diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0000-wifi-mt76-api_update.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0000-wifi-mt76-api_update.patch
deleted file mode 100644
index 7105734..0000000
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0000-wifi-mt76-api_update.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 44d055ff8225e0d6110048d8c02de526bf5152b2 Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Fri, 31 Mar 2023 14:38:44 +0800
-Subject: [PATCH] wifi: mt76: api_update
-
----
- tx.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tx.c b/tx.c
-index 1f309d0..3ad9742 100644
---- a/tx.c
-+++ b/tx.c
-@@ -330,7 +330,7 @@ mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
- 	if ((dev->drv->drv_flags & MT_DRV_HW_MGMT_TXQ) &&
- 	    !(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
- 	    !ieee80211_is_data(hdr->frame_control) &&
--	    !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) {
-+	    !ieee80211_is_bufferable_mmpdu(skb)) {
- 		qid = MT_TXQ_PSD;
- 	}
- 
--- 
-2.39.0
-
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0000-wifi-mt76-ignore-key-disable-commands.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0000-wifi-mt76-ignore-key-disable-commands.patch
deleted file mode 100644
index 78b70d7..0000000
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0000-wifi-mt76-ignore-key-disable-commands.patch
+++ /dev/null
@@ -1,326 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 22 Mar 2023 10:17:49 +0100
-Subject: [PATCH] wifi: mt76: ignore key disable commands
-
-This helps avoid cleartext leakage of already queued or powersave buffered
-packets, when a reassoc triggers the key deletion.
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/mt7603/main.c
-+++ b/mt7603/main.c
-@@ -512,15 +512,15 @@ mt7603_set_key(struct ieee80211_hw *hw,
- 	    !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
- 		return -EOPNOTSUPP;
- 
--	if (cmd == SET_KEY) {
--		key->hw_key_idx = wcid->idx;
--		wcid->hw_key_idx = idx;
--	} else {
-+	if (cmd != SET_KEY) {
- 		if (idx == wcid->hw_key_idx)
- 			wcid->hw_key_idx = -1;
- 
--		key = NULL;
-+		return 0;
- 	}
-+
-+	key->hw_key_idx = wcid->idx;
-+	wcid->hw_key_idx = idx;
- 	mt76_wcid_key_setup(&dev->mt76, wcid, key);
- 
- 	return mt7603_wtbl_set_key(dev, wcid->idx, key);
---- a/mt7615/mac.c
-+++ b/mt7615/mac.c
-@@ -1193,8 +1193,7 @@ EXPORT_SYMBOL_GPL(mt7615_mac_enable_rtsc
- static int
- mt7615_mac_wtbl_update_key(struct mt7615_dev *dev, struct mt76_wcid *wcid,
- 			   struct ieee80211_key_conf *key,
--			   enum mt76_cipher_type cipher, u16 cipher_mask,
--			   enum set_key_cmd cmd)
-+			   enum mt76_cipher_type cipher, u16 cipher_mask)
- {
- 	u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx) + 30 * 4;
- 	u8 data[32] = {};
-@@ -1203,27 +1202,18 @@ mt7615_mac_wtbl_update_key(struct mt7615
- 		return -EINVAL;
- 
- 	mt76_rr_copy(dev, addr, data, sizeof(data));
--	if (cmd == SET_KEY) {
--		if (cipher == MT_CIPHER_TKIP) {
--			/* Rx/Tx MIC keys are swapped */
--			memcpy(data, key->key, 16);
--			memcpy(data + 16, key->key + 24, 8);
--			memcpy(data + 24, key->key + 16, 8);
--		} else {
--			if (cipher_mask == BIT(cipher))
--				memcpy(data, key->key, key->keylen);
--			else if (cipher != MT_CIPHER_BIP_CMAC_128)
--				memcpy(data, key->key, 16);
--			if (cipher == MT_CIPHER_BIP_CMAC_128)
--				memcpy(data + 16, key->key, 16);
--		}
-+	if (cipher == MT_CIPHER_TKIP) {
-+		/* Rx/Tx MIC keys are swapped */
-+		memcpy(data, key->key, 16);
-+		memcpy(data + 16, key->key + 24, 8);
-+		memcpy(data + 24, key->key + 16, 8);
- 	} else {
-+		if (cipher_mask == BIT(cipher))
-+			memcpy(data, key->key, key->keylen);
-+		else if (cipher != MT_CIPHER_BIP_CMAC_128)
-+			memcpy(data, key->key, 16);
- 		if (cipher == MT_CIPHER_BIP_CMAC_128)
--			memset(data + 16, 0, 16);
--		else if (cipher_mask)
--			memset(data, 0, 16);
--		if (!cipher_mask)
--			memset(data, 0, sizeof(data));
-+			memcpy(data + 16, key->key, 16);
- 	}
- 
- 	mt76_wr_copy(dev, addr, data, sizeof(data));
-@@ -1234,7 +1224,7 @@ mt7615_mac_wtbl_update_key(struct mt7615
- static int
- mt7615_mac_wtbl_update_pk(struct mt7615_dev *dev, struct mt76_wcid *wcid,
- 			  enum mt76_cipher_type cipher, u16 cipher_mask,
--			  int keyidx, enum set_key_cmd cmd)
-+			  int keyidx)
- {
- 	u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx), w0, w1;
- 
-@@ -1253,9 +1243,7 @@ mt7615_mac_wtbl_update_pk(struct mt7615_
- 	else
- 		w0 &= ~MT_WTBL_W0_RX_IK_VALID;
- 
--	if (cmd == SET_KEY &&
--	    (cipher != MT_CIPHER_BIP_CMAC_128 ||
--	     cipher_mask == BIT(cipher))) {
-+	if (cipher != MT_CIPHER_BIP_CMAC_128 || cipher_mask == BIT(cipher)) {
- 		w0 &= ~MT_WTBL_W0_KEY_IDX;
- 		w0 |= FIELD_PREP(MT_WTBL_W0_KEY_IDX, keyidx);
- 	}
-@@ -1272,19 +1260,10 @@ mt7615_mac_wtbl_update_pk(struct mt7615_
- 
- static void
- mt7615_mac_wtbl_update_cipher(struct mt7615_dev *dev, struct mt76_wcid *wcid,
--			      enum mt76_cipher_type cipher, u16 cipher_mask,
--			      enum set_key_cmd cmd)
-+			      enum mt76_cipher_type cipher, u16 cipher_mask)
- {
- 	u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx);
- 
--	if (!cipher_mask) {
--		mt76_clear(dev, addr + 2 * 4, MT_WTBL_W2_KEY_TYPE);
--		return;
--	}
--
--	if (cmd != SET_KEY)
--		return;
--
- 	if (cipher == MT_CIPHER_BIP_CMAC_128 &&
- 	    cipher_mask & ~BIT(MT_CIPHER_BIP_CMAC_128))
- 		return;
-@@ -1295,8 +1274,7 @@ mt7615_mac_wtbl_update_cipher(struct mt7
- 
- int __mt7615_mac_wtbl_set_key(struct mt7615_dev *dev,
- 			      struct mt76_wcid *wcid,
--			      struct ieee80211_key_conf *key,
--			      enum set_key_cmd cmd)
-+			      struct ieee80211_key_conf *key)
- {
- 	enum mt76_cipher_type cipher;
- 	u16 cipher_mask = wcid->cipher;
-@@ -1306,19 +1284,14 @@ int __mt7615_mac_wtbl_set_key(struct mt7
- 	if (cipher == MT_CIPHER_NONE)
- 		return -EOPNOTSUPP;
- 
--	if (cmd == SET_KEY)
--		cipher_mask |= BIT(cipher);
--	else
--		cipher_mask &= ~BIT(cipher);
--
--	mt7615_mac_wtbl_update_cipher(dev, wcid, cipher, cipher_mask, cmd);
--	err = mt7615_mac_wtbl_update_key(dev, wcid, key, cipher, cipher_mask,
--					 cmd);
-+	cipher_mask |= BIT(cipher);
-+	mt7615_mac_wtbl_update_cipher(dev, wcid, cipher, cipher_mask);
-+	err = mt7615_mac_wtbl_update_key(dev, wcid, key, cipher, cipher_mask);
- 	if (err < 0)
- 		return err;
- 
- 	err = mt7615_mac_wtbl_update_pk(dev, wcid, cipher, cipher_mask,
--					key->keyidx, cmd);
-+					key->keyidx);
- 	if (err < 0)
- 		return err;
- 
-@@ -1329,13 +1302,12 @@ int __mt7615_mac_wtbl_set_key(struct mt7
- 
- int mt7615_mac_wtbl_set_key(struct mt7615_dev *dev,
- 			    struct mt76_wcid *wcid,
--			    struct ieee80211_key_conf *key,
--			    enum set_key_cmd cmd)
-+			    struct ieee80211_key_conf *key)
- {
- 	int err;
- 
- 	spin_lock_bh(&dev->mt76.lock);
--	err = __mt7615_mac_wtbl_set_key(dev, wcid, key, cmd);
-+	err = __mt7615_mac_wtbl_set_key(dev, wcid, key);
- 	spin_unlock_bh(&dev->mt76.lock);
- 
- 	return err;
---- a/mt7615/main.c
-+++ b/mt7615/main.c
-@@ -391,18 +391,17 @@ static int mt7615_set_key(struct ieee802
- 
- 	if (cmd == SET_KEY)
- 		*wcid_keyidx = idx;
--	else if (idx == *wcid_keyidx)
--		*wcid_keyidx = -1;
--	else
-+	else {
-+		if (idx == *wcid_keyidx)
-+			*wcid_keyidx = -1;
- 		goto out;
-+	}
- 
--	mt76_wcid_key_setup(&dev->mt76, wcid,
--			    cmd == SET_KEY ? key : NULL);
--
-+	mt76_wcid_key_setup(&dev->mt76, wcid, key);
- 	if (mt76_is_mmio(&dev->mt76))
--		err = mt7615_mac_wtbl_set_key(dev, wcid, key, cmd);
-+		err = mt7615_mac_wtbl_set_key(dev, wcid, key);
- 	else
--		err = __mt7615_mac_wtbl_set_key(dev, wcid, key, cmd);
-+		err = __mt7615_mac_wtbl_set_key(dev, wcid, key);
- 
- out:
- 	mt7615_mutex_release(dev);
---- a/mt7615/mt7615.h
-+++ b/mt7615/mt7615.h
-@@ -491,11 +491,9 @@ int mt7615_mac_write_txwi(struct mt7615_
- void mt7615_mac_set_timing(struct mt7615_phy *phy);
- int __mt7615_mac_wtbl_set_key(struct mt7615_dev *dev,
- 			      struct mt76_wcid *wcid,
--			      struct ieee80211_key_conf *key,
--			      enum set_key_cmd cmd);
-+			      struct ieee80211_key_conf *key);
- int mt7615_mac_wtbl_set_key(struct mt7615_dev *dev, struct mt76_wcid *wcid,
--			    struct ieee80211_key_conf *key,
--			    enum set_key_cmd cmd);
-+			    struct ieee80211_key_conf *key);
- void mt7615_mac_reset_work(struct work_struct *work);
- u32 mt7615_mac_get_sta_tid_sn(struct mt7615_dev *dev, int wcid, u8 tid);
- 
---- a/mt76x02_util.c
-+++ b/mt76x02_util.c
-@@ -454,20 +454,20 @@ int mt76x02_set_key(struct ieee80211_hw
- 	msta = sta ? (struct mt76x02_sta *)sta->drv_priv : NULL;
- 	wcid = msta ? &msta->wcid : &mvif->group_wcid;
- 
--	if (cmd == SET_KEY) {
--		key->hw_key_idx = wcid->idx;
--		wcid->hw_key_idx = idx;
--		if (key->flags & IEEE80211_KEY_FLAG_RX_MGMT) {
--			key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
--			wcid->sw_iv = true;
--		}
--	} else {
-+	if (cmd != SET_KEY) {
- 		if (idx == wcid->hw_key_idx) {
- 			wcid->hw_key_idx = -1;
- 			wcid->sw_iv = false;
- 		}
- 
--		key = NULL;
-+		return 0;
-+	}
-+
-+	key->hw_key_idx = wcid->idx;
-+	wcid->hw_key_idx = idx;
-+	if (key->flags & IEEE80211_KEY_FLAG_RX_MGMT) {
-+		key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
-+		wcid->sw_iv = true;
- 	}
- 	mt76_wcid_key_setup(&dev->mt76, wcid, key);
- 
---- a/mt7915/main.c
-+++ b/mt7915/main.c
-@@ -410,16 +410,15 @@ static int mt7915_set_key(struct ieee802
- 		mt7915_mcu_add_bss_info(phy, vif, true);
- 	}
- 
--	if (cmd == SET_KEY)
-+	if (cmd == SET_KEY) {
- 		*wcid_keyidx = idx;
--	else if (idx == *wcid_keyidx)
--		*wcid_keyidx = -1;
--	else
-+	} else {
-+		if (idx == *wcid_keyidx)
-+			*wcid_keyidx = -1;
- 		goto out;
-+	}
- 
--	mt76_wcid_key_setup(&dev->mt76, wcid,
--			    cmd == SET_KEY ? key : NULL);
--
-+	mt76_wcid_key_setup(&dev->mt76, wcid, key);
- 	err = mt76_connac_mcu_add_key(&dev->mt76, vif, &msta->bip,
- 				      key, MCU_EXT_CMD(STA_REC_UPDATE),
- 				      &msta->wcid, cmd);
---- a/mt7921/main.c
-+++ b/mt7921/main.c
-@@ -569,16 +569,15 @@ static int mt7921_set_key(struct ieee802
- 
- 	mt7921_mutex_acquire(dev);
- 
--	if (cmd == SET_KEY)
-+	if (cmd == SET_KEY) {
- 		*wcid_keyidx = idx;
--	else if (idx == *wcid_keyidx)
--		*wcid_keyidx = -1;
--	else
-+	} else {
-+		if (idx == *wcid_keyidx)
-+			*wcid_keyidx = -1;
- 		goto out;
-+	}
- 
--	mt76_wcid_key_setup(&dev->mt76, wcid,
--			    cmd == SET_KEY ? key : NULL);
--
-+	mt76_wcid_key_setup(&dev->mt76, wcid, key);
- 	err = mt76_connac_mcu_add_key(&dev->mt76, vif, &msta->bip,
- 				      key, MCU_UNI_CMD(STA_REC_UPDATE),
- 				      &msta->wcid, cmd);
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -351,16 +351,15 @@ static int mt7996_set_key(struct ieee802
- 		mt7996_mcu_add_bss_info(phy, vif, true);
- 	}
- 
--	if (cmd == SET_KEY)
-+	if (cmd == SET_KEY) {
- 		*wcid_keyidx = idx;
--	else if (idx == *wcid_keyidx)
--		*wcid_keyidx = -1;
--	else
-+	} else {
-+		if (idx == *wcid_keyidx)
-+			*wcid_keyidx = -1;
- 		goto out;
-+	}
- 
--	mt76_wcid_key_setup(&dev->mt76, wcid,
--			    cmd == SET_KEY ? key : NULL);
--
-+	mt76_wcid_key_setup(&dev->mt76, wcid, key);
- 	err = mt7996_mcu_add_key(&dev->mt76, vif, &msta->bip,
- 				 key, MCU_WMWA_UNI_CMD(STA_REC_UPDATE),
- 				 &msta->wcid, cmd);
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch
index c92c676..c927e1a 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch
@@ -1,7 +1,7 @@
-From 8537ca664de3e26b266e4b11f5b113f76371507c Mon Sep 17 00:00:00 2001
+From 31a7471ec1e183deafd9b28fd62cca3c25f79633 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 10 Feb 2023 17:39:23 +0800
-Subject: [PATCH 01/29] wifi: mt76: mt7996: add eht rx rate support
+Subject: [PATCH 01/22] wifi: mt76: mt7996: add eht rx rate support
 
 Add support to report eht rx rate.
 
@@ -14,7 +14,7 @@
  3 files changed, 27 insertions(+), 11 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 87902f4..e53166f 100644
+index 2c4a5290..467afef9 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -1067,9 +1067,14 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
@@ -36,7 +36,7 @@
  	status->nss = mstat.nss;
  	status->band = mstat.band;
 diff --git a/mt76.h b/mt76.h
-index 183b0fc..c3d1313 100644
+index 8b4635e9..6b07b8fa 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -621,12 +621,22 @@ struct mt76_rx_status {
@@ -67,10 +67,10 @@
  	u8 chains;
  	s8 chain_signal[IEEE80211_MAX_CHAINS];
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 3c3506c..d811b4e 100644
+index 0d51090d..23cbfdde 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -572,11 +572,12 @@ mt7996_mac_fill_rx_rate(struct mt7996_dev *dev,
+@@ -580,11 +580,12 @@ mt7996_mac_fill_rx_rate(struct mt7996_dev *dev,
  	case MT_PHY_TYPE_EHT_SU:
  	case MT_PHY_TYPE_EHT_TRIG:
  	case MT_PHY_TYPE_EHT_MU:
@@ -88,5 +88,5 @@
  	default:
  		return -EINVAL;
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0002-wifi-mt76-mt7996-let-non-bufferable-MMPDUs-use-corre.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0002-wifi-mt76-mt7996-let-non-bufferable-MMPDUs-use-corre.patch
deleted file mode 100644
index e0e8c2f..0000000
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0002-wifi-mt76-mt7996-let-non-bufferable-MMPDUs-use-corre.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From 296ef8f0ca10c825358d82f539289c2201243240 Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Thu, 16 Feb 2023 10:52:22 +0800
-Subject: [PATCH 02/29] wifi: mt76: mt7996: let non-bufferable MMPDUs use
- correct hw queue
-
-non-bufferable MMPDUs are expected to use ALTX hw queue, but current
-condition in mt7996_mac_write_txwi() won't let their tx descriptor
-be filled with correct q_idx. Fix this by passing qid parameter into
-the funciton.
-
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
-Change-Id: I18bd1a5ea698912c7aa8f4d4317d4a428d4ac440
----
- mt7996/mac.c    | 9 +++++----
- mt7996/mcu.c    | 4 ++--
- mt7996/mt7996.h | 3 ++-
- 3 files changed, 9 insertions(+), 7 deletions(-)
-
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index d811b4e..198eb71 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -982,7 +982,8 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
- }
- 
- void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
--			   struct sk_buff *skb, struct mt76_wcid *wcid, int pid,
-+			   struct sk_buff *skb, struct mt76_wcid *wcid,
-+			   enum mt76_txq_id qid, int pid,
- 			   struct ieee80211_key_conf *key, u32 changed)
- {
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-@@ -1014,7 +1015,7 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
- 	} else if (beacon) {
- 		p_fmt = MT_TX_TYPE_FW;
- 		q_idx = MT_LMAC_BCN0;
--	} else if (skb_get_queue_mapping(skb) >= MT_TXQ_PSD) {
-+	} else if (qid >= MT_TXQ_PSD) {
- 		p_fmt = MT_TX_TYPE_CT;
- 		q_idx = MT_LMAC_ALTX0;
- 	} else {
-@@ -1123,8 +1124,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- 	memset(txwi_ptr, 0, MT_TXD_SIZE);
- 	/* Transmit non qos data by 802.11 header and need to fill txd by host*/
- 	if (!is_8023 || pid >= MT_PACKET_ID_FIRST)
--		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, pid,
--				      key, 0);
-+		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, qid,
-+				      pid, key, 0);
- 
- 	txp = (struct mt76_connac_txp_common *)(txwi + MT_TXD_SIZE);
- 	for (i = 0; i < nbuf; i++) {
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 8ad51cb..dbe1057 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -1906,7 +1906,7 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
- 	}
- 
- 	buf = (u8 *)bcn + sizeof(*bcn) - MAX_BEACON_SIZE;
--	mt7996_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
-+	mt7996_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, 0, NULL,
- 			      BSS_CHANGED_BEACON);
- 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
- }
-@@ -2115,7 +2115,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
- 
- 	buf = (u8 *)tlv + sizeof(*discov) - MAX_INBAND_FRAME_SIZE;
- 
--	mt7996_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, NULL,
-+	mt7996_mac_write_txwi(dev, (__le32 *)buf, skb, wcid, 0, 0, NULL,
- 			      changed);
- 
- 	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 018dfd2..d20aa5f 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -487,7 +487,8 @@ void mt7996_mac_enable_nf(struct mt7996_dev *dev, u8 band);
- void mt7996_mac_enable_rtscts(struct mt7996_dev *dev,
- 			      struct ieee80211_vif *vif, bool enable);
- void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
--			   struct sk_buff *skb, struct mt76_wcid *wcid, int pid,
-+			   struct sk_buff *skb, struct mt76_wcid *wcid,
-+			   enum mt76_txq_id qid, int pid,
- 			   struct ieee80211_key_conf *key, u32 changed);
- void mt7996_mac_set_timing(struct mt7996_phy *phy);
- int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
--- 
-2.18.0
-
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0007-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0002-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
similarity index 82%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0007-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0002-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
index 3d4a8cf..50f83e7 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0007-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0002-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
@@ -1,7 +1,7 @@
-From 9d3d2b00d0f24547e3951f3186fd2a0f47e23ea9 Mon Sep 17 00:00:00 2001
+From 1a55033a534847f9c10ffd52e277378c1ba3e45a Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 16 Feb 2023 00:39:01 +0800
-Subject: [PATCH 07/29] wifi: mt76: mt7996: reduce repeated bss_info and
+Subject: [PATCH 02/22] wifi: mt76: mt7996: reduce repeated bss_info and
  sta_rec commands
 
