diff --git a/recipes-connectivity/hostapd/files/patches/99900-master-Add-hostapd_neighbor_count-and-hostapd_neighbor_ins.patch b/recipes-connectivity/hostapd/files/patches/99900-hostapd-mtk-Add-hostapd_neighbor_count-and-hostapd_neighbor_ins.patch
similarity index 100%
rename from recipes-connectivity/hostapd/files/patches/99900-master-Add-hostapd_neighbor_count-and-hostapd_neighbor_ins.patch
rename to recipes-connectivity/hostapd/files/patches/99900-hostapd-mtk-Add-hostapd_neighbor_count-and-hostapd_neighbor_ins.patch
diff --git a/recipes-connectivity/hostapd/files/patches/99901-master-Support-including-neighbor-report-elements-in-ANQP-.patch b/recipes-connectivity/hostapd/files/patches/99901-hostapd-mtk-Support-including-neighbor-report-elements-in-ANQP-.patch
similarity index 100%
rename from recipes-connectivity/hostapd/files/patches/99901-master-Support-including-neighbor-report-elements-in-ANQP-.patch
rename to recipes-connectivity/hostapd/files/patches/99901-hostapd-mtk-Support-including-neighbor-report-elements-in-ANQP-.patch
diff --git a/recipes-connectivity/hostapd/files/patches/99902-master-Support-including-neignbor-report-elements-in-BTM-r.patch b/recipes-connectivity/hostapd/files/patches/99902-hostapd-mtk-Support-including-neignbor-report-elements-in-BTM-r.patch
similarity index 100%
rename from recipes-connectivity/hostapd/files/patches/99902-master-Support-including-neignbor-report-elements-in-BTM-r.patch
rename to recipes-connectivity/hostapd/files/patches/99902-hostapd-mtk-Support-including-neignbor-report-elements-in-BTM-r.patch
diff --git a/recipes-connectivity/hostapd/files/patches/99903-master-Support-configuring-BSS-Termination-TSF-by-using-ho.patch b/recipes-connectivity/hostapd/files/patches/99903-hostapd-mtk-Support-configuring-BSS-Termination-TSF-by-using-ho.patch
similarity index 100%
rename from recipes-connectivity/hostapd/files/patches/99903-master-Support-configuring-BSS-Termination-TSF-by-using-ho.patch
rename to recipes-connectivity/hostapd/files/patches/99903-hostapd-mtk-Support-configuring-BSS-Termination-TSF-by-using-ho.patch
diff --git a/recipes-connectivity/hostapd/files/patches/99904-master-Disable-interface-if-BSS-Termination-TSF-is-set.patch b/recipes-connectivity/hostapd/files/patches/99904-hostapd-mtk-Disable-interface-if-BSS-Termination-TSF-is-set.patch
similarity index 100%
rename from recipes-connectivity/hostapd/files/patches/99904-master-Disable-interface-if-BSS-Termination-TSF-is-set.patch
rename to recipes-connectivity/hostapd/files/patches/99904-hostapd-mtk-Disable-interface-if-BSS-Termination-TSF-is-set.patch
diff --git a/recipes-connectivity/hostapd/files/patches/99905-master-Add-set_send_disassoc_frame_timer-to-send-disassoci.patch b/recipes-connectivity/hostapd/files/patches/99905-hostapd-mtk-Add-set_send_disassoc_frame_timer-to-send-disassoci.patch
similarity index 100%
rename from recipes-connectivity/hostapd/files/patches/99905-master-Add-set_send_disassoc_frame_timer-to-send-disassoci.patch
rename to recipes-connectivity/hostapd/files/patches/99905-hostapd-mtk-Add-set_send_disassoc_frame_timer-to-send-disassoci.patch
diff --git a/recipes-connectivity/hostapd/files/patches/99906-master-Support-including-neighbor-report-elements-in-BTM-r.patch b/recipes-connectivity/hostapd/files/patches/99906-hostapd-mtk-Support-including-neighbor-report-elements-in-BTM-r.patch
similarity index 100%
rename from recipes-connectivity/hostapd/files/patches/99906-master-Support-including-neighbor-report-elements-in-BTM-r.patch
rename to recipes-connectivity/hostapd/files/patches/99906-hostapd-mtk-Support-including-neighbor-report-elements-in-BTM-r.patch
diff --git a/recipes-connectivity/hostapd/files/patches/99907-master-Add-hostapd_neighbor_set_own_report_pref.patch b/recipes-connectivity/hostapd/files/patches/99907-hostapd-mtk-Add-hostapd_neighbor_set_own_report_pref.patch
similarity index 100%
rename from recipes-connectivity/hostapd/files/patches/99907-master-Add-hostapd_neighbor_set_own_report_pref.patch
rename to recipes-connectivity/hostapd/files/patches/99907-hostapd-mtk-Add-hostapd_neighbor_set_own_report_pref.patch
diff --git a/recipes-connectivity/hostapd/files/patches/99908-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch b/recipes-connectivity/hostapd/files/patches/99908-hostapd-mtk-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch
similarity index 100%
rename from recipes-connectivity/hostapd/files/patches/99908-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch
rename to recipes-connectivity/hostapd/files/patches/99908-hostapd-mtk-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch
diff --git a/recipes-connectivity/hostapd/files/patches/99909-master-print-sae-groups-by-hostapd-ctrl.patch b/recipes-connectivity/hostapd/files/patches/99909-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
similarity index 100%
rename from recipes-connectivity/hostapd/files/patches/99909-master-print-sae-groups-by-hostapd-ctrl.patch
rename to recipes-connectivity/hostapd/files/patches/99909-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
diff --git a/recipes-connectivity/hostapd/files/patches/99910-master-hostapd-add-support-for-runtime-set-in-band-discove.patch b/recipes-connectivity/hostapd/files/patches/99910-hostapd-mtk-hostapd-add-support-for-runtime-set-in-band-discove.patch
similarity index 100%
rename from recipes-connectivity/hostapd/files/patches/99910-master-hostapd-add-support-for-runtime-set-in-band-discove.patch
rename to recipes-connectivity/hostapd/files/patches/99910-hostapd-mtk-hostapd-add-support-for-runtime-set-in-band-discove.patch
diff --git a/recipes-connectivity/hostapd/files/patches/99911-master-Add-mtk_vendor.h.patch b/recipes-connectivity/hostapd/files/patches/99911-hostapd-mtk-Add-mtk_vendor.h.patch
similarity index 100%
rename from recipes-connectivity/hostapd/files/patches/99911-master-Add-mtk_vendor.h.patch
rename to recipes-connectivity/hostapd/files/patches/99911-hostapd-mtk-Add-mtk_vendor.h.patch
diff --git a/recipes-connectivity/hostapd/files/patches/99912-master-Support-new-hostapd-configuration-edcca_enable-and-.patch b/recipes-connectivity/hostapd/files/patches/99912-hostapd-mtk-Support-new-hostapd-configuration-edcca_enable-and-.patch
similarity index 100%
rename from recipes-connectivity/hostapd/files/patches/99912-master-Support-new-hostapd-configuration-edcca_enable-and-.patch
rename to recipes-connectivity/hostapd/files/patches/99912-hostapd-mtk-Support-new-hostapd-configuration-edcca_enable-and-.patch
diff --git a/recipes-connectivity/hostapd/files/patches/99913-master-Add-hostapd-command-handler-for-SET_EDCCA-GET_EDCCA.patch b/recipes-connectivity/hostapd/files/patches/99913-hostapd-mtk-Add-hostapd-command-handler-for-SET_EDCCA-GET_EDCCA.patch
similarity index 100%
rename from recipes-connectivity/hostapd/files/patches/99913-master-Add-hostapd-command-handler-for-SET_EDCCA-GET_EDCCA.patch
rename to recipes-connectivity/hostapd/files/patches/99913-hostapd-mtk-Add-hostapd-command-handler-for-SET_EDCCA-GET_EDCCA.patch
diff --git a/recipes-connectivity/hostapd/files/patches/99914-master-Add-hostapd-HEMU-SET-GET-control.patch b/recipes-connectivity/hostapd/files/patches/99914-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
similarity index 100%
rename from recipes-connectivity/hostapd/files/patches/99914-master-Add-hostapd-HEMU-SET-GET-control.patch
rename to recipes-connectivity/hostapd/files/patches/99914-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
diff --git a/recipes-connectivity/hostapd/files/patches/99915-master-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch b/recipes-connectivity/hostapd/files/patches/99915-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch
similarity index 100%
rename from recipes-connectivity/hostapd/files/patches/99915-master-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch
rename to recipes-connectivity/hostapd/files/patches/99915-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch
diff --git a/recipes-connectivity/hostapd/files/patches/99916-master-Add-hostapd-iBF-control.patch b/recipes-connectivity/hostapd/files/patches/99916-hostapd-mtk-Add-hostapd-iBF-control.patch
similarity index 100%
rename from recipes-connectivity/hostapd/files/patches/99916-master-Add-hostapd-iBF-control.patch
rename to recipes-connectivity/hostapd/files/patches/99916-hostapd-mtk-Add-hostapd-iBF-control.patch
diff --git a/recipes-connectivity/hostapd/files/patches/99917-hostapd-mtk-Add-hostapd-AMPDU-AMSDU-control.patch b/recipes-connectivity/hostapd/files/patches/99917-hostapd-mtk-Add-hostapd-AMPDU-AMSDU-control.patch
new file mode 100644
index 0000000..b568620
--- /dev/null
+++ b/recipes-connectivity/hostapd/files/patches/99917-hostapd-mtk-Add-hostapd-AMPDU-AMSDU-control.patch
@@ -0,0 +1,482 @@
+From b58c77a1500824465bb3eb003a7b9be5d35d06f4 Mon Sep 17 00:00:00 2001
+From: TomLiu <tomml.liu@mediatek.com>
+Date: Wed, 21 Sep 2022 15:14:11 -0700
+Subject: [PATCH][MAC80211][hostapd][add hostapd AMPDU and AMSDU control command]
+
+---
+ hostapd/config_file.c             |  18 ++++
+ hostapd/ctrl_iface.c              |  44 ++++++++
+ hostapd/hostapd_cli.c             |   9 ++
+ src/ap/ap_config.c                |   2 +
+ src/ap/ap_config.h                |   2 +
+ src/ap/ap_drv_ops.c               |  23 ++++-
+ src/ap/ap_drv_ops.h               |   3 +
+ src/ap/hostapd.c                  |   4 +
+ src/common/mtk_vendor.h           |  18 ++++
+ src/drivers/driver.h              |  11 ++
+ src/drivers/driver_nl80211.c      | 160 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h      |   1 +
+ src/drivers/driver_nl80211_capa.c |   3 +
+ 13 files changed, 297 insertions(+), 1 deletion(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 50bb536..71d1a5a 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4777,6 +4777,24 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 	} else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
+ 		int val = atoi(pos);
+ 		conf->ibf_enable = !!val;
++	} else if (os_strcmp(buf, "ampdu") == 0) {
++		int val = atoi(pos);
++		if (val < 0 || val > 1) {
++			wpa_printf(MSG_ERROR,
++					 "Line %d: invalid ampdu value",
++					 line);
++			return 1;
++		}
++		conf->ampdu = val;
++	} else if (os_strcmp(buf, "amsdu") == 0) {
++		int val = atoi(pos);
++		if (val < 0 || val > 1) {
++			wpa_printf(MSG_ERROR,
++					 "Line %d: invalid amsdu value",
++					 line);
++			return 1;
++		}
++		conf->amsdu = val;
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			   "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 75bf6e6..41386ce 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3480,6 +3480,48 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
+ }
+ 
+ 
++static int
++hostapd_ctrl_iface_get_aggregation(struct hostapd_data *hapd, char *buf,
++					 size_t buflen)
++{
++	u8 aggr;
++	int ret;
++	char *pos, *end;
++
++	pos = buf;
++	end = buf + buflen;
++
++	if (hostapd_drv_aggregation_dump(hapd, &aggr) == 0) {
++		if (aggr == 0) {
++				hapd->iconf->ampdu = 0;
++				hapd->iconf->amsdu = 0;
++				ret = os_snprintf(pos, end - pos, "[hostapd_cli] AMPDU: %u, AMSDU disabled\n",
++					hapd->iconf->ampdu);
++		} else if (aggr == 1) {
++				hapd->iconf->ampdu = 0;
++				hapd->iconf->amsdu = 1;
++				ret = os_snprintf(pos, end - pos, "[hostapd_cli] AMPDU: %u, AMSDU disabled\n",
++					hapd->iconf->ampdu);
++		} else if (aggr == 2) {
++				hapd->iconf->ampdu = 1;
++				hapd->iconf->amsdu = 0;
++				ret = os_snprintf(pos, end - pos, "[hostapd_cli] AMPDU: %u, AMSDU: %u\n",
++					hapd->iconf->ampdu, hapd->iconf->amsdu);
++		} else if (aggr == 3) {
++				hapd->iconf->ampdu = 1;
++				hapd->iconf->amsdu = 1;
++				ret = os_snprintf(pos, end - pos, "[hostapd_cli] AMPDU: %u, AMSDU: %u\n",
++					hapd->iconf->ampdu, hapd->iconf->amsdu);
++		}
++	}
++
++	if (os_snprintf_error(end - pos, ret))
++		return 0;
++
++	return ret;
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+@@ -4027,6 +4069,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 		reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
+ 	} else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
+ 		reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
++	} else if (os_strncmp(buf, "GET_AGGR", 8) == 0) {
++		reply_len = hostapd_ctrl_iface_get_aggregation(hapd, reply, reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index e98a0a4..aa0bf58 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1584,6 +1584,13 @@ static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
+ }
+ 
+ 
++static int hostapd_cli_cmd_get_aggregation(struct wpa_ctrl *ctrl, int argc,
++					   char *argv[])
++{
++	return hostapd_cli_cmd(ctrl, "GET_AGGR", 0, NULL, NULL);
++}
++
++
+ struct hostapd_cli_cmd {
+ 	const char *cmd;
+ 	int (*handler)(struct wpa_ctrl *ctrl, int argc, char *argv[]);
+@@ -1783,6 +1790,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+           "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
+ 	{ "get_ibf", hostapd_cli_cmd_get_ibf, NULL,
+ 	  " = show iBF state (enabled/disabled)"},
++	{ "get_aggr", hostapd_cli_cmd_get_aggregation, NULL,
++		" = show AMPDU and AMSDU state"},
+ 	{ NULL, NULL, NULL, NULL }
+ };
+ 
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index f28aa65..6fc99b9 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -299,6 +299,8 @@ struct hostapd_config * hostapd_config_defaults(void)
+ 	conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
+ 	conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
+ 	conf->ibf_enable = IBF_DEFAULT_ENABLE;
++	conf->ampdu = 1;
++	conf->amsdu = 1;
+ 
+ 	return conf;
+ }
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 9c73e40..6f94fc6 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1155,6 +1155,8 @@ struct hostapd_config {
+ 	s8 edcca_compensation;
+ 	u8 three_wire_enable;
+ 	u8 ibf_enable;
++	u8 ampdu;
++	u8 amsdu;
+ };
+ 
+ enum three_wire_mode {
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 7b3af9c..48a6d71 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1059,4 +1059,25 @@ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
+ 	if (!hapd->driver || !hapd->driver->ibf_dump)
+ 		return 0;
+ 	return hapd->driver->ibf_dump(hapd->drv_priv, ibf_enable);
+-}
+\ No newline at end of file
++}
++
++int hostapd_drv_ampdu_ctrl(struct hostapd_data *hapd)
++{
++	if (!hapd->driver || !hapd->driver->ampdu_ctrl)
++		return 0;
++	return hapd->driver->ampdu_ctrl(hapd->drv_priv, hapd->iconf->ampdu);
++}
++
++int hostapd_drv_amsdu_ctrl(struct hostapd_data *hapd)
++{
++	if (!hapd->driver || !hapd->driver->amsdu_ctrl)
++		return 0;
++	return hapd->driver->amsdu_ctrl(hapd->drv_priv, hapd->iconf->amsdu);
++}
++
++int hostapd_drv_aggregation_dump(struct hostapd_data *hapd, u8 *aggr)
++{
++	if (!hapd->driver || !hapd->driver->aggregation_dump)
++		return 0;
++	return hapd->driver->aggregation_dump(hapd->drv_priv, aggr);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index da82382..4084901 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -144,6 +144,9 @@ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
+ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable);
++int hostapd_drv_ampdu_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_amsdu_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_aggregation_dump(struct hostapd_data *hapd, u8 *aggr);
+ 
+ #include "drivers/driver.h"
+ 
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index c8a76b2..4adad23 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2303,6 +2303,10 @@ dfs_offload:
+ 		goto fail;
+ 	if (hostapd_drv_ibf_ctrl(hapd) < 0)
+ 		goto fail;
++	if (hostapd_drv_ampdu_ctrl(hapd) < 0)
++		goto fail;
++	if (hostapd_drv_amsdu_ctrl(hapd) < 0)
++		goto fail;
+ 
+ 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ 		   iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index d6d04de..5568dab 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -170,6 +170,24 @@ enum mtk_vendor_attr_wireless_ctrl {
+ 		NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
+ };
+ 
++enum mtk_vendor_attr_wireless_dump {
++	MTK_VENDOR_ATTR_WIRELESS_DUMP_UNSPEC,
++
++	MTK_VENDOR_ATTR_WIRELESS_DUMP_AMPDU,
++	MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP,
++	MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX =
++		NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP - 1
++};
++
++static const struct nla_policy
++wireless_dump_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP] = {
++	[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMPDU] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU] = { .type = NLA_U8 },
++};
++
+ enum mtk_vendor_attr_rfeature_ctrl {
+ 	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
+ 
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 8ce11ba..449da42 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4708,6 +4708,17 @@ struct wpa_driver_ops {
+ 	 *
+ 	 */
+ 	int (*ibf_dump)(void *priv, u8 *ibf_enable);
++
++	/**
++	 * ampdu_ctrl - enable/disable ampdu
++	 * amsdu_ctrl - enable/disable amsdu
++	 * aggregation_dump - get current ampdu and amsdu status
++	 * @priv: Private driver interface data
++	 *
++	 */
++	int (*ampdu_ctrl)(void *priv, u8 ampdu);
++	int (*amsdu_ctrl)(void *priv, u8 amsdu);
++	int (*aggregation_dump)(void *priv, u8 *aggr);
+ };
+ 
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 8cac145..2e902e6 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12639,6 +12639,163 @@ fail:
+ 	return -ENOBUFS;
+ }
+ 
++static int nl80211_enable_ampdu(void *priv, u8 ampdu)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_wireless_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting ap wireless control");
++		return 0;
++	}
++
++	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
++	if (!msg)
++		goto fail;
++
++	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL))
++		goto fail;
++
++	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++	if (!data)
++		goto fail;
++
++	nla_put_u8(msg, MTK_VENDOR_ATTR_WIRELESS_CTRL_AMPDU, ampdu);
++
++	nla_nest_end(msg, data);
++	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to set ampdu. ret=%d (%s)", ret, strerror(-ret));
++	}
++
++	return ret;
++
++fail:
++	nlmsg_free(msg);
++	return -ENOBUFS;
++}
++
++static int nl80211_enable_amsdu(void *priv, u8 amsdu)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_wireless_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting ap wireless control");
++		return 0;
++	}
++
++	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
++	if (!msg)
++		goto fail;
++
++	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL))
++		goto fail;
++
++	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++	if (!data)
++		goto fail;
++
++	nla_put_u8(msg, MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU, amsdu);
++
++	nla_nest_end(msg, data);
++	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to set amsdu. ret=%d (%s)", ret, strerror(-ret));
++	}
++
++	return ret;
++
++fail:
++	nlmsg_free(msg);
++	return -ENOBUFS;
++}
++
++static int dump_aggregation_handler(struct nl_msg *msg, void *arg)
++{
++	u8 ampdu, amsdu;
++	u8 *aggr = (u8 *) arg;
++	struct nlattr *tb[NL80211_ATTR_MAX + 1];
++	struct nlattr *tb_vendor[MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX + 1];
++	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++	struct nlattr *nl_vend, *attr_ampdu, *attr_amsdu;
++
++	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++			genlmsg_attrlen(gnlh, 0), NULL);
++
++	nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++	if (!nl_vend)
++		return NL_SKIP;
++
++	nla_parse(tb_vendor, MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX,
++			nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++	attr_ampdu = tb_vendor[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMPDU];
++	attr_amsdu = tb_vendor[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU];
++	if (!attr_ampdu || !attr_amsdu ){
++		wpa_printf(MSG_ERROR, "nl80211: cannot find vendor attributes");
++		return NL_SKIP;
++	}
++
++	ampdu = nla_get_u8(attr_ampdu);
++	amsdu = nla_get_u8(attr_amsdu);
++
++	*aggr = (ampdu<<1) + amsdu;
++	return NL_SKIP;
++}
++
++static int
++nl80211_dump_aggregation(void *priv, u8 *aggr)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_wireless_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++				 "nl80211: Driver does not support ap_wireless control");
++		return 0;
++	}
++
++	msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR);
++	if (!msg)
++		goto fail;
++
++	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL))
++		goto fail;
++
++	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++	if (!data)
++		goto fail;
++
++	nla_nest_end(msg, data);
++
++	ret = send_and_recv_msgs(drv, msg, dump_aggregation_handler, aggr, NULL, NULL);
++
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to dump aggregation. ret=%d (%s)", ret, strerror(-ret));
++	}
++
++	return ret;
++
++fail:
++	nlmsg_free(msg);
++	return -ENOBUFS;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.name = "nl80211",
+ 	.desc = "Linux nl80211/cfg80211",
+@@ -12791,4 +12948,7 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.three_wire_ctrl = nl80211_enable_three_wire,
+ 	.ibf_ctrl = nl80211_ibf_enable,
+ 	.ibf_dump = nl80211_ibf_dump,
++	.ampdu_ctrl = nl80211_enable_ampdu,
++	.amsdu_ctrl = nl80211_enable_amsdu,
++	.aggregation_dump = nl80211_dump_aggregation,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 11dd93a..e5c151f 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -184,6 +184,7 @@ struct wpa_driver_nl80211_data {
+ 	unsigned int mtk_hemu_vendor_cmd_avail:1;
+ 	unsigned int mtk_3wire_vendor_cmd_avail:1;
+ 	unsigned int mtk_ibf_vendor_cmd_avail:1;
++	unsigned int mtk_wireless_vendor_cmd_avail:1;
+ 
+ 	u64 vendor_scan_cookie;
+ 	u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 8cf67fe..d97d64d 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1059,6 +1059,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ 				case MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL:
+ 					drv->mtk_ibf_vendor_cmd_avail = 1;
+ 					break;
++				case MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL:
++					drv->mtk_wireless_vendor_cmd_avail = 1;
++					break;
+ 				}
+ 			}
+ 
+-- 
+2.32.0
+
diff --git a/recipes-connectivity/hostapd/files/patches/99918-Do-not-include-HE-capab-IE-if-associated-sta-s-HE-c.patch b/recipes-connectivity/hostapd/files/patches/99918-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated-sta-s-HE-c.patch
similarity index 100%
rename from recipes-connectivity/hostapd/files/patches/99918-Do-not-include-HE-capab-IE-if-associated-sta-s-HE-c.patch
rename to recipes-connectivity/hostapd/files/patches/99918-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated-sta-s-HE-c.patch
diff --git a/recipes-connectivity/hostapd/files/patches/99919-hostapd-mtk-Add-DFS-disable-channel-switch-when-receive-radar.patch b/recipes-connectivity/hostapd/files/patches/99919-hostapd-mtk-Add-DFS-disable-channel-switch-when-receive-radar.patch
new file mode 100644
index 0000000..58e73b1
--- /dev/null
+++ b/recipes-connectivity/hostapd/files/patches/99919-hostapd-mtk-Add-DFS-disable-channel-switch-when-receive-radar.patch
@@ -0,0 +1,121 @@
+From d9361b85b289804c9a69f4ca3d2747ca17aaf6d5 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 7 Oct 2022 10:46:29 +0800
+Subject: [PATCH] Add DFS disable channel switch when receive radar
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/config_file.c |  4 ++++
+ hostapd/ctrl_iface.c  | 20 ++++++++++++++++++++
+ src/ap/ap_config.h    | 13 +++++++++++++
+ src/ap/dfs.c          | 10 ++++++++++
+ 4 files changed, 47 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 310f97d..a2ee418 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4807,6 +4807,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 			return 1;
+ 		}
+ 		conf->amsdu = val;
++	} else if (os_strcmp(buf, "dfs_detect_mode") == 0) { /*bypass channel switch*/
++		u8 en = strtol(pos, NULL, 10);
++
++		conf->dfs_detect_mode = en;
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			   "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 0c40175..cc440fd 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3537,6 +3537,26 @@ hostapd_ctrl_iface_get_aggregation(struct hostapd_data *hapd, char *buf,
+ }
+ 
+ 
++static int
++hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
++				       char *buf, size_t buflen)
++{
++	u8 dfs_detect_mode;
++
++	if (!value)
++		return -1;
++
++	dfs_detect_mode = strtol(value, NULL, 10);
++	if (dfs_detect_mode > DFS_DETECT_MODE_MAX) {
++		wpa_printf(MSG_ERROR, "Invalid value for dfs detect mode");
++		return -1;
++	}
++	hapd->iconf->dfs_detect_mode = dfs_detect_mode;
++
++	return 0;
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 01b051d..f567c37 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1160,6 +1160,7 @@ struct hostapd_config {
+ 	u8 ibf_enable;
+ 	u8 ampdu;
+ 	u8 amsdu;
++	u8 dfs_detect_mode;
+ };
+ 
+ enum three_wire_mode {
+@@ -1174,6 +1175,18 @@ enum three_wire_mode {
+ 		NUM_THREE_WIRE_MODE - 1
+ };
+ 
++enum dfs_mode {
++	DFS_DETECT_MODE_DISABLE,
++	DFS_DETECT_MODE_AP_ENABLE,
++	DFS_DETECT_MODE_BACKGROUND_ENABLE,
++	DFS_DETECT_MODE_ALL_ENABLE,
++
++	/* keep last */
++	NUM_DFS_DETECT_MODE,
++	DFS_DETECT_MODE_MAX =
++		NUM_DFS_DETECT_MODE - 1
++};
++
+ enum edcca_mode {
+ 	EDCCA_MODE_FORCE_DISABLE = 0,
+ 	EDCCA_MODE_AUTO = 1,
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index b5d105d..5cb7799 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1317,6 +1317,11 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
+ 		   __func__, iface->radar_background.cac_started ? "yes" : "no",
+ 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
+ 
++	/* Skip channel switch when background dfs detect mode is on */
++	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_BACKGROUND_ENABLE ||
++	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++		return 0;
++
+ 	/* Check if CSA in progress */
+ 	if (hostapd_csa_in_progress(iface))
+ 		return 0;
+@@ -1365,6 +1370,11 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
+ 		   __func__, iface->cac_started ? "yes" : "no",
+ 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
+ 
++	/* Skip channel switch when dfs detect mode is on */
++	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_AP_ENABLE ||
++	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++		return 0;
++
+ 	/* Check if CSA in progress */
+ 	if (hostapd_csa_in_progress(iface))
+ 		return 0;
+-- 
+2.18.0
+
diff --git a/recipes-connectivity/hostapd/files/patches/patches.inc b/recipes-connectivity/hostapd/files/patches/patches.inc
index b9bb1ba..d8693e4 100644
--- a/recipes-connectivity/hostapd/files/patches/patches.inc
+++ b/recipes-connectivity/hostapd/files/patches/patches.inc
@@ -53,22 +53,24 @@
     file://800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch \
     file://990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch \
     file://992-openssl-include-rsa.patch \
-    file://99900-master-Add-hostapd_neighbor_count-and-hostapd_neighbor_ins.patch \
-    file://99901-master-Support-including-neighbor-report-elements-in-ANQP-.patch \
-    file://99902-master-Support-including-neignbor-report-elements-in-BTM-r.patch \
-    file://99903-master-Support-configuring-BSS-Termination-TSF-by-using-ho.patch \
-    file://99904-master-Disable-interface-if-BSS-Termination-TSF-is-set.patch \
-    file://99905-master-Add-set_send_disassoc_frame_timer-to-send-disassoci.patch \
-    file://99906-master-Support-including-neighbor-report-elements-in-BTM-r.patch \
-    file://99907-master-Add-hostapd_neighbor_set_own_report_pref.patch \
-    file://99908-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch \
-    file://99909-master-print-sae-groups-by-hostapd-ctrl.patch \
-    file://99910-master-hostapd-add-support-for-runtime-set-in-band-discove.patch \
-    file://99911-master-Add-mtk_vendor.h.patch \
-    file://99912-master-Support-new-hostapd-configuration-edcca_enable-and-.patch \
-    file://99913-master-Add-hostapd-command-handler-for-SET_EDCCA-GET_EDCCA.patch \
-    file://99914-master-Add-hostapd-HEMU-SET-GET-control.patch \
-    file://99915-master-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch \
-    file://99916-master-Add-hostapd-iBF-control.patch \
-    file://99918-Do-not-include-HE-capab-IE-if-associated-sta-s-HE-c.patch \
+    file://99900-hostapd-mtk-Add-hostapd_neighbor_count-and-hostapd_neighbor_ins.patch \
+    file://99901-hostapd-mtk-Support-including-neighbor-report-elements-in-ANQP-.patch \
+    file://99902-hostapd-mtk-Support-including-neignbor-report-elements-in-BTM-r.patch \
+    file://99903-hostapd-mtk-Support-configuring-BSS-Termination-TSF-by-using-ho.patch \
+    file://99904-hostapd-mtk-Disable-interface-if-BSS-Termination-TSF-is-set.patch \
+    file://99905-hostapd-mtk-Add-set_send_disassoc_frame_timer-to-send-disassoci.patch \
+    file://99906-hostapd-mtk-Support-including-neighbor-report-elements-in-BTM-r.patch \
+    file://99907-hostapd-mtk-Add-hostapd_neighbor_set_own_report_pref.patch \
+    file://99908-hostapd-mtk-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch \
+    file://99909-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch \
+    file://99910-hostapd-mtk-hostapd-add-support-for-runtime-set-in-band-discove.patch \
+    file://99911-hostapd-mtk-Add-mtk_vendor.h.patch \
+    file://99912-hostapd-mtk-Support-new-hostapd-configuration-edcca_enable-and-.patch \
+    file://99913-hostapd-mtk-Add-hostapd-command-handler-for-SET_EDCCA-GET_EDCCA.patch \
+    file://99914-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch \
+    file://99915-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch \
+    file://99916-hostapd-mtk-Add-hostapd-iBF-control.patch \
+    file://99917-hostapd-mtk-Add-hostapd-AMPDU-AMSDU-control.patch \
+    file://99918-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated-sta-s-HE-c.patch \
+    file://99919-hostapd-mtk-Add-DFS-disable-channel-switch-when-receive-radar.patch \
     "
diff --git a/recipes-connectivity/libnl-tiny/libnl-tiny_git.bb b/recipes-connectivity/libnl-tiny/libnl-tiny_git.bb
index f35921a..d0ba98a 100644
--- a/recipes-connectivity/libnl-tiny/libnl-tiny_git.bb
+++ b/recipes-connectivity/libnl-tiny/libnl-tiny_git.bb
@@ -5,7 +5,7 @@
 SECTION = "libs"
 
