diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
index 6036d7c..347d8e8 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
@@ -1,7 +1,7 @@
-From 8b72691afc0ab523e98a9737e56c7aeebd830b3f Mon Sep 17 00:00:00 2001
+From 35c54875181e0f1b0637746de7c4af6aa9ec0212 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Jun 2022 19:46:26 +0800
-Subject: [PATCH 1/8] mt76: mt7915: rework testmode init registers
+Subject: [PATCH 1/7] mt76: mt7915: rework testmode init registers
 
 ---
  mt7915/mmio.c     |  2 ++
@@ -10,7 +10,7 @@
  3 files changed, 54 insertions(+), 16 deletions(-)
 
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index c1256de..c81fa09 100644
+index 7bd5f672..68d978f4 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -59,6 +59,7 @@ static const u32 mt7986_reg[] = {
@@ -21,7 +21,7 @@
  	[TMAC_CDTR]		= 0x090,
  	[TMAC_ODTR]		= 0x094,
  	[TMAC_ATCR]		= 0x098,
-@@ -132,6 +133,7 @@ static const u32 mt7915_offs[] = {
+@@ -133,6 +134,7 @@ static const u32 mt7915_offs[] = {
  };
  
  static const u32 mt7916_offs[] = {
@@ -30,7 +30,7 @@
  	[TMAC_ODTR]		= 0x0cc,
  	[TMAC_ATCR]		= 0x00c,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 53061aa..1687568 100644
+index 5920e705..6d9d187a 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -30,6 +30,7 @@ enum reg_rev {
@@ -41,7 +41,7 @@
  	TMAC_CDTR,
  	TMAC_ODTR,
  	TMAC_ATCR,
-@@ -179,6 +180,12 @@ enum offs_rev {
+@@ -180,6 +181,12 @@ enum offs_rev {
  #define MT_TRB_RXPSR0_RX_WTBL_PTR	GENMASK(25, 16)
  #define MT_TRB_RXPSR0_RX_RMAC_PTR	GENMASK(9, 0)
  
@@ -54,7 +54,7 @@
  /* TMAC: band 0(0x820e4000), band 1(0x820f4000) */
  #define MT_WF_TMAC_BASE(_band)		((_band) ? 0x820f4000 : 0x820e4000)
  #define MT_WF_TMAC(_band, ofs)		(MT_WF_TMAC_BASE(_band) + (ofs))
-@@ -187,6 +194,9 @@ enum offs_rev {
+@@ -188,6 +195,9 @@ enum offs_rev {
  #define MT_TMAC_TCR0_TX_BLINK		GENMASK(7, 6)
  #define MT_TMAC_TCR0_TBTT_STOP_CTRL	BIT(25)
  
@@ -64,7 +64,7 @@
  #define MT_TMAC_CDTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_CDTR))
   #define MT_TMAC_ODTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_ODTR))
  #define MT_TIMEOUT_VAL_PLCP		GENMASK(15, 0)
-@@ -458,8 +468,10 @@ enum offs_rev {
+@@ -459,8 +469,10 @@ enum offs_rev {
  #define MT_AGG_PCR0_VHT_PROT		BIT(13)
  #define MT_AGG_PCR0_PTA_WIN_DIS		BIT(15)
  
@@ -78,7 +78,7 @@
  #define MT_AGG_ACR0(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR0))
  #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index efb9bb8..0186602 100644
+index efb9bb82..01866028 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -30,7 +30,7 @@ struct reg_band {
@@ -175,5 +175,5 @@
  
  static void
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch
index acc323f..caac8c3 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch
@@ -1,7 +1,7 @@
-From 879e20ba9e16a41db88087dd73e4ebbfecb1388b Mon Sep 17 00:00:00 2001
+From e7fac7c5c91fbabafa530abdf32cf11dd36834d7 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 25 Feb 2022 09:36:01 +0800
-Subject: [PATCH 2/8] mt76: testmode: rework tx antenna setting
+Subject: [PATCH 2/7] mt76: testmode: rework tx antenna setting
 
 ---
  mt7915/mcu.c      |  7 +------
@@ -10,10 +10,10 @@
  3 files changed, 8 insertions(+), 15 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7767bfe..e3123f2 100644
+index 3586a8e3..d9c9805b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2640,14 +2640,9 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
+@@ -2642,14 +2642,9 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
  
  #ifdef CONFIG_NL80211_TESTMODE
  	if (phy->mt76->test.tx_antenna_mask &&
@@ -30,7 +30,7 @@
  #endif
  
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 0186602..41b9949 100644
+index 01866028..41b99496 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -474,11 +474,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
@@ -69,10 +69,10 @@
  
  	for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
 diff --git a/testmode.c b/testmode.c
-index 71fd3fb..74a46e9 100644
+index 0accc71a..57cdfdf6 100644
 --- a/testmode.c
 +++ b/testmode.c
-@@ -443,8 +443,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -447,8 +447,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_LDPC], &td->tx_rate_ldpc, 0, 1) ||
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_STBC], &td->tx_rate_stbc, 0, 1) ||
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_LTF], &td->tx_ltf, 0, 2) ||
@@ -83,5 +83,5 @@
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
  			   &td->tx_duty_cycle, 0, 99) ||
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch
index d6f694c..1b0de96 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch
@@ -1,7 +1,7 @@
-From f8b12d3930f7c463bb0981904e648030461c1a82 Mon Sep 17 00:00:00 2001
+From 826c0c1849f01d0afaf4cfa14adfba0386f8d88f Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 3 Jan 2022 17:09:53 +0800
-Subject: [PATCH 3/8] mt76: mt7915: rework rx testmode stats
+Subject: [PATCH 3/7] mt76: mt7915: rework rx testmode stats
 
 ---
  mac80211.c        |  3 +-
@@ -15,10 +15,10 @@
  8 files changed, 109 insertions(+), 17 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index a46884d..d74300f 100644
+index bc3a7514..c5ef5940 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -751,7 +751,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
+@@ -752,7 +752,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
  	}
  
  #ifdef CONFIG_NL80211_TESTMODE
@@ -29,10 +29,10 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index 4da77d4..94541cd 100644
+index 87db9498..e4a248a1 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -612,6 +612,8 @@ struct mt76_testmode_ops {
+@@ -638,6 +638,8 @@ struct mt76_testmode_ops {
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  };
  
@@ -41,7 +41,7 @@
  struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
-@@ -643,6 +645,8 @@ struct mt76_testmode_data {
+@@ -669,6 +671,8 @@ struct mt76_testmode_data {
  
  	u8 addr[3][ETH_ALEN];
  
@@ -50,7 +50,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -650,6 +654,7 @@ struct mt76_testmode_data {
+@@ -676,6 +680,7 @@ struct mt76_testmode_data {
  	struct {
  		u64 packets[__MT_RXQ_MAX];
  		u64 fcs_error[__MT_RXQ_MAX];
@@ -59,10 +59,10 @@
  };
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f1d7c05..e94d670 100644
+index 718f427d..f62af7a8 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1130,6 +1130,7 @@ enum {
+@@ -1138,6 +1138,7 @@ enum {
  	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
  	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
  	MCU_EXT_CMD_MURU_CTRL = 0x9f,
@@ -71,7 +71,7 @@
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index cd1edf5..110e4f3 100644
+index cd1edf55..110e4f36 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -9,6 +9,7 @@
@@ -83,7 +83,7 @@
  	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
  };
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 41b9949..6c05dfa 100644
+index 41b99496..6c05dfab 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -133,6 +133,21 @@ mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
@@ -215,7 +215,7 @@
  
  const struct mt76_testmode_ops mt7915_testmode_ops = {
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 5573ac3..a1c54c8 100644
+index 5573ac30..a1c54c89 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -33,6 +33,12 @@ struct mt7915_tm_clean_txq {
@@ -266,10 +266,10 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 74a46e9..ba9ac2d 100644
+index 57cdfdf6..1d0d5d30 100644
 --- a/testmode.c
 +++ b/testmode.c
-@@ -555,6 +555,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
+@@ -559,6 +559,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
  	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_PACKETS, rx_packets,
  			      MT76_TM_STATS_ATTR_PAD) ||
  	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_FCS_ERROR, rx_fcs_error,
@@ -280,7 +280,7 @@
  		return -EMSGSIZE;
  
 diff --git a/testmode.h b/testmode.h
-index 5e2792d..8961326 100644
+index 5e2792d8..89613266 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -101,6 +101,8 @@ enum mt76_testmode_attr {
@@ -301,5 +301,5 @@
  	/* keep last */
  	NUM_MT76_TM_STATS_ATTRS,
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0004-mt76-mt7915-drop-undefined-action-frame.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0004-mt76-mt7915-drop-undefined-action-frame.patch
index f8627aa..b9dc31b 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/0004-mt76-mt7915-drop-undefined-action-frame.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0004-mt76-mt7915-drop-undefined-action-frame.patch
@@ -1,14 +1,14 @@
-From ca98c2d93f1d1b9c4702d3199e371972c15dcbed Mon Sep 17 00:00:00 2001
+From 96fcb3f5306bceb4f04ca87d097df6f7d391a147 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 14 Apr 2022 15:18:02 +0800
-Subject: [PATCH 4/8] mt76: mt7915: drop undefined action frame
+Subject: [PATCH 4/7] mt76: mt7915: drop undefined action frame
 
 ---
  mt7915/mac.c | 6 ++++++
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 1b660c9..31d1138 100644
+index b2322762..967e348c 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -684,6 +684,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -32,5 +32,5 @@
  	if (id < 0)
  		return id;
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0005-mt76-common-RF-CR-idx-require-8-bits.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0005-mt76-common-RF-CR-idx-require-8-bits.patch
index 5997f90..f13b609 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/0005-mt76-common-RF-CR-idx-require-8-bits.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0005-mt76-common-RF-CR-idx-require-8-bits.patch
@@ -1,7 +1,7 @@
-From dfd7bee7503ff97ba433d40c08c1b45a1a36ddff Mon Sep 17 00:00:00 2001
+From dfee8e4b5b042c1a0c2fa3b9bed6c4d212091813 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Mon, 13 Jun 2022 23:10:26 +0800
-Subject: [PATCH 5/8] mt76: common: RF CR idx require 8 bits
+Subject: [PATCH 5/7] mt76: common: RF CR idx require 8 bits
 
 Change-Id: I95af9cca36052be090be776868822d0a74377c9d
 ---
@@ -9,10 +9,10 @@
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index e3123f2..9ba930a 100644
+index d9c9805b..2d6642e6 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3440,8 +3440,8 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -3442,8 +3442,8 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  		__le32 ofs;
  		__le32 data;
  	} __packed req = {
@@ -24,5 +24,5 @@
  	};
  	struct sk_buff *skb;
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0007-mt76-mt7915-add-spatial-extension-index-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0006-mt76-mt7915-add-spatial-extension-index-support.patch
similarity index 89%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/0007-mt76-mt7915-add-spatial-extension-index-support.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/0006-mt76-mt7915-add-spatial-extension-index-support.patch
index 23083b2..4080c1d 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/0007-mt76-mt7915-add-spatial-extension-index-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0006-mt76-mt7915-add-spatial-extension-index-support.patch
@@ -1,7 +1,7 @@
-From 66e3f9c0cefaabcb7747f9ac52a92e8912332da9 Mon Sep 17 00:00:00 2001
+From f93eece806a777bea73ab2fcca1869b1b4b87b5c Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 13 Jul 2022 10:43:16 +0800
-Subject: [PATCH 7/8] mt76: mt7915: add spatial extension index support
+Subject: [PATCH 6/7] mt76: mt7915: add spatial extension index support
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -15,7 +15,7 @@
  7 files changed, 43 insertions(+), 14 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index d033655..7b6b3aa 100644
+index 635192c8..0915eb57 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -261,6 +261,17 @@ mt76_connac_txwi_to_txp(struct mt76_dev *dev, struct mt76_txwi_cache *t)
@@ -37,7 +37,7 @@
  void mt76_connac_power_save_sched(struct mt76_phy *phy,
  				  struct mt76_connac_pm *pm);
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index 18dea8e..a9e58cf 100644
+index 34ac3d81..8b7ec64a 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
 @@ -417,9 +417,6 @@ mt76_connac2_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi,
@@ -50,7 +50,7 @@
  	}
  
  	if (info->flags & IEEE80211_TX_CTL_INJECTED) {
-@@ -546,6 +543,14 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
+@@ -550,6 +547,14 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
  		val |= FIELD_PREP(MT_TXD6_TX_RATE, rate);
  		txwi[6] |= cpu_to_le32(val);
  		txwi[3] |= cpu_to_le32(MT_TXD3_BA_DISABLE);
@@ -66,10 +66,10 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac2_mac_write_txwi);
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index e94d670..17e5213 100644
+index f62af7a8..31017218 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -572,7 +572,7 @@ struct sta_rec_ra_fixed {
+@@ -580,7 +580,7 @@ struct sta_rec_ra_fixed {
  
  	struct sta_phy phy;
  
@@ -79,7 +79,7 @@
  	u8 is_5g;
  	u8 mmps_mode;
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 36faefb..1ba164a 100644
+index 2557fe08..edd678ce 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -957,9 +957,6 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
@@ -93,7 +93,7 @@
  
  	phy->mt76->antenna_mask = tx_ant;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 9ba930a..5fc7a24 100644
+index 2d6642e6..19a33120 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -1306,6 +1306,9 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
@@ -125,7 +125,7 @@
  static int
  mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  			       struct ieee80211_vif *vif,
-@@ -1433,7 +1448,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1435,7 +1450,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  			return ret;
  	}
  
@@ -134,7 +134,7 @@
  }
  
  static void
-@@ -2646,6 +2661,9 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
+@@ -2648,6 +2663,9 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
  	}
  #endif
  
@@ -145,7 +145,7 @@
  	    dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
  		req.switch_reason = CH_SWITCH_NORMAL;
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 110e4f3..ed94980 100644
+index 110e4f36..ed949802 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -395,6 +395,7 @@ enum {
@@ -157,7 +157,7 @@
  
  #define RATE_CFG_MCS			GENMASK(3, 0)
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 6c05dfa..35345d3 100644
+index 6c05dfab..35345d35 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -473,8 +473,6 @@ mt7915_tm_update_channel(struct mt7915_phy *phy)
@@ -185,5 +185,5 @@
  
  	mt7915_tm_set_tam_arb(phy, en,
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0006-mt76-testmode-use-random-payload-for-tx-packets.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0006-mt76-testmode-use-random-payload-for-tx-packets.patch
deleted file mode 100644
index 0c413a1..0000000
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/0006-mt76-testmode-use-random-payload-for-tx-packets.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From d5720c59e760004712e6bcdbdf112f82521fa72b Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Wed, 6 Jul 2022 21:52:45 +0800
-Subject: [PATCH 6/8] mt76: testmode: use random payload for tx packets
-
-Compared to fixed payload packets, random payload packets have better
-measured EVM under the same txpower. Our tests show EVM becomes at least
-3 dB better in test cases with high rate and long tx length, which also
-aligns the testing result of proprietary driver.
-
-Suggested-by: Jm Chen <jm.chen@mediatek.com>
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- testmode.c | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/testmode.c b/testmode.c
-index ba9ac2d..1d0d5d3 100644
---- a/testmode.c
-+++ b/testmode.c
-@@ -1,5 +1,7 @@
- // SPDX-License-Identifier: ISC
- /* Copyright (C) 2020 Felix Fietkau <nbd@nbd.name> */
-+
-+#include <linux/random.h>
- #include "mt76.h"
- 
- const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
-@@ -123,12 +125,14 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
- 	if (!head)
- 		return -ENOMEM;
- 
--	hdr = __skb_put_zero(head, head_len);
-+	hdr = __skb_put_zero(head, sizeof(*hdr));
- 	hdr->frame_control = cpu_to_le16(fc);
- 	memcpy(hdr->addr1, td->addr[0], ETH_ALEN);
- 	memcpy(hdr->addr2, td->addr[1], ETH_ALEN);
- 	memcpy(hdr->addr3, td->addr[2], ETH_ALEN);
- 	skb_set_queue_mapping(head, IEEE80211_AC_BE);
-+	get_random_bytes(__skb_put(head, head_len - sizeof(*hdr)),
-+			 head_len - sizeof(*hdr));
- 
- 	info = IEEE80211_SKB_CB(head);
- 	info->flags = IEEE80211_TX_CTL_INJECTED |
-@@ -154,7 +158,7 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
- 			return -ENOMEM;
- 		}
- 
--		__skb_put_zero(frag, frag_len);
-+		get_random_bytes(__skb_put(frag, frag_len), frag_len);
- 		head->len += frag->len;
- 		head->data_len += frag->len;
- 
--- 
-2.18.0
-
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0008-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0007-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch
similarity index 81%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/0008-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/0007-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch
index 35595d0..b1eb130 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/0008-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0007-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch
@@ -1,7 +1,7 @@
-From ebe0cc8b9878e72143f0e24fea00ba2b474cdd6b Mon Sep 17 00:00:00 2001
+From 41cd86ee3b09740a84cb1aba54e669aaadcb7d2b Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 26 Jul 2022 16:04:53 +0800
-Subject: [PATCH 8/8] mt76: mt7915: set the first antenna to detect radar for
+Subject: [PATCH 7/7] mt76: mt7915: set the first antenna to detect radar for
  MT7915
 
