
 Date: Thu, 2 Mar 2023 10:51:43 +0800
-Subject: [PATCH] hostapd: mtk: add 11v_mbss and ema support for hostapd
+Subject: [PATCH 21/24] hostapd: mtk: add 11v_mbss and ema support for hostapd
 
 Signed-off-by: mtk20656 <chank.chen@mediatek.com>
 ---
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0022-hostapd-mtk-Add-available-color-bitmap.patch b/recipes-wifi/hostapd/files/patches/mtk-0022-hostapd-mtk-Add-available-color-bitmap.patch
index 9bbbf87..a0065f3 100644
--- a/recipes-wifi/hostapd/files/patches/mtk-0022-hostapd-mtk-Add-available-color-bitmap.patch
+++ b/recipes-wifi/hostapd/files/patches/mtk-0022-hostapd-mtk-Add-available-color-bitmap.patch
@@ -1,7 +1,7 @@
-From e7790a1bceca6b7612f29b00c429cf23f5dd9e3a Mon Sep 17 00:00:00 2001
+From 46c88d8e3c513c04891913c77de179de9e7f36cd Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Thu, 26 Jan 2023 09:16:00 +0800
-Subject: [PATCH] hostapd: mtk: Add available color bitmap
+Subject: [PATCH 22/24] hostapd: mtk: Add available color bitmap
 
 Signed-off-by: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 ---
@@ -17,10 +17,10 @@
  9 files changed, 192 insertions(+), 1 deletion(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 0ad8451..b0d5ded 100644
+index 9ba6992..e1e9270 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -3635,6 +3635,76 @@ hostapd_ctrl_iface_get_amsdu(struct hostapd_data *hapd, char *buf,
+@@ -3645,6 +3645,76 @@ hostapd_ctrl_iface_get_amsdu(struct hostapd_data *hapd, char *buf,
  	return ret;
  }
  
@@ -97,7 +97,7 @@
  
  static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
  					      char *buf, char *reply,
-@@ -4202,6 +4272,10 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+@@ -4212,6 +4282,10 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
  		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
  	} else if (os_strncmp(buf, "GET_AMSDU", 9) == 0) {
  		reply_len = hostapd_ctrl_iface_get_amsdu(hapd, reply, reply_size);
@@ -109,7 +109,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index 30b3392..b6cf52e 100644
+index 6231e51..aad7aa5 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -1578,6 +1578,20 @@ static int hostapd_cli_cmd_reload_wpa_psk(struct wpa_ctrl *ctrl, int argc,
@@ -145,7 +145,7 @@
  	{ "driver", hostapd_cli_cmd_driver, NULL,
  	  "<driver sub command> [<hex formatted data>] = send driver command data" },
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 1a82f23..decffdd 100644
+index 342a7a8..40b9a20 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1091,4 +1091,12 @@ int hostapd_drv_amsdu_dump(struct hostapd_data *hapd, u8 *amsdu)
@@ -164,7 +164,7 @@
 +	return hapd->driver->get_aval_color_bmp(hapd->drv_priv, aval_color_bmp);
 +}
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index 4406666..61c1360 100644
+index 79fef71..136a3ac 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -149,6 +149,8 @@ int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd);
@@ -177,7 +177,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 0999ea9..f2afb2e 100644
+index 62d79cb..a99e6f2 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -15,6 +15,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -188,7 +188,7 @@
  };
  
  enum mtk_vendor_attr_edcca_ctrl {
-@@ -252,6 +253,16 @@ ibf_dump_policy[NUM_MTK_VENDOR_ATTRS_IBF_DUMP] = {
+@@ -253,6 +254,16 @@ ibf_dump_policy[NUM_MTK_VENDOR_ATTRS_IBF_DUMP] = {
  	[MTK_VENDOR_ATTR_IBF_DUMP_ENABLE] = { .type = NLA_U8 },
  };
  
@@ -206,10 +206,10 @@
  #define CSI_MAX_COUNT 256
  #define ETH_ALEN 6
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index b07aaf3..266c630 100644
+index 36f465c..7f6392f 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -4736,6 +4736,14 @@ struct wpa_driver_ops {
+@@ -4771,6 +4771,14 @@ struct wpa_driver_ops {
  	 */
  	int (*amsdu_ctrl)(void *priv, u8 amsdu);
  	int (*amsdu_dump)(void *priv, u8 *amsdu);
@@ -225,10 +225,10 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 6702384..c8771f7 100644
+index 3753409..f9a8763 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -12433,6 +12433,71 @@ static int nl80211_dpp_listen(void *priv, bool enable)
+@@ -12485,6 +12485,71 @@ static int nl80211_dpp_listen(void *priv, bool enable)
  }
  #endif /* CONFIG_DPP */
  
@@ -300,14 +300,14 @@
  
  #ifdef CONFIG_TESTING_OPTIONS
  
-@@ -13073,4 +13138,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.start_disabled = nl80211_start_disabled,
+@@ -13096,4 +13161,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.ibf_dump = nl80211_ibf_dump,
  	.amsdu_ctrl = nl80211_enable_amsdu,
  	.amsdu_dump = nl80211_dump_amsdu,
 +	.get_aval_color_bmp = nl80211_get_aval_color_bmp,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index e570224..b90c8fa 100644
+index 21d48cc..72c7abd 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -186,6 +186,7 @@ struct wpa_driver_nl80211_data {
@@ -319,10 +319,10 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index fcfa68b..c3c7b41 100644
+index d8078bc..e7c6f39 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
-@@ -1068,6 +1068,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+@@ -1092,6 +1092,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
  				case MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL:
  					drv->mtk_wireless_vendor_cmd_avail = 1;
  					break;
@@ -333,5 +333,5 @@
  			}
  
 -- 
-2.39.0
+2.18.0
 
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0023-hostapd-mtk-Add-channel-information-for-hostapd-relo.patch b/recipes-wifi/hostapd/files/patches/mtk-0023-hostapd-mtk-Add-channel-information-for-hostapd-relo.patch
new file mode 100644
index 0000000..b03656e
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches/mtk-0023-hostapd-mtk-Add-channel-information-for-hostapd-relo.patch
@@ -0,0 +1,79 @@
+From 6435612049c0a21a30ea835a31d07b6c14b3b248 Mon Sep 17 00:00:00 2001
+From: Michael Lee <michael-cy.lee@mediatek.com>
+Date: Wed, 22 Mar 2023 13:59:29 +0800
+Subject: [PATCH 23/24] hostapd: mtk: Add channel information for hostapd
+ reload
+
+Add center channel, operating class, and bandwidth into the UPDATE
+command when wpa_supplciant reloads hostapd.
+Hostapd can correctly update its channel information.
+
+Signed-off-by: Michael Lee <michael-cy.lee@mediatek.com>
+---
+ hostapd/ctrl_iface.c            | 11 +++++++++++
+ wpa_supplicant/wpa_supplicant.c | 17 ++++++++++++++---
+ 2 files changed, 25 insertions(+), 3 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index e1e9270..4c5d494 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -170,6 +170,17 @@ static struct hostapd_config *hostapd_ctrl_iface_config_read(const char *fname)
+ 			conf->hw_mode = atoi(val);
+ 		else if ((val = get_option(opt, "ieee80211n=")))
+ 			conf->ieee80211n = atoi(val);
++		else if ((val = get_option(opt, "center_segment0=")))
++			hostapd_set_oper_centr_freq_seg0_idx(conf, atoi(val));
++		else if ((val = get_option(opt, "center_segment1=")))
++			hostapd_set_oper_centr_freq_seg1_idx(conf, atoi(val));
++		else if ((val = get_option(opt, "op_class="))) {
++			enum oper_chan_width ch_width;
++
++			conf->op_class = atoi(val);
++			ch_width = op_class_to_ch_width(conf->op_class);
++			hostapd_set_oper_chwidth(conf, ch_width);
++		}
+ 		else
+ 			break;
+ 	}
+diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
+index 270da46..4930f7a 100644
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -150,9 +150,10 @@ static int hostapd_reload(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
+ 	char buf[256];
+ 	size_t len = sizeof(buf);
+ 	enum hostapd_hw_mode hw_mode;
+-	u8 channel;
++	u8 channel, center_segment0, center_segment1, op_class;
+ 	int sec_chan = 0;
+ 	int ret;
++	struct wpa_channel_info ci;
+ 
+ 	if (!bss)
+ 		return -1;
+@@ -165,9 +166,19 @@ static int hostapd_reload(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
+ 			sec_chan = -1;
+ 	}
+ 
++	ret = wpa_drv_channel_info(wpa_s, &ci);
++	if (ret)
++		return -1;
++
++	ieee80211_freq_to_chan(ci.center_frq1, &center_segment0);
++	ieee80211_freq_to_chan(ci.center_frq2, &center_segment1);
++	ieee80211_chaninfo_to_channel(ci.frequency, ci.chanwidth, sec_chan,
++				      &op_class, &channel);
+ 	hw_mode = ieee80211_freq_to_chan(bss->freq, &channel);
+-	if (asprintf(&cmd, "UPDATE channel=%d sec_chan=%d hw_mode=%d",
+-		     channel, sec_chan, hw_mode) < 0)
++	if (asprintf(&cmd, "UPDATE channel=%d center_segment0=%d "
++		     "center_segment1=%d sec_chan=%d hw_mode=%d op_class=%d",
++		     channel, center_segment0, center_segment1, sec_chan,
++		     hw_mode, op_class) < 0)
+ 		return -1;
+ 
+ 	ret = wpa_ctrl_request(wpa_s->hostapd, cmd, os_strlen(cmd), buf, &len, NULL);
+-- 
+2.18.0
+
diff --git a/recipes-wifi/hostapd/files/patches/mtk-0024-hostapd-mtk-Fix-ZWDFS-issue-in-BW-160.patch b/recipes-wifi/hostapd/files/patches/mtk-0024-hostapd-mtk-Fix-ZWDFS-issue-in-BW-160.patch
new file mode 100644
index 0000000..e914686
--- /dev/null
+++ b/recipes-wifi/hostapd/files/patches/mtk-0024-hostapd-mtk-Fix-ZWDFS-issue-in-BW-160.patch
@@ -0,0 +1,210 @@
+From 3a119f804f87e8535908c772d3c7251bc6bfa524 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Mar 2023 16:08:30 +0800
+Subject: [PATCH 24/24] hostapd: mtk: Fix ZWDFS issue in BW 160
+
+When background radar is enabled and bandwidth is set to 160, AP will
+fail to startup due to the lack of non-DFS channel.
+Under this circumstance, AP should perform CAC itself, and the background
+chain could also perform CAC simultaneously.
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ src/ap/dfs.c | 98 ++++++++++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 79 insertions(+), 19 deletions(-)
+
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index d082fe0..d688ecb 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -69,15 +69,22 @@ static int dfs_get_used_n_chans(struct hostapd_iface *iface, int *seg1)
+ static int dfs_channel_available(struct hostapd_channel_data *chan,
+ 				 enum dfs_channel_type type)
+ {
++	int dfs_status = chan->flag & HOSTAPD_CHAN_DFS_MASK;
++
++	if (chan->flag & HOSTAPD_CHAN_DISABLED)
++		return -1;
++
+ 	if (type == DFS_NO_CAC_YET) {
+ 		/* Select only radar channel where CAC has not been
+ 		 * performed yet
+ 		 */
+-		if ((chan->flag & HOSTAPD_CHAN_RADAR) &&
+-		    (chan->flag & HOSTAPD_CHAN_DFS_MASK) ==
+-		     HOSTAPD_CHAN_DFS_USABLE)
++		if (!(chan->flag & HOSTAPD_CHAN_RADAR))
++			return 0;
++
++		if (dfs_status == HOSTAPD_CHAN_DFS_USABLE)
+ 			return 1;
+-		return 0;
++
++		return -1;
+ 	}
+ 
+ 	/*
+@@ -86,16 +93,14 @@ static int dfs_channel_available(struct hostapd_channel_data *chan,
+ 	 * channel for CSA, unless they are available for immediate use.
+ 	 */
+ 	if (type == DFS_AVAILABLE && (chan->flag & HOSTAPD_CHAN_RADAR) &&
+-	    ((chan->flag & HOSTAPD_CHAN_DFS_MASK) !=
+-	     HOSTAPD_CHAN_DFS_AVAILABLE))
+-		return 0;
++	    (dfs_status != HOSTAPD_CHAN_DFS_AVAILABLE))
++		return -1;
+ 
+-	if (chan->flag & HOSTAPD_CHAN_DISABLED)
+-		return 0;
+ 	if ((chan->flag & HOSTAPD_CHAN_RADAR) &&
+-	    ((chan->flag & HOSTAPD_CHAN_DFS_MASK) ==
+-	     HOSTAPD_CHAN_DFS_UNAVAILABLE))
+-		return 0;
++	    ((dfs_status == HOSTAPD_CHAN_DFS_UNAVAILABLE) ||
++	    (dfs_status == HOSTAPD_CHAN_DFS_UNKNOWN)))
++		return -1;
++
+ 	return 1;
+ }
+ 
+@@ -167,7 +172,7 @@ static int dfs_chan_range_available(struct hostapd_hw_modes *mode,
+ 				    enum dfs_channel_type type)
+ {
+ 	struct hostapd_channel_data *first_chan, *chan;
+-	int i;
++	int i, available = 0, ret = 0;
+ 	u32 bw = num_chan_to_bw(num_chans);
+ 
+ 	if (first_chan_idx + num_chans > mode->num_channels) {
+@@ -203,14 +208,17 @@ static int dfs_chan_range_available(struct hostapd_hw_modes *mode,
+ 			return 0;
+ 		}
+ 
+-		if (!dfs_channel_available(chan, type)) {
++		ret = dfs_channel_available(chan, type);
++		if (ret < 0) {
+ 			wpa_printf(MSG_DEBUG, "DFS: channel not available %d",
+ 				   first_chan->freq + i * 20);
+ 			return 0;
+ 		}
++
++		available |= ret;
+ 	}
+ 
+-	return 1;
++	return available;
+ }
+ 
+ 
+@@ -826,8 +834,12 @@ static unsigned int dfs_get_cac_time(struct hostapd_iface *iface,
+  */
+ int hostapd_handle_dfs(struct hostapd_iface *iface)
+ {
++	struct hostapd_channel_data *channel;
+ 	int res, n_chans, n_chans1, start_chan_idx, start_chan_idx1;
+-	int skip_radar = 0;
++	int sec = 0, skip_radar = 0;
++	u8 cf1 = 0, cf2 = 0;
++	bool use_radar_background = dfs_use_radar_background(iface);
++	enum dfs_channel_type channel_type = DFS_NO_CAC_YET;
+ 
+ 	if (is_6ghz_freq(iface->freq))
+ 		return 1;
+@@ -890,7 +902,7 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
+ 	/* Finally start CAC */
+ 	hostapd_set_state(iface, HAPD_IFACE_DFS);
+ 	wpa_printf(MSG_DEBUG, "DFS start CAC on %d MHz%s", iface->freq,
+-		   dfs_use_radar_background(iface) ? " (background)" : "");
++		   use_radar_background ? " (background)" : "");
+ 	wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_CAC_START
+ 		"freq=%d chan=%d sec_chan=%d, width=%d, seg0=%d, seg1=%d, cac_time=%ds",
+ 		iface->freq,
+@@ -900,6 +912,16 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
+ 		hostapd_get_oper_centr_freq_seg1_idx(iface->conf),
+ 		iface->dfs_cac_ms / 1000);
+ 
++	if (use_radar_background) {
++		channel = dfs_get_valid_channel(iface, &sec, &cf1, &cf2, DFS_AVAILABLE);
++		/*
++		 * AP cannot get any random available channel.
++		 * Let AP and dedicated radar chain both perform CAC.
++		 */
++		if (!channel)
++			use_radar_background = false;
++	}
++
+ 	res = hostapd_start_dfs_cac(
+ 		iface, iface->conf->hw_mode, iface->freq, iface->conf->channel,
+ 		iface->conf->ieee80211n, iface->conf->ieee80211ac,
+@@ -908,14 +930,14 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
+ 		hostapd_get_oper_chwidth(iface->conf),
+ 		hostapd_get_oper_centr_freq_seg0_idx(iface->conf),
+ 		hostapd_get_oper_centr_freq_seg1_idx(iface->conf),
+-		dfs_use_radar_background(iface));
++		use_radar_background);
+ 
+ 	if (res) {
+ 		wpa_printf(MSG_ERROR, "DFS start_dfs_cac() failed, %d", res);
+ 		return -1;
+ 	}
+ 
+-	if (dfs_use_radar_background(iface)) {
++	if (use_radar_background) {
+ 		/* Cache background radar parameters. */
+ 		iface->radar_background.channel = iface->conf->channel;
+ 		iface->radar_background.secondary_channel =
+@@ -936,6 +958,35 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
+ 
+ 		iface->radar_background.temp_ch = 1;
+ 		return 1;
++	} else if (dfs_use_radar_background(iface)) {
++		if (iface->dfs_domain == HOSTAPD_DFS_REGION_ETSI)
++			channel_type = DFS_ANY_CHANNEL;
++
++		channel = dfs_get_valid_channel(iface, &sec, &cf1, &cf2, channel_type);
++
++		if (!channel ||
++		    (channel->chan == iface->conf->channel &&
++		    cf1 == hostapd_get_oper_centr_freq_seg0_idx(iface->conf) &&
++		    cf2 == hostapd_get_oper_centr_freq_seg1_idx(iface->conf))) {
++			wpa_printf(MSG_ERROR, "Background radar could not get valid channel\n");
++			iface->radar_background.channel = -1;
++			return 0;
++		}
++
++		hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
++				      channel->freq, channel->chan,
++				      iface->conf->ieee80211n,
++				      iface->conf->ieee80211ac,
++				      iface->conf->ieee80211ax,
++				      iface->conf->ieee80211be,
++				      sec, hostapd_get_oper_chwidth(iface->conf),
++				      cf1, cf2, true);
++
++		iface->radar_background.channel = channel->chan;
++		iface->radar_background.freq = channel->freq;
++		iface->radar_background.secondary_channel = sec;
++		iface->radar_background.centr_freq_seg0_idx = cf1;
++		iface->radar_background.centr_freq_seg1_idx = cf2;
+ 	}
+ 
+ 	return 0;
+@@ -1185,6 +1236,15 @@ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
+ 				hostapd_setup_interface_complete(iface, 0);
+ 				iface->cac_started = 0;
+ 			}
++
++			/*
++			 * When background radar is enabled but the CAC completion
++			 * is not received from the background chain.
++			 * Then, reset radar background chain.
++			 */
++			if (dfs_use_radar_background(iface) &&
++			    iface->radar_background.channel == -1)
++				hostpad_dfs_update_background_chain(iface);
+ 		}
+ 	} else if (hostapd_dfs_is_background_event(iface, freq)) {
+ 		iface->radar_background.cac_started = 0;
+-- 
+2.18.0
+
diff --git a/recipes-wifi/hostapd/files/patches/patches.inc b/recipes-wifi/hostapd/files/patches/patches.inc
index 3ec1290..e1aacd5 100644
--- a/recipes-wifi/hostapd/files/patches/patches.inc
+++ b/recipes-wifi/hostapd/files/patches/patches.inc
@@ -82,6 +82,8 @@
     file://mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch \
     file://mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch \
     file://mtk-0020-hostapd-mtk-Mark-DFS-channel-as-available-for-CSA.patch \
-    file://mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support.patch \
+    file://mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support-for-hostapd.patch \
     file://mtk-0022-hostapd-mtk-Add-available-color-bitmap.patch \
+    file://mtk-0023-hostapd-mtk-Add-channel-information-for-hostapd-relo.patch \
+    file://mtk-0024-hostapd-mtk-Fix-ZWDFS-issue-in-BW-160.patch \
     "
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/327-wifi-mac80211-add-support-for-letting-drivers-regist.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/327-wifi-mac80211-add-support-for-letting-drivers-regist.patch
new file mode 100644
index 0000000..f1807bd
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/327-wifi-mac80211-add-support-for-letting-drivers-regist.patch
@@ -0,0 +1,149 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 20 Mar 2023 14:28:08 +0100
+Subject: [PATCH] wifi: mac80211: add support for letting drivers register tc
+ offload support
+
+On newer MediaTek SoCs (e.g. MT7986), WLAN->WLAN or WLAN->Ethernet flows can
+be offloaded by the SoC. In order to support that, the .ndo_setup_tc op is
+needed.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -4196,6 +4196,10 @@ struct ieee80211_prep_tx_info {
+  *	Note that a sta can also be inserted or removed with valid links,
+  *	i.e. passed to @sta_add/@sta_state with sta->valid_links not zero.
+  *	In fact, cannot change from having valid_links and not having them.
++ * @net_setup_tc: Called from .ndo_setup_tc in order to prepare hardware
++ *	flow offloading for flows originating from the vif.
++ *	Note that the driver must not assume that the vif driver_data is valid
++ *	at this point, since the callback can be called during netdev teardown.
+  */
+ struct ieee80211_ops {
+ 	void (*tx)(struct ieee80211_hw *hw,
+@@ -4551,6 +4555,11 @@ struct ieee80211_ops {
+ 				struct ieee80211_vif *vif,
+ 				struct ieee80211_sta *sta,
+ 				u16 old_links, u16 new_links);
++	int (*net_setup_tc)(struct ieee80211_hw *hw,
++			    struct ieee80211_vif *vif,
++			    struct net_device *dev,
++			    enum tc_setup_type type,
++			    void *type_data);
+ };
+ 
+ /**
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1470,6 +1470,23 @@ static inline int drv_net_fill_forward_p
+ 	return ret;
+ }
+ 
++static inline int drv_net_setup_tc(struct ieee80211_local *local,
++				   struct ieee80211_sub_if_data *sdata,
++				   struct net_device *dev,
++				   enum tc_setup_type type, void *type_data)
++{
++	int ret = -EOPNOTSUPP;
++
++	sdata = get_bss_sdata(sdata);
++	trace_drv_net_setup_tc(local, sdata, type);
++	if (local->ops->net_setup_tc)
++		ret = local->ops->net_setup_tc(&local->hw, &sdata->vif, dev,
++					       type, type_data);
++	trace_drv_return_int(local, ret);
++
++	return ret;
++}
++
+ int drv_change_vif_links(struct ieee80211_local *local,
+ 			 struct ieee80211_sub_if_data *sdata,
+ 			 u16 old_links, u16 new_links,
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1935,7 +1935,8 @@ void ieee80211_color_change_finalize_wor
+ /* interface handling */
+ #define MAC80211_SUPPORTED_FEATURES_TX	(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \
+ 					 NETIF_F_HW_CSUM | NETIF_F_SG | \
+-					 NETIF_F_HIGHDMA | NETIF_F_GSO_SOFTWARE)
++					 NETIF_F_HIGHDMA | NETIF_F_GSO_SOFTWARE | \
++					 NETIF_F_HW_TC)
+ #define MAC80211_SUPPORTED_FEATURES_RX	(NETIF_F_RXCSUM)
+ #define MAC80211_SUPPORTED_FEATURES	(MAC80211_SUPPORTED_FEATURES_TX | \
+ 					 MAC80211_SUPPORTED_FEATURES_RX)
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -813,6 +813,21 @@ ieee80211_get_stats64(struct net_device
+ 	dev_fetch_sw_netstats(stats, dev->tstats);
+ }
+ 
++static int ieee80211_netdev_setup_tc(struct net_device *dev,
++				     enum tc_setup_type type, void *type_data)
++{
++	struct ieee80211_sub_if_data *sdata;
++	struct ieee80211_local *local;
++
++	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
++	local = sdata->local;
++
++	if (!local->ops->net_setup_tc)
++		return -EOPNOTSUPP;
++
++	return drv_net_setup_tc(local, sdata, dev, type, type_data);
++}
++
+ static const struct net_device_ops ieee80211_dataif_ops = {
+ 	.ndo_open		= ieee80211_open,
+ 	.ndo_stop		= ieee80211_stop,
+@@ -821,6 +836,7 @@ static const struct net_device_ops ieee8
+ 	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
+ 	.ndo_set_mac_address 	= ieee80211_change_mac,
+ 	.ndo_get_stats64	= ieee80211_get_stats64,
++	.ndo_setup_tc		= ieee80211_netdev_setup_tc,
+ };
+ 
+ static u16 ieee80211_monitor_select_queue(struct net_device *dev,
+@@ -929,6 +945,7 @@ static const struct net_device_ops ieee8
+ 	.ndo_set_mac_address	= ieee80211_change_mac,
+ 	.ndo_get_stats64	= ieee80211_get_stats64,
+ 	.ndo_fill_forward_path	= ieee80211_netdev_fill_forward_path,
++	.ndo_setup_tc		= ieee80211_netdev_setup_tc,
+ };
+ 
+ static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
+--- a/net/mac80211/trace.h
++++ b/net/mac80211/trace.h
+@@ -2478,6 +2478,31 @@ DEFINE_EVENT(sta_event, drv_net_fill_for
+ 	TP_ARGS(local, sdata, sta)
+ );
+ 
++TRACE_EVENT(drv_net_setup_tc,
++	TP_PROTO(struct ieee80211_local *local,
++		 struct ieee80211_sub_if_data *sdata,
++		 u8 type),
++
++	TP_ARGS(local, sdata, type),
++
++	TP_STRUCT__entry(
++		LOCAL_ENTRY
++		VIF_ENTRY
++		__field(u8, type)
++	),
++
++	TP_fast_assign(
++		LOCAL_ASSIGN;
++		VIF_ASSIGN;
++		__entry->type = type;
++	),
++
++	TP_printk(
++		LOCAL_PR_FMT VIF_PR_FMT " type:%d\n",
++		LOCAL_PR_ARG, VIF_PR_ARG, __entry->type
++	)
++);
++
+ TRACE_EVENT(drv_change_vif_links,
+ 	TP_PROTO(struct ieee80211_local *local,
+ 		 struct ieee80211_sub_if_data *sdata,
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/328-wifi-mac80211-fix-invalid-drv_sta_pre_rcu_remove-cal.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/328-wifi-mac80211-fix-invalid-drv_sta_pre_rcu_remove-cal.patch
new file mode 100644
index 0000000..289906c
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/328-wifi-mac80211-fix-invalid-drv_sta_pre_rcu_remove-cal.patch
@@ -0,0 +1,25 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 24 Mar 2023 13:04:17 +0100
+Subject: [PATCH] wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for
+ non-uploaded sta
+
+Avoid potential data corruption issues caused by uninitialized driver
+private data structures.
+
+Reported-by: Brian Coverstone <brian@mainsequence.net>
+Fixes: 6a9d1b91f34d ("mac80211: add pre-RCU-sync sta removal driver operation")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1241,7 +1241,8 @@ static int __must_check __sta_info_destr
+ 	list_del_rcu(&sta->list);
+ 	sta->removed = true;
+ 
+-	drv_sta_pre_rcu_remove(local, sta->sdata, sta);
++	if (sta->uploaded)
++		drv_sta_pre_rcu_remove(local, sta->sdata, sta);
+ 
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+ 	    rcu_access_pointer(sdata->u.vlan.sta) == sta)
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/329-wifi-mac80211-fix-receiving-mesh-packets-in-forwardi.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/329-wifi-mac80211-fix-receiving-mesh-packets-in-forwardi.patch
new file mode 100644
index 0000000..6882694
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/329-wifi-mac80211-fix-receiving-mesh-packets-in-forwardi.patch
@@ -0,0 +1,50 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 26 Mar 2023 17:11:34 +0200
+Subject: [PATCH] wifi: mac80211: fix receiving mesh packets in forwarding=0
+ networks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When forwarding is set to 0, frames are typically sent with ttl=1.
+Move the ttl decrement check below the check for local receive in order to
+fix packet drops.
+
+Reported-by: Thomas Hühn <thomas.huehn@hs-nordhausen.de>
+Reported-by: Nick Hainke <vincent@systemli.org>
+Fixes: 986e43b19ae9 ("wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2828,14 +2828,6 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 	if (sdata->crypto_tx_tailroom_needed_cnt)
+ 		tailroom = IEEE80211_ENCRYPT_TAILROOM;
+ 
+-	if (!--mesh_hdr->ttl) {
+-		if (multicast)
+-			goto rx_accept;
+-
+-		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
+-		return RX_DROP_MONITOR;
+-	}
+-
+ 	if (mesh_hdr->flags & MESH_FLAGS_AE) {
+ 		struct mesh_path *mppath;
+ 		char *proxied_addr;
+@@ -2874,6 +2866,14 @@ ieee80211_rx_mesh_data(struct ieee80211_
+ 	if (ether_addr_equal(sdata->vif.addr, eth->h_dest))
+ 		goto rx_accept;
+ 
++	if (!--mesh_hdr->ttl) {
++		if (multicast)
++			goto rx_accept;
++
++		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
++		return RX_DROP_MONITOR;
++	}
++
+ 	if (!ifmsh->mshcfg.dot11MeshForwarding) {
+ 		if (is_multicast_ether_addr(eth->h_dest))
+ 			goto rx_accept;
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch
index 80ffb49..d7ee33b 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/500-mac80211_configure_antenna_gain.patch
@@ -18,7 +18,7 @@
  
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1645,6 +1645,7 @@ enum ieee80211_smps_mode {
+@@ -1671,6 +1671,7 @@ enum ieee80211_smps_mode {
   *
   * @power_level: requested transmit power (in dBm), backward compatibility
   *	value only that is set to the minimum of all interfaces
@@ -26,7 +26,7 @@
   *
   * @chandef: the channel definition to tune to
   * @radar_enabled: whether radar detection is enabled
-@@ -1665,6 +1666,7 @@ enum ieee80211_smps_mode {
+@@ -1691,6 +1692,7 @@ enum ieee80211_smps_mode {
  struct ieee80211_conf {
  	u32 flags;
  	int power_level, dynamic_ps_timeout;
@@ -57,7 +57,7 @@
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2998,6 +2998,19 @@ static int ieee80211_get_tx_power(struct
+@@ -3028,6 +3028,19 @@ static int ieee80211_get_tx_power(struct
  	return 0;
  }
  
@@ -77,7 +77,7 @@
  static void ieee80211_rfkill_poll(struct wiphy *wiphy)
  {
  	struct ieee80211_local *local = wiphy_priv(wiphy);
-@@ -4881,6 +4894,7 @@ const struct cfg80211_ops mac80211_confi
+@@ -4911,6 +4924,7 @@ const struct cfg80211_ops mac80211_confi
  	.set_wiphy_params = ieee80211_set_wiphy_params,
  	.set_tx_power = ieee80211_set_tx_power,
  	.get_tx_power = ieee80211_get_tx_power,
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
index 8d2067f..4d394b6 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0013-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch
@@ -5,74 +5,42 @@
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
- include/net/mac80211.h    | 15 +++++++++++++--
+ include/net/mac80211.h    |  5 +++++
  net/mac80211/driver-ops.h | 13 +++++++++++++
- net/mac80211/iface.c      | 24 ++++++++++++++++++++++++
+ net/mac80211/iface.c      | 23 +++++++++++++++++++++++
  net/mac80211/util.c       |  9 +++++++++
- 4 files changed, 59 insertions(+), 2 deletions(-)
- mode change 100644 => 100755 net/mac80211/util.c
+ 4 files changed, 50 insertions(+)
 
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index ad5f217..d1d7fc3 100644
+index 6e5ad3e..cc02639 100644
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1380,7 +1380,7 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
-  * @RX_FLAG_AMPDU_EOF_BIT_KNOWN: The EOF value is known
-  * @RX_FLAG_RADIOTAP_HE: HE radiotap data is present
-  *	(&struct ieee80211_radiotap_he, mac80211 will fill in
-- *	
-+ *
-  *	 - DATA3_DATA_MCS
-  *	 - DATA3_DATA_DCM
-  *	 - DATA3_CODING
-@@ -1388,7 +1388,7 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
-  *	 - DATA5_DATA_BW_RU_ALLOC
-  *	 - DATA6_NSTS
-  *	 - DATA3_STBC
-- *	
-+ *
-  *	from the RX info data, so leave those zeroed when building this data)
-  * @RX_FLAG_RADIOTAP_HE_MU: HE MU radiotap data is present
-  *	(&struct ieee80211_radiotap_he_mu)
-@@ -1950,6 +1950,12 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
-  */
- struct wireless_dev *ieee80211_vif_to_wdev(struct ieee80211_vif *vif);
- 
-+/**
-+ * ieee80211_vif_to_wdev - return a net_device struct from a vif
-+ * @vif: the vif to get the net_device for
-+ */
-+struct net_device *ieee80211_vif_to_netdev(struct ieee80211_vif *vif);
-+
- /**
-  * lockdep_vif_mutex_held - for lockdep checks on link poiners
-  * @vif: the interface to check
-@@ -4219,6 +4225,8 @@ struct ieee80211_prep_tx_info {
-  *	Note that a sta can also be inserted or removed with valid links,
-  *	i.e. passed to @sta_add/@sta_state with sta->valid_links not zero.
-  *	In fact, cannot change from having valid_links and not having them.
+@@ -4207,6 +4207,8 @@ struct ieee80211_prep_tx_info {
+  *	disable background CAC/radar detection.
+  * @net_fill_forward_path: Called from .ndo_fill_forward_path in order to
+  *	resolve a path for hardware flow offloading
 + * @net_fill_receive_path: Called from .ndo_fill_receive_path in order to
 + *	get a path for hardware flow offloading
-  */
- struct ieee80211_ops {
- 	void (*tx)(struct ieee80211_hw *hw,
-@@ -4574,6 +4582,9 @@ struct ieee80211_ops {
- 				struct ieee80211_vif *vif,
- 				struct ieee80211_sta *sta,
- 				u16 old_links, u16 new_links);
+  * @change_vif_links: Change the valid links on an interface, note that while
+  *	removing the old link information is still valid (link_conf pointer),
+  *	but may immediately disappear after the function returns. The old or
+@@ -4570,6 +4572,9 @@ struct ieee80211_ops {
+ 				     struct ieee80211_sta *sta,
+ 				     struct net_device_path_ctx *ctx,
+ 				     struct net_device_path *path);
 +	int (*net_fill_receive_path)(struct ieee80211_hw *hw,
 +				     struct net_device_path_ctx *ctx,
 +				     struct net_device_path *path);
- };
- 
- /**
+ 	int (*change_vif_links)(struct ieee80211_hw *hw,
+ 				struct ieee80211_vif *vif,
+ 				u16 old_links, u16 new_links,
 diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
-index 3d16b09..bbecd2e 100644
+index 1c3a2c9..0057535 100644
 --- a/net/mac80211/driver-ops.h
 +++ b/net/mac80211/driver-ops.h
-@@ -1479,4 +1479,17 @@ int drv_change_sta_links(struct ieee80211_local *local,
- 			 struct ieee80211_sta *sta,
- 			 u16 old_links, u16 new_links);
+@@ -1470,6 +1470,19 @@ static inline int drv_net_fill_forward_path(struct ieee80211_local *local,
+ 	return ret;
+ }
  
 +static inline int drv_net_fill_receive_path(struct ieee80211_local *local,
 +					    struct net_device_path_ctx *ctx,
@@ -87,12 +55,14 @@
 +	return ret;
 +}
 +
- #endif /* __MAC80211_DRIVER_OPS */
+ static inline int drv_net_setup_tc(struct ieee80211_local *local,
+ 				   struct ieee80211_sub_if_data *sdata,
+ 				   struct net_device *dev,
 diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
-index 25a7545..6e76b23 100644
+index a18f80d..b82065c 100644
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -920,6 +920,29 @@ out:
+@@ -936,6 +936,28 @@ out:
  	return ret;
  }
  
@@ -118,22 +88,19 @@
 +	return ret;
 +}
 +
-+
  static const struct net_device_ops ieee80211_dataif_8023_ops = {
  	.ndo_open		= ieee80211_open,
  	.ndo_stop		= ieee80211_stop,
-@@ -929,6 +952,7 @@ static const struct net_device_ops ieee80211_dataif_8023_ops = {
+@@ -945,6 +967,7 @@ static const struct net_device_ops ieee80211_dataif_8023_ops = {
  	.ndo_set_mac_address	= ieee80211_change_mac,
  	.ndo_get_stats64	= ieee80211_get_stats64,
  	.ndo_fill_forward_path	= ieee80211_netdev_fill_forward_path,
-+	.ndo_fill_receive_path = ieee80211_netdev_fill_receive_path,
++	.ndo_fill_receive_path	= ieee80211_netdev_fill_receive_path,
+ 	.ndo_setup_tc		= ieee80211_netdev_setup_tc,
  };
  
- static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
 diff --git a/net/mac80211/util.c b/net/mac80211/util.c
-old mode 100644
-new mode 100755
-index 608f927..fd63ee3
+index 608f927..fd63ee3 100644
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
 @@ -914,6 +914,15 @@ struct wireless_dev *ieee80211_vif_to_wdev(struct ieee80211_vif *vif)
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0015-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch
similarity index 100%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0015-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-register-.ndo_setup_tc-to-support-wifi2.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-register-.ndo_setup_tc-to-support-wifi2.patch
deleted file mode 100644
index c32e2a0..0000000
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0014-mac80211-mtk-register-.ndo_setup_tc-to-support-wifi2.patch
+++ /dev/null
@@ -1,89 +0,0 @@
-From a4cd8f81a63827647e88021cbcfc479f024221cb Mon Sep 17 00:00:00 2001
-From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Fri, 23 Dec 2022 18:12:41 +0800
-Subject: [PATCH 14/19] mac80211: mtk: register .ndo_setup_tc to support
- wifi2wifi offload
-
-Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
----
- include/net/mac80211.h |  5 +++++
- net/mac80211/iface.c   | 26 ++++++++++++++++++++++++++
- 2 files changed, 31 insertions(+)
-
-diff --git a/include/net/mac80211.h b/include/net/mac80211.h
-index d1d7fc3..1de9fad 100644
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -4227,6 +4227,8 @@ struct ieee80211_prep_tx_info {
-  *	In fact, cannot change from having valid_links and not having them.
-  * @net_fill_receive_path: Called from .ndo_fill_receive_path in order to
-  *	get a path for hardware flow offloading
-+  * @net_setup_tc: Called from .ndo_setup_tc in order to register flowblock
-+ *	callback function
-  */
- struct ieee80211_ops {
- 	void (*tx)(struct ieee80211_hw *hw,
-@@ -4585,6 +4587,9 @@ struct ieee80211_ops {
- 	int (*net_fill_receive_path)(struct ieee80211_hw *hw,
- 				     struct net_device_path_ctx *ctx,
- 				     struct net_device_path *path);
-+	int (*net_setup_tc)(struct ieee80211_hw *hw,
-+			    struct net_device *dev,
-+			    int type, void *type_data);
- };
- 
- /**
-diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
-index 6e76b23..b80fb66 100644
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -942,6 +942,30 @@ static int ieee80211_netdev_fill_receive_path(struct net_device_path_ctx *ctx,
- 	return ret;
- }
- 
-+static int ieee80211_netdev_setup_tc(struct net_device *dev,
-+					       enum tc_setup_type type, void *type_data)
-+{
-+	struct ieee80211_sub_if_data *sdata;
-+	struct ieee80211_local *local;
-+	int ret = -ENOENT;
-+
-+	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-+	local = sdata->local;
-+
-+	if (!local->ops->net_setup_tc)
-+		return -EOPNOTSUPP;
-+
-+	if (!type_data)
-+		return -EINVAL;
-+
-+	rcu_read_lock();
-+
-+	ret = local->ops->net_setup_tc(&local->hw, dev, (int)type, type_data);
-+
-+	rcu_read_unlock();
-+
-+	return ret;
-+}
- 
- static const struct net_device_ops ieee80211_dataif_8023_ops = {
- 	.ndo_open		= ieee80211_open,
-@@ -953,6 +977,7 @@ static const struct net_device_ops ieee80211_dataif_8023_ops = {
- 	.ndo_get_stats64	= ieee80211_get_stats64,
- 	.ndo_fill_forward_path	= ieee80211_netdev_fill_forward_path,
- 	.ndo_fill_receive_path = ieee80211_netdev_fill_receive_path,
-+	.ndo_setup_tc		= ieee80211_netdev_setup_tc,
- };
- 
- static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
-@@ -1482,6 +1507,7 @@ static void ieee80211_if_setup(struct net_device *dev)
- 	ether_setup(dev);
- 	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
- 	dev->priv_flags |= IFF_NO_QUEUE;
-+	dev->features |= NETIF_F_HW_TC;
- 	dev->netdev_ops = &ieee80211_dataif_ops;
- 	dev->needs_free_netdev = true;
- 	dev->priv_destructor = ieee80211_if_free;
--- 
-2.18.0
-
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0016-mac80211-mtk-track-obss-color-bitmap.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0015-mac80211-mtk-track-obss-color-bitmap.patch
similarity index 95%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0016-mac80211-mtk-track-obss-color-bitmap.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0015-mac80211-mtk-track-obss-color-bitmap.patch
index 0c4ec80..a97deae 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0016-mac80211-mtk-track-obss-color-bitmap.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0015-mac80211-mtk-track-obss-color-bitmap.patch
@@ -27,7 +27,7 @@
  	struct ieee80211_fils_discovery fils_discovery;
  	u32 unsol_bcast_probe_resp_interval;
  	struct cfg80211_bitrate_mask beacon_tx_rate;
-@@ -7250,7 +7251,7 @@ ieee80211_get_unsol_bcast_probe_resp_tmpl(struct ieee80211_hw *hw,
+@@ -7248,7 +7249,7 @@ ieee80211_get_unsol_bcast_probe_resp_tmpl(struct ieee80211_hw *hw,
  					  struct ieee80211_vif *vif);
  
  /**
@@ -36,7 +36,7 @@
   * collision.
   *
   * @vif: &struct ieee80211_vif pointer from the add_interface callback.
-@@ -7259,7 +7260,7 @@ ieee80211_get_unsol_bcast_probe_resp_tmpl(struct ieee80211_hw *hw,
+@@ -7257,7 +7258,7 @@ ieee80211_get_unsol_bcast_probe_resp_tmpl(struct ieee80211_hw *hw,
   * @gfp: allocation flags
   */
  void
@@ -92,7 +92,7 @@
 index 9f43775..71e312f 100644
 --- a/net/mac80211/trace.h
 +++ b/net/mac80211/trace.h
-@@ -3026,6 +3026,27 @@ TRACE_EVENT(stop_queue,
+@@ -3051,6 +3051,27 @@ TRACE_EVENT(stop_queue,
  	)
  );
  
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0017-mac80211-mtk-aging-color-bitmap.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0016-mac80211-mtk-aging-color-bitmap.patch
similarity index 65%
rename from recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0017-mac80211-mtk-aging-color-bitmap.patch
rename to recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0016-mac80211-mtk-aging-color-bitmap.patch
index 5413f5c..8953cb9 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0017-mac80211-mtk-aging-color-bitmap.patch
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0016-mac80211-mtk-aging-color-bitmap.patch
@@ -1,17 +1,18 @@
-From 96d0335462d6762924800c7d90e378eebe590385 Mon Sep 17 00:00:00 2001
+From 638a487c558695eff644966027833704e583ab4d Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Mon, 13 Mar 2023 05:36:59 +0800
-Subject: [PATCH 2/2] mac80211: mtk: ageout color bitmap
+Subject: [PATCH] mac80211: mtk: ageout color bitmap
 
 Adding a periodic work which runs once per second to check BSS color.
 OBSS BSS Color will be ageout if not seen for 10 seconds.
 ---
  include/net/mac80211.h     |  1 +
- net/mac80211/cfg.c         | 26 ++++++++++++++++++++++++++
- net/mac80211/ieee80211_i.h |  6 ++++++
+ net/mac80211/cfg.c         | 30 ++++++++++++++++++++++++++++++
+ net/mac80211/ieee80211_i.h |  5 +++++
  net/mac80211/iface.c       |  5 +++++
+ net/mac80211/link.c        |  2 ++
  net/mac80211/rx.c          |  1 +
- 5 files changed, 39 insertions(+)
+ 6 files changed, 44 insertions(+)
 
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
 index 3cf1745..d044be5 100644
@@ -26,10 +27,10 @@
  	u32 unsol_bcast_probe_resp_interval;
  	struct cfg80211_bitrate_mask beacon_tx_rate;
 diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index 5c9dda1..4bcb1d4 100644
+index 5c9dda1..343ce2b 100644
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -4755,6 +4755,32 @@ out:
+@@ -4755,6 +4755,36 @@ out:
  	return err;
  }
  
@@ -38,12 +39,15 @@
 +{
 +	struct ieee80211_sub_if_data *sdata =
 +		container_of(work, struct ieee80211_sub_if_data,
-+				color_aging_work.work);
++			     deflink.color_aging_work.work);
 +	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
 +	int i = 0;
 +
 +	sdata_lock(sdata);
 +
++	if (!ieee80211_sdata_running(sdata))
++		goto unlock;
++
 +	for (i = 0; i < IEEE80211_BSS_COLOR_MAX; i++) {
 +		/* ageout if not seen for a period */
 +		if ((bss_conf->used_color_bitmap & BIT_ULL(i)) &&
@@ -54,8 +58,9 @@
 +	}
 +
 +	ieee80211_queue_delayed_work(&sdata->local->hw,
-+			&sdata->color_aging_work, HZ);
++			&sdata->deflink.color_aging_work, HZ);
 +
++unlock:
 +	sdata_unlock(sdata);
 +}
 +
@@ -63,19 +68,18 @@
  ieee80211_set_radar_background(struct wiphy *wiphy,
  			       struct cfg80211_chan_def *chandef)
 diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
-index a10ef29..295f45b 100644
+index a10ef29..4f4dd89 100644
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1111,6 +1111,8 @@ struct ieee80211_sub_if_data {
- 	} debugfs;
- #endif
+@@ -987,6 +987,7 @@ struct ieee80211_link_data {
+ 	struct cfg80211_chan_def csa_chandef;
  
+ 	struct work_struct color_change_finalize_work;
 +	struct delayed_work color_aging_work;
-+
- 	/* must be last, dynamically sized area in this! */
- 	struct ieee80211_vif vif;
- };
-@@ -1930,8 +1932,12 @@ void ieee80211_csa_finalize_work(struct work_struct *work);
+ 
+ 	/* context reservation -- protected with chanctx_mtx */
+ 	struct ieee80211_chanctx *reserved_chanctx;
+@@ -1930,8 +1931,12 @@ void ieee80211_csa_finalize_work(struct work_struct *work);
  int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
  			     struct cfg80211_csa_settings *params);
  
@@ -89,28 +93,41 @@
  /* interface handling */
  #define MAC80211_SUPPORTED_FEATURES_TX	(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \
 diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
-index b80fb66..6d37adb 100644
+index b80fb66..98682a0 100644
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -541,6 +541,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do
+@@ -541,6 +541,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do
  	cancel_work_sync(&sdata->deflink.color_change_finalize_work);
  
  	cancel_delayed_work_sync(&sdata->deflink.dfs_cac_timer_work);
-+	if (sdata->vif.type == NL80211_IFTYPE_AP)
-+		cancel_delayed_work_sync(&sdata->color_aging_work);
++	cancel_delayed_work_sync(&sdata->deflink.color_aging_work);
  
  	if (sdata->wdev.cac_started) {
  		chandef = sdata->vif.bss_conf.chandef;
-@@ -1787,6 +1789,9 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
- 		skb_queue_head_init(&sdata->u.ap.ps.bc_buf);
- 		INIT_LIST_HEAD(&sdata->u.ap.vlans);
- 		sdata->vif.bss_conf.bssid = sdata->vif.addr;
-+		INIT_DELAYED_WORK(&sdata->color_aging_work, ieee80211_color_aging_work);
+@@ -1470,6 +1471,10 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
+ 
+ 	set_bit(SDATA_STATE_RUNNING, &sdata->state);
+ 
++	if (sdata->vif.type == NL80211_IFTYPE_AP)
 +		ieee80211_queue_delayed_work(&sdata->local->hw,
-+					     &sdata->color_aging_work, 0);
- 		break;
- 	case NL80211_IFTYPE_P2P_CLIENT:
- 		type = NL80211_IFTYPE_STATION;
++					     &sdata->deflink.color_aging_work, HZ);
++
+ 	return 0;
+  err_del_interface:
+ 	drv_remove_interface(local, sdata);
+diff --git a/net/mac80211/link.c b/net/mac80211/link.c
+index e309708..d34cdc2 100644
+--- a/net/mac80211/link.c
++++ b/net/mac80211/link.c
+@@ -43,6 +43,8 @@ void ieee80211_link_init(struct ieee80211_sub_if_data *sdata,
+ 	INIT_LIST_HEAD(&link->reserved_chanctx_list);
+ 	INIT_DELAYED_WORK(&link->dfs_cac_timer_work,
+ 			  ieee80211_dfs_cac_timer_work);
++	INIT_DELAYED_WORK(&link->color_aging_work,
++			  ieee80211_color_aging_work);
+ 
+ 	if (!deflink) {
+ 		switch (sdata->vif.type) {
 diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
 index fd2f650..67c768c 100644
 --- a/net/mac80211/rx.c
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0103-mac80211-mtk-add-send-bar-on-addbarsp_handle.patch b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0103-mac80211-mtk-add-send-bar-on-addbarsp_handle.patch
new file mode 100644
index 0000000..054d623
--- /dev/null
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/mtk-0103-mac80211-mtk-add-send-bar-on-addbarsp_handle.patch
@@ -0,0 +1,30 @@
+From 64b7f68018adbbbe33c6edb602c05dc19f8c5ea8 Mon Sep 17 00:00:00 2001
+From: ye he <ye.he@mediatek.com>
+Date: Wed, 22 Feb 2023 16:09:32 +0800
+Subject: [PATCH] add send bar action when recieve addba rsp
+
+Signed-off-by: ye he <ye.he@mediatek.com>
+---
+ net/mac80211/agg-tx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+ mode change 100755 => 100644 net/mac80211/agg-tx.c
+
+diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
+old mode 100755
+new mode 100644
+index 7f750c1..4292258
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -1060,7 +1060,8 @@ next:
+ 
+ 		tid_tx->buf_size = buf_size;
+ 		tid_tx->amsdu = amsdu;
+-
++		ieee80211_send_bar(&sta->sdata->vif, sta->sta.addr,
++					   tid, 0);
+ 		if (test_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state))
+ 			ieee80211_agg_tx_operational(local, sta, tid);
+ 
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
index fd21f88..6976f33 100644
--- a/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
+++ b/recipes-wifi/linux-mac80211/files/patches-6.x/subsys/subsys.inc
@@ -31,6 +31,9 @@
     file://324-v6.3-wifi-mac80211-Add-HE-MU-MIMO-related-flags-in-ieee80.patch \
     file://325-wifi-mac80211-introduce-ieee80211_refresh_tx_agg_ses.patch \
     file://326-wifi-mac80211-add-mesh-fast-rx-support.patch \
+    file://327-wifi-mac80211-add-support-for-letting-drivers-regist.patch \
+    file://328-wifi-mac80211-fix-invalid-drv_sta_pre_rcu_remove-cal.patch \
+    file://329-wifi-mac80211-fix-receiving-mesh-packets-in-forwardi.patch \
     file://400-allow-ibss-mixed.patch \
     file://500-mac80211_configure_antenna_gain.patch \
     file://782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch \
@@ -46,10 +49,10 @@
     file://mtk-0011-mac80211-mtk-check-the-control-channel-before-downgr.patch \
     file://mtk-0012-mac80211-mtk-fix-tx-amsdu-aggregation.patch \
     file://mtk-0013-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-id.patch \
-    file://mtk-0014-mac80211-mtk-register-.ndo_setup_tc-to-support-wifi2.patch \
-    file://mtk-0015-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch \
-    file://mtk-0016-mac80211-mtk-track-obss-color-bitmap.patch \
-    file://mtk-0017-mac80211-mtk-aging-color-bitmap.patch \
+    file://mtk-0014-mac80211-mtk-fix-build-error-on-Linux-Kernel-5.4.patch \
+    file://mtk-0015-mac80211-mtk-track-obss-color-bitmap.patch \
+    file://mtk-0016-mac80211-mtk-aging-color-bitmap.patch \
     file://mtk-0100-mac80211-mtk-add-EHT-BA1024-support.patch \
     file://mtk-0101-mac80211-mtk-add-rate-duration-for-EHT-rate.patch \
+    file://mtk-0103-mac80211-mtk-add-send-bar-on-addbarsp_handle.patch \
     "
diff --git a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0017-mac80211-mtk-aging-color-bitmap.patch b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0017-mac80211-mtk-aging-color-bitmap.patch
index 3577abd..b530b3b 100644
--- a/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0017-mac80211-mtk-aging-color-bitmap.patch
+++ b/recipes-wifi/linux-mac80211/files/patches/subsys/mtk-0017-mac80211-mtk-aging-color-bitmap.patch
@@ -1,4 +1,4 @@
-From 13c1f52aa61fe71335711e16216ba6abb33a8ead Mon Sep 17 00:00:00 2001
+From 84d68e0b64f56564560fc96b6e3ce10078462a01 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Wed, 8 Mar 2023 06:32:42 +0800
 Subject: [PATCH] mac80211: mtk: ageout color bitmap
@@ -7,11 +7,11 @@
 OBSS BSS Color will be ageout if not seen for 10 seconds.
 ---
  include/net/mac80211.h     |  1 +
- net/mac80211/cfg.c         | 25 +++++++++++++++++++++++++
+ net/mac80211/cfg.c         | 29 +++++++++++++++++++++++++++++
  net/mac80211/ieee80211_i.h |  5 +++++
- net/mac80211/iface.c       |  5 +++++
+ net/mac80211/iface.c       |  7 +++++++
  net/mac80211/rx.c          |  1 +
- 5 files changed, 37 insertions(+)
+ 5 files changed, 43 insertions(+)
 
 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
 index c6cadf7..6f8c661 100644
@@ -26,10 +26,10 @@
  	u32 unsol_bcast_probe_resp_interval;
  	bool s1g;
 diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index 86d231b..82e44d2 100644
+index 86d231b..7449777 100644
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -4425,6 +4425,31 @@ unlock:
+@@ -4425,6 +4425,35 @@ unlock:
  	sdata_unlock(sdata);
  }
  
@@ -43,6 +43,9 @@
 +
 +	sdata_lock(sdata);
 +
++	if (!ieee80211_sdata_running(sdata))
++		goto unlock;
++
 +	for (i = 0; i < IEEE80211_BSS_COLOR_MAX; i++) {
 +		/* ageout if not seen for a period */
 +		if ((bss_conf->used_color_bitmap & BIT_ULL(i)) &&
@@ -55,6 +58,7 @@
 +	ieee80211_queue_delayed_work(&sdata->local->hw,
 +				     &sdata->color_aging_work, HZ);
 +
++unlock:
 +	sdata_unlock(sdata);
 +}
 +
@@ -87,30 +91,39 @@
  /* interface handling */
  #define MAC80211_SUPPORTED_FEATURES_TX	(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \
 diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
-index d314f39..ba25327 100644
+index d314f39..00b0443 100644
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -466,6 +466,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do
+@@ -466,6 +466,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do
  	cancel_work_sync(&sdata->color_change_finalize_work);
  
  	cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
-+	if (sdata->vif.type == NL80211_IFTYPE_AP)
-+		cancel_delayed_work_sync(&sdata->color_aging_work);
++	cancel_delayed_work_sync(&sdata->color_aging_work);
  
  	if (sdata->wdev.cac_started) {
  		chandef = sdata->vif.bss_conf.chandef;
-@@ -1758,6 +1760,9 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
- 		skb_queue_head_init(&sdata->u.ap.ps.bc_buf);
- 		INIT_LIST_HEAD(&sdata->u.ap.vlans);
- 		sdata->vif.bss_conf.bssid = sdata->vif.addr;
-+		INIT_DELAYED_WORK(&sdata->color_aging_work, ieee80211_color_aging_work);
+@@ -1391,6 +1392,10 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
+ 	set_bit(SDATA_STATE_RUNNING, &sdata->state);
+ 
+ 	switch (sdata->vif.type) {
++	case NL80211_IFTYPE_AP:
 +		ieee80211_queue_delayed_work(&sdata->local->hw,
-+					     &sdata->color_aging_work, 0);
++					     &sdata->color_aging_work, HZ);
++		break;
+ 	case NL80211_IFTYPE_P2P_DEVICE:
+ 		rcu_assign_pointer(local->p2p_sdata, sdata);
  		break;
- 	case NL80211_IFTYPE_P2P_CLIENT:
- 		type = NL80211_IFTYPE_STATION;
+@@ -2166,6 +2171,8 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
+ 			  ieee80211_dfs_cac_timer_work);
+ 	INIT_DELAYED_WORK(&sdata->dec_tailroom_needed_wk,
+ 			  ieee80211_delayed_tailroom_dec);
++	INIT_DELAYED_WORK(&sdata->color_aging_work,
++			  ieee80211_color_aging_work);
+ 
+ 	for (i = 0; i < NUM_NL80211_BANDS; i++) {
+ 		struct ieee80211_supported_band *sband;
 diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
-index 36fcf97..31d3bb4 100644
+index 36fcf97..838085f 100644
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
 @@ -3221,6 +3221,7 @@ ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data *rx)
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch
index 66ab9ce..28a93cc 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch
@@ -1,7 +1,7 @@
-From 995b09b6a62700568b36cc2e4ae6b6063456942b Mon Sep 17 00:00:00 2001
+From c23474064033e8f22f599b19c0580b045968c831 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 10 Feb 2023 17:39:23 +0800
-Subject: [PATCH 01/19] wifi: mt76: mt7996: add eht rx rate support
+Subject: [PATCH 01/29] wifi: mt76: mt7996: add eht rx rate support
 
 Add support to report eht rx rate.
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-let-non-bufferable-MMPDUs-use-corre.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-let-non-bufferable-MMPDUs-use-corre.patch
index 872ef03..e2322e8 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-let-non-bufferable-MMPDUs-use-corre.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0002-wifi-mt76-mt7996-let-non-bufferable-MMPDUs-use-corre.patch
@@ -1,7 +1,7 @@
-From 5b858f7f944144d99fb0ca1ef26d6b8c6719890c Mon Sep 17 00:00:00 2001
+From c31547ef67fd39b10eefc4516020383c822a55ee Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 16 Feb 2023 10:52:22 +0800
-Subject: [PATCH 02/19] wifi: mt76: mt7996: let non-bufferable MMPDUs use
+Subject: [PATCH 02/29] wifi: mt76: mt7996: let non-bufferable MMPDUs use
  correct hw queue
 
 non-bufferable MMPDUs are expected to use ALTX hw queue, but current
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch
index 65596f4..5ccaf1e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch
@@ -1,7 +1,7 @@
-From 00d76d4dc3cdb719b5fc234d9cf3bbef39f448ce Mon Sep 17 00:00:00 2001
+From 0c30c9dd897963c3524105599fa611aa5369b34e Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 13 Feb 2023 14:48:10 +0800
-Subject: [PATCH 06/19] wifi: mt76: mt7996: fix pointer calculation in ie
+Subject: [PATCH 03/29] wifi: mt76: mt7996: fix pointer calculation in ie
  countdown event
 
 Fix the tail and data pointers. The rxd->len in mt7996_mcu_rxd does not
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0016-wifi-mt76-mt7996-init-mpdu-density.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7996-init-mpdu-density.patch
similarity index 80%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0016-wifi-mt76-mt7996-init-mpdu-density.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7996-init-mpdu-density.patch
index 74992ab..299d240 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0016-wifi-mt76-mt7996-init-mpdu-density.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7996-init-mpdu-density.patch
@@ -1,7 +1,7 @@
-From 322307272a4c4ccb627d6596220b0ab5bd4aed45 Mon Sep 17 00:00:00 2001
+From 39eb5f447d4cba23c684744800609c17bfb457e4 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 13 Feb 2023 09:46:40 +0800
-Subject: [PATCH 16/19] wifi: mt76: mt7996: init mpdu density
+Subject: [PATCH 04/29] wifi: mt76: mt7996: init mpdu density
 
 Init mpdu density based on the hardware capability to
 prevent hardware drop.
@@ -12,10 +12,10 @@
  1 file changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index ced38ac8..479b2cee 100644
+index 946da93e..de94e151 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -374,10 +374,13 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
+@@ -196,10 +196,13 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
  
  	hw->max_tx_fragments = 4;
  
@@ -30,7 +30,7 @@
  
  	if (phy->mt76->cap.has_5ghz) {
  		phy->mt76->sband_5g.sband.ht_cap.cap |=
-@@ -389,6 +392,8 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
+@@ -211,6 +214,8 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
  			IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK |
  			IEEE80211_VHT_CAP_SHORT_GI_160 |
  			IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
@@ -39,7 +39,7 @@
  	}
  
  	mt76_set_stream_caps(phy->mt76, true);
-@@ -873,7 +878,7 @@ mt7996_init_he_caps(struct mt7996_phy *phy, enum nl80211_band band,
+@@ -689,7 +694,7 @@ mt7996_init_he_caps(struct mt7996_phy *phy, enum nl80211_band band,
  		u16 cap = IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
  			  IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS;
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0007-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0007-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch
index 7988196..dcd8cf1 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0007-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch
@@ -1,7 +1,7 @@
-From c2dafe57df1726acb80e30987bc8d678b86af14a Mon Sep 17 00:00:00 2001
+From 770f4020e030af0b930f761513275d6284a9344f Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 14 Feb 2023 18:35:43 +0800
-Subject: [PATCH 07/19] wifi: mt76: mt7996: remove mt7996_mcu_set_pm()
+Subject: [PATCH 05/29] wifi: mt76: mt7996: remove mt7996_mcu_set_pm()
 
 Currently using BSS_INFO_PS command will sometimes cause packet drop in
 hw rx queue.
@@ -17,10 +17,10 @@
  3 files changed, 35 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index a4fd9e24..44d23e1d 100644
+index 3e4da035..f13f67b2 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -56,10 +56,6 @@ static int mt7996_start(struct ieee80211_hw *hw)
+@@ -52,10 +52,6 @@ static int mt7996_start(struct ieee80211_hw *hw)
  
  	set_bit(MT76_STATE_RUNNING, &phy->mt76->state);
  
@@ -31,7 +31,7 @@
  	ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
  				     MT7996_WATCHDOG_TIME);
  
-@@ -85,10 +81,6 @@ static void mt7996_stop(struct ieee80211_hw *hw)
+@@ -79,10 +75,6 @@ static void mt7996_stop(struct ieee80211_hw *hw)
  
  	clear_bit(MT76_STATE_RUNNING, &phy->mt76->state);
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0015-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch
similarity index 89%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0015-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch
index 236cada..679e354 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0015-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0006-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch
@@ -1,7 +1,7 @@
-From 763303e5fb846c92c22dd19ffec95d844103e425 Mon Sep 17 00:00:00 2001
+From 9a407d91aec5a9320d3522d5c5d12c99503355b2 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 23 Feb 2023 19:18:45 +0800
-Subject: [PATCH 15/19] wifi: mt76: mt7996: fix eeprom antenna bitfield mask
+Subject: [PATCH 06/29] wifi: mt76: mt7996: fix eeprom antenna bitfield mask
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0007-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
similarity index 85%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0007-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
index c91eb62..b9081c5 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0003-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0007-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
@@ -1,7 +1,7 @@
-From 09ef1c1248c8b38c5f2c6e624397e64e8938349f Mon Sep 17 00:00:00 2001
+From 0983321b5cc8138e316fce622c7cd1e12951b046 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 16 Feb 2023 00:39:01 +0800
-Subject: [PATCH 03/19] wifi: mt76: mt7996: reduce repeated bss_info and
+Subject: [PATCH 07/29] wifi: mt76: mt7996: reduce repeated bss_info and
  sta_rec commands
 
 Refine the flow of setting bss_info and sta_rec commands to prevent from
@@ -14,10 +14,10 @@
  1 file changed, 6 insertions(+), 15 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 3e4da035..e80ee19e 100644
+index f13f67b2..ab28ebeb 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -241,8 +241,8 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+@@ -233,8 +233,8 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  	int idx = msta->wcid.idx;
  
@@ -27,7 +27,7 @@
  
  	if (vif == phy->monitor_vif)
  		phy->monitor_vif = NULL;
-@@ -510,17 +510,13 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+@@ -502,17 +502,13 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
  	/* station mode uses BSSID to map the wlan entry to a peer,
  	 * and then peer references bss_info_rfch to set bandwidth cap.
  	 */
@@ -50,7 +50,7 @@
  	if (changed & BSS_CHANGED_ERP_CTS_PROT)
  		mt7996_mac_enable_rtscts(dev, vif, info->use_cts_prot);
  
-@@ -533,11 +529,6 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+@@ -525,11 +521,6 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
  		}
  	}
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0008-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch
similarity index 76%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0008-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch
index cc366e3..5c63463 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0004-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0008-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch
@@ -1,7 +1,7 @@
-From c86f2243472f00fd2011cc44b89a87f7f6e2066a Mon Sep 17 00:00:00 2001
+From c3d13a89b2236a68d0cd5e0ed4e2ff8163ce7bf2 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 15 Feb 2023 18:38:04 +0800
-Subject: [PATCH 04/19] wifi: mt76: mt7996: move radio enable command to
+Subject: [PATCH 08/29] wifi: mt76: mt7996: move radio enable command to
  mt7996_start()
 
 The radio enable and disable commands are used for per-phy radio, so
@@ -14,7 +14,7 @@
  1 file changed, 6 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index e80ee19e..a4fd9e24 100644
+index ab28ebeb..44d23e1d 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -46,6 +46,10 @@ static int mt7996_start(struct ieee80211_hw *hw)
@@ -28,7 +28,7 @@
  	ret = mt7996_mcu_set_chan_info(phy, UNI_CHANNEL_RX_PATH);
  	if (ret)
  		goto out;
-@@ -77,6 +81,8 @@ static void mt7996_stop(struct ieee80211_hw *hw)
+@@ -73,6 +77,8 @@ static void mt7996_stop(struct ieee80211_hw *hw)
  
  	mutex_lock(&dev->mt76.mutex);
  
@@ -36,8 +36,8 @@
 +
  	clear_bit(MT76_STATE_RUNNING, &phy->mt76->state);
  
- 	ieee80211_iterate_interfaces(dev->mt76.hw,
-@@ -189,10 +195,6 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
+ 	mutex_unlock(&dev->mt76.mutex);
+@@ -181,10 +187,6 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
  	if (ret)
  		goto out;
  
@@ -48,7 +48,7 @@
  	dev->mt76.vif_mask |= BIT_ULL(mvif->mt76.idx);
  	phy->omac_mask |= BIT_ULL(mvif->mt76.omac_idx);
  
-@@ -248,7 +250,6 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+@@ -240,7 +242,6 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
  		phy->monitor_vif = NULL;
  
  	mt7996_mcu_add_dev_info(phy, vif, false);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0009-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
similarity index 91%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0009-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
index 07dffec..4509388 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0005-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0009-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
@@ -1,7 +1,7 @@
-From 5d4c7f88b2066f4a8ec1769cf6c067d0e88abfa3 Mon Sep 17 00:00:00 2001
+From 0a3940d0eaa4fa234c30d27c4f06b001caf0e5a0 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 16 Feb 2023 13:53:14 +0800
-Subject: [PATCH 05/19] wifi: mt76: connac: set correct muar_idx for connac3
+Subject: [PATCH 09/29] wifi: mt76: connac: set correct muar_idx for connac3
  chipset
 
 Set the muar_idx to 0xe for the hw bcast/mcast station entry of connac3
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0008-wifi-mt76-mt7996-add-muru-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0010-wifi-mt76-mt7996-add-muru-support.patch
similarity index 97%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0008-wifi-mt76-mt7996-add-muru-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0010-wifi-mt76-mt7996-add-muru-support.patch
index 20d7f48..d8b0cb5 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0008-wifi-mt76-mt7996-add-muru-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0010-wifi-mt76-mt7996-add-muru-support.patch
@@ -1,7 +1,7 @@
-From b587a9f1615585f8db0fa98cc46791a3253ddac7 Mon Sep 17 00:00:00 2001
+From e625dc373c444f9b5ccb1334319ea53466bc5d4a Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 Date: Mon, 28 Nov 2022 14:36:09 +0800
-Subject: [PATCH 08/19] wifi: mt76: mt7996: add muru support
+Subject: [PATCH 10/29] wifi: mt76: mt7996: add muru support
 
 Add sta_rec_muru() and related phy cap for MU and RU support.
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0009-wifi-mt76-mt7996-set-txd-v1.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0011-wifi-mt76-mt7996-set-txd-v1.patch
similarity index 92%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0009-wifi-mt76-mt7996-set-txd-v1.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0011-wifi-mt76-mt7996-set-txd-v1.patch
index cc7548a..acd0139 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0009-wifi-mt76-mt7996-set-txd-v1.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0011-wifi-mt76-mt7996-set-txd-v1.patch
@@ -1,7 +1,7 @@
-From 9a1a54c7df9babadd8f6ae066deb2b5e49715cb0 Mon Sep 17 00:00:00 2001
+From d6998e58f199c6f7bef7022ccae96d6679ef264f Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Feb 2023 10:40:33 +0800
-Subject: [PATCH 09/19] wifi: mt76: mt7996: set txd v1
+Subject: [PATCH 11/29] wifi: mt76: mt7996: set txd v1
 
 ---
  mt7996/mac.c | 3 +++
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0010-wifi-mt76-mt7996-add-thermal-protection-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0012-wifi-mt76-mt7996-add-thermal-protection-support.patch
similarity index 96%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0010-wifi-mt76-mt7996-add-thermal-protection-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0012-wifi-mt76-mt7996-add-thermal-protection-support.patch
index 319eb1f..9ab919e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0010-wifi-mt76-mt7996-add-thermal-protection-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0012-wifi-mt76-mt7996-add-thermal-protection-support.patch
@@ -1,7 +1,7 @@
-From 1744b5397ad4240ce41bf88bfff2eef34d76d587 Mon Sep 17 00:00:00 2001
+From 43cb74cdfc3651a15f6dd2b22bff3a83a2464950 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 2 Feb 2023 21:20:31 +0800
-Subject: [PATCH 10/19] wifi: mt76: mt7996: add thermal protection support
+Subject: [PATCH 12/29] wifi: mt76: mt7996: add thermal protection support
 
 This commit includes the following changes:
 1. implement MTK thermal protection driver API
@@ -30,7 +30,7 @@
  
  #define MCU_UNI_CMD_EVENT			BIT(1)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 946da93e..5a22cd81 100644
+index de94e151..44165a35 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -41,6 +41,98 @@ static const struct ieee80211_iface_combination if_comb[] = {
@@ -132,7 +132,7 @@
  static void mt7996_led_set_config(struct led_classdev *led_cdev,
  				  u8 delay_on, u8 delay_off)
  {
-@@ -367,6 +459,10 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
+@@ -372,6 +464,10 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
  	if (ret)
  		goto error;
  
@@ -143,7 +143,7 @@
  	ret = mt7996_init_debugfs(phy);
  	if (ret)
  		goto error;
-@@ -387,6 +483,8 @@ mt7996_unregister_phy(struct mt7996_phy *phy, enum mt76_band_id band)
+@@ -392,6 +488,8 @@ mt7996_unregister_phy(struct mt7996_phy *phy, enum mt76_band_id band)
  	if (!phy)
  		return;
  
@@ -152,7 +152,7 @@
  	mphy = phy->dev->mt76.phys[band];
  	mt76_unregister_phy(mphy);
  	ieee80211_free_hw(mphy->hw);
-@@ -876,6 +974,10 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -881,6 +979,10 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -163,7 +163,7 @@
  	ieee80211_queue_work(mt76_hw(dev), &dev->init_work);
  
  	ret = mt7996_register_phy(dev, mt7996_phy2(dev), MT_BAND1);
-@@ -893,6 +995,9 @@ void mt7996_unregister_device(struct mt7996_dev *dev)
+@@ -898,6 +1000,9 @@ void mt7996_unregister_device(struct mt7996_dev *dev)
  {
  	mt7996_unregister_phy(mt7996_phy3(dev), MT_BAND2);
  	mt7996_unregister_phy(mt7996_phy2(dev), MT_BAND1);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0011-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0013-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
similarity index 96%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0011-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0013-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
index 3de5b90..131536e 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0011-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0013-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
@@ -1,7 +1,7 @@
-From afdb511f0febad0e0cc5572461ab04794cf86852 Mon Sep 17 00:00:00 2001
+From f2ef3b6850401af359d0446ca86d882ef2a96ce7 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 2 Feb 2023 20:53:42 +0800
-Subject: [PATCH 11/19] wifi: mt76: mt7996: add thermal sensor device support
+Subject: [PATCH 13/29] wifi: mt76: mt7996: add thermal sensor device support
 
 ---
  mt7996/init.c | 87 +++++++++++++++++++++++++++++++++++++++++++++++++++
@@ -9,7 +9,7 @@
  2 files changed, 128 insertions(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 5a22cd81..631ada15 100644
+index 44165a35..7350194f 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -4,6 +4,8 @@
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0012-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0014-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch
similarity index 96%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0012-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0014-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch
index 728b4e0..a3f5531 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0012-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0014-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch
@@ -1,7 +1,7 @@
-From f78111386b1ac57a459687b9d58e1804a80d4970 Mon Sep 17 00:00:00 2001
+From cd1bbd6253594e8836b072a947c0b8b1d278a615 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Feb 2023 11:34:51 +0800
-Subject: [PATCH 12/19] wifi: mt76: mt7996: add 802.11s mesh amsdu/de-amsdu
+Subject: [PATCH 14/29] wifi: mt76: mt7996: add 802.11s mesh amsdu/de-amsdu
  support
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0013-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0015-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch
similarity index 98%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0013-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0015-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch
index 93ec12d..2a07e16 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0013-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0015-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch
@@ -1,7 +1,7 @@
-From 6b8dfe2580a782be754be7bcd44da6ad79dc4231 Mon Sep 17 00:00:00 2001
+From 56bbd0875ca8a21737d1b87c85eb38433c787e57 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 13 Feb 2023 18:00:25 +0800
-Subject: [PATCH 13/19] wifi: mt76: mt7996: add L0.5 system error recovery
+Subject: [PATCH 15/29] wifi: mt76: mt7996: add L0.5 system error recovery
  support
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
@@ -295,7 +295,7 @@
  {
  	mt7996_dma_disable(dev, true);
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 631ada15..ced38ac8 100644
+index 7350194f..479b2cee 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -278,8 +278,7 @@ static void mt7996_led_set_brightness(struct led_classdev *led_cdev,
@@ -308,7 +308,7 @@
  		    struct ieee80211_supported_band *sband)
  {
  	int i, nss = hweight8(dev->mphy.antenna_mask);
-@@ -429,7 +428,7 @@ mt7996_mac_init_band(struct mt7996_dev *dev, u8 band)
+@@ -434,7 +433,7 @@ mt7996_mac_init_band(struct mt7996_dev *dev, u8 band)
  	mt76_rmw(dev, MT_WTBLOFF_RSCR(band), mask, set);
  }
  
@@ -317,7 +317,7 @@
  {
  #define HIF_TXD_V2_1	4
  	int i;
-@@ -463,7 +462,7 @@ static void mt7996_mac_init(struct mt7996_dev *dev)
+@@ -468,7 +467,7 @@ static void mt7996_mac_init(struct mt7996_dev *dev)
  		mt7996_mac_init_band(dev, i);
  }
  
@@ -326,7 +326,7 @@
  {
  	int ret;
  
-@@ -1075,6 +1074,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1080,6 +1079,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0014-wifi-mt76-mt7996-add-dsp-firmware-download.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0016-wifi-mt76-mt7996-add-dsp-firmware-download.patch
similarity index 97%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0014-wifi-mt76-mt7996-add-dsp-firmware-download.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0016-wifi-mt76-mt7996-add-dsp-firmware-download.patch
index 8193a5a..67a5209 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0014-wifi-mt76-mt7996-add-dsp-firmware-download.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0016-wifi-mt76-mt7996-add-dsp-firmware-download.patch
@@ -1,7 +1,7 @@
-From 2d6ca0f6974ad4f6dcf110ccbbcbbc7185aa7655 Mon Sep 17 00:00:00 2001
+From 74dd56acd59a3c85279b5e21be789fbca5fdcc57 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 17 Feb 2023 14:13:38 +0800
-Subject: [PATCH 14/19] wifi: mt76: mt7996: add dsp firmware download
+Subject: [PATCH 16/29] wifi: mt76: mt7996: add dsp firmware download
 
 Add DSP firmware for phy related control. Without this patch,the
 firmware state would not be ready.
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0017-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0017-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch
index 0b179f4..6e63254 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0017-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0017-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch
@@ -1,46 +1,23 @@
-From b4af2c843368e7a787fc02ebde5a8ff41edf0a76 Mon Sep 17 00:00:00 2001
+From ce62eda4ead9fcb2374f5d0933da5416a48e64ed Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 2 Mar 2023 15:44:52 +0800
-Subject: [PATCH 17/19] wifi: mt76: mt7996: fix icv error when enable AP and
+Subject: [PATCH 17/29] wifi: mt76: mt7996: fix icv error when enable AP and
  STA simultaneously
 
 Fix mcu command content to prevent ICV error
-1. The legacy mld index needs to start from 16.
-2. The bmc_tx_wlan_idx needs to be the vif index rather
+The bmc_tx_wlan_idx needs to be the vif index rather
 than peer AP's index.
 