 SRC_URI = "git://git.openwrt.org/project/libnl-tiny.git"
-SRCREV = "b5b2ba09c4f1c8b3c21580aea7223edc2f5e92be"
+SRCREV = "28c44ca97cd546ef8168e7476472a0da022b3421"
 PV = "git${SRCPV}"
 
 inherit cmake pkgconfig
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/99900-master-Add-hostapd_neighbor_count-and-hostapd_neighbor_ins.patch b/recipes-connectivity/wpa-supplicant/files/patches/99900-hostapd-mtk-Add-hostapd_neighbor_count-and-hostapd_neighbor_ins.patch
similarity index 100%
rename from recipes-connectivity/wpa-supplicant/files/patches/99900-master-Add-hostapd_neighbor_count-and-hostapd_neighbor_ins.patch
rename to recipes-connectivity/wpa-supplicant/files/patches/99900-hostapd-mtk-Add-hostapd_neighbor_count-and-hostapd_neighbor_ins.patch
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/99901-master-Support-including-neighbor-report-elements-in-ANQP-.patch b/recipes-connectivity/wpa-supplicant/files/patches/99901-hostapd-mtk-Support-including-neighbor-report-elements-in-ANQP-.patch
similarity index 100%
rename from recipes-connectivity/wpa-supplicant/files/patches/99901-master-Support-including-neighbor-report-elements-in-ANQP-.patch
rename to recipes-connectivity/wpa-supplicant/files/patches/99901-hostapd-mtk-Support-including-neighbor-report-elements-in-ANQP-.patch
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/99902-master-Support-including-neignbor-report-elements-in-BTM-r.patch b/recipes-connectivity/wpa-supplicant/files/patches/99902-hostapd-mtk-Support-including-neignbor-report-elements-in-BTM-r.patch
similarity index 100%
rename from recipes-connectivity/wpa-supplicant/files/patches/99902-master-Support-including-neignbor-report-elements-in-BTM-r.patch
rename to recipes-connectivity/wpa-supplicant/files/patches/99902-hostapd-mtk-Support-including-neignbor-report-elements-in-BTM-r.patch
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/99903-master-Support-configuring-BSS-Termination-TSF-by-using-ho.patch b/recipes-connectivity/wpa-supplicant/files/patches/99903-hostapd-mtk-Support-configuring-BSS-Termination-TSF-by-using-ho.patch
similarity index 100%
rename from recipes-connectivity/wpa-supplicant/files/patches/99903-master-Support-configuring-BSS-Termination-TSF-by-using-ho.patch
rename to recipes-connectivity/wpa-supplicant/files/patches/99903-hostapd-mtk-Support-configuring-BSS-Termination-TSF-by-using-ho.patch
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/99904-master-Disable-interface-if-BSS-Termination-TSF-is-set.patch b/recipes-connectivity/wpa-supplicant/files/patches/99904-hostapd-mtk-Disable-interface-if-BSS-Termination-TSF-is-set.patch
similarity index 100%
rename from recipes-connectivity/wpa-supplicant/files/patches/99904-master-Disable-interface-if-BSS-Termination-TSF-is-set.patch
rename to recipes-connectivity/wpa-supplicant/files/patches/99904-hostapd-mtk-Disable-interface-if-BSS-Termination-TSF-is-set.patch
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/99905-master-Add-set_send_disassoc_frame_timer-to-send-disassoci.patch b/recipes-connectivity/wpa-supplicant/files/patches/99905-hostapd-mtk-Add-set_send_disassoc_frame_timer-to-send-disassoci.patch
similarity index 100%
rename from recipes-connectivity/wpa-supplicant/files/patches/99905-master-Add-set_send_disassoc_frame_timer-to-send-disassoci.patch
rename to recipes-connectivity/wpa-supplicant/files/patches/99905-hostapd-mtk-Add-set_send_disassoc_frame_timer-to-send-disassoci.patch
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/99906-master-Support-including-neighbor-report-elements-in-BTM-r.patch b/recipes-connectivity/wpa-supplicant/files/patches/99906-hostapd-mtk-Support-including-neighbor-report-elements-in-BTM-r.patch
similarity index 100%
rename from recipes-connectivity/wpa-supplicant/files/patches/99906-master-Support-including-neighbor-report-elements-in-BTM-r.patch
rename to recipes-connectivity/wpa-supplicant/files/patches/99906-hostapd-mtk-Support-including-neighbor-report-elements-in-BTM-r.patch
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/99907-master-Add-hostapd_neighbor_set_own_report_pref.patch b/recipes-connectivity/wpa-supplicant/files/patches/99907-hostapd-mtk-Add-hostapd_neighbor_set_own_report_pref.patch
similarity index 100%
rename from recipes-connectivity/wpa-supplicant/files/patches/99907-master-Add-hostapd_neighbor_set_own_report_pref.patch
rename to recipes-connectivity/wpa-supplicant/files/patches/99907-hostapd-mtk-Add-hostapd_neighbor_set_own_report_pref.patch
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/99908-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch b/recipes-connectivity/wpa-supplicant/files/patches/99908-hostapd-mtk-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch
similarity index 100%
rename from recipes-connectivity/wpa-supplicant/files/patches/99908-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch
rename to recipes-connectivity/wpa-supplicant/files/patches/99908-hostapd-mtk-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/99909-master-print-sae-groups-by-hostapd-ctrl.patch b/recipes-connectivity/wpa-supplicant/files/patches/99909-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
similarity index 100%
rename from recipes-connectivity/wpa-supplicant/files/patches/99909-master-print-sae-groups-by-hostapd-ctrl.patch
rename to recipes-connectivity/wpa-supplicant/files/patches/99909-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/99910-master-hostapd-add-support-for-runtime-set-in-band-discove.patch b/recipes-connectivity/wpa-supplicant/files/patches/99910-hostapd-mtk-hostapd-add-support-for-runtime-set-in-band-discove.patch
similarity index 100%
rename from recipes-connectivity/wpa-supplicant/files/patches/99910-master-hostapd-add-support-for-runtime-set-in-band-discove.patch
rename to recipes-connectivity/wpa-supplicant/files/patches/99910-hostapd-mtk-hostapd-add-support-for-runtime-set-in-band-discove.patch
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/99911-master-Add-mtk_vendor.h.patch b/recipes-connectivity/wpa-supplicant/files/patches/99911-hostapd-mtk-Add-mtk_vendor.h.patch
similarity index 100%
rename from recipes-connectivity/wpa-supplicant/files/patches/99911-master-Add-mtk_vendor.h.patch
rename to recipes-connectivity/wpa-supplicant/files/patches/99911-hostapd-mtk-Add-mtk_vendor.h.patch
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/99912-master-Support-new-hostapd-configuration-edcca_enable-and-.patch b/recipes-connectivity/wpa-supplicant/files/patches/99912-hostapd-mtk-Support-new-hostapd-configuration-edcca_enable-and-.patch
similarity index 100%
rename from recipes-connectivity/wpa-supplicant/files/patches/99912-master-Support-new-hostapd-configuration-edcca_enable-and-.patch
rename to recipes-connectivity/wpa-supplicant/files/patches/99912-hostapd-mtk-Support-new-hostapd-configuration-edcca_enable-and-.patch
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/99913-master-Add-hostapd-command-handler-for-SET_EDCCA-GET_EDCCA.patch b/recipes-connectivity/wpa-supplicant/files/patches/99913-hostapd-mtk-Add-hostapd-command-handler-for-SET_EDCCA-GET_EDCCA.patch
similarity index 100%
rename from recipes-connectivity/wpa-supplicant/files/patches/99913-master-Add-hostapd-command-handler-for-SET_EDCCA-GET_EDCCA.patch
rename to recipes-connectivity/wpa-supplicant/files/patches/99913-hostapd-mtk-Add-hostapd-command-handler-for-SET_EDCCA-GET_EDCCA.patch
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/99914-master-Add-hostapd-HEMU-SET-GET-control.patch b/recipes-connectivity/wpa-supplicant/files/patches/99914-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
similarity index 100%
rename from recipes-connectivity/wpa-supplicant/files/patches/99914-master-Add-hostapd-HEMU-SET-GET-control.patch
rename to recipes-connectivity/wpa-supplicant/files/patches/99914-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/99915-master-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch b/recipes-connectivity/wpa-supplicant/files/patches/99915-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch
similarity index 100%
rename from recipes-connectivity/wpa-supplicant/files/patches/99915-master-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch
rename to recipes-connectivity/wpa-supplicant/files/patches/99915-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/99916-master-Add-hostapd-iBF-control.patch b/recipes-connectivity/wpa-supplicant/files/patches/99916-hostapd-mtk-Add-hostapd-iBF-control.patch
similarity index 100%
rename from recipes-connectivity/wpa-supplicant/files/patches/99916-master-Add-hostapd-iBF-control.patch
rename to recipes-connectivity/wpa-supplicant/files/patches/99916-hostapd-mtk-Add-hostapd-iBF-control.patch
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/99917-hostapd-mtk-Add-hostapd-AMPDU-AMSDU-control.patch b/recipes-connectivity/wpa-supplicant/files/patches/99917-hostapd-mtk-Add-hostapd-AMPDU-AMSDU-control.patch
new file mode 100644
index 0000000..b568620
--- /dev/null
+++ b/recipes-connectivity/wpa-supplicant/files/patches/99917-hostapd-mtk-Add-hostapd-AMPDU-AMSDU-control.patch
@@ -0,0 +1,482 @@
+From b58c77a1500824465bb3eb003a7b9be5d35d06f4 Mon Sep 17 00:00:00 2001
+From: TomLiu <tomml.liu@mediatek.com>
+Date: Wed, 21 Sep 2022 15:14:11 -0700
+Subject: [PATCH][MAC80211][hostapd][add hostapd AMPDU and AMSDU control command]
+
+---
+ hostapd/config_file.c             |  18 ++++
+ hostapd/ctrl_iface.c              |  44 ++++++++
+ hostapd/hostapd_cli.c             |   9 ++
+ src/ap/ap_config.c                |   2 +
+ src/ap/ap_config.h                |   2 +
+ src/ap/ap_drv_ops.c               |  23 ++++-
+ src/ap/ap_drv_ops.h               |   3 +
+ src/ap/hostapd.c                  |   4 +
+ src/common/mtk_vendor.h           |  18 ++++
+ src/drivers/driver.h              |  11 ++
+ src/drivers/driver_nl80211.c      | 160 ++++++++++++++++++++++++++++++
+ src/drivers/driver_nl80211.h      |   1 +
+ src/drivers/driver_nl80211_capa.c |   3 +
+ 13 files changed, 297 insertions(+), 1 deletion(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 50bb536..71d1a5a 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4777,6 +4777,24 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 	} else if (os_strcmp(buf, "ibf_enable") == 0) { /*ibf setting is per device*/
+ 		int val = atoi(pos);
+ 		conf->ibf_enable = !!val;
++	} else if (os_strcmp(buf, "ampdu") == 0) {
++		int val = atoi(pos);
++		if (val < 0 || val > 1) {
++			wpa_printf(MSG_ERROR,
++					 "Line %d: invalid ampdu value",
++					 line);
++			return 1;
++		}
++		conf->ampdu = val;
++	} else if (os_strcmp(buf, "amsdu") == 0) {
++		int val = atoi(pos);
++		if (val < 0 || val > 1) {
++			wpa_printf(MSG_ERROR,
++					 "Line %d: invalid amsdu value",
++					 line);
++			return 1;
++		}
++		conf->amsdu = val;
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			   "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 75bf6e6..41386ce 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3480,6 +3480,48 @@ hostapd_ctrl_iface_get_ibf(struct hostapd_data *hapd, char *buf,
+ }
+ 
+ 
++static int
++hostapd_ctrl_iface_get_aggregation(struct hostapd_data *hapd, char *buf,
++					 size_t buflen)
++{
++	u8 aggr;
++	int ret;
++	char *pos, *end;
++
++	pos = buf;
++	end = buf + buflen;
++
++	if (hostapd_drv_aggregation_dump(hapd, &aggr) == 0) {
++		if (aggr == 0) {
++				hapd->iconf->ampdu = 0;
++				hapd->iconf->amsdu = 0;
++				ret = os_snprintf(pos, end - pos, "[hostapd_cli] AMPDU: %u, AMSDU disabled\n",
++					hapd->iconf->ampdu);
++		} else if (aggr == 1) {
++				hapd->iconf->ampdu = 0;
++				hapd->iconf->amsdu = 1;
++				ret = os_snprintf(pos, end - pos, "[hostapd_cli] AMPDU: %u, AMSDU disabled\n",
++					hapd->iconf->ampdu);
++		} else if (aggr == 2) {
++				hapd->iconf->ampdu = 1;
++				hapd->iconf->amsdu = 0;
++				ret = os_snprintf(pos, end - pos, "[hostapd_cli] AMPDU: %u, AMSDU: %u\n",
++					hapd->iconf->ampdu, hapd->iconf->amsdu);
++		} else if (aggr == 3) {
++				hapd->iconf->ampdu = 1;
++				hapd->iconf->amsdu = 1;
++				ret = os_snprintf(pos, end - pos, "[hostapd_cli] AMPDU: %u, AMSDU: %u\n",
++					hapd->iconf->ampdu, hapd->iconf->amsdu);
++		}
++	}
++
++	if (os_snprintf_error(end - pos, ret))
++		return 0;
++
++	return ret;
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+@@ -4027,6 +4069,8 @@ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 		reply_len = hostapd_ctrl_iface_get_hemu(hapd, reply, reply_size);
+ 	} else if (os_strncmp(buf, "GET_IBF", 7) == 0) {
+ 		reply_len = hostapd_ctrl_iface_get_ibf(hapd, reply, reply_size);
++	} else if (os_strncmp(buf, "GET_AGGR", 8) == 0) {
++		reply_len = hostapd_ctrl_iface_get_aggregation(hapd, reply, reply_size);
+ 	} else {
+ 		os_memcpy(reply, "UNKNOWN COMMAND\n", 16);
+ 		reply_len = 16;
+diff --git a/hostapd/hostapd_cli.c b/hostapd/hostapd_cli.c
+index e98a0a4..aa0bf58 100644
+--- a/hostapd/hostapd_cli.c
++++ b/hostapd/hostapd_cli.c
+@@ -1584,6 +1584,13 @@ static int hostapd_cli_cmd_get_ibf(struct wpa_ctrl *ctrl, int argc,
+ }
+ 
+ 
++static int hostapd_cli_cmd_get_aggregation(struct wpa_ctrl *ctrl, int argc,
++					   char *argv[])
++{
++	return hostapd_cli_cmd(ctrl, "GET_AGGR", 0, NULL, NULL);
++}
++
++
+ struct hostapd_cli_cmd {
+ 	const char *cmd;
+ 	int (*handler)(struct wpa_ctrl *ctrl, int argc, char *argv[]);
+@@ -1783,6 +1790,8 @@ static const struct hostapd_cli_cmd hostapd_cli_commands[] = {
+           "<tx type(0/1/2)> <interval> = runtime set inband discovery" },
+ 	{ "get_ibf", hostapd_cli_cmd_get_ibf, NULL,
+ 	  " = show iBF state (enabled/disabled)"},
++	{ "get_aggr", hostapd_cli_cmd_get_aggregation, NULL,
++		" = show AMPDU and AMSDU state"},
+ 	{ NULL, NULL, NULL, NULL }
+ };
+ 
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index f28aa65..6fc99b9 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -299,6 +299,8 @@ struct hostapd_config * hostapd_config_defaults(void)
+ 	conf->edcca_compensation = EDCCA_DEFAULT_COMPENSATION;
+ 	conf->three_wire_enable = THREE_WIRE_MODE_DISABLE;
+ 	conf->ibf_enable = IBF_DEFAULT_ENABLE;
++	conf->ampdu = 1;
++	conf->amsdu = 1;
+ 
+ 	return conf;
+ }
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 9c73e40..6f94fc6 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1155,6 +1155,8 @@ struct hostapd_config {
+ 	s8 edcca_compensation;
+ 	u8 three_wire_enable;
+ 	u8 ibf_enable;
++	u8 ampdu;
++	u8 amsdu;
+ };
+ 
+ enum three_wire_mode {
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index 7b3af9c..48a6d71 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1059,4 +1059,25 @@ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable)
+ 	if (!hapd->driver || !hapd->driver->ibf_dump)
+ 		return 0;
+ 	return hapd->driver->ibf_dump(hapd->drv_priv, ibf_enable);
+-}
+\ No newline at end of file
++}
++
++int hostapd_drv_ampdu_ctrl(struct hostapd_data *hapd)
++{
++	if (!hapd->driver || !hapd->driver->ampdu_ctrl)
++		return 0;
++	return hapd->driver->ampdu_ctrl(hapd->drv_priv, hapd->iconf->ampdu);
++}
++
++int hostapd_drv_amsdu_ctrl(struct hostapd_data *hapd)
++{
++	if (!hapd->driver || !hapd->driver->amsdu_ctrl)
++		return 0;
++	return hapd->driver->amsdu_ctrl(hapd->drv_priv, hapd->iconf->amsdu);
++}
++
++int hostapd_drv_aggregation_dump(struct hostapd_data *hapd, u8 *aggr)
++{
++	if (!hapd->driver || !hapd->driver->aggregation_dump)
++		return 0;
++	return hapd->driver->aggregation_dump(hapd->drv_priv, aggr);
++}
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index da82382..4084901 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -144,6 +144,9 @@ int hostapd_drv_hemu_dump(struct hostapd_data *hapd, u8 *hemu_onoff);
+ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_ibf_dump(struct hostapd_data *hapd, u8 *ibf_enable);
++int hostapd_drv_ampdu_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_amsdu_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_aggregation_dump(struct hostapd_data *hapd, u8 *aggr);
+ 
+ #include "drivers/driver.h"
+ 
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index c8a76b2..4adad23 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2303,6 +2303,10 @@ dfs_offload:
+ 		goto fail;
+ 	if (hostapd_drv_ibf_ctrl(hapd) < 0)
+ 		goto fail;
++	if (hostapd_drv_ampdu_ctrl(hapd) < 0)
++		goto fail;
++	if (hostapd_drv_amsdu_ctrl(hapd) < 0)
++		goto fail;
+ 
+ 	wpa_printf(MSG_DEBUG, "%s: Setup of interface done.",
+ 		   iface->bss[0]->conf->iface);
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index d6d04de..5568dab 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -170,6 +170,24 @@ enum mtk_vendor_attr_wireless_ctrl {
+ 		NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
+ };
+ 
++enum mtk_vendor_attr_wireless_dump {
++	MTK_VENDOR_ATTR_WIRELESS_DUMP_UNSPEC,
++
++	MTK_VENDOR_ATTR_WIRELESS_DUMP_AMPDU,
++	MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP,
++	MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX =
++		NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP - 1
++};
++
++static const struct nla_policy
++wireless_dump_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP] = {
++	[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMPDU] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU] = { .type = NLA_U8 },
++};
++
+ enum mtk_vendor_attr_rfeature_ctrl {
+ 	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
+ 
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 8ce11ba..449da42 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4708,6 +4708,17 @@ struct wpa_driver_ops {
+ 	 *
+ 	 */
+ 	int (*ibf_dump)(void *priv, u8 *ibf_enable);
++
++	/**
++	 * ampdu_ctrl - enable/disable ampdu
++	 * amsdu_ctrl - enable/disable amsdu
++	 * aggregation_dump - get current ampdu and amsdu status
++	 * @priv: Private driver interface data
++	 *
++	 */
++	int (*ampdu_ctrl)(void *priv, u8 ampdu);
++	int (*amsdu_ctrl)(void *priv, u8 amsdu);
++	int (*aggregation_dump)(void *priv, u8 *aggr);
+ };
+ 
+ /**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 8cac145..2e902e6 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12639,6 +12639,163 @@ fail:
+ 	return -ENOBUFS;
+ }
+ 
++static int nl80211_enable_ampdu(void *priv, u8 ampdu)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_wireless_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting ap wireless control");
++		return 0;
++	}
++
++	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
++	if (!msg)
++		goto fail;
++
++	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL))
++		goto fail;
++
++	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++	if (!data)
++		goto fail;
++
++	nla_put_u8(msg, MTK_VENDOR_ATTR_WIRELESS_CTRL_AMPDU, ampdu);
++
++	nla_nest_end(msg, data);
++	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to set ampdu. ret=%d (%s)", ret, strerror(-ret));
++	}
++
++	return ret;
++
++fail:
++	nlmsg_free(msg);
++	return -ENOBUFS;
++}
++
++static int nl80211_enable_amsdu(void *priv, u8 amsdu)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_wireless_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++			   "nl80211: Driver does not support setting ap wireless control");
++		return 0;
++	}
++
++	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
++	if (!msg)
++		goto fail;
++
++	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL))
++		goto fail;
++
++	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++	if (!data)
++		goto fail;
++
++	nla_put_u8(msg, MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU, amsdu);
++
++	nla_nest_end(msg, data);
++	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to set amsdu. ret=%d (%s)", ret, strerror(-ret));
++	}
++
++	return ret;
++
++fail:
++	nlmsg_free(msg);
++	return -ENOBUFS;
++}
++
++static int dump_aggregation_handler(struct nl_msg *msg, void *arg)
++{
++	u8 ampdu, amsdu;
++	u8 *aggr = (u8 *) arg;
++	struct nlattr *tb[NL80211_ATTR_MAX + 1];
++	struct nlattr *tb_vendor[MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX + 1];
++	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
++	struct nlattr *nl_vend, *attr_ampdu, *attr_amsdu;
++
++	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
++			genlmsg_attrlen(gnlh, 0), NULL);
++
++	nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
++	if (!nl_vend)
++		return NL_SKIP;
++
++	nla_parse(tb_vendor, MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX,
++			nla_data(nl_vend), nla_len(nl_vend), NULL);
++
++	attr_ampdu = tb_vendor[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMPDU];
++	attr_amsdu = tb_vendor[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU];
++	if (!attr_ampdu || !attr_amsdu ){
++		wpa_printf(MSG_ERROR, "nl80211: cannot find vendor attributes");
++		return NL_SKIP;
++	}
++
++	ampdu = nla_get_u8(attr_ampdu);
++	amsdu = nla_get_u8(attr_amsdu);
++
++	*aggr = (ampdu<<1) + amsdu;
++	return NL_SKIP;
++}
++
++static int
++nl80211_dump_aggregation(void *priv, u8 *aggr)
++{
++	struct i802_bss *bss = priv;
++	struct wpa_driver_nl80211_data *drv = bss->drv;
++	struct nl_msg *msg;
++	struct nlattr *data;
++	int ret;
++
++	if (!drv->mtk_wireless_vendor_cmd_avail) {
++		wpa_printf(MSG_INFO,
++				 "nl80211: Driver does not support ap_wireless control");
++		return 0;
++	}
++
++	msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_VENDOR);
++	if (!msg)
++		goto fail;
++
++	if (nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
++		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL))
++		goto fail;
++
++	data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
++	if (!data)
++		goto fail;
++
++	nla_nest_end(msg, data);
++
++	ret = send_and_recv_msgs(drv, msg, dump_aggregation_handler, aggr, NULL, NULL);
++
++	if (ret) {
++		wpa_printf(MSG_ERROR, "Failed to dump aggregation. ret=%d (%s)", ret, strerror(-ret));
++	}
++
++	return ret;
++
++fail:
++	nlmsg_free(msg);
++	return -ENOBUFS;
++}
++
+ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.name = "nl80211",
+ 	.desc = "Linux nl80211/cfg80211",
+@@ -12791,4 +12948,7 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.three_wire_ctrl = nl80211_enable_three_wire,
+ 	.ibf_ctrl = nl80211_ibf_enable,
+ 	.ibf_dump = nl80211_ibf_dump,
++	.ampdu_ctrl = nl80211_enable_ampdu,
++	.amsdu_ctrl = nl80211_enable_amsdu,
++	.aggregation_dump = nl80211_dump_aggregation,
+ };
+diff --git a/src/drivers/driver_nl80211.h b/src/drivers/driver_nl80211.h
+index 11dd93a..e5c151f 100644
+--- a/src/drivers/driver_nl80211.h
++++ b/src/drivers/driver_nl80211.h
+@@ -184,6 +184,7 @@ struct wpa_driver_nl80211_data {
+ 	unsigned int mtk_hemu_vendor_cmd_avail:1;
+ 	unsigned int mtk_3wire_vendor_cmd_avail:1;
+ 	unsigned int mtk_ibf_vendor_cmd_avail:1;
++	unsigned int mtk_wireless_vendor_cmd_avail:1;
+ 
+ 	u64 vendor_scan_cookie;
+ 	u64 remain_on_chan_cookie;
+diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
+index 8cf67fe..d97d64d 100644
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1059,6 +1059,9 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
+ 				case MTK_NL80211_VENDOR_SUBCMD_IBF_CTRL:
+ 					drv->mtk_ibf_vendor_cmd_avail = 1;
+ 					break;
++				case MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL:
++					drv->mtk_wireless_vendor_cmd_avail = 1;
++					break;
+ 				}
+ 			}
+ 
+-- 
+2.32.0
+
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/99918-Do-not-include-HE-capab-IE-if-associated-sta-s-HE-c.patch b/recipes-connectivity/wpa-supplicant/files/patches/99918-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated-sta-s-HE-c.patch
similarity index 100%
rename from recipes-connectivity/wpa-supplicant/files/patches/99918-Do-not-include-HE-capab-IE-if-associated-sta-s-HE-c.patch
rename to recipes-connectivity/wpa-supplicant/files/patches/99918-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated-sta-s-HE-c.patch
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/99919-hostapd-mtk-Add-DFS-disable-channel-switch-when-receive-radar.patch b/recipes-connectivity/wpa-supplicant/files/patches/99919-hostapd-mtk-Add-DFS-disable-channel-switch-when-receive-radar.patch
new file mode 100644
index 0000000..58e73b1
--- /dev/null
+++ b/recipes-connectivity/wpa-supplicant/files/patches/99919-hostapd-mtk-Add-DFS-disable-channel-switch-when-receive-radar.patch
@@ -0,0 +1,121 @@
+From d9361b85b289804c9a69f4ca3d2747ca17aaf6d5 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 7 Oct 2022 10:46:29 +0800
+Subject: [PATCH] Add DFS disable channel switch when receive radar
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ hostapd/config_file.c |  4 ++++
+ hostapd/ctrl_iface.c  | 20 ++++++++++++++++++++
+ src/ap/ap_config.h    | 13 +++++++++++++
+ src/ap/dfs.c          | 10 ++++++++++
+ 4 files changed, 47 insertions(+)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 310f97d..a2ee418 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -4807,6 +4807,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 			return 1;
+ 		}
+ 		conf->amsdu = val;
++	} else if (os_strcmp(buf, "dfs_detect_mode") == 0) { /*bypass channel switch*/
++		u8 en = strtol(pos, NULL, 10);
++
++		conf->dfs_detect_mode = en;
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			   "Line %d: unknown configuration item '%s'",
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index 0c40175..cc440fd 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3537,6 +3537,26 @@ hostapd_ctrl_iface_get_aggregation(struct hostapd_data *hapd, char *buf,
+ }
+ 
+ 
++static int
++hostapd_ctrl_iface_set_dfs_detect_mode(struct hostapd_data *hapd, char *value,
++				       char *buf, size_t buflen)
++{
++	u8 dfs_detect_mode;
++
++	if (!value)
++		return -1;
++
++	dfs_detect_mode = strtol(value, NULL, 10);
++	if (dfs_detect_mode > DFS_DETECT_MODE_MAX) {
++		wpa_printf(MSG_ERROR, "Invalid value for dfs detect mode");
++		return -1;
++	}
++	hapd->iconf->dfs_detect_mode = dfs_detect_mode;
++
++	return 0;
++}
++
++
+ static int hostapd_ctrl_iface_receive_process(struct hostapd_data *hapd,
+ 					      char *buf, char *reply,
+ 					      int reply_size,
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 01b051d..f567c37 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1160,6 +1160,7 @@ struct hostapd_config {
+ 	u8 ibf_enable;
+ 	u8 ampdu;
+ 	u8 amsdu;
++	u8 dfs_detect_mode;
+ };
+ 
+ enum three_wire_mode {
+@@ -1174,6 +1175,18 @@ enum three_wire_mode {
+ 		NUM_THREE_WIRE_MODE - 1
+ };
+ 
++enum dfs_mode {
++	DFS_DETECT_MODE_DISABLE,
++	DFS_DETECT_MODE_AP_ENABLE,
++	DFS_DETECT_MODE_BACKGROUND_ENABLE,
++	DFS_DETECT_MODE_ALL_ENABLE,
++
++	/* keep last */
++	NUM_DFS_DETECT_MODE,
++	DFS_DETECT_MODE_MAX =
++		NUM_DFS_DETECT_MODE - 1
++};
++
+ enum edcca_mode {
+ 	EDCCA_MODE_FORCE_DISABLE = 0,
+ 	EDCCA_MODE_AUTO = 1,
+diff --git a/src/ap/dfs.c b/src/ap/dfs.c
+index b5d105d..5cb7799 100644
+--- a/src/ap/dfs.c
++++ b/src/ap/dfs.c
+@@ -1317,6 +1317,11 @@ hostapd_dfs_background_start_channel_switch(struct hostapd_iface *iface,
+ 		   __func__, iface->radar_background.cac_started ? "yes" : "no",
+ 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
+ 
++	/* Skip channel switch when background dfs detect mode is on */
++	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_BACKGROUND_ENABLE ||
++	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++		return 0;
++
+ 	/* Check if CSA in progress */
+ 	if (hostapd_csa_in_progress(iface))
+ 		return 0;
+@@ -1365,6 +1370,11 @@ static int hostapd_dfs_start_channel_switch(struct hostapd_iface *iface)
+ 		   __func__, iface->cac_started ? "yes" : "no",
+ 		   hostapd_csa_in_progress(iface) ? "yes" : "no");
+ 
++	/* Skip channel switch when dfs detect mode is on */
++	if (iface->conf->dfs_detect_mode == DFS_DETECT_MODE_AP_ENABLE ||
++	    iface->conf->dfs_detect_mode == DFS_DETECT_MODE_ALL_ENABLE)
++		return 0;
++
+ 	/* Check if CSA in progress */
+ 	if (hostapd_csa_in_progress(iface))
+ 		return 0;
+-- 
+2.18.0
+
diff --git a/recipes-connectivity/wpa-supplicant/files/patches/patches.inc b/recipes-connectivity/wpa-supplicant/files/patches/patches.inc
index b9bb1ba..d8693e4 100644
--- a/recipes-connectivity/wpa-supplicant/files/patches/patches.inc
+++ b/recipes-connectivity/wpa-supplicant/files/patches/patches.inc
@@ -53,22 +53,24 @@
     file://800-acs-don-t-select-indoor-channel-on-outdoor-operation.patch \
     file://990-ctrl-make-WNM_AP-functions-dependant-on-CONFIG_AP.patch \
     file://992-openssl-include-rsa.patch \
-    file://99900-master-Add-hostapd_neighbor_count-and-hostapd_neighbor_ins.patch \
-    file://99901-master-Support-including-neighbor-report-elements-in-ANQP-.patch \
-    file://99902-master-Support-including-neignbor-report-elements-in-BTM-r.patch \
-    file://99903-master-Support-configuring-BSS-Termination-TSF-by-using-ho.patch \
-    file://99904-master-Disable-interface-if-BSS-Termination-TSF-is-set.patch \
-    file://99905-master-Add-set_send_disassoc_frame_timer-to-send-disassoci.patch \
-    file://99906-master-Support-including-neighbor-report-elements-in-BTM-r.patch \
-    file://99907-master-Add-hostapd_neighbor_set_own_report_pref.patch \
-    file://99908-master-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch \
-    file://99909-master-print-sae-groups-by-hostapd-ctrl.patch \
-    file://99910-master-hostapd-add-support-for-runtime-set-in-band-discove.patch \
-    file://99911-master-Add-mtk_vendor.h.patch \
-    file://99912-master-Support-new-hostapd-configuration-edcca_enable-and-.patch \
-    file://99913-master-Add-hostapd-command-handler-for-SET_EDCCA-GET_EDCCA.patch \
-    file://99914-master-Add-hostapd-HEMU-SET-GET-control.patch \
-    file://99915-master-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch \
-    file://99916-master-Add-hostapd-iBF-control.patch \
-    file://99918-Do-not-include-HE-capab-IE-if-associated-sta-s-HE-c.patch \
+    file://99900-hostapd-mtk-Add-hostapd_neighbor_count-and-hostapd_neighbor_ins.patch \
+    file://99901-hostapd-mtk-Support-including-neighbor-report-elements-in-ANQP-.patch \
+    file://99902-hostapd-mtk-Support-including-neignbor-report-elements-in-BTM-r.patch \
+    file://99903-hostapd-mtk-Support-configuring-BSS-Termination-TSF-by-using-ho.patch \
+    file://99904-hostapd-mtk-Disable-interface-if-BSS-Termination-TSF-is-set.patch \
+    file://99905-hostapd-mtk-Add-set_send_disassoc_frame_timer-to-send-disassoci.patch \
+    file://99906-hostapd-mtk-Support-including-neighbor-report-elements-in-BTM-r.patch \
+    file://99907-hostapd-mtk-Add-hostapd_neighbor_set_own_report_pref.patch \
+    file://99908-hostapd-mtk-Add-hostapd_neighbor_set_pref_by_non_pref_chan.patch \
+    file://99909-hostapd-mtk-print-sae-groups-by-hostapd-ctrl.patch \
+    file://99910-hostapd-mtk-hostapd-add-support-for-runtime-set-in-band-discove.patch \
+    file://99911-hostapd-mtk-Add-mtk_vendor.h.patch \
+    file://99912-hostapd-mtk-Support-new-hostapd-configuration-edcca_enable-and-.patch \
+    file://99913-hostapd-mtk-Add-hostapd-command-handler-for-SET_EDCCA-GET_EDCCA.patch \
+    file://99914-hostapd-mtk-Add-hostapd-HEMU-SET-GET-control.patch \
+    file://99915-hostapd-mtk-Add-three-wire-PTA-ctrl-hostapd-vendor-command.patch \
+    file://99916-hostapd-mtk-Add-hostapd-iBF-control.patch \
+    file://99917-hostapd-mtk-Add-hostapd-AMPDU-AMSDU-control.patch \
+    file://99918-hostapd-mtk-Do-not-include-HE-capab-IE-if-associated-sta-s-HE-c.patch \
+    file://99919-hostapd-mtk-Add-DFS-disable-channel-switch-when-receive-radar.patch \
     "
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/343-wifi-mac80211-fix-decap-offload-for-stations-on-AP_V.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/343-wifi-mac80211-fix-decap-offload-for-stations-on-AP_V.patch
new file mode 100644
index 0000000..0feb408
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/343-wifi-mac80211-fix-decap-offload-for-stations-on-AP_V.patch
@@ -0,0 +1,37 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 28 Sep 2022 13:50:34 +0200
+Subject: [PATCH] wifi: mac80211: fix decap offload for stations on AP_VLAN
+ interfaces
+
+Since AP_VLAN interfaces are not passed to the driver, check offload_flags
+on the bss vif instead.
+
+Reported-by: Howard Hsu <howard-yh.hsu@mediatek.com>
+Fixes: 80a915ec4427 ("mac80211: add rx decapsulation offload support")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4265,6 +4265,7 @@ void ieee80211_check_fast_rx(struct sta_
+ 		.vif_type = sdata->vif.type,
+ 		.control_port_protocol = sdata->control_port_protocol,
+ 	}, *old, *new = NULL;
++	u32 offload_flags;
+ 	bool set_offload = false;
+ 	bool assign = false;
+ 	bool offload;
+@@ -4380,10 +4381,10 @@ void ieee80211_check_fast_rx(struct sta_
+ 	if (assign)
+ 		new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL);
+ 
+-	offload = assign &&
+-		  (sdata->vif.offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED);
++	offload_flags = get_bss_sdata(sdata)->vif.offload_flags;
++	offload = offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED;
+ 
+-	if (offload)
++	if (assign && offload)
+ 		set_offload = !test_and_set_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD);
+ 	else
+ 		set_offload = test_and_clear_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD);
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/344-wifi-cfg80211-fix-ieee80211_data_to_8023_exthdr-hand.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/344-wifi-cfg80211-fix-ieee80211_data_to_8023_exthdr-hand.patch
new file mode 100644
index 0000000..161c7d6
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/344-wifi-cfg80211-fix-ieee80211_data_to_8023_exthdr-hand.patch
@@ -0,0 +1,99 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 7 Oct 2022 10:54:47 +0200
+Subject: [PATCH] wifi: cfg80211: fix ieee80211_data_to_8023_exthdr
+ handling of small packets
+
+STP topology change notification packets only have a payload of 7 bytes,
+so they get dropped due to the skb->len < hdrlen + 8 check.
+Fix this by removing skb->len based checks and instead check the return code
+on the skb_copy_bits calls.
+
+Fixes: 2d1c304cb2d5 ("cfg80211: add function for 802.3 conversion with separate output buffer")
+Reported-by: Chad Monroe <chad.monroe@smartrg.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -557,7 +557,7 @@ int ieee80211_data_to_8023_exthdr(struct
+ 		return -1;
+ 
+ 	hdrlen = ieee80211_hdrlen(hdr->frame_control) + data_offset;
+-	if (skb->len < hdrlen + 8)
++	if (skb->len < hdrlen)
+ 		return -1;
+ 
+ 	/* convert IEEE 802.11 header + possible LLC headers into Ethernet
+@@ -572,8 +572,9 @@ int ieee80211_data_to_8023_exthdr(struct
+ 	memcpy(tmp.h_dest, ieee80211_get_DA(hdr), ETH_ALEN);
+ 	memcpy(tmp.h_source, ieee80211_get_SA(hdr), ETH_ALEN);
+ 
+-	if (iftype == NL80211_IFTYPE_MESH_POINT)
+-		skb_copy_bits(skb, hdrlen, &mesh_flags, 1);
++	if (iftype == NL80211_IFTYPE_MESH_POINT &&
++	    skb_copy_bits(skb, hdrlen, &mesh_flags, 1) < 0)
++		return -1;
+ 
+ 	mesh_flags &= MESH_FLAGS_AE;
+ 
+@@ -593,11 +594,12 @@ int ieee80211_data_to_8023_exthdr(struct
+ 		if (iftype == NL80211_IFTYPE_MESH_POINT) {
+ 			if (mesh_flags == MESH_FLAGS_AE_A4)
+ 				return -1;
+-			if (mesh_flags == MESH_FLAGS_AE_A5_A6) {
+-				skb_copy_bits(skb, hdrlen +
+-					offsetof(struct ieee80211s_hdr, eaddr1),
+-					tmp.h_dest, 2 * ETH_ALEN);
+-			}
++			if (mesh_flags == MESH_FLAGS_AE_A5_A6 &&
++			    skb_copy_bits(skb, hdrlen +
++					  offsetof(struct ieee80211s_hdr, eaddr1),
++					  tmp.h_dest, 2 * ETH_ALEN) < 0)
++				return -1;
++
+ 			hdrlen += __ieee80211_get_mesh_hdrlen(mesh_flags);
+ 		}
+ 		break;
+@@ -611,10 +613,11 @@ int ieee80211_data_to_8023_exthdr(struct
+ 		if (iftype == NL80211_IFTYPE_MESH_POINT) {
+ 			if (mesh_flags == MESH_FLAGS_AE_A5_A6)
+ 				return -1;
+-			if (mesh_flags == MESH_FLAGS_AE_A4)
+-				skb_copy_bits(skb, hdrlen +
+-					offsetof(struct ieee80211s_hdr, eaddr1),
+-					tmp.h_source, ETH_ALEN);
++			if (mesh_flags == MESH_FLAGS_AE_A4 &&
++			    skb_copy_bits(skb, hdrlen +
++					  offsetof(struct ieee80211s_hdr, eaddr1),
++					  tmp.h_source, ETH_ALEN) < 0)
++				return -1;
+ 			hdrlen += __ieee80211_get_mesh_hdrlen(mesh_flags);
+ 		}
+ 		break;
+@@ -626,18 +629,18 @@ int ieee80211_data_to_8023_exthdr(struct
+ 		break;
+ 	}
+ 
+-	skb_copy_bits(skb, hdrlen, &payload, sizeof(payload));
+-	tmp.h_proto = payload.proto;
+-
+-	if (likely((!is_amsdu && ether_addr_equal(payload.hdr, rfc1042_header) &&
+-		    tmp.h_proto != htons(ETH_P_AARP) &&
+-		    tmp.h_proto != htons(ETH_P_IPX)) ||
+-		   ether_addr_equal(payload.hdr, bridge_tunnel_header)))
++	if (likely(skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)) == 0 &&
++	           ((!is_amsdu && ether_addr_equal(payload.hdr, rfc1042_header) &&
++		     payload.proto != htons(ETH_P_AARP) &&
++		     payload.proto != htons(ETH_P_IPX)) ||
++		    ether_addr_equal(payload.hdr, bridge_tunnel_header)))) {
+ 		/* remove RFC1042 or Bridge-Tunnel encapsulation and
+ 		 * replace EtherType */
+ 		hdrlen += ETH_ALEN + 2;
+-	else
++		tmp.h_proto = payload.proto;
++	} else {
+ 		tmp.h_proto = htons(skb->len - hdrlen);
++	}
+ 
+ 	pskb_pull(skb, hdrlen);
+ 
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/345-wifi-mac80211-do-not-drop-packets-smaller-than-the-L.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/345-wifi-mac80211-do-not-drop-packets-smaller-than-the-L.patch
new file mode 100644
index 0000000..16cafc4
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/345-wifi-mac80211-do-not-drop-packets-smaller-than-the-L.patch
@@ -0,0 +1,25 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 7 Oct 2022 10:58:26 +0200
+Subject: [PATCH] wifi: mac80211: do not drop packets smaller than the
+ LLC-SNAP header on fast-rx
+
+Since STP TCN frames are only 7 bytes, the pskb_may_pull call returns an error.
+Instead of dropping those packets, bump them back to the slow path for proper
+processing.
+
+Fixes: 49ddf8e6e234 ("mac80211: add fast-rx path")
+Reported-by: Chad Monroe <chad.monroe@smartrg.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4601,7 +4601,7 @@ static bool ieee80211_invoke_fast_rx(str
+ 
+ 	if (!(status->rx_flags & IEEE80211_RX_AMSDU)) {
+ 		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
+-			goto drop;
++			return false;
+ 
+ 		payload = (void *)(skb->data + snap_offs);
+ 
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/800-mac80211-mask-nested-A-MSDU-support-for-mesh.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/800-mac80211-mask-nested-A-MSDU-support-for-mesh.patch
new file mode 100644
index 0000000..e7da94c
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/800-mac80211-mask-nested-A-MSDU-support-for-mesh.patch
@@ -0,0 +1,33 @@
+From 313d8c18385f10957402b475f9b0c209ceab6c5a Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Fri, 8 Oct 2021 00:25:19 +0200
+Subject: [PATCH] mac80211: mask nested A-MSDU support for mesh
+
+mac80211 incorrectly processes A-MSDUs contained in A-MPDU frames. This
+results in dropped packets and severely impacted throughput.
+
+As a workaround, don't indicate support for A-MSDUs contained in
+A-MPDUs. This improves throughput over mesh links by factor 10.
+
+Ref: https://github.com/openwrt/mt76/issues/450
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ net/mac80211/agg-rx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/mac80211/agg-rx.c
++++ b/net/mac80211/agg-rx.c
+@@ -251,7 +251,11 @@ static void ieee80211_send_addba_resp(st
+ 	mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
+ 	mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
+ 
+-	capab = u16_encode_bits(amsdu, IEEE80211_ADDBA_PARAM_AMSDU_MASK);
++	capab = 0;
++#ifdef CONFIG_MAC80211_MESH
++	if (!sta->mesh)
++#endif
++		capab = u16_encode_bits(amsdu, IEEE80211_ADDBA_PARAM_AMSDU_MASK);
+ 	capab |= u16_encode_bits(policy, IEEE80211_ADDBA_PARAM_POLICY_MASK);
+ 	capab |= u16_encode_bits(tid, IEEE80211_ADDBA_PARAM_TID_MASK);
+ 	capab |= u16_encode_bits(buf_size, IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK);
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/900-mac80211-mtk-export-del-all-station-for-ampdu-amsdu-on-off-function.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/900-mac80211-mtk-export-del-all-station-for-ampdu-amsdu-on-off-function.patch
new file mode 100755
index 0000000..ada8e31
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/900-mac80211-mtk-export-del-all-station-for-ampdu-amsdu-on-off-function.patch
@@ -0,0 +1,63 @@
+--- b/include/net/mac80211.h	2021-09-22 21:10:45.803721216 +0800
++++ a/include/net/mac80211.h	2021-09-22 21:19:40.494744637 +0800
+@@ -2639,6 +2639,13 @@
+ }
+ #define ieee80211_hw_set(hw, flg)	_ieee80211_hw_set(hw, IEEE80211_HW_##flg)
+ 
++static inline void _ieee80211_hw_clear(struct ieee80211_hw *hw,
++				     enum ieee80211_hw_flags flg)
++{
++	return __clear_bit(flg, hw->flags);
++}
++#define ieee80211_hw_clear(hw, flg)	_ieee80211_hw_clear(hw, IEEE80211_HW_##flg)
++
+ /**
+  * struct ieee80211_scan_request - hw scan request
+  *
+@@ -4989,6 +4996,12 @@
+ void ieee80211_csa_finish(struct ieee80211_vif *vif);
+ 
+ /**
++ * ieee80211_del_all_station - request mac80211 to delete all stations
++ * @hw: pointer obtained from ieee80211_alloc_hw().
++ */
++void ieee80211_del_all_station(struct ieee80211_hw *hw);
++
++/**
+  * ieee80211_beacon_cntdwn_is_complete - find out if countdown reached 1
+  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+  *
+--- b/net/mac80211/cfg.c	2021-09-22 21:10:45.675720709 +0800
++++ a/net/mac80211/cfg.c	2021-09-22 21:11:23.456352549 +0800
+@@ -1718,6 +1718,19 @@
+ 	return 0;
+ }
+ 
++void ieee80211_del_all_station(struct ieee80211_hw *hw)
++{
++	struct ieee80211_local *local = hw_to_local(hw);
++	struct sta_info *sta, *tmp;
++
++	mutex_lock(&local->sta_mtx);
++	list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
++		WARN_ON(__sta_info_destroy(sta));
++	}
++	mutex_unlock(&local->sta_mtx);
++}
++EXPORT_SYMBOL(ieee80211_del_all_station);
++
+ static int ieee80211_change_station(struct wiphy *wiphy,
+ 				    struct net_device *dev, const u8 *mac,
+ 				    struct station_parameters *params)
+--- b/net/mac80211/sta_info.c	2021-09-22 21:10:45.599720409 +0800
++++ a/net/mac80211/sta_info.c	2021-09-22 20:50:39.158775251 +0800
+@@ -683,7 +683,8 @@
+ 	}
+ 
+ 	/* accept BA sessions now */
+-	clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
++	if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION))
++		clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
+ 
+ 	ieee80211_sta_debugfs_add(sta);
+ 	rate_control_add_sta_debugfs(sta);
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/901-mac80211-check-twt-responder-when-setu-twt.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/901-mac80211-mtk-check-twt-responder-when-setu-twt.patch
similarity index 100%
rename from recipes-kernel/linux-mac80211/files/patches/subsys/901-mac80211-check-twt-responder-when-setu-twt.patch
rename to recipes-kernel/linux-mac80211/files/patches/subsys/901-mac80211-mtk-check-twt-responder-when-setu-twt.patch
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/902-nl80211-internal-extend-CAC-time-for-weather-radar-c.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/902-nl80211-mtk-internal-extend-CAC-time-for-weather-radar-c.patch
similarity index 100%
rename from recipes-kernel/linux-mac80211/files/patches/subsys/902-nl80211-internal-extend-CAC-time-for-weather-radar-c.patch
rename to recipes-kernel/linux-mac80211/files/patches/subsys/902-nl80211-mtk-internal-extend-CAC-time-for-weather-radar-c.patch
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/903-mac80211-it-s-invalid-case-when-frag_threshold-is-gr.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/903-mac80211-mtk-it-s-invalid-case-when-frag_threshold-is-gr.patch
similarity index 100%
rename from recipes-kernel/linux-mac80211/files/patches/subsys/903-mac80211-it-s-invalid-case-when-frag_threshold-is-gr.patch
rename to recipes-kernel/linux-mac80211/files/patches/subsys/903-mac80211-mtk-it-s-invalid-case-when-frag_threshold-is-gr.patch
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/904-mac80211-correct-legacy-rates-check-in-ieee80211_cal.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/904-mac80211-mtk-correct-legacy-rates-check-in-ieee80211_cal.patch
similarity index 100%
rename from recipes-kernel/linux-mac80211/files/patches/subsys/904-mac80211-correct-legacy-rates-check-in-ieee80211_cal.patch
rename to recipes-kernel/linux-mac80211/files/patches/subsys/904-mac80211-mtk-correct-legacy-rates-check-in-ieee80211_cal.patch
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/905-mac80211-airtime_flags-depends-on-NL80211_EXT_FEATUR.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/905-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FEATUR.patch
similarity index 100%
rename from recipes-kernel/linux-mac80211/files/patches/subsys/905-mac80211-airtime_flags-depends-on-NL80211_EXT_FEATUR.patch
rename to recipes-kernel/linux-mac80211/files/patches/subsys/905-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FEATUR.patch
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/906-mac80211-add-support-for-runtime-set-inband-discovery.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/906-mac80211-mtk-add-support-for-runtime-set-inband-discovery.patch
similarity index 100%
rename from recipes-kernel/linux-mac80211/files/patches/subsys/906-mac80211-add-support-for-runtime-set-inband-discovery.patch
rename to recipes-kernel/linux-mac80211/files/patches/subsys/906-mac80211-mtk-add-support-for-runtime-set-inband-discovery.patch
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/908-mac80211-add-s1g-category-to-_ieee80211_is_robust_mg.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/908-mac80211-mtk-add-s1g-category-to-_ieee80211_is_robust_mg.patch
similarity index 100%
rename from recipes-kernel/linux-mac80211/files/patches/subsys/908-mac80211-add-s1g-category-to-_ieee80211_is_robust_mg.patch
rename to recipes-kernel/linux-mac80211/files/patches/subsys/908-mac80211-mtk-add-s1g-category-to-_ieee80211_is_robust_mg.patch
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/910-mac80211-offload.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/910-mac80211-mtk-offload.patch
similarity index 100%
rename from recipes-kernel/linux-mac80211/files/patches/subsys/910-mac80211-offload.patch
rename to recipes-kernel/linux-mac80211/files/patches/subsys/910-mac80211-mtk-offload.patch
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/911-add-fill-receive-path-ops-to-get-wed-idx-v2.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/911-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-idx-v2.patch
similarity index 100%
rename from recipes-kernel/linux-mac80211/files/patches/subsys/911-add-fill-receive-path-ops-to-get-wed-idx-v2.patch
rename to recipes-kernel/linux-mac80211/files/patches/subsys/911-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-idx-v2.patch
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/912-mac80211-make-4addr-null-frames-using-min-rate-for-WDS.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/912-mac80211-mtk-make-4addr-null-frames-using-min-rate-for-WDS.patch
similarity index 100%
rename from recipes-kernel/linux-mac80211/files/patches/subsys/912-mac80211-make-4addr-null-frames-using-min-rate-for-WDS.patch
rename to recipes-kernel/linux-mac80211/files/patches/subsys/912-mac80211-mtk-make-4addr-null-frames-using-min-rate-for-WDS.patch
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/913-mac80211-mtk-remove-timerout-handle-for-ax210-iot-issue.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/913-mac80211-mtk-remove-timerout-handle-for-ax210-iot-issue.patch
new file mode 100755
index 0000000..4d3b674
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/913-mac80211-mtk-remove-timerout-handle-for-ax210-iot-issue.patch
@@ -0,0 +1,20 @@
+diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
+index 1deb3d8..c30f02d 100755
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -568,10 +568,9 @@ static void sta_tx_agg_session_timer_expired(struct timer_list *t)
+ 	}
+
+ 	timeout = tid_tx->last_tx + TU_TO_JIFFIES(tid_tx->timeout);
+-	if (time_is_after_jiffies(timeout)) {
+-		mod_timer(&tid_tx->session_timer, timeout);
+-		return;
+-	}
++	/* remove timerout handle for ax210 iot issue */
++	mod_timer(&tid_tx->session_timer, timeout);
++	return;
+
+ 	ht_dbg(sta->sdata, "tx session timer expired on %pM tid %d\n",
+ 	       sta->sta.addr, tid);
+-- 
+2.18.0
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/914-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-skip-command.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/914-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-skip-command.patch
new file mode 100644
index 0000000..2aaf114
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/914-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-skip-command.patch
@@ -0,0 +1,256 @@
+From eca521242b94855825f085d1bca67a5958420baa Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 22 Sep 2022 14:27:41 +0800
+Subject: [PATCH] cfg80211: implement DFS status show, cac and nop skip command
+ via debugfs
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ net/wireless/debugfs.c | 228 +++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 221 insertions(+), 7 deletions(-)
+
+diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c
+index aab4346..19c3091 100644
+--- a/net/wireless/debugfs.c
++++ b/net/wireless/debugfs.c
+@@ -95,16 +95,230 @@ static const struct file_operations ht40allow_map_ops = {
+ 	.llseek = default_llseek,
+ };
+ 
+-#define DEBUGFS_ADD(name)						\
+-	debugfs_create_file(#name, 0444, phyd, &rdev->wiphy, &name## _ops)
++static int dfs_print_chan(struct ieee80211_channel *chan, int remain_time,
++			  char *buf, int buf_size, int offset)
++{
++	if (WARN_ON(offset > buf_size))
++		return 0;
++
++	if (chan->dfs_state == NL80211_DFS_UNAVAILABLE) {
++		offset += scnprintf(buf + offset, buf_size - offset,
++				    "	Channel = %d, DFS_state = Unavailable",
++				    chan->hw_value);
++		if (remain_time > 0)
++			offset += scnprintf(buf + offset, buf_size - offset,
++					    ", Non-occupancy Remain Time = %d [sec]\n",
++					    remain_time);
++		else
++			offset += scnprintf(buf + offset, buf_size - offset,
++					    ", Changing state...\n");
++	} else if (chan->dfs_state == NL80211_DFS_USABLE) {
++		offset += scnprintf(buf + offset, buf_size - offset,
++				    "	Channel = %d, DFS_state = Usable",
++				    chan->hw_value);
++		if (remain_time > 0)
++			offset += scnprintf(buf + offset, buf_size - offset,
++					    ", CAC Remain Time = %d [sec]\n",
++					    remain_time);
++		else
++			offset += scnprintf(buf + offset, buf_size - offset,
++					    "\n");
++	} else if (chan->dfs_state == NL80211_DFS_AVAILABLE) {
++		offset += scnprintf(buf + offset, buf_size - offset,
++				    "	Channel = %d, DFS_state = Available\n",
++				    chan->hw_value);
++	} else {
++		offset += scnprintf(buf + offset, buf_size - offset,
++				    "	Channel = %d, DFS_state = Unknown\n",
++				    chan->hw_value);
++	}
++
++	return offset;
++}
++
++static int dfs_status_read_wdev(struct wiphy *wiphy, struct wireless_dev *wdev, char *buf,
++				unsigned int buf_size, unsigned int offset)
++{
++	struct cfg80211_chan_def *chandef;
++	enum nl80211_band band;
++	struct ieee80211_supported_band *sband;
++	struct ieee80211_channel *chan;
++	unsigned long jiffies_passed;
++	int i, remain_time = 0;
++
++	offset += scnprintf(buf + offset, buf_size - offset, "DFS Channel:\n");
++
++	for (band = 0; band < NUM_NL80211_BANDS; band++) {
++		sband = wiphy->bands[band];
++		if (!sband)
++			continue;
++		for (i = 0; i < sband->n_channels; i++) {
++			chan = &sband->channels[i];
++
++			if (!(chan->flags & IEEE80211_CHAN_RADAR))
++				continue;
++
++			if (chan->dfs_state == NL80211_DFS_UNAVAILABLE) {
++				jiffies_passed = jiffies - chan->dfs_state_entered;
++				remain_time = (IEEE80211_DFS_MIN_NOP_TIME_MS -
++					       jiffies_to_msecs(jiffies_passed));
++				if (remain_time > IEEE80211_DFS_MIN_NOP_TIME_MS)
++					remain_time = 0;
++			} else if (chan->dfs_state == NL80211_DFS_USABLE) {
++				chandef = &wdev->chandef;
++				if (wdev->cac_started && cfg80211_is_sub_chan(chandef, chan)) {
++					jiffies_passed = jiffies - wdev->cac_start_time;
++					remain_time = (wdev->cac_time_ms -
++							jiffies_to_msecs(jiffies_passed));
++				}
++				if (remain_time > wdev->cac_time_ms)
++					remain_time = 0;
++			}
++			offset = dfs_print_chan(chan, remain_time / 1000, buf, buf_size, offset);
++			remain_time = 0;
++		}
++	}
++
++	return offset;
++}
++
++static ssize_t dfs_status_read(struct file *file, char __user *user_buf,
++			       size_t count, loff_t *ppos)
++{
++	struct wiphy *wiphy = file->private_data;
++	struct wireless_dev *wdev;
++	char *buf;
++	unsigned int offset = 0, buf_size = PAGE_SIZE, r;
++	const char * const iftype_str[] = {
++		[NL80211_IFTYPE_UNSPECIFIED] = "unspecified",
++		[NL80211_IFTYPE_ADHOC] = "adhoc",
++		[NL80211_IFTYPE_STATION] = "station",
++		[NL80211_IFTYPE_AP] = "ap",
++		[NL80211_IFTYPE_AP_VLAN] = "ap vlan",
++		[NL80211_IFTYPE_WDS] = "wds",
++		[NL80211_IFTYPE_MONITOR] = "monitor",
++		[NL80211_IFTYPE_MESH_POINT] = "mesh point",
++		[NL80211_IFTYPE_P2P_CLIENT] = "p2p client",
++		[NL80211_IFTYPE_P2P_GO] = "p2p go",
++		[NL80211_IFTYPE_P2P_DEVICE] = "p2p device",
++		[NL80211_IFTYPE_OCB] = "ocb",
++		[NL80211_IFTYPE_NAN] = "nan",
++	};
++
++	buf = kzalloc(buf_size, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	list_for_each_entry(wdev, &wiphy->wdev_list, list) {
++		offset += scnprintf(buf + offset, buf_size - offset,
++				    "wdev 0x%x\n"
++				    "interface type %s\n",
++				    wdev->identifier, iftype_str[wdev->iftype]);
++		offset = dfs_status_read_wdev(wiphy, wdev, buf, buf_size, offset);
++	}
++
++	r = simple_read_from_buffer(user_buf, count, ppos, buf, offset);
++
++	kfree(buf);
++
++	return r;
++}
++
++static const struct file_operations dfs_status_ops = {
++	.read = dfs_status_read,
++	.open = simple_open,
++	.llseek = default_llseek,
++};
++
++static int
++dfs_nop_skip(void *data, u64 val)
++{
++	struct wiphy *wiphy = data;
++	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
++	bool en = !!val;
++	enum nl80211_band band;
++	struct ieee80211_supported_band *sband;
++	struct ieee80211_channel *chan;
++	u32 nop_time = IEEE80211_DFS_MIN_NOP_TIME_MS;
++	int i;
++
++	if (!en)
++		return 0;
++
++	for (band = 0; band < NUM_NL80211_BANDS; band++) {
++		sband = wiphy->bands[band];
++		if (!sband)
++			continue;
++		for (i = 0; i < sband->n_channels; i++) {
++			chan = &sband->channels[i];
++
++			if (!(chan->flags & IEEE80211_CHAN_RADAR))
++				continue;
++
++			if (chan->dfs_state == NL80211_DFS_UNAVAILABLE) {
++				// Let current jiffies > dfs_state_entered_jiffies + NOP time
++				chan->dfs_state_entered = jiffies -
++						       msecs_to_jiffies(nop_time + 1);
++			}
++		}
++	}
++
++	cfg80211_sched_dfs_chan_update(rdev);
++
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(dfs_skip_nop_ops, NULL,
++			 dfs_nop_skip, "0x%08llx\n");
++
++static int
++dfs_cac_skip(void *data, u64 val)
++{
++	struct wiphy *wiphy = data;
++	struct wireless_dev *wdev;
++	struct cfg80211_chan_def *chandef;
++	bool en = !!val;
++	struct ieee80211_channel *chan;
++
++	if (!en)
++		return 0;
++
++	list_for_each_entry(wdev, &wiphy->wdev_list, list) {
++		chandef = &wdev->chandef;
++		if (chandef->chan) {
++			chan = chandef->chan;
++			if (!(chan->flags & IEEE80211_CHAN_RADAR))
++				continue;
++
++			if (chan->dfs_state == NL80211_DFS_USABLE && wdev->cac_started) {
++				// Let current jiffies > dfs_state_entered_jiffies + CAC time
++				wdev->cac_start_time = jiffies -
++						       msecs_to_jiffies(wdev->cac_time_ms + 1);
++				cfg80211_cac_event(wdev->netdev, chandef,
++						   NL80211_RADAR_CAC_FINISHED, GFP_KERNEL);
++			}
++		}
++	}
++
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(dfs_skip_cac_ops, NULL,
++			 dfs_cac_skip, "0x%08llx\n");
++
++#define DEBUGFS_ADD(name, chmod)						\
++	debugfs_create_file(#name, chmod, phyd, &rdev->wiphy, &name## _ops)
+ 
+ void cfg80211_debugfs_rdev_add(struct cfg80211_registered_device *rdev)
+ {
+ 	struct dentry *phyd = rdev->wiphy.debugfsdir;
+ 
+-	DEBUGFS_ADD(rts_threshold);
+-	DEBUGFS_ADD(fragmentation_threshold);
+-	DEBUGFS_ADD(short_retry_limit);
+-	DEBUGFS_ADD(long_retry_limit);
+-	DEBUGFS_ADD(ht40allow_map);
++	DEBUGFS_ADD(rts_threshold, 0444);
++	DEBUGFS_ADD(fragmentation_threshold, 0444);
++	DEBUGFS_ADD(short_retry_limit, 0444);
++	DEBUGFS_ADD(long_retry_limit, 0444);
++	DEBUGFS_ADD(ht40allow_map, 0444);
++	DEBUGFS_ADD(dfs_status, 0444);
++	DEBUGFS_ADD(dfs_skip_nop, 0600);
++	DEBUGFS_ADD(dfs_skip_cac, 0600);
+ }
+-- 
+2.18.0
+
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/915-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-as-1.-This-mo.patch b/recipes-kernel/linux-mac80211/files/patches/subsys/915-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-as-1.-This-mo.patch
new file mode 100644
index 0000000..a9c78aa
--- /dev/null
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/915-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-as-1.-This-mo.patch
@@ -0,0 +1,26 @@
+From 9fc161afbc474cdcc3acaf42d93295d5272afbb4 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Tue, 4 Oct 2022 10:47:05 +0800
+Subject: [PATCH] Set TWT Information Frame Disabled bit as 1. This
+ modification means that current implementation do not support twt information
+ frame.
+
+---
+ net/mac80211/s1g.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/mac80211/s1g.c b/net/mac80211/s1g.c
+index 4141bc8..82da404 100644
+--- a/net/mac80211/s1g.c
++++ b/net/mac80211/s1g.c
+@@ -101,6 +101,7 @@ ieee80211_s1g_rx_twt_setup(struct ieee80211_sub_if_data *sdata,
+ 	struct ieee80211_twt_params *twt_agrt = (void *)twt->params;
+ 
+ 	twt_agrt->req_type &= cpu_to_le16(~IEEE80211_TWT_REQTYPE_REQUEST);
++	twt->control |= IEEE80211_TWT_CONTROL_RX_DISABLED;
+ 
+ 	/* broadcast TWT not supported yet */
+ 	if (twt->control & IEEE80211_TWT_CONTROL_NEG_TYPE_BROADCAST) {
+-- 
+2.18.0
+
diff --git a/recipes-kernel/linux-mac80211/files/patches/subsys/subsys.inc b/recipes-kernel/linux-mac80211/files/patches/subsys/subsys.inc
index 2a053de..8ca4824 100644
--- a/recipes-kernel/linux-mac80211/files/patches/subsys/subsys.inc
+++ b/recipes-kernel/linux-mac80211/files/patches/subsys/subsys.inc
@@ -38,6 +38,9 @@
     file://340-wifi-mac80211-do-not-abuse-fq.lock-in-ieee80211_do_s.patch \
     file://341-mac80211-Fix-deadlock-Don-t-start-TX-while-holding-f.patch \
     file://342-mac80211-Ensure-vif-queues-are-operational-after-sta.patch \
+    file://343-wifi-mac80211-fix-decap-offload-for-stations-on-AP_V.patch \
+    file://344-wifi-cfg80211-fix-ieee80211_data_to_8023_exthdr-hand.patch \
+    file://345-wifi-mac80211-do-not-drop-packets-smaller-than-the-L.patch \
     file://350-bss-color-collision.patch \
     file://360-mac80211-fix-a-memory-leak-where-sta_info-is-not-fre.patch \
     file://361-wifi-mac80211-Don-t-finalize-CSA-in-IBSS-mode-if-sta.patch \
@@ -46,14 +49,19 @@
     file://500-mac80211_configure_antenna_gain.patch \
     file://782-net-next-1-of-net-pass-the-dst-buffer-to-of_get_mac_address.patch \
     file://783-sync-nl80211.patch \
-    file://901-mac80211-check-twt-responder-when-setu-twt.patch \
-    file://902-nl80211-internal-extend-CAC-time-for-weather-radar-c.patch \
-    file://903-mac80211-it-s-invalid-case-when-frag_threshold-is-gr.patch \
-    file://904-mac80211-correct-legacy-rates-check-in-ieee80211_cal.patch \
-    file://905-mac80211-airtime_flags-depends-on-NL80211_EXT_FEATUR.patch \
-    file://906-mac80211-add-support-for-runtime-set-inband-discovery.patch \
-    file://908-mac80211-add-s1g-category-to-_ieee80211_is_robust_mg.patch \
-    file://910-mac80211-offload.patch \
-    file://911-add-fill-receive-path-ops-to-get-wed-idx-v2.patch \
-    file://912-mac80211-make-4addr-null-frames-using-min-rate-for-WDS.patch \
+    file://800-mac80211-mask-nested-A-MSDU-support-for-mesh.patch \
+    file://900-mac80211-mtk-export-del-all-station-for-ampdu-amsdu-on-off-function.patch \
+    file://901-mac80211-mtk-check-twt-responder-when-setu-twt.patch \
+    file://902-nl80211-mtk-internal-extend-CAC-time-for-weather-radar-c.patch \
+    file://903-mac80211-mtk-it-s-invalid-case-when-frag_threshold-is-gr.patch \
+    file://904-mac80211-mtk-correct-legacy-rates-check-in-ieee80211_cal.patch \
+    file://905-mac80211-mtk-airtime_flags-depends-on-NL80211_EXT_FEATUR.patch \
+    file://906-mac80211-mtk-add-support-for-runtime-set-inband-discovery.patch \
+    file://908-mac80211-mtk-add-s1g-category-to-_ieee80211_is_robust_mg.patch \
+    file://910-mac80211-mtk-offload.patch \
+    file://911-mac80211-mtk-add-fill-receive-path-ops-to-get-wed-idx-v2.patch \
+    file://912-mac80211-mtk-make-4addr-null-frames-using-min-rate-for-WDS.patch \
+    file://913-mac80211-mtk-remove-timerout-handle-for-ax210-iot-issue.patch \
+    file://914-cfg80211-mtk-implement-DFS-status-show-cac-and-nop-skip-command.patch \
+    file://915-mac80211-mtk-Set-TWT-Information-Frame-Disabled-bit-as-1.-This-mo.patch \
     "
diff --git a/recipes-kernel/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch b/recipes-kernel/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
index 347d8e8..873a154 100644
--- a/recipes-kernel/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
@@ -1,19 +1,20 @@
-From 35c54875181e0f1b0637746de7c4af6aa9ec0212 Mon Sep 17 00:00:00 2001
+From f45f9c4ab6b8e9508a0fedb65de098c4f1be63c3 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Jun 2022 19:46:26 +0800
-Subject: [PATCH 1/7] mt76: mt7915: rework testmode init registers
+Subject: [PATCH 1/3] mt76: mt7915: rework testmode init registers
 