 The default value of listening antenna set by FW might be different in
@@ -15,10 +15,10 @@
  2 files changed, 16 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 31d1138..a1d5c15 100644
+index 967e348c..11d2866b 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1817,6 +1817,13 @@ static int mt7915_dfs_start_rdd(struct mt7915_dev *dev, int chain)
+@@ -1820,6 +1820,13 @@ static int mt7915_dfs_start_rdd(struct mt7915_dev *dev, int chain)
  	if (err < 0)
  		return err;
  
@@ -32,7 +32,7 @@
  	return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_DET_MODE, chain,
  				       MT_RX_SEL0, 1);
  }
-@@ -1937,6 +1944,14 @@ stop:
+@@ -1940,6 +1947,14 @@ stop:
  	if (err < 0)
  		return err;
  
@@ -48,10 +48,10 @@
  	phy->mt76->dfs_state = MT_DFS_STATE_DISABLED;
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 54ef2a1..836a7f1 100644
+index 1eb11617..c90a148d 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -359,6 +359,7 @@ enum mt7915_rdd_cmd {
+@@ -357,6 +357,7 @@ enum mt7915_rdd_cmd {
  	RDD_DET_MODE,
  	RDD_RADAR_EMULATE,
  	RDD_START_TXQ = 20,
@@ -60,5 +60,5 @@
  	RDD_CAC_END,
  	RDD_NORMAL_START,
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
index 990fbfb..b93bc32 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -1,4 +1,4 @@
-From 6e089768a68a8cc86526d61d34730043fee724af Mon Sep 17 00:00:00 2001
+From dcaf9bdc667b94263fd95971d7a920934a7a1725 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
 Subject: [PATCH 1001/1009] mt76: mt7915: add mtk internal debug tools for mt76
@@ -22,10 +22,10 @@
  create mode 100644 mt7915/mtk_mcu.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 17e5213..c7aeae5 100644
+index 31017218..89732676 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1119,6 +1119,12 @@ enum {
+@@ -1127,6 +1127,12 @@ enum {
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
  	MCU_EXT_CMD_RXDCOC_CAL = 0x59,
  	MCU_EXT_CMD_GET_MIB_INFO = 0x5a,
@@ -39,7 +39,7 @@
  	MCU_EXT_CMD_CAL_CACHE = 0x67,
  	MCU_EXT_CMD_SET_RADAR_TH = 0x7c,
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index b794ceb..a3474e2 100644
+index b794ceb7..a3474e2f 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -3,7 +3,7 @@
@@ -53,7 +53,7 @@
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 \ No newline at end of file
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 9f21d97..0cfb606 100644
+index a4e37a52..ea512fd1 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -8,6 +8,9 @@
@@ -197,7 +197,7 @@
  
  	if (dev->relay_fwlog)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index a1d5c15..6b0a527 100644
+index 11d2866b..00218624 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -239,6 +239,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -236,7 +236,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 1ba164a..14ba84f 100644
+index edd678ce..48b8be17 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -62,7 +62,11 @@ static int mt7915_start(struct ieee80211_hw *hw)
@@ -252,7 +252,7 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 5fc7a24..b080340 100644
+index 19a33120..e498b61f 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -195,6 +195,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -267,7 +267,7 @@
  	return mt76_tx_queue_skb_raw(dev, mdev->q_mcu[qid], skb, 0);
  }
  
-@@ -3176,6 +3181,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3178,6 +3183,8 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.sku_enable = enable,
  	};
  
@@ -276,7 +276,7 @@
  	return mt76_mcu_send_msg(&dev->mt76,
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
-@@ -3451,6 +3458,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3453,6 +3460,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -321,7 +321,7 @@
  {
  	struct {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index ed94980..bfb822f 100644
+index ed949802..bfb822fa 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -259,6 +259,10 @@ enum {
@@ -336,7 +336,7 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 836a7f1..60d489d 100644
+index c90a148d..8990b5b0 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -347,7 +347,7 @@
  #define MT7915_MAX_INTERFACES		19
  #define MT7915_WTBL_SIZE		288
  #define MT7916_WTBL_SIZE		544
-@@ -338,6 +339,29 @@ struct mt7915_dev {
+@@ -336,6 +337,29 @@ struct mt7915_dev {
  	struct reset_control *rstc;
  	void __iomem *dcm;
  	void __iomem *sku;
@@ -377,7 +377,7 @@
  };
  
  enum {
-@@ -594,4 +618,23 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -592,4 +616,23 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
  #endif
  
@@ -403,7 +403,7 @@
  #endif
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
 new file mode 100644
-index 0000000..58ba2cd
+index 00000000..58ba2cdf
 --- /dev/null
 +++ b/mt7915/mt7915_debug.h
 @@ -0,0 +1,1350 @@
@@ -1759,7 +1759,7 @@
 +#endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
 new file mode 100644
-index 0000000..f18c8b6
+index 00000000..f18c8b6c
 --- /dev/null
 +++ b/mt7915/mtk_debugfs.c
 @@ -0,0 +1,2923 @@
@@ -4688,7 +4688,7 @@
 +#endif
 diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
 new file mode 100644
-index 0000000..145fe78
+index 00000000..145fe785
 --- /dev/null
 +++ b/mt7915/mtk_mcu.c
 @@ -0,0 +1,51 @@
@@ -4744,7 +4744,7 @@
 +				 sizeof(req), true);
 +}
 diff --git a/tools/fwlog.c b/tools/fwlog.c
-index e5d4a10..3d51d9e 100644
+index e5d4a105..3d51d9ec 100644
 --- a/tools/fwlog.c
 +++ b/tools/fwlog.c
 @@ -26,7 +26,7 @@ static const char *debugfs_path(const char *phyname, const char *file)
@@ -4858,5 +4858,5 @@
  	return ret;
  }
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1002-mt76-mt7915-csi-implement-csi-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
index 2e3abe4..d020e94 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
@@ -1,4 +1,4 @@
-From 254614674ffe5c96ae73e0079b8dbb3105b115fb Mon Sep 17 00:00:00 2001
+From 87e6f3e21a575655e449ff2d09a27e3933940842 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Jun 2022 20:13:02 +0800
 Subject: [PATCH 1002/1009] mt76: mt7915: csi: implement csi support
@@ -17,10 +17,10 @@
  create mode 100644 mt7915/vendor.h
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index c7aeae5..ede5923 100644
+index 89732676..90bf841e 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -971,6 +971,7 @@ enum {
+@@ -979,6 +979,7 @@ enum {
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
  	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
@@ -28,7 +28,7 @@
  };
  
  enum {
-@@ -1141,6 +1142,7 @@ enum {
+@@ -1149,6 +1150,7 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -37,7 +37,7 @@
  
  enum {
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index a3474e2..e272c82 100644
+index a3474e2f..e272c826 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -1,9 +1,9 @@
@@ -54,7 +54,7 @@
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 \ No newline at end of file
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 489f6e7..6efa28f 100644
+index 489f6e77..6efa28fe 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -547,6 +547,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
@@ -132,7 +132,7 @@
  	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
  		dev->mt76.led_cdev.brightness_set = mt7915_led_set_brightness;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index b080340..9d2c813 100644
+index e498b61f..48e9e5ec 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -32,6 +32,10 @@
@@ -158,7 +158,7 @@
  	case MCU_EXT_EVENT_BCC_NOTIFY:
  		mt7915_mcu_rx_bcc_notify(dev, skb);
  		break;
-@@ -3458,6 +3467,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3460,6 +3469,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -268,7 +268,7 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index bfb822f..a27129c 100644
+index bfb822fa..a27129c2 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -480,4 +480,80 @@ enum {
@@ -353,10 +353,10 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 60d489d..fda264f 100644
+index 8990b5b0..4914c91d 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -276,6 +276,20 @@ struct mt7915_phy {
+@@ -274,6 +274,20 @@ struct mt7915_phy {
  		u8 spe_idx;
  	} test;
  #endif
@@ -377,7 +377,7 @@
  };
  
  struct mt7915_dev {
-@@ -618,6 +632,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -616,6 +630,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
  #endif
  
@@ -392,7 +392,7 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
 new file mode 100644
-index 0000000..98fd9c2
+index 00000000..98fd9c2d
 --- /dev/null
 +++ b/mt7915/vendor.c
 @@ -0,0 +1,452 @@
@@ -850,7 +850,7 @@
 +}
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
 new file mode 100644
-index 0000000..9d3db2a
+index 00000000..9d3db2a7
 --- /dev/null
 +++ b/mt7915/vendor.h
 @@ -0,0 +1,60 @@
@@ -915,5 +915,5 @@
 +
 +#endif
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1003-mt76-mt7915-air-monitor-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1003-mt76-mt7915-air-monitor-support.patch
index 160bb81..e3fd6a0 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1003-mt76-mt7915-air-monitor-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1003-mt76-mt7915-air-monitor-support.patch
@@ -1,4 +1,4 @@
-From 3199502dabfb1a31cc6741668ce6219fa8d1f1e9 Mon Sep 17 00:00:00 2001
+From 63af0047d060a1e8c7469a7115f9f69920f20ac5 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 11 Jan 2022 12:03:23 +0800
 Subject: [PATCH 1003/1009] mt76: mt7915: air monitor support
@@ -13,10 +13,10 @@
  6 files changed, 440 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index ede5923..865bbf3 100644
+index 90bf841e..80515382 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1142,6 +1142,8 @@ enum {
+@@ -1150,6 +1150,8 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -26,7 +26,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 6b0a527..75e2036 100644
+index 00218624..9f17f0b7 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -486,6 +486,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -41,7 +41,7 @@
  		status->flag |= RX_FLAG_8023;
  	}
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 14ba84f..43daa17 100644
+index 48b8be17..c27f9b54 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -675,6 +675,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -55,10 +55,10 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index fda264f..5551d77 100644
+index 4914c91d..32d66c4c 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -231,6 +231,35 @@ struct mt7915_hif {
+@@ -229,6 +229,35 @@ struct mt7915_hif {
  	int irq;
  };
  
@@ -94,7 +94,7 @@
  struct mt7915_phy {
  	struct mt76_phy *mt76;
  	struct mt7915_dev *dev;
-@@ -289,6 +318,8 @@ struct mt7915_phy {
+@@ -287,6 +316,8 @@ struct mt7915_phy {
  		u32 interval;
  		u32 last_record;
  	} csi;
@@ -103,7 +103,7 @@
  #endif
  };
  
-@@ -636,6 +667,9 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -634,6 +665,9 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
@@ -114,7 +114,7 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 98fd9c2..b94d787 100644
+index 98fd9c2d..b94d787e 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -430,6 +430,353 @@ out:
@@ -491,7 +491,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 9d3db2a..976817f 100644
+index 9d3db2a7..976817f3 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -4,6 +4,7 @@
@@ -545,5 +545,5 @@
 +
  #endif
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
index 286ae5d..62ecc61 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -1,4 +1,4 @@
-From cb7c232f28e31db392ffec836c4af9160e13dca1 Mon Sep 17 00:00:00 2001
+From 781871b4690c21e24ba3a86b488efb46aaa402c5 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:45:53 +0800
 Subject: [PATCH 1004/1009] mt76: mt7915: add support for muru_onoff via
@@ -12,7 +12,7 @@
  4 files changed, 47 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 6efa28f..37b7b54 100644
+index 6efa28fe..37b7b54a 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -582,6 +582,7 @@ static void mt7915_init_work(struct work_struct *work)
@@ -24,7 +24,7 @@
  
  void mt7915_wfsys_reset(struct mt7915_dev *dev)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 9d2c813..f7a3eb1 100644
+index 48e9e5ec..ed789707 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -856,13 +856,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
@@ -49,7 +49,7 @@
  		muru->mimo_dl.vht_mu_bfee =
  			!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index a27129c..d3cc828 100644
+index a27129c2..d3cc8283 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -556,4 +556,10 @@ struct csi_data {
@@ -64,7 +64,7 @@
 +
  #endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index f18c8b6..e239df9 100644
+index f18c8b6c..e239df95 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2480,6 +2480,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
@@ -115,5 +115,5 @@
  			    &fops_fw_debug_module);
  	debugfs_create_file("fw_debug_level", 0600, dir, dev,
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1005-mt76-certification-patches.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1005-mt76-certification-patches.patch
index 2a22b2a..7b5aabf 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1005-mt76-certification-patches.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1005-mt76-certification-patches.patch
@@ -1,4 +1,4 @@
-From 076da9e2a0dd1bce87dac8a88cd26cbb77046076 Mon Sep 17 00:00:00 2001
+From 05302c18e285b0dbdc3d0c1ea14819c6be425bb9 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 6 Jun 2022 20:15:51 +0800
 Subject: [PATCH 1005/1009] mt76: certification patches
@@ -16,10 +16,10 @@
  9 files changed, 956 insertions(+), 5 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 865bbf3..25aeedc 100644
+index 80515382..9fb75e6e 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1144,6 +1144,7 @@ enum {
+@@ -1152,6 +1152,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -28,7 +28,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 75e2036..6b3fa4c 100644
+index 9f17f0b7..4d777fd5 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -7,6 +7,7 @@
@@ -39,7 +39,7 @@
  
  #define to_rssi(field, rxv)	((FIELD_GET(field, rxv) - 220) / 2)
  
-@@ -1738,6 +1739,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+@@ -1741,6 +1742,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
  	phy->trb_ts = trb;
  }
  
@@ -61,7 +61,7 @@
  void mt7915_mac_sta_rc_work(struct work_struct *work)
  {
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev, rc_work);
-@@ -1760,6 +1776,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
+@@ -1763,6 +1779,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
  		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
  		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
  
@@ -76,7 +76,7 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 43daa17..4e82904 100644
+index c27f9b54..e2f557a2 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -653,6 +653,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -109,10 +109,10 @@
  
  void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f7a3eb1..f692e52 100644
+index ed789707..b4cf4d86 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3572,6 +3572,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -3574,6 +3574,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
  
  	return 0;
  }
@@ -586,7 +586,7 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index d3cc828..aab1a6a 100644
+index d3cc8283..aab1a6a3 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -396,10 +396,14 @@ enum {
@@ -820,10 +820,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 5551d77..267fa7e 100644
+index 32d66c4c..f08974bb 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -664,6 +664,19 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -662,6 +662,19 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  #endif
  
  #ifdef CONFIG_MTK_VENDOR
@@ -844,7 +844,7 @@
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index e239df9..222268f 100644
+index e239df95..222268fc 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2486,7 +2486,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
@@ -869,7 +869,7 @@
         }
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index b94d787..7456c57 100644
+index b94d787e..7456c577 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -22,6 +22,29 @@ csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
@@ -1081,7 +1081,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 976817f..1b08321 100644
+index 976817f3..1b08321c 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -6,6 +6,48 @@
@@ -1134,5 +1134,5 @@
  
  enum mtk_vendor_attr_csi_ctrl {
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
index 652c4e4..76ecbcf 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
@@ -1,4 +1,4 @@
-From c98da6a8443de7aeb6104de3ddc200253f0ee116 Mon Sep 17 00:00:00 2001
+From 18093d743469680c1ae7b8f91837dc3804cc1756 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Wed, 22 Jun 2022 10:51:59 +0800
 Subject: [PATCH 1006/1009] mt76: mt7915: add L0.5 system error recovery
@@ -8,17 +8,17 @@
  mt7915/debugfs.c |  88 ++++++++++++---
  mt7915/dma.c     |  48 ++++++++
  mt7915/init.c    |   8 +-
- mt7915/mac.c     | 283 +++++++++++++++++++++++++++++++++++++----------
+ mt7915/mac.c     | 281 +++++++++++++++++++++++++++++++++++++----------
  mt7915/main.c    |  19 +++-
  mt7915/mcu.c     |  95 ++++++++++++++--
  mt7915/mcu.h     |   3 +-
  mt7915/mmio.c    |   8 +-
  mt7915/mt7915.h  |  23 ++++
  mt7915/regs.h    |  16 +++
- 10 files changed, 492 insertions(+), 99 deletions(-)
+ 10 files changed, 491 insertions(+), 98 deletions(-)
 
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 0cfb606..07de2ee 100644
+index ea512fd1..0fe95f84 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -52,12 +52,17 @@ static ssize_t
@@ -142,7 +142,7 @@
  	kfree(buff);
  	return ret;
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index f7e6bb1..4b594a5 100644
+index f7e6bb10..4b594a53 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -479,6 +479,54 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -201,7 +201,7 @@
  {
  	mt7915_dma_disable(dev, true);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 37b7b54..141c5ad 100644
+index 37b7b54a..141c5ad8 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -262,7 +262,7 @@ static void mt7915_led_set_brightness(struct led_classdev *led_cdev,
@@ -241,7 +241,7 @@
  
  unreg_thermal:
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 6b3fa4c..e540941 100644
+index 4d777fd5..d44af409 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -3,6 +3,7 @@
@@ -252,7 +252,7 @@
  #include "mt7915.h"
  #include "../dma.h"
  #include "mac.h"
-@@ -1315,85 +1316,187 @@ mt7915_update_beacons(struct mt7915_dev *dev)
+@@ -1318,85 +1319,187 @@ mt7915_update_beacons(struct mt7915_dev *dev)
  		mt7915_update_vif_beacon, mphy_ext->hw);
  }
  