 Refine the flow of setting bss_info and sta_rec commands to prevent from
@@ -14,10 +14,10 @@
  1 file changed, 6 insertions(+), 15 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index f13f67b..ab28ebe 100644
+index f306e9c5..136a0c28 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -233,8 +233,8 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+@@ -246,8 +246,8 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  	int idx = msta->wcid.idx;
  
@@ -27,7 +27,7 @@
  
  	if (vif == phy->monitor_vif)
  		phy->monitor_vif = NULL;
-@@ -502,17 +502,13 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+@@ -544,17 +544,13 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
  	/* station mode uses BSSID to map the wlan entry to a peer,
  	 * and then peer references bss_info_rfch to set bandwidth cap.
  	 */
@@ -50,9 +50,9 @@
  	if (changed & BSS_CHANGED_ERP_CTS_PROT)
  		mt7996_mac_enable_rtscts(dev, vif, info->use_cts_prot);
  
-@@ -525,11 +521,6 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
- 		}
- 	}
+@@ -575,11 +571,6 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+ 		mvif->basic_rates_idx =
+ 			mt7996_get_rates_table(hw, vif, false, false);
  
 -	if (changed & BSS_CHANGED_BEACON_ENABLED && info->enable_beacon) {
 -		mt7996_mcu_add_bss_info(phy, vif, true);
@@ -63,5 +63,5 @@
  	if (changed & (BSS_CHANGED_QOS | BSS_CHANGED_BEACON_ENABLED))
  		mt7996_mcu_set_tx(dev, vif);
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0003-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0003-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch
deleted file mode 100644
index 2174447..0000000
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0003-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From e505146b00960b7f04426f953e0b061d973354fd Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 13 Feb 2023 14:48:10 +0800
-Subject: [PATCH 03/29] wifi: mt76: mt7996: fix pointer calculation in ie
- countdown event
-
-Fix the tail and data pointers. The rxd->len in mt7996_mcu_rxd does not
-include the length of general rxd. It only includes the length of
-firmware event rxd. Use the skb->length to get the correct length.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
-Change-Id: I832194559e63e6b49b7ee00dc9c606b6106d8669
----
- mt7996/mcu.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index dbe1057..2e25572 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -422,7 +422,8 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
- 	if (hdr->band && dev->mt76.phys[hdr->band])
- 		mphy = dev->mt76.phys[hdr->band];
- 
--	tail = skb->data + le16_to_cpu(rxd->len);
-+	tail = skb->data + skb->len;
-+	data += sizeof(struct header);
- 	while (data + sizeof(struct tlv) < tail && le16_to_cpu(tlv->len)) {
- 		switch (le16_to_cpu(tlv->tag)) {
- 		case UNI_EVENT_IE_COUNTDOWN_CSA:
--- 
-2.18.0
-
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0008-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0003-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch
similarity index 75%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0008-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0003-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch
index ac3766e..d723e62 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0008-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0003-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch
@@ -1,7 +1,7 @@
-From 5ade85e2bad5f7b8736dae47a77fb76591b5c645 Mon Sep 17 00:00:00 2001
+From 61c13ad2aacdc077bc3729090702821d4777530a Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 15 Feb 2023 18:38:04 +0800
-Subject: [PATCH 08/29] wifi: mt76: mt7996: move radio enable command to
+Subject: [PATCH 03/22] wifi: mt76: mt7996: move radio enable command to
  mt7996_start()
 
 The radio enable and disable commands are used for per-phy radio, so
@@ -14,10 +14,10 @@
  1 file changed, 6 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index ab28ebe..44d23e1 100644
+index 136a0c28..28b63d44 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -46,6 +46,10 @@ static int mt7996_start(struct ieee80211_hw *hw)
+@@ -43,6 +43,10 @@ int mt7996_run(struct ieee80211_hw *hw)
  	if (ret)
  		goto out;
  
@@ -28,7 +28,7 @@
  	ret = mt7996_mcu_set_chan_info(phy, UNI_CHANNEL_RX_PATH);
  	if (ret)
  		goto out;
-@@ -73,6 +77,8 @@ static void mt7996_stop(struct ieee80211_hw *hw)
+@@ -82,6 +86,8 @@ static void mt7996_stop(struct ieee80211_hw *hw)
  
  	mutex_lock(&dev->mt76.mutex);
  
@@ -37,7 +37,7 @@
  	clear_bit(MT76_STATE_RUNNING, &phy->mt76->state);
  
  	mutex_unlock(&dev->mt76.mutex);
-@@ -181,10 +187,6 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
+@@ -190,10 +196,6 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
  	if (ret)
  		goto out;
  
@@ -48,7 +48,7 @@
  	dev->mt76.vif_mask |= BIT_ULL(mvif->mt76.idx);
  	phy->omac_mask |= BIT_ULL(mvif->mt76.omac_idx);
  
-@@ -240,7 +242,6 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+@@ -253,7 +255,6 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
  		phy->monitor_vif = NULL;
  
  	mt7996_mcu_add_dev_info(phy, vif, false);
@@ -57,5 +57,5 @@
  	rcu_assign_pointer(dev->mt76.wcid[idx], NULL);
  
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0009-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0004-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
similarity index 81%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0009-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0004-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
index f3251b2..3f55f11 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0009-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0004-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
@@ -1,7 +1,7 @@
-From 73923332230ef57e0d4ff6f6436d4133a1256a6f Mon Sep 17 00:00:00 2001
+From fb2659a8aa12346cdda4010737f63178040fa513 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 16 Feb 2023 13:53:14 +0800
-Subject: [PATCH 09/29] wifi: mt76: connac: set correct muar_idx for connac3
+Subject: [PATCH 04/22] wifi: mt76: connac: set correct muar_idx for connac3
  chipset
 
 Set the muar_idx to 0xe for the hw bcast/mcast station entry of connac3
@@ -15,10 +15,10 @@
  2 files changed, 8 insertions(+)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index b339c50..c8b91e8 100644
+index 77ca8f05..02acac64 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
-@@ -216,6 +216,11 @@ static inline bool is_connac_v1(struct mt76_dev *dev)
+@@ -240,6 +240,11 @@ static inline bool is_connac_v1(struct mt76_dev *dev)
  	return is_mt7615(dev) || is_mt7663(dev) || is_mt7622(dev);
  }
  
@@ -31,7 +31,7 @@
  {
  	switch (mt76_chip(dev)) {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index efb9bfa..4e4f6b3 100644
+index 46f69aa8..5fab6772 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -281,6 +281,9 @@ __mt76_connac_mcu_alloc_sta_req(struct mt76_dev *dev, struct mt76_vif *mvif,
@@ -45,5 +45,5 @@
  				     &hdr.wlan_idx_hi);
  	skb = mt76_mcu_msg_alloc(dev, NULL, len);
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0004-wifi-mt76-mt7996-init-mpdu-density.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0004-wifi-mt76-mt7996-init-mpdu-density.patch
deleted file mode 100644
index dab6e5b..0000000
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0004-wifi-mt76-mt7996-init-mpdu-density.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From b76cd7102b71458bb38868b8e0c2d2866aba1183 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 13 Feb 2023 09:46:40 +0800
-Subject: [PATCH 04/29] wifi: mt76: mt7996: init mpdu density
-
-Init mpdu density based on the hardware capability to
-prevent hardware drop.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7996/init.c | 9 +++++++--
- 1 file changed, 7 insertions(+), 2 deletions(-)
-
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 946da93..de94e15 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -196,10 +196,13 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
- 
- 	hw->max_tx_fragments = 4;
- 
--	if (phy->mt76->cap.has_2ghz)
-+	if (phy->mt76->cap.has_2ghz) {
- 		phy->mt76->sband_2g.sband.ht_cap.cap |=
- 			IEEE80211_HT_CAP_LDPC_CODING |
- 			IEEE80211_HT_CAP_MAX_AMSDU;
-+		phy->mt76->sband_2g.sband.ht_cap.ampdu_density =
-+			IEEE80211_HT_MPDU_DENSITY_2;
-+	}
- 
- 	if (phy->mt76->cap.has_5ghz) {
- 		phy->mt76->sband_5g.sband.ht_cap.cap |=
-@@ -211,6 +214,8 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
- 			IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK |
- 			IEEE80211_VHT_CAP_SHORT_GI_160 |
- 			IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
-+		phy->mt76->sband_5g.sband.ht_cap.ampdu_density =
-+			IEEE80211_HT_MPDU_DENSITY_1;
- 	}
- 
- 	mt76_set_stream_caps(phy->mt76, true);
-@@ -689,7 +694,7 @@ mt7996_init_he_caps(struct mt7996_phy *phy, enum nl80211_band band,
- 		u16 cap = IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
- 			  IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS;
- 
--		cap |= u16_encode_bits(IEEE80211_HT_MPDU_DENSITY_2,
-+		cap |= u16_encode_bits(IEEE80211_HT_MPDU_DENSITY_0_5,
- 				       IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START) |
- 		       u16_encode_bits(IEEE80211_VHT_MAX_AMPDU_1024K,
- 				       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP) |
--- 
-2.18.0
-
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0010-wifi-mt76-mt7996-add-muru-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0005-wifi-mt76-mt7996-add-muru-support.patch
similarity index 61%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0010-wifi-mt76-mt7996-add-muru-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0005-wifi-mt76-mt7996-add-muru-support.patch
index ed47666..1854421 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0010-wifi-mt76-mt7996-add-muru-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0005-wifi-mt76-mt7996-add-muru-support.patch
@@ -1,7 +1,7 @@
-From 15078cb8bc36fb6194ecaf65887d899f9a9c5435 Mon Sep 17 00:00:00 2001
+From 85fb9bc9f85a5e64d88db85fbfdef968d037fada Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 Date: Mon, 28 Nov 2022 14:36:09 +0800
-Subject: [PATCH 10/29] wifi: mt76: mt7996: add muru support
+Subject: [PATCH 05/22] wifi: mt76: mt7996: add muru support
 
 Add sta_rec_muru() and related phy cap for MU and RU support.
 
@@ -10,12 +10,11 @@
 Change-Id: I2206a9bb6fd6e50f4bf1380a8bea19920f1b7bfd
 ---
  mt76_connac_mcu.h |  3 ++-
- mt7996/mcu.c      | 69 ++++++++++++++++++++++++++++++++++++++++++++++-
- mt7996/mt7996.h   |  3 +++
- 3 files changed, 73 insertions(+), 2 deletions(-)
+ mt7996/mcu.c      | 57 ++++++++++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 58 insertions(+), 2 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 40a99e0..6f30a0f 100644
+index 91d98eff..8580ca59 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -518,7 +518,8 @@ struct sta_rec_muru {
@@ -29,10 +28,10 @@
  
  	struct {
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index f694743..b6bd36c 100644
+index 88e2f9d0..6812a47b 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1050,6 +1050,63 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1050,6 +1050,60 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	}
  }
  
@@ -40,7 +39,6 @@
 +mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
 +			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
 +{
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
 +	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
 +	struct sta_rec_muru *muru;
 +	struct tlv *tlv;
@@ -53,12 +51,10 @@
 +
 +	muru = (struct sta_rec_muru *)tlv;
 +
-+	muru->cfg.mimo_dl_en = mvif->cap.eht_mu_ebfer_bw80 ||
-+			       mvif->cap.eht_mu_ebfer_bw160 ||
-+			       mvif->cap.eht_mu_ebfer_bw320 ||
-+			       mvif->cap.he_mu_ebfer ||
-+			       mvif->cap.vht_mu_ebfer ||
-+			       mvif->cap.vht_mu_ebfee;
++	muru->cfg.mimo_dl_en = vif->bss_conf.eht_mu_beamformer ||
++			       vif->bss_conf.he_mu_beamformer ||
++			       vif->bss_conf.vht_mu_beamformer ||
++			       vif->bss_conf.vht_mu_beamformee;
 +	muru->cfg.ofdma_dl_en = true;
 +
 +	if (sta->deflink.vht_cap.vht_supported)
@@ -96,7 +92,7 @@
  static inline bool
  mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
  			struct ieee80211_sta *sta, bool bfee)
-@@ -1722,7 +1779,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -1727,7 +1781,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  		mt7996_mcu_sta_he_6g_tlv(skb, sta);
  		/* starec eht */
  		mt7996_mcu_sta_eht_tlv(skb, sta);
@@ -106,36 +102,6 @@
  		/* starec bfee */
  		mt7996_mcu_sta_bfee_tlv(dev, skb, vif, sta);
  		/* starec hdr trans */
-@@ -2005,6 +2063,15 @@ mt7996_mcu_beacon_check_caps(struct mt7996_phy *phy, struct ieee80211_vif *vif,
- 		vc->eht_su_ebfee =
- 			EHT_PHY(CAP0_SU_BEAMFORMEE, eht->phy_cap_info[0]) &&
- 			EHT_PHY(CAP0_SU_BEAMFORMEE, pe->phy_cap_info[0]);
-+		vc->eht_mu_ebfer_bw80 =
-+			EHT_PHY(CAP7_MU_BEAMFORMER_80MHZ, eht->phy_cap_info[7]) &&
-+			EHT_PHY(CAP7_MU_BEAMFORMER_80MHZ, pe->phy_cap_info[7]);
-+		vc->eht_mu_ebfer_bw160 =
-+			EHT_PHY(CAP7_MU_BEAMFORMER_160MHZ, eht->phy_cap_info[7]) &&
-+			EHT_PHY(CAP7_MU_BEAMFORMER_160MHZ, pe->phy_cap_info[7]);
-+		vc->eht_mu_ebfer_bw320 =
-+			EHT_PHY(CAP7_MU_BEAMFORMER_320MHZ, eht->phy_cap_info[7]) &&
-+			EHT_PHY(CAP7_MU_BEAMFORMER_320MHZ, pe->phy_cap_info[7]);
- 	}
- }
- 
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index f9d8fbf..997a0bf 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -125,6 +125,9 @@ struct mt7996_vif_cap {
- 	bool he_mu_ebfer:1;
- 	bool eht_su_ebfer:1;
- 	bool eht_su_ebfee:1;
-+	bool eht_mu_ebfer_bw80:1;
-+	bool eht_mu_ebfer_bw160:1;
-+	bool eht_mu_ebfer_bw320:1;
- };
- 
- struct mt7996_vif {
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0005-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0005-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch
deleted file mode 100644
index e6132e2..0000000
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0005-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From 1fea00cf3e5af0ae1d1b3de6d772b21b83ac7ef4 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Tue, 14 Feb 2023 18:35:43 +0800
-Subject: [PATCH 05/29] wifi: mt76: mt7996: remove mt7996_mcu_set_pm()
-
-Currently using BSS_INFO_PS command will sometimes cause packet drop in
-hw rx queue.
-Temporarily remove this function until finding the cause.
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
-Change-Id: I863fc1edb18e4d7b5dac20140dd0904875e1323c
----
- mt7996/main.c   |  8 --------
- mt7996/mcu.c    | 26 --------------------------
- mt7996/mt7996.h |  1 -
- 3 files changed, 35 deletions(-)
-
-diff --git a/mt7996/main.c b/mt7996/main.c
-index 3e4da03..f13f67b 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -52,10 +52,6 @@ static int mt7996_start(struct ieee80211_hw *hw)
- 
- 	set_bit(MT76_STATE_RUNNING, &phy->mt76->state);
- 
--	ieee80211_iterate_interfaces(dev->mt76.hw,
--				     IEEE80211_IFACE_ITER_RESUME_ALL,
--				     mt7996_mcu_set_pm, dev->mt76.hw);
--
- 	ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
- 				     MT7996_WATCHDOG_TIME);
- 
-@@ -79,10 +75,6 @@ static void mt7996_stop(struct ieee80211_hw *hw)
- 
- 	clear_bit(MT76_STATE_RUNNING, &phy->mt76->state);
- 
--	ieee80211_iterate_interfaces(dev->mt76.hw,
--				     IEEE80211_IFACE_ITER_RESUME_ALL,
--				     mt7996_mcu_set_pm, dev->mt76.hw);
--
- 	mutex_unlock(&dev->mt76.mutex);
- }
- 
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 2e25572..f694743 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -3577,32 +3577,6 @@ int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
- 				 &req, sizeof(req), true);
- }
- 
--void mt7996_mcu_set_pm(void *priv, u8 *mac, struct ieee80211_vif *vif)
--{
--#define EXIT_PM_STATE	0
--#define ENTER_PM_STATE	1
--	struct ieee80211_hw *hw = priv;
--	struct mt7996_dev *dev = mt7996_hw_dev(hw);
--	struct mt7996_phy *phy = mt7996_hw_phy(hw);
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct bss_power_save *ps;
--	struct sk_buff *skb;
--	struct tlv *tlv;
--	bool running = test_bit(MT76_STATE_RUNNING, &phy->mt76->state);
--
--	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76,
--					 MT7996_BSS_UPDATE_MAX_SIZE);
--	if (IS_ERR(skb))
--		return;
--
--	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_PS, sizeof(*ps));
--	ps = (struct bss_power_save *)tlv;
--	ps->profile = running ? EXIT_PM_STATE : ENTER_PM_STATE;
--
--	mt76_mcu_skb_send_msg(&dev->mt76, skb,
--			      MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
--}
--
- int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val)
- {
- 	struct {
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index d20aa5f..f9d8fbf 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -432,7 +432,6 @@ int mt7996_mcu_set_pulse_th(struct mt7996_dev *dev,
- int mt7996_mcu_set_radar_th(struct mt7996_dev *dev, int index,
- 			    const struct mt7996_dfs_pattern *pattern);
- int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable);
--void mt7996_mcu_set_pm(void *priv, u8 *mac, struct ieee80211_vif *vif);
- int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val);
- int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch);
- int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
--- 
-2.18.0
-
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0006-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0006-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch
deleted file mode 100644
index 597ce5d..0000000
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0006-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 1e695bf2e52c4982331e0fac7f15b6ca60fb5584 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Thu, 23 Feb 2023 19:18:45 +0800
-Subject: [PATCH 06/29] wifi: mt76: mt7996: fix eeprom antenna bitfield mask
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt7996/eeprom.h | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 8da599e..cfc4869 100644
---- a/mt7996/eeprom.h
-+++ b/mt7996/eeprom.h
-@@ -31,11 +31,11 @@ enum mt7996_eeprom_field {
- #define MT_EE_WIFI_CONF2_BAND_SEL		GENMASK(2, 0)
- 
- #define MT_EE_WIFI_CONF1_TX_PATH_BAND0		GENMASK(5, 3)
--#define MT_EE_WIFI_CONF2_TX_PATH_BAND1		GENMASK(5, 3)
--#define MT_EE_WIFI_CONF2_TX_PATH_BAND2		GENMASK(2, 0)
-+#define MT_EE_WIFI_CONF2_TX_PATH_BAND1		GENMASK(2, 0)
-+#define MT_EE_WIFI_CONF2_TX_PATH_BAND2		GENMASK(5, 3)
- #define MT_EE_WIFI_CONF4_STREAM_NUM_BAND0	GENMASK(5, 3)
--#define MT_EE_WIFI_CONF5_STREAM_NUM_BAND1	GENMASK(5, 3)
--#define MT_EE_WIFI_CONF5_STREAM_NUM_BAND2	GENMASK(2, 0)
-+#define MT_EE_WIFI_CONF5_STREAM_NUM_BAND1	GENMASK(2, 0)
-+#define MT_EE_WIFI_CONF5_STREAM_NUM_BAND2	GENMASK(5, 3)
- 
- #define MT_EE_RATE_DELTA_MASK			GENMASK(5, 0)
- #define MT_EE_RATE_DELTA_SIGN			BIT(6)
--- 
-2.18.0
-
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0011-wifi-mt76-mt7996-set-txd-v1.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0006-wifi-mt76-mt7996-set-txd-v1.patch
similarity index 72%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0011-wifi-mt76-mt7996-set-txd-v1.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0006-wifi-mt76-mt7996-set-txd-v1.patch
index b71dbcc..f9cdd1a 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0011-wifi-mt76-mt7996-set-txd-v1.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0006-wifi-mt76-mt7996-set-txd-v1.patch
@@ -1,7 +1,7 @@
-From 3c5f2f053c8115e1a0a818c9f8ba270b30d69c88 Mon Sep 17 00:00:00 2001
+From a25714fa7b610430f9aa3d4ec24647eaea505d35 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Feb 2023 10:40:33 +0800
-Subject: [PATCH 11/29] wifi: mt76: mt7996: set txd v1
+Subject: [PATCH 06/22] wifi: mt76: mt7996: set txd v1
 
