diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
index 347d8e8..873a154 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
@@ -1,19 +1,20 @@
-From 35c54875181e0f1b0637746de7c4af6aa9ec0212 Mon Sep 17 00:00:00 2001
+From f45f9c4ab6b8e9508a0fedb65de098c4f1be63c3 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Jun 2022 19:46:26 +0800
-Subject: [PATCH 1/7] mt76: mt7915: rework testmode init registers
+Subject: [PATCH 1/3] mt76: mt7915: rework testmode init registers
 
 ---
  mt7915/mmio.c     |  2 ++
  mt7915/regs.h     | 16 +++++++++++++--
  mt7915/testmode.c | 52 ++++++++++++++++++++++++++++++++++-------------
- 3 files changed, 54 insertions(+), 16 deletions(-)
+ testmode.c        |  3 +--
+ 4 files changed, 55 insertions(+), 18 deletions(-)
 
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 7bd5f672..68d978f4 100644
+index be1b8ea..9c2c508 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -59,6 +59,7 @@ static const u32 mt7986_reg[] = {
+@@ -68,6 +68,7 @@ static const u32 mt7986_reg[] = {
  };
  
  static const u32 mt7915_offs[] = {
@@ -21,7 +22,7 @@
  	[TMAC_CDTR]		= 0x090,
  	[TMAC_ODTR]		= 0x094,
  	[TMAC_ATCR]		= 0x098,
-@@ -133,6 +134,7 @@ static const u32 mt7915_offs[] = {
+@@ -142,6 +143,7 @@ static const u32 mt7915_offs[] = {
  };
  
  static const u32 mt7916_offs[] = {
@@ -30,10 +31,10 @@
  	[TMAC_ODTR]		= 0x0cc,
  	[TMAC_ATCR]		= 0x00c,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 5920e705..6d9d187a 100644
+index 5180dd9..2e44537 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -30,6 +30,7 @@ enum reg_rev {
+@@ -32,6 +32,7 @@ enum reg_rev {
  };
  
  enum offs_rev {
@@ -41,7 +42,7 @@
  	TMAC_CDTR,
  	TMAC_ODTR,
  	TMAC_ATCR,
-@@ -180,6 +181,12 @@ enum offs_rev {
+@@ -182,6 +183,12 @@ enum offs_rev {
  #define MT_TRB_RXPSR0_RX_WTBL_PTR	GENMASK(25, 16)
  #define MT_TRB_RXPSR0_RX_RMAC_PTR	GENMASK(9, 0)
  
@@ -54,7 +55,7 @@
  /* TMAC: band 0(0x820e4000), band 1(0x820f4000) */
  #define MT_WF_TMAC_BASE(_band)		((_band) ? 0x820f4000 : 0x820e4000)
  #define MT_WF_TMAC(_band, ofs)		(MT_WF_TMAC_BASE(_band) + (ofs))
-@@ -188,6 +195,9 @@ enum offs_rev {
+@@ -190,6 +197,9 @@ enum offs_rev {
  #define MT_TMAC_TCR0_TX_BLINK		GENMASK(7, 6)
  #define MT_TMAC_TCR0_TBTT_STOP_CTRL	BIT(25)
  
@@ -64,7 +65,7 @@
  #define MT_TMAC_CDTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_CDTR))
   #define MT_TMAC_ODTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_ODTR))
  #define MT_TIMEOUT_VAL_PLCP		GENMASK(15, 0)
-@@ -459,8 +469,10 @@ enum offs_rev {
+@@ -461,8 +471,10 @@ enum offs_rev {
  #define MT_AGG_PCR0_VHT_PROT		BIT(13)
  #define MT_AGG_PCR0_PTA_WIN_DIS		BIT(15)
  
@@ -78,7 +79,7 @@
  #define MT_AGG_ACR0(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR0))
  #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index efb9bb82..01866028 100644
+index a979460..819fafe 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -30,7 +30,7 @@ struct reg_band {
@@ -174,6 +175,20 @@
  }
  
  static void
+diff --git a/testmode.c b/testmode.c
+index 0accc71..57cdfdf 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -447,8 +447,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_LDPC], &td->tx_rate_ldpc, 0, 1) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_STBC], &td->tx_rate_stbc, 0, 1) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_LTF], &td->tx_ltf, 0, 2) ||
+-	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA],
+-			   &td->tx_antenna_mask, 0, 0xff) ||
++	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA], &td->tx_antenna_mask, 1, 0xff) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_SPE_IDX], &td->tx_spe_idx, 0, 27) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
+ 			   &td->tx_duty_cycle, 0, 99) ||
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0002-mt76-mt7915-rework-rx-testmode-stats.patch
similarity index 91%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/0002-mt76-mt7915-rework-rx-testmode-stats.patch
index 1b0de96..08f86a3 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0002-mt76-mt7915-rework-rx-testmode-stats.patch
@@ -1,7 +1,7 @@
-From 826c0c1849f01d0afaf4cfa14adfba0386f8d88f Mon Sep 17 00:00:00 2001
+From 095584941c21d2348ab3c3afe67f4dfa0b6957cd Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 3 Jan 2022 17:09:53 +0800
-Subject: [PATCH 3/7] mt76: mt7915: rework rx testmode stats
+Subject: [PATCH 2/3] mt76: mt7915: rework rx testmode stats
 
 ---
  mac80211.c        |  3 +-
@@ -15,10 +15,10 @@
  8 files changed, 109 insertions(+), 17 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index bc3a7514..c5ef5940 100644
+index e2a8ef9..7ef853c 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -752,7 +752,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
+@@ -756,7 +756,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
  	}
  
  #ifdef CONFIG_NL80211_TESTMODE
@@ -29,10 +29,10 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index 87db9498..e4a248a1 100644
+index f9bdf16..aef6006 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -638,6 +638,8 @@ struct mt76_testmode_ops {
+@@ -626,6 +626,8 @@ struct mt76_testmode_ops {
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  };
  
@@ -41,7 +41,7 @@
  struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
-@@ -669,6 +671,8 @@ struct mt76_testmode_data {
+@@ -657,6 +659,8 @@ struct mt76_testmode_data {
  
  	u8 addr[3][ETH_ALEN];
  
@@ -50,7 +50,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -676,6 +680,7 @@ struct mt76_testmode_data {
+@@ -664,6 +668,7 @@ struct mt76_testmode_data {
  	struct {
  		u64 packets[__MT_RXQ_MAX];
  		u64 fcs_error[__MT_RXQ_MAX];
@@ -59,7 +59,7 @@
  };
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 718f427d..f62af7a8 100644
+index cf4ce3b..3101721 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1138,6 +1138,7 @@ enum {
@@ -71,7 +71,7 @@
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index cd1edf55..110e4f36 100644
+index 87cd1bf..ed94980 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -9,6 +9,7 @@
@@ -83,7 +83,7 @@
  	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
  };
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 41b99496..6c05dfab 100644
+index 819fafe..8d99edc 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -133,6 +133,21 @@ mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
@@ -117,7 +117,7 @@
  	if (!en)
  		mt7915_tm_set_tam_arb(phy, en, 0);
  }
-@@ -504,18 +521,63 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+@@ -501,18 +518,63 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
  	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
  }
  
@@ -184,7 +184,7 @@
  		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
  	}
  }
-@@ -745,12 +807,8 @@ static int
+@@ -742,12 +804,8 @@ static int
  mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  {
  	struct mt7915_phy *phy = mphy->priv;
@@ -197,7 +197,7 @@
  
  	rx = nla_nest_start(msg, MT76_TM_STATS_ATTR_LAST_RX);
  	if (!rx)
-@@ -794,15 +852,7 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+@@ -791,15 +849,7 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  
  	nla_nest_end(msg, rx);
  
@@ -215,7 +215,7 @@
  
  const struct mt76_testmode_ops mt7915_testmode_ops = {
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 5573ac30..a1c54c89 100644
+index 5573ac3..a1c54c8 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -33,6 +33,12 @@ struct mt7915_tm_clean_txq {
@@ -266,7 +266,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 57cdfdf6..1d0d5d30 100644
+index 57cdfdf..1d0d5d3 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -559,6 +559,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
@@ -280,7 +280,7 @@
  		return -EMSGSIZE;
  
 diff --git a/testmode.h b/testmode.h
-index 5e2792d8..89613266 100644
+index 5e2792d..8961326 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -101,6 +101,8 @@ enum mt76_testmode_attr {
@@ -301,5 +301,5 @@
  	/* keep last */
  	NUM_MT76_TM_STATS_ATTRS,
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch
deleted file mode 100644
index caac8c3..0000000
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From e7fac7c5c91fbabafa530abdf32cf11dd36834d7 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Fri, 25 Feb 2022 09:36:01 +0800
-Subject: [PATCH 2/7] mt76: testmode: rework tx antenna setting
-
----
- mt7915/mcu.c      |  7 +------
- mt7915/testmode.c | 13 ++++++-------
- testmode.c        |  3 +--
- 3 files changed, 8 insertions(+), 15 deletions(-)
-
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 3586a8e3..d9c9805b 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -2642,14 +2642,9 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
- 
- #ifdef CONFIG_NL80211_TESTMODE
- 	if (phy->mt76->test.tx_antenna_mask &&
--	    (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
--	     phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES ||
--	     phy->mt76->test.state == MT76_TM_STATE_TX_CONT)) {
-+	    mt76_testmode_enabled(phy->mt76)) {
- 		req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
- 		req.rx_streams = phy->mt76->test.tx_antenna_mask;
--
--		if (phy != &dev->phy)
--			req.rx_streams >>= dev->chainshift;
- 	}
- #endif
- 
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 01866028..41b99496 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -474,11 +474,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
- 		if (td->tx_spe_idx) {
- 			phy->test.spe_idx = td->tx_spe_idx;
- 		} else {
--			u8 tx_ant = td->tx_antenna_mask;
--
--			if (phy != &dev->phy)
--				tx_ant >>= dev->chainshift;
--			phy->test.spe_idx = spe_idx_map[tx_ant];
-+			phy->test.spe_idx = spe_idx_map[td->tx_antenna_mask];
- 		}
- 	}
- 
-@@ -720,8 +716,10 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
- {
- 	struct mt76_testmode_data *td = &mphy->test;
- 	struct mt7915_phy *phy = mphy->priv;
--	u32 changed = 0;
-+	struct mt7915_dev *dev = phy->dev;
-+	u32 chainmask = mphy->chainmask, changed = 0;
- 	int i;
-+	bool ext_phy = phy != &dev->phy;
- 
- 	BUILD_BUG_ON(NUM_TM_CHANGED >= 32);
- 
-@@ -729,7 +727,8 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
- 	    td->state == MT76_TM_STATE_OFF)
- 		return 0;
- 
--	if (td->tx_antenna_mask & ~mphy->chainmask)
-+	chainmask = ext_phy ? chainmask >> dev->chainshift : chainmask;
-+	if (td->tx_antenna_mask > chainmask)
- 		return -EINVAL;
- 
- 	for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
-diff --git a/testmode.c b/testmode.c
-index 0accc71a..57cdfdf6 100644
---- a/testmode.c
-+++ b/testmode.c
-@@ -447,8 +447,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_LDPC], &td->tx_rate_ldpc, 0, 1) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_STBC], &td->tx_rate_stbc, 0, 1) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_LTF], &td->tx_ltf, 0, 2) ||
--	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA],
--			   &td->tx_antenna_mask, 0, 0xff) ||
-+	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA], &td->tx_antenna_mask, 1, 0xff) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_SPE_IDX], &td->tx_spe_idx, 0, 27) ||
- 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
- 			   &td->tx_duty_cycle, 0, 99) ||
--- 
-2.25.1
-
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0004-mt76-mt7915-drop-undefined-action-frame.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0003-mt76-mt7915-drop-undefined-action-frame.patch
similarity index 86%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/0004-mt76-mt7915-drop-undefined-action-frame.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/0003-mt76-mt7915-drop-undefined-action-frame.patch
index b9dc31b..c48bc4c 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/0004-mt76-mt7915-drop-undefined-action-frame.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0003-mt76-mt7915-drop-undefined-action-frame.patch
@@ -1,14 +1,14 @@
-From 96fcb3f5306bceb4f04ca87d097df6f7d391a147 Mon Sep 17 00:00:00 2001
+From 71dc778b26769005bb0396d0a167ad18a7599ad9 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 14 Apr 2022 15:18:02 +0800
-Subject: [PATCH 4/7] mt76: mt7915: drop undefined action frame
+Subject: [PATCH 3/3] mt76: mt7915: drop undefined action frame
 