@@ -451,9 +451,6 @@
 -	idr_for_each_entry(&dev->mt76.token, txwi, id) {
 -		mt7915_txwi_free(dev, txwi, NULL, NULL);
 -		dev->mt76.token_count--;
--	}
--	spin_unlock_bh(&dev->mt76.token_lock);
--	idr_destroy(&dev->mt76.token);
 +	ext_phy = dev->mt76.phys[MT_BAND1];
 +	phy2 = ext_phy ? ext_phy->priv : NULL;
 +
@@ -476,7 +473,9 @@
 +	for (i = 0; i < 10; i++) {
 +		if (!mt7915_mac_reset(dev))
 +			break;
-+ 	}
+ 	}
+-	spin_unlock_bh(&dev->mt76.token_lock);
+-	idr_destroy(&dev->mt76.token);
 +	mutex_unlock(&dev->mt76.mutex);
 +
 +	if (i == 10)
@@ -500,7 +499,7 @@
  }
  
  /* system error recovery */
-@@ -1408,6 +1511,36 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1411,6 +1514,36 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	ext_phy = dev->mt76.phys[MT_BAND1];
  	phy2 = ext_phy ? ext_phy->priv : NULL;
  
@@ -537,7 +536,7 @@
  	if (!(READ_ONCE(dev->reset_state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
-@@ -1433,7 +1566,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1436,7 +1569,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_STOPPED);
  
  	if (mt7915_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) {
@@ -546,7 +545,7 @@
  
  		mt7915_tx_token_put(dev);
  		idr_init(&dev->mt76.token);
-@@ -1482,6 +1615,34 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1485,6 +1618,34 @@ void mt7915_mac_reset_work(struct work_struct *work)
  					     MT7915_WATCHDOG_TIME);
  }
  
@@ -582,7 +581,7 @@
  {
  	struct mt7915_dev *dev = phy->dev;
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 4e82904..7a7ff86 100644
+index e2f557a2..5b25604e 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -20,17 +20,13 @@ static bool mt7915_dev_running(struct mt7915_dev *dev)
@@ -632,7 +631,7 @@
  	mutex_lock(&dev->mt76.mutex);
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f692e52..5eac6ed 100644
+index b4cf4d86..3f18967a 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -150,19 +150,90 @@ mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
@@ -726,7 +725,7 @@
  	rxd = (struct mt76_connac2_mcu_rxd *)skb->data;
  	if (seq != rxd->seq)
  		return -EAGAIN;
-@@ -2266,18 +2337,10 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
+@@ -2268,18 +2339,10 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
  				 sizeof(req), true);
  }
  
@@ -746,7 +745,7 @@
  	/* force firmware operation mode into normal state,
  	 * which should be set before firmware download stage.
  	 */
-@@ -2326,6 +2389,20 @@ int mt7915_mcu_init(struct mt7915_dev *dev)
+@@ -2328,6 +2391,20 @@ int mt7915_mcu_init(struct mt7915_dev *dev)
  				 MCU_WA_PARAM_RED, 0, 0);
  }
  
@@ -768,7 +767,7 @@
  {
  	__mt76_mcu_restart(&dev->mt76);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index aab1a6a..c485064 100644
+index aab1a6a3..c4850644 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -453,8 +453,9 @@ enum {
@@ -783,7 +782,7 @@
  	SER_SET_RECOVER_L3_RX_ABORT,
  	SER_SET_RECOVER_L3_TX_ABORT,
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index c81fa09..8469d8f 100644
+index 68d978f4..fd2f70e3 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -24,6 +24,7 @@ static const u32 mt7915_reg[] = {
@@ -810,7 +809,7 @@
  };
  
  static const u32 mt7915_offs[] = {
-@@ -613,10 +616,9 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
+@@ -615,10 +618,9 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
  		u32 val = mt76_rr(dev, MT_MCU_CMD);
  
  		mt76_wr(dev, MT_MCU_CMD, val);
@@ -824,10 +823,10 @@
  	}
  }
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 267fa7e..d214b18 100644
+index f08974bb..e8feba36 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -352,6 +352,15 @@ struct mt7915_dev {
+@@ -350,6 +350,15 @@ struct mt7915_dev {
  	struct work_struct reset_work;
  	wait_queue_head_t reset_wait;
  	u32 reset_state;
@@ -843,7 +842,7 @@
  
  	struct list_head sta_rc_list;
  	struct list_head sta_poll_list;
-@@ -416,6 +425,12 @@ enum {
+@@ -414,6 +423,12 @@ enum {
  	__MT_WFDMA_MAX,
  };
  
@@ -856,7 +855,7 @@
  enum {
  	MT_RX_SEL0,
  	MT_RX_SEL1,
-@@ -514,6 +529,14 @@ s8 mt7915_eeprom_get_power_delta(struct mt7915_dev *dev, int band);
+@@ -512,6 +527,14 @@ s8 mt7915_eeprom_get_power_delta(struct mt7915_dev *dev, int band);
  int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2);
  void mt7915_dma_prefetch(struct mt7915_dev *dev);
  void mt7915_dma_cleanup(struct mt7915_dev *dev);
@@ -872,7 +871,7 @@
  int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  			       struct mt7915_vif *mvif,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 1687568..3d2c15b 100644
+index 6d9d187a..e2b0ff7d 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -26,6 +26,7 @@ enum reg_rev {
@@ -883,7 +882,7 @@
  	__MT_REG_MAX,
  };
  
-@@ -107,6 +108,11 @@ enum offs_rev {
+@@ -108,6 +109,11 @@ enum offs_rev {
  #define __REG(id)			(dev->reg.reg_rev[(id)])
  #define __OFFS(id)			(dev->reg.offs_rev[(id)])
  
@@ -895,7 +894,7 @@
  /* MCU WFDMA0 */
  #define MT_MCU_WFDMA0_BASE		0x2000
  #define MT_MCU_WFDMA0(ofs)		(MT_MCU_WFDMA0_BASE + (ofs))
-@@ -559,6 +565,10 @@ enum offs_rev {
+@@ -563,6 +569,10 @@ enum offs_rev {
  #define MT_WFDMA0_PRI_DLY_INT_CFG1	MT_WFDMA0(0x2f4)
  #define MT_WFDMA0_PRI_DLY_INT_CFG2	MT_WFDMA0(0x2f8)
  
@@ -906,7 +905,7 @@
  /* WFDMA1 */
  #define MT_WFDMA1_BASE			0xd5000
  #define MT_WFDMA1(ofs)			(MT_WFDMA1_BASE + (ofs))
-@@ -704,6 +714,10 @@ enum offs_rev {
+@@ -708,6 +718,10 @@ enum offs_rev {
  #define MT_MCU_CMD_NORMAL_STATE		BIT(5)
  #define MT_MCU_CMD_ERROR_MASK		GENMASK(5, 1)
  
@@ -917,7 +916,7 @@
  /* TOP RGU */
  #define MT_TOP_RGU_BASE			0x18000000
  #define MT_TOP_PWR_CTRL			(MT_TOP_RGU_BASE + (0x0))
-@@ -979,6 +993,8 @@ enum offs_rev {
+@@ -983,6 +997,8 @@ enum offs_rev {
  #define MT_CPU_UTIL_PEAK_IDLE_CNT	MT_CPU_UTIL(0x0c)
  #define MT_CPU_UTIL_CTRL		MT_CPU_UTIL(0x1c)
  
@@ -927,5 +926,5 @@
  #define MT_LED_TOP_BASE			0x18013000
  #define MT_LED_PHYS(_n)			(MT_LED_TOP_BASE + (_n))
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
index 04f104d..b7d2f5b 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
@@ -1,4 +1,4 @@
-From 55e3010fdad6c8ad6e24d6502874e6a54bc3e084 Mon Sep 17 00:00:00 2001
+From e937fef1994ae95703ae1920db249a68e7da0549 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Fri, 27 May 2022 15:51:48 +0800
 Subject: [PATCH 1007/1009] mt76: mt7915:add support for runtime set in-band
@@ -10,10 +10,10 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 5eac6ed..09a130d 100644
+index 3f18967a..a3035597 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2020,8 +2020,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -2022,8 +2022,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	u8 *buf, interval;
  	int len;
  
@@ -23,7 +23,7 @@
  		interval = vif->bss_conf.fils_discovery.max_interval;
  		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
  	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-@@ -2056,7 +2055,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
+@@ -2058,7 +2057,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
  	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
  	discov->tx_interval = interval;
  	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
@@ -33,5 +33,5 @@
  	buf = (u8 *)tlv + sizeof(*discov);
  
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
index bdcb876..3dcce36 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -1,4 +1,4 @@
-From 96aa5b1fd4b17bc3aadeff2d04fb9818aa549639 Mon Sep 17 00:00:00 2001
+From fd62d0e9fb340653b1f5e78f5492848b1e686ea5 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:53:43 +0800
 Subject: [PATCH 1008/1009] mt76: mt7915: add mt76 vendor muru onoff command
@@ -11,10 +11,10 @@
  4 files changed, 63 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 09a130d..9a7c9d3 100644
+index a3035597..c8c8be49 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3668,6 +3668,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -3670,6 +3670,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  		if (val == 0)
  			dev->dbg.muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
  		break;
@@ -29,7 +29,7 @@
  }
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index c485064..0a77ad0 100644
+index c4850644..0a77ad0d 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -403,6 +403,7 @@ enum {
@@ -41,7 +41,7 @@
  };
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 7456c57..c755184 100644
+index 7456c577..c7551848 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -34,6 +34,11 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -109,7 +109,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 1b08321..a8e4ebf 100644
+index 1b08321c..a8e4ebf9 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -8,6 +8,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -139,5 +139,5 @@
  	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
  
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1009-mt76-mt7915-add-fw_version-dump.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1009-mt76-mt7915-add-fw_version-dump.patch
index 17a7013..fbc6ba0 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1009-mt76-mt7915-add-fw_version-dump.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1009-mt76-mt7915-add-fw_version-dump.patch
@@ -1,4 +1,4 @@
-From 958bb5b8c333641344dd61cd84ee5402c4d11b32 Mon Sep 17 00:00:00 2001
+From 20a76d5a926f067a858a29c91bd21e0ff7ee7f10 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 17 Aug 2022 13:40:24 +0800
 Subject: [PATCH 1009/1009] mt76: mt7915: add fw_version dump
@@ -10,10 +10,10 @@
  3 files changed, 32 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index 94541cd..8e81f40 100644
+index e4a248a1..b5453d35 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -811,6 +811,10 @@ struct mt76_dev {
+@@ -837,6 +837,10 @@ struct mt76_dev {
  		struct mt76_usb usb;
  		struct mt76_sdio sdio;
  	};
@@ -25,20 +25,20 @@
  
  struct mt76_power_limits {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 261181d..47b2bce 100644
+index ed6c9ebb..c1ed9fef 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -2883,6 +2883,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+@@ -2875,6 +2875,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
  		goto out;
  	}
  
 +	dev->wm_hdr = devm_kzalloc(dev->dev, sizeof(*hdr), GFP_KERNEL);
 +	memcpy(dev->wm_hdr, hdr, sizeof(*hdr));
 +
- 	release_firmware(fw);
- 
- 	if (!fw_wa)
-@@ -2908,6 +2911,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+ 	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
+ 	dev_info(dev->dev, "WM Firmware Version: %.10s, Build Time: %.15s\n",
+ 		 hdr->fw_ver, hdr->build_date);
+@@ -2914,6 +2917,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
  		goto out;
  	}
  
@@ -48,7 +48,7 @@
  	snprintf(dev->hw->wiphy->fw_version,
  		 sizeof(dev->hw->wiphy->fw_version),
  		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
-@@ -2978,6 +2984,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
+@@ -2984,6 +2990,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
  	dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
  		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
  
@@ -59,7 +59,7 @@
  		struct mt76_connac2_patch_sec *sec;
  		u32 len, addr, mode;
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 222268f..cfd0b30 100644
+index 222268fc..ef0c27d2 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2721,6 +2721,22 @@ static int mt7915_agginfo_read_band1(struct seq_file *s, void *data)
@@ -70,7 +70,7 @@
 +{
 +	struct mt7915_dev *dev = dev_get_drvdata(s->private);
 +	struct mt76_dev *mdev = NULL;
-+	seq_printf(s, "Version: 2.2.3.0\n");
++	seq_printf(s, "Version: 2.2.5.0\n");
 +
 +	if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 +		return 0;
@@ -96,5 +96,5 @@
  }
  #endif
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1111-mt76-testmode-additional-supports.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1111-mt76-testmode-additional-supports.patch
index 23b457c..2179d74 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1111-mt76-testmode-additional-supports.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1111-mt76-testmode-additional-supports.patch
@@ -1,7 +1,7 @@
-From b3560ff20a0c83b70bf4e60cf98747fb5115cbe3 Mon Sep 17 00:00:00 2001
+From ee15bb2a93f96ebe3169c9bbda9855da4314d3b4 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
-Subject: [PATCH 1111/1121] mt76: testmode: additional supports
+Subject: [PATCH 1111/1124] mt76: testmode: additional supports
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -27,7 +27,7 @@
  19 files changed, 1961 insertions(+), 146 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 40cb910..8ea09e6 100644
+index 40cb9109..8ea09e6e 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -426,8 +426,7 @@ free:
@@ -41,7 +41,7 @@
  #endif
  
 diff --git a/mac80211.c b/mac80211.c
-index d74300f..e1c3332 100644
+index c5ef5940..f34a93e0 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
@@ -71,10 +71,10 @@
  
  static const struct ieee80211_channel mt76_channels_6ghz[] = {
 diff --git a/mt76.h b/mt76.h
-index 8e81f40..d03f312 100644
+index b5453d35..0e4eea16 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -610,6 +610,21 @@ struct mt76_testmode_ops {
+@@ -636,6 +636,21 @@ struct mt76_testmode_ops {
  	int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
@@ -96,7 +96,7 @@
  };
  
  #define MT_TM_FW_RX_COUNT	BIT(0)
-@@ -618,16 +633,11 @@ struct mt76_testmode_data {
+@@ -644,16 +659,11 @@ struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
  	u32 param_set[DIV_ROUND_UP(NUM_MT76_TM_ATTRS, 32)];
@@ -113,7 +113,7 @@
  	u8 tx_rate_stbc;
  	u8 tx_ltf;
  
-@@ -643,10 +653,37 @@ struct mt76_testmode_data {
+@@ -669,10 +679,37 @@ struct mt76_testmode_data {
  	u8 tx_power[4];
  	u8 tx_power_control;
  
@@ -152,7 +152,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -1123,6 +1160,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
+@@ -1129,6 +1166,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
  #endif
  }
  
@@ -212,7 +212,7 @@
  static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  					struct sk_buff *skb,
  					struct ieee80211_hw **hw)
-@@ -1133,7 +1223,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
+@@ -1139,7 +1229,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  	for (i = 0; i < ARRAY_SIZE(dev->phys); i++) {
  		struct mt76_phy *phy = dev->phys[i];
  
@@ -222,7 +222,7 @@
  			*hw = dev->phys[i]->hw;
  			return true;
  		}
-@@ -1234,7 +1325,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1240,7 +1331,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
  		       struct netlink_callback *cb, void *data, int len);
  int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
@@ -233,10 +233,10 @@
  static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
  {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 47b2bce..e701db8 100644
+index c1ed9fef..36a2914e 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -391,6 +391,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
+@@ -393,6 +393,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
  	switch (vif->type) {
  	case NL80211_IFTYPE_MESH_POINT:
  	case NL80211_IFTYPE_AP:
@@ -244,7 +244,7 @@
  		if (vif->p2p)
  			conn_type = CONNECTION_P2P_GC;
  		else
-@@ -572,6 +573,9 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
+@@ -574,6 +575,9 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
  	rx->rca2 = 1;
  	rx->rv = 1;
  
@@ -255,10 +255,10 @@
  		return;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 25aeedc..cb1e94a 100644
+index 9fb75e6e..9b9878ac 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -967,6 +967,7 @@ enum {
+@@ -975,6 +975,7 @@ enum {
  	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
  	MCU_EXT_EVENT_ASSERT_DUMP = 0x23,
@@ -266,7 +266,7 @@
  	MCU_EXT_EVENT_RDD_REPORT = 0x3a,
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
-@@ -1144,6 +1145,7 @@ enum {
+@@ -1152,6 +1153,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -275,7 +275,7 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 141c5ad..538ff5c 100644
+index 141c5ad8..538ff5c3 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -576,7 +576,7 @@ static void mt7915_init_work(struct work_struct *work)
@@ -288,7 +288,7 @@
  	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index e540941..f0eefc6 100644
+index d44af409..471d533b 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -565,16 +565,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
@@ -352,7 +352,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 7a7ff86..b5c3c14 100644
+index 5b25604e..ff9fd19d 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -224,7 +224,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
@@ -365,7 +365,7 @@
  		mvif->mt76.wmm_idx += 2;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 9a7c9d3..ecdc4fb 100644
+index c8c8be49..ff0e91e5 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -434,6 +434,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -388,7 +388,7 @@
  	    !rxd->seq)
  		mt7915_mcu_rx_unsolicited_event(dev, skb);
  	else
-@@ -2824,14 +2830,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
+@@ -2826,14 +2832,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
  	return 0;
  }
  