 ---
  mt7996/mac.c | 3 +++
@@ -9,10 +9,10 @@
  2 files changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 198eb71..40ef5e4 100644
+index 23cbfdde..420c7403 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1096,6 +1096,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1110,6 +1110,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	struct mt76_txwi_cache *t;
  	int id, i, pid, nbuf = tx_info->nbuf - 1;
  	bool is_8023 = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP;
@@ -20,9 +20,9 @@
  	u8 *txwi = (u8 *)txwi_ptr;
  
  	if (unlikely(tx_info->skb->len <= ETH_HLEN))
-@@ -1127,6 +1128,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- 		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, qid,
- 				      pid, key, 0);
+@@ -1141,6 +1142,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key,
+ 				      pid, qid, 0);
  
 +	txd[0] |= le32_encode_bits(1, MT_TXD0_VER);
 +
@@ -30,10 +30,10 @@
  	for (i = 0; i < nbuf; i++) {
  		txp->fw.buf[i] = cpu_to_le32(tx_info->buf[i + 1].addr);
 diff --git a/mt7996/mac.h b/mt7996/mac.h
-index 2cc218f..4914d3e 100644
+index bc4e6c55..9ab8e8d2 100644
 --- a/mt7996/mac.h
 +++ b/mt7996/mac.h
-@@ -183,7 +183,8 @@ enum tx_mgnt_type {
+@@ -173,7 +173,8 @@ enum tx_mgnt_type {
  
  #define MT_TXD0_Q_IDX			GENMASK(31, 25)
  #define MT_TXD0_PKT_FMT			GENMASK(24, 23)
@@ -44,5 +44,5 @@
  
  #define MT_TXD1_FIXED_RATE		BIT(31)
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0012-wifi-mt76-mt7996-add-thermal-protection-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0007-wifi-mt76-mt7996-add-thermal-protection-support.patch
similarity index 90%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0012-wifi-mt76-mt7996-add-thermal-protection-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0007-wifi-mt76-mt7996-add-thermal-protection-support.patch
index ee6db36..526edc7 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0012-wifi-mt76-mt7996-add-thermal-protection-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0007-wifi-mt76-mt7996-add-thermal-protection-support.patch
@@ -1,7 +1,7 @@
-From 198d3e931e8f24534b63314334454f3254db7892 Mon Sep 17 00:00:00 2001
+From 7d85212987815786ceff28379015a6bb23012dc3 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 2 Feb 2023 21:20:31 +0800
-Subject: [PATCH 12/29] wifi: mt76: mt7996: add thermal protection support
+Subject: [PATCH 07/22] wifi: mt76: mt7996: add thermal protection support
 
 This commit includes the following changes:
 1. implement MTK thermal protection driver API
@@ -10,15 +10,15 @@
 Change-Id: I8fecc28f5b17ee50ae4644d1dd17d188dd694731
 ---
  mt76_connac_mcu.h |   1 +
- mt7996/init.c     | 105 +++++++++++++++++++++++++++++++++++++++++++++
+ mt7996/init.c     | 103 ++++++++++++++++++++++++++++++++++++++++++++
  mt7996/main.c     |   8 ++++
  mt7996/mcu.c      | 106 ++++++++++++++++++++++++++++++++++++++++++++++
  mt7996/mcu.h      |  44 +++++++++++++++++++
  mt7996/mt7996.h   |  15 +++++++
- 6 files changed, 279 insertions(+)
+ 6 files changed, 277 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 6f30a0f..fa10d82 100644
+index 8580ca59..c5c48349 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1009,6 +1009,7 @@ enum {
@@ -30,10 +30,10 @@
  
  #define MCU_UNI_CMD_EVENT			BIT(1)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index de94e15..44165a3 100644
+index f1b48cdd..53852ffc 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -41,6 +41,98 @@ static const struct ieee80211_iface_combination if_comb[] = {
+@@ -42,6 +42,98 @@ static const struct ieee80211_iface_combination if_comb[] = {
  	}
  };
  
@@ -132,7 +132,7 @@
  static void mt7996_led_set_config(struct led_classdev *led_cdev,
  				  u8 delay_on, u8 delay_off)
  {
-@@ -372,6 +464,10 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
+@@ -389,6 +481,10 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
  	if (ret)
  		goto error;
  
@@ -143,7 +143,7 @@
  	ret = mt7996_init_debugfs(phy);
  	if (ret)
  		goto error;
-@@ -392,6 +488,8 @@ mt7996_unregister_phy(struct mt7996_phy *phy, enum mt76_band_id band)
+@@ -409,6 +505,8 @@ mt7996_unregister_phy(struct mt7996_phy *phy, enum mt76_band_id band)
  	if (!phy)
  		return;
  
@@ -152,7 +152,7 @@
  	mphy = phy->dev->mt76.phys[band];
  	mt76_unregister_phy(mphy);
  	ieee80211_free_hw(mphy->hw);
-@@ -881,6 +979,10 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -879,6 +977,10 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -163,21 +163,19 @@
  	ieee80211_queue_work(mt76_hw(dev), &dev->init_work);
  
  	ret = mt7996_register_phy(dev, mt7996_phy2(dev), MT_BAND1);
-@@ -898,6 +1000,9 @@ void mt7996_unregister_device(struct mt7996_dev *dev)
+@@ -902,6 +1004,7 @@ void mt7996_unregister_device(struct mt7996_dev *dev)
  {
  	mt7996_unregister_phy(mt7996_phy3(dev), MT_BAND2);
  	mt7996_unregister_phy(mt7996_phy2(dev), MT_BAND1);
-+
 +	mt7996_unregister_thermal(&dev->phy);
-+
+ 	mt7996_coredump_unregister(dev);
  	mt76_unregister_device(&dev->mt76);
  	mt7996_mcu_exit(dev);
- 	mt7996_tx_token_put(dev);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 44d23e1..d8d578c 100644
+index 28b63d44..fbb7270d 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -54,6 +54,14 @@ static int mt7996_start(struct ieee80211_hw *hw)
+@@ -51,6 +51,14 @@ int mt7996_run(struct ieee80211_hw *hw)
  	if (ret)
  		goto out;
  
@@ -193,7 +191,7 @@
  
  	ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index b6bd36c..3820a63 100644
+index 6812a47b..325051bd 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -443,6 +443,34 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
@@ -241,7 +239,7 @@
  	default:
  		break;
  	}
-@@ -3277,6 +3308,81 @@ out:
+@@ -3178,6 +3209,81 @@ out:
  	return 0;
  }
  
@@ -324,7 +322,7 @@
  {
  	struct {
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index dd0c5ac..7fefc28 100644
+index d7075a4d..778deedf 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -30,6 +30,28 @@ struct mt7996_mcu_uni_event {
@@ -393,12 +391,12 @@
  	UNI_CMD_ACCESS_REG_BASIC = 0x0,
  	UNI_CMD_ACCESS_RF_REG_BASIC,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 997a0bf..25b20fa 100644
+index 4d7dcb95..36337808 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -43,6 +43,13 @@
- #define MT7996_MAX_STA_TWT_AGRT		8
- #define MT7996_MAX_QUEUE		(__MT_RXQ_MAX +	__MT_MCUQ_MAX + 3)
+@@ -47,6 +47,13 @@
+ #define MT7996_BASIC_RATES_TBL		11
+ #define MT7996_BEACON_RATES_TBL		25
  
 +#define MT7996_THERMAL_THROTTLE_MAX	100
 +#define MT7996_CDEV_THROTTLE_MAX	99
@@ -410,7 +408,7 @@
  struct mt7996_vif;
  struct mt7996_sta;
  struct mt7996_dfs_pulse;
-@@ -211,6 +218,11 @@ struct mt7996_phy {
+@@ -209,6 +216,11 @@ struct mt7996_phy {
  
  	struct ieee80211_vif *monitor_vif;
  
@@ -422,7 +420,7 @@
  	u32 rxfilter;
  	u64 omac_mask;
  
-@@ -437,6 +449,9 @@ int mt7996_mcu_set_radar_th(struct mt7996_dev *dev, int index,
+@@ -457,6 +469,9 @@ int mt7996_mcu_set_radar_th(struct mt7996_dev *dev, int index,
  int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable);
  int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val);
  int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch);
@@ -433,5 +431,5 @@
  		       u8 rx_sel, u8 val);
  int mt7996_mcu_rdd_background_enable(struct mt7996_phy *phy,
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0013-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0008-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
similarity index 91%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0013-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0008-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
index b680326..9e0668a 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0013-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0008-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
@@ -1,7 +1,7 @@
-From a0190f9cb1bc65c5dced813fa1929de9bb714d9f Mon Sep 17 00:00:00 2001
+From 72f33a06b35ae981db88d12cd8db267ce68b9e08 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 2 Feb 2023 20:53:42 +0800
-Subject: [PATCH 13/29] wifi: mt76: mt7996: add thermal sensor device support
+Subject: [PATCH 08/22] wifi: mt76: mt7996: add thermal sensor device support
 
 ---
  mt7996/init.c | 87 +++++++++++++++++++++++++++++++++++++++++++++++++++
@@ -9,7 +9,7 @@
  2 files changed, 128 insertions(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 44165a3..7350194 100644
+index 53852ffc..9c5d20ad 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -4,6 +4,8 @@
@@ -21,7 +21,7 @@
  #include <linux/thermal.h>
  #include "mt7996.h"
  #include "mac.h"
-@@ -41,6 +43,81 @@ static const struct ieee80211_iface_combination if_comb[] = {
+@@ -42,6 +44,81 @@ static const struct ieee80211_iface_combination if_comb[] = {
  	}
  };
  
@@ -103,7 +103,7 @@
  static int
  mt7996_thermal_get_max_throttle_state(struct thermal_cooling_device *cdev,
  				      unsigned long *state)
-@@ -112,6 +189,7 @@ static int mt7996_thermal_init(struct mt7996_phy *phy)
+@@ -113,6 +190,7 @@ static int mt7996_thermal_init(struct mt7996_phy *phy)
  {
  	struct wiphy *wiphy = phy->mt76->hw->wiphy;
  	struct thermal_cooling_device *cdev;
@@ -111,7 +111,7 @@
  	const char *name;
  
  	name = devm_kasprintf(&wiphy->dev, GFP_KERNEL, "mt7996_%s",
-@@ -130,6 +208,15 @@ static int mt7996_thermal_init(struct mt7996_phy *phy)
+@@ -131,6 +209,15 @@ static int mt7996_thermal_init(struct mt7996_phy *phy)
  	phy->throttle_temp[MT7996_CRIT_TEMP_IDX] = MT7996_CRIT_TEMP;
  	phy->throttle_temp[MT7996_MAX_TEMP_IDX] = MT7996_MAX_TEMP;
  
@@ -128,10 +128,10 @@
  }
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 3820a63..b332658 100644
+index 325051bd..f3fd2fd4 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3308,6 +3308,47 @@ out:
+@@ -3209,6 +3209,47 @@ out:
  	return 0;
  }
  
@@ -180,5 +180,5 @@
  int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state)
  {
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0016-wifi-mt76-mt7996-add-dsp-firmware-download.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0009-wifi-mt76-mt7996-add-dsp-firmware-download.patch
similarity index 91%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0016-wifi-mt76-mt7996-add-dsp-firmware-download.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0009-wifi-mt76-mt7996-add-dsp-firmware-download.patch
index 0301e1e..eb65330 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0016-wifi-mt76-mt7996-add-dsp-firmware-download.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0009-wifi-mt76-mt7996-add-dsp-firmware-download.patch
@@ -1,7 +1,7 @@
-From a23a49eb89ce2abc3370f452bc1915a061b864bd Mon Sep 17 00:00:00 2001
+From 9b6e04ff1ac32161c6aacb939b2ff51bdced9629 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 17 Feb 2023 14:13:38 +0800
-Subject: [PATCH 16/29] wifi: mt76: mt7996: add dsp firmware download
+Subject: [PATCH 09/22] wifi: mt76: mt7996: add dsp firmware download
 
 Add DSP firmware for phy related control. Without this patch,the
 firmware state would not be ready.
@@ -15,7 +15,7 @@
  4 files changed, 50 insertions(+), 53 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index fa10d82..79dde31 100644
+index c5c48349..fbb1206f 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -22,6 +22,7 @@
@@ -27,10 +27,10 @@
  #define PATCH_SEC_NOT_SUPPORT		GENMASK(31, 0)
  #define PATCH_SEC_TYPE_MASK		GENMASK(15, 0)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index a949ff7..09800ff 100644
+index f3fd2fd4..73d5dedf 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2353,7 +2353,7 @@ out:
+@@ -2241,7 +2241,7 @@ out:
  static int
  mt7996_mcu_send_ram_firmware(struct mt7996_dev *dev,
  			     const struct mt7996_fw_trailer *hdr,
@@ -39,7 +39,7 @@
  {
  	int i, offset = 0;
  	u32 override = 0, option = 0;
-@@ -2365,8 +2365,10 @@ mt7996_mcu_send_ram_firmware(struct mt7996_dev *dev,
+@@ -2253,8 +2253,10 @@ mt7996_mcu_send_ram_firmware(struct mt7996_dev *dev,
  
  		region = (const struct mt7996_fw_region *)((const u8 *)hdr -
  			 (hdr->n_region - i) * sizeof(*region));
@@ -51,7 +51,7 @@
  		len = le32_to_cpu(region->len);
  		addr = le32_to_cpu(region->addr);
  
-@@ -2393,8 +2395,10 @@ mt7996_mcu_send_ram_firmware(struct mt7996_dev *dev,
+@@ -2281,8 +2283,10 @@ mt7996_mcu_send_ram_firmware(struct mt7996_dev *dev,
  	if (override)
  		option |= FW_START_OVERRIDE;
  
@@ -63,7 +63,7 @@
  
  	return mt76_connac_mcu_start_firmware(&dev->mt76, override, option);
  }
-@@ -2405,56 +2409,40 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
+@@ -2293,56 +2297,40 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
  	const struct firmware *fw;
  	int ret;
  
@@ -155,7 +155,7 @@
  	return ret;
  }
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 923e6fc..c2f8900 100644
+index 36337808..ab4521a4 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -29,6 +29,7 @@
@@ -166,7 +166,7 @@
  #define MT7996_ROM_PATCH		"mediatek/mt7996/mt7996_rom_patch.bin"
  
  #define MT7996_EEPROM_DEFAULT		"mediatek/mt7996/mt7996_eeprom.bin"
-@@ -55,6 +56,12 @@ struct mt7996_sta;
+@@ -59,6 +60,12 @@ struct mt7996_sta;
  struct mt7996_dfs_pulse;
  struct mt7996_dfs_pattern;
  
@@ -180,7 +180,7 @@
  	MT7996_TXQ_FWDL = 16,
  	MT7996_TXQ_MCU_WM,
 diff --git a/mt7996/pci.c b/mt7996/pci.c
-index 64aee3f..c530105 100644
+index 64aee3fb..c5301050 100644
 --- a/mt7996/pci.c
 +++ b/mt7996/pci.c
 @@ -219,4 +219,5 @@ MODULE_DEVICE_TABLE(pci, mt7996_pci_device_table);
@@ -190,5 +190,5 @@
 +MODULE_FIRMWARE(MT7996_FIRMWARE_DSP);
  MODULE_FIRMWARE(MT7996_ROM_PATCH);
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0017-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0010-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch
similarity index 76%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0017-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0010-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch
index 2372387..caa9b1a 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0017-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0010-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch
@@ -1,7 +1,7 @@
-From 8f28593519b8a46b666d67e98112222377272f48 Mon Sep 17 00:00:00 2001
+From ee3a2aa33145d17d3be17af85583437f079e91fb Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 2 Mar 2023 15:44:52 +0800
-Subject: [PATCH 17/29] wifi: mt76: mt7996: fix icv error when enable AP and
+Subject: [PATCH 10/22] wifi: mt76: mt7996: fix icv error when enable AP and
  STA simultaneously
 
 Fix mcu command content to prevent ICV error
@@ -14,10 +14,10 @@
  1 file changed, 3 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 09800ff..07c521c 100644
+index 73d5dedf..6d11bc1a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -744,6 +744,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -743,6 +743,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  	struct cfg80211_chan_def *chandef = &phy->chandef;
  	struct mt76_connac_bss_basic_tlv *bss;
  	u32 type = CONNECTION_INFRA_AP;
@@ -25,7 +25,7 @@
  	struct tlv *tlv;
  	int idx;
  
-@@ -763,7 +764,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -762,7 +763,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  				struct mt76_wcid *wcid;
  
  				wcid = (struct mt76_wcid *)sta->drv_priv;
@@ -34,7 +34,7 @@
  			}
  			rcu_read_unlock();
  		}
-@@ -783,7 +784,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -782,7 +783,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
  	bss->dtim_period = vif->bss_conf.dtim_period;
  	bss->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
@@ -44,5 +44,5 @@
  	bss->omac_idx = mvif->omac_idx;
  	bss->band_idx = mvif->band_idx;
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0018-wifi-mt76-mt7996-set-wcid-in-txp.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0011-wifi-mt76-mt7996-set-wcid-in-txp.patch
similarity index 78%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0018-wifi-mt76-mt7996-set-wcid-in-txp.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0011-wifi-mt76-mt7996-set-wcid-in-txp.patch
index fa53759..d612bdf 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0018-wifi-mt76-mt7996-set-wcid-in-txp.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0011-wifi-mt76-mt7996-set-wcid-in-txp.patch
@@ -1,7 +1,7 @@
-From a3732513f3acab7c60cdfe39909850b43c1a0839 Mon Sep 17 00:00:00 2001
+From 952869c0b481651e9c125d5cd7c4ea2b255521c5 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 6 Mar 2023 15:52:26 +0800
-Subject: [PATCH 18/29] wifi: mt76: mt7996: set wcid in txp
+Subject: [PATCH 11/22] wifi: mt76: mt7996: set wcid in txp
 
 Set correct wcid in txp for SDO to get wtbl.
 