 ---
  mt7915/mac.c | 6 ++++++
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index b2322762..967e348c 100644
+index a76c82b..8ef5ddc 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -684,6 +684,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -32,5 +32,5 @@
  	if (id < 0)
  		return id;
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0005-mt76-common-RF-CR-idx-require-8-bits.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0005-mt76-common-RF-CR-idx-require-8-bits.patch
deleted file mode 100644
index f13b609..0000000
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/0005-mt76-common-RF-CR-idx-require-8-bits.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From dfee8e4b5b042c1a0c2fa3b9bed6c4d212091813 Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Mon, 13 Jun 2022 23:10:26 +0800
-Subject: [PATCH 5/7] mt76: common: RF CR idx require 8 bits
-
-Change-Id: I95af9cca36052be090be776868822d0a74377c9d
----
- mt7915/mcu.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d9c9805b..2d6642e6 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -3442,8 +3442,8 @@ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
- 		__le32 ofs;
- 		__le32 data;
- 	} __packed req = {
--		.idx = cpu_to_le32(u32_get_bits(regidx, GENMASK(31, 28))),
--		.ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(27, 0))),
-+		.idx = cpu_to_le32(u32_get_bits(regidx, GENMASK(31, 24))),
-+		.ofs = cpu_to_le32(u32_get_bits(regidx, GENMASK(23, 0))),
- 		.data = set ? cpu_to_le32(*val) : 0,
- 	};
- 	struct sk_buff *skb;
--- 
-2.25.1
-
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0006-mt76-mt7915-add-spatial-extension-index-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0006-mt76-mt7915-add-spatial-extension-index-support.patch
deleted file mode 100644
index 4080c1d..0000000
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/0006-mt76-mt7915-add-spatial-extension-index-support.patch
+++ /dev/null
@@ -1,189 +0,0 @@
-From f93eece806a777bea73ab2fcca1869b1b4b87b5c Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Wed, 13 Jul 2022 10:43:16 +0800
-Subject: [PATCH 6/7] mt76: mt7915: add spatial extension index support
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- mt76_connac.h     | 11 +++++++++++
- mt76_connac_mac.c | 11 ++++++++---
- mt76_connac_mcu.h |  2 +-
- mt7915/main.c     |  3 ---
- mt7915/mcu.c      | 20 +++++++++++++++++++-
- mt7915/mcu.h      |  1 +
- mt7915/testmode.c |  9 +++------
- 7 files changed, 43 insertions(+), 14 deletions(-)
-
-diff --git a/mt76_connac.h b/mt76_connac.h
-index 635192c8..0915eb57 100644
---- a/mt76_connac.h
-+++ b/mt76_connac.h
-@@ -261,6 +261,17 @@ mt76_connac_txwi_to_txp(struct mt76_dev *dev, struct mt76_txwi_cache *t)
- 	return (void *)(txwi + MT_TXD_SIZE);
- }
- 
-+static inline u8 mt76_connac_spe_idx(u8 antenna_mask)
-+{
-+	static const u8 ant_to_spe[] = {0, 0, 1, 0, 3, 2, 4, 0,
-+					9, 8, 6, 10, 16, 12, 18, 0};
-+
-+	if (antenna_mask >= sizeof(ant_to_spe))
-+		return 0;
-+
-+	return ant_to_spe[antenna_mask];
-+}
-+
- int mt76_connac_pm_wake(struct mt76_phy *phy, struct mt76_connac_pm *pm);
- void mt76_connac_power_save_sched(struct mt76_phy *phy,
- 				  struct mt76_connac_pm *pm);
-diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index 34ac3d81..8b7ec64a 100644
---- a/mt76_connac_mac.c
-+++ b/mt76_connac_mac.c
-@@ -417,9 +417,6 @@ mt76_connac2_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi,
- 	if (ieee80211_is_beacon(fc)) {
- 		txwi[3] &= ~cpu_to_le32(MT_TXD3_SW_POWER_MGMT);
- 		txwi[3] |= cpu_to_le32(MT_TXD3_REM_TX_COUNT);
--		if (!is_mt7921(dev))
--			txwi[7] |= cpu_to_le32(FIELD_PREP(MT_TXD7_SPE_IDX,
--							  0x18));
- 	}
- 
- 	if (info->flags & IEEE80211_TX_CTL_INJECTED) {
-@@ -550,6 +547,14 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
- 		val |= FIELD_PREP(MT_TXD6_TX_RATE, rate);
- 		txwi[6] |= cpu_to_le32(val);
- 		txwi[3] |= cpu_to_le32(MT_TXD3_BA_DISABLE);
-+
-+		if (!is_mt7921(dev)) {
-+			u8 spe_idx = mt76_connac_spe_idx(mphy->antenna_mask);
-+
-+			if (!spe_idx)
-+				spe_idx = 24 + phy_idx;
-+			txwi[7] |= cpu_to_le32(FIELD_PREP(MT_TXD7_SPE_IDX, spe_idx));
-+		}
- 	}
- }
- EXPORT_SYMBOL_GPL(mt76_connac2_mac_write_txwi);
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f62af7a8..31017218 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -580,7 +580,7 @@ struct sta_rec_ra_fixed {
- 
- 	struct sta_phy phy;
- 
--	u8 spe_en;
-+	u8 spe_idx;
- 	u8 short_preamble;
- 	u8 is_5g;
- 	u8 mmps_mode;
-diff --git a/mt7915/main.c b/mt7915/main.c
-index 2557fe08..edd678ce 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -957,9 +957,6 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
- 	if (!tx_ant || tx_ant != rx_ant || ffs(tx_ant) > max_nss)
- 		return -EINVAL;
- 
--	if ((BIT(hweight8(tx_ant)) - 1) != tx_ant)
--		tx_ant = BIT(ffs(tx_ant) - 1) - 1;
--
- 	mutex_lock(&dev->mt76.mutex);
- 
- 	phy->mt76->antenna_mask = tx_ant;
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 2d6642e6..19a33120 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -1306,6 +1306,9 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
- 	case RATE_PARAM_MMPS_UPDATE:
- 		ra->mmps_mode = mt7915_mcu_get_mmps_mode(sta->smps_mode);
- 		break;
-+	case RATE_PARAM_SPE_UPDATE:
-+		ra->spe_idx = *(u8 *)data;
-+		break;
- 	default:
- 		break;
- 	}
-@@ -1348,6 +1351,18 @@ int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif,
- 					      RATE_PARAM_MMPS_UPDATE);
- }
- 
-+static int
-+mt7915_mcu_set_spe_idx(struct mt7915_dev *dev, struct ieee80211_vif *vif,
-+		       struct ieee80211_sta *sta)
-+{
-+	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-+	struct mt76_phy *mphy = mvif->phy->mt76;
-+	u8 spe_idx = mt76_connac_spe_idx(mphy->antenna_mask);
-+
-+	return mt7915_mcu_set_fixed_rate_ctrl(dev, vif, sta, &spe_idx,
-+					      RATE_PARAM_SPE_UPDATE);
-+}
-+
- static int
- mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
- 			       struct ieee80211_vif *vif,
-@@ -1435,7 +1450,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
- 			return ret;
- 	}
- 
--	return 0;
-+	return mt7915_mcu_set_spe_idx(dev, vif, sta);
- }
- 
- static void
-@@ -2648,6 +2663,9 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
- 	}
- #endif
- 
-+	if (mt76_connac_spe_idx(phy->mt76->antenna_mask))
-+		req.tx_streams_num = fls(phy->mt76->antenna_mask);
-+
- 	if (cmd == MCU_EXT_CMD(SET_RX_PATH) ||
- 	    dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
- 		req.switch_reason = CH_SWITCH_NORMAL;
-diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 110e4f36..ed949802 100644
---- a/mt7915/mcu.h
-+++ b/mt7915/mcu.h
-@@ -395,6 +395,7 @@ enum {
- 	RATE_PARAM_FIXED_MCS,
- 	RATE_PARAM_FIXED_GI = 11,
- 	RATE_PARAM_AUTO = 20,
-+	RATE_PARAM_SPE_UPDATE = 22,
- };
- 
- #define RATE_CFG_MCS			GENMASK(3, 0)
-diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 6c05dfab..35345d35 100644
---- a/mt7915/testmode.c
-+++ b/mt7915/testmode.c
-@@ -473,8 +473,6 @@ mt7915_tm_update_channel(struct mt7915_phy *phy)
- static void
- mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
- {
--	static const u8 spe_idx_map[] = {0, 0, 1, 0, 3, 2, 4, 0,
--					 9, 8, 6, 10, 16, 12, 18, 0};
- 	struct mt76_testmode_data *td = &phy->mt76->test;
- 	struct mt7915_dev *dev = phy->dev;
- 	struct ieee80211_tx_info *info;
-@@ -488,11 +486,10 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
- 	if (en) {
- 		mt7915_tm_update_channel(phy);
- 
--		if (td->tx_spe_idx) {
-+		if (td->tx_spe_idx)
- 			phy->test.spe_idx = td->tx_spe_idx;
--		} else {
--			phy->test.spe_idx = spe_idx_map[td->tx_antenna_mask];
--		}
-+		else
-+			phy->test.spe_idx = mt76_connac_spe_idx(td->tx_antenna_mask);
- 	}
- 
- 	mt7915_tm_set_tam_arb(phy, en,
--- 
-2.25.1
-
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0007-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0007-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch
deleted file mode 100644
index b1eb130..0000000
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/0007-mt76-mt7915-set-the-first-antenna-to-detect-radar-fo.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 41cd86ee3b09740a84cb1aba54e669aaadcb7d2b Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Tue, 26 Jul 2022 16:04:53 +0800
-Subject: [PATCH 7/7] mt76: mt7915: set the first antenna to detect radar for
- MT7915
-
-The default value of listening antenna set by FW might be different in
-MT7915. As most of our cooperated labs use the first antenna to verify
-the radar detection function, manually set the value by a mcu command.
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- mt7915/mac.c    | 15 +++++++++++++++
- mt7915/mt7915.h |  1 +
- 2 files changed, 16 insertions(+)
-
-diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 967e348c..11d2866b 100644
---- a/mt7915/mac.c
-+++ b/mt7915/mac.c
-@@ -1820,6 +1820,13 @@ static int mt7915_dfs_start_rdd(struct mt7915_dev *dev, int chain)
- 	if (err < 0)
- 		return err;
- 
-+	if (is_mt7915(&dev->mt76)) {
-+		err = mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_SET_WF_ANT, chain,
-+					      0, dev->dbdc_support ? 2 : 0);
-+		if (err < 0)
-+			return err;
-+	}
-+
- 	return mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_DET_MODE, chain,
- 				       MT_RX_SEL0, 1);
- }
-@@ -1940,6 +1947,14 @@ stop:
- 	if (err < 0)
- 		return err;
- 
-+	if (is_mt7915(&dev->mt76)) {
-+		err = mt76_connac_mcu_rdd_cmd(&dev->mt76, RDD_SET_WF_ANT,
-+					      phy->band_idx, 0,
-+					      dev->dbdc_support ? 2 : 0);
-+		if (err < 0)
-+			return err;
-+	}
-+
- 	mt7915_dfs_stop_radar_detector(phy);
- 	phy->mt76->dfs_state = MT_DFS_STATE_DISABLED;
- 
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 1eb11617..c90a148d 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -357,6 +357,7 @@ enum mt7915_rdd_cmd {
- 	RDD_DET_MODE,
- 	RDD_RADAR_EMULATE,
- 	RDD_START_TXQ = 20,
-+	RDD_SET_WF_ANT = 30,
- 	RDD_CAC_START = 50,
- 	RDD_CAC_END,
- 	RDD_NORMAL_START,
--- 
-2.25.1
-
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0008-mt76-mt7915-set-chainmask-to-3-for-mt7916.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0008-mt76-mt7915-set-chainmask-to-3-for-mt7916.patch
deleted file mode 100644
index 5514339..0000000
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/0008-mt76-mt7915-set-chainmask-to-3-for-mt7916.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-From e93433a00ee18a27cfb9ef6a9cd0df6c28f96cb7 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Wed, 21 Sep 2022 13:25:26 +0800
-Subject: [PATCH] mt76: mt7915: set chainmask to 3 for mt7916
-
-Use chainmask to represent the number of TRx path and set it to 3 for mt7916.
-Use antenna_mask to represent the TRx streams.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7915/init.c | 11 ++++++-----
- mt7915/main.c |  6 +++++-
- mt7915/mcu.c  |  2 +-
- 3 files changed, 12 insertions(+), 7 deletions(-)
-
-diff --git a/mt7915/init.c b/mt7915/init.c
-index 489f6e77..8474c11f 100644
---- a/mt7915/init.c
-+++ b/mt7915/init.c
-@@ -730,11 +730,12 @@ void mt7915_set_stream_vht_txbf_caps(struct mt7915_phy *phy)
- }
- 
- static void
--mt7915_set_stream_he_txbf_caps(struct mt7915_dev *dev,
--			       struct ieee80211_sta_he_cap *he_cap,
--			       int vif, int nss)
-+mt7915_set_stream_he_txbf_caps(struct mt7915_phy *phy,
-+			       struct ieee80211_sta_he_cap *he_cap, int vif)
- {
-+	struct mt7915_dev *dev = phy->dev;
- 	struct ieee80211_he_cap_elem *elem = &he_cap->he_cap_elem;
-+	int nss = hweight8(phy->mt76->chainmask);
- 	u8 c, nss_160;
- 
- 	/* Can do 1/2 of NSS streams in 160Mhz mode for mt7915 */
-@@ -839,7 +840,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
- 		    struct ieee80211_sband_iftype_data *data)
- {
- 	struct mt7915_dev *dev = phy->dev;
--	int i, idx = 0, nss = hweight8(phy->mt76->chainmask);
-+	int i, idx = 0, nss = hweight8(phy->mt76->antenna_mask);
- 	u16 mcs_map = 0;
- 	u16 mcs_map_160 = 0;
- 	u8 nss_160;
-@@ -972,7 +973,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
- 		he_mcs->rx_mcs_80p80 = cpu_to_le16(mcs_map_160);
- 		he_mcs->tx_mcs_80p80 = cpu_to_le16(mcs_map_160);
- 
--		mt7915_set_stream_he_txbf_caps(dev, he_cap, i, nss);
-+		mt7915_set_stream_he_txbf_caps(phy, he_cap, i);
- 
- 		memset(he_cap->ppe_thres, 0, sizeof(he_cap->ppe_thres));
- 		if (he_cap_elem->phy_cap_info[6] &
-diff --git a/mt7915/main.c b/mt7915/main.c
-index edd678ce..fc5319da 100644
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -952,6 +952,7 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
- 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
- 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
- 	int max_nss = hweight8(hw->wiphy->available_antennas_tx);
-+	int tx_nss = hweight8(tx_ant), rx_nss = hweight8(rx_ant);
- 	bool ext_phy = phy != &dev->phy;
- 
- 	if (!tx_ant || tx_ant != rx_ant || ffs(tx_ant) > max_nss)
-@@ -964,7 +965,10 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
- 	if (ext_phy)
- 		tx_ant <<= dev->chainshift;
- 
--	phy->mt76->chainmask = tx_ant;
-+	if (is_mt7916(&dev->mt76) && tx_nss == max_nss && rx_nss == max_nss)
-+		phy->mt76->chainmask = 0x7;
-+	else
-+		phy->mt76->chainmask = tx_ant;
- 
- 	mt76_set_stream_caps(phy->mt76, true);
- 	mt7915_set_stream_vht_txbf_caps(phy);
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 19a33120..f11ca25d 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -485,7 +485,7 @@ static void
- mt7915_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
- 		      struct mt7915_phy *phy)
- {
--	int max_nss = hweight8(phy->mt76->chainmask);
-+	int max_nss = hweight8(phy->mt76->antenna_mask);
- 	struct bss_info_ra *ra;
- 	struct tlv *tlv;
- 
--- 
-2.18.0
-
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
index 410adde..efe4f03 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -1,7 +1,7 @@
-From 30238567bb559bd31644a811d75d63c808a4d55f Mon Sep 17 00:00:00 2001
+From 66c81406b30b24a50be33f5434664191b7cf7ab0 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
-Subject: [PATCH] mt76: mt7915: add mtk internal debug tools for mt76
+Subject: [PATCH 1001/1009] mt76: mt7915: add mtk internal debug tools for mt76
 
 ---
  mt76_connac_mcu.h     |    7 +
@@ -22,7 +22,7 @@
  create mode 100644 mt7915/mtk_mcu.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 31017218..06813f77 100644
+index 3101721..06813f7 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1104,6 +1104,7 @@ enum {
@@ -47,7 +47,7 @@
  	MCU_EXT_CMD_CAL_CACHE = 0x67,
  	MCU_EXT_CMD_SET_RADAR_TH = 0x7c,
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index b794ceb7..a3474e2f 100644
+index b794ceb..a3474e2 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -3,7 +3,7 @@
@@ -61,7 +61,7 @@
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 \ No newline at end of file
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index a4e37a52..ea512fd1 100644
+index b95c81d..fd0c9d1 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -8,6 +8,9 @@
@@ -205,7 +205,7 @@
  
  	if (dev->relay_fwlog)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 11d2866b..00218624 100644
+index 8ef5ddc..2ff90f7 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -239,6 +239,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -244,7 +244,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index fc5319da..1eb8107a 100644
+index 0dffe82..7913059 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -62,7 +62,11 @@ static int mt7915_start(struct ieee80211_hw *hw)
@@ -260,7 +260,7 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f11ca25d..44d461d7 100644
+index 2f6d328..c710624 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -195,6 +195,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -352,7 +352,7 @@
 +}
 +#endif
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index ed949802..bfb822fa 100644
+index ed94980..bfb822f 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -259,6 +259,10 @@ enum {
@@ -367,7 +367,7 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index c90a148d..193b8ab4 100644
+index fe6a6d3..c0dfe10 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -408,9 +408,9 @@
  };
  
  enum {
-@@ -592,4 +616,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 			    struct ieee80211_sta *sta, struct dentry *dir);
- #endif
+@@ -594,4 +618,24 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 			 bool pci, int *irq);
  
 +#ifdef MTK_DEBUG
 +int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
@@ -435,7 +435,7 @@
  #endif
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
 new file mode 100644
-index 00000000..58ba2cdf
+index 0000000..58ba2cd
 --- /dev/null
 +++ b/mt7915/mt7915_debug.h
 @@ -0,0 +1,1350 @@
@@ -1791,7 +1791,7 @@
 +#endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
 new file mode 100644
-index 00000000..747a9014
+index 0000000..747a901
 --- /dev/null
 +++ b/mt7915/mtk_debugfs.c
 @@ -0,0 +1,2925 @@
@@ -4722,7 +4722,7 @@
 +#endif
 diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
 new file mode 100644
-index 00000000..145fe785
+index 0000000..145fe78
 --- /dev/null
 +++ b/mt7915/mtk_mcu.c
 @@ -0,0 +1,51 @@
@@ -4778,7 +4778,7 @@
 +				 sizeof(req), true);
 +}
 diff --git a/tools/fwlog.c b/tools/fwlog.c
-index e5d4a105..3d51d9ec 100644
+index e5d4a10..3d51d9e 100644
 --- a/tools/fwlog.c
 +++ b/tools/fwlog.c
 @@ -26,7 +26,7 @@ static const char *debugfs_path(const char *phyname, const char *file)
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1002-mt76-mt7915-csi-implement-csi-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
index d020e94..d578e64 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
@@ -1,4 +1,4 @@
-From 87e6f3e21a575655e449ff2d09a27e3933940842 Mon Sep 17 00:00:00 2001
+From 0da94e40be885271ff884b581117498f2e4db997 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Jun 2022 20:13:02 +0800
 Subject: [PATCH 1002/1009] mt76: mt7915: csi: implement csi support
@@ -17,7 +17,7 @@
  create mode 100644 mt7915/vendor.h
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 89732676..90bf841e 100644
+index 06813f7..5d7c911 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -979,6 +979,7 @@ enum {
@@ -28,7 +28,7 @@
  };
  
  enum {
-@@ -1149,6 +1150,7 @@ enum {
+@@ -1150,6 +1151,7 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -37,7 +37,7 @@
  
  enum {
 diff --git a/mt7915/Makefile b/mt7915/Makefile
-index a3474e2f..e272c826 100644
+index a3474e2..e272c82 100644
 --- a/mt7915/Makefile
 +++ b/mt7915/Makefile
 @@ -1,9 +1,9 @@
@@ -54,7 +54,7 @@
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 \ No newline at end of file
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 489f6e77..6efa28fe 100644
+index 416e5ac..34b5df7 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -547,6 +547,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
@@ -70,7 +70,7 @@
  	ret = mt76_register_phy(mphy, true, mt76_rates,
  				ARRAY_SIZE(mt76_rates));
  	if (ret)
-@@ -1037,6 +1043,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
+@@ -1036,6 +1042,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
  	}
  }
  
@@ -96,7 +96,7 @@
  static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  {
  	struct mt7915_phy *phy = mt7915_ext_phy(dev);
-@@ -1045,6 +1070,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
+@@ -1044,6 +1069,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
  	if (!phy)
  		return;
  
@@ -107,7 +107,7 @@
  	mt7915_unregister_thermal(phy);
  	mt76_unregister_phy(mphy);
  	ieee80211_free_hw(mphy->hw);
-@@ -1057,6 +1086,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
+@@ -1056,6 +1085,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
  	mt7915_dma_cleanup(dev);
  	tasklet_disable(&dev->irq_tasklet);
  
@@ -118,7 +118,7 @@
  	if (is_mt7986(&dev->mt76))
  		mt7986_wmac_disable(dev);
  }
-@@ -1097,6 +1130,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1096,6 +1129,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
  	dev->mt76.test_ops = &mt7915_testmode_ops;
  #endif
  
@@ -132,7 +132,7 @@
  	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
  		dev->mt76.led_cdev.brightness_set = mt7915_led_set_brightness;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index e498b61f..48e9e5ec 100644
+index c710624..d9ff5a3 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -32,6 +32,10 @@
@@ -268,7 +268,7 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index bfb822fa..a27129c2 100644
+index bfb822f..a27129c 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -480,4 +480,80 @@ enum {
@@ -353,7 +353,7 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 8990b5b0..4914c91d 100644
+index c0dfe10..bcfcf6f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -274,6 +274,20 @@ struct mt7915_phy {
@@ -377,9 +377,9 @@
  };
  
  struct mt7915_dev {
-@@ -616,6 +630,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 			    struct ieee80211_sta *sta, struct dentry *dir);
- #endif
+@@ -618,6 +632,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 			 bool pci, int *irq);
  
 +#ifdef CONFIG_MTK_VENDOR
 +void mt7915_vendor_register(struct mt7915_phy *phy);
@@ -392,7 +392,7 @@
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
 new file mode 100644
-index 00000000..98fd9c2d
+index 0000000..98fd9c2
 --- /dev/null
 +++ b/mt7915/vendor.c
 @@ -0,0 +1,452 @@
@@ -850,7 +850,7 @@
 +}
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
 new file mode 100644
-index 00000000..9d3db2a7
+index 0000000..9d3db2a
 --- /dev/null
 +++ b/mt7915/vendor.h
 @@ -0,0 +1,60 @@
@@ -915,5 +915,5 @@
 +
 +#endif
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1003-mt76-mt7915-air-monitor-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1003-mt76-mt7915-air-monitor-support.patch
index e3fd6a0..9eb1876 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1003-mt76-mt7915-air-monitor-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1003-mt76-mt7915-air-monitor-support.patch
@@ -1,4 +1,4 @@
-From 63af0047d060a1e8c7469a7115f9f69920f20ac5 Mon Sep 17 00:00:00 2001
+From e5b6d9784c5d5866df066f448940046a093aa9e4 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 11 Jan 2022 12:03:23 +0800
 Subject: [PATCH 1003/1009] mt76: mt7915: air monitor support
@@ -13,10 +13,10 @@
  6 files changed, 440 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 90bf841e..80515382 100644
+index 5d7c911..d87ad38 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1150,6 +1150,8 @@ enum {
+@@ -1151,6 +1151,8 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -26,7 +26,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 00218624..9f17f0b7 100644
+index 2ff90f7..78190af 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -486,6 +486,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -41,7 +41,7 @@
  		status->flag |= RX_FLAG_8023;
  	}
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 48b8be17..c27f9b54 100644
+index 7913059..35cd7ad 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -675,6 +675,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -55,7 +55,7 @@
  }
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 4914c91d..32d66c4c 100644
+index bcfcf6f..4c3bb62 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -229,6 +229,35 @@ struct mt7915_hif {
@@ -103,7 +103,7 @@
  #endif
  };
  
-@@ -634,6 +665,9 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -636,6 +667,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
@@ -114,7 +114,7 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 98fd9c2d..b94d787e 100644
+index 98fd9c2..b94d787 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -430,6 +430,353 @@ out:
@@ -491,7 +491,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 9d3db2a7..976817f3 100644
+index 9d3db2a..976817f 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -4,6 +4,7 @@
@@ -545,5 +545,5 @@
 +
  #endif
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
index 62ecc61..e5a31be 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -1,4 +1,4 @@
-From 781871b4690c21e24ba3a86b488efb46aaa402c5 Mon Sep 17 00:00:00 2001
+From 952b05674331043bc5e904a16b7ec4e5634f5b5f Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:45:53 +0800
 Subject: [PATCH 1004/1009] mt76: mt7915: add support for muru_onoff via
@@ -12,7 +12,7 @@
  4 files changed, 47 insertions(+), 2 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 6efa28fe..37b7b54a 100644
+index 34b5df7..479b984 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -582,6 +582,7 @@ static void mt7915_init_work(struct work_struct *work)
@@ -24,7 +24,7 @@
  
  void mt7915_wfsys_reset(struct mt7915_dev *dev)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 48e9e5ec..ed789707 100644
+index d9ff5a3..4c04760 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -856,13 +856,18 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
@@ -49,7 +49,7 @@
  		muru->mimo_dl.vht_mu_bfee =
  			!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index a27129c2..d3cc8283 100644
+index a27129c..d3cc828 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -556,4 +556,10 @@ struct csi_data {
@@ -64,7 +64,7 @@
 +
  #endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index f18c8b6c..e239df95 100644
+index 747a901..176937a 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2480,6 +2480,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
@@ -106,7 +106,7 @@
  static int mt7915_amsduinfo_read(struct seq_file *s, void *data)
  {
  	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-@@ -2857,6 +2889,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -2859,6 +2891,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
  
@@ -115,5 +115,5 @@
  			    &fops_fw_debug_module);
  	debugfs_create_file("fw_debug_level", 0600, dir, dev,
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1005-mt76-certification-patches.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1005-mt76-certification-patches.patch
index 7b5aabf..f91650a 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1005-mt76-certification-patches.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1005-mt76-certification-patches.patch
@@ -1,4 +1,4 @@
-From 05302c18e285b0dbdc3d0c1ea14819c6be425bb9 Mon Sep 17 00:00:00 2001
+From 280df913359a09229adfeb301edd1f64c9f4c464 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 6 Jun 2022 20:15:51 +0800
 Subject: [PATCH 1005/1009] mt76: certification patches
@@ -16,10 +16,10 @@
  9 files changed, 956 insertions(+), 5 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 80515382..9fb75e6e 100644
+index d87ad38..01035b2 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1152,6 +1152,7 @@ enum {
+@@ -1153,6 +1153,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -28,7 +28,7 @@
  };
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 9f17f0b7..4d777fd5 100644
+index 78190af..7caa0ec 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -7,6 +7,7 @@
@@ -39,7 +39,7 @@
  