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
- mt7996/mcu.c | 12 +++++++++---
- 1 file changed, 9 insertions(+), 3 deletions(-)
+ mt7996/mcu.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 09800ff2..829f7be6 100644
+index 09800ff2..07c521c1 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -664,6 +664,7 @@ mt7996_mcu_bss_txcmd_tlv(struct sk_buff *skb, bool en)
- static void
- mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
- {
-+#define MT7996_LEGACY_MLD_IDX_START 16
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct bss_mld_tlv *mld;
- 	struct tlv *tlv;
-@@ -672,8 +673,12 @@ mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
- 
- 	mld = (struct bss_mld_tlv *)tlv;
- 	mld->group_mld_id = 0xff;
--	mld->own_mld_id = mvif->mt76.idx;
-+	mld->own_mld_id = MT7996_LEGACY_MLD_IDX_START + mvif->mt76.idx;
- 	mld->remap_idx = 0xff;
-+	if (vif->type == NL80211_IFTYPE_AP) {
-+		mld->group_mld_id = MT7996_LEGACY_MLD_IDX_START + mvif->mt76.idx;
-+		memcpy(mld->mac_addr, vif->bss_conf.bssid, ETH_ALEN);
-+	}
- }
- 
- static void
-@@ -744,6 +749,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -744,6 +744,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  	struct cfg80211_chan_def *chandef = &phy->chandef;
  	struct mt76_connac_bss_basic_tlv *bss;
  	u32 type = CONNECTION_INFRA_AP;
@@ -48,7 +25,7 @@
  	struct tlv *tlv;
  	int idx;
  
-@@ -763,7 +769,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -763,7 +764,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  				struct mt76_wcid *wcid;
  
  				wcid = (struct mt76_wcid *)sta->drv_priv;
@@ -57,7 +34,7 @@
  			}
  			rcu_read_unlock();
  		}
-@@ -783,7 +789,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -783,7 +784,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
  	bss->dtim_period = vif->bss_conf.dtim_period;
  	bss->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0018-wifi-mt76-mt7996-set-wcid-in-txp.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0018-wifi-mt76-mt7996-set-wcid-in-txp.patch
index 74f4e9e..9c284eb 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0018-wifi-mt76-mt7996-set-wcid-in-txp.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0018-wifi-mt76-mt7996-set-wcid-in-txp.patch
@@ -1,7 +1,7 @@
-From 68649746f1862d6c9b3e06492789aadde8c4d2e5 Mon Sep 17 00:00:00 2001
+From a940bcb3617bec4f302f1b271fce9d65f56cdd97 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 6 Mar 2023 15:52:26 +0800
-Subject: [PATCH 18/19] wifi: mt76: mt7996: set wcid in txp
+Subject: [PATCH 18/29] wifi: mt76: mt7996: set wcid in txp
 
 Set correct wcid in txp for SDO to get wtbl.
 
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0019-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0019-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch
new file mode 100644
index 0000000..a3c95e4
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0019-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch
@@ -0,0 +1,30 @@
+From 86aa4e386d09edc4948878e894782a86ba4f8506 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Fri, 17 Mar 2023 11:08:04 +0800
+Subject: [PATCH 19/29] wifi: mt76: mt7996: init he and eht cap for AP_VLAN
+
+Add AP_VLAN types in __mt7996_set_stream_he_eht_caps to
+initialize the ht and eht caps. Without this patch, the
+BA response from VLAN AP would not include the ADDBA
+extension tag.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt7996/init.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/mt7996/init.c b/mt7996/init.c
+index 479b2cee..381917a8 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -996,6 +996,7 @@ __mt7996_set_stream_he_eht_caps(struct mt7996_phy *phy,
+ 		switch (i) {
+ 		case NL80211_IFTYPE_STATION:
+ 		case NL80211_IFTYPE_AP:
++		case NL80211_IFTYPE_AP_VLAN:
+ #ifdef CONFIG_MAC80211_MESH
+ 		case NL80211_IFTYPE_MESH_POINT:
+ #endif
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0020-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0020-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch
new file mode 100644
index 0000000..807e1c2
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0020-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch
@@ -0,0 +1,29 @@
+From ffccfb05f1edb318d1c12437fc5554085ca264db Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 16 Mar 2023 16:09:51 +0800
+Subject: [PATCH 20/29] wifi: mt76: mt7996: fix beamform mcu cmd configuration
+
+bf_num means how many band can support beamform, so the value shall be 3.
+bf_bitmap represents which band can support beamform.
+---
+ mt7996/mcu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 07c521c1..ed1abe14 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -3506,8 +3506,8 @@ int mt7996_mcu_set_txbf(struct mt7996_dev *dev, u8 action)
+ 
+ 		tlv = mt7996_mcu_add_uni_tlv(skb, action, sizeof(*req_mod_en));
+ 		req_mod_en = (struct bf_mod_en_ctrl *)tlv;
+-		req_mod_en->bf_num = 2;
+-		req_mod_en->bf_bitmap = GENMASK(0, 0);
++		req_mod_en->bf_num = 3;
++		req_mod_en->bf_bitmap = GENMASK(2, 0);
+ 		break;
+ 	}
+ 	default:
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0021-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0021-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch
new file mode 100644
index 0000000..6f528ef
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0021-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch
@@ -0,0 +1,35 @@
+From 205e9952e06a64ef212ca0a01d5fc9319604bae4 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Tue, 7 Mar 2023 17:05:01 +0800
+Subject: [PATCH 21/29] wifi: mt76: mt7996: Fix using the wrong phy for
+ background radar event
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7996/mcu.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index ed1abe14..cc6c6a4a 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -339,10 +339,15 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
+ 	if (r->band_idx >= ARRAY_SIZE(dev->mt76.phys))
+ 		return;
+ 
+-	mphy = dev->mt76.phys[r->band_idx];
++	if (dev->rdd2_phy && r->band_idx == MT_RX_SEL2)
++		mphy = dev->rdd2_phy->mt76;
++	else
++		mphy = dev->mt76.phys[r->band_idx];
++
+ 	if (!mphy)
+ 		return;
+ 
++	/* TODO: check fw background chain's rdd idx */
+ 	if (r->band_idx == MT_RX_SEL2)
+ 		cfg80211_background_radar_event(mphy->hw->wiphy,
+ 						&dev->rdd2_chandef,
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0022-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0022-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch
new file mode 100644
index 0000000..5214415
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0022-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch
@@ -0,0 +1,180 @@
+From 82f771fc993aea34d3cefb6fbc11ea855a653c1b Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Tue, 20 Dec 2022 09:47:31 +0800
+Subject: [PATCH 22/29] wifi: mt76: mt7996: support more options in
+ .set_bitrate_mask()
+
+With this patch, driver can support runtime configuration for single
+rate, (HE)GI and HE_Ltf through .set_bitrate_mask(). Please noted that
+currently we do not support to fix any single parameter for EHT mode.
+---
+ mt7996/mcu.c | 139 ++++++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 137 insertions(+), 2 deletions(-)
+
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index cc6c6a4a..a0d468df 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -1616,6 +1616,136 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
+ 				     MCU_WM_UNI_CMD(RA), true);
+ }
+ 
++static int
++mt7996_mcu_set_part_fixed_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
++				    struct ieee80211_sta *sta, void *data, u32 field)
++{
++	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct sta_phy *phy = data;
++	struct sta_rec_ra_fixed *ra;
++	struct sk_buff *skb;
++	struct tlv *tlv;
++
++	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
++					      &msta->wcid,
++					      MT7996_STA_UPDATE_MAX_SIZE);
++
++	if (IS_ERR(skb))
++		return PTR_ERR(skb);
++
++	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
++	ra = (struct sta_rec_ra_fixed*)tlv;
++
++	switch (field) {
++	case RATE_PARAM_AUTO:
++		break;
++	case RATE_PARAM_FIXED:
++	case RATE_PARAM_FIXED_MCS:
++	case RATE_PARAM_FIXED_GI:
++	case RATE_PARAM_FIXED_HE_LTF:
++		if (phy)
++			ra->phy = *phy;
++		break;
++	default:
++		break;
++	}
++	ra->field = cpu_to_le32(field);
++
++	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
++				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
++}
++
++
++static int
++mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif,
++			       struct ieee80211_sta *sta)
++{
++	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
++	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
++	enum nl80211_band band = chandef->chan->band;
++	struct sta_phy phy = {};
++	int ret, nrates = 0;
++
++#define __sta_phy_bitrate_mask_check(_mcs, _gi, _ht, _he)			\
++	do {									\
++		u8 i, gi = mask->control[band]._gi;				\
++		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
++		for (i = 0; i <= sta->deflink.bandwidth; i++) {			\
++			phy.sgi |= gi << (i << (_he));				\
++			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
++		}								\
++		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {	\
++			if (!mask->control[band]._mcs[i])			\
++				continue;					\
++			nrates += hweight16(mask->control[band]._mcs[i]);	\
++			phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;		\
++			if (_ht)						\
++				phy.mcs += 8 * i;				\
++		}								\
++	} while (0)
++
++	if (sta->deflink.he_cap.has_he) {
++		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
++	} else if (sta->deflink.vht_cap.vht_supported) {
++		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
++	} else if (sta->deflink.ht_cap.ht_supported) {
++		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
++	} else {
++		nrates = hweight32(mask->control[band].legacy);
++		phy.mcs = ffs(mask->control[band].legacy) - 1;
++	}
++#undef __sta_phy_bitrate_mask_check
++
++	/* fall back to auto rate control */
++	if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
++	    mask->control[band].he_gi == GENMASK(7, 0) &&
++	    mask->control[band].he_ltf == GENMASK(7, 0) &&
++	    nrates != 1)
++		return 0;
++
++	/* fixed single rate */
++	if (nrates == 1) {
++		ret = mt7996_mcu_set_part_fixed_rate_ctrl(dev, vif, sta, &phy,
++							  RATE_PARAM_FIXED_MCS);
++		if (ret)
++			return ret;
++	}
++
++	/* fixed GI */
++	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
++	    mask->control[band].he_gi != GENMASK(7, 0)) {
++		struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++		u32 addr;
++
++		/* firmware updates only TXCMD but doesn't take WTBL into
++		 * account, so driver should update here to reflect the
++		 * actual txrate hardware sends out.
++		 */
++		addr = mt7996_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
++		if (sta->deflink.he_cap.has_he)
++			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
++		else
++			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
++
++		ret = mt7996_mcu_set_part_fixed_rate_ctrl(dev, vif, sta, &phy,
++							  RATE_PARAM_FIXED_GI);
++		if (ret)
++			return ret;
++	}
++
++	/* fixed HE_LTF */
++	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
++		ret = mt7996_mcu_set_part_fixed_rate_ctrl(dev, vif, sta, &phy,
++							  RATE_PARAM_FIXED_HE_LTF);
++		if (ret)
++			return ret;
++	}
++
++	return 0;
++}
++
+ static void
+ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+ 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
+@@ -1725,6 +1855,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 	struct sk_buff *skb;
++	int ret;
+ 
+ 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
+ 					      &msta->wcid,
+@@ -1744,8 +1875,12 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ 	 */
+ 	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
+ 
+-	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
+-				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
++	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
++				    MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
++	if (ret)
++		return ret;
++
++	return mt7996_mcu_add_rate_ctrl_fixed(dev, vif, sta);
+ }
+ 
+ static int
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0023-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0023-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch
new file mode 100644
index 0000000..4e6194a
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0023-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch
@@ -0,0 +1,42 @@
+From 384684375a7f6e14c1359eb201a2567aeef72b4b Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Fri, 17 Mar 2023 11:16:44 +0800
+Subject: [PATCH 23/29] wifi: mt76: mt7996: fill txwi by SW temporarily
+
+If use WA to fill TXD, it cannot ping pass.
+Remove this patch after bug fix.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt7996/mac.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/mt7996/mac.c b/mt7996/mac.c
+index bb23f531..cddb1dfe 100644
+--- a/mt7996/mac.c
++++ b/mt7996/mac.c
+@@ -1137,9 +1137,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb);
+ 	memset(txwi_ptr, 0, MT_TXD_SIZE);
+ 	/* Transmit non qos data by 802.11 header and need to fill txd by host*/
+-	if (!is_8023 || pid >= MT_PACKET_ID_FIRST)
+-		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, qid,
+-				      pid, key, 0);
++	mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, qid,
++			      pid, key, 0);
+ 
+ 	txd[0] |= le32_encode_bits(1, MT_TXD0_VER);
+ 
+@@ -1152,8 +1151,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 
+ 	txp->fw.flags = cpu_to_le16(MT_CT_INFO_FROM_HOST);
+ 
+-	if (!is_8023 || pid >= MT_PACKET_ID_FIRST)
+-		txp->fw.flags |= cpu_to_le16(MT_CT_INFO_APPLY_TXD);
++	txp->fw.flags |= cpu_to_le16(MT_CT_INFO_APPLY_TXD);
+ 
+ 	if (!key)
+ 		txp->fw.flags |= cpu_to_le16(MT_CT_INFO_NONE_CIPHER_FRAME);
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0024-wifi-mt76-mt7996-update-wmm-queue-mapping.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0024-wifi-mt76-mt7996-update-wmm-queue-mapping.patch
new file mode 100644
index 0000000..83354d0
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0024-wifi-mt76-mt7996-update-wmm-queue-mapping.patch
@@ -0,0 +1,62 @@
+From 96c6a8e68b5fd3dacdb5239a6ce9a26e5a08c07f Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Mon, 20 Mar 2023 19:09:59 +0800
+Subject: [PATCH 24/29] wifi: mt76: mt7996: update wmm queue mapping
+
+The mac80211 use mac80211 queue (MQ) and the firmware
+use access class index (ACI) so convert the MQ to ACI
+in mt7996_conf_tx.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt7996/main.c | 11 +++++++++--
+ mt7996/mcu.c  |  2 +-
+ 2 files changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/mt7996/main.c b/mt7996/main.c
+index cb0e0d31..4e9536e7 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -197,7 +197,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
+ 	mvif->mt76.omac_idx = idx;
+ 	mvif->phy = phy;
+ 	mvif->mt76.band_idx = band_idx;
+-	mvif->mt76.wmm_idx = band_idx;
++	mvif->mt76.wmm_idx = vif->type != NL80211_IFTYPE_AP;
+ 
+ 	ret = mt7996_mcu_add_dev_info(phy, vif, true);
+ 	if (ret)
+@@ -419,9 +419,16 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	       const struct ieee80211_tx_queue_params *params)
+ {
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	const u8 MQ_to_ACI[IEEE80211_NUM_ACS] = {
++		[IEEE80211_AC_VO] = 3,
++		[IEEE80211_AC_VI] = 2,
++		[IEEE80211_AC_BE] = 0,
++		[IEEE80211_AC_BK] = 1,
++	};
+ 
+ 	/* no need to update right away, we'll get BSS_CHANGED_QOS */
+-	queue = mt76_connac_lmac_mapping(queue);
++	/* convert mac80211 queue to ACI */
++	queue = MQ_to_ACI[queue];
+ 	mvif->queue_params[queue] = *params;
+ 
+ 	return 0;
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index a0d468df..deb6e1eb 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -2902,7 +2902,7 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
+ 
+ 		e = (struct edca *)tlv;
+ 		e->set = WMM_PARAM_SET;
+-		e->queue = ac + mvif->mt76.wmm_idx * MT7996_MAX_WMM_SETS;
++		e->queue = ac;
+ 		e->aifs = q->aifs;
+ 		e->txop = cpu_to_le16(q->txop);
+ 
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0025-wifi-mt76-mt7996-enable-IDS-debug-log.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0025-wifi-mt76-mt7996-enable-IDS-debug-log.patch
new file mode 100644
index 0000000..44adc3c
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0025-wifi-mt76-mt7996-enable-IDS-debug-log.patch
@@ -0,0 +1,40 @@
+From 7d83cdb40941ae174a91ec95406f2f61bc6887d5 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Tue, 21 Mar 2023 15:04:45 +0800
+Subject: [PATCH 25/29] wifi: mt76: mt7996: enable IDS debug log
+
+---
+ mt7996/debugfs.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
+index f2c46a50..34c30a58 100644
+--- a/mt7996/debugfs.c
++++ b/mt7996/debugfs.c
+@@ -296,6 +296,12 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
+ 		DEBUG_SPL,
+ 		DEBUG_RPT_RX,
+ 		DEBUG_RPT_RA = 68,
++		DEBUG_IDS_PP = 93,
++		DEBUG_IDS_RA = 94,
++		DEBUG_IDS_BF = 95,
++		DEBUG_IDS_SR = 96,
++		DEBUG_IDS_RU = 97,
++		DEBUG_IDS_MUMIMO = 98,
+ 	} debug;
+ 	bool tx, rx, en;
+ 	int ret;
+@@ -315,8 +321,8 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
+ 	if (ret)
+ 		return ret;
+ 
+-	for (debug = DEBUG_TXCMD; debug <= DEBUG_RPT_RA; debug++) {
+-		if (debug == 67)
++	for (debug = DEBUG_TXCMD; debug <= DEBUG_IDS_MUMIMO; debug++) {
++		if (debug == 67 || (debug > DEBUG_RPT_RA && debug < DEBUG_IDS_PP))
+ 			continue;
+ 
+ 		if (debug == DEBUG_RPT_RX)
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0026-mt76-testmode-add-atenl-support-in-mt7996.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0026-mt76-testmode-add-atenl-support-in-mt7996.patch
new file mode 100644
index 0000000..272a8f2
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0026-mt76-testmode-add-atenl-support-in-mt7996.patch
@@ -0,0 +1,48 @@
+From 8ab802ff986da3c6ec8afbbe761df35b9f824ea6 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Wed, 28 Dec 2022 22:24:25 +0800
+Subject: [PATCH 26/29] mt76: testmode: add atenl support in mt7996
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ testmode.c | 3 ++-
+ testmode.h | 2 ++
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/testmode.c b/testmode.c
+index 0accc71a..0d2bae9f 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -612,7 +612,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ 
+ 	if (dev->test_mtd.name &&
+ 	    (nla_put_string(msg, MT76_TM_ATTR_MTD_PART, dev->test_mtd.name) ||
+-	     nla_put_u32(msg, MT76_TM_ATTR_MTD_OFFSET, dev->test_mtd.offset)))
++	     nla_put_u32(msg, MT76_TM_ATTR_MTD_OFFSET, dev->test_mtd.offset) ||
++	     nla_put_u8(msg, MT76_TM_ATTR_BAND_IDX, phy->band_idx)))
+ 		goto out;
+ 
+ 	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
+diff --git a/testmode.h b/testmode.h
+index 5e2792d8..a40cd74b 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -17,6 +17,7 @@
+  *
+  * @MT76_TM_ATTR_MTD_PART: mtd partition used for eeprom data (string)
+  * @MT76_TM_ATTR_MTD_OFFSET: offset of eeprom data within the partition (u32)
++ * @MT76_TM_ATTR_BAND_IDX: band idx of the chip (u8)
+  *
+  * @MT76_TM_ATTR_TX_COUNT: configured number of frames to send when setting
+  *	state to MT76_TM_STATE_TX_FRAMES (u32)
+@@ -56,6 +57,7 @@ enum mt76_testmode_attr {
+ 
+ 	MT76_TM_ATTR_MTD_PART,
+ 	MT76_TM_ATTR_MTD_OFFSET,
++	MT76_TM_ATTR_BAND_IDX,
+ 
+ 	MT76_TM_ATTR_TX_COUNT,
+ 	MT76_TM_ATTR_TX_LENGTH,
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0027-mt76-testmode-add-basic-testmode-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0027-mt76-testmode-add-basic-testmode-support.patch
new file mode 100644
index 0000000..6072f10
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0027-mt76-testmode-add-basic-testmode-support.patch
@@ -0,0 +1,1788 @@
+From 8913b802b0d59773c58e669b6d4e9be2154828a0 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Wed, 1 Mar 2023 11:59:16 +0800
+Subject: [PATCH 27/29] mt76: testmode: add basic testmode support
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ eeprom.c          |   6 +-
+ mac80211.c        |   3 +-
+ mt76.h            |  11 +
+ mt76_connac_mcu.h |   2 +
+ mt7996/Makefile   |   2 +
+ mt7996/eeprom.c   |  35 ++-
+ mt7996/eeprom.h   |   1 +
+ mt7996/init.c     |   7 +
+ mt7996/main.c     |  15 ++
+ mt7996/mcu.c      |  39 ++-
+ mt7996/mcu.h      |  27 ++
+ mt7996/mt7996.h   |  22 ++
+ mt7996/testmode.c | 615 ++++++++++++++++++++++++++++++++++++++++++++++
+ mt7996/testmode.h | 292 ++++++++++++++++++++++
+ testmode.c        |  45 +++-
+ testmode.h        |  60 +++++
+ tools/fields.c    |  92 +++++++
+ 17 files changed, 1257 insertions(+), 17 deletions(-)
+ create mode 100644 mt7996/testmode.c
+ create mode 100644 mt7996/testmode.h
+
+diff --git a/eeprom.c b/eeprom.c
+index ea54b7af..263e5089 100644
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -89,8 +89,10 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
+ 	}
+ 
+ #ifdef CONFIG_NL80211_TESTMODE
+-	dev->test_mtd.name = devm_kstrdup(dev->dev, part, GFP_KERNEL);
+-	dev->test_mtd.offset = offset;
++	if (len == dev->eeprom.size) {
++		dev->test_mtd.name = devm_kstrdup(dev->dev, part, GFP_KERNEL);
++		dev->test_mtd.offset = offset;
++	}
+ #endif
+ 
+ out_put_node:
+diff --git a/mac80211.c b/mac80211.c
+index e53166fc..a4b3d346 100644
+--- a/mac80211.c
++++ b/mac80211.c
+@@ -826,7 +826,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
+ 	}
+ 
+ #ifdef CONFIG_NL80211_TESTMODE
+-	if (phy->test.state == MT76_TM_STATE_RX_FRAMES) {
++	if (!(phy->test.flag & MT_TM_FW_RX_COUNT) &&
++	    phy->test.state == MT76_TM_STATE_RX_FRAMES) {
+ 		phy->test.rx_stats.packets[q]++;
+ 		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
+ 			phy->test.rx_stats.fcs_error[q]++;
+diff --git a/mt76.h b/mt76.h
+index c3d1313e..343bd910 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -652,8 +652,12 @@ struct mt76_testmode_ops {
+ 	int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
+ 			  enum mt76_testmode_state new_state);
+ 	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
++	void (*reset_rx_stats)(struct mt76_phy *phy);
++	void (*tx_stop)(struct mt76_phy *phy);
+ };
+ 
++#define MT_TM_FW_RX_COUNT	BIT(0)
++
+ struct mt76_testmode_data {
+ 	enum mt76_testmode_state state;
+ 
+@@ -669,6 +673,7 @@ struct mt76_testmode_data {
+ 	u8 tx_rate_sgi;
+ 	u8 tx_rate_ldpc;
+ 	u8 tx_rate_stbc;
++	u16 tx_preamble_puncture;
+ 	u8 tx_ltf;
+ 
+ 	u8 tx_antenna_mask;
+@@ -678,6 +683,9 @@ struct mt76_testmode_data {
+ 	u32 tx_time;
+ 	u32 tx_ipg;
+ 
++	bool ibf;
++	bool ebf;
++
+ 	u32 freq_offset;
+ 
+ 	u8 tx_power[4];
+@@ -692,7 +700,10 @@ struct mt76_testmode_data {
+ 	struct {
+ 		u64 packets[__MT_RXQ_MAX];
+ 		u64 fcs_error[__MT_RXQ_MAX];
++		u64 len_mismatch;
+ 	} rx_stats;
++	u8 flag;
++	u8 aid;
+ };
+ 
+ struct mt76_vif {
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 79dde31a..bfbf18d6 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1218,10 +1218,12 @@ enum {
+ 	MCU_UNI_CMD_EFUSE_CTRL = 0x2d,
+ 	MCU_UNI_CMD_RA = 0x2f,
+ 	MCU_UNI_CMD_MURU = 0x31,
++	MCU_UNI_CMD_TESTMODE_RX_STAT = 0x32,
+ 	MCU_UNI_CMD_BF = 0x33,
+ 	MCU_UNI_CMD_CHANNEL_SWITCH = 0x34,
+ 	MCU_UNI_CMD_THERMAL = 0x35,
+ 	MCU_UNI_CMD_VOW = 0x37,
++	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
+ 	MCU_UNI_CMD_RRO = 0x57,
+ 	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
+ };
+diff --git a/mt7996/Makefile b/mt7996/Makefile
+index bcb9a3c5..f9fb1b0d 100644
+--- a/mt7996/Makefile
++++ b/mt7996/Makefile
+@@ -4,3 +4,5 @@ obj-$(CONFIG_MT7996E) += mt7996e.o
+ 
+ mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
+ 	     debugfs.o mmio.o
++
++mt7996e-$(CONFIG_NL80211_TESTMODE) += testmode.o
+diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
+index 2e48c5a4..64e3c4e2 100644
+--- a/mt7996/eeprom.c
++++ b/mt7996/eeprom.c
+@@ -6,6 +6,11 @@
+ #include <linux/firmware.h>
+ #include "mt7996.h"
+ #include "eeprom.h"
++#include <linux/moduleparam.h>
++
++static bool testmode_enable;
++module_param(testmode_enable, bool, 0644);
++MODULE_PARM_DESC(testmode_enable, "Enable testmode");
+ 
+ static int mt7996_check_eeprom(struct mt7996_dev *dev)
+ {
+@@ -23,7 +28,10 @@ static int mt7996_check_eeprom(struct mt7996_dev *dev)
+ static char *mt7996_eeprom_name(struct mt7996_dev *dev)
+ {
+ 	/* reserve for future variants */
+-	return MT7996_EEPROM_DEFAULT;
++	if (dev->testmode_enable)
++		return MT7996_EEPROM_DEFAULT_TM;
++	else
++		return MT7996_EEPROM_DEFAULT;
+ }
+ 
+ static int
+@@ -52,21 +60,36 @@ out:
+ 	return ret;
+ }
+ 
+-static int mt7996_eeprom_load(struct mt7996_dev *dev)
++int mt7996_eeprom_check_fw_mode(struct mt7996_dev *dev)
+ {
++	u8 *eeprom;
+ 	int ret;
+ 
++	/* load eeprom in flash or bin file mode to determine fw mode */
+ 	ret = mt76_eeprom_init(&dev->mt76, MT7996_EEPROM_SIZE);
+ 	if (ret < 0)
+ 		return ret;
+ 
+ 	if (ret) {
+ 		dev->flash_mode = true;
+-	} else {
+-		u8 free_block_num;
+-		u32 block_num, i;
+-		u32 eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;
++		eeprom = dev->mt76.eeprom.data;
++		/* testmode enable priority: eeprom field > module parameter */
++		dev->testmode_enable = !mt7996_check_eeprom(dev) ? eeprom[MT_EE_TESTMODE_EN] :
++								   testmode_enable;
++	}
++
++	return ret;
++}
++
++static int mt7996_eeprom_load(struct mt7996_dev *dev)
++{
++	int ret;
++	u8 free_block_num;
++	u32 block_num, i;
++	u32 eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;
+ 
++	/* flash or bin file mode eeprom is loaded before mcu init */
++	if (!dev->flash_mode) {
+ 		ret = mt7996_mcu_get_eeprom_free_block(dev, &free_block_num);
+ 		if (ret < 0)
+ 			return ret;
+diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
+index cfc48698..f7497c9b 100644
+--- a/mt7996/eeprom.h
++++ b/mt7996/eeprom.h
+@@ -14,6 +14,7 @@ enum mt7996_eeprom_field {
+ 	MT_EE_MAC_ADDR =	0x004,
+ 	MT_EE_MAC_ADDR2 =	0x00a,
+ 	MT_EE_WIFI_CONF =	0x190,
++	MT_EE_TESTMODE_EN =	0x1af,
+ 	MT_EE_MAC_ADDR3 =	0x2c0,
+ 	MT_EE_RATE_DELTA_2G =	0x1400,
+ 	MT_EE_RATE_DELTA_5G =	0x147d,
+diff --git a/mt7996/init.c b/mt7996/init.c
+index 381917a8..29a6783c 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -621,6 +621,10 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
+ 
+ 	set_bit(MT76_STATE_INITIALIZED, &dev->mphy.state);
+ 
++	ret = mt7996_eeprom_check_fw_mode(dev);
++	if (ret < 0)
++		return ret;
++
+ 	ret = mt7996_mcu_init(dev);
+ 	if (ret)
+ 		return ret;
+@@ -1055,6 +1059,9 @@ int mt7996_register_device(struct mt7996_dev *dev)
+ 
+ 	mt7996_init_wiphy(hw);
+ 
++#ifdef CONFIG_NL80211_TESTMODE
++	dev->mt76.test_ops = &mt7996_testmode_ops;
++#endif
+ 	/* init led callbacks */
+ 	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
+ 		dev->mphy.leds.cdev.brightness_set = mt7996_led_set_brightness;
+diff --git a/mt7996/main.c b/mt7996/main.c
+index 4e9536e7..b24c75aa 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -22,6 +22,17 @@ static bool mt7996_dev_running(struct mt7996_dev *dev)
+ 	return phy && test_bit(MT76_STATE_RUNNING, &phy->mt76->state);
+ }
+ 
++static void mt7996_testmode_disable_all(struct mt7996_dev *dev)
++{
++	struct mt7996_phy *phy;
++	int i;
++
++	for (i = 0; i < __MT_MAX_BAND; i++) {
++		phy = __mt7996_phy(dev, i);
++		mt76_testmode_set_state(phy->mt76, MT76_TM_STATE_OFF);
++	}
++}
++
+ int mt7996_run(struct ieee80211_hw *hw)
+ {
+ 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
+@@ -36,6 +47,8 @@ int mt7996_run(struct ieee80211_hw *hw)
+ 			goto out;
+ 	}
+ 
++	mt7996_testmode_disable_all(dev);
++
+ 	mt7996_mac_enable_nf(dev, phy->mt76->band_idx);
+ 
+ 	ret = mt7996_mcu_set_rts_thresh(phy, 0x92b);
+@@ -1343,6 +1356,8 @@ const struct ieee80211_ops mt7996_ops = {
+ 	.sta_set_decap_offload = mt7996_sta_set_decap_offload,
+ 	.add_twt_setup = mt7996_mac_add_twt_setup,
+ 	.twt_teardown_request = mt7996_twt_teardown_request,
++	CFG80211_TESTMODE_CMD(mt76_testmode_cmd)
++	CFG80211_TESTMODE_DUMP(mt76_testmode_dump)
+ #ifdef CONFIG_MAC80211_DEBUGFS
+ 	.sta_add_debugfs = mt7996_sta_add_debugfs,
+ #endif
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index deb6e1eb..0a52afd1 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -2580,7 +2580,10 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
+ 		release_firmware(fw);						\
+ 	} while (0)
+ 
+-	LOAD_RAM(WM);
++	if (dev->testmode_enable)
++		LOAD_RAM(WM_TM);
++	else
++		LOAD_RAM(WM);
+ 	LOAD_RAM(DSP);
+ 	LOAD_RAM(WA);
+ #undef LOAD_RAM
+@@ -4109,3 +4112,37 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u8 val)
+ 	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(RRO), &req,
+ 				 sizeof(req), true);
+ }
++
++int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data)
++{
++	struct mt7996_dev *dev = phy->dev;
++	struct tx_power_ctrl req = {
++		.tag = cpu_to_le16(power_ctrl_id),
++		.len = cpu_to_le16(sizeof(req) - 4),
++		.power_ctrl_id = power_ctrl_id,
++		.band_idx = phy->mt76->band_idx,
++	};
++
++	switch (power_ctrl_id) {
++	case UNI_TXPOWER_SKU_POWER_LIMIT_CTRL:
++		req.sku_enable = !!data;
++		break;
++	case UNI_TXPOWER_PERCENTAGE_CTRL:
++		req.percentage_ctrl_enable = !!data;
++		break;
++	case UNI_TXPOWER_PERCENTAGE_DROP_CTRL:
++		req.power_drop_level = data;
++		break;
++	case UNI_TXPOWER_BACKOFF_POWER_LIMIT_CTRL:
++		req.bf_backoff_enable = !!data;
++		break;
++	case UNI_TXPOWER_ATE_MODE_CTRL:
++		req.ate_mode_enable = !!data;
++		break;
++	default:
++		req.sku_enable = !!data;
++	}
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(TXPOWER),
++				 &req, sizeof(req), false);
++}
+diff --git a/mt7996/mcu.h b/mt7996/mcu.h
+index 778deedf..ebc62713 100644
+--- a/mt7996/mcu.h
++++ b/mt7996/mcu.h
+@@ -686,6 +686,33 @@ enum {
+ 	UNI_CMD_THERMAL_PROTECT_DUTY_CONFIG,
+ };
+ 
++struct tx_power_ctrl {
++	u8 _rsv[4];
++
++	__le16 tag;
++	__le16 len;
++
++	u8 power_ctrl_id;
++	union {
++		bool sku_enable;
++		bool ate_mode_enable;
++		bool percentage_ctrl_enable;
++		bool bf_backoff_enable;
++		u8 power_drop_level;
++	};
++	u8 band_idx;
++	u8 rsv[1];
++} __packed;
++
++enum {
++	UNI_TXPOWER_SKU_POWER_LIMIT_CTRL = 0,
++	UNI_TXPOWER_PERCENTAGE_CTRL = 1,
++	UNI_TXPOWER_PERCENTAGE_DROP_CTRL = 2,
++	UNI_TXPOWER_BACKOFF_POWER_LIMIT_CTRL = 3,
++	UNI_TXPOWER_POWER_LIMIT_TABLE_CTRL = 4,
++	UNI_TXPOWER_ATE_MODE_CTRL = 6,
++};
++
+ enum {
+ 	UNI_CMD_ACCESS_REG_BASIC = 0x0,
+ 	UNI_CMD_ACCESS_RF_REG_BASIC,
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index c2f8900c..e3fd50f6 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -30,9 +30,11 @@
+ #define MT7996_FIRMWARE_WA		"mediatek/mt7996/mt7996_wa.bin"
+ #define MT7996_FIRMWARE_WM		"mediatek/mt7996/mt7996_wm.bin"
+ #define MT7996_FIRMWARE_DSP		"mediatek/mt7996/mt7996_dsp.bin"
++#define MT7996_FIRMWARE_WM_TM		"mediatek/mt7996/mt7996_wm_tm.bin"
+ #define MT7996_ROM_PATCH		"mediatek/mt7996/mt7996_rom_patch.bin"
+ 
+ #define MT7996_EEPROM_DEFAULT		"mediatek/mt7996/mt7996_eeprom.bin"
++#define MT7996_EEPROM_DEFAULT_TM	"mediatek/mt7996/mt7996_eeprom_tm.bin"
+ #define MT7996_EEPROM_SIZE		7680
+ #define MT7996_EEPROM_BLOCK_SIZE	16
+ #define MT7996_TOKEN_SIZE		8192
+@@ -58,6 +60,7 @@ struct mt7996_dfs_pattern;
+ 
+ enum mt7996_ram_type {
+ 	MT7996_RAM_TYPE_WM = 0,
++	MT7996_RAM_TYPE_WM_TM = MT7996_RAM_TYPE_WM,
+ 	MT7996_RAM_TYPE_WA,
+ 	MT7996_RAM_TYPE_DSP,
+ };
+@@ -245,6 +248,20 @@ struct mt7996_phy {
+ 
+ 	struct mib_stats mib;
+ 	struct mt76_channel_state state_ts;
++
++#ifdef CONFIG_NL80211_TESTMODE
++	struct {
++		u32 *reg_backup;
++
++		s32 last_freq_offset;
++		u8 last_rcpi[4];
++		s8 last_ib_rssi[4];
++		s8 last_wb_rssi[4];
++		u8 last_snr;
++
++		u8 spe_idx;
++	} test;
++#endif
+ };
+ 
+ struct mt7996_dev {
+@@ -296,6 +313,8 @@ struct mt7996_dev {
+ 	bool flash_mode:1;
+ 	bool has_eht:1;
+ 
++	bool testmode_enable;
++
+ 	bool ibf;
+ 	u8 fw_debug_wm;
+ 	u8 fw_debug_wa;
+@@ -401,6 +420,7 @@ mt7996_phy3(struct mt7996_dev *dev)
+ extern const struct ieee80211_ops mt7996_ops;
+ extern struct pci_driver mt7996_pci_driver;
+ extern struct pci_driver mt7996_hif_driver;
++extern const struct mt76_testmode_ops mt7996_testmode_ops;
+ 
+ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
+ 				     void __iomem *mem_base, u32 device_id);
+@@ -410,6 +430,7 @@ u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif);
+ int mt7996_register_device(struct mt7996_dev *dev);
+ void mt7996_unregister_device(struct mt7996_dev *dev);
+ int mt7996_eeprom_init(struct mt7996_dev *dev);
++int mt7996_eeprom_check_fw_mode(struct mt7996_dev *dev);
+ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
+ int mt7996_eeprom_get_target_power(struct mt7996_dev *dev,
+ 				   struct ieee80211_channel *chan);
+@@ -485,6 +506,7 @@ int mt7996_mcu_fw_log_2_host(struct mt7996_dev *dev, u8 type, u8 ctrl);
+ int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
+ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
+ void mt7996_mcu_exit(struct mt7996_dev *dev);
++int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
+ 
+ static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
+ {
+diff --git a/mt7996/testmode.c b/mt7996/testmode.c
+new file mode 100644
+index 00000000..5dbbb788
+--- /dev/null
++++ b/mt7996/testmode.c
+@@ -0,0 +1,615 @@
++// SPDX-License-Identifier: ISC
++/*
++ * Copyright (C) 2022 MediaTek Inc.
++ */
++
++#include "mt7996.h"
++#include "mac.h"
++#include "mcu.h"
++#include "testmode.h"
++
++enum {
++	TM_CHANGED_TXPOWER,
++	TM_CHANGED_FREQ_OFFSET,
++	TM_CHANGED_TX_LENGTH,
++	TM_CHANGED_TX_TIME,
++
++	/* must be last */
++	NUM_TM_CHANGED
++};
++
++static const u8 tm_change_map[] = {
++	[TM_CHANGED_TXPOWER] = MT76_TM_ATTR_TX_POWER,
++	[TM_CHANGED_FREQ_OFFSET] = MT76_TM_ATTR_FREQ_OFFSET,
++	[TM_CHANGED_TX_LENGTH] = MT76_TM_ATTR_TX_LENGTH,
++	[TM_CHANGED_TX_TIME] = MT76_TM_ATTR_TX_TIME,
++};
++
++static u8 mt7996_tm_bw_mapping(enum nl80211_chan_width width, enum bw_mapping_method method)
++{
++	static const u8 width_to_bw[][NUM_BW_MAP] = {
++		[NL80211_CHAN_WIDTH_40] = {FW_CDBW_40MHZ, TM_CBW_40MHZ},
++		[NL80211_CHAN_WIDTH_80] = {FW_CDBW_80MHZ, TM_CBW_80MHZ},
++		[NL80211_CHAN_WIDTH_80P80] = {FW_CDBW_8080MHZ, TM_CBW_8080MHZ},
++		[NL80211_CHAN_WIDTH_160] = {FW_CDBW_160MHZ, TM_CBW_160MHZ},
++		[NL80211_CHAN_WIDTH_5] = {FW_CDBW_5MHZ, TM_CBW_5MHZ},
++		[NL80211_CHAN_WIDTH_10] = {FW_CDBW_10MHZ, TM_CBW_10MHZ},
++		[NL80211_CHAN_WIDTH_20] = {FW_CDBW_20MHZ, TM_CBW_20MHZ},
++		[NL80211_CHAN_WIDTH_20_NOHT] = {FW_CDBW_20MHZ, TM_CBW_20MHZ},
++		[NL80211_CHAN_WIDTH_320] = {FW_CDBW_320MHZ, TM_CBW_320MHZ},
++	};
++
++	if (width >= ARRAY_SIZE(width_to_bw))
++		return 0;
++
++	return width_to_bw[width][method];
++}
++
++static u8 mt7996_tm_rate_to_phy(u8 tx_rate_mode)
++{
++	static const u8 rate_to_phy[] = {
++		[MT76_TM_TX_MODE_CCK] = MT_PHY_TYPE_CCK,
++		[MT76_TM_TX_MODE_OFDM] = MT_PHY_TYPE_OFDM,
++		[MT76_TM_TX_MODE_HT] = MT_PHY_TYPE_HT,
++		[MT76_TM_TX_MODE_VHT] = MT_PHY_TYPE_VHT,
++		[MT76_TM_TX_MODE_HE_SU] = MT_PHY_TYPE_HE_SU,
++		[MT76_TM_TX_MODE_HE_EXT_SU] = MT_PHY_TYPE_HE_EXT_SU,
++		[MT76_TM_TX_MODE_HE_TB] = MT_PHY_TYPE_HE_TB,
++		[MT76_TM_TX_MODE_HE_MU] = MT_PHY_TYPE_HE_MU,
++		[MT76_TM_TX_MODE_EHT_SU] = MT_PHY_TYPE_EHT_SU,
++		[MT76_TM_TX_MODE_EHT_TRIG] = MT_PHY_TYPE_EHT_TRIG,
++		[MT76_TM_TX_MODE_EHT_MU] = MT_PHY_TYPE_EHT_MU,
++	};
++
++	if (tx_rate_mode > MT76_TM_TX_MODE_MAX)
++		return -EINVAL;
++
++	return rate_to_phy[tx_rate_mode];
++}
++
++static int
++mt7996_tm_set(struct mt7996_dev *dev, u32 func_idx, u32 data)
++{
++	struct mt7996_tm_req req = {
++		.rf_test = {
++			.tag = cpu_to_le16(UNI_RF_TEST_CTRL),
++			.len = cpu_to_le16(sizeof(req.rf_test)),
++			.action = RF_ACTION_SET,
++			.op.rf.func_idx = func_idx,
++			.op.rf.param.func_data = cpu_to_le32(data),
++		},
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(TESTMODE_CTRL), &req,
++				 sizeof(req), false);
++}
++
++static int
++mt7996_tm_get(struct mt7996_dev *dev, u32 func_idx, u32 data, u32 *result)
++{
++	struct mt7996_tm_req req = {
++		.rf_test = {
++			.tag = cpu_to_le16(UNI_RF_TEST_CTRL),
++			.len = cpu_to_le16(sizeof(req.rf_test)),
++			.action = RF_ACTION_GET,
++			.op.rf.func_idx = func_idx,
++			.op.rf.param.func_data = cpu_to_le32(data),
++		},
++	};
++	struct mt7996_tm_event *event;
++	struct sk_buff *skb;
++	int ret;
++
++	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WM_UNI_CMD_QUERY(TESTMODE_CTRL),
++					&req, sizeof(req), true, &skb);
++	if (ret)
++		return ret;
++
++	event = (struct mt7996_tm_event *)skb->data;
++	*result = event->result.payload_length;
++
++	dev_kfree_skb(skb);
++
++	return ret;
++}
++
++static void
++mt7996_tm_set_antenna(struct mt7996_phy *phy, u32 func_idx)
++{
++#define SPE_INDEX_MASK		BIT(31)
++#define RX_ANTENNA_MASK		GENMASK(20, 16)		/* RX antenna mask at most 5 bit */
++	struct mt7996_dev *dev = phy->dev;
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	u32 antenna_mask, idx = MT76_TM_ATTR_TX_ANTENNA;
++	bool is_antenna_set = td->param_set[idx / 32] & BIT(idx % 32);
++
++	if (!is_antenna_set)
++		return;
++
++	if (func_idx == SET_ID(TX_PATH))
++		antenna_mask = td->tx_spe_idx ? (SPE_INDEX_MASK | td->tx_spe_idx) :
++						td->tx_antenna_mask;
++	else if (func_idx == SET_ID(RX_PATH))
++		antenna_mask = u32_encode_bits(td->tx_antenna_mask, RX_ANTENNA_MASK);
++	else
++		return;
++
++	mt7996_tm_set(dev, func_idx, antenna_mask);
++}
++
++static void
++mt7996_tm_set_mac_addr(struct mt7996_dev *dev, u8 *addr, u32 func_idx)
++{
++#define REMAIN_PART_TAG		BIT(18)
++	u32 own_mac_first = 0, own_mac_remain = 0;
++	int len = sizeof(u32);
++
++	memcpy(&own_mac_first, addr, len);
++	mt7996_tm_set(dev, func_idx, own_mac_first);
++	/* Set the remain part of mac address */
++	memcpy(&own_mac_remain, addr + len, ETH_ALEN - len);
++	mt7996_tm_set(dev, func_idx | REMAIN_PART_TAG, own_mac_remain);
++}
++
++static int
++mt7996_tm_rf_switch_mode(struct mt7996_dev *dev, u32 op_mode)
++{
++	struct mt7996_tm_req req = {
++		.rf_test = {
++			.tag = cpu_to_le16(UNI_RF_TEST_CTRL),
++			.len = cpu_to_le16(sizeof(req.rf_test)),
++			.action = RF_ACTION_SWITCH_TO_RF_TEST,
++			.op.op_mode = cpu_to_le32(op_mode),
++		},
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(TESTMODE_CTRL), &req,
++				 sizeof(req), false);
++}
++
++static void
++mt7996_tm_init(struct mt7996_phy *phy, bool en)
++{
++#define POWER_CTRL(type)	UNI_TXPOWER_##type##_CTRL
++	struct mt7996_dev *dev = phy->dev;
++	u8 rf_test_mode = en ? RF_OPER_RF_TEST : RF_OPER_NORMAL;
++
++	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
++		return;
++
++	mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(ATE_MODE), en);
++	mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(SKU_POWER_LIMIT), !en);
++	mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(PERCENTAGE_DROP), 100);
++	mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(PERCENTAGE), !en);
++	mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(BACKOFF_POWER_LIMIT), !en);
++
++	mt7996_tm_rf_switch_mode(dev, rf_test_mode);
++
++	mt7996_mcu_add_bss_info(phy, phy->monitor_vif, en);
++	mt7996_mcu_add_sta(dev, phy->monitor_vif, NULL, en);
++
++	mt7996_tm_set(dev, SET_ID(BAND_IDX), phy->mt76->band_idx);
++
++	/* use firmware counter for RX stats */
++	phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
++}
++
++static void
++mt7996_tm_update_channel(struct mt7996_phy *phy)
++{
++#define CHAN_FREQ_BW_80P80_TAG		(SET_ID(CHAN_FREQ) | BIT(16))
++	struct mt7996_dev *dev = phy->dev;
++	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
++	struct ieee80211_channel *chan = chandef->chan;
++	u8 width = chandef->width;
++	static const u8 ch_band[] = {
++		[NL80211_BAND_2GHZ] = 0,
++		[NL80211_BAND_5GHZ] = 1,
++		[NL80211_BAND_6GHZ] = 2,
++	};
++
++	if (!chan || !chandef) {
++		dev_info(dev->mt76.dev, "chandef not found, channel update failed!\n");
++		return;
++	}
++
++	/* system bw */
++	mt7996_tm_set(dev, SET_ID(CBW), mt7996_tm_bw_mapping(width, BW_MAP_NL_TO_FW));
++
++	if (width == NL80211_CHAN_WIDTH_80P80) {
++		width = NL80211_CHAN_WIDTH_160;
++		mt7996_tm_set(dev, CHAN_FREQ_BW_80P80_TAG, chandef->center_freq2 * 1000);
++	}
++
++	/* TODO: define per-packet bw */
++	/* per-packet bw */
++	mt7996_tm_set(dev, SET_ID(DBW), mt7996_tm_bw_mapping(width, BW_MAP_NL_TO_FW));
++
++	/* control channel selection index */
++	mt7996_tm_set(dev, SET_ID(PRIMARY_CH), 0);
++	mt7996_tm_set(dev, SET_ID(BAND), ch_band[chan->band]);
++
++	/* trigger switch channel calibration */
++	mt7996_tm_set(dev, SET_ID(CHAN_FREQ), chandef->center_freq1 * 1000);
++
++	// TODO: update power limit table
++}
++
++static void
++mt7996_tm_tx_stop(struct mt76_phy *mphy)
++{
++	struct mt76_testmode_data *td = &mphy->test;
++	struct mt7996_phy *phy = mphy->priv;
++	struct mt7996_dev *dev = phy->dev;
++
++	mt7996_tm_set(dev, SET_ID(COMMAND), RF_CMD(STOP_TEST));
++	td->tx_pending = 0;
++}
++
++static void
++mt7996_tm_set_tx_frames(struct mt7996_phy *phy, bool en)
++{
++#define FRAME_CONTROL		0x88
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7996_dev *dev = phy->dev;
++
++	//TODO: RU operation, replace mcs, nss, and ldpc
++	if (en) {
++		mt7996_tm_set(dev, SET_ID(MAC_HEADER), FRAME_CONTROL);
++		mt7996_tm_set(dev, SET_ID(SEQ_CTRL), 0);
++		mt7996_tm_set(dev, SET_ID(TX_COUNT), td->tx_count);
++		mt7996_tm_set(dev, SET_ID(TX_MODE), mt7996_tm_rate_to_phy(td->tx_rate_mode));
++		mt7996_tm_set(dev, SET_ID(TX_RATE), td->tx_rate_idx);
++		mt7996_tm_set(dev, SET_ID(POWER), td->tx_power[0]);
++		mt7996_tm_set_antenna(phy, SET_ID(TX_PATH));
++		mt7996_tm_set(dev, SET_ID(STBC), td->tx_rate_stbc);
++		mt7996_tm_set(dev, SET_ID(ENCODE_MODE), td->tx_rate_ldpc);
++		mt7996_tm_set(dev, SET_ID(IBF_ENABLE), td->ibf);
++		mt7996_tm_set(dev, SET_ID(EBF_ENABLE), td->ebf);
++		mt7996_tm_set(dev, SET_ID(IPG), td->tx_ipg);
++		mt7996_tm_set(dev, SET_ID(GI), td->tx_rate_sgi);
++		mt7996_tm_set(dev, SET_ID(NSS), td->tx_rate_nss);
++		mt7996_tm_set(dev, SET_ID(AID_OFFSET), 0);
++		mt7996_tm_set(dev, SET_ID(PUNCTURE), td->tx_preamble_puncture);
++
++		mt7996_tm_set(dev, SET_ID(MAX_PE), 2);
++		mt7996_tm_set(dev, SET_ID(HW_TX_MODE), 0);
++		mt7996_tm_update_channel(phy);
++
++		/* trigger firmware to start TX */
++		mt7996_tm_set(dev, SET_ID(COMMAND), RF_CMD(START_TX));
++	} else {
++		mt7996_tm_tx_stop(phy->mt76);
++	}
++}
++
++static int
++mt7996_tm_rx_stats_user_ctrl(struct mt7996_phy *phy, u16 user_idx)
++{
++	struct mt7996_dev *dev = phy->dev;
++	struct mt7996_tm_rx_req req = {
++		.band = phy->mt76->band_idx,
++		.user_ctrl = {
++			.tag = cpu_to_le16(UNI_TM_RX_STAT_SET_USER_CTRL),
++			.len = cpu_to_le16(sizeof(req.user_ctrl)),
++			.band_idx = phy->mt76->band_idx,
++			.user_idx = cpu_to_le16(user_idx),
++		},
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(TESTMODE_RX_STAT), &req,
++				 sizeof(req), false);
++}
++
++static void
++mt7996_tm_set_rx_frames(struct mt7996_phy *phy, bool en)
++{
++#define RX_MU_DISABLE	0xf800
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7996_dev *dev = phy->dev;
++	int ret;
++
++	if (en) {
++		ret = mt7996_tm_rx_stats_user_ctrl(phy, td->aid);
++		if (ret) {
++			dev_info(dev->mt76.dev, "Set RX stats user control failed!\n");
++			return;
++		}
++
++		mt7996_tm_update_channel(phy);
++
++		if (td->tx_rate_mode >= MT76_TM_TX_MODE_HE_MU) {
++			if (td->aid)
++				ret = mt7996_tm_set(dev, SET_ID(RX_MU_AID), td->aid);
++			else
++				ret = mt7996_tm_set(dev, SET_ID(RX_MU_AID), RX_MU_DISABLE);
++		}
++		mt7996_tm_set(dev, SET_ID(TX_MODE), mt7996_tm_rate_to_phy(td->tx_rate_mode));
++		mt7996_tm_set(dev, SET_ID(GI), td->tx_rate_sgi);
++		mt7996_tm_set_antenna(phy, SET_ID(RX_PATH));
++		mt7996_tm_set(dev, SET_ID(MAX_PE), 2);
++
++		mt7996_tm_set_mac_addr(dev, td->addr[1], SET_ID(SA));
++
++		/* trigger firmware to start RX */
++		mt7996_tm_set(dev, SET_ID(COMMAND), RF_CMD(START_RX));
++	} else {
++		/* trigger firmware to stop RX */
++		mt7996_tm_set(dev, SET_ID(COMMAND), RF_CMD(STOP_TEST));
++	}
++}
++
++static void
++mt7996_tm_set_tx_cont(struct mt7996_phy *phy, bool en)
++{
++#define CONT_WAVE_MODE_OFDM	3
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7996_dev *dev = phy->dev;
++
++	if (en) {
++		mt7996_tm_update_channel(phy);
++		mt7996_tm_set(dev, SET_ID(TX_MODE), mt7996_tm_rate_to_phy(td->tx_rate_mode));
++		mt7996_tm_set(dev, SET_ID(TX_RATE), td->tx_rate_idx);
++		/* fix payload is OFDM */
++		mt7996_tm_set(dev, SET_ID(CONT_WAVE_MODE), CONT_WAVE_MODE_OFDM);
++		mt7996_tm_set(dev, SET_ID(ANT_MASK), td->tx_antenna_mask);
++
++		/* trigger firmware to start CONT TX */
++		mt7996_tm_set(dev, SET_ID(COMMAND), RF_CMD(CONT_WAVE));
++	} else {
++		/* trigger firmware to stop CONT TX  */
++		mt7996_tm_set(dev, SET_ID(COMMAND), RF_CMD(STOP_TEST));
++	}
++}
++
++static void
++mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
++{
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7996_dev *dev = phy->dev;
++	bool en = td->state != MT76_TM_STATE_OFF;
++
++	if (changed & BIT(TM_CHANGED_FREQ_OFFSET))
++		mt7996_tm_set(dev, SET_ID(FREQ_OFFSET), en ? td->freq_offset : 0);
++	if (changed & BIT(TM_CHANGED_TXPOWER))
++		mt7996_tm_set(dev, SET_ID(POWER), td->tx_power[0]);
++	if (changed & BIT(TM_CHANGED_TX_LENGTH)) {
++		mt7996_tm_set(dev, SET_ID(TX_LEN), td->tx_mpdu_len);
++		mt7996_tm_set(dev, SET_ID(TX_TIME), 0);
++	}
++	if (changed & BIT(TM_CHANGED_TX_TIME)) {
++		mt7996_tm_set(dev, SET_ID(TX_LEN), 0);
++		mt7996_tm_set(dev, SET_ID(TX_TIME), td->tx_time);
++	}
++}
++
++static int
++mt7996_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
++{
++	struct mt76_testmode_data *td = &mphy->test;
++	struct mt7996_phy *phy = mphy->priv;
++	enum mt76_testmode_state prev_state = td->state;
++
++	mphy->test.state = state;
++
++	if (prev_state != MT76_TM_STATE_OFF)
++		mt7996_tm_set(phy->dev, SET_ID(BAND_IDX), mphy->band_idx);
++
++	if (prev_state == MT76_TM_STATE_TX_FRAMES ||
++	    state == MT76_TM_STATE_TX_FRAMES)
++		mt7996_tm_set_tx_frames(phy, state == MT76_TM_STATE_TX_FRAMES);
++	else if (prev_state == MT76_TM_STATE_RX_FRAMES ||
++		 state == MT76_TM_STATE_RX_FRAMES)
++		mt7996_tm_set_rx_frames(phy, state == MT76_TM_STATE_RX_FRAMES);
++	else if (prev_state == MT76_TM_STATE_TX_CONT ||
++		 state == MT76_TM_STATE_TX_CONT)
++		mt7996_tm_set_tx_cont(phy, state == MT76_TM_STATE_TX_CONT);
++	else if (prev_state == MT76_TM_STATE_OFF ||
++		 state == MT76_TM_STATE_OFF)
++		mt7996_tm_init(phy, !(state == MT76_TM_STATE_OFF));
++
++	if ((state == MT76_TM_STATE_IDLE &&
++	     prev_state == MT76_TM_STATE_OFF) ||
++	    (state == MT76_TM_STATE_OFF &&
++	     prev_state == MT76_TM_STATE_IDLE)) {
++		u32 changed = 0;
++		int i;
++
++		for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
++			u16 cur = tm_change_map[i];
++
++			if (td->param_set[cur / 32] & BIT(cur % 32))
++				changed |= BIT(i);
++		}
++
++		mt7996_tm_update_params(phy, changed);
++	}
++
++	return 0;
++}
++
++static int
++mt7996_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
++		     enum mt76_testmode_state new_state)
++{
++	struct mt76_testmode_data *td = &mphy->test;
++	struct mt7996_phy *phy = mphy->priv;
++	struct mt7996_dev *dev = phy->dev;
++	u32 chainmask = mphy->chainmask, changed = 0;
++	u8 band_idx = phy->mt76->band_idx;
++	int i;
++
++	BUILD_BUG_ON(NUM_TM_CHANGED >= 32);
++
++	if (new_state == MT76_TM_STATE_OFF ||
++	    td->state == MT76_TM_STATE_OFF)
++		return 0;
++
++	chainmask = chainmask >> dev->chainshift[band_idx];
++	if (td->tx_antenna_mask > chainmask)
++		return -EINVAL;
++
++	for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
++		if (tb[tm_change_map[i]])
++			changed |= BIT(i);
++	}
++
++	mt7996_tm_set(dev, SET_ID(BAND_IDX), mphy->band_idx);
++	mt7996_tm_update_params(phy, changed);
++
++	return 0;
++}
++
++static int
++mt7996_tm_get_rx_stats(struct mt7996_phy *phy)
++{
++	struct mt7996_dev *dev = phy->dev;
++	struct mt7996_tm_rx_req req = {
++		.band = phy->mt76->band_idx,
++		.rx_stat_all = {
++			.tag = cpu_to_le16(UNI_TM_RX_STAT_GET_ALL_V2),
++			.len = cpu_to_le16(sizeof(req.rx_stat_all)),
++			.band_idx = phy->mt76->band_idx,
++		},
++	};
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7996_tm_rx_event *rx_stats;
++	struct mt7996_tm_rx_event_stat_all *rx_stats_all;
++	struct sk_buff *skb;
++	enum mt76_rxq_id qid;
++	int i, ret = 0;
++	u32 mac_rx_mdrdy_cnt;
++	u16 mac_rx_len_mismatch, fcs_err_count;
++
++	if (td->state != MT76_TM_STATE_RX_FRAMES)
++		return 0;
++
++	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WM_UNI_CMD_QUERY(TESTMODE_RX_STAT),
++					&req, sizeof(req), true, &skb);
++
++	if (ret)
++		return ret;
++
++	rx_stats = (struct mt7996_tm_rx_event *)skb->data;
++	rx_stats_all = &rx_stats->rx_stat_all;
++
++	phy->test.last_freq_offset = le32_to_cpu(rx_stats_all->user_info[0].freq_offset);
++	phy->test.last_snr = le32_to_cpu(rx_stats_all->user_info[0].snr);
++	for (i = 0; i < ARRAY_SIZE(phy->test.last_rcpi); i++) {
++		phy->test.last_rcpi[i] = le16_to_cpu(rx_stats_all->rxv_info[i].rcpi);
++		phy->test.last_ib_rssi[i] = rx_stats_all->fagc[i].ib_rssi;
++		phy->test.last_wb_rssi[i] = rx_stats_all->fagc[i].wb_rssi;
++	}
++
++	if (phy->mt76->band_idx == 2)
++		qid = MT_RXQ_BAND2;
++	else if (phy->mt76->band_idx == 1)
++		qid = MT_RXQ_BAND1;
++	else
++		qid = MT_RXQ_MAIN;
++
++	fcs_err_count = le16_to_cpu(rx_stats_all->band_info.mac_rx_fcs_err_cnt);
++	mac_rx_len_mismatch = le16_to_cpu(rx_stats_all->band_info.mac_rx_len_mismatch);
++	mac_rx_mdrdy_cnt = le32_to_cpu(rx_stats_all->band_info.mac_rx_mdrdy_cnt);
++	td->rx_stats.packets[qid] += mac_rx_mdrdy_cnt;
++	td->rx_stats.packets[qid] += fcs_err_count;
++	td->rx_stats.fcs_error[qid] += fcs_err_count;
++	td->rx_stats.len_mismatch += mac_rx_len_mismatch;
++
++	dev_kfree_skb(skb);
++
++	return ret;
++}
++
++static void
++mt7996_tm_reset_rx_stats(struct mt76_phy *mphy)
++{
++	struct mt7996_phy *phy = mphy->priv;
++	struct mt7996_dev *dev = phy->dev;
++
++	memset(&mphy->test.rx_stats, 0, sizeof(mphy->test.rx_stats));
++	mt7996_tm_set(dev, SET_ID(TRX_COUNTER_RESET), 0);
++}
++
++static int
++mt7996_tm_get_tx_stats(struct mt7996_phy *phy)
++{
++	struct mt7996_dev *dev = phy->dev;
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	int ret;
++
++	if (td->state != MT76_TM_STATE_TX_FRAMES)
++		return 0;
++
++	ret = mt7996_tm_get(dev, GET_ID(TXED_COUNT), 0, &td->tx_done);
++	if (ret)
++		return ret;
++
++	td->tx_pending = td->tx_count - td->tx_done;
++
++	return ret;
++}
++
++static int
++mt7996_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
++{
++	struct mt7996_phy *phy = mphy->priv;
++	void *rx, *rssi;
++	int i;
++
++	mt7996_tm_set(phy->dev, SET_ID(BAND_IDX), mphy->band_idx);
++	mt7996_tm_get_rx_stats(phy);
++	mt7996_tm_get_tx_stats(phy);
++
++	rx = nla_nest_start(msg, MT76_TM_STATS_ATTR_LAST_RX);
++	if (!rx)
++		return -ENOMEM;
++
++	if (nla_put_s32(msg, MT76_TM_RX_ATTR_FREQ_OFFSET, phy->test.last_freq_offset))
++		return -ENOMEM;
++
++	rssi = nla_nest_start(msg, MT76_TM_RX_ATTR_RCPI);
++	if (!rssi)
++		return -ENOMEM;
++
++	for (i = 0; i < ARRAY_SIZE(phy->test.last_rcpi); i++)
++		if (nla_put_u8(msg, i, phy->test.last_rcpi[i]))
++			return -ENOMEM;
++
++	nla_nest_end(msg, rssi);
++
++	rssi = nla_nest_start(msg, MT76_TM_RX_ATTR_IB_RSSI);
++	if (!rssi)
++		return -ENOMEM;
++
++	for (i = 0; i < ARRAY_SIZE(phy->test.last_ib_rssi); i++)
++		if (nla_put_s8(msg, i, phy->test.last_ib_rssi[i]))
++			return -ENOMEM;
++
++	nla_nest_end(msg, rssi);
++
++	rssi = nla_nest_start(msg, MT76_TM_RX_ATTR_WB_RSSI);
++	if (!rssi)
++		return -ENOMEM;
++
++	for (i = 0; i < ARRAY_SIZE(phy->test.last_wb_rssi); i++)
++		if (nla_put_s8(msg, i, phy->test.last_wb_rssi[i]))
++			return -ENOMEM;
++
++	nla_nest_end(msg, rssi);
++
++	if (nla_put_u8(msg, MT76_TM_RX_ATTR_SNR, phy->test.last_snr))
++		return -ENOMEM;
++
++	nla_nest_end(msg, rx);
++
++	return 0;
++}
++
++const struct mt76_testmode_ops mt7996_testmode_ops = {
++	.set_state = mt7996_tm_set_state,
++	.set_params = mt7996_tm_set_params,
++	.dump_stats = mt7996_tm_dump_stats,
++	.reset_rx_stats = mt7996_tm_reset_rx_stats,
++	.tx_stop = mt7996_tm_tx_stop,
++};
+diff --git a/mt7996/testmode.h b/mt7996/testmode.h
+new file mode 100644
+index 00000000..f381da56
+--- /dev/null
++++ b/mt7996/testmode.h
+@@ -0,0 +1,292 @@
++/* SPDX-License-Identifier: ISC */
++/* Copyright (C) 2020 MediaTek Inc. */
++
++#ifndef __MT7996_TESTMODE_H
++#define __MT7996_TESTMODE_H
++
++enum {
++	TM_CBW_20MHZ,
++	TM_CBW_40MHZ,
++	TM_CBW_80MHZ,
++	TM_CBW_10MHZ,
++	TM_CBW_5MHZ,
++	TM_CBW_160MHZ,
++	TM_CBW_8080MHZ,
++	TM_CBW_320MHZ = 12,
++};
++
++/* BW defined in FW hal_cal_flow_rom.h */
++enum {
++	FW_CDBW_20MHZ,
++	FW_CDBW_40MHZ,
++	FW_CDBW_80MHZ,
++	FW_CDBW_160MHZ,
++	FW_CDBW_320MHZ,
++	FW_CDBW_5MHZ,
++	FW_CDBW_10MHZ,
++	FW_CDBW_8080MHZ,
++};
++
++enum bw_mapping_method {
++	BW_MAP_NL_TO_FW,
++	BW_MAP_NL_TO_TM,
++
++	NUM_BW_MAP,
++};
++
++struct mt7996_tm_rf_test {
++	__le16 tag;
++	__le16 len;
++
++	u8 action;
++	u8 icap_len;
++	u8 _rsv[2];
++	union {
++		__le32 op_mode;
++		__le32 freq;
++
++		struct {
++			__le32 func_idx;
++			union {
++				__le32 func_data;
++				__le32 cal_dump;
++
++				u8 _pad[80];
++			} param;
++		} rf;
++	} op;
++} __packed;
++
++struct mt7996_tm_req {
++	u8 _rsv[4];
++
++	struct mt7996_tm_rf_test rf_test;
++} __packed;
++
++struct mt7996_tm_rf_test_result {
++	__le32 func_idx;
++	__le32 payload_length;
++	u8 event[0];
++};
++
++struct mt7996_tm_event {
++	u8 _rsv[4];
++
++	__le16 tag;
++	__le16 len;
++	struct mt7996_tm_rf_test_result result;
++} __packed;
++
++enum {
++	RF_ACTION_SWITCH_TO_RF_TEST,
++	RF_ACTION_IN_RF_TEST,
++	RF_ACTION_SET = 3,
++	RF_ACTION_GET,
++};
++
++enum {
++	RF_OPER_NORMAL,
++	RF_OPER_RF_TEST,
++	RF_OPER_ICAP,
++	RF_OPER_ICAP_OVERLAP,
++	RF_OPER_WIFI_SPECTRUM,
++};
++
++enum {
++	UNI_RF_TEST_CTRL,
++};
++
++#define RF_CMD(cmd)		RF_TEST_CMD_##cmd
++
++enum {
++	RF_TEST_CMD_STOP_TEST = 0,
++	RF_TEST_CMD_START_TX = 1,
++	RF_TEST_CMD_START_RX = 2,
++	RF_TEST_CMD_CONT_WAVE = 10,
++	RF_TEST_CMD_TX_COMMIT = 18,
++	RF_TEST_CMD_RX_COMMIT = 19,
++};
++
++#define SET_ID(id)		RF_TEST_ID_SET_##id
++#define GET_ID(id)		RF_TEST_ID_GET_##id
++
++enum {
++	RF_TEST_ID_SET_COMMAND = 1,
++	RF_TEST_ID_SET_POWER = 2,
++	RF_TEST_ID_SET_TX_RATE = 3,
++	RF_TEST_ID_SET_TX_MODE = 4,
++	RF_TEST_ID_SET_TX_LEN = 6,
++	RF_TEST_ID_SET_TX_COUNT = 7,
++	RF_TEST_ID_SET_IPG = 8,
++	RF_TEST_ID_SET_GI = 16,
++	RF_TEST_ID_SET_STBC = 17,
++	RF_TEST_ID_SET_CHAN_FREQ = 18,
++	RF_TEST_ID_GET_TXED_COUNT = 32,
++	RF_TEST_ID_SET_CONT_WAVE_MODE = 65,
++	RF_TEST_ID_SET_DA = 68,
++	RF_TEST_ID_SET_SA = 69,
++	RF_TEST_ID_SET_CBW = 71,
++	RF_TEST_ID_SET_DBW = 72,
++	RF_TEST_ID_SET_PRIMARY_CH = 73,
++	RF_TEST_ID_SET_ENCODE_MODE = 74,
++	RF_TEST_ID_SET_BAND = 90,
++	RF_TEST_ID_SET_TRX_COUNTER_RESET = 91,
++	RF_TEST_ID_SET_MAC_HEADER = 101,
++	RF_TEST_ID_SET_SEQ_CTRL = 102,
++	RF_TEST_ID_SET_BAND_IDX = 104,
++	RF_TEST_ID_SET_RX_PATH = 106,
++	RF_TEST_ID_SET_FREQ_OFFSET = 107,
++	RF_TEST_ID_GET_FREQ_OFFSET = 108,
++	RF_TEST_ID_SET_TX_PATH = 113,
++	RF_TEST_ID_SET_NSS = 114,
++	RF_TEST_ID_SET_ANT_MASK = 115,
++	RF_TEST_ID_SET_IBF_ENABLE = 126,
++	RF_TEST_ID_SET_EBF_ENABLE = 127,
++	RF_TEST_ID_GET_TX_POWER = 136,
++	RF_TEST_ID_SET_RX_MU_AID = 157,
++	RF_TEST_ID_SET_HW_TX_MODE = 167,
++	RF_TEST_ID_SET_PUNCTURE = 168,
++	RF_TEST_ID_SET_BSSID = 189,
++	RF_TEST_ID_SET_TX_TIME = 190,
++	RF_TEST_ID_SET_MAX_PE = 191,
++	RF_TEST_ID_SET_AID_OFFSET = 204,
++};
++
++struct mt7996_tm_rx_stat_user_ctrl {
++	__le16 tag;
++	__le16 len;
++
++	u8 band_idx;
++	u8 rsv;
++	__le16 user_idx;
++} __packed;
++
++struct mt7996_tm_rx_stat_all {
++	__le16 tag;
++	__le16 len;
++
++	u8 band_idx;
++	u8 rsv[3];
++} __packed;
++
++struct mt7996_tm_rx_req {
++	u8 band;
++	u8 _rsv[3];
++
++	union {
++		struct mt7996_tm_rx_stat_user_ctrl user_ctrl;
++		struct mt7996_tm_rx_stat_all rx_stat_all;
++	};
++} __packed;
++
++enum {
++	UNI_TM_RX_STAT_SET_USER_CTRL = 7,
++	UNI_TM_RX_STAT_GET_ALL_V2 = 9,
++};
++
++struct rx_band_info {
++	/* mac part */
++	__le16 mac_rx_fcs_err_cnt;
++	__le16 mac_rx_len_mismatch;
++	__le16 mac_rx_fcs_ok_cnt;
++	u8 rsv1[2];
++	__le32 mac_rx_mdrdy_cnt;
++
++	/* phy part */
++	__le16 phy_rx_fcs_err_cnt_cck;
++	__le16 phy_rx_fcs_err_cnt_ofdm;
++	__le16 phy_rx_pd_cck;
++	__le16 phy_rx_pd_ofdm;
++	__le16 phy_rx_sig_err_cck;
++	__le16 phy_rx_sfd_err_cck;
++	__le16 phy_rx_sig_err_ofdm;
++	__le16 phy_rx_tag_err_ofdm;
++	__le16 phy_rx_mdrdy_cnt_cck;
++	__le16 phy_rx_mdrdy_cnt_ofdm;
++} __packed;
++
++struct rx_band_info_ext {
++	/* mac part */
++	__le32 mac_rx_mpdu_cnt;
++
++	/* phy part */
++	u8 rsv[4];
++} __packed;
++
++struct rx_common_info {
++	__le16 rx_fifo_full;
++	u8 rsv[2];
++	__le32 aci_hit_low;
++	__le32 aci_hit_high;
++} __packed;
++
++struct rx_common_info_ext {
++	__le32 driver_rx_count;
++	__le32 sinr;
++	__le32 mu_pkt_count;
++
++	/* mac part */
++	u8 _rsv[4];
++
++	/* phy part */
++	u8 sig_mcs;
++	u8 rsv[3];
++} __packed;
++
++struct rx_rxv_info {
++	__le16 rcpi;
++	s16 rssi;
++	s16 snr;
++	s16 adc_rssi;
++} __packed;
++
++struct rx_rssi_info {
++	s8 ib_rssi;
++	s8 wb_rssi;
++	u8 rsv[2];
++} __packed;
++
++struct rx_user_info {
++	s32 freq_offset;
++	s32 snr;
++	__le32 fcs_err_count;
++} __packed;
++
++struct rx_user_info_ext {
++	s8 ne_var_db_all_user;
++	u8 rsv[3];
++} __packed;
++
++#define MAX_ANTENNA_NUM		8
++#define MAX_USER_NUM		16
++
++struct mt7996_tm_rx_event_stat_all {
++	__le16 tag;
++	__le16 len;
++
++	struct rx_band_info band_info;
++	struct rx_band_info_ext band_info_ext;
++	struct rx_common_info common_info;
++	struct rx_common_info_ext common_info_ext;
++
++	/* RXV info */
++	struct rx_rxv_info rxv_info[MAX_ANTENNA_NUM];
++
++	/* RSSI info */
++	struct rx_rssi_info fagc[MAX_ANTENNA_NUM];
++	struct rx_rssi_info inst[MAX_ANTENNA_NUM];
++
++	/* User info */
++	struct rx_user_info user_info[MAX_USER_NUM];
++	struct rx_user_info_ext user_info_ext[MAX_USER_NUM];
++} __packed;
++
++struct mt7996_tm_rx_event {
++	u8 _rsv[4];
++
++	union {
++		struct mt7996_tm_rx_event_stat_all rx_stat_all;
++	};
++} __packed;
++
++#endif
+diff --git a/testmode.c b/testmode.c
+index 0d2bae9f..007358bd 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -2,6 +2,7 @@
+ /* Copyright (C) 2020 Felix Fietkau <nbd@nbd.name> */
+ 
+ #include <linux/random.h>
++#include "mt76_connac.h"
+ #include "mt76.h"
+ 
+ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
+@@ -81,6 +82,11 @@ mt76_testmode_max_mpdu_len(struct mt76_phy *phy, u8 tx_rate_mode)
+ 		    IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991)
+ 			return IEEE80211_MAX_MPDU_LEN_VHT_7991;
+ 		return IEEE80211_MAX_MPDU_LEN_VHT_11454;
++	case MT76_TM_TX_MODE_EHT_SU:
++	case MT76_TM_TX_MODE_EHT_TRIG:
++	case MT76_TM_TX_MODE_EHT_MU:
++		/* TODO: check the limit */
++		return UINT_MAX;
+ 	case MT76_TM_TX_MODE_CCK:
+ 	case MT76_TM_TX_MODE_OFDM:
+ 	default:
+@@ -182,6 +188,9 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
+ 	u8 max_nss = hweight8(phy->antenna_mask);
+ 	int ret;
+ 
++	if (is_mt7996(phy->dev))
++		return 0;
++
+ 	ret = mt76_testmode_alloc_skb(phy, td->tx_mpdu_len);
+ 	if (ret)
+ 		return ret;
+@@ -274,7 +283,9 @@ mt76_testmode_tx_start(struct mt76_phy *phy)
+ 	td->tx_queued = 0;
+ 	td->tx_done = 0;
+ 	td->tx_pending = td->tx_count;
+-	mt76_worker_schedule(&dev->tx_worker);
++
++	if (!is_mt7996(dev))
++		mt76_worker_schedule(&dev->tx_worker);
+ }
+ 
+ static void
+@@ -283,6 +294,11 @@ mt76_testmode_tx_stop(struct mt76_phy *phy)
+ 	struct mt76_testmode_data *td = &phy->test;
+ 	struct mt76_dev *dev = phy->dev;
+ 
++	if (is_mt7996(dev) && dev->test_ops->tx_stop) {
++		dev->test_ops->tx_stop(phy);
++		return;
++	}
++
+ 	mt76_worker_disable(&dev->tx_worker);
+ 
+ 	td->tx_pending = 0;
+@@ -311,6 +327,7 @@ static void
+ mt76_testmode_init_defaults(struct mt76_phy *phy)
+ {
+ 	struct mt76_testmode_data *td = &phy->test;
++	u8 addr[ETH_ALEN] = {phy->band_idx, 0x11, 0x22, 0xaa, 0xbb, 0xcc};
+ 
+ 	if (td->tx_mpdu_len > 0)
+ 		return;
+@@ -318,11 +335,18 @@ mt76_testmode_init_defaults(struct mt76_phy *phy)
+ 	td->tx_mpdu_len = 1024;
+ 	td->tx_count = 1;
+ 	td->tx_rate_mode = MT76_TM_TX_MODE_OFDM;
++	td->tx_rate_idx = 7;
+ 	td->tx_rate_nss = 1;
++	/* 0xffff for OFDMA no puncture */
++	td->tx_preamble_puncture = ~(td->tx_preamble_puncture & 0);
++	td->tx_ipg = 50;
+ 
+-	memcpy(td->addr[0], phy->macaddr, ETH_ALEN);
+-	memcpy(td->addr[1], phy->macaddr, ETH_ALEN);
+-	memcpy(td->addr[2], phy->macaddr, ETH_ALEN);
++	/* rx stat user config */
++	td->aid = 1;
++
++	memcpy(td->addr[0], addr, ETH_ALEN);
++	memcpy(td->addr[1], addr, ETH_ALEN);
++	memcpy(td->addr[2], addr, ETH_ALEN);
+ }
+ 
+ static int
+@@ -352,7 +376,7 @@ __mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state)
+ 	if (state == MT76_TM_STATE_TX_FRAMES)
+ 		mt76_testmode_tx_start(phy);
+ 	else if (state == MT76_TM_STATE_RX_FRAMES) {
+-		memset(&phy->test.rx_stats, 0, sizeof(phy->test.rx_stats));
++		dev->test_ops->reset_rx_stats(phy);
+ 	}
+ 
+ 	phy->test.state = state;
+@@ -453,7 +477,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
+ 			   &td->tx_duty_cycle, 0, 99) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_POWER_CONTROL],
+-			   &td->tx_power_control, 0, 1))
++			   &td->tx_power_control, 0, 1) ||
++	    mt76_tm_get_u8(tb[MT76_TM_ATTR_AID], &td->aid, 0, 16))
+ 		goto out;
+ 
+ 	if (tb[MT76_TM_ATTR_TX_LENGTH]) {
+@@ -493,7 +518,9 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			    idx >= ARRAY_SIZE(td->tx_power))
+ 				goto out;
+ 
+-			td->tx_power[idx++] = nla_get_u8(cur);
++			err = mt76_tm_get_u8(cur, &td->tx_power[idx++], 0, 63);
++			if (err)
++				return err;
+ 		}
+ 	}
+ 
+@@ -560,6 +587,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
+ 	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_PACKETS, rx_packets,
+ 			      MT76_TM_STATS_ATTR_PAD) ||
+ 	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_FCS_ERROR, rx_fcs_error,
++			      MT76_TM_STATS_ATTR_PAD) ||
++	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_LEN_MISMATCH,
++			      td->rx_stats.len_mismatch,
+ 			      MT76_TM_STATS_ATTR_PAD))
+ 		return -EMSGSIZE;
+ 
+@@ -624,6 +654,7 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_SGI, td->tx_rate_sgi) ||
+ 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_LDPC, td->tx_rate_ldpc) ||
+ 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_STBC, td->tx_rate_stbc) ||
++	    nla_put_u8(msg, MT76_TM_ATTR_AID, td->aid) ||
+ 	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_LTF) &&
+ 	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
+ 	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_ANTENNA) &&
+diff --git a/testmode.h b/testmode.h
+index a40cd74b..8d0b9702 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -39,6 +39,11 @@
+  *
+  * @MT76_TM_ATTR_STATS: statistics (nested, see &enum mt76_testmode_stats_attr)
+  *
++ * @MT76_TM_ATTR_PRECAL: Pre-cal data (u8)
++ * @MT76_TM_ATTR_PRECAL_INFO: group size, dpd size, dpd_info, transmit size,
++ *                            eeprom cal indicator (u32),
++ *                            dpd_info = [dpd_per_chan_size, chan_num_2g,
++ *                                        chan_num_5g, chan_num_6g]
+  * @MT76_TM_ATTR_TX_SPE_IDX: tx spatial extension index (u8)
+  *
+  * @MT76_TM_ATTR_TX_DUTY_CYCLE: packet tx duty cycle (u8)
+@@ -48,6 +53,29 @@
+  * @MT76_TM_ATTR_DRV_DATA: driver specific netlink attrs (nested)
+  *
+  * @MT76_TM_ATTR_MAC_ADDRS: array of nested MAC addresses (nested)
++ *
++ * @MT76_TM_ATTR_EEPROM_ACTION: eeprom setting actions
++ *	(u8, see &enum mt76_testmode_eeprom_action)
++ * @MT76_TM_ATTR_EEPROM_OFFSET: offset of eeprom data block for writing (u32)
++ * @MT76_TM_ATTR_EEPROM_VAL: values for writing into a 16-byte data block
++ *	(nested, u8 attrs)
++ *
++ * @MT76_TM_ATTR_CFG: config testmode rf feature (nested, see &mt76_testmode_cfg)
++ * @MT76_TM_ATTR_TXBF_ACT: txbf setting actions (u8)
++ * @MT76_TM_ATTR_TXBF_PARAM: txbf parameters (nested)
++ *
++ * @MT76_TM_ATTR_OFF_CH_SCAN_CH: config the channel of background chain (ZWDFS) (u8)
++ * @MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH: config the center channel of background chain (ZWDFS) (u8)
++ * @MT76_TM_ATTR_OFF_CH_SCAN_BW: config the bandwidth of background chain (ZWDFS) (u8)
++ * @MT76_TM_ATTR_OFF_CH_SCAN_PATH: config the tx path of background chain (ZWDFS) (u8)
++ *
++ * @MT76_TM_ATTR_IPI_THRESHOLD: config the IPI index you want to read (u8)
++ * @MT76_TM_ATTR_IPI_PERIOD: config the time period for reading
++ *			     the histogram of specific IPI index (u8)
++ * @MT76_TM_ATTR_IPI_ANTENNA_INDEX: config the antenna index for reading
++ *				    the histogram of specific IPI index (u8)
++ * @MT76_TM_ATTR_IPI_RESET: Reset the IPI counter
++ *
+  */
+ enum mt76_testmode_attr {
+ 	MT76_TM_ATTR_UNSPEC,
+@@ -76,6 +104,8 @@ enum mt76_testmode_attr {
+ 	MT76_TM_ATTR_FREQ_OFFSET,
+ 
+ 	MT76_TM_ATTR_STATS,
++	MT76_TM_ATTR_PRECAL,
++	MT76_TM_ATTR_PRECAL_INFO,
+ 
+ 	MT76_TM_ATTR_TX_SPE_IDX,
+ 
+@@ -86,6 +116,27 @@ enum mt76_testmode_attr {
+ 	MT76_TM_ATTR_DRV_DATA,
+ 
+ 	MT76_TM_ATTR_MAC_ADDRS,
++	MT76_TM_ATTR_AID,
++	MT76_TM_ATTR_RU_ALLOC,
++	MT76_TM_ATTR_RU_IDX,
++
++	MT76_TM_ATTR_EEPROM_ACTION,
++	MT76_TM_ATTR_EEPROM_OFFSET,
++	MT76_TM_ATTR_EEPROM_VAL,
++
++	MT76_TM_ATTR_CFG,
++	MT76_TM_ATTR_TXBF_ACT,
++	MT76_TM_ATTR_TXBF_PARAM,
++
++	MT76_TM_ATTR_OFF_CH_SCAN_CH,
++	MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH,
++	MT76_TM_ATTR_OFF_CH_SCAN_BW,
++	MT76_TM_ATTR_OFF_CH_SCAN_PATH,
++
++	MT76_TM_ATTR_IPI_THRESHOLD,
++	MT76_TM_ATTR_IPI_PERIOD,
++	MT76_TM_ATTR_IPI_ANTENNA_INDEX,
++	MT76_TM_ATTR_IPI_RESET,
+ 
+ 	/* keep last */
+ 	NUM_MT76_TM_ATTRS,
+@@ -103,6 +154,8 @@ enum mt76_testmode_attr {
+  * @MT76_TM_STATS_ATTR_RX_FCS_ERROR: number of rx packets with FCS error (u64)
+  * @MT76_TM_STATS_ATTR_LAST_RX: information about the last received packet
+  *	see &enum mt76_testmode_rx_attr
++ * @MT76_TM_STATS_ATTR_RX_LEN_MISMATCH: number of rx packets with length
++ *	mismatch error (u64)
+  */
+ enum mt76_testmode_stats_attr {
+ 	MT76_TM_STATS_ATTR_UNSPEC,
+@@ -115,6 +168,7 @@ enum mt76_testmode_stats_attr {
+ 	MT76_TM_STATS_ATTR_RX_PACKETS,
+ 	MT76_TM_STATS_ATTR_RX_FCS_ERROR,
+ 	MT76_TM_STATS_ATTR_LAST_RX,
++	MT76_TM_STATS_ATTR_RX_LEN_MISMATCH,
+ 
+ 	/* keep last */
+ 	NUM_MT76_TM_STATS_ATTRS,
+@@ -179,6 +233,9 @@ enum mt76_testmode_state {
+  * @MT76_TM_TX_MODE_HE_EXT_SU: 802.11ax extended-range SU
+  * @MT76_TM_TX_MODE_HE_TB: 802.11ax trigger-based
+  * @MT76_TM_TX_MODE_HE_MU: 802.11ax multi-user MIMO
++ * @MT76_TM_TX_MODE_EHT_SU: 802.11be single-user MIMO
++ * @MT76_TM_TX_MODE_EHT_TRIG: 802.11be trigger-based
++ * @MT76_TM_TX_MODE_EHT_MU: 802.11be multi-user MIMO
+  */
+ enum mt76_testmode_tx_mode {
+ 	MT76_TM_TX_MODE_CCK,
+@@ -189,6 +246,9 @@ enum mt76_testmode_tx_mode {
+ 	MT76_TM_TX_MODE_HE_EXT_SU,
+ 	MT76_TM_TX_MODE_HE_TB,
+ 	MT76_TM_TX_MODE_HE_MU,
++	MT76_TM_TX_MODE_EHT_SU,
++	MT76_TM_TX_MODE_EHT_TRIG,
++	MT76_TM_TX_MODE_EHT_MU,
+ 
+ 	/* keep last */
+ 	NUM_MT76_TM_TX_MODES,
+diff --git a/tools/fields.c b/tools/fields.c
+index e3f69089..e5cf7c53 100644
+--- a/tools/fields.c
++++ b/tools/fields.c
+@@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
+ 	[MT76_TM_STATE_IDLE] = "idle",
+ 	[MT76_TM_STATE_TX_FRAMES] = "tx_frames",
+ 	[MT76_TM_STATE_RX_FRAMES] = "rx_frames",
++	[MT76_TM_STATE_TX_CONT] = "tx_cont",
+ };
+ 
+ static const char * const testmode_tx_mode[] = {
+@@ -21,6 +22,9 @@ static const char * const testmode_tx_mode[] = {
+ 	[MT76_TM_TX_MODE_HE_EXT_SU] = "he_ext_su",
+ 	[MT76_TM_TX_MODE_HE_TB] = "he_tb",
+ 	[MT76_TM_TX_MODE_HE_MU] = "he_mu",
++	[MT76_TM_TX_MODE_EHT_SU] = "eht_su",
++	[MT76_TM_TX_MODE_EHT_TRIG] = "eht_tb",
++	[MT76_TM_TX_MODE_EHT_MU] = "eht_mu",
+ };
+ 
+ static void print_enum(const struct tm_field *field, struct nlattr *attr)
+@@ -201,6 +205,62 @@ static void print_extra_stats(const struct tm_field *field, struct nlattr **tb)
+ 	printf("%srx_per=%.02f%%\n", prefix, 100 * failed / total);
+ }
+ 
++static bool parse_mac(const struct tm_field *field, int idx,
++		      struct nl_msg *msg, const char *val)
++{
++#define ETH_ALEN	6
++	bool ret = true;
++	char *str, *cur, *ap;
++	void *a;
++
++	str = strdup(val);
++	ap = str;
++
++	a = nla_nest_start(msg, idx);
++
++	idx = 0;
++	while ((cur = strsep(&ap, ",")) != NULL) {
++		unsigned char addr[ETH_ALEN];
++		char *val, *tmp = cur;
++		int i = 0;
++
++		while ((val = strsep(&tmp, ":")) != NULL) {
++			if (i >= ETH_ALEN)
++				break;
++
++			addr[i++] = strtoul(val, NULL, 16);
++		}
++
++		nla_put(msg, idx, ETH_ALEN, addr);
++
++		idx++;
++	}
++
++	nla_nest_end(msg, a);
++
++	free(str);
++
++	return ret;
++}
++
++static void print_mac(const struct tm_field *field, struct nlattr *attr)
++{
++#define MAC2STR(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5]
++#define MACSTR "%02x:%02x:%02x:%02x:%02x:%02x"
++	unsigned char addr[3][6];
++	struct nlattr *cur;
++	int idx = 0;
++	int rem;
++
++	nla_for_each_nested(cur, attr, rem) {
++		if (nla_len(cur) != 6)
++			continue;
++		memcpy(addr[idx++], nla_data(cur), 6);
++	}
++
++	printf("" MACSTR "," MACSTR "," MACSTR "",
++	       MAC2STR(addr[0]), MAC2STR(addr[1]), MAC2STR(addr[2]));
++}
+ 
+ #define FIELD_GENERIC(_field, _name, ...)	\
+ 	[FIELD_NAME(_field)] = {			\
+@@ -250,6 +310,13 @@ static void print_extra_stats(const struct tm_field *field, struct nlattr **tb)
+ 		 ##__VA_ARGS__				\
+ 	)
+ 
++#define FIELD_MAC(_field, _name)			\
++	[FIELD_NAME(_field)] = {			\
++		.name = _name,				\
++		.parse = parse_mac,			\
++		.print = print_mac			\
++	}
++
+ #define FIELD_NAME(_field) MT76_TM_RX_ATTR_##_field
+ static const struct tm_field rx_fields[NUM_MT76_TM_RX_ATTRS] = {
+ 	FIELD_RO(s32, FREQ_OFFSET, "freq_offset"),
+@@ -274,6 +341,7 @@ static const struct tm_field stats_fields[NUM_MT76_TM_STATS_ATTRS] = {
+ 	FIELD_RO(u32, TX_DONE, "tx_done"),
+ 	FIELD_RO(u64, RX_PACKETS, "rx_packets"),
+ 	FIELD_RO(u64, RX_FCS_ERROR, "rx_fcs_error"),
++	FIELD_RO(u64, RX_LEN_MISMATCH, "rx_len_mismatch"),
+ 	FIELD_NESTED_RO(LAST_RX, rx, "last_"),
+ };
+ static struct nla_policy stats_policy[NUM_MT76_TM_STATS_ATTRS] = {
+@@ -282,6 +350,7 @@ static struct nla_policy stats_policy[NUM_MT76_TM_STATS_ATTRS] = {
+ 	[MT76_TM_STATS_ATTR_TX_DONE] = { .type = NLA_U32 },
+ 	[MT76_TM_STATS_ATTR_RX_PACKETS] = { .type = NLA_U64 },
+ 	[MT76_TM_STATS_ATTR_RX_FCS_ERROR] = { .type = NLA_U64 },
++	[MT76_TM_STATS_ATTR_RX_LEN_MISMATCH] = { .type = NLA_U64 },
+ };
+ #undef FIELD_NAME
+ 
+@@ -300,12 +369,20 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
+ 	FIELD(u8, TX_RATE_LDPC, "tx_rate_ldpc"),
+ 	FIELD(u8, TX_RATE_STBC, "tx_rate_stbc"),
+ 	FIELD(u8, TX_LTF, "tx_ltf"),
++	FIELD(u8, TX_DUTY_CYCLE, "tx_duty_cycle"),
++	FIELD(u32, TX_IPG, "tx_ipg"),
++	FIELD(u32, TX_TIME, "tx_time"),
+ 	FIELD(u8, TX_POWER_CONTROL, "tx_power_control"),
+ 	FIELD_ARRAY(u8, TX_POWER, "tx_power"),
+ 	FIELD(u8, TX_ANTENNA, "tx_antenna"),
+ 	FIELD(u32, FREQ_OFFSET, "freq_offset"),
++	FIELD(u8, AID, "aid"),
++	FIELD(u8, RU_ALLOC, "ru_alloc"),
++	FIELD(u8, RU_IDX, "ru_idx"),
++	FIELD_MAC(MAC_ADDRS, "mac_addrs"),
+ 	FIELD_NESTED_RO(STATS, stats, "",
+ 			.print_extra = print_extra_stats),
++
+ };
+ #undef FIELD_NAME
+ 
+@@ -322,10 +399,25 @@ static struct nla_policy testdata_policy[NUM_MT76_TM_ATTRS] = {
+ 	[MT76_TM_ATTR_TX_RATE_LDPC] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_TX_RATE_STBC] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_TX_LTF] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_TX_DUTY_CYCLE] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_TX_IPG] = { .type = NLA_U32 },
++	[MT76_TM_ATTR_TX_TIME] = { .type = NLA_U32 },
+ 	[MT76_TM_ATTR_TX_POWER_CONTROL] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_TX_ANTENNA] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_TX_SPE_IDX] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_FREQ_OFFSET] = { .type = NLA_U32 },
++	[MT76_TM_ATTR_AID] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_RU_ALLOC] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_RU_IDX] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_STATS] = { .type = NLA_NESTED },
++	[MT76_TM_ATTR_TXBF_ACT] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_OFF_CH_SCAN_CH] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_OFF_CH_SCAN_BW] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_IPI_THRESHOLD] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_IPI_PERIOD] = { .type = NLA_U32 },
++	[MT76_TM_ATTR_IPI_ANTENNA_INDEX] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_IPI_RESET] = { .type = NLA_U8 },
+ };
+ 
+ const struct tm_field msg_field = {
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0028-mt76-testmode-add-chainmask-hacking-for-eagle-band-2.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0028-mt76-testmode-add-chainmask-hacking-for-eagle-band-2.patch
new file mode 100644
index 0000000..955da4f
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0028-mt76-testmode-add-chainmask-hacking-for-eagle-band-2.patch
@@ -0,0 +1,26 @@
+From ce6a6a9f16be09f992a937ddc7b8606158f1bd4b Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 9 Mar 2023 18:45:04 +0800
+Subject: [PATCH 28/29] mt76: testmode: add chainmask hacking for eagle band 2
+ 4T5R
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7996/testmode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/mt7996/testmode.c b/mt7996/testmode.c
+index 5dbbb788..17212516 100644
+--- a/mt7996/testmode.c
++++ b/mt7996/testmode.c
+@@ -446,6 +446,7 @@ mt7996_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
+ 		return 0;
+ 
+ 	chainmask = chainmask >> dev->chainshift[band_idx];
++	chainmask = 0x1f;	/* hacking for eagle band2 4T5R */
+ 	if (td->tx_antenna_mask > chainmask)
+ 		return -EINVAL;
+ 
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0019-mt76-revert-page-pool-changes.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0029-mt76-revert-page-pool-changes.patch
similarity index 98%
rename from recipes-wifi/linux-mt76/files/patches-3.x/0019-mt76-revert-page-pool-changes.patch
rename to recipes-wifi/linux-mt76/files/patches-3.x/0029-mt76-revert-page-pool-changes.patch
index 20feead..b2c9629 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0019-mt76-revert-page-pool-changes.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0029-mt76-revert-page-pool-changes.patch
@@ -1,7 +1,7 @@
-From 175bf122ac5790e7e28dadecd9410370364bc16a Mon Sep 17 00:00:00 2001
+From be2fad591cace6a3ba5a2043e085fc143cff0a0e Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Feb 2023 15:34:43 +0800
-Subject: [PATCH 19/19] mt76: revert page pool changes
+Subject: [PATCH 29/29] mt76: revert page pool changes
 