@@ -11,10 +11,10 @@
  1 file changed, 5 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 4c0c8f1..bb23f53 100644
+index 420c7403..ca163969 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1168,10 +1168,12 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1169,10 +1169,12 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	}
  
  	txp->fw.token = cpu_to_le16(id);
@@ -31,5 +31,5 @@
  
  	/* pass partial skb header to fw */
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0019-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0012-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch
similarity index 74%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0019-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0012-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch
index e8a856b..f05fe30 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0019-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0012-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch
@@ -1,7 +1,7 @@
-From 9db64ef2800ce8f6d0a1f37273ca2922d57326d0 Mon Sep 17 00:00:00 2001
+From 9af2057cec3d77aafb4f92b8d1542d88c8ac5efc Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 17 Mar 2023 11:08:04 +0800
-Subject: [PATCH 19/29] wifi: mt76: mt7996: init he and eht cap for AP_VLAN
+Subject: [PATCH 12/22] wifi: mt76: mt7996: init he and eht cap for AP_VLAN
 
 Add AP_VLAN types in __mt7996_set_stream_he_eht_caps to
 initialize the ht and eht caps. Without this patch, the
@@ -14,10 +14,10 @@
  1 file changed, 1 insertion(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 479b2ce..381917a 100644
+index 9c5d20ad..d44e3ae9 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -996,6 +996,7 @@ __mt7996_set_stream_he_eht_caps(struct mt7996_phy *phy,
+@@ -993,6 +993,7 @@ __mt7996_set_stream_he_eht_caps(struct mt7996_phy *phy,
  		switch (i) {
  		case NL80211_IFTYPE_STATION:
  		case NL80211_IFTYPE_AP:
@@ -26,5 +26,5 @@
  		case NL80211_IFTYPE_MESH_POINT:
  #endif
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0020-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0013-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch
similarity index 75%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0020-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0013-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch
index debf1a6..b2ed6a1 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0020-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0013-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch
@@ -1,7 +1,7 @@
-From e0d5636b28358017571697b1e2ee0a1ee5500647 Mon Sep 17 00:00:00 2001
+From 854db11781bd8f9fa7cb45ed529223a4784de9d9 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 16 Mar 2023 16:09:51 +0800
-Subject: [PATCH 20/29] wifi: mt76: mt7996: fix beamform mcu cmd configuration
+Subject: [PATCH 13/22] wifi: mt76: mt7996: fix beamform mcu cmd configuration
 
 bf_num means how many band can support beamform, so the value shall be 3.
 bf_bitmap represents which band can support beamform.
@@ -10,10 +10,10 @@
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 07c521c..ed1abe1 100644
+index 6d11bc1a..df1ae639 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3506,8 +3506,8 @@ int mt7996_mcu_set_txbf(struct mt7996_dev *dev, u8 action)
+@@ -3394,8 +3394,8 @@ int mt7996_mcu_set_txbf(struct mt7996_dev *dev, u8 action)
  