  #define to_rssi(field, rxv)	((FIELD_GET(field, rxv) - 220) / 2)
  
-@@ -1741,6 +1742,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+@@ -1752,6 +1753,21 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
  	phy->trb_ts = trb;
  }
  
@@ -61,7 +61,7 @@
  void mt7915_mac_sta_rc_work(struct work_struct *work)
  {
  	struct mt7915_dev *dev = container_of(work, struct mt7915_dev, rc_work);
-@@ -1763,6 +1779,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
+@@ -1774,6 +1790,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
  		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
  		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
  
@@ -76,7 +76,7 @@
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
 diff --git a/mt7915/main.c b/mt7915/main.c
-index c27f9b54..e2f557a2 100644
+index 35cd7ad..abfdc72 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -653,6 +653,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -109,7 +109,7 @@
  
  void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ed789707..b4cf4d86 100644
+index 4c04760..8731f7d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -3574,6 +3574,472 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -586,7 +586,7 @@
  
  #ifdef MTK_DEBUG
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index d3cc8283..aab1a6a3 100644
+index d3cc828..aab1a6a 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -396,10 +396,14 @@ enum {
@@ -820,11 +820,11 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 32d66c4c..f08974bb 100644
+index 4c3bb62..93afa3d 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -662,6 +662,19 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- #endif
+@@ -664,6 +664,19 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
 +void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta);
@@ -844,7 +844,7 @@
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
  			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index e239df95..222268fc 100644
+index 176937a..e24b4d7 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2486,7 +2486,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
@@ -869,7 +869,7 @@
         }
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index b94d787e..7456c577 100644
+index b94d787..7456c57 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -22,6 +22,29 @@ csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
@@ -1081,7 +1081,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 976817f3..1b08321c 100644
+index 976817f..1b08321 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -6,6 +6,48 @@
@@ -1134,5 +1134,5 @@
  
  enum mtk_vendor_attr_csi_ctrl {
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
index 76ecbcf..8df260a 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
@@ -1,4 +1,4 @@
-From 18093d743469680c1ae7b8f91837dc3804cc1756 Mon Sep 17 00:00:00 2001
+From 8df2b764386b00bbe48eb2f7e0d6829ce36eccda Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Wed, 22 Jun 2022 10:51:59 +0800
 Subject: [PATCH 1006/1009] mt76: mt7915: add L0.5 system error recovery
@@ -18,7 +18,7 @@
  10 files changed, 491 insertions(+), 98 deletions(-)
 
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index ea512fd1..0fe95f84 100644
+index fd0c9d1..f585eb9 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -52,12 +52,17 @@ static ssize_t
@@ -142,10 +142,10 @@
  	kfree(buff);
  	return ret;
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index f7e6bb10..4b594a53 100644
+index edae845..e391886 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
-@@ -479,6 +479,54 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -514,6 +514,54 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  	return 0;
  }
  
@@ -201,7 +201,7 @@
  {
  	mt7915_dma_disable(dev, true);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 37b7b54a..141c5ad8 100644
+index 479b984..d83ba2b 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -262,7 +262,7 @@ static void mt7915_led_set_brightness(struct led_classdev *led_cdev,
@@ -231,7 +231,7 @@
  {
  	int ret;
  
-@@ -1162,6 +1162,8 @@ int mt7915_register_device(struct mt7915_dev *dev)
+@@ -1161,6 +1161,8 @@ int mt7915_register_device(struct mt7915_dev *dev)
  
  	mt7915_init_debugfs(&dev->phy);
  
@@ -241,7 +241,7 @@
  
  unreg_thermal:
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 4d777fd5..d44af409 100644
+index 7caa0ec..cac296e 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -3,6 +3,7 @@
@@ -252,7 +252,7 @@
  #include "mt7915.h"
  #include "../dma.h"
  #include "mac.h"
-@@ -1318,85 +1319,187 @@ mt7915_update_beacons(struct mt7915_dev *dev)
+@@ -1329,85 +1330,187 @@ mt7915_update_beacons(struct mt7915_dev *dev)
  		mt7915_update_vif_beacon, mphy_ext->hw);
  }
  
@@ -499,7 +499,7 @@
  }
  
  /* system error recovery */
-@@ -1411,6 +1514,36 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1422,6 +1525,36 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	ext_phy = dev->mt76.phys[MT_BAND1];
  	phy2 = ext_phy ? ext_phy->priv : NULL;
  
@@ -536,7 +536,7 @@
  	if (!(READ_ONCE(dev->reset_state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
-@@ -1436,7 +1569,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1447,7 +1580,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_STOPPED);
  
  	if (mt7915_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) {
@@ -545,7 +545,7 @@
  
  		mt7915_tx_token_put(dev);
  		idr_init(&dev->mt76.token);
-@@ -1485,6 +1618,34 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1496,6 +1629,34 @@ void mt7915_mac_reset_work(struct work_struct *work)
  					     MT7915_WATCHDOG_TIME);
  }
  
@@ -581,7 +581,7 @@
  {
  	struct mt7915_dev *dev = phy->dev;
 diff --git a/mt7915/main.c b/mt7915/main.c
-index e2f557a2..5b25604e 100644
+index abfdc72..98dce0f 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -20,17 +20,13 @@ static bool mt7915_dev_running(struct mt7915_dev *dev)
@@ -631,7 +631,7 @@
  	mutex_lock(&dev->mt76.mutex);
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index b4cf4d86..3f18967a 100644
+index 8731f7d..7984432 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -150,19 +150,90 @@ mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
@@ -767,7 +767,7 @@
  {
  	__mt76_mcu_restart(&dev->mt76);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index aab1a6a3..c4850644 100644
+index aab1a6a..c485064 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -453,8 +453,9 @@ enum {
@@ -782,34 +782,34 @@
  	SER_SET_RECOVER_L3_RX_ABORT,
  	SER_SET_RECOVER_L3_TX_ABORT,
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 68d978f4..fd2f70e3 100644
+index 9c2c508..2e73bd7 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -24,6 +24,7 @@ static const u32 mt7915_reg[] = {
- 	[INFRA_MCU_ADDR_END]	= 0x7c3fffff,
- 	[FW_EXCEPTION_ADDR]	= 0x219848,
+@@ -29,6 +29,7 @@ static const u32 mt7915_reg[] = {
  	[SWDEF_BASE_ADDR]	= 0x41f200,
+ 	[TXQ_WED_RING_BASE]	= 0xd7300,
+ 	[RXQ_WED_RING_BASE]	= 0xd7410,
 +	[EXCEPTION_BASE_ADDR]	= 0x219848,
  };
  
  static const u32 mt7916_reg[] = {
-@@ -40,6 +41,7 @@ static const u32 mt7916_reg[] = {
- 	[INFRA_MCU_ADDR_END]	= 0x7c085fff,
- 	[FW_EXCEPTION_ADDR]	= 0x022050bc,
+@@ -47,6 +48,7 @@ static const u32 mt7916_reg[] = {
  	[SWDEF_BASE_ADDR]	= 0x411400,
+ 	[TXQ_WED_RING_BASE]	= 0xd7300,
+ 	[RXQ_WED_RING_BASE]	= 0xd7410,
 +	[EXCEPTION_BASE_ADDR]	= 0x022050BC,
  };
  
  static const u32 mt7986_reg[] = {
-@@ -56,6 +58,7 @@ static const u32 mt7986_reg[] = {
- 	[INFRA_MCU_ADDR_END]	= 0x7c085fff,
- 	[FW_EXCEPTION_ADDR]	= 0x02204ffc,
+@@ -65,6 +67,7 @@ static const u32 mt7986_reg[] = {
  	[SWDEF_BASE_ADDR]	= 0x411400,
+ 	[TXQ_WED_RING_BASE]	= 0x24420,
+ 	[RXQ_WED_RING_BASE]	= 0x24520,
 +	[EXCEPTION_BASE_ADDR]	= 0x02204FFC,
  };
  
  static const u32 mt7915_offs[] = {
-@@ -615,10 +618,9 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
+@@ -748,10 +751,9 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
  		u32 val = mt76_rr(dev, MT_MCU_CMD);
  
  		mt76_wr(dev, MT_MCU_CMD, val);
@@ -823,7 +823,7 @@
  	}
  }
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index f08974bb..e8feba36 100644
+index 93afa3d..6868813 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -350,6 +350,15 @@ struct mt7915_dev {
@@ -871,18 +871,18 @@
  int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  			       struct mt7915_vif *mvif,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 6d9d187a..e2b0ff7d 100644
+index 2e44537..3f283a8 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -26,6 +26,7 @@ enum reg_rev {
- 	INFRA_MCU_ADDR_END,
- 	FW_EXCEPTION_ADDR,
+@@ -28,6 +28,7 @@ enum reg_rev {
  	SWDEF_BASE_ADDR,
+ 	TXQ_WED_RING_BASE,
+ 	RXQ_WED_RING_BASE,
 +	EXCEPTION_BASE_ADDR,
  	__MT_REG_MAX,
  };
  
-@@ -108,6 +109,11 @@ enum offs_rev {
+@@ -110,6 +111,11 @@ enum offs_rev {
  #define __REG(id)			(dev->reg.reg_rev[(id)])
  #define __OFFS(id)			(dev->reg.offs_rev[(id)])
  
@@ -894,7 +894,7 @@
  /* MCU WFDMA0 */
  #define MT_MCU_WFDMA0_BASE		0x2000
  #define MT_MCU_WFDMA0(ofs)		(MT_MCU_WFDMA0_BASE + (ofs))
-@@ -563,6 +569,10 @@ enum offs_rev {
+@@ -565,6 +571,10 @@ enum offs_rev {
  #define MT_WFDMA0_PRI_DLY_INT_CFG1	MT_WFDMA0(0x2f4)
  #define MT_WFDMA0_PRI_DLY_INT_CFG2	MT_WFDMA0(0x2f8)
  
@@ -905,7 +905,7 @@
  /* WFDMA1 */
  #define MT_WFDMA1_BASE			0xd5000
  #define MT_WFDMA1(ofs)			(MT_WFDMA1_BASE + (ofs))
-@@ -708,6 +718,10 @@ enum offs_rev {
+@@ -721,6 +731,10 @@ enum offs_rev {
  #define MT_MCU_CMD_NORMAL_STATE		BIT(5)
  #define MT_MCU_CMD_ERROR_MASK		GENMASK(5, 1)
  
@@ -916,7 +916,7 @@
  /* TOP RGU */
  #define MT_TOP_RGU_BASE			0x18000000
  #define MT_TOP_PWR_CTRL			(MT_TOP_RGU_BASE + (0x0))
-@@ -983,6 +997,8 @@ enum offs_rev {
+@@ -996,6 +1010,8 @@ enum offs_rev {
  #define MT_CPU_UTIL_PEAK_IDLE_CNT	MT_CPU_UTIL(0x0c)
  #define MT_CPU_UTIL_CTRL		MT_CPU_UTIL(0x1c)
  
@@ -926,5 +926,5 @@
  #define MT_LED_TOP_BASE			0x18013000
  #define MT_LED_PHYS(_n)			(MT_LED_TOP_BASE + (_n))
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
index b7d2f5b..cee0d14 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch
@@ -1,4 +1,4 @@
-From e937fef1994ae95703ae1920db249a68e7da0549 Mon Sep 17 00:00:00 2001
+From d8a6f77dc9b3c58499375951b17c8f124668dd86 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Fri, 27 May 2022 15:51:48 +0800
 Subject: [PATCH 1007/1009] mt76: mt7915:add support for runtime set in-band
@@ -10,7 +10,7 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 3f18967a..a3035597 100644
+index 7984432..d36bcd0 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2022,8 +2022,7 @@ mt7915_mcu_beacon_inband_discov(struct mt7915_dev *dev, struct ieee80211_vif *vi
@@ -33,5 +33,5 @@
  	buf = (u8 *)tlv + sizeof(*discov);
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
index 3dcce36..c205a87 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch
@@ -1,4 +1,4 @@
-From fd62d0e9fb340653b1f5e78f5492848b1e686ea5 Mon Sep 17 00:00:00 2001
+From 602c89b9ac8e7fec5ab466a28a4457c70da37b53 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Jun 2022 10:53:43 +0800
 Subject: [PATCH 1008/1009] mt76: mt7915: add mt76 vendor muru onoff command
@@ -11,7 +11,7 @@
  4 files changed, 63 insertions(+)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index a3035597..c8c8be49 100644
+index d36bcd0..bcecc5e 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -3670,6 +3670,13 @@ void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
@@ -29,7 +29,7 @@
  }
  
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index c4850644..0a77ad0d 100644
+index c485064..0a77ad0 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -403,6 +403,7 @@ enum {
@@ -41,7 +41,7 @@
  };
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 7456c577..c7551848 100644
+index 7456c57..c755184 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -34,6 +34,11 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -109,7 +109,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 1b08321c..a8e4ebf9 100644
+index 1b08321..a8e4ebf 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -8,6 +8,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -139,5 +139,5 @@
  	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1009-mt76-mt7915-add-fw_version-dump.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1009-mt76-mt7915-add-fw_version-dump.patch
index b7d2df3..fd99f23 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1009-mt76-mt7915-add-fw_version-dump.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1009-mt76-mt7915-add-fw_version-dump.patch
@@ -1,7 +1,7 @@
-From c0238eeeaec21b5f1e0087bec4b6306d3c5aed53 Mon Sep 17 00:00:00 2001
+From 3240a8b38a26ca9293db89e3e5bf8f48f5434518 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Wed, 17 Aug 2022 13:40:24 +0800
-Subject: [PATCH] mt76: mt7915: add fw_version dump
+Subject: [PATCH 1009/1009] mt76: mt7915: add fw_version dump
 
 ---
  mt76.h               |  4 ++++
@@ -10,10 +10,10 @@
  3 files changed, 32 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index e4a248a1..b5453d35 100644
+index aef6006..fac1dfb 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -837,6 +837,10 @@ struct mt76_dev {
+@@ -823,6 +823,10 @@ struct mt76_dev {
  		struct mt76_usb usb;
  		struct mt76_sdio sdio;
  	};
@@ -25,7 +25,7 @@
  
  struct mt76_power_limits {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index ed6c9ebb..be2a2de1 100644
+index ed6c9eb..be2a2de 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -2889,6 +2889,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
@@ -59,7 +59,7 @@
  		struct mt76_connac2_patch_sec *sec;
  		u32 len, addr, mode;
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 222268fc..ef0c27d2 100644
+index e24b4d7..9de5b0f 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -2721,6 +2721,22 @@ static int mt7915_agginfo_read_band1(struct seq_file *s, void *data)
@@ -70,7 +70,7 @@
 +{
 +	struct mt7915_dev *dev = dev_get_drvdata(s->private);
 +	struct mt76_dev *mdev = NULL;
-+	seq_printf(s, "Version: 2.2.5.0\n");
++	seq_printf(s, "Version: 2.2.6.0\n");
 +
 +	if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 +		return 0;
@@ -85,7 +85,7 @@
  /*usage: <en> <num> <len>
  	en: BIT(16) 0: sw amsdu  1: hw amsdu
  	num: GENMASK(15, 8) range 1-8
-@@ -2952,6 +2968,9 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -2954,6 +2970,9 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
  
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1111-mt76-testmode-additional-supports.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1111-mt76-testmode-additional-supports.patch
index 2179d74..0265815 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1111-mt76-testmode-additional-supports.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1111-mt76-testmode-additional-supports.patch
@@ -1,4 +1,4 @@
-From ee15bb2a93f96ebe3169c9bbda9855da4314d3b4 Mon Sep 17 00:00:00 2001
+From 7846c2ea51d1b3f037688af0ea1bed306683daf0 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
 Subject: [PATCH 1111/1124] mt76: testmode: additional supports
@@ -27,7 +27,7 @@
  19 files changed, 1961 insertions(+), 146 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 40cb9109..8ea09e6e 100644
+index 40cb910..8ea09e6 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -426,8 +426,7 @@ free:
@@ -41,7 +41,7 @@
  #endif
  
 diff --git a/mac80211.c b/mac80211.c
-index c5ef5940..f34a93e0 100644
+index 7ef853c..454f449 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
@@ -71,10 +71,10 @@
  
  static const struct ieee80211_channel mt76_channels_6ghz[] = {
 diff --git a/mt76.h b/mt76.h
-index b5453d35..0e4eea16 100644
+index fac1dfb..c4cdb4b 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -636,6 +636,21 @@ struct mt76_testmode_ops {
+@@ -624,6 +624,21 @@ struct mt76_testmode_ops {
  	int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
@@ -96,7 +96,7 @@
  };
  
  #define MT_TM_FW_RX_COUNT	BIT(0)
-@@ -644,16 +659,11 @@ struct mt76_testmode_data {
+@@ -632,16 +647,11 @@ struct mt76_testmode_data {
  	enum mt76_testmode_state state;
  
  	u32 param_set[DIV_ROUND_UP(NUM_MT76_TM_ATTRS, 32)];
@@ -113,7 +113,7 @@
  	u8 tx_rate_stbc;
  	u8 tx_ltf;
  
-@@ -669,10 +679,37 @@ struct mt76_testmode_data {
+@@ -657,10 +667,37 @@ struct mt76_testmode_data {
  	u8 tx_power[4];
  	u8 tx_power_control;
  
@@ -152,7 +152,7 @@
  	u32 tx_pending;
  	u32 tx_queued;
  	u16 tx_queued_limit;
-@@ -1129,6 +1166,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
+@@ -1115,6 +1152,59 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
  #endif
  }
  
@@ -212,7 +212,7 @@
  static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  					struct sk_buff *skb,
  					struct ieee80211_hw **hw)
-@@ -1139,7 +1229,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
+@@ -1125,7 +1215,8 @@ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
  	for (i = 0; i < ARRAY_SIZE(dev->phys); i++) {
  		struct mt76_phy *phy = dev->phys[i];
  
@@ -222,7 +222,7 @@
  			*hw = dev->phys[i]->hw;
  			return true;
  		}
-@@ -1240,7 +1331,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1226,7 +1317,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
  		       struct netlink_callback *cb, void *data, int len);
  int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
@@ -233,7 +233,7 @@
  static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
  {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index c1ed9fef..36a2914e 100644
+index be2a2de..01561a5 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -393,6 +393,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
@@ -255,7 +255,7 @@
  		return;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 9fb75e6e..9b9878ac 100644
+index 01035b2..a60965a 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -975,6 +975,7 @@ enum {
@@ -266,7 +266,7 @@
  	MCU_EXT_EVENT_RDD_REPORT = 0x3a,
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
-@@ -1152,6 +1153,7 @@ enum {
+@@ -1153,6 +1154,7 @@ enum {
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
@@ -275,7 +275,7 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 141c5ad8..538ff5c3 100644
+index d83ba2b..6833bbf 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -576,7 +576,7 @@ static void mt7915_init_work(struct work_struct *work)
@@ -288,7 +288,7 @@
  	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index d44af409..471d533b 100644
+index cac296e..d798ec8 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -565,16 +565,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
@@ -352,7 +352,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 5b25604e..ff9fd19d 100644
+index 98dce0f..0a5a4b3 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -224,7 +224,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
@@ -365,7 +365,7 @@
  		mvif->mt76.wmm_idx += 2;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index c8c8be49..ff0e91e5 100644
+index bcecc5e..1b56635 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -434,6 +434,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -406,7 +406,7 @@
  