 ---
  dma.c         | 72 ++++++++++++++++++++++++++-------------------------
@@ -214,7 +214,7 @@
  
  	mt76_free_pending_txwi(dev);
 diff --git a/mac80211.c b/mac80211.c
-index e53166fc..d69e7214 100644
+index a4b3d346..40fda9d0 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -4,7 +4,6 @@
@@ -273,7 +273,7 @@
  struct mt76_dev *
  mt76_alloc_device(struct device *pdev, unsigned int size,
  		  const struct ieee80211_ops *ops,
-@@ -1746,21 +1704,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
+@@ -1747,21 +1705,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  }
  EXPORT_SYMBOL_GPL(mt76_ethtool_worker);
  
@@ -296,7 +296,7 @@
  {
  	struct ieee80211_hw *hw = phy->hw;
 diff --git a/mt76.h b/mt76.h
-index c3d1313e..49da2caa 100644
+index 343bd910..3d96b33e 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -202,7 +202,7 @@ struct mt76_queue {
@@ -308,7 +308,7 @@
  };
  
  struct mt76_mcu_ops {
-@@ -1329,7 +1329,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
+@@ -1340,7 +1340,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
  	return usb_bulk_msg(udev, pipe, data, len, actual_len, timeout);
  }
  
@@ -316,7 +316,7 @@
  void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  			 struct mt76_sta_stats *stats, bool eht);
  int mt76_skb_adjust_pad(struct sk_buff *skb, int pad);
-@@ -1441,25 +1440,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
+@@ -1452,25 +1451,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
  struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
  			  struct mt76_txwi_cache *r, dma_addr_t phys);
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0999-mt76-mt7996-for-build-pass.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0999-mt76-mt7996-for-build-pass.patch
index 2f9a0c3..fea9eee 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0999-mt76-mt7996-for-build-pass.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0999-mt76-mt7996-for-build-pass.patch
@@ -1,20 +1,21 @@
-From a126ad08af718c71b4b05261caefb68996044330 Mon Sep 17 00:00:00 2001
+From 5b6ee04d5043e2cbf4a7c0a0129e1dfbd7f33f2b Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 3 Nov 2022 00:27:17 +0800
-Subject: [PATCH] mt76: mt7996: for build pass
+Subject: [PATCH 0999/1001] mt76: mt7996: for build pass
 
 Change-Id: Ieb44c33ee6e6a2e6058c1ef528404c1a1cbcfdaf
 ---
  debugfs.c         | 3 +++
+ dma.c             | 2 +-
  eeprom.c          | 8 +++++++-
  mcu.c             | 1 +
  mt7615/mcu.c      | 1 +
  mt76_connac_mcu.c | 1 +
  mt7915/mcu.c      | 1 +
  mt7996/dma.c      | 4 ++--
- mt7996/eeprom.c   | 2 ++
+ mt7996/eeprom.c   | 1 +
  mt7996/mcu.c      | 1 +
- 9 files changed, 19 insertions(+), 3 deletions(-)
+ 10 files changed, 19 insertions(+), 4 deletions(-)
 
 diff --git a/debugfs.c b/debugfs.c
 index 79064a4d..e10d4cbc 100644
@@ -32,11 +33,24 @@
  
  	return 0;
  }
+diff --git a/dma.c b/dma.c
+index 7357b398..2fc70e23 100644
+--- a/dma.c
++++ b/dma.c
+@@ -856,7 +856,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+ 		    !(dev->drv->rx_check(dev, data, len)))
+ 			goto free_frag;
+ 
+-		skb = napi_build_skb(data, q->buf_size);
++		skb = build_skb(data, q->buf_size);
+ 		if (!skb)
+ 			goto free_frag;
+ 
 diff --git a/eeprom.c b/eeprom.c
-index ea54b7af..90d36c8d 100644
+index 263e5089..aa889258 100644
 --- a/eeprom.c
 +++ b/eeprom.c
-@@ -106,9 +106,15 @@ void
+@@ -108,9 +108,15 @@ void
  mt76_eeprom_override(struct mt76_phy *phy)
  {
  	struct mt76_dev *dev = phy->dev;
@@ -117,20 +131,19 @@
  