  		tlv = mt7996_mcu_add_uni_tlv(skb, action, sizeof(*req_mod_en));
  		req_mod_en = (struct bf_mod_en_ctrl *)tlv;
@@ -25,5 +25,5 @@
  	}
  	default:
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0014-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0014-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch
new file mode 100644
index 0000000..461236e
--- /dev/null
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0014-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch
@@ -0,0 +1,31 @@
+From b1296ffe7596adf514bc2b5397c946e276e30176 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Tue, 7 Mar 2023 17:05:01 +0800
+Subject: [PATCH 14/22] wifi: mt76: mt7996: Fix using the wrong phy for
+ background radar event
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7996/mcu.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index df1ae639..cd86209b 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -339,7 +339,11 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
+ 	if (r->band_idx >= ARRAY_SIZE(dev->mt76.phys))
+ 		return;
+ 
+-	mphy = dev->mt76.phys[r->band_idx];
++	if (dev->rdd2_phy && r->band_idx == MT_RX_SEL2)
++		mphy = dev->rdd2_phy->mt76;
++	else
++		mphy = dev->mt76.phys[r->band_idx];
++
+ 	if (!mphy)
+ 		return;
+ 
+-- 
+2.39.2
+
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0014-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0014-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch
deleted file mode 100644
index 5541738..0000000
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0014-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch
+++ /dev/null
@@ -1,126 +0,0 @@
-From d8f7b7ae8934a0107bf9f36c2c5199a767febad6 Mon Sep 17 00:00:00 2001
-From: Bo Jiao <Bo.Jiao@mediatek.com>
-Date: Mon, 6 Feb 2023 11:34:51 +0800
-Subject: [PATCH 14/29] wifi: mt76: mt7996: add 802.11s mesh amsdu/de-amsdu
- support
-
-Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
----
- mt7996/mac.c  | 15 ++++++++++++++-
- mt7996/mac.h  |  2 ++
- mt7996/mcu.c  |  9 ++++++++-
- mt7996/mcu.h  |  2 +-
- mt7996/mmio.c |  3 ++-
- 5 files changed, 27 insertions(+), 4 deletions(-)
-
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 40ef5e4..8dc3a62 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -633,6 +633,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb)
- 	u32 rxd4 = le32_to_cpu(rxd[4]);
- 	u32 csum_mask = MT_RXD0_NORMAL_IP_SUM | MT_RXD0_NORMAL_UDP_TCP_SUM;
- 	u32 csum_status = *(u32 *)skb->cb;
-+	u32 mesh_mask = MT_RXD0_MESH | MT_RXD0_MHCP;
- 	bool unicast, insert_ccmp_hdr = false;
- 	u8 remove_pad, amsdu_info, band_idx;
- 	u8 mode = 0, qos_ctl = 0;
-@@ -825,6 +826,9 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb)
- 
- 		skb_pull(skb, hdr_gap);
- 		if (!hdr_trans && status->amsdu) {
-+		    if(ieee80211_has_a4(fc) && ((rxd0 & mesh_mask) == mesh_mask))
-+			pad_start = 0;
-+		    else
- 			pad_start = ieee80211_get_hdrlen_from_skb(skb);
- 		} else if (hdr_trans && (rxd2 & MT_RXD2_NORMAL_HDR_TRANS_ERROR)) {
- 			/* When header translation failure is indicated,
-@@ -857,8 +861,17 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, struct sk_buff *skb)
- 		hdr = mt76_skb_get_hdr(skb);
- 		fc = hdr->frame_control;
- 		if (ieee80211_is_data_qos(fc)) {
-+			u8 *p = ieee80211_get_qos_ctl(hdr);
-+
- 			seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
--			qos_ctl = *ieee80211_get_qos_ctl(hdr);
-+			qos_ctl = *p;
-+
-+			/* the hardware support mesh de-amsdu by default,
-+			 * so, clear amsdu present bit in the Qos Control field.
-+			 */
-+			if (ieee80211_has_a4(fc) && status->amsdu &&
-+			    ((rxd0 & mesh_mask) == mesh_mask))
-+				*p &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;
- 		}
- 	} else {
- 		status->flag |= RX_FLAG_8023;
-diff --git a/mt7996/mac.h b/mt7996/mac.h
-index 4914d3e..e48cc68 100644
---- a/mt7996/mac.h
-+++ b/mt7996/mac.h
-@@ -12,6 +12,8 @@
- #define MT_RXD0_LENGTH			GENMASK(15, 0)
- #define MT_RXD0_PKT_TYPE		GENMASK(31, 27)
- 
-+#define MT_RXD0_MESH			BIT(18)
-+#define MT_RXD0_MHCP			BIT(19)
- #define MT_RXD0_NORMAL_ETH_TYPE_OFS	GENMASK(22, 16)
- #define MT_RXD0_NORMAL_IP_SUM		BIT(23)
- #define MT_RXD0_NORMAL_UDP_TCP_SUM	BIT(24)
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index b332658..0dbe2e0 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -1054,7 +1054,8 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- 	struct tlv *tlv;
- 
- 	if (vif->type != NL80211_IFTYPE_STATION &&
--	    vif->type != NL80211_IFTYPE_AP)
-+	    vif->type != NL80211_IFTYPE_AP &&
-+	    vif->type != NL80211_IFTYPE_MESH_POINT)
- 		return;
- 
- 	if (!sta->deflink.agg.max_amsdu_len)
-@@ -1560,6 +1561,12 @@ mt7996_mcu_sta_hdr_trans_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- 		hdr_trans->to_ds = true;
- 		hdr_trans->from_ds = true;
- 	}
-+
-+	if (vif->type == NL80211_IFTYPE_MESH_POINT) {
-+		hdr_trans->to_ds = true;
-+		hdr_trans->from_ds = true;
-+		hdr_trans->mesh = true;
-+	}
- }
- 
- static enum mcu_mmps_mode
-diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 7fefc28..ad66a1f 100644
---- a/mt7996/mcu.h
-+++ b/mt7996/mcu.h
-@@ -434,7 +434,7 @@ struct sta_rec_hdr_trans {
- 	u8 from_ds;
- 	u8 to_ds;
- 	u8 dis_rx_hdr_tran;
--	u8 rsv;
-+	u8 mesh;
- } __packed;
- 
- struct hdr_trans_en {
-diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 902370a..6610cc4 100644
---- a/mt7996/mmio.c
-+++ b/mt7996/mmio.c
-@@ -320,7 +320,8 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
- 		/* txwi_size = txd size + txp size */
- 		.txwi_size = MT_TXD_SIZE + sizeof(struct mt76_connac_fw_txp),
- 		.drv_flags = MT_DRV_TXWI_NO_FREE |
--			     MT_DRV_HW_MGMT_TXQ,
-+			     MT_DRV_HW_MGMT_TXQ |
-+			     MT_DRV_AMSDU_OFFLOAD,
- 		.survey_flags = SURVEY_INFO_TIME_TX |
- 				SURVEY_INFO_TIME_RX |
- 				SURVEY_INFO_TIME_BSS_RX,
--- 
-2.18.0
-
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0015-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0015-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch
deleted file mode 100644
index 1751cb6..0000000
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0015-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch
+++ /dev/null
@@ -1,948 +0,0 @@
-From 0809af5eefeebb30854486e1e928c06ed0a667d6 Mon Sep 17 00:00:00 2001
-From: Bo Jiao <Bo.Jiao@mediatek.com>
-Date: Mon, 13 Feb 2023 18:00:25 +0800
-Subject: [PATCH 15/29] wifi: mt76: mt7996: add L0.5 system error recovery
- support
-
-Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
----
- mt7996/debugfs.c | 155 +++++++++++++++++++++++---
- mt7996/dma.c     |  65 +++++++++++
- mt7996/init.c    |   9 +-
- mt7996/mac.c     | 285 +++++++++++++++++++++++++++++++++++++++--------
- mt7996/main.c    |  18 ++-
- mt7996/mcu.c     |  22 ++--
- mt7996/mcu.h     |  28 +++--
- mt7996/mmio.c    |   7 +-
- mt7996/mt7996.h  |  17 ++-
- mt7996/regs.h    |  36 +++++-
- 10 files changed, 542 insertions(+), 100 deletions(-)
-
-diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 9c5e9ac..f2c46a5 100644
---- a/mt7996/debugfs.c
-+++ b/mt7996/debugfs.c
-@@ -48,12 +48,12 @@ DEFINE_DEBUGFS_ATTRIBUTE(fops_implicit_txbf, mt7996_implicit_txbf_get,
- 
- /* test knob of system error recovery */
- static ssize_t
--mt7996_fw_ser_set(struct file *file, const char __user *user_buf,
--		  size_t count, loff_t *ppos)
-+mt7996_sys_recovery_set(struct file *file, const char __user *user_buf,
-+			size_t count, loff_t *ppos)
- {
- 	struct mt7996_phy *phy = file->private_data;
- 	struct mt7996_dev *dev = phy->dev;
--	u8 band_idx = phy->mt76->band_idx;
-+	bool band = phy->mt76->band_idx;
- 	char buf[16];
- 	int ret = 0;
- 	u16 val;
-@@ -73,17 +73,49 @@ mt7996_fw_ser_set(struct file *file, const char __user *user_buf,
- 		return -EINVAL;
- 
- 	switch (val) {
--	case SER_SET_RECOVER_L1:
--	case SER_SET_RECOVER_L2:
--	case SER_SET_RECOVER_L3_RX_ABORT:
--	case SER_SET_RECOVER_L3_TX_ABORT:
--	case SER_SET_RECOVER_L3_TX_DISABLE:
--	case SER_SET_RECOVER_L3_BF:
--		ret = mt7996_mcu_set_ser(dev, SER_ENABLE, BIT(val), band_idx);
-+	/*
-+	 * 0: grab firmware current SER state.
-+	 * 1: trigger & enable system error L1 recovery.
-+	 * 2: trigger & enable system error L2 recovery.
-+	 * 3: trigger & enable system error L3 rx abort.
-+	 * 4: trigger & enable system error L3 tx abort.
-+	 * 5: trigger & enable system error L3 tx disable.
-+	 * 6: trigger & enable system error L3 bf recovery.
-+	 * 7: trigger & enable system error L4 MDP recovery.
-+	 * 8: trigger & enable system error full recovery.
-+	 * 9: trigger firmware crash.
-+	 */
-+	case UNI_CMD_SER_QUERY:
-+		ret = mt7996_mcu_set_ser(dev, UNI_CMD_SER_QUERY, 0, band);
-+		break;
-+	case UNI_CMD_SER_SET_RECOVER_L1:
-+	case UNI_CMD_SER_SET_RECOVER_L2:
-+	case UNI_CMD_SER_SET_RECOVER_L3_RX_ABORT:
-+	case UNI_CMD_SER_SET_RECOVER_L3_TX_ABORT:
-+	case UNI_CMD_SER_SET_RECOVER_L3_TX_DISABLE:
-+	case UNI_CMD_SER_SET_RECOVER_L3_BF:
-+	case UNI_CMD_SER_SET_RECOVER_L4_MDP:
-+		ret = mt7996_mcu_set_ser(dev, UNI_CMD_SER_SET, BIT(val), band);
-+		if (ret)
-+			return ret;
-+
-+		ret = mt7996_mcu_set_ser(dev, UNI_CMD_SER_TRIGGER, val, band);
-+		break;
-+
-+	/* enable full chip reset */
-+	case UNI_CMD_SER_SET_RECOVER_FULL:
-+		mt76_set(dev, MT_WFDMA0_MCU_HOST_INT_ENA, MT_MCU_CMD_WDT_MASK);
- 		if (ret)
- 			return ret;
- 
--		ret = mt7996_mcu_set_ser(dev, SER_RECOVER, val, band_idx);
-+		dev->recovery.state |= MT_MCU_CMD_WDT_MASK;
-+		mt7996_reset(dev);
-+		break;
-+
-+	/* WARNING: trigger firmware crash */
-+	case UNI_CMD_SER_SET_SYSTEM_ASSERT:
-+		mt76_wr(dev, MT_MCU_WM_CIRQ_EINT_MASK_CLR_ADDR, BIT(18));
-+		mt76_wr(dev, MT_MCU_WM_CIRQ_EINT_SOFT_ADDR, BIT(18));
- 		break;
- 	default:
- 		break;
-@@ -92,9 +124,101 @@ mt7996_fw_ser_set(struct file *file, const char __user *user_buf,
- 	return ret ? ret : count;
- }
- 
--static const struct file_operations mt7996_fw_ser_ops = {
--	.write = mt7996_fw_ser_set,
--	/* TODO: ser read */
-+static ssize_t
-+mt7996_sys_recovery_get(struct file *file, char __user *user_buf,
-+			size_t count, loff_t *ppos)
-+{
-+	struct mt7996_phy *phy = file->private_data;
-+	struct mt7996_dev *dev = phy->dev;
-+	char *buff;
-+	int desc = 0;
-+	ssize_t ret;
-+	static const size_t bufsz = 1024;
-+
-+	buff = kmalloc(bufsz, GFP_KERNEL);
-+	if (!buff)
-+		return -ENOMEM;
-+
-+	/* HELP */
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "Please echo the correct value ...\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "0: grab firmware transient SER state\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "1: trigger system error L1 recovery\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "2: trigger system error L2 recovery\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "3: trigger system error L3 rx abort\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "4: trigger system error L3 tx abort\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "5: trigger system error L3 tx disable\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "6: trigger system error L3 bf recovery\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "7: trigger system error L4 MDP recovery\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "8: trigger system error full recovery\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "9: trigger firmware crash\n");
-+
-+	/* SER statistics */
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "\nlet's dump firmware SER statistics...\n");
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_STATUS        = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_SER_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_PLE_ERR       = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_PLE_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_PLE_ERR_1     = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_PLE1_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_PLE_ERR_AMSDU = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_PLE_AMSDU_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_PSE_ERR       = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_PSE_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_PSE_ERR_1     = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_PSE1_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_LMAC_WISR6_B0 = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_LAMC_WISR6_BN0_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_LMAC_WISR6_B1 = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_LAMC_WISR6_BN1_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_LMAC_WISR6_B2 = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_LAMC_WISR6_BN2_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_LMAC_WISR7_B0 = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_LAMC_WISR7_BN0_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_LMAC_WISR7_B1 = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_LAMC_WISR7_BN1_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_LMAC_WISR7_B2 = 0x%08x\n",
-+			  mt76_rr(dev, MT_SWDEF_LAMC_WISR7_BN2_STATS));
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "::E  R , SER_WFDMA_ERR = 0x%08x\n",
-+			  mt76_rr(dev, WF_SWDEF_WFDMA_STATUS_ADDR));
-+
-+	desc += scnprintf(buff + desc, bufsz - desc,
-+			  "\nSYS_RESET_COUNT: WM %d, WA %d\n",
-+			  dev->recovery.wm_reset_count,
-+			  dev->recovery.wa_reset_count);
-+
-+	ret = simple_read_from_buffer(user_buf, count, ppos, buff, desc);
-+	kfree(buff);
-+	return ret;
-+}
-+
-+static const struct file_operations mt7996_sys_recovery_ops = {
-+	.write = mt7996_sys_recovery_set,
-+	.read = mt7996_sys_recovery_get,
- 	.open = simple_open,
- 	.llseek = default_llseek,
- };
-@@ -674,6 +798,8 @@ int mt7996_init_debugfs(struct mt7996_phy *phy)
- 	debugfs_create_file("xmit-queues", 0400, dir, phy,
- 			    &mt7996_xmit_queues_fops);
- 	debugfs_create_file("tx_stats", 0400, dir, phy, &mt7996_tx_stats_fops);
-+	debugfs_create_file("sys_recovery", 0600, dir, phy,
-+			    &mt7996_sys_recovery_ops);
- 	debugfs_create_file("fw_debug_wm", 0600, dir, dev, &fops_fw_debug_wm);
- 	debugfs_create_file("fw_debug_wa", 0600, dir, dev, &fops_fw_debug_wa);
- 	debugfs_create_file("fw_debug_bin", 0600, dir, dev, &fops_fw_debug_bin);
-@@ -684,7 +810,6 @@ int mt7996_init_debugfs(struct mt7996_phy *phy)
- 			    &fops_implicit_txbf);
- 	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
- 				    mt7996_twt_stats);
--	debugfs_create_file("fw_ser", 0600, dir, phy, &mt7996_fw_ser_ops);
- 	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
- 
- 	if (phy->mt76->cap.has_5ghz) {
-diff --git a/mt7996/dma.c b/mt7996/dma.c
-index c09fe42..18ea758 100644
---- a/mt7996/dma.c
-+++ b/mt7996/dma.c
-@@ -352,6 +352,71 @@ int mt7996_dma_init(struct mt7996_dev *dev)
- 	return 0;
- }
- 
-+void mt7996_dma_reset(struct mt7996_dev *dev, bool force)
-+{
-+	struct mt76_phy *phy2 = dev->mt76.phys[MT_BAND1];
-+	struct mt76_phy *phy3 = dev->mt76.phys[MT_BAND2];
-+	u32 hif1_ofs = MT_WFDMA0_PCIE1(0) - MT_WFDMA0(0);
-+	int i;
-+
-+	mt76_clear(dev, MT_WFDMA0_GLO_CFG,
-+		   MT_WFDMA0_GLO_CFG_TX_DMA_EN |
-+		   MT_WFDMA0_GLO_CFG_RX_DMA_EN);
-+
-+	if (dev->hif2)
-+		mt76_clear(dev, MT_WFDMA0_GLO_CFG + hif1_ofs,
-+			   MT_WFDMA0_GLO_CFG_TX_DMA_EN |
-+			   MT_WFDMA0_GLO_CFG_RX_DMA_EN);
-+
-+	usleep_range(1000, 2000);
-+
-+	for (i = 0; i < __MT_TXQ_MAX; i++) {
-+		mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[i], true);
-+		if (phy2)
-+			mt76_queue_tx_cleanup(dev, phy2->q_tx[i], true);
-+		if (phy3)
-+			mt76_queue_tx_cleanup(dev, phy3->q_tx[i], true);
-+	}
-+
-+	for (i = 0; i < __MT_MCUQ_MAX; i++)
-+		mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[i], true);
-+
-+	mt76_for_each_q_rx(&dev->mt76, i)
-+		//mt76_queue_rx_reset(dev, i);
-+		mt76_queue_rx_cleanup(dev, &dev->mt76.q_rx[i]);
-+
-+	mt76_tx_status_check(&dev->mt76, true);
-+
-+	/* reset wfsys */
-+	if (force)
-+		mt7996_wfsys_reset(dev);
-+
-+	mt7996_dma_disable(dev, force);
-+
-+	/* reset hw queues */
-+	for (i = 0; i < __MT_TXQ_MAX; i++) {
-+		mt76_queue_reset(dev, dev->mphy.q_tx[i]);
-+		if (phy2)
-+			mt76_queue_reset(dev, phy2->q_tx[i]);
-+		if (phy3)
-+			mt76_queue_reset(dev, phy3->q_tx[i]);
-+	}
-+
-+	for (i = 0; i < __MT_MCUQ_MAX; i++)
-+		mt76_queue_reset(dev, dev->mt76.q_mcu[i]);
-+
-+	mt76_for_each_q_rx(&dev->mt76, i) {
-+		mt76_queue_reset(dev, &dev->mt76.q_rx[i]);
-+	}
-+
-+	mt76_tx_status_check(&dev->mt76, true);
-+
-+	mt76_for_each_q_rx(&dev->mt76, i)
-+		mt76_queue_rx_reset(dev, i);
-+
-+	mt7996_dma_enable(dev);
-+}
-+
- void mt7996_dma_cleanup(struct mt7996_dev *dev)
- {
- 	mt7996_dma_disable(dev, true);
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 7350194..479b2ce 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -278,8 +278,7 @@ static void mt7996_led_set_brightness(struct led_classdev *led_cdev,
- 		mt7996_led_set_config(led_cdev, 0xff, 0);
- }
- 
--static void
--mt7996_init_txpower(struct mt7996_dev *dev,
-+void mt7996_init_txpower(struct mt7996_dev *dev,
- 		    struct ieee80211_supported_band *sband)
- {
- 	int i, nss = hweight8(dev->mphy.antenna_mask);
-@@ -434,7 +433,7 @@ mt7996_mac_init_band(struct mt7996_dev *dev, u8 band)
- 	mt76_rmw(dev, MT_WTBLOFF_RSCR(band), mask, set);
- }
- 
--static void mt7996_mac_init(struct mt7996_dev *dev)
-+void mt7996_mac_init(struct mt7996_dev *dev)
- {
- #define HIF_TXD_V2_1	4
- 	int i;
-@@ -468,7 +467,7 @@ static void mt7996_mac_init(struct mt7996_dev *dev)
- 		mt7996_mac_init_band(dev, i);
- }
- 
--static int mt7996_txbf_init(struct mt7996_dev *dev)
-+int mt7996_txbf_init(struct mt7996_dev *dev)
- {
- 	int ret;
- 
-@@ -1080,6 +1079,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
- 	if (ret)
- 		return ret;
- 
-+	dev->recovery.hw_init_done = true;
-+
- 	return mt7996_init_debugfs(&dev->phy);
- }
- 
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 8dc3a62..4c0c8f1 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -1724,7 +1724,7 @@ mt7996_wait_reset_state(struct mt7996_dev *dev, u32 state)
- 	bool ret;
- 
- 	ret = wait_event_timeout(dev->reset_wait,
--				 (READ_ONCE(dev->reset_state) & state),
-+				 (READ_ONCE(dev->recovery.state) & state),
- 				 MT7996_RESET_TIMEOUT);
- 
- 	WARN(!ret, "Timeout waiting for MCU reset state %x\n", state);
-@@ -1773,68 +1773,208 @@ mt7996_update_beacons(struct mt7996_dev *dev)
- 					    mt7996_update_vif_beacon, phy3->hw);
- }
- 
--static void
--mt7996_dma_reset(struct mt7996_dev *dev)
-+void mt7996_tx_token_put(struct mt7996_dev *dev)
- {
--	struct mt76_phy *phy2 = dev->mt76.phys[MT_BAND1];
--	struct mt76_phy *phy3 = dev->mt76.phys[MT_BAND2];
--	u32 hif1_ofs = MT_WFDMA0_PCIE1(0) - MT_WFDMA0(0);
--	int i;
-+	struct mt76_txwi_cache *txwi;
-+	int id;
- 
--	mt76_clear(dev, MT_WFDMA0_GLO_CFG,
--		   MT_WFDMA0_GLO_CFG_TX_DMA_EN |
--		   MT_WFDMA0_GLO_CFG_RX_DMA_EN);
-+	spin_lock_bh(&dev->mt76.token_lock);
-+	idr_for_each_entry(&dev->mt76.token, txwi, id) {
-+		mt7996_txwi_free(dev, txwi, NULL, NULL);
-+		dev->mt76.token_count--;
-+	}
-+	spin_unlock_bh(&dev->mt76.token_lock);
-+	idr_destroy(&dev->mt76.token);
-+}
- 
--	if (dev->hif2)
--		mt76_clear(dev, MT_WFDMA0_GLO_CFG + hif1_ofs,
--			   MT_WFDMA0_GLO_CFG_TX_DMA_EN |
--			   MT_WFDMA0_GLO_CFG_RX_DMA_EN);
- 
--	usleep_range(1000, 2000);
-+static int
-+mt7996_mac_restart(struct mt7996_dev *dev)
-+{
-+	struct mt7996_phy *phy2, *phy3;
-+	struct mt76_dev *mdev = &dev->mt76;
-+	int i, ret;
- 
--	for (i = 0; i < __MT_TXQ_MAX; i++) {
--		mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[i], true);
--		if (phy2)
--			mt76_queue_tx_cleanup(dev, phy2->q_tx[i], true);
--		if (phy3)
--			mt76_queue_tx_cleanup(dev, phy3->q_tx[i], true);
-+	phy2 = mt7996_phy2(dev);
-+	phy3 = mt7996_phy3(dev);
-+
-+	if (dev->hif2) {
-+		mt76_wr(dev, MT_INT1_MASK_CSR, 0x0);
-+		mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0);
- 	}
- 
--	for (i = 0; i < __MT_MCUQ_MAX; i++)
--		mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[i], true);
-+	if (dev_is_pci(mdev->dev)) {
-+		mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0x0);
-+		if (dev->hif2)
-+			mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0x0);
-+	}
- 
--	mt76_for_each_q_rx(&dev->mt76, i)
--		mt76_queue_rx_reset(dev, i);
-+	set_bit(MT76_RESET, &dev->mphy.state);
-+	set_bit(MT76_MCU_RESET, &dev->mphy.state);
-+	wake_up(&dev->mt76.mcu.wait);
-+	if (phy2) {
-+		set_bit(MT76_RESET, &phy2->mt76->state);
-+		set_bit(MT76_MCU_RESET, &phy2->mt76->state);
-+	}
-+	if (phy3) {
-+		set_bit(MT76_RESET, &phy3->mt76->state);
-+		set_bit(MT76_MCU_RESET, &phy3->mt76->state);
-+	}
- 
--	mt76_tx_status_check(&dev->mt76, true);
-+	/* lock/unlock all queues to ensure that no tx is pending */
-+	mt76_txq_schedule_all(&dev->mphy);
-+	if (phy2)
-+		mt76_txq_schedule_all(phy2->mt76);
-+	if (phy3)
-+		mt76_txq_schedule_all(phy3->mt76);
-+
-+	/* disable all tx/rx napi */
-+	mt76_worker_disable(&dev->mt76.tx_worker);
-+	mt76_for_each_q_rx(mdev, i) {
-+		if (mdev->q_rx[i].ndesc)
-+			napi_disable(&dev->mt76.napi[i]);
-+	}
-+	napi_disable(&dev->mt76.tx_napi);
- 
--	/* re-init prefetch settings after reset */
--	mt7996_dma_prefetch(dev);
-+	/* token reinit */
-+	mt7996_tx_token_put(dev);
-+	idr_init(&dev->mt76.token);
- 
--	mt76_set(dev, MT_WFDMA0_GLO_CFG,
--		 MT_WFDMA0_GLO_CFG_TX_DMA_EN | MT_WFDMA0_GLO_CFG_RX_DMA_EN);
-+	mt7996_dma_reset(dev, true);
- 
--	if (dev->hif2)
--		mt76_set(dev, MT_WFDMA0_GLO_CFG + hif1_ofs,
--			 MT_WFDMA0_GLO_CFG_TX_DMA_EN |
--			 MT_WFDMA0_GLO_CFG_RX_DMA_EN);
-+	local_bh_disable();
-+	mt76_for_each_q_rx(mdev, i) {
-+		if (mdev->q_rx[i].ndesc) {
-+			napi_enable(&dev->mt76.napi[i]);
-+			napi_schedule(&dev->mt76.napi[i]);
-+		}
-+	}
-+	local_bh_enable();
-+	clear_bit(MT76_MCU_RESET, &dev->mphy.state);
-+	clear_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
-+
-+	mt76_wr(dev, MT_INT_MASK_CSR, dev->mt76.mmio.irqmask);
-+	mt76_wr(dev, MT_INT_SOURCE_CSR, ~0);
-+	if (dev->hif2) {
-+		mt76_wr(dev, MT_INT1_MASK_CSR, dev->mt76.mmio.irqmask);
-+		mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0);
-+	}
-+	if (dev_is_pci(mdev->dev)) {
-+		mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0xff);
-+		if (dev->hif2)
-+			mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0xff);
-+	}
-+
-+	/* load firmware */
-+	ret = mt7996_mcu_init_firmware(dev);
-+	if (ret)
-+		goto out;
-+
-+	/* set the necessary init items */
-+	ret = mt7996_mcu_set_eeprom(dev);
-+	if (ret)
-+		goto out;
-+
-+	mt7996_mac_init(dev);
-+	mt7996_init_txpower(dev, &dev->mphy.sband_2g.sband);
-+	mt7996_init_txpower(dev, &dev->mphy.sband_5g.sband);
-+	mt7996_init_txpower(dev, &dev->mphy.sband_6g.sband);
-+	ret = mt7996_txbf_init(dev);
-+
-+	if (test_bit(MT76_STATE_RUNNING, &dev->mphy.state)) {
-+		ret = mt7996_run(dev->mphy.hw);
-+		if (ret)
-+			goto out;
-+	}
-+
-+	if (phy2 && test_bit(MT76_STATE_RUNNING, &phy2->mt76->state)) {
-+		ret = mt7996_run(phy2->mt76->hw);
-+		if (ret)
-+			goto out;
-+	}
-+
-+	if (phy3 && test_bit(MT76_STATE_RUNNING, &phy3->mt76->state)) {
-+		ret = mt7996_run(phy3->mt76->hw);
-+		if (ret)
-+			goto out;
-+	}
-+
-+out:
-+	/* reset done */
-+	clear_bit(MT76_RESET, &dev->mphy.state);
-+	if (phy2)
-+		clear_bit(MT76_RESET, &phy2->mt76->state);
-+	if (phy3)
-+		clear_bit(MT76_RESET, &phy3->mt76->state);
-+
-+	local_bh_disable();
-+	napi_enable(&dev->mt76.tx_napi);
-+	napi_schedule(&dev->mt76.tx_napi);
-+	local_bh_enable();
-+
-+	mt76_worker_enable(&dev->mt76.tx_worker);
-+	return ret;
- }
- 
--void mt7996_tx_token_put(struct mt7996_dev *dev)
-+static void
-+mt7996_mac_full_reset(struct mt7996_dev *dev)
- {
--	struct mt76_txwi_cache *txwi;
--	int id;
-+	struct mt7996_phy *phy2, *phy3;
-+	int i;
- 
--	spin_lock_bh(&dev->mt76.token_lock);
--	idr_for_each_entry(&dev->mt76.token, txwi, id) {
--		mt7996_txwi_free(dev, txwi, NULL, NULL);
--		dev->mt76.token_count--;
-+	phy2 = mt7996_phy2(dev);
-+	phy3 = mt7996_phy3(dev);
-+	dev->recovery.hw_full_reset = true;
-+
-+	wake_up(&dev->mt76.mcu.wait);
-+	ieee80211_stop_queues(mt76_hw(dev));
-+	if (phy2)
-+		ieee80211_stop_queues(phy2->mt76->hw);
-+	if (phy3)
-+		ieee80211_stop_queues(phy3->mt76->hw);
-+
-+	cancel_delayed_work_sync(&dev->mphy.mac_work);
-+	if (phy2)
-+		cancel_delayed_work_sync(&phy2->mt76->mac_work);
-+	if (phy3)
-+		cancel_delayed_work_sync(&phy3->mt76->mac_work);
-+
-+	mutex_lock(&dev->mt76.mutex);
-+	for (i = 0; i < 10; i++) {
-+		if (!mt7996_mac_restart(dev))
-+			break;
- 	}
--	spin_unlock_bh(&dev->mt76.token_lock);
--	idr_destroy(&dev->mt76.token);
-+	mutex_unlock(&dev->mt76.mutex);
-+
-+	if (i == 10)
-+		dev_err(dev->mt76.dev, "chip full reset failed\n");
-+
-+	ieee80211_restart_hw(mt76_hw(dev));
-+	if (phy2)
-+		ieee80211_restart_hw(phy2->mt76->hw);
-+	if (phy3)
-+		ieee80211_restart_hw(phy3->mt76->hw);
-+
-+	ieee80211_wake_queues(mt76_hw(dev));
-+	if (phy2)
-+		ieee80211_wake_queues(phy2->mt76->hw);
-+	if (phy3)
-+		ieee80211_wake_queues(phy3->mt76->hw);
-+
-+	dev->recovery.hw_full_reset = false;
-+	ieee80211_queue_delayed_work(mt76_hw(dev),
-+				     &dev->mphy.mac_work,
-+				     MT7996_WATCHDOG_TIME);
-+	if (phy2)
-+		ieee80211_queue_delayed_work(phy2->mt76->hw,
-+					     &phy2->mt76->mac_work,
-+					     MT7996_WATCHDOG_TIME);
-+	if (phy3)
-+		ieee80211_queue_delayed_work(phy3->mt76->hw,
-+					     &phy3->mt76->mac_work,
-+					     MT7996_WATCHDOG_TIME);
- }
- 
--/* system error recovery */
- void mt7996_mac_reset_work(struct work_struct *work)
- {
- 	struct mt7996_phy *phy2, *phy3;
-@@ -1845,9 +1985,36 @@ void mt7996_mac_reset_work(struct work_struct *work)
- 	phy2 = mt7996_phy2(dev);
- 	phy3 = mt7996_phy3(dev);
- 
--	if (!(READ_ONCE(dev->reset_state) & MT_MCU_CMD_STOP_DMA))
-+	/* chip full reset */
-+	if (dev->recovery.restart) {
-+		/* disable WA/WM WDT */
-+		mt76_clear(dev, MT_WFDMA0_MCU_HOST_INT_ENA,
-+			   MT_MCU_CMD_WDT_MASK);
-+
-+		if (READ_ONCE(dev->recovery.state) & MT_MCU_CMD_WA_WDT)
-+			dev->recovery.wa_reset_count++;
-+		else
-+			dev->recovery.wm_reset_count++;
-+
-+		mt7996_mac_full_reset(dev);
-+
-+		/* enable mcu irq */
-+		mt7996_irq_enable(dev, MT_INT_MCU_CMD);
-+		mt7996_irq_disable(dev, 0);
-+
-+		/* enable WA/WM WDT */
-+		mt76_set(dev, MT_WFDMA0_MCU_HOST_INT_ENA, MT_MCU_CMD_WDT_MASK);
-+
-+		dev->recovery.state = MT_MCU_CMD_NORMAL_STATE;
-+		dev->recovery.restart = false;
- 		return;
-+	}
- 
-+	if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA))
-+		return;
-+
-+	dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.",
-+		 wiphy_name(dev->mt76.hw->wiphy));
- 	ieee80211_stop_queues(mt76_hw(dev));
- 	if (phy2)
- 		ieee80211_stop_queues(phy2->mt76->hw);
-@@ -1876,7 +2043,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
- 	mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_STOPPED);
- 
- 	if (mt7996_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) {
--		mt7996_dma_reset(dev);
-+		mt7996_dma_reset(dev, false);
- 
- 		mt7996_tx_token_put(dev);
- 		idr_init(&dev->mt76.token);
-@@ -1931,6 +2098,32 @@ void mt7996_mac_reset_work(struct work_struct *work)
- 		ieee80211_queue_delayed_work(phy3->mt76->hw,
- 					     &phy3->mt76->mac_work,
- 					     MT7996_WATCHDOG_TIME);
-+	dev_info(dev->mt76.dev,"\n%s L1 SER recovery completed.",
-+		 wiphy_name(dev->mt76.hw->wiphy));
-+}
-+
-+void mt7996_reset(struct mt7996_dev *dev)
-+{
-+	if (!dev->recovery.hw_init_done)
-+		return;
-+
-+	if (dev->recovery.hw_full_reset)
-+		return;
-+
-+	/* wm/wa exception: do full recovery */
-+	if (READ_ONCE(dev->recovery.state) & MT_MCU_CMD_WDT_MASK) {
-+		dev->recovery.restart = true;
-+		dev_info(dev->mt76.dev,
-+			 "%s indicated firmware crash, attempting recovery\n",
-+			 wiphy_name(dev->mt76.hw->wiphy));
-+
-+		mt7996_irq_disable(dev, MT_INT_MCU_CMD);
-+		queue_work(dev->mt76.wq, &dev->reset_work);
-+		return;
-+	}
-+
-+	queue_work(dev->mt76.wq, &dev->reset_work);
-+	wake_up(&dev->reset_wait);
- }
- 
- void mt7996_mac_update_stats(struct mt7996_phy *phy)
-diff --git a/mt7996/main.c b/mt7996/main.c
-index d8d578c..cb0e0d3 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -22,17 +22,13 @@ static bool mt7996_dev_running(struct mt7996_dev *dev)
- 	return phy && test_bit(MT76_STATE_RUNNING, &phy->mt76->state);
- }
- 
--static int mt7996_start(struct ieee80211_hw *hw)
-+int mt7996_run(struct ieee80211_hw *hw)
- {
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
- 	bool running;
- 	int ret;
- 
--	flush_work(&dev->init_work);
--
--	mutex_lock(&dev->mt76.mutex);
--
- 	running = mt7996_dev_running(dev);
- 	if (!running) {
- 		ret = mt7996_mcu_set_hdr_trans(dev, true);
-@@ -71,6 +67,18 @@ static int mt7996_start(struct ieee80211_hw *hw)
- 		mt7996_mac_reset_counters(phy);
- 
- out:
-+	return ret;
-+}
-+
-+static int mt7996_start(struct ieee80211_hw *hw)
-+{
-+	struct mt7996_dev *dev = mt7996_hw_dev(hw);
-+	int ret;
-+
-+	flush_work(&dev->init_work);
-+
-+	mutex_lock(&dev->mt76.mutex);
-+	ret = mt7996_run(hw);
- 	mutex_unlock(&dev->mt76.mutex);
- 
- 	return ret;
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 0dbe2e0..a949ff7 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -2629,17 +2629,10 @@ mt7996_mcu_init_rx_airtime(struct mt7996_dev *dev)
- 				     MCU_WM_UNI_CMD(VOW), true);
- }
- 
--int mt7996_mcu_init(struct mt7996_dev *dev)
-+int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
- {
--	static const struct mt76_mcu_ops mt7996_mcu_ops = {
--		.headroom = sizeof(struct mt76_connac2_mcu_txd), /* reuse */
--		.mcu_skb_send_msg = mt7996_mcu_send_message,
--		.mcu_parse_response = mt7996_mcu_parse_response,
--	};
- 	int ret;
- 
--	dev->mt76.mcu_ops = &mt7996_mcu_ops;
--
- 	/* force firmware operation mode into normal state,
- 	 * which should be set before firmware download stage.
- 	 */
-@@ -2680,6 +2673,19 @@ int mt7996_mcu_init(struct mt7996_dev *dev)
- 				 MCU_WA_PARAM_RED, 0, 0);
- }
- 
-+int mt7996_mcu_init(struct mt7996_dev *dev)
-+{
-+	static const struct mt76_mcu_ops mt7996_mcu_ops = {
-+		.headroom = sizeof(struct mt76_connac2_mcu_txd), /* reuse */
-+		.mcu_skb_send_msg = mt7996_mcu_send_message,
-+		.mcu_parse_response = mt7996_mcu_parse_response,
-+	};
-+
-+	dev->mt76.mcu_ops = &mt7996_mcu_ops;
-+
-+	return mt7996_mcu_init_firmware(dev);
-+}
-+
- void mt7996_mcu_exit(struct mt7996_dev *dev)
- {
- 	mt7996_mcu_restart(&dev->mt76);
-diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index ad66a1f..778deed 100644
---- a/mt7996/mcu.h
-+++ b/mt7996/mcu.h
-@@ -692,23 +692,21 @@ enum {
- };
- 
- enum {
--	UNI_CMD_SER_QUERY = 0x0,
--	UNI_CMD_SER_SET = 0x2,
--	UNI_CMD_SER_TRIGGER = 0x3,
--};
--
--enum {
--	SER_QUERY,
-+	UNI_CMD_SER_QUERY,
- 	/* recovery */
--	SER_SET_RECOVER_L1,
--	SER_SET_RECOVER_L2,
--	SER_SET_RECOVER_L3_RX_ABORT,
--	SER_SET_RECOVER_L3_TX_ABORT,
--	SER_SET_RECOVER_L3_TX_DISABLE,
--	SER_SET_RECOVER_L3_BF,
-+	UNI_CMD_SER_SET_RECOVER_L1,
-+	UNI_CMD_SER_SET_RECOVER_L2,
-+	UNI_CMD_SER_SET_RECOVER_L3_RX_ABORT,
-+	UNI_CMD_SER_SET_RECOVER_L3_TX_ABORT,
-+	UNI_CMD_SER_SET_RECOVER_L3_TX_DISABLE,
-+	UNI_CMD_SER_SET_RECOVER_L3_BF,
-+	UNI_CMD_SER_SET_RECOVER_L4_MDP,
-+	UNI_CMD_SER_SET_RECOVER_FULL,
-+	UNI_CMD_SER_SET_SYSTEM_ASSERT,
- 	/* action */
--	SER_ENABLE = 2,
--	SER_RECOVER
-+	UNI_CMD_SER_ENABLE = 1,
-+	UNI_CMD_SER_SET,
-+	UNI_CMD_SER_TRIGGER
- };
- 
- enum {
-diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 6610cc4..0e11f39 100644
---- a/mt7996/mmio.c
-+++ b/mt7996/mmio.c
-@@ -289,10 +289,9 @@ static void mt7996_irq_tasklet(struct tasklet_struct *t)
- 		u32 val = mt76_rr(dev, MT_MCU_CMD);
- 
- 		mt76_wr(dev, MT_MCU_CMD, val);
--		if (val & MT_MCU_CMD_ERROR_MASK) {
--			dev->reset_state = val;
--			ieee80211_queue_work(mt76_hw(dev), &dev->reset_work);
--			wake_up(&dev->reset_wait);
-+		if (val & (MT_MCU_CMD_ERROR_MASK | MT_MCU_CMD_WDT_MASK)) {
-+			dev->recovery.state = val;
-+			mt7996_reset(dev);
- 		}
- 	}
- }
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 25b20fa..923e6fc 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -268,7 +268,14 @@ struct mt7996_dev {
- 	struct work_struct rc_work;
- 	struct work_struct reset_work;
- 	wait_queue_head_t reset_wait;
--	u32 reset_state;
-+	struct {
-+		u32 state;
-+		u32 wa_reset_count;
-+		u32 wm_reset_count;
-+		bool hw_full_reset:1;
-+		bool hw_init_done:1;
-+		bool restart:1;
-+	} recovery;
- 
- 	struct list_head sta_rc_list;
- 	struct list_head sta_poll_list;
-@@ -401,9 +408,16 @@ int mt7996_eeprom_get_target_power(struct mt7996_dev *dev,
- 				   struct ieee80211_channel *chan);
- s8 mt7996_eeprom_get_power_delta(struct mt7996_dev *dev, int band);
- int mt7996_dma_init(struct mt7996_dev *dev);
-+void mt7996_dma_reset(struct mt7996_dev *dev, bool force);
- void mt7996_dma_prefetch(struct mt7996_dev *dev);
- void mt7996_dma_cleanup(struct mt7996_dev *dev);
-+void mt7996_init_txpower(struct mt7996_dev *dev,
-+		    struct ieee80211_supported_band *sband);
-+int mt7996_txbf_init(struct mt7996_dev *dev);
-+void mt7996_reset(struct mt7996_dev *dev);
-+int mt7996_run(struct ieee80211_hw *hw);
- int mt7996_mcu_init(struct mt7996_dev *dev);
-+int mt7996_mcu_init_firmware(struct mt7996_dev *dev);
- int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
- 			       struct mt7996_vif *mvif,
- 			       struct mt7996_twt_flow *flow,
-@@ -496,6 +510,7 @@ static inline void mt7996_irq_disable(struct mt7996_dev *dev, u32 mask)
- 		mt76_set_irq_mask(&dev->mt76, MT_INT_MASK_CSR, mask, 0);
- }
- 
-+void mt7996_mac_init(struct mt7996_dev *dev);
- u32 mt7996_mac_wtbl_lmac_addr(struct mt7996_dev *dev, u16 wcid, u8 dw);
- bool mt7996_mac_wtbl_update(struct mt7996_dev *dev, int idx, u32 mask);
- void mt7996_mac_reset_counters(struct mt7996_phy *phy);
-diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 7a28cae..0775ca5 100644
---- a/mt7996/regs.h
-+++ b/mt7996/regs.h
-@@ -317,6 +317,8 @@ enum base_rev {
- #define MT_WFDMA0_RX_INT_PCIE_SEL		MT_WFDMA0(0x154)
- #define MT_WFDMA0_RX_INT_SEL_RING3		BIT(3)
- 
-+#define MT_WFDMA0_MCU_HOST_INT_ENA		MT_WFDMA0(0x1f4)
-+
- #define MT_WFDMA0_GLO_CFG			MT_WFDMA0(0x208)
- #define MT_WFDMA0_GLO_CFG_TX_DMA_EN		BIT(0)
- #define MT_WFDMA0_GLO_CFG_RX_DMA_EN		BIT(2)
-@@ -444,6 +446,10 @@ enum base_rev {
- #define MT_MCU_CMD_NORMAL_STATE			BIT(5)
- #define MT_MCU_CMD_ERROR_MASK			GENMASK(5, 1)
- 
-+#define MT_MCU_CMD_WA_WDT			BIT(31)
-+#define MT_MCU_CMD_WM_WDT			BIT(30)
-+#define MT_MCU_CMD_WDT_MASK			GENMASK(31, 30)
-+
- /* l1/l2 remap */
- #define MT_HIF_REMAP_L1				0x155024
- #define MT_HIF_REMAP_L1_MASK			GENMASK(31, 16)
-@@ -468,8 +474,27 @@ enum base_rev {
- #define MT_INFRA_MCU_END			0x7c3fffff
- 
- /* FW MODE SYNC */
--#define MT_SWDEF_MODE				0x9143c
-+#define MT_SWDEF_BASE				0x00401400
-+
-+#define MT_SWDEF(ofs)				(MT_SWDEF_BASE + (ofs))
-+#define MT_SWDEF_MODE				MT_SWDEF(0x3c)
- #define MT_SWDEF_NORMAL_MODE			0
-+#define MT_SWDEF_ICAP_MODE			1
-+#define MT_SWDEF_SPECTRUM_MODE			2
-+
-+#define MT_SWDEF_SER_STATS			MT_SWDEF(0x040)
-+#define MT_SWDEF_PLE_STATS			MT_SWDEF(0x044)
-+#define MT_SWDEF_PLE1_STATS			MT_SWDEF(0x048)
-+#define MT_SWDEF_PLE_AMSDU_STATS		MT_SWDEF(0x04C)
-+#define MT_SWDEF_PSE_STATS			MT_SWDEF(0x050)
-+#define MT_SWDEF_PSE1_STATS			MT_SWDEF(0x054)
-+#define MT_SWDEF_LAMC_WISR6_BN0_STATS		MT_SWDEF(0x058)
-+#define MT_SWDEF_LAMC_WISR6_BN1_STATS		MT_SWDEF(0x05C)
-+#define MT_SWDEF_LAMC_WISR6_BN2_STATS		MT_SWDEF(0x060)
-+#define MT_SWDEF_LAMC_WISR7_BN0_STATS		MT_SWDEF(0x064)
-+#define MT_SWDEF_LAMC_WISR7_BN1_STATS		MT_SWDEF(0x068)
-+#define MT_SWDEF_LAMC_WISR7_BN2_STATS		MT_SWDEF(0x06C)
-+#define WF_SWDEF_WFDMA_STATUS_ADDR		MT_SWDEF(0x090)
- 
- /* LED */
- #define MT_LED_TOP_BASE				0x18013000
-@@ -506,7 +531,7 @@ enum base_rev {
- #define MT_TOP_MISC_FW_STATE			GENMASK(2, 0)
- 
- #define MT_HW_REV				0x70010204
--#define MT_WF_SUBSYS_RST			0x70002600
-+#define MT_WF_SUBSYS_RST			0x70028600
- 
- /* PCIE MAC */
- #define MT_PCIE_MAC_BASE			0x74030000
-@@ -539,4 +564,11 @@ enum base_rev {
- #define MT_WF_PHYRX_CSD_BAND_RXTD12_IRPI_SW_CLR_ONLY	BIT(18)
- #define MT_WF_PHYRX_CSD_BAND_RXTD12_IRPI_SW_CLR		BIT(29)
- 
-+#define MT_MCU_WM_CIRQ_BASE			0x89010000
-+#define MT_MCU_WM_CIRQ(ofs)			(MT_MCU_WM_CIRQ_BASE + (ofs))
-+#define MT_MCU_WM_CIRQ_IRQ_MASK_CLR_ADDR	MT_MCU_WM_CIRQ(0x80)
-+#define MT_MCU_WM_CIRQ_IRQ_SOFT_ADDR		MT_MCU_WM_CIRQ(0xc0)
-+#define MT_MCU_WM_CIRQ_EINT_MASK_CLR_ADDR	MT_MCU_WM_CIRQ(0x108)
-+#define MT_MCU_WM_CIRQ_EINT_SOFT_ADDR		MT_MCU_WM_CIRQ(0x118)
-+
- #endif
--- 
-2.18.0
-
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0022-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0015-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch
similarity index 93%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0022-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0015-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch
index 62909d1..1e2ec3b 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0022-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0015-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch
@@ -1,7 +1,7 @@
-From ee568eb941838f834f16bf65867a83935ff1ac83 Mon Sep 17 00:00:00 2001
+From c1d0d0a15d4cdafa1ed0a61606fd5fefa85a6bb7 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 20 Dec 2022 09:47:31 +0800
-Subject: [PATCH 22/29] wifi: mt76: mt7996: support more options in
+Subject: [PATCH 15/22] wifi: mt76: mt7996: support more options in
  .set_bitrate_mask()
 