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 0a77ad0d..ad85e56c 100644
+index 0a77ad0..ad85e56 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -8,10 +8,15 @@
@@ -463,10 +463,10 @@
  
  enum {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index fd2f70e3..088c9f3e 100644
+index 2e73bd7..1eda361 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -76,6 +76,7 @@ static const u32 mt7915_offs[] = {
+@@ -85,6 +85,7 @@ static const u32 mt7915_offs[] = {
  	[ARB_DRNGR0]		= 0x194,
  	[ARB_SCR]		= 0x080,
  	[RMAC_MIB_AIRTIME14]	= 0x3b8,
@@ -474,7 +474,7 @@
  	[AGG_AWSCR0]		= 0x05c,
  	[AGG_PCR0]		= 0x06c,
  	[AGG_ACR0]		= 0x084,
-@@ -151,6 +152,7 @@ static const u32 mt7916_offs[] = {
+@@ -160,6 +161,7 @@ static const u32 mt7916_offs[] = {
  	[ARB_DRNGR0]		= 0x1e0,
  	[ARB_SCR]		= 0x000,
  	[RMAC_MIB_AIRTIME14]	= 0x0398,
@@ -483,7 +483,7 @@
  	[AGG_PCR0]		= 0x040,
  	[AGG_ACR0]		= 0x054,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index e8feba36..798c9337 100644
+index 6868813..3bfec8f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -301,6 +301,9 @@ struct mt7915_phy {
@@ -529,10 +529,10 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index e2b0ff7d..d7f71033 100644
+index 3f283a8..8fd2f69 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -45,6 +45,7 @@ enum offs_rev {
+@@ -47,6 +47,7 @@ enum offs_rev {
  	ARB_DRNGR0,
  	ARB_SCR,
  	RMAC_MIB_AIRTIME14,
@@ -540,7 +540,7 @@
  	AGG_AWSCR0,
  	AGG_PCR0,
  	AGG_ACR0,
-@@ -462,6 +463,8 @@ enum offs_rev {
+@@ -464,6 +465,8 @@ enum offs_rev {
  #define MT_WF_AGG_BASE(_band)		((_band) ? 0x820f2000 : 0x820e2000)
  #define MT_WF_AGG(_band, ofs)		(MT_WF_AGG_BASE(_band) + (ofs))
  
@@ -550,7 +550,7 @@
  							  (_n) * 4))
  #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 35345d35..bc4cd809 100644
+index 8d99edc..8f250db 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -9,6 +9,9 @@
@@ -1881,7 +1881,7 @@
 +	.set_eeprom = mt7915_tm_set_eeprom,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index a1c54c89..01b08e9e 100644
+index a1c54c8..01b08e9 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -4,6 +4,8 @@
@@ -2196,7 +2196,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 1d0d5d30..7a9ed543 100644
+index 1d0d5d3..7a9ed54 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -27,28 +27,16 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -2663,7 +2663,7 @@
  		a = nla_nest_start(msg, MT76_TM_ATTR_TX_POWER);
  		if (!a)
 diff --git a/testmode.h b/testmode.h
-index 89613266..57949f2b 100644
+index 8961326..57949f2 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -6,6 +6,8 @@
@@ -2768,7 +2768,7 @@
 +
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
-index e3f69089..6e36ab27 100644
+index e3f6908..6e36ab2 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
@@ -2894,7 +2894,7 @@
  };
  
 diff --git a/tx.c b/tx.c
-index 65e2b7c1..8b33186b 100644
+index 65e2b7c..8b33186 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -245,8 +245,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
@@ -2908,5 +2908,5 @@
  			wake_up(&dev->tx_wait);
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-testmode-add-pre-cal-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-testmode-add-pre-cal-support.patch
index 6d942c4..9ccd494 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-testmode-add-pre-cal-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-testmode-add-pre-cal-support.patch
@@ -1,4 +1,4 @@
-From a000ed0273b915b24a5fe83b19b85b8a9f8a45ef Mon Sep 17 00:00:00 2001
+From a87d889131d6a636ebae5e0a51c90ded201d7e6e Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 31 Aug 2022 20:06:52 +0800
 Subject: [PATCH 1112/1124] mt76: testmode: add pre-cal support
@@ -20,7 +20,7 @@
  11 files changed, 562 insertions(+), 13 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 25f67760..4c50bfe6 100644
+index 25f6776..4c50bfe 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -89,8 +89,10 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
@@ -37,10 +37,10 @@
  
  out_put_node:
 diff --git a/mt76.h b/mt76.h
-index 0e4eea16..b28fe32f 100644
+index c4cdb4b..3ca449f 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -637,6 +637,7 @@ struct mt76_testmode_ops {
+@@ -625,6 +625,7 @@ struct mt76_testmode_ops {
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
  	int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
@@ -49,7 +49,7 @@
  
  struct mt76_testmode_entry_data {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 9b9878ac..cb06827c 100644
+index a60965a..b14f931 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -971,6 +971,7 @@ enum {
@@ -61,7 +61,7 @@
  	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index 7578ac6d..b980342c 100644
+index f3e5681..88aaa16 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -39,10 +39,18 @@ enum mt7915_eeprom_field {
@@ -86,7 +86,7 @@
  
  #define MT_EE_WIFI_CONF0_TX_PATH		GENMASK(2, 0)
  #define MT_EE_WIFI_CONF0_BAND_SEL		GENMASK(7, 6)
-@@ -160,6 +168,26 @@ mt7915_tssi_enabled(struct mt7915_dev *dev, enum nl80211_band band)
+@@ -155,6 +163,26 @@ mt7915_tssi_enabled(struct mt7915_dev *dev, enum nl80211_band band)
  		return val & MT_EE_WIFI_CONF7_TSSI0_5G;
  }
  
@@ -114,7 +114,7 @@
  
  #endif
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index ff0e91e5..d7e6df50 100644
+index 1b56635..34ce7d6 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -438,6 +438,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -169,7 +169,7 @@
  
  	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 798c9337..dfef078b 100644
+index 3bfec8f..f3bbdba 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -379,6 +379,10 @@ struct mt7915_dev {
@@ -192,7 +192,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index bc4cd809..7a49608c 100644
+index 8f250db..b1ce299 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -5,6 +5,7 @@
@@ -666,7 +666,7 @@
 +	.dump_precal = mt7915_tm_dump_precal,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 01b08e9e..d500987d 100644
+index 01b08e9..d500987 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -81,6 +81,11 @@ struct tm_tx_cont {
@@ -734,7 +734,7 @@
  	TAM_ARB_OP_MODE_NORMAL = 1,
  	TAM_ARB_OP_MODE_TEST,
 diff --git a/testmode.c b/testmode.c
-index 7a9ed543..82b8e983 100644
+index 7a9ed54..82b8e98 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -763,6 +763,18 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
@@ -767,7 +767,7 @@
  
  	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
 diff --git a/testmode.h b/testmode.h
-index 57949f2b..e2190e72 100644
+index 57949f2..e2190e7 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -19,6 +19,7 @@
@@ -823,7 +823,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 6e36ab27..1be1ffd6 100644
+index 6e36ab2..1be1ffd 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -11,6 +11,14 @@ static const char * const testmode_state[] = {
@@ -842,5 +842,5 @@
  
  static const char * const testmode_tx_mode[] = {
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch
index 7f8b21b..49562c9 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1113-mt76-testmode-add-iBF-command-mode-support.patch
@@ -1,4 +1,4 @@
-From eefd860e1bf33fd7a222a999a8cb8eb631150952 Mon Sep 17 00:00:00 2001
+From a5f91f701b6389e793b4c705ddd39631d18cdd80 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 12 Sep 2022 18:16:54 +0800
 Subject: [PATCH 1113/1124] mt76: testmode: add iBF command mode support
@@ -13,7 +13,7 @@
  4 files changed, 85 insertions(+), 7 deletions(-)
 
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 7a49608c..0a58ad97 100644
+index b1ce299..f735ed6 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -701,6 +701,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
@@ -105,7 +105,7 @@
  		mt7915_tm_set_tx_len(phy, tx_time);
  
 diff --git a/testmode.c b/testmode.c
-index 82b8e983..aa874a83 100644
+index 82b8e98..aa874a8 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -530,6 +530,42 @@ out:
@@ -164,7 +164,7 @@
  		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
  			if (nla_len(cur) != 2 ||
 diff --git a/testmode.h b/testmode.h
-index e2190e72..5d1fe793 100644
+index e2190e7..5d1fe79 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -281,8 +281,10 @@ enum mt76_testmode_txbf_act {
@@ -179,7 +179,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 1be1ffd6..47fc69f9 100644
+index 1be1ffd..47fc69f 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -32,6 +32,20 @@ static const char * const testmode_tx_mode[] = {
@@ -239,5 +239,5 @@
  
  const struct tm_field msg_field = {
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index d5857d7..94e28d2 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,4 +1,4 @@
-From fbf7d08a95e8138cb192543bbb275d4504797e66 Mon Sep 17 00:00:00 2001
+From ae8372c6fb4b5344218a8b724ed9caeea1bd4dcc Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
 Subject: [PATCH 1114/1124] mt76: mt7915: init rssi in WTBL when add station
@@ -8,7 +8,7 @@
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index ff9fd19d..ba1b3e4b 100644
+index 0a5a4b3..fdbf1ee 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -666,6 +666,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -30,5 +30,5 @@
  	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
  #endif
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1115-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1115-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
index fb89274..f808c1e 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1115-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1115-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
@@ -1,4 +1,4 @@
-From e39367c6182ae57baa2ff67b69535d0754c650ef Mon Sep 17 00:00:00 2001
+From 1a023afd7dd2ff4820f056de4d60ac019b1f72e7 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 4 Aug 2022 14:08:11 +0800
 Subject: [PATCH 1115/1124] mt76: mt7915: reduce TWT SP sent to FW for cert
@@ -11,7 +11,7 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d7e6df50..431dd37f 100644
+index 34ce7d6..b6733b1 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -3558,7 +3558,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
@@ -24,5 +24,5 @@
  		.start_tsf = cpu_to_le64(flow->tsf),
  		.mantissa = flow->mantissa,
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1116-mt76-airtime-fairness-feature-off-in-mac80211.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1116-mt76-airtime-fairness-feature-off-in-mac80211.patch
index c4c820a..25a32e0 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1116-mt76-airtime-fairness-feature-off-in-mac80211.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1116-mt76-airtime-fairness-feature-off-in-mac80211.patch
@@ -1,4 +1,4 @@
-From 4ae7e72fc778ee60267520bec667967e8a47f68b Mon Sep 17 00:00:00 2001
+From eb09887134c11a820556064ad6d18c21e06fc6ab Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
 Subject: [PATCH 1116/1124] mt76: airtime fairness feature off in mac80211
@@ -8,7 +8,7 @@
  1 file changed, 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index f34a93e0..4eaf317b 100644
+index 454f449..b7c1b13 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -429,7 +429,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
@@ -20,5 +20,5 @@
  
  	wiphy->available_antennas_tx = phy->antenna_mask;
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1117-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1117-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
index c1b5440..7598dc0 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1117-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1117-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
@@ -1,4 +1,4 @@
-From 5c423096aae12eb90d5959f43f3286004f4fb97f Mon Sep 17 00:00:00 2001
+From 63804504dd96a01005b6a2b828bcfe76c42d6b2a Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 20 May 2022 19:19:25 +0800
 Subject: [PATCH 1117/1124] mt76: mt7915: add mt7986 and mt7916 pre-calibration
@@ -15,7 +15,7 @@
  3 files changed, 62 insertions(+), 26 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 4b1a9811..ee3049e5 100644
+index e2482c6..d58a320 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -9,23 +9,22 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
@@ -50,7 +50,7 @@
  
  static int mt7915_check_eeprom(struct mt7915_dev *dev)
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index b980342c..fb9fbfe2 100644
+index 88aaa16..fdae347 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -19,6 +19,7 @@ enum mt7915_eeprom_field {
@@ -62,7 +62,7 @@
  	MT_EE_RATE_DELTA_5G =	0x29d,
  	MT_EE_TX0_POWER_2G =	0x2fc,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 431dd37f..f649bcaf 100644
+index b6733b1..69a266f 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2928,7 +2928,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
@@ -198,5 +198,5 @@
  
  	return 0;
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1118-mt76-mt7915-add-phy-capability-vendor-command.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1118-mt76-mt7915-add-phy-capability-vendor-command.patch
index 178c694..53c6a9b 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1118-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1118-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,4 +1,4 @@
-From 119142ef3be4457a975d7ca109e44bfac5bed444 Mon Sep 17 00:00:00 2001
+From 6debaa3030b494e9a0179ad5acacf046f037858a Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Tue, 12 Jul 2022 10:04:35 -0700
 Subject: [PATCH 1118/1124] mt76: mt7915: add phy capability vendor command
@@ -10,7 +10,7 @@
  3 files changed, 78 insertions(+)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index dfef078b..432f0b8a 100644
+index f3bbdba..bd20e7c 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -11,6 +11,7 @@
@@ -22,7 +22,7 @@
  #define MT7916_WTBL_SIZE		544
  #define MT7915_WTBL_RESERVED		(mt7915_wtbl_size(dev) - 1)
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index c7551848..77d71e48 100644
+index c755184..77d71e4 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -50,6 +50,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
@@ -99,7 +99,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index a8e4ebf9..719b851f 100644
+index a8e4ebf..719b851 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -9,6 +9,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -140,5 +140,5 @@
 +
  #endif
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1119-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1119-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
index 9bdd9f6..7eb811e 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1119-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1119-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl.patch
@@ -1,7 +1,7 @@
-From e5d1346bdc27c267911ec5d2a6815350c43cccb8 Mon Sep 17 00:00:00 2001
+From ef7f1097ad31dc69e3e5d0893ef5713f6af98a44 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH] mt76: mt7915: add vendor subcmd EDCCA ctrl
+Subject: [PATCH 1119/1124] mt76: mt7915: add vendor subcmd EDCCA ctrl
 
 Change-Id: I92dabf8be9c5a7ecec78f35325bc5645af8d15ab
 ---
@@ -15,7 +15,7 @@
  7 files changed, 138 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index b14f931b..6143d8e4 100644
+index b14f931..6143d8e 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1157,6 +1157,7 @@ enum {
@@ -27,7 +27,7 @@
  };
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 85e9cd60..bad0fe1e 100644
+index fdbf1ee..80f4d9d 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -456,6 +456,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
@@ -41,7 +41,7 @@
  		ret = mt7915_set_channel(phy);
  		if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 6d67e9e1..523cc6da 100644
+index 69a266f..8dcc54e 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -4272,3 +4272,41 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
@@ -87,7 +87,7 @@
 +	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCCA), &req, sizeof(req), true);
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index ad85e56c..b8a433e5 100644
+index ad85e56..b8a433e 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -789,4 +789,16 @@ enum {
@@ -108,10 +108,10 @@
 +};
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b750660d..a5abcc56 100644
+index bd20e7c..1b08686 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -723,6 +723,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -725,6 +725,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
@@ -121,7 +121,7 @@
  #ifdef MTK_DEBUG
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 77d71e48..5a28a554 100644
+index 77d71e4..5a28a55 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -62,6 +62,17 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
@@ -209,7 +209,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 719b851f..83c41bc1 100644
+index 719b851..83c41bc 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -10,8 +10,27 @@ enum mtk_nl80211_vendor_subcmds {
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1120-mt76-mt7915-implement-bin-file-mode.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1120-mt76-mt7915-implement-bin-file-mode.patch
index afd47c2..73a117a 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1120-mt76-mt7915-implement-bin-file-mode.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1120-mt76-mt7915-implement-bin-file-mode.patch
@@ -1,4 +1,4 @@
-From 79ddf246652c86dbda37aa94526497b791ec8246 Mon Sep 17 00:00:00 2001
+From 09763f3753bb13ed2d754440295a459f6bb743c3 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 7 Jul 2022 11:09:59 +0800
 Subject: [PATCH 1120/1124] mt76: mt7915: implement bin file mode
@@ -13,7 +13,7 @@
  4 files changed, 71 insertions(+), 11 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 4c50bfe6..baca86fd 100644
+index 4c50bfe..baca86f 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -104,6 +104,24 @@ out_put_node:
@@ -42,10 +42,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index b28fe32f..e997908a 100644
+index 3ca449f..e547f79 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1015,6 +1015,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+@@ -1001,6 +1001,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
  int mt76_eeprom_init(struct mt76_dev *dev, int len);
  void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
@@ -54,7 +54,7 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index ee3049e5..e5cfa5b0 100644
+index d58a320..632ecc7 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -46,26 +46,36 @@ static char *mt7915_eeprom_name(struct mt7915_dev *dev)
@@ -114,7 +114,7 @@
  		ret = -EINVAL;
  		goto out;
  	}
-@@ -234,12 +247,30 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+@@ -221,12 +234,30 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
  {
  	int ret;
  
@@ -148,7 +148,7 @@
  		if (ret)
  			return ret;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 439d071a..6fe3191d 100644
+index 1b08686..5fa1dfa 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -51,6 +51,15 @@
@@ -176,5 +176,5 @@
  	bool ibf;
  
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1121-mt76-mt7915-initialize-wcid.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1121-mt76-mt7915-initialize-wcid.patch
index ceead53..f5ed0a0 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1121-mt76-mt7915-initialize-wcid.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1121-mt76-mt7915-initialize-wcid.patch
@@ -1,4 +1,4 @@
-From cf4ded769fa58acd2d98f3a795bb8663456c114f Mon Sep 17 00:00:00 2001
+From bf5186ab642f733c312f6971d93934af4ec0f406 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 12 Jul 2022 13:56:07 +0800
 Subject: [PATCH 1121/1124] mt76 mt7915 initialize wcid
@@ -9,11 +9,11 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 471d533b..0631ad2c 100644
+index d798ec8..961b7af 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -965,7 +965,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
- 		 */
+@@ -967,7 +967,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+ 		info = le32_to_cpu(*cur_info);
  		if (info & MT_TX_FREE_PAIR) {
  			struct mt7915_sta *msta;
 -			struct mt76_wcid *wcid;
@@ -22,5 +22,5 @@
  