  	mt7996_dma_enable(dev);
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 2e48c5a4..e747cb9f 100644
+index 64e3c4e2..7bff504a 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -98,6 +98,8 @@ static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_dev *dev)
+@@ -121,6 +121,7 @@ static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
-+	/* for internal testing */
-+	cap = 0x4b249248;
++	cap = 0x4b249248;	/* internal hardcode */
  	if (cap) {
  		dev->has_eht = !(cap & MODE_HE_ONLY);
  		dev->wtbl_size_group = u32_get_bits(cap, WTBL_SIZE_GROUP);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 829f7be6..0d9d309f 100644
+index 0a52afd1..cc948395 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -5,6 +5,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1000-mt76-mt7996-add-debug-tool.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1000-mt76-mt7996-add-debug-tool.patch
new file mode 100644
index 0000000..2adf0f2
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1000-mt76-mt7996-add-debug-tool.patch
@@ -0,0 +1,4824 @@
+From 6187d3505e8023d0fec2fb5e0abb56e3d1376755 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Fri, 24 Mar 2023 14:02:32 +0800
+Subject: [PATCH 1000/1001] mt76: mt7996: add debug tool
+
+Change-Id: Ie10390b01f17db893dbfbf3221bf63a4bd1fe38f
+---
+ mt7996/Makefile      |    3 +
+ mt7996/debugfs.c     |   31 +-
+ mt7996/mcu.c         |    4 +
+ mt7996/mt7996.h      |   15 +
+ mt7996/mtk_debug.h   | 2166 ++++++++++++++++++++++++++++++++++++++
+ mt7996/mtk_debugfs.c | 2344 ++++++++++++++++++++++++++++++++++++++++++
+ mt7996/mtk_mcu.c     |   18 +
+ mt7996/mtk_mcu.h     |   16 +
+ tools/fwlog.c        |   25 +-
+ 9 files changed, 4606 insertions(+), 16 deletions(-)
+ create mode 100644 mt7996/mtk_debug.h
+ create mode 100644 mt7996/mtk_debugfs.c
+ create mode 100644 mt7996/mtk_mcu.c
+ create mode 100644 mt7996/mtk_mcu.h
+
+diff --git a/mt7996/Makefile b/mt7996/Makefile
+index f9fb1b0d..5056e179 100644
+--- a/mt7996/Makefile
++++ b/mt7996/Makefile
+@@ -1,4 +1,5 @@
+ # SPDX-License-Identifier: ISC
++EXTRA_CFLAGS += -DCONFIG_MTK_DEBUG
+ 
+ obj-$(CONFIG_MT7996E) += mt7996e.o
+ 
+@@ -6,3 +7,5 @@ mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
+ 	     debugfs.o mmio.o
+ 
+ mt7996e-$(CONFIG_NL80211_TESTMODE) += testmode.o
++
++mt7996e-y += mtk_debugfs.o mtk_mcu.o
+diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
+index 34c30a58..6d04f274 100644
+--- a/mt7996/debugfs.c
++++ b/mt7996/debugfs.c
+@@ -307,6 +307,9 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
+ 	int ret;
+ 
+ 	dev->fw_debug_wm = val ? MCU_FW_LOG_TO_HOST : 0;
++#ifdef CONFIG_MTK_DEBUG
++	dev->fw_debug_wm = val;
++#endif
+ 
+ 	if (dev->fw_debug_bin)
+ 		val = MCU_FW_LOG_RELAY;
+@@ -413,16 +416,22 @@ mt7996_fw_debug_bin_set(void *data, u64 val)
+ 	};
+ 	struct mt7996_dev *dev = data;
+ 
+-	if (!dev->relay_fwlog)
++	if (!dev->relay_fwlog) {
+ 		dev->relay_fwlog = relay_open("fwlog_data", dev->debugfs_dir,
+ 					      1500, 512, &relay_cb, NULL);
+-	if (!dev->relay_fwlog)
+-		return -ENOMEM;
++		if (!dev->relay_fwlog)
++			return -ENOMEM;
++	}
+ 
+ 	dev->fw_debug_bin = val;
+ 
+ 	relay_reset(dev->relay_fwlog);
+ 
++	if (dev->relay_fwlog && !val) {
++		relay_close(dev->relay_fwlog);
++		dev->relay_fwlog = NULL;
++	}
++
+ 	return mt7996_fw_debug_wm_set(dev, dev->fw_debug_wm);
+ }
+ 
+@@ -827,8 +836,13 @@ int mt7996_init_debugfs(struct mt7996_phy *phy)
+ 					    mt7996_rdd_monitor);
+ 	}
+ 
+-	if (phy == &dev->phy)
++	if (phy == &dev->phy) {
+ 		dev->debugfs_dir = dir;
++#ifdef CONFIG_MTK_DEBUG
++		debugfs_create_u16("wlan_idx", 0600, dir, &dev->wlan_idx);
++		mt7996_mtk_init_debugfs(phy, dir);
++#endif
++	}
+ 
+ 	return 0;
+ }
+@@ -842,6 +856,12 @@ mt7996_debugfs_write_fwlog(struct mt7996_dev *dev, const void *hdr, int hdrlen,
+ 	void *dest;
+ 
+ 	spin_lock_irqsave(&lock, flags);
++
++	if (!dev->relay_fwlog) {
++		spin_unlock_irqrestore(&lock, flags);
++		return;
++	}
++
+ 	dest = relay_reserve(dev->relay_fwlog, hdrlen + len + 4);
+ 	if (dest) {
+ 		*(u32 *)dest = hdrlen + len;
+@@ -874,9 +894,6 @@ void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int
+ 		.msg_type = cpu_to_le16(PKT_TYPE_RX_FW_MONITOR),
+ 	};
+ 
+-	if (!dev->relay_fwlog)
+-		return;
+-
+ 	hdr.serial_id = cpu_to_le16(dev->fw_debug_seq++);
+ 	hdr.timestamp = cpu_to_le32(mt76_rr(dev, MT_LPON_FRCR(0)));
+ 	hdr.len = *(__le16 *)data;
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index cc948395..1461ba8e 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -2437,6 +2437,7 @@ static int mt7996_load_patch(struct mt7996_dev *dev)
+ 
+ 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
+ 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
++	memcpy(dev->dbg.patch_build_date, hdr->build_date, sizeof(dev->dbg.patch_build_date));
+ 
+ 	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
+ 		struct mt7996_patch_sec *sec;
+@@ -2566,6 +2567,9 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
+ 		hdr = (const struct mt7996_fw_trailer *)			\
+ 				(fw->data + fw->size - sizeof(*hdr));		\
+ 										\
++		memcpy(dev->dbg.ram_build_date[MT7996_RAM_TYPE_##_type],	\
++		       hdr->build_date,						\
++		       sizeof(dev->dbg.ram_build_date[MT7996_RAM_TYPE_##_type]));\
+ 		dev_info(dev->mt76.dev,						\
+ 			 "%s Firmware Version: %.10s, Build Time: %.15s\n",	\
+ 			 #_type, hdr->fw_ver, hdr->build_date);			\
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index e3fd50f6..8b76d69a 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -333,6 +333,17 @@ struct mt7996_dev {
+ 	u32 reg_l2_backup;
+ 
+ 	u8 wtbl_size_group;
++
++#ifdef CONFIG_MTK_DEBUG
++	u16 wlan_idx;
++	struct {
++		char patch_build_date[16];
++		char ram_build_date[3][15];
++		u32 fw_dbg_module;
++		u8 fw_dbg_lv;
++		u32 bcn_total_cnt[__MT_MAX_BAND];
++	} dbg;
++#endif
+ };
+ 
+ enum {
+@@ -596,4 +607,8 @@ void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			    struct ieee80211_sta *sta, struct dentry *dir);
+ #endif
+ 
++#ifdef CONFIG_MTK_DEBUG
++int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir);
++#endif
++
+ #endif
+diff --git a/mt7996/mtk_debug.h b/mt7996/mtk_debug.h
+new file mode 100644
+index 00000000..a48bac50
+--- /dev/null
++++ b/mt7996/mtk_debug.h
+@@ -0,0 +1,2166 @@
++#ifndef __MTK_DEBUG_H
++#define __MTK_DEBUG_H
++
++#ifdef CONFIG_MTK_DEBUG
++#define NO_SHIFT_DEFINE 0xFFFFFFFF
++#define BITS(m, n)              (~(BIT(m)-1) & ((BIT(n) - 1) | BIT(n)))
++
++#define GET_FIELD(_field, _reg)	\
++	({	\
++		(((_reg) & (_field##_MASK)) >> (_field##_SHIFT));	\
++	})
++
++/* AGG */
++#define BN0_WF_AGG_TOP_BASE                                    0x820e2000
++#define BN1_WF_AGG_TOP_BASE                                    0x820f2000
++#define IP1_BN0_WF_AGG_TOP_BASE                                0x830e2000
++
++#define BN0_WF_AGG_TOP_SCR_ADDR                                (BN0_WF_AGG_TOP_BASE + 0x0) // 2000
++#define BN0_WF_AGG_TOP_SCR0_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x4) // 2004
++#define BN0_WF_AGG_TOP_SCR1_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x8) // 2008
++#define BN0_WF_AGG_TOP_BCR_ADDR                                (BN0_WF_AGG_TOP_BASE + 0xc) // 200C
++#define BN0_WF_AGG_TOP_BWCR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x10) // 2010
++#define BN0_WF_AGG_TOP_ARCR0_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x14) // 2014
++#define BN0_WF_AGG_TOP_ARUCR_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x18) // 2018
++#define BN0_WF_AGG_TOP_ARDCR_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x1c) // 201C
++#define BN0_WF_AGG_TOP_AALCR0_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x20) // 2020
++#define BN0_WF_AGG_TOP_AALCR1_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x24) // 2024
++#define BN0_WF_AGG_TOP_PCR0_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x28) // 2028
++#define BN0_WF_AGG_TOP_PCR1_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x2c) // 202C
++#define BN0_WF_AGG_TOP_TTCR0_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x30) // 2030
++#define BN0_WF_AGG_TOP_TTCR1_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x34) // 2034
++#define BN0_WF_AGG_TOP_ACR1_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x38) // 2038
++#define BN0_WF_AGG_TOP_ACR4_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x3c) // 203C
++#define BN0_WF_AGG_TOP_ACR5_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x40) // 2040
++#define BN0_WF_AGG_TOP_ACR6_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x44) // 2044
++#define BN0_WF_AGG_TOP_ACR8_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x4c) // 204C
++#define BN0_WF_AGG_TOP_MRCR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x50) // 2050
++#define BN0_WF_AGG_TOP_MMPDR_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x54) // 2054
++#define BN0_WF_AGG_TOP_GFPDR_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x58) // 2058
++#define BN0_WF_AGG_TOP_VHTPDR_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x5c) // 205C
++#define BN0_WF_AGG_TOP_HEPDR_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x60) // 2060
++#define BN0_WF_AGG_TOP_CTCR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x64) // 2064
++#define BN0_WF_AGG_TOP_ATCR3_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x68) // 2068
++#define BN0_WF_AGG_TOP_SRCR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x6c) // 206C
++#define BN0_WF_AGG_TOP_VBCR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x70) // 2070
++#define BN0_WF_AGG_TOP_TCR_ADDR                                (BN0_WF_AGG_TOP_BASE + 0x74) // 2074
++#define BN0_WF_AGG_TOP_SRHS_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x78) // 2078
++#define BN0_WF_AGG_TOP_DBRCR0_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x7c) // 207C
++#define BN0_WF_AGG_TOP_DBRCR1_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x80) // 2080
++#define BN0_WF_AGG_TOP_CTETCR_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x84) // 2084
++#define BN0_WF_AGG_TOP_WPDR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x88) // 2088
++#define BN0_WF_AGG_TOP_PLRPDR_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x8c) // 208C
++#define BN0_WF_AGG_TOP_CECR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x90) // 2090
++#define BN0_WF_AGG_TOP_OMRCR0_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x94) // 2094
++#define BN0_WF_AGG_TOP_OMRCR1_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x98) // 2098
++#define BN0_WF_AGG_TOP_OMRCR2_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x9c) // 209C
++#define BN0_WF_AGG_TOP_OMRCR3_ADDR                             (BN0_WF_AGG_TOP_BASE + 0xa0) // 20A0
++#define BN0_WF_AGG_TOP_TMCR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0xa4) // 20A4
++#define BN0_WF_AGG_TOP_TWTCR_ADDR                              (BN0_WF_AGG_TOP_BASE + 0xa8) // 20A8
++#define BN0_WF_AGG_TOP_TWTSTACR_ADDR                           (BN0_WF_AGG_TOP_BASE + 0xac) // 20AC
++#define BN0_WF_AGG_TOP_TWTE0TB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xb0) // 20B0
++#define BN0_WF_AGG_TOP_TWTE1TB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xb4) // 20B4
++#define BN0_WF_AGG_TOP_TWTE2TB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xb8) // 20B8
++#define BN0_WF_AGG_TOP_TWTE3TB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xbc) // 20BC
++#define BN0_WF_AGG_TOP_TWTE4TB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xc0) // 20C0
++#define BN0_WF_AGG_TOP_TWTE5TB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xc4) // 20C4
++#define BN0_WF_AGG_TOP_TWTE6TB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xc8) // 20C8
++#define BN0_WF_AGG_TOP_TWTE7TB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xcc) // 20CC
++#define BN0_WF_AGG_TOP_TWTE8TB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xd0) // 20D0
++#define BN0_WF_AGG_TOP_TWTE9TB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xd4) // 20D4
++#define BN0_WF_AGG_TOP_TWTEATB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xd8) // 20D8
++#define BN0_WF_AGG_TOP_TWTEBTB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xdc) // 20DC
++#define BN0_WF_AGG_TOP_TWTECTB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xe0) // 20E0
++#define BN0_WF_AGG_TOP_TWTEDTB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xe4) // 20E4
++#define BN0_WF_AGG_TOP_TWTEETB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xe8) // 20E8
++#define BN0_WF_AGG_TOP_TWTEFTB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xec) // 20EC
++#define BN0_WF_AGG_TOP_AALCR2_ADDR                             (BN0_WF_AGG_TOP_BASE + 0xf0) // 20F0
++#define BN0_WF_AGG_TOP_AALCR3_ADDR                             (BN0_WF_AGG_TOP_BASE + 0xf4) // 20F4
++#define BN0_WF_AGG_TOP_AALCR4_ADDR                             (BN0_WF_AGG_TOP_BASE + 0xf8) // 20F8
++#define BN0_WF_AGG_TOP_AALCR5_ADDR                             (BN0_WF_AGG_TOP_BASE + 0xfc) // 20FC
++#define BN0_WF_AGG_TOP_AALCR6_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x100) // 2100
++#define BN0_WF_AGG_TOP_AALCR7_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x104) // 2104
++#define BN0_WF_AGG_TOP_ATCR0_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x108) // 2108
++#define BN0_WF_AGG_TOP_ATCR1_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x10c) // 210C
++#define BN0_WF_AGG_TOP_TCCR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x110) // 2110
++#define BN0_WF_AGG_TOP_TFCR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x114) // 2114
++#define BN0_WF_AGG_TOP_MUCR0_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x118) // 2118
++#define BN0_WF_AGG_TOP_MUCR1_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x11c) // 211C
++#define BN0_WF_AGG_TOP_CSDCR0_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x120) // 2120
++#define BN0_WF_AGG_TOP_CSDCR1_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x124) // 2124
++#define BN0_WF_AGG_TOP_CSDCR2_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x128) // 2128
++#define BN0_WF_AGG_TOP_CSDCR3_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x12c) // 212C
++#define BN0_WF_AGG_TOP_CSDCR4_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x130) // 2130
++#define BN0_WF_AGG_TOP_DYNSCR_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x178) // 2178
++#define BN0_WF_AGG_TOP_DYNSSCR_ADDR                            (BN0_WF_AGG_TOP_BASE + 0x198) // 2198
++#define BN0_WF_AGG_TOP_TCDCNT0_ADDR                            (BN0_WF_AGG_TOP_BASE + 0x2c8) // 22C8
++#define BN0_WF_AGG_TOP_TCDCNT1_ADDR                            (BN0_WF_AGG_TOP_BASE + 0x2cc) // 22CC
++#define BN0_WF_AGG_TOP_TCSR0_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x2d0) // 22D0
++#define BN0_WF_AGG_TOP_TCSR1_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x2d4) // 22D4
++#define BN0_WF_AGG_TOP_TCSR2_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x2d8) // 22D8
++#define BN0_WF_AGG_TOP_DCR_ADDR                                (BN0_WF_AGG_TOP_BASE + 0x2e4) // 22E4
++#define BN0_WF_AGG_TOP_SMDCR_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x2e8) // 22E8
++#define BN0_WF_AGG_TOP_TXCMDSMCR_ADDR                          (BN0_WF_AGG_TOP_BASE + 0x2ec) // 22EC
++#define BN0_WF_AGG_TOP_SMCR0_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x2f0) // 22F0
++#define BN0_WF_AGG_TOP_SMCR1_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x2f4) // 22F4
++#define BN0_WF_AGG_TOP_SMCR2_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x2f8) // 22F8
++#define BN0_WF_AGG_TOP_SMCR3_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x2fc) // 22FC
++
++#define BN0_WF_AGG_TOP_AALCR0_AC01_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR0_ADDR
++#define BN0_WF_AGG_TOP_AALCR0_AC01_AGG_LIMIT_MASK              0x03FF0000                // AC01_AGG_LIMIT[25..16]
++#define BN0_WF_AGG_TOP_AALCR0_AC01_AGG_LIMIT_SHFT              16
++#define BN0_WF_AGG_TOP_AALCR0_AC00_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR0_ADDR
++#define BN0_WF_AGG_TOP_AALCR0_AC00_AGG_LIMIT_MASK              0x000003FF                // AC00_AGG_LIMIT[9..0]
++#define BN0_WF_AGG_TOP_AALCR0_AC00_AGG_LIMIT_SHFT              0
++
++#define BN0_WF_AGG_TOP_AALCR1_AC03_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR1_ADDR
++#define BN0_WF_AGG_TOP_AALCR1_AC03_AGG_LIMIT_MASK              0x03FF0000                // AC03_AGG_LIMIT[25..16]
++#define BN0_WF_AGG_TOP_AALCR1_AC03_AGG_LIMIT_SHFT              16
++#define BN0_WF_AGG_TOP_AALCR1_AC02_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR1_ADDR
++#define BN0_WF_AGG_TOP_AALCR1_AC02_AGG_LIMIT_MASK              0x000003FF                // AC02_AGG_LIMIT[9..0]
++#define BN0_WF_AGG_TOP_AALCR1_AC02_AGG_LIMIT_SHFT              0
++
++#define BN0_WF_AGG_TOP_AALCR2_AC11_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR2_ADDR
++#define BN0_WF_AGG_TOP_AALCR2_AC11_AGG_LIMIT_MASK              0x03FF0000                // AC11_AGG_LIMIT[25..16]
++#define BN0_WF_AGG_TOP_AALCR2_AC11_AGG_LIMIT_SHFT              16
++#define BN0_WF_AGG_TOP_AALCR2_AC10_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR2_ADDR
++#define BN0_WF_AGG_TOP_AALCR2_AC10_AGG_LIMIT_MASK              0x000003FF                // AC10_AGG_LIMIT[9..0]
++#define BN0_WF_AGG_TOP_AALCR2_AC10_AGG_LIMIT_SHFT              0
++
++#define BN0_WF_AGG_TOP_AALCR3_AC13_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR3_ADDR
++#define BN0_WF_AGG_TOP_AALCR3_AC13_AGG_LIMIT_MASK              0x03FF0000                // AC13_AGG_LIMIT[25..16]
++#define BN0_WF_AGG_TOP_AALCR3_AC13_AGG_LIMIT_SHFT              16
++#define BN0_WF_AGG_TOP_AALCR3_AC12_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR3_ADDR
++#define BN0_WF_AGG_TOP_AALCR3_AC12_AGG_LIMIT_MASK              0x000003FF                // AC12_AGG_LIMIT[9..0]
++#define BN0_WF_AGG_TOP_AALCR3_AC12_AGG_LIMIT_SHFT              0
++
++#define BN0_WF_AGG_TOP_AALCR4_AC21_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR4_ADDR
++#define BN0_WF_AGG_TOP_AALCR4_AC21_AGG_LIMIT_MASK              0x03FF0000                // AC21_AGG_LIMIT[25..16]
++#define BN0_WF_AGG_TOP_AALCR4_AC21_AGG_LIMIT_SHFT              16
++#define BN0_WF_AGG_TOP_AALCR4_AC20_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR4_ADDR
++#define BN0_WF_AGG_TOP_AALCR4_AC20_AGG_LIMIT_MASK              0x000003FF                // AC20_AGG_LIMIT[9..0]
++#define BN0_WF_AGG_TOP_AALCR4_AC20_AGG_LIMIT_SHFT              0
++
++#define BN0_WF_AGG_TOP_AALCR5_AC23_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR5_ADDR
++#define BN0_WF_AGG_TOP_AALCR5_AC23_AGG_LIMIT_MASK              0x03FF0000                // AC23_AGG_LIMIT[25..16]
++#define BN0_WF_AGG_TOP_AALCR5_AC23_AGG_LIMIT_SHFT              16
++#define BN0_WF_AGG_TOP_AALCR5_AC22_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR5_ADDR
++#define BN0_WF_AGG_TOP_AALCR5_AC22_AGG_LIMIT_MASK              0x000003FF                // AC22_AGG_LIMIT[9..0]
++#define BN0_WF_AGG_TOP_AALCR5_AC22_AGG_LIMIT_SHFT              0
++
++#define BN0_WF_AGG_TOP_AALCR6_AC31_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR6_ADDR
++#define BN0_WF_AGG_TOP_AALCR6_AC31_AGG_LIMIT_MASK              0x03FF0000                // AC31_AGG_LIMIT[25..16]
++#define BN0_WF_AGG_TOP_AALCR6_AC31_AGG_LIMIT_SHFT              16
++#define BN0_WF_AGG_TOP_AALCR6_AC30_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR6_ADDR
++#define BN0_WF_AGG_TOP_AALCR6_AC30_AGG_LIMIT_MASK              0x000003FF                // AC30_AGG_LIMIT[9..0]
++#define BN0_WF_AGG_TOP_AALCR6_AC30_AGG_LIMIT_SHFT              0
++#define BN0_WF_AGG_TOP_AALCR7_AC33_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR7_ADDR
++#define BN0_WF_AGG_TOP_AALCR7_AC33_AGG_LIMIT_MASK              0x03FF0000                // AC33_AGG_LIMIT[25..16]
++#define BN0_WF_AGG_TOP_AALCR7_AC33_AGG_LIMIT_SHFT              16
++#define BN0_WF_AGG_TOP_AALCR7_AC32_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR7_ADDR
++#define BN0_WF_AGG_TOP_AALCR7_AC32_AGG_LIMIT_MASK              0x000003FF                // AC32_AGG_LIMIT[9..0]
++#define BN0_WF_AGG_TOP_AALCR7_AC32_AGG_LIMIT_SHFT              0
++
++/* DMA */
++struct queue_desc {
++	u32 hw_desc_base;
++	u16 ring_size;
++	char *const ring_info;
++};
++// HOST DMA
++//#define CONN_INFRA_REMAPPING_OFFSET 0x64000000
++//#define WF_WFDMA_HOST_DMA0_BASE (0x18024000 + CONN_INFRA_REMAPPING_OFFSET)
++#define WF_WFDMA_HOST_DMA0_BASE                                0xd4000
++
++#define WF_WFDMA_HOST_DMA0_HOST_INT_STA_ADDR                                   \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x200) /* 4200 */
++#define WF_WFDMA_HOST_DMA0_HOST_INT_ENA_ADDR                                   \
++	(WF_WFDMA_HOST_DMA0_BASE + 0X204) /* 4204 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_ADDR                                  \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x208) /* 4208 */
++
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_ADDR                      \
++	WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK                      \
++	0x00000008 /* RX_DMA_BUSY[3] */
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT 3
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_ADDR                        \
++	WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_MASK                        \
++	0x00000004 /* RX_DMA_EN[2] */
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_SHFT 2
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_ADDR                      \
++	WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK                      \
++	0x00000002 /* TX_DMA_BUSY[1] */
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT 1
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_ADDR                        \
++	WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_MASK                        \
++	0x00000001 /* TX_DMA_EN[0] */
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_SHFT 0
++
++
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING0_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x300) /* 4300 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING0_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x304) /* 4304 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING0_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x308) /* 4308 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING0_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x30c) /* 430C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING1_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x310) /* 4310 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING1_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x314) /* 4314 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING1_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x318) /* 4318 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING1_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x31c) /* 431C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING2_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x320) /* 4320 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING2_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x324) /* 4324 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING2_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x328) /* 4328 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING2_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x32c) /* 432C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING3_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x330) /* 4330 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING3_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x334) /* 4334 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING3_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x338) /* 4338 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING3_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x33c) /* 433C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING4_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x340) /* 4340 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING4_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x344) /* 4344 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING4_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x348) /* 4348 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING4_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x34c) /* 434C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING5_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x350) /* 4350 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING5_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x354) /* 4354 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING5_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x358) /* 4358 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING5_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x35c) /* 435C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING6_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x360) /* 4360 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING6_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x364) /* 4364 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING6_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x368) /* 4368 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING6_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x36c) /* 436C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING16_CTRL0_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x400) /* 4400 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING16_CTRL1_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x404) /* 4404 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING16_CTRL2_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x408) /* 4408 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING16_CTRL3_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x40c) /* 440C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING17_CTRL0_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x410) /* 4410 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING17_CTRL1_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x414) /* 4414 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING17_CTRL2_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x418) /* 4418 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING17_CTRL3_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x41c) /* 441C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING18_CTRL0_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x420) /* 4420 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING18_CTRL1_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x424) /* 4424 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING18_CTRL2_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x428) /* 4428 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING18_CTRL3_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x42c) /* 442C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING19_CTRL0_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x430) /* 4430 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING19_CTRL1_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x434) /* 4434 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING19_CTRL2_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x438) /* 4438 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING19_CTRL3_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x43c) /* 443C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING20_CTRL0_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x440) /* 4440 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING20_CTRL1_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x444) /* 4444 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING20_CTRL2_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x448) /* 4448 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING20_CTRL3_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x44c) /* 444C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING21_CTRL0_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x450) /* 4450 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING21_CTRL1_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x454) /* 4454 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING21_CTRL2_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x458) /* 4458 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING21_CTRL3_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x45c) /* 445c */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING22_CTRL0_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x460) // 4460
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING22_CTRL1_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x464) // 4464
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING22_CTRL2_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x468) // 4468
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING22_CTRL3_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x46c) // 446C
++
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING0_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x500) /* 4500 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING0_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x504) /* 4504 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING0_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x508) /* 4508 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING0_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x50c) /* 450C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING1_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x510) /* 4510 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING1_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x514) /* 4514 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING1_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x518) /* 4518 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING1_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x51c) /* 451C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING2_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x520) /* 4520 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING2_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x524) /* 4524 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING2_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x528) /* 4528 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING2_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x52C) /* 452C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING3_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x530) /* 4530 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING3_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x534) /* 4534 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING3_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x538) /* 4538 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING3_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x53C) /* 453C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING4_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x540) /* 4540 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING4_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x544) /* 4544 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING4_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x548) /* 4548 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING4_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x54c) /* 454C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING5_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x550) /* 4550 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING5_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x554) /* 4554 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING5_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x558) /* 4558 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING5_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x55c) /* 455C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING6_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x560) /* 4560 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING6_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x564) /* 4564 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING6_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x568) /* 4568 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING6_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x56c) /* 456C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING7_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x570) /* 4570 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING7_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x574) /* 4574 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING7_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x578) /* 4578 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING7_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x57c) /* 457C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING8_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x580) /* 4580 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING8_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x584) /* 4584 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING8_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x588) /* 4588 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING8_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x58c) /* 458C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING9_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x590) /* 4590 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING9_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x594) /* 4594 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING9_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x598) /* 4598 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING9_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x59c) /* 459C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING10_CTRL0_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5a0) // 45A0
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING10_CTRL1_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5a4) // 45A4
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING10_CTRL2_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5a8) // 45A8
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING10_CTRL3_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5ac) // 45AC
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING11_CTRL0_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5b0) // 45B0
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING11_CTRL1_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5b4) // 45B4
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING11_CTRL2_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5b8) // 45B8
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING11_CTRL3_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5bc) // 45BC
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING12_CTRL0_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5C0) // 45C0
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING12_CTRL1_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5C4) // 45C4
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING12_CTRL2_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5C8) // 45C8
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING12_CTRL3_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5CC) // 45CC
++
++// HOST PCIE1 DMA
++#define WF_WFDMA_HOST_DMA0_PCIE1_BASE				0xd8000
++
++#define WF_WFDMA_HOST_DMA0_PCIE1_HOST_INT_STA_ADDR		(WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x200) // 8200
++#define WF_WFDMA_HOST_DMA0_PCIE1_HOST_INT_ENA_ADDR		(WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0X204) // 8204
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_ADDR		(WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x208) // 8208
++
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_PDMA_BT_SIZE_SHFT	4
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK		0x00000008
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT		3
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_RX_DMA_EN_MASK		0x00000004
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_RX_DMA_EN_SHFT		2
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK		0x00000002
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT		1
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_TX_DMA_EN_MASK		0x00000001
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_TX_DMA_EN_SHFT		0
++
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING21_CTRL0_ADDR    (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x450) // 8450
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING21_CTRL1_ADDR    (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x454) // 8454
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING21_CTRL2_ADDR    (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x458) // 8458
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING21_CTRL3_ADDR    (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x45c) // 845C
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING22_CTRL0_ADDR    (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x460) // 8460
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING22_CTRL1_ADDR    (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x464) // 8464
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING22_CTRL2_ADDR    (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x468) // 8468
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING22_CTRL3_ADDR    (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x46c) // 846C
++
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING3_CTRL0_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x530) // 8530
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING3_CTRL1_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x534) // 8534
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING3_CTRL2_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x538) // 8538
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING3_CTRL3_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x53C) // 853C
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING5_CTRL0_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x550) // 8550
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING5_CTRL1_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x554) // 8554
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING5_CTRL2_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x558) // 8558
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING5_CTRL3_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x55c) // 855C
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING6_CTRL0_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x560) // 8560
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING6_CTRL1_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x564) // 8564
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING6_CTRL2_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x568) // 8568
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING6_CTRL3_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x56c) // 856C
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING7_CTRL0_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x570) // 8570
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING7_CTRL1_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x574) // 8574
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING7_CTRL2_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x578) // 8578
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING7_CTRL3_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x57c) // 857C
++//MCU DMA
++//#define WF_WFDMA_MCU_DMA0_BASE                                 0x02000
++#define WF_WFDMA_MCU_DMA0_BASE                                 0x54000000
++
++#define WF_WFDMA_MCU_DMA0_HOST_INT_STA_ADDR                    (WF_WFDMA_MCU_DMA0_BASE + 0x200) // 0200
++#define WF_WFDMA_MCU_DMA0_HOST_INT_ENA_ADDR                    (WF_WFDMA_MCU_DMA0_BASE + 0X204) // 0204
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR                   (WF_WFDMA_MCU_DMA0_BASE + 0x208) // 0208
++
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_ADDR       WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK       0x00000008                // RX_DMA_BUSY[3]
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT       3
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_ADDR         WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_MASK         0x00000004                // RX_DMA_EN[2]
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_SHFT         2
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_ADDR       WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK       0x00000002                // TX_DMA_BUSY[1]
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT       1
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_ADDR         WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_MASK         0x00000001                // TX_DMA_EN[0]
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_SHFT         0
++
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING0_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x300) // 0300
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING0_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x304) // 0304
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING0_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x308) // 0308
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING0_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x30c) // 030C
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING1_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x310) // 0310
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING1_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x314) // 0314
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING1_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x318) // 0318
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING1_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x31c) // 031C
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING2_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x320) // 0320
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING2_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x324) // 0324
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING2_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x328) // 0328
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING2_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x32c) // 032C
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING3_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x330) // 0330
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING3_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x334) // 0334
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING3_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x338) // 0338
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING3_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x33c) // 033C
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING4_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x340) // 0340
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING4_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x344) // 0344
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING4_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x348) // 0348
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING4_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x34c) // 034C
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING5_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x350) // 0350
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING5_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x354) // 0354
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING5_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x358) // 0358
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING5_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x35c) // 035C
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING6_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x360) // 0360
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING6_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x364) // 0364
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING6_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x368) // 0368
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING6_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x36c) // 036C
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING7_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x370) // 0370
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING7_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x374) // 0374
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING7_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x378) // 0378
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING7_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x37c) // 037C
++
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING0_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x500) // 0500
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING0_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x504) // 0504
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING0_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x508) // 0508
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING0_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x50c) // 050C
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING1_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x510) // 0510
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING1_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x514) // 0514
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING1_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x518) // 0518
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING1_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x51c) // 051C
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING2_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x520) // 0520
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING2_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x524) // 0524
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING2_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x528) // 0528
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING2_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x52C) // 052C
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING3_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x530) // 0530
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING3_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x534) // 0534
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING3_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x538) // 0538
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING3_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x53C) // 053C
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING4_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x540) // 0540
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING4_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x544) // 0544
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING4_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x548) // 0548
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING4_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x54C) // 054C
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING5_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x550) // 0550
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING5_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x554) // 0554
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING5_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x558) // 0558
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING5_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x55C) // 055C
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING6_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x560) // 0560
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING6_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x564) // 0564
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING6_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x568) // 0568
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING6_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x56c) // 056C
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING7_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x570) // 0570
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING7_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x574) // 0574
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING7_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x578) // 0578
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING7_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x57c) // 057C
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING8_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x580) // 0580
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING8_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x584) // 0584
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING8_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x588) // 0588
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING8_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x58c) // 058C
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING9_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x590) // 0590
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING9_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x594) // 0594
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING9_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x598) // 0598
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING9_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x59c) // 059C
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING10_CTRL0_ADDR           (WF_WFDMA_MCU_DMA0_BASE + 0x5A0) // 05A0
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING10_CTRL1_ADDR           (WF_WFDMA_MCU_DMA0_BASE + 0x5A4) // 05A4
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING10_CTRL2_ADDR           (WF_WFDMA_MCU_DMA0_BASE + 0x5A8) // 05A8
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING10_CTRL3_ADDR           (WF_WFDMA_MCU_DMA0_BASE + 0x5Ac) // 05AC
++
++// MEM DMA
++#define WF_WFDMA_MEM_DMA_BASE                                  0x58000000
++
++#define WF_WFDMA_MEM_DMA_HOST_INT_STA_ADDR                     (WF_WFDMA_MEM_DMA_BASE + 0x200) // 0200
++#define WF_WFDMA_MEM_DMA_HOST_INT_ENA_ADDR                     (WF_WFDMA_MEM_DMA_BASE + 0X204) // 0204
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_ADDR                    (WF_WFDMA_MEM_DMA_BASE + 0x208) // 0208
++
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_ADDR        WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK        0x00000008                // RX_DMA_BUSY[3]
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT        3
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_ADDR          WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_MASK          0x00000004                // RX_DMA_EN[2]
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_SHFT          2
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_ADDR        WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK        0x00000002                // TX_DMA_BUSY[1]
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT        1
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_ADDR          WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_MASK          0x00000001                // TX_DMA_EN[0]
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_SHFT          0
++
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING0_CTRL0_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x300) // 0300
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING0_CTRL1_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x304) // 0304
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING0_CTRL2_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x308) // 0308
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING0_CTRL3_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x30c) // 030C
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING1_CTRL0_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x310) // 0310
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING1_CTRL1_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x314) // 0314
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING1_CTRL2_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x318) // 0318
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING1_CTRL3_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x31c) // 031C
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING2_CTRL0_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x320) // 0320
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING2_CTRL1_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x324) // 0324
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING2_CTRL2_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x328) // 0328
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING2_CTRL3_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x32c) // 032C
++
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING0_CTRL0_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x500) // 0500
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING0_CTRL1_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x504) // 0504
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING0_CTRL2_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x508) // 0508
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING0_CTRL3_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x50c) // 050C
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING1_CTRL0_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x510) // 0510
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING1_CTRL1_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x514) // 0514
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING1_CTRL2_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x518) // 0518
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING1_CTRL3_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x51c) // 051C
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING2_CTRL0_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x520) // 0520
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING2_CTRL1_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x524) // 0524
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING2_CTRL2_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x528) // 0528
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING2_CTRL3_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x52C) // 052C
++
++/* MIB */
++#define WF_UMIB_TOP_BASE                                       0x820cd000
++#define BN0_WF_MIB_TOP_BASE                                    0x820ed000
++#define BN1_WF_MIB_TOP_BASE                                    0x820fd000
++#define IP1_BN0_WF_MIB_TOP_BASE                                0x830ed000
++
++#define WF_UMIB_TOP_B0BROCR_ADDR                               (WF_UMIB_TOP_BASE + 0x484) // D484
++#define WF_UMIB_TOP_B0BRBCR_ADDR                               (WF_UMIB_TOP_BASE + 0x4D4) // D4D4
++#define WF_UMIB_TOP_B0BRDCR_ADDR                               (WF_UMIB_TOP_BASE + 0x524) // D524
++#define WF_UMIB_TOP_B1BROCR_ADDR                               (WF_UMIB_TOP_BASE + 0x5E8) // D5E8
++#define WF_UMIB_TOP_B2BROCR_ADDR                               (WF_UMIB_TOP_BASE + 0x74C) // D74C
++
++#define BN0_WF_MIB_TOP_M0SCR0_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x000) // D000
++#define BN0_WF_MIB_TOP_M0SDR6_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x020) // D020
++#define BN0_WF_MIB_TOP_M0SDR9_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x024) // D024
++#define BN0_WF_MIB_TOP_M0SDR18_ADDR                            (BN0_WF_MIB_TOP_BASE + 0x030) // D030
++#define BN0_WF_MIB_TOP_BTOCR_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x400) // D400
++#define BN0_WF_MIB_TOP_BTBCR_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x450) // D450
++#define BN0_WF_MIB_TOP_BTDCR_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x590) // D590
++#define BN0_WF_MIB_TOP_BTCR_ADDR                               (BN0_WF_MIB_TOP_BASE + 0x5A0) // D5A0
++#define BN0_WF_MIB_TOP_RVSR0_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x720) // D720
++
++#define BN0_WF_MIB_TOP_TSCR0_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6B0) // D6B0
++#define BN0_WF_MIB_TOP_TSCR3_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6BC) // D6BC
++#define BN0_WF_MIB_TOP_TSCR4_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6C0) // D6C0
++#define BN0_WF_MIB_TOP_TSCR5_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6C4) // D6C4
++#define BN0_WF_MIB_TOP_TSCR6_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6C8) // D6C8
++#define BN0_WF_MIB_TOP_TSCR7_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6D0) // D6D0
++#define BN0_WF_MIB_TOP_TSCR8_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6CC) // D6CC
++
++#define BN0_WF_MIB_TOP_TBCR0_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6EC) // D6EC
++#define BN0_WF_MIB_TOP_TBCR1_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6F0) // D6F0
++#define BN0_WF_MIB_TOP_TBCR2_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6F4) // D6F4
++#define BN0_WF_MIB_TOP_TBCR3_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6F8) // D6F8
++#define BN0_WF_MIB_TOP_TBCR4_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6FC) // D6FC
++
++#define BN0_WF_MIB_TOP_TDRCR0_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x728) // D728
++#define BN0_WF_MIB_TOP_TDRCR1_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x72C) // D72C
++#define BN0_WF_MIB_TOP_TDRCR2_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x730) // D730
++#define BN0_WF_MIB_TOP_TDRCR3_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x734) // D734
++#define BN0_WF_MIB_TOP_TDRCR4_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x738) // D738
++
++#define BN0_WF_MIB_TOP_BTSCR0_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x5E0) // D5E0
++#define BN0_WF_MIB_TOP_BTSCR1_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x5F0) // D5F0
++#define BN0_WF_MIB_TOP_BTSCR2_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x600) // D600
++#define BN0_WF_MIB_TOP_BTSCR3_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x610) // D610
++#define BN0_WF_MIB_TOP_BTSCR4_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x620) // D620
++#define BN0_WF_MIB_TOP_BTSCR5_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x788) // D788
++#define BN0_WF_MIB_TOP_BTSCR6_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x798) // D798
++
++#define BN0_WF_MIB_TOP_RSCR1_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x7AC) // D7AC
++#define BN0_WF_MIB_TOP_BSCR2_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9D4) // D9D4
++#define BN0_WF_MIB_TOP_TSCR18_ADDR                             (BN0_WF_MIB_TOP_BASE + 0xA1C) // DA1C
++
++#define BN0_WF_MIB_TOP_MSR0_ADDR                               (BN0_WF_MIB_TOP_BASE + 0xA64) // DA64
++#define BN0_WF_MIB_TOP_MSR1_ADDR                               (BN0_WF_MIB_TOP_BASE + 0xA68) // DA68
++#define BN0_WF_MIB_TOP_MSR2_ADDR                               (BN0_WF_MIB_TOP_BASE + 0xA6C) // DA6C
++#define BN0_WF_MIB_TOP_MCTR5_ADDR                              (BN0_WF_MIB_TOP_BASE + 0xA70) // DA70
++#define BN0_WF_MIB_TOP_MCTR6_ADDR                              (BN0_WF_MIB_TOP_BASE + 0xA74) // DA74
++
++#define BN0_WF_MIB_TOP_RSCR26_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x950) // D950
++#define BN0_WF_MIB_TOP_RSCR27_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x954) // D954
++#define BN0_WF_MIB_TOP_RSCR28_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x958) // D958
++#define BN0_WF_MIB_TOP_RSCR31_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x964) // D964
++#define BN0_WF_MIB_TOP_RSCR33_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x96C) // D96C
++#define BN0_WF_MIB_TOP_RSCR35_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x974) // D974
++#define BN0_WF_MIB_TOP_RSCR36_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x978) // D978
++
++#define BN0_WF_MIB_TOP_TSCR3_AMPDU_MPDU_COUNT_MASK             0xFFFFFFFF                // AMPDU_MPDU_COUNT[31..0]
++#define BN0_WF_MIB_TOP_TSCR4_AMPDU_ACKED_COUNT_MASK            0xFFFFFFFF                // AMPDU_ACKED_COUNT[31..0]
++#define BN0_WF_MIB_TOP_M0SDR6_CHANNEL_IDLE_COUNT_MASK          0x0000FFFF                // CHANNEL_IDLE_COUNT[15..0]
++#define BN0_WF_MIB_TOP_M0SDR9_CCA_NAV_TX_TIME_MASK             0x00FFFFFF                // CCA_NAV_TX_TIME[23..0]
++#define BN0_WF_MIB_TOP_RSCR26_RX_MDRDY_COUNT_MASK              0xFFFFFFFF                // RX_MDRDY_COUNT[31..0]
++#define BN0_WF_MIB_TOP_MSR0_CCK_MDRDY_TIME_MASK                0xFFFFFFFF                // CCK_MDRDY_TIME[31..0]
++#define BN0_WF_MIB_TOP_MSR1_OFDM_LG_MIXED_VHT_MDRDY_TIME_MASK  0xFFFFFFFF                // OFDM_LG_MIXED_VHT_MDRDY_TIME[31..0]
++#define BN0_WF_MIB_TOP_MSR2_OFDM_GREEN_MDRDY_TIME_MASK         0xFFFFFFFF                // OFDM_GREEN_MDRDY_TIME[31..0]
++#define BN0_WF_MIB_TOP_MCTR5_P_CCA_TIME_MASK                   0xFFFFFFFF                // P_CCA_TIME[31..0]
++#define BN0_WF_MIB_TOP_MCTR6_S_CCA_TIME_MASK                   0xFFFFFFFF                // S_CCA_TIME[31..0]
++#define BN0_WF_MIB_TOP_M0SDR18_P_ED_TIME_MASK                  0x00FFFFFF                // P_ED_TIME[23..0]
++#define BN0_WF_MIB_TOP_TSCR18_BEACONTXCOUNT_MASK               0xFFFFFFFF                // BEACONTXCOUNT[31..0]
++#define BN0_WF_MIB_TOP_TBCR0_TX_20MHZ_CNT_MASK                 0xFFFFFFFF                // TX_20MHZ_CNT[31..0]
++#define BN0_WF_MIB_TOP_TBCR1_TX_40MHZ_CNT_MASK                 0xFFFFFFFF                // TX_40MHZ_CNT[31..0]
++#define BN0_WF_MIB_TOP_TBCR2_TX_80MHZ_CNT_MASK                 0xFFFFFFFF                // TX_80MHZ_CNT[31..0]
++#define BN0_WF_MIB_TOP_TBCR3_TX_160MHZ_CNT_MASK                0xFFFFFFFF                // TX_160MHZ_CNT[31..0]
++#define BN0_WF_MIB_TOP_TBCR4_TX_320MHZ_CNT_MASK                0xFFFFFFFF                // TX_320MHZ_CNT[31..0]
++#define BN0_WF_MIB_TOP_BSCR2_MUBF_TX_COUNT_MASK                0xFFFFFFFF                // MUBF_TX_COUNT[31..0]
++#define BN0_WF_MIB_TOP_RVSR0_VEC_MISS_COUNT_MASK               0xFFFFFFFF                // VEC_MISS_COUNT[31..0]
++#define BN0_WF_MIB_TOP_RSCR35_DELIMITER_FAIL_COUNT_MASK        0xFFFFFFFF                // DELIMITER_FAIL_COUNT[31..0]
++#define BN0_WF_MIB_TOP_RSCR1_RX_FCS_ERROR_COUNT_MASK           0xFFFFFFFF                // RX_FCS_ERROR_COUNT[31..0]
++#define BN0_WF_MIB_TOP_RSCR33_RX_FIFO_FULL_COUNT_MASK          0xFFFFFFFF                // RX_FIFO_FULL_COUNT[31..0]
++#define BN0_WF_MIB_TOP_RSCR36_RX_LEN_MISMATCH_MASK             0xFFFFFFFF                // RX_LEN_MISMATCH[31..0]
++#define BN0_WF_MIB_TOP_RSCR31_RX_MPDU_COUNT_MASK               0xFFFFFFFF                // RX_MPDU_COUNT[31..0]
++#define BN0_WF_MIB_TOP_BTSCR5_RTSTXCOUNTn_MASK                 0xFFFFFFFF                // RTSTXCOUNTn[31..0]
++#define BN0_WF_MIB_TOP_BTSCR6_RTSRETRYCOUNTn_MASK              0xFFFFFFFF                // RTSRETRYCOUNTn[31..0]
++#define BN0_WF_MIB_TOP_BTSCR0_BAMISSCOUNTn_MASK                0xFFFFFFFF                // BAMISSCOUNTn[31..0]
++#define BN0_WF_MIB_TOP_BTSCR1_ACKFAILCOUNTn_MASK               0xFFFFFFFF                // ACKFAILCOUNTn[31..0]
++#define BN0_WF_MIB_TOP_BTSCR2_FRAMERETRYCOUNTn_MASK            0xFFFFFFFF                // FRAMERETRYCOUNTn[31..0]
++#define BN0_WF_MIB_TOP_BTSCR3_FRAMERETRY2COUNTn_MASK           0xFFFFFFFF                // FRAMERETRY2COUNTn[31..0]
++#define BN0_WF_MIB_TOP_BTSCR4_FRAMERETRY3COUNTn_MASK           0xFFFFFFFF                // FRAMERETRY3COUNTn[31..0]
++#define BN0_WF_MIB_TOP_TRARC0_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x0B0) // D0B0
++#define BN0_WF_MIB_TOP_TRARC1_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x0B4) // D0B4
++#define BN0_WF_MIB_TOP_TRARC2_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x0B8) // D0B8
++#define BN0_WF_MIB_TOP_TRARC3_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x0BC) // D0BC
++#define BN0_WF_MIB_TOP_TRARC4_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x0C0) // D0C0
++#define BN0_WF_MIB_TOP_TRARC5_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x0C4) // D0C4
++#define BN0_WF_MIB_TOP_TRARC6_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x0C8) // D0C8
++#define BN0_WF_MIB_TOP_TRARC7_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x0CC) // D0CC
++
++#define BN0_WF_MIB_TOP_TRDR0_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9B4) // D9B4
++#define BN0_WF_MIB_TOP_TRDR1_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9B8) // D9B8
++#define BN0_WF_MIB_TOP_TRDR2_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9BC) // D9BC
++#define BN0_WF_MIB_TOP_TRDR3_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9C0) // D9C0
++#define BN0_WF_MIB_TOP_TRDR4_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9C4) // D9C4
++#define BN0_WF_MIB_TOP_TRDR5_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9C8) // D9C8
++#define BN0_WF_MIB_TOP_TRDR6_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9CC) // D9CC
++#define BN0_WF_MIB_TOP_TRDR7_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9D0) // D9D0
++#define BN0_WF_MIB_TOP_TRDR8_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9D4) // D9D4
++#define BN0_WF_MIB_TOP_TRDR9_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9D8) // D9D8
++#define BN0_WF_MIB_TOP_TRDR10_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x9DC) // D9DC
++#define BN0_WF_MIB_TOP_TRDR11_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x9E0) // D9E0
++#define BN0_WF_MIB_TOP_TRDR12_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x9E4) // D9E4
++#define BN0_WF_MIB_TOP_TRDR13_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x9E8) // D9E8
++#define BN0_WF_MIB_TOP_TRDR14_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x9EC) // D9EC
++#define BN0_WF_MIB_TOP_TRDR15_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x9F0) // D9F0
++
++#define BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_1_ADDR              BN0_WF_MIB_TOP_TRARC0_ADDR
++#define BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_1_MASK              0x03FF0000                // AGG_RANG_SEL_1[25..16]
++#define BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_1_SHFT              16
++#define BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_0_ADDR              BN0_WF_MIB_TOP_TRARC0_ADDR
++#define BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_0_MASK              0x000003FF                // AGG_RANG_SEL_0[9..0]
++#define BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_0_SHFT              0
++
++#define BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_3_ADDR              BN0_WF_MIB_TOP_TRARC1_ADDR
++#define BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_3_MASK              0x03FF0000                // AGG_RANG_SEL_3[25..16]
++#define BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_3_SHFT              16
++#define BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_2_ADDR              BN0_WF_MIB_TOP_TRARC1_ADDR
++#define BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_2_MASK              0x000003FF                // AGG_RANG_SEL_2[9..0]
++#define BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_2_SHFT              0
++
++#define BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_5_ADDR              BN0_WF_MIB_TOP_TRARC2_ADDR
++#define BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_5_MASK              0x03FF0000                // AGG_RANG_SEL_5[25..16]
++#define BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_5_SHFT              16
++#define BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_4_ADDR              BN0_WF_MIB_TOP_TRARC2_ADDR
++#define BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_4_MASK              0x000003FF                // AGG_RANG_SEL_4[9..0]
++#define BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_4_SHFT              0
++
++#define BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_7_ADDR              BN0_WF_MIB_TOP_TRARC3_ADDR
++#define BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_7_MASK              0x03FF0000                // AGG_RANG_SEL_7[25..16]
++#define BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_7_SHFT              16
++#define BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_6_ADDR              BN0_WF_MIB_TOP_TRARC3_ADDR
++#define BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_6_MASK              0x000003FF                // AGG_RANG_SEL_6[9..0]
++#define BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_6_SHFT              0
++
++#define BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_9_ADDR              BN0_WF_MIB_TOP_TRARC4_ADDR
++#define BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_9_MASK              0x03FF0000                // AGG_RANG_SEL_9[25..16]
++#define BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_9_SHFT              16
++#define BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_8_ADDR              BN0_WF_MIB_TOP_TRARC4_ADDR
++#define BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_8_MASK              0x000003FF                // AGG_RANG_SEL_8[9..0]
++#define BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_8_SHFT              0
++
++#define BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_11_ADDR             BN0_WF_MIB_TOP_TRARC5_ADDR
++#define BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_11_MASK             0x03FF0000                // AGG_RANG_SEL_11[25..16]
++#define BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_11_SHFT             16
++#define BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_10_ADDR             BN0_WF_MIB_TOP_TRARC5_ADDR
++#define BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_10_MASK             0x000003FF                // AGG_RANG_SEL_10[9..0]
++#define BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_10_SHFT             0
++
++#define BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_13_ADDR             BN0_WF_MIB_TOP_TRARC6_ADDR
++#define BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_13_MASK             0x03FF0000                // AGG_RANG_SEL_13[25..16]
++#define BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_13_SHFT             16
++#define BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_12_ADDR             BN0_WF_MIB_TOP_TRARC6_ADDR
++#define BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_12_MASK             0x000003FF                // AGG_RANG_SEL_12[9..0]
++#define BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_12_SHFT             0
++
++#define BN0_WF_MIB_TOP_TRARC7_AGG_RANG_SEL_14_ADDR             BN0_WF_MIB_TOP_TRARC7_ADDR
++#define BN0_WF_MIB_TOP_TRARC7_AGG_RANG_SEL_14_MASK             0x000003FF                // AGG_RANG_SEL_14[9..0]
++#define BN0_WF_MIB_TOP_TRARC7_AGG_RANG_SEL_14_SHFT             0
++
++/* RRO TOP */
++#define WF_RRO_TOP_BASE                                        0xA000 /*0x820C2000 */
++#define WF_RRO_TOP_IND_CMD_0_CTRL0_ADDR                        (WF_RRO_TOP_BASE + 0x40) // 2040
++											//
++/* WTBL */
++enum mt7996_wtbl_type {
++	WTBL_TYPE_LMAC, 	/* WTBL in LMAC */
++	WTBL_TYPE_UMAC, 	/* WTBL in UMAC */
++	WTBL_TYPE_KEY,		/* Key Table */
++	MAX_NUM_WTBL_TYPE
++};
++
++struct berse_wtbl_parse {
++	u8 *name;
++	u32 mask;
++	u32 shift;
++	u8 new_line;
++};
++
++enum muar_idx {
++	MUAR_INDEX_OWN_MAC_ADDR_0 = 0,
++	MUAR_INDEX_OWN_MAC_ADDR_1,
++	MUAR_INDEX_OWN_MAC_ADDR_2,
++	MUAR_INDEX_OWN_MAC_ADDR_3,
++	MUAR_INDEX_OWN_MAC_ADDR_4,
++	MUAR_INDEX_OWN_MAC_ADDR_BC_MC = 0xE,
++	MUAR_INDEX_UNMATCHED = 0xF,
++	MUAR_INDEX_OWN_MAC_ADDR_11 = 0x11,
++	MUAR_INDEX_OWN_MAC_ADDR_12,
++	MUAR_INDEX_OWN_MAC_ADDR_13,
++	MUAR_INDEX_OWN_MAC_ADDR_14,
++	MUAR_INDEX_OWN_MAC_ADDR_15,
++	MUAR_INDEX_OWN_MAC_ADDR_16,
++	MUAR_INDEX_OWN_MAC_ADDR_17,
++	MUAR_INDEX_OWN_MAC_ADDR_18,
++	MUAR_INDEX_OWN_MAC_ADDR_19,
++	MUAR_INDEX_OWN_MAC_ADDR_1A,
++	MUAR_INDEX_OWN_MAC_ADDR_1B,
++	MUAR_INDEX_OWN_MAC_ADDR_1C,
++	MUAR_INDEX_OWN_MAC_ADDR_1D,
++	MUAR_INDEX_OWN_MAC_ADDR_1E,
++	MUAR_INDEX_OWN_MAC_ADDR_1F,
++	MUAR_INDEX_OWN_MAC_ADDR_20,
++	MUAR_INDEX_OWN_MAC_ADDR_21,
++	MUAR_INDEX_OWN_MAC_ADDR_22,
++	MUAR_INDEX_OWN_MAC_ADDR_23,
++	MUAR_INDEX_OWN_MAC_ADDR_24,
++	MUAR_INDEX_OWN_MAC_ADDR_25,
++	MUAR_INDEX_OWN_MAC_ADDR_26,
++	MUAR_INDEX_OWN_MAC_ADDR_27,
++	MUAR_INDEX_OWN_MAC_ADDR_28,
++	MUAR_INDEX_OWN_MAC_ADDR_29,
++	MUAR_INDEX_OWN_MAC_ADDR_2A,
++	MUAR_INDEX_OWN_MAC_ADDR_2B,
++	MUAR_INDEX_OWN_MAC_ADDR_2C,
++	MUAR_INDEX_OWN_MAC_ADDR_2D,
++	MUAR_INDEX_OWN_MAC_ADDR_2E,
++	MUAR_INDEX_OWN_MAC_ADDR_2F
++};
++
++enum cipher_suit {
++	IGTK_CIPHER_SUIT_NONE = 0,
++	IGTK_CIPHER_SUIT_BIP,
++	IGTK_CIPHER_SUIT_BIP_256
++};
++
++#define LWTBL_LEN_IN_DW			36
++#define UWTBL_LEN_IN_DW			10
++
++#define MT_DBG_WTBL_BASE		0x820D8000
++
++#define MT_DBG_WTBLON_TOP_BASE		0x820d4000
++#define MT_DBG_WTBLON_TOP_WDUCR_ADDR	(MT_DBG_WTBLON_TOP_BASE + 0x0370) // 4370
++#define MT_DBG_WTBLON_TOP_WDUCR_GROUP	GENMASK(4, 0)
++
++#define MT_DBG_UWTBL_TOP_BASE		0x820c4000
++#define MT_DBG_UWTBL_TOP_WDUCR_ADDR	(MT_DBG_UWTBL_TOP_BASE + 0x0104) // 4104
++#define MT_DBG_UWTBL_TOP_WDUCR_GROUP	GENMASK(5, 0)
++#define MT_DBG_UWTBL_TOP_WDUCR_TARGET	BIT(31)
++
++#define LWTBL_IDX2BASE_ID		GENMASK(14, 8)
++#define LWTBL_IDX2BASE_DW		GENMASK(7, 2)
++#define LWTBL_IDX2BASE(_id, _dw)	(MT_DBG_WTBL_BASE | \
++					FIELD_PREP(LWTBL_IDX2BASE_ID, _id) | \
++					FIELD_PREP(LWTBL_IDX2BASE_DW, _dw))
++
++#define UWTBL_IDX2BASE_ID		GENMASK(12, 6)
++#define UWTBL_IDX2BASE_DW		GENMASK(5, 2)
++#define UWTBL_IDX2BASE(_id, _dw)	(MT_DBG_UWTBL_TOP_BASE | 0x2000 | \
++					FIELD_PREP(UWTBL_IDX2BASE_ID, _id) | \
++					FIELD_PREP(UWTBL_IDX2BASE_DW, _dw))
++
++#define KEYTBL_IDX2BASE_KEY		GENMASK(12, 6)
++#define KEYTBL_IDX2BASE_DW		GENMASK(5, 2)
++#define KEYTBL_IDX2BASE(_key, _dw)	(MT_DBG_UWTBL_TOP_BASE | 0x2000 | \
++					FIELD_PREP(KEYTBL_IDX2BASE_KEY, _key) | \
++					FIELD_PREP(KEYTBL_IDX2BASE_DW, _dw))
++
++// UMAC WTBL
++// DW0
++#define WF_UWTBL_PEER_MLD_ADDRESS_47_32__DW                         0
++#define WF_UWTBL_PEER_MLD_ADDRESS_47_32__ADDR                       0
++#define WF_UWTBL_PEER_MLD_ADDRESS_47_32__MASK                       0x0000ffff // 15- 0
++#define WF_UWTBL_PEER_MLD_ADDRESS_47_32__SHIFT                      0
++#define WF_UWTBL_OWN_MLD_ID_DW                                      0
++#define WF_UWTBL_OWN_MLD_ID_ADDR                                    0
++#define WF_UWTBL_OWN_MLD_ID_MASK                                    0x003f0000 // 21-16
++#define WF_UWTBL_OWN_MLD_ID_SHIFT                                   16
++// DW1
++#define WF_UWTBL_PEER_MLD_ADDRESS_31_0__DW                          1
++#define WF_UWTBL_PEER_MLD_ADDRESS_31_0__ADDR                        4
++#define WF_UWTBL_PEER_MLD_ADDRESS_31_0__MASK                        0xffffffff // 31- 0
++#define WF_UWTBL_PEER_MLD_ADDRESS_31_0__SHIFT                       0
++// DW2
++#define WF_UWTBL_PN_31_0__DW                                        2
++#define WF_UWTBL_PN_31_0__ADDR                                      8
++#define WF_UWTBL_PN_31_0__MASK                                      0xffffffff // 31- 0
++#define WF_UWTBL_PN_31_0__SHIFT                                     0
++// DW3
++#define WF_UWTBL_PN_47_32__DW                                       3
++#define WF_UWTBL_PN_47_32__ADDR                                     12
++#define WF_UWTBL_PN_47_32__MASK                                     0x0000ffff // 15- 0
++#define WF_UWTBL_PN_47_32__SHIFT                                    0
++#define WF_UWTBL_COM_SN_DW                                          3
++#define WF_UWTBL_COM_SN_ADDR                                        12
++#define WF_UWTBL_COM_SN_MASK                                        0x0fff0000 // 27-16
++#define WF_UWTBL_COM_SN_SHIFT                                       16
++// DW4
++#define WF_UWTBL_TID0_SN_DW                                         4
++#define WF_UWTBL_TID0_SN_ADDR                                       16
++#define WF_UWTBL_TID0_SN_MASK                                       0x00000fff // 11- 0
++#define WF_UWTBL_TID0_SN_SHIFT                                      0
++#define WF_UWTBL_RX_BIPN_31_0__DW                                   4
++#define WF_UWTBL_RX_BIPN_31_0__ADDR                                 16
++#define WF_UWTBL_RX_BIPN_31_0__MASK                                 0xffffffff // 31- 0
++#define WF_UWTBL_RX_BIPN_31_0__SHIFT                                0
++#define WF_UWTBL_TID1_SN_DW                                         4
++#define WF_UWTBL_TID1_SN_ADDR                                       16
++#define WF_UWTBL_TID1_SN_MASK                                       0x00fff000 // 23-12
++#define WF_UWTBL_TID1_SN_SHIFT                                      12
++#define WF_UWTBL_TID2_SN_7_0__DW                                    4
++#define WF_UWTBL_TID2_SN_7_0__ADDR                                  16
++#define WF_UWTBL_TID2_SN_7_0__MASK                                  0xff000000 // 31-24
++#define WF_UWTBL_TID2_SN_7_0__SHIFT                                 24
++// DW5
++#define WF_UWTBL_TID2_SN_11_8__DW                                   5
++#define WF_UWTBL_TID2_SN_11_8__ADDR                                 20
++#define WF_UWTBL_TID2_SN_11_8__MASK                                 0x0000000f //  3- 0
++#define WF_UWTBL_TID2_SN_11_8__SHIFT                                0
++#define WF_UWTBL_RX_BIPN_47_32__DW                                  5
++#define WF_UWTBL_RX_BIPN_47_32__ADDR                                20
++#define WF_UWTBL_RX_BIPN_47_32__MASK                                0x0000ffff // 15- 0
++#define WF_UWTBL_RX_BIPN_47_32__SHIFT                               0
++#define WF_UWTBL_TID3_SN_DW                                         5
++#define WF_UWTBL_TID3_SN_ADDR                                       20
++#define WF_UWTBL_TID3_SN_MASK                                       0x0000fff0 // 15- 4
++#define WF_UWTBL_TID3_SN_SHIFT                                      4
++#define WF_UWTBL_TID4_SN_DW                                         5
++#define WF_UWTBL_TID4_SN_ADDR                                       20
++#define WF_UWTBL_TID4_SN_MASK                                       0x0fff0000 // 27-16
++#define WF_UWTBL_TID4_SN_SHIFT                                      16
++#define WF_UWTBL_TID5_SN_3_0__DW                                    5
++#define WF_UWTBL_TID5_SN_3_0__ADDR                                  20
++#define WF_UWTBL_TID5_SN_3_0__MASK                                  0xf0000000 // 31-28
++#define WF_UWTBL_TID5_SN_3_0__SHIFT                                 28
++// DW6
++#define WF_UWTBL_TID5_SN_11_4__DW                                   6
++#define WF_UWTBL_TID5_SN_11_4__ADDR                                 24
++#define WF_UWTBL_TID5_SN_11_4__MASK                                 0x000000ff //  7- 0
++#define WF_UWTBL_TID5_SN_11_4__SHIFT                                0
++#define WF_UWTBL_KEY_LOC2_DW                                        6
++#define WF_UWTBL_KEY_LOC2_ADDR                                      24
++#define WF_UWTBL_KEY_LOC2_MASK                                      0x00001fff // 12- 0
++#define WF_UWTBL_KEY_LOC2_SHIFT                                     0
++#define WF_UWTBL_TID6_SN_DW                                         6
++#define WF_UWTBL_TID6_SN_ADDR                                       24
++#define WF_UWTBL_TID6_SN_MASK                                       0x000fff00 // 19- 8
++#define WF_UWTBL_TID6_SN_SHIFT                                      8
++#define WF_UWTBL_TID7_SN_DW                                         6
++#define WF_UWTBL_TID7_SN_ADDR                                       24
++#define WF_UWTBL_TID7_SN_MASK                                       0xfff00000 // 31-20
++#define WF_UWTBL_TID7_SN_SHIFT                                      20
++// DW7
++#define WF_UWTBL_KEY_LOC0_DW                                        7
++#define WF_UWTBL_KEY_LOC0_ADDR                                      28
++#define WF_UWTBL_KEY_LOC0_MASK                                      0x00001fff // 12- 0
++#define WF_UWTBL_KEY_LOC0_SHIFT                                     0
++#define WF_UWTBL_KEY_LOC1_DW                                        7
++#define WF_UWTBL_KEY_LOC1_ADDR                                      28
++#define WF_UWTBL_KEY_LOC1_MASK                                      0x1fff0000 // 28-16
++#define WF_UWTBL_KEY_LOC1_SHIFT                                     16
++// DW8
++#define WF_UWTBL_AMSDU_CFG_DW                                       8
++#define WF_UWTBL_AMSDU_CFG_ADDR                                     32
++#define WF_UWTBL_AMSDU_CFG_MASK                                     0x00000fff // 11- 0
++#define WF_UWTBL_AMSDU_CFG_SHIFT                                    0
++#define WF_UWTBL_WMM_Q_DW                                           8
++#define WF_UWTBL_WMM_Q_ADDR                                         32
++#define WF_UWTBL_WMM_Q_MASK                                         0x06000000 // 26-25
++#define WF_UWTBL_WMM_Q_SHIFT                                        25
++#define WF_UWTBL_QOS_DW                                             8
++#define WF_UWTBL_QOS_ADDR                                           32
++#define WF_UWTBL_QOS_MASK                                           0x08000000 // 27-27
++#define WF_UWTBL_QOS_SHIFT                                          27
++#define WF_UWTBL_HT_DW                                              8
++#define WF_UWTBL_HT_ADDR                                            32
++#define WF_UWTBL_HT_MASK                                            0x10000000 // 28-28
++#define WF_UWTBL_HT_SHIFT                                           28
++#define WF_UWTBL_HDRT_MODE_DW                                       8
++#define WF_UWTBL_HDRT_MODE_ADDR                                     32
++#define WF_UWTBL_HDRT_MODE_MASK                                     0x20000000 // 29-29
++#define WF_UWTBL_HDRT_MODE_SHIFT                                    29
++// DW9
++#define WF_UWTBL_RELATED_IDX0_DW                                    9
++#define WF_UWTBL_RELATED_IDX0_ADDR                                  36
++#define WF_UWTBL_RELATED_IDX0_MASK                                  0x00000fff // 11- 0
++#define WF_UWTBL_RELATED_IDX0_SHIFT                                 0
++#define WF_UWTBL_RELATED_BAND0_DW                                   9
++#define WF_UWTBL_RELATED_BAND0_ADDR                                 36
++#define WF_UWTBL_RELATED_BAND0_MASK                                 0x00003000 // 13-12
++#define WF_UWTBL_RELATED_BAND0_SHIFT                                12
++#define WF_UWTBL_PRIMARY_MLD_BAND_DW                                9
++#define WF_UWTBL_PRIMARY_MLD_BAND_ADDR                              36
++#define WF_UWTBL_PRIMARY_MLD_BAND_MASK                              0x0000c000 // 15-14
++#define WF_UWTBL_PRIMARY_MLD_BAND_SHIFT                             14
++#define WF_UWTBL_RELATED_IDX1_DW                                    9
++#define WF_UWTBL_RELATED_IDX1_ADDR                                  36
++#define WF_UWTBL_RELATED_IDX1_MASK                                  0x0fff0000 // 27-16
++#define WF_UWTBL_RELATED_IDX1_SHIFT                                 16
++#define WF_UWTBL_RELATED_BAND1_DW                                   9
++#define WF_UWTBL_RELATED_BAND1_ADDR                                 36
++#define WF_UWTBL_RELATED_BAND1_MASK                                 0x30000000 // 29-28
++#define WF_UWTBL_RELATED_BAND1_SHIFT                                28
++#define WF_UWTBL_SECONDARY_MLD_BAND_DW                              9
++#define WF_UWTBL_SECONDARY_MLD_BAND_ADDR                            36
++#define WF_UWTBL_SECONDARY_MLD_BAND_MASK                            0xc0000000 // 31-30
++#define WF_UWTBL_SECONDARY_MLD_BAND_SHIFT                           30
++
++/* LMAC WTBL */
++// DW0
++#define WF_LWTBL_PEER_LINK_ADDRESS_47_32__DW                        0
++#define WF_LWTBL_PEER_LINK_ADDRESS_47_32__ADDR                      0
++#define WF_LWTBL_PEER_LINK_ADDRESS_47_32__MASK \
++	0x0000ffff // 15- 0
++#define WF_LWTBL_PEER_LINK_ADDRESS_47_32__SHIFT                     0
++#define WF_LWTBL_MUAR_DW                                            0
++#define WF_LWTBL_MUAR_ADDR                                          0
++#define WF_LWTBL_MUAR_MASK \
++	0x003f0000 // 21-16
++#define WF_LWTBL_MUAR_SHIFT                                         16
++#define WF_LWTBL_RCA1_DW                                            0
++#define WF_LWTBL_RCA1_ADDR                                          0
++#define WF_LWTBL_RCA1_MASK \
++	0x00400000 // 22-22
++#define WF_LWTBL_RCA1_SHIFT                                         22
++#define WF_LWTBL_KID_DW                                             0
++#define WF_LWTBL_KID_ADDR                                           0
++#define WF_LWTBL_KID_MASK \
++	0x01800000 // 24-23
++#define WF_LWTBL_KID_SHIFT                                          23
++#define WF_LWTBL_RCID_DW                                            0
++#define WF_LWTBL_RCID_ADDR                                          0
++#define WF_LWTBL_RCID_MASK \
++	0x02000000 // 25-25
++#define WF_LWTBL_RCID_SHIFT                                         25
++#define WF_LWTBL_BAND_DW                                            0
++#define WF_LWTBL_BAND_ADDR                                          0
++#define WF_LWTBL_BAND_MASK \
++	0x0c000000 // 27-26
++#define WF_LWTBL_BAND_SHIFT                                         26
++#define WF_LWTBL_RV_DW                                              0
++#define WF_LWTBL_RV_ADDR                                            0
++#define WF_LWTBL_RV_MASK \
++	0x10000000 // 28-28
++#define WF_LWTBL_RV_SHIFT                                           28
++#define WF_LWTBL_RCA2_DW                                            0
++#define WF_LWTBL_RCA2_ADDR                                          0
++#define WF_LWTBL_RCA2_MASK \
++	0x20000000 // 29-29
++#define WF_LWTBL_RCA2_SHIFT                                         29
++#define WF_LWTBL_WPI_FLAG_DW                                        0
++#define WF_LWTBL_WPI_FLAG_ADDR                                      0
++#define WF_LWTBL_WPI_FLAG_MASK \
++	0x40000000 // 30-30
++#define WF_LWTBL_WPI_FLAG_SHIFT                                     30
++// DW1
++#define WF_LWTBL_PEER_LINK_ADDRESS_31_0__DW                         1
++#define WF_LWTBL_PEER_LINK_ADDRESS_31_0__ADDR                       4
++#define WF_LWTBL_PEER_LINK_ADDRESS_31_0__MASK \
++	0xffffffff // 31- 0
++#define WF_LWTBL_PEER_LINK_ADDRESS_31_0__SHIFT                      0
++// DW2
++#define WF_LWTBL_AID_DW                                             2
++#define WF_LWTBL_AID_ADDR                                           8
++#define WF_LWTBL_AID_MASK \
++	0x00000fff // 11- 0
++#define WF_LWTBL_AID_SHIFT                                          0
++#define WF_LWTBL_GID_SU_DW                                          2
++#define WF_LWTBL_GID_SU_ADDR                                        8
++#define WF_LWTBL_GID_SU_MASK \
++	0x00001000 // 12-12
++#define WF_LWTBL_GID_SU_SHIFT                                       12
++#define WF_LWTBL_SPP_EN_DW                                          2
++#define WF_LWTBL_SPP_EN_ADDR                                        8
++#define WF_LWTBL_SPP_EN_MASK \
++	0x00002000 // 13-13
++#define WF_LWTBL_SPP_EN_SHIFT                                       13
++#define WF_LWTBL_WPI_EVEN_DW                                        2
++#define WF_LWTBL_WPI_EVEN_ADDR                                      8
++#define WF_LWTBL_WPI_EVEN_MASK \
++	0x00004000 // 14-14
++#define WF_LWTBL_WPI_EVEN_SHIFT                                     14
++#define WF_LWTBL_AAD_OM_DW                                          2
++#define WF_LWTBL_AAD_OM_ADDR                                        8
++#define WF_LWTBL_AAD_OM_MASK \
++	0x00008000 // 15-15
++#define WF_LWTBL_AAD_OM_SHIFT                                       15
++#define WF_LWTBL_CIPHER_SUIT_PGTK_DW                                2
++#define WF_LWTBL_CIPHER_SUIT_PGTK_ADDR                              8
++#define WF_LWTBL_CIPHER_SUIT_PGTK_MASK \
++	0x001f0000 // 20-16
++#define WF_LWTBL_CIPHER_SUIT_PGTK_SHIFT                             16
++#define WF_LWTBL_FD_DW                                              2
++#define WF_LWTBL_FD_ADDR                                            8
++#define WF_LWTBL_FD_MASK \
++	0x00200000 // 21-21
++#define WF_LWTBL_FD_SHIFT                                           21
++#define WF_LWTBL_TD_DW                                              2
++#define WF_LWTBL_TD_ADDR                                            8
++#define WF_LWTBL_TD_MASK \
++	0x00400000 // 22-22
++#define WF_LWTBL_TD_SHIFT                                           22
++#define WF_LWTBL_SW_DW                                              2
++#define WF_LWTBL_SW_ADDR                                            8
++#define WF_LWTBL_SW_MASK \
++	0x00800000 // 23-23
++#define WF_LWTBL_SW_SHIFT                                           23
++#define WF_LWTBL_UL_DW                                              2
++#define WF_LWTBL_UL_ADDR                                            8
++#define WF_LWTBL_UL_MASK \
++	0x01000000 // 24-24
++#define WF_LWTBL_UL_SHIFT                                           24
++#define WF_LWTBL_TX_PS_DW                                           2
++#define WF_LWTBL_TX_PS_ADDR                                         8
++#define WF_LWTBL_TX_PS_MASK \
++	0x02000000 // 25-25
++#define WF_LWTBL_TX_PS_SHIFT                                        25
++#define WF_LWTBL_QOS_DW                                             2
++#define WF_LWTBL_QOS_ADDR                                           8
++#define WF_LWTBL_QOS_MASK \
++	0x04000000 // 26-26
++#define WF_LWTBL_QOS_SHIFT                                          26
++#define WF_LWTBL_HT_DW                                              2
++#define WF_LWTBL_HT_ADDR                                            8
++#define WF_LWTBL_HT_MASK \
++	0x08000000 // 27-27
++#define WF_LWTBL_HT_SHIFT                                           27
++#define WF_LWTBL_VHT_DW                                             2
++#define WF_LWTBL_VHT_ADDR                                           8
++#define WF_LWTBL_VHT_MASK \
++	0x10000000 // 28-28
++#define WF_LWTBL_VHT_SHIFT                                          28
++#define WF_LWTBL_HE_DW                                              2
++#define WF_LWTBL_HE_ADDR                                            8
++#define WF_LWTBL_HE_MASK \
++	0x20000000 // 29-29
++#define WF_LWTBL_HE_SHIFT                                           29
++#define WF_LWTBL_EHT_DW                                             2
++#define WF_LWTBL_EHT_ADDR                                           8
++#define WF_LWTBL_EHT_MASK \
++	0x40000000 // 30-30
++#define WF_LWTBL_EHT_SHIFT                                          30
++#define WF_LWTBL_MESH_DW                                            2
++#define WF_LWTBL_MESH_ADDR                                          8
++#define WF_LWTBL_MESH_MASK \
++	0x80000000 // 31-31
++#define WF_LWTBL_MESH_SHIFT                                         31
++// DW3
++#define WF_LWTBL_WMM_Q_DW                                           3
++#define WF_LWTBL_WMM_Q_ADDR                                         12
++#define WF_LWTBL_WMM_Q_MASK \
++	0x00000003 // 1- 0
++#define WF_LWTBL_WMM_Q_SHIFT                                        0
++#define WF_LWTBL_EHT_SIG_MCS_DW                                     3
++#define WF_LWTBL_EHT_SIG_MCS_ADDR                                   12
++#define WF_LWTBL_EHT_SIG_MCS_MASK \
++	0x0000000c // 3- 2
++#define WF_LWTBL_EHT_SIG_MCS_SHIFT                                  2
++#define WF_LWTBL_HDRT_MODE_DW                                       3
++#define WF_LWTBL_HDRT_MODE_ADDR                                     12
++#define WF_LWTBL_HDRT_MODE_MASK \
++	0x00000010 // 4- 4
++#define WF_LWTBL_HDRT_MODE_SHIFT                                    4
++#define WF_LWTBL_BEAM_CHG_DW                                        3
++#define WF_LWTBL_BEAM_CHG_ADDR                                      12
++#define WF_LWTBL_BEAM_CHG_MASK \
++	0x00000020 // 5- 5
++#define WF_LWTBL_BEAM_CHG_SHIFT                                     5
++#define WF_LWTBL_EHT_LTF_SYM_NUM_OPT_DW                             3
++#define WF_LWTBL_EHT_LTF_SYM_NUM_OPT_ADDR                           12
++#define WF_LWTBL_EHT_LTF_SYM_NUM_OPT_MASK \
++	0x000000c0 // 7- 6
++#define WF_LWTBL_EHT_LTF_SYM_NUM_OPT_SHIFT                          6
++#define WF_LWTBL_PFMU_IDX_DW                                        3
++#define WF_LWTBL_PFMU_IDX_ADDR                                      12
++#define WF_LWTBL_PFMU_IDX_MASK \
++	0x0000ff00 // 15- 8
++#define WF_LWTBL_PFMU_IDX_SHIFT                                     8
++#define WF_LWTBL_ULPF_IDX_DW                                        3
++#define WF_LWTBL_ULPF_IDX_ADDR                                      12
++#define WF_LWTBL_ULPF_IDX_MASK \
++	0x00ff0000 // 23-16
++#define WF_LWTBL_ULPF_IDX_SHIFT                                     16
++#define WF_LWTBL_RIBF_DW                                            3
++#define WF_LWTBL_RIBF_ADDR                                          12
++#define WF_LWTBL_RIBF_MASK \
++	0x01000000 // 24-24
++#define WF_LWTBL_RIBF_SHIFT                                         24
++#define WF_LWTBL_ULPF_DW                                            3
++#define WF_LWTBL_ULPF_ADDR                                          12
++#define WF_LWTBL_ULPF_MASK \
++	0x02000000 // 25-25
++#define WF_LWTBL_ULPF_SHIFT                                         25
++#define WF_LWTBL_TBF_HT_DW                                          3
++#define WF_LWTBL_TBF_HT_ADDR                                        12
++#define WF_LWTBL_TBF_HT_MASK \
++	0x08000000 // 27-27
++#define WF_LWTBL_TBF_HT_SHIFT                                       27
++#define WF_LWTBL_TBF_VHT_DW                                         3
++#define WF_LWTBL_TBF_VHT_ADDR                                       12
++#define WF_LWTBL_TBF_VHT_MASK \
++	0x10000000 // 28-28
++#define WF_LWTBL_TBF_VHT_SHIFT                                      28
++#define WF_LWTBL_TBF_HE_DW                                          3
++#define WF_LWTBL_TBF_HE_ADDR                                        12
++#define WF_LWTBL_TBF_HE_MASK \
++	0x20000000 // 29-29
++#define WF_LWTBL_TBF_HE_SHIFT                                       29
++#define WF_LWTBL_TBF_EHT_DW                                         3
++#define WF_LWTBL_TBF_EHT_ADDR                                       12
++#define WF_LWTBL_TBF_EHT_MASK \
++	0x40000000 // 30-30
++#define WF_LWTBL_TBF_EHT_SHIFT                                      30
++#define WF_LWTBL_IGN_FBK_DW                                         3
++#define WF_LWTBL_IGN_FBK_ADDR                                       12
++#define WF_LWTBL_IGN_FBK_MASK \
++	0x80000000 // 31-31
++#define WF_LWTBL_IGN_FBK_SHIFT                                      31
++// DW4
++#define WF_LWTBL_ANT_ID0_DW                                         4
++#define WF_LWTBL_ANT_ID0_ADDR                                       16
++#define WF_LWTBL_ANT_ID0_MASK \
++	0x00000007 // 2- 0
++#define WF_LWTBL_ANT_ID0_SHIFT                                      0
++#define WF_LWTBL_ANT_ID1_DW                                         4
++#define WF_LWTBL_ANT_ID1_ADDR                                       16
++#define WF_LWTBL_ANT_ID1_MASK \
++	0x00000038 // 5- 3
++#define WF_LWTBL_ANT_ID1_SHIFT                                      3
++#define WF_LWTBL_ANT_ID2_DW                                         4
++#define WF_LWTBL_ANT_ID2_ADDR                                       16
++#define WF_LWTBL_ANT_ID2_MASK \
++	0x000001c0 // 8- 6
++#define WF_LWTBL_ANT_ID2_SHIFT                                      6
++#define WF_LWTBL_ANT_ID3_DW                                         4
++#define WF_LWTBL_ANT_ID3_ADDR                                       16
++#define WF_LWTBL_ANT_ID3_MASK \
++	0x00000e00 // 11- 9
++#define WF_LWTBL_ANT_ID3_SHIFT                                      9
++#define WF_LWTBL_ANT_ID4_DW                                         4
++#define WF_LWTBL_ANT_ID4_ADDR                                       16
++#define WF_LWTBL_ANT_ID4_MASK \
++	0x00007000 // 14-12
++#define WF_LWTBL_ANT_ID4_SHIFT                                      12
++#define WF_LWTBL_ANT_ID5_DW                                         4
++#define WF_LWTBL_ANT_ID5_ADDR                                       16
++#define WF_LWTBL_ANT_ID5_MASK \
++	0x00038000 // 17-15
++#define WF_LWTBL_ANT_ID5_SHIFT                                      15
++#define WF_LWTBL_ANT_ID6_DW                                         4
++#define WF_LWTBL_ANT_ID6_ADDR                                       16
++#define WF_LWTBL_ANT_ID6_MASK \
++	0x001c0000 // 20-18
++#define WF_LWTBL_ANT_ID6_SHIFT                                      18
++#define WF_LWTBL_ANT_ID7_DW                                         4
++#define WF_LWTBL_ANT_ID7_ADDR                                       16
++#define WF_LWTBL_ANT_ID7_MASK \
++	0x00e00000 // 23-21
++#define WF_LWTBL_ANT_ID7_SHIFT                                      21
++#define WF_LWTBL_PE_DW                                              4
++#define WF_LWTBL_PE_ADDR                                            16
++#define WF_LWTBL_PE_MASK \
++	0x03000000 // 25-24
++#define WF_LWTBL_PE_SHIFT                                           24
++#define WF_LWTBL_DIS_RHTR_DW                                        4
++#define WF_LWTBL_DIS_RHTR_ADDR                                      16
++#define WF_LWTBL_DIS_RHTR_MASK \
++	0x04000000 // 26-26
++#define WF_LWTBL_DIS_RHTR_SHIFT                                     26
++#define WF_LWTBL_LDPC_HT_DW                                         4
++#define WF_LWTBL_LDPC_HT_ADDR                                       16
++#define WF_LWTBL_LDPC_HT_MASK \
++	0x08000000 // 27-27
++#define WF_LWTBL_LDPC_HT_SHIFT                                      27
++#define WF_LWTBL_LDPC_VHT_DW                                        4
++#define WF_LWTBL_LDPC_VHT_ADDR                                      16
++#define WF_LWTBL_LDPC_VHT_MASK \
++	0x10000000 // 28-28
++#define WF_LWTBL_LDPC_VHT_SHIFT                                     28
++#define WF_LWTBL_LDPC_HE_DW                                         4
++#define WF_LWTBL_LDPC_HE_ADDR                                       16
++#define WF_LWTBL_LDPC_HE_MASK \
++	0x20000000 // 29-29
++#define WF_LWTBL_LDPC_HE_SHIFT                                      29
++#define WF_LWTBL_LDPC_EHT_DW                                        4
++#define WF_LWTBL_LDPC_EHT_ADDR                                      16
++#define WF_LWTBL_LDPC_EHT_MASK \
++	0x40000000 // 30-30
++#define WF_LWTBL_LDPC_EHT_SHIFT                                     30
++// DW5
++#define WF_LWTBL_AF_DW                                              5
++#define WF_LWTBL_AF_ADDR                                            20
++#define WF_LWTBL_AF_MASK \
++	0x00000007 // 2- 0
++#define WF_LWTBL_AF_SHIFT                                           0
++#define WF_LWTBL_AF_HE_DW                                           5
++#define WF_LWTBL_AF_HE_ADDR                                         20
++#define WF_LWTBL_AF_HE_MASK \
++	0x00000018 // 4- 3
++#define WF_LWTBL_AF_HE_SHIFT                                        3
++#define WF_LWTBL_RTS_DW                                             5
++#define WF_LWTBL_RTS_ADDR                                           20
++#define WF_LWTBL_RTS_MASK \
++	0x00000020 // 5- 5
++#define WF_LWTBL_RTS_SHIFT                                          5
++#define WF_LWTBL_SMPS_DW                                            5
++#define WF_LWTBL_SMPS_ADDR                                          20
++#define WF_LWTBL_SMPS_MASK \
++	0x00000040 // 6- 6
++#define WF_LWTBL_SMPS_SHIFT                                         6
++#define WF_LWTBL_DYN_BW_DW                                          5
++#define WF_LWTBL_DYN_BW_ADDR                                        20
++#define WF_LWTBL_DYN_BW_MASK \
++	0x00000080 // 7- 7
++#define WF_LWTBL_DYN_BW_SHIFT                                       7
++#define WF_LWTBL_MMSS_DW                                            5
++#define WF_LWTBL_MMSS_ADDR                                          20
++#define WF_LWTBL_MMSS_MASK \
++	0x00000700 // 10- 8
++#define WF_LWTBL_MMSS_SHIFT                                         8
++#define WF_LWTBL_USR_DW                                             5
++#define WF_LWTBL_USR_ADDR                                           20
++#define WF_LWTBL_USR_MASK \
++	0x00000800 // 11-11
++#define WF_LWTBL_USR_SHIFT                                          11
++#define WF_LWTBL_SR_R_DW                                            5
++#define WF_LWTBL_SR_R_ADDR                                          20
++#define WF_LWTBL_SR_R_MASK \
++	0x00007000 // 14-12
++#define WF_LWTBL_SR_R_SHIFT                                         12
++#define WF_LWTBL_SR_ABORT_DW                                        5
++#define WF_LWTBL_SR_ABORT_ADDR                                      20
++#define WF_LWTBL_SR_ABORT_MASK \
++	0x00008000 // 15-15
++#define WF_LWTBL_SR_ABORT_SHIFT                                     15
++#define WF_LWTBL_TX_POWER_OFFSET_DW                                 5
++#define WF_LWTBL_TX_POWER_OFFSET_ADDR                               20
++#define WF_LWTBL_TX_POWER_OFFSET_MASK \
++	0x003f0000 // 21-16
++#define WF_LWTBL_TX_POWER_OFFSET_SHIFT                              16
++#define WF_LWTBL_LTF_EHT_DW                                         5
++#define WF_LWTBL_LTF_EHT_ADDR                                       20
++#define WF_LWTBL_LTF_EHT_MASK \
++	0x00c00000 // 23-22
++#define WF_LWTBL_LTF_EHT_SHIFT                                      22
++#define WF_LWTBL_GI_EHT_DW                                          5
++#define WF_LWTBL_GI_EHT_ADDR                                        20
++#define WF_LWTBL_GI_EHT_MASK \
++	0x03000000 // 25-24
++#define WF_LWTBL_GI_EHT_SHIFT                                       24
++#define WF_LWTBL_DOPPL_DW                                           5
++#define WF_LWTBL_DOPPL_ADDR                                         20
++#define WF_LWTBL_DOPPL_MASK \
++	0x04000000 // 26-26
++#define WF_LWTBL_DOPPL_SHIFT                                        26
++#define WF_LWTBL_TXOP_PS_CAP_DW                                     5
++#define WF_LWTBL_TXOP_PS_CAP_ADDR                                   20
++#define WF_LWTBL_TXOP_PS_CAP_MASK \
++	0x08000000 // 27-27
++#define WF_LWTBL_TXOP_PS_CAP_SHIFT                                  27
++#define WF_LWTBL_DU_I_PSM_DW                                        5
++#define WF_LWTBL_DU_I_PSM_ADDR                                      20
++#define WF_LWTBL_DU_I_PSM_MASK \
++	0x10000000 // 28-28
++#define WF_LWTBL_DU_I_PSM_SHIFT                                     28
++#define WF_LWTBL_I_PSM_DW                                           5
++#define WF_LWTBL_I_PSM_ADDR                                         20
++#define WF_LWTBL_I_PSM_MASK \
++	0x20000000 // 29-29
++#define WF_LWTBL_I_PSM_SHIFT                                        29
++#define WF_LWTBL_PSM_DW                                             5
++#define WF_LWTBL_PSM_ADDR                                           20
++#define WF_LWTBL_PSM_MASK \
++	0x40000000 // 30-30
++#define WF_LWTBL_PSM_SHIFT                                          30
++#define WF_LWTBL_SKIP_TX_DW                                         5
++#define WF_LWTBL_SKIP_TX_ADDR                                       20
++#define WF_LWTBL_SKIP_TX_MASK \
++	0x80000000 // 31-31
++#define WF_LWTBL_SKIP_TX_SHIFT                                      31
++// DW6
++#define WF_LWTBL_CBRN_DW                                            6
++#define WF_LWTBL_CBRN_ADDR                                          24
++#define WF_LWTBL_CBRN_MASK \
++	0x00000007 // 2- 0
++#define WF_LWTBL_CBRN_SHIFT                                         0
++#define WF_LWTBL_DBNSS_EN_DW                                        6
++#define WF_LWTBL_DBNSS_EN_ADDR                                      24
++#define WF_LWTBL_DBNSS_EN_MASK \
++	0x00000008 // 3- 3
++#define WF_LWTBL_DBNSS_EN_SHIFT                                     3
++#define WF_LWTBL_BAF_EN_DW                                          6
++#define WF_LWTBL_BAF_EN_ADDR                                        24
++#define WF_LWTBL_BAF_EN_MASK \
++	0x00000010 // 4- 4
++#define WF_LWTBL_BAF_EN_SHIFT                                       4
++#define WF_LWTBL_RDGBA_DW                                           6
++#define WF_LWTBL_RDGBA_ADDR                                         24
++#define WF_LWTBL_RDGBA_MASK \
++	0x00000020 // 5- 5
++#define WF_LWTBL_RDGBA_SHIFT                                        5
++#define WF_LWTBL_R_DW                                               6
++#define WF_LWTBL_R_ADDR                                             24
++#define WF_LWTBL_R_MASK \
++	0x00000040 // 6- 6
++#define WF_LWTBL_R_SHIFT                                            6
++#define WF_LWTBL_SPE_IDX_DW                                         6
++#define WF_LWTBL_SPE_IDX_ADDR                                       24
++#define WF_LWTBL_SPE_IDX_MASK \
++	0x00000f80 // 11- 7
++#define WF_LWTBL_SPE_IDX_SHIFT                                      7
++#define WF_LWTBL_G2_DW                                              6
++#define WF_LWTBL_G2_ADDR                                            24
++#define WF_LWTBL_G2_MASK \
++	0x00001000 // 12-12
++#define WF_LWTBL_G2_SHIFT                                           12
++#define WF_LWTBL_G4_DW                                              6
++#define WF_LWTBL_G4_ADDR                                            24
++#define WF_LWTBL_G4_MASK \
++	0x00002000 // 13-13
++#define WF_LWTBL_G4_SHIFT                                           13
++#define WF_LWTBL_G8_DW                                              6
++#define WF_LWTBL_G8_ADDR                                            24
++#define WF_LWTBL_G8_MASK \
++	0x00004000 // 14-14
++#define WF_LWTBL_G8_SHIFT                                           14
++#define WF_LWTBL_G16_DW                                             6
++#define WF_LWTBL_G16_ADDR                                           24
++#define WF_LWTBL_G16_MASK \
++	0x00008000 // 15-15
++#define WF_LWTBL_G16_SHIFT                                          15
++#define WF_LWTBL_G2_LTF_DW                                          6
++#define WF_LWTBL_G2_LTF_ADDR                                        24
++#define WF_LWTBL_G2_LTF_MASK \
++	0x00030000 // 17-16
++#define WF_LWTBL_G2_LTF_SHIFT                                       16
++#define WF_LWTBL_G4_LTF_DW                                          6
++#define WF_LWTBL_G4_LTF_ADDR                                        24
++#define WF_LWTBL_G4_LTF_MASK \
++	0x000c0000 // 19-18
++#define WF_LWTBL_G4_LTF_SHIFT                                       18
++#define WF_LWTBL_G8_LTF_DW                                          6
++#define WF_LWTBL_G8_LTF_ADDR                                        24
++#define WF_LWTBL_G8_LTF_MASK \
++	0x00300000 // 21-20
++#define WF_LWTBL_G8_LTF_SHIFT                                       20
++#define WF_LWTBL_G16_LTF_DW                                         6
++#define WF_LWTBL_G16_LTF_ADDR                                       24
++#define WF_LWTBL_G16_LTF_MASK \
++	0x00c00000 // 23-22
++#define WF_LWTBL_G16_LTF_SHIFT                                      22
++#define WF_LWTBL_G2_HE_DW                                           6
++#define WF_LWTBL_G2_HE_ADDR                                         24
++#define WF_LWTBL_G2_HE_MASK \
++	0x03000000 // 25-24
++#define WF_LWTBL_G2_HE_SHIFT                                        24
++#define WF_LWTBL_G4_HE_DW                                           6
++#define WF_LWTBL_G4_HE_ADDR                                         24
++#define WF_LWTBL_G4_HE_MASK \
++	0x0c000000 // 27-26
++#define WF_LWTBL_G4_HE_SHIFT                                        26
++#define WF_LWTBL_G8_HE_DW                                           6
++#define WF_LWTBL_G8_HE_ADDR                                         24
++#define WF_LWTBL_G8_HE_MASK \
++	0x30000000 // 29-28
++#define WF_LWTBL_G8_HE_SHIFT                                        28
++#define WF_LWTBL_G16_HE_DW                                          6
++#define WF_LWTBL_G16_HE_ADDR                                        24
++#define WF_LWTBL_G16_HE_MASK \
++	0xc0000000 // 31-30
++#define WF_LWTBL_G16_HE_SHIFT                                       30
++// DW7
++#define WF_LWTBL_BA_WIN_SIZE0_DW                                    7
++#define WF_LWTBL_BA_WIN_SIZE0_ADDR                                  28
++#define WF_LWTBL_BA_WIN_SIZE0_MASK \
++	0x0000000f // 3- 0
++#define WF_LWTBL_BA_WIN_SIZE0_SHIFT                                 0
++#define WF_LWTBL_BA_WIN_SIZE1_DW                                    7
++#define WF_LWTBL_BA_WIN_SIZE1_ADDR                                  28
++#define WF_LWTBL_BA_WIN_SIZE1_MASK \
++	0x000000f0 // 7- 4
++#define WF_LWTBL_BA_WIN_SIZE1_SHIFT                                 4
++#define WF_LWTBL_BA_WIN_SIZE2_DW                                    7
++#define WF_LWTBL_BA_WIN_SIZE2_ADDR                                  28
++#define WF_LWTBL_BA_WIN_SIZE2_MASK \
++	0x00000f00 // 11- 8
++#define WF_LWTBL_BA_WIN_SIZE2_SHIFT                                 8
++#define WF_LWTBL_BA_WIN_SIZE3_DW                                    7
++#define WF_LWTBL_BA_WIN_SIZE3_ADDR                                  28
++#define WF_LWTBL_BA_WIN_SIZE3_MASK \
++	0x0000f000 // 15-12
++#define WF_LWTBL_BA_WIN_SIZE3_SHIFT                                 12
++#define WF_LWTBL_BA_WIN_SIZE4_DW                                    7
++#define WF_LWTBL_BA_WIN_SIZE4_ADDR                                  28
++#define WF_LWTBL_BA_WIN_SIZE4_MASK \
++	0x000f0000 // 19-16
++#define WF_LWTBL_BA_WIN_SIZE4_SHIFT                                 16
++#define WF_LWTBL_BA_WIN_SIZE5_DW                                    7
++#define WF_LWTBL_BA_WIN_SIZE5_ADDR                                  28
++#define WF_LWTBL_BA_WIN_SIZE5_MASK \
++	0x00f00000 // 23-20
++#define WF_LWTBL_BA_WIN_SIZE5_SHIFT                                 20
++#define WF_LWTBL_BA_WIN_SIZE6_DW                                    7
++#define WF_LWTBL_BA_WIN_SIZE6_ADDR                                  28
++#define WF_LWTBL_BA_WIN_SIZE6_MASK \
++	0x0f000000 // 27-24
++#define WF_LWTBL_BA_WIN_SIZE6_SHIFT                                 24
++#define WF_LWTBL_BA_WIN_SIZE7_DW                                    7
++#define WF_LWTBL_BA_WIN_SIZE7_ADDR                                  28
++#define WF_LWTBL_BA_WIN_SIZE7_MASK \
++	0xf0000000 // 31-28
++#define WF_LWTBL_BA_WIN_SIZE7_SHIFT                                 28
++// DW8
++#define WF_LWTBL_AC0_RTS_FAIL_CNT_DW                                8
++#define WF_LWTBL_AC0_RTS_FAIL_CNT_ADDR                              32
++#define WF_LWTBL_AC0_RTS_FAIL_CNT_MASK \
++	0x0000001f // 4- 0
++#define WF_LWTBL_AC0_RTS_FAIL_CNT_SHIFT                             0
++#define WF_LWTBL_AC1_RTS_FAIL_CNT_DW                                8
++#define WF_LWTBL_AC1_RTS_FAIL_CNT_ADDR                              32
++#define WF_LWTBL_AC1_RTS_FAIL_CNT_MASK \
++	0x000003e0 // 9- 5
++#define WF_LWTBL_AC1_RTS_FAIL_CNT_SHIFT                             5
++#define WF_LWTBL_AC2_RTS_FAIL_CNT_DW                                8
++#define WF_LWTBL_AC2_RTS_FAIL_CNT_ADDR                              32
++#define WF_LWTBL_AC2_RTS_FAIL_CNT_MASK \
++	0x00007c00 // 14-10
++#define WF_LWTBL_AC2_RTS_FAIL_CNT_SHIFT                             10
++#define WF_LWTBL_AC3_RTS_FAIL_CNT_DW                                8
++#define WF_LWTBL_AC3_RTS_FAIL_CNT_ADDR                              32
++#define WF_LWTBL_AC3_RTS_FAIL_CNT_MASK \
++	0x000f8000 // 19-15
++#define WF_LWTBL_AC3_RTS_FAIL_CNT_SHIFT                             15
++#define WF_LWTBL_PARTIAL_AID_DW                                     8
++#define WF_LWTBL_PARTIAL_AID_ADDR                                   32
++#define WF_LWTBL_PARTIAL_AID_MASK \
++	0x1ff00000 // 28-20
++#define WF_LWTBL_PARTIAL_AID_SHIFT                                  20
++#define WF_LWTBL_CHK_PER_DW                                         8
++#define WF_LWTBL_CHK_PER_ADDR                                       32
++#define WF_LWTBL_CHK_PER_MASK \
++	0x80000000 // 31-31
++#define WF_LWTBL_CHK_PER_SHIFT                                      31
++// DW9
++#define WF_LWTBL_RX_AVG_MPDU_SIZE_DW                                9
++#define WF_LWTBL_RX_AVG_MPDU_SIZE_ADDR                              36
++#define WF_LWTBL_RX_AVG_MPDU_SIZE_MASK \
++	0x00003fff // 13- 0
++#define WF_LWTBL_RX_AVG_MPDU_SIZE_SHIFT                             0
++#define WF_LWTBL_PRITX_SW_MODE_DW                                   9
++#define WF_LWTBL_PRITX_SW_MODE_ADDR                                 36
++#define WF_LWTBL_PRITX_SW_MODE_MASK \
++	0x00008000 // 15-15
++#define WF_LWTBL_PRITX_SW_MODE_SHIFT                                15
++#define WF_LWTBL_PRITX_ERSU_DW                                      9
++#define WF_LWTBL_PRITX_ERSU_ADDR                                    36
++#define WF_LWTBL_PRITX_ERSU_MASK \
++	0x00010000 // 16-16
++#define WF_LWTBL_PRITX_ERSU_SHIFT                                   16
++#define WF_LWTBL_PRITX_PLR_DW                                       9
++#define WF_LWTBL_PRITX_PLR_ADDR                                     36
++#define WF_LWTBL_PRITX_PLR_MASK \
++	0x00020000 // 17-17
++#define WF_LWTBL_PRITX_PLR_SHIFT                                    17
++#define WF_LWTBL_PRITX_DCM_DW                                       9
++#define WF_LWTBL_PRITX_DCM_ADDR                                     36
++#define WF_LWTBL_PRITX_DCM_MASK \
++	0x00040000 // 18-18
++#define WF_LWTBL_PRITX_DCM_SHIFT                                    18
++#define WF_LWTBL_PRITX_ER106T_DW                                    9
++#define WF_LWTBL_PRITX_ER106T_ADDR                                  36
++#define WF_LWTBL_PRITX_ER106T_MASK \
++	0x00080000 // 19-19
++#define WF_LWTBL_PRITX_ER106T_SHIFT                                 19
++#define WF_LWTBL_FCAP_DW                                            9
++#define WF_LWTBL_FCAP_ADDR                                          36
++#define WF_LWTBL_FCAP_MASK \
++	0x00700000 // 22-20
++#define WF_LWTBL_FCAP_SHIFT                                         20
++#define WF_LWTBL_MPDU_FAIL_CNT_DW                                   9
++#define WF_LWTBL_MPDU_FAIL_CNT_ADDR                                 36
++#define WF_LWTBL_MPDU_FAIL_CNT_MASK \
++	0x03800000 // 25-23
++#define WF_LWTBL_MPDU_FAIL_CNT_SHIFT                                23
++#define WF_LWTBL_MPDU_OK_CNT_DW                                     9
++#define WF_LWTBL_MPDU_OK_CNT_ADDR                                   36
++#define WF_LWTBL_MPDU_OK_CNT_MASK \
++	0x1c000000 // 28-26
++#define WF_LWTBL_MPDU_OK_CNT_SHIFT                                  26
++#define WF_LWTBL_RATE_IDX_DW                                        9
++#define WF_LWTBL_RATE_IDX_ADDR                                      36
++#define WF_LWTBL_RATE_IDX_MASK \
++	0xe0000000 // 31-29
++#define WF_LWTBL_RATE_IDX_SHIFT                                     29
++// DW10
++#define WF_LWTBL_RATE1_DW                                           10
++#define WF_LWTBL_RATE1_ADDR                                         40
++#define WF_LWTBL_RATE1_MASK \
++	0x00007fff // 14- 0
++#define WF_LWTBL_RATE1_SHIFT                                        0
++#define WF_LWTBL_RATE2_DW                                           10
++#define WF_LWTBL_RATE2_ADDR                                         40
++#define WF_LWTBL_RATE2_MASK \
++	0x7fff0000 // 30-16
++#define WF_LWTBL_RATE2_SHIFT                                        16
++// DW11
++#define WF_LWTBL_RATE3_DW                                           11
++#define WF_LWTBL_RATE3_ADDR                                         44
++#define WF_LWTBL_RATE3_MASK \
++	0x00007fff // 14- 0
++#define WF_LWTBL_RATE3_SHIFT                                        0
++#define WF_LWTBL_RATE4_DW                                           11
++#define WF_LWTBL_RATE4_ADDR                                         44
++#define WF_LWTBL_RATE4_MASK \
++	0x7fff0000 // 30-16
++#define WF_LWTBL_RATE4_SHIFT                                        16
++// DW12
++#define WF_LWTBL_RATE5_DW                                           12
++#define WF_LWTBL_RATE5_ADDR                                         48
++#define WF_LWTBL_RATE5_MASK \
++	0x00007fff // 14- 0
++#define WF_LWTBL_RATE5_SHIFT                                        0
++#define WF_LWTBL_RATE6_DW                                           12
++#define WF_LWTBL_RATE6_ADDR                                         48
++#define WF_LWTBL_RATE6_MASK \
++	0x7fff0000 // 30-16
++#define WF_LWTBL_RATE6_SHIFT                                        16
++// DW13
++#define WF_LWTBL_RATE7_DW                                           13
++#define WF_LWTBL_RATE7_ADDR                                         52
++#define WF_LWTBL_RATE7_MASK \
++	0x00007fff // 14- 0
++#define WF_LWTBL_RATE7_SHIFT                                        0
++#define WF_LWTBL_RATE8_DW                                           13
++#define WF_LWTBL_RATE8_ADDR                                         52
++#define WF_LWTBL_RATE8_MASK \
++	0x7fff0000 // 30-16
++#define WF_LWTBL_RATE8_SHIFT                                        16
++// DW14
++#define WF_LWTBL_RATE1_TX_CNT_DW                                    14
++#define WF_LWTBL_RATE1_TX_CNT_ADDR                                  56
++#define WF_LWTBL_RATE1_TX_CNT_MASK \
++	0x0000ffff // 15- 0
++#define WF_LWTBL_RATE1_TX_CNT_SHIFT                                 0
++#define WF_LWTBL_CIPHER_SUIT_IGTK_DW                                14
++#define WF_LWTBL_CIPHER_SUIT_IGTK_ADDR                              56
++#define WF_LWTBL_CIPHER_SUIT_IGTK_MASK \
++	0x00003000 // 13-12
++#define WF_LWTBL_CIPHER_SUIT_IGTK_SHIFT                             12
++#define WF_LWTBL_CIPHER_SUIT_BIGTK_DW                               14
++#define WF_LWTBL_CIPHER_SUIT_BIGTK_ADDR                             56
++#define WF_LWTBL_CIPHER_SUIT_BIGTK_MASK \
++	0x0000c000 // 15-14
++#define WF_LWTBL_CIPHER_SUIT_BIGTK_SHIFT                            14
++#define WF_LWTBL_RATE1_FAIL_CNT_DW                                  14
++#define WF_LWTBL_RATE1_FAIL_CNT_ADDR                                56
++#define WF_LWTBL_RATE1_FAIL_CNT_MASK \
++	0xffff0000 // 31-16
++#define WF_LWTBL_RATE1_FAIL_CNT_SHIFT                               16
++// DW15
++#define WF_LWTBL_RATE2_OK_CNT_DW                                    15
++#define WF_LWTBL_RATE2_OK_CNT_ADDR                                  60
++#define WF_LWTBL_RATE2_OK_CNT_MASK \
++	0x0000ffff // 15- 0
++#define WF_LWTBL_RATE2_OK_CNT_SHIFT                                 0
++#define WF_LWTBL_RATE3_OK_CNT_DW                                    15
++#define WF_LWTBL_RATE3_OK_CNT_ADDR                                  60
++#define WF_LWTBL_RATE3_OK_CNT_MASK \
++	0xffff0000 // 31-16
++#define WF_LWTBL_RATE3_OK_CNT_SHIFT                                 16
++// DW16
++#define WF_LWTBL_CURRENT_BW_TX_CNT_DW                               16
++#define WF_LWTBL_CURRENT_BW_TX_CNT_ADDR                             64
++#define WF_LWTBL_CURRENT_BW_TX_CNT_MASK \
++	0x0000ffff // 15- 0
++#define WF_LWTBL_CURRENT_BW_TX_CNT_SHIFT                            0
++#define WF_LWTBL_CURRENT_BW_FAIL_CNT_DW                             16
++#define WF_LWTBL_CURRENT_BW_FAIL_CNT_ADDR                           64
++#define WF_LWTBL_CURRENT_BW_FAIL_CNT_MASK \
++	0xffff0000 // 31-16
++#define WF_LWTBL_CURRENT_BW_FAIL_CNT_SHIFT                          16
++// DW17
++#define WF_LWTBL_OTHER_BW_TX_CNT_DW                                 17
++#define WF_LWTBL_OTHER_BW_TX_CNT_ADDR                               68
++#define WF_LWTBL_OTHER_BW_TX_CNT_MASK \
++	0x0000ffff // 15- 0
++#define WF_LWTBL_OTHER_BW_TX_CNT_SHIFT                              0
++#define WF_LWTBL_OTHER_BW_FAIL_CNT_DW                               17
++#define WF_LWTBL_OTHER_BW_FAIL_CNT_ADDR                             68
++#define WF_LWTBL_OTHER_BW_FAIL_CNT_MASK \
++	0xffff0000 // 31-16
++#define WF_LWTBL_OTHER_BW_FAIL_CNT_SHIFT                            16
++// DW18
++#define WF_LWTBL_RTS_OK_CNT_DW                                      18
++#define WF_LWTBL_RTS_OK_CNT_ADDR                                    72
++#define WF_LWTBL_RTS_OK_CNT_MASK \
++	0x0000ffff // 15- 0
++#define WF_LWTBL_RTS_OK_CNT_SHIFT                                   0
++#define WF_LWTBL_RTS_FAIL_CNT_DW                                    18
++#define WF_LWTBL_RTS_FAIL_CNT_ADDR                                  72
++#define WF_LWTBL_RTS_FAIL_CNT_MASK \
++	0xffff0000 // 31-16
++#define WF_LWTBL_RTS_FAIL_CNT_SHIFT                                 16
++// DW19
++#define WF_LWTBL_DATA_RETRY_CNT_DW                                  19
++#define WF_LWTBL_DATA_RETRY_CNT_ADDR                                76
++#define WF_LWTBL_DATA_RETRY_CNT_MASK \
++	0x0000ffff // 15- 0
++#define WF_LWTBL_DATA_RETRY_CNT_SHIFT                               0
++#define WF_LWTBL_MGNT_RETRY_CNT_DW                                  19
++#define WF_LWTBL_MGNT_RETRY_CNT_ADDR                                76
++#define WF_LWTBL_MGNT_RETRY_CNT_MASK \
++	0xffff0000 // 31-16
++#define WF_LWTBL_MGNT_RETRY_CNT_SHIFT                               16
++// DW20
++#define WF_LWTBL_AC0_CTT_CDT_CRB_DW                                 20
++#define WF_LWTBL_AC0_CTT_CDT_CRB_ADDR                               80
++#define WF_LWTBL_AC0_CTT_CDT_CRB_MASK \
++	0xffffffff // 31- 0
++#define WF_LWTBL_AC0_CTT_CDT_CRB_SHIFT                              0
++// DW21
++// DO NOT process repeat field(adm[0])
++// DW22
++#define WF_LWTBL_AC1_CTT_CDT_CRB_DW                                 22
++#define WF_LWTBL_AC1_CTT_CDT_CRB_ADDR                               88
++#define WF_LWTBL_AC1_CTT_CDT_CRB_MASK \
++	0xffffffff // 31- 0
++#define WF_LWTBL_AC1_CTT_CDT_CRB_SHIFT                              0
++// DW23
++// DO NOT process repeat field(adm[1])
++// DW24
++#define WF_LWTBL_AC2_CTT_CDT_CRB_DW                                 24
++#define WF_LWTBL_AC2_CTT_CDT_CRB_ADDR                               96
++#define WF_LWTBL_AC2_CTT_CDT_CRB_MASK \
++	0xffffffff // 31- 0
++#define WF_LWTBL_AC2_CTT_CDT_CRB_SHIFT                              0
++// DW25
++// DO NOT process repeat field(adm[2])
++// DW26
++#define WF_LWTBL_AC3_CTT_CDT_CRB_DW                                 26
++#define WF_LWTBL_AC3_CTT_CDT_CRB_ADDR                               104
++#define WF_LWTBL_AC3_CTT_CDT_CRB_MASK \
++	0xffffffff // 31- 0
++#define WF_LWTBL_AC3_CTT_CDT_CRB_SHIFT                              0
++// DW27
++// DO NOT process repeat field(adm[3])
++// DW28
++#define WF_LWTBL_RELATED_IDX0_DW                                    28
++#define WF_LWTBL_RELATED_IDX0_ADDR                                  112
++#define WF_LWTBL_RELATED_IDX0_MASK \
++	0x00000fff // 11- 0
++#define WF_LWTBL_RELATED_IDX0_SHIFT                                 0
++#define WF_LWTBL_RELATED_BAND0_DW                                   28
++#define WF_LWTBL_RELATED_BAND0_ADDR                                 112
++#define WF_LWTBL_RELATED_BAND0_MASK \
++	0x00003000 // 13-12
++#define WF_LWTBL_RELATED_BAND0_SHIFT                                12
++#define WF_LWTBL_PRIMARY_MLD_BAND_DW                                28
++#define WF_LWTBL_PRIMARY_MLD_BAND_ADDR                              112
++#define WF_LWTBL_PRIMARY_MLD_BAND_MASK \
++	0x0000c000 // 15-14
++#define WF_LWTBL_PRIMARY_MLD_BAND_SHIFT                             14
++#define WF_LWTBL_RELATED_IDX1_DW                                    28
++#define WF_LWTBL_RELATED_IDX1_ADDR                                  112
++#define WF_LWTBL_RELATED_IDX1_MASK \
++	0x0fff0000 // 27-16
++#define WF_LWTBL_RELATED_IDX1_SHIFT                                 16
++#define WF_LWTBL_RELATED_BAND1_DW                                   28
++#define WF_LWTBL_RELATED_BAND1_ADDR                                 112
++#define WF_LWTBL_RELATED_BAND1_MASK \
++	0x30000000 // 29-28
++#define WF_LWTBL_RELATED_BAND1_SHIFT                                28
++#define WF_LWTBL_SECONDARY_MLD_BAND_DW                              28
++#define WF_LWTBL_SECONDARY_MLD_BAND_ADDR                            112
++#define WF_LWTBL_SECONDARY_MLD_BAND_MASK \
++	0xc0000000 // 31-30
++#define WF_LWTBL_SECONDARY_MLD_BAND_SHIFT                           30
++// DW29
++#define WF_LWTBL_DISPATCH_POLICY0_DW                                29
++#define WF_LWTBL_DISPATCH_POLICY0_ADDR                              116
++#define WF_LWTBL_DISPATCH_POLICY0_MASK \
++	0x00000003 // 1- 0
++#define WF_LWTBL_DISPATCH_POLICY0_SHIFT                             0
++#define WF_LWTBL_DISPATCH_POLICY1_DW                                29
++#define WF_LWTBL_DISPATCH_POLICY1_ADDR                              116
++#define WF_LWTBL_DISPATCH_POLICY1_MASK \
++	0x0000000c // 3- 2
++#define WF_LWTBL_DISPATCH_POLICY1_SHIFT                             2
++#define WF_LWTBL_DISPATCH_POLICY2_DW                                29
++#define WF_LWTBL_DISPATCH_POLICY2_ADDR                              116
++#define WF_LWTBL_DISPATCH_POLICY2_MASK \
++	0x00000030 // 5- 4
++#define WF_LWTBL_DISPATCH_POLICY2_SHIFT                             4
++#define WF_LWTBL_DISPATCH_POLICY3_DW                                29
++#define WF_LWTBL_DISPATCH_POLICY3_ADDR                              116
++#define WF_LWTBL_DISPATCH_POLICY3_MASK \
++	0x000000c0 // 7- 6
++#define WF_LWTBL_DISPATCH_POLICY3_SHIFT                             6
++#define WF_LWTBL_DISPATCH_POLICY4_DW                                29
++#define WF_LWTBL_DISPATCH_POLICY4_ADDR                              116
++#define WF_LWTBL_DISPATCH_POLICY4_MASK \
++	0x00000300 // 9- 8
++#define WF_LWTBL_DISPATCH_POLICY4_SHIFT                             8
++#define WF_LWTBL_DISPATCH_POLICY5_DW                                29
++#define WF_LWTBL_DISPATCH_POLICY5_ADDR                              116
++#define WF_LWTBL_DISPATCH_POLICY5_MASK \
++	0x00000c00 // 11-10
++#define WF_LWTBL_DISPATCH_POLICY5_SHIFT                             10
++#define WF_LWTBL_DISPATCH_POLICY6_DW                                29
++#define WF_LWTBL_DISPATCH_POLICY6_ADDR                              116
++#define WF_LWTBL_DISPATCH_POLICY6_MASK \
++	0x00003000 // 13-12
++#define WF_LWTBL_DISPATCH_POLICY6_SHIFT                             12
++#define WF_LWTBL_DISPATCH_POLICY7_DW                                29
++#define WF_LWTBL_DISPATCH_POLICY7_ADDR                              116
++#define WF_LWTBL_DISPATCH_POLICY7_MASK \
++	0x0000c000 // 15-14
++#define WF_LWTBL_DISPATCH_POLICY7_SHIFT                             14
++#define WF_LWTBL_OWN_MLD_ID_DW                                      29
++#define WF_LWTBL_OWN_MLD_ID_ADDR                                    116
++#define WF_LWTBL_OWN_MLD_ID_MASK \
++	0x003f0000 // 21-16
++#define WF_LWTBL_OWN_MLD_ID_SHIFT                                   16
++#define WF_LWTBL_EMLSR0_DW                                          29
++#define WF_LWTBL_EMLSR0_ADDR                                        116
++#define WF_LWTBL_EMLSR0_MASK \
++	0x00400000 // 22-22
++#define WF_LWTBL_EMLSR0_SHIFT                                       22
++#define WF_LWTBL_EMLMR0_DW                                          29
++#define WF_LWTBL_EMLMR0_ADDR                                        116
++#define WF_LWTBL_EMLMR0_MASK \
++	0x00800000 // 23-23
++#define WF_LWTBL_EMLMR0_SHIFT                                       23
++#define WF_LWTBL_EMLSR1_DW                                          29
++#define WF_LWTBL_EMLSR1_ADDR                                        116
++#define WF_LWTBL_EMLSR1_MASK \
++	0x01000000 // 24-24
++#define WF_LWTBL_EMLSR1_SHIFT                                       24
++#define WF_LWTBL_EMLMR1_DW                                          29
++#define WF_LWTBL_EMLMR1_ADDR                                        116
++#define WF_LWTBL_EMLMR1_MASK \
++	0x02000000 // 25-25
++#define WF_LWTBL_EMLMR1_SHIFT                                       25
++#define WF_LWTBL_EMLSR2_DW                                          29
++#define WF_LWTBL_EMLSR2_ADDR                                        116
++#define WF_LWTBL_EMLSR2_MASK \
++	0x04000000 // 26-26
++#define WF_LWTBL_EMLSR2_SHIFT                                       26
++#define WF_LWTBL_EMLMR2_DW                                          29
++#define WF_LWTBL_EMLMR2_ADDR                                        116
++#define WF_LWTBL_EMLMR2_MASK \
++	0x08000000 // 27-27
++#define WF_LWTBL_EMLMR2_SHIFT                                       27
++#define WF_LWTBL_STR_BITMAP_DW                                      29
++#define WF_LWTBL_STR_BITMAP_ADDR                                    116
++#define WF_LWTBL_STR_BITMAP_MASK \
++	0xe0000000 // 31-29
++#define WF_LWTBL_STR_BITMAP_SHIFT                                   29
++// DW30
++#define WF_LWTBL_DISPATCH_ORDER_DW                                  30
++#define WF_LWTBL_DISPATCH_ORDER_ADDR                                120
++#define WF_LWTBL_DISPATCH_ORDER_MASK \
++	0x0000007f // 6- 0
++#define WF_LWTBL_DISPATCH_ORDER_SHIFT                               0
++#define WF_LWTBL_DISPATCH_RATIO_DW                                  30
++#define WF_LWTBL_DISPATCH_RATIO_ADDR                                120
++#define WF_LWTBL_DISPATCH_RATIO_MASK \
++	0x00003f80 // 13- 7
++#define WF_LWTBL_DISPATCH_RATIO_SHIFT                               7
++#define WF_LWTBL_LINK_MGF_DW                                        30
++#define WF_LWTBL_LINK_MGF_ADDR                                      120
++#define WF_LWTBL_LINK_MGF_MASK \
++	0xffff0000 // 31-16
++#define WF_LWTBL_LINK_MGF_SHIFT                                     16
++// DW31
++#define WF_LWTBL_NEGOTIATED_WINSIZE0_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE0_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE0_MASK \
++	0x00000007 // 2- 0
++#define WF_LWTBL_NEGOTIATED_WINSIZE0_SHIFT                          0
++#define WF_LWTBL_NEGOTIATED_WINSIZE1_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE1_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE1_MASK \
++	0x00000038 // 5- 3
++#define WF_LWTBL_NEGOTIATED_WINSIZE1_SHIFT                          3
++#define WF_LWTBL_NEGOTIATED_WINSIZE2_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE2_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE2_MASK \
++	0x000001c0 // 8- 6
++#define WF_LWTBL_NEGOTIATED_WINSIZE2_SHIFT                          6
++#define WF_LWTBL_NEGOTIATED_WINSIZE3_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE3_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE3_MASK \
++	0x00000e00 // 11- 9
++#define WF_LWTBL_NEGOTIATED_WINSIZE3_SHIFT                          9
++#define WF_LWTBL_NEGOTIATED_WINSIZE4_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE4_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE4_MASK \
++	0x00007000 // 14-12
++#define WF_LWTBL_NEGOTIATED_WINSIZE4_SHIFT                          12
++#define WF_LWTBL_NEGOTIATED_WINSIZE5_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE5_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE5_MASK \
++	0x00038000 // 17-15
++#define WF_LWTBL_NEGOTIATED_WINSIZE5_SHIFT                          15
++#define WF_LWTBL_NEGOTIATED_WINSIZE6_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE6_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE6_MASK \
++	0x001c0000 // 20-18
++#define WF_LWTBL_NEGOTIATED_WINSIZE6_SHIFT                          18
++#define WF_LWTBL_NEGOTIATED_WINSIZE7_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE7_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE7_MASK \
++	0x00e00000 // 23-21
++#define WF_LWTBL_NEGOTIATED_WINSIZE7_SHIFT                          21
++#define WF_LWTBL_CASCAD_DW                                          31
++#define WF_LWTBL_CASCAD_ADDR                                        124
++#define WF_LWTBL_CASCAD_MASK \
++	0x02000000 // 25-25
++#define WF_LWTBL_CASCAD_SHIFT                                       25
++#define WF_LWTBL_ALL_ACK_DW                                         31
++#define WF_LWTBL_ALL_ACK_ADDR                                       124
++#define WF_LWTBL_ALL_ACK_MASK \
++	0x04000000 // 26-26
++#define WF_LWTBL_ALL_ACK_SHIFT                                      26
++#define WF_LWTBL_MPDU_SIZE_DW                                       31
++#define WF_LWTBL_MPDU_SIZE_ADDR                                     124