 ---
  mt7915/mmio.c     |  2 ++
  mt7915/regs.h     | 16 +++++++++++++--
  mt7915/testmode.c | 52 ++++++++++++++++++++++++++++++++++-------------
- 3 files changed, 54 insertions(+), 16 deletions(-)
+ testmode.c        |  3 +--
+ 4 files changed, 55 insertions(+), 18 deletions(-)
 
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 7bd5f672..68d978f4 100644
+index be1b8ea..9c2c508 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -59,6 +59,7 @@ static const u32 mt7986_reg[] = {
+@@ -68,6 +68,7 @@ static const u32 mt7986_reg[] = {
  };
  
  static const u32 mt7915_offs[] = {
@@ -21,7 +22,7 @@
  	[TMAC_CDTR]		= 0x090,
  	[TMAC_ODTR]		= 0x094,
  	[TMAC_ATCR]		= 0x098,
-@@ -133,6 +134,7 @@ static const u32 mt7915_offs[] = {
+@@ -142,6 +143,7 @@ static const u32 mt7915_offs[] = {
  };
  
  static const u32 mt7916_offs[] = {
@@ -30,10 +31,10 @@
  	[TMAC_ODTR]		= 0x0cc,
  	[TMAC_ATCR]		= 0x00c,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 5920e705..6d9d187a 100644
+index 5180dd9..2e44537 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -30,6 +30,7 @@ enum reg_rev {
+@@ -32,6 +32,7 @@ enum reg_rev {
  };
  
  enum offs_rev {
@@ -41,7 +42,7 @@
  	TMAC_CDTR,
  	TMAC_ODTR,
  	TMAC_ATCR,
-@@ -180,6 +181,12 @@ enum offs_rev {
+@@ -182,6 +183,12 @@ enum offs_rev {
  #define MT_TRB_RXPSR0_RX_WTBL_PTR	GENMASK(25, 16)
  #define MT_TRB_RXPSR0_RX_RMAC_PTR	GENMASK(9, 0)
  
@@ -54,7 +55,7 @@
  /* TMAC: band 0(0x820e4000), band 1(0x820f4000) */
  #define MT_WF_TMAC_BASE(_band)		((_band) ? 0x820f4000 : 0x820e4000)
  #define MT_WF_TMAC(_band, ofs)		(MT_WF_TMAC_BASE(_band) + (ofs))
-@@ -188,6 +195,9 @@ enum offs_rev {
+@@ -190,6 +197,9 @@ enum offs_rev {
  #define MT_TMAC_TCR0_TX_BLINK		GENMASK(7, 6)
  #define MT_TMAC_TCR0_TBTT_STOP_CTRL	BIT(25)
  