@@ -406,7 +406,7 @@
  
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 0a77ad0..ad85e56 100644
+index 0a77ad0d..ad85e56c 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -8,10 +8,15 @@
@@ -463,7 +463,7 @@
  
  enum {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 8469d8f..8d966ef 100644
+index fd2f70e3..088c9f3e 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -76,6 +76,7 @@ static const u32 mt7915_offs[] = {
@@ -474,7 +474,7 @@
  	[AGG_AWSCR0]		= 0x05c,
  	[AGG_PCR0]		= 0x06c,
  	[AGG_ACR0]		= 0x084,
-@@ -150,6 +151,7 @@ static const u32 mt7916_offs[] = {
+@@ -151,6 +152,7 @@ static const u32 mt7916_offs[] = {
  	[ARB_DRNGR0]		= 0x1e0,
  	[ARB_SCR]		= 0x000,
  	[RMAC_MIB_AIRTIME14]	= 0x0398,
@@ -483,10 +483,10 @@
  	[AGG_PCR0]		= 0x040,
  	[AGG_ACR0]		= 0x054,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index d214b18..99f364c 100644
+index e8feba36..798c9337 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -303,6 +303,9 @@ struct mt7915_phy {
+@@ -301,6 +301,9 @@ struct mt7915_phy {
  		u8 last_snr;
  
  		u8 spe_idx;
@@ -496,7 +496,7 @@
  	} test;
  #endif
  
-@@ -394,6 +397,14 @@ struct mt7915_dev {
+@@ -392,6 +395,14 @@ struct mt7915_dev {
  	void __iomem *dcm;
  	void __iomem *sku;
  
@@ -511,7 +511,7 @@
  #ifdef MTK_DEBUG
  	u16 wlan_idx;
  	struct {
-@@ -572,7 +583,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -570,7 +581,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_vif *vif,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
@@ -520,7 +520,7 @@
  int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset);
  int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
  int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
-@@ -605,6 +616,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+@@ -603,6 +614,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
@@ -529,7 +529,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 3d2c15b..05ab6d9 100644
+index e2b0ff7d..d7f71033 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -45,6 +45,7 @@ enum offs_rev {
@@ -540,7 +540,7 @@
  	AGG_AWSCR0,
  	AGG_PCR0,
  	AGG_ACR0,
-@@ -461,6 +462,8 @@ enum offs_rev {
+@@ -462,6 +463,8 @@ enum offs_rev {
  #define MT_WF_AGG_BASE(_band)		((_band) ? 0x820f2000 : 0x820e2000)
  #define MT_WF_AGG(_band, ofs)		(MT_WF_AGG_BASE(_band) + (ofs))
  
@@ -550,7 +550,7 @@
  							  (_n) * 4))
  #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 35345d3..bc4cd80 100644
+index 35345d35..bc4cd809 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -9,6 +9,9 @@
@@ -1881,7 +1881,7 @@
 +	.set_eeprom = mt7915_tm_set_eeprom,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index a1c54c8..01b08e9 100644
+index a1c54c89..01b08e9e 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -4,6 +4,8 @@
@@ -2196,7 +2196,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 1d0d5d3..7a9ed54 100644
+index 1d0d5d30..7a9ed543 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -27,28 +27,16 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -2663,7 +2663,7 @@
  		a = nla_nest_start(msg, MT76_TM_ATTR_TX_POWER);
  		if (!a)
 diff --git a/testmode.h b/testmode.h
-index 8961326..57949f2 100644
+index 89613266..57949f2b 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -6,6 +6,8 @@
@@ -2768,7 +2768,7 @@
 +
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
-index e3f6908..6e36ab2 100644
+index e3f69089..6e36ab27 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
@@ -2894,7 +2894,7 @@
  };
  
 diff --git a/tx.c b/tx.c
-index 65e2b7c..8b33186 100644
+index 65e2b7c1..8b33186b 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -245,8 +245,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
@@ -2908,5 +2908,5 @@
  			wake_up(&dev->tx_wait);
  
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-testmode-add-pre-cal-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-testmode-add-pre-cal-support.patch
index 7ecdd8b..6d942c4 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-testmode-add-pre-cal-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-testmode-add-pre-cal-support.patch
@@ -1,7 +1,7 @@
-From 3e0328c381fcaaa6e5fcf50494934c770d9ade49 Mon Sep 17 00:00:00 2001
+From a000ed0273b915b24a5fe83b19b85b8a9f8a45ef Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 31 Aug 2022 20:06:52 +0800
-Subject: [PATCH 1112/1121] mt76: testmode: add pre-cal support
+Subject: [PATCH 1112/1124] mt76: testmode: add pre-cal support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: Ibfbbc3443de994eeb4daa5e364b0a90f5d7d3bcd
@@ -20,7 +20,7 @@
  11 files changed, 562 insertions(+), 13 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 1e41b94..e083964 100644
+index 25f67760..4c50bfe6 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -89,8 +89,10 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
@@ -37,10 +37,10 @@
  
  out_put_node:
 diff --git a/mt76.h b/mt76.h
-index d03f312..0ed4188 100644
+index 0e4eea16..b28fe32f 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -611,6 +611,7 @@ struct mt76_testmode_ops {
+@@ -637,6 +637,7 @@ struct mt76_testmode_ops {
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  	int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
@@ -49,10 +49,10 @@
  
  struct mt76_testmode_entry_data {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index cb1e94a..9789380 100644
+index 9b9878ac..cb06827c 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -963,6 +963,7 @@ enum {
+@@ -971,6 +971,7 @@ enum {
  
  /* ext event table */
  enum {
@@ -61,7 +61,7 @@
  	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index 7578ac6..b980342 100644
+index 7578ac6d..b980342c 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -39,10 +39,18 @@ enum mt7915_eeprom_field {
@@ -114,7 +114,7 @@
  
  #endif
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ecdc4fb..42b1abc 100644
+index ff0e91e5..d7e6df50 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -438,6 +438,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -127,7 +127,7 @@
  #endif
  	default:
  		break;
-@@ -2925,7 +2928,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
+@@ -2927,7 +2930,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
  	u32 total = MT_EE_CAL_GROUP_SIZE;
  
@@ -136,7 +136,7 @@
  		return 0;
  
  	/*
-@@ -3005,11 +3008,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -3007,11 +3010,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  {
  	struct mt7915_dev *dev = phy->dev;
  	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
@@ -169,10 +169,10 @@
  
  	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 99f364c..fc0621e 100644
+index 798c9337..dfef078b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -381,6 +381,10 @@ struct mt7915_dev {
+@@ -379,6 +379,10 @@ struct mt7915_dev {
  	struct rchan *relay_fwlog;
  
  	void *cal;
@@ -183,7 +183,7 @@
  
  	struct {
  		u8 debug_wm;
-@@ -617,6 +621,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+@@ -615,6 +619,7 @@ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
  int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
@@ -192,7 +192,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index bc4cd80..7a49608 100644
+index bc4cd809..7a49608c 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -5,6 +5,7 @@
@@ -666,7 +666,7 @@
 +	.dump_precal = mt7915_tm_dump_precal,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 01b08e9..d500987 100644
+index 01b08e9e..d500987d 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -81,6 +81,11 @@ struct tm_tx_cont {
@@ -734,7 +734,7 @@
  	TAM_ARB_OP_MODE_NORMAL = 1,
  	TAM_ARB_OP_MODE_TEST,
 diff --git a/testmode.c b/testmode.c
-index 7a9ed54..82b8e98 100644
+index 7a9ed543..82b8e983 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -763,6 +763,18 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
@@ -767,7 +767,7 @@
  
  	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
 diff --git a/testmode.h b/testmode.h
-index 57949f2..e2190e7 100644
+index 57949f2b..e2190e72 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -19,6 +19,7 @@
@@ -823,7 +823,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 6e36ab2..1be1ffd 100644
+index 6e36ab27..1be1ffd6 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -11,6 +11,14 @@ static const char * const testmode_state[] = {
@@ -842,5 +842,5 @@
  
  static const char * const testmode_tx_mode[] = {
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch
index 2cdeaae..7f8b21b 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch
@@ -1,4 +1,4 @@
-From ec1151e292e2c753543f509a8817760d00aecf89 Mon Sep 17 00:00:00 2001
+From eefd860e1bf33fd7a222a999a8cb8eb631150952 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 12 Sep 2022 18:16:54 +0800
 Subject: [PATCH 1113/1124] mt76: testmode: add iBF command mode support
@@ -13,7 +13,7 @@
  4 files changed, 85 insertions(+), 7 deletions(-)
 
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 7a49608..0a58ad9 100644
+index 7a49608c..0a58ad97 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -701,6 +701,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
@@ -105,7 +105,7 @@
  		mt7915_tm_set_tx_len(phy, tx_time);
  
 diff --git a/testmode.c b/testmode.c
-index 82b8e98..aa874a8 100644
+index 82b8e983..aa874a83 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -530,6 +530,42 @@ out:
@@ -164,7 +164,7 @@
  		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
  			if (nla_len(cur) != 2 ||
 diff --git a/testmode.h b/testmode.h
-index e2190e7..5d1fe79 100644
+index e2190e72..5d1fe793 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -281,8 +281,10 @@ enum mt76_testmode_txbf_act {
@@ -179,7 +179,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 1be1ffd..47fc69f 100644
+index 1be1ffd6..47fc69f9 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -32,6 +32,20 @@ static const char * const testmode_tx_mode[] = {
@@ -239,5 +239,5 @@
  
  const struct tm_field msg_field = {
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index 60ca52c..d5857d7 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,4 +1,4 @@
-From 5fc0e5aa0b2b7b3acbc0c89377c301163e83b531 Mon Sep 17 00:00:00 2001
+From fbf7d08a95e8138cb192543bbb275d4504797e66 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
 Subject: [PATCH 1114/1124] mt76: mt7915: init rssi in WTBL when add station
@@ -8,7 +8,7 @@
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index b5c3c14..551e909 100644
+index ff9fd19d..ba1b3e4b 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -666,6 +666,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -30,5 +30,5 @@
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1115-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1115-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
index c88fcb1..fb89274 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1115-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1115-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
@@ -1,4 +1,4 @@
-From 925be10947fa0ded7da35187477f41723f7fc8b3 Mon Sep 17 00:00:00 2001
+From e39367c6182ae57baa2ff67b69535d0754c650ef Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 4 Aug 2022 14:08:11 +0800
 Subject: [PATCH 1115/1124] mt76: mt7915: reduce TWT SP sent to FW for cert
@@ -11,10 +11,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 42b1abc..eb53095 100644
+index d7e6df50..431dd37f 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3556,7 +3556,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3558,7 +3558,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  		.own_mac_idx = mvif->mt76.omac_idx,
  		.flowid = flow->id,
  		.peer_id = cpu_to_le16(flow->wcid),
@@ -24,5 +24,5 @@
  		.start_tsf = cpu_to_le64(flow->tsf),
  		.mantissa = flow->mantissa,
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1116-mt76-airtime-fairness-feature-off-in-mac80211.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1116-mt76-airtime-fairness-feature-off-in-mac80211.patch
index ef601a1..c4c820a 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1116-mt76-airtime-fairness-feature-off-in-mac80211.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1116-mt76-airtime-fairness-feature-off-in-mac80211.patch
@@ -1,4 +1,4 @@
-From e49f96fd1610ae0414bb7a921a2094901911e41e Mon Sep 17 00:00:00 2001
+From 4ae7e72fc778ee60267520bec667967e8a47f68b Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
 Subject: [PATCH 1116/1124] mt76: airtime fairness feature off in mac80211
@@ -8,7 +8,7 @@
  1 file changed, 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index f34a93e..4eaf317 100644
+index f34a93e0..4eaf317b 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -429,7 +429,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
@@ -20,5 +20,5 @@
  
  	wiphy->available_antennas_tx = phy->antenna_mask;
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1117-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1117-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
index 6f2c7f7..c1b5440 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1117-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1117-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
@@ -1,4 +1,4 @@
-From e93d8124ef77ded639c54ee1f762982a06bc7bfc Mon Sep 17 00:00:00 2001
+From 5c423096aae12eb90d5959f43f3286004f4fb97f Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 20 May 2022 19:19:25 +0800
 Subject: [PATCH 1117/1124] mt76: mt7915: add mt7986 and mt7916 pre-calibration
@@ -15,7 +15,7 @@
  3 files changed, 62 insertions(+), 26 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 4b1a981..ee3049e 100644
+index 4b1a9811..ee3049e5 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -9,23 +9,22 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
@@ -50,7 +50,7 @@
  
  static int mt7915_check_eeprom(struct mt7915_dev *dev)
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index b980342..fb9fbfe 100644
+index b980342c..fb9fbfe2 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -19,6 +19,7 @@ enum mt7915_eeprom_field {
@@ -62,10 +62,10 @@
  	MT_EE_RATE_DELTA_5G =	0x29d,
  	MT_EE_TX0_POWER_2G =	0x2fc,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index eb53095..9d1dea2 100644
+index 431dd37f..f649bcaf 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2926,7 +2926,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
+@@ -2928,7 +2928,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
  int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  {
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
@@ -75,7 +75,7 @@
  
  	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
  		return 0;
-@@ -2964,9 +2965,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
+@@ -2966,9 +2967,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
  	return -1;
  }
  
@@ -87,7 +87,7 @@
  		5180, 5200, 5220, 5240,
  		5260, 5280, 5300, 5320,
  		5500, 5520, 5540, 5560,
-@@ -2974,34 +2975,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
+@@ -2976,34 +2977,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
  		5660, 5680, 5700, 5745,
  		5765, 5785, 5805, 5825
  	};
@@ -167,7 +167,7 @@
  }
  
  int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
-@@ -3033,24 +3069,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -3035,24 +3071,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  	if (!(eep[offs] & dpd_mask))
  		return 0;
  
@@ -198,5 +198,5 @@
  
  	return 0;
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1118-mt76-mt7915-add-phy-capability-vendor-command.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1118-mt76-mt7915-add-phy-capability-vendor-command.patch
index e9bda9e..178c694 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1118-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1118-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,4 +1,4 @@
-From c8790614801df7e39e590a290f36a3855527bc38 Mon Sep 17 00:00:00 2001
+From 119142ef3be4457a975d7ca109e44bfac5bed444 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Tue, 12 Jul 2022 10:04:35 -0700
 Subject: [PATCH 1118/1124] mt76: mt7915: add phy capability vendor command
@@ -10,7 +10,7 @@
  3 files changed, 78 insertions(+)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index fc0621e..99796d7 100644
+index dfef078b..432f0b8a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -11,6 +11,7 @@
@@ -22,7 +22,7 @@
  #define MT7916_WTBL_SIZE		544
  #define MT7915_WTBL_RESERVED		(mt7915_wtbl_size(dev) - 1)
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index c755184..77d71e4 100644
+index c7551848..77d71e48 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -50,6 +50,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
@@ -99,7 +99,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index a8e4ebf..719b851 100644
+index a8e4ebf9..719b851f 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -9,6 +9,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -140,5 +140,5 @@
 +
  #endif
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1119-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1119-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
index a18cb98..e1ecea1 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1119-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1119-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
@@ -1,4 +1,4 @@
-From 6630fa32c32df43a091462643d75dd351ef2b13a Mon Sep 17 00:00:00 2001
+From 2043d4b7cd46412f5a480c6b8f8c4c1d4a0801f9 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
 Subject: [PATCH 1119/1124] mt76: mt7915: add vendor subcmd EDCCA ctrl
@@ -15,10 +15,10 @@
  7 files changed, 138 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 9789380..2162a4a 100644
+index cb06827c..683d8542 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1148,6 +1148,7 @@ enum {
+@@ -1156,6 +1156,7 @@ enum {
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
@@ -27,7 +27,7 @@
  };
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 551e909..c287de3 100644
+index ba1b3e4b..192b0a9b 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -456,6 +456,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
@@ -41,10 +41,10 @@
  		ret = mt7915_set_channel(phy);
  		if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 9d1dea2..1f45d1a 100644
+index f649bcaf..7e6102b8 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4251,3 +4251,41 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -4253,3 +4253,41 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  
  	return 0;
  }
@@ -87,7 +87,7 @@
 +	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCCA), &req, sizeof(req), true);
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index ad85e56..b8a433e 100644
+index ad85e56c..b8a433e5 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -789,4 +789,16 @@ enum {
@@ -108,10 +108,10 @@
 +};
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 99796d7..730b91b 100644
+index 432f0b8a..439d071a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -725,6 +725,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -723,6 +723,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
@@ -121,7 +121,7 @@
  #ifdef MTK_DEBUG
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 77d71e4..5a28a55 100644
+index 77d71e48..5a28a554 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -62,6 +62,17 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
@@ -209,7 +209,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 719b851..83c41bc 100644
+index 719b851f..83c41bc1 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -10,8 +10,27 @@ enum mtk_nl80211_vendor_subcmds {
@@ -241,5 +241,5 @@
  	CAPI_RFEATURE_CHANGED		= BIT(16),
  	CAPI_WIRELESS_CHANGED		= BIT(17),
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1120-mt76-mt7915-implement-bin-file-mode.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1120-mt76-mt7915-implement-bin-file-mode.patch
index 8c1d4a7..afd47c2 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1120-mt76-mt7915-implement-bin-file-mode.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1120-mt76-mt7915-implement-bin-file-mode.patch
@@ -1,4 +1,4 @@
-From 7baba6d23f4633ee545c883f0676c7b076e88aee Mon Sep 17 00:00:00 2001
+From 79ddf246652c86dbda37aa94526497b791ec8246 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 7 Jul 2022 11:09:59 +0800
 Subject: [PATCH 1120/1124] mt76: mt7915: implement bin file mode
@@ -13,7 +13,7 @@
  4 files changed, 71 insertions(+), 11 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index e083964..5b9faf7 100644
+index 4c50bfe6..baca86fd 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -104,6 +104,24 @@ out_put_node:
@@ -42,10 +42,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index 0ed4188..4a41949 100644
+index b28fe32f..e997908a 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1009,6 +1009,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+@@ -1015,6 +1015,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
  int mt76_eeprom_init(struct mt76_dev *dev, int len);
  void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
@@ -54,7 +54,7 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index ee3049e..e5cfa5b 100644
+index ee3049e5..e5cfa5b0 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -46,26 +46,36 @@ static char *mt7915_eeprom_name(struct mt7915_dev *dev)
@@ -148,7 +148,7 @@
  		if (ret)
  			return ret;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 730b91b..78f0b18 100644
+index 439d071a..6fe3191d 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -51,6 +51,15 @@
@@ -167,7 +167,7 @@
  #define MT7915_EEPROM_SIZE		3584
  #define MT7916_EEPROM_SIZE		4096
  