++#define WF_LWTBL_MPDU_SIZE_MASK \
++	0x18000000 // 28-27
++#define WF_LWTBL_MPDU_SIZE_SHIFT                                    27
++#define WF_LWTBL_BA_MODE_DW                                         31
++#define WF_LWTBL_BA_MODE_ADDR                                       124
++#define WF_LWTBL_BA_MODE_MASK \
++	0xe0000000 // 31-29
++#define WF_LWTBL_BA_MODE_SHIFT                                      29
++// DW32
++#define WF_LWTBL_OM_INFO_DW                                         32
++#define WF_LWTBL_OM_INFO_ADDR                                       128
++#define WF_LWTBL_OM_INFO_MASK \
++	0x00000fff // 11- 0
++#define WF_LWTBL_OM_INFO_SHIFT                                      0
++#define WF_LWTBL_RXD_DUP_FOR_OM_CHG_DW                              32
++#define WF_LWTBL_RXD_DUP_FOR_OM_CHG_ADDR                            128
++#define WF_LWTBL_RXD_DUP_FOR_OM_CHG_MASK \
++	0x00001000 // 12-12
++#define WF_LWTBL_RXD_DUP_FOR_OM_CHG_SHIFT                           12
++#define WF_LWTBL_RXD_DUP_WHITE_LIST_DW                              32
++#define WF_LWTBL_RXD_DUP_WHITE_LIST_ADDR                            128
++#define WF_LWTBL_RXD_DUP_WHITE_LIST_MASK \
++	0x01ffe000 // 24-13
++#define WF_LWTBL_RXD_DUP_WHITE_LIST_SHIFT                           13
++#define WF_LWTBL_RXD_DUP_MODE_DW                                    32
++#define WF_LWTBL_RXD_DUP_MODE_ADDR                                  128
++#define WF_LWTBL_RXD_DUP_MODE_MASK \
++	0x06000000 // 26-25
++#define WF_LWTBL_RXD_DUP_MODE_SHIFT                                 25
++#define WF_LWTBL_DROP_DW                                            32
++#define WF_LWTBL_DROP_ADDR                                          128
++#define WF_LWTBL_DROP_MASK \
++	0x40000000 // 30-30
++#define WF_LWTBL_DROP_SHIFT                                         30
++#define WF_LWTBL_ACK_EN_DW                                          32
++#define WF_LWTBL_ACK_EN_ADDR                                        128
++#define WF_LWTBL_ACK_EN_MASK \
++	0x80000000 // 31-31
++#define WF_LWTBL_ACK_EN_SHIFT                                       31
++// DW33
++#define WF_LWTBL_USER_RSSI_DW                                       33
++#define WF_LWTBL_USER_RSSI_ADDR                                     132
++#define WF_LWTBL_USER_RSSI_MASK \
++	0x000001ff // 8- 0
++#define WF_LWTBL_USER_RSSI_SHIFT                                    0
++#define WF_LWTBL_USER_SNR_DW                                        33
++#define WF_LWTBL_USER_SNR_ADDR                                      132
++#define WF_LWTBL_USER_SNR_MASK \
++	0x00007e00 // 14- 9
++#define WF_LWTBL_USER_SNR_SHIFT                                     9
++#define WF_LWTBL_RAPID_REACTION_RATE_DW                             33
++#define WF_LWTBL_RAPID_REACTION_RATE_ADDR                           132
++#define WF_LWTBL_RAPID_REACTION_RATE_MASK \
++	0x0fff0000 // 27-16
++#define WF_LWTBL_RAPID_REACTION_RATE_SHIFT                          16
++#define WF_LWTBL_HT_AMSDU_DW                                        33
++#define WF_LWTBL_HT_AMSDU_ADDR                                      132
++#define WF_LWTBL_HT_AMSDU_MASK \
++	0x40000000 // 30-30
++#define WF_LWTBL_HT_AMSDU_SHIFT                                     30
++#define WF_LWTBL_AMSDU_CROSS_LG_DW                                  33
++#define WF_LWTBL_AMSDU_CROSS_LG_ADDR                                132
++#define WF_LWTBL_AMSDU_CROSS_LG_MASK \
++	0x80000000 // 31-31
++#define WF_LWTBL_AMSDU_CROSS_LG_SHIFT                               31
++// DW34
++#define WF_LWTBL_RESP_RCPI0_DW                                      34
++#define WF_LWTBL_RESP_RCPI0_ADDR                                    136
++#define WF_LWTBL_RESP_RCPI0_MASK \
++	0x000000ff // 7- 0
++#define WF_LWTBL_RESP_RCPI0_SHIFT                                   0
++#define WF_LWTBL_RESP_RCPI1_DW                                      34
++#define WF_LWTBL_RESP_RCPI1_ADDR                                    136
++#define WF_LWTBL_RESP_RCPI1_MASK \
++	0x0000ff00 // 15- 8
++#define WF_LWTBL_RESP_RCPI1_SHIFT                                   8
++#define WF_LWTBL_RESP_RCPI2_DW                                      34
++#define WF_LWTBL_RESP_RCPI2_ADDR                                    136
++#define WF_LWTBL_RESP_RCPI2_MASK \
++	0x00ff0000 // 23-16
++#define WF_LWTBL_RESP_RCPI2_SHIFT                                   16
++#define WF_LWTBL_RESP_RCPI3_DW                                      34
++#define WF_LWTBL_RESP_RCPI3_ADDR                                    136
++#define WF_LWTBL_RESP_RCPI3_MASK \
++	0xff000000 // 31-24
++#define WF_LWTBL_RESP_RCPI3_SHIFT                                   24
++// DW35
++#define WF_LWTBL_SNR_RX0_DW                                         35
++#define WF_LWTBL_SNR_RX0_ADDR                                       140
++#define WF_LWTBL_SNR_RX0_MASK \
++	0x0000003f // 5- 0
++#define WF_LWTBL_SNR_RX0_SHIFT                                      0
++#define WF_LWTBL_SNR_RX1_DW                                         35
++#define WF_LWTBL_SNR_RX1_ADDR                                       140
++#define WF_LWTBL_SNR_RX1_MASK \
++	0x00000fc0 // 11- 6
++#define WF_LWTBL_SNR_RX1_SHIFT                                      6
++#define WF_LWTBL_SNR_RX2_DW                                         35
++#define WF_LWTBL_SNR_RX2_ADDR                                       140
++#define WF_LWTBL_SNR_RX2_MASK \
++	0x0003f000 // 17-12
++#define WF_LWTBL_SNR_RX2_SHIFT                                      12
++#define WF_LWTBL_SNR_RX3_DW                                         35
++#define WF_LWTBL_SNR_RX3_ADDR                                       140
++#define WF_LWTBL_SNR_RX3_MASK \
++	0x00fc0000 // 23-18
++#define WF_LWTBL_SNR_RX3_SHIFT                                      18
++
++/* WTBL Group - Packet Number */
++/* DW 2 */
++#define WTBL_PN0_MASK                   BITS(0, 7)
++#define WTBL_PN0_OFFSET                 0
++#define WTBL_PN1_MASK                   BITS(8, 15)
++#define WTBL_PN1_OFFSET                 8
++#define WTBL_PN2_MASK                   BITS(16, 23)
++#define WTBL_PN2_OFFSET                 16
++#define WTBL_PN3_MASK                   BITS(24, 31)
++#define WTBL_PN3_OFFSET                 24
++
++/* DW 3 */
++#define WTBL_PN4_MASK                   BITS(0, 7)
++#define WTBL_PN4_OFFSET                 0
++#define WTBL_PN5_MASK                   BITS(8, 15)
++#define WTBL_PN5_OFFSET                 8
++
++/* DW 4 */
++#define WTBL_BIPN0_MASK                 BITS(0, 7)
++#define WTBL_BIPN0_OFFSET               0
++#define WTBL_BIPN1_MASK                 BITS(8, 15)
++#define WTBL_BIPN1_OFFSET               8
++#define WTBL_BIPN2_MASK                 BITS(16, 23)
++#define WTBL_BIPN2_OFFSET               16
++#define WTBL_BIPN3_MASK                 BITS(24, 31)
++#define WTBL_BIPN3_OFFSET               24
++
++/* DW 5 */
++#define WTBL_BIPN4_MASK                 BITS(0, 7)
++#define WTBL_BIPN4_OFFSET               0
++#define WTBL_BIPN5_MASK                 BITS(8, 15)
++#define WTBL_BIPN5_OFFSET               8
++
++/* UWTBL DW 6 */
++#define WTBL_AMSDU_LEN_MASK             BITS(0, 5)
++#define WTBL_AMSDU_LEN_OFFSET           0
++#define WTBL_AMSDU_NUM_MASK             BITS(6, 10)
++#define WTBL_AMSDU_NUM_OFFSET           6
++#define WTBL_AMSDU_EN_MASK              BIT(11)
++#define WTBL_AMSDU_EN_OFFSET            11
++
++/* LWTBL Rate field */
++#define WTBL_RATE_TX_RATE_MASK          BITS(0, 5)
++#define WTBL_RATE_TX_RATE_OFFSET        0
++#define WTBL_RATE_TX_MODE_MASK          BITS(6, 9)
++#define WTBL_RATE_TX_MODE_OFFSET        6
++#define WTBL_RATE_NSTS_MASK             BITS(10, 13)
++#define WTBL_RATE_NSTS_OFFSET           10
++#define WTBL_RATE_STBC_MASK             BIT(14)
++#define WTBL_RATE_STBC_OFFSET           14
++
++/***** WTBL(LMAC) DW Offset *****/
++/* LMAC WTBL Group - Peer Unique Information */
++#define WTBL_GROUP_PEER_INFO_DW_0               0
++#define WTBL_GROUP_PEER_INFO_DW_1               1
++
++/* WTBL Group - TxRx Capability/Information */
++#define WTBL_GROUP_TRX_CAP_DW_2                 2
++#define WTBL_GROUP_TRX_CAP_DW_3                 3
++#define WTBL_GROUP_TRX_CAP_DW_4                 4
++#define WTBL_GROUP_TRX_CAP_DW_5                 5
++#define WTBL_GROUP_TRX_CAP_DW_6                 6
++#define WTBL_GROUP_TRX_CAP_DW_7                 7
++#define WTBL_GROUP_TRX_CAP_DW_8                 8
++#define WTBL_GROUP_TRX_CAP_DW_9                 9
++
++/* WTBL Group - Auto Rate Table*/
++#define WTBL_GROUP_AUTO_RATE_1_2                10
++#define WTBL_GROUP_AUTO_RATE_3_4                11
++#define WTBL_GROUP_AUTO_RATE_5_6                12
++#define WTBL_GROUP_AUTO_RATE_7_8                13
++
++/* WTBL Group - Tx Counter */
++#define WTBL_GROUP_TX_CNT_LINE_1                14
++#define WTBL_GROUP_TX_CNT_LINE_2                15
++#define WTBL_GROUP_TX_CNT_LINE_3                16
++#define WTBL_GROUP_TX_CNT_LINE_4                17
++#define WTBL_GROUP_TX_CNT_LINE_5                18
++#define WTBL_GROUP_TX_CNT_LINE_6                19
++
++/* WTBL Group - Admission Control Counter */
++#define WTBL_GROUP_ADM_CNT_LINE_1               20
++#define WTBL_GROUP_ADM_CNT_LINE_2               21
++#define WTBL_GROUP_ADM_CNT_LINE_3               22
++#define WTBL_GROUP_ADM_CNT_LINE_4               23
++#define WTBL_GROUP_ADM_CNT_LINE_5               24
++#define WTBL_GROUP_ADM_CNT_LINE_6               25
++#define WTBL_GROUP_ADM_CNT_LINE_7               26
++#define WTBL_GROUP_ADM_CNT_LINE_8               27
++
++/* WTBL Group -MLO Info */
++#define WTBL_GROUP_MLO_INFO_LINE_1              28
++#define WTBL_GROUP_MLO_INFO_LINE_2              29
++#define WTBL_GROUP_MLO_INFO_LINE_3              30
++
++/* WTBL Group -RESP Info */
++#define WTBL_GROUP_RESP_INFO_DW_31              31
++
++/* WTBL Group -RX DUP Info */
++#define WTBL_GROUP_RX_DUP_INFO_DW_32            32
++
++/* WTBL Group - Rx Statistics Counter */
++#define WTBL_GROUP_RX_STAT_CNT_LINE_1           33
++#define WTBL_GROUP_RX_STAT_CNT_LINE_2           34
++#define WTBL_GROUP_RX_STAT_CNT_LINE_3           35
++
++/* UWTBL Group - HW AMSDU */
++#define UWTBL_HW_AMSDU_DW                       WF_UWTBL_AMSDU_CFG_DW
++
++/* LWTBL DW 4 */
++#define WTBL_DIS_RHTR                           WF_LWTBL_DIS_RHTR_MASK
++
++/* UWTBL DW 5 */
++#define WTBL_KEY_LINK_DW_KEY_LOC0_MASK          BITS(0, 10)
++#define WTBL_PSM				WF_LWTBL_PSM_MASK
++
++/* Need to sync with FW define */
++#define INVALID_KEY_ENTRY                       WTBL_KEY_LINK_DW_KEY_LOC0_MASK
++
++// RATE
++#define WTBL_RATE_TX_RATE_MASK          	BITS(0, 5)
++#define WTBL_RATE_TX_RATE_OFFSET        	0
++#define WTBL_RATE_TX_MODE_MASK          	BITS(6, 9)
++#define WTBL_RATE_TX_MODE_OFFSET        	6
++#define WTBL_RATE_NSTS_MASK             	BITS(10, 13)
++#define WTBL_RATE_NSTS_OFFSET           	10
++#define WTBL_RATE_STBC_MASK            	 	BIT(14)
++#define WTBL_RATE_STBC_OFFSET          	 	14
++#endif
++
++#endif
+diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
+new file mode 100644
+index 00000000..080f756e
+--- /dev/null
++++ b/mt7996/mtk_debugfs.c
+@@ -0,0 +1,2344 @@
++// SPDX-License-Identifier: ISC
++/*
++ * Copyright (C) 2023 MediaTek Inc.
++ */
++#include "mt7996.h"
++#include "../mt76.h"
++#include "mcu.h"
++#include "mac.h"
++#include "eeprom.h"
++#include "mtk_debug.h"
++#include "mtk_mcu.h"
++
++#ifdef CONFIG_MTK_DEBUG
++
++/* AGG INFO */
++static int
++mt7996_agginfo_read_per_band(struct seq_file *s, int band_idx)
++{
++	struct mt7996_dev *dev = dev_get_drvdata(s->private);
++	u64 total_burst, total_ampdu, ampdu_cnt[16];
++	u32 value, idx, row_idx, col_idx, start_range, agg_rang_sel[16], burst_cnt[16], band_offset = 0;
++	u8 readFW = 0, partial_str[16] = {}, full_str[64] = {};
++
++	switch (band_idx) {
++	case 0:
++		band_offset = 0;
++		break;
++	case 1:
++		band_offset = BN1_WF_AGG_TOP_BASE - BN0_WF_AGG_TOP_BASE;
++		break;
++	case 2:
++		band_offset = IP1_BN0_WF_AGG_TOP_BASE - BN0_WF_AGG_TOP_BASE;
++		break;
++	default:
++		return 0;
++	}
++
++	seq_printf(s, "Band %d AGG Status\n", band_idx);
++	seq_printf(s, "===============================\n");
++	value = mt76_rr(dev, BN0_WF_AGG_TOP_AALCR0_ADDR + band_offset);
++	seq_printf(s, "AC00 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR0_AC00_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR0_AC00_AGG_LIMIT_SHFT);
++	seq_printf(s, "AC01 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR0_AC01_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR0_AC01_AGG_LIMIT_SHFT);
++	value = mt76_rr(dev, BN0_WF_AGG_TOP_AALCR1_ADDR + band_offset);
++	seq_printf(s, "AC02 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR1_AC02_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR1_AC02_AGG_LIMIT_SHFT);
++	seq_printf(s, "AC03 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR1_AC03_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR1_AC03_AGG_LIMIT_SHFT);
++	value = mt76_rr(dev, BN0_WF_AGG_TOP_AALCR2_ADDR + band_offset);
++	seq_printf(s, "AC10 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR2_AC10_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR2_AC10_AGG_LIMIT_SHFT);
++	seq_printf(s, "AC11 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR2_AC11_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR2_AC11_AGG_LIMIT_SHFT);
++	value = mt76_rr(dev, BN0_WF_AGG_TOP_AALCR3_ADDR + band_offset);
++	seq_printf(s, "AC12 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR3_AC12_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR3_AC12_AGG_LIMIT_SHFT);
++	seq_printf(s, "AC13 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR3_AC13_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR3_AC13_AGG_LIMIT_SHFT);
++	value = mt76_rr(dev, BN0_WF_AGG_TOP_AALCR4_ADDR + band_offset);
++	seq_printf(s, "AC20 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR4_AC20_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR4_AC20_AGG_LIMIT_SHFT);
++	seq_printf(s, "AC21 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR4_AC21_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR4_AC21_AGG_LIMIT_SHFT);
++	value = mt76_rr(dev, BN0_WF_AGG_TOP_AALCR5_ADDR + band_offset);
++	seq_printf(s, "AC22 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR5_AC22_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR5_AC22_AGG_LIMIT_SHFT);
++	seq_printf(s, "AC23 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR5_AC23_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR5_AC23_AGG_LIMIT_SHFT);
++	value = mt76_rr(dev, BN0_WF_AGG_TOP_AALCR6_ADDR + band_offset);
++	seq_printf(s, "AC30 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR6_AC30_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR6_AC30_AGG_LIMIT_SHFT);
++	seq_printf(s, "AC31 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR6_AC31_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR6_AC31_AGG_LIMIT_SHFT);
++	value = mt76_rr(dev, BN0_WF_AGG_TOP_AALCR7_ADDR + band_offset);
++	seq_printf(s, "AC32 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR7_AC32_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR7_AC32_AGG_LIMIT_SHFT);
++	seq_printf(s, "AC33 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR7_AC33_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR7_AC33_AGG_LIMIT_SHFT);
++
++	switch (band_idx) {
++	case 0:
++		band_offset = 0;
++		break;
++	case 1:
++		band_offset = BN1_WF_MIB_TOP_BASE - BN0_WF_MIB_TOP_BASE;
++		break;
++	case 2:
++		band_offset = IP1_BN0_WF_MIB_TOP_BASE - BN0_WF_MIB_TOP_BASE;
++		break;
++	default:
++		return 0;
++	}
++
++	seq_printf(s, "===AMPDU Related Counters===\n");
++
++	if (readFW) {
++		/* BELLWETHER TODO: Wait MIB counter API implement complete */
++	} else {
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC0_ADDR + band_offset);
++		agg_rang_sel[0] = (value & BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_0_MASK) >> BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_0_SHFT;
++		agg_rang_sel[1] = (value & BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_1_MASK) >> BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_1_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC1_ADDR + band_offset);
++		agg_rang_sel[2] = (value & BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_2_MASK) >> BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_2_SHFT;
++		agg_rang_sel[3] = (value & BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_3_MASK) >> BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_3_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC2_ADDR + band_offset);
++		agg_rang_sel[4] = (value & BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_4_MASK) >> BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_4_SHFT;
++		agg_rang_sel[5] = (value & BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_5_MASK) >> BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_5_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC3_ADDR + band_offset);
++		agg_rang_sel[6] = (value & BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_6_MASK) >> BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_6_SHFT;
++		agg_rang_sel[7] = (value & BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_7_MASK) >> BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_7_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC4_ADDR + band_offset);
++		agg_rang_sel[8] = (value & BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_8_MASK) >> BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_8_SHFT;
++		agg_rang_sel[9] = (value & BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_9_MASK) >> BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_9_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC5_ADDR + band_offset);
++		agg_rang_sel[10] = (value & BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_10_MASK) >> BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_10_SHFT;
++		agg_rang_sel[11] = (value & BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_11_MASK) >> BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_11_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC6_ADDR + band_offset);
++		agg_rang_sel[12] = (value & BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_12_MASK) >> BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_12_SHFT;
++		agg_rang_sel[13] = (value & BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_13_MASK) >> BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_13_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC7_ADDR + band_offset);
++		agg_rang_sel[14] = (value & BN0_WF_MIB_TOP_TRARC7_AGG_RANG_SEL_14_MASK) >> BN0_WF_MIB_TOP_TRARC7_AGG_RANG_SEL_14_SHFT;
++
++		burst_cnt[0] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR0_ADDR + band_offset);
++		burst_cnt[1] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR1_ADDR + band_offset);
++		burst_cnt[2] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR2_ADDR + band_offset);
++		burst_cnt[3] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR3_ADDR + band_offset);
++		burst_cnt[4] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR4_ADDR + band_offset);
++		burst_cnt[5] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR5_ADDR + band_offset);
++		burst_cnt[6] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR6_ADDR + band_offset);
++		burst_cnt[7] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR7_ADDR + band_offset);
++		burst_cnt[8] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR8_ADDR + band_offset);
++		burst_cnt[9] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR9_ADDR + band_offset);
++		burst_cnt[10] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR10_ADDR + band_offset);
++		burst_cnt[11] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR11_ADDR + band_offset);
++		burst_cnt[12] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR12_ADDR + band_offset);
++		burst_cnt[13] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR13_ADDR + band_offset);
++		burst_cnt[14] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR14_ADDR + band_offset);
++		burst_cnt[15] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR15_ADDR + band_offset);
++	}
++
++	start_range = 1;
++	total_burst = 0;
++	total_ampdu = 0;
++	agg_rang_sel[15] = 1023;
++
++	/* Need to add 1 after read from AGG_RANG_SEL CR */
++	for (idx = 0; idx < 16; idx++) {
++		agg_rang_sel[idx]++;
++		total_burst += burst_cnt[idx];
++
++		if (start_range == agg_rang_sel[idx])
++			ampdu_cnt[idx] = (u64) start_range * burst_cnt[idx];
++		else
++			ampdu_cnt[idx] = (u64) ((start_range + agg_rang_sel[idx]) >> 1) * burst_cnt[idx];
++
++		start_range = agg_rang_sel[idx] + 1;
++		total_ampdu += ampdu_cnt[idx];
++	}
++
++	start_range = 1;
++	sprintf(full_str, "%13s ", "Tx Agg Range:");
++
++	for (row_idx = 0; row_idx < 4; row_idx++) {
++		for (col_idx = 0; col_idx < 4; col_idx++, idx++) {
++			idx = 4 * row_idx + col_idx;
++
++			if (start_range == agg_rang_sel[idx])
++				sprintf(partial_str, "%d", agg_rang_sel[idx]);
++			else
++				sprintf(partial_str, "%d~%d", start_range, agg_rang_sel[idx]);
++
++			start_range = agg_rang_sel[idx] + 1;
++			sprintf(full_str + strlen(full_str), "%-11s ", partial_str);
++		}
++
++		idx = 4 * row_idx;
++
++		seq_printf(s, "%s\n", full_str);
++		seq_printf(s, "%13s 0x%-9x 0x%-9x 0x%-9x 0x%-9x\n",
++			row_idx ? "" : "Burst count:",
++			burst_cnt[idx], burst_cnt[idx + 1],
++			burst_cnt[idx + 2], burst_cnt[idx + 3]);
++
++		if (total_burst != 0) {
++			if (row_idx == 0)
++				sprintf(full_str, "%13s ",
++					"Burst ratio:");
++			else
++				sprintf(full_str, "%13s ", "");
++
++			for (col_idx = 0; col_idx < 4; col_idx++) {
++				u64 count = (u64) burst_cnt[idx + col_idx] * 100;
++
++				sprintf(partial_str, "(%llu%%)",
++					div64_u64(count, total_burst));
++				sprintf(full_str + strlen(full_str),
++					"%-11s ", partial_str);
++			}
++
++			seq_printf(s, "%s\n", full_str);
++
++			if (row_idx == 0)
++				sprintf(full_str, "%13s ",
++					"MDPU ratio:");
++			else
++				sprintf(full_str, "%13s ", "");
++
++			for (col_idx = 0; col_idx < 4; col_idx++) {
++				u64 count = ampdu_cnt[idx + col_idx] * 100;
++
++				sprintf(partial_str, "(%llu%%)",
++					div64_u64(count, total_ampdu));
++				sprintf(full_str + strlen(full_str),
++					"%-11s ", partial_str);
++			}
++
++			seq_printf(s, "%s\n", full_str);
++		}
++
++		sprintf(full_str, "%13s ", "");
++	}
++
++	return 0;
++}
++
++static int mt7996_agginfo_read_band0(struct seq_file *s, void *data)
++{
++	mt7996_agginfo_read_per_band(s, MT_BAND0);
++	return 0;
++}
++
++static int mt7996_agginfo_read_band1(struct seq_file *s, void *data)
++{
++	mt7996_agginfo_read_per_band(s, MT_BAND1);
++	return 0;
++}
++
++static int mt7996_agginfo_read_band2(struct seq_file *s, void *data)
++{
++	mt7996_agginfo_read_per_band(s, MT_BAND2);
++	return 0;
++}
++
++/* AMSDU INFO */
++static int mt7996_amsdu_result_read(struct seq_file *s, void *data)
++{
++#define HW_MSDU_CNT_ADDR 0xf400
++#define HW_MSDU_NUM_MAX 33
++	struct mt7996_dev *dev = dev_get_drvdata(s->private);
++	u32 ple_stat[HW_MSDU_NUM_MAX] = {0}, total_amsdu = 0;
++	u8 i;
++
++	for (i = 0; i < HW_MSDU_NUM_MAX; i++)
++		ple_stat[i] = mt76_rr(dev, HW_MSDU_CNT_ADDR + i * 0x04);
++
++	seq_printf(s, "TXD counter status of MSDU:\n");
++
++	for (i = 0; i < HW_MSDU_NUM_MAX; i++)
++		total_amsdu += ple_stat[i];
++
++	for (i = 0; i < HW_MSDU_NUM_MAX; i++) {
++		seq_printf(s, "AMSDU pack count of %d MSDU in TXD: 0x%x ", i, ple_stat[i]);
++		if (total_amsdu != 0)
++			seq_printf(s, "(%d%%)\n", ple_stat[i] * 100 / total_amsdu);
++		else
++			seq_printf(s, "\n");
++	}
++
++	return 0;
++}
++
++/* DBG MODLE */
++static int
++mt7996_fw_debug_module_set(void *data, u64 module)
++{
++	struct mt7996_dev *dev = data;
++
++	dev->dbg.fw_dbg_module = module;
++	return 0;
++}
++
++static int
++mt7996_fw_debug_module_get(void *data, u64 *module)
++{
++	struct mt7996_dev *dev = data;
++
++	*module = dev->dbg.fw_dbg_module;
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_module, mt7996_fw_debug_module_get,
++			 mt7996_fw_debug_module_set, "%lld\n");
++
++static int
++mt7996_fw_debug_level_set(void *data, u64 level)
++{
++	struct mt7996_dev *dev = data;
++
++	dev->dbg.fw_dbg_lv = level;
++	mt7996_mcu_fw_dbg_ctrl(dev, dev->dbg.fw_dbg_module, dev->dbg.fw_dbg_lv);
++	return 0;
++}
++
++static int
++mt7996_fw_debug_level_get(void *data, u64 *level)
++{
++	struct mt7996_dev *dev = data;
++
++	*level = dev->dbg.fw_dbg_lv;
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_level, mt7996_fw_debug_level_get,
++			 mt7996_fw_debug_level_set, "%lld\n");
++
++/* usage: echo 0x[arg3][arg2][arg1] > fw_wa_set */
++static int
++mt7996_wa_set(void *data, u64 val)
++{
++	struct mt7996_dev *dev = data;
++	u32 arg1, arg2, arg3;
++
++	arg1 = FIELD_GET(GENMASK_ULL(7, 0), val);
++	arg2 = FIELD_GET(GENMASK_ULL(15, 8), val);
++	arg3 = FIELD_GET(GENMASK_ULL(23, 16), val);
++
++	return mt7996_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
++				arg1, arg2, arg3);
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_set, NULL, mt7996_wa_set,
++			 "0x%llx\n");
++
++/* usage: echo 0x[arg3][arg2][arg1] > fw_wa_query */
++static int
++mt7996_wa_query(void *data, u64 val)
++{
++	struct mt7996_dev *dev = data;
++	u32 arg1, arg2, arg3;
++
++	arg1 = FIELD_GET(GENMASK_ULL(7, 0), val);
++	arg2 = FIELD_GET(GENMASK_ULL(15, 8), val);
++	arg3 = FIELD_GET(GENMASK_ULL(23, 16), val);
++
++	return mt7996_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(QUERY),
++				arg1, arg2, arg3);
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_query, NULL, mt7996_wa_query,
++			 "0x%llx\n");
++
++static int mt7996_dump_version(struct seq_file *s, void *data)
++{
++	struct mt7996_dev *dev = dev_get_drvdata(s->private);
++	seq_printf(s, "Version: 3.3.10.0\n");
++
++	if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
++		return 0;
++
++	seq_printf(s, "Rom Patch Build Time: %.16s\n", dev->dbg.patch_build_date);
++	seq_printf(s, "WM Patch Build Time: %.15s\n",
++		   dev->dbg.ram_build_date[MT7996_RAM_TYPE_WM]);
++	seq_printf(s, "WA Patch Build Time: %.15s\n",
++		   dev->dbg.ram_build_date[MT7996_RAM_TYPE_WA]);
++	seq_printf(s, "DSP Patch Build Time: %.15s\n",
++		   dev->dbg.ram_build_date[MT7996_RAM_TYPE_DSP]);
++	return 0;
++}
++
++/* dma info dump */
++const struct queue_desc mt7902_tx_ring_layout[] = {
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_TX_RING18_CTRL0_ADDR,
++	 .ring_size = 2048,
++	 .ring_info = "band0 TXD"
++	},
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_TX_RING19_CTRL0_ADDR,
++	 .ring_size = 2048,
++	 .ring_info = "band1 TXD"
++	},
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_TX_RING21_CTRL0_ADDR,
++	 .ring_size = 2048,
++	 .ring_info = "band2 TXD"
++	},
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_TX_RING16_CTRL0_ADDR,
++	 .ring_size = 128,
++	 .ring_info = "FWDL"
++	},
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_TX_RING17_CTRL0_ADDR,
++	 .ring_size = 256,
++	 .ring_info = "cmd to WM"
++	},
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_TX_RING20_CTRL0_ADDR,
++	 .ring_size = 256,
++	 .ring_info = "cmd to WA"
++	}
++};
++
++const struct queue_desc mt7902_rx_ring_layout[] = {
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_RX_RING4_CTRL0_ADDR,
++	 .ring_size = 1536,
++	 .ring_info = "band0 RX data"
++	},
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_RX_RING5_CTRL0_ADDR,
++	 .ring_size = 1536,
++	 .ring_info = "band1 RX data"
++	},
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_RX_RING8_CTRL0_ADDR,
++	 .ring_size = 1536,
++	 .ring_info = "band2 RX data"
++	},
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_RX_RING0_CTRL0_ADDR,
++	 .ring_size = 512,
++	 .ring_info = "event from WM"
++	},
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_RX_RING1_CTRL0_ADDR,
++	 .ring_size = 1024,
++	 .ring_info = "event from WA"
++	},
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_RX_RING2_CTRL0_ADDR,
++	 .ring_size = 1024,
++	 .ring_info = "band0/1/2 tx free done"
++	},
++};
++
++static void
++dump_dma_tx_ring_info(struct seq_file *s, struct mt7996_dev *dev,  char *str1, char *str2, u32 ring_base)
++{
++	u32 base, cnt, cidx, didx, queue_cnt;
++
++	base= mt76_rr(dev, ring_base);
++	cnt = mt76_rr(dev, ring_base + 4);
++	cidx = mt76_rr(dev, ring_base + 8);
++	didx = mt76_rr(dev, ring_base + 12);
++	queue_cnt = (cidx >= didx) ? (cidx - didx) : (cidx - didx + cnt);
++
++	seq_printf(s, "%20s %6s %10x %15x %10x %10x %10x\n", str1, str2, base, cnt, cidx, didx, queue_cnt);
++}
++
++static void
++dump_dma_rx_ring_info(struct seq_file *s, struct mt7996_dev *dev,  char *str1, char *str2, u32 ring_base)
++{
++	u32 base, ctrl1, cnt, cidx, didx, queue_cnt;
++
++	base= mt76_rr(dev, ring_base);
++	ctrl1 = mt76_rr(dev, ring_base + 4);
++	cidx = mt76_rr(dev, ring_base + 8) & 0xfff;
++	didx = mt76_rr(dev, ring_base + 12) & 0xfff;
++	cnt = ctrl1 & 0xfff;
++	queue_cnt = (didx > cidx) ? (didx - cidx - 1) : (didx - cidx + cnt - 1);
++
++	seq_printf(s, "%20s %6s %10x %10x(%3x) %10x %10x %10x\n",
++		   str1, str2, base, ctrl1, cnt, cidx, didx, queue_cnt);
++}
++
++static void
++mt7996_show_dma_info(struct seq_file *s, struct mt7996_dev *dev)
++{
++	u32 sys_ctrl[10];
++
++	/* HOST DMA0 information */
++	sys_ctrl[0] = mt76_rr(dev, WF_WFDMA_HOST_DMA0_HOST_INT_STA_ADDR);
++	sys_ctrl[1] = mt76_rr(dev, WF_WFDMA_HOST_DMA0_HOST_INT_ENA_ADDR);
++	sys_ctrl[2] = mt76_rr(dev, WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_ADDR);
++
++	seq_printf(s, "HOST_DMA Configuration\n");
++	seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
++		"DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
++	seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
++		"DMA0", sys_ctrl[0], sys_ctrl[1], sys_ctrl[2],
++		(sys_ctrl[2] & WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_MASK)
++			>> WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
++		(sys_ctrl[2] & WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_MASK)
++			>> WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
++		(sys_ctrl[2] & WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK)
++			>> WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
++		(sys_ctrl[2] & WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK)
++			>> WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
++
++	if (dev->hif2) {
++		/* HOST DMA1 information */
++		sys_ctrl[0] = mt76_rr(dev, WF_WFDMA_HOST_DMA0_PCIE1_HOST_INT_STA_ADDR);
++		sys_ctrl[1] = mt76_rr(dev, WF_WFDMA_HOST_DMA0_PCIE1_HOST_INT_ENA_ADDR);
++		sys_ctrl[2] = mt76_rr(dev, WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_ADDR);
++
++		seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
++			"DMA0P1", sys_ctrl[0], sys_ctrl[1], sys_ctrl[2],
++			(sys_ctrl[2] & WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_TX_DMA_EN_MASK)
++				>> WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
++			(sys_ctrl[2] & WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_RX_DMA_EN_MASK)
++				>> WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
++			(sys_ctrl[2] & WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK)
++				>> WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
++			(sys_ctrl[2] & WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK)
++				>> WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
++	}
++
++	seq_printf(s, "HOST_DMA0 Ring Configuration\n");
++	seq_printf(s, "%20s %6s %10s %15s %10s %10s %10s\n",
++		"Name", "Used", "Base", "Ctrl1(Cnt)", "CIDX", "DIDX", "QCnt");
++	dump_dma_tx_ring_info(s, dev, "T0:TXD0(H2MAC)", "STA",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING0_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T1:TXD1(H2MAC)", "STA",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING1_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T2:TXD2(H2MAC)", "STA",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING2_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T3:", "STA",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING3_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T4:", "STA",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING4_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T5:", "STA",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING5_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T6:", "STA",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING6_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T16:FWDL", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING16_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T17:Cmd(H2WM)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING17_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T18:TXD0(H2WA)", "AP",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING18_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T19:TXD1(H2WA)", "AP",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING19_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T20:Cmd(H2WA)", "AP",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING20_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T21:TXD2(H2WA)", "AP",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING21_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T22:TXD3(H2WA)", "AP",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING22_CTRL0_ADDR);
++
++
++	dump_dma_rx_ring_info(s, dev, "R0:Event(WM2H)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING0_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R1:Event(WA2H)", "AP",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING1_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R2:TxDone0(WA2H)", "AP",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING2_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R3:TxDone1(WA2H)", "AP",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING3_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R4:Data0(MAC2H)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING4_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R5:Data1(MAC2H)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING5_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R6:BUF1(MAC2H)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING6_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R7:TxDone1(MAC2H)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING7_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R8:BUF0(MAC2H)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING8_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R9:TxDone0(MAC2H)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING9_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R10:MSDU_PG0(MAC2H)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING10_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R11:MSDU_PG1(MAC2H)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING11_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R12:MSDU_PG2(MAC2H)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING12_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "IND:IND_CMD(MAC2H)", "Both",
++		WF_RRO_TOP_IND_CMD_0_CTRL0_ADDR);
++
++	if (dev->hif2) {
++		seq_printf(s, "HOST_DMA0 PCIe1 Ring Configuration\n");
++		seq_printf(s, "%20s %6s %10s %15s %10s %10s %10s\n",
++			"Name", "Used", "Base", "Ctrl1(Cnt)", "CIDX", "DIDX", "QCnt");
++		dump_dma_tx_ring_info(s, dev, "T21:TXD2(H2WA)", "AP",
++			WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING21_CTRL0_ADDR);
++		dump_dma_tx_ring_info(s, dev, "T22:TXD?(H2WA)", "AP",
++			WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING22_CTRL0_ADDR);
++
++		dump_dma_rx_ring_info(s, dev, "R3:TxDone1(WA2H)", "AP",
++			WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING3_CTRL0_ADDR);
++		dump_dma_rx_ring_info(s, dev, "R5:Data1(MAC2H)", "Both",
++			WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING5_CTRL0_ADDR);
++		dump_dma_rx_ring_info(s, dev, "R6:BUF1(MAC2H)", "Both",
++			WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING6_CTRL0_ADDR);
++		dump_dma_rx_ring_info(s, dev, "R7:TxDone1(MAC2H)", "Both",
++			WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING7_CTRL0_ADDR);
++	}
++
++	/* MCU DMA information */
++	sys_ctrl[0] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR);
++	sys_ctrl[1] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_HOST_INT_STA_ADDR);
++	sys_ctrl[2] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_HOST_INT_ENA_ADDR);
++
++	seq_printf(s, "MCU_DMA Configuration\n");
++	seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
++		"DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
++	seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
++		"DMA0", sys_ctrl[1], sys_ctrl[2], sys_ctrl[0],
++		(sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_MASK)
++			>> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
++		(sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_MASK)
++			>> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
++		(sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK)
++			>> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
++		(sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK)
++			>> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
++
++	seq_printf(s, "MCU_DMA0 Ring Configuration\n");
++	seq_printf(s, "%20s %6s %10s %15s %10s %10s %10s\n",
++		"Name", "Used", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++	dump_dma_tx_ring_info(s, dev, "T0:Event(WM2H)", "Both",
++		WF_WFDMA_MCU_DMA0_WPDMA_TX_RING0_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T1:Event(WA2H)", "AP",
++		WF_WFDMA_MCU_DMA0_WPDMA_TX_RING1_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T2:TxDone0(WA2H)", "AP",
++		WF_WFDMA_MCU_DMA0_WPDMA_TX_RING2_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T3:TxDone1(WA2H)", "AP",
++		WF_WFDMA_MCU_DMA0_WPDMA_TX_RING3_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T4:TXD(WM2MAC)", "Both",
++		WF_WFDMA_MCU_DMA0_WPDMA_TX_RING4_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T5:TXCMD(WM2MAC)", "Both",
++		WF_WFDMA_MCU_DMA0_WPDMA_TX_RING5_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T6:TXD(WA2MAC)", "AP",
++		WF_WFDMA_MCU_DMA0_WPDMA_TX_RING6_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R0:FWDL", "Both",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING0_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R1:Cmd(H2WM)", "Both",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING1_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R2:TXD0(H2WA)", "AP",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING2_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R3:TXD1(H2WA)", "AP",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING3_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R4:Cmd(H2WA)", "AP",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING4_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R5:Data0(MAC2WM)", "Both",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING5_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R6:TxDone(MAC2WM)", "Both",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING6_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R7:SPL/RPT(MAC2WM)", "Both",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING7_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R8:TxDone(MAC2WA)", "AP",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING8_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R9:Data1(MAC2WM)", "Both",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING9_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R10:TXD2(H2WA)", "AP",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING10_CTRL0_ADDR);
++
++	/* MEM DMA information */
++	sys_ctrl[0] = mt76_rr(dev, WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_ADDR);
++	sys_ctrl[1] = mt76_rr(dev, WF_WFDMA_MEM_DMA_HOST_INT_STA_ADDR);
++	sys_ctrl[2] = mt76_rr(dev, WF_WFDMA_MEM_DMA_HOST_INT_ENA_ADDR);
++
++	seq_printf(s, "MEM_DMA Configuration\n");
++	seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
++		"DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
++	seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
++		"MEM", sys_ctrl[1], sys_ctrl[2], sys_ctrl[0],
++		(sys_ctrl[0] & WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_MASK)
++			>> WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
++		(sys_ctrl[0] & WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_MASK)
++			>> WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
++		(sys_ctrl[0] & WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK)
++			>> WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
++		(sys_ctrl[0] & WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK)
++			>> WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
++
++	seq_printf(s, "MEM_DMA Ring Configuration\n");
++	seq_printf(s, "%20s %6s %10s %10s %10s %10s %10s\n",
++		"Name", "Used", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++	dump_dma_tx_ring_info(s, dev, "T0:CmdEvent(WM2WA)", "AP",
++		WF_WFDMA_MEM_DMA_WPDMA_TX_RING0_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T1:CmdEvent(WA2WM)", "AP",
++		WF_WFDMA_MEM_DMA_WPDMA_TX_RING1_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R0:CmdEvent(WM2WA)", "AP",
++		WF_WFDMA_MEM_DMA_WPDMA_RX_RING0_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R1:CmdEvent(WA2WM)", "AP",
++		WF_WFDMA_MEM_DMA_WPDMA_RX_RING1_CTRL0_ADDR);
++}
++
++static int mt7996_trinfo_read(struct seq_file *s, void *data)
++{
++	struct mt7996_dev *dev = dev_get_drvdata(s->private);
++	mt7996_show_dma_info(s, dev);
++	return 0;
++}
++
++/* MIB INFO */
++static int mt7996_mibinfo_read_per_band(struct seq_file *s, int band_idx)
++{
++#define BSS_NUM	4
++	struct mt7996_dev *dev = dev_get_drvdata(s->private);
++	u8 bss_nums = BSS_NUM;
++	u32 idx;
++	u32 mac_val, band_offset = 0, band_offset_umib = 0;
++	u32 msdr6, msdr9, msdr18;
++	u32 rvsr0, rscr26, rscr35, mctr5, mctr6, msr0, msr1, msr2;
++	u32 tbcr0, tbcr1, tbcr2, tbcr3, tbcr4;
++	u32 btscr[7];
++	u32 tdrcr[5];
++	u32 mbtocr[16], mbtbcr[16], mbrocr[16], mbrbcr[16];
++	u32 btcr, btbcr, brocr, brbcr, btdcr, brdcr;
++	u32 mu_cnt[5];
++	u32 ampdu_cnt[3];
++	u64 per;
++
++	switch (band_idx) {
++	case 0:
++		band_offset = 0;
++		band_offset_umib = 0;
++		break;
++	case 1:
++		band_offset = BN1_WF_MIB_TOP_BASE - BN0_WF_MIB_TOP_BASE;
++		band_offset_umib = WF_UMIB_TOP_B1BROCR_ADDR - WF_UMIB_TOP_B0BROCR_ADDR;
++		break;
++	case 2:
++		band_offset = IP1_BN0_WF_MIB_TOP_BASE - BN0_WF_MIB_TOP_BASE;
++		band_offset_umib = WF_UMIB_TOP_B2BROCR_ADDR - WF_UMIB_TOP_B0BROCR_ADDR;
++		break;
++	default:
++		return true;
++	}
++
++	seq_printf(s, "Band %d MIB Status\n", band_idx);
++	seq_printf(s, "===============================\n");
++	mac_val = mt76_rr(dev, BN0_WF_MIB_TOP_M0SCR0_ADDR + band_offset);
++	seq_printf(s, "MIB Status Control=0x%x\n", mac_val);
++
++	msdr6 = mt76_rr(dev, BN0_WF_MIB_TOP_M0SDR6_ADDR + band_offset);
++	rvsr0 = mt76_rr(dev, BN0_WF_MIB_TOP_RVSR0_ADDR + band_offset);
++	rscr35 = mt76_rr(dev, BN0_WF_MIB_TOP_RSCR35_ADDR + band_offset);
++	msdr9 = mt76_rr(dev, BN0_WF_MIB_TOP_M0SDR9_ADDR + band_offset);
++	rscr26 = mt76_rr(dev, BN0_WF_MIB_TOP_RSCR26_ADDR + band_offset);
++	mctr5 = mt76_rr(dev, BN0_WF_MIB_TOP_MCTR5_ADDR + band_offset);
++	mctr6 = mt76_rr(dev, BN0_WF_MIB_TOP_MCTR6_ADDR + band_offset);
++	msdr18 = mt76_rr(dev, BN0_WF_MIB_TOP_M0SDR18_ADDR + band_offset);
++	msr0 = mt76_rr(dev, BN0_WF_MIB_TOP_MSR0_ADDR + band_offset);
++	msr1 = mt76_rr(dev, BN0_WF_MIB_TOP_MSR1_ADDR + band_offset);
++	msr2 = mt76_rr(dev, BN0_WF_MIB_TOP_MSR2_ADDR + band_offset);
++	ampdu_cnt[0] = mt76_rr(dev, BN0_WF_MIB_TOP_TSCR0_ADDR + band_offset);
++	ampdu_cnt[1] = mt76_rr(dev, BN0_WF_MIB_TOP_TSCR3_ADDR + band_offset);
++	ampdu_cnt[2] = mt76_rr(dev, BN0_WF_MIB_TOP_TSCR4_ADDR + band_offset);
++	ampdu_cnt[1] &= BN0_WF_MIB_TOP_TSCR3_AMPDU_MPDU_COUNT_MASK;
++	ampdu_cnt[2] &= BN0_WF_MIB_TOP_TSCR4_AMPDU_ACKED_COUNT_MASK;
++
++	seq_printf(s, "===Phy/Timing Related Counters===\n");
++	seq_printf(s, "\tChannelIdleCnt=0x%x\n",
++		msdr6 & BN0_WF_MIB_TOP_M0SDR6_CHANNEL_IDLE_COUNT_MASK);
++	seq_printf(s, "\tCCA_NAV_Tx_Time=0x%x\n",
++		msdr9 & BN0_WF_MIB_TOP_M0SDR9_CCA_NAV_TX_TIME_MASK);
++	seq_printf(s, "\tRx_MDRDY_CNT=0x%x\n",
++		rscr26 & BN0_WF_MIB_TOP_RSCR26_RX_MDRDY_COUNT_MASK);
++	seq_printf(s, "\tCCK_MDRDY_TIME=0x%x, OFDM_MDRDY_TIME=0x%x",
++		msr0 & BN0_WF_MIB_TOP_MSR0_CCK_MDRDY_TIME_MASK,
++		msr1 & BN0_WF_MIB_TOP_MSR1_OFDM_LG_MIXED_VHT_MDRDY_TIME_MASK);
++	seq_printf(s, ", OFDM_GREEN_MDRDY_TIME=0x%x\n",
++		msr2 & BN0_WF_MIB_TOP_MSR2_OFDM_GREEN_MDRDY_TIME_MASK);
++	seq_printf(s, "\tPrim CCA Time=0x%x\n",
++		mctr5 & BN0_WF_MIB_TOP_MCTR5_P_CCA_TIME_MASK);
++	seq_printf(s, "\tSec CCA Time=0x%x\n",
++		mctr6 & BN0_WF_MIB_TOP_MCTR6_S_CCA_TIME_MASK);
++	seq_printf(s, "\tPrim ED Time=0x%x\n",
++		msdr18 & BN0_WF_MIB_TOP_M0SDR18_P_ED_TIME_MASK);
++
++	seq_printf(s, "===Tx Related Counters(Generic)===\n");
++	mac_val = mt76_rr(dev, BN0_WF_MIB_TOP_TSCR18_ADDR + band_offset);
++	dev->dbg.bcn_total_cnt[band_idx] +=
++		(mac_val & BN0_WF_MIB_TOP_TSCR18_BEACONTXCOUNT_MASK);
++	seq_printf(s, "\tBeaconTxCnt=0x%x\n", dev->dbg.bcn_total_cnt[band_idx]);
++	dev->dbg.bcn_total_cnt[band_idx] = 0;
++
++	tbcr0 = mt76_rr(dev, BN0_WF_MIB_TOP_TBCR0_ADDR + band_offset);
++	seq_printf(s, "\tTx 20MHz Cnt=0x%x\n",
++		tbcr0 & BN0_WF_MIB_TOP_TBCR0_TX_20MHZ_CNT_MASK);
++	tbcr1 = mt76_rr(dev, BN0_WF_MIB_TOP_TBCR1_ADDR + band_offset);
++	seq_printf(s, "\tTx 40MHz Cnt=0x%x\n",
++		tbcr1 & BN0_WF_MIB_TOP_TBCR1_TX_40MHZ_CNT_MASK);
++	tbcr2 = mt76_rr(dev, BN0_WF_MIB_TOP_TBCR2_ADDR + band_offset);
++	seq_printf(s, "\tTx 80MHz Cnt=0x%x\n",
++		tbcr2 & BN0_WF_MIB_TOP_TBCR2_TX_80MHZ_CNT_MASK);
++	tbcr3 = mt76_rr(dev, BN0_WF_MIB_TOP_TBCR3_ADDR + band_offset);
++	seq_printf(s, "\tTx 160MHz Cnt=0x%x\n",
++		tbcr3 & BN0_WF_MIB_TOP_TBCR3_TX_160MHZ_CNT_MASK);
++	tbcr4 = mt76_rr(dev, BN0_WF_MIB_TOP_TBCR4_ADDR + band_offset);
++	seq_printf(s, "\tTx 320MHz Cnt=0x%x\n",
++		tbcr4 & BN0_WF_MIB_TOP_TBCR4_TX_320MHZ_CNT_MASK);
++	seq_printf(s, "\tAMPDU Cnt=0x%x\n", ampdu_cnt[0]);
++	seq_printf(s, "\tAMPDU MPDU Cnt=0x%x\n", ampdu_cnt[1]);
++	seq_printf(s, "\tAMPDU MPDU Ack Cnt=0x%x\n", ampdu_cnt[2]);
++	per = (ampdu_cnt[2] == 0 ?
++		0 : 1000 * (ampdu_cnt[1] - ampdu_cnt[2]) / ampdu_cnt[1]);
++	seq_printf(s, "\tAMPDU MPDU PER=%llu.%1llu%%\n", per / 10, per % 10);
++
++	seq_printf(s, "===MU Related Counters===\n");
++	mu_cnt[0] = mt76_rr(dev, BN0_WF_MIB_TOP_BSCR2_ADDR + band_offset);
++	mu_cnt[1] = mt76_rr(dev, BN0_WF_MIB_TOP_TSCR5_ADDR + band_offset);
++	mu_cnt[2] = mt76_rr(dev, BN0_WF_MIB_TOP_TSCR6_ADDR + band_offset);
++	mu_cnt[3] = mt76_rr(dev, BN0_WF_MIB_TOP_TSCR8_ADDR + band_offset);
++	mu_cnt[4] = mt76_rr(dev, BN0_WF_MIB_TOP_TSCR7_ADDR + band_offset);
++
++	seq_printf(s, "\tMUBF_TX_COUNT=0x%x\n",
++		mu_cnt[0] & BN0_WF_MIB_TOP_BSCR2_MUBF_TX_COUNT_MASK);
++	seq_printf(s, "\tMU_TX_MPDU_COUNT(Ok+Fail)=0x%x\n", mu_cnt[1]);
++	seq_printf(s, "\tMU_TX_OK_MPDU_COUNT=0x%x\n", mu_cnt[2]);
++	seq_printf(s, "\tMU_TO_MU_FAIL_PPDU_COUNT=0x%x\n", mu_cnt[3]);
++	seq_printf(s, "\tSU_TX_OK_MPDU_COUNT=0x%x\n", mu_cnt[4]);
++
++	seq_printf(s, "===Rx Related Counters(Generic)===\n");
++	seq_printf(s, "\tVector Mismacth Cnt=0x%x\n",
++		rvsr0 & BN0_WF_MIB_TOP_RVSR0_VEC_MISS_COUNT_MASK);
++	seq_printf(s, "\tDelimiter Fail Cnt=0x%x\n",
++		rscr35 & BN0_WF_MIB_TOP_RSCR35_DELIMITER_FAIL_COUNT_MASK);
++
++	mac_val = mt76_rr(dev, BN0_WF_MIB_TOP_RSCR1_ADDR + band_offset);
++	seq_printf(s, "\tRxFCSErrCnt=0x%x\n",
++		(mac_val & BN0_WF_MIB_TOP_RSCR1_RX_FCS_ERROR_COUNT_MASK));
++	mac_val = mt76_rr(dev, BN0_WF_MIB_TOP_RSCR33_ADDR + band_offset);
++	seq_printf(s, "\tRxFifoFullCnt=0x%x\n",
++		(mac_val & BN0_WF_MIB_TOP_RSCR33_RX_FIFO_FULL_COUNT_MASK));
++	mac_val = mt76_rr(dev, BN0_WF_MIB_TOP_RSCR36_ADDR + band_offset);
++	seq_printf(s, "\tRxLenMismatch=0x%x\n",
++		(mac_val & BN0_WF_MIB_TOP_RSCR36_RX_LEN_MISMATCH_MASK));
++	mac_val = mt76_rr(dev, BN0_WF_MIB_TOP_RSCR31_ADDR + band_offset);
++	seq_printf(s, "\tRxMPDUCnt=0x%x\n",
++		(mac_val & BN0_WF_MIB_TOP_RSCR31_RX_MPDU_COUNT_MASK));
++	mac_val = mt76_rr(dev, BN0_WF_MIB_TOP_RSCR27_ADDR + band_offset);
++	seq_printf(s, "\tRx AMPDU Cnt=0x%x\n", mac_val);
++	mac_val = mt76_rr(dev, BN0_WF_MIB_TOP_RSCR28_ADDR + band_offset);
++	seq_printf(s, "\tRx Total ByteCnt=0x%x\n", mac_val);
++
++
++	/* Per-BSS T/RX Counters */
++	seq_printf(s, "===Per-BSS Related Tx/Rx Counters===\n");
++	seq_printf(s, "BSS Idx TxCnt/DataCnt TxByteCnt RxOkCnt/DataCnt RxByteCnt\n");
++	for (idx = 0; idx < bss_nums; idx++) {
++		btcr = mt76_rr(dev, BN0_WF_MIB_TOP_BTCR_ADDR + band_offset + idx * 4);
++		btdcr = mt76_rr(dev, BN0_WF_MIB_TOP_BTDCR_ADDR + band_offset + idx * 4);
++		btbcr = mt76_rr(dev, BN0_WF_MIB_TOP_BTBCR_ADDR + band_offset + idx * 4);
++
++		brocr = mt76_rr(dev, WF_UMIB_TOP_B0BROCR_ADDR + band_offset_umib + idx * 4);
++		brdcr = mt76_rr(dev, WF_UMIB_TOP_B0BRDCR_ADDR + band_offset_umib + idx * 4);
++		brbcr = mt76_rr(dev, WF_UMIB_TOP_B0BRBCR_ADDR + band_offset_umib + idx * 4);
++
++		seq_printf(s, "%d\t 0x%x/0x%x\t 0x%x \t 0x%x/0x%x \t 0x%x\n",
++			idx, btcr, btdcr, btbcr, brocr, brdcr, brbcr);
++	}
++
++	seq_printf(s, "===Per-BSS Related MIB Counters===\n");
++	seq_printf(s, "BSS Idx RTSTx/RetryCnt BAMissCnt AckFailCnt FrmRetry1/2/3Cnt\n");
++
++	/* Per-BSS TX Status */
++	for (idx = 0; idx < bss_nums; idx++) {
++		btscr[0] = mt76_rr(dev, BN0_WF_MIB_TOP_BTSCR5_ADDR + band_offset + idx * 4);
++		btscr[1] = mt76_rr(dev, BN0_WF_MIB_TOP_BTSCR6_ADDR + band_offset + idx * 4);
++		btscr[2] = mt76_rr(dev, BN0_WF_MIB_TOP_BTSCR0_ADDR + band_offset + idx * 4);
++		btscr[3] = mt76_rr(dev, BN0_WF_MIB_TOP_BTSCR1_ADDR + band_offset + idx * 4);
++		btscr[4] = mt76_rr(dev, BN0_WF_MIB_TOP_BTSCR2_ADDR + band_offset + idx * 4);
++		btscr[5] = mt76_rr(dev, BN0_WF_MIB_TOP_BTSCR3_ADDR + band_offset + idx * 4);
++		btscr[6] = mt76_rr(dev, BN0_WF_MIB_TOP_BTSCR4_ADDR + band_offset + idx * 4);
++
++		seq_printf(s, "%d:\t0x%x/0x%x  0x%x \t 0x%x \t  0x%x/0x%x/0x%x\n",
++			idx, (btscr[0] & BN0_WF_MIB_TOP_BTSCR5_RTSTXCOUNTn_MASK),
++			(btscr[1] & BN0_WF_MIB_TOP_BTSCR6_RTSRETRYCOUNTn_MASK),
++			(btscr[2] & BN0_WF_MIB_TOP_BTSCR0_BAMISSCOUNTn_MASK),
++			(btscr[3] & BN0_WF_MIB_TOP_BTSCR1_ACKFAILCOUNTn_MASK),
++			(btscr[4] & BN0_WF_MIB_TOP_BTSCR2_FRAMERETRYCOUNTn_MASK),
++			(btscr[5] & BN0_WF_MIB_TOP_BTSCR3_FRAMERETRY2COUNTn_MASK),
++			(btscr[6] & BN0_WF_MIB_TOP_BTSCR4_FRAMERETRY3COUNTn_MASK));
++	}
++
++	/* Dummy delimiter insertion result */
++	seq_printf(s, "===Dummy delimiter insertion result===\n");
++	tdrcr[0] = mt76_rr(dev, BN0_WF_MIB_TOP_TDRCR0_ADDR + band_offset);
++	tdrcr[1] = mt76_rr(dev, BN0_WF_MIB_TOP_TDRCR1_ADDR + band_offset);
++	tdrcr[2] = mt76_rr(dev, BN0_WF_MIB_TOP_TDRCR2_ADDR + band_offset);
++	tdrcr[3] = mt76_rr(dev, BN0_WF_MIB_TOP_TDRCR3_ADDR + band_offset);
++	tdrcr[4] = mt76_rr(dev, BN0_WF_MIB_TOP_TDRCR4_ADDR + band_offset);
++
++	seq_printf(s, "Range0 = %d\t Range1 = %d\t Range2 = %d\t Range3 = %d\t Range4 = %d\n",
++		tdrcr[0],
++		tdrcr[1],
++		tdrcr[2],
++		tdrcr[3],
++		tdrcr[4]);
++
++	/* Per-MBSS T/RX Counters */
++	seq_printf(s, "===Per-MBSS Related Tx/Rx Counters===\n");
++	seq_printf(s, "MBSSIdx   TxOkCnt  TxByteCnt  RxOkCnt  RxByteCnt\n");
++
++	for (idx = 0; idx < 16; idx++) {
++		mbtocr[idx] = mt76_rr(dev, BN0_WF_MIB_TOP_BTOCR_ADDR + band_offset + (bss_nums + idx) * 4);
++		mbtbcr[idx] = mt76_rr(dev, BN0_WF_MIB_TOP_BTBCR_ADDR + band_offset + (bss_nums + idx) * 4);
++
++		mbrocr[idx] = mt76_rr(dev, WF_UMIB_TOP_B0BROCR_ADDR + band_offset_umib + (bss_nums + idx) * 4);
++		mbrbcr[idx] = mt76_rr(dev, WF_UMIB_TOP_B0BRBCR_ADDR + band_offset_umib + (bss_nums + idx) * 4);
++	}
++
++	for (idx = 0; idx < 16; idx++) {
++		seq_printf(s, "%d\t 0x%x\t 0x%x \t 0x%x \t 0x%x\n",
++			idx, mbtocr[idx], mbtbcr[idx], mbrocr[idx], mbrbcr[idx]);
++	}
++
++	return 0;
++}
++
++static int mt7996_mibinfo_band0(struct seq_file *s, void *data)
++{
++	mt7996_mibinfo_read_per_band(s, MT_BAND0);
++	return 0;
++}
++
++static int mt7996_mibinfo_band1(struct seq_file *s, void *data)
++{
++	mt7996_mibinfo_read_per_band(s, MT_BAND1);
++	return 0;
++}
++
++static int mt7996_mibinfo_band2(struct seq_file *s, void *data)
++{
++	mt7996_mibinfo_read_per_band(s, MT_BAND2);
++	return 0;
++}
++
++/* WTBL INFO */
++static int
++mt7996_wtbl_read_raw(struct mt7996_dev *dev, u16 idx,
++		     enum mt7996_wtbl_type type, u16 start_dw,
++		     u16 len, void *buf)
++{
++	u32 *dest_cpy = (u32 *)buf;
++	u32 size_dw = len;
++	u32 src = 0;
++
++	if (!buf)
++		return 0xFF;
++
++	if (type == WTBL_TYPE_LMAC) {
++		mt76_wr(dev, MT_DBG_WTBLON_TOP_WDUCR_ADDR,
++			FIELD_PREP(MT_DBG_WTBLON_TOP_WDUCR_GROUP, (idx >> 7)));
++		src = LWTBL_IDX2BASE(idx, start_dw);
++	} else if (type == WTBL_TYPE_UMAC) {
++		mt76_wr(dev,  MT_DBG_UWTBL_TOP_WDUCR_ADDR,
++			FIELD_PREP(MT_DBG_UWTBL_TOP_WDUCR_GROUP, (idx >> 7)));
++		src = UWTBL_IDX2BASE(idx, start_dw);
++	} else if (type == WTBL_TYPE_KEY) {
++		mt76_wr(dev,  MT_DBG_UWTBL_TOP_WDUCR_ADDR,
++			MT_DBG_UWTBL_TOP_WDUCR_TARGET |
++			FIELD_PREP(MT_DBG_UWTBL_TOP_WDUCR_GROUP, (idx >> 7)));
++		src = KEYTBL_IDX2BASE(idx, start_dw);
++	}
++
++	while (size_dw--) {
++		*dest_cpy++ = mt76_rr(dev, src);
++		src += 4;
++	};
++
++	return 0;
++}
++
++#if 0
++static int
++mt7996_wtbl_write_raw(struct mt7996_dev *dev, u16 idx,
++			  enum mt7996_wtbl_type type, u16 start_dw,
++			  u32 val)
++{
++	u32 addr = 0;
++
++	if (type == WTBL_TYPE_LMAC) {
++		mt76_wr(dev, MT_DBG_WTBLON_TOP_WDUCR_ADDR,
++			FIELD_PREP(MT_DBG_WTBLON_TOP_WDUCR_GROUP, (idx >> 7)));
++		addr = LWTBL_IDX2BASE(idx, start_dw);
++	} else if (type == WTBL_TYPE_UMAC) {
++		mt76_wr(dev, MT_DBG_UWTBL_TOP_WDUCR_ADDR,
++			FIELD_PREP(MT_DBG_UWTBL_TOP_WDUCR_GROUP, (idx >> 7)));
++		addr = UWTBL_IDX2BASE(idx, start_dw);
++	} else if (type == WTBL_TYPE_KEY) {
++		mt76_wr(dev, MT_DBG_UWTBL_TOP_WDUCR_ADDR,
++			MT_DBG_UWTBL_TOP_WDUCR_TARGET |
++			FIELD_PREP(MT_DBG_UWTBL_TOP_WDUCR_GROUP, (idx >> 7)));
++		addr = KEYTBL_IDX2BASE(idx, start_dw);
++	}
++
++	mt76_wr(dev, addr, val);
++
++	return 0;
++}
++#endif
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW0[] = {
++	{"MUAR_IDX",    WF_LWTBL_MUAR_MASK, WF_LWTBL_MUAR_SHIFT,false},
++	{"RCA1",        WF_LWTBL_RCA1_MASK, NO_SHIFT_DEFINE,	false},
++	{"KID",         WF_LWTBL_KID_MASK,  WF_LWTBL_KID_SHIFT,	false},
++	{"RCID",        WF_LWTBL_RCID_MASK, NO_SHIFT_DEFINE,	false},
++	{"BAND",        WF_LWTBL_BAND_MASK, WF_LWTBL_BAND_SHIFT,false},
++	{"RV",          WF_LWTBL_RV_MASK,   NO_SHIFT_DEFINE,	false},
++	{"RCA2",        WF_LWTBL_RCA2_MASK, NO_SHIFT_DEFINE,	false},
++	{"WPI_FLAG",    WF_LWTBL_WPI_FLAG_MASK, NO_SHIFT_DEFINE,true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw0_1(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LinkAddr: %02x:%02x:%02x:%02x:%02x:%02x(D0[B0~15], D1[B0~31])\n",
++		lwtbl[4], lwtbl[5], lwtbl[6], lwtbl[7], lwtbl[0], lwtbl[1]);
++
++	/* LMAC WTBL DW 0 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 0/1\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_PEER_INFO_DW_0*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW0[i].name) {
++
++		if (WTBL_LMAC_DW0[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW0[i].name,
++					 (dw_value & WTBL_LMAC_DW0[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW0[i].name,
++					  (dw_value & WTBL_LMAC_DW0[i].mask) >> WTBL_LMAC_DW0[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW2[] = {
++	{"AID",                 WF_LWTBL_AID_MASK,              WF_LWTBL_AID_SHIFT,	false},
++	{"GID_SU",              WF_LWTBL_GID_SU_MASK,           NO_SHIFT_DEFINE,	false},
++	{"SPP_EN",              WF_LWTBL_SPP_EN_MASK,           NO_SHIFT_DEFINE,	false},
++	{"WPI_EVEN",            WF_LWTBL_WPI_EVEN_MASK,         NO_SHIFT_DEFINE,	false},
++	{"AAD_OM",              WF_LWTBL_AAD_OM_MASK,           NO_SHIFT_DEFINE,	false},
++	{"CIPHER_PGTK",WF_LWTBL_CIPHER_SUIT_PGTK_MASK, WF_LWTBL_CIPHER_SUIT_PGTK_SHIFT,	true},
++	{"FROM_DS",             WF_LWTBL_FD_MASK,               NO_SHIFT_DEFINE,	false},
++	{"TO_DS",               WF_LWTBL_TD_MASK,               NO_SHIFT_DEFINE,	false},
++	{"SW",                  WF_LWTBL_SW_MASK,               NO_SHIFT_DEFINE,	false},
++	{"UL",                  WF_LWTBL_UL_MASK,               NO_SHIFT_DEFINE,	false},
++	{"TX_POWER_SAVE",       WF_LWTBL_TX_PS_MASK,            NO_SHIFT_DEFINE,	true},
++	{"QOS",                 WF_LWTBL_QOS_MASK,              NO_SHIFT_DEFINE,	false},
++	{"HT",                  WF_LWTBL_HT_MASK,               NO_SHIFT_DEFINE,	false},
++	{"VHT",                 WF_LWTBL_VHT_MASK,              NO_SHIFT_DEFINE,	false},
++	{"HE",                  WF_LWTBL_HE_MASK,               NO_SHIFT_DEFINE,	false},
++	{"EHT",                 WF_LWTBL_EHT_MASK,              NO_SHIFT_DEFINE,	false},
++	{"MESH",                WF_LWTBL_MESH_MASK,             NO_SHIFT_DEFINE,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw2(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 2 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 2\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_TRX_CAP_DW_2*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW2[i].name) {
++
++		if (WTBL_LMAC_DW2[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW2[i].name,
++					 (dw_value & WTBL_LMAC_DW2[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW2[i].name,
++					  (dw_value & WTBL_LMAC_DW2[i].mask) >> WTBL_LMAC_DW2[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW3[] = {
++	{"WMM_Q",           WF_LWTBL_WMM_Q_MASK,		WF_LWTBL_WMM_Q_SHIFT,		false},
++	{"EHT_SIG_MCS",     WF_LWTBL_EHT_SIG_MCS_MASK,		WF_LWTBL_EHT_SIG_MCS_SHIFT,	false},
++	{"HDRT_MODE",       WF_LWTBL_HDRT_MODE_MASK,		NO_SHIFT_DEFINE,		false},
++	{"BEAM_CHG",        WF_LWTBL_BEAM_CHG_MASK,		NO_SHIFT_DEFINE,		false},
++	{"EHT_LTF_SYM_NUM", WF_LWTBL_EHT_LTF_SYM_NUM_OPT_MASK,  WF_LWTBL_EHT_LTF_SYM_NUM_OPT_SHIFT,	true},
++	{"PFMU_IDX",	    WF_LWTBL_PFMU_IDX_MASK,		WF_LWTBL_PFMU_IDX_SHIFT,	false},
++	{"ULPF_IDX",	    WF_LWTBL_ULPF_IDX_MASK,		WF_LWTBL_ULPF_IDX_SHIFT,	false},
++	{"RIBF",	    WF_LWTBL_RIBF_MASK,			NO_SHIFT_DEFINE,		false},
++	{"ULPF",	    WF_LWTBL_ULPF_MASK,			NO_SHIFT_DEFINE,		true},
++	{"TBF_HT",          WF_LWTBL_TBF_HT_MASK,		NO_SHIFT_DEFINE,		false},
++	{"TBF_VHT",         WF_LWTBL_TBF_VHT_MASK,		NO_SHIFT_DEFINE,		false},
++	{"TBF_HE",          WF_LWTBL_TBF_HE_MASK,		NO_SHIFT_DEFINE,		false},
++	{"TBF_EHT",         WF_LWTBL_TBF_EHT_MASK,		NO_SHIFT_DEFINE,		false},
++	{"IGN_FBK",         WF_LWTBL_IGN_FBK_MASK,		NO_SHIFT_DEFINE,		true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw3(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 3 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 3\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_TRX_CAP_DW_3*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW3[i].name) {
++
++		if (WTBL_LMAC_DW3[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW3[i].name,
++					 (dw_value & WTBL_LMAC_DW3[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW3[i].name,
++					  (dw_value & WTBL_LMAC_DW3[i].mask) >> WTBL_LMAC_DW3[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW4[] = {
++	{"ANT_ID_STS0",     WF_LWTBL_ANT_ID0_MASK,      WF_LWTBL_ANT_ID0_SHIFT,	false},
++	{"STS1",            WF_LWTBL_ANT_ID1_MASK,      WF_LWTBL_ANT_ID1_SHIFT,	false},
++	{"STS2",            WF_LWTBL_ANT_ID2_MASK,      WF_LWTBL_ANT_ID2_SHIFT,	false},
++	{"STS3",            WF_LWTBL_ANT_ID3_MASK,      WF_LWTBL_ANT_ID3_SHIFT,	true},
++	{"ANT_ID_STS4",     WF_LWTBL_ANT_ID4_MASK,      WF_LWTBL_ANT_ID4_SHIFT,	false},
++	{"STS5",            WF_LWTBL_ANT_ID5_MASK,      WF_LWTBL_ANT_ID5_SHIFT,	false},
++	{"STS6",            WF_LWTBL_ANT_ID6_MASK,      WF_LWTBL_ANT_ID6_SHIFT,	false},
++	{"STS7",            WF_LWTBL_ANT_ID7_MASK,      WF_LWTBL_ANT_ID7_SHIFT,	true},
++	{"PE",              WF_LWTBL_PE_MASK,           WF_LWTBL_PE_SHIFT,	false},
++	{"DIS_RHTR",        WF_LWTBL_DIS_RHTR_MASK,     NO_SHIFT_DEFINE,	false},
++	{"LDPC_HT",         WF_LWTBL_LDPC_HT_MASK,      NO_SHIFT_DEFINE,	false},
++	{"LDPC_VHT",        WF_LWTBL_LDPC_VHT_MASK,     NO_SHIFT_DEFINE,	false},
++	{"LDPC_HE",         WF_LWTBL_LDPC_HE_MASK,      NO_SHIFT_DEFINE,	false},
++	{"LDPC_EHT",	    WF_LWTBL_LDPC_EHT_MASK,	NO_SHIFT_DEFINE,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw4(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 4 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 4\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_TRX_CAP_DW_4*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW4[i].name) {
++		if (WTBL_LMAC_DW4[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW4[i].name,
++					 (dw_value & WTBL_LMAC_DW4[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW4[i].name,
++					  (dw_value & WTBL_LMAC_DW4[i].mask) >> WTBL_LMAC_DW4[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW5[] = {
++	{"AF",                  WF_LWTBL_AF_MASK,           WF_LWTBL_AF_SHIFT,	false},
++	{"AF_HE",               WF_LWTBL_AF_HE_MASK,        WF_LWTBL_AF_HE_SHIFT,false},
++	{"RTS",                 WF_LWTBL_RTS_MASK,          NO_SHIFT_DEFINE,	false},
++	{"SMPS",                WF_LWTBL_SMPS_MASK,         NO_SHIFT_DEFINE,	false},
++	{"DYN_BW",              WF_LWTBL_DYN_BW_MASK,       NO_SHIFT_DEFINE,	true},
++	{"MMSS",                WF_LWTBL_MMSS_MASK,         WF_LWTBL_MMSS_SHIFT,false},
++	{"USR",                 WF_LWTBL_USR_MASK,          NO_SHIFT_DEFINE,	false},
++	{"SR_RATE",             WF_LWTBL_SR_R_MASK,         WF_LWTBL_SR_R_SHIFT,false},
++	{"SR_ABORT",            WF_LWTBL_SR_ABORT_MASK,     NO_SHIFT_DEFINE,	true},
++	{"TX_POWER_OFFSET",     WF_LWTBL_TX_POWER_OFFSET_MASK,  WF_LWTBL_TX_POWER_OFFSET_SHIFT,	false},
++	{"LTF_EHT",		WF_LWTBL_LTF_EHT_MASK,      WF_LWTBL_LTF_EHT_SHIFT, false},
++	{"GI_EHT",		WF_LWTBL_GI_EHT_MASK,       WF_LWTBL_GI_EHT_SHIFT, false},
++	{"DOPPL",               WF_LWTBL_DOPPL_MASK,        NO_SHIFT_DEFINE,	false},
++	{"TXOP_PS_CAP",         WF_LWTBL_TXOP_PS_CAP_MASK,  NO_SHIFT_DEFINE,	false},
++	{"DONOT_UPDATE_I_PSM",  WF_LWTBL_DU_I_PSM_MASK,     NO_SHIFT_DEFINE,	true},
++	{"I_PSM",               WF_LWTBL_I_PSM_MASK,        NO_SHIFT_DEFINE,	false},
++	{"PSM",                 WF_LWTBL_PSM_MASK,          NO_SHIFT_DEFINE,	false},
++	{"SKIP_TX",             WF_LWTBL_SKIP_TX_MASK,      NO_SHIFT_DEFINE,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw5(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 5 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 5\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_TRX_CAP_DW_5*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW5[i].name) {
++		if (WTBL_LMAC_DW5[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW5[i].name,
++					 (dw_value & WTBL_LMAC_DW5[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW5[i].name,
++					  (dw_value & WTBL_LMAC_DW5[i].mask) >> WTBL_LMAC_DW5[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW6[] = {
++	{"CBRN",        WF_LWTBL_CBRN_MASK,	    WF_LWTBL_CBRN_SHIFT,	false},
++	{"DBNSS_EN",    WF_LWTBL_DBNSS_EN_MASK, NO_SHIFT_DEFINE,	false},
++	{"BAF_EN",      WF_LWTBL_BAF_EN_MASK,   NO_SHIFT_DEFINE,	false},
++	{"RDGBA",       WF_LWTBL_RDGBA_MASK,    NO_SHIFT_DEFINE,	false},
++	{"RDG",         WF_LWTBL_R_MASK,        NO_SHIFT_DEFINE,	false},
++	{"SPE_IDX",     WF_LWTBL_SPE_IDX_MASK,  WF_LWTBL_SPE_IDX_SHIFT,	true},
++	{"G2",          WF_LWTBL_G2_MASK,       NO_SHIFT_DEFINE,	false},
++	{"G4",          WF_LWTBL_G4_MASK,       NO_SHIFT_DEFINE,	false},
++	{"G8",          WF_LWTBL_G8_MASK,       NO_SHIFT_DEFINE,	false},
++	{"G16",         WF_LWTBL_G16_MASK,      NO_SHIFT_DEFINE,	true},
++	{"G2_LTF",      WF_LWTBL_G2_LTF_MASK,   WF_LWTBL_G2_LTF_SHIFT,	false},
++	{"G4_LTF",      WF_LWTBL_G4_LTF_MASK,   WF_LWTBL_G4_LTF_SHIFT,	false},
++	{"G8_LTF",      WF_LWTBL_G8_LTF_MASK,   WF_LWTBL_G8_LTF_SHIFT,	false},
++	{"G16_LTF",     WF_LWTBL_G16_LTF_MASK,  WF_LWTBL_G16_LTF_SHIFT,	true},
++	{"G2_HE",       WF_LWTBL_G2_HE_MASK,    WF_LWTBL_G2_HE_SHIFT,	false},
++	{"G4_HE",       WF_LWTBL_G4_HE_MASK,    WF_LWTBL_G4_HE_SHIFT,	false},
++	{"G8_HE",       WF_LWTBL_G8_HE_MASK,    WF_LWTBL_G8_HE_SHIFT,	false},
++	{"G16_HE",      WF_LWTBL_G16_HE_MASK,   WF_LWTBL_G16_HE_SHIFT,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw6(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 6 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 6\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_TRX_CAP_DW_6*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW6[i].name) {
++		if (WTBL_LMAC_DW6[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW6[i].name,
++					 (dw_value & WTBL_LMAC_DW6[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW6[i].name,
++					  (dw_value & WTBL_LMAC_DW6[i].mask) >> WTBL_LMAC_DW6[i].shift);
++		i++;
++	}
++}
++
++static void parse_fmac_lwtbl_dw7(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	int i = 0;
++
++	/* LMAC WTBL DW 7 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 7\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_TRX_CAP_DW_7*4]);
++	dw_value = *addr;
++
++	for (i = 0; i < 8; i++) {
++		seq_printf(s, "\tBA_WIN_SIZE%u:%lu\n", i, ((dw_value & BITS(i*4, i*4+3)) >> i*4));
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW8[] = {
++	{"RTS_FAIL_CNT_AC0",    WF_LWTBL_AC0_RTS_FAIL_CNT_MASK,	WF_LWTBL_AC0_RTS_FAIL_CNT_SHIFT,	false},
++	{"AC1",                 WF_LWTBL_AC1_RTS_FAIL_CNT_MASK,	WF_LWTBL_AC1_RTS_FAIL_CNT_SHIFT,	false},
++	{"AC2",                 WF_LWTBL_AC2_RTS_FAIL_CNT_MASK,	WF_LWTBL_AC2_RTS_FAIL_CNT_SHIFT,	false},
++	{"AC3",                 WF_LWTBL_AC3_RTS_FAIL_CNT_MASK,	WF_LWTBL_AC3_RTS_FAIL_CNT_SHIFT,	true},
++	{"PARTIAL_AID",         WF_LWTBL_PARTIAL_AID_MASK,		WF_LWTBL_PARTIAL_AID_SHIFT,	false},
++	{"CHK_PER",             WF_LWTBL_CHK_PER_MASK,		NO_SHIFT_DEFINE,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw8(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 8 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 8\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_TRX_CAP_DW_8*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW8[i].name) {
++		if (WTBL_LMAC_DW8[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW8[i].name,
++					 (dw_value & WTBL_LMAC_DW8[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW8[i].name,
++					  (dw_value & WTBL_LMAC_DW8[i].mask) >> WTBL_LMAC_DW8[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW9[] = {
++	{"RX_AVG_MPDU_SIZE",    WF_LWTBL_RX_AVG_MPDU_SIZE_MASK,    WF_LWTBL_RX_AVG_MPDU_SIZE_SHIFT,	false},
++	{"PRITX_SW_MODE",       WF_LWTBL_PRITX_SW_MODE_MASK,       NO_SHIFT_DEFINE,	false},
++	{"PRITX_ERSU",	    WF_LWTBL_PRITX_ERSU_MASK,	       NO_SHIFT_DEFINE,	false},
++	{"PRITX_PLR",           WF_LWTBL_PRITX_PLR_MASK,           NO_SHIFT_DEFINE,	true},
++	{"PRITX_DCM",           WF_LWTBL_PRITX_DCM_MASK,           NO_SHIFT_DEFINE,	false},
++	{"PRITX_ER106T",        WF_LWTBL_PRITX_ER106T_MASK,        NO_SHIFT_DEFINE,	true},
++	/* {"FCAP(0:20 1:~40)",    WTBL_FCAP_20_TO_160_MHZ,	WTBL_FCAP_20_TO_160_MHZ_OFFSET}, */
++	{"MPDU_FAIL_CNT",       WF_LWTBL_MPDU_FAIL_CNT_MASK,       WF_LWTBL_MPDU_FAIL_CNT_SHIFT,	false},
++	{"MPDU_OK_CNT",         WF_LWTBL_MPDU_OK_CNT_MASK,         WF_LWTBL_MPDU_OK_CNT_SHIFT,	false},
++	{"RATE_IDX",            WF_LWTBL_RATE_IDX_MASK,            WF_LWTBL_RATE_IDX_SHIFT,	true},
++	{NULL,}
++};
++
++char *fcap_name[] = {"20MHz", "20/40MHz", "20/40/80MHz", "20/40/80/160/80+80MHz", "20/40/80/160/80+80/320MHz"};
++
++static void parse_fmac_lwtbl_dw9(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 9 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 9\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_TRX_CAP_DW_9*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW9[i].name) {
++		if (WTBL_LMAC_DW9[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW9[i].name,
++					 (dw_value & WTBL_LMAC_DW9[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW9[i].name,
++					  (dw_value & WTBL_LMAC_DW9[i].mask) >> WTBL_LMAC_DW9[i].shift);
++		i++;
++	}
++
++	/* FCAP parser */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "FCAP:%s\n", fcap_name[(dw_value & WF_LWTBL_FCAP_MASK) >> WF_LWTBL_FCAP_SHIFT]);
++}
++
++#define HW_TX_RATE_TO_MODE(_x)			(((_x) & WTBL_RATE_TX_MODE_MASK) >> WTBL_RATE_TX_MODE_OFFSET)
++#define HW_TX_RATE_TO_MCS(_x, _mode)		((_x) & WTBL_RATE_TX_RATE_MASK >> WTBL_RATE_TX_RATE_OFFSET)
++#define HW_TX_RATE_TO_NSS(_x)			(((_x) & WTBL_RATE_NSTS_MASK) >> WTBL_RATE_NSTS_OFFSET)
++#define HW_TX_RATE_TO_STBC(_x)			(((_x) & WTBL_RATE_STBC_MASK) >> WTBL_RATE_STBC_OFFSET)
++
++#define MAX_TX_MODE 16
++static char *HW_TX_MODE_STR[] = {"CCK", "OFDM", "HT-Mix", "HT-GF", "VHT",
++				 "N/A", "N/A", "N/A",
++				 "HE_SU", "HE_EXT_SU", "HE_TRIG", "HE_MU",
++				 "N/A",
++				 "EHT_EXT_SU", "EHT_TRIG", "EHT_MU",
++				 "N/A"};
++static char *HW_TX_RATE_CCK_STR[] = {"1M", "2Mlong", "5.5Mlong", "11Mlong", "N/A", "2Mshort", "5.5Mshort", "11Mshort", "N/A"};
++static char *HW_TX_RATE_OFDM_STR[] = {"6M", "9M", "12M", "18M", "24M", "36M", "48M", "54M", "N/A"};
++
++static char *hw_rate_ofdm_str(uint16_t ofdm_idx)
++{
++	switch (ofdm_idx) {
++	case 11: /* 6M */
++		return HW_TX_RATE_OFDM_STR[0];
++
++	case 15: /* 9M */
++		return HW_TX_RATE_OFDM_STR[1];
++
++	case 10: /* 12M */
++		return HW_TX_RATE_OFDM_STR[2];
++
++	case 14: /* 18M */
++		return HW_TX_RATE_OFDM_STR[3];
++
++	case 9: /* 24M */
++		return HW_TX_RATE_OFDM_STR[4];
++
++	case 13: /* 36M */
++		return HW_TX_RATE_OFDM_STR[5];
++
++	case 8: /* 48M */
++		return HW_TX_RATE_OFDM_STR[6];
++
++	case 12: /* 54M */
++		return HW_TX_RATE_OFDM_STR[7];
++
++	default:
++		return HW_TX_RATE_OFDM_STR[8];
++	}
++}
++
++static char *hw_rate_str(u8 mode, uint16_t rate_idx)
++{
++	if (mode == 0)
++		return rate_idx < 8 ? HW_TX_RATE_CCK_STR[rate_idx] : HW_TX_RATE_CCK_STR[8];
++	else if (mode == 1)
++		return hw_rate_ofdm_str(rate_idx);
++	else
++		return "MCS";
++}
++
++static void
++parse_rate(struct seq_file *s, uint16_t rate_idx, uint16_t txrate)
++{
++	uint16_t txmode, mcs, nss, stbc;
++
++	txmode = HW_TX_RATE_TO_MODE(txrate);
++	mcs = HW_TX_RATE_TO_MCS(txrate, txmode);
++	nss = HW_TX_RATE_TO_NSS(txrate);
++	stbc = HW_TX_RATE_TO_STBC(txrate);
++
++	seq_printf(s, "\tRate%d(0x%x):TxMode=%d(%s), TxRate=%d(%s), Nsts=%d, STBC=%d\n",
++			  rate_idx + 1, txrate,
++			  txmode, (txmode < MAX_TX_MODE ? HW_TX_MODE_STR[txmode] : HW_TX_MODE_STR[MAX_TX_MODE]),
++			  mcs, hw_rate_str(txmode, mcs), nss, stbc);
++}
++
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW10[] = {
++	{"RATE1",       WF_LWTBL_RATE1_MASK,        WF_LWTBL_RATE1_SHIFT},
++	{"RATE2",       WF_LWTBL_RATE2_MASK,        WF_LWTBL_RATE2_SHIFT},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw10(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 10 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 10\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_AUTO_RATE_1_2*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW10[i].name) {
++		parse_rate(s, i, (dw_value & WTBL_LMAC_DW10[i].mask) >> WTBL_LMAC_DW10[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW11[] = {
++	{"RATE3",       WF_LWTBL_RATE3_MASK,        WF_LWTBL_RATE3_SHIFT},
++	{"RATE4",       WF_LWTBL_RATE4_MASK,        WF_LWTBL_RATE4_SHIFT},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw11(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 11 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 11\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_AUTO_RATE_3_4*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW11[i].name) {
++		parse_rate(s, i+2, (dw_value & WTBL_LMAC_DW11[i].mask) >> WTBL_LMAC_DW11[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW12[] = {
++	{"RATE5",       WF_LWTBL_RATE5_MASK,        WF_LWTBL_RATE5_SHIFT},
++	{"RATE6",       WF_LWTBL_RATE6_MASK,        WF_LWTBL_RATE6_SHIFT},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw12(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 12 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 12\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_AUTO_RATE_5_6*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW12[i].name) {
++		parse_rate(s, i+4, (dw_value & WTBL_LMAC_DW12[i].mask) >> WTBL_LMAC_DW12[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW13[] = {
++	{"RATE7",       WF_LWTBL_RATE7_MASK,        WF_LWTBL_RATE7_SHIFT},
++	{"RATE8",       WF_LWTBL_RATE8_MASK,        WF_LWTBL_RATE8_SHIFT},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw13(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 13 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 13\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_AUTO_RATE_7_8*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW13[i].name) {
++		parse_rate(s, i+6, (dw_value & WTBL_LMAC_DW13[i].mask) >> WTBL_LMAC_DW13[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW14_BMC[] = {
++	{"CIPHER_IGTK",         WF_LWTBL_CIPHER_SUIT_IGTK_MASK,    WF_LWTBL_CIPHER_SUIT_IGTK_SHIFT,		false},
++	{"CIPHER_BIGTK",        WF_LWTBL_CIPHER_SUIT_BIGTK_MASK,   WF_LWTBL_CIPHER_SUIT_BIGTK_SHIFT,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw14(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr, *muar_addr = 0;
++	u32 dw_value, muar_dw_value = 0;
++	u16 i = 0;
++
++	/* DUMP DW14 for BMC entry only */
++	muar_addr = (u32 *)&(lwtbl[WF_LWTBL_MUAR_DW*4]);
++	muar_dw_value = *muar_addr;
++	if (((muar_dw_value & WF_LWTBL_MUAR_MASK) >> WF_LWTBL_MUAR_SHIFT)
++		== MUAR_INDEX_OWN_MAC_ADDR_BC_MC) {
++		/* LMAC WTBL DW 14 */
++		seq_printf(s, "\t\n");
++		seq_printf(s, "LWTBL DW 14\n");
++		addr = (u32 *)&(lwtbl[WF_LWTBL_CIPHER_SUIT_IGTK_DW*4]);
++		dw_value = *addr;
++
++		while (WTBL_LMAC_DW14_BMC[i].name) {
++			parse_rate(s, i+6, (dw_value & WTBL_LMAC_DW14_BMC[i].mask) >> WTBL_LMAC_DW14_BMC[i].shift);
++			i++;
++		}
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW28[] = {
++	{"RELATED_IDX0",	WF_LWTBL_RELATED_IDX0_MASK,		WF_LWTBL_RELATED_IDX0_SHIFT,	false},
++	{"RELATED_BAND0",	WF_LWTBL_RELATED_BAND0_MASK,		WF_LWTBL_RELATED_BAND0_SHIFT,	false},
++	{"PRI_MLD_BAND",    WF_LWTBL_PRIMARY_MLD_BAND_MASK,		WF_LWTBL_PRIMARY_MLD_BAND_SHIFT,	true},
++	{"RELATED_IDX0",	WF_LWTBL_RELATED_IDX1_MASK,		WF_LWTBL_RELATED_IDX1_SHIFT,	false},
++	{"RELATED_BAND1",   WF_LWTBL_RELATED_BAND1_MASK,		WF_LWTBL_RELATED_BAND1_SHIFT,	false},
++	{"SEC_MLD_BAND",	WF_LWTBL_SECONDARY_MLD_BAND_MASK,	WF_LWTBL_SECONDARY_MLD_BAND_SHIFT,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw28(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 28 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 28\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_MLO_INFO_LINE_1*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW28[i].name) {
++		if (WTBL_LMAC_DW28[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW28[i].name,
++				(dw_value & WTBL_LMAC_DW28[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW28[i].name,
++				(dw_value & WTBL_LMAC_DW28[i].mask) >>
++					WTBL_LMAC_DW28[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW29[] = {
++	{"DISPATCH_POLICY_MLD_TID0", WF_LWTBL_DISPATCH_POLICY0_MASK,	WF_LWTBL_DISPATCH_POLICY0_SHIFT,	false},
++	{"MLD_TID1",	WF_LWTBL_DISPATCH_POLICY1_MASK,		WF_LWTBL_DISPATCH_POLICY1_SHIFT,	false},
++	{"MLD_TID2",	WF_LWTBL_DISPATCH_POLICY2_MASK,		WF_LWTBL_DISPATCH_POLICY2_SHIFT,	false},
++	{"MLD_TID3",	WF_LWTBL_DISPATCH_POLICY3_MASK,	WF_LWTBL_DISPATCH_POLICY3_SHIFT,	true},
++	{"MLD_TID4",	WF_LWTBL_DISPATCH_POLICY4_MASK,		WF_LWTBL_DISPATCH_POLICY4_SHIFT,	false},
++	{"MLD_TID5",	WF_LWTBL_DISPATCH_POLICY5_MASK,		WF_LWTBL_DISPATCH_POLICY5_SHIFT,	false},
++	{"MLD_TID6",	WF_LWTBL_DISPATCH_POLICY6_MASK,		WF_LWTBL_DISPATCH_POLICY6_SHIFT,	false},
++	{"MLD_TID7",	WF_LWTBL_DISPATCH_POLICY7_MASK,		WF_LWTBL_DISPATCH_POLICY7_SHIFT,	true},
++	{"OMLD_ID",		WF_LWTBL_OWN_MLD_ID_MASK,	WF_LWTBL_OWN_MLD_ID_SHIFT,	false},
++	{"EMLSR0",		WF_LWTBL_EMLSR0_MASK,		NO_SHIFT_DEFINE,	false},
++	{"EMLMR0",		WF_LWTBL_EMLMR0_MASK,		NO_SHIFT_DEFINE,	false},
++	{"EMLSR1",		WF_LWTBL_EMLSR1_MASK,		NO_SHIFT_DEFINE,	false},
++	{"EMLMR1",		WF_LWTBL_EMLMR1_MASK,		NO_SHIFT_DEFINE,	true},
++	{"EMLSR2",		WF_LWTBL_EMLSR2_MASK,		NO_SHIFT_DEFINE,	false},
++	{"EMLMR2",		WF_LWTBL_EMLMR2_MASK,		NO_SHIFT_DEFINE,	false},
++	{"STR_BITMAP",	WF_LWTBL_STR_BITMAP_MASK,	WF_LWTBL_STR_BITMAP_SHIFT,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw29(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 29 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 29\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_MLO_INFO_LINE_2*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW29[i].name) {
++		if (WTBL_LMAC_DW29[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW29[i].name,
++				(dw_value & WTBL_LMAC_DW29[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW29[i].name,
++				(dw_value & WTBL_LMAC_DW29[i].mask) >>
++					WTBL_LMAC_DW29[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW30[] = {
++	{"DISPATCH_ORDER",	WF_LWTBL_DISPATCH_ORDER_MASK,	WF_LWTBL_DISPATCH_ORDER_SHIFT,	false},
++	{"DISPATCH_RATIO",	WF_LWTBL_DISPATCH_RATIO_MASK,	WF_LWTBL_DISPATCH_RATIO_SHIFT,	false},
++	{"LINK_MGF",		WF_LWTBL_LINK_MGF_MASK,		WF_LWTBL_LINK_MGF_SHIFT,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw30(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 30 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 30\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_MLO_INFO_LINE_3*4]);
++	dw_value = *addr;
++
++
++	while (WTBL_LMAC_DW30[i].name) {
++		if (WTBL_LMAC_DW30[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW30[i].name,
++				(dw_value & WTBL_LMAC_DW30[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW30[i].name,
++				(dw_value & WTBL_LMAC_DW30[i].mask) >> WTBL_LMAC_DW30[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW31[] = {
++	{"NEGO_WINSIZE0",	WF_LWTBL_NEGOTIATED_WINSIZE0_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE0_SHIFT,    false},
++	{"WINSIZE1",	WF_LWTBL_NEGOTIATED_WINSIZE1_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE1_SHIFT,    false},
++	{"WINSIZE2",	WF_LWTBL_NEGOTIATED_WINSIZE2_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE2_SHIFT,    false},
++	{"WINSIZE3",	WF_LWTBL_NEGOTIATED_WINSIZE3_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE3_SHIFT,    true},
++	{"WINSIZE4",	WF_LWTBL_NEGOTIATED_WINSIZE4_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE4_SHIFT,    false},
++	{"WINSIZE5",	WF_LWTBL_NEGOTIATED_WINSIZE5_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE5_SHIFT,    false},
++	{"WINSIZE6",	WF_LWTBL_NEGOTIATED_WINSIZE6_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE6_SHIFT,    false},
++	{"WINSIZE7",	WF_LWTBL_NEGOTIATED_WINSIZE7_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE7_SHIFT,    true},
++	{"CASCAD",	        WF_LWTBL_CASCAD_MASK,			NO_SHIFT_DEFINE,    false},
++	{"ALL_ACK",	        WF_LWTBL_ALL_ACK_MASK,			NO_SHIFT_DEFINE,    false},
++	{"MPDU_SIZE",	WF_LWTBL_MPDU_SIZE_MASK,		WF_LWTBL_MPDU_SIZE_SHIFT,  false},
++	{"BA_MODE",		WF_LWTBL_BA_MODE_MASK,			WF_LWTBL_BA_MODE_SHIFT,  true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw31(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 31 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 31\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_RESP_INFO_DW_31*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW31[i].name) {
++		if (WTBL_LMAC_DW31[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW31[i].name,
++				(dw_value & WTBL_LMAC_DW31[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW31[i].name,
++				(dw_value & WTBL_LMAC_DW31[i].mask) >>
++					WTBL_LMAC_DW31[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW32[] = {
++	{"OM_INFO",			WF_LWTBL_OM_INFO_MASK,			WF_LWTBL_OM_INFO_SHIFT,		false},
++	{"OM_RXD_DUP_MODE",		WF_LWTBL_RXD_DUP_FOR_OM_CHG_MASK,	NO_SHIFT_DEFINE,		false},
++	{"RXD_DUP_WHITE_LIST",	WF_LWTBL_RXD_DUP_WHITE_LIST_MASK,	WF_LWTBL_RXD_DUP_WHITE_LIST_SHIFT,	false},
++	{"RXD_DUP_MODE",		WF_LWTBL_RXD_DUP_MODE_MASK,		WF_LWTBL_RXD_DUP_MODE_SHIFT,	false},
++	{"DROP",			WF_LWTBL_DROP_MASK,			NO_SHIFT_DEFINE,		false},
++	{"ACK_EN",			WF_LWTBL_ACK_EN_MASK,			NO_SHIFT_DEFINE,		true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw32(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 32 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 32\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_RX_DUP_INFO_DW_32*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW32[i].name) {
++		if (WTBL_LMAC_DW32[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW32[i].name,
++				(dw_value & WTBL_LMAC_DW32[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW32[i].name,
++				(dw_value & WTBL_LMAC_DW32[i].mask) >>
++					WTBL_LMAC_DW32[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW33[] = {
++	{"USER_RSSI",                   WF_LWTBL_USER_RSSI_MASK,            WF_LWTBL_USER_RSSI_SHIFT,	false},
++	{"USER_SNR",                    WF_LWTBL_USER_SNR_MASK,             WF_LWTBL_USER_SNR_SHIFT,	false},
++	{"RAPID_REACTION_RATE",         WF_LWTBL_RAPID_REACTION_RATE_MASK,  WF_LWTBL_RAPID_REACTION_RATE_SHIFT,	true},
++	{"HT_AMSDU(Read Only)",         WF_LWTBL_HT_AMSDU_MASK,             NO_SHIFT_DEFINE,	false},
++	{"AMSDU_CROSS_LG(Read Only)",   WF_LWTBL_AMSDU_CROSS_LG_MASK,       NO_SHIFT_DEFINE,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw33(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 33 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 33\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_RX_STAT_CNT_LINE_1*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW33[i].name) {
++		if (WTBL_LMAC_DW33[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW33[i].name,
++				(dw_value & WTBL_LMAC_DW33[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW33[i].name,
++				(dw_value & WTBL_LMAC_DW33[i].mask) >>
++					WTBL_LMAC_DW33[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW34[] = {
++	{"RESP_RCPI0",	WF_LWTBL_RESP_RCPI0_MASK,	WF_LWTBL_RESP_RCPI0_SHIFT,	false},
++	{"RCPI1",	WF_LWTBL_RESP_RCPI1_MASK,	WF_LWTBL_RESP_RCPI1_SHIFT,	false},
++	{"RCPI2",	WF_LWTBL_RESP_RCPI2_MASK,	WF_LWTBL_RESP_RCPI2_SHIFT,	false},
++	{"RCPI3",	WF_LWTBL_RESP_RCPI3_MASK,	WF_LWTBL_RESP_RCPI3_SHIFT,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw34(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 34 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 34\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_RX_STAT_CNT_LINE_2*4]);
++	dw_value = *addr;
++
++
++	while (WTBL_LMAC_DW34[i].name) {
++		if (WTBL_LMAC_DW34[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW34[i].name,
++				(dw_value & WTBL_LMAC_DW34[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW34[i].name,
++				(dw_value & WTBL_LMAC_DW34[i].mask) >>
++					WTBL_LMAC_DW34[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW35[] = {
++	{"SNR 0",	WF_LWTBL_SNR_RX0_MASK,		WF_LWTBL_SNR_RX0_SHIFT,	false},
++	{"SNR 1",	WF_LWTBL_SNR_RX1_MASK,		WF_LWTBL_SNR_RX1_SHIFT,	false},
++	{"SNR 2",	WF_LWTBL_SNR_RX2_MASK,		WF_LWTBL_SNR_RX2_SHIFT,	false},
++	{"SNR 3",	WF_LWTBL_SNR_RX3_MASK,		WF_LWTBL_SNR_RX3_SHIFT,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw35(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 35 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 35\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_RX_STAT_CNT_LINE_3*4]);
++	dw_value = *addr;
++
++
++	while (WTBL_LMAC_DW35[i].name) {
++		if (WTBL_LMAC_DW35[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW35[i].name,
++				(dw_value & WTBL_LMAC_DW35[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW35[i].name,
++				(dw_value & WTBL_LMAC_DW35[i].mask) >>
++					WTBL_LMAC_DW35[i].shift);
++		i++;
++	}
++}
++
++static void parse_fmac_lwtbl_rx_stats(struct seq_file *s, u8 *lwtbl)
++{
++	parse_fmac_lwtbl_dw33(s, lwtbl);
++	parse_fmac_lwtbl_dw34(s, lwtbl);
++	parse_fmac_lwtbl_dw35(s, lwtbl);
++}
++
++static void parse_fmac_lwtbl_mlo_info(struct seq_file *s, u8 *lwtbl)
++{
++	parse_fmac_lwtbl_dw28(s, lwtbl);
++	parse_fmac_lwtbl_dw29(s, lwtbl);
++	parse_fmac_lwtbl_dw30(s, lwtbl);
++}
++
++static const struct berse_wtbl_parse WTBL_UMAC_DW9[] = {
++	{"RELATED_IDX0",	WF_UWTBL_RELATED_IDX0_MASK,		WF_UWTBL_RELATED_IDX0_SHIFT,	false},
++	{"RELATED_BAND0",	WF_UWTBL_RELATED_BAND0_MASK,		WF_UWTBL_RELATED_BAND0_SHIFT,	false},
++	{"PRI_MLD_BAND",    WF_UWTBL_PRIMARY_MLD_BAND_MASK,		WF_UWTBL_PRIMARY_MLD_BAND_SHIFT,	true},
++	{"RELATED_IDX0",	WF_UWTBL_RELATED_IDX1_MASK,		WF_UWTBL_RELATED_IDX1_SHIFT,	false},
++	{"RELATED_BAND1",   WF_UWTBL_RELATED_BAND1_MASK,		WF_UWTBL_RELATED_BAND1_SHIFT,	false},
++	{"SEC_MLD_BAND",	WF_UWTBL_SECONDARY_MLD_BAND_MASK,	WF_UWTBL_SECONDARY_MLD_BAND_SHIFT,	true},
++	{NULL,}
++};
++
++static void parse_fmac_uwtbl_mlo_info(struct seq_file *s, u8 *uwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	seq_printf(s, "\t\n");
++	seq_printf(s, "MldAddr: %02x:%02x:%02x:%02x:%02x:%02x(D0[B0~15], D1[B0~31])\n",
++		uwtbl[4], uwtbl[5], uwtbl[6], uwtbl[7], uwtbl[0], uwtbl[1]);
++
++	/* UMAC WTBL DW 0 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "UWTBL DW 0\n");
++	addr = (u32 *)&(uwtbl[WF_UWTBL_OWN_MLD_ID_DW*4]);
++	dw_value = *addr;
++
++	seq_printf(s, "\t%s:%u\n", "OMLD_ID",
++		(dw_value & WF_UWTBL_OWN_MLD_ID_MASK) >> WF_UWTBL_OWN_MLD_ID_SHIFT);
++
++	/* UMAC WTBL DW 9 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "UWTBL DW 9\n");
++	addr = (u32 *)&(uwtbl[WF_UWTBL_RELATED_IDX0_DW*4]);
++	dw_value = *addr;
++
++	while (WTBL_UMAC_DW9[i].name) {
++
++		if (WTBL_UMAC_DW9[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_UMAC_DW9[i].name,
++				(dw_value & WTBL_UMAC_DW9[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_UMAC_DW9[i].name,
++				 (dw_value & WTBL_UMAC_DW9[i].mask) >>
++					WTBL_UMAC_DW9[i].shift);
++		i++;
++	}
++}
++
++static bool
++is_wtbl_bigtk_exist(u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++
++	addr = (u32 *)&(lwtbl[WF_LWTBL_MUAR_DW*4]);
++	dw_value = *addr;
++	if (((dw_value & WF_LWTBL_MUAR_MASK) >> WF_LWTBL_MUAR_SHIFT) ==
++					MUAR_INDEX_OWN_MAC_ADDR_BC_MC) {
++		addr = (u32 *)&(lwtbl[WF_LWTBL_CIPHER_SUIT_BIGTK_DW*4]);
++		dw_value = *addr;
++		if (((dw_value & WF_LWTBL_CIPHER_SUIT_BIGTK_MASK) >>
++			WF_LWTBL_CIPHER_SUIT_BIGTK_SHIFT) != IGTK_CIPHER_SUIT_NONE)
++			return true;
++	}
++
++	return false;
++}
++
++static const struct berse_wtbl_parse WTBL_UMAC_DW2[] = {
++	{"PN0",		WTBL_PN0_MASK,		WTBL_PN0_OFFSET,	false},
++	{"PN1",		WTBL_PN1_MASK,		WTBL_PN1_OFFSET,	false},
++	{"PN2",		WTBL_PN2_MASK,		WTBL_PN2_OFFSET,	true},
++	{"PN3",		WTBL_PN3_MASK,		WTBL_PN3_OFFSET,	false},
++	{NULL,}
++};
++
++static const struct berse_wtbl_parse WTBL_UMAC_DW3[] = {
++	{"PN4",     WTBL_PN4_MASK,      WTBL_PN4_OFFSET,	false},
++	{"PN5",     WTBL_PN5_MASK,      WTBL_PN5_OFFSET,	true},
++	{NULL,}
++};
++
++static const struct berse_wtbl_parse WTBL_UMAC_DW4_BIPN[] = {
++	{"BIPN0",	WTBL_BIPN0_MASK,	WTBL_BIPN0_OFFSET,	false},
++	{"BIPN1",	WTBL_BIPN1_MASK,	WTBL_BIPN1_OFFSET,	false},
++	{"BIPN2",	WTBL_BIPN2_MASK,	WTBL_BIPN2_OFFSET,	true},
++	{"BIPN3",	WTBL_BIPN3_MASK,	WTBL_BIPN3_OFFSET,	false},
++	{NULL,}
++};
++
++static const struct berse_wtbl_parse WTBL_UMAC_DW5_BIPN[] = {
++	{"BIPN4",	WTBL_BIPN0_MASK,	WTBL_BIPN0_OFFSET,	false},
++	{"BIPN5",	WTBL_BIPN1_MASK,	WTBL_BIPN1_OFFSET,	true},
++	{NULL,}
++};
++
++static void parse_fmac_uwtbl_pn(struct seq_file *s, u8 *uwtbl, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	seq_printf(s, "\t\n");
++	seq_printf(s, "UWTBL PN\n");
++
++	/* UMAC WTBL DW 2/3 */
++	addr = (u32 *)&(uwtbl[WF_UWTBL_PN_31_0__DW*4]);
++	dw_value = *addr;
++
++	while (WTBL_UMAC_DW2[i].name) {
++		seq_printf(s, "\t%s:%u\n", WTBL_UMAC_DW2[i].name,
++			(dw_value & WTBL_UMAC_DW2[i].mask) >>
++				WTBL_UMAC_DW2[i].shift);
++		i++;
++	}
++
++	i = 0;
++	addr = (u32 *)&(uwtbl[WF_UWTBL_PN_47_32__DW*4]);
++	dw_value = *addr;
++
++	while (WTBL_UMAC_DW3[i].name) {
++		seq_printf(s, "\t%s:%u\n", WTBL_UMAC_DW3[i].name,
++			 (dw_value & WTBL_UMAC_DW3[i].mask) >>
++			WTBL_UMAC_DW3[i].shift);
++		i++;
++	}
++
++
++	/* UMAC WTBL DW 4/5 for BIGTK */
++	if (is_wtbl_bigtk_exist(lwtbl) == true) {
++		i = 0;
++		addr = (u32 *)&(uwtbl[WF_UWTBL_RX_BIPN_31_0__DW*4]);
++		dw_value = *addr;
++
++		while (WTBL_UMAC_DW4_BIPN[i].name) {
++			seq_printf(s, "\t%s:%u\n", WTBL_UMAC_DW4_BIPN[i].name,
++				(dw_value & WTBL_UMAC_DW4_BIPN[i].mask) >>
++					WTBL_UMAC_DW4_BIPN[i].shift);
++			i++;
++		}
++
++		i = 0;
++		addr = (u32 *)&(uwtbl[WF_UWTBL_RX_BIPN_47_32__DW*4]);
++		dw_value = *addr;
++
++		while (WTBL_UMAC_DW5_BIPN[i].name) {
++			seq_printf(s, "\t%s:%u\n", WTBL_UMAC_DW5_BIPN[i].name,
++				(dw_value & WTBL_UMAC_DW5_BIPN[i].mask) >>
++				WTBL_UMAC_DW5_BIPN[i].shift);
++			i++;
++		}
++	}
++}
++
++static void parse_fmac_uwtbl_sn(struct seq_file *s, u8 *uwtbl)
++{
++	u32 *addr = 0;
++	u32 u2SN = 0;
++
++	/* UMAC WTBL DW SN part */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "UWTBL SN\n");
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_TID0_SN_DW*4]);
++	u2SN = ((*addr) & WF_UWTBL_TID0_SN_MASK) >> WF_UWTBL_TID0_SN_SHIFT;
++	seq_printf(s, "\t%s:%u\n", "TID0_AC0_SN", u2SN);
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_TID1_SN_DW*4]);
++	u2SN = ((*addr) & WF_UWTBL_TID1_SN_MASK) >> WF_UWTBL_TID1_SN_SHIFT;
++	seq_printf(s, "\t%s:%u\n", "TID1_AC1_SN", u2SN);
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_TID2_SN_7_0__DW*4]);
++	u2SN = ((*addr) & WF_UWTBL_TID2_SN_7_0__MASK) >>
++				WF_UWTBL_TID2_SN_7_0__SHIFT;
++	addr = (u32 *)&(uwtbl[WF_UWTBL_TID2_SN_11_8__DW*4]);
++	u2SN |= (((*addr) & WF_UWTBL_TID2_SN_11_8__MASK) >>
++			WF_UWTBL_TID2_SN_11_8__SHIFT) << 8;
++	seq_printf(s, "\t%s:%u\n", "TID2_AC2_SN", u2SN);
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_TID3_SN_DW*4]);
++	u2SN = ((*addr) & WF_UWTBL_TID3_SN_MASK) >> WF_UWTBL_TID3_SN_SHIFT;
++	seq_printf(s, "\t%s:%u\n", "TID3_AC3_SN", u2SN);
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_TID4_SN_DW*4]);
++	u2SN = ((*addr) & WF_UWTBL_TID4_SN_MASK) >> WF_UWTBL_TID4_SN_SHIFT;
++	seq_printf(s, "\t%s:%u\n", "TID4_SN", u2SN);
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_TID5_SN_3_0__DW*4]);
++	u2SN = ((*addr) & WF_UWTBL_TID5_SN_3_0__MASK) >>
++				WF_UWTBL_TID5_SN_3_0__SHIFT;
++	addr = (u32 *)&(uwtbl[WF_UWTBL_TID5_SN_11_4__DW*4]);
++	u2SN |= (((*addr) & WF_UWTBL_TID5_SN_11_4__MASK) >>
++				WF_UWTBL_TID5_SN_11_4__SHIFT) << 4;
++	seq_printf(s, "\t%s:%u\n", "TID5_SN", u2SN);
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_TID6_SN_DW*4]);
++	u2SN = ((*addr) & WF_UWTBL_TID6_SN_MASK) >> WF_UWTBL_TID6_SN_SHIFT;
++	seq_printf(s, "\t%s:%u\n", "TID6_SN", u2SN);
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_TID7_SN_DW*4]);
++	u2SN = ((*addr) & WF_UWTBL_TID7_SN_MASK) >> WF_UWTBL_TID7_SN_SHIFT;
++	seq_printf(s, "\t%s:%u\n", "TID7_SN", u2SN);
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_COM_SN_DW*4]);
++	u2SN = ((*addr) & WF_UWTBL_COM_SN_MASK) >> WF_UWTBL_COM_SN_SHIFT;
++	seq_printf(s, "\t%s:%u\n", "COM_SN", u2SN);
++}
++
++static void dump_key_table(
++	struct seq_file *s,
++	uint16_t keyloc0,
++	uint16_t keyloc1,
++	uint16_t keyloc2
++)
++{
++#define ONE_KEY_ENTRY_LEN_IN_DW                8
++	struct mt7996_dev *dev = dev_get_drvdata(s->private);
++	u8 keytbl[ONE_KEY_ENTRY_LEN_IN_DW*4] = {0};
++	uint16_t x;
++
++	seq_printf(s, "\t\n");
++	seq_printf(s, "\t%s:%d\n", "keyloc0", keyloc0);
++	if (keyloc0 != INVALID_KEY_ENTRY) {
++
++		/* Don't swap below two lines, halWtblReadRaw will
++		* write new value WF_WTBLON_TOP_WDUCR_ADDR
++		*/
++		mt7996_wtbl_read_raw(dev, keyloc0,
++			WTBL_TYPE_KEY, 0, ONE_KEY_ENTRY_LEN_IN_DW, keytbl);
++		seq_printf(s, "\t\tKEY WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
++			MT_DBG_UWTBL_TOP_WDUCR_ADDR,
++			mt76_rr(dev, MT_DBG_UWTBL_TOP_WDUCR_ADDR),
++			KEYTBL_IDX2BASE(keyloc0, 0));
++		for (x = 0; x < ONE_KEY_ENTRY_LEN_IN_DW; x++) {
++			seq_printf(s, "\t\tDW%02d: %02x %02x %02x %02x\n",
++				x,
++				keytbl[x * 4 + 3],
++				keytbl[x * 4 + 2],
++				keytbl[x * 4 + 1],
++				keytbl[x * 4]);
++		}
++	}
++
++	seq_printf(s, "\t%s:%d\n", "keyloc1", keyloc1);
++	if (keyloc1 != INVALID_KEY_ENTRY) {
++		/* Don't swap below two lines, halWtblReadRaw will
++		* write new value WF_WTBLON_TOP_WDUCR_ADDR
++		*/
++		mt7996_wtbl_read_raw(dev, keyloc1,
++			WTBL_TYPE_KEY, 0, ONE_KEY_ENTRY_LEN_IN_DW, keytbl);
++		seq_printf(s, "\t\tKEY WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
++			MT_DBG_UWTBL_TOP_WDUCR_ADDR,
++			mt76_rr(dev, MT_DBG_UWTBL_TOP_WDUCR_ADDR),
++			KEYTBL_IDX2BASE(keyloc1, 0));
++		for (x = 0; x < ONE_KEY_ENTRY_LEN_IN_DW; x++) {
++			seq_printf(s, "\t\tDW%02d: %02x %02x %02x %02x\n",
++				x,
++				keytbl[x * 4 + 3],
++				keytbl[x * 4 + 2],
++				keytbl[x * 4 + 1],
++				keytbl[x * 4]);
++		}
++	}
++
++	seq_printf(s, "\t%s:%d\n", "keyloc2", keyloc2);
++	if (keyloc2 != INVALID_KEY_ENTRY) {
++		/* Don't swap below two lines, halWtblReadRaw will
++		* write new value WF_WTBLON_TOP_WDUCR_ADDR
++		*/
++		mt7996_wtbl_read_raw(dev, keyloc2,
++			WTBL_TYPE_KEY, 0, ONE_KEY_ENTRY_LEN_IN_DW, keytbl);
++		seq_printf(s, "\t\tKEY WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
++			MT_DBG_UWTBL_TOP_WDUCR_ADDR,
++			mt76_rr(dev, MT_DBG_UWTBL_TOP_WDUCR_ADDR),
++			KEYTBL_IDX2BASE(keyloc2, 0));
++		for (x = 0; x < ONE_KEY_ENTRY_LEN_IN_DW; x++) {
++			seq_printf(s, "\t\tDW%02d: %02x %02x %02x %02x\n",
++				x,
++				keytbl[x * 4 + 3],
++				keytbl[x * 4 + 2],
++				keytbl[x * 4 + 1],
++				keytbl[x * 4]);
++		}
++	}
++}
++
++static void parse_fmac_uwtbl_key_info(struct seq_file *s, u8 *uwtbl, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	uint16_t keyloc0 = INVALID_KEY_ENTRY;
++	uint16_t keyloc1 = INVALID_KEY_ENTRY;
++	uint16_t keyloc2 = INVALID_KEY_ENTRY;
++
++	/* UMAC WTBL DW 7 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "UWTBL key info\n");
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_KEY_LOC0_DW*4]);
++	dw_value = *addr;
++	keyloc0 = (dw_value & WF_UWTBL_KEY_LOC0_MASK) >> WF_UWTBL_KEY_LOC0_SHIFT;
++	keyloc1 = (dw_value & WF_UWTBL_KEY_LOC1_MASK) >> WF_UWTBL_KEY_LOC1_SHIFT;
++
++	seq_printf(s, "\t%s:%u/%u\n", "Key Loc 0/1", keyloc0, keyloc1);
++
++	/* UMAC WTBL DW 6 for BIGTK */
++	if (is_wtbl_bigtk_exist(lwtbl) == true) {
++		keyloc2 = (dw_value & WF_UWTBL_KEY_LOC2_MASK) >>
++			WF_UWTBL_KEY_LOC2_SHIFT;
++		seq_printf(s, "\t%s:%u\n", "Key Loc 2", keyloc2);
++	}
++
++	/* Parse KEY link */
++	dump_key_table(s, keyloc0, keyloc1, keyloc2);
++}
++
++static const struct berse_wtbl_parse WTBL_UMAC_DW8[] = {
++	{"UWTBL_WMM_Q",		WF_UWTBL_WMM_Q_MASK,		WF_UWTBL_WMM_Q_SHIFT,	false},
++	{"UWTBL_QOS",		WF_UWTBL_QOS_MASK,		NO_SHIFT_DEFINE,	false},
++	{"UWTBL_HT_VHT_HE",	WF_UWTBL_HT_MASK,		NO_SHIFT_DEFINE,	false},
++	{"UWTBL_HDRT_MODE",	WF_UWTBL_HDRT_MODE_MASK,	NO_SHIFT_DEFINE,	true},
++	{NULL,}
++};
++
++static void parse_fmac_uwtbl_msdu_info(struct seq_file *s, u8 *uwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u32 amsdu_len = 0;
++	u16 i = 0;
++
++	/* UMAC WTBL DW 8 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "UWTBL DW8\n");
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_AMSDU_CFG_DW*4]);
++	dw_value = *addr;
++
++	while (WTBL_UMAC_DW8[i].name) {
++
++		if (WTBL_UMAC_DW8[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_UMAC_DW8[i].name,
++				(dw_value & WTBL_UMAC_DW8[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_UMAC_DW8[i].name,
++				(dw_value & WTBL_UMAC_DW8[i].mask) >>
++					WTBL_UMAC_DW8[i].shift);
++		i++;
++	}
++
++	/* UMAC WTBL DW 8 - AMSDU_CFG */
++	seq_printf(s, "\t%s:%d\n", "HW AMSDU Enable",
++				(dw_value & WTBL_AMSDU_EN_MASK) ? 1 : 0);
++
++	amsdu_len = (dw_value & WTBL_AMSDU_LEN_MASK) >> WTBL_AMSDU_LEN_OFFSET;
++	if (amsdu_len == 0)
++		seq_printf(s, "\t%s:invalid (WTBL value=0x%x)\n", "HW AMSDU Len",
++			amsdu_len);
++	else if (amsdu_len == 1)
++		seq_printf(s, "\t%s:%d~%d (WTBL value=0x%x)\n", "HW AMSDU Len",
++			1,
++			255,
++			amsdu_len);
++	else if (amsdu_len == 2)
++		seq_printf(s, "\t%s:%d~%d (WTBL value=0x%x)\n", "HW AMSDU Len",
++			256,
++			511,
++			amsdu_len);
++	else if (amsdu_len == 3)
++		seq_printf(s, "\t%s:%d~%d (WTBL value=0x%x)\n", "HW AMSDU Len",
++			512,
++			767,
++			amsdu_len);
++	else
++		seq_printf(s, "\t%s:%d~%d (WTBL value=0x%x)\n", "HW AMSDU Len",
++			256 * (amsdu_len - 1),
++			256 * (amsdu_len - 1) + 255,
++			amsdu_len);
++
++	seq_printf(s, "\t%s:%lu (WTBL value=0x%lx)\n", "HW AMSDU Num",
++		((dw_value & WTBL_AMSDU_NUM_MASK) >> WTBL_AMSDU_NUM_OFFSET) + 1,
++		(dw_value & WTBL_AMSDU_NUM_MASK) >> WTBL_AMSDU_NUM_OFFSET);
++}
++
++static int mt7996_wtbl_read(struct seq_file *s, void *data)
++{
++	struct mt7996_dev *dev = dev_get_drvdata(s->private);
++	u8 lwtbl[LWTBL_LEN_IN_DW * 4] = {0};
++	u8 uwtbl[UWTBL_LEN_IN_DW * 4] = {0};
++	int x;
++
++	mt7996_wtbl_read_raw(dev, dev->wlan_idx, WTBL_TYPE_LMAC, 0,
++				 LWTBL_LEN_IN_DW, lwtbl);
++	seq_printf(s, "Dump WTBL info of WLAN_IDX:%d\n", dev->wlan_idx);
++	seq_printf(s, "LMAC WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
++		   MT_DBG_WTBLON_TOP_WDUCR_ADDR,
++		   mt76_rr(dev, MT_DBG_WTBLON_TOP_WDUCR_ADDR),
++		   LWTBL_IDX2BASE(dev->wlan_idx, 0));
++	for (x = 0; x < LWTBL_LEN_IN_DW; x++) {
++		seq_printf(s, "DW%02d: %02x %02x %02x %02x\n",
++			   x,
++			   lwtbl[x * 4 + 3],
++			   lwtbl[x * 4 + 2],
++			   lwtbl[x * 4 + 1],
++			   lwtbl[x * 4]);
++	}
++
++	/* Parse LWTBL */
++	parse_fmac_lwtbl_dw0_1(s, lwtbl);
++	parse_fmac_lwtbl_dw2(s, lwtbl);
++	parse_fmac_lwtbl_dw3(s, lwtbl);
++	parse_fmac_lwtbl_dw4(s, lwtbl);
++	parse_fmac_lwtbl_dw5(s, lwtbl);
++	parse_fmac_lwtbl_dw6(s, lwtbl);
++	parse_fmac_lwtbl_dw7(s, lwtbl);
++	parse_fmac_lwtbl_dw8(s, lwtbl);
++	parse_fmac_lwtbl_dw9(s, lwtbl);
++	parse_fmac_lwtbl_dw10(s, lwtbl);
++	parse_fmac_lwtbl_dw11(s, lwtbl);
++	parse_fmac_lwtbl_dw12(s, lwtbl);
++	parse_fmac_lwtbl_dw13(s, lwtbl);
++	parse_fmac_lwtbl_dw14(s, lwtbl);
++	parse_fmac_lwtbl_mlo_info(s, lwtbl);
++	parse_fmac_lwtbl_dw31(s, lwtbl);
++	parse_fmac_lwtbl_dw32(s, lwtbl);
++	parse_fmac_lwtbl_rx_stats(s, lwtbl);
++
++	mt7996_wtbl_read_raw(dev, dev->wlan_idx, WTBL_TYPE_UMAC, 0,
++				 UWTBL_LEN_IN_DW, uwtbl);
++	seq_printf(s, "Dump WTBL info of WLAN_IDX:%d\n", dev->wlan_idx);
++	seq_printf(s, "UMAC WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
++		   MT_DBG_UWTBL_TOP_WDUCR_ADDR,
++		   mt76_rr(dev, MT_DBG_UWTBL_TOP_WDUCR_ADDR),
++		   UWTBL_IDX2BASE(dev->wlan_idx, 0));
++	for (x = 0; x < UWTBL_LEN_IN_DW; x++) {
++		seq_printf(s, "DW%02d: %02x %02x %02x %02x\n",
++			   x,
++			   uwtbl[x * 4 + 3],
++			   uwtbl[x * 4 + 2],
++			   uwtbl[x * 4 + 1],
++			   uwtbl[x * 4]);
++	}
++
++	/* Parse UWTBL */
++	parse_fmac_uwtbl_mlo_info(s, uwtbl);
++	parse_fmac_uwtbl_pn(s, uwtbl, lwtbl);
++	parse_fmac_uwtbl_sn(s, uwtbl);
++	parse_fmac_uwtbl_key_info(s, uwtbl, lwtbl);
++	parse_fmac_uwtbl_msdu_info(s, uwtbl);
++
++	return 0;
++}
++
++static int mt7996_sta_info(struct seq_file *s, void *data)
++{
++	struct mt7996_dev *dev = dev_get_drvdata(s->private);
++	u8 lwtbl[LWTBL_LEN_IN_DW*4] = {0};
++	u16 i = 0;
++
++	for (i=0; i < mt7996_wtbl_size(dev); i++) {
++		mt7996_wtbl_read_raw(dev, i, WTBL_TYPE_LMAC, 0,
++				     LWTBL_LEN_IN_DW, lwtbl);
++
++		if (lwtbl[4] || lwtbl[5] || lwtbl[6] || lwtbl[7] || lwtbl[0] || lwtbl[1]) {
++			u32 *addr = (u32 *)&(lwtbl[WTBL_GROUP_TRX_CAP_DW_2*4]);
++			u32 dw_value = *addr;
++
++			seq_printf(s, "wcid:%d\tAddr: %02x:%02x:%02x:%02x:%02x:%02x",
++					i, lwtbl[4], lwtbl[5], lwtbl[6], lwtbl[7], lwtbl[0], lwtbl[1]);
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW2[0].name,
++					(dw_value & WTBL_LMAC_DW2[0].mask) >> WTBL_LMAC_DW2[0].shift);
++		}
++	}
++
++	return 0;
++}
++
++int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
++{
++	struct mt7996_dev *dev = phy->dev;
++
++	mt7996_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
++
++	/* agg */
++	debugfs_create_devm_seqfile(dev->mt76.dev, "agg_info0", dir,
++				    mt7996_agginfo_read_band0);
++	debugfs_create_devm_seqfile(dev->mt76.dev, "agg_info1", dir,
++				    mt7996_agginfo_read_band1);
++	debugfs_create_devm_seqfile(dev->mt76.dev, "agg_info2", dir,
++				    mt7996_agginfo_read_band2);
++	/* amsdu */
++	debugfs_create_devm_seqfile(dev->mt76.dev, "amsdu_info", dir,
++				    mt7996_amsdu_result_read);
++
++	debugfs_create_file("fw_debug_module", 0600, dir, dev,
++			    &fops_fw_debug_module);
++	debugfs_create_file("fw_debug_level", 0600, dir, dev,
++			    &fops_fw_debug_level);
++	debugfs_create_file("fw_wa_query", 0600, dir, dev, &fops_wa_query);
++	debugfs_create_file("fw_wa_set", 0600, dir, dev, &fops_wa_set);
++	debugfs_create_devm_seqfile(dev->mt76.dev, "fw_version", dir,
++				    mt7996_dump_version);
++
++	debugfs_create_devm_seqfile(dev->mt76.dev, "mib_info0", dir,
++				    mt7996_mibinfo_band0);
++	debugfs_create_devm_seqfile(dev->mt76.dev, "mib_info1", dir,
++				    mt7996_mibinfo_band1);
++	debugfs_create_devm_seqfile(dev->mt76.dev, "mib_info2", dir,
++				    mt7996_mibinfo_band2);
++
++	debugfs_create_devm_seqfile(dev->mt76.dev, "sta_info", dir,
++				    mt7996_sta_info);
++
++	debugfs_create_devm_seqfile(dev->mt76.dev, "tr_info", dir,
++				    mt7996_trinfo_read);
++
++	debugfs_create_devm_seqfile(dev->mt76.dev, "wtbl_info", dir,
++				    mt7996_wtbl_read);
++
++	return 0;
++}
++
++#endif
+diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
+new file mode 100644
+index 00000000..e8870166
+--- /dev/null
++++ b/mt7996/mtk_mcu.c
+@@ -0,0 +1,18 @@
++// SPDX-License-Identifier: ISC
++/*
++ * Copyright (C) 2023 MediaTek Inc.
++ */
++
++#include <linux/firmware.h>
++#include <linux/fs.h>
++#include "mt7996.h"
++#include "mcu.h"
++#include "mac.h"
++#include "mtk_mcu.h"
++
++#ifdef CONFIG_MTK_DEBUG
++
++
++
++
++#endif
+diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
+new file mode 100644
+index 00000000..e741aa27
+--- /dev/null
++++ b/mt7996/mtk_mcu.h
+@@ -0,0 +1,16 @@
++/* SPDX-License-Identifier: ISC */
++/*
++ * Copyright (C) 2023 MediaTek Inc.
++ */
++
++#ifndef __MT7996_MTK_MCU_H
++#define __MT7996_MTK_MCU_H
++
++#include "../mt76_connac_mcu.h"
++
++#ifdef CONFIG_MTK_DEBUG
++
++
++#endif
++
++#endif
+diff --git a/tools/fwlog.c b/tools/fwlog.c
+index e5d4a105..3c6a61d7 100644
+--- a/tools/fwlog.c
++++ b/tools/fwlog.c
+@@ -26,7 +26,7 @@ static const char *debugfs_path(const char *phyname, const char *file)
+ 	return path;
+ }
+ 
+-static int mt76_set_fwlog_en(const char *phyname, bool en)
++static int mt76_set_fwlog_en(const char *phyname, bool en, char *val)
+ {
+ 	FILE *f = fopen(debugfs_path(phyname, "fw_debug_bin"), "w");
+ 
+@@ -35,7 +35,13 @@ static int mt76_set_fwlog_en(const char *phyname, bool en)
+ 		return 1;
+ 	}
+ 
+-	fprintf(f, "7");
++	if (en && val)
++		fprintf(f, "%s", val);
++	else if (en)
++		fprintf(f, "7");
++	else
++		fprintf(f, "0");
++
+ 	fclose(f);
+ 
+ 	return 0;
+@@ -76,6 +82,7 @@ static void handle_signal(int sig)
+ 
+ int mt76_fwlog(const char *phyname, int argc, char **argv)
+ {
++#define BUF_SIZE 1504
+ 	struct sockaddr_in local = {
+ 		.sin_family = AF_INET,
+ 		.sin_addr.s_addr = INADDR_ANY,
+@@ -84,9 +91,9 @@ int mt76_fwlog(const char *phyname, int argc, char **argv)
+ 		.sin_family = AF_INET,
+ 		.sin_port = htons(55688),
+ 	};
+-	char buf[1504];
++	char *buf = calloc(BUF_SIZE, sizeof(char));
+ 	int ret = 0;
+-	int yes = 1;
++	/* int yes = 1; */
+ 	int s, fd;
+ 
+ 	if (argc < 1) {
+@@ -105,13 +112,13 @@ int mt76_fwlog(const char *phyname, int argc, char **argv)
+ 		return 1;
+ 	}
+ 
+-	setsockopt(s, SOL_SOCKET, SO_BROADCAST, &yes, sizeof(yes));
++	/* setsockopt(s, SOL_SOCKET, SO_BROADCAST, &yes, sizeof(yes)); */
+ 	if (bind(s, (struct sockaddr *)&local, sizeof(local)) < 0) {
+ 		perror("bind");
+ 		return 1;
+ 	}
+ 
+-	if (mt76_set_fwlog_en(phyname, true))
++	if (mt76_set_fwlog_en(phyname, true, argv[1]))
+ 		return 1;
+ 
+ 	fd = open(debugfs_path(phyname, "fwlog_data"), O_RDONLY);
+@@ -145,8 +152,8 @@ int mt76_fwlog(const char *phyname, int argc, char **argv)
+ 		if (!r)
+ 			continue;
+ 
+-		if (len > sizeof(buf)) {
+-			fprintf(stderr, "Length error: %d > %d\n", len, (int)sizeof(buf));
++		if (len > BUF_SIZE) {
++			fprintf(stderr, "Length error: %d > %d\n", len, BUF_SIZE);
+ 			ret = 1;
+ 			break;
+ 		}
+@@ -171,7 +178,7 @@ int mt76_fwlog(const char *phyname, int argc, char **argv)
+ 	close(fd);
+ 
+ out:
+-	mt76_set_fwlog_en(phyname, false);
++	mt76_set_fwlog_en(phyname, false, NULL);
+ 
+ 	return ret;
+ }
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7996-add-txpower-support.patch b/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7996-add-txpower-support.patch
new file mode 100644
index 0000000..f162ca4
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/1001-mt76-mt7996-add-txpower-support.patch
@@ -0,0 +1,566 @@
+From d7cae77110e06d64cf5046278e905aeb676ef594 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 24 Mar 2023 23:35:30 +0800
+Subject: [PATCH 1001/1001] mt76: mt7996: add txpower support
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Change-Id: Ic3e7b17f3664fa7f774137572f885359fa2ec93b
+---
+ mt7996/eeprom.c      |  34 +++++++
+ mt7996/eeprom.h      |  42 ++++++++
+ mt7996/mcu.h         |   2 +
+ mt7996/mt7996.h      |   3 +
+ mt7996/mtk_debugfs.c | 229 +++++++++++++++++++++++++++++++++++++++++++
+ mt7996/mtk_mcu.c     |  23 +++++
+ mt7996/mtk_mcu.h     |  78 +++++++++++++++
+ mt7996/regs.h        |  17 +++-
+ 8 files changed, 423 insertions(+), 5 deletions(-)
+
+diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
+index 7bff504a..670e0db3 100644
+--- a/mt7996/eeprom.c
++++ b/mt7996/eeprom.c
+@@ -284,3 +284,37 @@ s8 mt7996_eeprom_get_power_delta(struct mt7996_dev *dev, int band)
+ 
+ 	return val & MT_EE_RATE_DELTA_SIGN ? delta : -delta;
+ }
++
++const u8 mt7996_sku_group_len[] = {
++	[SKU_CCK] = 4,
++	[SKU_OFDM] = 8,
++	[SKU_HT20] = 8,
++	[SKU_HT40] = 9,
++	[SKU_VHT20] = 12,
++	[SKU_VHT40] = 12,
++	[SKU_VHT80] = 12,
++	[SKU_VHT160] = 12,
++	[SKU_HE26] = 12,
++	[SKU_HE52] = 12,
++	[SKU_HE106] = 12,
++	[SKU_HE242] = 12,
++	[SKU_HE484] = 12,
++	[SKU_HE996] = 12,
++	[SKU_HE2x996] = 12,
++	[SKU_EHT26] = 16,
++	[SKU_EHT52] = 16,
++	[SKU_EHT106] = 16,
++	[SKU_EHT242] = 16,
++	[SKU_EHT484] = 16,
++	[SKU_EHT996] = 16,
++	[SKU_EHT2x996] = 16,
++	[SKU_EHT4x996] = 16,
++	[SKU_EHT26_52] = 16,
++	[SKU_EHT26_106] = 16,
++	[SKU_EHT484_242] = 16,
++	[SKU_EHT996_484] = 16,
++	[SKU_EHT996_484_242] = 16,
++	[SKU_EHT2x996_484] = 16,
++	[SKU_EHT3x996] = 16,
++	[SKU_EHT3x996_484] = 16,
++};
+diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
+index f7497c9b..b5852da5 100644
+--- a/mt7996/eeprom.h
++++ b/mt7996/eeprom.h
+@@ -73,4 +73,46 @@ mt7996_get_channel_group_6g(int channel)
+ 	return DIV_ROUND_UP(channel - 29, 32);
+ }
+ 
++enum mt7996_sku_rate_group {
++	SKU_CCK,
++	SKU_OFDM,
++
++	SKU_HT20,
++	SKU_HT40,
++
++	SKU_VHT20,
++	SKU_VHT40,
++	SKU_VHT80,
++	SKU_VHT160,
++
++	SKU_HE26,
++	SKU_HE52,
++	SKU_HE106,
++	SKU_HE242,
++	SKU_HE484,
++	SKU_HE996,
++	SKU_HE2x996,
++
++	SKU_EHT26,
++	SKU_EHT52,
++	SKU_EHT106,
++	SKU_EHT242,
++	SKU_EHT484,
++	SKU_EHT996,
++	SKU_EHT2x996,
++	SKU_EHT4x996,
++	SKU_EHT26_52,
++	SKU_EHT26_106,
++	SKU_EHT484_242,
++	SKU_EHT996_484,
++	SKU_EHT996_484_242,
++	SKU_EHT2x996_484,
++	SKU_EHT3x996,
++	SKU_EHT3x996_484,
++
++	MAX_SKU_RATE_GROUP_NUM,
++};
++
++extern const u8 mt7996_sku_group_len[MAX_SKU_RATE_GROUP_NUM];
++
+ #endif
+diff --git a/mt7996/mcu.h b/mt7996/mcu.h
+index ebc62713..476e007b 100644
+--- a/mt7996/mcu.h
++++ b/mt7996/mcu.h
+@@ -698,6 +698,7 @@ struct tx_power_ctrl {
+ 		bool ate_mode_enable;
+ 		bool percentage_ctrl_enable;
+ 		bool bf_backoff_enable;
++		u8 show_info_category;
+ 		u8 power_drop_level;
+ 	};
+ 	u8 band_idx;
+@@ -711,6 +712,7 @@ enum {
+ 	UNI_TXPOWER_BACKOFF_POWER_LIMIT_CTRL = 3,
+ 	UNI_TXPOWER_POWER_LIMIT_TABLE_CTRL = 4,
+ 	UNI_TXPOWER_ATE_MODE_CTRL = 6,
++	UNI_TXPOWER_SHOW_INFO = 7,
+ };
+ 
+ enum {
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index 8b76d69a..d5be582d 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -53,6 +53,8 @@
+ #define MT7996_CRIT_TEMP		110
+ #define MT7996_MAX_TEMP			120
+ 
++#define MT7996_SKU_RATE_NUM		417
++
+ struct mt7996_vif;
+ struct mt7996_sta;
+ struct mt7996_dfs_pulse;
+@@ -518,6 +520,7 @@ int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
+ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
+ void mt7996_mcu_exit(struct mt7996_dev *dev);
+ int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
++int mt7996_mcu_get_tx_power_info(struct mt7996_phy *phy, u8 category, void *event);
+ 
+ static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
+ {
+diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
+index 080f756e..c05f8465 100644
+--- a/mt7996/mtk_debugfs.c
++++ b/mt7996/mtk_debugfs.c
+@@ -2296,6 +2296,232 @@ static int mt7996_sta_info(struct seq_file *s, void *data)
+ 	return 0;
+ }
+ 
++static int
++mt7996_txpower_level_set(void *data, u64 val)
++{
++	struct mt7996_phy *phy = data;
++	int ret;
++
++	if (val > 100)
++		return -EINVAL;
++
++	ret = mt7996_mcu_set_tx_power_ctrl(phy, UNI_TXPOWER_PERCENTAGE_CTRL, !!val);
++	if (ret)
++		return ret;
++
++	return mt7996_mcu_set_tx_power_ctrl(phy, UNI_TXPOWER_PERCENTAGE_DROP_CTRL, val);
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_txpower_level, NULL,
++			 mt7996_txpower_level_set, "%lld\n");
++
++static ssize_t
++mt7996_get_txpower_info(struct file *file, char __user *user_buf,
++			size_t count, loff_t *ppos)
++{
++	struct mt7996_phy *phy = file->private_data;
++	struct mt7996_mcu_txpower_event *event;
++	struct txpower_basic_info *basic_info;
++	static const size_t size = 2048;
++	int len = 0;
++	ssize_t ret;
++	char *buf;
++
++	buf = kzalloc(size, GFP_KERNEL);
++	event = kzalloc(sizeof(*event), GFP_KERNEL);
++	if (!buf || !event)
++		return -ENOMEM;
++
++	ret = mt7996_mcu_get_tx_power_info(phy, BASIC_INFO, event);
++	if (ret ||
++	    le32_to_cpu(event->basic_info.category) != UNI_TXPOWER_BASIC_INFO)
++		goto out;
++
++	basic_info = &event->basic_info;
++
++	len += scnprintf(buf + len, size - len,
++			 "======================== BASIC INFO ========================\n");
++	len += scnprintf(buf + len, size - len, "    Band Index: %d, Channel Band: %d\n",
++			 basic_info->band_idx, basic_info->band);
++	len += scnprintf(buf + len, size - len, "    PA Type: %s\n",
++			 basic_info->is_epa ? "ePA" : "iPA");
++	len += scnprintf(buf + len, size - len, "    LNA Type: %s\n",
++			 basic_info->is_elna ? "eLNA" : "iLNA");
++
++	len += scnprintf(buf + len, size - len,
++			 "------------------------------------------------------------\n");
++	len += scnprintf(buf + len, size - len, "    SKU: %s\n",
++			 basic_info->sku_enable ? "enable" : "disable");
++	len += scnprintf(buf + len, size - len, "    Percentage Control: %s\n",
++			 basic_info->percentage_ctrl_enable ? "enable" : "disable");
++	len += scnprintf(buf + len, size - len, "    Power Drop: %d [dBm]\n",
++			 basic_info->power_drop_level >> 1);
++	len += scnprintf(buf + len, size - len, "    Backoff: %s\n",
++			 basic_info->bf_backoff_enable ? "enable" : "disable");
++	len += scnprintf(buf + len, size - len, "    TX Front-end Loss:  %d, %d, %d, %d\n",
++			 basic_info->front_end_loss_tx[0], basic_info->front_end_loss_tx[1],
++			 basic_info->front_end_loss_tx[2], basic_info->front_end_loss_tx[3]);
++	len += scnprintf(buf + len, size - len, "    RX Front-end Loss:  %d, %d, %d, %d\n",
++			 basic_info->front_end_loss_rx[0], basic_info->front_end_loss_rx[1],
++			 basic_info->front_end_loss_rx[2], basic_info->front_end_loss_rx[3]);
++	len += scnprintf(buf + len, size - len,
++			 "    MU TX Power Mode:  %s\n",
++			 basic_info->mu_tx_power_manual_enable ? "manual" : "auto");
++	len += scnprintf(buf + len, size - len,
++			 "    MU TX Power (Auto / Manual): %d / %d [0.5 dBm]\n",
++			 basic_info->mu_tx_power_auto, basic_info->mu_tx_power_manual);
++	len += scnprintf(buf + len, size - len,
++			 "    Thermal Compensation:  %s\n",
++			 basic_info->thermal_compensate_enable ? "enable" : "disable");
++	len += scnprintf(buf + len, size - len,
++			 "    Theraml Compensation Value: %d\n",
++			 basic_info->thermal_compensate_value);
++
++	ret = simple_read_from_buffer(user_buf, count, ppos, buf, len);
++
++out:
++	kfree(buf);
++	kfree(event);
++	return ret;
++}
++
++static const struct file_operations mt7996_txpower_info_fops = {
++	.read = mt7996_get_txpower_info,
++	.open = simple_open,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++#define mt7996_txpower_puts(rate)							\
++({											\
++	len += scnprintf(buf + len, size - len, "%-21s:", #rate " (TMAC)");		\
++	for (i = 0; i < mt7996_sku_group_len[SKU_##rate]; i++, offs++)			\
++		len += scnprintf(buf + len, size - len, " %6d",				\
++				 event->phy_rate_info.frame_power[offs][band_idx]);	\
++	len += scnprintf(buf + len, size - len, "\n");					\
++})
++
++static ssize_t
++mt7996_get_txpower_sku(struct file *file, char __user *user_buf,
++		       size_t count, loff_t *ppos)
++{
++	struct mt7996_phy *phy = file->private_data;
++	struct mt7996_dev *dev = phy->dev;
++	struct mt7996_mcu_txpower_event *event;
++	u8 band_idx = phy->mt76->band_idx;
++	static const size_t size = 5120;
++	int i, offs = 0, len = 0;
++	ssize_t ret;
++	char *buf;
++	u32 reg;
++
++	buf = kzalloc(size, GFP_KERNEL);
++	event = kzalloc(sizeof(*event), GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	ret = mt7996_mcu_get_tx_power_info(phy, PHY_RATE_INFO, event);
++	if (ret ||
++	    le32_to_cpu(event->phy_rate_info.category) != UNI_TXPOWER_PHY_RATE_INFO)
++		goto out;
++
++	len += scnprintf(buf + len, size - len,
++			 "\nPhy %d TX Power Table (Channel %d)\n",
++			 band_idx, phy->mt76->chandef.chan->hw_value);
++	len += scnprintf(buf + len, size - len, "%-21s  %6s %6s %6s %6s\n",
++			 " ", "1m", "2m", "5m", "11m");
++	mt7996_txpower_puts(CCK);
++
++	len += scnprintf(buf + len, size - len,
++			 "%-21s  %6s %6s %6s %6s %6s %6s %6s %6s\n",
++			 " ", "6m", "9m", "12m", "18m", "24m", "36m", "48m",
++			 "54m");
++	mt7996_txpower_puts(OFDM);
++
++	len += scnprintf(buf + len, size - len,
++			 "%-21s  %6s %6s %6s %6s %6s %6s %6s %6s\n",
++			 " ", "mcs0", "mcs1", "mcs2", "mcs3", "mcs4",
++			 "mcs5", "mcs6", "mcs7");
++	mt7996_txpower_puts(HT20);
++
++	len += scnprintf(buf + len, size - len,
++			 "%-21s  %6s %6s %6s %6s %6s %6s %6s %6s %6s\n",
++			 " ", "mcs0", "mcs1", "mcs2", "mcs3", "mcs4", "mcs5",
++			 "mcs6", "mcs7", "mcs32");
++	mt7996_txpower_puts(HT40);
++
++	len += scnprintf(buf + len, size - len,
++			 "%-21s  %6s %6s %6s %6s %6s %6s %6s %6s %6s %6s %6s %6s\n",
++			 " ", "mcs0", "mcs1", "mcs2", "mcs3", "mcs4", "mcs5",
++			 "mcs6", "mcs7", "mcs8", "mcs9", "mcs10", "mcs11");
++	mt7996_txpower_puts(VHT20);
++	mt7996_txpower_puts(VHT40);
++	mt7996_txpower_puts(VHT80);
++	mt7996_txpower_puts(VHT160);
++	mt7996_txpower_puts(HE26);
++	mt7996_txpower_puts(HE52);
++	mt7996_txpower_puts(HE106);
++	mt7996_txpower_puts(HE242);
++	mt7996_txpower_puts(HE484);
++	mt7996_txpower_puts(HE996);
++	mt7996_txpower_puts(HE2x996);
++
++	len += scnprintf(buf + len, size - len,
++			 "%-21s  %6s %6s %6s %6s %6s %6s %6s %6s ",
++			 " ", "mcs0", "mcs1", "mcs2", "mcs3", "mcs4", "mcs5", "mcs6", "mcs7");
++	len += scnprintf(buf + len, size - len,
++			 "%6s %6s %6s %6s %6s %6s %6s %6s\n",
++			 "mcs8", "mcs9", "mcs10", "mcs11", "mcs12", "mcs13", "mcs14", "mcs15");
++	mt7996_txpower_puts(EHT26);
++	mt7996_txpower_puts(EHT52);
++	mt7996_txpower_puts(EHT106);
++	mt7996_txpower_puts(EHT242);
++	mt7996_txpower_puts(EHT484);
++	mt7996_txpower_puts(EHT996);
++	mt7996_txpower_puts(EHT2x996);
++	mt7996_txpower_puts(EHT4x996);
++	mt7996_txpower_puts(EHT26_52);
++	mt7996_txpower_puts(EHT26_106);
++	mt7996_txpower_puts(EHT484_242);
++	mt7996_txpower_puts(EHT996_484);
++	mt7996_txpower_puts(EHT996_484_242);
++	mt7996_txpower_puts(EHT2x996_484);
++	mt7996_txpower_puts(EHT3x996);
++	mt7996_txpower_puts(EHT3x996_484);
++
++	len += scnprintf(buf + len, size - len, "\nePA Gain: %d\n",
++			 event->phy_rate_info.epa_gain);
++	len += scnprintf(buf + len, size - len, "Max Power Bound: %d\n",
++			 event->phy_rate_info.max_power_bound);
++	len += scnprintf(buf + len, size - len, "Min Power Bound: %d\n",
++			 event->phy_rate_info.min_power_bound);
++
++	reg = MT_WF_PHYDFE_BAND_TPC_CTRL_STAT0(band_idx);
++	len += scnprintf(buf + len, size - len,
++			 "BBP TX Power (target power from TMAC)  : %6ld [0.5 dBm]\n",
++			 mt76_get_field(dev, reg, MT_WF_PHY_TPC_POWER_TMAC));
++	len += scnprintf(buf + len, size - len,
++			 "BBP TX Power (target power from RMAC)  : %6ld [0.5 dBm]\n",
++			 mt76_get_field(dev, reg, MT_WF_PHY_TPC_POWER_RMAC));
++	len += scnprintf(buf + len, size - len,
++			 "BBP TX Power (TSSI module power input)  : %6ld [0.5 dBm]\n",
++			 mt76_get_field(dev, reg, MT_WF_PHY_TPC_POWER_TSSI));
++
++	ret = simple_read_from_buffer(user_buf, count, ppos, buf, len);
++
++out:
++	kfree(buf);
++	kfree(event);
++	return ret;
++}
++
++static const struct file_operations mt7996_txpower_sku_fops = {
++	.read = mt7996_get_txpower_sku,
++	.open = simple_open,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
+ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+ {
+ 	struct mt7996_dev *dev = phy->dev;
+@@ -2334,6 +2560,9 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+ 
+ 	debugfs_create_devm_seqfile(dev->mt76.dev, "tr_info", dir,
+ 				    mt7996_trinfo_read);
++	debugfs_create_file("txpower_level", 0600, dir, phy, &fops_txpower_level);
++	debugfs_create_file("txpower_info", 0600, dir, phy, &mt7996_txpower_info_fops);
++	debugfs_create_file("txpower_sku", 0600, dir, phy, &mt7996_txpower_sku_fops);
+ 
+ 	debugfs_create_devm_seqfile(dev->mt76.dev, "wtbl_info", dir,
+ 				    mt7996_wtbl_read);
+diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
+index e8870166..f772243b 100644
+--- a/mt7996/mtk_mcu.c
++++ b/mt7996/mtk_mcu.c
+@@ -12,7 +12,30 @@
+ 
+ #ifdef CONFIG_MTK_DEBUG
+ 
++int mt7996_mcu_get_tx_power_info(struct mt7996_phy *phy, u8 category, void *event)
++{
++	struct mt7996_dev *dev = phy->dev;
++	struct tx_power_ctrl req = {
++		.tag = cpu_to_le16(UNI_TXPOWER_SHOW_INFO),
++		.len = cpu_to_le16(sizeof(req) - 4),
++		.power_ctrl_id = UNI_TXPOWER_SHOW_INFO,
++		.show_info_category = category,
++		.band_idx = phy->mt76->band_idx,
++	};
++	struct sk_buff *skb;
++	int ret;
+ 
++	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
++					MCU_WM_UNI_CMD_QUERY(TXPOWER),
++					&req, sizeof(req), true, &skb);
++	if (ret)
++		return ret;
+ 
++	memcpy(event, skb->data, sizeof(struct mt7996_mcu_txpower_event));
++
++	dev_kfree_skb(skb);
++
++	return 0;
++}
+ 
+ #endif
+diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
+index e741aa27..1fa449ea 100644
+--- a/mt7996/mtk_mcu.h
++++ b/mt7996/mtk_mcu.h
+@@ -10,6 +10,84 @@
+ 
+ #ifdef CONFIG_MTK_DEBUG
+ 
++struct txpower_basic_info {
++	u8 category;
++	u8 rsv1;
++
++	/* basic info */
++	u8 band_idx;
++	u8 band;
++
++	/* board type info */
++	bool is_epa;
++	bool is_elna;
++
++	/* power percentage info */
++	bool percentage_ctrl_enable;
++	u8 power_drop_level;
++
++	/* frond-end loss TX info */
++	u8 front_end_loss_tx[4];
++
++	/* frond-end loss RX info */
++	u8 front_end_loss_rx[4];
++
++	/* thermal info */
++	bool thermal_compensate_enable;
++	u8 thermal_compensate_value;
++	u8 rsv2;
++
++	/* TX power max/min limit info */
++	u8 max_power_bound;
++	u8 min_power_bound;
++
++	/* power limit info */
++	bool sku_enable;
++	bool bf_backoff_enable;
++
++	/* MU TX power info */
++	bool mu_tx_power_manual_enable;
++	u8 mu_tx_power_auto;
++	u8 mu_tx_power_manual;
++	u8 rsv3;
++};
++
++struct txpower_phy_rate_info {
++	u8 category;
++	u8 band_idx;
++	u8 band;
++	u8 epa_gain;
++
++	/* rate power info [dBm] */
++	s8 frame_power[MT7996_SKU_RATE_NUM][__MT_MAX_BAND];
++
++	/* TX power max/min limit info */
++	s8 max_power_bound;
++	s8 min_power_bound;
++	u8 rsv1;
++};
++
++struct mt7996_mcu_txpower_event {
++	u8 _rsv[4];
++
++	__le16 tag;
++	__le16 len;
++
++	union {
++		struct txpower_basic_info basic_info;
++		struct txpower_phy_rate_info phy_rate_info;
++	};
++};
++
++enum txpower_category {
++	BASIC_INFO,
++	PHY_RATE_INFO = 2,
++};
++
++enum txpower_event {
++	UNI_TXPOWER_BASIC_INFO = 0,
++	UNI_TXPOWER_PHY_RATE_INFO = 5,
++};
+ 
+ #endif
+ 
+diff --git a/mt7996/regs.h b/mt7996/regs.h
+index 0775ca58..03e8329e 100644
+--- a/mt7996/regs.h
++++ b/mt7996/regs.h
+@@ -543,15 +543,22 @@ enum base_rev {
+ 
+ #define MT_PCIE1_MAC_INT_ENABLE			MT_PCIE1_MAC(0x188)
+ 
+-/* PHYRX CTRL */
+-#define MT_WF_PHYRX_BAND_BASE			0x83080000
+-#define MT_WF_PHYRX_BAND(_band, ofs)		(MT_WF_PHYRX_BAND_BASE + \
++/* PHY CTRL */
++#define MT_WF_PHY_BAND_BASE			0x83080000
++#define MT_WF_PHY_BAND(_band, ofs)		(MT_WF_PHY_BAND_BASE + \
+ 						 ((_band) << 20) + (ofs))
+ 
+-#define MT_WF_PHYRX_BAND_RX_CTRL1(_band)	MT_WF_PHYRX_BAND(_band, 0x2004)
++/* PHYRX CTRL */
++#define MT_WF_PHYRX_BAND_RX_CTRL1(_band)	MT_WF_PHY_BAND(_band, 0x2004)
+ #define MT_WF_PHYRX_BAND_RX_CTRL1_IPI_EN	GENMASK(2, 0)
+ #define MT_WF_PHYRX_BAND_RX_CTRL1_STSCNT_EN	GENMASK(11, 9)
+ 
++/* PHYDFE CTRL */
++#define MT_WF_PHYDFE_BAND_TPC_CTRL_STAT0(_phy)	MT_WF_PHY_BAND(_phy, 0xe7a0)
++#define MT_WF_PHY_TPC_POWER_TMAC		GENMASK(15, 8)
++#define MT_WF_PHY_TPC_POWER_RMAC		GENMASK(23, 16)
++#define MT_WF_PHY_TPC_POWER_TSSI		GENMASK(31, 24)
++
+ /* PHYRX CSD */
+ #define MT_WF_PHYRX_CSD_BASE			0x83000000
+ #define MT_WF_PHYRX_CSD(_band, _wf, ofs)	(MT_WF_PHYRX_CSD_BASE + \
+@@ -560,7 +567,7 @@ enum base_rev {
+ #define MT_WF_PHYRX_CSD_IRPI(_band, _wf)	MT_WF_PHYRX_CSD(_band, _wf, 0x1000)
+ 
+ /* PHYRX CSD BAND */
+-#define MT_WF_PHYRX_CSD_BAND_RXTD12(_band)		MT_WF_PHYRX_BAND(_band, 0x8230)
++#define MT_WF_PHYRX_CSD_BAND_RXTD12(_band)		MT_WF_PHY_BAND(_band, 0x8230)
+ #define MT_WF_PHYRX_CSD_BAND_RXTD12_IRPI_SW_CLR_ONLY	BIT(18)
+ #define MT_WF_PHYRX_CSD_BAND_RXTD12_IRPI_SW_CLR		BIT(29)
+ 
+-- 
+2.39.2
+
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
index 51df096..9714d73 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/patches.inc
@@ -2,22 +2,34 @@
 SRC_URI_append = " \
     file://0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch \
     file://0002-wifi-mt76-mt7996-let-non-bufferable-MMPDUs-use-corre.patch \
-    file://0003-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch \
-    file://0004-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch \
-    file://0005-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch \
-    file://0006-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch \
-    file://0007-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch \
-    file://0008-wifi-mt76-mt7996-add-muru-support.patch \
-    file://0009-wifi-mt76-mt7996-set-txd-v1.patch \
-    file://0010-wifi-mt76-mt7996-add-thermal-protection-support.patch \
-    file://0011-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch \
-    file://0012-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch \
-    file://0013-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch \
-    file://0014-wifi-mt76-mt7996-add-dsp-firmware-download.patch \
-    file://0015-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch \
-    file://0016-wifi-mt76-mt7996-init-mpdu-density.patch \
+    file://0003-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch \
+    file://0004-wifi-mt76-mt7996-init-mpdu-density.patch \
+    file://0005-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch \
+    file://0006-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch \
+    file://0007-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch \
+    file://0008-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch \
+    file://0009-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch \
+    file://0010-wifi-mt76-mt7996-add-muru-support.patch \
+    file://0011-wifi-mt76-mt7996-set-txd-v1.patch \
+    file://0012-wifi-mt76-mt7996-add-thermal-protection-support.patch \
+    file://0013-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch \
+    file://0014-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch \
+    file://0015-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch \
+    file://0016-wifi-mt76-mt7996-add-dsp-firmware-download.patch \
     file://0017-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch \
     file://0018-wifi-mt76-mt7996-set-wcid-in-txp.patch \
-    file://0019-mt76-revert-page-pool-changes.patch \
+    file://0019-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch \
+    file://0020-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch \
+    file://0021-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch \
+    file://0022-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch \
+    file://0023-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch \
+    file://0024-wifi-mt76-mt7996-update-wmm-queue-mapping.patch \
+    file://0025-wifi-mt76-mt7996-enable-IDS-debug-log.patch \
+    file://0026-mt76-testmode-add-atenl-support-in-mt7996.patch \
+    file://0027-mt76-testmode-add-basic-testmode-support.patch \
+    file://0028-mt76-testmode-add-chainmask-hacking-for-eagle-band-2.patch \
+    file://0029-mt76-revert-page-pool-changes.patch \
     file://0999-mt76-mt7996-for-build-pass.patch \
+    file://1000-mt76-mt7996-add-debug-tool.patch \
+    file://1001-mt76-mt7996-add-txpower-support.patch \
     "
diff --git a/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-Update-beacon-size-limitation-for-1.patch b/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-Update-beacon-size-limitation-for-1.patch
new file mode 100644
index 0000000..80f0706
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0002-wifi-mt76-mt7915-Update-beacon-size-limitation-for-1.patch
@@ -0,0 +1,228 @@
+From 881a2a6a5237b86287ee5eeaa1914a1e85cbeab6 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Thu, 23 Mar 2023 08:49:48 +0800
+Subject: [PATCH] wifi: mt76: mt7915: Update beacon size limitation for 11v
+
+Separate the beacon offload command into two;
+one is for beacons and the other is for inband discovery frames.
+Also, the TLV size limitation for these two has been expanded to
+accommodate 11v MBSSID IE.
+
+Co-developed-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Co-developed-by: Money Wang <Money.Wang@mediatek.com>
+Signed-off-by: Money Wang <Money.Wang@mediatek.com>
+Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+---
+ mt7915/main.c   |  8 +++++---
+ mt7915/mcu.c    | 50 +++++++++++++++++++++++++++++--------------------
+ mt7915/mcu.h    | 31 +++++++++++++++---------------
+ mt7915/mt7915.h |  2 ++
+ 4 files changed, 52 insertions(+), 39 deletions(-)
+
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 3bbccbd..ea1d4e6 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -647,11 +647,13 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
+ 		mt7915_update_bss_color(hw, vif, &info->he_bss_color);
+ 
+ 	if (changed & (BSS_CHANGED_BEACON |
+-		       BSS_CHANGED_BEACON_ENABLED |
+-		       BSS_CHANGED_UNSOL_BCAST_PROBE_RESP |
+-		       BSS_CHANGED_FILS_DISCOVERY))
++		       BSS_CHANGED_BEACON_ENABLED))
+ 		mt7915_mcu_add_beacon(hw, vif, info->enable_beacon, changed);
+ 
++	if (changed & (BSS_CHANGED_UNSOL_BCAST_PROBE_RESP |
++		       BSS_CHANGED_FILS_DISCOVERY))
++		mt7915_mcu_add_inband_discov(dev, vif, changed);
++
+ 	mutex_unlock(&dev->mt76.mutex);
+ }
+ 
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index d08907f..dae1de8 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -1953,10 +1953,9 @@ mt7915_mcu_beacon_check_caps(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ 	}
+ }
+ 
+-static void
+-mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+-				struct sk_buff *rskb, struct bss_info_bcn *bcn,
+-				u32 changed)
++int
++mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
++			     u32 changed)
+ {
+ #define OFFLOAD_TX_MODE_SU	BIT(0)
+ #define OFFLOAD_TX_MODE_MU	BIT(1)
+@@ -1966,14 +1965,28 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+ 	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
+ 	enum nl80211_band band = chandef->chan->band;
+ 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
++	struct bss_info_bcn *bcn;
+ 	struct bss_info_inband_discovery *discov;
+ 	struct ieee80211_tx_info *info;
+-	struct sk_buff *skb = NULL;
+-	struct tlv *tlv;
++	struct sk_buff *rskb, *skb = NULL;
++	struct tlv *tlv, *sub_tlv;
+ 	bool ext_phy = phy != &dev->phy;
+ 	u8 *buf, interval;
+ 	int len;
+ 
++	if (vif->bss_conf.nontransmitted)
++		return 0;
++
++	rskb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, NULL,
++					       MT7915_MAX_BSS_OFFLOAD_SIZE);
++
++	if (IS_ERR(rskb))
++		return PTR_ERR(rskb);
++
++	tlv = mt76_connac_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn));
++	bcn = (struct bss_info_bcn *)tlv;
++	bcn->enable = true;
++
+ 	if (changed & BSS_CHANGED_FILS_DISCOVERY &&
+ 	    vif->bss_conf.fils_discovery.max_interval) {
+ 		interval = vif->bss_conf.fils_discovery.max_interval;
+@@ -1985,26 +1998,25 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+ 	}
+ 
+ 	if (!skb)
+-		return;
++		return -EINVAL;
+ 
+ 	info = IEEE80211_SKB_CB(skb);
+ 	info->control.vif = vif;
+ 	info->band = band;
+-
+ 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, ext_phy);
+ 
+ 	len = sizeof(*discov) + MT_TXD_SIZE + skb->len;
+ 	len = (len & 0x3) ? ((len | 0x3) + 1) : len;
+ 
+-	if (len > (MT7915_MAX_BSS_OFFLOAD_SIZE - rskb->len)) {
++	if (skb->len > MT7915_MAX_BEACON_SIZE) {
+ 		dev_err(dev->mt76.dev, "inband discovery size limit exceed\n");
+ 		dev_kfree_skb(skb);
+-		return;
++		return -EINVAL;
+ 	}
+ 
+-	tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_DISCOV,
+-					   len, &bcn->sub_ntlv, &bcn->len);
+-	discov = (struct bss_info_inband_discovery *)tlv;
++	sub_tlv = mt7915_mcu_add_nested_subtlv(rskb, BSS_INFO_BCN_DISCOV,
++					       len, &bcn->sub_ntlv, &bcn->len);
++	discov = (struct bss_info_inband_discovery *)sub_tlv;
+ 	discov->tx_mode = OFFLOAD_TX_MODE_SU;
+ 	/* 0: UNSOL PROBE RESP, 1: FILS DISCOV */
+ 	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
+@@ -2012,13 +2024,16 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+ 	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
+ 	discov->enable = true;
+ 
+-	buf = (u8 *)tlv + sizeof(*discov);
++	buf = (u8 *)sub_tlv + sizeof(*discov);
+ 
+ 	mt7915_mac_write_txwi(&dev->mt76, (__le32 *)buf, skb, wcid, 0, NULL,
+ 			      0, changed);
+ 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
+ 
+ 	dev_kfree_skb(skb);
++
++	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
++				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
+ }
+ 
+ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2054,7 +2069,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	if (!skb)
+ 		return -EINVAL;
+ 
+-	if (skb->len > MT7915_MAX_BEACON_SIZE - MT_TXD_SIZE) {
++	if (skb->len > MT7915_MAX_BEACON_SIZE) {
+ 		dev_err(dev->mt76.dev, "Bcn size limit exceed\n");
+ 		dev_kfree_skb(skb);
+ 		return -EINVAL;
+@@ -2070,11 +2085,6 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	mt7915_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
+ 	dev_kfree_skb(skb);
+ 
+-	if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP ||
+-	    changed & BSS_CHANGED_FILS_DISCOVERY)
+-		mt7915_mcu_beacon_inband_discov(dev, vif, rskb,
+-						bcn, changed);
+-
+ out:
+ 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
+ 				     MCU_EXT_CMD(BSS_INFO_UPDATE), true);
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index b9ea297..e8c9f74 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -495,28 +495,27 @@ enum {
+ 	SER_RECOVER
+ };
+ 
+-#define MT7915_MAX_BEACON_SIZE		512
+-#define MT7915_MAX_INBAND_FRAME_SIZE	256
+-#define MT7915_MAX_BSS_OFFLOAD_SIZE	(MT7915_MAX_BEACON_SIZE +	  \
+-					 MT7915_MAX_INBAND_FRAME_SIZE +	  \
+-					 MT7915_BEACON_UPDATE_SIZE)
+-
+-#define MT7915_BSS_UPDATE_MAX_SIZE	(sizeof(struct sta_req_hdr) +	\
+-					 sizeof(struct bss_info_omac) +	\
++#define MT7915_MAX_BEACON_SIZE		1308
++#define MT7915_BEACON_UPDATE_SIZE	(sizeof(struct sta_req_hdr) +	\
++					 sizeof(struct bss_info_bcn) +	\
++					 sizeof(struct bss_info_bcn_cntdwn) +	\
++					 sizeof(struct bss_info_bcn_mbss) +	\
++					 MT_TXD_SIZE +	\
++					 sizeof(struct bss_info_bcn_cont))
++#define MT7915_MAX_BSS_OFFLOAD_SIZE	(sizeof(struct mt76_connac2_mcu_txd) +	\
++					 MT7915_MAX_BEACON_SIZE +	\
++					 MT7915_BEACON_UPDATE_SIZE)
++
++#define MT7915_BSS_UPDATE_MAX_SIZE	(sizeof(struct sta_req_hdr) +	\
++					 sizeof(struct bss_info_omac) +	\
+ 					 sizeof(struct bss_info_basic) +\
+ 					 sizeof(struct bss_info_rf_ch) +\
+-					 sizeof(struct bss_info_ra) +	\
++					 sizeof(struct bss_info_ra) +	\
+ 					 sizeof(struct bss_info_hw_amsdu) +\
+-					 sizeof(struct bss_info_he) +	\
++					 sizeof(struct bss_info_he) +	\
+ 					 sizeof(struct bss_info_bmc_rate) +\
+ 					 sizeof(struct bss_info_ext_bss))
+ 
+-#define MT7915_BEACON_UPDATE_SIZE	(sizeof(struct sta_req_hdr) +	\
+-					 sizeof(struct bss_info_bcn_cntdwn) + \
+-					 sizeof(struct bss_info_bcn_mbss) + \
+-					 sizeof(struct bss_info_bcn_cont) + \
+-					 sizeof(struct bss_info_inband_discovery))
+-
+ static inline s8
+ mt7915_get_power_bound(struct mt7915_phy *phy, s8 txpower)
+ {
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 3cbfb9b..b66938b 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -506,6 +506,8 @@ int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
+ 			 bool add);
+ int mt7915_mcu_update_bss_color(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+ 				struct cfg80211_he_bss_color *he_bss_color);
++int mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
++				 u32 changed);
+ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			  int enable, u32 changed);
+ int mt7915_mcu_add_obss_spr(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+-- 
+2.39.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
index ef37684..2d2ccf9 100644
--- a/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -1,12 +1,12 @@
-From 764731bb9676e58e8819bdbe48719b1076625032 Mon Sep 17 00:00:00 2001
+From a5c56c30acb0543550bbe6f315fc2dbfdd7cdafb Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
-Subject: [PATCH 1001/1009] mt76: mt7915: add mtk internal debug tools for mt76
+Subject: [PATCH] mt76: mt7915: add mtk internal debug tools for mt76
 