@@ -64,7 +65,7 @@
  #define MT_TMAC_CDTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_CDTR))
   #define MT_TMAC_ODTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_ODTR))
  #define MT_TIMEOUT_VAL_PLCP		GENMASK(15, 0)
-@@ -459,8 +469,10 @@ enum offs_rev {
+@@ -461,8 +471,10 @@ enum offs_rev {
  #define MT_AGG_PCR0_VHT_PROT		BIT(13)
  #define MT_AGG_PCR0_PTA_WIN_DIS		BIT(15)
  
@@ -78,7 +79,7 @@
  #define MT_AGG_ACR0(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR0))
  #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index efb9bb82..01866028 100644
+index a979460..819fafe 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -30,7 +30,7 @@ struct reg_band {
@@ -174,6 +175,20 @@
  }
  
  static void
+diff --git a/testmode.c b/testmode.c
+index 0accc71..57cdfdf 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -447,8 +447,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_LDPC], &td->tx_rate_ldpc, 0, 1) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_STBC], &td->tx_rate_stbc, 0, 1) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_LTF], &td->tx_ltf, 0, 2) ||
+-	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA],
+-			   &td->tx_antenna_mask, 0, 0xff) ||
++	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA], &td->tx_antenna_mask, 1, 0xff) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_SPE_IDX], &td->tx_spe_idx, 0, 27) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
+ 			   &td->tx_duty_cycle, 0, 99) ||
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch b/recipes-kernel/linux-mt76/files/patches/0002-mt76-mt7915-rework-rx-testmode-stats.patch
similarity index 91%
rename from recipes-kernel/linux-mt76/files/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch
rename to recipes-kernel/linux-mt76/files/patches/0002-mt76-mt7915-rework-rx-testmode-stats.patch
index 1b0de96..08f86a3 100644
--- a/recipes-kernel/linux-mt76/files/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0002-mt76-mt7915-rework-rx-testmode-stats.patch
@@ -1,7 +1,7 @@
-From 826c0c1849f01d0afaf4cfa14adfba0386f8d88f Mon Sep 17 00:00:00 2001
+From 095584941c21d2348ab3c3afe67f4dfa0b6957cd Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 3 Jan 2022 17:09:53 +0800
-Subject: [PATCH 3/7] mt76: mt7915: rework rx testmode stats
+Subject: [PATCH 2/3] mt76: mt7915: rework rx testmode stats
 
 ---
  mac80211.c        |  3 +-
@@ -15,10 +15,10 @@
  8 files changed, 109 insertions(+), 17 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index bc3a7514..c5ef5940 100644
+index e2a8ef9..7ef853c 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -752,7 +752,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
+@@ -756,7 +756,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
  	}
  
  #ifdef CONFIG_NL80211_TESTMODE
@@ -29,10 +29,10 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index 87db9498..e4a248a1 100644
+index f9bdf16..aef6006 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -638,6 +638,8 @@ struct mt76_testmode_ops {
+@@ -626,6 +626,8 @@ struct mt76_testmode_ops {
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  };
  
@@ -41,7 +41,7 @@
  struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
-@@ -669,6 +671,8 @@ struct mt76_testmode_data {
+@@ -657,6 +659,8 @@ struct mt76_testmode_data {
  
  	u8 addr[3][ETH_ALEN];
  
@@ -50,7 +50,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -676,6 +680,7 @@ struct mt76_testmode_data {
+@@ -664,6 +668,7 @@ struct mt76_testmode_data {
  	struct {
  		u64 packets[__MT_RXQ_MAX];
  		u64 fcs_error[__MT_RXQ_MAX];
@@ -59,7 +59,7 @@
  };
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 718f427d..f62af7a8 100644
+index cf4ce3b..3101721 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1138,6 +1138,7 @@ enum {
@@ -71,7 +71,7 @@
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index cd1edf55..110e4f36 100644
+index 87cd1bf..ed94980 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -9,6 +9,7 @@
@@ -83,7 +83,7 @@
  	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
  };
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 41b99496..6c05dfab 100644
+index 819fafe..8d99edc 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -133,6 +133,21 @@ mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
@@ -117,7 +117,7 @@
  	if (!en)
  		mt7915_tm_set_tam_arb(phy, en, 0);
  }
-@@ -504,18 +521,63 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+@@ -501,18 +518,63 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
  	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
  }
  
@@ -184,7 +184,7 @@
  		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
  	}
  }
-@@ -745,12 +807,8 @@ static int
+@@ -742,12 +804,8 @@ static int
  mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  {
  	struct mt7915_phy *phy = mphy->priv;
@@ -197,7 +197,7 @@
  
  	rx = nla_nest_start(msg, MT76_TM_STATS_ATTR_LAST_RX);
  	if (!rx)
-@@ -794,15 +852,7 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+@@ -791,15 +849,7 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  
  	nla_nest_end(msg, rx);
  
@@ -215,7 +215,7 @@
  
  const struct mt76_testmode_ops mt7915_testmode_ops = {
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 5573ac30..a1c54c89 100644
+index 5573ac3..a1c54c8 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -33,6 +33,12 @@ struct mt7915_tm_clean_txq {
@@ -266,7 +266,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 57cdfdf6..1d0d5d30 100644
+index 57cdfdf..1d0d5d3 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -559,6 +559,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
@@ -280,7 +280,7 @@
  		return -EMSGSIZE;
  
 diff --git a/testmode.h b/testmode.h
-index 5e2792d8..89613266 100644
+index 5e2792d..8961326 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -101,6 +101,8 @@ enum mt76_testmode_attr {
@@ -301,5 +301,5 @@
  	/* keep last */
  	NUM_MT76_TM_STATS_ATTRS,
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch b/recipes-kernel/linux-mt76/files/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch
deleted file mode 100644
index caac8c3..0000000
--- a/recipes-kernel/linux-mt76/files/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From e7fac7c5c91fbabafa530abdf32cf11dd36834d7 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Fri, 25 Feb 2022 09:36:01 +0800
-Subject: [PATCH 2/7] mt76: testmode: rework tx antenna setting
-
----
- mt7915/mcu.c      |  7 +------
- mt7915/testmode.c | 13 ++++++-------
- testmode.c        |  3 +--
- 3 files changed, 8 insertions(+), 15 deletions(-)
-
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 3586a8e3..d9c9805b 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -2642,14 +2642,9 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
- 
- #ifdef CONFIG_NL80211_TESTMODE
- 	if (phy->mt76->test.tx_antenna_mask &&
--	    (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
--	     phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES ||
--	     phy->mt76->test.state == MT76_TM_STATE_TX_CONT)) {
-+	    mt76_testmode_enabled(phy->mt76)) {
- 		req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
- 		req.rx_streams = phy->mt76->test.tx_antenna_mask;
--
--		if (phy != &dev->phy)
--			req.rx_streams >>= dev->chainshift;
- 	}
- #endif
- 
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 01866028..41b99496 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -474,11 +474,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
- 		if (td->tx_spe_idx) {
- 			phy->test.spe_idx = td->tx_spe_idx;
- 		} else {
--			u8 tx_ant = td->tx_antenna_mask;
--
--			if (phy != &dev->phy)
--				tx_ant >>= dev->chainshift;
--			phy->test.spe_idx = spe_idx_map[tx_ant];
-+			phy->test.spe_idx = spe_idx_map[td->tx_antenna_mask];
- 		}
- 	}
- 
-@@ -720,8 +716,10 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
- {
- 	struct mt76_testmode_data *td = &mphy->test;
- 	struct mt7915_phy *phy = mphy->priv;
--	u32 changed = 0;
-+	struct mt7915_dev *dev = phy->dev;
-+	u32 chainmask = mphy->chainmask, changed = 0;
- 	int i;
-+	bool ext_phy = phy != &dev->phy;
- 
- 	BUILD_BUG_ON(NUM_TM_CHANGED >= 32);
- 
-@@ -729,7 +727,8 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
- 	    td->state == MT76_TM_STATE_OFF)
- 		return 0;
- 
--	if (td->tx_antenna_mask & ~mphy->chainmask)
-+	chainmask = ext_phy ? chainmask >> dev->chainshift : chainmask;
-+	if (td->tx_antenna_mask > chainmask)
- 		return -EINVAL;
- 
- 	for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
-diff --git a/testmode.c b/testmode.c
-index 0accc71a..57cdfdf6 100644
---- a/testmode.c
-+++ b/testmode.c
-@@ -447,8 +447,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_LDPC], &td->tx_rate_ldpc, 0, 1) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_STBC], &td->tx_rate_stbc, 0, 1) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_LTF], &td->tx_ltf, 0, 2) ||
--	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA],
--			   &td->tx_antenna_mask, 0, 0xff) ||
-+	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA], &td->tx_antenna_mask, 1, 0xff) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_SPE_IDX], &td->tx_spe_idx, 0, 27) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
- 			   &td->tx_duty_cycle, 0, 99) ||
--- 
-2.25.1
-
diff --git a/recipes-kernel/linux-mt76/files/patches/0004-mt76-mt7915-drop-undefined-action-frame.patch b/recipes-kernel/linux-mt76/files/patches/0003-mt76-mt7915-drop-undefined-action-frame.patch
similarity index 86%
rename from recipes-kernel/linux-mt76/files/patches/0004-mt76-mt7915-drop-undefined-action-frame.patch
rename to recipes-kernel/linux-mt76/files/patches/0003-mt76-mt7915-drop-undefined-action-frame.patch
index b9dc31b..c48bc4c 100644
--- a/recipes-kernel/linux-mt76/files/patches/0004-mt76-mt7915-drop-undefined-action-frame.patch
+++ b/recipes-kernel/linux-mt76/files/patches/0003-mt76-mt7915-drop-undefined-action-frame.patch
@@ -1,14 +1,14 @@
-From 96fcb3f5306bceb4f04ca87d097df6f7d391a147 Mon Sep 17 00:00:00 2001
+From 71dc778b26769005bb0396d0a167ad18a7599ad9 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 14 Apr 2022 15:18:02 +0800
-Subject: [PATCH 4/7] mt76: mt7915: drop undefined action frame
+Subject: [PATCH 3/3] mt76: mt7915: drop undefined action frame
 
 ---
  mt7915/mac.c | 6 ++++++
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index b2322762..967e348c 100644
+index a76c82b..8ef5ddc 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -684,6 +684,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -32,5 +32,5 @@
  	if (id < 0)
  		return id;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/0005-mt76-common-RF-CR-idx-require-8-bits.patch b/recipes-kernel/linux-mt76/files/patches/0005-mt76-common-RF-CR-idx-require-8-bits.patch
deleted file mode 100644
index f13b609..0000000
--- a/recipes-kernel/linux-mt76/files/patches/0005-mt76-common-RF-CR-idx-require-8-bits.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From dfee8e4b5b042c1a0c2fa3b9bed6c4d212091813 Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Mon, 13 Jun 2022 23:10:26 +0800
-Subject: [PATCH 5/7] mt76: common: RF CR idx require 8 bits
-
-Change-Id: I95af9cca36052be090be776868822d0a74377c9d
----
- mt7915/mcu.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d9c9805b..2d6642e6 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -3442,8 +3442,8 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
- 		__le32 ofs;
- 		__le32 data;
- 	} __packed req = {
--		.idx = cpu_to_le32(u32_get_bits(regidx, GENMASK(31, 28))),
--		.ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(27, 0))),
-+		.idx = cpu_to_le32(u32_get_bits(regidx, GENMASK(31, 24))),
-+		.ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(23, 0))),
- 		.data = set ? cpu_to_le32(*val) : 0,
- 	};
- 	struct sk_buff *skb;
--- 
-2.25.1
-
diff --git a/recipes-kernel/linux-mt76/files/patches/0006-mt76-mt7915-add-spatial-extension-index-support.patch b/recipes-kernel/linux-mt76/files/patches/0006-mt76-mt7915-add-spatial-extension-index-support.patch
deleted file mode 100644
index 4080c1d..0000000
--- a/recipes-kernel/linux-mt76/files/patches/0006-mt76-mt7915-add-spatial-extension-index-support.patch
+++ /dev/null
@@ -1,189 +0,0 @@
-From f93eece806a777bea73ab2fcca1869b1b4b87b5c Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Wed, 13 Jul 2022 10:43:16 +0800
-Subject: [PATCH 6/7] mt76: mt7915: add spatial extension index support
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- mt76_connac.h     | 11 +++++++++++
- mt76_connac_mac.c | 11 ++++++++---
- mt76_connac_mcu.h |  2 +-
- mt7915/main.c     |  3 ---
- mt7915/mcu.c      | 20 +++++++++++++++++++-
- mt7915/mcu.h      |  1 +
- mt7915/testmode.c |  9 +++------
- 7 files changed, 43 insertions(+), 14 deletions(-)
-
-diff --git a/mt76_connac.h b/mt76_connac.h
-index 635192c8..0915eb57 100644
---- a/mt76_connac.h
-+++ b/mt76_connac.h
-@@ -261,6 +261,17 @@ mt76_connac_txwi_to_txp(struct mt76_dev *dev, struct mt76_txwi_cache *t)
- 	return (void *)(txwi + MT_TXD_SIZE);
- }
- 
-+static inline u8 mt76_connac_spe_idx(u8 antenna_mask)
-+{
-+	static const u8 ant_to_spe[] = {0, 0, 1, 0, 3, 2, 4, 0,
-+					9, 8, 6, 10, 16, 12, 18, 0};
-+
-+	if (antenna_mask >= sizeof(ant_to_spe))
-+		return 0;
-+
-+	return ant_to_spe[antenna_mask];
-+}
-+
- int mt76_connac_pm_wake(struct mt76_phy *phy, struct mt76_connac_pm *pm);
- void mt76_connac_power_save_sched(struct mt76_phy *phy,
- 				  struct mt76_connac_pm *pm);
-diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index 34ac3d81..8b7ec64a 100644
---- a/mt76_connac_mac.c
-+++ b/mt76_connac_mac.c
-@@ -417,9 +417,6 @@ mt76_connac2_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi,
- 	if (ieee80211_is_beacon(fc)) {
- 		txwi[3] &= ~cpu_to_le32(MT_TXD3_SW_POWER_MGMT);
- 		txwi[3] |= cpu_to_le32(MT_TXD3_REM_TX_COUNT);
--		if (!is_mt7921(dev))
--			txwi[7] |= cpu_to_le32(FIELD_PREP(MT_TXD7_SPE_IDX,
--							  0x18));
- 	}
- 
- 	if (info->flags & IEEE80211_TX_CTL_INJECTED) {
-@@ -550,6 +547,14 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
- 		val |= FIELD_PREP(MT_TXD6_TX_RATE, rate);
- 		txwi[6] |= cpu_to_le32(val);
- 		txwi[3] |= cpu_to_le32(MT_TXD3_BA_DISABLE);
-+
-+		if (!is_mt7921(dev)) {
-+			u8 spe_idx = mt76_connac_spe_idx(mphy->antenna_mask);
-+
-+			if (!spe_idx)
-+				spe_idx = 24 + phy_idx;
-+			txwi[7] |= cpu_to_le32(FIELD_PREP(MT_TXD7_SPE_IDX, spe_idx));
-+		}
- 	}
- }
- EXPORT_SYMBOL_GPL(mt76_connac2_mac_write_txwi);
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f62af7a8..31017218 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -580,7 +580,7 @@ struct sta_rec_ra_fixed {
- 
- 	struct sta_phy phy;
- 
--	u8 spe_en;
-+	u8 spe_idx;
- 	u8 short_preamble;
- 	u8 is_5g;
- 	u8 mmps_mode;
-diff --git a/mt7915/main.c b/mt7915/main.c
-index 2557fe08..edd678ce 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -957,9 +957,6 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
- 	if (!tx_ant || tx_ant != rx_ant || ffs(tx_ant) > max_nss)
- 		return -EINVAL;
- 
--	if ((BIT(hweight8(tx_ant)) - 1) != tx_ant)
--		tx_ant = BIT(ffs(tx_ant) - 1) - 1;
--
- 	mutex_lock(&dev->mt76.mutex);
- 
- 	phy->mt76->antenna_mask = tx_ant;
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 2d6642e6..19a33120 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -1306,6 +1306,9 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
- 	case RATE_PARAM_MMPS_UPDATE:
- 		ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->smps_mode);
- 		break;
-+	case RATE_PARAM_SPE_UPDATE:
-+		ra->spe_idx = *(u8 *)data;
-+		break;
- 	default:
- 		break;
- 	}
-@@ -1348,6 +1351,18 @@ int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
- 					      RATE_PARAM_MMPS_UPDATE);
- }
- 
-+static int
-+mt7915_mcu_set_spe_idx(struct mt7915_dev *dev, struct ieee80211_vif *vif,
-+		       struct ieee80211_sta *sta)
-+{
-+	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-+	struct mt76_phy *mphy = mvif->phy->mt76;
-+	u8 spe_idx = mt76_connac_spe_idx(mphy->antenna_mask);
-+
-+	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &spe_idx,
-+					      RATE_PARAM_SPE_UPDATE);
-+}
-+
- static int
- mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
- 			       struct ieee80211_vif *vif,
-@@ -1435,7 +1450,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
- 			return ret;
- 	}
- 
--	return 0;
-+	return mt7915_mcu_set_spe_idx(dev, vif, sta);
- }
- 
- static void
-@@ -2648,6 +2663,9 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
- 	}
- #endif
- 
-+	if (mt76_connac_spe_idx(phy->mt76->antenna_mask))
-+		req.tx_streams_num = fls(phy->mt76->antenna_mask);
-+
- 	if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
- 	    dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
- 		req.switch_reason = CH_SWITCH_NORMAL;
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 110e4f36..ed949802 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -395,6 +395,7 @@ enum {
- 	RATE_PARAM_FIXED_MCS,
- 	RATE_PARAM_FIXED_GI = 11,
- 	RATE_PARAM_AUTO = 20,
-+	RATE_PARAM_SPE_UPDATE = 22,
- };
- 
- #define RATE_CFG_MCS			GENMASK(3, 0)
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 6c05dfab..35345d35 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -473,8 +473,6 @@ mt7915_tm_update_channel(struct mt7915_phy *phy)
- static void
- mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
- {
--	static const u8 spe_idx_map[] = {0, 0, 1, 0, 3, 2, 4, 0,
--					 9, 8, 6, 10, 16, 12, 18, 0};
- 	struct mt76_testmode_data *td = &phy->mt76->test;
- 	struct mt7915_dev *dev = phy->dev;
- 	struct ieee80211_tx_info *info;
-@@ -488,11 +486,10 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
- 	if (en) {
- 		mt7915_tm_update_channel(phy);
- 
--		if (td->tx_spe_idx) {
-+		if (td->tx_spe_idx)
- 			phy->test.spe_idx = td->tx_spe_idx;
--		} else {
--			phy->test.spe_idx = spe_idx_map[td->tx_antenna_mask];
--		}
-+		else
-+			phy->test.spe_idx = mt76_connac_spe_idx(td->tx_antenna_mask);
- 	}
- 
- 	mt7915_tm_set_tam_arb(phy, en,
--- 
-2.25.1
-
diff --git a/recipes-kernel/linux-mt76/files/patches/0007-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch b/recipes-kernel/linux-mt76/files/patches/0007-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch
deleted file mode 100644
index b1eb130..0000000
--- a/recipes-kernel/linux-mt76/files/patches/0007-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 41cd86ee3b09740a84cb1aba54e669aaadcb7d2b Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Tue, 26 Jul 2022 16:04:53 +0800
-Subject: [PATCH 7/7] mt76: mt7915: set the first antenna to detect radar for
- MT7915
-
-The default value of listening antenna set by FW might be different in
-MT7915. As most of our cooperated labs use the first antenna to verify
-the radar detection function, manually set the value by a mcu command.
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- mt7915/mac.c    | 15 +++++++++++++++
- mt7915/mt7915.h |  1 +
- 2 files changed, 16 insertions(+)
-
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 967e348c..11d2866b 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -1820,6 +1820,13 @@ static int mt7915_dfs_start_rdd(struct mt7915_dev *dev, int chain)
- 	if (err < 0)
- 		return err;
- 
-+	if (is_mt7915(&dev->mt76)) {
-+		err = mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_SET_WF_ANT, chain,
-+					      0, dev->dbdc_support ? 2 : 0);
-+		if (err < 0)
-+			return err;
-+	}
-+
- 	return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_DET_MODE, chain,
- 				       MT_RX_SEL0, 1);
- }
-@@ -1940,6 +1947,14 @@ stop:
- 	if (err < 0)
- 		return err;
- 
-+	if (is_mt7915(&dev->mt76)) {
-+		err = mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_SET_WF_ANT,
-+					      phy->band_idx, 0,
-+					      dev->dbdc_support ? 2 : 0);
-+		if (err < 0)
-+			return err;
-+	}
-+
- 	mt7915_dfs_stop_radar_detector(phy);
- 	phy->mt76->dfs_state = MT_DFS_STATE_DISABLED;
- 
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 1eb11617..c90a148d 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -357,6 +357,7 @@ enum mt7915_rdd_cmd {
- 	RDD_DET_MODE,
- 	RDD_RADAR_EMULATE,
- 	RDD_START_TXQ = 20,
-+	RDD_SET_WF_ANT = 30,
- 	RDD_CAC_START = 50,
- 	RDD_CAC_END,
- 	RDD_NORMAL_START,
--- 
-2.25.1
-
diff --git a/recipes-kernel/linux-mt76/files/patches/0008-mt76-mt7915-set-chainmask-to-3-for-mt7916.patch b/recipes-kernel/linux-mt76/files/patches/0008-mt76-mt7915-set-chainmask-to-3-for-mt7916.patch
deleted file mode 100644
index 5514339..0000000
--- a/recipes-kernel/linux-mt76/files/patches/0008-mt76-mt7915-set-chainmask-to-3-for-mt7916.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-From e93433a00ee18a27cfb9ef6a9cd0df6c28f96cb7 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Wed, 21 Sep 2022 13:25:26 +0800
-Subject: [PATCH] mt76: mt7915: set chainmask to 3 for mt7916
-
-Use chainmask to represent the number of TRx path and set it to 3 for mt7916.
-Use antenna_mask to represent the TRx streams.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7915/init.c | 11 ++++++-----
- mt7915/main.c |  6 +++++-
- mt7915/mcu.c  |  2 +-
- 3 files changed, 12 insertions(+), 7 deletions(-)
-
-diff --git a/mt7915/init.c b/mt7915/init.c
-index 489f6e77..8474c11f 100644
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -730,11 +730,12 @@ void mt7915_set_stream_vht_txbf_caps(struct mt7915_phy *phy)
- }
- 
- static void
--mt7915_set_stream_he_txbf_caps(struct mt7915_dev *dev,
--			       struct ieee80211_sta_he_cap *he_cap,
--			       int vif, int nss)
-+mt7915_set_stream_he_txbf_caps(struct mt7915_phy *phy,
-+			       struct ieee80211_sta_he_cap *he_cap, int vif)
- {
-+	struct mt7915_dev *dev = phy->dev;
- 	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
-+	int nss = hweight8(phy->mt76->chainmask);
- 	u8 c, nss_160;
- 
- 	/* Can do 1/2 of NSS streams in 160Mhz mode for mt7915 */
-@@ -839,7 +840,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
- 		    struct ieee80211_sband_iftype_data *data)
- {
- 	struct mt7915_dev *dev = phy->dev;
--	int i, idx = 0, nss = hweight8(phy->mt76->chainmask);
-+	int i, idx = 0, nss = hweight8(phy->mt76->antenna_mask);
- 	u16 mcs_map = 0;
- 	u16 mcs_map_160 = 0;
- 	u8 nss_160;
-@@ -972,7 +973,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
- 		he_mcs->rx_mcs_80p80 = cpu_to_le16(mcs_map_160);
- 		he_mcs->tx_mcs_80p80 = cpu_to_le16(mcs_map_160);
- 
--		mt7915_set_stream_he_txbf_caps(dev, he_cap, i, nss);
-+		mt7915_set_stream_he_txbf_caps(phy, he_cap, i);
- 
- 		memset(he_cap->ppe_thres, 0, sizeof(he_cap->ppe_thres));
- 		if (he_cap_elem->phy_cap_info[6] &
-diff --git a/mt7915/main.c b/mt7915/main.c
-index edd678ce..fc5319da 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -952,6 +952,7 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
- 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
- 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
- 	int max_nss = hweight8(hw->wiphy->available_antennas_tx);
-+	int tx_nss = hweight8(tx_ant), rx_nss = hweight8(rx_ant);
- 	bool ext_phy = phy != &dev->phy;
- 
- 	if (!tx_ant || tx_ant != rx_ant || ffs(tx_ant) > max_nss)
-@@ -964,7 +965,10 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
- 	if (ext_phy)
- 		tx_ant <<= dev->chainshift;
- 
--	phy->mt76->chainmask = tx_ant;
-+	if (is_mt7916(&dev->mt76) && tx_nss == max_nss && rx_nss == max_nss)
-+		phy->mt76->chainmask = 0x7;
-+	else
-+		phy->mt76->chainmask = tx_ant;
- 
- 	mt76_set_stream_caps(phy->mt76, true);
- 	mt7915_set_stream_vht_txbf_caps(phy);
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 19a33120..f11ca25d 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -485,7 +485,7 @@ static void
- mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
- 		      struct mt7915_phy *phy)
- {
--	int max_nss = hweight8(phy->mt76->chainmask);
-+	int max_nss = hweight8(phy->mt76->antenna_mask);
- 	struct bss_info_ra *ra;
- 	struct tlv *tlv;
- 
--- 
-2.18.0
-
diff --git a/recipes-kernel/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/recipes-kernel/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
index 410adde..e75b064 100644
--- a/recipes-kernel/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -1,7 +1,7 @@
-From 30238567bb559bd31644a811d75d63c808a4d55f Mon Sep 17 00:00:00 2001
+From 66c81406b30b24a50be33f5434664191b7cf7ab0 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
-Subject: [PATCH] mt76: mt7915: add mtk internal debug tools for mt76
+Subject: [PATCH 1001/1009] mt76: mt7915: add mtk internal debug tools for mt76
 
 ---
  mt76_connac_mcu.h     |    7 +
@@ -22,7 +22,7 @@
  create mode 100644 mt7915/mtk_mcu.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 31017218..06813f77 100644
+index 3101721..06813f7 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1104,6 +1104,7 @@ enum {
@@ -47,7 +47,7 @@
  	MCU_EXT_CMD_CAL_CACHE = 0x67,
  	MCU_EXT_CMD_SET_RADAR_TH = 0x7c,
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index b794ceb7..a3474e2f 100644
+index b794ceb..a3474e2 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -3,7 +3,7 @@
@@ -61,7 +61,7 @@
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 \ No newline at end of file
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index a4e37a52..ea512fd1 100644
+index b95c81d..fd0c9d1 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -8,6 +8,9 @@
@@ -205,7 +205,7 @@
  
  	if (dev->relay_fwlog)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 11d2866b..00218624 100644
+index 8ef5ddc..2ff90f7 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -239,6 +239,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -244,7 +244,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index fc5319da..1eb8107a 100644
+index 0dffe82..7913059 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -62,7 +62,11 @@ static int mt7915_start(struct ieee80211_hw *hw)
@@ -260,7 +260,7 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f11ca25d..44d461d7 100644
+index 2f6d328..c710624 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -195,6 +195,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -352,7 +352,7 @@
 +}
 +#endif
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index ed949802..bfb822fa 100644
+index ed94980..bfb822f 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -259,6 +259,10 @@ enum {
@@ -367,7 +367,7 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index c90a148d..193b8ab4 100644
+index fe6a6d3..c0dfe10 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -408,9 +408,9 @@
  };
  
  enum {
-@@ -592,4 +616,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 			    struct ieee80211_sta *sta, struct dentry *dir);
- #endif
+@@ -594,4 +618,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 			 bool pci, int *irq);
  
 +#ifdef MTK_DEBUG
 +int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
@@ -435,7 +435,7 @@
  #endif
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
 new file mode 100644
-index 00000000..58ba2cdf
+index 0000000..58ba2cd
 --- /dev/null
 +++ b/mt7915/mt7915_debug.h
 @@ -0,0 +1,1350 @@
@@ -1062,7 +1062,7 @@
 +#define MT_DBG_UWTBL_TOP_BASE			0x820C4000
 +#define MT_DBG_UWTBL_TOP(ofs)			(MT_DBG_UWTBL_TOP_BASE + (ofs))
 +
-+#define MT_DBG_UWTBL_TOP_WDUCR			MT_DBG_WTBLON_TOP(__DBG_REG_OFFS(dev, DBG_UWTBL_WDUCR))
++#define MT_DBG_UWTBL_TOP_WDUCR			MT_DBG_UWTBL_TOP(__DBG_REG_OFFS(dev, DBG_UWTBL_WDUCR))
 +
 +#define MT_UWTBL_TOP_WDUCR_TARGET		BIT(31)
 +#define MT_UWTBL_TOP_WDUCR_GROUP		GENMASK(3, 0)
@@ -1791,7 +1791,7 @@
 +#endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
 new file mode 100644
-index 00000000..747a9014
+index 0000000..747a901
 --- /dev/null
 +++ b/mt7915/mtk_debugfs.c
 @@ -0,0 +1,2925 @@
@@ -4722,7 +4722,7 @@
 +#endif
 diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
 new file mode 100644
-index 00000000..145fe785
+index 0000000..145fe78
 --- /dev/null
 +++ b/mt7915/mtk_mcu.c
 @@ -0,0 +1,51 @@
@@ -4778,7 +4778,7 @@
 +				 sizeof(req), true);
 +}
 diff --git a/tools/fwlog.c b/tools/fwlog.c
-index e5d4a105..3d51d9ec 100644
+index e5d4a10..3d51d9e 100644
 --- a/tools/fwlog.c
 +++ b/tools/fwlog.c
 @@ -26,7 +26,7 @@ static const char *debugfs_path(const char *phyname, const char *file)
diff --git a/recipes-kernel/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch b/recipes-kernel/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
index d020e94..d578e64 100644
--- a/recipes-kernel/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
@@ -1,4 +1,4 @@
-From 87e6f3e21a575655e449ff2d09a27e3933940842 Mon Sep 17 00:00:00 2001
+From 0da94e40be885271ff884b581117498f2e4db997 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Jun 2022 20:13:02 +0800
 Subject: [PATCH 1002/1009] mt76: mt7915: csi: implement csi support
@@ -17,7 +17,7 @@
  create mode 100644 mt7915/vendor.h
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 89732676..90bf841e 100644
+index 06813f7..5d7c911 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -979,6 +979,7 @@ enum {
@@ -28,7 +28,7 @@
  };
  
  enum {
-@@ -1149,6 +1150,7 @@ enum {
+@@ -1150,6 +1151,7 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -37,7 +37,7 @@
  
  enum {
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index a3474e2f..e272c826 100644
+index a3474e2..e272c82 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -1,9 +1,9 @@
@@ -54,7 +54,7 @@
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 \ No newline at end of file
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 489f6e77..6efa28fe 100644
+index 416e5ac..34b5df7 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -547,6 +547,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
@@ -70,7 +70,7 @@
  	ret = mt76_register_phy(mphy, true, mt76_rates,
  				ARRAY_SIZE(mt76_rates));
  	if (ret)
-@@ -1037,6 +1043,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
+@@ -1036,6 +1042,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
  	}
  }
  
@@ -96,7 +96,7 @@
  static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  {
  	struct mt7915_phy *phy = mt7915_ext_phy(dev);
-@@ -1045,6 +1070,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
+@@ -1044,6 +1069,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  	if (!phy)
  		return;
  
@@ -107,7 +107,7 @@
  	mt7915_unregister_thermal(phy);
  	mt76_unregister_phy(mphy);
  	ieee80211_free_hw(mphy->hw);
-@@ -1057,6 +1086,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
+@@ -1056,6 +1085,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
  	mt7915_dma_cleanup(dev);
  	tasklet_disable(&dev->irq_tasklet);
  
@@ -118,7 +118,7 @@
  	if (is_mt7986(&dev->mt76))
  		mt7986_wmac_disable(dev);
  }
-@@ -1097,6 +1130,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1096,6 +1129,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	dev->mt76.test_ops = &mt7915_testmode_ops;
  #endif
  
@@ -132,7 +132,7 @@
  	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
  		dev->mt76.led_cdev.brightness_set = mt7915_led_set_brightness;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index e498b61f..48e9e5ec 100644
+index c710624..d9ff5a3 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -32,6 +32,10 @@
@@ -268,7 +268,7 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index bfb822fa..a27129c2 100644
+index bfb822f..a27129c 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -480,4 +480,80 @@ enum {
@@ -353,7 +353,7 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 8990b5b0..4914c91d 100644
+index c0dfe10..bcfcf6f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -274,6 +274,20 @@ struct mt7915_phy {
@@ -377,9 +377,9 @@
  };
  
  struct mt7915_dev {
-@@ -616,6 +630,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 			    struct ieee80211_sta *sta, struct dentry *dir);
- #endif
+@@ -618,6 +632,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 			 bool pci, int *irq);
  
 +#ifdef CONFIG_MTK_VENDOR
 +void mt7915_vendor_register(struct mt7915_phy *phy);
@@ -392,7 +392,7 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
 new file mode 100644
-index 00000000..98fd9c2d
+index 0000000..98fd9c2
 --- /dev/null
 +++ b/mt7915/vendor.c
 @@ -0,0 +1,452 @@
@@ -850,7 +850,7 @@
 +}
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
 new file mode 100644
-index 00000000..9d3db2a7
+index 0000000..9d3db2a
 --- /dev/null
 +++ b/mt7915/vendor.h
 @@ -0,0 +1,60 @@
@@ -915,5 +915,5 @@
 +
 +#endif
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch b/recipes-kernel/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
index e3fd6a0..9eb1876 100644
--- a/recipes-kernel/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1003-mt76-mt7915-air-monitor-support.patch
@@ -1,4 +1,4 @@
-From 63af0047d060a1e8c7469a7115f9f69920f20ac5 Mon Sep 17 00:00:00 2001
+From e5b6d9784c5d5866df066f448940046a093aa9e4 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 11 Jan 2022 12:03:23 +0800
 Subject: [PATCH 1003/1009] mt76: mt7915: air monitor support
@@ -13,10 +13,10 @@
  6 files changed, 440 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 90bf841e..80515382 100644
+index 5d7c911..d87ad38 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1150,6 +1150,8 @@ enum {
+@@ -1151,6 +1151,8 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -26,7 +26,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 00218624..9f17f0b7 100644
+index 2ff90f7..78190af 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -486,6 +486,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -41,7 +41,7 @@
  		status->flag |= RX_FLAG_8023;
  	}
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 48b8be17..c27f9b54 100644
+index 7913059..35cd7ad 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -675,6 +675,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -55,7 +55,7 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 4914c91d..32d66c4c 100644
+index bcfcf6f..4c3bb62 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -229,6 +229,35 @@ struct mt7915_hif {
@@ -103,7 +103,7 @@
  #endif
  };
  