-@@ -375,6 +384,7 @@ struct mt7915_dev {
+@@ -373,6 +382,7 @@ struct mt7915_dev {
  
  	bool dbdc_support;
  	bool flash_mode;
@@ -176,5 +176,5 @@
  	bool ibf;
  
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1121-mt76-mt7915-initialize-wcid.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1121-mt76-mt7915-initialize-wcid.patch
index a8dec05..ceead53 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1121-mt76-mt7915-initialize-wcid.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1121-mt76-mt7915-initialize-wcid.patch
@@ -1,4 +1,4 @@
-From 92302a0017de6f1eef70a62d7ecc27c95f2b5135 Mon Sep 17 00:00:00 2001
+From cf4ded769fa58acd2d98f3a795bb8663456c114f Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 12 Jul 2022 13:56:07 +0800
 Subject: [PATCH 1121/1124] mt76 mt7915 initialize wcid
@@ -9,7 +9,7 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index f0eefc6..7c11e28 100644
+index 471d533b..0631ad2c 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -965,7 +965,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
@@ -22,5 +22,5 @@
  
  			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1122-mt76-HEMU-Add-dump-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1122-mt76-HEMU-Add-dump-support.patch
index e4d0183..0051b6a 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1122-mt76-HEMU-Add-dump-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1122-mt76-HEMU-Add-dump-support.patch
@@ -1,4 +1,4 @@
-From a4a5f09adcf51a57cd63033c25a1cc4f41e2112a Mon Sep 17 00:00:00 2001
+From 7e1d446505177bebaeeac17e10f622d1f612f1e3 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
 Subject: [PATCH 1122/1124] mt76: HEMU: Add dump support
@@ -10,7 +10,7 @@
  2 files changed, 27 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 5a28a55..7acb330 100644
+index 5a28a554..7acb3304 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -37,6 +37,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -61,7 +61,7 @@
  		.maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 83c41bc..57f52f3 100644
+index 83c41bc1..57f52f3a 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -58,6 +58,7 @@ enum mtk_vendor_attr_hemu_ctrl {
@@ -73,5 +73,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
index 4ec9fdf..264fcad 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
@@ -1,4 +1,4 @@
-From b1b5c25122a0976786e2500478b1bc344aa70f92 Mon Sep 17 00:00:00 2001
+From ee8f75888527b8f7114d5ac3f946a9acd21f9aa4 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 30 Aug 2022 15:29:38 +0800
 Subject: [PATCH 1123/1124] mt76: mt7915: add vendor subcmd three wire (PTA)
@@ -16,10 +16,10 @@
  6 files changed, 108 insertions(+), 29 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 2162a4a..b777d95 100644
+index 683d8542..4cdfadc7 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1147,7 +1147,7 @@ enum {
+@@ -1155,7 +1155,7 @@ enum {
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
@@ -29,10 +29,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 1f45d1a..6931f2a 100644
+index 7e6102b8..8d74275d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4017,37 +4017,34 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
+@@ -4019,37 +4019,34 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
  			&req, sizeof(req), false);
  }
  
@@ -95,7 +95,7 @@
  
  void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b8a433e..9d0fac4 100644
+index b8a433e5..9d0fac47 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -576,6 +576,35 @@ struct csi_data {
@@ -135,10 +135,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 78f0b18..e8ac75e 100644
+index 6fe3191d..3fcedba5 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -727,6 +727,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
+@@ -725,6 +725,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
  void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
  int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
  void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
@@ -147,7 +147,7 @@
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 7acb330..7f67c0d 100644
+index 7acb3304..7f67c0d3 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -40,6 +40,11 @@ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
@@ -221,7 +221,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 57f52f3..e0c5fd9 100644
+index 57f52f3a..e0c5fd94 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -11,6 +11,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -251,5 +251,5 @@
  enum mtk_capi_control_changed {
  	CAPI_RFEATURE_CHANGED		= BIT(16),
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1124-mt76-add-ibf-control-vendor-cmd.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1124-mt76-add-ibf-control-vendor-cmd.patch
index facb487..d1992a2 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1124-mt76-add-ibf-control-vendor-cmd.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1124-mt76-add-ibf-control-vendor-cmd.patch
@@ -1,4 +1,4 @@
-From 4f1d6d0b6bc61e8b3f70a910235ef8626fe7983d Mon Sep 17 00:00:00 2001
+From c0f1432186c58fd534715d347d4693660a3fa1fe Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:01:29 -0700
 Subject: [PATCH 1124/1124] mt76: add ibf control vendor cmd
@@ -10,7 +10,7 @@
  2 files changed, 94 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 7f67c0d..cbbb084 100644
+index 7f67c0d3..cbbb0843 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -78,6 +78,16 @@ edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
@@ -105,7 +105,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index e0c5fd9..5aac559 100644
+index e0c5fd94..5aac5595 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -11,7 +11,8 @@ enum mtk_nl80211_vendor_subcmds {
@@ -146,5 +146,5 @@
 +
  #endif
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3001-mt76-add-wed-tx-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3001-mt76-add-wed-tx-support.patch
index f2f3125..b5b407c 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3001-mt76-add-wed-tx-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3001-mt76-add-wed-tx-support.patch
@@ -1,7 +1,7 @@
-From a215cf58f8f9bc1eaf3645a4a4ff77fc7d4acc80 Mon Sep 17 00:00:00 2001
+From a46e93efedae595b85fec8295e16641c2de183fb Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Sun, 12 Jun 2022 16:38:45 +0800
-Subject: [PATCH 3001/3008] mt76 add wed tx support
+Subject: [PATCH 3001/3007] mt76 add wed tx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -12,13 +12,13 @@
  mt7915/mcu.c    |   2 +-
  mt7915/mmio.c   | 110 +++++++++++++++++++++++++++++++++++++++++++++++-
  mt7915/mt7915.h |   2 +
- mt7915/pci.c    |  72 +------------------------------
+ mt7915/pci.c    |  93 +---------------------------------------
  mt7915/regs.h   |  15 +++++++
  mt7915/soc.c    |  16 +++++--
- 10 files changed, 193 insertions(+), 97 deletions(-)
+ 10 files changed, 193 insertions(+), 118 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 7b6b3aa..f71ded8 100644
+index 0915eb57..9a468878 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -116,6 +116,7 @@ struct mt76_connac_sta_key_conf {
@@ -30,7 +30,7 @@
  struct mt76_connac_fw_txp {
  	__le16 flags;
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 4b594a5..ac30698 100644
+index 4b594a53..ac30698f 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -11,7 +11,10 @@ mt7915_init_tx_queues(struct mt7915_phy *phy, int idx, int n_desc, int ring_base
@@ -144,7 +144,7 @@
  			return ret;
  	}
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 7c11e28..0a13b7d 100644
+index 0631ad2c..b1788fb8 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -826,9 +826,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
@@ -160,10 +160,10 @@
  
  static void
 diff --git a/mt7915/main.c b/mt7915/main.c
-index c287de3..b77b3be 100644
+index 192b0a9b..3a09f3f5 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1439,14 +1439,19 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1456,14 +1456,19 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
  
@@ -186,10 +186,10 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 6931f2a..a041bb2 100644
+index 8d74275d..f5caa326 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2377,7 +2377,7 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
+@@ -2379,7 +2379,7 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -199,7 +199,7 @@
  
  	ret = mt7915_mcu_set_mwds(dev, 1);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 8d966ef..b0d8a61 100644
+index 088c9f3e..11c90772 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -10,6 +10,9 @@
@@ -212,7 +212,7 @@
  static const u32 mt7915_reg[] = {
  	[INT_SOURCE_CSR]	= 0xd7010,
  	[INT_MASK_CSR]		= 0xd7014,
-@@ -541,7 +544,11 @@ void mt7915_dual_hif_set_irq_mask(struct mt7915_dev *dev,
+@@ -543,7 +546,11 @@ void mt7915_dual_hif_set_irq_mask(struct mt7915_dev *dev,
  	mdev->mmio.irqmask |= set;
  
  	if (write_reg) {
@@ -225,7 +225,7 @@
  		mt76_wr(dev, MT_INT1_MASK_CSR, mdev->mmio.irqmask);
  	}
  
-@@ -565,6 +572,8 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
+@@ -567,6 +574,8 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
  
  	if (mtk_wed_device_active(wed)) {
  		mtk_wed_device_irq_set_mask(wed, 0);
@@ -234,7 +234,7 @@
  		intr = mtk_wed_device_irq_get(wed, dev->mt76.mmio.irqmask);
  	} else {
  		mt76_wr(dev, MT_INT_MASK_CSR, 0);
-@@ -646,6 +655,105 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
+@@ -648,6 +657,105 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
  	return IRQ_HANDLED;
  }
  
@@ -341,10 +341,10 @@
  				     void __iomem *mem_base, u32 device_id)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e8ac75e..e329f74 100644
+index 3fcedba5..1c78b882 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -536,6 +536,8 @@ static inline void mt7986_wmac_disable(struct mt7915_dev *dev)
+@@ -534,6 +534,8 @@ static inline void mt7986_wmac_disable(struct mt7915_dev *dev)
  {
  }
  #endif
@@ -354,7 +354,7 @@
  				     void __iomem *mem_base, u32 device_id);
  void mt7915_wfsys_reset(struct mt7915_dev *dev);
 diff --git a/mt7915/pci.c b/mt7915/pci.c
-index d74f609..c5da01a 100644
+index 728a879c..c5da01a9 100644
 --- a/mt7915/pci.c
 +++ b/mt7915/pci.c
 @@ -12,9 +12,6 @@
@@ -367,7 +367,7 @@
  static LIST_HEAD(hif_list);
  static DEFINE_SPINLOCK(hif_lock);
  static u32 hif_idx;
-@@ -95,73 +92,6 @@ static int mt7915_pci_hif2_probe(struct pci_dev *pdev)
+@@ -95,94 +92,6 @@ static int mt7915_pci_hif2_probe(struct pci_dev *pdev)
  	return 0;
  }
  
@@ -375,6 +375,7 @@
 -static int mt7915_wed_offload_enable(struct mtk_wed_device *wed)
 -{
 -	struct mt7915_dev *dev;
+-	struct mt7915_phy *phy;
 -	int ret;
 -
 -	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
@@ -388,18 +389,38 @@
 -	if (!ret)
 -		return -EAGAIN;
 -
+-	phy = &dev->phy;
+-	mt76_set(dev, MT_AGG_ACR4(phy->band_idx), MT_AGG_ACR_PPDU_TXS2H);
+-
+-	phy = dev->mt76.phys[MT_BAND1] ? dev->mt76.phys[MT_BAND1]->priv : NULL;
+-	if (phy)
+-		mt76_set(dev, MT_AGG_ACR4(phy->band_idx),
+-			 MT_AGG_ACR_PPDU_TXS2H);
+-
 -	return 0;
 -}
 -
 -static void mt7915_wed_offload_disable(struct mtk_wed_device *wed)
 -{
 -	struct mt7915_dev *dev;
+-	struct mt7915_phy *phy;
 -
 -	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
 -
 -	spin_lock_bh(&dev->mt76.token_lock);
 -	dev->mt76.token_size = MT7915_TOKEN_SIZE;
 -	spin_unlock_bh(&dev->mt76.token_lock);
+-
+-	/* MT_TXD5_TX_STATUS_HOST (MPDU format) has higher priority than
+-	 * MT_AGG_ACR_PPDU_TXS2H (PPDU format) even though ACR bit is set.
+-	 */
+-	phy = &dev->phy;
+-	mt76_clear(dev, MT_AGG_ACR4(phy->band_idx), MT_AGG_ACR_PPDU_TXS2H);
+-
+-	phy = dev->mt76.phys[MT_BAND1] ? dev->mt76.phys[MT_BAND1]->priv : NULL;
+-	if (phy)
+-		mt76_clear(dev, MT_AGG_ACR4(phy->band_idx),
+-			   MT_AGG_ACR_PPDU_TXS2H);
 -}
 -#endif
 -
@@ -441,7 +462,7 @@
  static int mt7915_pci_probe(struct pci_dev *pdev,
  			    const struct pci_device_id *id)
  {
-@@ -199,7 +129,7 @@ static int mt7915_pci_probe(struct pci_dev *pdev,
+@@ -220,7 +129,7 @@ static int mt7915_pci_probe(struct pci_dev *pdev,
  	mt7915_wfsys_reset(dev);
  	hif2 = mt7915_pci_init_hif2(pdev);
  
@@ -451,10 +472,10 @@
  		goto free_wed_or_irq_vector;
  
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 05ab6d9..432ed30 100644
+index d7f71033..51eb553c 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -617,6 +617,7 @@ enum offs_rev {
+@@ -621,6 +621,7 @@ enum offs_rev {
  #define MT_PCIE_RECOG_ID_MASK		GENMASK(30, 0)
  #define MT_PCIE_RECOG_ID_SEM		BIT(31)
  
@@ -462,7 +483,7 @@
  #define MT_INT_WED_MASK_CSR		MT_WFDMA_EXT_CSR(0x204)
  
  #define MT_WED_TX_RING_BASE		MT_WFDMA_EXT_CSR(0x300)
-@@ -663,6 +664,13 @@ enum offs_rev {
+@@ -667,6 +668,13 @@ enum offs_rev {
  #define MT_TXQ_EXT_CTRL(q)		(MT_Q_BASE(__TXQ(q)) + 0x600 +	\
  					 MT_TXQ_ID(q)* 0x4)
  
@@ -476,7 +497,7 @@
  #define MT_INT_SOURCE_CSR		__REG(INT_SOURCE_CSR)
  #define MT_INT_MASK_CSR			__REG(INT_MASK_CSR)
  
-@@ -681,6 +689,11 @@ enum offs_rev {
+@@ -685,6 +693,11 @@ enum offs_rev {
  #define MT_INT_RX_DONE_WA_MAIN_MT7916	BIT(2)
  #define MT_INT_RX_DONE_WA_EXT_MT7916	BIT(3)
  
@@ -488,7 +509,7 @@
  #define MT_INT_RX(q)			(dev->q_int_mask[__RXQ(q)])
  #define MT_INT_TX_MCU(q)		(dev->q_int_mask[(q)])
  
-@@ -704,6 +717,8 @@ enum offs_rev {
+@@ -708,6 +721,8 @@ enum offs_rev {
  #define MT_INT_TX_DONE_BAND0		BIT(30)
  #define MT_INT_TX_DONE_BAND1		BIT(31)
  #define MT_INT_TX_DONE_MCU_WA_MT7916	BIT(25)
@@ -498,7 +519,7 @@
  #define MT_INT_TX_DONE_MCU		(MT_INT_TX_MCU(MT_MCUQ_WA) |	\
  					 MT_INT_TX_MCU(MT_MCUQ_WM) |	\
 diff --git a/mt7915/soc.c b/mt7915/soc.c
-index 3618718..8d0b206 100644
+index 3618718d..8d0b2068 100644
 --- a/mt7915/soc.c
 +++ b/mt7915/soc.c
 @@ -1171,10 +1171,6 @@ static int mt7986_wmac_probe(struct platform_device *pdev)
@@ -539,5 +560,5 @@
  
  	return ret;
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3001-mt76-add-wed-tx-wds-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3002-add-wed-tx-wds-support-on-mt7986.patch
similarity index 87%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/3001-mt76-add-wed-tx-wds-support.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/3002-add-wed-tx-wds-support-on-mt7986.patch
index e8dbc64..752add2 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3001-mt76-add-wed-tx-wds-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3002-add-wed-tx-wds-support-on-mt7986.patch
@@ -1,7 +1,7 @@
-From d34e4542c5a6e89521d6a0e0625455e8edca0829 Mon Sep 17 00:00:00 2001
+From 33e8b84542a2d58af377c6e74eaeefbd7f29146c Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Sat, 10 Sep 2022 17:09:21 +0800
-Subject: [PATCH 3002/3008] 3001-add-wed-tx-wds-support-on-mt7986
+Subject: [PATCH 3002/3007] add-wed-tx-wds-support-on-mt7986
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -16,7 +16,7 @@
  8 files changed, 79 insertions(+), 9 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 4eaf317..c477d62 100644
+index 4eaf317b..c477d625 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -1360,7 +1360,10 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
@@ -32,10 +32,10 @@
  }
  EXPORT_SYMBOL_GPL(__mt76_sta_remove);
 diff --git a/mt76.h b/mt76.h
-index 4a41949..b7da992 100644
+index e997908a..ec9bd59d 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -426,6 +426,7 @@ struct mt76_driver_ops {
+@@ -453,6 +453,7 @@ struct mt76_driver_ops {
  
  	void (*sta_remove)(struct mt76_dev *dev, struct ieee80211_vif *vif,
  			   struct ieee80211_sta *sta);
@@ -43,7 +43,7 @@
  };
  
  struct mt76_channel_state {
-@@ -800,6 +801,7 @@ struct mt76_dev {
+@@ -826,6 +827,7 @@ struct mt76_dev {
  	spinlock_t status_lock;
  
  	u32 wcid_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
@@ -52,7 +52,7 @@
  
  	u64 vif_mask;
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 538ff5c..cd9d846 100644
+index 538ff5c3..cd9d846d 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -695,6 +695,15 @@ mt7915_init_hardware(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -72,7 +72,7 @@
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index b77b3be..828042e 100644
+index 3a09f3f5..b1fb3ddf 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -658,6 +658,24 @@ mt7915_channel_switch_beacon(struct ieee80211_hw *hw,
@@ -120,7 +120,7 @@
  	if (idx < 0)
  		return -ENOSPC;
  