  			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1122-mt76-HEMU-Add-dump-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1122-mt76-HEMU-Add-dump-support.patch
index 0051b6a..286936e 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1122-mt76-HEMU-Add-dump-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1122-mt76-HEMU-Add-dump-support.patch
@@ -1,4 +1,4 @@
-From 7e1d446505177bebaeeac17e10f622d1f612f1e3 Mon Sep 17 00:00:00 2001
+From a56e9413d6604dcec4fe5c21f240ad8d3e82eb7b Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
 Subject: [PATCH 1122/1124] mt76: HEMU: Add dump support
@@ -10,7 +10,7 @@
  2 files changed, 27 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 5a28a554..7acb3304 100644
+index 5a28a55..7acb330 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -37,6 +37,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -61,7 +61,7 @@
  		.maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 83c41bc1..57f52f3a 100644
+index 83c41bc..57f52f3 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -58,6 +58,7 @@ enum mtk_vendor_attr_hemu_ctrl {
@@ -73,5 +73,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_HEMU_CTRL,
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
index 264fcad..c5814bd 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1123-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
@@ -1,4 +1,4 @@
-From ee8f75888527b8f7114d5ac3f946a9acd21f9aa4 Mon Sep 17 00:00:00 2001
+From c2a099c2d4c02f67232cf98ee7d4e4b241b6befc Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 30 Aug 2022 15:29:38 +0800
 Subject: [PATCH 1123/1124] mt76: mt7915: add vendor subcmd three wire (PTA)
@@ -16,10 +16,10 @@
  6 files changed, 108 insertions(+), 29 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 683d8542..4cdfadc7 100644
+index 6143d8e..27a3624 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1155,7 +1155,7 @@ enum {
+@@ -1156,7 +1156,7 @@ enum {
  	/* for vendor csi and air monitor */
  	MCU_EXT_CMD_SMESH_CTRL = 0xae,
  	MCU_EXT_CMD_RX_STAT_USER_CTRL = 0xb3,
@@ -29,7 +29,7 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7e6102b8..8d74275d 100644
+index 8dcc54e..477a41c 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -4019,37 +4019,34 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
@@ -95,7 +95,7 @@
  
  void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b8a433e5..9d0fac47 100644
+index b8a433e..9d0fac4 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -576,6 +576,35 @@ struct csi_data {
@@ -135,10 +135,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 6fe3191d..3fcedba5 100644
+index 5fa1dfa..f403820 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -725,6 +725,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
+@@ -727,6 +727,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
  void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
  int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
  void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
@@ -147,7 +147,7 @@
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 7acb3304..7f67c0d3 100644
+index 7acb330..7f67c0d 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -40,6 +40,11 @@ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
@@ -221,7 +221,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 57f52f3a..e0c5fd94 100644
+index 57f52f3..e0c5fd9 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -11,6 +11,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -251,5 +251,5 @@
  enum mtk_capi_control_changed {
  	CAPI_RFEATURE_CHANGED		= BIT(16),
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1124-mt76-add-ibf-control-vendor-cmd.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1124-mt76-add-ibf-control-vendor-cmd.patch
index d1992a2..3532752 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1124-mt76-add-ibf-control-vendor-cmd.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1124-mt76-add-ibf-control-vendor-cmd.patch
@@ -1,4 +1,4 @@
-From c0f1432186c58fd534715d347d4693660a3fa1fe Mon Sep 17 00:00:00 2001
+From 5c25234839bdbe57851bc0ea0d7946fac8458af3 Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:01:29 -0700
 Subject: [PATCH 1124/1124] mt76: add ibf control vendor cmd
@@ -10,7 +10,7 @@
  2 files changed, 94 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 7f67c0d3..cbbb0843 100644
+index 7f67c0d..cbbb084 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -78,6 +78,16 @@ edcca_ctrl_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_CTRL] = {
@@ -105,7 +105,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index e0c5fd94..5aac5595 100644
+index e0c5fd9..5aac559 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -11,7 +11,8 @@ enum mtk_nl80211_vendor_subcmds {
@@ -146,5 +146,5 @@
 +
  #endif
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3001-mt76-add-wed-tx-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3001-mt76-add-wed-tx-support.patch
index 6e4f96e..19408f7 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3001-mt76-add-wed-tx-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3001-mt76-add-wed-tx-support.patch
@@ -1,21 +1,15 @@
-From a46e93efedae595b85fec8295e16641c2de183fb Mon Sep 17 00:00:00 2001
+From 76d6af5ef0539cfa09fadf9e7dd60c015428d12d Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Sun, 12 Jun 2022 16:38:45 +0800
-Subject: [PATCH 3001/3007] mt76 add wed tx support
+Subject: [PATCH] mt76 add wed tx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
- mt76_connac.h   |   1 +
- mt7915/dma.c    |  59 +++++++++++++++++++-------
- mt7915/mac.c    |  11 +++--
- mt7915/main.c   |   9 +++-
- mt7915/mcu.c    |   2 +-
- mt7915/mmio.c   | 110 +++++++++++++++++++++++++++++++++++++++++++++++-
- mt7915/mt7915.h |   2 +
- mt7915/pci.c    |  93 +---------------------------------------
- mt7915/regs.h   |  15 +++++++
- mt7915/soc.c    |  16 +++++--
- 10 files changed, 193 insertions(+), 118 deletions(-)
+ mt76_connac.h |  1 +
+ mt7915/mac.c  | 11 +++++++----
+ mt7915/main.c |  4 ++--
+ mt7915/mmio.c | 10 +++++++++-
+ 4 files changed, 19 insertions(+), 7 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
 index 0915eb57..9a468878 100644
@@ -29,122 +23,8 @@
  
  struct mt76_connac_fw_txp {
  	__le16 flags;
-diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 4b594a53..ac30698f 100644
---- a/mt7915/dma.c
-+++ b/mt7915/dma.c
-@@ -11,7 +11,10 @@ mt7915_init_tx_queues(struct mt7915_phy *phy, int idx, int n_desc, int ring_base
- 	struct mt7915_dev *dev = phy->dev;
- 
- 	if (mtk_wed_device_active(&phy->dev->mt76.mmio.wed)) {
--		ring_base = MT_WED_TX_RING_BASE;
-+		if(!is_mt7986(&dev->mt76))
-+			ring_base = MT_WED_TX_RING_BASE;
-+		else
-+			ring_base += MT_TXQ_ID(0) * MT_RING_SIZE;
- 		idx -= MT_TXQ_ID(0);
- 	}
- 
-@@ -58,14 +61,23 @@ static void mt7915_dma_config(struct mt7915_dev *dev)
- 		MCUQ_CONFIG(MT_MCUQ_WA, WFDMA1, MT_INT_TX_DONE_MCU_WA, MT7915_TXQ_MCU_WA);
- 		MCUQ_CONFIG(MT_MCUQ_FWDL, WFDMA1, MT_INT_TX_DONE_FWDL, MT7915_TXQ_FWDL);
- 	} else {
--		RXQ_CONFIG(MT_RXQ_MAIN, WFDMA0, MT_INT_RX_DONE_BAND0_MT7916, MT7916_RXQ_BAND0);
-+		if(is_mt7916(&dev->mt76) && (mtk_wed_device_active(&dev->mt76.mmio.wed))) {
-+			RXQ_CONFIG(MT_RXQ_MAIN, WFDMA0, MT_INT_WED_RX_DONE_BAND0_MT7916, MT7916_RXQ_BAND0);
-+			RXQ_CONFIG(MT_RXQ_MCU_WA, WFDMA0, MT_INT_WED_RX_DONE_WA_MT7916, MT7916_RXQ_MCU_WA);
-+			RXQ_CONFIG(MT_RXQ_BAND1, WFDMA0, MT_INT_WED_RX_DONE_BAND1_MT7916, MT7916_RXQ_BAND1);
-+			RXQ_CONFIG(MT_RXQ_MAIN_WA, WFDMA0, MT_INT_WED_RX_DONE_WA_MAIN_MT7916, MT7916_RXQ_MCU_WA_MAIN);
-+			TXQ_CONFIG(0, WFDMA0, MT_INT_WED_TX_DONE_BAND0, MT7915_TXQ_BAND0);
-+			TXQ_CONFIG(1, WFDMA0, MT_INT_WED_TX_DONE_BAND1, MT7915_TXQ_BAND1);
-+		} else {
-+			RXQ_CONFIG(MT_RXQ_MAIN, WFDMA0, MT_INT_RX_DONE_BAND0_MT7916, MT7916_RXQ_BAND0);
-+			RXQ_CONFIG(MT_RXQ_MCU_WA, WFDMA0, MT_INT_RX_DONE_WA, MT7916_RXQ_MCU_WA);
-+			RXQ_CONFIG(MT_RXQ_BAND1, WFDMA0, MT_INT_RX_DONE_BAND1_MT7916, MT7916_RXQ_BAND1);
-+			RXQ_CONFIG(MT_RXQ_MAIN_WA, WFDMA0, MT_INT_RX_DONE_WA_MAIN_MT7916, MT7916_RXQ_MCU_WA_MAIN);
-+			TXQ_CONFIG(0, WFDMA0, MT_INT_TX_DONE_BAND0, MT7915_TXQ_BAND0);
-+			TXQ_CONFIG(1, WFDMA0, MT_INT_TX_DONE_BAND1, MT7915_TXQ_BAND1);
-+		}
- 		RXQ_CONFIG(MT_RXQ_MCU, WFDMA0, MT_INT_RX_DONE_WM, MT7916_RXQ_MCU_WM);
--		RXQ_CONFIG(MT_RXQ_MCU_WA, WFDMA0, MT_INT_RX_DONE_WA, MT7916_RXQ_MCU_WA);
--		RXQ_CONFIG(MT_RXQ_BAND1, WFDMA0, MT_INT_RX_DONE_BAND1_MT7916, MT7916_RXQ_BAND1);
- 		RXQ_CONFIG(MT_RXQ_BAND1_WA, WFDMA0, MT_INT_RX_DONE_WA_EXT_MT7916, MT7916_RXQ_MCU_WA_EXT);
--		RXQ_CONFIG(MT_RXQ_MAIN_WA, WFDMA0, MT_INT_RX_DONE_WA_MAIN_MT7916, MT7916_RXQ_MCU_WA_MAIN);
--		TXQ_CONFIG(0, WFDMA0, MT_INT_TX_DONE_BAND0, MT7915_TXQ_BAND0);
--		TXQ_CONFIG(1, WFDMA0, MT_INT_TX_DONE_BAND1, MT7915_TXQ_BAND1);
- 		MCUQ_CONFIG(MT_MCUQ_WM, WFDMA0, MT_INT_TX_DONE_MCU_WM, MT7915_TXQ_MCU_WM);
- 		MCUQ_CONFIG(MT_MCUQ_WA, WFDMA0, MT_INT_TX_DONE_MCU_WA_MT7916, MT7915_TXQ_MCU_WA);
- 		MCUQ_CONFIG(MT_MCUQ_FWDL, WFDMA0, MT_INT_TX_DONE_FWDL, MT7915_TXQ_FWDL);
-@@ -323,7 +335,9 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
- 		u32 wed_irq_mask = irq_mask;
- 
- 		wed_irq_mask |= MT_INT_TX_DONE_BAND0 | MT_INT_TX_DONE_BAND1;
--		mt76_wr(dev, MT_INT_WED_MASK_CSR, wed_irq_mask);
-+		if (!is_mt7986(&dev->mt76))
-+			mt76_wr(dev, MT_INT_WED_MASK_CSR, wed_irq_mask);
-+		mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
- 		mtk_wed_device_start(&dev->mt76.mmio.wed, wed_irq_mask);
- 	}
- 
-@@ -348,15 +362,19 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 
- 	mt7915_dma_disable(dev, true);
- 
--	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
-+	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && !is_mt7986(mdev)) {
- 		mt76_set(dev, MT_WFDMA_HOST_CONFIG, MT_WFDMA_HOST_CONFIG_WED);
--
-+		if(is_mt7915(mdev)) {
- 		mt76_wr(dev, MT_WFDMA_WED_RING_CONTROL,
- 			FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX0, 18) |
- 			FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX1, 19) |
- 			FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_RX1, 1));
--	} else {
--		mt76_clear(dev, MT_WFDMA_HOST_CONFIG, MT_WFDMA_HOST_CONFIG_WED);
-+		} else {
-+			mt76_wr(dev, MT_WFDMA_WED_RING_CONTROL,
-+				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX0, 18) |
-+				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX1, 19) |
-+				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_RX1, 2));
-+		}
- 	}
- 
- 	/* init tx queue */
-@@ -410,7 +428,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 		return ret;
- 
- 	/* event from WA */
--	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
-+	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && is_mt7915(mdev)) {
- 		wa_rx_base = MT_WED_RX_RING_BASE;
- 		wa_rx_idx = MT7915_RXQ_MCU_WA;
- 		dev->mt76.q_rx[MT_RXQ_MCU_WA].flags = MT_WED_Q_TXFREE;
-@@ -437,11 +455,20 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 
- 	/* tx free notify event from WA for band0 */
- 	if (!is_mt7915(mdev)) {
-+		wa_rx_base = MT_RXQ_RING_BASE(MT_RXQ_MAIN_WA);
-+		wa_rx_idx = MT_RXQ_ID(MT_RXQ_MAIN_WA);
-+
-+		if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
-+			dev->mt76.q_rx[MT_RXQ_MAIN_WA].flags = MT_WED_Q_TXFREE;
-+			if (is_mt7916(mdev)) {
-+				wa_rx_base =  MT_WED_RX_RING_BASE;
-+				wa_rx_idx = MT7915_RXQ_MCU_WA;
-+			}
-+		}
- 		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_MAIN_WA],
--				       MT_RXQ_ID(MT_RXQ_MAIN_WA),
-+				       wa_rx_idx,
- 				       MT7915_RX_MCU_RING_SIZE,
--				       MT_RX_BUF_SIZE,
--				       MT_RXQ_RING_BASE(MT_RXQ_MAIN_WA));
-+				       MT_RX_BUF_SIZE, wa_rx_base);
- 		if (ret)
- 			return ret;
- 	}
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 0631ad2c..b1788fb8 100644
+index 961b7afc..65e47f95 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -826,9 +826,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
@@ -167,13 +47,13 @@
  	u16 total, count = 0;
  	u32 txd = le32_to_cpu(free->txd);
  	__le32 *cur_info;
-@@ -997,12 +998,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -999,12 +1000,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  			txwi = mt76_token_release(mdev, msdu, &wake);
  			if (!txwi)
  				continue;
 +			else
 +				with_txwi = false;
-
+ 
  			mt7915_txwi_free(dev, txwi, sta, &free_list);
  		}
  	}
@@ -182,13 +62,13 @@
 +	if (!with_txwi)
 +		mt7915_mac_tx_free_done(dev, &free_list, wake);
  }
-
+ 
  static void
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 192b0a9b..3a09f3f5 100644
+index 80f4d9dd..4e915279 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1456,14 +1456,19 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1457,14 +1457,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
  
@@ -200,390 +80,64 @@
  	path->dev = ctx->dev;
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
  	path->mtk_wdma.bss = mvif->mt76.idx;
--	path->mtk_wdma.wcid = msta->wcid.idx;
-+	/* fw will find the wcid by dest addr */
-+	if(is_mt7915(&dev->mt76))
-+		path->mtk_wdma.wcid = 0xff;
-+	else
-+		path->mtk_wdma.wcid = 0x3ff;
-+
+-	path->mtk_wdma.wcid = is_mt7915(&dev->mt76) ? msta->wcid.idx : 0x3ff;
++	path->mtk_wdma.wcid = is_mt7915(&dev->mt76) ? 0xff : 0x3ff;
  	path->mtk_wdma.queue = phy != &dev->phy;
  
  	ctx->dev = NULL;
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 8d74275d..f5caa326 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -2379,7 +2379,7 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
- 	if (ret)
- 		return ret;
- 
--	if (mtk_wed_device_active(&dev->mt76.mmio.wed))
-+	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && is_mt7915(&dev->mt76))
- 		mt7915_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(CAPABILITY), 0, 0, 0);
- 
- 	ret = mt7915_mcu_set_mwds(dev, 1);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 088c9f3e..11c90772 100644
+index 1eda361f..0b37f1b3 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -10,6 +10,9 @@
+@@ -10,7 +10,7 @@
  #include "mac.h"
  #include "../trace.h"
  
+-static bool wed_enable;
 +static bool wed_enable = true;
-+module_param(wed_enable, bool, 0644);
-+
- static const u32 mt7915_reg[] = {
- 	[INT_SOURCE_CSR]	= 0xd7010,
- 	[INT_MASK_CSR]		= 0xd7014,
-@@ -543,7 +546,11 @@ void mt7915_dual_hif_set_irq_mask(struct mt7915_dev *dev,
- 	mdev->mmio.irqmask |= set;
+ module_param(wed_enable, bool, 0644);
  
