diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3002-mt76-add-wed-rx-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3002-mt76-add-wed-rx-support.patch
index 8265434..45e7386 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3002-mt76-add-wed-rx-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3002-mt76-add-wed-rx-support.patch
@@ -1,35 +1,38 @@
-From a6bbc51840c63e5992c2d0cee9fbbb795312da0c Mon Sep 17 00:00:00 2001
+From 50c04081556744438d6017c11ddfa3b7239efd26 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 5 Jul 2022 19:42:55 +0800
 Subject: [PATCH 3002/3003] mt76 add wed rx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
- drivers/net/wireless/mediatek/mt76/dma.c      | 250 +++++++++++++++---
- drivers/net/wireless/mediatek/mt76/dma.h      |  10 +
- drivers/net/wireless/mediatek/mt76/mac80211.c |   8 +-
- drivers/net/wireless/mediatek/mt76/mt76.h     |  24 +-
- .../net/wireless/mediatek/mt76/mt7603/dma.c   |   2 +-
- .../wireless/mediatek/mt76/mt7603/mt7603.h    |   2 +-
- .../net/wireless/mediatek/mt76/mt7615/mac.c   |   2 +-
- .../wireless/mediatek/mt76/mt7615/mt7615.h    |   2 +-
- .../wireless/mediatek/mt76/mt76_connac_mcu.c  |   9 +
- drivers/net/wireless/mediatek/mt76/mt76x02.h  |   2 +-
- .../net/wireless/mediatek/mt76/mt76x02_txrx.c |   2 +-
- .../net/wireless/mediatek/mt76/mt7915/dma.c   |  10 +
- .../net/wireless/mediatek/mt76/mt7915/mac.c   | 103 +++++++-
- .../net/wireless/mediatek/mt76/mt7915/mcu.c   |   3 +
- .../net/wireless/mediatek/mt76/mt7915/mmio.c  |  26 +-
- .../wireless/mediatek/mt76/mt7915/mt7915.h    |   7 +-
- .../net/wireless/mediatek/mt76/mt7915/regs.h  |  14 +-
- .../net/wireless/mediatek/mt76/mt7921/mac.c   |   2 +-
- .../wireless/mediatek/mt76/mt7921/mt7921.h    |   4 +-
- .../wireless/mediatek/mt76/mt7921/pci_mac.c   |   4 +-
- drivers/net/wireless/mediatek/mt76/tx.c       |  34 +++
- 21 files changed, 448 insertions(+), 68 deletions(-)
+ dma.c             | 250 ++++++++++++++++++++++++++++++++++++++--------
+ dma.h             |  10 ++
+ mac80211.c        |   8 +-
+ mt76.h            |  25 ++++-
+ mt7603/dma.c      |   2 +-
+ mt7603/mt7603.h   |   2 +-
+ mt7615/mac.c      |   2 +-
+ mt7615/mt7615.h   |   2 +-
+ mt76_connac_mcu.c |   9 ++
+ mt76x02.h         |   2 +-
+ mt76x02_txrx.c    |   2 +-
+ mt7915/dma.c      |  10 ++
+ mt7915/init.c     |   9 ++
+ mt7915/mac.c      | 103 ++++++++++++++++++-
+ mt7915/main.c     |  25 ++++-
+ mt7915/mcu.c      |  14 ++-
+ mt7915/mcu.h      |   1 +
+ mt7915/mmio.c     |  26 ++++-
+ mt7915/mt7915.h   |  10 +-
+ mt7915/regs.h     |  14 ++-
+ mt7921/mac.c      |   2 +-
+ mt7921/mt7921.h   |   4 +-
+ mt7921/pci_mac.c  |   4 +-
+ tx.c              |  34 +++++++
+ 24 files changed, 495 insertions(+), 75 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 03ee9109..3acba9a3 100644
+index 03ee910..4d4d404 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -98,6 +98,63 @@ mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
@@ -271,7 +274,7 @@
  {
  	int idx = q->tail;
  
-@@ -314,7 +433,7 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
+@@ -314,7 +435,7 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
  	q->tail = (q->tail + 1) % q->ndesc;
  	q->queued--;
  
@@ -280,7 +283,7 @@
  }
  
  static int
-@@ -336,7 +455,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -336,7 +457,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
  	buf.len = skb->len;
  
  	spin_lock_bh(&q->lock);
@@ -289,7 +292,7 @@
  	mt76_dma_kick_queue(dev, q);
  	spin_unlock_bh(&q->lock);
  