 With this patch, driver can support runtime configuration for single
@@ -12,10 +12,10 @@
  1 file changed, 137 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index cc6c6a4..a0d468d 100644
+index cd86209b..8a7487ba 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1616,6 +1616,136 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
+@@ -1610,6 +1610,136 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
  				     MCU_WM_UNI_CMD(RA), true);
  }
  
@@ -152,7 +152,7 @@
  static void
  mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
-@@ -1725,6 +1855,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -1719,6 +1849,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
  	struct sk_buff *skb;
@@ -160,7 +160,7 @@
  
  	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
  					      &msta->wcid,
-@@ -1744,8 +1875,12 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -1738,8 +1869,12 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	 */
  	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
  
@@ -176,5 +176,5 @@
  
  static int
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0023-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0016-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch
similarity index 68%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0023-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0016-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch
index 0567253..c756ccd 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0023-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0016-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch
@@ -1,7 +1,7 @@
-From 057869b174019d83f5ff3db97608e489f2808036 Mon Sep 17 00:00:00 2001
+From aa539aaae8a95f3e970ad8e1f5a7381bb249ad7e Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 17 Mar 2023 11:16:44 +0800
-Subject: [PATCH 23/29] wifi: mt76: mt7996: fill txwi by SW temporarily
+Subject: [PATCH 16/22] wifi: mt76: mt7996: fill txwi by SW temporarily
 
 If use WA to fill TXD, it cannot ping pass.
 Remove this patch after bug fix.
@@ -12,22 +12,22 @@
  1 file changed, 3 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index bb23f53..cddb1df 100644
+index ca163969..7059a4e1 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1137,9 +1137,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1138,9 +1138,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb);
  	memset(txwi_ptr, 0, MT_TXD_SIZE);
  	/* Transmit non qos data by 802.11 header and need to fill txd by host*/
 -	if (!is_8023 || pid >= MT_PACKET_ID_FIRST)
--		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, qid,
--				      pid, key, 0);
-+	mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, qid,
-+			      pid, key, 0);
+-		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key,
+-				      pid, qid, 0);
++	mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key,
++			      pid, qid, 0);
  
  	txd[0] |= le32_encode_bits(1, MT_TXD0_VER);
  
-@@ -1152,8 +1151,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1153,8 +1152,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  
  	txp->fw.flags = cpu_to_le16(MT_CT_INFO_FROM_HOST);
  
@@ -38,5 +38,5 @@
  	if (!key)
  		txp->fw.flags |= cpu_to_le16(MT_CT_INFO_NONE_CIPHER_FRAME);
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0024-wifi-mt76-mt7996-update-wmm-queue-mapping.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0017-wifi-mt76-mt7996-update-wmm-queue-mapping.patch
similarity index 80%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0024-wifi-mt76-mt7996-update-wmm-queue-mapping.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0017-wifi-mt76-mt7996-update-wmm-queue-mapping.patch
index 4e4abd2..659e580 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0024-wifi-mt76-mt7996-update-wmm-queue-mapping.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0017-wifi-mt76-mt7996-update-wmm-queue-mapping.patch
@@ -1,7 +1,7 @@
-From a2453d9011651714108a899aa791eb80925613c7 Mon Sep 17 00:00:00 2001
+From c3611ca1b4d8260dee8893cb922ad2ad0a8eb8d7 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 20 Mar 2023 19:09:59 +0800
-Subject: [PATCH 24/29] wifi: mt76: mt7996: update wmm queue mapping
+Subject: [PATCH 17/22] wifi: mt76: mt7996: update wmm queue mapping
 
 The mac80211 use mac80211 queue (MQ) and the firmware
 use access class index (ACI) so convert the MQ to ACI
@@ -14,10 +14,10 @@
  2 files changed, 10 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index cb0e0d3..4e9536e 100644
+index fbb7270d..059cc420 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -197,7 +197,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
+@@ -198,7 +198,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
  	mvif->mt76.omac_idx = idx;
  	mvif->phy = phy;
  	mvif->mt76.band_idx = band_idx;
@@ -26,7 +26,7 @@
  
  	ret = mt7996_mcu_add_dev_info(phy, vif, true);
  	if (ret)
-@@ -419,9 +419,16 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -423,9 +423,16 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	       const struct ieee80211_tx_queue_params *params)
  {
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -45,10 +45,10 @@
  
  	return 0;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index a0d468d..deb6e1e 100644
+index 8a7487ba..43a4f939 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2902,7 +2902,7 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
+@@ -2789,7 +2789,7 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
  
  		e = (struct edca *)tlv;
  		e->set = WMM_PARAM_SET;
@@ -58,5 +58,5 @@
  		e->txop = cpu_to_le16(q->txop);
  
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0025-wifi-mt76-mt7996-enable-IDS-debug-log.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0018-wifi-mt76-mt7996-enable-IDS-debug-log.patch
similarity index 73%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0025-wifi-mt76-mt7996-enable-IDS-debug-log.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0018-wifi-mt76-mt7996-enable-IDS-debug-log.patch
index 38ac643..ca2e812 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0025-wifi-mt76-mt7996-enable-IDS-debug-log.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0018-wifi-mt76-mt7996-enable-IDS-debug-log.patch
@@ -1,17 +1,17 @@
-From ebe6fe9b526c946bc9639778ca51938746a27fd0 Mon Sep 17 00:00:00 2001
+From 6e972b77bd615df709c8ce4401ea6e120ccdf758 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 21 Mar 2023 15:04:45 +0800
-Subject: [PATCH 25/29] wifi: mt76: mt7996: enable IDS debug log
+Subject: [PATCH 18/22] wifi: mt76: mt7996: enable IDS debug log
 
 ---
  mt7996/debugfs.c | 10 ++++++++--
  1 file changed, 8 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index f2c46a5..34c30a5 100644
+index 513ab4ba..04220180 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
-@@ -296,6 +296,12 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
+@@ -290,6 +290,12 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
  		DEBUG_SPL,
  		DEBUG_RPT_RX,
  		DEBUG_RPT_RA = 68,
@@ -24,7 +24,7 @@
  	} debug;
  	bool tx, rx, en;
  	int ret;
-@@ -315,8 +321,8 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
+@@ -309,8 +315,8 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
  	if (ret)
  		return ret;
  
@@ -36,5 +36,5 @@
  
  		if (debug == DEBUG_RPT_RX)
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0026-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0019-mt76-testmode-add-atenl-support-in-mt7996.patch
similarity index 87%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0026-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0019-mt76-testmode-add-atenl-support-in-mt7996.patch
index c779eb7..1cbaf0e 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0026-wifi-mt76-testmode-add-atenl-support-in-mt7996.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0019-mt76-testmode-add-atenl-support-in-mt7996.patch
@@ -1,7 +1,7 @@
-From c559ca2ba572ba59906c8c194330c3ae6dc99b48 Mon Sep 17 00:00:00 2001
+From e119dd8edebc8baa1e30945db3d0a7bc192bfc4b Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 28 Dec 2022 22:24:25 +0800
-Subject: [PATCH 26/29] wifi: mt76: testmode: add atenl support in mt7996
+Subject: [PATCH 19/22] mt76: testmode: add atenl support in mt7996
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -10,7 +10,7 @@
  2 files changed, 4 insertions(+), 1 deletion(-)
 
 diff --git a/testmode.c b/testmode.c
-index 0accc71..0d2bae9 100644
+index 0accc71a..0d2bae9f 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -612,7 +612,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
@@ -24,7 +24,7 @@
  