- 	if (write_reg) {
--		mt76_wr(dev, MT_INT_MASK_CSR, mdev->mmio.irqmask);
-+		if (mtk_wed_device_active(&mdev->mmio.wed))
-+			mtk_wed_device_irq_set_mask(&mdev->mmio.wed,
-+						    mdev->mmio.irqmask);
-+		else
-+			mt76_wr(dev, MT_INT_MASK_CSR, mdev->mmio.irqmask);
- 		mt76_wr(dev, MT_INT1_MASK_CSR, mdev->mmio.irqmask);
- 	}
- 
-@@ -567,6 +574,8 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
+ static const u32 mt7915_reg[] = {
+@@ -556,6 +556,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  
- 	if (mtk_wed_device_active(wed)) {
- 		mtk_wed_device_irq_set_mask(wed, 0);
-+		if (dev->hif2)
-+			mt76_wr(dev, MT_INT1_MASK_CSR, 0);
- 		intr = mtk_wed_device_irq_get(wed, dev->mt76.mmio.irqmask);
+ 		wed->wlan.pci_dev = pci_dev;
+ 		wed->wlan.bus_type = MTK_WED_BUS_PCIE;
++		wed->wlan.base = (void __iomem *)ioremap(
++				 pci_resource_start(pci_dev, 0),
++				 pci_resource_len(pci_dev, 0));
+ 		wed->wlan.wpdma_int = pci_resource_start(pci_dev, 0) +
+ 				      MT_INT_WED_SOURCE_CSR;
+ 		wed->wlan.wpdma_mask = pci_resource_start(pci_dev, 0) +
+@@ -566,6 +569,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 				     MT_TXQ_WED_RING_BASE;
+ 		wed->wlan.wpdma_txfree = pci_resource_start(pci_dev, 0) +
+ 					 MT_RXQ_WED_RING_BASE;
++		wed->wlan.phy_base = pci_resource_start(pci_dev, 0);
  	} else {
- 		mt76_wr(dev, MT_INT_MASK_CSR, 0);
-@@ -648,6 +657,105 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
- 	return IRQ_HANDLED;
- }
+ 		struct platform_device *plat_dev = pdev_ptr;
+ 		struct resource *res;
+@@ -576,10 +580,13 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  
-+#ifdef CONFIG_NET_MEDIATEK_SOC_WED
-+static int mt7915_wed_offload_enable(struct mtk_wed_device *wed)
-+{
-+	struct mt7915_dev *dev;
-+	int ret;
-+
-+	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+
-+	spin_lock_bh(&dev->mt76.token_lock);
-+	dev->mt76.token_size = wed->wlan.token_start;
-+	spin_unlock_bh(&dev->mt76.token_lock);
-+
-+	ret = wait_event_timeout(dev->mt76.tx_wait,
-+				 !dev->mt76.wed_token_count, HZ);
-+	if (!ret)
-+		return -EAGAIN;
-+
-+	return 0;
-+}
-+
-+static void mt7915_wed_offload_disable(struct mtk_wed_device *wed)
-+{
-+	struct mt7915_dev *dev;
-+
-+	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-+
-+	spin_lock_bh(&dev->mt76.token_lock);
-+	dev->mt76.token_size = wed->wlan.token_start;//MT7915_TOKEN_SIZE;
-+	spin_unlock_bh(&dev->mt76.token_lock);
-+}
-+#endif
-+
-+int
-+mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
-+{
-+#ifdef CONFIG_NET_MEDIATEK_SOC_WED
-+	struct mt76_dev *mdev = &dev->mt76;
-+	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
-+	u32 base;
-+	int ret;
-+
-+	if (!wed_enable)
-+		return 0;
-+
-+	if (dev_is_pci(pdev)) {
-+		struct pci_dev *pci_dev;
-+
-+		pci_dev = container_of(pdev, struct pci_dev, dev);
-+		base = pci_resource_start(pci_dev, 0);
-+		wed->wlan.base = (void __iomem *)ioremap(base, pci_resource_len(pci_dev, 0));
-+
-+		wed->wlan.pci_dev = pci_dev;
-+		wed->wlan.bus_type = MTK_BUS_TYPE_PCIE;
-+		wed->wlan.wpdma_int = base + MT_INT_WED_SOURCE_CSR;
-+		wed->wlan.wpdma_mask = base + MT_INT_WED_MASK_CSR;
-+	} else {
-+		struct platform_device *plat_dev;
-+		struct resource *res;
-+
-+		plat_dev = to_platform_device(pdev);
-+		res = platform_get_resource(plat_dev, IORESOURCE_MEM, 0);
-+		base = res->start;
-+		wed->wlan.base = (void __iomem *)ioremap(base, resource_size(res));
-+		wed->wlan.bus_type = MTK_BUS_TYPE_AXI;
-+		wed->wlan.wpdma_int = base + MT_INT_SOURCE_CSR;
-+		wed->wlan.wpdma_mask = base + MT_INT_MASK_CSR;
-+	}
-+	wed->wlan.wpdma_tx = base + MT_TXQ_WED_RING_BASE;
-+	wed->wlan.wpdma_txfree = base + MT_RXQ_WED_RING_BASE;
-+
-+	wed->wlan.tx_tbit[0] = MT_WED_TX_DONE_BAND0;
-+	wed->wlan.tx_tbit[1] = MT_WED_TX_DONE_BAND1;
-+	wed->wlan.txfree_tbit = MT_WED_TX_FREE_DONE;
-+	wed->wlan.nbuf = 7168;
-+	wed->wlan.token_start = MT7915_TOKEN_SIZE - wed->wlan.nbuf;
-+	wed->wlan.init_buf = mt7915_wed_init_buf;
-+	/* disable dynamic tx token */
-+	wed->wlan.offload_enable = mt7915_wed_offload_enable;
-+	wed->wlan.offload_disable = mt7915_wed_offload_disable;
-+
-+	if (mtk_wed_device_attach(wed) != 0)
-+		return 0;
-+
-+	if (wed->ver == MTK_WED_V1)
-+		wed->wlan.wpdma_phys = base + MT_WFDMA_EXT_CSR_BASE;
-+
-+	*irq = wed->irq;
-+	dev->mt76.dma_dev = wed->dev;
-+	mdev->token_size = wed->wlan.token_start;
-+	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
-+	if (ret)
-+		return ret;
-+
-+	return 1;
-+#else
-+	return 0;
-+#endif
-+}
-+
- struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
- 				     void __iomem *mem_base, u32 device_id)
- {
-diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 3fcedba5..1c78b882 100644
---- a/mt7915/mt7915.h
-+++ b/mt7915/mt7915.h
-@@ -534,6 +534,8 @@ static inline void mt7986_wmac_disable(struct mt7915_dev *dev)
- {
- }
- #endif
-+int mt7915_pci_wed_init(struct mt7915_dev *dev,
-+			struct device *pdev, int *irq);
- struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
- 				     void __iomem *mem_base, u32 device_id);
- void mt7915_wfsys_reset(struct mt7915_dev *dev);
-diff --git a/mt7915/pci.c b/mt7915/pci.c
-index 728a879c..c5da01a9 100644
---- a/mt7915/pci.c
-+++ b/mt7915/pci.c
-@@ -12,9 +12,6 @@
- #include "mac.h"
- #include "../trace.h"
- 
--static bool wed_enable = false;
--module_param(wed_enable, bool, 0644);
--
- static LIST_HEAD(hif_list);
- static DEFINE_SPINLOCK(hif_lock);
- static u32 hif_idx;
-@@ -95,94 +92,6 @@ static int mt7915_pci_hif2_probe(struct pci_dev *pdev)
- 	return 0;
- }
- 
--#ifdef CONFIG_NET_MEDIATEK_SOC_WED
--static int mt7915_wed_offload_enable(struct mtk_wed_device *wed)
--{
--	struct mt7915_dev *dev;
--	struct mt7915_phy *phy;
--	int ret;
--
--	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
--
--	spin_lock_bh(&dev->mt76.token_lock);
--	dev->mt76.token_size = wed->wlan.token_start;
--	spin_unlock_bh(&dev->mt76.token_lock);
--
--	ret = wait_event_timeout(dev->mt76.tx_wait,
--				 !dev->mt76.wed_token_count, HZ);
--	if (!ret)
--		return -EAGAIN;
--
--	phy = &dev->phy;
--	mt76_set(dev, MT_AGG_ACR4(phy->band_idx), MT_AGG_ACR_PPDU_TXS2H);
--
--	phy = dev->mt76.phys[MT_BAND1] ? dev->mt76.phys[MT_BAND1]->priv : NULL;
--	if (phy)
--		mt76_set(dev, MT_AGG_ACR4(phy->band_idx),
--			 MT_AGG_ACR_PPDU_TXS2H);
--
--	return 0;
--}
--
--static void mt7915_wed_offload_disable(struct mtk_wed_device *wed)
--{
--	struct mt7915_dev *dev;
--	struct mt7915_phy *phy;
--
--	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
--
--	spin_lock_bh(&dev->mt76.token_lock);
--	dev->mt76.token_size = MT7915_TOKEN_SIZE;
--	spin_unlock_bh(&dev->mt76.token_lock);
--
--	/* MT_TXD5_TX_STATUS_HOST (MPDU format) has higher priority than
--	 * MT_AGG_ACR_PPDU_TXS2H (PPDU format) even though ACR bit is set.
--	 */
--	phy = &dev->phy;
--	mt76_clear(dev, MT_AGG_ACR4(phy->band_idx), MT_AGG_ACR_PPDU_TXS2H);
--
--	phy = dev->mt76.phys[MT_BAND1] ? dev->mt76.phys[MT_BAND1]->priv : NULL;
--	if (phy)
--		mt76_clear(dev, MT_AGG_ACR4(phy->band_idx),
--			   MT_AGG_ACR_PPDU_TXS2H);
--}
--#endif
--
--static int
--mt7915_pci_wed_init(struct mt7915_dev *dev, struct pci_dev *pdev, int *irq)
--{
--#ifdef CONFIG_NET_MEDIATEK_SOC_WED
--	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
--	int ret;
--
--	if (!wed_enable)
--		return 0;
--
--	wed->wlan.pci_dev = pdev;
--	wed->wlan.wpdma_phys = pci_resource_start(pdev, 0) +
--			       MT_WFDMA_EXT_CSR_BASE;
--	wed->wlan.nbuf = 4096;
--	wed->wlan.token_start = MT7915_TOKEN_SIZE - wed->wlan.nbuf;
--	wed->wlan.init_buf = mt7915_wed_init_buf;
--	wed->wlan.offload_enable = mt7915_wed_offload_enable;
--	wed->wlan.offload_disable = mt7915_wed_offload_disable;
--
--	if (mtk_wed_device_attach(wed) != 0)
--		return 0;
--
--	*irq = wed->irq;
--	dev->mt76.dma_dev = wed->dev;
--
--	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
--	if (ret)
--		return ret;
--
--	return 1;
--#else
--	return 0;
--#endif
--}
--
- static int mt7915_pci_probe(struct pci_dev *pdev,
- 			    const struct pci_device_id *id)
- {
-@@ -220,7 +129,7 @@ static int mt7915_pci_probe(struct pci_dev *pdev,
- 	mt7915_wfsys_reset(dev);
- 	hif2 = mt7915_pci_init_hif2(pdev);
- 
--	ret = mt7915_pci_wed_init(dev, pdev, &irq);
-+	ret = mt7915_pci_wed_init(dev, &pdev->dev, &irq);
- 	if (ret < 0)
- 		goto free_wed_or_irq_vector;
- 
-diff --git a/mt7915/regs.h b/mt7915/regs.h
-index d7f71033..51eb553c 100644
---- a/mt7915/regs.h
-+++ b/mt7915/regs.h
-@@ -621,6 +621,7 @@ enum offs_rev {
- #define MT_PCIE_RECOG_ID_MASK		GENMASK(30, 0)
- #define MT_PCIE_RECOG_ID_SEM		BIT(31)
- 
-+#define MT_INT_WED_SOURCE_CSR		MT_WFDMA_EXT_CSR(0x200)
- #define MT_INT_WED_MASK_CSR		MT_WFDMA_EXT_CSR(0x204)
- 
- #define MT_WED_TX_RING_BASE		MT_WFDMA_EXT_CSR(0x300)
-@@ -667,6 +668,13 @@ enum offs_rev {
- #define MT_TXQ_EXT_CTRL(q)		(MT_Q_BASE(__TXQ(q)) + 0x600 +	\
- 					 MT_TXQ_ID(q)* 0x4)
- 
-+#define MT_TXQ_WED_RING_BASE		(!is_mt7986(mdev)? 0xd7300 : 0x24420)
-+#define MT_RXQ_WED_RING_BASE		(!is_mt7986(mdev)? 0xd7410 : 0x24520)
-+
-+#define MT_WED_TX_DONE_BAND0		(is_mt7915(mdev)? 4 : 30)
-+#define MT_WED_TX_DONE_BAND1		(is_mt7915(mdev)? 5 : 31)
-+#define MT_WED_TX_FREE_DONE		(is_mt7915(mdev)? 1 : 2)
-+
- #define MT_INT_SOURCE_CSR		__REG(INT_SOURCE_CSR)
- #define MT_INT_MASK_CSR			__REG(INT_MASK_CSR)
- 
-@@ -685,6 +693,11 @@ enum offs_rev {
- #define MT_INT_RX_DONE_WA_MAIN_MT7916	BIT(2)
- #define MT_INT_RX_DONE_WA_EXT_MT7916	BIT(3)
- 
-+#define MT_INT_WED_RX_DONE_BAND0_MT7916		BIT(18)
-+#define MT_INT_WED_RX_DONE_BAND1_MT7916		BIT(19)
-+#define MT_INT_WED_RX_DONE_WA_MAIN_MT7916	BIT(1)
-+#define MT_INT_WED_RX_DONE_WA_MT7916		BIT(17)
-+
- #define MT_INT_RX(q)			(dev->q_int_mask[__RXQ(q)])
- #define MT_INT_TX_MCU(q)		(dev->q_int_mask[(q)])
- 
-@@ -708,6 +721,8 @@ enum offs_rev {
- #define MT_INT_TX_DONE_BAND0		BIT(30)
- #define MT_INT_TX_DONE_BAND1		BIT(31)
- #define MT_INT_TX_DONE_MCU_WA_MT7916	BIT(25)
-+#define MT_INT_WED_TX_DONE_BAND0	BIT(4)
-+#define MT_INT_WED_TX_DONE_BAND1	BIT(5)
- 
- #define MT_INT_TX_DONE_MCU		(MT_INT_TX_MCU(MT_MCUQ_WA) |	\
- 					 MT_INT_TX_MCU(MT_MCUQ_WM) |	\
-diff --git a/mt7915/soc.c b/mt7915/soc.c
-index 3618718d..8d0b2068 100644
---- a/mt7915/soc.c
-+++ b/mt7915/soc.c
-@@ -1171,10 +1171,6 @@ static int mt7986_wmac_probe(struct platform_device *pdev)
- 
- 	chip_id = (uintptr_t)of_device_get_match_data(&pdev->dev);
+ 		wed->wlan.platform_dev = plat_dev;
+ 		wed->wlan.bus_type = MTK_WED_BUS_AXI;
++		wed->wlan.base = (void __iomem *)ioremap(res->start,
++				 resource_size(res));
+ 		wed->wlan.wpdma_int = res->start + MT_INT_SOURCE_CSR;
+ 		wed->wlan.wpdma_mask = res->start + MT_INT_MASK_CSR;
+ 		wed->wlan.wpdma_tx = res->start + MT_TXQ_WED_RING_BASE;
+ 		wed->wlan.wpdma_txfree = res->start + MT_RXQ_WED_RING_BASE;
++		wed->wlan.phy_base = res->start;
+ 	}
+ 	wed->wlan.nbuf = 4096;
+ 	wed->wlan.tx_tbit[0] = is_mt7915(&dev->mt76) ? 4 : 30;
+@@ -595,6 +602,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  
--	irq = platform_get_irq(pdev, 0);
--	if (irq < 0)
--		return irq;
--
- 	mem_base = devm_platform_ioremap_resource(pdev, 0);
- 	if (IS_ERR(mem_base)) {
- 		dev_err(&pdev->dev, "Failed to get memory resource\n");
-@@ -1186,6 +1182,16 @@ static int mt7986_wmac_probe(struct platform_device *pdev)
- 		return PTR_ERR(dev);
+ 	*irq = wed->irq;
+ 	dev->mt76.dma_dev = wed->dev;
++	dev->mt76.token_size = wed->wlan.token_start;
  
- 	mdev = &dev->mt76;
-+	ret = mt7915_pci_wed_init(dev, &pdev->dev, &irq);
-+	if (ret < 0)
-+		goto free_device;
-+
-+	if (!ret) {
-+		irq = platform_get_irq(pdev, 0);
-+		if (irq < 0)
-+			return irq;;
-+	}
-+
- 	ret = devm_request_irq(mdev->dev, irq, mt7915_irq_handler,
- 			       IRQF_SHARED, KBUILD_MODNAME, dev);
+ 	ret = dma_set_mask(wed->dev, DMA_BIT_MASK(32));
  	if (ret)
-@@ -1207,6 +1213,8 @@ free_irq:
- 	devm_free_irq(mdev->dev, irq, dev);
- 
- free_device:
-+	if (mtk_wed_device_active(&mdev->mmio.wed))
-+		mtk_wed_device_detach(&mdev->mmio.wed);
- 	mt76_free_device(&dev->mt76);
- 
- 	return ret;
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch
index 4edceb9..910365d 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3002-mt76-mt7915-add-wed-tx-wds-support-on-mt7986.patch
@@ -1,25 +1,25 @@
-From 8aa505cd1dcb9410d38bb608214aa28c01bc3cd2 Mon Sep 17 00:00:00 2001
+From 2e99c7444625c73a247c0be7b3c1b60fb5de72ce Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Sat, 10 Sep 2022 17:09:21 +0800
-Subject: [PATCH] mt76: mt7915: add-wed-tx-wds-support-on-mt7986
+Subject: [PATCH 3002/3010] mt76: mt7915: add-wed-tx-wds-support-on-mt7986
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
  mac80211.c      |  5 ++++-
  mt76.h          |  2 ++
  mt7915/init.c   |  9 +++++++++
- mt7915/main.c   | 52 +++++++++++++++++++++++++++++++++++++++++++------
+ mt7915/main.c   | 44 ++++++++++++++++++++++++++++++++++++++++++--
  mt7915/mcu.c    | 12 ++++++++++--
  mt7915/mcu.h    |  1 +
  mt7915/mmio.c   |  3 +++
  mt7915/mt7915.h |  4 ++++
- 8 files changed, 79 insertions(+), 9 deletions(-)
+ 8 files changed, 75 insertions(+), 5 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 4eaf317b..c477d625 100644
+index b7c1b13..7571e83 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1360,7 +1360,10 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
+@@ -1364,7 +1364,10 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
  
  	mt76_packet_id_flush(dev, wcid);
  
@@ -32,10 +32,10 @@
  }
  EXPORT_SYMBOL_GPL(__mt76_sta_remove);
 diff --git a/mt76.h b/mt76.h
-index e997908a..ec9bd59d 100644
+index e547f79..335f0b1 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -453,6 +453,7 @@ struct mt76_driver_ops {
+@@ -454,6 +454,7 @@ struct mt76_driver_ops {
  
  	void (*sta_remove)(struct mt76_dev *dev, struct ieee80211_vif *vif,
  			   struct ieee80211_sta *sta);
@@ -43,7 +43,7 @@
  };
  
  struct mt76_channel_state {
-@@ -826,6 +827,7 @@ struct mt76_dev {
+@@ -814,6 +815,7 @@ struct mt76_dev {
  	spinlock_t status_lock;
  
  	u32 wcid_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
@@ -52,7 +52,7 @@
  
  	u64 vif_mask;
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 538ff5c3..cd9d846d 100644
+index 6833bbf..8055c6e 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -695,6 +695,15 @@ mt7915_init_hardware(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -72,7 +72,7 @@
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3a09f3f5..b1fb3ddf 100644
+index 4e91527..74c9777 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -658,6 +658,24 @@ mt7915_channel_switch_beacon(struct ieee80211_hw *hw,
@@ -105,11 +105,11 @@
  	int ret, idx;
  	u32 addr;
 +	bool wed_wds = false;
- 
--	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
++
 +	if (mtk_wed_device_active(&mdev->mmio.wed) && is_mt7986(mdev))
 +		wed_wds = !!test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
-+
+ 
+-	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
 +	if (wed_wds)
 +		idx = mt76_wcid_alloc(mdev->wcid_wds_mask, MT7915_WTBL_STA);
 +	else {
@@ -120,7 +120,7 @@
  	if (idx < 0)
  		return -ENOSPC;
  
-@@ -1124,6 +1152,14 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
+@@ -1125,6 +1153,14 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
  	else
  		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
  
@@ -135,30 +135,21 @@
  	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
  }
  
-@@ -1463,12 +1499,16 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1464,7 +1500,11 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->dev = ctx->dev;
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
  	path->mtk_wdma.bss = mvif->mt76.idx;
--	/* fw will find the wcid by dest addr */
--	if(is_mt7915(&dev->mt76))
--		path->mtk_wdma.wcid = 0xff;
--	else
--		path->mtk_wdma.wcid = 0x3ff;
- 
-+	if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags)) {
+-	path->mtk_wdma.wcid = is_mt7915(&dev->mt76) ? 0xff : 0x3ff;
++
++	if (test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags))
 +		path->mtk_wdma.wcid = msta->wcid.idx;
-+	} else {
-+		/* fw will find the wcid by dest addr */
-+		if(is_mt7915(&dev->mt76))
-+			path->mtk_wdma.wcid = 0xff;
-+		else
-+			path->mtk_wdma.wcid = 0x3ff;
-+	}
++	else
++		path->mtk_wdma.wcid = is_mt7915(&dev->mt76) ? 0xff : 0x3ff;
  	path->mtk_wdma.queue = phy != &dev->phy;
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f5caa326..21167f00 100644
+index 477a41c..1d5cb2b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2350,6 +2350,7 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
@@ -188,7 +179,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 9d0fac47..1f56db6b 100644
+index 9d0fac4..1f56db6 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -268,6 +268,7 @@ enum {
@@ -200,19 +191,19 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 11c90772..6df039a7 100644
+index 1eda361..6f0f262 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -736,6 +736,8 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
- 	/* disable dynamic tx token */
- 	wed->wlan.offload_enable = mt7915_wed_offload_enable;
- 	wed->wlan.offload_disable = mt7915_wed_offload_disable;
+@@ -589,6 +589,8 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 	wed->wlan.init_buf = mt7915_wed_init_buf;
+ 	wed->wlan.offload_enable = mt7915_mmio_wed_offload_enable;
+ 	wed->wlan.offload_disable = mt7915_mmio_wed_offload_disable;
 +	if (!is_mt7915(mdev))
 +		wed->wlan.wcid_512 = true;
  
- 	if (mtk_wed_device_attach(wed) != 0)
+ 	if (mtk_wed_device_attach(wed))
  		return 0;
-@@ -776,6 +778,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
+@@ -802,6 +804,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
  		.sta_add = mt7915_mac_sta_add,
  		.sta_remove = mt7915_mac_sta_remove,
  		.update_survey = mt7915_update_channel,
@@ -221,7 +212,7 @@
  	struct mt7915_dev *dev;
  	struct mt76_dev *mdev;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 1c78b882..486c203c 100644
+index f403820..b06e7a9 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -18,6 +18,9 @@
@@ -234,7 +225,7 @@
  #define MT7915_WATCHDOG_TIME		(HZ / 10)
  #define MT7915_RESET_TIMEOUT		(30 * HZ)
  