-@@ -413,7 +532,7 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -413,7 +534,7 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
  		goto unmap;
  
  	return mt76_dma_add_buf(dev, q, tx_info.buf, tx_info.nbuf,
@@ -298,7 +301,7 @@
  
  unmap:
  	for (n--; n > 0; n--)
-@@ -448,6 +567,8 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -448,6 +569,8 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  	int frames = 0;
  	int len = SKB_WITH_OVERHEAD(q->buf_size);
  	int offset = q->buf_offset;
@@ -307,7 +310,7 @@
  
  	if (!q->ndesc)
  		return 0;
-@@ -456,10 +577,29 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -456,10 +579,29 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  
  	while (q->queued < q->ndesc - 1) {
  		struct mt76_queue_buf qbuf;
@@ -340,7 +343,7 @@
  
  		addr = dma_map_single(dev->dma_dev, buf, len, DMA_FROM_DEVICE);
  		if (unlikely(dma_mapping_error(dev->dma_dev, addr))) {
-@@ -470,7 +610,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -470,7 +612,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  		qbuf.addr = addr + offset;
  		qbuf.len = len - offset;
  		qbuf.skip_unmap = false;
@@ -349,7 +352,7 @@
  		frames++;
  	}
  
-@@ -516,6 +656,11 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -516,6 +658,11 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
  		if (!ret)
  			q->wed_regs = wed->txfree_ring.reg_base;
  		break;
@@ -361,7 +364,7 @@
  	default:
  		ret = -EINVAL;
  	}
-@@ -531,7 +676,8 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -531,7 +678,8 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  		     int idx, int n_desc, int bufsize,
  		     u32 ring_base)
  {
@@ -371,7 +374,7 @@
  
  	spin_lock_init(&q->lock);
  	spin_lock_init(&q->cleanup_lock);
-@@ -541,6 +687,11 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -541,6 +689,11 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  	q->buf_size = bufsize;
  	q->hw_idx = idx;
  
@@ -383,7 +386,7 @@
  	size = q->ndesc * sizeof(struct mt76_desc);
  	q->desc = dmam_alloc_coherent(dev->dma_dev, size, &q->desc_dma, GFP_KERNEL);
  	if (!q->desc)
-@@ -573,7 +724,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -573,7 +726,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  
  	spin_lock_bh(&q->lock);
  	do {
@@ -392,7 +395,7 @@
  		if (!buf)
  			break;
  
-@@ -614,7 +765,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+@@ -614,7 +767,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
  
  static void
  mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
@@ -401,7 +404,7 @@
  {
  	struct sk_buff *skb = q->rx_head;
  	struct skb_shared_info *shinfo = skb_shinfo(skb);
-@@ -634,7 +785,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+@@ -634,7 +787,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
  
  	q->rx_head = NULL;
  	if (nr_frags < ARRAY_SIZE(shinfo->frags))
@@ -410,7 +413,7 @@
  	else
  		dev_kfree_skb(skb);
  }
-@@ -655,6 +806,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -655,6 +808,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  	}
  
  	while (done < budget) {
@@ -418,7 +421,7 @@
  		u32 info;
  
  		if (check_ddone) {
-@@ -665,10 +817,13 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -665,10 +819,13 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  				break;
  		}
  
@@ -433,7 +436,7 @@
  		if (q->rx_head)
  			data_len = q->buf_size;
  		else
-@@ -681,7 +836,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -681,7 +838,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  		}
  
  		if (q->rx_head) {
@@ -442,7 +445,7 @@
  			continue;
  		}
  
-@@ -708,7 +863,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -708,7 +865,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  			continue;
  		}
  
@@ -451,7 +454,7 @@
  		continue;
  
  free_frag:
-@@ -785,7 +940,7 @@ EXPORT_SYMBOL_GPL(mt76_dma_attach);
+@@ -785,7 +942,7 @@ EXPORT_SYMBOL_GPL(mt76_dma_attach);
  
  void mt76_dma_cleanup(struct mt76_dev *dev)
  {
@@ -460,7 +463,7 @@
  
  	mt76_worker_disable(&dev->tx_worker);
  	netif_napi_del(&dev->tx_napi);
-@@ -801,12 +956,17 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+@@ -801,12 +958,17 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
  