-@@ -634,6 +665,9 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -636,6 +667,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
@@ -114,7 +114,7 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 98fd9c2d..b94d787e 100644
+index 98fd9c2..b94d787 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -430,6 +430,353 @@ out:
@@ -491,7 +491,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 9d3db2a7..976817f3 100644
+index 9d3db2a..976817f 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -4,6 +4,7 @@
@@ -545,5 +545,5 @@
 +
  #endif
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/recipes-kernel/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
index 62ecc61..e5a31be 100644
--- a/recipes-kernel/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -1,4 +1,4 @@
-From 781871b4690c21e24ba3a86b488efb46aaa402c5 Mon Sep 17 00:00:00 2001
+From 952b05674331043bc5e904a16b7ec4e5634f5b5f Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:45:53 +0800
 Subject: [PATCH 1004/1009] mt76: mt7915: add support for muru_onoff via
@@ -12,7 +12,7 @@
  4 files changed, 47 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 6efa28fe..37b7b54a 100644
+index 34b5df7..479b984 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -582,6 +582,7 @@ static void mt7915_init_work(struct work_struct *work)
@@ -24,7 +24,7 @@
  
  void mt7915_wfsys_reset(struct mt7915_dev *dev)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 48e9e5ec..ed789707 100644
+index d9ff5a3..4c04760 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -856,13 +856,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
@@ -49,7 +49,7 @@
  		muru->mimo_dl.vht_mu_bfee =
  			!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index a27129c2..d3cc8283 100644
+index a27129c..d3cc828 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -556,4 +556,10 @@ struct csi_data {
@@ -64,7 +64,7 @@
 +
  #endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index f18c8b6c..e239df95 100644
+index 747a901..176937a 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2480,6 +2480,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
@@ -106,7 +106,7 @@
  static int mt7915_amsduinfo_read(struct seq_file *s, void *data)
  {
  	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-@@ -2857,6 +2889,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -2859,6 +2891,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
  
@@ -115,5 +115,5 @@
  			    &fops_fw_debug_module);
  	debugfs_create_file("fw_debug_level", 0600, dir, dev,
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1005-mt76-certification-patches.patch b/recipes-kernel/linux-mt76/files/patches/1005-mt76-certification-patches.patch
index 7b5aabf..f91650a 100644
--- a/recipes-kernel/linux-mt76/files/patches/1005-mt76-certification-patches.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1005-mt76-certification-patches.patch
@@ -1,4 +1,4 @@
-From 05302c18e285b0dbdc3d0c1ea14819c6be425bb9 Mon Sep 17 00:00:00 2001
+From 280df913359a09229adfeb301edd1f64c9f4c464 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 6 Jun 2022 20:15:51 +0800
 Subject: [PATCH 1005/1009] mt76: certification patches
@@ -16,10 +16,10 @@
  9 files changed, 956 insertions(+), 5 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 80515382..9fb75e6e 100644
+index d87ad38..01035b2 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1152,6 +1152,7 @@ enum {
+@@ -1153,6 +1153,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -28,7 +28,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 9f17f0b7..4d777fd5 100644
+index 78190af..7caa0ec 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -7,6 +7,7 @@
@@ -39,7 +39,7 @@
  
  #define to_rssi(field, rxv)	((FIELD_GET(field, rxv) - 220) / 2)
  
-@@ -1741,6 +1742,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+@@ -1752,6 +1753,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
  	phy->trb_ts = trb;
  }
  
@@ -61,7 +61,7 @@
  void mt7915_mac_sta_rc_work(struct work_struct *work)
  {
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev, rc_work);
-@@ -1763,6 +1779,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
+@@ -1774,6 +1790,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
  		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
  		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
  
@@ -76,7 +76,7 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index c27f9b54..e2f557a2 100644
+index 35cd7ad..abfdc72 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -653,6 +653,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -109,7 +109,7 @@
  
  void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ed789707..b4cf4d86 100644
+index 4c04760..8731f7d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -3574,6 +3574,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -586,7 +586,7 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index d3cc8283..aab1a6a3 100644
+index d3cc828..aab1a6a 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -396,10 +396,14 @@ enum {
@@ -820,11 +820,11 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 32d66c4c..f08974bb 100644
+index 4c3bb62..93afa3d 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -662,6 +662,19 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- #endif
+@@ -664,6 +664,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
 +void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta);
@@ -844,7 +844,7 @@
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index e239df95..222268fc 100644
+index 176937a..e24b4d7 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2486,7 +2486,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
@@ -869,7 +869,7 @@
         }
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index b94d787e..7456c577 100644
+index b94d787..7456c57 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -22,6 +22,29 @@ csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
@@ -1081,7 +1081,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 976817f3..1b08321c 100644
+index 976817f..1b08321 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -6,6 +6,48 @@
@@ -1134,5 +1134,5 @@
  
  enum mtk_vendor_attr_csi_ctrl {
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch b/recipes-kernel/linux-mt76/files/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
index 76ecbcf..8df260a 100644
--- a/recipes-kernel/linux-mt76/files/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
@@ -1,4 +1,4 @@
-From 18093d743469680c1ae7b8f91837dc3804cc1756 Mon Sep 17 00:00:00 2001
+From 8df2b764386b00bbe48eb2f7e0d6829ce36eccda Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Wed, 22 Jun 2022 10:51:59 +0800
 Subject: [PATCH 1006/1009] mt76: mt7915: add L0.5 system error recovery
@@ -18,7 +18,7 @@
  10 files changed, 491 insertions(+), 98 deletions(-)
 
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index ea512fd1..0fe95f84 100644
+index fd0c9d1..f585eb9 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -52,12 +52,17 @@ static ssize_t
@@ -142,10 +142,10 @@
  	kfree(buff);
  	return ret;
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index f7e6bb10..4b594a53 100644
+index edae845..e391886 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
-@@ -479,6 +479,54 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -514,6 +514,54 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  	return 0;
  }
  
@@ -201,7 +201,7 @@
  {
  	mt7915_dma_disable(dev, true);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 37b7b54a..141c5ad8 100644
+index 479b984..d83ba2b 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -262,7 +262,7 @@ static void mt7915_led_set_brightness(struct led_classdev *led_cdev,
@@ -231,7 +231,7 @@
  {
  	int ret;
  
-@@ -1162,6 +1162,8 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1161,6 +1161,8 @@ int mt7915_register_device(struct mt7915_dev *dev)
  
  	mt7915_init_debugfs(&dev->phy);
  
@@ -241,7 +241,7 @@
  
  unreg_thermal:
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 4d777fd5..d44af409 100644
+index 7caa0ec..cac296e 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -3,6 +3,7 @@
@@ -252,7 +252,7 @@
  #include "mt7915.h"
  #include "../dma.h"
  #include "mac.h"
-@@ -1318,85 +1319,187 @@ mt7915_update_beacons(struct mt7915_dev *dev)
+@@ -1329,85 +1330,187 @@ mt7915_update_beacons(struct mt7915_dev *dev)
  		mt7915_update_vif_beacon, mphy_ext->hw);
  }
  
@@ -499,7 +499,7 @@
  }
  
  /* system error recovery */
-@@ -1411,6 +1514,36 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1422,6 +1525,36 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	ext_phy = dev->mt76.phys[MT_BAND1];
  	phy2 = ext_phy ? ext_phy->priv : NULL;
  
@@ -536,7 +536,7 @@
  	if (!(READ_ONCE(dev->reset_state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
-@@ -1436,7 +1569,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1447,7 +1580,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_STOPPED);
  
  	if (mt7915_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) {
@@ -545,7 +545,7 @@
  
  		mt7915_tx_token_put(dev);
  		idr_init(&dev->mt76.token);
-@@ -1485,6 +1618,34 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1496,6 +1629,34 @@ void mt7915_mac_reset_work(struct work_struct *work)
  					     MT7915_WATCHDOG_TIME);
  }
  
@@ -581,7 +581,7 @@
  {
  	struct mt7915_dev *dev = phy->dev;
 diff --git a/mt7915/main.c b/mt7915/main.c
-index e2f557a2..5b25604e 100644
+index abfdc72..98dce0f 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -20,17 +20,13 @@ static bool mt7915_dev_running(struct mt7915_dev *dev)
@@ -631,7 +631,7 @@
  	mutex_lock(&dev->mt76.mutex);
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index b4cf4d86..3f18967a 100644
+index 8731f7d..7984432 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -150,19 +150,90 @@ mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
@@ -767,7 +767,7 @@
  {
  	__mt76_mcu_restart(&dev->mt76);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index aab1a6a3..c4850644 100644
+index aab1a6a..c485064 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -453,8 +453,9 @@ enum {
@@ -782,34 +782,34 @@
  	SER_SET_RECOVER_L3_RX_ABORT,
  	SER_SET_RECOVER_L3_TX_ABORT,
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 68d978f4..fd2f70e3 100644
+index 9c2c508..2e73bd7 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -24,6 +24,7 @@ static const u32 mt7915_reg[] = {
- 	[INFRA_MCU_ADDR_END]	= 0x7c3fffff,
- 	[FW_EXCEPTION_ADDR]	= 0x219848,
+@@ -29,6 +29,7 @@ static const u32 mt7915_reg[] = {
  	[SWDEF_BASE_ADDR]	= 0x41f200,
+ 	[TXQ_WED_RING_BASE]	= 0xd7300,
+ 	[RXQ_WED_RING_BASE]	= 0xd7410,
 +	[EXCEPTION_BASE_ADDR]	= 0x219848,
  };
  
  static const u32 mt7916_reg[] = {
-@@ -40,6 +41,7 @@ static const u32 mt7916_reg[] = {
- 	[INFRA_MCU_ADDR_END]	= 0x7c085fff,
- 	[FW_EXCEPTION_ADDR]	= 0x022050bc,
+@@ -47,6 +48,7 @@ static const u32 mt7916_reg[] = {
  	[SWDEF_BASE_ADDR]	= 0x411400,
+ 	[TXQ_WED_RING_BASE]	= 0xd7300,
+ 	[RXQ_WED_RING_BASE]	= 0xd7410,
 +	[EXCEPTION_BASE_ADDR]	= 0x022050BC,
  };
  
  static const u32 mt7986_reg[] = {
-@@ -56,6 +58,7 @@ static const u32 mt7986_reg[] = {
- 	[INFRA_MCU_ADDR_END]	= 0x7c085fff,
- 	[FW_EXCEPTION_ADDR]	= 0x02204ffc,
+@@ -65,6 +67,7 @@ static const u32 mt7986_reg[] = {
  	[SWDEF_BASE_ADDR]	= 0x411400,
+ 	[TXQ_WED_RING_BASE]	= 0x24420,
+ 	[RXQ_WED_RING_BASE]	= 0x24520,
 +	[EXCEPTION_BASE_ADDR]	= 0x02204FFC,
  };
  
  static const u32 mt7915_offs[] = {
-@@ -615,10 +618,9 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
+@@ -748,10 +751,9 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
  		u32 val = mt76_rr(dev, MT_MCU_CMD);
  
  		mt76_wr(dev, MT_MCU_CMD, val);
@@ -823,7 +823,7 @@
  	}
  }
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index f08974bb..e8feba36 100644
+index 93afa3d..6868813 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -350,6 +350,15 @@ struct mt7915_dev {
@@ -871,18 +871,18 @@
  int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  			       struct mt7915_vif *mvif,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 6d9d187a..e2b0ff7d 100644
+index 2e44537..3f283a8 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -26,6 +26,7 @@ enum reg_rev {
- 	INFRA_MCU_ADDR_END,
- 	FW_EXCEPTION_ADDR,
+@@ -28,6 +28,7 @@ enum reg_rev {
  	SWDEF_BASE_ADDR,
+ 	TXQ_WED_RING_BASE,
+ 	RXQ_WED_RING_BASE,
 +	EXCEPTION_BASE_ADDR,
  	__MT_REG_MAX,
  };
  
-@@ -108,6 +109,11 @@ enum offs_rev {
+@@ -110,6 +111,11 @@ enum offs_rev {
  #define __REG(id)			(dev->reg.reg_rev[(id)])
  #define __OFFS(id)			(dev->reg.offs_rev[(id)])
  
@@ -894,7 +894,7 @@
  /* MCU WFDMA0 */
  #define MT_MCU_WFDMA0_BASE		0x2000
  #define MT_MCU_WFDMA0(ofs)		(MT_MCU_WFDMA0_BASE + (ofs))
-@@ -563,6 +569,10 @@ enum offs_rev {
+@@ -565,6 +571,10 @@ enum offs_rev {
  #define MT_WFDMA0_PRI_DLY_INT_CFG1	MT_WFDMA0(0x2f4)
  #define MT_WFDMA0_PRI_DLY_INT_CFG2	MT_WFDMA0(0x2f8)
  
@@ -905,7 +905,7 @@
  /* WFDMA1 */
  #define MT_WFDMA1_BASE			0xd5000
  #define MT_WFDMA1(ofs)			(MT_WFDMA1_BASE + (ofs))
-@@ -708,6 +718,10 @@ enum offs_rev {
+@@ -721,6 +731,10 @@ enum offs_rev {
  #define MT_MCU_CMD_NORMAL_STATE		BIT(5)
  #define MT_MCU_CMD_ERROR_MASK		GENMASK(5, 1)
  
@@ -916,7 +916,7 @@
  /* TOP RGU */
  #define MT_TOP_RGU_BASE			0x18000000
  #define MT_TOP_PWR_CTRL			(MT_TOP_RGU_BASE + (0x0))
-@@ -983,6 +997,8 @@ enum offs_rev {
+@@ -996,6 +1010,8 @@ enum offs_rev {
  #define MT_CPU_UTIL_PEAK_IDLE_CNT	MT_CPU_UTIL(0x0c)
  #define MT_CPU_UTIL_CTRL		MT_CPU_UTIL(0x1c)
  
@@ -926,5 +926,5 @@
  #define MT_LED_TOP_BASE			0x18013000
  #define MT_LED_PHYS(_n)			(MT_LED_TOP_BASE + (_n))
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch b/recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
index b7d2f5b..cee0d14 100644
--- a/recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
@@ -1,4 +1,4 @@
-From e937fef1994ae95703ae1920db249a68e7da0549 Mon Sep 17 00:00:00 2001
+From d8a6f77dc9b3c58499375951b17c8f124668dd86 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Fri, 27 May 2022 15:51:48 +0800
 Subject: [PATCH 1007/1009] mt76: mt7915:add support for runtime set in-band
@@ -10,7 +10,7 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 3f18967a..a3035597 100644
+index 7984432..d36bcd0 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2022,8 +2022,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
@@ -33,5 +33,5 @@
  	buf = (u8 *)tlv + sizeof(*discov);
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/recipes-kernel/linux-mt76/files/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
index 3dcce36..c205a87 100644
--- a/recipes-kernel/linux-mt76/files/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -1,4 +1,4 @@
-From fd62d0e9fb340653b1f5e78f5492848b1e686ea5 Mon Sep 17 00:00:00 2001
+From 602c89b9ac8e7fec5ab466a28a4457c70da37b53 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:53:43 +0800
 Subject: [PATCH 1008/1009] mt76: mt7915: add mt76 vendor muru onoff command
@@ -11,7 +11,7 @@
  4 files changed, 63 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index a3035597..c8c8be49 100644
+index d36bcd0..bcecc5e 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -3670,6 +3670,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
@@ -29,7 +29,7 @@
  }
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index c4850644..0a77ad0d 100644
+index c485064..0a77ad0 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -403,6 +403,7 @@ enum {
@@ -41,7 +41,7 @@
  };
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 7456c577..c7551848 100644
+index 7456c57..c755184 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -34,6 +34,11 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -109,7 +109,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 1b08321c..a8e4ebf9 100644
+index 1b08321..a8e4ebf 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -8,6 +8,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -139,5 +139,5 @@
  	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch b/recipes-kernel/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch
index b7d2df3..fd99f23 100644
--- a/recipes-kernel/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch
@@ -1,7 +1,7 @@
-From c0238eeeaec21b5f1e0087bec4b6306d3c5aed53 Mon Sep 17 00:00:00 2001
+From 3240a8b38a26ca9293db89e3e5bf8f48f5434518 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 17 Aug 2022 13:40:24 +0800
-Subject: [PATCH] mt76: mt7915: add fw_version dump
+Subject: [PATCH 1009/1009] mt76: mt7915: add fw_version dump
 
 ---
  mt76.h               |  4 ++++
@@ -10,10 +10,10 @@
  3 files changed, 32 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index e4a248a1..b5453d35 100644
+index aef6006..fac1dfb 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -837,6 +837,10 @@ struct mt76_dev {
+@@ -823,6 +823,10 @@ struct mt76_dev {
  		struct mt76_usb usb;
  		struct mt76_sdio sdio;
  	};
@@ -25,7 +25,7 @@
  
  struct mt76_power_limits {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index ed6c9ebb..be2a2de1 100644
+index ed6c9eb..be2a2de 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -2889,6 +2889,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
@@ -59,7 +59,7 @@
  		struct mt76_connac2_patch_sec *sec;
  		u32 len, addr, mode;
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 222268fc..ef0c27d2 100644
+index e24b4d7..9de5b0f 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2721,6 +2721,22 @@ static int mt7915_agginfo_read_band1(struct seq_file *s, void *data)
@@ -70,7 +70,7 @@
 +{
 +	struct mt7915_dev *dev = dev_get_drvdata(s->private);
 +	struct mt76_dev *mdev = NULL;
-+	seq_printf(s, "Version: 2.2.5.0\n");
++	seq_printf(s, "Version: 2.2.6.0\n");
 +
 +	if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 +		return 0;
@@ -85,7 +85,7 @@
  /*usage: <en> <num> <len>
  	en: BIT(16) 0: sw amsdu  1: hw amsdu
  	num: GENMASK(15, 8) range 1-8
-@@ -2952,6 +2968,9 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -2954,6 +2970,9 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
  
diff --git a/recipes-kernel/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch b/recipes-kernel/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch
index 2179d74..0265815 100644
--- a/recipes-kernel/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1111-mt76-testmode-additional-supports.patch
@@ -1,4 +1,4 @@
-From ee15bb2a93f96ebe3169c9bbda9855da4314d3b4 Mon Sep 17 00:00:00 2001
+From 7846c2ea51d1b3f037688af0ea1bed306683daf0 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
 Subject: [PATCH 1111/1124] mt76: testmode: additional supports
@@ -27,7 +27,7 @@
  19 files changed, 1961 insertions(+), 146 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 40cb9109..8ea09e6e 100644
+index 40cb910..8ea09e6 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -426,8 +426,7 @@ free:
@@ -41,7 +41,7 @@
  #endif
  
 diff --git a/mac80211.c b/mac80211.c
-index c5ef5940..f34a93e0 100644
+index 7ef853c..454f449 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
@@ -71,10 +71,10 @@
  
  static const struct ieee80211_channel mt76_channels_6ghz[] = {
 diff --git a/mt76.h b/mt76.h
-index b5453d35..0e4eea16 100644
+index fac1dfb..c4cdb4b 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -636,6 +636,21 @@ struct mt76_testmode_ops {
+@@ -624,6 +624,21 @@ struct mt76_testmode_ops {
  	int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
@@ -96,7 +96,7 @@
  };
  
  #define MT_TM_FW_RX_COUNT	BIT(0)
-@@ -644,16 +659,11 @@ struct mt76_testmode_data {
+@@ -632,16 +647,11 @@ struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
  	u32 param_set[DIV_ROUND_UP(NUM_MT76_TM_ATTRS, 32)];
@@ -113,7 +113,7 @@
  	u8 tx_rate_stbc;
  	u8 tx_ltf;
  
-@@ -669,10 +679,37 @@ struct mt76_testmode_data {
+@@ -657,10 +667,37 @@ struct mt76_testmode_data {
  	u8 tx_power[4];
  	u8 tx_power_control;
  
@@ -152,7 +152,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -1129,6 +1166,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
+@@ -1115,6 +1152,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
  #endif
  }
  
@@ -212,7 +212,7 @@
  static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  					struct sk_buff *skb,
  					struct ieee80211_hw **hw)
-@@ -1139,7 +1229,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
+@@ -1125,7 +1215,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  	for (i = 0; i < ARRAY_SIZE(dev->phys); i++) {
  		struct mt76_phy *phy = dev->phys[i];
  
@@ -222,7 +222,7 @@
  			*hw = dev->phys[i]->hw;
  			return true;
  		}
-@@ -1240,7 +1331,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1226,7 +1317,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
  		       struct netlink_callback *cb, void *data, int len);
  int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
@@ -233,7 +233,7 @@
  static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
  {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index c1ed9fef..36a2914e 100644
+index be2a2de..01561a5 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -393,6 +393,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
@@ -255,7 +255,7 @@
  		return;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 9fb75e6e..9b9878ac 100644
+index 01035b2..a60965a 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -975,6 +975,7 @@ enum {
@@ -266,7 +266,7 @@
  	MCU_EXT_EVENT_RDD_REPORT = 0x3a,
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
-@@ -1152,6 +1153,7 @@ enum {
+@@ -1153,6 +1154,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -275,7 +275,7 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 141c5ad8..538ff5c3 100644
+index d83ba2b..6833bbf 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -576,7 +576,7 @@ static void mt7915_init_work(struct work_struct *work)
@@ -288,7 +288,7 @@
  	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index d44af409..471d533b 100644
+index cac296e..d798ec8 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -565,16 +565,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
@@ -352,7 +352,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 5b25604e..ff9fd19d 100644
+index 98dce0f..0a5a4b3 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -224,7 +224,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
@@ -365,7 +365,7 @@
  		mvif->mt76.wmm_idx += 2;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index c8c8be49..ff0e91e5 100644
+index bcecc5e..1b56635 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -434,6 +434,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -406,7 +406,7 @@
  
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 0a77ad0d..ad85e56c 100644
+index 0a77ad0..ad85e56 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -8,10 +8,15 @@
@@ -463,10 +463,10 @@
  
  enum {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index fd2f70e3..088c9f3e 100644
+index 2e73bd7..1eda361 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -76,6 +76,7 @@ static const u32 mt7915_offs[] = {
+@@ -85,6 +85,7 @@ static const u32 mt7915_offs[] = {
  	[ARB_DRNGR0]		= 0x194,
  	[ARB_SCR]		= 0x080,
  	[RMAC_MIB_AIRTIME14]	= 0x3b8,
@@ -474,7 +474,7 @@
  	[AGG_AWSCR0]		= 0x05c,
  	[AGG_PCR0]		= 0x06c,
  	[AGG_ACR0]		= 0x084,
-@@ -151,6 +152,7 @@ static const u32 mt7916_offs[] = {
+@@ -160,6 +161,7 @@ static const u32 mt7916_offs[] = {
  	[ARB_DRNGR0]		= 0x1e0,
  	[ARB_SCR]		= 0x000,
  	[RMAC_MIB_AIRTIME14]	= 0x0398,
@@ -483,7 +483,7 @@
  	[AGG_PCR0]		= 0x040,
  	[AGG_ACR0]		= 0x054,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e8feba36..798c9337 100644
+index 6868813..3bfec8f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -301,6 +301,9 @@ struct mt7915_phy {
@@ -529,10 +529,10 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index e2b0ff7d..d7f71033 100644
+index 3f283a8..8fd2f69 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -45,6 +45,7 @@ enum offs_rev {
+@@ -47,6 +47,7 @@ enum offs_rev {
  	ARB_DRNGR0,
  	ARB_SCR,
  	RMAC_MIB_AIRTIME14,
@@ -540,7 +540,7 @@
  	AGG_AWSCR0,
  	AGG_PCR0,
  	AGG_ACR0,
-@@ -462,6 +463,8 @@ enum offs_rev {
+@@ -464,6 +465,8 @@ enum offs_rev {
  #define MT_WF_AGG_BASE(_band)		((_band) ? 0x820f2000 : 0x820e2000)
  #define MT_WF_AGG(_band, ofs)		(MT_WF_AGG_BASE(_band) + (ofs))
  
@@ -550,7 +550,7 @@
  							  (_n) * 4))
  #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 35345d35..bc4cd809 100644
+index 8d99edc..8f250db 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -9,6 +9,9 @@
@@ -1881,7 +1881,7 @@
 +	.set_eeprom = mt7915_tm_set_eeprom,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index a1c54c89..01b08e9e 100644
+index a1c54c8..01b08e9 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -4,6 +4,8 @@
@@ -2196,7 +2196,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 1d0d5d30..7a9ed543 100644
+index 1d0d5d3..7a9ed54 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -27,28 +27,16 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -2663,7 +2663,7 @@
  		a = nla_nest_start(msg, MT76_TM_ATTR_TX_POWER);
  		if (!a)
 diff --git a/testmode.h b/testmode.h
-index 89613266..57949f2b 100644
+index 8961326..57949f2 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -6,6 +6,8 @@
@@ -2768,7 +2768,7 @@
 +
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
-index e3f69089..6e36ab27 100644
+index e3f6908..6e36ab2 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
@@ -2894,7 +2894,7 @@
  };
  
 diff --git a/tx.c b/tx.c
-index 65e2b7c1..8b33186b 100644
+index 65e2b7c..8b33186 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -245,8 +245,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
@@ -2908,5 +2908,5 @@
  			wake_up(&dev->tx_wait);
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1112-mt76-testmode-add-pre-cal-support.patch b/recipes-kernel/linux-mt76/files/patches/1112-mt76-testmode-add-pre-cal-support.patch
index 6d942c4..9ccd494 100644
--- a/recipes-kernel/linux-mt76/files/patches/1112-mt76-testmode-add-pre-cal-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1112-mt76-testmode-add-pre-cal-support.patch
@@ -1,4 +1,4 @@
-From a000ed0273b915b24a5fe83b19b85b8a9f8a45ef Mon Sep 17 00:00:00 2001
+From a87d889131d6a636ebae5e0a51c90ded201d7e6e Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 31 Aug 2022 20:06:52 +0800
 Subject: [PATCH 1112/1124] mt76: testmode: add pre-cal support
@@ -20,7 +20,7 @@
  11 files changed, 562 insertions(+), 13 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 25f67760..4c50bfe6 100644
+index 25f6776..4c50bfe 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -89,8 +89,10 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
@@ -37,10 +37,10 @@
  
  out_put_node:
 diff --git a/mt76.h b/mt76.h
-index 0e4eea16..b28fe32f 100644
+index c4cdb4b..3ca449f 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -637,6 +637,7 @@ struct mt76_testmode_ops {
+@@ -625,6 +625,7 @@ struct mt76_testmode_ops {
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  	int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
@@ -49,7 +49,7 @@
  
  struct mt76_testmode_entry_data {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 9b9878ac..cb06827c 100644
+index a60965a..b14f931 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -971,6 +971,7 @@ enum {
@@ -61,7 +61,7 @@
  	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index 7578ac6d..b980342c 100644
+index f3e5681..88aaa16 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -39,10 +39,18 @@ enum mt7915_eeprom_field {
@@ -86,7 +86,7 @@
  
  #define MT_EE_WIFI_CONF0_TX_PATH		GENMASK(2, 0)
  #define MT_EE_WIFI_CONF0_BAND_SEL		GENMASK(7, 6)
-@@ -160,6 +168,26 @@ mt7915_tssi_enabled(struct mt7915_dev *dev, enum nl80211_band band)
+@@ -155,6 +163,26 @@ mt7915_tssi_enabled(struct mt7915_dev *dev, enum nl80211_band band)
  		return val & MT_EE_WIFI_CONF7_TSSI0_5G;
  }
  
@@ -114,7 +114,7 @@
  
  #endif
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ff0e91e5..d7e6df50 100644
+index 1b56635..34ce7d6 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -438,6 +438,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -169,7 +169,7 @@
  
  	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 798c9337..dfef078b 100644
+index 3bfec8f..f3bbdba 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -379,6 +379,10 @@ struct mt7915_dev {
@@ -192,7 +192,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index bc4cd809..7a49608c 100644
+index 8f250db..b1ce299 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -5,6 +5,7 @@
@@ -666,7 +666,7 @@
 +	.dump_precal = mt7915_tm_dump_precal,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 01b08e9e..d500987d 100644
+index 01b08e9..d500987 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -81,6 +81,11 @@ struct tm_tx_cont {
@@ -734,7 +734,7 @@
  	TAM_ARB_OP_MODE_NORMAL = 1,
  	TAM_ARB_OP_MODE_TEST,
 diff --git a/testmode.c b/testmode.c
-index 7a9ed543..82b8e983 100644
+index 7a9ed54..82b8e98 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -763,6 +763,18 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
@@ -767,7 +767,7 @@
  
  	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
 diff --git a/testmode.h b/testmode.h
-index 57949f2b..e2190e72 100644
+index 57949f2..e2190e7 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -19,6 +19,7 @@
@@ -823,7 +823,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 6e36ab27..1be1ffd6 100644
+index 6e36ab2..1be1ffd 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -11,6 +11,14 @@ static const char * const testmode_state[] = {
@@ -842,5 +842,5 @@
  
  static const char * const testmode_tx_mode[] = {
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch b/recipes-kernel/linux-mt76/files/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch
index 7f8b21b..49562c9 100644
--- a/recipes-kernel/linux-mt76/files/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch
@@ -1,4 +1,4 @@
-From eefd860e1bf33fd7a222a999a8cb8eb631150952 Mon Sep 17 00:00:00 2001
+From a5f91f701b6389e793b4c705ddd39631d18cdd80 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 12 Sep 2022 18:16:54 +0800
 Subject: [PATCH 1113/1124] mt76: testmode: add iBF command mode support
@@ -13,7 +13,7 @@
  4 files changed, 85 insertions(+), 7 deletions(-)
 
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 7a49608c..0a58ad97 100644
+index b1ce299..f735ed6 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -701,6 +701,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
@@ -105,7 +105,7 @@
  		mt7915_tm_set_tx_len(phy, tx_time);
  
 diff --git a/testmode.c b/testmode.c
-index 82b8e983..aa874a83 100644
+index 82b8e98..aa874a8 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -530,6 +530,42 @@ out:
@@ -164,7 +164,7 @@
  		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
  			if (nla_len(cur) != 2 ||
 diff --git a/testmode.h b/testmode.h
-index e2190e72..5d1fe793 100644
+index e2190e7..5d1fe79 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -281,8 +281,10 @@ enum mt76_testmode_txbf_act {
@@ -179,7 +179,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 1be1ffd6..47fc69f9 100644
+index 1be1ffd..47fc69f 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -32,6 +32,20 @@ static const char * const testmode_tx_mode[] = {
@@ -239,5 +239,5 @@
  
  const struct tm_field msg_field = {
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1114-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/recipes-kernel/linux-mt76/files/patches/1114-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index d5857d7..94e28d2 100644
--- a/recipes-kernel/linux-mt76/files/patches/1114-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1114-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,4 +1,4 @@
-From fbf7d08a95e8138cb192543bbb275d4504797e66 Mon Sep 17 00:00:00 2001
+From ae8372c6fb4b5344218a8b724ed9caeea1bd4dcc Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
 Subject: [PATCH 1114/1124] mt76: mt7915: init rssi in WTBL when add station
@@ -8,7 +8,7 @@
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index ff9fd19d..ba1b3e4b 100644
+index 0a5a4b3..fdbf1ee 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -666,6 +666,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -30,5 +30,5 @@
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1115-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch b/recipes-kernel/linux-mt76/files/patches/1115-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
index fb89274..f808c1e 100644
--- a/recipes-kernel/linux-mt76/files/patches/1115-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1115-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
@@ -1,4 +1,4 @@
-From e39367c6182ae57baa2ff67b69535d0754c650ef Mon Sep 17 00:00:00 2001
+From 1a023afd7dd2ff4820f056de4d60ac019b1f72e7 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 4 Aug 2022 14:08:11 +0800
 Subject: [PATCH 1115/1124] mt76: mt7915: reduce TWT SP sent to FW for cert
@@ -11,7 +11,7 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d7e6df50..431dd37f 100644
+index 34ce7d6..b6733b1 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -3558,7 +3558,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
@@ -24,5 +24,5 @@
  		.start_tsf = cpu_to_le64(flow->tsf),
  		.mantissa = flow->mantissa,
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1116-mt76-airtime-fairness-feature-off-in-mac80211.patch b/recipes-kernel/linux-mt76/files/patches/1116-mt76-airtime-fairness-feature-off-in-mac80211.patch
index c4c820a..25a32e0 100644
--- a/recipes-kernel/linux-mt76/files/patches/1116-mt76-airtime-fairness-feature-off-in-mac80211.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1116-mt76-airtime-fairness-feature-off-in-mac80211.patch
@@ -1,4 +1,4 @@
-From 4ae7e72fc778ee60267520bec667967e8a47f68b Mon Sep 17 00:00:00 2001
+From eb09887134c11a820556064ad6d18c21e06fc6ab Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
 Subject: [PATCH 1116/1124] mt76: airtime fairness feature off in mac80211
@@ -8,7 +8,7 @@
  1 file changed, 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index f34a93e0..4eaf317b 100644
+index 454f449..b7c1b13 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -429,7 +429,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
@@ -20,5 +20,5 @@
  
  	wiphy->available_antennas_tx = phy->antenna_mask;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1117-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/recipes-kernel/linux-mt76/files/patches/1117-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
index c1b5440..7598dc0 100644
--- a/recipes-kernel/linux-mt76/files/patches/1117-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1117-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
@@ -1,4 +1,4 @@
-From 5c423096aae12eb90d5959f43f3286004f4fb97f Mon Sep 17 00:00:00 2001
+From 63804504dd96a01005b6a2b828bcfe76c42d6b2a Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 20 May 2022 19:19:25 +0800
 Subject: [PATCH 1117/1124] mt76: mt7915: add mt7986 and mt7916 pre-calibration
@@ -15,7 +15,7 @@
  3 files changed, 62 insertions(+), 26 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 4b1a9811..ee3049e5 100644
+index e2482c6..d58a320 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -9,23 +9,22 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
@@ -50,7 +50,7 @@
  
  static int mt7915_check_eeprom(struct mt7915_dev *dev)
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index b980342c..fb9fbfe2 100644
+index 88aaa16..fdae347 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -19,6 +19,7 @@ enum mt7915_eeprom_field {
@@ -62,7 +62,7 @@
  	MT_EE_RATE_DELTA_5G =	0x29d,
  	MT_EE_TX0_POWER_2G =	0x2fc,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 431dd37f..f649bcaf 100644
+index b6733b1..69a266f 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2928,7 +2928,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
@@ -198,5 +198,5 @@
  
  	return 0;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1118-mt76-mt7915-add-phy-capability-vendor-command.patch b/recipes-kernel/linux-mt76/files/patches/1118-mt76-mt7915-add-phy-capability-vendor-command.patch
index 178c694..53c6a9b 100644
--- a/recipes-kernel/linux-mt76/files/patches/1118-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1118-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,4 +1,4 @@
-From 119142ef3be4457a975d7ca109e44bfac5bed444 Mon Sep 17 00:00:00 2001
+From 6debaa3030b494e9a0179ad5acacf046f037858a Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Tue, 12 Jul 2022 10:04:35 -0700
 Subject: [PATCH 1118/1124] mt76: mt7915: add phy capability vendor command
@@ -10,7 +10,7 @@
  3 files changed, 78 insertions(+)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index dfef078b..432f0b8a 100644
+index f3bbdba..bd20e7c 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -11,6 +11,7 @@
@@ -22,7 +22,7 @@
  #define MT7916_WTBL_SIZE		544
  #define MT7915_WTBL_RESERVED		(mt7915_wtbl_size(dev) - 1)
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index c7551848..77d71e48 100644
+index c755184..77d71e4 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -50,6 +50,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
@@ -99,7 +99,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index a8e4ebf9..719b851f 100644
+index a8e4ebf..719b851 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -9,6 +9,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -140,5 +140,5 @@
 +
  #endif
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1119-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch b/recipes-kernel/linux-mt76/files/patches/1119-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
index 9bdd9f6..7eb811e 100644
--- a/recipes-kernel/linux-mt76/files/patches/1119-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1119-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
@@ -1,7 +1,7 @@
-From e5d1346bdc27c267911ec5d2a6815350c43cccb8 Mon Sep 17 00:00:00 2001
+From ef7f1097ad31dc69e3e5d0893ef5713f6af98a44 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH] mt76: mt7915: add vendor subcmd EDCCA ctrl
+Subject: [PATCH 1119/1124] mt76: mt7915: add vendor subcmd EDCCA ctrl
 