  	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
 diff --git a/testmode.h b/testmode.h
-index 5e2792d..a40cd74 100644
+index 5e2792d8..a40cd74b 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -17,6 +17,7 @@
@@ -44,5 +44,5 @@
  	MT76_TM_ATTR_TX_COUNT,
  	MT76_TM_ATTR_TX_LENGTH,
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0027-wifi-mt76-testmode-add-basic-testmode-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0020-mt76-testmode-add-basic-testmode-support.patch
similarity index 90%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0027-wifi-mt76-testmode-add-basic-testmode-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0020-mt76-testmode-add-basic-testmode-support.patch
index b47f160..30eef7a 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0027-wifi-mt76-testmode-add-basic-testmode-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0020-mt76-testmode-add-basic-testmode-support.patch
@@ -1,13 +1,13 @@
-From ead183c5143c45e4f188d0bb0214b0d41c113ed2 Mon Sep 17 00:00:00 2001
+From 058747d35c83a796712bec098cf6509965cf28cc Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 1 Mar 2023 11:59:16 +0800
-Subject: [PATCH 27/29] wifi: mt76: testmode: add basic testmode support
+Subject: [PATCH 20/22] mt76: testmode: add basic testmode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  eeprom.c          |   6 +-
  mac80211.c        |   3 +-
- mt76.h            |  11 +
+ mt76.h            |  33 +++
  mt76_connac_mcu.h |   2 +
  mt7996/Makefile   |   2 +
  mt7996/eeprom.c   |  35 ++-
@@ -17,17 +17,17 @@
  mt7996/mcu.c      |  39 ++-
  mt7996/mcu.h      |  27 ++
  mt7996/mt7996.h   |  22 ++
- mt7996/testmode.c | 615 ++++++++++++++++++++++++++++++++++++++++++++++
- mt7996/testmode.h | 292 ++++++++++++++++++++++
- testmode.c        |  45 +++-
+ mt7996/testmode.c | 632 ++++++++++++++++++++++++++++++++++++++++++++++
+ mt7996/testmode.h | 295 ++++++++++++++++++++++
+ testmode.c        |  73 ++++--
  testmode.h        |  60 +++++
  tools/fields.c    |  92 +++++++
- 17 files changed, 1257 insertions(+), 17 deletions(-)
+ 17 files changed, 1315 insertions(+), 29 deletions(-)
  create mode 100644 mt7996/testmode.c
  create mode 100644 mt7996/testmode.h
 
 diff --git a/eeprom.c b/eeprom.c
-index ea54b7a..263e508 100644
+index ea54b7af..263e5089 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -89,8 +89,10 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
@@ -44,7 +44,7 @@
  
  out_put_node:
 diff --git a/mac80211.c b/mac80211.c
-index e53166f..a4b3d34 100644
+index 467afef9..d1cdaee8 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -826,7 +826,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
@@ -58,7 +58,7 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index c3d1313..343bd91 100644
+index 6b07b8fa..31d5dc37 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -652,8 +652,12 @@ struct mt76_testmode_ops {
@@ -92,19 +92,48 @@
  	u32 freq_offset;
  
  	u8 tx_power[4];
-@@ -692,7 +700,10 @@ struct mt76_testmode_data {
+@@ -692,7 +700,16 @@ struct mt76_testmode_data {
  	struct {
  		u64 packets[__MT_RXQ_MAX];
  		u64 fcs_error[__MT_RXQ_MAX];
 +		u64 len_mismatch;
  	} rx_stats;
 +	u8 flag;
++
++	struct {
++		u8 type;
++		u8 enable;
++	} cfg;
++
 +	u8 aid;
  };
  
  struct mt76_vif {
+@@ -1258,6 +1275,22 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
+ int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
+ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len);
+ 
++static inline void
++mt76_testmode_param_set(struct mt76_testmode_data *td, u16 idx)
++{
++#ifdef CONFIG_NL80211_TESTMODE
++	td->param_set[idx / 32] |= BIT(idx % 32);
++#endif
++}
++
++static inline bool
++mt76_testmode_param_present(struct mt76_testmode_data *td, u16 idx)
++{
++#ifdef CONFIG_NL80211_TESTMODE
++	return td->param_set[idx / 32] & BIT(idx % 32);
++#endif
++}
++
+ static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
+ {
+ #ifdef CONFIG_NL80211_TESTMODE
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 79dde31..bfbf18d 100644
+index fbb1206f..17cb8128 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1218,10 +1218,12 @@ enum {
@@ -119,19 +148,19 @@
 +	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
  	MCU_UNI_CMD_RRO = 0x57,
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
- };
+ 	MCU_UNI_CMD_ASSERT_DUMP = 0x6f,
 diff --git a/mt7996/Makefile b/mt7996/Makefile
-index bcb9a3c..f9fb1b0 100644
+index 07c8b555..bed9efd6 100644
 --- a/mt7996/Makefile
 +++ b/mt7996/Makefile
-@@ -4,3 +4,5 @@ obj-$(CONFIG_MT7996E) += mt7996e.o
- 
- mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
+@@ -6,3 +6,5 @@ mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
  	     debugfs.o mmio.o
+ 
+ mt7996e-$(CONFIG_DEV_COREDUMP) += coredump.o
 +
 +mt7996e-$(CONFIG_NL80211_TESTMODE) += testmode.o
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 2e48c5a..64e3c4e 100644
+index 544b6c6f..f5e95460 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -6,6 +6,11 @@
@@ -201,7 +230,7 @@
  		if (ret < 0)
  			return ret;
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index cfc4869..f7497c9 100644
+index 0c749774..0f8f0cd8 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -14,6 +14,7 @@ enum mt7996_eeprom_field {
@@ -213,10 +242,10 @@
  	MT_EE_RATE_DELTA_2G =	0x1400,
  	MT_EE_RATE_DELTA_5G =	0x147d,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 381917a..29a6783 100644
+index d44e3ae9..36ead6db 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -621,6 +621,10 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
+@@ -639,6 +639,10 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
  
  	set_bit(MT76_STATE_INITIALIZED, &dev->mphy.state);
  
@@ -227,7 +256,7 @@
  	ret = mt7996_mcu_init(dev);
  	if (ret)
  		return ret;
-@@ -1055,6 +1059,9 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1054,6 +1058,9 @@ int mt7996_register_device(struct mt7996_dev *dev)
  
  	mt7996_init_wiphy(hw);
  
@@ -238,10 +267,10 @@
  	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
  		dev->mphy.leds.cdev.brightness_set = mt7996_led_set_brightness;
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 4e9536e..b24c75a 100644
+index 059cc420..3820b235 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -22,6 +22,17 @@ static bool mt7996_dev_running(struct mt7996_dev *dev)
+@@ -23,6 +23,17 @@ static bool mt7996_dev_running(struct mt7996_dev *dev)
  	return phy && test_bit(MT76_STATE_RUNNING, &phy->mt76->state);
  }
  
@@ -259,7 +288,7 @@
  int mt7996_run(struct ieee80211_hw *hw)
  {
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
-@@ -36,6 +47,8 @@ int mt7996_run(struct ieee80211_hw *hw)
+@@ -37,6 +48,8 @@ int mt7996_run(struct ieee80211_hw *hw)
  			goto out;
  	}
  
@@ -268,7 +297,7 @@
  	mt7996_mac_enable_nf(dev, phy->mt76->band_idx);
  
  	ret = mt7996_mcu_set_rts_thresh(phy, 0x92b);
-@@ -1343,6 +1356,8 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -1390,6 +1403,8 @@ const struct ieee80211_ops mt7996_ops = {
  	.sta_set_decap_offload = mt7996_sta_set_decap_offload,
  	.add_twt_setup = mt7996_mac_add_twt_setup,
  	.twt_teardown_request = mt7996_twt_teardown_request,
@@ -278,10 +307,10 @@
  	.sta_add_debugfs = mt7996_sta_add_debugfs,
  #endif
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index deb6e1e..0a52afd 100644
+index 43a4f939..24adeb12 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2580,7 +2580,10 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
+@@ -2467,7 +2467,10 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
  		release_firmware(fw);						\
  	} while (0)
  
@@ -293,7 +322,7 @@
  	LOAD_RAM(DSP);
  	LOAD_RAM(WA);
  #undef LOAD_RAM
-@@ -4109,3 +4112,37 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u8 val)
+@@ -4012,3 +4015,37 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u8 val)
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(RRO), &req,
  				 sizeof(req), true);
  }
@@ -332,7 +361,7 @@
 +				 &req, sizeof(req), false);
 +}
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 778deed..ebc6271 100644
+index 778deedf..ebc62713 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -686,6 +686,33 @@ enum {
@@ -370,7 +399,7 @@
  	UNI_CMD_ACCESS_REG_BASIC = 0x0,
  	UNI_CMD_ACCESS_RF_REG_BASIC,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index c2f8900..e3fd50f 100644
+index ab4521a4..9bf3bf1a 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -30,9 +30,11 @@
@@ -385,7 +414,7 @@
  #define MT7996_EEPROM_SIZE		7680
  #define MT7996_EEPROM_BLOCK_SIZE	16
  #define MT7996_TOKEN_SIZE		8192
-@@ -58,6 +60,7 @@ struct mt7996_dfs_pattern;
+@@ -62,6 +64,7 @@ struct mt7996_dfs_pattern;
  
  enum mt7996_ram_type {
  	MT7996_RAM_TYPE_WM = 0,
@@ -393,7 +422,7 @@
  	MT7996_RAM_TYPE_WA,
  	MT7996_RAM_TYPE_DSP,
  };
-@@ -245,6 +248,20 @@ struct mt7996_phy {
+@@ -243,6 +246,20 @@ struct mt7996_phy {
  
  	struct mib_stats mib;
  	struct mt76_channel_state state_ts;
@@ -414,7 +443,7 @@
  };
  
  struct mt7996_dev {
-@@ -296,6 +313,8 @@ struct mt7996_dev {
+@@ -302,6 +319,8 @@ struct mt7996_dev {
  	bool flash_mode:1;
  	bool has_eht:1;
  
@@ -423,7 +452,7 @@
  	bool ibf;
  	u8 fw_debug_wm;
  	u8 fw_debug_wa;
-@@ -401,6 +420,7 @@ mt7996_phy3(struct mt7996_dev *dev)
+@@ -407,6 +426,7 @@ mt7996_phy3(struct mt7996_dev *dev)
  extern const struct ieee80211_ops mt7996_ops;
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
@@ -431,7 +460,7 @@
  
  struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
  				     void __iomem *mem_base, u32 device_id);
-@@ -410,6 +430,7 @@ u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif);
+@@ -416,6 +436,7 @@ u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif);
  int mt7996_register_device(struct mt7996_dev *dev);
  void mt7996_unregister_device(struct mt7996_dev *dev);
  int mt7996_eeprom_init(struct mt7996_dev *dev);
@@ -439,8 +468,8 @@
  int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
  int mt7996_eeprom_get_target_power(struct mt7996_dev *dev,
  				   struct ieee80211_channel *chan);
-@@ -485,6 +506,7 @@ int mt7996_mcu_fw_log_2_host(struct mt7996_dev *dev, u8 type, u8 ctrl);
- int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
+@@ -492,6 +513,7 @@ int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
+ int mt7996_mcu_trigger_assert(struct mt7996_dev *dev);
  void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
  void mt7996_mcu_exit(struct mt7996_dev *dev);
 +int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
@@ -449,10 +478,10 @@
  {
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
 new file mode 100644
-index 0000000..5dbbb78
+index 00000000..6d7cdbd5
 --- /dev/null
 +++ b/mt7996/testmode.c
-@@ -0,0 +1,615 @@
+@@ -0,0 +1,632 @@
 +// SPDX-License-Identifier: ISC
 +/*
 + * Copyright (C) 2022 MediaTek Inc.
@@ -468,6 +497,7 @@
 +	TM_CHANGED_FREQ_OFFSET,
 +	TM_CHANGED_TX_LENGTH,
 +	TM_CHANGED_TX_TIME,
++	TM_CHANGED_CFG,
 +
 +	/* must be last */
 +	NUM_TM_CHANGED
@@ -478,6 +508,7 @@
 +	[TM_CHANGED_FREQ_OFFSET] = MT76_TM_ATTR_FREQ_OFFSET,
 +	[TM_CHANGED_TX_LENGTH] = MT76_TM_ATTR_TX_LENGTH,
 +	[TM_CHANGED_TX_TIME] = MT76_TM_ATTR_TX_TIME,
++	[TM_CHANGED_CFG] = MT76_TM_ATTR_CFG,
 +};
 +
 +static u8 mt7996_tm_bw_mapping(enum nl80211_chan_width width, enum bw_mapping_method method)
@@ -575,10 +606,9 @@
 +#define RX_ANTENNA_MASK		GENMASK(20, 16)		/* RX antenna mask at most 5 bit */
 +	struct mt7996_dev *dev = phy->dev;
 +	struct mt76_testmode_data *td = &phy->mt76->test;
-+	u32 antenna_mask, idx = MT76_TM_ATTR_TX_ANTENNA;
-+	bool is_antenna_set = td->param_set[idx / 32] & BIT(idx % 32);
++	u32 antenna_mask;
 +
-+	if (!is_antenna_set)
++	if (!mt76_testmode_param_present(td, MT76_TM_ATTR_TX_ANTENNA))
 +		return;
 +
 +	if (func_idx == SET_ID(TX_PATH))
@@ -715,7 +745,18 @@
 +		mt7996_tm_set(dev, SET_ID(TX_COUNT), td->tx_count);
 +		mt7996_tm_set(dev, SET_ID(TX_MODE), mt7996_tm_rate_to_phy(td->tx_rate_mode));
 +		mt7996_tm_set(dev, SET_ID(TX_RATE), td->tx_rate_idx);
-+		mt7996_tm_set(dev, SET_ID(POWER), td->tx_power[0]);
++
++		if (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_POWER))
++			mt7996_tm_set(dev, SET_ID(POWER), td->tx_power[0]);
++
++		if (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_TIME)) {
++			mt7996_tm_set(dev, SET_ID(TX_LEN), 0);
++			mt7996_tm_set(dev, SET_ID(TX_TIME), td->tx_time);
++		} else {
++			mt7996_tm_set(dev, SET_ID(TX_LEN), td->tx_mpdu_len);
++			mt7996_tm_set(dev, SET_ID(TX_TIME), 0);
++		}
++
 +		mt7996_tm_set_antenna(phy, SET_ID(TX_PATH));
 +		mt7996_tm_set(dev, SET_ID(STBC), td->tx_rate_stbc);
 +		mt7996_tm_set(dev, SET_ID(ENCODE_MODE), td->tx_rate_ldpc);
@@ -836,6 +877,11 @@
 +		mt7996_tm_set(dev, SET_ID(TX_LEN), 0);
 +		mt7996_tm_set(dev, SET_ID(TX_TIME), td->tx_time);
 +	}
++	if (changed & BIT(TM_CHANGED_CFG)) {
++		u32 func_idx = td->cfg.enable ? SET_ID(CFG_ON) : SET_ID(CFG_OFF);
++
++		mt7996_tm_set(dev, func_idx, td->cfg.type);
++	}
 +}
 +
 +static int
@@ -873,7 +919,7 @@
 +		for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
 +			u16 cur = tm_change_map[i];
 +
-+			if (td->param_set[cur / 32] & BIT(cur % 32))
++			if (mt76_testmode_param_present(td, cur))
 +				changed |= BIT(i);
 +		}
 +
@@ -977,7 +1023,7 @@
 +}
 +
 +static void
-+mt7996_tm_reset_rx_stats(struct mt76_phy *mphy)
++mt7996_tm_reset_trx_stats(struct mt76_phy *mphy)
 +{
 +	struct mt7996_phy *phy = mphy->priv;
 +	struct mt7996_dev *dev = phy->dev;
@@ -1065,15 +1111,15 @@
 +	.set_state = mt7996_tm_set_state,
 +	.set_params = mt7996_tm_set_params,
 +	.dump_stats = mt7996_tm_dump_stats,
-+	.reset_rx_stats = mt7996_tm_reset_rx_stats,
++	.reset_rx_stats = mt7996_tm_reset_trx_stats,
 +	.tx_stop = mt7996_tm_tx_stop,
 +};
 diff --git a/mt7996/testmode.h b/mt7996/testmode.h
 new file mode 100644
-index 0000000..f381da5
+index 00000000..f00e51f4
 --- /dev/null
 +++ b/mt7996/testmode.h
-@@ -0,0 +1,292 @@
+@@ -0,0 +1,295 @@
 +/* SPDX-License-Identifier: ISC */
 +/* Copyright (C) 2020 MediaTek Inc. */
 +
@@ -1209,6 +1255,7 @@
 +	RF_TEST_ID_SET_TRX_COUNTER_RESET = 91,
 +	RF_TEST_ID_SET_MAC_HEADER = 101,
 +	RF_TEST_ID_SET_SEQ_CTRL = 102,
++	RF_TEST_ID_SET_PAYLOAD = 103,
 +	RF_TEST_ID_SET_BAND_IDX = 104,
 +	RF_TEST_ID_SET_RX_PATH = 106,
 +	RF_TEST_ID_SET_FREQ_OFFSET = 107,
@@ -1222,6 +1269,8 @@
 +	RF_TEST_ID_SET_RX_MU_AID = 157,
 +	RF_TEST_ID_SET_HW_TX_MODE = 167,
 +	RF_TEST_ID_SET_PUNCTURE = 168,
++	RF_TEST_ID_SET_CFG_ON = 176,
++	RF_TEST_ID_SET_CFG_OFF = 177,
 +	RF_TEST_ID_SET_BSSID = 189,
 +	RF_TEST_ID_SET_TX_TIME = 190,
 +	RF_TEST_ID_SET_MAX_PE = 191,
@@ -1367,7 +1416,7 @@
 +
 +#endif
 diff --git a/testmode.c b/testmode.c
-index 0d2bae9..007358b 100644
+index 0d2bae9f..fc68c2af 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -2,6 +2,7 @@
@@ -1423,7 +1472,23 @@
  	mt76_worker_disable(&dev->tx_worker);
  
  	td->tx_pending = 0;
-@@ -311,6 +327,7 @@ static void
+@@ -295,22 +311,11 @@ mt76_testmode_tx_stop(struct mt76_phy *phy)
+ 	mt76_testmode_free_skb(phy);
+ }
+ 
+-static inline void
+-mt76_testmode_param_set(struct mt76_testmode_data *td, u16 idx)
+-{
+-	td->param_set[idx / 32] |= BIT(idx % 32);
+-}
+-
+-static inline bool
+-mt76_testmode_param_present(struct mt76_testmode_data *td, u16 idx)
+-{
+-	return td->param_set[idx / 32] & BIT(idx % 32);
+-}
+-
+ static void
  mt76_testmode_init_defaults(struct mt76_phy *phy)
  {
  	struct mt76_testmode_data *td = &phy->test;
@@ -1431,7 +1496,7 @@
  
  	if (td->tx_mpdu_len > 0)
  		return;
-@@ -318,11 +335,18 @@ mt76_testmode_init_defaults(struct mt76_phy *phy)
+@@ -318,11 +323,18 @@ mt76_testmode_init_defaults(struct mt76_phy *phy)
  	td->tx_mpdu_len = 1024;
  	td->tx_count = 1;
  	td->tx_rate_mode = MT76_TM_TX_MODE_OFDM;
@@ -1440,20 +1505,20 @@
 +	/* 0xffff for OFDMA no puncture */
 +	td->tx_preamble_puncture = ~(td->tx_preamble_puncture & 0);
 +	td->tx_ipg = 50;
++
++	/* rx stat user config */
++	td->aid = 1;
  
 -	memcpy(td->addr[0], phy->macaddr, ETH_ALEN);
 -	memcpy(td->addr[1], phy->macaddr, ETH_ALEN);
 -	memcpy(td->addr[2], phy->macaddr, ETH_ALEN);
-+	/* rx stat user config */
-+	td->aid = 1;
-+
 +	memcpy(td->addr[0], addr, ETH_ALEN);
 +	memcpy(td->addr[1], addr, ETH_ALEN);
 +	memcpy(td->addr[2], addr, ETH_ALEN);
  }
  
  static int
-@@ -352,7 +376,7 @@ __mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state)
+@@ -352,7 +364,7 @@ __mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state)
  	if (state == MT76_TM_STATE_TX_FRAMES)
  		mt76_testmode_tx_start(phy);
  	else if (state == MT76_TM_STATE_RX_FRAMES) {
@@ -1462,7 +1527,7 @@
  	}
  
  	phy->test.state = state;
-@@ -453,7 +477,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -453,7 +465,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
  			   &td->tx_duty_cycle, 0, 99) ||
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_POWER_CONTROL],
@@ -1472,7 +1537,7 @@
  		goto out;
  
  	if (tb[MT76_TM_ATTR_TX_LENGTH]) {
-@@ -493,7 +518,9 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -493,7 +506,9 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    idx >= ARRAY_SIZE(td->tx_power))
  				goto out;
  
@@ -1483,7 +1548,30 @@
  		}
  	}
  
+@@ -511,6 +526,22 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		}
+ 	}
+ 
-@@ -560,6 +587,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
++	if (tb[MT76_TM_ATTR_CFG]) {
++		struct nlattr *cur;
++		int rem, idx = 0;
++
++		nla_for_each_nested(cur, tb[MT76_TM_ATTR_CFG], rem) {
++			if (nla_len(cur) != 1 || idx >= 2)
++				goto out;
++
++			if (idx == 0)
++				td->cfg.type = nla_get_u8(cur);
++			else
++				td->cfg.enable = nla_get_u8(cur);
++			idx++;
++		}
++	}
++
+ 	if (dev->test_ops->set_params) {
+ 		err = dev->test_ops->set_params(phy, tb, state);
+ 		if (err)
+@@ -560,6 +591,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
  	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_PACKETS, rx_packets,
  			      MT76_TM_STATS_ATTR_PAD) ||
  	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_FCS_ERROR, rx_fcs_error,
@@ -1493,7 +1581,7 @@
  			      MT76_TM_STATS_ATTR_PAD))
  		return -EMSGSIZE;
  