-@@ -697,6 +700,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
+@@ -695,6 +698,7 @@ void mt7915_tx_token_put(struct mt7915_dev *dev);
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  			 struct sk_buff *skb);
  bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len);
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-add-wed-rx-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-add-wed-rx-support.patch
index 4646c44..b6ae918 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-add-wed-rx-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-add-wed-rx-support.patch
@@ -1,7 +1,7 @@
-From dfbef22fdf1a3e29f9d3c00a50083a02c69e8ad1 Mon Sep 17 00:00:00 2001
+From 9c57070620b011bc01d24aac8d387e6fa37bcde7 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 5 Jul 2022 19:42:55 +0800
-Subject: [PATCH 3003/3007] mt76 add wed rx support
+Subject: [PATCH] mt76 add wed rx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -16,16 +16,16 @@
  mt76_connac_mcu.c |   9 ++
  mt76x02.h         |   2 +-
  mt76x02_txrx.c    |   2 +-
- mt7915/dma.c      |  25 +++--
+ mt7915/dma.c      |  17 +++-
  mt7915/mac.c      | 101 ++++++++++++++++++-
  mt7915/mcu.c      |   3 +
- mt7915/mmio.c     |  26 ++++-
+ mt7915/mmio.c     |  30 ++++--
  mt7915/mt7915.h   |   7 +-
- mt7915/regs.h     |  14 ++-
+ mt7915/regs.h     |   6 ++
  mt7921/mac.c      |   2 +-
  mt7921/mt7921.h   |   2 +-
  tx.c              |  34 +++++++
- 20 files changed, 456 insertions(+), 71 deletions(-)
+ 20 files changed, 448 insertions(+), 67 deletions(-)
 
 diff --git a/dma.c b/dma.c
 index 8ea09e6e..3317d2b9 100644
@@ -500,10 +500,10 @@
  #define MT_RX_INFO_LEN			4
  #define MT_FCE_INFO_LEN			4
 diff --git a/mac80211.c b/mac80211.c
-index c477d625..4a8d8d8d 100644
+index 7571e832..d0bd215a 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -599,11 +599,14 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
+@@ -603,11 +603,14 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
  		BIT(NL80211_IFTYPE_ADHOC);
  
  	spin_lock_init(&dev->token_lock);
@@ -518,7 +518,7 @@
  	dev->token_size = dev->drv->token_size;
  
  	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
-@@ -1301,7 +1304,10 @@ void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
+@@ -1305,7 +1308,10 @@ void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
  
  	while ((skb = __skb_dequeue(&dev->rx_skb[q])) != NULL) {
  		mt76_check_sta(dev, skb);
@@ -531,7 +531,7 @@
  
  	mt76_rx_complete(dev, &frames, napi);
 diff --git a/mt76.h b/mt76.h
-index ec9bd59d..f19433d4 100644
+index 335f0b10..959fb240 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -20,6 +20,8 @@
@@ -571,7 +571,7 @@
  };
  
  struct mt76_rx_tid {
-@@ -438,7 +445,7 @@ struct mt76_driver_ops {
+@@ -439,7 +446,7 @@ struct mt76_driver_ops {
  	bool (*rx_check)(struct mt76_dev *dev, void *data, int len);
  
  	void (*rx_skb)(struct mt76_dev *dev, enum mt76_rxq_id q,
@@ -580,7 +580,7 @@
  
  	void (*rx_poll_complete)(struct mt76_dev *dev, enum mt76_rxq_id q);
  
-@@ -783,6 +790,7 @@ struct mt76_dev {
+@@ -771,6 +778,7 @@ struct mt76_dev {
  	struct ieee80211_hw *hw;
  
  	spinlock_t lock;
@@ -588,7 +588,7 @@
  	spinlock_t cc_lock;
  
  	u32 cur_cc_bss_rx;
-@@ -808,6 +816,7 @@ struct mt76_dev {
+@@ -796,6 +804,7 @@ struct mt76_dev {
  	struct sk_buff_head rx_skb[__MT_RXQ_MAX];
  
  	struct list_head txwi_cache;
@@ -596,7 +596,7 @@
  	struct mt76_queue *q_mcu[__MT_MCUQ_MAX];
  	struct mt76_queue q_rx[__MT_RXQ_MAX];
  	const struct mt76_queue_ops *queue_ops;
-@@ -821,6 +830,9 @@ struct mt76_dev {
+@@ -809,6 +818,9 @@ struct mt76_dev {
  	u16 wed_token_count;
  	u16 token_count;
  	u16 token_size;
@@ -606,7 +606,7 @@
  
  	wait_queue_head_t tx_wait;
  	/* spinclock used to protect wcid pktid linked list */
-@@ -1365,6 +1377,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1351,6 +1363,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -615,7 +615,7 @@
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
-@@ -1509,6 +1523,12 @@ struct mt76_txwi_cache *
+@@ -1495,6 +1509,12 @@ struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
@@ -681,7 +681,7 @@
  int mt7615_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 36a2914e..290e9711 100644
+index 01561a56..0f800909 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -1192,6 +1192,7 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
@@ -729,10 +729,10 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_add_key);
 diff --git a/mt76x02.h b/mt76x02.h
-index f76fd22e..0b872af1 100644
+index 849c2644..49112ab6 100644
 --- a/mt76x02.h
 +++ b/mt76x02.h
-@@ -173,7 +173,7 @@ int mt76x02_set_rts_threshold(struct ieee80211_hw *hw, u32 val);
+@@ -187,7 +187,7 @@ int mt76x02_set_rts_threshold(struct ieee80211_hw *hw, u32 val);
  void mt76x02_remove_hdr_pad(struct sk_buff *skb, int len);
  bool mt76x02_tx_status_data(struct mt76_dev *mdev, u8 *update);
  void mt76x02_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
@@ -742,7 +742,7 @@
  irqreturn_t mt76x02_irq_handler(int irq, void *dev_instance);
  void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
 diff --git a/mt76x02_txrx.c b/mt76x02_txrx.c
-index 96fdf423..bf24d3e0 100644
+index 3a313075..5d6c8f71 100644
 --- a/mt76x02_txrx.c
 +++ b/mt76x02_txrx.c
 @@ -33,7 +33,7 @@ void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
@@ -755,10 +755,10 @@
  	struct mt76x02_dev *dev = container_of(mdev, struct mt76x02_dev, mt76);
  	void *rxwi = skb->data;
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index ac30698f..197a0169 100644
+index e3918860..702d629a 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
-@@ -337,7 +337,8 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
+@@ -344,7 +344,8 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
  		wed_irq_mask |= MT_INT_TX_DONE_BAND0 | MT_INT_TX_DONE_BAND1;
  		if (!is_mt7986(&dev->mt76))
  			mt76_wr(dev, MT_INT_WED_MASK_CSR, wed_irq_mask);
@@ -767,8 +767,8 @@
 +			mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
  		mtk_wed_device_start(&dev->mt76.mmio.wed, wed_irq_mask);
  	}
-
-@@ -349,6 +350,7 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
+ 
+@@ -356,6 +357,7 @@ static int mt7915_dma_enable(struct mt7915_dev *dev)
  int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  {
  	struct mt76_dev *mdev = &dev->mt76;
@@ -776,33 +776,17 @@
  	u32 wa_rx_base, wa_rx_idx;
  	u32 hif1_ofs = 0;
  	int ret;
-@@ -365,10 +366,12 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && !is_mt7986(mdev)) {
- 		mt76_set(dev, MT_WFDMA_HOST_CONFIG, MT_WFDMA_HOST_CONFIG_WED);
- 		if(is_mt7915(mdev)) {
--		mt76_wr(dev, MT_WFDMA_WED_RING_CONTROL,
--			FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX0, 18) |
--			FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX1, 19) |
--			FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_RX1, 1));
-+			mt76_wr(dev, MT_WFDMA_WED_RING_CONTROL,
-+				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX0, 18) |
-+				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX1, 19) |
-+				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_RX1, 1));
+@@ -380,6 +382,9 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+ 				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX1, 19) |
+ 				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_RX1,
+ 					   wed_control_rx1));
++			if(is_mt7915(mdev))
 +				mt76_rmw(dev, MT_WFDMA0_EXT0_CFG, MT_WFDMA0_EXT0_RXWB_KEEP,
-+					 MT_WFDMA0_EXT0_RXWB_KEEP);
- 		} else {
- 			mt76_wr(dev, MT_WFDMA_WED_RING_CONTROL,
- 				FIELD_PREP(MT_WFDMA_WED_RING_CONTROL_TX0, 18) |
-@@ -428,7 +431,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 		return ret;
- 
- 	/* event from WA */
--	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && is_mt7915(mdev)) {
-+	if (mtk_wed_device_active(wed) && is_mt7915(mdev)) {
- 		wa_rx_base = MT_WED_RX_RING_BASE;
- 		wa_rx_idx = MT7915_RXQ_MCU_WA;
- 		dev->mt76.q_rx[MT_RXQ_MCU_WA].flags = MT_WED_Q_TXFREE;
-@@ -444,6 +447,11 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
++					   MT_WFDMA0_EXT0_RXWB_KEEP);
+ 		}
+ 	} else {
+ 		mt76_clear(dev, MT_WFDMA_HOST_CONFIG, MT_WFDMA_HOST_CONFIG_WED);
+@@ -452,6 +457,11 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  
  	/* rx data queue for band0 */
  	if (!dev->phy.band_idx) {
@@ -814,16 +798,7 @@
  		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_MAIN],
  				       MT_RXQ_ID(MT_RXQ_MAIN),
  				       MT7915_RX_RING_SIZE,
-@@ -458,7 +466,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
- 		wa_rx_base = MT_RXQ_RING_BASE(MT_RXQ_MAIN_WA);
- 		wa_rx_idx = MT_RXQ_ID(MT_RXQ_MAIN_WA);
- 
--		if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
-+		if (mtk_wed_device_active(wed)) {
- 			dev->mt76.q_rx[MT_RXQ_MAIN_WA].flags = MT_WED_Q_TXFREE;
- 			if (is_mt7916(mdev)) {
- 				wa_rx_base =  MT_WED_RX_RING_BASE;
-@@ -474,6 +482,11 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -482,6 +492,11 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  	}
  
  	if (dev->dbdc_support || dev->phy.band_idx) {
@@ -836,7 +811,7 @@
  		ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_BAND1],
  				       MT_RXQ_ID(MT_RXQ_BAND1),
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index b1788fb8..4e0c3ec4 100644
+index 65e47f95..06268e06 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -217,7 +217,7 @@ static void mt7915_mac_sta_poll(struct mt7915_dev *dev)
@@ -957,7 +932,7 @@
  static void
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
-@@ -1110,7 +1205,7 @@ bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len)
+@@ -1115,7 +1210,7 @@ bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len)
  }
  
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
@@ -966,7 +941,7 @@
  {
  	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
  	__le32 *rxd = (__le32 *)skb->data;
-@@ -1144,7 +1239,7 @@ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+@@ -1149,7 +1244,7 @@ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  		dev_kfree_skb(skb);
  		break;
  	case PKT_TYPE_NORMAL:
@@ -976,7 +951,7 @@
  			return;
  		}
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 21167f00..aa8bcf70 100644
+index 1d5cb2b3..a405bfde 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -1724,6 +1724,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
@@ -997,69 +972,86 @@
  				     MCU_EXT_CMD(STA_REC_UPDATE), true);
  }
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 6df039a7..6e07311d 100644
+index c197e5eb..b98458e5 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -28,6 +28,9 @@ static const u32 mt7915_reg[] = {
- 	[FW_EXCEPTION_ADDR]	= 0x219848,
+@@ -29,6 +29,7 @@ static const u32 mt7915_reg[] = {
  	[SWDEF_BASE_ADDR]	= 0x41f200,
- 	[EXCEPTION_BASE_ADDR]	= 0x219848,
-+	[WED_TX_RING]		= 0xd7300,
-+	[WED_RX_RING]		= 0xd7410,
+ 	[TXQ_WED_RING_BASE]	= 0xd7300,
+ 	[RXQ_WED_RING_BASE]	= 0xd7410,
 +	[WED_RX_DATA_RING]	= 0xd4500,
+ 	[EXCEPTION_BASE_ADDR]	= 0x219848,
  };
  
- static const u32 mt7916_reg[] = {
-@@ -45,6 +48,9 @@ static const u32 mt7916_reg[] = {
- 	[FW_EXCEPTION_ADDR]	= 0x022050bc,
+@@ -48,6 +49,7 @@ static const u32 mt7916_reg[] = {
  	[SWDEF_BASE_ADDR]	= 0x411400,
- 	[EXCEPTION_BASE_ADDR]	= 0x022050BC,
-+	[WED_TX_RING]		= 0xd7300,
-+	[WED_RX_RING]		= 0xd7410,
+ 	[TXQ_WED_RING_BASE]	= 0xd7300,
+ 	[RXQ_WED_RING_BASE]	= 0xd7410,
 +	[WED_RX_DATA_RING]	= 0xd4540,
+ 	[EXCEPTION_BASE_ADDR]	= 0x022050BC,
  };
  
- static const u32 mt7986_reg[] = {
-@@ -62,6 +68,9 @@ static const u32 mt7986_reg[] = {
- 	[FW_EXCEPTION_ADDR]	= 0x02204ffc,
+@@ -67,6 +69,7 @@ static const u32 mt7986_reg[] = {
  	[SWDEF_BASE_ADDR]	= 0x411400,
- 	[EXCEPTION_BASE_ADDR]	= 0x02204FFC,
-+	[WED_TX_RING]		= 0x24420,
-+	[WED_RX_RING]		= 0x24520,
+ 	[TXQ_WED_RING_BASE]	= 0x24420,
+ 	[RXQ_WED_RING_BASE]	= 0x24520,
 +	[WED_RX_DATA_RING]	= 0x24540,
+ 	[EXCEPTION_BASE_ADDR]	= 0x02204FFC,
  };
  
- static const u32 mt7915_offs[] = {
-@@ -712,6 +721,7 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
- 		wed->wlan.bus_type = MTK_BUS_TYPE_PCIE;
- 		wed->wlan.wpdma_int = base + MT_INT_WED_SOURCE_CSR;
- 		wed->wlan.wpdma_mask = base + MT_INT_WED_MASK_CSR;
-+		wed->wlan.wpdma_phys = base + MT_WFDMA_EXT_CSR_BASE;
+@@ -555,7 +558,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 		struct pci_dev *pci_dev = pdev_ptr;
+ 
+ 		wed->wlan.pci_dev = pci_dev;
+-		wed->wlan.bus_type = MTK_WED_BUS_PCIE;
++		wed->wlan.bus_type = MTK_BUS_TYPE_PCIE;
+ 		wed->wlan.base = (void __iomem *)ioremap(
+ 				 pci_resource_start(pci_dev, 0),
+ 				 pci_resource_len(pci_dev, 0));
+@@ -569,6 +572,10 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 				     MT_TXQ_WED_RING_BASE;
+ 		wed->wlan.wpdma_txfree = pci_resource_start(pci_dev, 0) +
+ 					 MT_RXQ_WED_RING_BASE;
++		wed->wlan.wpdma_rx_glo = pci_resource_start(pci_dev, 0) +
++					 MT_WPDMA_GLO_CFG;
++		wed->wlan.wpdma_rx = pci_resource_start(pci_dev, 0) +
++					 MT_RXQ_WED_DATA_RING_BASE;
+ 		wed->wlan.phy_base = pci_resource_start(pci_dev, 0);
  	} else {
- 		struct platform_device *plat_dev;
- 		struct resource *res;
-@@ -724,12 +734,19 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
- 		wed->wlan.wpdma_int = base + MT_INT_SOURCE_CSR;
- 		wed->wlan.wpdma_mask = base + MT_INT_MASK_CSR;
+ 		struct platform_device *plat_dev = pdev_ptr;
+@@ -578,27 +585,38 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 		if (!res)
+ 			return -ENOMEM;
+ 
+-		wed->wlan.platform_dev = plat_dev;
+-		wed->wlan.bus_type = MTK_WED_BUS_AXI;
++		//wed->wlan.platform_dev = plat_dev;
++		wed->wlan.bus_type = MTK_BUS_TYPE_AXI;
+ 		wed->wlan.base = (void __iomem *)ioremap(res->start,
+ 				 resource_size(res));
+ 		wed->wlan.wpdma_int = res->start + MT_INT_SOURCE_CSR;
+ 		wed->wlan.wpdma_mask = res->start + MT_INT_MASK_CSR;
+ 		wed->wlan.wpdma_tx = res->start + MT_TXQ_WED_RING_BASE;
+ 		wed->wlan.wpdma_txfree = res->start + MT_RXQ_WED_RING_BASE;
++		wed->wlan.wpdma_rx_glo = res->start + MT_WPDMA_GLO_CFG;
++		wed->wlan.wpdma_rx = res->start + MT_RXQ_WED_DATA_RING_BASE;
+ 		wed->wlan.phy_base = res->start;
  	}
+-	wed->wlan.nbuf = 4096;
 +	wed->wlan.rx_pkt = MT7915_WED_RX_TOKEN_SIZE;
-+	wed->wlan.phy_base = base;
- 	wed->wlan.wpdma_tx = base + MT_TXQ_WED_RING_BASE;
- 	wed->wlan.wpdma_txfree = base + MT_RXQ_WED_RING_BASE;
-+	wed->wlan.wpdma_rx_glo = base + MT_WPDMA_GLO_CFG;
-+	wed->wlan.wpdma_rx = base + MT_RXQ_WED_DATA_RING_BASE;
- 
- 	wed->wlan.tx_tbit[0] = MT_WED_TX_DONE_BAND0;
- 	wed->wlan.tx_tbit[1] = MT_WED_TX_DONE_BAND1;
- 	wed->wlan.txfree_tbit = MT_WED_TX_FREE_DONE;
-+	wed->wlan.rx_tbit[0] = MT_WED_RX_DONE_BAND0;
-+	wed->wlan.rx_tbit[1] = MT_WED_RX_DONE_BAND1;
-+
- 	wed->wlan.nbuf = 7168;
++	wed->wlan.nbuf = 7168;
+ 	wed->wlan.tx_tbit[0] = is_mt7915(&dev->mt76) ? 4 : 30;
+ 	wed->wlan.tx_tbit[1] = is_mt7915(&dev->mt76) ? 5 : 31;
+-	wed->wlan.txfree_tbit = is_mt7915(&dev->mt76) ? 1 : 2;
++	wed->wlan.txfree_tbit = (is_mt7986(&dev->mt76) ? 2 : 1);
++	wed->wlan.rx_tbit[0] = (is_mt7915(&dev->mt76) ? 16 : (is_mt7986(&dev->mt76) ? 22 : 18));
++	wed->wlan.rx_tbit[1] = (is_mt7915(&dev->mt76) ? 17 : (is_mt7986(&dev->mt76) ? 23 : 19));
  	wed->wlan.token_start = MT7915_TOKEN_SIZE - wed->wlan.nbuf;
  	wed->wlan.init_buf = mt7915_wed_init_buf;
-@@ -739,12 +756,15 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
- 	if (!is_mt7915(mdev))
+ 	wed->wlan.offload_enable = mt7915_mmio_wed_offload_enable;
+ 	wed->wlan.offload_disable = mt7915_mmio_wed_offload_disable;
+-	if (!is_mt7915(mdev))
++	if (!is_mt7915(&dev->mt76))
  		wed->wlan.wcid_512 = true;
  
 +	wed->wlan.rx_nbuf = 65536;
@@ -1068,17 +1060,11 @@
 +	wed->wlan.release_rx_buf = mt7915_wed_release_rx_buf;
 +
 +	dev->mt76.rx_token_size = wed->wlan.rx_pkt;
- 	if (mtk_wed_device_attach(wed) != 0)
+ 	if (mtk_wed_device_attach(wed))
  		return 0;
  