 Change-Id: I92dabf8be9c5a7ecec78f35325bc5645af8d15ab
 ---
@@ -15,7 +15,7 @@
  7 files changed, 138 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index b14f931b..6143d8e4 100644
+index b14f931..6143d8e 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1157,6 +1157,7 @@ enum {
@@ -27,7 +27,7 @@
  };
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 85e9cd60..bad0fe1e 100644
+index fdbf1ee..80f4d9d 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -456,6 +456,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
@@ -41,7 +41,7 @@
  		ret = mt7915_set_channel(phy);
  		if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 6d67e9e1..523cc6da 100644
+index 69a266f..8dcc54e 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -4272,3 +4272,41 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
@@ -87,7 +87,7 @@
 +	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCCA), &req, sizeof(req), true);
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index ad85e56c..b8a433e5 100644
+index ad85e56..b8a433e 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -789,4 +789,16 @@ enum {
@@ -108,10 +108,10 @@
 +};
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b750660d..a5abcc56 100644
+index bd20e7c..1b08686 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -723,6 +723,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -725,6 +725,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
@@ -121,7 +121,7 @@
  #ifdef MTK_DEBUG
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 77d71e48..5a28a554 100644
+index 77d71e4..5a28a55 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -62,6 +62,17 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
@@ -209,7 +209,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 719b851f..83c41bc1 100644
+index 719b851..83c41bc 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -10,8 +10,27 @@ enum mtk_nl80211_vendor_subcmds {
diff --git a/recipes-kernel/linux-mt76/files/patches/1120-mt76-mt7915-implement-bin-file-mode.patch b/recipes-kernel/linux-mt76/files/patches/1120-mt76-mt7915-implement-bin-file-mode.patch
index afd47c2..73a117a 100644
--- a/recipes-kernel/linux-mt76/files/patches/1120-mt76-mt7915-implement-bin-file-mode.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1120-mt76-mt7915-implement-bin-file-mode.patch
@@ -1,4 +1,4 @@
-From 79ddf246652c86dbda37aa94526497b791ec8246 Mon Sep 17 00:00:00 2001
+From 09763f3753bb13ed2d754440295a459f6bb743c3 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 7 Jul 2022 11:09:59 +0800
 Subject: [PATCH 1120/1124] mt76: mt7915: implement bin file mode
@@ -13,7 +13,7 @@
  4 files changed, 71 insertions(+), 11 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 4c50bfe6..baca86fd 100644
+index 4c50bfe..baca86f 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -104,6 +104,24 @@ out_put_node:
@@ -42,10 +42,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index b28fe32f..e997908a 100644
+index 3ca449f..e547f79 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1015,6 +1015,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+@@ -1001,6 +1001,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
  int mt76_eeprom_init(struct mt76_dev *dev, int len);
  void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
@@ -54,7 +54,7 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index ee3049e5..e5cfa5b0 100644
+index d58a320..632ecc7 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -46,26 +46,36 @@ static char *mt7915_eeprom_name(struct mt7915_dev *dev)
@@ -114,7 +114,7 @@
  		ret = -EINVAL;
  		goto out;
  	}
-@@ -234,12 +247,30 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+@@ -221,12 +234,30 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
  {
  	int ret;
  
@@ -148,7 +148,7 @@
  		if (ret)
  			return ret;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 439d071a..6fe3191d 100644
+index 1b08686..5fa1dfa 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -51,6 +51,15 @@
@@ -176,5 +176,5 @@
  	bool ibf;
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1121-mt76-mt7915-initialize-wcid.patch b/recipes-kernel/linux-mt76/files/patches/1121-mt76-mt7915-initialize-wcid.patch
index ceead53..f5ed0a0 100644
--- a/recipes-kernel/linux-mt76/files/patches/1121-mt76-mt7915-initialize-wcid.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1121-mt76-mt7915-initialize-wcid.patch
@@ -1,4 +1,4 @@
-From cf4ded769fa58acd2d98f3a795bb8663456c114f Mon Sep 17 00:00:00 2001
+From bf5186ab642f733c312f6971d93934af4ec0f406 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 12 Jul 2022 13:56:07 +0800
 Subject: [PATCH 1121/1124] mt76 mt7915 initialize wcid
@@ -9,11 +9,11 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 471d533b..0631ad2c 100644
+index d798ec8..961b7af 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -965,7 +965,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
- 		 */
+@@ -967,7 +967,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+ 		info = le32_to_cpu(*cur_info);
  		if (info & MT_TX_FREE_PAIR) {
  			struct mt7915_sta *msta;
 -			struct mt76_wcid *wcid;
@@ -22,5 +22,5 @@
  
  			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1122-mt76-HEMU-Add-dump-support.patch b/recipes-kernel/linux-mt76/files/patches/1122-mt76-HEMU-Add-dump-support.patch
index 0051b6a..286936e 100644
--- a/recipes-kernel/linux-mt76/files/patches/1122-mt76-HEMU-Add-dump-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1122-mt76-HEMU-Add-dump-support.patch
@@ -1,4 +1,4 @@
-From 7e1d446505177bebaeeac17e10f622d1f612f1e3 Mon Sep 17 00:00:00 2001
+From a56e9413d6604dcec4fe5c21f240ad8d3e82eb7b Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
 Subject: [PATCH 1122/1124] mt76: HEMU: Add dump support
@@ -10,7 +10,7 @@
  2 files changed, 27 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 5a28a554..7acb3304 100644
+index 5a28a55..7acb330 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -37,6 +37,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -61,7 +61,7 @@
  		.maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 83c41bc1..57f52f3a 100644
+index 83c41bc..57f52f3 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -58,6 +58,7 @@ enum mtk_vendor_attr_hemu_ctrl {
@@ -73,5 +73,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch b/recipes-kernel/linux-mt76/files/patches/1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
index 264fcad..c5814bd 100644
--- a/recipes-kernel/linux-mt76/files/patches/1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
@@ -1,4 +1,4 @@
-From ee8f75888527b8f7114d5ac3f946a9acd21f9aa4 Mon Sep 17 00:00:00 2001
+From c2a099c2d4c02f67232cf98ee7d4e4b241b6befc Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 30 Aug 2022 15:29:38 +0800
 Subject: [PATCH 1123/1124] mt76: mt7915: add vendor subcmd three wire (PTA)
@@ -16,10 +16,10 @@
  6 files changed, 108 insertions(+), 29 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 683d8542..4cdfadc7 100644
+index 6143d8e..27a3624 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1155,7 +1155,7 @@ enum {
+@@ -1156,7 +1156,7 @@ enum {
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
@@ -29,7 +29,7 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7e6102b8..8d74275d 100644
+index 8dcc54e..477a41c 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -4019,37 +4019,34 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
@@ -95,7 +95,7 @@
  
  void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b8a433e5..9d0fac47 100644
+index b8a433e..9d0fac4 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -576,6 +576,35 @@ struct csi_data {
@@ -135,10 +135,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6fe3191d..3fcedba5 100644
+index 5fa1dfa..f403820 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -725,6 +725,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
+@@ -727,6 +727,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
  void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
  int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
  void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
@@ -147,7 +147,7 @@
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 7acb3304..7f67c0d3 100644
+index 7acb330..7f67c0d 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -40,6 +40,11 @@ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
@@ -221,7 +221,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 57f52f3a..e0c5fd94 100644
+index 57f52f3..e0c5fd9 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -11,6 +11,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -251,5 +251,5 @@
  enum mtk_capi_control_changed {
  	CAPI_RFEATURE_CHANGED		= BIT(16),
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1124-mt76-add-ibf-control-vendor-cmd.patch b/recipes-kernel/linux-mt76/files/patches/1124-mt76-add-ibf-control-vendor-cmd.patch
index d1992a2..3532752 100644
--- a/recipes-kernel/linux-mt76/files/patches/1124-mt76-add-ibf-control-vendor-cmd.patch
+++ b/recipes-kernel/linux-mt76/files/patches/1124-mt76-add-ibf-control-vendor-cmd.patch
@@ -1,4 +1,4 @@
-From c0f1432186c58fd534715d347d4693660a3fa1fe Mon Sep 17 00:00:00 2001
+From 5c25234839bdbe57851bc0ea0d7946fac8458af3 Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:01:29 -0700
 Subject: [PATCH 1124/1124] mt76: add ibf control vendor cmd
@@ -10,7 +10,7 @@
  2 files changed, 94 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 7f67c0d3..cbbb0843 100644
+index 7f67c0d..cbbb084 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -78,6 +78,16 @@ edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
@@ -105,7 +105,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index e0c5fd94..5aac5595 100644
+index e0c5fd9..5aac559 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -11,7 +11,8 @@ enum mtk_nl80211_vendor_subcmds {
@@ -146,5 +146,5 @@
 +
  #endif
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/1125-mt76-add-ampdu-amsdu-control.patch b/recipes-kernel/linux-mt76/files/patches/1125-mt76-add-ampdu-amsdu-control.patch
new file mode 100644
index 0000000..15e938d
--- /dev/null
+++ b/recipes-kernel/linux-mt76/files/patches/1125-mt76-add-ampdu-amsdu-control.patch
@@ -0,0 +1,172 @@
+From f15366ef845f70c3557e6ebcc4c72ee154e7cfc1 Mon Sep 17 00:00:00 2001
+From: TomLiu <tomml.liu@mediatek.com>
+Date: Wed, 21 Sep 2022 13:55:15 -0700
+Subject: [PATCH][MAC80211][mt76][add AMPDU/AMSDU OnOff ctonrol]
+
+---
+ mt7915/mac.c    | 28 ++++++++++++++++++++++++++++
+ mt7915/mt7915.h |  2 ++
+ mt7915/vendor.c | 39 +++++++++++++++++++++++++++++++++++++++
+ mt7915/vendor.h | 14 ++++++++++++++
+ 4 files changed, 83 insertions(+)
+
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 516717c..6ad32b1 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -2064,6 +2064,34 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+ 	phy->trb_ts = trb;
+ }
+ 
++void mt7915_set_wireless_ampdu(struct ieee80211_hw *hw, u8 en)
++{
++	ieee80211_del_all_station(hw);
++	/* clear/set the feature ampdu support */
++	if (en)
++		ieee80211_hw_set(hw, AMPDU_AGGREGATION);
++	else
++		ieee80211_hw_clear(hw, AMPDU_AGGREGATION);
++}
++
++void mt7915_set_wireless_amsdu(struct ieee80211_hw *hw, u8 en) {
++	struct mt76_phy *mphy = hw->priv;
++	struct mt76_dev *mdev = mphy->dev;
++
++	if (!ieee80211_hw_check(hw, AMPDU_AGGREGATION)) {
++		dev_err(mdev->dev, "AMSDU set failed, please enable ampdu first!\n");
++		return;
++	}
++
++	ieee80211_del_all_station(hw);
++
++	/* clear/set the feature ampdu support */
++	if (en)
++		ieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);
++	else
++		ieee80211_hw_clear(hw, SUPPORTS_AMSDU_IN_AMPDU);
++}
++
+ #ifdef CONFIG_MTK_VENDOR
+ void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta)
+ {
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 3029315..bac7fcb 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -726,6 +726,8 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ #endif
+ 
+ #ifdef CONFIG_MTK_VENDOR
++void mt7915_set_wireless_ampdu(struct ieee80211_hw *hw, u8 en);
++void mt7915_set_wireless_amsdu(struct ieee80211_hw *hw, u8 en);
+ void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta);
+ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
+ void mt7915_mcu_set_rfeature_starec(void *data, struct mt7915_dev *dev,
+diff --git a/mt7915/vendor.c b/mt7915/vendor.c
+index cbbb084..d73fdd4 100644
+--- a/mt7915/vendor.c
++++ b/mt7915/vendor.c
+@@ -30,10 +30,18 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
+ 	[MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA] = {.type = NLA_U8 },
+ 	[MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO] = {.type = NLA_U8 },
+ 	[MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE] = {.type = NLA_U16 },
++	[MTK_VENDOR_ATTR_WIRELESS_CTRL_AMPDU] = {.type = NLA_U8 },
++	[MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU] = {.type = NLA_U8 },
+ 	[MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA] = {.type = NLA_U8 },
+ 	[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT] = {.type = NLA_U8 },
+ };
+ 
++static const struct nla_policy
++wireless_dump_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP] = {
++	[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMPDU] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU] = { .type = NLA_U8 },
++};
++
+ static const struct nla_policy
+ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
+ 	[MTK_VENDOR_ATTR_HEMU_CTRL_ONOFF] = {.type = NLA_U8 },
+@@ -981,11 +989,41 @@ static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
+ 		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]);
+ 		mt7915_mcu_set_cfg(phy, CFGINFO_CERT_CFG, val8); /* Cert Enable for OMI */
+ 		mt7915_mcu_set_bypass_smthint(phy, val8); /* Cert bypass smooth interpolation */
++	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_AMPDU]) {
++		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_AMPDU]);
++		mt7915_set_wireless_ampdu(hw, val8);
++	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU]) {
++		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU]);
++		mt7915_set_wireless_amsdu(hw, val8);
+ 	}
+ 
+ 	return 0;
+ }
+ 
++static int
++mt7915_vendor_wireless_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
++			     struct sk_buff *skb, const void *data, int data_len,
++			     unsigned long *storage)
++{
++	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++	struct mt7915_phy *phy = mt7915_hw_phy(hw);
++	struct mt7915_dev *dev = phy->dev;
++	int len = 0;
++	if (*storage == 1)
++		return -ENOENT;
++	*storage = 1;
++
++
++	if (nla_put_u8(skb,
++	    MTK_VENDOR_ATTR_WIRELESS_DUMP_AMPDU, ieee80211_hw_check(hw, AMPDU_AGGREGATION)) ||
++	    nla_put_u8(skb,
++	    MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU, ieee80211_hw_check(hw, SUPPORTS_AMSDU_IN_AMPDU)))
++		return -ENOMEM;
++	len += 2;
++
++	return len;
++}
++
+ static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
+ 				  struct wireless_dev *wdev,
+ 				  const void *data,
+@@ -1223,6 +1261,7 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ 		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
+ 			WIPHY_VENDOR_CMD_NEED_RUNNING,
+ 		.doit = mt7915_vendor_wireless_ctrl,
++		.dumpit = mt7915_vendor_wireless_ctrl_dump,
+ 		.policy = wireless_ctrl_policy,
+ 		.maxattr = MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX,
+ 	},
+diff --git a/mt7915/vendor.h b/mt7915/vendor.h
+index 5aac559..53abb10 100644
+--- a/mt7915/vendor.h
++++ b/mt7915/vendor.h
+@@ -58,6 +58,8 @@ enum mtk_vendor_attr_wireless_ctrl {
+ 	MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA,
+ 	MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE,
+ 	MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMPDU,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_AMSDU,
+ 	MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT = 9,
+ 
+ 	MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA, /* reserve */
+@@ -67,6 +69,18 @@ enum mtk_vendor_attr_wireless_ctrl {
+ 		NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
+ };
+ 
++enum mtk_vendor_attr_wireless_dump {
++	MTK_VENDOR_ATTR_WIRELESS_DUMP_UNSPEC,
++
++	MTK_VENDOR_ATTR_WIRELESS_DUMP_AMPDU,
++	MTK_VENDOR_ATTR_WIRELESS_DUMP_AMSDU,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP,
++	MTK_VENDOR_ATTR_WIRELESS_DUMP_MAX =
++		NUM_MTK_VENDOR_ATTRS_WIRELESS_DUMP - 1
++};
++
+ enum mtk_vendor_attr_hemu_ctrl {
+ 	MTK_VENDOR_ATTR_HEMU_CTRL_UNSPEC,
+ 
+-- 
+2.32.0
+
diff --git a/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch b/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
index 6e4f96e..19408f7 100644
--- a/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3001-mt76-add-wed-tx-support.patch
@@ -1,21 +1,15 @@
-From a46e93efedae595b85fec8295e16641c2de183fb Mon Sep 17 00:00:00 2001
+From 76d6af5ef0539cfa09fadf9e7dd60c015428d12d Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Sun, 12 Jun 2022 16:38:45 +0800
-Subject: [PATCH 3001/3007] mt76 add wed tx support
+Subject: [PATCH] mt76 add wed tx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
- mt76_connac.h   |   1 +
- mt7915/dma.c    |  59 +++++++++++++++++++-------
- mt7915/mac.c    |  11 +++--
- mt7915/main.c   |   9 +++-
- mt7915/mcu.c    |   2 +-
- mt7915/mmio.c   | 110 +++++++++++++++++++++++++++++++++++++++++++++++-
- mt7915/mt7915.h |   2 +
- mt7915/pci.c    |  93 +---------------------------------------
- mt7915/regs.h   |  15 +++++++
- mt7915/soc.c    |  16 +++++--
- 10 files changed, 193 insertions(+), 118 deletions(-)
+ mt76_connac.h |  1 +
+ mt7915/mac.c  | 11 +++++++----
+ mt7915/main.c |  4 ++--
+ mt7915/mmio.c | 10 +++++++++-
+ 4 files changed, 19 insertions(+), 7 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
 index 0915eb57..9a468878 100644
@@ -29,122 +23,8 @@
  
  struct mt76_connac_fw_txp {
  	__le16 flags;
-diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 4b594a53..ac30698f 100644
---- a/mt7915/dma.c
-+++ b/mt7915/dma.c
-@@ -11,7 +11,10 @@ mt7915_init_tx_queues(struct mt7915_phy *phy, int idx, int n_desc, int ring_base
- 	struct mt7915_dev *dev = phy->dev;
- 
- 	if (mtk_wed_device_active(&phy->dev->mt76.mmio.wed)) {
--		ring_base = MT_WED_TX_RING_BASE;
-+		if(!is_mt7986(&dev->mt76))
-+			ring_base = MT_WED_TX_RING_BASE;
-+		else
-+			ring_base += MT_TXQ_ID(0) * MT_RING_SIZE;
- 		idx -= MT_TXQ_ID(0);
- 	}
- 
-@@ -58,14 +61,23 @@ static void mt7915_dma_config(struct mt7915_dev *dev)
- 		MCUQ_CONFIG(MT_MCUQ_WA, WFDMA1, MT_INT_TX_DONE_MCU_WA, MT7915_TXQ_MCU_WA);
- 		MCUQ_CONFIG(MT_MCUQ_FWDL, WFDMA1, MT_INT_TX_DONE_FWDL, MT7915_TXQ_FWDL);
- 	} else {
--		RXQ_CONFIG(MT_RXQ_MAIN, WFDMA0, MT_INT_RX_DONE_BAND0_MT7916, MT7916_RXQ_BAND0);
-+		if(is_mt7916(&dev->mt76) && (mtk_wed_device_active(&dev->mt76.mmio.wed))) {
-+			RXQ_CONFIG(MT_RXQ_MAIN, WFDMA0, MT_INT_WED_RX_DONE_BAND0_MT7916, MT7916_RXQ_BAND0);
-+			RXQ_CONFIG(MT_RXQ_MCU_WA, WFDMA0, MT_INT_WED_RX_DONE_WA_MT7916, MT7916_RXQ_MCU_WA);
-+			RXQ_CONFIG(MT_RXQ_BAND1, WFDMA0, MT_INT_WED_RX_DONE_BAND1_MT7916, MT7916_RXQ_BAND1);
-+			RXQ_CONFIG(MT_RXQ_MAIN_WA, WFDMA0, MT_INT_WED_RX_DONE_WA_MAIN_MT7916, MT7916_RXQ_MCU_WA_MAIN);
-+			TXQ_CONFIG(0, WFDMA0, MT_INT_WED_TX_DONE_BAND0, MT7915_TXQ_BAND0);
-+			TXQ_CONFIG(1, WFDMA0, MT_INT_WED_TX_DONE_BAND1, MT7915_TXQ_BAND1);
-+		} else {
-+			RXQ_CONFIG(MT_RXQ_MAIN, WFDMA0, MT_INT_RX_DONE_BAND0_MT7916, MT7916_RXQ_BAND0);
-+			RXQ_CONFIG(MT_RXQ_MCU_WA, WFDMA0, MT_INT_RX_DONE_WA, MT7916_RXQ_MCU_WA);
-+			RXQ_CONFIG(MT_RXQ_BAND1, WFDMA0, MT_INT_RX_DONE_BAND1_MT7916, MT7916_RXQ_BAND1);
-+			RXQ_CONFIG(MT_RXQ_MAIN_WA, WFDMA0, MT_INT_RX_DONE_WA_MAIN_MT7916, MT7916_RXQ_MCU_WA_MAIN);
-+			TXQ_CONFIG(0, WFDMA0, MT_INT_TX_DONE_BAND0, MT7915_TXQ_BAND0);
-+			TXQ_CONFIG(1, WFDMA0, MT_INT_TX_DONE_BAND1, MT7915_TXQ_BAND1);
-+		}
- 		RXQ_CONFIG(MT_RXQ_MCU, WFDMA0, MT_INT_RX_DONE_WM, MT7916_RXQ_MCU_WM);
--		RXQ_CONFIG(MT_RXQ_MCU_WA, WFDMA0, MT_INT_RX_DONE_WA, MT7916_RXQ_MCU_WA);
--		RXQ_CONFIG(MT_RXQ_BAND1, WFDMA0, MT_INT_RX_DONE_BAND1_MT7916, MT7916_RXQ_BAND1);
- 		RXQ_CONFIG(MT_RXQ_BAND1_WA, WFDMA0, MT_INT_RX_DONE_WA_EXT_MT7916, MT7916_RXQ_MCU_WA_EXT);
--		RXQ_CONFIG(MT_RXQ_MAIN_WA, WFDMA0, MT_INT_RX_DONE_WA_MAIN_MT7916, MT7916_RXQ_MCU_WA_MAIN);
--		TXQ_CONFIG(0, WFDMA0, MT_INT_TX_DONE_BAND0, MT7915_TXQ_BAND0);
--		TXQ_CONFIG(1, WFDMA0, MT_INT_TX_DONE_BAND1, MT7915_TXQ_BAND1);
- 		MCUQ_CONFIG(MT_MCUQ_WM, WFDMA0, MT_INT_TX_DONE_MCU_WM, MT7915_TXQ_MCU_WM);
- 		MCUQ_CONFIG(MT_MCUQ_WA, WFDMA0, MT_INT_TX_DONE_MCU_WA_MT7916, MT7915_TXQ_MCU_WA);
- 		MCUQ_CONFIG(MT_MCUQ_FWDL, WFDMA0, MT_INT_TX_DONE_FWDL, MT7915_TXQ_FWDL);
-@@ -323,7 +335,9 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
- 		u32 wed_irq_mask = irq_mask;
- 
- 		wed_irq_mask |= MT_INT_TX_DONE_BAND0 | MT_INT_TX_DONE_BAND1;
--		mt76_wr(dev, MT_INT_WED_MASK_CSR, wed_irq_mask);
-+		if (!is_mt7986(&dev->mt76))
-+			mt76_wr(dev, MT_INT_WED_MASK_CSR, wed_irq_mask);
-+		mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
- 		mtk_wed_device_start(&dev->mt76.mmio.wed, wed_irq_mask);
- 	}
- 
-@@ -348,15 +362,19 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 
- 	mt7915_dma_disable(dev, true);
- 
--	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
-+	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && !is_mt7986(mdev)) {
- 		mt76_set(dev, MT_WFDMA_HOST_CONFIG, MT_WFDMA_HOST_CONFIG_WED);
--
-+		if(is_mt7915(mdev)) {
- 		mt76_wr(dev, MT_WFDMA_WED_RING_CONTROL,
- 			FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX0, 18) |
- 			FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX1, 19) |
- 			FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_RX1, 1));
--	} else {
--		mt76_clear(dev, MT_WFDMA_HOST_CONFIG, MT_WFDMA_HOST_CONFIG_WED);
-+		} else {
-+			mt76_wr(dev, MT_WFDMA_WED_RING_CONTROL,
-+				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX0, 18) |
-+				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX1, 19) |
-+				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_RX1, 2));
-+		}
- 	}
- 
- 	/* init tx queue */
-@@ -410,7 +428,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 		return ret;
- 
- 	/* event from WA */
--	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
-+	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && is_mt7915(mdev)) {
- 		wa_rx_base = MT_WED_RX_RING_BASE;
- 		wa_rx_idx = MT7915_RXQ_MCU_WA;
- 		dev->mt76.q_rx[MT_RXQ_MCU_WA].flags = MT_WED_Q_TXFREE;
-@@ -437,11 +455,20 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 
- 	/* tx free notify event from WA for band0 */
- 	if (!is_mt7915(mdev)) {
-+		wa_rx_base = MT_RXQ_RING_BASE(MT_RXQ_MAIN_WA);
-+		wa_rx_idx = MT_RXQ_ID(MT_RXQ_MAIN_WA);
-+
-+		if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
-+			dev->mt76.q_rx[MT_RXQ_MAIN_WA].flags = MT_WED_Q_TXFREE;
-+			if (is_mt7916(mdev)) {
-+				wa_rx_base =  MT_WED_RX_RING_BASE;
-+				wa_rx_idx = MT7915_RXQ_MCU_WA;
-+			}
-+		}
- 		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_MAIN_WA],
--				       MT_RXQ_ID(MT_RXQ_MAIN_WA),
-+				       wa_rx_idx,
- 				       MT7915_RX_MCU_RING_SIZE,
--				       MT_RX_BUF_SIZE,
--				       MT_RXQ_RING_BASE(MT_RXQ_MAIN_WA));
-+				       MT_RX_BUF_SIZE, wa_rx_base);
- 		if (ret)
- 			return ret;
- 	}
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 0631ad2c..b1788fb8 100644
+index 961b7afc..65e47f95 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -826,9 +826,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
@@ -167,13 +47,13 @@
  	u16 total, count = 0;
  	u32 txd = le32_to_cpu(free->txd);
  	__le32 *cur_info;
-@@ -997,12 +998,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -999,12 +1000,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  			txwi = mt76_token_release(mdev, msdu, &wake);
  			if (!txwi)
  				continue;
 +			else
 +				with_txwi = false;
-
+ 
  			mt7915_txwi_free(dev, txwi, sta, &free_list);
  		}
  	}
@@ -182,13 +62,13 @@
 +	if (!with_txwi)
 +		mt7915_mac_tx_free_done(dev, &free_list, wake);
  }
-
+ 
  static void
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 192b0a9b..3a09f3f5 100644
+index 80f4d9dd..4e915279 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1456,14 +1456,19 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1457,14 +1457,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
  
@@ -200,390 +80,64 @@
  	path->dev = ctx->dev;
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
  	path->mtk_wdma.bss = mvif->mt76.idx;
--	path->mtk_wdma.wcid = msta->wcid.idx;
-+	/* fw will find the wcid by dest addr */
-+	if(is_mt7915(&dev->mt76))
-+		path->mtk_wdma.wcid = 0xff;
-+	else
-+		path->mtk_wdma.wcid = 0x3ff;
-+
+-	path->mtk_wdma.wcid = is_mt7915(&dev->mt76) ? msta->wcid.idx : 0x3ff;
++	path->mtk_wdma.wcid = is_mt7915(&dev->mt76) ? 0xff : 0x3ff;
  	path->mtk_wdma.queue = phy != &dev->phy;
  
  	ctx->dev = NULL;
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 8d74275d..f5caa326 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -2379,7 +2379,7 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
- 	if (ret)
- 		return ret;
- 
--	if (mtk_wed_device_active(&dev->mt76.mmio.wed))
-+	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && is_mt7915(&dev->mt76))
- 		mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY), 0, 0, 0);
- 
- 	ret = mt7915_mcu_set_mwds(dev, 1);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 088c9f3e..11c90772 100644
+index 1eda361f..0b37f1b3 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -10,6 +10,9 @@
+@@ -10,7 +10,7 @@
  #include "mac.h"
  #include "../trace.h"
  
+-static bool wed_enable;
 +static bool wed_enable = true;
-+module_param(wed_enable, bool, 0644);
-+
- static const u32 mt7915_reg[] = {
- 	[INT_SOURCE_CSR]	= 0xd7010,
- 	[INT_MASK_CSR]		= 0xd7014,
-@@ -543,7 +546,11 @@ void mt7915_dual_hif_set_irq_mask(struct mt7915_dev *dev,
- 	mdev->mmio.irqmask |= set;
+ module_param(wed_enable, bool, 0644);
  