-@@ -1107,6 +1135,14 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
+@@ -1124,6 +1152,14 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
  	else
  		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
  
@@ -135,7 +135,7 @@
  	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
  }
  
-@@ -1446,12 +1482,16 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1463,12 +1499,16 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->dev = ctx->dev;
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
  	path->mtk_wdma.bss = mvif->mt76.idx;
@@ -158,10 +158,10 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index a041bb2..73efa55 100644
+index f5caa326..21167f00 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2348,6 +2348,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
+@@ -2350,6 +2350,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
  int mt7915_run_firmware(struct mt7915_dev *dev)
  {
  	int ret;
@@ -169,7 +169,7 @@
  
  	/* force firmware operation mode into normal state,
  	 * which should be set before firmware download stage.
-@@ -2377,8 +2378,15 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
+@@ -2379,8 +2380,15 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -188,7 +188,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 9d0fac4..1f56db6 100644
+index 9d0fac47..1f56db6b 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -268,6 +268,7 @@ enum {
@@ -200,10 +200,10 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index b0d8a61..de797fd 100644
+index 11c90772..6df039a7 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -734,6 +734,8 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+@@ -736,6 +736,8 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
  	/* disable dynamic tx token */
  	wed->wlan.offload_enable = mt7915_wed_offload_enable;
  	wed->wlan.offload_disable = mt7915_wed_offload_disable;
@@ -212,7 +212,7 @@
  
  	if (mtk_wed_device_attach(wed) != 0)
  		return 0;
-@@ -774,6 +776,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
+@@ -776,6 +778,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
  		.sta_add = mt7915_mac_sta_add,
  		.sta_remove = mt7915_mac_sta_remove,
  		.update_survey = mt7915_update_channel,
@@ -221,7 +221,7 @@
  	struct mt7915_dev *dev;
  	struct mt76_dev *mdev;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e329f74..33c00af 100644
+index 1c78b882..486c203c 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -18,6 +18,9 @@
@@ -234,7 +234,7 @@
  #define MT7915_WATCHDOG_TIME		(HZ / 10)
  #define MT7915_RESET_TIMEOUT		(30 * HZ)
  
-@@ -699,6 +702,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
+@@ -697,6 +700,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  			 struct sk_buff *skb);
  bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len);
@@ -243,5 +243,5 @@
  void mt7915_stats_work(struct work_struct *work);
  int mt76_dfs_start_rdd(struct mt7915_dev *dev, bool force);
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3002-mt76-add-wed-rx-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-add-wed-rx-support.patch
similarity index 90%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/3002-mt76-add-wed-rx-support.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-add-wed-rx-support.patch
index 17ac8dd..d07d072 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3002-mt76-add-wed-rx-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-add-wed-rx-support.patch
@@ -1,7 +1,7 @@
-From 5da9d9bc7cfe0dc95358b6d983499f884c424c49 Mon Sep 17 00:00:00 2001
+From dfbef22fdf1a3e29f9d3c00a50083a02c69e8ad1 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 5 Jul 2022 19:42:55 +0800
-Subject: [PATCH 3003/3008] mt76 add wed rx support
+Subject: [PATCH 3003/3007] mt76 add wed rx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -17,19 +17,18 @@
  mt76x02.h         |   2 +-
  mt76x02_txrx.c    |   2 +-
  mt7915/dma.c      |  25 +++--
- mt7915/mac.c      | 103 ++++++++++++++++++-
+ mt7915/mac.c      | 101 ++++++++++++++++++-
  mt7915/mcu.c      |   3 +
  mt7915/mmio.c     |  26 ++++-
  mt7915/mt7915.h   |   7 +-
  mt7915/regs.h     |  14 ++-
  mt7921/mac.c      |   2 +-
- mt7921/mt7921.h   |   4 +-
- mt7921/pci_mac.c  |   4 +-
+ mt7921/mt7921.h   |   2 +-
  tx.c              |  34 +++++++
- 21 files changed, 460 insertions(+), 75 deletions(-)
+ 20 files changed, 456 insertions(+), 71 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 8ea09e6..3317d2b 100644
+index 8ea09e6e..3317d2b9 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -98,6 +98,63 @@ mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
@@ -480,7 +479,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_dma_cleanup);
 diff --git a/dma.h b/dma.h
-index fdf786f..90370d1 100644
+index fdf786f9..90370d12 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -16,6 +16,16 @@
@@ -501,7 +500,7 @@
  #define MT_RX_INFO_LEN			4
  #define MT_FCE_INFO_LEN			4
 diff --git a/mac80211.c b/mac80211.c
-index c477d62..4a8d8d8 100644
+index c477d625..4a8d8d8d 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -599,11 +599,14 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
@@ -532,7 +531,7 @@
  
  	mt76_rx_complete(dev, &frames, napi);
 diff --git a/mt76.h b/mt76.h
-index b7da992..20fd0ec 100644
+index ec9bd59d..f19433d4 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -20,6 +20,8 @@
@@ -560,7 +559,7 @@
  };
  
  struct mt76_bus_ops {
-@@ -313,7 +317,10 @@ struct mt76_txwi_cache {
+@@ -339,7 +343,10 @@ struct mt76_txwi_cache {
  	struct list_head list;
  	dma_addr_t dma_addr;
  
@@ -572,7 +571,7 @@
  };
  
  struct mt76_rx_tid {
-@@ -411,7 +418,7 @@ struct mt76_driver_ops {
+@@ -438,7 +445,7 @@ struct mt76_driver_ops {
  	bool (*rx_check)(struct mt76_dev *dev, void *data, int len);
  
  	void (*rx_skb)(struct mt76_dev *dev, enum mt76_rxq_id q,
@@ -581,7 +580,7 @@
  
  	void (*rx_poll_complete)(struct mt76_dev *dev, enum mt76_rxq_id q);
  
-@@ -757,6 +764,7 @@ struct mt76_dev {
+@@ -783,6 +790,7 @@ struct mt76_dev {
  	struct ieee80211_hw *hw;
  
  	spinlock_t lock;
@@ -589,7 +588,7 @@
  	spinlock_t cc_lock;
  
  	u32 cur_cc_bss_rx;
-@@ -782,6 +790,7 @@ struct mt76_dev {
+@@ -808,6 +816,7 @@ struct mt76_dev {
  	struct sk_buff_head rx_skb[__MT_RXQ_MAX];
  
  	struct list_head txwi_cache;
@@ -597,7 +596,7 @@
  	struct mt76_queue *q_mcu[__MT_MCUQ_MAX];
  	struct mt76_queue q_rx[__MT_RXQ_MAX];
  	const struct mt76_queue_ops *queue_ops;
-@@ -795,6 +804,9 @@ struct mt76_dev {
+@@ -821,6 +830,9 @@ struct mt76_dev {
  	u16 wed_token_count;
  	u16 token_count;
  	u16 token_size;
@@ -607,7 +606,7 @@
  
  	wait_queue_head_t tx_wait;
  	/* spinclock used to protect wcid pktid linked list */
-@@ -1359,6 +1371,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1365,6 +1377,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -616,7 +615,7 @@
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
-@@ -1503,6 +1517,12 @@ struct mt76_txwi_cache *
+@@ -1509,6 +1523,12 @@ struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
@@ -630,7 +629,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7603/dma.c b/mt7603/dma.c
-index 590cff9..2ff71c5 100644
+index 590cff9d..2ff71c53 100644
 --- a/mt7603/dma.c
 +++ b/mt7603/dma.c
 @@ -69,7 +69,7 @@ free:
@@ -643,7 +642,7 @@
  	struct mt7603_dev *dev = container_of(mdev, struct mt7603_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
 diff --git a/mt7603/mt7603.h b/mt7603/mt7603.h
-index 0fd46d9..f2ce22a 100644
+index 0fd46d90..f2ce22ae 100644
 --- a/mt7603/mt7603.h
 +++ b/mt7603/mt7603.h
 @@ -244,7 +244,7 @@ int mt7603_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -656,7 +655,7 @@
  void mt7603_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
  int mt7603_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7615/mac.c b/mt7615/mac.c
-index d6aae60..4774eaa 100644
+index d6aae60c..4774eaab 100644
 --- a/mt7615/mac.c
 +++ b/mt7615/mac.c
 @@ -1651,7 +1651,7 @@ bool mt7615_rx_check(struct mt76_dev *mdev, void *data, int len)
@@ -669,7 +668,7 @@
  	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
 diff --git a/mt7615/mt7615.h b/mt7615/mt7615.h
-index 060d52c..232b0f2 100644
+index 060d52c8..232b0f29 100644
 --- a/mt7615/mt7615.h
 +++ b/mt7615/mt7615.h
 @@ -511,7 +511,7 @@ void mt7615_tx_worker(struct mt76_worker *w);
@@ -682,10 +681,10 @@
  int mt7615_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index e701db8..6ae1159 100644
+index 36a2914e..290e9711 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -1190,6 +1190,7 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
+@@ -1192,6 +1192,7 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
  			   int cmd, bool enable, bool tx)
  {
  	struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv;
@@ -693,7 +692,7 @@
  	struct wtbl_req_hdr *wtbl_hdr;
  	struct tlv *sta_wtbl;
  	struct sk_buff *skb;
-@@ -1210,6 +1211,8 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
+@@ -1212,6 +1213,8 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
  	mt76_connac_mcu_wtbl_ba_tlv(dev, skb, params, enable, tx, sta_wtbl,
  				    wtbl_hdr);
  
@@ -702,7 +701,7 @@
  	ret = mt76_mcu_skb_send_msg(dev, skb, cmd, true);
  	if (ret)
  		return ret;
-@@ -1220,6 +1223,8 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
+@@ -1222,6 +1225,8 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
  
  	mt76_connac_mcu_sta_ba_tlv(skb, params, enable, tx);
  
@@ -711,7 +710,7 @@
  	return mt76_mcu_skb_send_msg(dev, skb, cmd, true);
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_ba);
-@@ -2634,6 +2639,7 @@ int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
+@@ -2636,6 +2641,7 @@ int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
  			    struct mt76_wcid *wcid, enum set_key_cmd cmd)
  {
  	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
@@ -719,7 +718,7 @@
  	struct sk_buff *skb;
  	int ret;
  
-@@ -2645,6 +2651,9 @@ int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
+@@ -2647,6 +2653,9 @@ int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
@@ -730,7 +729,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_add_key);
 diff --git a/mt76x02.h b/mt76x02.h
-index f76fd22..0b872af 100644
+index f76fd22e..0b872af1 100644
 --- a/mt76x02.h
 +++ b/mt76x02.h
 @@ -173,7 +173,7 @@ int mt76x02_set_rts_threshold(struct ieee80211_hw *hw, u32 val);
@@ -743,7 +742,7 @@
  irqreturn_t mt76x02_irq_handler(int irq, void *dev_instance);
  void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
 diff --git a/mt76x02_txrx.c b/mt76x02_txrx.c
-index 96fdf42..bf24d3e 100644
+index 96fdf423..bf24d3e0 100644
 --- a/mt76x02_txrx.c
 +++ b/mt76x02_txrx.c
 @@ -33,7 +33,7 @@ void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
@@ -756,7 +755,7 @@
  	struct mt76x02_dev *dev = container_of(mdev, struct mt76x02_dev, mt76);
  	void *rxwi = skb->data;
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index ac30698..197a016 100644
+index ac30698f..197a0169 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -349,6 +349,7 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
@@ -827,7 +826,7 @@
  		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_BAND1],
  				       MT_RXQ_ID(MT_RXQ_BAND1),
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 0a13b7d..4e1dfc9 100644
+index b1788fb8..4e0c3ec4 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -217,7 +217,7 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
@@ -839,15 +838,6 @@
  {
  	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
  	struct mt76_phy *mphy = &dev->mt76.phy;
-@@ -234,7 +234,7 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
- 	bool unicast, insert_ccmp_hdr = false;
- 	u8 remove_pad, amsdu_info;
- 	u8 mode = 0, qos_ctl = 0;
--	struct mt7915_sta *msta;
-+	struct mt7915_sta *msta = NULL;
- 	bool hdr_trans;
- 	u16 hdr_gap;
- 	u16 seq_ctrl = 0;
 @@ -494,6 +494,27 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
  #endif
  	} else {
@@ -957,7 +947,7 @@
  static void
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
-@@ -1107,7 +1202,7 @@ bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len)
+@@ -1110,7 +1205,7 @@ bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len)
  }
  
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
@@ -966,7 +956,7 @@
  {
  	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
-@@ -1141,7 +1236,7 @@ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+@@ -1144,7 +1239,7 @@ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  		dev_kfree_skb(skb);
  		break;
  	case PKT_TYPE_NORMAL:
@@ -976,10 +966,10 @@
  			return;
  		}
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 73efa55..22f68da 100644
+index 21167f00..aa8bcf70 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -1722,6 +1722,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1724,6 +1724,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta, bool enable)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -987,7 +977,7 @@
  	struct mt7915_sta *msta;
  	struct sk_buff *skb;
  	int ret;
-@@ -1774,6 +1775,8 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1776,6 +1777,8 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  		return ret;
  	}
  out:
@@ -997,7 +987,7 @@
  				     MCU_EXT_CMD(STA_REC_UPDATE), true);
  }
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index de797fd..181b94d 100644
+index 6df039a7..6e07311d 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -28,6 +28,9 @@ static const u32 mt7915_reg[] = {
@@ -1030,7 +1020,7 @@
  };
  
  static const u32 mt7915_offs[] = {
-@@ -710,6 +719,7 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+@@ -712,6 +721,7 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
  		wed->wlan.bus_type = MTK_BUS_TYPE_PCIE;
  		wed->wlan.wpdma_int = base + MT_INT_WED_SOURCE_CSR;
  		wed->wlan.wpdma_mask = base + MT_INT_WED_MASK_CSR;
@@ -1038,7 +1028,7 @@
  	} else {
  		struct platform_device *plat_dev;
  		struct resource *res;
-@@ -722,12 +732,19 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+@@ -724,12 +734,19 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
  		wed->wlan.wpdma_int = base + MT_INT_SOURCE_CSR;
  		wed->wlan.wpdma_mask = base + MT_INT_MASK_CSR;
  	}
@@ -1058,7 +1048,7 @@
  	wed->wlan.nbuf = 7168;
  	wed->wlan.token_start = MT7915_TOKEN_SIZE - wed->wlan.nbuf;
  	wed->wlan.init_buf = mt7915_wed_init_buf;
-@@ -737,12 +754,15 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+@@ -739,12 +756,15 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
  	if (!is_mt7915(mdev))
  		wed->wlan.wcid_512 = true;
  
@@ -1078,7 +1068,7 @@
  	dev->mt76.dma_dev = wed->dev;
  	mdev->token_size = wed->wlan.token_start;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 33c00af..b805aae 100644
+index 486c203c..2da2ff8b 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -81,6 +81,7 @@
@@ -1089,7 +1079,7 @@
  
  struct mt7915_vif;
  struct mt7915_sta;
-@@ -547,7 +548,9 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
+@@ -545,7 +546,9 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
  irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
  u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
  u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
@@ -1100,7 +1090,7 @@
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
  int mt7915_eeprom_init(struct mt7915_dev *dev);
-@@ -700,7 +703,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -698,7 +701,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  			  struct mt76_tx_info *tx_info);
  void mt7915_tx_token_put(struct mt7915_dev *dev);
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
@@ -1110,7 +1100,7 @@
  bool mt7915_wed_wds_check(struct mt76_dev *mdev, struct ieee80211_sta *sta);
  void mt7915_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 432ed30..36ef8a9 100644
+index 51eb553c..dcb40181 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -27,6 +27,9 @@ enum reg_rev {
@@ -1123,7 +1113,7 @@
  	__MT_REG_MAX,
  };
  
-@@ -564,9 +567,13 @@ enum offs_rev {
+@@ -568,9 +571,13 @@ enum offs_rev {
  #define MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2	BIT(21)
  