  	mt76_for_each_q_rx(dev, i) {
  		netif_napi_del(&dev->napi[i]);
@@ -480,7 +483,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_dma_cleanup);
 diff --git a/dma.h b/dma.h
-index fdf786f9..90370d12 100644
+index fdf786f..90370d1 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -16,6 +16,16 @@
@@ -501,7 +504,7 @@
  #define MT_RX_INFO_LEN			4
  #define MT_FCE_INFO_LEN			4
 diff --git a/mac80211.c b/mac80211.c
-index af2c09ad..fa5ce6ec 100644
+index af2c09a..fa5ce6e 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -594,11 +594,14 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
@@ -532,7 +535,7 @@
  
  	mt76_rx_complete(dev, &frames, napi);
 diff --git a/mt76.h b/mt76.h
-index 49314895..9162213a 100644
+index 4931489..0043c7c 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -20,6 +20,8 @@
@@ -597,7 +600,7 @@
  	struct mt76_queue *q_mcu[__MT_MCUQ_MAX];
  	struct mt76_queue q_rx[__MT_RXQ_MAX];
  	const struct mt76_queue_ops *queue_ops;
-@@ -785,6 +794,9 @@ struct mt76_dev {
+@@ -785,12 +794,16 @@ struct mt76_dev {
  	u16 wed_token_count;
  	u16 token_count;
  	u16 token_size;
@@ -607,7 +610,14 @@
  