- 	if (write_reg) {
--		mt76_wr(dev, MT_INT_MASK_CSR, mdev->mmio.irqmask);
-+		if (mtk_wed_device_active(&mdev->mmio.wed))
-+			mtk_wed_device_irq_set_mask(&mdev->mmio.wed,
-+						    mdev->mmio.irqmask);
-+		else
-+			mt76_wr(dev, MT_INT_MASK_CSR, mdev->mmio.irqmask);
- 		mt76_wr(dev, MT_INT1_MASK_CSR, mdev->mmio.irqmask);
- 	}
- 
-@@ -567,6 +574,8 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
+ static const u32 mt7915_reg[] = {
+@@ -556,6 +556,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  
- 	if (mtk_wed_device_active(wed)) {
- 		mtk_wed_device_irq_set_mask(wed, 0);
-+		if (dev->hif2)
-+			mt76_wr(dev, MT_INT1_MASK_CSR, 0);
- 		intr = mtk_wed_device_irq_get(wed, dev->mt76.mmio.irqmask);
+ 		wed->wlan.pci_dev = pci_dev;
+ 		wed->wlan.bus_type = MTK_WED_BUS_PCIE;
++		wed->wlan.base = (void __iomem *)ioremap(
++				 pci_resource_start(pci_dev, 0),
++				 pci_resource_len(pci_dev, 0));
+ 		wed->wlan.wpdma_int = pci_resource_start(pci_dev, 0) +
+ 				      MT_INT_WED_SOURCE_CSR;
+ 		wed->wlan.wpdma_mask = pci_resource_start(pci_dev, 0) +
+@@ -566,6 +569,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 				     MT_TXQ_WED_RING_BASE;
+ 		wed->wlan.wpdma_txfree = pci_resource_start(pci_dev, 0) +
+ 					 MT_RXQ_WED_RING_BASE;
++		wed->wlan.phy_base = pci_resource_start(pci_dev, 0);
  	} else {
- 		mt76_wr(dev, MT_INT_MASK_CSR, 0);
-@@ -648,6 +657,105 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
- 	return IRQ_HANDLED;
- }
+ 		struct platform_device *plat_dev = pdev_ptr;
+ 		struct resource *res;
+@@ -576,10 +580,13 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  
-+#ifdef CONFIG_NET_MEDIATEK_SOC_WED
-+static int mt7915_wed_offload_enable(struct mtk_wed_device *wed)
-+{
-+	struct mt7915_dev *dev;
-+	int ret;
-+
-+	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+
-+	spin_lock_bh(&dev->mt76.token_lock);
-+	dev->mt76.token_size = wed->wlan.token_start;
-+	spin_unlock_bh(&dev->mt76.token_lock);
-+
-+	ret = wait_event_timeout(dev->mt76.tx_wait,
-+				 !dev->mt76.wed_token_count, HZ);
-+	if (!ret)
-+		return -EAGAIN;
-+
-+	return 0;
-+}
-+
-+static void mt7915_wed_offload_disable(struct mtk_wed_device *wed)
-+{
-+	struct mt7915_dev *dev;
-+
-+	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+
-+	spin_lock_bh(&dev->mt76.token_lock);
-+	dev->mt76.token_size = wed->wlan.token_start;//MT7915_TOKEN_SIZE;
-+	spin_unlock_bh(&dev->mt76.token_lock);
-+}
-+#endif
-+
-+int
-+mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
-+{
-+#ifdef CONFIG_NET_MEDIATEK_SOC_WED
-+	struct mt76_dev *mdev = &dev->mt76;
-+	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
-+	u32 base;
-+	int ret;
-+
-+	if (!wed_enable)
-+		return 0;
-+
-+	if (dev_is_pci(pdev)) {
-+		struct pci_dev *pci_dev;
-+
-+		pci_dev = container_of(pdev, struct pci_dev, dev);
-+		base = pci_resource_start(pci_dev, 0);
-+		wed->wlan.base = (void __iomem *)ioremap(base, pci_resource_len(pci_dev, 0));
-+
-+		wed->wlan.pci_dev = pci_dev;
-+		wed->wlan.bus_type = MTK_BUS_TYPE_PCIE;
-+		wed->wlan.wpdma_int = base + MT_INT_WED_SOURCE_CSR;
-+		wed->wlan.wpdma_mask = base + MT_INT_WED_MASK_CSR;
-+	} else {
-+		struct platform_device *plat_dev;
-+		struct resource *res;
-+
-+		plat_dev = to_platform_device(pdev);
-+		res = platform_get_resource(plat_dev, IORESOURCE_MEM, 0);
-+		base = res->start;
-+		wed->wlan.base = (void __iomem *)ioremap(base, resource_size(res));
-+		wed->wlan.bus_type = MTK_BUS_TYPE_AXI;
-+		wed->wlan.wpdma_int = base + MT_INT_SOURCE_CSR;
-+		wed->wlan.wpdma_mask = base + MT_INT_MASK_CSR;
-+	}
-+	wed->wlan.wpdma_tx = base + MT_TXQ_WED_RING_BASE;
-+	wed->wlan.wpdma_txfree = base + MT_RXQ_WED_RING_BASE;
-+
-+	wed->wlan.tx_tbit[0] = MT_WED_TX_DONE_BAND0;
-+	wed->wlan.tx_tbit[1] = MT_WED_TX_DONE_BAND1;
-+	wed->wlan.txfree_tbit = MT_WED_TX_FREE_DONE;
-+	wed->wlan.nbuf = 7168;
-+	wed->wlan.token_start = MT7915_TOKEN_SIZE - wed->wlan.nbuf;
-+	wed->wlan.init_buf = mt7915_wed_init_buf;
-+	/* disable dynamic tx token */
-+	wed->wlan.offload_enable = mt7915_wed_offload_enable;
-+	wed->wlan.offload_disable = mt7915_wed_offload_disable;
-+
-+	if (mtk_wed_device_attach(wed) != 0)
-+		return 0;
-+
-+	if (wed->ver == MTK_WED_V1)
-+		wed->wlan.wpdma_phys = base + MT_WFDMA_EXT_CSR_BASE;
-+
-+	*irq = wed->irq;
-+	dev->mt76.dma_dev = wed->dev;
-+	mdev->token_size = wed->wlan.token_start;
-+	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
-+	if (ret)
-+		return ret;
-+
-+	return 1;
-+#else
-+	return 0;
-+#endif
-+}
-+
- struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
- 				     void __iomem *mem_base, u32 device_id)
- {
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 3fcedba5..1c78b882 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -534,6 +534,8 @@ static inline void mt7986_wmac_disable(struct mt7915_dev *dev)
- {
- }
- #endif
-+int mt7915_pci_wed_init(struct mt7915_dev *dev,
-+			struct device *pdev, int *irq);
- struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
- 				     void __iomem *mem_base, u32 device_id);
- void mt7915_wfsys_reset(struct mt7915_dev *dev);
-diff --git a/mt7915/pci.c b/mt7915/pci.c
-index 728a879c..c5da01a9 100644
---- a/mt7915/pci.c
-+++ b/mt7915/pci.c
-@@ -12,9 +12,6 @@
- #include "mac.h"
- #include "../trace.h"
- 
--static bool wed_enable = false;
--module_param(wed_enable, bool, 0644);
--
- static LIST_HEAD(hif_list);
- static DEFINE_SPINLOCK(hif_lock);
- static u32 hif_idx;
-@@ -95,94 +92,6 @@ static int mt7915_pci_hif2_probe(struct pci_dev *pdev)
- 	return 0;
- }
- 
--#ifdef CONFIG_NET_MEDIATEK_SOC_WED
--static int mt7915_wed_offload_enable(struct mtk_wed_device *wed)
--{
--	struct mt7915_dev *dev;
--	struct mt7915_phy *phy;
--	int ret;
--
--	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
--
--	spin_lock_bh(&dev->mt76.token_lock);
--	dev->mt76.token_size = wed->wlan.token_start;
--	spin_unlock_bh(&dev->mt76.token_lock);
--
--	ret = wait_event_timeout(dev->mt76.tx_wait,
--				 !dev->mt76.wed_token_count, HZ);
--	if (!ret)
--		return -EAGAIN;
--
--	phy = &dev->phy;
--	mt76_set(dev, MT_AGG_ACR4(phy->band_idx), MT_AGG_ACR_PPDU_TXS2H);
--
--	phy = dev->mt76.phys[MT_BAND1] ? dev->mt76.phys[MT_BAND1]->priv : NULL;
--	if (phy)
--		mt76_set(dev, MT_AGG_ACR4(phy->band_idx),
--			 MT_AGG_ACR_PPDU_TXS2H);
--
--	return 0;
--}
--
--static void mt7915_wed_offload_disable(struct mtk_wed_device *wed)
--{
--	struct mt7915_dev *dev;
--	struct mt7915_phy *phy;
--
--	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
--
--	spin_lock_bh(&dev->mt76.token_lock);
--	dev->mt76.token_size = MT7915_TOKEN_SIZE;
--	spin_unlock_bh(&dev->mt76.token_lock);
--
--	/* MT_TXD5_TX_STATUS_HOST (MPDU format) has higher priority than
--	 * MT_AGG_ACR_PPDU_TXS2H (PPDU format) even though ACR bit is set.
--	 */
--	phy = &dev->phy;
--	mt76_clear(dev, MT_AGG_ACR4(phy->band_idx), MT_AGG_ACR_PPDU_TXS2H);
--
--	phy = dev->mt76.phys[MT_BAND1] ? dev->mt76.phys[MT_BAND1]->priv : NULL;
--	if (phy)
--		mt76_clear(dev, MT_AGG_ACR4(phy->band_idx),
--			   MT_AGG_ACR_PPDU_TXS2H);
--}
--#endif
--
--static int
--mt7915_pci_wed_init(struct mt7915_dev *dev, struct pci_dev *pdev, int *irq)
--{
--#ifdef CONFIG_NET_MEDIATEK_SOC_WED
--	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
--	int ret;
--
--	if (!wed_enable)
--		return 0;
--
--	wed->wlan.pci_dev = pdev;
--	wed->wlan.wpdma_phys = pci_resource_start(pdev, 0) +
--			       MT_WFDMA_EXT_CSR_BASE;
--	wed->wlan.nbuf = 4096;
--	wed->wlan.token_start = MT7915_TOKEN_SIZE - wed->wlan.nbuf;
--	wed->wlan.init_buf = mt7915_wed_init_buf;
--	wed->wlan.offload_enable = mt7915_wed_offload_enable;
--	wed->wlan.offload_disable = mt7915_wed_offload_disable;
--
--	if (mtk_wed_device_attach(wed) != 0)
--		return 0;
--
--	*irq = wed->irq;
--	dev->mt76.dma_dev = wed->dev;
--
--	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
--	if (ret)
--		return ret;
--
--	return 1;
--#else
--	return 0;
--#endif
--}
--
- static int mt7915_pci_probe(struct pci_dev *pdev,
- 			    const struct pci_device_id *id)
- {
-@@ -220,7 +129,7 @@ static int mt7915_pci_probe(struct pci_dev *pdev,
- 	mt7915_wfsys_reset(dev);
- 	hif2 = mt7915_pci_init_hif2(pdev);
- 
--	ret = mt7915_pci_wed_init(dev, pdev, &irq);
-+	ret = mt7915_pci_wed_init(dev, &pdev->dev, &irq);
- 	if (ret < 0)
- 		goto free_wed_or_irq_vector;
- 
-diff --git a/mt7915/regs.h b/mt7915/regs.h
-index d7f71033..51eb553c 100644
---- a/mt7915/regs.h
-+++ b/mt7915/regs.h
-@@ -621,6 +621,7 @@ enum offs_rev {
- #define MT_PCIE_RECOG_ID_MASK		GENMASK(30, 0)
- #define MT_PCIE_RECOG_ID_SEM		BIT(31)
- 
-+#define MT_INT_WED_SOURCE_CSR		MT_WFDMA_EXT_CSR(0x200)
- #define MT_INT_WED_MASK_CSR		MT_WFDMA_EXT_CSR(0x204)
- 
- #define MT_WED_TX_RING_BASE		MT_WFDMA_EXT_CSR(0x300)
-@@ -667,6 +668,13 @@ enum offs_rev {
- #define MT_TXQ_EXT_CTRL(q)		(MT_Q_BASE(__TXQ(q)) + 0x600 +	\
- 					 MT_TXQ_ID(q)* 0x4)
- 
-+#define MT_TXQ_WED_RING_BASE		(!is_mt7986(mdev)? 0xd7300 : 0x24420)
-+#define MT_RXQ_WED_RING_BASE		(!is_mt7986(mdev)? 0xd7410 : 0x24520)
-+
-+#define MT_WED_TX_DONE_BAND0		(is_mt7915(mdev)? 4 : 30)
-+#define MT_WED_TX_DONE_BAND1		(is_mt7915(mdev)? 5 : 31)
-+#define MT_WED_TX_FREE_DONE		(is_mt7915(mdev)? 1 : 2)
-+
- #define MT_INT_SOURCE_CSR		__REG(INT_SOURCE_CSR)
- #define MT_INT_MASK_CSR			__REG(INT_MASK_CSR)
- 
-@@ -685,6 +693,11 @@ enum offs_rev {
- #define MT_INT_RX_DONE_WA_MAIN_MT7916	BIT(2)
- #define MT_INT_RX_DONE_WA_EXT_MT7916	BIT(3)
- 
-+#define MT_INT_WED_RX_DONE_BAND0_MT7916		BIT(18)
-+#define MT_INT_WED_RX_DONE_BAND1_MT7916		BIT(19)
-+#define MT_INT_WED_RX_DONE_WA_MAIN_MT7916	BIT(1)
-+#define MT_INT_WED_RX_DONE_WA_MT7916		BIT(17)
-+
- #define MT_INT_RX(q)			(dev->q_int_mask[__RXQ(q)])
- #define MT_INT_TX_MCU(q)		(dev->q_int_mask[(q)])
- 
-@@ -708,6 +721,8 @@ enum offs_rev {
- #define MT_INT_TX_DONE_BAND0		BIT(30)
- #define MT_INT_TX_DONE_BAND1		BIT(31)
- #define MT_INT_TX_DONE_MCU_WA_MT7916	BIT(25)
-+#define MT_INT_WED_TX_DONE_BAND0	BIT(4)
-+#define MT_INT_WED_TX_DONE_BAND1	BIT(5)
- 
- #define MT_INT_TX_DONE_MCU		(MT_INT_TX_MCU(MT_MCUQ_WA) |	\
- 					 MT_INT_TX_MCU(MT_MCUQ_WM) |	\
-diff --git a/mt7915/soc.c b/mt7915/soc.c
-index 3618718d..8d0b2068 100644
---- a/mt7915/soc.c
-+++ b/mt7915/soc.c
-@@ -1171,10 +1171,6 @@ static int mt7986_wmac_probe(struct platform_device *pdev)
- 
- 	chip_id = (uintptr_t)of_device_get_match_data(&pdev->dev);
+ 		wed->wlan.platform_dev = plat_dev;
+ 		wed->wlan.bus_type = MTK_WED_BUS_AXI;
++		wed->wlan.base = (void __iomem *)ioremap(res->start,
++				 resource_size(res));
+ 		wed->wlan.wpdma_int = res->start + MT_INT_SOURCE_CSR;
+ 		wed->wlan.wpdma_mask = res->start + MT_INT_MASK_CSR;
+ 		wed->wlan.wpdma_tx = res->start + MT_TXQ_WED_RING_BASE;
+ 		wed->wlan.wpdma_txfree = res->start + MT_RXQ_WED_RING_BASE;
++		wed->wlan.phy_base = res->start;
+ 	}
+ 	wed->wlan.nbuf = 4096;
+ 	wed->wlan.tx_tbit[0] = is_mt7915(&dev->mt76) ? 4 : 30;
+@@ -595,6 +602,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  
--	irq = platform_get_irq(pdev, 0);
--	if (irq < 0)
--		return irq;
--
- 	mem_base = devm_platform_ioremap_resource(pdev, 0);
- 	if (IS_ERR(mem_base)) {
- 		dev_err(&pdev->dev, "Failed to get memory resource\n");
-@@ -1186,6 +1182,16 @@ static int mt7986_wmac_probe(struct platform_device *pdev)
- 		return PTR_ERR(dev);
+ 	*irq = wed->irq;
+ 	dev->mt76.dma_dev = wed->dev;
++	dev->mt76.token_size = wed->wlan.token_start;
  
- 	mdev = &dev->mt76;
-+	ret = mt7915_pci_wed_init(dev, &pdev->dev, &irq);
-+	if (ret < 0)
-+		goto free_device;
-+
-+	if (!ret) {
-+		irq = platform_get_irq(pdev, 0);
-+		if (irq < 0)
-+			return irq;;
-+	}
-+
- 	ret = devm_request_irq(mdev->dev, irq, mt7915_irq_handler,
- 			       IRQF_SHARED, KBUILD_MODNAME, dev);
+ 	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
  	if (ret)
-@@ -1207,6 +1213,8 @@ free_irq:
- 	devm_free_irq(mdev->dev, irq, dev);
- 
- free_device:
-+	if (mtk_wed_device_active(&mdev->mmio.wed))
-+		mtk_wed_device_detach(&mdev->mmio.wed);
- 	mt76_free_device(&dev->mt76);
- 
- 	return ret;
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch b/recipes-kernel/linux-mt76/files/patches/3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch
index 4edceb9..910365d 100644
--- a/recipes-kernel/linux-mt76/files/patches/3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch
@@ -1,25 +1,25 @@
-From 8aa505cd1dcb9410d38bb608214aa28c01bc3cd2 Mon Sep 17 00:00:00 2001
+From 2e99c7444625c73a247c0be7b3c1b60fb5de72ce Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Sat, 10 Sep 2022 17:09:21 +0800
-Subject: [PATCH] mt76: mt7915: add-wed-tx-wds-support-on-mt7986
+Subject: [PATCH 3002/3010] mt76: mt7915: add-wed-tx-wds-support-on-mt7986
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
  mac80211.c      |  5 ++++-
  mt76.h          |  2 ++
  mt7915/init.c   |  9 +++++++++
- mt7915/main.c   | 52 +++++++++++++++++++++++++++++++++++++++++++------
+ mt7915/main.c   | 44 ++++++++++++++++++++++++++++++++++++++++++--
  mt7915/mcu.c    | 12 ++++++++++--
  mt7915/mcu.h    |  1 +
  mt7915/mmio.c   |  3 +++
  mt7915/mt7915.h |  4 ++++
- 8 files changed, 79 insertions(+), 9 deletions(-)
+ 8 files changed, 75 insertions(+), 5 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 4eaf317b..c477d625 100644
+index b7c1b13..7571e83 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1360,7 +1360,10 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
+@@ -1364,7 +1364,10 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
  
  	mt76_packet_id_flush(dev, wcid);
  
@@ -32,10 +32,10 @@
  }
  EXPORT_SYMBOL_GPL(__mt76_sta_remove);
 diff --git a/mt76.h b/mt76.h
-index e997908a..ec9bd59d 100644
+index e547f79..335f0b1 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -453,6 +453,7 @@ struct mt76_driver_ops {
+@@ -454,6 +454,7 @@ struct mt76_driver_ops {
  
  	void (*sta_remove)(struct mt76_dev *dev, struct ieee80211_vif *vif,
  			   struct ieee80211_sta *sta);
@@ -43,7 +43,7 @@
  };
  
  struct mt76_channel_state {
-@@ -826,6 +827,7 @@ struct mt76_dev {
+@@ -814,6 +815,7 @@ struct mt76_dev {
  	spinlock_t status_lock;
  
  	u32 wcid_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
@@ -52,7 +52,7 @@
  
  	u64 vif_mask;
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 538ff5c3..cd9d846d 100644
+index 6833bbf..8055c6e 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -695,6 +695,15 @@ mt7915_init_hardware(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -72,7 +72,7 @@
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3a09f3f5..b1fb3ddf 100644
+index 4e91527..74c9777 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -658,6 +658,24 @@ mt7915_channel_switch_beacon(struct ieee80211_hw *hw,
@@ -105,11 +105,11 @@
  	int ret, idx;
  	u32 addr;
 +	bool wed_wds = false;
- 
--	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
++
 +	if (mtk_wed_device_active(&mdev->mmio.wed) && is_mt7986(mdev))
 +		wed_wds = !!test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
-+
+ 
+-	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
 +	if (wed_wds)
 +		idx = mt76_wcid_alloc(mdev->wcid_wds_mask, MT7915_WTBL_STA);
 +	else {
@@ -120,7 +120,7 @@
  	if (idx < 0)
  		return -ENOSPC;
  
-@@ -1124,6 +1152,14 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
+@@ -1125,6 +1153,14 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
  	else
  		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
  
@@ -135,30 +135,21 @@
  	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
  }
  
-@@ -1463,12 +1499,16 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1464,7 +1500,11 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->dev = ctx->dev;
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
  	path->mtk_wdma.bss = mvif->mt76.idx;
--	/* fw will find the wcid by dest addr */
--	if(is_mt7915(&dev->mt76))
--		path->mtk_wdma.wcid = 0xff;
--	else
--		path->mtk_wdma.wcid = 0x3ff;
- 
-+	if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags)) {
+-	path->mtk_wdma.wcid = is_mt7915(&dev->mt76) ? 0xff : 0x3ff;
++
++	if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags))
 +		path->mtk_wdma.wcid = msta->wcid.idx;
-+	} else {
-+		/* fw will find the wcid by dest addr */
-+		if(is_mt7915(&dev->mt76))
-+			path->mtk_wdma.wcid = 0xff;
-+		else
-+			path->mtk_wdma.wcid = 0x3ff;
-+	}
++	else
++		path->mtk_wdma.wcid = is_mt7915(&dev->mt76) ? 0xff : 0x3ff;
  	path->mtk_wdma.queue = phy != &dev->phy;
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f5caa326..21167f00 100644
+index 477a41c..1d5cb2b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2350,6 +2350,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
@@ -188,7 +179,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 9d0fac47..1f56db6b 100644
+index 9d0fac4..1f56db6 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -268,6 +268,7 @@ enum {
@@ -200,19 +191,19 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 11c90772..6df039a7 100644
+index 1eda361..6f0f262 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -736,6 +736,8 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
- 	/* disable dynamic tx token */
- 	wed->wlan.offload_enable = mt7915_wed_offload_enable;
- 	wed->wlan.offload_disable = mt7915_wed_offload_disable;
+@@ -589,6 +589,8 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 	wed->wlan.init_buf = mt7915_wed_init_buf;
+ 	wed->wlan.offload_enable = mt7915_mmio_wed_offload_enable;
+ 	wed->wlan.offload_disable = mt7915_mmio_wed_offload_disable;
 +	if (!is_mt7915(mdev))
 +		wed->wlan.wcid_512 = true;
  
- 	if (mtk_wed_device_attach(wed) != 0)
+ 	if (mtk_wed_device_attach(wed))
  		return 0;
-@@ -776,6 +778,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
+@@ -802,6 +804,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
  		.sta_add = mt7915_mac_sta_add,
  		.sta_remove = mt7915_mac_sta_remove,
  		.update_survey = mt7915_update_channel,
@@ -221,7 +212,7 @@
  	struct mt7915_dev *dev;
  	struct mt76_dev *mdev;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 1c78b882..486c203c 100644
+index f403820..b06e7a9 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -18,6 +18,9 @@
@@ -234,7 +225,7 @@
  #define MT7915_WATCHDOG_TIME		(HZ / 10)
  #define MT7915_RESET_TIMEOUT		(30 * HZ)
  
-@@ -697,6 +700,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
+@@ -695,6 +698,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  			 struct sk_buff *skb);
  bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len);
diff --git a/recipes-kernel/linux-mt76/files/patches/3003-mt76-add-wed-rx-support.patch b/recipes-kernel/linux-mt76/files/patches/3003-mt76-add-wed-rx-support.patch
index 4646c44..b6ae918 100644
--- a/recipes-kernel/linux-mt76/files/patches/3003-mt76-add-wed-rx-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3003-mt76-add-wed-rx-support.patch
@@ -1,7 +1,7 @@
-From dfbef22fdf1a3e29f9d3c00a50083a02c69e8ad1 Mon Sep 17 00:00:00 2001
+From 9c57070620b011bc01d24aac8d387e6fa37bcde7 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 5 Jul 2022 19:42:55 +0800
-Subject: [PATCH 3003/3007] mt76 add wed rx support
+Subject: [PATCH] mt76 add wed rx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -16,16 +16,16 @@
  mt76_connac_mcu.c |   9 ++
  mt76x02.h         |   2 +-
  mt76x02_txrx.c    |   2 +-
- mt7915/dma.c      |  25 +++--
+ mt7915/dma.c      |  17 +++-
  mt7915/mac.c      | 101 ++++++++++++++++++-
  mt7915/mcu.c      |   3 +
- mt7915/mmio.c     |  26 ++++-
+ mt7915/mmio.c     |  30 ++++--
  mt7915/mt7915.h   |   7 +-
- mt7915/regs.h     |  14 ++-
+ mt7915/regs.h     |   6 ++
  mt7921/mac.c      |   2 +-
  mt7921/mt7921.h   |   2 +-
  tx.c              |  34 +++++++
- 20 files changed, 456 insertions(+), 71 deletions(-)
+ 20 files changed, 448 insertions(+), 67 deletions(-)
 
 diff --git a/dma.c b/dma.c
 index 8ea09e6e..3317d2b9 100644
@@ -500,10 +500,10 @@
  #define MT_RX_INFO_LEN			4
  #define MT_FCE_INFO_LEN			4
 diff --git a/mac80211.c b/mac80211.c
-index c477d625..4a8d8d8d 100644
+index 7571e832..d0bd215a 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -599,11 +599,14 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
+@@ -603,11 +603,14 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
  		BIT(NL80211_IFTYPE_ADHOC);
  
  	spin_lock_init(&dev->token_lock);
@@ -518,7 +518,7 @@
  	dev->token_size = dev->drv->token_size;
  
  	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
-@@ -1301,7 +1304,10 @@ void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
+@@ -1305,7 +1308,10 @@ void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
  
  	while ((skb = __skb_dequeue(&dev->rx_skb[q])) != NULL) {
  		mt76_check_sta(dev, skb);
@@ -531,7 +531,7 @@
  
  	mt76_rx_complete(dev, &frames, napi);
 diff --git a/mt76.h b/mt76.h
-index ec9bd59d..f19433d4 100644
+index 335f0b10..959fb240 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -20,6 +20,8 @@
@@ -571,7 +571,7 @@
  };
  
  struct mt76_rx_tid {
-@@ -438,7 +445,7 @@ struct mt76_driver_ops {
+@@ -439,7 +446,7 @@ struct mt76_driver_ops {
  	bool (*rx_check)(struct mt76_dev *dev, void *data, int len);
  
  	void (*rx_skb)(struct mt76_dev *dev, enum mt76_rxq_id q,
@@ -580,7 +580,7 @@
  
  	void (*rx_poll_complete)(struct mt76_dev *dev, enum mt76_rxq_id q);
  
-@@ -783,6 +790,7 @@ struct mt76_dev {
+@@ -771,6 +778,7 @@ struct mt76_dev {
  	struct ieee80211_hw *hw;
  
  	spinlock_t lock;
@@ -588,7 +588,7 @@
  	spinlock_t cc_lock;
  
  	u32 cur_cc_bss_rx;
-@@ -808,6 +816,7 @@ struct mt76_dev {
+@@ -796,6 +804,7 @@ struct mt76_dev {
  	struct sk_buff_head rx_skb[__MT_RXQ_MAX];
  
  	struct list_head txwi_cache;
@@ -596,7 +596,7 @@
  	struct mt76_queue *q_mcu[__MT_MCUQ_MAX];
  	struct mt76_queue q_rx[__MT_RXQ_MAX];
  	const struct mt76_queue_ops *queue_ops;
-@@ -821,6 +830,9 @@ struct mt76_dev {
+@@ -809,6 +818,9 @@ struct mt76_dev {
  	u16 wed_token_count;
  	u16 token_count;
  	u16 token_size;
@@ -606,7 +606,7 @@
  
  	wait_queue_head_t tx_wait;
  	/* spinclock used to protect wcid pktid linked list */
-@@ -1365,6 +1377,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1351,6 +1363,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -615,7 +615,7 @@
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
-@@ -1509,6 +1523,12 @@ struct mt76_txwi_cache *
+@@ -1495,6 +1509,12 @@ struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
@@ -681,7 +681,7 @@
  int mt7615_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 36a2914e..290e9711 100644
+index 01561a56..0f800909 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -1192,6 +1192,7 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
@@ -729,10 +729,10 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_add_key);
 diff --git a/mt76x02.h b/mt76x02.h
-index f76fd22e..0b872af1 100644
+index 849c2644..49112ab6 100644
 --- a/mt76x02.h
 +++ b/mt76x02.h
-@@ -173,7 +173,7 @@ int mt76x02_set_rts_threshold(struct ieee80211_hw *hw, u32 val);
+@@ -187,7 +187,7 @@ int mt76x02_set_rts_threshold(struct ieee80211_hw *hw, u32 val);
  void mt76x02_remove_hdr_pad(struct sk_buff *skb, int len);
  bool mt76x02_tx_status_data(struct mt76_dev *mdev, u8 *update);
  void mt76x02_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
@@ -742,7 +742,7 @@
  irqreturn_t mt76x02_irq_handler(int irq, void *dev_instance);
  void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
 diff --git a/mt76x02_txrx.c b/mt76x02_txrx.c
-index 96fdf423..bf24d3e0 100644
+index 3a313075..5d6c8f71 100644
 --- a/mt76x02_txrx.c
 +++ b/mt76x02_txrx.c
 @@ -33,7 +33,7 @@ void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
@@ -755,10 +755,10 @@
  	struct mt76x02_dev *dev = container_of(mdev, struct mt76x02_dev, mt76);
  	void *rxwi = skb->data;
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index ac30698f..197a0169 100644
+index e3918860..702d629a 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
-@@ -337,7 +337,8 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
+@@ -344,7 +344,8 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
  		wed_irq_mask |= MT_INT_TX_DONE_BAND0 | MT_INT_TX_DONE_BAND1;
  		if (!is_mt7986(&dev->mt76))
  			mt76_wr(dev, MT_INT_WED_MASK_CSR, wed_irq_mask);
@@ -767,8 +767,8 @@
 +			mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
  		mtk_wed_device_start(&dev->mt76.mmio.wed, wed_irq_mask);
  	}
-
-@@ -349,6 +350,7 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
+ 
+@@ -356,6 +357,7 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
  int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  {
  	struct mt76_dev *mdev = &dev->mt76;
@@ -776,33 +776,17 @@
  	u32 wa_rx_base, wa_rx_idx;
  	u32 hif1_ofs = 0;
  	int ret;
-@@ -365,10 +366,12 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && !is_mt7986(mdev)) {
- 		mt76_set(dev, MT_WFDMA_HOST_CONFIG, MT_WFDMA_HOST_CONFIG_WED);
- 		if(is_mt7915(mdev)) {
--		mt76_wr(dev, MT_WFDMA_WED_RING_CONTROL,
--			FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX0, 18) |
--			FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX1, 19) |
--			FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_RX1, 1));
-+			mt76_wr(dev, MT_WFDMA_WED_RING_CONTROL,
-+				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX0, 18) |
-+				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX1, 19) |
-+				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_RX1, 1));
+@@ -380,6 +382,9 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+ 				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX1, 19) |
+ 				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_RX1,
+ 					   wed_control_rx1));
++			if(is_mt7915(mdev))
 +				mt76_rmw(dev, MT_WFDMA0_EXT0_CFG, MT_WFDMA0_EXT0_RXWB_KEEP,
-+					 MT_WFDMA0_EXT0_RXWB_KEEP);
- 		} else {
- 			mt76_wr(dev, MT_WFDMA_WED_RING_CONTROL,
- 				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX0, 18) |
-@@ -428,7 +431,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 		return ret;
- 
- 	/* event from WA */
--	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && is_mt7915(mdev)) {
-+	if (mtk_wed_device_active(wed) && is_mt7915(mdev)) {
- 		wa_rx_base = MT_WED_RX_RING_BASE;
- 		wa_rx_idx = MT7915_RXQ_MCU_WA;
- 		dev->mt76.q_rx[MT_RXQ_MCU_WA].flags = MT_WED_Q_TXFREE;
-@@ -444,6 +447,11 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
++					   MT_WFDMA0_EXT0_RXWB_KEEP);
+ 		}
+ 	} else {
+ 		mt76_clear(dev, MT_WFDMA_HOST_CONFIG, MT_WFDMA_HOST_CONFIG_WED);
+@@ -452,6 +457,11 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  
  	/* rx data queue for band0 */
  	if (!dev->phy.band_idx) {
@@ -814,16 +798,7 @@
  		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_MAIN],
  				       MT_RXQ_ID(MT_RXQ_MAIN),
  				       MT7915_RX_RING_SIZE,
-@@ -458,7 +466,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 		wa_rx_base = MT_RXQ_RING_BASE(MT_RXQ_MAIN_WA);
- 		wa_rx_idx = MT_RXQ_ID(MT_RXQ_MAIN_WA);
- 
--		if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
-+		if (mtk_wed_device_active(wed)) {
- 			dev->mt76.q_rx[MT_RXQ_MAIN_WA].flags = MT_WED_Q_TXFREE;
- 			if (is_mt7916(mdev)) {
- 				wa_rx_base =  MT_WED_RX_RING_BASE;
-@@ -474,6 +482,11 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -482,6 +492,11 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  	}
  
  	if (dev->dbdc_support || dev->phy.band_idx) {
@@ -836,7 +811,7 @@
  		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_BAND1],
  				       MT_RXQ_ID(MT_RXQ_BAND1),
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index b1788fb8..4e0c3ec4 100644
+index 65e47f95..06268e06 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -217,7 +217,7 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
@@ -957,7 +932,7 @@
  static void
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
-@@ -1110,7 +1205,7 @@ bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len)
+@@ -1115,7 +1210,7 @@ bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len)
  }
  
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
@@ -966,7 +941,7 @@
  {
  	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
-@@ -1144,7 +1239,7 @@ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+@@ -1149,7 +1244,7 @@ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  		dev_kfree_skb(skb);
  		break;
  	case PKT_TYPE_NORMAL:
@@ -976,7 +951,7 @@
  			return;
  		}
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 21167f00..aa8bcf70 100644
+index 1d5cb2b3..a405bfde 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -1724,6 +1724,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
@@ -997,69 +972,86 @@
  				     MCU_EXT_CMD(STA_REC_UPDATE), true);
  }
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 6df039a7..6e07311d 100644
+index c197e5eb..b98458e5 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -28,6 +28,9 @@ static const u32 mt7915_reg[] = {
- 	[FW_EXCEPTION_ADDR]	= 0x219848,
+@@ -29,6 +29,7 @@ static const u32 mt7915_reg[] = {
  	[SWDEF_BASE_ADDR]	= 0x41f200,
- 	[EXCEPTION_BASE_ADDR]	= 0x219848,
-+	[WED_TX_RING]		= 0xd7300,
-+	[WED_RX_RING]		= 0xd7410,
+ 	[TXQ_WED_RING_BASE]	= 0xd7300,
+ 	[RXQ_WED_RING_BASE]	= 0xd7410,
 +	[WED_RX_DATA_RING]	= 0xd4500,
+ 	[EXCEPTION_BASE_ADDR]	= 0x219848,
  };
  
- static const u32 mt7916_reg[] = {
-@@ -45,6 +48,9 @@ static const u32 mt7916_reg[] = {
- 	[FW_EXCEPTION_ADDR]	= 0x022050bc,
+@@ -48,6 +49,7 @@ static const u32 mt7916_reg[] = {
  	[SWDEF_BASE_ADDR]	= 0x411400,
- 	[EXCEPTION_BASE_ADDR]	= 0x022050BC,
-+	[WED_TX_RING]		= 0xd7300,
-+	[WED_RX_RING]		= 0xd7410,
+ 	[TXQ_WED_RING_BASE]	= 0xd7300,
+ 	[RXQ_WED_RING_BASE]	= 0xd7410,
 +	[WED_RX_DATA_RING]	= 0xd4540,
+ 	[EXCEPTION_BASE_ADDR]	= 0x022050BC,
  };
  
- static const u32 mt7986_reg[] = {
-@@ -62,6 +68,9 @@ static const u32 mt7986_reg[] = {
- 	[FW_EXCEPTION_ADDR]	= 0x02204ffc,
+@@ -67,6 +69,7 @@ static const u32 mt7986_reg[] = {
  	[SWDEF_BASE_ADDR]	= 0x411400,
- 	[EXCEPTION_BASE_ADDR]	= 0x02204FFC,
-+	[WED_TX_RING]		= 0x24420,
-+	[WED_RX_RING]		= 0x24520,
+ 	[TXQ_WED_RING_BASE]	= 0x24420,
+ 	[RXQ_WED_RING_BASE]	= 0x24520,
 +	[WED_RX_DATA_RING]	= 0x24540,
+ 	[EXCEPTION_BASE_ADDR]	= 0x02204FFC,
  };
  