  #define MT_WFDMA0_RST_DTX_PTR		MT_WFDMA0(0x20c)
@@ -1137,7 +1127,7 @@
  
  #define MT_WFDMA0_MCU_HOST_INT_ENA	MT_WFDMA0(0x1f4)
  #define MT_WFDMA0_MT_WA_WDT_INT		BIT(31)
-@@ -664,12 +671,15 @@ enum offs_rev {
+@@ -668,12 +675,15 @@ enum offs_rev {
  #define MT_TXQ_EXT_CTRL(q)		(MT_Q_BASE(__TXQ(q)) + 0x600 +	\
  					 MT_TXQ_ID(q)* 0x4)
  
@@ -1156,11 +1146,11 @@
  #define MT_INT_SOURCE_CSR		__REG(INT_SOURCE_CSR)
  #define MT_INT_MASK_CSR			__REG(INT_MASK_CSR)
 diff --git a/mt7921/mac.c b/mt7921/mac.c
-index 1374c15..275f367 100644
+index 9c82ec24..6b631a64 100644
 --- a/mt7921/mac.c
 +++ b/mt7921/mac.c
-@@ -555,7 +555,7 @@ out:
- EXPORT_SYMBOL_GPL(mt7921_mac_add_txs);
+@@ -680,7 +680,7 @@ bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len)
+ EXPORT_SYMBOL_GPL(mt7921_rx_check);
  
  void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
 -			 struct sk_buff *skb)
@@ -1169,51 +1159,20 @@
  	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
 diff --git a/mt7921/mt7921.h b/mt7921/mt7921.h
-index c161031..0a1f035 100644
+index eaba114a..54a30ca1 100644
 --- a/mt7921/mt7921.h
 +++ b/mt7921/mt7921.h
-@@ -381,7 +381,7 @@ int mt7921e_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- void mt7921_tx_worker(struct mt76_worker *w);
+@@ -408,7 +408,7 @@ void mt7921_tx_worker(struct mt76_worker *w);
  void mt7921_tx_token_put(struct mt7921_dev *dev);
+ bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len);
  void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
 -			 struct sk_buff *skb);
 +			 struct sk_buff *skb, u32 info);
  void mt7921_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
  void mt7921_stats_work(struct work_struct *work);
  void mt7921_set_stream_he_caps(struct mt7921_phy *phy);
-@@ -417,7 +417,7 @@ int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
- 
- bool mt7921e_rx_check(struct mt76_dev *mdev, void *data, int len);
- void mt7921e_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			  struct sk_buff *skb);
-+			  struct sk_buff *skb, u32 info);
- int mt7921e_driver_own(struct mt7921_dev *dev);
- int mt7921e_mac_reset(struct mt7921_dev *dev);
- int mt7921e_mcu_init(struct mt7921_dev *dev);
-diff --git a/mt7921/pci_mac.c b/mt7921/pci_mac.c
-index e180067..ca982eb 100644
---- a/mt7921/pci_mac.c
-+++ b/mt7921/pci_mac.c
-@@ -182,7 +182,7 @@ bool mt7921e_rx_check(struct mt76_dev *mdev, void *data, int len)
- }
- 
- void mt7921e_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
--			  struct sk_buff *skb)
-+			  struct sk_buff *skb, u32 info)
- {
- 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
- 	__le32 *rxd = (__le32 *)skb->data;
-@@ -196,7 +196,7 @@ void mt7921e_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
- 		napi_consume_skb(skb, 1);
- 		break;
- 	default:
--		mt7921_queue_rx_skb(mdev, q, skb);
-+		mt7921_queue_rx_skb(mdev, q, skb, info);
- 		break;
- 	}
- }
 diff --git a/tx.c b/tx.c
-index 8b33186..b812d06 100644
+index 8b33186b..b812d067 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -778,3 +778,37 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
@@ -1255,5 +1214,5 @@
 +}
 +EXPORT_SYMBOL_GPL(mt76_rx_token_release);
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-add-fill-receive-path-to-report-wed-idx.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
similarity index 77%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-add-fill-receive-path-to-report-wed-idx.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
index 36c8084..ef9724f 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-add-fill-receive-path-to-report-wed-idx.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
@@ -1,7 +1,7 @@
-From 46d51f08c25a6ae72858a826c3290c958212a486 Mon Sep 17 00:00:00 2001
+From 72230221dbb07d547dba931b7b3787cbebb2125a Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 19 May 2022 13:44:42 +0800
-Subject: [PATCH 3004/3008] mt76: add fill receive path to report wed idx
+Subject: [PATCH 3004/3007] mt76: add fill receive path to report wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,10 +9,10 @@
  1 file changed, 19 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 828042e..e238eab 100644
+index b1fb3ddf..fcf122cf 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1497,6 +1497,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1515,6 +1515,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  
  	return 0;
  }
@@ -37,7 +37,7 @@
  #endif
  
  const struct ieee80211_ops mt7915_ops = {
-@@ -1548,5 +1566,6 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1566,5 +1584,6 @@ const struct ieee80211_ops mt7915_ops = {
  	.set_radar_background = mt7915_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	.net_fill_forward_path = mt7915_net_fill_forward_path,
@@ -45,5 +45,5 @@
  #endif
  };
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3004-mt76-add-ser-spport-when-wed-on.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-add-ser-spport-when-wed-on.patch
similarity index 92%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/3004-mt76-add-ser-spport-when-wed-on.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-add-ser-spport-when-wed-on.patch
index 4a48a30..cee9fe0 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3004-mt76-add-ser-spport-when-wed-on.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-add-ser-spport-when-wed-on.patch
@@ -1,7 +1,7 @@
-From ea9bb882fa5d067de166aa7b025abaa1e06debcc Mon Sep 17 00:00:00 2001
+From c3c6234cc24fd9b57bb0d57b194252d533f5f012 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 28 Jul 2022 11:16:15 +0800
-Subject: [PATCH 3005/3008] mt76 add ser spport when wed on
+Subject: [PATCH 3005/3007] mt76 add ser spport when wed on
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -15,7 +15,7 @@
  7 files changed, 76 insertions(+), 15 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 3317d2b..fa56ccf 100644
+index 3317d2b9..fa56ccfb 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -169,7 +169,7 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
@@ -109,7 +109,7 @@
  	if (!q->rx_head)
  		return;
 diff --git a/dma.h b/dma.h
-index 90370d1..083cbca 100644
+index 90370d12..083cbca4 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -58,5 +58,5 @@ enum mt76_mcu_evt_type {
@@ -120,10 +120,10 @@
 +int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset);
  #endif
 diff --git a/mt76.h b/mt76.h
-index 20fd0ec..ee63da5 100644
+index f19433d4..9b00f53c 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1373,6 +1373,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1379,6 +1379,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
@@ -132,7 +132,7 @@
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 197a016..e0a5131 100644
+index 197a0169..e0a51316 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -522,6 +522,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -203,7 +203,7 @@
  }
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 4e1dfc9..5b68492 100644
+index 4e0c3ec4..0cd9cad9 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -916,6 +916,8 @@ void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed)
@@ -234,7 +234,7 @@
  static void
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
-@@ -1662,6 +1676,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1665,6 +1679,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	if (!(READ_ONCE(dev->reset_state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
@@ -248,10 +248,10 @@
  	if (ext_phy)
  		ieee80211_stop_queues(ext_phy->hw);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 181b94d..a0bb879 100644
+index 6e07311d..0edea0d3 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -757,6 +757,8 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+@@ -761,6 +761,8 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
  	wed->wlan.init_rx_buf = mt7915_wed_init_rx_buf;
  	wed->wlan.release_rx_buf = mt7915_wed_release_rx_buf;
  