 ---
  mt76_connac_mcu.h     |    6 +
  mt7915/Makefile       |    2 +-
- mt7915/debugfs.c      |   73 +-
+ mt7915/debugfs.c      |   89 +-
  mt7915/mac.c          |   14 +
  mt7915/main.c         |    4 +
  mt7915/mcu.c          |   48 +-
@@ -16,7 +16,7 @@
  mt7915/mtk_debugfs.c  | 3003 +++++++++++++++++++++++++++++++++++++++++
  mt7915/mtk_mcu.c      |   51 +
  tools/fwlog.c         |   44 +-
- 12 files changed, 4641 insertions(+), 14 deletions(-)
+ 12 files changed, 4652 insertions(+), 19 deletions(-)
  create mode 100644 mt7915/mt7915_debug.h
  create mode 100644 mt7915/mtk_debugfs.c
  create mode 100644 mt7915/mtk_mcu.c
@@ -59,7 +59,7 @@
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 5a46813a..f1f3f2f3 100644
+index 5a46813a..eb149104 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -8,6 +8,9 @@
@@ -118,7 +118,21 @@
  
  	return 0;
  }
-@@ -632,6 +651,17 @@ mt7915_fw_debug_bin_set(void *data, u64 val)
+@@ -622,16 +641,30 @@ mt7915_fw_debug_bin_set(void *data, u64 val)
+ 	};
+ 	struct mt7915_dev *dev = data;
+ 
+-	if (!dev->relay_fwlog)
++	if (!dev->relay_fwlog && val) {
+ 		dev->relay_fwlog = relay_open("fwlog_data", dev->debugfs_dir,
+ 					    1500, 512, &relay_cb, NULL);
+-	if (!dev->relay_fwlog)
+-		return -ENOMEM;
++		if (!dev->relay_fwlog)
++			return -ENOMEM;
++	}
+ 
+ 	dev->fw.debug_bin = val;
  