- static const u32 mt7915_offs[] = {
-@@ -712,6 +721,7 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
- 		wed->wlan.bus_type = MTK_BUS_TYPE_PCIE;
- 		wed->wlan.wpdma_int = base + MT_INT_WED_SOURCE_CSR;
- 		wed->wlan.wpdma_mask = base + MT_INT_WED_MASK_CSR;
-+		wed->wlan.wpdma_phys = base + MT_WFDMA_EXT_CSR_BASE;
+@@ -555,7 +558,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 		struct pci_dev *pci_dev = pdev_ptr;
+ 
+ 		wed->wlan.pci_dev = pci_dev;
+-		wed->wlan.bus_type = MTK_WED_BUS_PCIE;
++		wed->wlan.bus_type = MTK_BUS_TYPE_PCIE;
+ 		wed->wlan.base = (void __iomem *)ioremap(
+ 				 pci_resource_start(pci_dev, 0),
+ 				 pci_resource_len(pci_dev, 0));
+@@ -569,6 +572,10 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 				     MT_TXQ_WED_RING_BASE;
+ 		wed->wlan.wpdma_txfree = pci_resource_start(pci_dev, 0) +
+ 					 MT_RXQ_WED_RING_BASE;
++		wed->wlan.wpdma_rx_glo = pci_resource_start(pci_dev, 0) +
++					 MT_WPDMA_GLO_CFG;
++		wed->wlan.wpdma_rx = pci_resource_start(pci_dev, 0) +
++					 MT_RXQ_WED_DATA_RING_BASE;
+ 		wed->wlan.phy_base = pci_resource_start(pci_dev, 0);
  	} else {
- 		struct platform_device *plat_dev;
- 		struct resource *res;
-@@ -724,12 +734,19 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
- 		wed->wlan.wpdma_int = base + MT_INT_SOURCE_CSR;
- 		wed->wlan.wpdma_mask = base + MT_INT_MASK_CSR;
+ 		struct platform_device *plat_dev = pdev_ptr;
+@@ -578,27 +585,38 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 		if (!res)
+ 			return -ENOMEM;
+ 
+-		wed->wlan.platform_dev = plat_dev;
+-		wed->wlan.bus_type = MTK_WED_BUS_AXI;
++		//wed->wlan.platform_dev = plat_dev;
++		wed->wlan.bus_type = MTK_BUS_TYPE_AXI;
+ 		wed->wlan.base = (void __iomem *)ioremap(res->start,
+ 				 resource_size(res));
+ 		wed->wlan.wpdma_int = res->start + MT_INT_SOURCE_CSR;
+ 		wed->wlan.wpdma_mask = res->start + MT_INT_MASK_CSR;
+ 		wed->wlan.wpdma_tx = res->start + MT_TXQ_WED_RING_BASE;
+ 		wed->wlan.wpdma_txfree = res->start + MT_RXQ_WED_RING_BASE;
++		wed->wlan.wpdma_rx_glo = res->start + MT_WPDMA_GLO_CFG;
++		wed->wlan.wpdma_rx = res->start + MT_RXQ_WED_DATA_RING_BASE;
+ 		wed->wlan.phy_base = res->start;
  	}
+-	wed->wlan.nbuf = 4096;
 +	wed->wlan.rx_pkt = MT7915_WED_RX_TOKEN_SIZE;
-+	wed->wlan.phy_base = base;
- 	wed->wlan.wpdma_tx = base + MT_TXQ_WED_RING_BASE;
- 	wed->wlan.wpdma_txfree = base + MT_RXQ_WED_RING_BASE;
-+	wed->wlan.wpdma_rx_glo = base + MT_WPDMA_GLO_CFG;
-+	wed->wlan.wpdma_rx = base + MT_RXQ_WED_DATA_RING_BASE;
- 
- 	wed->wlan.tx_tbit[0] = MT_WED_TX_DONE_BAND0;
- 	wed->wlan.tx_tbit[1] = MT_WED_TX_DONE_BAND1;
- 	wed->wlan.txfree_tbit = MT_WED_TX_FREE_DONE;
-+	wed->wlan.rx_tbit[0] = MT_WED_RX_DONE_BAND0;
-+	wed->wlan.rx_tbit[1] = MT_WED_RX_DONE_BAND1;
-+
- 	wed->wlan.nbuf = 7168;
++	wed->wlan.nbuf = 7168;
+ 	wed->wlan.tx_tbit[0] = is_mt7915(&dev->mt76) ? 4 : 30;
+ 	wed->wlan.tx_tbit[1] = is_mt7915(&dev->mt76) ? 5 : 31;
+-	wed->wlan.txfree_tbit = is_mt7915(&dev->mt76) ? 1 : 2;
++	wed->wlan.txfree_tbit = (is_mt7986(&dev->mt76) ? 2 : 1);
++	wed->wlan.rx_tbit[0] = (is_mt7915(&dev->mt76) ? 16 : (is_mt7986(&dev->mt76) ? 22 : 18));
++	wed->wlan.rx_tbit[1] = (is_mt7915(&dev->mt76) ? 17 : (is_mt7986(&dev->mt76) ? 23 : 19));
  	wed->wlan.token_start = MT7915_TOKEN_SIZE - wed->wlan.nbuf;
  	wed->wlan.init_buf = mt7915_wed_init_buf;
-@@ -739,12 +756,15 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
- 	if (!is_mt7915(mdev))
+ 	wed->wlan.offload_enable = mt7915_mmio_wed_offload_enable;
+ 	wed->wlan.offload_disable = mt7915_mmio_wed_offload_disable;
+-	if (!is_mt7915(mdev))
++	if (!is_mt7915(&dev->mt76))
  		wed->wlan.wcid_512 = true;
  
 +	wed->wlan.rx_nbuf = 65536;
@@ -1068,17 +1060,11 @@
 +	wed->wlan.release_rx_buf = mt7915_wed_release_rx_buf;
 +
 +	dev->mt76.rx_token_size = wed->wlan.rx_pkt;
- 	if (mtk_wed_device_attach(wed) != 0)
+ 	if (mtk_wed_device_attach(wed))
  		return 0;
  
--	if (wed->ver == MTK_WED_V1)
--		wed->wlan.wpdma_phys = base + MT_WFDMA_EXT_CSR_BASE;
--
- 	*irq = wed->irq;
- 	dev->mt76.dma_dev = wed->dev;
- 	mdev->token_size = wed->wlan.token_start;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 486c203c..2da2ff8b 100644
+index b06e7a90..d96709b1 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -81,6 +81,7 @@
@@ -1089,7 +1075,7 @@
  
  struct mt7915_vif;
  struct mt7915_sta;
-@@ -545,7 +546,9 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
+@@ -543,7 +544,9 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
  irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
  u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
  u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
@@ -1100,7 +1086,7 @@
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
  int mt7915_eeprom_init(struct mt7915_dev *dev);
-@@ -698,7 +701,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -696,7 +699,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  			  struct mt76_tx_info *tx_info);
  void mt7915_tx_token_put(struct mt7915_dev *dev);
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
@@ -1110,20 +1096,18 @@
  bool mt7915_wed_wds_check(struct mt76_dev *mdev, struct ieee80211_sta *sta);
  void mt7915_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 51eb553c..dcb40181 100644
+index 8fd2f69a..36ad2433 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -27,6 +27,9 @@ enum reg_rev {
- 	FW_EXCEPTION_ADDR,
+@@ -28,6 +28,7 @@ enum reg_rev {
  	SWDEF_BASE_ADDR,
- 	EXCEPTION_BASE_ADDR,
-+	WED_TX_RING,
-+	WED_RX_RING,
+ 	TXQ_WED_RING_BASE,
+ 	RXQ_WED_RING_BASE,
 +	WED_RX_DATA_RING,
+ 	EXCEPTION_BASE_ADDR,
  	__MT_REG_MAX,
  };
- 
-@@ -568,9 +571,13 @@ enum offs_rev {
+@@ -570,9 +571,13 @@ enum offs_rev {
  #define MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2	BIT(21)
  
  #define MT_WFDMA0_RST_DTX_PTR		MT_WFDMA0(0x20c)
@@ -1137,33 +1121,19 @@
  
  #define MT_WFDMA0_MCU_HOST_INT_ENA	MT_WFDMA0(0x1f4)
  #define MT_WFDMA0_MT_WA_WDT_INT		BIT(31)
-@@ -668,12 +675,18 @@ enum offs_rev {
- #define MT_TXQ_EXT_CTRL(q)		(MT_Q_BASE(__TXQ(q)) + 0x600 +	\
- 					 MT_TXQ_ID(q)* 0x4)
+@@ -672,6 +677,7 @@ enum offs_rev {
  
--#define MT_TXQ_WED_RING_BASE		(!is_mt7986(mdev)? 0xd7300 : 0x24420)
--#define MT_RXQ_WED_RING_BASE		(!is_mt7986(mdev)? 0xd7410 : 0x24520)
-+#define MT_TXQ_WED_RING_BASE		__REG(WED_TX_RING)
-+#define MT_RXQ_WED_RING_BASE		__REG(WED_RX_RING)
+ #define MT_TXQ_WED_RING_BASE		__REG(TXQ_WED_RING_BASE)
+ #define MT_RXQ_WED_RING_BASE		__REG(RXQ_WED_RING_BASE)
 +#define MT_RXQ_WED_DATA_RING_BASE	__REG(WED_RX_DATA_RING)
  
- #define MT_WED_TX_DONE_BAND0		(is_mt7915(mdev)? 4 : 30)
- #define MT_WED_TX_DONE_BAND1		(is_mt7915(mdev)? 5 : 31)
--#define MT_WED_TX_FREE_DONE		(is_mt7915(mdev)? 1 : 2)
-+#define MT_WED_TX_FREE_DONE		(is_mt7986(mdev) ? 2 : 1)
-+#define MT_WED_RX_DONE_BAND0		(is_mt7915(mdev) ? 16 : \
-+					 (is_mt7986(mdev) ? 22 : 18))
-+#define MT_WED_RX_DONE_BAND1		(is_mt7915(mdev) ? 17 : \
-+					 (is_mt7986(mdev) ? 23 : 19))
-+
- 
  #define MT_INT_SOURCE_CSR		__REG(INT_SOURCE_CSR)
  #define MT_INT_MASK_CSR			__REG(INT_MASK_CSR)
 diff --git a/mt7921/mac.c b/mt7921/mac.c
-index 9c82ec24..6b631a64 100644
+index dbdf4a77..c93cd5c4 100644
 --- a/mt7921/mac.c
 +++ b/mt7921/mac.c
-@@ -680,7 +680,7 @@ bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len)
+@@ -690,7 +690,7 @@ bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len)
  EXPORT_SYMBOL_GPL(mt7921_rx_check);
  
  void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
@@ -1228,5 +1198,5 @@
 +}
 +EXPORT_SYMBOL_GPL(mt76_rx_token_release);
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch b/recipes-kernel/linux-mt76/files/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
index ef9724f..163076d 100644
--- a/recipes-kernel/linux-mt76/files/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
@@ -1,7 +1,7 @@
-From 72230221dbb07d547dba931b7b3787cbebb2125a Mon Sep 17 00:00:00 2001
+From ce92956ffffb916d8dd7ec6c5bb63c94e153678d Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 19 May 2022 13:44:42 +0800
-Subject: [PATCH 3004/3007] mt76: add fill receive path to report wed idx
+Subject: [PATCH 3004/3010] mt76: add fill receive path to report wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,10 +9,10 @@
  1 file changed, 19 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index b1fb3ddf..fcf122cf 100644
+index 74c9777..d5360ce 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1515,6 +1515,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1511,6 +1511,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  
  	return 0;
  }
@@ -37,7 +37,7 @@
  #endif
  
  const struct ieee80211_ops mt7915_ops = {
-@@ -1566,5 +1584,6 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1562,5 +1580,6 @@ const struct ieee80211_ops mt7915_ops = {
  	.set_radar_background = mt7915_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	.net_fill_forward_path = mt7915_net_fill_forward_path,
@@ -45,5 +45,5 @@
  #endif
  };
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/3005-mt76-add-ser-spport-when-wed-on.patch b/recipes-kernel/linux-mt76/files/patches/3005-mt76-add-ser-spport-when-wed-on.patch
index cee9fe0..9118c67 100644
--- a/recipes-kernel/linux-mt76/files/patches/3005-mt76-add-ser-spport-when-wed-on.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3005-mt76-add-ser-spport-when-wed-on.patch
@@ -1,7 +1,7 @@
-From c3c6234cc24fd9b57bb0d57b194252d533f5f012 Mon Sep 17 00:00:00 2001
+From 067df4201faff9efe5d8574ce98172262bec25e1 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 28 Jul 2022 11:16:15 +0800
-Subject: [PATCH 3005/3007] mt76 add ser spport when wed on
+Subject: [PATCH 3005/3010] mt76 add ser spport when wed on
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -15,7 +15,7 @@
  7 files changed, 76 insertions(+), 15 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 3317d2b9..fa56ccfb 100644
+index 3317d2b..fa56ccf 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -169,7 +169,7 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
@@ -109,7 +109,7 @@
  	if (!q->rx_head)
  		return;
 diff --git a/dma.h b/dma.h
-index 90370d12..083cbca4 100644
+index 90370d1..083cbca 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -58,5 +58,5 @@ enum mt76_mcu_evt_type {
@@ -120,10 +120,10 @@
 +int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset);
  #endif
 diff --git a/mt76.h b/mt76.h
-index f19433d4..9b00f53c 100644
+index 959fb24..3530d21 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1379,6 +1379,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1365,6 +1365,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
@@ -132,10 +132,10 @@
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 197a0169..e0a51316 100644
+index 702d629..96cad2b 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
-@@ -522,6 +522,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -532,6 +532,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
  {
  	struct mt76_phy *mphy_ext = dev->mt76.phys[MT_BAND1];
@@ -143,7 +143,7 @@
  	int i;
  
  	/* clean up hw queues */
-@@ -542,28 +543,53 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
+@@ -552,28 +553,53 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
  		mt7915_wfsys_reset(dev);
  
  	/* disable wfdma */
@@ -203,7 +203,7 @@
  }
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 4e0c3ec4..0cd9cad9 100644
+index 06268e0..544d166 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -916,6 +916,8 @@ void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed)
@@ -234,7 +234,7 @@
  static void
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
-@@ -1665,6 +1679,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1679,6 +1693,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	if (!(READ_ONCE(dev->reset_state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
@@ -248,23 +248,23 @@
  	if (ext_phy)
  		ieee80211_stop_queues(ext_phy->hw);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 6e07311d..0edea0d3 100644
+index edf99d2..11c7e94 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -761,6 +761,8 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+@@ -609,6 +609,8 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  	wed->wlan.init_rx_buf = mt7915_wed_init_rx_buf;
  	wed->wlan.release_rx_buf = mt7915_wed_release_rx_buf;
  
 +	wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
 +
  	dev->mt76.rx_token_size = wed->wlan.rx_pkt;
- 	if (mtk_wed_device_attach(wed) != 0)
+ 	if (mtk_wed_device_attach(wed))
  		return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2da2ff8b..a4872451 100644
+index d96709b..1a32e82 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -549,6 +549,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -547,6 +547,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
  				int pkt_num);
  void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed);
@@ -273,5 +273,5 @@
  void mt7915_unregister_device(struct mt7915_dev *dev);
  int mt7915_eeprom_init(struct mt7915_dev *dev);
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch b/recipes-kernel/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch
index b749789..4de3b94 100644
--- a/recipes-kernel/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch
@@ -1,7 +1,7 @@
-From 247fa46efdeaa5ea727a3d5dde7a9f3d7aac97d4 Mon Sep 17 00:00:00 2001
+From 74a76d638bf234a888a94a607aadeb0fda232abd Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Fri, 5 Aug 2022 13:58:11 -0700
-Subject: [PATCH 3006/3007] mt76: mt7915: add statistic for H/W Rx Path
+Subject: [PATCH 3006/3010] mt76: mt7915: add statistic for H/W Rx Path
 
 Change-Id: Id94d663f08e91c83d296bd57e5e9b65a505ae1c7
 ---
@@ -16,7 +16,7 @@
  8 files changed, 107 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index 9b00f53c..4958d97c 100644
+index 3530d21..47a9213 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -278,6 +278,10 @@ struct mt76_sta_stats {
@@ -31,7 +31,7 @@
  
  enum mt76_wcid_flags {
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 9a468878..7ecc7253 100644
+index 9a46887..7ecc725 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -224,6 +224,11 @@ static inline bool is_mt76_fw_txp(struct mt76_dev *dev)
@@ -47,10 +47,10 @@
  {
  	static const u8 width_to_bw[] = {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 4cdfadc7..adb06f84 100644
+index 27a3624..475c391 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1210,6 +1210,41 @@ enum {
+@@ -1211,6 +1211,41 @@ enum {
  	MCU_CE_CMD_GET_TXPWR = 0xd0,
  };
  
@@ -93,7 +93,7 @@
  	PATCH_SEM_RELEASE,
  	PATCH_SEM_GET
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 0cd9cad9..35c13efd 100644
+index 544d166..bfc6c52 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -940,6 +940,31 @@ void mt7915_wed_trigger_ser(struct mtk_wed_device *wed)
@@ -129,10 +129,10 @@
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
 diff --git a/mt7915/main.c b/mt7915/main.c
-index fcf122cf..db9d55fe 100644
+index d5360ce..3e8142e 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1049,7 +1049,8 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+@@ -1050,7 +1050,8 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
  	struct rate_info *txrate = &msta->wcid.rate;
  	struct rate_info rxrate = {};
  
@@ -142,7 +142,7 @@
  	    !mt7915_mcu_get_rx_rate(phy, vif, sta, &rxrate)) {
  		sinfo->rxrate = rxrate;
  		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
-@@ -1086,6 +1087,12 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+@@ -1087,6 +1088,12 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
  
  		sinfo->tx_retries = msta->wcid.stats.tx_retries;
  		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
@@ -156,7 +156,7 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index aa8bcf70..b0fa6dac 100644
+index a405bfd..48305b4 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -293,6 +293,27 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
@@ -188,7 +188,7 @@
  mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 0edea0d3..c5ce8cf7 100644
+index 11c7e94..1f794df 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -9,6 +9,7 @@
@@ -197,18 +197,18 @@
  #include "../trace.h"
 +#include "../mt76_connac_mcu.h"
  
- static bool wed_enable = true;
+ static bool wed_enable;
  module_param(wed_enable, bool, 0644);
-@@ -763,6 +764,8 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+@@ -611,6 +612,8 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  
  	wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
  
 +	wed->wlan.update_wo_rxcnt = mt7915_wed_update_wo_rxcnt;
 +
  	dev->mt76.rx_token_size = wed->wlan.rx_pkt;
- 	if (mtk_wed_device_attach(wed) != 0)
+ 	if (mtk_wed_device_attach(wed))
  		return 0;
-@@ -774,6 +777,9 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+@@ -622,6 +625,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  	if (ret)
  		return ret;
  
@@ -219,10 +219,10 @@
  #else
  	return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index a4872451..03486837 100644
+index 1a32e82..c2a7f35 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -550,6 +550,8 @@ u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
+@@ -548,6 +548,8 @@ u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
  				int pkt_num);
  void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed);
  void mt7915_wed_trigger_ser(struct mtk_wed_device *wed);
@@ -231,7 +231,7 @@
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
  int mt7915_eeprom_init(struct mt7915_dev *dev);
-@@ -634,6 +636,7 @@ int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
+@@ -632,6 +634,7 @@ int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
  				     struct cfg80211_chan_def *chandef);
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set);
  int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
@@ -240,5 +240,5 @@
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch b/recipes-kernel/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
index 4f4d700..dee6d8c 100644
--- a/recipes-kernel/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
@@ -1,7 +1,7 @@
-From 10f2c201cbeaae838ffa2489a7ff928d812d6f49 Mon Sep 17 00:00:00 2001
+From 95895d15a31f5fef5133f1dafef38cd6b39700ea Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 2 Sep 2022 14:40:40 +0800
-Subject: [PATCH 3007/3007] mt76: mt7915: enable red per-band token drop for HW
+Subject: [PATCH 3007/3010] mt76: mt7915: enable red per-band token drop for HW
  Path
 
 Limit the number of token used by each band. If a band uses too many token,
@@ -16,7 +16,7 @@
  3 files changed, 45 insertions(+), 11 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index b0fa6dac..98277d27 100644
+index 48305b4..a3600c7 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2412,8 +2412,13 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
@@ -110,7 +110,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 1f56db6b..9181e961 100644
+index 1f56db6..9181e96 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -269,6 +269,7 @@ enum {
@@ -122,7 +122,7 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 03486837..30293158 100644
+index c2a7f35..14dfc34 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -749,11 +749,11 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
@@ -139,5 +139,5 @@
  int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
  void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
 -- 
-2.25.1
+2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch b/recipes-kernel/linux-mt76/files/patches/3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch
index 9e3fb2a..997a28f 100644
--- a/recipes-kernel/linux-mt76/files/patches/3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch
@@ -1,7 +1,8 @@
-From 5fbff98bcf45a6b2a5467d06af26507dbdb0c7aa Mon Sep 17 00:00:00 2001
+From 7b58f758461fd34ce64e75a8310787a347fd2ee5 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 22 Sep 2022 09:54:53 +0800
-Subject: [PATCH] mt76: mt7915: update mt7916 trinfo when hw path enable
+Subject: [PATCH 3008/3010] mt76: mt7915: update mt7916 trinfo when hw path
+ enable
 
 ---
  mt7915/mt7915_debug.h | 10 ++++++++++
@@ -9,7 +10,7 @@
  2 files changed, 23 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
-index 58ba2cdf..50b588bd 100644
+index 58ba2cd..50b588b 100644
 --- a/mt7915/mt7915_debug.h
 +++ b/mt7915/mt7915_debug.h
 @@ -133,6 +133,8 @@ enum dbg_reg_rev {
@@ -56,7 +57,7 @@
  #define MT_DBG_INT_SOURCE_CSR			__DBG_REG(dev, DBG_INT_SOURCE_CSR)
  #define MT_DBG_INT_MASK_CSR			__DBG_REG(dev, DBG_INT_MASK_CSR)
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index e336b35a..c9d634ce 100644
+index 9de5b0f..5f09f0a 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -855,12 +855,22 @@ mt7986_show_host_dma_info(struct seq_file *s, struct mt7915_dev *dev)
diff --git a/recipes-kernel/linux-mt76/files/patches/3009-mt76-mt7915-find-rx-token-by-physical-address.patch b/recipes-kernel/linux-mt76/files/patches/3009-mt76-mt7915-find-rx-token-by-physical-address.patch
index 8e1873d..a252398 100644
--- a/recipes-kernel/linux-mt76/files/patches/3009-mt76-mt7915-find-rx-token-by-physical-address.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3009-mt76-mt7915-find-rx-token-by-physical-address.patch
@@ -1,4 +1,4 @@
-From c72a8943ae9e7b97d9f67c066fe232eba920f517 Mon Sep 17 00:00:00 2001
+From 82335286ec2a9d33c9638c30e7638035f431e116 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 27 Sep 2022 16:34:26 +0800
 Subject: [PATCH 3009/3010] mt76: mt7915: find rx token by physical address
@@ -12,19 +12,19 @@
  1 file changed, 18 insertions(+), 1 deletion(-)
 
 diff --git a/dma.c b/dma.c
-index fa56ccfb..c5513690 100644
+index fa56ccf..c551369 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -380,11 +380,28 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
-
+ 
  	type = FIELD_GET(MT_QFLAG_WED_TYPE, q->flags);
  	if (mtk_wed_device_active(wed) && type == MT76_WED_Q_RX) {
 -		u32 token;
 +		u32 token, id, find = 0;
  		struct mt76_txwi_cache *r;
-
+ 
  		token = FIELD_GET(MT_DMA_CTL_TOKEN, desc->buf1);
-
+ 
 +		if (*more) {
 +			spin_lock_bh(&dev->rx_token_lock);
 +
@@ -45,6 +45,6 @@
  		r = mt76_rx_token_release(dev, token);
  		if (!r)
  			return NULL;
---
+-- 
 2.18.0
 
diff --git a/recipes-kernel/linux-mt76/files/patches/3010-mt76-mt7915-drop-scatter-and-gather-frame.patch b/recipes-kernel/linux-mt76/files/patches/3010-mt76-mt7915-drop-scatter-and-gather-frame.patch
new file mode 100644
index 0000000..dbc898d
--- /dev/null
+++ b/recipes-kernel/linux-mt76/files/patches/3010-mt76-mt7915-drop-scatter-and-gather-frame.patch
@@ -0,0 +1,62 @@
+From fbbc214ee09aae422c5a8f89dd88c8adeecb7356 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Wed, 28 Sep 2022 18:52:54 +0800
+Subject: [PATCH 3010/3010] mt76: mt7915: drop scatter and gather frame
+
+The scatter and gather frame may be incorrect because WED and WO may
+send frames to host driver interleaved.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ dma.c  | 9 +++++++++
+ dma.h  | 1 +
+ mt76.h | 1 +
+ 3 files changed, 11 insertions(+)
+
+diff --git a/dma.c b/dma.c
+index c551369..f893c78 100644
+--- a/dma.c
++++ b/dma.c
+@@ -419,6 +419,15 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ 
+ 		if (desc->ctrl & (MT_DMA_CTL_TO_HOST_A | MT_DMA_CTL_DROP))
+ 			*drop = true;
++
++		if (*more || (q->flags & MT_QFLAG_WED_FRAG)) {
++			*drop = true;
++
++			if (!(*more) && FIELD_GET(MT_DMA_CTL_WO, desc->buf1))
++				q->flags &= ~MT_QFLAG_WED_FRAG;
++			else
++				q->flags |= MT_QFLAG_WED_FRAG;
++		}
+ 	} else {
+ 		buf_addr = e->dma_addr[0];
+ 		e->buf = NULL;
+diff --git a/dma.h b/dma.h
+index 083cbca..221fcc8 100644
+--- a/dma.h
++++ b/dma.h
+@@ -21,6 +21,7 @@
+ #define MT_DMA_CTL_DROP			BIT(14)
+ 
+ #define MT_DMA_CTL_TOKEN		GENMASK(31, 16)
++#define MT_DMA_CTL_WO			BIT(8)
+ 
+ #define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
+ #define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
+diff --git a/mt76.h b/mt76.h
+index 47a9213..1af188e 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -32,6 +32,7 @@
+ #define MT_QFLAG_WED_RING	GENMASK(1, 0)
+ #define MT_QFLAG_WED_TYPE	GENMASK(3, 2)
+ #define MT_QFLAG_WED		BIT(4)
++#define MT_QFLAG_WED_FRAG	BIT(5)
+ 
+ #define __MT_WED_Q(_type, _n)	(MT_QFLAG_WED | \
+ 				 FIELD_PREP(MT_QFLAG_WED_TYPE, _type) | \
+-- 
+2.18.0
+
diff --git a/recipes-kernel/linux-mt76/files/patches/patches.inc b/recipes-kernel/linux-mt76/files/patches/patches.inc
index eb2119c..d9a0e57 100644
--- a/recipes-kernel/linux-mt76/files/patches/patches.inc
+++ b/recipes-kernel/linux-mt76/files/patches/patches.inc
@@ -1,13 +1,8 @@
 #patch patches (come from openwrt/lede/target/linux/mediatek)
 SRC_URI_append = " \
     file://0001-mt76-mt7915-rework-testmode-init-registers.patch \
-    file://0002-mt76-testmode-rework-tx-antenna-setting.patch \
-    file://0003-mt76-mt7915-rework-rx-testmode-stats.patch \
-    file://0004-mt76-mt7915-drop-undefined-action-frame.patch \
-    file://0005-mt76-common-RF-CR-idx-require-8-bits.patch \
-    file://0006-mt76-mt7915-add-spatial-extension-index-support.patch \
-    file://0007-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch \
-    file://0008-mt76-mt7915-set-chainmask-to-3-for-mt7916.patch \
+    file://0002-mt76-mt7915-rework-rx-testmode-stats.patch \
+    file://0003-mt76-mt7915-drop-undefined-action-frame.patch \
     file://100-Revert-of-net-pass-the-dst-buffer-to-of_get_mac_addr.patch \
     file://1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch \
     file://1002-mt76-mt7915-csi-implement-csi-support.patch \
@@ -32,6 +27,7 @@
     file://1122-mt76-HEMU-Add-dump-support.patch \
     file://1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch \
     file://1124-mt76-add-ibf-control-vendor-cmd.patch \
+    file://1125-mt76-add-ampdu-amsdu-control.patch \
     file://3001-mt76-add-wed-tx-support.patch \
     file://3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch \
     file://3003-mt76-add-wed-rx-support.patch \
@@ -41,4 +37,5 @@
     file://3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch \
     file://3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch \
     file://3009-mt76-mt7915-find-rx-token-by-physical-address.patch \
+    file://3010-mt76-mt7915-drop-scatter-and-gather-frame.patch \
     "
diff --git a/recipes-kernel/linux-mt76/linux-mt76.bb b/recipes-kernel/linux-mt76/linux-mt76.bb
index ae48a44..0eb6b8e 100644
--- a/recipes-kernel/linux-mt76/linux-mt76.bb
+++ b/recipes-kernel/linux-mt76/linux-mt76.bb
@@ -7,7 +7,7 @@
 
 PV = "1.0"
 
-SRCREV ?= "763a1d90133bfd2efae1a533d6b571d9802bcaa3"
+SRCREV ?= "72b87836d368685a093b927229209b61d8272541"
 SRC_URI = " \
     git://git@github.com/openwrt/mt76.git;protocol=https \
     file://COPYING;subdir=git \
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9990-mt7622-backport-nf-hw-offload-framework-and-ups.patch b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9990-mt7622-backport-nf-hw-offload-framework-and-ups.patch
index 0d93e46..31bfae5 100755
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9990-mt7622-backport-nf-hw-offload-framework-and-ups.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9990-mt7622-backport-nf-hw-offload-framework-and-ups.patch
@@ -1291,7 +1291,7 @@
 index 000000000..4294f0c74
 --- /dev/null
 +++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
-@@ -0,0 +1,526 @@
+@@ -0,0 +1,541 @@
 +// SPDX-License-Identifier: GPL-2.0-only
 +/*
 + *  Copyright (C) 2020 Felix Fietkau <nbd@nbd.name>
@@ -1760,9 +1760,13 @@
 +{
 +	struct mtk_mac *mac = netdev_priv(dev);
 +	struct mtk_eth *eth = mac->hw;
++	struct nf_flowtable *flowtable;
 +	static LIST_HEAD(block_cb_list);
 +	struct flow_block_cb *block_cb;
 +	flow_setup_cb_t *cb;
++	int err = 0;
++
++	flowtable = container_of(f->block, struct nf_flowtable, flow_block);
 +
 +	if (!eth->ppe.foe_table)
 +		return -EOPNOTSUPP;
@@ -1773,33 +1777,44 @@
 +	cb = mtk_eth_setup_tc_block_cb;
 +	f->driver_block_list = &block_cb_list;
 +
++	down_write(&flowtable->flow_block_lock);
++
 +	switch (f->command) {
 +	case FLOW_BLOCK_BIND:
 +		block_cb = flow_block_cb_lookup(f->block, cb, dev);
 +		if (block_cb) {
 +			flow_block_cb_incref(block_cb);
-+			return 0;
++			goto unlock;
 +		}
 +		block_cb = flow_block_cb_alloc(cb, dev, dev, NULL);
-+		if (IS_ERR(block_cb))
-+			return PTR_ERR(block_cb);
++		if (IS_ERR(block_cb)) {
++			err = PTR_ERR(block_cb);
++			goto unlock;
++		}
 +
 +		flow_block_cb_add(block_cb, f);
 +		list_add_tail(&block_cb->driver_list, &block_cb_list);
-+		return 0;
++		break;
 +	case FLOW_BLOCK_UNBIND:
 +		block_cb = flow_block_cb_lookup(f->block, cb, dev);
-+		if (!block_cb)
-+			return -ENOENT;
++		if (!block_cb) {
++			err = -ENOENT;
++			goto unlock;
++		}
 +
 +		if (flow_block_cb_decref(block_cb)) {
 +			flow_block_cb_remove(block_cb, f);
 +			list_del(&block_cb->driver_list);
 +		}
-+		return 0;
++		break;
 +	default:
-+		return -EOPNOTSUPP;
++		err = -EOPNOTSUPP;
++		break;
 +	}
++
++unlock:
++	up_write(&flowtable->flow_block_lock);
++	return err;
 +}
 +
 +int mtk_eth_setup_tc(struct net_device *dev, enum tc_setup_type type,
@@ -5785,7 +5800,7 @@
 +	if (cmd == FLOW_CLS_REPLACE)
 +		cls_flow.rule = flow_rule->rule;
 +
-+	down_read(&flowtable->flow_block_lock);
++	down_write(&flowtable->flow_block_lock);
 +	list_for_each_entry(block_cb, block_cb_list, list) {
 +		err = block_cb->cb(TC_SETUP_CLSFLOWER, &cls_flow,
 +				   block_cb->cb_priv);
@@ -5794,7 +5809,7 @@
 +
 +		i++;
 +	}
-+	up_read(&flowtable->flow_block_lock);
++	up_write(&flowtable->flow_block_lock);
 +
 +	if (cmd == FLOW_CLS_STATS)
 +		memcpy(stats, &cls_flow.stats, sizeof(*stats));
diff --git a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9995-flow-offload-add-mkhnat-dual-ppe-new-v2.patch b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9995-flow-offload-add-mkhnat-dual-ppe-new-v2.patch
index 8277899..6ff62ff 100755
--- a/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9995-flow-offload-add-mkhnat-dual-ppe-new-v2.patch
+++ b/recipes-kernel/linux/linux-mediatek-5.4/mediatek/flow_patch/9995-flow-offload-add-mkhnat-dual-ppe-new-v2.patch
@@ -430,11 +430,14 @@
  	f->stats.lastused = jiffies - idle * HZ;
  
  	return 0;
-@@ -540,9 +564,12 @@ mtk_eth_setup_tc_block(struct net_device *dev, struct flow_block_offload *f)
+@@ -540,12 +564,14 @@ mtk_eth_setup_tc_block(struct net_device *dev, struct flow_block_offload *f)
  	static LIST_HEAD(block_cb_list);
  	struct flow_block_cb *block_cb;
  	flow_setup_cb_t *cb;
-+	int i;
+-	int err = 0;
++	int i, err = 0;
+ 
+ 	flowtable = container_of(f->block, struct nf_flowtable, flow_block);
  
 -	if (!eth->ppe || !eth->ppe->foe_table)
 -		return -EOPNOTSUPP;