@@ -261,10 +261,10 @@
  	if (mtk_wed_device_attach(wed) != 0)
  		return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b805aae..ca62622 100644
+index 2da2ff8b..a4872451 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -551,6 +551,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -549,6 +549,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
  				int pkt_num);
  void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed);
@@ -273,5 +273,5 @@
  void mt7915_unregister_device(struct mt7915_dev *dev);
  int mt7915_eeprom_init(struct mt7915_dev *dev);
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-mt7915-add-statistic-for-HW-Tx-Path.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-mt7915-add-statistic-for-HW-Tx-Path.patch
deleted file mode 100644
index 53d4bbd..0000000
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-mt7915-add-statistic-for-HW-Tx-Path.patch
+++ /dev/null
@@ -1,476 +0,0 @@
-From a6cc491093f5280496ae75a2ba953d8a10d919f8 Mon Sep 17 00:00:00 2001
-From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
-Date: Thu, 21 Jul 2022 10:56:09 -0700
-Subject: [PATCH 3006/3008] mt76: mt7915: add statistic for H/W Tx Path
-
-Set PPDU_TXS2H_EN_B0/B1 to get PPDU txs.
-Add MT_PACKET_ID_WED for PPDU txs, and change MT_PACKET_ID_FIRST to 3
-to differentiate. We also need do byte cnt and pkt cnt for S/W path since
-we report it directly from mt7915_sta_statistics.
----
- mt76.h             | 49 ++++++++++++++++-------------
- mt76_connac.h      |  5 +--
- mt76_connac2_mac.h | 14 +++++++++
- mt76_connac_mac.c  | 77 +++++++++++++++++++++++++++++-----------------
- mt7915/mac.c       | 12 ++++----
- mt7915/main.c      | 16 +++++++++-
- mt7915/mmio.c      | 22 +++++++++++++
- mt7915/mt7915.h    |  2 --
- mt7915/regs.h      |  4 +++
- mt7921/mt7921.h    |  1 -
- 10 files changed, 141 insertions(+), 61 deletions(-)
-
-diff --git a/mt76.h b/mt76.h
-index ee63da5..bd75b5a 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -275,6 +275,30 @@ DECLARE_EWMA(signal, 10, 8);
- #define MT_WCID_TX_INFO_TXPWR_ADJ	GENMASK(25, 18)
- #define MT_WCID_TX_INFO_SET		BIT(31)
- 
-+enum mt76_phy_type {
-+	MT_PHY_TYPE_CCK,
-+	MT_PHY_TYPE_OFDM,
-+	MT_PHY_TYPE_HT,
-+	MT_PHY_TYPE_HT_GF,
-+	MT_PHY_TYPE_VHT,
-+	MT_PHY_TYPE_HE_SU = 8,
-+	MT_PHY_TYPE_HE_EXT_SU,
-+	MT_PHY_TYPE_HE_TB,
-+	MT_PHY_TYPE_HE_MU,
-+	__MT_PHY_TYPE_HE_MAX,
-+};
-+
-+struct mt76_sta_stats {
-+	u64 tx_mode[__MT_PHY_TYPE_HE_MAX];
-+	u64 tx_bw[4];		/* 20, 40, 80, 160 */
-+	u64 tx_nss[4];		/* 1, 2, 3, 4 */
-+	u64 tx_mcs[16];		/* mcs idx */
-+	u64 tx_bytes;
-+	u32 tx_packets;
-+	u32 tx_retries;
-+	u32 tx_failed;
-+};
-+
- struct mt76_wcid {
- 	struct mt76_rx_tid __rcu *aggr[IEEE80211_NUM_TIDS];
- 
-@@ -303,6 +327,8 @@ struct mt76_wcid {
- 
- 	struct list_head list;
- 	struct idr pktid;
-+
-+	struct mt76_sta_stats stats;
- };
- 
- struct mt76_txq {
-@@ -349,7 +375,8 @@ struct mt76_rx_tid {
- #define MT_PACKET_ID_MASK		GENMASK(6, 0)
- #define MT_PACKET_ID_NO_ACK		0
- #define MT_PACKET_ID_NO_SKB		1
--#define MT_PACKET_ID_FIRST		2
-+#define MT_PACKET_ID_WED		2
-+#define MT_PACKET_ID_FIRST		3
- #define MT_PACKET_ID_HAS_RATE		BIT(7)
- /* This is timer for when to give up when waiting for TXS callback,
-  * with starting time being the time at which the DMA_DONE callback
-@@ -876,26 +903,6 @@ struct mt76_power_limits {
- 	s8 ru[7][12];
- };
- 
--enum mt76_phy_type {
--	MT_PHY_TYPE_CCK,
--	MT_PHY_TYPE_OFDM,
--	MT_PHY_TYPE_HT,
--	MT_PHY_TYPE_HT_GF,
--	MT_PHY_TYPE_VHT,
--	MT_PHY_TYPE_HE_SU = 8,
--	MT_PHY_TYPE_HE_EXT_SU,
--	MT_PHY_TYPE_HE_TB,
--	MT_PHY_TYPE_HE_MU,
--	__MT_PHY_TYPE_HE_MAX,
--};
--
--struct mt76_sta_stats {
--	u64 tx_mode[__MT_PHY_TYPE_HE_MAX];
--	u64 tx_bw[4];		/* 20, 40, 80, 160 */
--	u64 tx_nss[4];		/* 1, 2, 3, 4 */
--	u64 tx_mcs[16];		/* mcs idx */
--};
--
- struct mt76_ethtool_worker_info {
- 	u64 *data;
- 	int idx;
-diff --git a/mt76_connac.h b/mt76_connac.h
-index f71ded8..4a43838 100644
---- a/mt76_connac.h
-+++ b/mt76_connac.h
-@@ -366,9 +366,10 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
- 				 struct sk_buff *skb, struct mt76_wcid *wcid,
- 				 struct ieee80211_key_conf *key, int pid,
- 				 enum mt76_txq_id qid, u32 changed);
-+bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
-+				   __le32 *txs_data, struct mt76_sta_stats *stats);
- bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
--				  int pid, __le32 *txs_data,
--				  struct mt76_sta_stats *stats);
-+				  int pid, __le32 *txs_data);
- void mt76_connac2_mac_decode_he_radiotap(struct mt76_dev *dev,
- 					 struct sk_buff *skb,
- 					 __le32 *rxv, u32 mode);
-diff --git a/mt76_connac2_mac.h b/mt76_connac2_mac.h
-index 67ce216..c7064ba 100644
---- a/mt76_connac2_mac.h
-+++ b/mt76_connac2_mac.h
-@@ -123,6 +123,12 @@ enum {
- /* VHT/HE only use bits 0-3 */
- #define MT_TX_RATE_IDX			GENMASK(5, 0)
- 
-+enum {
-+	MT_TXS_MPDU_FM0,
-+	MT_TXS_MPDU_FM1,
-+	MT_TXS_PPDU_FM
-+};
-+
- #define MT_TXS0_FIXED_RATE		BIT(31)
- #define MT_TXS0_BW			GENMASK(30, 29)
- #define MT_TXS0_TID			GENMASK(28, 26)
-@@ -158,6 +164,14 @@ enum {
- 
- #define MT_TXS4_TIMESTAMP		GENMASK(31, 0)
- 
-+/* PPDU based */
-+#define MT_TXS5_MPDU_TX_BYTE		GENMASK(22, 0)
-+#define MT_TXS5_MPDU_TX_CNT		GENMASK(31, 23)
-+
-+#define MT_TXS6_MPDU_FAIL_CNT		GENMASK(31, 23)
-+
-+#define MT_TXS7_MPDU_RETRY_CNT		GENMASK(31, 23)
-+
- /* RXD DW1 */
- #define MT_RXD1_NORMAL_WLAN_IDX		GENMASK(9, 0)
- #define MT_RXD1_NORMAL_GROUP_1		BIT(11)
-diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index a9e58cf..af265d9 100644
---- a/mt76_connac_mac.c
-+++ b/mt76_connac_mac.c
-@@ -487,6 +487,9 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
- 		p_fmt = mt76_is_mmio(dev) ? MT_TX_TYPE_CT : MT_TX_TYPE_SF;
- 		q_idx = wmm_idx * MT76_CONNAC_MAX_WMM_SETS +
- 			mt76_connac_lmac_mapping(skb_get_queue_mapping(skb));
-+
-+		wcid->stats.tx_bytes += skb->len;
-+		wcid->stats.tx_packets++;
- 	}
- 
- 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len + sz_txd) |
-@@ -555,35 +558,26 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
- }
- EXPORT_SYMBOL_GPL(mt76_connac2_mac_write_txwi);
- 
--bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
--				  int pid, __le32 *txs_data,
--				  struct mt76_sta_stats *stats)
-+bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
-+				   __le32 *txs_data, struct mt76_sta_stats *stats)
- {
- 	struct ieee80211_supported_band *sband;
- 	struct mt76_phy *mphy;
--	struct ieee80211_tx_info *info;
--	struct sk_buff_head list;
- 	struct rate_info rate = {};
--	struct sk_buff *skb;
- 	bool cck = false;
- 	u32 txrate, txs, mode;
- 
--	mt76_tx_status_lock(dev, &list);
--	skb = mt76_tx_status_skb_get(dev, wcid, pid, &list);
--	if (!skb)
--		goto out;
--
- 	txs = le32_to_cpu(txs_data[0]);
--
--	info = IEEE80211_SKB_CB(skb);
--	if (!(txs & MT_TXS0_ACK_ERROR_MASK))
--		info->flags |= IEEE80211_TX_STAT_ACK;
--
--	info->status.ampdu_len = 1;
--	info->status.ampdu_ack_len = !!(info->flags &
--					IEEE80211_TX_STAT_ACK);
--
--	info->status.rates[0].idx = -1;
-+	if (FIELD_GET(MT_TXS0_TXS_FORMAT, txs) == MT_TXS_PPDU_FM) {
-+		stats->tx_bytes +=
-+			le32_get_bits(txs_data[5], MT_TXS5_MPDU_TX_BYTE);
-+		stats->tx_packets +=
-+			le32_get_bits(txs_data[5], MT_TXS5_MPDU_TX_CNT);
-+		stats->tx_failed +=
-+			le32_get_bits(txs_data[6], MT_TXS6_MPDU_FAIL_CNT);
-+		stats->tx_retries +=
-+			le32_get_bits(txs_data[7], MT_TXS7_MPDU_RETRY_CNT);
-+	}
- 
- 	txrate = FIELD_GET(MT_TXS0_TX_RATE, txs);
- 
-@@ -618,7 +612,7 @@ bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
- 	case MT_PHY_TYPE_HT:
- 	case MT_PHY_TYPE_HT_GF:
- 		if (rate.mcs > 31)
--			goto out;
-+			return false;
- 
- 		rate.flags = RATE_INFO_FLAGS_MCS;
- 		if (wcid->rate.flags & RATE_INFO_FLAGS_SHORT_GI)
-@@ -626,7 +620,7 @@ bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
- 		break;
- 	case MT_PHY_TYPE_VHT:
- 		if (rate.mcs > 9)
--			goto out;
-+			return false;
- 
- 		rate.flags = RATE_INFO_FLAGS_VHT_MCS;
- 		break;
-@@ -635,14 +629,14 @@ bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
- 	case MT_PHY_TYPE_HE_TB:
- 	case MT_PHY_TYPE_HE_MU:
- 		if (rate.mcs > 11)
--			goto out;
-+			return false;
- 
- 		rate.he_gi = wcid->rate.he_gi;
- 		rate.he_dcm = FIELD_GET(MT_TX_RATE_DCM, txrate);
- 		rate.flags = RATE_INFO_FLAGS_HE_MCS;
- 		break;
- 	default:
--		goto out;
-+		return false;
- 	}
- 
- 	stats->tx_mode[mode]++;
-@@ -667,10 +661,37 @@ bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
- 	}
- 	wcid->rate = rate;
- 
--out:
--	if (skb)
--		mt76_tx_status_skb_done(dev, skb, &list);
-+	return true;
-+}
-+EXPORT_SYMBOL_GPL(mt76_connac2_mac_fill_txs);
-+
-+bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
-+				  int pid, __le32 *txs_data)
-+{
-+	struct mt76_sta_stats *stats = &wcid->stats;
-+	struct sk_buff_head list;
-+	struct sk_buff *skb;
-+
-+	if (pid < MT_PACKET_ID_FIRST)
-+		return false;
- 
-+	mt76_tx_status_lock(dev, &list);
-+	skb = mt76_tx_status_skb_get(dev, wcid, pid, &list);
-+	if (skb) {
-+		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+
-+		if (!(le32_to_cpu(txs_data[0]) & MT_TXS0_ACK_ERROR_MASK))
-+			info->flags |= IEEE80211_TX_STAT_ACK;
-+
-+		info->status.rates[0].idx = -1;
-+		info->status.ampdu_len = 1;
-+		info->status.ampdu_ack_len = !!(info->flags &
-+						IEEE80211_TX_STAT_ACK);
-+		stats->tx_failed += !(info->flags & IEEE80211_TX_STAT_ACK);
-+
-+		mt76_connac2_mac_fill_txs(dev, wcid, txs_data, stats);
-+		mt76_tx_status_skb_done(dev, skb, &list);
-+	}
- 	mt76_tx_status_unlock(dev, &list);
- 
- 	return !!skb;
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 5b68492..63c702e 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -1153,13 +1153,10 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
- 	u16 wcidx;
- 	u8 pid;
- 
--	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) > 1)
--		return;
--
- 	wcidx = le32_get_bits(txs_data[2], MT_TXS2_WCID);
- 	pid = le32_get_bits(txs_data[3], MT_TXS3_PID);
- 
--	if (pid < MT_PACKET_ID_FIRST)
-+	if (pid < MT_PACKET_ID_WED)
- 		return;
- 
- 	if (wcidx >= mt7915_wtbl_size(dev))
-@@ -1173,8 +1170,11 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
- 
- 	msta = container_of(wcid, struct mt7915_sta, wcid);
- 
--	mt76_connac2_mac_add_txs_skb(&dev->mt76, wcid, pid, txs_data,
--				     &msta->stats);
-+	if (pid == MT_PACKET_ID_WED)
-+		mt76_connac2_mac_fill_txs(&dev->mt76, wcid, txs_data,
-+					  &msta->wcid.stats);
-+	else
-+		mt76_connac2_mac_add_txs_skb(&dev->mt76, wcid, pid, txs_data);
- 	if (!wcid->sta)
- 		goto out;
- 
-diff --git a/mt7915/main.c b/mt7915/main.c
-index e238eab..1ea3f6f 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -1070,6 +1070,20 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
- 	}
- 	sinfo->txrate.flags = txrate->flags;
- 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
-+
-+	if (mtk_wed_device_active(&phy->dev->mt76.mmio.wed)) {
-+		sinfo->tx_bytes = msta->wcid.stats.tx_bytes;
-+		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES64);
-+
-+		sinfo->tx_packets = msta->wcid.stats.tx_packets;
-+		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
-+
-+		sinfo->tx_failed = msta->wcid.stats.tx_failed;
-+		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
-+
-+		sinfo->tx_retries = msta->wcid.stats.tx_retries;
-+		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
-+	}
- }
- 
- static void mt7915_sta_rc_work(void *data, struct ieee80211_sta *sta)
-@@ -1292,7 +1306,7 @@ static void mt7915_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
- 	if (msta->vif->mt76.idx != wi->idx)
- 		return;
- 
--	mt76_ethtool_worker(wi, &msta->stats);
-+	mt76_ethtool_worker(wi, &msta->wcid.stats);
- }
- 
- static
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index a0bb879..e07153b 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -92,6 +92,7 @@ static const u32 mt7915_offs[] = {
- 	[AGG_AWSCR0]		= 0x05c,
- 	[AGG_PCR0]		= 0x06c,
- 	[AGG_ACR0]		= 0x084,
-+	[AGG_ACR4]		= 0x08C,
- 	[AGG_MRCR]		= 0x098,
- 	[AGG_ATCR1]		= 0x0f0,
- 	[AGG_ATCR3]		= 0x0f4,
-@@ -167,6 +168,7 @@ static const u32 mt7916_offs[] = {
- 	[AGG_AWSCR0]		= 0x030,
- 	[AGG_PCR0]		= 0x040,
- 	[AGG_ACR0]		= 0x054,
-+	[AGG_ACR4]		= 0x05C,
- 	[AGG_MRCR]		= 0x068,
- 	[AGG_ATCR1]		= 0x1a8,
- 	[AGG_ATCR3]		= 0x080,
-@@ -668,9 +670,12 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
- static int mt7915_wed_offload_enable(struct mtk_wed_device *wed)
- {
- 	struct mt7915_dev *dev;
-+	struct mt7915_phy *phy;
- 	int ret;
- 
- 	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+	if (!dev)
-+		return -EINVAL;
- 
- 	spin_lock_bh(&dev->mt76.token_lock);
- 	dev->mt76.token_size = wed->wlan.token_start;
-@@ -681,18 +686,35 @@ static int mt7915_wed_offload_enable(struct mtk_wed_device *wed)
- 	if (!ret)
- 		return -EAGAIN;
- 
-+	phy = &dev->phy;
-+	mt76_set(dev, MT_AGG_ACR4(phy->band_idx), MT_AGG_ACR_PPDU_TXS2H);
-+
-+	phy = dev->mt76.phys[MT_BAND1] ? dev->mt76.phys[MT_BAND1]->priv : NULL;
-+	if (phy)
-+		mt76_set(dev, MT_AGG_ACR4(phy->band_idx), MT_AGG_ACR_PPDU_TXS2H);
-+
- 	return 0;
- }
- 
- static void mt7915_wed_offload_disable(struct mtk_wed_device *wed)
- {
- 	struct mt7915_dev *dev;
-+	struct mt7915_phy *phy;
- 
- 	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+	if (!dev)
-+		return;
- 
- 	spin_lock_bh(&dev->mt76.token_lock);
- 	dev->mt76.token_size = wed->wlan.token_start;//MT7915_TOKEN_SIZE;
- 	spin_unlock_bh(&dev->mt76.token_lock);
-+
-+	phy = &dev->phy;
-+	mt76_clear(dev, MT_AGG_ACR4(phy->band_idx), MT_AGG_ACR_PPDU_TXS2H);
-+
-+	phy = dev->mt76.phys[MT_BAND1] ? dev->mt76.phys[MT_BAND1]->priv : NULL;
-+	if (phy)
-+		mt76_clear(dev, MT_AGG_ACR4(phy->band_idx), MT_AGG_ACR_PPDU_TXS2H);
- }
- #endif
- 
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index ca62622..a487245 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -142,8 +142,6 @@ struct mt7915_sta {
- 	unsigned long jiffies;
- 	unsigned long ampdu_state;
- 
--	struct mt76_sta_stats stats;
--
- 	struct mt76_connac_sta_key_conf bip;
- 
- 	struct {
-diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 36ef8a9..dcb4018 100644
---- a/mt7915/regs.h
-+++ b/mt7915/regs.h
-@@ -52,6 +52,7 @@ enum offs_rev {
- 	AGG_AWSCR0,
- 	AGG_PCR0,
- 	AGG_ACR0,
-+	AGG_ACR4,
- 	AGG_MRCR,
- 	AGG_ATCR1,
- 	AGG_ATCR3,
-@@ -489,6 +490,9 @@ enum offs_rev {
- #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
- #define MT_AGG_ACR_BAR_RATE		GENMASK(29, 16)
- 
-+#define MT_AGG_ACR4(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR4))
-+#define MT_AGG_ACR_PPDU_TXS2H		BIT(1)
-+
- #define MT_AGG_MRCR(_band)		MT_WF_AGG(_band, __OFFS(AGG_MRCR))
- #define MT_AGG_MRCR_BAR_CNT_LIMIT		GENMASK(15, 12)
- #define MT_AGG_MRCR_LAST_RTS_CTS_RN		BIT(6)
-diff --git a/mt7921/mt7921.h b/mt7921/mt7921.h
-index 0a1f035..96267d5 100644
---- a/mt7921/mt7921.h
-+++ b/mt7921/mt7921.h
-@@ -100,7 +100,6 @@ struct mt7921_sta {
- 
- 	unsigned long last_txs;
- 	unsigned long ampdu_state;
--	struct mt76_sta_stats stats;
- 
- 	struct mt76_connac_sta_key_conf bip;
- };
--- 
-2.18.0
-
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-add-statistic-for-HW-Rx-Path.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch
similarity index 85%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-add-statistic-for-HW-Rx-Path.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch
index e2335bf..b749789 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-add-statistic-for-HW-Rx-Path.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch
@@ -1,25 +1,25 @@
-From c2eb0d9692269323d6f6d94cc48f5e37ecccdb13 Mon Sep 17 00:00:00 2001
+From 247fa46efdeaa5ea727a3d5dde7a9f3d7aac97d4 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Fri, 5 Aug 2022 13:58:11 -0700
-Subject: [PATCH 3007/3008] mt76: mt7915: add statistic for H/W Rx Path
+Subject: [PATCH 3006/3007] mt76: mt7915: add statistic for H/W Rx Path
 
 Change-Id: Id94d663f08e91c83d296bd57e5e9b65a505ae1c7
 ---
  mt76.h            |  4 ++++
  mt76_connac.h     |  5 +++++
  mt76_connac_mcu.h | 35 +++++++++++++++++++++++++++++++++++
- mt7915/mac.c      | 26 ++++++++++++++++++++++++++
+ mt7915/mac.c      | 25 +++++++++++++++++++++++++
  mt7915/main.c     |  9 ++++++++-
  mt7915/mcu.c      | 21 +++++++++++++++++++++
  mt7915/mmio.c     |  6 ++++++
  mt7915/mt7915.h   |  3 +++
- 8 files changed, 108 insertions(+), 1 deletion(-)
+ 8 files changed, 107 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index bd75b5a..480ed21 100644
+index 9b00f53c..4958d97c 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -297,6 +297,10 @@ struct mt76_sta_stats {
+@@ -278,6 +278,10 @@ struct mt76_sta_stats {
  	u32 tx_packets;
  	u32 tx_retries;
  	u32 tx_failed;
@@ -29,9 +29,9 @@
 +	u32 rx_drop;
  };
  
- struct mt76_wcid {
+ enum mt76_wcid_flags {
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 4a43838..e324c79 100644
+index 9a468878..7ecc7253 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -224,6 +224,11 @@ static inline bool is_mt76_fw_txp(struct mt76_dev *dev)
@@ -47,10 +47,10 @@
  {
  	static const u8 width_to_bw[] = {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index b777d95..40de521 100644
+index 4cdfadc7..adb06f84 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1201,6 +1201,41 @@ enum {
+@@ -1210,6 +1210,41 @@ enum {
  	MCU_CE_CMD_GET_TXPWR = 0xd0,
  };
  
@@ -93,7 +93,7 @@
  	PATCH_SEM_RELEASE,
  	PATCH_SEM_GET
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 63c702e..516717c 100644
+index 0cd9cad9..35c13efd 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -940,6 +940,31 @@ void mt7915_wed_trigger_ser(struct mtk_wed_device *wed)
@@ -128,16 +128,8 @@
  static void
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
-@@ -1175,6 +1200,7 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
- 					  &msta->wcid.stats);
- 	else
- 		mt76_connac2_mac_add_txs_skb(&dev->mt76, wcid, pid, txs_data);
-+
- 	if (!wcid->sta)
- 		goto out;
- 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 1ea3f6f..7e5947d 100644
+index fcf122cf..db9d55fe 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -1049,7 +1049,8 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
@@ -150,7 +142,7 @@
  	    !mt7915_mcu_get_rx_rate(phy, vif, sta, &rxrate)) {
  		sinfo->rxrate = rxrate;
  		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
-@@ -1083,6 +1084,12 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+@@ -1086,6 +1087,12 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
  
  		sinfo->tx_retries = msta->wcid.stats.tx_retries;
  		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
@@ -164,7 +156,7 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 22f68da..6b70e47 100644
+index aa8bcf70..b0fa6dac 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -293,6 +293,27 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
@@ -196,7 +188,7 @@
  mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index e07153b..0561b2a 100644
+index 0edea0d3..c5ce8cf7 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -9,6 +9,7 @@
@@ -207,7 +199,7 @@
  
  static bool wed_enable = true;
  module_param(wed_enable, bool, 0644);
-@@ -781,6 +782,8 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+@@ -763,6 +764,8 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
  
  	wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
  
@@ -216,7 +208,7 @@
  	dev->mt76.rx_token_size = wed->wlan.rx_pkt;
  	if (mtk_wed_device_attach(wed) != 0)
  		return 0;
-@@ -792,6 +795,9 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+@@ -774,6 +777,9 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
  	if (ret)
  		return ret;
  
@@ -227,7 +219,7 @@
  #else
  	return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index a487245..0348683 100644
+index a4872451..03486837 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -550,6 +550,8 @@ u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
@@ -248,5 +240,5 @@
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
 -- 
-2.18.0
+2.25.1
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
index 2cec6cb..4f4d700 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
@@ -1,7 +1,7 @@
-From d56162deb8cfa121513bc4b4fc64d931e0770f7e Mon Sep 17 00:00:00 2001
+From 10f2c201cbeaae838ffa2489a7ff928d812d6f49 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 2 Sep 2022 14:40:40 +0800
-Subject: [PATCH 3008/3008] mt76: mt7915: enable red per-band token drop for HW
+Subject: [PATCH 3007/3007] mt76: mt7915: enable red per-band token drop for HW
  Path
 
 Limit the number of token used by each band. If a band uses too many token,
@@ -16,10 +16,10 @@
  3 files changed, 45 insertions(+), 11 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 6b70e47..7be542e 100644
+index b0fa6dac..98277d27 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2410,8 +2410,13 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
+@@ -2412,8 +2412,13 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
  			mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
  					  MCU_WA_PARAM_WED_VERSION,
  					  wed->rev_id, 0);
@@ -33,7 +33,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
  		return ret;
-@@ -2421,12 +2426,7 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
+@@ -2423,12 +2428,7 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -47,7 +47,7 @@
  }
  
  int mt7915_mcu_init(struct mt7915_dev *dev)
-@@ -4230,6 +4230,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
+@@ -4232,6 +4232,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
  
  	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), wait_resp);
  }
@@ -83,7 +83,7 @@
  
  int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  {
-@@ -4240,17 +4269,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
+@@ -4242,17 +4271,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  	u32 red_type = enabled > 0 ? RED_BY_WA_ENABLE : RED_DISABLE;
  	__le32 req = cpu_to_le32(red_type);
  
@@ -110,7 +110,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 1f56db6..9181e96 100644
+index 1f56db6b..9181e961 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -269,6 +269,7 @@ enum {
@@ -122,7 +122,7 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 0348683..3029315 100644
+index 03486837..30293158 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -749,11 +749,11 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
@@ -139,5 +139,5 @@
  int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
  void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
 -- 
-2.18.0
+2.25.1