  	relay_reset(dev->relay_fwlog);
  
@@ -128,15 +142,17 @@
 +	dev->dbg.dump_tx_pkt = val & BIT(6) ? true : false;
 +	dev->dbg.dump_rx_pkt = val & BIT(7) ? true : false;
 +	dev->dbg.dump_rx_raw = val & BIT(8) ? true : false;
-+	if (!(val & GENMASK(3, 0)))
-+		return 0;
 +#endif
 +
++	if (dev->relay_fwlog && !val) {
++		relay_close(dev->relay_fwlog);
++		dev->relay_fwlog = NULL;
++	}
 +
  	return mt7915_fw_debug_wm_set(dev, dev->fw.debug_wm);
  }
  
-@@ -1257,6 +1287,11 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+@@ -1257,6 +1290,11 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
  	if (!ext_phy)
  		dev->debugfs_dir = dir;
  
@@ -148,10 +164,25 @@
  	return 0;
  }
  
-@@ -1297,17 +1332,53 @@ void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int
+@@ -1269,6 +1307,12 @@ mt7915_debugfs_write_fwlog(struct mt7915_dev *dev, const void *hdr, int hdrlen,
+ 	void *dest;
+ 
+ 	spin_lock_irqsave(&lock, flags);
++
++	if (!dev->relay_fwlog) {
++		spin_unlock_irqrestore(&lock, flags);
++		return;
++	}
++
+ 	dest = relay_reserve(dev->relay_fwlog, hdrlen + len + 4);
+ 	if (dest) {
+ 		*(u32 *)dest = hdrlen + len;
+@@ -1297,17 +1341,50 @@ void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int
  		.msg_type = cpu_to_le16(PKT_TYPE_RX_FW_MONITOR),
  	};
  
+-	if (!dev->relay_fwlog)
+-		return;
 +#ifdef MTK_DEBUG
 +	struct {
 +		__le32 magic;
@@ -167,9 +198,6 @@
 +		.msg_type = PKT_TYPE_RX_FW_MONITOR,
 +	};
 +#endif
-+
- 	if (!dev->relay_fwlog)
- 		return;
  
 +#ifdef MTK_DEBUG
 +	/* old magic num */
@@ -258,7 +286,7 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d08907f5..1fecd4b1 100644
+index dc24a475..198b623f 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -199,6 +199,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -4972,5 +5000,5 @@
  	return ret;
  }
 -- 
-2.18.0
+2.39.2
 
diff --git a/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch b/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
index b1db4b7..bb91417 100644
--- a/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1006-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
@@ -1,8 +1,7 @@
-From 8999d582213c666073a3bf3c855b66b16be16a52 Mon Sep 17 00:00:00 2001
+From 659402f6dcf3e66e5e39065fa5ccda91deecfefa Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
-Date: Fri, 27 May 2022 15:51:48 +0800
-Subject: [PATCH 1006/1009] mt76: mt7915: add support for runtime set in-band
- discovery
+Date: Thu, 23 Mar 2023 09:55:50 +0800
+Subject: [PATCH] mt76: mt7915: add support for runtime set in-band discovery
 
 Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 ---
@@ -10,12 +9,12 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 057ea6ee..03c94349 100644
+index 5aa103b..8ff5440 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -1994,8 +1994,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
- 	u8 *buf, interval;
- 	int len;
+@@ -2007,8 +2007,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+ 	bcn = (struct bss_info_bcn *)tlv;
+ 	bcn->enable = true;
  
 -	if (changed & BSS_CHANGED_FILS_DISCOVERY &&
 -	    vif->bss_conf.fils_discovery.max_interval) {
@@ -23,15 +22,15 @@
  		interval = vif->bss_conf.fils_discovery.max_interval;
  		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
  	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-@@ -2030,7 +2029,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -2042,7 +2041,7 @@ mt7915_mcu_add_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
  	discov->tx_interval = interval;
  	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
 -	discov->enable = true;
 +	discov->enable = !!(interval);
  
- 	buf = (u8 *)tlv + sizeof(*discov);
+ 	buf = (u8 *)sub_tlv + sizeof(*discov);
  
 -- 
-2.18.0
+2.39.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/patches.inc b/recipes-wifi/linux-mt76/files/patches/patches.inc
index 9fe95eb..e398741 100644
--- a/recipes-wifi/linux-mt76/files/patches/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches/patches.inc
@@ -1,6 +1,7 @@
 #patch patches (come from openwrt/lede/target/linux/mediatek)
 SRC_URI_append = " \
     file://0001-mt76-mt7915-fix-background-radar-event-being-blocked.patch \
+    file://0002-wifi-mt76-mt7915-Update-beacon-size-limitation-for-1.patch \
     file://1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch \
     file://1002-mt76-mt7915-csi-implement-csi-support.patch \
     file://1003-mt76-mt7915-air-monitor-support.patch \
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_dsp.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_dsp.bin
index 91fd282..d5d541f 100755
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_dsp.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_dsp.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_rom_patch.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_rom_patch.bin
index d54f1af..8a02116 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_rom_patch.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_rom_patch.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wa.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wa.bin
index 65abe42..924509d 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wa.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wa.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wm.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wm.bin
index c171e57..5bbf475 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wm.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wm.bin
Binary files differ
diff --git a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wm_tm.bin b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wm_tm.bin
index 7de344f..8f91f29 100644
--- a/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wm_tm.bin
+++ b/recipes-wifi/linux-mt76/files/src/firmware/mt7996/mt7996_wm_tm.bin
Binary files differ
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0001-hostapd-mtk-Add-neighbor-report-and-BSS-Termination-.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0001-hostapd-mtk-Add-neighbor-report-and-BSS-Termination-.patch
index fb7c63f..0c0e3c6 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0001-hostapd-mtk-Add-neighbor-report-and-BSS-Termination-.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0001-hostapd-mtk-Add-neighbor-report-and-BSS-Termination-.patch
@@ -1,7 +1,7 @@
-From cd52509a69c3ba34d9b4146664140fd1ff712aa9 Mon Sep 17 00:00:00 2001
+From d76ef3ce86c91a33baa763014c8a991faa4fae4a Mon Sep 17 00:00:00 2001
 From: "howard.hsu" <howard-yh.hsu@mediatek.com>
 Date: Wed, 19 Jan 2022 19:18:07 +0800
-Subject: [PATCH 01/15] hostapd: mtk: Add neighbor report and BSS Termination
+Subject: [PATCH 01/24] hostapd: mtk: Add neighbor report and BSS Termination
  for MBO certification
 
 1. Add hostapd_neighbor_count() and hostapd_neighbor_insert_buffer ()
@@ -32,7 +32,7 @@
  9 files changed, 252 insertions(+), 5 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index a2584920c..c2a282227 100644
+index a258492..c2a2822 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -1338,6 +1338,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
@@ -48,7 +48,7 @@
  		ret = hostapd_set_iface(hapd->iconf, hapd->conf, cmd, value);
  		if (ret)
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index d7a0c7c80..4a20eb4e1 100644
+index d7a0c7c..4a20eb4 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -170,6 +170,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
@@ -60,7 +60,7 @@
  
  
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 39b26d602..a87563265 100644
+index 39b26d6..a875632 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -558,6 +558,7 @@ struct hostapd_bss_config {
@@ -72,7 +72,7 @@
  	/* IEEE 802.11u - Interworking */
  	int interworking;
 diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
-index 96209ce7e..18bae5c8b 100644
+index 96209ce..18bae5c 100644
 --- a/src/ap/ctrl_iface_ap.c
 +++ b/src/ap/ctrl_iface_ap.c
 @@ -1203,6 +1203,10 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
@@ -115,7 +115,7 @@
  	if (pos) {
  		unsigned int mbo_reason, cell_pref, reassoc_delay;
 diff --git a/src/ap/gas_serv.c b/src/ap/gas_serv.c
-index 90f15778b..5845ff857 100644
+index 90f1577..5845ff8 100644
 --- a/src/ap/gas_serv.c
 +++ b/src/ap/gas_serv.c
 @@ -19,6 +19,7 @@
@@ -183,7 +183,7 @@
  #ifdef CONFIG_FILS
  		if (info_id == ANQP_FILS_REALM_INFO &&
 diff --git a/src/ap/gas_serv.h b/src/ap/gas_serv.h
-index 1528af4af..d0241f23c 100644
+index 1528af4..d0241f2 100644
 --- a/src/ap/gas_serv.h
 +++ b/src/ap/gas_serv.h
 @@ -40,6 +40,8 @@
@@ -196,7 +196,7 @@
   * First 15 Hotspot 2.0 vendor specific ANQP-elements can be included in the
   * optimized bitmap.
 diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
-index 52f25eb7a..9254d09fd 100644
+index 52f25eb..9254d09 100644
 --- a/src/ap/neighbor_db.c
 +++ b/src/ap/neighbor_db.c
 @@ -89,6 +89,38 @@ int hostapd_neighbor_show(struct hostapd_data *hapd, char *buf, size_t buflen)
@@ -330,7 +330,7 @@
 +}
 +#endif
 diff --git a/src/ap/neighbor_db.h b/src/ap/neighbor_db.h
-index 992671b62..a1ddc075b 100644
+index 992671b..a1ddc07 100644
 --- a/src/ap/neighbor_db.h
 +++ b/src/ap/neighbor_db.h
 @@ -24,4 +24,13 @@ int hostapd_neighbor_remove(struct hostapd_data *hapd, const u8 *bssid,
@@ -348,7 +348,7 @@
 +#endif
  #endif /* NEIGHBOR_DB_H */
 diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
-index 3ea92af2d..4349e1df2 100644
+index 3ea92af..4349e1d 100644
 --- a/src/ap/wnm_ap.c
 +++ b/src/ap/wnm_ap.c
 @@ -20,6 +20,7 @@
@@ -471,5 +471,5 @@
  
  	return 0;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0002-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0002-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
index 3f20768..df95c34 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0002-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0002-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
@@ -1,14 +1,14 @@
-From 2a08e4acbe0ff6f6af42df8262178cf153c8868d Mon Sep 17 00:00:00 2001
+From d4795ed4b051c4d9d9ee130a353bbe629f2f230a Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 20 Sep 2022 19:33:45 +0800
-Subject: [PATCH 02/15] hostapd: mtk: print sae groups by hostapd ctrl
+Subject: [PATCH 02/24] hostapd: mtk: print sae groups by hostapd ctrl
 
 ---
  hostapd/ctrl_iface.c | 13 +++++++++++++
  1 file changed, 13 insertions(+)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index c2a282227..bc690c526 100644
+index c2a2822..bc690c5 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -1412,6 +1412,19 @@ static int hostapd_ctrl_iface_get(struct hostapd_data *hapd, char *cmd,
@@ -32,5 +32,5 @@
  
  	return -1;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0003-hostapd-mtk-add-support-for-runtime-set-in-band-disc.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0003-hostapd-mtk-add-support-for-runtime-set-in-band-disc.patch
index 18d5970..686d6e8 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0003-hostapd-mtk-add-support-for-runtime-set-in-band-disc.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0003-hostapd-mtk-add-support-for-runtime-set-in-band-disc.patch
@@ -1,7 +1,7 @@
-From b2253861a02b5ae8074f36e0a417e05a207891b9 Mon Sep 17 00:00:00 2001
+From 7f31f81b12c13bd0748c2c2149da3319d4b7572a Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 31 May 2022 21:15:54 +0800
-Subject: [PATCH 03/15] hostapd: mtk: add support for runtime set in-band
+Subject: [PATCH 03/24] hostapd: mtk: add support for runtime set in-band
  discovery
 
 Usage:
@@ -21,7 +21,7 @@
  5 files changed, 98 insertions(+), 4 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index bc690c526..bb8c74fd3 100644
+index bc690c5..bb8c74f 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -826,6 +826,69 @@ static int hostapd_ctrl_iface_send_qos_map_conf(struct hostapd_data *hapd,
@@ -105,7 +105,7 @@
  		reply_len = hostapd_ctrl_iface_get_config(hapd, reply,
  							  reply_size);
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index 85c41d0c3..db2125805 100644
+index 85c41d0..db21258 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -642,6 +642,24 @@ static int hostapd_cli_cmd_wps_config(struct wpa_ctrl *ctrl, int argc,
@@ -143,7 +143,7 @@
  };
  
 diff --git a/src/ap/beacon.c b/src/ap/beacon.c
-index 814e86efe..1a26f11ff 100644
+index 814e86e..1a26f11 100644
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
 @@ -1497,6 +1497,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
@@ -166,7 +166,7 @@
  						  &params->fd_frame_tmpl_len);
  
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 1fa7dd8e0..c695263bf 100644
+index 1fa7dd8..c695263 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -4498,9 +4498,10 @@ static int nl80211_fils_discovery(struct i802_bss *bss, struct nl_msg *msg,
@@ -195,7 +195,7 @@
  #endif /* CONFIG_FILS */
  
 diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
-index 0568a7909..c4bf3ad35 100644
+index 0568a79..c4bf3ad 100644
 --- a/src/drivers/nl80211_copy.h
 +++ b/src/drivers/nl80211_copy.h
 @@ -7379,6 +7379,7 @@ enum nl80211_fils_discovery_attributes {
@@ -207,5 +207,5 @@
  	/* keep last */
  	__NL80211_FILS_DISCOVERY_ATTR_LAST,
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0004-hostapd-mtk-Add-mtk_vendor.h.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0004-hostapd-mtk-Add-mtk_vendor.h.patch
index 5b1a853..1f5d0cb 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0004-hostapd-mtk-Add-mtk_vendor.h.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0004-hostapd-mtk-Add-mtk_vendor.h.patch
@@ -1,7 +1,7 @@
-From 514ffcc16d420fade1b28478cd785e7709878bc7 Mon Sep 17 00:00:00 2001
+From c52b9a7ad6817c8d7efbf0525cceb007e8bda9a8 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 30 May 2022 15:04:57 +0800
-Subject: [PATCH 04/15] hostapd: mtk: Add mtk_vendor.h
+Subject: [PATCH 04/24] hostapd: mtk: Add mtk_vendor.h
 
 ---
  src/common/mtk_vendor.h | 195 ++++++++++++++++++++++++++++++++++++++++
@@ -10,7 +10,7 @@
 
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
 new file mode 100644
-index 000000000..528387fa5
+index 0000000..528387f
 --- /dev/null
 +++ b/src/common/mtk_vendor.h
 @@ -0,0 +1,195 @@
@@ -210,5 +210,5 @@
 +};
 +#endif /* MTK_VENDOR_H */
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0005-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0005-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
index 317a678..4527d83 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0005-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0005-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
@@ -1,7 +1,7 @@
-From f3df970bcf111eb0912f639ac32c0c145e381f95 Mon Sep 17 00:00:00 2001
+From a2022c1b617c259a37eac7e8a76667df122f8040 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 30 May 2022 16:31:34 +0800
-Subject: [PATCH 05/15] hostapd: mtk: Support EDCCA hostapd configuration
+Subject: [PATCH 05/24] hostapd: mtk: Support EDCCA hostapd configuration
 
 edcca_enable and edcca_compensation and implement edcca related handlers.
 ---
@@ -20,7 +20,7 @@
  12 files changed, 415 insertions(+), 7 deletions(-)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 24018f721..b5024ccd5 100644
+index 24018f7..b5024cc 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4755,6 +4755,38 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -63,7 +63,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index bb8c74fd3..9c70d5419 100644
+index bb8c74f..9c70d54 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -598,6 +598,19 @@ static const char * pbc_status_str(enum pbc_status status)
@@ -213,7 +213,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 4a20eb4e1..344585aee 100644
+index 4a20eb4..344585a 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -294,6 +294,9 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -235,7 +235,7 @@
  	wpabuf_free(conf->civic);
  
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a87563265..4ac469910 100644
+index a875632..4ac4699 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1154,8 +1154,37 @@ struct hostapd_config {
@@ -277,7 +277,7 @@
  static inline enum oper_chan_width
  hostapd_get_oper_chwidth(struct hostapd_config *conf)
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 0c7aee276..25e967d1b 100644
+index 0c7aee2..25e967d 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1015,3 +1015,27 @@ int hostapd_drv_dpp_listen(struct hostapd_data *hapd, bool enable)
@@ -309,7 +309,7 @@
 +	return hapd->driver->get_edcca(hapd->drv_priv, mode, value);
 +}
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index b4fb766ee..70a99f406 100644
+index b4fb766..70a99f4 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -138,7 +138,10 @@ int hostapd_drv_do_acs(struct hostapd_data *hapd);
@@ -325,7 +325,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index 65487ac28..3bb38fec3 100644
+index 65487ac..3bb38fe 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
 @@ -2296,6 +2296,13 @@ dfs_offload:
@@ -343,7 +343,7 @@
  		   iface->bss[0]->conf->iface);
  	if (iface->interfaces && iface->interfaces->terminate_on_error > 0)
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 528387fa5..70561263c 100644
+index 528387f..7056126 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -29,14 +29,21 @@ enum mtk_vendor_attr_edcca_ctrl {
@@ -375,7 +375,7 @@
  	[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
  	[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 1d2b1b265..35599741c 100644
+index 1d2b1b2..3559974 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -4676,6 +4676,10 @@ struct wpa_driver_ops {
@@ -390,7 +390,7 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index c695263bf..6d4a4dbbe 100644
+index c695263..6d4a4db 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -35,6 +35,8 @@
@@ -578,7 +578,7 @@
 +	.get_edcca = nl80211_get_edcca,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 6e40d5556..13e5d248c 100644
+index 6e40d55..13e5d24 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -181,6 +181,7 @@ struct wpa_driver_nl80211_data {
@@ -590,7 +590,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 7ede0d030..732ae292d 100644
+index 7ede0d0..732ae29 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -18,6 +18,7 @@
@@ -615,5 +615,5 @@
  
  			wpa_printf(MSG_DEBUG, "nl80211: Supported vendor command: vendor_id=0x%x subcmd=%u",
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0006-hostapd-mtk-Add-hostapd-MU-SET-GET-control.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0006-hostapd-mtk-Add-hostapd-MU-SET-GET-control.patch
index 07e0d6d..4378628 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0006-hostapd-mtk-Add-hostapd-MU-SET-GET-control.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0006-hostapd-mtk-Add-hostapd-MU-SET-GET-control.patch
@@ -1,7 +1,7 @@
-From 4919444a2dc29c019ec92321109603763c732071 Mon Sep 17 00:00:00 2001
+From 927adcab2218b9fe76c7c12c89ef4604ae530639 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Tue, 9 Aug 2022 10:23:44 -0700
-Subject: [PATCH 06/15] hostapd: mtk: Add hostapd MU SET/GET control
+Subject: [PATCH 06/24] hostapd: mtk: Add hostapd MU SET/GET control
 
 ---
  hostapd/config_file.c             |   9 +++
@@ -20,7 +20,7 @@
  13 files changed, 251 insertions(+)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index b5024ccd5..cd27d0890 100644
+index b5024cc..62e8b33 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -3661,6 +3661,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -40,7 +40,7 @@
  	} else if (os_strcmp(buf, "max_listen_interval") == 0) {
  		bss->max_listen_interval = atoi(pos);
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 9c70d5419..5f71aeea9 100644
+index 9c70d54..c72f336 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3441,6 +3441,63 @@ hostapd_ctrl_iface_get_edcca(struct hostapd_data *hapd, char *cmd, char *buf,
@@ -120,7 +120,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index db2125805..0d364773b 100644
+index db21258..e16a1dc 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -1380,6 +1380,20 @@ static int hostapd_cli_cmd_driver_flags(struct wpa_ctrl *ctrl, int argc,
@@ -156,7 +156,7 @@
  	{ "dpp_qr_code", hostapd_cli_cmd_dpp_qr_code, NULL,
  	  "report a scanned DPP URI from a QR Code" },
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 344585aee..0e1f192cf 100644
+index 344585a..d4fc191 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -280,6 +280,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -168,7 +168,7 @@
  
  	/* The third octet of the country string uses an ASCII space character
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 4ac469910..0616c30bb 100644
+index 4ac4699..37779b7 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1115,6 +1115,7 @@ struct hostapd_config {
@@ -180,7 +180,7 @@
  
  	/* VHT enable/disable config from CHAN_SWITCH */
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 25e967d1b..4598737a3 100644
+index 25e967d..60b9fc0 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1039,3 +1039,17 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value)
@@ -202,7 +202,7 @@
 +	return hapd->driver->mu_dump(hapd->drv_priv, mu_onoff);
 +}
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index 70a99f406..bca39c502 100644
+index 70a99f4..185d5f3 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -142,6 +142,8 @@ int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd);
@@ -215,7 +215,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index 3bb38fec3..44a378aa9 100644
+index 3bb38fe..71d7bfa 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
 @@ -2302,6 +2302,8 @@ dfs_offload:
@@ -228,7 +228,7 @@
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 70561263c..69a46dfbb 100644
+index 7056126..ef8618e 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -10,6 +10,8 @@ enum mtk_nl80211_vendor_subcmds {
@@ -261,7 +261,7 @@
  #define ETH_ALEN 6
  
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 35599741c..4cd7505db 100644
+index 3559974..fa5ad45 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -1623,6 +1623,11 @@ struct wpa_driver_ap_params {
@@ -292,7 +292,7 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 6d4a4dbbe..f8b3f40c2 100644
+index 6d4a4db..0523aab 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -12304,6 +12304,114 @@ fail:
@@ -420,7 +420,7 @@
  	.dpp_listen = nl80211_dpp_listen,
  #endif /* CONFIG_DPP */
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 13e5d248c..57f02497e 100644
+index 13e5d24..1dd984c 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -182,6 +182,7 @@ struct wpa_driver_nl80211_data {
@@ -432,7 +432,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 732ae292d..cc146d9fc 100644
+index 732ae29..cc11891 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -1056,6 +1056,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
@@ -446,5 +446,5 @@
  			}
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0007-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-c.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0007-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-c.patch
index 8ca8c55..b33c599 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0007-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-c.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0007-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-c.patch
@@ -1,7 +1,7 @@
-From 00a1908f92e31d6d85edc877c98387a9fdb737af Mon Sep 17 00:00:00 2001
+From 1ed9156c654c1affb51bf1bfa2cc5be8f9b7c465 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 2 Sep 2022 01:03:23 +0800
-Subject: [PATCH 07/15] hostapd: mtk: Add three wire PTA ctrl hostapd vendor
+Subject: [PATCH 07/24] hostapd: mtk: Add three wire PTA ctrl hostapd vendor
  command
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -20,7 +20,7 @@
  11 files changed, 93 insertions(+)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index cd27d0890..df9c1e7a7 100644
+index 62e8b33..6e526eb 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4796,6 +4796,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -35,7 +35,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 0e1f192cf..9249a6bb8 100644
+index d4fc191..1a1a059 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -297,6 +297,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -47,7 +47,7 @@
  	return conf;
  }
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 0616c30bb..0c370e75b 100644
+index 37779b7..f1be7ae 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1158,6 +1158,19 @@ struct hostapd_config {
@@ -71,7 +71,7 @@
  
  enum edcca_mode {
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 4598737a3..a1d83e4ee 100644
+index 60b9fc0..973b44e 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1053,3 +1053,14 @@ int hostapd_drv_mu_dump(struct hostapd_data *hapd, u8 *mu_onoff)
@@ -90,7 +90,7 @@
 +	return hapd->driver->three_wire_ctrl(hapd->drv_priv, hapd->iconf->three_wire_enable);
 +}
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index bca39c502..5ba62978c 100644
+index 185d5f3..51d7b3b 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -144,6 +144,7 @@ int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
@@ -102,7 +102,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index 44a378aa9..c972b15ea 100644
+index 71d7bfa..77e7eb4 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
 @@ -2304,6 +2304,8 @@ dfs_offload:
@@ -115,7 +115,7 @@
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 69a46dfbb..ee5a4f436 100644
+index ef8618e..ed47487 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -13,6 +13,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -149,7 +149,7 @@
  	MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
  
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 4cd7505db..9ca19af81 100644
+index fa5ad45..6c4c70c 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -4693,6 +4693,14 @@ struct wpa_driver_ops {
@@ -168,7 +168,7 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index f8b3f40c2..92882cb73 100644
+index 0523aab..568c704 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -12637,6 +12637,38 @@ static int nl80211_get_edcca(void *priv, const u8 mode, u8 *value)
@@ -217,7 +217,7 @@
 +	.three_wire_ctrl = nl80211_enable_three_wire,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 57f02497e..9fe7811b9 100644
+index 1dd984c..35fd4d2 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -183,6 +183,7 @@ struct wpa_driver_nl80211_data {
@@ -229,7 +229,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index cc146d9fc..04bc54e77 100644
+index cc11891..dc2d7b1 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -1059,6 +1059,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
@@ -243,5 +243,5 @@
  			}
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0008-hostapd-mtk-Add-hostapd-iBF-control.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0008-hostapd-mtk-Add-hostapd-iBF-control.patch
index fc38b4f..d2f7b2f 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0008-hostapd-mtk-Add-hostapd-iBF-control.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0008-hostapd-mtk-Add-hostapd-iBF-control.patch
@@ -1,7 +1,7 @@
-From 508e76ba51d47394a1b01ba7b9f3c1f25db0aa39 Mon Sep 17 00:00:00 2001
+From 0d84da530a21971ee7a3572c8ce559d53b5eb138 Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:41:51 -0700
-Subject: [PATCH 08/15] hostapd: mtk: Add hostapd iBF control
+Subject: [PATCH 08/24] hostapd: mtk: Add hostapd iBF control
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
@@ -21,7 +21,7 @@
  13 files changed, 224 insertions(+), 1 deletion(-)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index df9c1e7a7..63c9d40be 100644
+index 6e526eb..579193f 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4800,6 +4800,9 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -35,7 +35,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 5f71aeea9..c881d3717 100644
+index c72f336..5590100 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3498,6 +3498,30 @@ hostapd_ctrl_iface_get_mu(struct hostapd_data *hapd, char *buf,
@@ -79,7 +79,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index 0d364773b..c2a123a8c 100644
+index e16a1dc..1f7013e 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -1586,6 +1586,13 @@ static int hostapd_cli_cmd_driver(struct wpa_ctrl *ctrl, int argc, char *argv[])
@@ -106,7 +106,7 @@
  };
  
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 9249a6bb8..7a96cb8b2 100644
+index 1a1a059..df90814 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -298,6 +298,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -118,7 +118,7 @@
  	return conf;
  }
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 0c370e75b..a9e3d2aeb 100644
+index f1be7ae..be30b51 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1159,6 +1159,7 @@ struct hostapd_config {
@@ -138,7 +138,7 @@
  static inline enum oper_chan_width
  hostapd_get_oper_chwidth(struct hostapd_config *conf)
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index a1d83e4ee..60ae8253b 100644
+index 973b44e..bec9798 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1064,3 +1064,17 @@ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd)
@@ -161,7 +161,7 @@
 +}
 \ No newline at end of file
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index 5ba62978c..ab9aedcee 100644
+index 51d7b3b..30b0322 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -145,6 +145,8 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
@@ -174,7 +174,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index c972b15ea..da7f7d87b 100644
+index 77e7eb4..e83298e 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
 @@ -2306,6 +2306,8 @@ dfs_offload:
@@ -187,7 +187,7 @@
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index ee5a4f436..4050cf886 100644
+index ed47487..7b7aeaa 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -13,7 +13,8 @@ enum mtk_nl80211_vendor_subcmds {
@@ -240,7 +240,7 @@
  #define CSI_MAX_COUNT 256
  #define ETH_ALEN 6
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 9ca19af81..71ded617f 100644
+index 6c4c70c..913a194 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -1628,6 +1628,11 @@ struct wpa_driver_ap_params {
@@ -277,7 +277,7 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 92882cb73..5c2a291ca 100644
+index 568c704..ff257eb 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -12670,6 +12670,112 @@ static int nl80211_enable_three_wire(void *priv, const u8 three_wire_enable)
@@ -401,7 +401,7 @@
 +	.ibf_dump = nl80211_ibf_dump,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 9fe7811b9..607592ceb 100644
+index 35fd4d2..92e5ad6 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -184,6 +184,7 @@ struct wpa_driver_nl80211_data {
@@ -413,7 +413,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 04bc54e77..9ecc0ff9a 100644
+index dc2d7b1..83b4c5e 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -1062,6 +1062,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
@@ -427,5 +427,5 @@
  			}
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0009-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0009-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated.patch
index daf82b0..097f4e7 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0009-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0009-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated.patch
@@ -1,7 +1,7 @@
-From 1d4ef2662fb22f96c6db3730f35879d1be55db3d Mon Sep 17 00:00:00 2001
+From 571a9efc9c8ed7ccd4460f487ccbb2c8c9c6cb97 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 22 Sep 2022 16:08:09 +0800
-Subject: [PATCH 09/15] hostapd: mtk: Do not include HE capab IE if associated
+Subject: [PATCH 09/24] hostapd: mtk: Do not include HE capab IE if associated
  sta's HE capab IE is invalid
 
 ---
@@ -9,7 +9,7 @@
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
-index d92178379..098793ef3 100644
+index d921783..098793e 100644
 --- a/src/ap/ieee802_11.c
 +++ b/src/ap/ieee802_11.c
 @@ -5192,7 +5192,8 @@ static u16 send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
@@ -23,5 +23,5 @@
  		p = hostapd_eid_he_operation(hapd, p);
  		p = hostapd_eid_cca(hapd, p);
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch
index 7ec986a..54289c7 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch
@@ -1,7 +1,7 @@
-From 6828156c206701f5a0e5d30afcc514f452ce0ada Mon Sep 17 00:00:00 2001
+From c628c4257fb1b7eb0e3689d82c7b4bee5ae5d892 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 20 Feb 2023 14:55:49 +0800
-Subject: [PATCH 10/16] hostapd: mtk: Add DFS detection mode
+Subject: [PATCH 10/24] hostapd: mtk: Add DFS detection mode
 
 Add DFS detection mode for testing radar detection rate.
 If DFS detection mode is on, AP will not switch channels when receiving
@@ -17,7 +17,7 @@
  4 files changed, 50 insertions(+)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 63c9d40..cd15349 100644
+index 579193f..8a61726 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4803,6 +4803,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -32,7 +32,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index c881d37..0b4c234 100644
+index 5590100..fcbc4ae 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3522,6 +3522,26 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
@@ -73,7 +73,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a9e3d2a..77f6169 100644
+index be30b51..d3a9fb0 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1160,6 +1160,7 @@ struct hostapd_config {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch
index 1d8baf8..4246599 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch
@@ -1,7 +1,7 @@
-From 88dd3df28e3736af4cca0daf4f7d19ab888ea6c4 Mon Sep 17 00:00:00 2001
+From 7027df47dfc72e52763c90ecce524606e61a5384 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 20 Feb 2023 14:56:55 +0800
-Subject: [PATCH 11/16] hostapd: mtk: Add DFS offchan channel switch
+Subject: [PATCH 11/24] hostapd: mtk: Add DFS offchan channel switch
 
 Add DFS background chain channel switch command for testing purpose.
 This feature is implemented via hostapd_cli command.
@@ -16,7 +16,7 @@
  3 files changed, 96 insertions(+), 16 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 0b4c234..6ea1573 100644
+index fcbc4ae..37a1b2a 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3542,6 +3542,76 @@ hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
index 7db3ae2..01346dc 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
@@ -1,7 +1,7 @@
-From d0128fc60d38ce4f20f8368bdc5ea9ed19a329b7 Mon Sep 17 00:00:00 2001
+From 1e8a42f893d138b7ca29d4758d1528545e88d657 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 16 Dec 2022 03:57:11 +0800
-Subject: [PATCH 12/16] hostapd: mtk: Add amsdu set get ctrl
+Subject: [PATCH 12/24] hostapd: mtk: Add amsdu set get ctrl
 
 ---
  hostapd/config_file.c             |   9 +++
@@ -20,7 +20,7 @@
  13 files changed, 207 insertions(+), 1 deletion(-)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index cd15349..10ea525 100644
+index 8a61726..017c21e 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4807,6 +4807,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -40,7 +40,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 6ea1573..0ad8451 100644
+index 37a1b2a..61c9e80 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3612,6 +3612,30 @@ hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
@@ -84,7 +84,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index c2a123a..30b3392 100644
+index 1f7013e..0da18e2 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -1593,6 +1593,13 @@ static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
@@ -111,7 +111,7 @@
  };
  
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 7a96cb8..85ad5e4 100644
+index df90814..24fc0f5 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -299,6 +299,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -123,7 +123,7 @@
  	return conf;
  }
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 77f6169..a9ac396 100644
+index d3a9fb0..ce0d84c 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1161,6 +1161,7 @@ struct hostapd_config {
@@ -135,7 +135,7 @@
  
  enum three_wire_mode {
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 60ae825..1a82f23 100644
+index bec9798..342a7a8 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1077,4 +1077,18 @@ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
@@ -159,7 +159,7 @@
  }
 \ No newline at end of file
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index ab9aedc..4406666 100644
+index 30b0322..79fef71 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -147,6 +147,8 @@ int hostapd_drv_mu_dump(struct hostapd_data *hapd, u8 *mu_onoff);
@@ -172,7 +172,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index da7f7d8..a18e744 100644
+index e83298e..42e8ed7 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
 @@ -2308,6 +2308,8 @@ dfs_offload:
@@ -185,7 +185,7 @@
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 4050cf8..0999ea9 100644
+index 7b7aeaa..97c5a47 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -167,7 +167,6 @@ enum mtk_vendor_attr_wireless_ctrl {
@@ -220,7 +220,7 @@
  	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
  
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 71ded61..265d86d 100644
+index 913a194..3e034d7 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -4720,6 +4720,15 @@ struct wpa_driver_ops {
@@ -240,7 +240,7 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 5c2a291..d91b29c 100644
+index ff257eb..6c65901 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -12776,6 +12776,118 @@ fail:
@@ -370,7 +370,7 @@
 +	.amsdu_dump = nl80211_dump_amsdu,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 607592c..e570224 100644
+index 92e5ad6..21d48cc 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -185,6 +185,7 @@ struct wpa_driver_nl80211_data {
@@ -382,7 +382,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 9ecc0ff..fcfa68b 100644
+index 83b4c5e..06a52db 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -1065,6 +1065,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
index 4df0ba6..a35ed64 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
@@ -1,7 +1,7 @@
-From ebbf23ac8c19224b34523e8b9820e32f0789fe11 Mon Sep 17 00:00:00 2001
+From a8f35d893f1f3a9688b2dd52b68a9784e2778201 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 12 Jan 2023 15:18:19 +0800
-Subject: [PATCH 13/16] hostapd: mtk: Add he_ldpc configuration
+Subject: [PATCH 13/24] hostapd: mtk: Add he_ldpc configuration
 
 ---
  hostapd/config_file.c        | 2 ++
@@ -13,7 +13,7 @@
  6 files changed, 19 insertions(+)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 10ea525..4237a5c 100644
+index 017c21e..649618b 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -3508,6 +3508,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -42,7 +42,7 @@
  #he_bss_color=1
  
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 85ad5e4..b283de6 100644
+index 24fc0f5..4e46a62 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -268,6 +268,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -54,7 +54,7 @@
  		HE_OPERATION_RTS_THRESHOLD_OFFSET;
  	/* Set default basic MCS/NSS set to single stream MCS 0-7 */
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a9ac396..b8b20a7 100644
+index ce0d84c..7aeb176 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -929,6 +929,7 @@ struct hostapd_bss_config {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
index f0d25c6..0bd08ef 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
@@ -1,7 +1,7 @@
-From bb5cb086162828392a04820063ad7997d8ae26d7 Mon Sep 17 00:00:00 2001
+From 8d6637b3e04d1d3a41d739a7e824e11f39a05fca Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 17 Jan 2023 13:25:18 +0800
-Subject: [PATCH 14/16] hostapd: mtk: Add the broadcast destination address of
+Subject: [PATCH 14/24] hostapd: mtk: Add the broadcast destination address of
  Probe Response frame on 6 GHz
 
 According to IEEE 802.11ax 26.17.2.3.2,
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
index 5fcd0c5..bbd0743 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
@@ -1,7 +1,7 @@
-From 1db373190399a907b27141c199841aeafd4643da Mon Sep 17 00:00:00 2001
+From 60b1edabde3e0f9e3e09cc4b9646e146c0c3e92a Mon Sep 17 00:00:00 2001
 From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
 Date: Tue, 24 Jan 2023 19:06:44 +0800
-Subject: [PATCH 15/16] hostapd: mtk: Add vendor command attribute for RTS BW
+Subject: [PATCH 15/24] hostapd: mtk: Add vendor command attribute for RTS BW
  signaling.
 
 Signed-off-by: himanshu.goyal <himanshu.goyal@mediatek.com>
@@ -10,7 +10,7 @@
  1 file changed, 1 insertion(+)
 
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 0999ea9..fb12895 100644
+index 97c5a47..62d79cb 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -169,6 +169,7 @@ enum mtk_vendor_attr_wireless_ctrl {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
index 33fea78..63b0bae 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
@@ -1,7 +1,7 @@
-From efa1d271d28c84b8ca77ffc3ca7cb75e727088a0 Mon Sep 17 00:00:00 2001
+From 4cf61c8d0aa99d1e15afafe6c9f0eab24814f615 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 13 Feb 2023 11:03:53 +0800
-Subject: [PATCH 16/16] hostapd: mtk: 6G band does not require DFS
+Subject: [PATCH 16/24] hostapd: mtk: 6G band does not require DFS
 
 ---
  src/ap/dfs.c | 1 +
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch
index 265c37a..0e2327b 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch
@@ -1,8 +1,8 @@
-From f6bfd9a4a6c0d08e0dec9311873c9e863a07c9a8 Mon Sep 17 00:00:00 2001
+From c0b5c3ba905d10495f1f035fd93bbdd5295d60ea Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 20 Feb 2023 11:01:18 +0800
-Subject: [PATCH] hostapd: mtk: Fix sending wrong VHT operation IE in CSA while
- using ZWDFS
+Subject: [PATCH 17/24] hostapd: mtk: Fix sending wrong VHT operation IE in CSA
+ while using ZWDFS
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch
index db3c813..027aab4 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch
@@ -1,7 +1,7 @@
-From 3337e7b4f75a66e53e1320e49deba2b58a8a80b0 Mon Sep 17 00:00:00 2001
+From a96e3398373b64bca5e33c8eb1a6d289bb07837b Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 20 Feb 2023 10:51:47 +0800
-Subject: [PATCH 18/19] hostapd: mtk: Add sta-assisted DFS state update
+Subject: [PATCH 18/24] hostapd: mtk: Add sta-assisted DFS state update
  mechanism
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -119,7 +119,7 @@
  #define AP_CSA_FINISHED "AP-CSA-FINISHED "
  
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 265d86d..b5de0e6 100644
+index 3e034d7..82daef0 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -5317,6 +5317,20 @@ enum wpa_event_type {
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch
index 8340fd9..a29ec33 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch
@@ -1,7 +1,8 @@
-From 83ab1a9cc51225095842d3c62bf75cf4efe63075 Mon Sep 17 00:00:00 2001
+From 61b475daa5dbf9802932657943d1322cb5c8f5b3 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 20 Feb 2023 16:58:20 +0800
-Subject: [PATCH] hostapd: mtk: Fix auto ht issue when switching to DFS channel
+Subject: [PATCH 19/24] hostapd: mtk: Fix auto ht issue when switching to DFS
+ channel
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -9,7 +10,7 @@
  1 file changed, 6 insertions(+), 6 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 0ad8451..407790f 100644
+index 61c9e80..c33b7a4 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -2698,6 +2698,12 @@ static int hostapd_ctrl_iface_chan_switch(struct hostapd_iface *iface,
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0020-hostapd-mtk-Mark-DFS-channel-as-available-for-CSA.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0020-hostapd-mtk-Mark-DFS-channel-as-available-for-CSA.patch
index 1fe5c88..6e9e315 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0020-hostapd-mtk-Mark-DFS-channel-as-available-for-CSA.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0020-hostapd-mtk-Mark-DFS-channel-as-available-for-CSA.patch
@@ -1,7 +1,7 @@
-From 3e9500a42a41e8cd7c2d7bc20aba96e1e17161fb Mon Sep 17 00:00:00 2001
+From 4cfadfd4c22232fc973e81a70039324b3db383ab Mon Sep 17 00:00:00 2001
 From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
 Date: Fri, 3 Mar 2023 12:45:42 +0800
-Subject: [PATCH] hostapd: mtk: Mark DFS channel as available for CSA.
+Subject: [PATCH 20/24] hostapd: mtk: Mark DFS channel as available for CSA.
 