  	wait_queue_head_t tx_wait;
  	/* spinclock used to protect wcid pktid linked list */
-@@ -1352,6 +1364,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+ 	spinlock_t status_lock;
+ 
+ 	u32 wcid_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
++	u32 wcid_wds_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
+ 	u32 wcid_phy_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
+ 
+ 	u64 vif_mask;
+@@ -1352,6 +1365,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -616,7 +626,7 @@
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
-@@ -1496,6 +1510,12 @@ struct mt76_txwi_cache *
+@@ -1496,6 +1511,12 @@ struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
@@ -630,7 +640,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7603/dma.c b/mt7603/dma.c
-index 590cff9d..2ff71c53 100644
+index 590cff9..2ff71c5 100644
 --- a/mt7603/dma.c
 +++ b/mt7603/dma.c
 @@ -69,7 +69,7 @@ free:
@@ -643,7 +653,7 @@
  	struct mt7603_dev *dev = container_of(mdev, struct mt7603_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
 diff --git a/mt7603/mt7603.h b/mt7603/mt7603.h
-index 0fd46d90..f2ce22ae 100644
+index 0fd46d9..f2ce22a 100644
 --- a/mt7603/mt7603.h
 +++ b/mt7603/mt7603.h
 @@ -244,7 +244,7 @@ int mt7603_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -656,7 +666,7 @@
  void mt7603_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
  int mt7603_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7615/mac.c b/mt7615/mac.c
-index 37286276..14cdd9a2 100644
+index 3728627..14cdd9a 100644
 --- a/mt7615/mac.c
 +++ b/mt7615/mac.c
 @@ -1648,7 +1648,7 @@ bool mt7615_rx_check(struct mt76_dev *mdev, void *data, int len)
@@ -669,7 +679,7 @@
  	struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
 diff --git a/mt7615/mt7615.h b/mt7615/mt7615.h
-index 25880d1a..983469c7 100644
+index 25880d1..983469c 100644
 --- a/mt7615/mt7615.h
 +++ b/mt7615/mt7615.h
 @@ -511,7 +511,7 @@ void mt7615_tx_worker(struct mt76_worker *w);
@@ -682,7 +692,7 @@
  int mt7615_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index cd350689..24548469 100644
+index cd35068..2454846 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -1190,6 +1190,7 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
@@ -730,7 +740,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_add_key);
 diff --git a/mt76x02.h b/mt76x02.h
-index f76fd22e..0b872af1 100644
+index f76fd22..0b872af 100644
 --- a/mt76x02.h
 +++ b/mt76x02.h
 @@ -173,7 +173,7 @@ int mt76x02_set_rts_threshold(struct ieee80211_hw *hw, u32 val);
@@ -743,7 +753,7 @@
  irqreturn_t mt76x02_irq_handler(int irq, void *dev_instance);
  void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
 diff --git a/mt76x02_txrx.c b/mt76x02_txrx.c
-index 96fdf423..bf24d3e0 100644
+index 96fdf42..bf24d3e 100644
 --- a/mt76x02_txrx.c
 +++ b/mt76x02_txrx.c
 @@ -33,7 +33,7 @@ void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
@@ -756,7 +766,7 @@
  	struct mt76x02_dev *dev = container_of(mdev, struct mt76x02_dev, mt76);
  	void *rxwi = skb->data;
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 71223221..ac98e01b 100644
+index 7122322..ac98e01 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -376,6 +376,8 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -790,8 +800,28 @@
  		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_EXT],
  				       MT_RXQ_ID(MT_RXQ_EXT),
  				       MT7915_RX_RING_SIZE,
+diff --git a/mt7915/init.c b/mt7915/init.c
+index b549fa0..eb321b7 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -695,6 +695,15 @@ mt7915_init_hardware(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+ 			return ret;
+ 	}
+ 
++	/* wds workaround for mt7986 */
++	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && is_mt7986(&dev->mt76)) {
++		for(idx = MT7915_WTBL_WDS_START; idx < MT7915_WTBL_WDS_END; idx++)
++			mt76_wcid_mask_set(dev->mt76.wcid_mask, idx);
++
++		for (idx = 0; idx < DIV_ROUND_UP(MT7915_WTBL_STA, 32); idx++)
++			dev->mt76.wcid_wds_mask[idx] = ~dev->mt76.wcid_mask[idx];
++	}
++
+ 	/* Beacon and mgmt frames should occupy wcid 0 */
+ 	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
+ 	if (idx)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index db21d83e..1f8e1230 100644
+index db21d83..1f8e123 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -217,7 +217,7 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
@@ -939,11 +969,62 @@
  			mt76_rx(&dev->mt76, q, skb);
  			return;
  		}
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 2e721cd..9c808ff 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -670,8 +670,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ #endif
+ 	int ret, idx;
+ 	u32 addr;
++	bool wed_wds = false;
+ 
+-	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
++	if (mtk_wed_device_active(&mdev->mmio.wed))
++		wed_wds = !!test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
++
++	if (wed_wds)
++		idx = mt76_wcid_alloc(mdev->wcid_wds_mask, MT7915_WTBL_STA);
++	else
++	        idx = mt76_wcid_alloc(mdev->wcid_mask, MT7915_WTBL_STA);
+ 	if (idx < 0)
+ 		return -ENOSPC;
+ 
+@@ -1107,6 +1114,13 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
+ 	else
+ 		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
+ 
++	if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
++	    (msta->wcid.idx < MT7915_WTBL_WDS_START ||
++	     msta->wcid.idx > MT7915_WTBL_WDS_END)) {
++		mt7915_sta_remove(hw, vif, sta);
++		mt7915_sta_add(hw, vif, sta);
++	 }
++
+ 	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
+ }
+ 
+@@ -1449,9 +1463,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+ 	/* fw will find the wcid by dest addr */
+ 	if(is_mt7915(&dev->mt76))
+ 		path->mtk_wdma.wcid = 0xff;
+-	else
+-		path->mtk_wdma.wcid = 0x3ff;
+-
++	else {
++		if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags))
++			path->mtk_wdma.wcid = msta->wcid.idx;
++		else
++			path->mtk_wdma.wcid = 0x3ff;
++	}
+ 	path->mtk_wdma.queue = phy != &dev->phy;
+ 
+ 	ctx->dev = NULL;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 674cbc4e..0ae6daf3 100644
+index 9e9a2ea..dfa7311 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -1723,6 +1723,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1719,6 +1719,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta, bool enable)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -951,7 +1032,7 @@
  	struct mt7915_sta *msta;
  	struct sk_buff *skb;
  	int ret;
-@@ -1775,6 +1776,8 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1771,6 +1772,8 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  		return ret;
  	}
  out:
@@ -960,8 +1041,45 @@
  	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
  				     MCU_EXT_CMD(STA_REC_UPDATE), true);
  }
+@@ -2348,6 +2351,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
+ int mt7915_run_firmware(struct mt7915_dev *dev)
+ {
+ 	int ret;
++	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
+ 
+ 	/* force firmware operation mode into normal state,
+ 	 * which should be set before firmware download stage.
+@@ -2377,8 +2381,14 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
+ 	if (ret)
+ 		return ret;
+ 
+-	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && is_mt7915(&dev->mt76))
+-		mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY), 0, 0, 0);
++	if (mtk_wed_device_active(wed)) {
++		if (wed->ver == MTK_WED_V1)
++			mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY),
++					  0, 0, 0);
++		mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
++				  MCU_WA_PARAM_WED_VERSION,
++				  wed->rev_id, 0);
++	}
+ 
+ 	ret = mt7915_mcu_set_mwds(dev, 1);
+ 	if (ret)
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index b8a433e..ce50e60 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -268,6 +268,7 @@ enum {
+ 	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
+ 	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
+ #endif
++	MCU_WA_PARAM_WED_VERSION = 0x32,
+ };
+ 
+ enum mcu_mmps_mode {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index b4a3120d..08ff556e 100644
+index b4a3120..08ff556 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -28,6 +28,9 @@ static const u32 mt7915_reg[] = {
@@ -1042,10 +1160,20 @@
  	dev->mt76.dma_dev = wed->dev;
  	mdev->token_size = wed->wlan.token_start;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 39127922..22399cc7 100644
+index 3912792..97eac73 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -78,6 +78,7 @@
+@@ -18,6 +18,9 @@
+ #define MT7915_WTBL_STA			(MT7915_WTBL_RESERVED - \
+ 					 MT7915_MAX_INTERFACES)
+ 
++#define MT7915_WTBL_WDS_START		256
++#define MT7915_WTBL_WDS_END		274
++
+ #define MT7915_WATCHDOG_TIME		(HZ / 10)
+ #define MT7915_RESET_TIMEOUT		(30 * HZ)
+ 
+@@ -78,6 +81,7 @@
  #define MT7915_MAX_STA_TWT_AGRT		8
  #define MT7915_MIN_TWT_DUR 64
  #define MT7915_MAX_QUEUE		(__MT_RXQ_MAX + __MT_MCUQ_MAX + 2)
@@ -1053,7 +1181,7 @@
  