--	if (wed->ver == MTK_WED_V1)
--		wed->wlan.wpdma_phys = base + MT_WFDMA_EXT_CSR_BASE;
--
- 	*irq = wed->irq;
- 	dev->mt76.dma_dev = wed->dev;
- 	mdev->token_size = wed->wlan.token_start;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 486c203c..2da2ff8b 100644
+index b06e7a90..d96709b1 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -81,6 +81,7 @@
@@ -1089,7 +1075,7 @@
  
  struct mt7915_vif;
  struct mt7915_sta;
-@@ -545,7 +546,9 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
+@@ -543,7 +544,9 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
  irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
  u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
  u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
@@ -1100,7 +1086,7 @@
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
  int mt7915_eeprom_init(struct mt7915_dev *dev);
-@@ -698,7 +701,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -696,7 +699,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  			  struct mt76_tx_info *tx_info);
  void mt7915_tx_token_put(struct mt7915_dev *dev);
  void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
@@ -1110,20 +1096,18 @@
  bool mt7915_wed_wds_check(struct mt76_dev *mdev, struct ieee80211_sta *sta);
  void mt7915_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 51eb553c..dcb40181 100644
+index 8fd2f69a..36ad2433 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -27,6 +27,9 @@ enum reg_rev {
- 	FW_EXCEPTION_ADDR,
+@@ -28,6 +28,7 @@ enum reg_rev {
  	SWDEF_BASE_ADDR,
- 	EXCEPTION_BASE_ADDR,
-+	WED_TX_RING,
-+	WED_RX_RING,
+ 	TXQ_WED_RING_BASE,
+ 	RXQ_WED_RING_BASE,
 +	WED_RX_DATA_RING,
+ 	EXCEPTION_BASE_ADDR,
  	__MT_REG_MAX,
  };
- 
-@@ -568,9 +571,13 @@ enum offs_rev {
+@@ -570,9 +571,13 @@ enum offs_rev {
  #define MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2	BIT(21)
  
  #define MT_WFDMA0_RST_DTX_PTR		MT_WFDMA0(0x20c)
@@ -1137,33 +1121,19 @@
  
  #define MT_WFDMA0_MCU_HOST_INT_ENA	MT_WFDMA0(0x1f4)
  #define MT_WFDMA0_MT_WA_WDT_INT		BIT(31)
-@@ -668,12 +675,18 @@ enum offs_rev {
- #define MT_TXQ_EXT_CTRL(q)		(MT_Q_BASE(__TXQ(q)) + 0x600 +	\
- 					 MT_TXQ_ID(q)* 0x4)
+@@ -672,6 +677,7 @@ enum offs_rev {
  
--#define MT_TXQ_WED_RING_BASE		(!is_mt7986(mdev)? 0xd7300 : 0x24420)
--#define MT_RXQ_WED_RING_BASE		(!is_mt7986(mdev)? 0xd7410 : 0x24520)
-+#define MT_TXQ_WED_RING_BASE		__REG(WED_TX_RING)
-+#define MT_RXQ_WED_RING_BASE		__REG(WED_RX_RING)
+ #define MT_TXQ_WED_RING_BASE		__REG(TXQ_WED_RING_BASE)
+ #define MT_RXQ_WED_RING_BASE		__REG(RXQ_WED_RING_BASE)
 +#define MT_RXQ_WED_DATA_RING_BASE	__REG(WED_RX_DATA_RING)
  
- #define MT_WED_TX_DONE_BAND0		(is_mt7915(mdev)? 4 : 30)
- #define MT_WED_TX_DONE_BAND1		(is_mt7915(mdev)? 5 : 31)
--#define MT_WED_TX_FREE_DONE		(is_mt7915(mdev)? 1 : 2)
-+#define MT_WED_TX_FREE_DONE		(is_mt7986(mdev) ? 2 : 1)
-+#define MT_WED_RX_DONE_BAND0		(is_mt7915(mdev) ? 16 : \
-+					 (is_mt7986(mdev) ? 22 : 18))
-+#define MT_WED_RX_DONE_BAND1		(is_mt7915(mdev) ? 17 : \
-+					 (is_mt7986(mdev) ? 23 : 19))
-+
- 
  #define MT_INT_SOURCE_CSR		__REG(INT_SOURCE_CSR)
  #define MT_INT_MASK_CSR			__REG(INT_MASK_CSR)
 diff --git a/mt7921/mac.c b/mt7921/mac.c
-index 9c82ec24..6b631a64 100644
+index dbdf4a77..c93cd5c4 100644
 --- a/mt7921/mac.c
 +++ b/mt7921/mac.c
-@@ -680,7 +680,7 @@ bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len)
+@@ -690,7 +690,7 @@ bool mt7921_rx_check(struct mt76_dev *mdev, void *data, int len)
  EXPORT_SYMBOL_GPL(mt7921_rx_check);
  
  void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
@@ -1228,5 +1198,5 @@
 +}
 +EXPORT_SYMBOL_GPL(mt76_rx_token_release);
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
index ef9724f..163076d 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3004-mt76-add-fill-receive-path-to-report-wed-idx.patch
@@ -1,7 +1,7 @@
-From 72230221dbb07d547dba931b7b3787cbebb2125a Mon Sep 17 00:00:00 2001
+From ce92956ffffb916d8dd7ec6c5bb63c94e153678d Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 19 May 2022 13:44:42 +0800
-Subject: [PATCH 3004/3007] mt76: add fill receive path to report wed idx
+Subject: [PATCH 3004/3010] mt76: add fill receive path to report wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,10 +9,10 @@
  1 file changed, 19 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index b1fb3ddf..fcf122cf 100644
+index 74c9777..d5360ce 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1515,6 +1515,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1511,6 +1511,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  
  	return 0;
  }
@@ -37,7 +37,7 @@
  #endif
  
  const struct ieee80211_ops mt7915_ops = {
-@@ -1566,5 +1584,6 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1562,5 +1580,6 @@ const struct ieee80211_ops mt7915_ops = {
  	.set_radar_background = mt7915_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	.net_fill_forward_path = mt7915_net_fill_forward_path,
@@ -45,5 +45,5 @@
  #endif
  };
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-add-ser-spport-when-wed-on.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-add-ser-spport-when-wed-on.patch
index cee9fe0..9118c67 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-add-ser-spport-when-wed-on.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-add-ser-spport-when-wed-on.patch
@@ -1,7 +1,7 @@
-From c3c6234cc24fd9b57bb0d57b194252d533f5f012 Mon Sep 17 00:00:00 2001
+From 067df4201faff9efe5d8574ce98172262bec25e1 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 28 Jul 2022 11:16:15 +0800
-Subject: [PATCH 3005/3007] mt76 add ser spport when wed on
+Subject: [PATCH 3005/3010] mt76 add ser spport when wed on
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -15,7 +15,7 @@
  7 files changed, 76 insertions(+), 15 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 3317d2b9..fa56ccfb 100644
+index 3317d2b..fa56ccf 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -169,7 +169,7 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
@@ -109,7 +109,7 @@
  	if (!q->rx_head)
  		return;
 diff --git a/dma.h b/dma.h
-index 90370d12..083cbca4 100644
+index 90370d1..083cbca 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -58,5 +58,5 @@ enum mt76_mcu_evt_type {
@@ -120,10 +120,10 @@
 +int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset);
  #endif
 diff --git a/mt76.h b/mt76.h
-index f19433d4..9b00f53c 100644
+index 959fb24..3530d21 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1379,6 +1379,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1365,6 +1365,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
@@ -132,10 +132,10 @@
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 197a0169..e0a51316 100644
+index 702d629..96cad2b 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
-@@ -522,6 +522,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+@@ -532,6 +532,7 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
  int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
  {
  	struct mt76_phy *mphy_ext = dev->mt76.phys[MT_BAND1];
@@ -143,7 +143,7 @@
  	int i;
  
  	/* clean up hw queues */
-@@ -542,28 +543,53 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
+@@ -552,28 +553,53 @@ int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
  		mt7915_wfsys_reset(dev);
  
  	/* disable wfdma */
@@ -203,7 +203,7 @@
  }
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 4e0c3ec4..0cd9cad9 100644
+index 06268e0..544d166 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -916,6 +916,8 @@ void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed)
@@ -234,7 +234,7 @@
  static void
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
-@@ -1665,6 +1679,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1679,6 +1693,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	if (!(READ_ONCE(dev->reset_state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
@@ -248,23 +248,23 @@
  	if (ext_phy)
  		ieee80211_stop_queues(ext_phy->hw);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 6e07311d..0edea0d3 100644
+index edf99d2..11c7e94 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -761,6 +761,8 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+@@ -609,6 +609,8 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  	wed->wlan.init_rx_buf = mt7915_wed_init_rx_buf;
  	wed->wlan.release_rx_buf = mt7915_wed_release_rx_buf;
  
 +	wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
 +
  	dev->mt76.rx_token_size = wed->wlan.rx_pkt;
- 	if (mtk_wed_device_attach(wed) != 0)
+ 	if (mtk_wed_device_attach(wed))
  		return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2da2ff8b..a4872451 100644
+index d96709b..1a32e82 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -549,6 +549,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -547,6 +547,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
  				int pkt_num);
  void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed);
@@ -273,5 +273,5 @@
  void mt7915_unregister_device(struct mt7915_dev *dev);
  int mt7915_eeprom_init(struct mt7915_dev *dev);
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch
index b749789..4de3b94 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-add-statistic-for-H-W-Rx-Path.patch
@@ -1,7 +1,7 @@
-From 247fa46efdeaa5ea727a3d5dde7a9f3d7aac97d4 Mon Sep 17 00:00:00 2001
+From 74a76d638bf234a888a94a607aadeb0fda232abd Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Fri, 5 Aug 2022 13:58:11 -0700
-Subject: [PATCH 3006/3007] mt76: mt7915: add statistic for H/W Rx Path
+Subject: [PATCH 3006/3010] mt76: mt7915: add statistic for H/W Rx Path
 
 Change-Id: Id94d663f08e91c83d296bd57e5e9b65a505ae1c7
 ---
@@ -16,7 +16,7 @@
  8 files changed, 107 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index 9b00f53c..4958d97c 100644
+index 3530d21..47a9213 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -278,6 +278,10 @@ struct mt76_sta_stats {
@@ -31,7 +31,7 @@
  
  enum mt76_wcid_flags {
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 9a468878..7ecc7253 100644
+index 9a46887..7ecc725 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -224,6 +224,11 @@ static inline bool is_mt76_fw_txp(struct mt76_dev *dev)
@@ -47,10 +47,10 @@
  {
  	static const u8 width_to_bw[] = {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 4cdfadc7..adb06f84 100644
+index 27a3624..475c391 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1210,6 +1210,41 @@ enum {
+@@ -1211,6 +1211,41 @@ enum {
  	MCU_CE_CMD_GET_TXPWR = 0xd0,
  };
  
@@ -93,7 +93,7 @@
  	PATCH_SEM_RELEASE,
  	PATCH_SEM_GET
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 0cd9cad9..35c13efd 100644
+index 544d166..bfc6c52 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -940,6 +940,31 @@ void mt7915_wed_trigger_ser(struct mtk_wed_device *wed)
@@ -129,10 +129,10 @@
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
 diff --git a/mt7915/main.c b/mt7915/main.c
-index fcf122cf..db9d55fe 100644
+index d5360ce..3e8142e 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1049,7 +1049,8 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+@@ -1050,7 +1050,8 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
  	struct rate_info *txrate = &msta->wcid.rate;
  	struct rate_info rxrate = {};
  
@@ -142,7 +142,7 @@
  	    !mt7915_mcu_get_rx_rate(phy, vif, sta, &rxrate)) {
  		sinfo->rxrate = rxrate;
  		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
-@@ -1086,6 +1087,12 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+@@ -1087,6 +1088,12 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
  
  		sinfo->tx_retries = msta->wcid.stats.tx_retries;
  		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
@@ -156,7 +156,7 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index aa8bcf70..b0fa6dac 100644
+index a405bfd..48305b4 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -293,6 +293,27 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
@@ -188,7 +188,7 @@
  mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 0edea0d3..c5ce8cf7 100644
+index 11c7e94..1f794df 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -9,6 +9,7 @@
@@ -197,18 +197,18 @@
  #include "../trace.h"
 +#include "../mt76_connac_mcu.h"
  
- static bool wed_enable = true;
+ static bool wed_enable;
  module_param(wed_enable, bool, 0644);
-@@ -763,6 +764,8 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+@@ -611,6 +612,8 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  
  	wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
  
 +	wed->wlan.update_wo_rxcnt = mt7915_wed_update_wo_rxcnt;
 +
  	dev->mt76.rx_token_size = wed->wlan.rx_pkt;
- 	if (mtk_wed_device_attach(wed) != 0)
+ 	if (mtk_wed_device_attach(wed))
  		return 0;
-@@ -774,6 +777,9 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+@@ -622,6 +625,9 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  	if (ret)
  		return ret;
  
@@ -219,10 +219,10 @@
  #else
  	return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index a4872451..03486837 100644
+index 1a32e82..c2a7f35 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -550,6 +550,8 @@ u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
+@@ -548,6 +548,8 @@ u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
  				int pkt_num);
  void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed);
  void mt7915_wed_trigger_ser(struct mtk_wed_device *wed);
@@ -231,7 +231,7 @@
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
  int mt7915_eeprom_init(struct mt7915_dev *dev);
-@@ -634,6 +636,7 @@ int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
+@@ -632,6 +634,7 @@ int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
  				     struct cfg80211_chan_def *chandef);
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set);
  int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
@@ -240,5 +240,5 @@
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
index 4f4d700..dee6d8c 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3007-mt76-mt7915-enable-red-per-band-token-drop-for-HW-Pa.patch
@@ -1,7 +1,7 @@
-From 10f2c201cbeaae838ffa2489a7ff928d812d6f49 Mon Sep 17 00:00:00 2001
+From 95895d15a31f5fef5133f1dafef38cd6b39700ea Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 2 Sep 2022 14:40:40 +0800
-Subject: [PATCH 3007/3007] mt76: mt7915: enable red per-band token drop for HW
+Subject: [PATCH 3007/3010] mt76: mt7915: enable red per-band token drop for HW
  Path
 
 Limit the number of token used by each band. If a band uses too many token,
@@ -16,7 +16,7 @@
  3 files changed, 45 insertions(+), 11 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index b0fa6dac..98277d27 100644
+index 48305b4..a3600c7 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2412,8 +2412,13 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
@@ -110,7 +110,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 1f56db6b..9181e961 100644
+index 1f56db6..9181e96 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -269,6 +269,7 @@ enum {
@@ -122,7 +122,7 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 03486837..30293158 100644
+index c2a7f35..14dfc34 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -749,11 +749,11 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
@@ -139,5 +139,5 @@
  int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
  void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
 -- 
-2.25.1
+2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch
index 9e3fb2a..997a28f 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3008-mt76-mt7915-update-mt7916-trinfo-when-hw-path-enable.patch
@@ -1,7 +1,8 @@
-From 5fbff98bcf45a6b2a5467d06af26507dbdb0c7aa Mon Sep 17 00:00:00 2001
+From 7b58f758461fd34ce64e75a8310787a347fd2ee5 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 22 Sep 2022 09:54:53 +0800
-Subject: [PATCH] mt76: mt7915: update mt7916 trinfo when hw path enable
+Subject: [PATCH 3008/3010] mt76: mt7915: update mt7916 trinfo when hw path
+ enable
 
 ---
  mt7915/mt7915_debug.h | 10 ++++++++++
@@ -9,7 +10,7 @@
  2 files changed, 23 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
-index 58ba2cdf..50b588bd 100644
+index 58ba2cd..50b588b 100644
 --- a/mt7915/mt7915_debug.h
 +++ b/mt7915/mt7915_debug.h
 @@ -133,6 +133,8 @@ enum dbg_reg_rev {
@@ -56,7 +57,7 @@
  #define MT_DBG_INT_SOURCE_CSR			__DBG_REG(dev, DBG_INT_SOURCE_CSR)
  #define MT_DBG_INT_MASK_CSR			__DBG_REG(dev, DBG_INT_MASK_CSR)
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index e336b35a..c9d634ce 100644
+index 9de5b0f..5f09f0a 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -855,12 +855,22 @@ mt7986_show_host_dma_info(struct seq_file *s, struct mt7915_dev *dev)
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3009-mt76-mt7915-find-rx-token-by-physical-address.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3009-mt76-mt7915-find-rx-token-by-physical-address.patch
index 8e1873d..a252398 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3009-mt76-mt7915-find-rx-token-by-physical-address.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3009-mt76-mt7915-find-rx-token-by-physical-address.patch
@@ -1,4 +1,4 @@
-From c72a8943ae9e7b97d9f67c066fe232eba920f517 Mon Sep 17 00:00:00 2001
+From 82335286ec2a9d33c9638c30e7638035f431e116 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 27 Sep 2022 16:34:26 +0800
 Subject: [PATCH 3009/3010] mt76: mt7915: find rx token by physical address
@@ -12,19 +12,19 @@
  1 file changed, 18 insertions(+), 1 deletion(-)
 
 diff --git a/dma.c b/dma.c
-index fa56ccfb..c5513690 100644
+index fa56ccf..c551369 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -380,11 +380,28 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
-
+ 
  	type = FIELD_GET(MT_QFLAG_WED_TYPE, q->flags);
  	if (mtk_wed_device_active(wed) && type == MT76_WED_Q_RX) {
 -		u32 token;
 +		u32 token, id, find = 0;
  		struct mt76_txwi_cache *r;
-
+ 
  		token = FIELD_GET(MT_DMA_CTL_TOKEN, desc->buf1);
-
+ 
 +		if (*more) {
 +			spin_lock_bh(&dev->rx_token_lock);
 +
@@ -45,6 +45,6 @@
  		r = mt76_rx_token_release(dev, token);
  		if (!r)
  			return NULL;
---
+-- 
 2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3010-mt76-mt7915-drop-scatter-and-gather-frame.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3010-mt76-mt7915-drop-scatter-and-gather-frame.patch
index 0930bfd..dbc898d 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3010-mt76-mt7915-drop-scatter-and-gather-frame.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3010-mt76-mt7915-drop-scatter-and-gather-frame.patch
@@ -1,7 +1,7 @@
-From 53ca78fb2c0a95d0776b41002f6307801cb406df Mon Sep 17 00:00:00 2001
+From fbbc214ee09aae422c5a8f89dd88c8adeecb7356 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 28 Sep 2022 18:52:54 +0800
-Subject: [PATCH] mt76: mt7915: drop scatter and gather frame
+Subject: [PATCH 3010/3010] mt76: mt7915: drop scatter and gather frame
 
 The scatter and gather frame may be incorrect because WED and WO may
 send frames to host driver interleaved.
@@ -14,11 +14,11 @@
  3 files changed, 11 insertions(+)
 
 diff --git a/dma.c b/dma.c
-index 063335e1..e6048024 100644
+index c551369..f893c78 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -421,6 +421,15 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
-
+@@ -419,6 +419,15 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ 
  		if (desc->ctrl & (MT_DMA_CTL_TO_HOST_A | MT_DMA_CTL_DROP))
  			*drop = true;
 +
@@ -34,19 +34,19 @@
  		buf_addr = e->dma_addr[0];
  		e->buf = NULL;
 diff --git a/dma.h b/dma.h
-index 083cbca4..221fcc8e 100644
+index 083cbca..221fcc8 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -21,6 +21,7 @@
  #define MT_DMA_CTL_DROP			BIT(14)
-
+ 
  #define MT_DMA_CTL_TOKEN		GENMASK(31, 16)
 +#define MT_DMA_CTL_WO			BIT(8)
-
+ 
  #define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
  #define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
 diff --git a/mt76.h b/mt76.h
-index 4958d97c..0311e9ea 100644
+index 47a9213..1af188e 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -32,6 +32,7 @@
@@ -54,9 +54,9 @@
  #define MT_QFLAG_WED_TYPE	GENMASK(3, 2)
  #define MT_QFLAG_WED		BIT(4)
 +#define MT_QFLAG_WED_FRAG	BIT(5)
-
+ 
  #define __MT_WED_Q(_type, _n)	(MT_QFLAG_WED | \
  				 FIELD_PREP(MT_QFLAG_WED_TYPE, _type) | \
---
+-- 
 2.18.0