 ---
  hostapd/ctrl_iface.c   | 10 ++++++++++
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support-for-hostapd.patch
similarity index 99%
rename from recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support.patch
rename to recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support-for-hostapd.patch
index 8d59a0f..a9e802d 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support-for-hostapd.patch
@@ -1,7 +1,7 @@
-From 8cbdb9a59e3bbe8804f909b13ce6df6e2777c3da Mon Sep 17 00:00:00 2001
+From 832350b2c16a9ad2f65c32d32584e7cdb06b074a Mon Sep 17 00:00:00 2001
 From: mtk20656 <chank.chen@mediatek.com>
 Date: Thu, 2 Mar 2023 10:51:43 +0800
-Subject: [PATCH] hostapd: mtk: add 11v_mbss and ema support for hostapd
+Subject: [PATCH 21/24] hostapd: mtk: add 11v_mbss and ema support for hostapd
 
 Signed-off-by: mtk20656 <chank.chen@mediatek.com>
 ---
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0022-hostapd-mtk-Add-available-color-bitmap.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0022-hostapd-mtk-Add-available-color-bitmap.patch
index 9bbbf87..a0065f3 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0022-hostapd-mtk-Add-available-color-bitmap.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0022-hostapd-mtk-Add-available-color-bitmap.patch
@@ -1,7 +1,7 @@
-From e7790a1bceca6b7612f29b00c429cf23f5dd9e3a Mon Sep 17 00:00:00 2001
+From 46c88d8e3c513c04891913c77de179de9e7f36cd Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Thu, 26 Jan 2023 09:16:00 +0800
-Subject: [PATCH] hostapd: mtk: Add available color bitmap
+Subject: [PATCH 22/24] hostapd: mtk: Add available color bitmap
 
 Signed-off-by: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 ---
@@ -17,10 +17,10 @@
  9 files changed, 192 insertions(+), 1 deletion(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 0ad8451..b0d5ded 100644
+index 9ba6992..e1e9270 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -3635,6 +3635,76 @@ hostapd_ctrl_iface_get_amsdu(struct hostapd_data *hapd, char *buf,
+@@ -3645,6 +3645,76 @@ hostapd_ctrl_iface_get_amsdu(struct hostapd_data *hapd, char *buf,
  	return ret;
  }
  
@@ -97,7 +97,7 @@
  
  static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
  					      char *buf, char *reply,
-@@ -4202,6 +4272,10 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+@@ -4212,6 +4282,10 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
  		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
  	} else if (os_strncmp(buf, "GET_AMSDU", 9) == 0) {
  		reply_len = hostapd_ctrl_iface_get_amsdu(hapd, reply, reply_size);
@@ -109,7 +109,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index 30b3392..b6cf52e 100644
+index 6231e51..aad7aa5 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -1578,6 +1578,20 @@ static int hostapd_cli_cmd_reload_wpa_psk(struct wpa_ctrl *ctrl, int argc,
@@ -145,7 +145,7 @@
  	{ "driver", hostapd_cli_cmd_driver, NULL,
  	  "<driver sub command> [<hex formatted data>] = send driver command data" },
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 1a82f23..decffdd 100644
+index 342a7a8..40b9a20 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1091,4 +1091,12 @@ int hostapd_drv_amsdu_dump(struct hostapd_data *hapd, u8 *amsdu)
@@ -164,7 +164,7 @@
 +	return hapd->driver->get_aval_color_bmp(hapd->drv_priv, aval_color_bmp);
 +}
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index 4406666..61c1360 100644
+index 79fef71..136a3ac 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -149,6 +149,8 @@ int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd);
@@ -177,7 +177,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 0999ea9..f2afb2e 100644
+index 62d79cb..a99e6f2 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -15,6 +15,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -188,7 +188,7 @@
  };
  
  enum mtk_vendor_attr_edcca_ctrl {
-@@ -252,6 +253,16 @@ ibf_dump_policy[NUM_MTK_VENDOR_ATTRS_IBF_DUMP] = {
+@@ -253,6 +254,16 @@ ibf_dump_policy[NUM_MTK_VENDOR_ATTRS_IBF_DUMP] = {
  	[MTK_VENDOR_ATTR_IBF_DUMP_ENABLE] = { .type = NLA_U8 },
  };
  
@@ -206,10 +206,10 @@
  #define CSI_MAX_COUNT 256
  #define ETH_ALEN 6
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index b07aaf3..266c630 100644
+index 36f465c..7f6392f 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -4736,6 +4736,14 @@ struct wpa_driver_ops {
+@@ -4771,6 +4771,14 @@ struct wpa_driver_ops {
  	 */
  	int (*amsdu_ctrl)(void *priv, u8 amsdu);
  	int (*amsdu_dump)(void *priv, u8 *amsdu);
@@ -225,10 +225,10 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 6702384..c8771f7 100644
+index 3753409..f9a8763 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -12433,6 +12433,71 @@ static int nl80211_dpp_listen(void *priv, bool enable)
+@@ -12485,6 +12485,71 @@ static int nl80211_dpp_listen(void *priv, bool enable)
  }
  #endif /* CONFIG_DPP */
  
@@ -300,14 +300,14 @@
  
  #ifdef CONFIG_TESTING_OPTIONS
  
-@@ -13073,4 +13138,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.start_disabled = nl80211_start_disabled,
+@@ -13096,4 +13161,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.ibf_dump = nl80211_ibf_dump,
  	.amsdu_ctrl = nl80211_enable_amsdu,
  	.amsdu_dump = nl80211_dump_amsdu,
 +	.get_aval_color_bmp = nl80211_get_aval_color_bmp,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index e570224..b90c8fa 100644
+index 21d48cc..72c7abd 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -186,6 +186,7 @@ struct wpa_driver_nl80211_data {
@@ -319,10 +319,10 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index fcfa68b..c3c7b41 100644
+index d8078bc..e7c6f39 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
-@@ -1068,6 +1068,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+@@ -1092,6 +1092,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
  				case MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL:
  					drv->mtk_wireless_vendor_cmd_avail = 1;
  					break;
@@ -333,5 +333,5 @@
  			}
  
 -- 
-2.39.0
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0023-hostapd-mtk-Add-channel-information-for-hostapd-relo.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0023-hostapd-mtk-Add-channel-information-for-hostapd-relo.patch
new file mode 100644
index 0000000..b03656e
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0023-hostapd-mtk-Add-channel-information-for-hostapd-relo.patch
@@ -0,0 +1,79 @@
+From 6435612049c0a21a30ea835a31d07b6c14b3b248 Mon Sep 17 00:00:00 2001
+From: Michael Lee <michael-cy.lee@mediatek.com>
+Date: Wed, 22 Mar 2023 13:59:29 +0800
+Subject: [PATCH 23/24] hostapd: mtk: Add channel information for hostapd
+ reload
+
+Add center channel, operating class, and bandwidth into the UPDATE
+command when wpa_supplciant reloads hostapd.
+Hostapd can correctly update its channel information.
+
+Signed-off-by: Michael Lee <michael-cy.lee@mediatek.com>
+---
+ hostapd/ctrl_iface.c            | 11 +++++++++++
+ wpa_supplicant/wpa_supplicant.c | 17 ++++++++++++++---
+ 2 files changed, 25 insertions(+), 3 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index e1e9270..4c5d494 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -170,6 +170,17 @@ static struct hostapd_config *hostapd_ctrl_iface_config_read(const char *fname)
+ 			conf->hw_mode = atoi(val);
+ 		else if ((val = get_option(opt, "ieee80211n=")))
+ 			conf->ieee80211n = atoi(val);
++		else if ((val = get_option(opt, "center_segment0=")))
++			hostapd_set_oper_centr_freq_seg0_idx(conf, atoi(val));
++		else if ((val = get_option(opt, "center_segment1=")))
++			hostapd_set_oper_centr_freq_seg1_idx(conf, atoi(val));
++		else if ((val = get_option(opt, "op_class="))) {
++			enum oper_chan_width ch_width;
++
++			conf->op_class = atoi(val);
++			ch_width = op_class_to_ch_width(conf->op_class);
++			hostapd_set_oper_chwidth(conf, ch_width);
++		}
+ 		else
+ 			break;
+ 	}
+diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
+index 270da46..4930f7a 100644
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -150,9 +150,10 @@ static int hostapd_reload(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
+ 	char buf[256];
+ 	size_t len = sizeof(buf);
+ 	enum hostapd_hw_mode hw_mode;
+-	u8 channel;
++	u8 channel, center_segment0, center_segment1, op_class;
+ 	int sec_chan = 0;
+ 	int ret;
++	struct wpa_channel_info ci;
+ 
+ 	if (!bss)
+ 		return -1;
+@@ -165,9 +166,19 @@ static int hostapd_reload(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
+ 			sec_chan = -1;
+ 	}
+ 
++	ret = wpa_drv_channel_info(wpa_s, &ci);
++	if (ret)
++		return -1;
++
++	ieee80211_freq_to_chan(ci.center_frq1, &center_segment0);
++	ieee80211_freq_to_chan(ci.center_frq2, &center_segment1);
++	ieee80211_chaninfo_to_channel(ci.frequency, ci.chanwidth, sec_chan,
++				      &op_class, &channel);
+ 	hw_mode = ieee80211_freq_to_chan(bss->freq, &channel);
+-	if (asprintf(&cmd, "UPDATE channel=%d sec_chan=%d hw_mode=%d",
+-		     channel, sec_chan, hw_mode) < 0)
++	if (asprintf(&cmd, "UPDATE channel=%d center_segment0=%d "
++		     "center_segment1=%d sec_chan=%d hw_mode=%d op_class=%d",
++		     channel, center_segment0, center_segment1, sec_chan,
++		     hw_mode, op_class) < 0)
+ 		return -1;
+ 
+ 	ret = wpa_ctrl_request(wpa_s->hostapd, cmd, os_strlen(cmd), buf, &len, NULL);
+-- 
+2.18.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0024-hostapd-mtk-Fix-ZWDFS-issue-in-BW-160.patch b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0024-hostapd-mtk-Fix-ZWDFS-issue-in-BW-160.patch
new file mode 100644
index 0000000..e914686
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/mtk-0024-hostapd-mtk-Fix-ZWDFS-issue-in-BW-160.patch
@@ -0,0 +1,210 @@
+From 3a119f804f87e8535908c772d3c7251bc6bfa524 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Mar 2023 16:08:30 +0800
+Subject: [PATCH 24/24] hostapd: mtk: Fix ZWDFS issue in BW 160
+
+When background radar is enabled and bandwidth is set to 160, AP will
+fail to startup due to the lack of non-DFS channel.
+Under this circumstance, AP should perform CAC itself, and the background
+chain could also perform CAC simultaneously.
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ src/ap/dfs.c | 98 ++++++++++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 79 insertions(+), 19 deletions(-)
+
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index d082fe0..d688ecb 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -69,15 +69,22 @@ static int dfs_get_used_n_chans(struct hostapd_iface *iface, int *seg1)
+ static int dfs_channel_available(struct hostapd_channel_data *chan,
+ 				 enum dfs_channel_type type)
+ {
++	int dfs_status = chan->flag & HOSTAPD_CHAN_DFS_MASK;
++
++	if (chan->flag & HOSTAPD_CHAN_DISABLED)
++		return -1;
++
+ 	if (type == DFS_NO_CAC_YET) {
+ 		/* Select only radar channel where CAC has not been
+ 		 * performed yet
+ 		 */
+-		if ((chan->flag & HOSTAPD_CHAN_RADAR) &&
+-		    (chan->flag & HOSTAPD_CHAN_DFS_MASK) ==
+-		     HOSTAPD_CHAN_DFS_USABLE)
++		if (!(chan->flag & HOSTAPD_CHAN_RADAR))
++			return 0;
++
++		if (dfs_status == HOSTAPD_CHAN_DFS_USABLE)
+ 			return 1;
+-		return 0;
++
++		return -1;
+ 	}
+ 
+ 	/*
+@@ -86,16 +93,14 @@ static int dfs_channel_available(struct hostapd_channel_data *chan,
+ 	 * channel for CSA, unless they are available for immediate use.
+ 	 */
+ 	if (type == DFS_AVAILABLE && (chan->flag & HOSTAPD_CHAN_RADAR) &&
+-	    ((chan->flag & HOSTAPD_CHAN_DFS_MASK) !=
+-	     HOSTAPD_CHAN_DFS_AVAILABLE))
+-		return 0;
++	    (dfs_status != HOSTAPD_CHAN_DFS_AVAILABLE))
++		return -1;
+ 
+-	if (chan->flag & HOSTAPD_CHAN_DISABLED)
+-		return 0;
+ 	if ((chan->flag & HOSTAPD_CHAN_RADAR) &&
+-	    ((chan->flag & HOSTAPD_CHAN_DFS_MASK) ==
+-	     HOSTAPD_CHAN_DFS_UNAVAILABLE))
+-		return 0;
++	    ((dfs_status == HOSTAPD_CHAN_DFS_UNAVAILABLE) ||
++	    (dfs_status == HOSTAPD_CHAN_DFS_UNKNOWN)))
++		return -1;
++
+ 	return 1;
+ }
+ 
+@@ -167,7 +172,7 @@ static int dfs_chan_range_available(struct hostapd_hw_modes *mode,
+ 				    enum dfs_channel_type type)
+ {
+ 	struct hostapd_channel_data *first_chan, *chan;
+-	int i;
++	int i, available = 0, ret = 0;
+ 	u32 bw = num_chan_to_bw(num_chans);
+ 
+ 	if (first_chan_idx + num_chans > mode->num_channels) {
+@@ -203,14 +208,17 @@ static int dfs_chan_range_available(struct hostapd_hw_modes *mode,
+ 			return 0;
+ 		}
+ 
+-		if (!dfs_channel_available(chan, type)) {
++		ret = dfs_channel_available(chan, type);
++		if (ret < 0) {
+ 			wpa_printf(MSG_DEBUG, "DFS: channel not available %d",
+ 				   first_chan->freq + i * 20);
+ 			return 0;
+ 		}
++
++		available |= ret;
+ 	}
+ 
+-	return 1;
++	return available;
+ }
+ 
+ 
+@@ -826,8 +834,12 @@ static unsigned int dfs_get_cac_time(struct hostapd_iface *iface,
+  */
+ int hostapd_handle_dfs(struct hostapd_iface *iface)
+ {
++	struct hostapd_channel_data *channel;
+ 	int res, n_chans, n_chans1, start_chan_idx, start_chan_idx1;
+-	int skip_radar = 0;
++	int sec = 0, skip_radar = 0;
++	u8 cf1 = 0, cf2 = 0;
++	bool use_radar_background = dfs_use_radar_background(iface);
++	enum dfs_channel_type channel_type = DFS_NO_CAC_YET;
+ 
+ 	if (is_6ghz_freq(iface->freq))
+ 		return 1;
+@@ -890,7 +902,7 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
+ 	/* Finally start CAC */
+ 	hostapd_set_state(iface, HAPD_IFACE_DFS);
+ 	wpa_printf(MSG_DEBUG, "DFS start CAC on %d MHz%s", iface->freq,
+-		   dfs_use_radar_background(iface) ? " (background)" : "");
++		   use_radar_background ? " (background)" : "");
+ 	wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_CAC_START
+ 		"freq=%d chan=%d sec_chan=%d, width=%d, seg0=%d, seg1=%d, cac_time=%ds",
+ 		iface->freq,
+@@ -900,6 +912,16 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
+ 		hostapd_get_oper_centr_freq_seg1_idx(iface->conf),
+ 		iface->dfs_cac_ms / 1000);
+ 
++	if (use_radar_background) {
++		channel = dfs_get_valid_channel(iface, &sec, &cf1, &cf2, DFS_AVAILABLE);
++		/*
++		 * AP cannot get any random available channel.
++		 * Let AP and dedicated radar chain both perform CAC.
++		 */
++		if (!channel)
++			use_radar_background = false;
++	}
++
+ 	res = hostapd_start_dfs_cac(
+ 		iface, iface->conf->hw_mode, iface->freq, iface->conf->channel,
+ 		iface->conf->ieee80211n, iface->conf->ieee80211ac,
+@@ -908,14 +930,14 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
+ 		hostapd_get_oper_chwidth(iface->conf),
+ 		hostapd_get_oper_centr_freq_seg0_idx(iface->conf),
+ 		hostapd_get_oper_centr_freq_seg1_idx(iface->conf),
+-		dfs_use_radar_background(iface));
++		use_radar_background);
+ 
+ 	if (res) {
+ 		wpa_printf(MSG_ERROR, "DFS start_dfs_cac() failed, %d", res);
+ 		return -1;
+ 	}
+ 
+-	if (dfs_use_radar_background(iface)) {
++	if (use_radar_background) {
+ 		/* Cache background radar parameters. */
+ 		iface->radar_background.channel = iface->conf->channel;
+ 		iface->radar_background.secondary_channel =
+@@ -936,6 +958,35 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
+ 
+ 		iface->radar_background.temp_ch = 1;
+ 		return 1;
++	} else if (dfs_use_radar_background(iface)) {
++		if (iface->dfs_domain == HOSTAPD_DFS_REGION_ETSI)
++			channel_type = DFS_ANY_CHANNEL;
++
++		channel = dfs_get_valid_channel(iface, &sec, &cf1, &cf2, channel_type);
++
++		if (!channel ||
++		    (channel->chan == iface->conf->channel &&
++		    cf1 == hostapd_get_oper_centr_freq_seg0_idx(iface->conf) &&
++		    cf2 == hostapd_get_oper_centr_freq_seg1_idx(iface->conf))) {
++			wpa_printf(MSG_ERROR, "Background radar could not get valid channel\n");
++			iface->radar_background.channel = -1;
++			return 0;
++		}
++
++		hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
++				      channel->freq, channel->chan,
++				      iface->conf->ieee80211n,
++				      iface->conf->ieee80211ac,
++				      iface->conf->ieee80211ax,
++				      iface->conf->ieee80211be,
++				      sec, hostapd_get_oper_chwidth(iface->conf),
++				      cf1, cf2, true);
++
++		iface->radar_background.channel = channel->chan;
++		iface->radar_background.freq = channel->freq;
++		iface->radar_background.secondary_channel = sec;
++		iface->radar_background.centr_freq_seg0_idx = cf1;
++		iface->radar_background.centr_freq_seg1_idx = cf2;
+ 	}
+ 
+ 	return 0;
+@@ -1185,6 +1236,15 @@ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
+ 				hostapd_setup_interface_complete(iface, 0);
+ 				iface->cac_started = 0;
+ 			}
++
++			/*
++			 * When background radar is enabled but the CAC completion
++			 * is not received from the background chain.
++			 * Then, reset radar background chain.
++			 */
++			if (dfs_use_radar_background(iface) &&
++			    iface->radar_background.channel == -1)
++				hostpad_dfs_update_background_chain(iface);
+ 		}
+ 	} else if (hostapd_dfs_is_background_event(iface, freq)) {
+ 		iface->radar_background.cac_started = 0;
+-- 
+2.18.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
index 283b55c..1265b34 100644
--- a/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
+++ b/recipes-wifi/wpa-supplicant/files/patches-2.10.3/patches.inc
@@ -82,7 +82,9 @@
     file://mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch \
     file://mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch \
     file://mtk-0020-hostapd-mtk-Mark-DFS-channel-as-available-for-CSA.patch \
-    file://mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support.patch \
+    file://mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support-for-hostapd.patch \
     file://mtk-0022-hostapd-mtk-Add-available-color-bitmap.patch \
+    file://mtk-0023-hostapd-mtk-Add-channel-information-for-hostapd-relo.patch \
+    file://mtk-0024-hostapd-mtk-Fix-ZWDFS-issue-in-BW-160.patch \
     file://mtk-0100-hostapd-mtk-update-eht-operation-elem.patch \
     "
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0001-hostapd-mtk-Add-neighbor-report-and-BSS-Termination-.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0001-hostapd-mtk-Add-neighbor-report-and-BSS-Termination-.patch
index fb7c63f..0c0e3c6 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0001-hostapd-mtk-Add-neighbor-report-and-BSS-Termination-.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0001-hostapd-mtk-Add-neighbor-report-and-BSS-Termination-.patch
@@ -1,7 +1,7 @@
-From cd52509a69c3ba34d9b4146664140fd1ff712aa9 Mon Sep 17 00:00:00 2001
+From d76ef3ce86c91a33baa763014c8a991faa4fae4a Mon Sep 17 00:00:00 2001
 From: "howard.hsu" <howard-yh.hsu@mediatek.com>
 Date: Wed, 19 Jan 2022 19:18:07 +0800
-Subject: [PATCH 01/15] hostapd: mtk: Add neighbor report and BSS Termination
+Subject: [PATCH 01/24] hostapd: mtk: Add neighbor report and BSS Termination
  for MBO certification
 
 1. Add hostapd_neighbor_count() and hostapd_neighbor_insert_buffer ()
@@ -32,7 +32,7 @@
  9 files changed, 252 insertions(+), 5 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index a2584920c..c2a282227 100644
+index a258492..c2a2822 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -1338,6 +1338,11 @@ static int hostapd_ctrl_iface_set(struct hostapd_data *hapd, char *cmd)
@@ -48,7 +48,7 @@
  		ret = hostapd_set_iface(hapd->iconf, hapd->conf, cmd, value);
  		if (ret)
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index d7a0c7c80..4a20eb4e1 100644
+index d7a0c7c..4a20eb4 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -170,6 +170,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
@@ -60,7 +60,7 @@
  
  
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 39b26d602..a87563265 100644
+index 39b26d6..a875632 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -558,6 +558,7 @@ struct hostapd_bss_config {
@@ -72,7 +72,7 @@
  	/* IEEE 802.11u - Interworking */
  	int interworking;
 diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
-index 96209ce7e..18bae5c8b 100644
+index 96209ce..18bae5c 100644
 --- a/src/ap/ctrl_iface_ap.c
 +++ b/src/ap/ctrl_iface_ap.c
 @@ -1203,6 +1203,10 @@ int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
@@ -115,7 +115,7 @@
  	if (pos) {
  		unsigned int mbo_reason, cell_pref, reassoc_delay;
 diff --git a/src/ap/gas_serv.c b/src/ap/gas_serv.c
-index 90f15778b..5845ff857 100644
+index 90f1577..5845ff8 100644
 --- a/src/ap/gas_serv.c
 +++ b/src/ap/gas_serv.c
 @@ -19,6 +19,7 @@
@@ -183,7 +183,7 @@
  #ifdef CONFIG_FILS
  		if (info_id == ANQP_FILS_REALM_INFO &&
 diff --git a/src/ap/gas_serv.h b/src/ap/gas_serv.h
-index 1528af4af..d0241f23c 100644
+index 1528af4..d0241f2 100644
 --- a/src/ap/gas_serv.h
 +++ b/src/ap/gas_serv.h
 @@ -40,6 +40,8 @@
@@ -196,7 +196,7 @@
   * First 15 Hotspot 2.0 vendor specific ANQP-elements can be included in the
   * optimized bitmap.
 diff --git a/src/ap/neighbor_db.c b/src/ap/neighbor_db.c
-index 52f25eb7a..9254d09fd 100644
+index 52f25eb..9254d09 100644
 --- a/src/ap/neighbor_db.c
 +++ b/src/ap/neighbor_db.c
 @@ -89,6 +89,38 @@ int hostapd_neighbor_show(struct hostapd_data *hapd, char *buf, size_t buflen)
@@ -330,7 +330,7 @@
 +}
 +#endif
 diff --git a/src/ap/neighbor_db.h b/src/ap/neighbor_db.h
-index 992671b62..a1ddc075b 100644
+index 992671b..a1ddc07 100644
 --- a/src/ap/neighbor_db.h
 +++ b/src/ap/neighbor_db.h
 @@ -24,4 +24,13 @@ int hostapd_neighbor_remove(struct hostapd_data *hapd, const u8 *bssid,
@@ -348,7 +348,7 @@
 +#endif
  #endif /* NEIGHBOR_DB_H */
 diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
-index 3ea92af2d..4349e1df2 100644
+index 3ea92af..4349e1d 100644
 --- a/src/ap/wnm_ap.c
 +++ b/src/ap/wnm_ap.c
 @@ -20,6 +20,7 @@
@@ -471,5 +471,5 @@
  
  	return 0;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0002-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0002-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
index 3f20768..df95c34 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0002-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0002-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
@@ -1,14 +1,14 @@
-From 2a08e4acbe0ff6f6af42df8262178cf153c8868d Mon Sep 17 00:00:00 2001
+From d4795ed4b051c4d9d9ee130a353bbe629f2f230a Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 20 Sep 2022 19:33:45 +0800
-Subject: [PATCH 02/15] hostapd: mtk: print sae groups by hostapd ctrl
+Subject: [PATCH 02/24] hostapd: mtk: print sae groups by hostapd ctrl
 
 ---
  hostapd/ctrl_iface.c | 13 +++++++++++++
  1 file changed, 13 insertions(+)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index c2a282227..bc690c526 100644
+index c2a2822..bc690c5 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -1412,6 +1412,19 @@ static int hostapd_ctrl_iface_get(struct hostapd_data *hapd, char *cmd,
@@ -32,5 +32,5 @@
  
  	return -1;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0003-hostapd-mtk-add-support-for-runtime-set-in-band-disc.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0003-hostapd-mtk-add-support-for-runtime-set-in-band-disc.patch
index 18d5970..686d6e8 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0003-hostapd-mtk-add-support-for-runtime-set-in-band-disc.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0003-hostapd-mtk-add-support-for-runtime-set-in-band-disc.patch
@@ -1,7 +1,7 @@
-From b2253861a02b5ae8074f36e0a417e05a207891b9 Mon Sep 17 00:00:00 2001
+From 7f31f81b12c13bd0748c2c2149da3319d4b7572a Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 31 May 2022 21:15:54 +0800
-Subject: [PATCH 03/15] hostapd: mtk: add support for runtime set in-band
+Subject: [PATCH 03/24] hostapd: mtk: add support for runtime set in-band
  discovery
 
 Usage:
@@ -21,7 +21,7 @@
  5 files changed, 98 insertions(+), 4 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index bc690c526..bb8c74fd3 100644
+index bc690c5..bb8c74f 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -826,6 +826,69 @@ static int hostapd_ctrl_iface_send_qos_map_conf(struct hostapd_data *hapd,
@@ -105,7 +105,7 @@
  		reply_len = hostapd_ctrl_iface_get_config(hapd, reply,
  							  reply_size);
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index 85c41d0c3..db2125805 100644
+index 85c41d0..db21258 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -642,6 +642,24 @@ static int hostapd_cli_cmd_wps_config(struct wpa_ctrl *ctrl, int argc,
@@ -143,7 +143,7 @@
  };
  
 diff --git a/src/ap/beacon.c b/src/ap/beacon.c
-index 814e86efe..1a26f11ff 100644
+index 814e86e..1a26f11 100644
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
 @@ -1497,6 +1497,8 @@ static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
@@ -166,7 +166,7 @@
  						  &params->fd_frame_tmpl_len);
  
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 1fa7dd8e0..c695263bf 100644
+index 1fa7dd8..c695263 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -4498,9 +4498,10 @@ static int nl80211_fils_discovery(struct i802_bss *bss, struct nl_msg *msg,
@@ -195,7 +195,7 @@
  #endif /* CONFIG_FILS */
  
 diff --git a/src/drivers/nl80211_copy.h b/src/drivers/nl80211_copy.h
-index 0568a7909..c4bf3ad35 100644
+index 0568a79..c4bf3ad 100644
 --- a/src/drivers/nl80211_copy.h
 +++ b/src/drivers/nl80211_copy.h
 @@ -7379,6 +7379,7 @@ enum nl80211_fils_discovery_attributes {
@@ -207,5 +207,5 @@
  	/* keep last */
  	__NL80211_FILS_DISCOVERY_ATTR_LAST,
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0004-hostapd-mtk-Add-mtk_vendor.h.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0004-hostapd-mtk-Add-mtk_vendor.h.patch
index 5b1a853..1f5d0cb 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0004-hostapd-mtk-Add-mtk_vendor.h.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0004-hostapd-mtk-Add-mtk_vendor.h.patch
@@ -1,7 +1,7 @@
-From 514ffcc16d420fade1b28478cd785e7709878bc7 Mon Sep 17 00:00:00 2001
+From c52b9a7ad6817c8d7efbf0525cceb007e8bda9a8 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 30 May 2022 15:04:57 +0800
-Subject: [PATCH 04/15] hostapd: mtk: Add mtk_vendor.h
+Subject: [PATCH 04/24] hostapd: mtk: Add mtk_vendor.h
 
 ---
  src/common/mtk_vendor.h | 195 ++++++++++++++++++++++++++++++++++++++++
@@ -10,7 +10,7 @@
 
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
 new file mode 100644
-index 000000000..528387fa5
+index 0000000..528387f
 --- /dev/null
 +++ b/src/common/mtk_vendor.h
 @@ -0,0 +1,195 @@
@@ -210,5 +210,5 @@
 +};
 +#endif /* MTK_VENDOR_H */
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0005-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0005-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
index 317a678..4527d83 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0005-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0005-hostapd-mtk-Support-EDCCA-hostapd-configuration.patch
@@ -1,7 +1,7 @@
-From f3df970bcf111eb0912f639ac32c0c145e381f95 Mon Sep 17 00:00:00 2001
+From a2022c1b617c259a37eac7e8a76667df122f8040 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 30 May 2022 16:31:34 +0800
-Subject: [PATCH 05/15] hostapd: mtk: Support EDCCA hostapd configuration
+Subject: [PATCH 05/24] hostapd: mtk: Support EDCCA hostapd configuration
 
 edcca_enable and edcca_compensation and implement edcca related handlers.
 ---
@@ -20,7 +20,7 @@
  12 files changed, 415 insertions(+), 7 deletions(-)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 24018f721..b5024ccd5 100644
+index 24018f7..b5024cc 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4755,6 +4755,38 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -63,7 +63,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index bb8c74fd3..9c70d5419 100644
+index bb8c74f..9c70d54 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -598,6 +598,19 @@ static const char * pbc_status_str(enum pbc_status status)
@@ -213,7 +213,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 4a20eb4e1..344585aee 100644
+index 4a20eb4..344585a 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -294,6 +294,9 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -235,7 +235,7 @@
  	wpabuf_free(conf->civic);
  
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a87563265..4ac469910 100644
+index a875632..4ac4699 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1154,8 +1154,37 @@ struct hostapd_config {
@@ -277,7 +277,7 @@
  static inline enum oper_chan_width
  hostapd_get_oper_chwidth(struct hostapd_config *conf)
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 0c7aee276..25e967d1b 100644
+index 0c7aee2..25e967d 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1015,3 +1015,27 @@ int hostapd_drv_dpp_listen(struct hostapd_data *hapd, bool enable)
@@ -309,7 +309,7 @@
 +	return hapd->driver->get_edcca(hapd->drv_priv, mode, value);
 +}
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index b4fb766ee..70a99f406 100644
+index b4fb766..70a99f4 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -138,7 +138,10 @@ int hostapd_drv_do_acs(struct hostapd_data *hapd);
@@ -325,7 +325,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index 65487ac28..3bb38fec3 100644
+index 65487ac..3bb38fe 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
 @@ -2296,6 +2296,13 @@ dfs_offload:
@@ -343,7 +343,7 @@
  		   iface->bss[0]->conf->iface);
  	if (iface->interfaces && iface->interfaces->terminate_on_error > 0)
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 528387fa5..70561263c 100644
+index 528387f..7056126 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -29,14 +29,21 @@ enum mtk_vendor_attr_edcca_ctrl {
@@ -375,7 +375,7 @@
  	[MTK_VENDOR_ATTR_EDCCA_CTRL_MODE] = { .type = NLA_U8 },
  	[MTK_VENDOR_ATTR_EDCCA_CTRL_PRI20_VAL] = { .type = NLA_U8 },
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 1d2b1b265..35599741c 100644
+index 1d2b1b2..3559974 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -4676,6 +4676,10 @@ struct wpa_driver_ops {
@@ -390,7 +390,7 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index c695263bf..6d4a4dbbe 100644
+index c695263..6d4a4db 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -35,6 +35,8 @@
@@ -578,7 +578,7 @@
 +	.get_edcca = nl80211_get_edcca,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 6e40d5556..13e5d248c 100644
+index 6e40d55..13e5d24 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -181,6 +181,7 @@ struct wpa_driver_nl80211_data {
@@ -590,7 +590,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 7ede0d030..732ae292d 100644
+index 7ede0d0..732ae29 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -18,6 +18,7 @@
@@ -615,5 +615,5 @@
  
  			wpa_printf(MSG_DEBUG, "nl80211: Supported vendor command: vendor_id=0x%x subcmd=%u",
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0006-hostapd-mtk-Add-hostapd-MU-SET-GET-control.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0006-hostapd-mtk-Add-hostapd-MU-SET-GET-control.patch
index 07e0d6d..4378628 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0006-hostapd-mtk-Add-hostapd-MU-SET-GET-control.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0006-hostapd-mtk-Add-hostapd-MU-SET-GET-control.patch
@@ -1,7 +1,7 @@
-From 4919444a2dc29c019ec92321109603763c732071 Mon Sep 17 00:00:00 2001
+From 927adcab2218b9fe76c7c12c89ef4604ae530639 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Tue, 9 Aug 2022 10:23:44 -0700
-Subject: [PATCH 06/15] hostapd: mtk: Add hostapd MU SET/GET control
+Subject: [PATCH 06/24] hostapd: mtk: Add hostapd MU SET/GET control
 
 ---
  hostapd/config_file.c             |   9 +++
@@ -20,7 +20,7 @@
  13 files changed, 251 insertions(+)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index b5024ccd5..cd27d0890 100644
+index b5024cc..62e8b33 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -3661,6 +3661,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -40,7 +40,7 @@
  	} else if (os_strcmp(buf, "max_listen_interval") == 0) {
  		bss->max_listen_interval = atoi(pos);
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 9c70d5419..5f71aeea9 100644
+index 9c70d54..c72f336 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3441,6 +3441,63 @@ hostapd_ctrl_iface_get_edcca(struct hostapd_data *hapd, char *cmd, char *buf,
@@ -120,7 +120,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index db2125805..0d364773b 100644
+index db21258..e16a1dc 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -1380,6 +1380,20 @@ static int hostapd_cli_cmd_driver_flags(struct wpa_ctrl *ctrl, int argc,
@@ -156,7 +156,7 @@
  	{ "dpp_qr_code", hostapd_cli_cmd_dpp_qr_code, NULL,
  	  "report a scanned DPP URI from a QR Code" },
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 344585aee..0e1f192cf 100644
+index 344585a..d4fc191 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -280,6 +280,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -168,7 +168,7 @@
  
  	/* The third octet of the country string uses an ASCII space character
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 4ac469910..0616c30bb 100644
+index 4ac4699..37779b7 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1115,6 +1115,7 @@ struct hostapd_config {
@@ -180,7 +180,7 @@
  
  	/* VHT enable/disable config from CHAN_SWITCH */
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 25e967d1b..4598737a3 100644
+index 25e967d..60b9fc0 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1039,3 +1039,17 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value)
@@ -202,7 +202,7 @@
 +	return hapd->driver->mu_dump(hapd->drv_priv, mu_onoff);
 +}
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index 70a99f406..bca39c502 100644
+index 70a99f4..185d5f3 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -142,6 +142,8 @@ int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd);
@@ -215,7 +215,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index 3bb38fec3..44a378aa9 100644
+index 3bb38fe..71d7bfa 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
 @@ -2302,6 +2302,8 @@ dfs_offload:
@@ -228,7 +228,7 @@
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 70561263c..69a46dfbb 100644
+index 7056126..ef8618e 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -10,6 +10,8 @@ enum mtk_nl80211_vendor_subcmds {
@@ -261,7 +261,7 @@
  #define ETH_ALEN 6
  
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 35599741c..4cd7505db 100644
+index 3559974..fa5ad45 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -1623,6 +1623,11 @@ struct wpa_driver_ap_params {
@@ -292,7 +292,7 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 6d4a4dbbe..f8b3f40c2 100644
+index 6d4a4db..0523aab 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -12304,6 +12304,114 @@ fail:
@@ -420,7 +420,7 @@
  	.dpp_listen = nl80211_dpp_listen,
  #endif /* CONFIG_DPP */
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 13e5d248c..57f02497e 100644
+index 13e5d24..1dd984c 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -182,6 +182,7 @@ struct wpa_driver_nl80211_data {
@@ -432,7 +432,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 732ae292d..cc146d9fc 100644
+index 732ae29..cc11891 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -1056,6 +1056,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
@@ -446,5 +446,5 @@
  			}
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0007-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-c.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0007-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-c.patch
index 8ca8c55..b33c599 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0007-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-c.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0007-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-c.patch
@@ -1,7 +1,7 @@
-From 00a1908f92e31d6d85edc877c98387a9fdb737af Mon Sep 17 00:00:00 2001
+From 1ed9156c654c1affb51bf1bfa2cc5be8f9b7c465 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 2 Sep 2022 01:03:23 +0800
-Subject: [PATCH 07/15] hostapd: mtk: Add three wire PTA ctrl hostapd vendor
+Subject: [PATCH 07/24] hostapd: mtk: Add three wire PTA ctrl hostapd vendor
  command
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -20,7 +20,7 @@
  11 files changed, 93 insertions(+)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index cd27d0890..df9c1e7a7 100644
+index 62e8b33..6e526eb 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4796,6 +4796,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -35,7 +35,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 0e1f192cf..9249a6bb8 100644
+index d4fc191..1a1a059 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -297,6 +297,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -47,7 +47,7 @@
  	return conf;
  }
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 0616c30bb..0c370e75b 100644
+index 37779b7..f1be7ae 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1158,6 +1158,19 @@ struct hostapd_config {
@@ -71,7 +71,7 @@
  
  enum edcca_mode {
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 4598737a3..a1d83e4ee 100644
+index 60b9fc0..973b44e 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1053,3 +1053,14 @@ int hostapd_drv_mu_dump(struct hostapd_data *hapd, u8 *mu_onoff)
@@ -90,7 +90,7 @@
 +	return hapd->driver->three_wire_ctrl(hapd->drv_priv, hapd->iconf->three_wire_enable);
 +}
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index bca39c502..5ba62978c 100644
+index 185d5f3..51d7b3b 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -144,6 +144,7 @@ int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
@@ -102,7 +102,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index 44a378aa9..c972b15ea 100644
+index 71d7bfa..77e7eb4 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
 @@ -2304,6 +2304,8 @@ dfs_offload:
@@ -115,7 +115,7 @@
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 69a46dfbb..ee5a4f436 100644
+index ef8618e..ed47487 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -13,6 +13,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -149,7 +149,7 @@
  	MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
  
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 4cd7505db..9ca19af81 100644
+index fa5ad45..6c4c70c 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -4693,6 +4693,14 @@ struct wpa_driver_ops {
@@ -168,7 +168,7 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index f8b3f40c2..92882cb73 100644
+index 0523aab..568c704 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -12637,6 +12637,38 @@ static int nl80211_get_edcca(void *priv, const u8 mode, u8 *value)
@@ -217,7 +217,7 @@
 +	.three_wire_ctrl = nl80211_enable_three_wire,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 57f02497e..9fe7811b9 100644
+index 1dd984c..35fd4d2 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -183,6 +183,7 @@ struct wpa_driver_nl80211_data {
@@ -229,7 +229,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index cc146d9fc..04bc54e77 100644
+index cc11891..dc2d7b1 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -1059,6 +1059,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
@@ -243,5 +243,5 @@
  			}
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0008-hostapd-mtk-Add-hostapd-iBF-control.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0008-hostapd-mtk-Add-hostapd-iBF-control.patch
index fc38b4f..d2f7b2f 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0008-hostapd-mtk-Add-hostapd-iBF-control.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0008-hostapd-mtk-Add-hostapd-iBF-control.patch
@@ -1,7 +1,7 @@
-From 508e76ba51d47394a1b01ba7b9f3c1f25db0aa39 Mon Sep 17 00:00:00 2001
+From 0d84da530a21971ee7a3572c8ce559d53b5eb138 Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:41:51 -0700
-Subject: [PATCH 08/15] hostapd: mtk: Add hostapd iBF control
+Subject: [PATCH 08/24] hostapd: mtk: Add hostapd iBF control
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
@@ -21,7 +21,7 @@
  13 files changed, 224 insertions(+), 1 deletion(-)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index df9c1e7a7..63c9d40be 100644
+index 6e526eb..579193f 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4800,6 +4800,9 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -35,7 +35,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 5f71aeea9..c881d3717 100644
+index c72f336..5590100 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3498,6 +3498,30 @@ hostapd_ctrl_iface_get_mu(struct hostapd_data *hapd, char *buf,
@@ -79,7 +79,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index 0d364773b..c2a123a8c 100644
+index e16a1dc..1f7013e 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -1586,6 +1586,13 @@ static int hostapd_cli_cmd_driver(struct wpa_ctrl *ctrl, int argc, char *argv[])
@@ -106,7 +106,7 @@
  };
  
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 9249a6bb8..7a96cb8b2 100644
+index 1a1a059..df90814 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -298,6 +298,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -118,7 +118,7 @@
  	return conf;
  }
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 0c370e75b..a9e3d2aeb 100644
+index f1be7ae..be30b51 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1159,6 +1159,7 @@ struct hostapd_config {
@@ -138,7 +138,7 @@
  static inline enum oper_chan_width
  hostapd_get_oper_chwidth(struct hostapd_config *conf)
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index a1d83e4ee..60ae8253b 100644
+index 973b44e..bec9798 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1064,3 +1064,17 @@ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd)
@@ -161,7 +161,7 @@
 +}
 \ No newline at end of file
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index 5ba62978c..ab9aedcee 100644
+index 51d7b3b..30b0322 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -145,6 +145,8 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
@@ -174,7 +174,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index c972b15ea..da7f7d87b 100644
+index 77e7eb4..e83298e 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
 @@ -2306,6 +2306,8 @@ dfs_offload:
@@ -187,7 +187,7 @@
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index ee5a4f436..4050cf886 100644
+index ed47487..7b7aeaa 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -13,7 +13,8 @@ enum mtk_nl80211_vendor_subcmds {
@@ -240,7 +240,7 @@
  #define CSI_MAX_COUNT 256
  #define ETH_ALEN 6
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 9ca19af81..71ded617f 100644
+index 6c4c70c..913a194 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -1628,6 +1628,11 @@ struct wpa_driver_ap_params {
@@ -277,7 +277,7 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 92882cb73..5c2a291ca 100644
+index 568c704..ff257eb 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -12670,6 +12670,112 @@ static int nl80211_enable_three_wire(void *priv, const u8 three_wire_enable)
@@ -401,7 +401,7 @@
 +	.ibf_dump = nl80211_ibf_dump,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 9fe7811b9..607592ceb 100644
+index 35fd4d2..92e5ad6 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -184,6 +184,7 @@ struct wpa_driver_nl80211_data {
@@ -413,7 +413,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 04bc54e77..9ecc0ff9a 100644
+index dc2d7b1..83b4c5e 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -1062,6 +1062,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
@@ -427,5 +427,5 @@
  			}
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0009-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0009-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated.patch
index daf82b0..097f4e7 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0009-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0009-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated.patch
@@ -1,7 +1,7 @@
-From 1d4ef2662fb22f96c6db3730f35879d1be55db3d Mon Sep 17 00:00:00 2001
+From 571a9efc9c8ed7ccd4460f487ccbb2c8c9c6cb97 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 22 Sep 2022 16:08:09 +0800
-Subject: [PATCH 09/15] hostapd: mtk: Do not include HE capab IE if associated
+Subject: [PATCH 09/24] hostapd: mtk: Do not include HE capab IE if associated
  sta's HE capab IE is invalid
 
 ---
@@ -9,7 +9,7 @@
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
-index d92178379..098793ef3 100644
+index d921783..098793e 100644
 --- a/src/ap/ieee802_11.c
 +++ b/src/ap/ieee802_11.c
 @@ -5192,7 +5192,8 @@ static u16 send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
@@ -23,5 +23,5 @@
  		p = hostapd_eid_he_operation(hapd, p);
  		p = hostapd_eid_cca(hapd, p);
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch
index 7ec986a..54289c7 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0010-hostapd-mtk-Add-DFS-detection-mode.patch
@@ -1,7 +1,7 @@
-From 6828156c206701f5a0e5d30afcc514f452ce0ada Mon Sep 17 00:00:00 2001
+From c628c4257fb1b7eb0e3689d82c7b4bee5ae5d892 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 20 Feb 2023 14:55:49 +0800
-Subject: [PATCH 10/16] hostapd: mtk: Add DFS detection mode
+Subject: [PATCH 10/24] hostapd: mtk: Add DFS detection mode
 
 Add DFS detection mode for testing radar detection rate.
 If DFS detection mode is on, AP will not switch channels when receiving
@@ -17,7 +17,7 @@
  4 files changed, 50 insertions(+)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 63c9d40..cd15349 100644
+index 579193f..8a61726 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4803,6 +4803,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -32,7 +32,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index c881d37..0b4c234 100644
+index 5590100..fcbc4ae 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3522,6 +3522,26 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
@@ -73,7 +73,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a9e3d2a..77f6169 100644
+index be30b51..d3a9fb0 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1160,6 +1160,7 @@ struct hostapd_config {
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch
index 1d8baf8..4246599 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0011-hostapd-mtk-Add-DFS-offchan-channel-switch.patch
@@ -1,7 +1,7 @@
-From 88dd3df28e3736af4cca0daf4f7d19ab888ea6c4 Mon Sep 17 00:00:00 2001
+From 7027df47dfc72e52763c90ecce524606e61a5384 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 20 Feb 2023 14:56:55 +0800
-Subject: [PATCH 11/16] hostapd: mtk: Add DFS offchan channel switch
+Subject: [PATCH 11/24] hostapd: mtk: Add DFS offchan channel switch
 
 Add DFS background chain channel switch command for testing purpose.
 This feature is implemented via hostapd_cli command.
@@ -16,7 +16,7 @@
  3 files changed, 96 insertions(+), 16 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 0b4c234..6ea1573 100644
+index fcbc4ae..37a1b2a 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3542,6 +3542,76 @@ hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
index 7db3ae2..01346dc 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0012-hostapd-mtk-Add-amsdu-set-get-ctrl.patch
@@ -1,7 +1,7 @@
-From d0128fc60d38ce4f20f8368bdc5ea9ed19a329b7 Mon Sep 17 00:00:00 2001
+From 1e8a42f893d138b7ca29d4758d1528545e88d657 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 16 Dec 2022 03:57:11 +0800
-Subject: [PATCH 12/16] hostapd: mtk: Add amsdu set get ctrl
+Subject: [PATCH 12/24] hostapd: mtk: Add amsdu set get ctrl
 
 ---
  hostapd/config_file.c             |   9 +++
@@ -20,7 +20,7 @@
  13 files changed, 207 insertions(+), 1 deletion(-)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index cd15349..10ea525 100644
+index 8a61726..017c21e 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -4807,6 +4807,15 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -40,7 +40,7 @@
  		wpa_printf(MSG_ERROR,
  			   "Line %d: unknown configuration item '%s'",
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 6ea1573..0ad8451 100644
+index 37a1b2a..61c9e80 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -3612,6 +3612,30 @@ hostapd_ctrl_iface_set_offchan_ctrl(struct hostapd_data *hapd, char *cmd,
@@ -84,7 +84,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index c2a123a..30b3392 100644
+index 1f7013e..0da18e2 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -1593,6 +1593,13 @@ static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
@@ -111,7 +111,7 @@
  };
  
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 7a96cb8..85ad5e4 100644
+index df90814..24fc0f5 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -299,6 +299,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -123,7 +123,7 @@
  	return conf;
  }
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index 77f6169..a9ac396 100644
+index d3a9fb0..ce0d84c 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -1161,6 +1161,7 @@ struct hostapd_config {
@@ -135,7 +135,7 @@
  
  enum three_wire_mode {
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 60ae825..1a82f23 100644
+index bec9798..342a7a8 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1077,4 +1077,18 @@ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
@@ -159,7 +159,7 @@
  }
 \ No newline at end of file
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index ab9aedc..4406666 100644
+index 30b0322..79fef71 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -147,6 +147,8 @@ int hostapd_drv_mu_dump(struct hostapd_data *hapd, u8 *mu_onoff);
@@ -172,7 +172,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
-index da7f7d8..a18e744 100644
+index e83298e..42e8ed7 100644
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
 @@ -2308,6 +2308,8 @@ dfs_offload:
@@ -185,7 +185,7 @@
  	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
  		   iface->bss[0]->conf->iface);
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 4050cf8..0999ea9 100644
+index 7b7aeaa..97c5a47 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -167,7 +167,6 @@ enum mtk_vendor_attr_wireless_ctrl {
@@ -220,7 +220,7 @@
  	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
  
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 71ded61..265d86d 100644
+index 913a194..3e034d7 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -4720,6 +4720,15 @@ struct wpa_driver_ops {
@@ -240,7 +240,7 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 5c2a291..d91b29c 100644
+index ff257eb..6c65901 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
 @@ -12776,6 +12776,118 @@ fail:
@@ -370,7 +370,7 @@
 +	.amsdu_dump = nl80211_dump_amsdu,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index 607592c..e570224 100644
+index 92e5ad6..21d48cc 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -185,6 +185,7 @@ struct wpa_driver_nl80211_data {
@@ -382,7 +382,7 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index 9ecc0ff..fcfa68b 100644
+index 83b4c5e..06a52db 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
 @@ -1065,6 +1065,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
index 4df0ba6..a35ed64 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0013-hostapd-mtk-Add-he_ldpc-configuration.patch
@@ -1,7 +1,7 @@
-From ebbf23ac8c19224b34523e8b9820e32f0789fe11 Mon Sep 17 00:00:00 2001
+From a8f35d893f1f3a9688b2dd52b68a9784e2778201 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 12 Jan 2023 15:18:19 +0800
-Subject: [PATCH 13/16] hostapd: mtk: Add he_ldpc configuration
+Subject: [PATCH 13/24] hostapd: mtk: Add he_ldpc configuration
 
 ---
  hostapd/config_file.c        | 2 ++
@@ -13,7 +13,7 @@
  6 files changed, 19 insertions(+)
 
 diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 10ea525..4237a5c 100644
+index 017c21e..649618b 100644
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
 @@ -3508,6 +3508,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
@@ -42,7 +42,7 @@
  #he_bss_color=1
  
 diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 85ad5e4..b283de6 100644
+index 24fc0f5..4e46a62 100644
 --- a/src/ap/ap_config.c
 +++ b/src/ap/ap_config.c
 @@ -268,6 +268,7 @@ struct hostapd_config * hostapd_config_defaults(void)
@@ -54,7 +54,7 @@
  		HE_OPERATION_RTS_THRESHOLD_OFFSET;
  	/* Set default basic MCS/NSS set to single stream MCS 0-7 */
 diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index a9ac396..b8b20a7 100644
+index ce0d84c..7aeb176 100644
 --- a/src/ap/ap_config.h
 +++ b/src/ap/ap_config.h
 @@ -929,6 +929,7 @@ struct hostapd_bss_config {
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
index f0d25c6..0bd08ef 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0014-hostapd-mtk-Add-the-broadcast-destination-address-of.patch
@@ -1,7 +1,7 @@
-From bb5cb086162828392a04820063ad7997d8ae26d7 Mon Sep 17 00:00:00 2001
+From 8d6637b3e04d1d3a41d739a7e824e11f39a05fca Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 17 Jan 2023 13:25:18 +0800
-Subject: [PATCH 14/16] hostapd: mtk: Add the broadcast destination address of
+Subject: [PATCH 14/24] hostapd: mtk: Add the broadcast destination address of
  Probe Response frame on 6 GHz
 
 According to IEEE 802.11ax 26.17.2.3.2,
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
index 5fcd0c5..bbd0743 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0015-hostapd-mtk-Add-vendor-command-attribute-for-RTS-BW-.patch
@@ -1,7 +1,7 @@
-From 1db373190399a907b27141c199841aeafd4643da Mon Sep 17 00:00:00 2001
+From 60b1edabde3e0f9e3e09cc4b9646e146c0c3e92a Mon Sep 17 00:00:00 2001
 From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
 Date: Tue, 24 Jan 2023 19:06:44 +0800
-Subject: [PATCH 15/16] hostapd: mtk: Add vendor command attribute for RTS BW
+Subject: [PATCH 15/24] hostapd: mtk: Add vendor command attribute for RTS BW
  signaling.
 
 Signed-off-by: himanshu.goyal <himanshu.goyal@mediatek.com>
@@ -10,7 +10,7 @@
  1 file changed, 1 insertion(+)
 
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 0999ea9..fb12895 100644
+index 97c5a47..62d79cb 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -169,6 +169,7 @@ enum mtk_vendor_attr_wireless_ctrl {
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
index 33fea78..63b0bae 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0016-hostapd-mtk-6G-band-does-not-require-DFS.patch
@@ -1,7 +1,7 @@
-From efa1d271d28c84b8ca77ffc3ca7cb75e727088a0 Mon Sep 17 00:00:00 2001
+From 4cf61c8d0aa99d1e15afafe6c9f0eab24814f615 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 13 Feb 2023 11:03:53 +0800
-Subject: [PATCH 16/16] hostapd: mtk: 6G band does not require DFS
+Subject: [PATCH 16/24] hostapd: mtk: 6G band does not require DFS
 
 ---
  src/ap/dfs.c | 1 +
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch
index 265c37a..0e2327b 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0017-hostapd-mtk-Fix-sending-wrong-VHT-operation-IE-in-CS.patch
@@ -1,8 +1,8 @@
-From f6bfd9a4a6c0d08e0dec9311873c9e863a07c9a8 Mon Sep 17 00:00:00 2001
+From c0b5c3ba905d10495f1f035fd93bbdd5295d60ea Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 20 Feb 2023 11:01:18 +0800
-Subject: [PATCH] hostapd: mtk: Fix sending wrong VHT operation IE in CSA while
- using ZWDFS
+Subject: [PATCH 17/24] hostapd: mtk: Fix sending wrong VHT operation IE in CSA
+ while using ZWDFS
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch
index db3c813..027aab4 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch
@@ -1,7 +1,7 @@
-From 3337e7b4f75a66e53e1320e49deba2b58a8a80b0 Mon Sep 17 00:00:00 2001
+From a96e3398373b64bca5e33c8eb1a6d289bb07837b Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 20 Feb 2023 10:51:47 +0800
-Subject: [PATCH 18/19] hostapd: mtk: Add sta-assisted DFS state update
+Subject: [PATCH 18/24] hostapd: mtk: Add sta-assisted DFS state update
  mechanism
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -119,7 +119,7 @@
  #define AP_CSA_FINISHED "AP-CSA-FINISHED "
  
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index 265d86d..b5de0e6 100644
+index 3e034d7..82daef0 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -5317,6 +5317,20 @@ enum wpa_event_type {
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch
index 8340fd9..a29ec33 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch
@@ -1,7 +1,8 @@
-From 83ab1a9cc51225095842d3c62bf75cf4efe63075 Mon Sep 17 00:00:00 2001
+From 61b475daa5dbf9802932657943d1322cb5c8f5b3 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 20 Feb 2023 16:58:20 +0800
-Subject: [PATCH] hostapd: mtk: Fix auto ht issue when switching to DFS channel
+Subject: [PATCH 19/24] hostapd: mtk: Fix auto ht issue when switching to DFS
+ channel
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -9,7 +10,7 @@
  1 file changed, 6 insertions(+), 6 deletions(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 0ad8451..407790f 100644
+index 61c9e80..c33b7a4 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
 @@ -2698,6 +2698,12 @@ static int hostapd_ctrl_iface_chan_switch(struct hostapd_iface *iface,
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0020-hostapd-mtk-Mark-DFS-channel-as-available-for-CSA.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0020-hostapd-mtk-Mark-DFS-channel-as-available-for-CSA.patch
index 1fe5c88..6e9e315 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0020-hostapd-mtk-Mark-DFS-channel-as-available-for-CSA.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0020-hostapd-mtk-Mark-DFS-channel-as-available-for-CSA.patch
@@ -1,7 +1,7 @@
-From 3e9500a42a41e8cd7c2d7bc20aba96e1e17161fb Mon Sep 17 00:00:00 2001
+From 4cfadfd4c22232fc973e81a70039324b3db383ab Mon Sep 17 00:00:00 2001
 From: "himanshu.goyal" <himanshu.goyal@mediatek.com>
 Date: Fri, 3 Mar 2023 12:45:42 +0800
-Subject: [PATCH] hostapd: mtk: Mark DFS channel as available for CSA.
+Subject: [PATCH 20/24] hostapd: mtk: Mark DFS channel as available for CSA.
 
 ---
  hostapd/ctrl_iface.c   | 10 ++++++++++
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support-for-hostapd.patch
similarity index 99%
rename from recipes-wifi/wpa-supplicant/files/patches/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support.patch
rename to recipes-wifi/wpa-supplicant/files/patches/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support-for-hostapd.patch
index 8d59a0f..a9e802d 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support-for-hostapd.patch
@@ -1,7 +1,7 @@
-From 8cbdb9a59e3bbe8804f909b13ce6df6e2777c3da Mon Sep 17 00:00:00 2001
+From 832350b2c16a9ad2f65c32d32584e7cdb06b074a Mon Sep 17 00:00:00 2001
 From: mtk20656 <chank.chen@mediatek.com>
 Date: Thu, 2 Mar 2023 10:51:43 +0800
-Subject: [PATCH] hostapd: mtk: add 11v_mbss and ema support for hostapd
+Subject: [PATCH 21/24] hostapd: mtk: add 11v_mbss and ema support for hostapd
 
 Signed-off-by: mtk20656 <chank.chen@mediatek.com>
 ---
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0022-hostapd-mtk-Add-available-color-bitmap.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0022-hostapd-mtk-Add-available-color-bitmap.patch
index 9bbbf87..a0065f3 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/mtk-0022-hostapd-mtk-Add-available-color-bitmap.patch
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0022-hostapd-mtk-Add-available-color-bitmap.patch
@@ -1,7 +1,7 @@
-From e7790a1bceca6b7612f29b00c429cf23f5dd9e3a Mon Sep 17 00:00:00 2001
+From 46c88d8e3c513c04891913c77de179de9e7f36cd Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Thu, 26 Jan 2023 09:16:00 +0800
-Subject: [PATCH] hostapd: mtk: Add available color bitmap
+Subject: [PATCH 22/24] hostapd: mtk: Add available color bitmap
 
 Signed-off-by: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 ---
@@ -17,10 +17,10 @@
  9 files changed, 192 insertions(+), 1 deletion(-)
 
 diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
-index 0ad8451..b0d5ded 100644
+index 9ba6992..e1e9270 100644
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -3635,6 +3635,76 @@ hostapd_ctrl_iface_get_amsdu(struct hostapd_data *hapd, char *buf,
+@@ -3645,6 +3645,76 @@ hostapd_ctrl_iface_get_amsdu(struct hostapd_data *hapd, char *buf,
  	return ret;
  }
  
@@ -97,7 +97,7 @@
  
  static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
  					      char *buf, char *reply,
-@@ -4202,6 +4272,10 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+@@ -4212,6 +4282,10 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
  		reply_len = hostapd_ctrl_iface_set_offchan_ctrl(hapd, buf + 16, reply, reply_size);
  	} else if (os_strncmp(buf, "GET_AMSDU", 9) == 0) {
  		reply_len = hostapd_ctrl_iface_get_amsdu(hapd, reply, reply_size);
@@ -109,7 +109,7 @@
  		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
  		reply_len = 16;
 diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
-index 30b3392..b6cf52e 100644
+index 6231e51..aad7aa5 100644
 --- a/hostapd/hostapd_cli.c
 +++ b/hostapd/hostapd_cli.c
 @@ -1578,6 +1578,20 @@ static int hostapd_cli_cmd_reload_wpa_psk(struct wpa_ctrl *ctrl, int argc,
@@ -145,7 +145,7 @@
  	{ "driver", hostapd_cli_cmd_driver, NULL,
  	  "<driver sub command> [<hex formatted data>] = send driver command data" },
 diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
-index 1a82f23..decffdd 100644
+index 342a7a8..40b9a20 100644
 --- a/src/ap/ap_drv_ops.c
 +++ b/src/ap/ap_drv_ops.c
 @@ -1091,4 +1091,12 @@ int hostapd_drv_amsdu_dump(struct hostapd_data *hapd, u8 *amsdu)
@@ -164,7 +164,7 @@
 +	return hapd->driver->get_aval_color_bmp(hapd->drv_priv, aval_color_bmp);
 +}
 diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
-index 4406666..61c1360 100644
+index 79fef71..136a3ac 100644
 --- a/src/ap/ap_drv_ops.h
 +++ b/src/ap/ap_drv_ops.h
 @@ -149,6 +149,8 @@ int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd);
@@ -177,7 +177,7 @@
  #include "drivers/driver.h"
  
 diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
-index 0999ea9..f2afb2e 100644
+index 62d79cb..a99e6f2 100644
 --- a/src/common/mtk_vendor.h
 +++ b/src/common/mtk_vendor.h
 @@ -15,6 +15,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -188,7 +188,7 @@
  };
  
  enum mtk_vendor_attr_edcca_ctrl {
-@@ -252,6 +253,16 @@ ibf_dump_policy[NUM_MTK_VENDOR_ATTRS_IBF_DUMP] = {
+@@ -253,6 +254,16 @@ ibf_dump_policy[NUM_MTK_VENDOR_ATTRS_IBF_DUMP] = {
  	[MTK_VENDOR_ATTR_IBF_DUMP_ENABLE] = { .type = NLA_U8 },
  };
  
@@ -206,10 +206,10 @@
  #define CSI_MAX_COUNT 256
  #define ETH_ALEN 6
 diff --git a/src/drivers/driver.h b/src/drivers/driver.h
-index b07aaf3..266c630 100644
+index 36f465c..7f6392f 100644
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -4736,6 +4736,14 @@ struct wpa_driver_ops {
+@@ -4771,6 +4771,14 @@ struct wpa_driver_ops {
  	 */
  	int (*amsdu_ctrl)(void *priv, u8 amsdu);
  	int (*amsdu_dump)(void *priv, u8 *amsdu);
@@ -225,10 +225,10 @@
  
  /**
 diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
-index 6702384..c8771f7 100644
+index 3753409..f9a8763 100644
 --- a/src/drivers/driver_nl80211.c
 +++ b/src/drivers/driver_nl80211.c
-@@ -12433,6 +12433,71 @@ static int nl80211_dpp_listen(void *priv, bool enable)
+@@ -12485,6 +12485,71 @@ static int nl80211_dpp_listen(void *priv, bool enable)
  }
  #endif /* CONFIG_DPP */
  
@@ -300,14 +300,14 @@
  
  #ifdef CONFIG_TESTING_OPTIONS
  
-@@ -13073,4 +13138,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
- 	.start_disabled = nl80211_start_disabled,
+@@ -13096,4 +13161,5 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.ibf_dump = nl80211_ibf_dump,
  	.amsdu_ctrl = nl80211_enable_amsdu,
  	.amsdu_dump = nl80211_dump_amsdu,
 +	.get_aval_color_bmp = nl80211_get_aval_color_bmp,
  };
 diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
-index e570224..b90c8fa 100644
+index 21d48cc..72c7abd 100644
 --- a/src/drivers/driver_nl80211.h
 +++ b/src/drivers/driver_nl80211.h
 @@ -186,6 +186,7 @@ struct wpa_driver_nl80211_data {
@@ -319,10 +319,10 @@
  	u64 vendor_scan_cookie;
  	u64 remain_on_chan_cookie;
 diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
-index fcfa68b..c3c7b41 100644
+index d8078bc..e7c6f39 100644
 --- a/src/drivers/driver_nl80211_capa.c
 +++ b/src/drivers/driver_nl80211_capa.c
-@@ -1068,6 +1068,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+@@ -1092,6 +1092,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
  				case MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL:
  					drv->mtk_wireless_vendor_cmd_avail = 1;
  					break;
@@ -333,5 +333,5 @@
  			}
  
 -- 
-2.39.0
+2.18.0
 
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0023-hostapd-mtk-Add-channel-information-for-hostapd-relo.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0023-hostapd-mtk-Add-channel-information-for-hostapd-relo.patch
new file mode 100644
index 0000000..b03656e
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0023-hostapd-mtk-Add-channel-information-for-hostapd-relo.patch
@@ -0,0 +1,79 @@
+From 6435612049c0a21a30ea835a31d07b6c14b3b248 Mon Sep 17 00:00:00 2001
+From: Michael Lee <michael-cy.lee@mediatek.com>
+Date: Wed, 22 Mar 2023 13:59:29 +0800
+Subject: [PATCH 23/24] hostapd: mtk: Add channel information for hostapd
+ reload
+
+Add center channel, operating class, and bandwidth into the UPDATE
+command when wpa_supplciant reloads hostapd.
+Hostapd can correctly update its channel information.
+
+Signed-off-by: Michael Lee <michael-cy.lee@mediatek.com>
+---
+ hostapd/ctrl_iface.c            | 11 +++++++++++
+ wpa_supplicant/wpa_supplicant.c | 17 ++++++++++++++---
+ 2 files changed, 25 insertions(+), 3 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index e1e9270..4c5d494 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -170,6 +170,17 @@ static struct hostapd_config *hostapd_ctrl_iface_config_read(const char *fname)
+ 			conf->hw_mode = atoi(val);
+ 		else if ((val = get_option(opt, "ieee80211n=")))
+ 			conf->ieee80211n = atoi(val);
++		else if ((val = get_option(opt, "center_segment0=")))
++			hostapd_set_oper_centr_freq_seg0_idx(conf, atoi(val));
++		else if ((val = get_option(opt, "center_segment1=")))
++			hostapd_set_oper_centr_freq_seg1_idx(conf, atoi(val));
++		else if ((val = get_option(opt, "op_class="))) {
++			enum oper_chan_width ch_width;
++
++			conf->op_class = atoi(val);
++			ch_width = op_class_to_ch_width(conf->op_class);
++			hostapd_set_oper_chwidth(conf, ch_width);
++		}
+ 		else
+ 			break;
+ 	}
+diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
+index 270da46..4930f7a 100644
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -150,9 +150,10 @@ static int hostapd_reload(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
+ 	char buf[256];
+ 	size_t len = sizeof(buf);
+ 	enum hostapd_hw_mode hw_mode;
+-	u8 channel;
++	u8 channel, center_segment0, center_segment1, op_class;
+ 	int sec_chan = 0;
+ 	int ret;
++	struct wpa_channel_info ci;
+ 
+ 	if (!bss)
+ 		return -1;
+@@ -165,9 +166,19 @@ static int hostapd_reload(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
+ 			sec_chan = -1;
+ 	}
+ 
++	ret = wpa_drv_channel_info(wpa_s, &ci);
++	if (ret)
++		return -1;
++
++	ieee80211_freq_to_chan(ci.center_frq1, &center_segment0);
++	ieee80211_freq_to_chan(ci.center_frq2, &center_segment1);
++	ieee80211_chaninfo_to_channel(ci.frequency, ci.chanwidth, sec_chan,
++				      &op_class, &channel);
+ 	hw_mode = ieee80211_freq_to_chan(bss->freq, &channel);
+-	if (asprintf(&cmd, "UPDATE channel=%d sec_chan=%d hw_mode=%d",
+-		     channel, sec_chan, hw_mode) < 0)
++	if (asprintf(&cmd, "UPDATE channel=%d center_segment0=%d "
++		     "center_segment1=%d sec_chan=%d hw_mode=%d op_class=%d",
++		     channel, center_segment0, center_segment1, sec_chan,
++		     hw_mode, op_class) < 0)
+ 		return -1;
+ 
+ 	ret = wpa_ctrl_request(wpa_s->hostapd, cmd, os_strlen(cmd), buf, &len, NULL);
+-- 
+2.18.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches/mtk-0024-hostapd-mtk-Fix-ZWDFS-issue-in-BW-160.patch b/recipes-wifi/wpa-supplicant/files/patches/mtk-0024-hostapd-mtk-Fix-ZWDFS-issue-in-BW-160.patch
new file mode 100644
index 0000000..e914686
--- /dev/null
+++ b/recipes-wifi/wpa-supplicant/files/patches/mtk-0024-hostapd-mtk-Fix-ZWDFS-issue-in-BW-160.patch
@@ -0,0 +1,210 @@
+From 3a119f804f87e8535908c772d3c7251bc6bfa524 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Mon, 20 Mar 2023 16:08:30 +0800
+Subject: [PATCH 24/24] hostapd: mtk: Fix ZWDFS issue in BW 160
+
+When background radar is enabled and bandwidth is set to 160, AP will
+fail to startup due to the lack of non-DFS channel.
+Under this circumstance, AP should perform CAC itself, and the background
+chain could also perform CAC simultaneously.
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ src/ap/dfs.c | 98 ++++++++++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 79 insertions(+), 19 deletions(-)
+
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index d082fe0..d688ecb 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -69,15 +69,22 @@ static int dfs_get_used_n_chans(struct hostapd_iface *iface, int *seg1)
+ static int dfs_channel_available(struct hostapd_channel_data *chan,
+ 				 enum dfs_channel_type type)
+ {
++	int dfs_status = chan->flag & HOSTAPD_CHAN_DFS_MASK;
++
++	if (chan->flag & HOSTAPD_CHAN_DISABLED)
++		return -1;
++
+ 	if (type == DFS_NO_CAC_YET) {
+ 		/* Select only radar channel where CAC has not been
+ 		 * performed yet
+ 		 */
+-		if ((chan->flag & HOSTAPD_CHAN_RADAR) &&
+-		    (chan->flag & HOSTAPD_CHAN_DFS_MASK) ==
+-		     HOSTAPD_CHAN_DFS_USABLE)
++		if (!(chan->flag & HOSTAPD_CHAN_RADAR))
++			return 0;
++
++		if (dfs_status == HOSTAPD_CHAN_DFS_USABLE)
+ 			return 1;
+-		return 0;
++
++		return -1;
+ 	}
+ 
+ 	/*
+@@ -86,16 +93,14 @@ static int dfs_channel_available(struct hostapd_channel_data *chan,
+ 	 * channel for CSA, unless they are available for immediate use.
+ 	 */
+ 	if (type == DFS_AVAILABLE && (chan->flag & HOSTAPD_CHAN_RADAR) &&
+-	    ((chan->flag & HOSTAPD_CHAN_DFS_MASK) !=
+-	     HOSTAPD_CHAN_DFS_AVAILABLE))
+-		return 0;
++	    (dfs_status != HOSTAPD_CHAN_DFS_AVAILABLE))
++		return -1;
+ 
+-	if (chan->flag & HOSTAPD_CHAN_DISABLED)
+-		return 0;
+ 	if ((chan->flag & HOSTAPD_CHAN_RADAR) &&
+-	    ((chan->flag & HOSTAPD_CHAN_DFS_MASK) ==
+-	     HOSTAPD_CHAN_DFS_UNAVAILABLE))
+-		return 0;
++	    ((dfs_status == HOSTAPD_CHAN_DFS_UNAVAILABLE) ||
++	    (dfs_status == HOSTAPD_CHAN_DFS_UNKNOWN)))
++		return -1;
++
+ 	return 1;
+ }
+ 
+@@ -167,7 +172,7 @@ static int dfs_chan_range_available(struct hostapd_hw_modes *mode,
+ 				    enum dfs_channel_type type)
+ {
+ 	struct hostapd_channel_data *first_chan, *chan;
+-	int i;
++	int i, available = 0, ret = 0;
+ 	u32 bw = num_chan_to_bw(num_chans);
+ 
+ 	if (first_chan_idx + num_chans > mode->num_channels) {
+@@ -203,14 +208,17 @@ static int dfs_chan_range_available(struct hostapd_hw_modes *mode,
+ 			return 0;
+ 		}
+ 
+-		if (!dfs_channel_available(chan, type)) {
++		ret = dfs_channel_available(chan, type);
++		if (ret < 0) {
+ 			wpa_printf(MSG_DEBUG, "DFS: channel not available %d",
+ 				   first_chan->freq + i * 20);
+ 			return 0;
+ 		}
++
++		available |= ret;
+ 	}
+ 
+-	return 1;
++	return available;
+ }
+ 
+ 
+@@ -826,8 +834,12 @@ static unsigned int dfs_get_cac_time(struct hostapd_iface *iface,
+  */
+ int hostapd_handle_dfs(struct hostapd_iface *iface)
+ {
++	struct hostapd_channel_data *channel;
+ 	int res, n_chans, n_chans1, start_chan_idx, start_chan_idx1;
+-	int skip_radar = 0;
++	int sec = 0, skip_radar = 0;
++	u8 cf1 = 0, cf2 = 0;
++	bool use_radar_background = dfs_use_radar_background(iface);
++	enum dfs_channel_type channel_type = DFS_NO_CAC_YET;
+ 
+ 	if (is_6ghz_freq(iface->freq))
+ 		return 1;
+@@ -890,7 +902,7 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
+ 	/* Finally start CAC */
+ 	hostapd_set_state(iface, HAPD_IFACE_DFS);
+ 	wpa_printf(MSG_DEBUG, "DFS start CAC on %d MHz%s", iface->freq,
+-		   dfs_use_radar_background(iface) ? " (background)" : "");
++		   use_radar_background ? " (background)" : "");
+ 	wpa_msg(iface->bss[0]->msg_ctx, MSG_INFO, DFS_EVENT_CAC_START
+ 		"freq=%d chan=%d sec_chan=%d, width=%d, seg0=%d, seg1=%d, cac_time=%ds",
+ 		iface->freq,
+@@ -900,6 +912,16 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
+ 		hostapd_get_oper_centr_freq_seg1_idx(iface->conf),
+ 		iface->dfs_cac_ms / 1000);
+ 
++	if (use_radar_background) {
++		channel = dfs_get_valid_channel(iface, &sec, &cf1, &cf2, DFS_AVAILABLE);
++		/*
++		 * AP cannot get any random available channel.
++		 * Let AP and dedicated radar chain both perform CAC.
++		 */
++		if (!channel)
++			use_radar_background = false;
++	}
++
+ 	res = hostapd_start_dfs_cac(
+ 		iface, iface->conf->hw_mode, iface->freq, iface->conf->channel,
+ 		iface->conf->ieee80211n, iface->conf->ieee80211ac,
+@@ -908,14 +930,14 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
+ 		hostapd_get_oper_chwidth(iface->conf),
+ 		hostapd_get_oper_centr_freq_seg0_idx(iface->conf),
+ 		hostapd_get_oper_centr_freq_seg1_idx(iface->conf),
+-		dfs_use_radar_background(iface));
++		use_radar_background);
+ 
+ 	if (res) {
+ 		wpa_printf(MSG_ERROR, "DFS start_dfs_cac() failed, %d", res);
+ 		return -1;
+ 	}
+ 
+-	if (dfs_use_radar_background(iface)) {
++	if (use_radar_background) {
+ 		/* Cache background radar parameters. */
+ 		iface->radar_background.channel = iface->conf->channel;
+ 		iface->radar_background.secondary_channel =
+@@ -936,6 +958,35 @@ int hostapd_handle_dfs(struct hostapd_iface *iface)
+ 
+ 		iface->radar_background.temp_ch = 1;
+ 		return 1;
++	} else if (dfs_use_radar_background(iface)) {
++		if (iface->dfs_domain == HOSTAPD_DFS_REGION_ETSI)
++			channel_type = DFS_ANY_CHANNEL;
++
++		channel = dfs_get_valid_channel(iface, &sec, &cf1, &cf2, channel_type);
++
++		if (!channel ||
++		    (channel->chan == iface->conf->channel &&
++		    cf1 == hostapd_get_oper_centr_freq_seg0_idx(iface->conf) &&
++		    cf2 == hostapd_get_oper_centr_freq_seg1_idx(iface->conf))) {
++			wpa_printf(MSG_ERROR, "Background radar could not get valid channel\n");
++			iface->radar_background.channel = -1;
++			return 0;
++		}
++
++		hostapd_start_dfs_cac(iface, iface->conf->hw_mode,
++				      channel->freq, channel->chan,
++				      iface->conf->ieee80211n,
++				      iface->conf->ieee80211ac,
++				      iface->conf->ieee80211ax,
++				      iface->conf->ieee80211be,
++				      sec, hostapd_get_oper_chwidth(iface->conf),
++				      cf1, cf2, true);
++
++		iface->radar_background.channel = channel->chan;
++		iface->radar_background.freq = channel->freq;
++		iface->radar_background.secondary_channel = sec;
++		iface->radar_background.centr_freq_seg0_idx = cf1;
++		iface->radar_background.centr_freq_seg1_idx = cf2;
+ 	}
+ 
+ 	return 0;
+@@ -1185,6 +1236,15 @@ int hostapd_dfs_complete_cac(struct hostapd_iface *iface, int success, int freq,
+ 				hostapd_setup_interface_complete(iface, 0);
+ 				iface->cac_started = 0;
+ 			}
++
++			/*
++			 * When background radar is enabled but the CAC completion
++			 * is not received from the background chain.
++			 * Then, reset radar background chain.
++			 */
++			if (dfs_use_radar_background(iface) &&
++			    iface->radar_background.channel == -1)
++				hostpad_dfs_update_background_chain(iface);
+ 		}
+ 	} else if (hostapd_dfs_is_background_event(iface, freq)) {
+ 		iface->radar_background.cac_started = 0;
+-- 
+2.18.0
+
diff --git a/recipes-wifi/wpa-supplicant/files/patches/patches.inc b/recipes-wifi/wpa-supplicant/files/patches/patches.inc
index 3ec1290..e1aacd5 100644
--- a/recipes-wifi/wpa-supplicant/files/patches/patches.inc
+++ b/recipes-wifi/wpa-supplicant/files/patches/patches.inc
@@ -82,6 +82,8 @@
     file://mtk-0018-hostapd-mtk-Add-sta-assisted-DFS-state-update-mechan.patch \
     file://mtk-0019-hostapd-mtk-Fix-auto-ht-issue-when-switching-to-DFS-.patch \
     file://mtk-0020-hostapd-mtk-Mark-DFS-channel-as-available-for-CSA.patch \
-    file://mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support.patch \
+    file://mtk-0021-hostapd-mtk-add-11v_mbss-and-ema-support-for-hostapd.patch \
     file://mtk-0022-hostapd-mtk-Add-available-color-bitmap.patch \
+    file://mtk-0023-hostapd-mtk-Add-channel-information-for-hostapd-relo.patch \
+    file://mtk-0024-hostapd-mtk-Fix-ZWDFS-issue-in-BW-160.patch \
     "