  struct mt7915_vif;
  struct mt7915_sta;
-@@ -541,7 +542,9 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
+@@ -541,7 +545,9 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
  irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
  u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
  u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
@@ -1064,7 +1192,7 @@
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
  int mt7915_eeprom_init(struct mt7915_dev *dev);
-@@ -693,7 +696,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -693,7 +699,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  			  struct mt76_tx_info *tx_info);
  void mt7915_tx_token_put(struct mt7915_dev *dev);
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
@@ -1074,7 +1202,7 @@
  void mt7915_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
  void mt7915_stats_work(struct work_struct *work);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index ffda5f6b..08bf84ce 100644
+index ffda5f6..08bf84c 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -33,6 +33,9 @@ enum reg_rev {
@@ -1120,7 +1248,7 @@
  #define MT_INT_SOURCE_CSR		__REG(INT_SOURCE_CSR)
  #define MT_INT_MASK_CSR			__REG(INT_MASK_CSR)
 diff --git a/mt7921/mac.c b/mt7921/mac.c
-index 4fcadf86..4897940b 100644
+index 4fcadf8..4897940 100644
 --- a/mt7921/mac.c
 +++ b/mt7921/mac.c
 @@ -555,7 +555,7 @@ out:
@@ -1133,7 +1261,7 @@
  	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
 diff --git a/mt7921/mt7921.h b/mt7921/mt7921.h
-index efeb82cb..4b2e974b 100644
+index efeb82c..4b2e974 100644
 --- a/mt7921/mt7921.h
 +++ b/mt7921/mt7921.h
 @@ -388,7 +388,7 @@ int mt7921e_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -1155,7 +1283,7 @@
  int mt7921e_mac_reset(struct mt7921_dev *dev);
  int mt7921e_mcu_init(struct mt7921_dev *dev);
 diff --git a/mt7921/pci_mac.c b/mt7921/pci_mac.c
-index e1800674..ca982eb5 100644
+index e180067..ca982eb 100644
 --- a/mt7921/pci_mac.c
 +++ b/mt7921/pci_mac.c
 @@ -182,7 +182,7 @@ bool mt7921e_rx_check(struct mt76_dev *mdev, void *data, int len)
@@ -1177,7 +1305,7 @@
  	}
  }
 diff --git a/tx.c b/tx.c
-index ae44afe0..bccd206e 100644
+index ae44afe..bccd206 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -767,3 +767,37 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
@@ -1219,5 +1347,5 @@
 +}
 +EXPORT_SYMBOL_GPL(mt76_rx_token_release);
 -- 
-2.25.1
+2.18.0