-@@ -624,6 +654,7 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -624,6 +658,7 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_SGI, td->tx_rate_sgi) ||
  	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_LDPC, td->tx_rate_ldpc) ||
  	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_STBC, td->tx_rate_stbc) ||
@@ -1502,7 +1590,7 @@
  	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
  	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_ANTENNA) &&
 diff --git a/testmode.h b/testmode.h
-index a40cd74..8d0b970 100644
+index a40cd74b..8d0b9702 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -39,6 +39,11 @@
@@ -1622,7 +1710,7 @@
  	/* keep last */
  	NUM_MT76_TM_TX_MODES,
 diff --git a/tools/fields.c b/tools/fields.c
-index e3f6908..e5cf7c5 100644
+index e3f69089..e5cf7c53 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
@@ -1784,5 +1872,5 @@
  
  const struct tm_field msg_field = {
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0028-wifi-mt76-testmode-add-chainmask-hacking-for-eagle-b.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0021-mt76-testmode-add-chainmask-hacking-for-eagle-band-2.patch
similarity index 67%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0028-wifi-mt76-testmode-add-chainmask-hacking-for-eagle-b.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0021-mt76-testmode-add-chainmask-hacking-for-eagle-band-2.patch
index 4e05664..a3a0633 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0028-wifi-mt76-testmode-add-chainmask-hacking-for-eagle-b.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0021-mt76-testmode-add-chainmask-hacking-for-eagle-band-2.patch
@@ -1,8 +1,8 @@
-From 576d54b4dce61e33ad31b8d8266548972ea13049 Mon Sep 17 00:00:00 2001
+From 59c4b77798c213a1766b3dac36a9de08145f063e Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 9 Mar 2023 18:45:04 +0800
-Subject: [PATCH 28/29] wifi: mt76: testmode: add chainmask hacking for eagle
- band 2 4T5R
+Subject: [PATCH 21/22] mt76: testmode: add chainmask hacking for eagle band 2
+ 4T5R
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -10,10 +10,10 @@
  1 file changed, 1 insertion(+)
 
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 5dbbb78..1721251 100644
+index 6d7cdbd5..0d4d9138 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -446,6 +446,7 @@ mt7996_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
+@@ -463,6 +463,7 @@ mt7996_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
  		return 0;
  
  	chainmask = chainmask >> dev->chainshift[band_idx];
@@ -22,5 +22,5 @@
  		return -EINVAL;
  
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0021-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0021-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch
deleted file mode 100644
index fd8a2fb..0000000
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0021-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From b45cb95c51dbe6118d9133255eceafe765765be8 Mon Sep 17 00:00:00 2001
-From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Tue, 7 Mar 2023 17:05:01 +0800
-Subject: [PATCH 21/29] wifi: mt76: mt7996: Fix using the wrong phy for
- background radar event
-
-Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
----
- mt7996/mcu.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index ed1abe1..cc6c6a4 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -339,10 +339,15 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
- 	if (r->band_idx >= ARRAY_SIZE(dev->mt76.phys))
- 		return;
- 
--	mphy = dev->mt76.phys[r->band_idx];
-+	if (dev->rdd2_phy && r->band_idx == MT_RX_SEL2)
-+		mphy = dev->rdd2_phy->mt76;
-+	else
-+		mphy = dev->mt76.phys[r->band_idx];
-+
- 	if (!mphy)
- 		return;
- 
-+	/* TODO: check fw background chain's rdd idx */
- 	if (r->band_idx == MT_RX_SEL2)
- 		cfg80211_background_radar_event(mphy->hw->wiphy,
- 						&dev->rdd2_chandef,
--- 
-2.18.0
-
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0999-wifi-mt76-mt7996-for-build-pass.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0022-mt76-revert-page-pool-changes.patch
similarity index 75%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0999-wifi-mt76-mt7996-for-build-pass.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0022-mt76-revert-page-pool-changes.patch
index 3005b16..f0daca8 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0999-wifi-mt76-mt7996-for-build-pass.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0022-mt76-revert-page-pool-changes.patch
@@ -1,45 +1,20 @@
-From 589b56aaeaead7d2d4fb28be20fd577e46706de3 Mon Sep 17 00:00:00 2001
+From d28a3716f729848ef65192c84411b0912afe70c6 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Thu, 3 Nov 2022 00:27:17 +0800
-Subject: [PATCH] wifi: mt76: mt7996: for build pass
+Date: Mon, 6 Feb 2023 15:34:43 +0800
+Subject: [PATCH 22/22] mt76: revert page pool changes
 
 ---
- debugfs.c         |  3 ++
- dma.c             | 74 ++++++++++++++++++++++++-----------------------
- eeprom.c          |  8 ++++-
- mac80211.c        | 57 ------------------------------------
- mcu.c             |  1 +
- mt76.h            | 22 +-------------
- mt7615/mcu.c      |  1 +
- mt76_connac_mcu.c |  1 +
- mt7915/main.c     | 26 +++++++----------
- mt7915/mcu.c      |  1 +
- mt7915/mmio.c     | 55 +++++++++++++++++++++--------------
- mt7921/main.c     | 31 +++-----------------
- mt7996/dma.c      |  4 +--
- mt7996/eeprom.c   |  1 +
- mt7996/mcu.c      |  1 +
- usb.c             | 43 +++++++++++++--------------
- 16 files changed, 127 insertions(+), 202 deletions(-)
+ dma.c         | 72 ++++++++++++++++++++++++++-------------------------
+ mac80211.c    | 57 ----------------------------------------
+ mt76.h        | 22 +---------------
+ mt7915/main.c | 26 +++++++------------
+ mt7915/mmio.c | 55 ++++++++++++++++++++++++---------------
+ mt7921/main.c | 31 +++-------------------
+ usb.c         | 43 +++++++++++++++---------------
+ 7 files changed, 108 insertions(+), 198 deletions(-)
 
-diff --git a/debugfs.c b/debugfs.c
-index 79064a4..e10d4cb 100644
---- a/debugfs.c
-+++ b/debugfs.c
-@@ -33,8 +33,11 @@ mt76_napi_threaded_set(void *data, u64 val)
- 	if (!mt76_is_mmio(dev))
- 		return -EOPNOTSUPP;
- 
-+#if 0
-+	/* need to backport patch from networking stack */
- 	if (dev->napi_dev.threaded != val)
- 		return dev_set_threaded(&dev->napi_dev, val);
-+#endif
- 
- 	return 0;
- }
 diff --git a/dma.c b/dma.c
-index df2ca73..2fc70e2 100644
+index 465190eb..f560d37d 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -173,7 +173,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
@@ -77,7 +52,7 @@
  	}
  
  	return buf;
-@@ -584,11 +584,11 @@ free_skb:
+@@ -586,11 +586,11 @@ free_skb:
  }
  
  static int
@@ -92,7 +67,7 @@
  
  	if (!q->ndesc)
  		return 0;
-@@ -596,25 +596,26 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -598,25 +598,26 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
  	spin_lock_bh(&q->lock);
  
  	while (q->queued < q->ndesc - 1) {
@@ -130,7 +105,7 @@
  			break;
  		}
  		frames++;
-@@ -658,7 +659,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
+@@ -660,7 +661,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
  		/* WED txfree queue needs ring to be initialized before setup */
  		q->flags = 0;
  		mt76_dma_queue_reset(dev, q);
@@ -139,7 +114,7 @@
  		q->flags = flags;
  
  		ret = mtk_wed_device_txfree_ring_setup(wed, q->regs);
-@@ -706,10 +707,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -708,10 +709,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  	if (!q->entry)
  		return -ENOMEM;
  
@@ -150,7 +125,7 @@
  	ret = mt76_dma_wed_setup(dev, q, false);
  	if (ret)
  		return ret;
-@@ -723,6 +720,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -725,6 +722,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  static void
  mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  {
@@ -158,7 +133,7 @@
  	void *buf;
  	bool more;
  
-@@ -736,7 +734,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -738,7 +736,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  		if (!buf)
  			break;
  
@@ -167,7 +142,7 @@
  	} while (1);
  
  	if (q->rx_head) {
-@@ -745,6 +743,13 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -747,6 +745,13 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  	}
  
  	spin_unlock_bh(&q->lock);
@@ -181,7 +156,7 @@
  }
  
  static void
-@@ -765,7 +770,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+@@ -767,7 +772,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
  	mt76_dma_wed_setup(dev, q, true);
  	if (q->flags != MT_WED_Q_TXFREE) {
  		mt76_dma_sync_idx(dev, q);
@@ -190,7 +165,7 @@
  	}
  }
  
-@@ -783,7 +788,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+@@ -785,7 +790,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
  
  		skb_add_rx_frag(skb, nr_frags, page, offset, len, q->buf_size);
  	} else {
@@ -199,13 +174,7 @@
  	}
  
  	if (more)
-@@ -851,12 +856,11 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
- 		    !(dev->drv->rx_check(dev, data, len)))
- 			goto free_frag;
- 
--		skb = napi_build_skb(data, q->buf_size);
-+		skb = build_skb(data, q->buf_size);
- 		if (!skb)
+@@ -858,7 +863,6 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  			goto free_frag;
  
  		skb_reserve(skb, q->buf_offset);
@@ -213,7 +182,7 @@
  
  		*(u32 *)skb->cb = info;
  
-@@ -872,10 +876,10 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+@@ -874,10 +878,10 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
  		continue;
  
  free_frag:
@@ -226,7 +195,7 @@
  	return done;
  }
  
-@@ -920,7 +924,7 @@ mt76_dma_init(struct mt76_dev *dev,
+@@ -922,7 +926,7 @@ mt76_dma_init(struct mt76_dev *dev,
  
  	mt76_for_each_q_rx(dev, i) {
  		netif_napi_add(&dev->napi_dev, &dev->napi[i], poll);
@@ -235,7 +204,7 @@
  		napi_enable(&dev->napi[i]);
  	}
  
-@@ -971,8 +975,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+@@ -973,8 +977,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
  
  		netif_napi_del(&dev->napi[i]);
  		mt76_dma_rx_cleanup(dev, q);
@@ -244,29 +213,8 @@
  	}
  
  	mt76_free_pending_txwi(dev);
-diff --git a/eeprom.c b/eeprom.c
-index 263e508..aa88925 100644
---- a/eeprom.c
-+++ b/eeprom.c
-@@ -108,9 +108,15 @@ void
- mt76_eeprom_override(struct mt76_phy *phy)
- {
- 	struct mt76_dev *dev = phy->dev;
-+#ifdef CONFIG_OF
- 	struct device_node *np = dev->dev->of_node;
-+	const u8 *mac = NULL;
- 
--	of_get_mac_address(np, phy->macaddr);
-+	if (np)
-+		mac = of_get_mac_address(np);
-+	if (!IS_ERR_OR_NULL(mac))
-+		ether_addr_copy(phy->macaddr, mac);
-+#endif
- 
- 	if (!is_valid_ether_addr(phy->macaddr)) {
- 		eth_random_addr(phy->macaddr);
 diff --git a/mac80211.c b/mac80211.c
-index a4b3d34..40fda9d 100644
+index d1cdaee8..4599f697 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -4,7 +4,6 @@
@@ -325,7 +273,7 @@
  struct mt76_dev *
  mt76_alloc_device(struct device *pdev, unsigned int size,
  		  const struct ieee80211_ops *ops,
-@@ -1747,21 +1705,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
+@@ -1748,21 +1706,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  }
  EXPORT_SYMBOL_GPL(mt76_ethtool_worker);
  
@@ -347,20 +295,8 @@
  enum mt76_dfs_state mt76_phy_dfs_state(struct mt76_phy *phy)
  {
  	struct ieee80211_hw *hw = phy->hw;
-diff --git a/mcu.c b/mcu.c
-index a8cafa3..fa4b054 100644
---- a/mcu.c
-+++ b/mcu.c
-@@ -4,6 +4,7 @@
-  */
- 
- #include "mt76.h"
-+#include <linux/moduleparam.h>
- 
- struct sk_buff *
- __mt76_mcu_msg_alloc(struct mt76_dev *dev, const void *data,
 diff --git a/mt76.h b/mt76.h
-index 343bd91..3d96b33 100644
+index 31d5dc37..f012ac0c 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -202,7 +202,7 @@ struct mt76_queue {
@@ -372,7 +308,7 @@
  };
  
  struct mt76_mcu_ops {
-@@ -1340,7 +1340,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
+@@ -1363,7 +1363,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
  	return usb_bulk_msg(udev, pipe, data, len, actual_len, timeout);
  }
  
@@ -380,7 +316,7 @@
  void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  			 struct mt76_sta_stats *stats, bool eht);
  int mt76_skb_adjust_pad(struct sk_buff *skb, int pad);
-@@ -1452,25 +1451,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
+@@ -1475,25 +1474,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
  struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
  			  struct mt76_txwi_cache *r, dma_addr_t phys);
@@ -406,35 +342,11 @@
  
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
-diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index eea398c..4593b2e 100644
---- a/mt7615/mcu.c
-+++ b/mt7615/mcu.c
-@@ -10,6 +10,7 @@
- #include "mcu.h"
- #include "mac.h"
- #include "eeprom.h"
-+#include <linux/moduleparam.h>
- 
- static bool prefer_offload_fw = true;
- module_param(prefer_offload_fw, bool, 0644);
-diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 4e4f6b3..e581522 100644
---- a/mt76_connac_mcu.c
-+++ b/mt76_connac_mcu.c
-@@ -4,6 +4,7 @@
- #include <linux/firmware.h>
- #include "mt76_connac2_mac.h"
- #include "mt76_connac_mcu.h"
-+#include <linux/module.h>
- 
- int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
- {
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 3bbccbd..161a2d1 100644
+index 8ce7b1c5..fbff908f 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1291,22 +1291,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
+@@ -1289,22 +1289,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
  			   struct ieee80211_vif *vif,
  			   u32 sset, u8 *data)
  {
@@ -463,7 +375,7 @@
  }
  
  static void mt7915_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
-@@ -1334,7 +1331,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1332,7 +1329,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  	};
  	struct mib_stats *mib = &phy->mib;
  	/* See mt7915_ampdu_stat_read_phy, etc */
@@ -472,7 +384,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
  
-@@ -1415,12 +1412,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1413,12 +1410,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  		return;
  
  	ei += wi.worker_stat_count;
@@ -488,20 +400,8 @@
  }
  
  static void
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d08907f..99ef8c9 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -6,6 +6,7 @@
- #include "mcu.h"
- #include "mac.h"
- #include "eeprom.h"
-+#include <linux/moduleparam.h>
- 
- #define fw_name(_dev, name, ...)	({			\
- 	char *_fw;						\
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 6f0c0e2..5ef43c4 100644
+index 984b5f60..1bb8a4cb 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -596,9 +596,13 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
@@ -605,10 +505,10 @@
  	return -ENOMEM;
  }
 diff --git a/mt7921/main.c b/mt7921/main.c
-index a72964e..4c40022 100644
+index 3b6adb29..47eb38e4 100644
 --- a/mt7921/main.c
 +++ b/mt7921/main.c
-@@ -1090,34 +1090,17 @@ static void
+@@ -1083,34 +1083,17 @@ static void
  mt7921_get_et_strings(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		      u32 sset, u8 *data)
  {
@@ -644,7 +544,7 @@
  }
  
  static void
-@@ -1137,7 +1120,6 @@ void mt7921_get_et_stats(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1130,7 +1113,6 @@ void mt7921_get_et_stats(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			 struct ethtool_stats *stats, u64 *data)
  {
  	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
@@ -652,7 +552,7 @@
  	struct mt7921_phy *phy = mt7921_hw_phy(hw);
  	struct mt7921_dev *dev = phy->dev;
  	struct mib_stats *mib = &phy->mib;
-@@ -1193,14 +1175,9 @@ void mt7921_get_et_stats(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -1186,14 +1168,9 @@ void mt7921_get_et_stats(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		return;
  
  	ei += wi.worker_stat_count;
@@ -670,47 +570,8 @@
  }
  
  static u64
-diff --git a/mt7996/dma.c b/mt7996/dma.c
-index 18ea758..3e2967f 100644
---- a/mt7996/dma.c
-+++ b/mt7996/dma.c
-@@ -343,8 +343,8 @@ int mt7996_dma_init(struct mt7996_dev *dev)
- 	if (ret < 0)
- 		return ret;
- 
--	netif_napi_add_tx(&dev->mt76.tx_napi_dev, &dev->mt76.tx_napi,
--			  mt7996_poll_tx);
-+	netif_tx_napi_add(&dev->mt76.tx_napi_dev, &dev->mt76.tx_napi,
-+			  mt7996_poll_tx, NAPI_POLL_WEIGHT);
- 	napi_enable(&dev->mt76.tx_napi);
- 
- 	mt7996_dma_enable(dev);
-diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 64e3c4e..7bff504 100644
---- a/mt7996/eeprom.c
-+++ b/mt7996/eeprom.c
-@@ -121,6 +121,7 @@ static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_dev *dev)
- 	if (ret)
- 		return ret;
- 
-+	cap = 0x4b249248;	/* internal hardcode */
- 	if (cap) {
- 		dev->has_eht = !(cap & MODE_HE_ONLY);
- 		dev->wtbl_size_group = u32_get_bits(cap, WTBL_SIZE_GROUP);
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 0a52afd..cc94839 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -5,6 +5,7 @@
- 
- #include <linux/firmware.h>
- #include <linux/fs.h>
-+#include <linux/moduleparam.h>
- #include "mt7996.h"
- #include "mcu.h"
- #include "mac.h"
 diff --git a/usb.c b/usb.c
-index 5e5c7bf..3e28171 100644
+index 5e5c7bf5..3e281715 100644
 --- a/usb.c
 +++ b/usb.c
 @@ -319,27 +319,29 @@ mt76u_set_endpoints(struct usb_interface *intf,
@@ -844,5 +705,5 @@
  
  static void mt76u_free_rx(struct mt76_dev *dev)
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0029-wifi-mt76-mt7996-set-SUPPORTS_VHT_EXT_NSS_BW-in-mt79.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0029-wifi-mt76-mt7996-set-SUPPORTS_VHT_EXT_NSS_BW-in-mt79.patch
deleted file mode 100644
index b19ee65..0000000
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0029-wifi-mt76-mt7996-set-SUPPORTS_VHT_EXT_NSS_BW-in-mt79.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From f4ce8f80fee46f630d564e48880cc0b02cb10ed5 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 27 Mar 2023 14:30:25 +0800
-Subject: [PATCH 29/29] wifi: mt76: mt7996: set SUPPORTS_VHT_EXT_NSS_BW in
- mt7996_init_wiphy
-
-Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt7996/init.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 29a6783..fbe1b71 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -394,6 +394,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
- 			IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
- 		phy->mt76->sband_5g.sband.ht_cap.ampdu_density =
- 			IEEE80211_HT_MPDU_DENSITY_1;
-+		ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);
- 	}
- 
- 	mt76_set_stream_caps(phy->mt76, true);
--- 
-2.18.0
-
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0999-mt76-mt7996-for-build-pass.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0999-mt76-mt7996-for-build-pass.patch
new file mode 100644
index 0000000..89d1cdd
--- /dev/null
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0999-mt76-mt7996-for-build-pass.patch
@@ -0,0 +1,159 @@
+From c187058bfc83a80b3cfbfed4ce0c73ece6efb1fe Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Thu, 3 Nov 2022 00:27:17 +0800
+Subject: [PATCH 0999/1001] mt76: mt7996: for build pass
+
+Change-Id: Ieb44c33ee6e6a2e6058c1ef528404c1a1cbcfdaf
+---
+ debugfs.c         | 3 +++
+ dma.c             | 2 +-
+ eeprom.c          | 8 +++++++-
+ mcu.c             | 1 +
+ mt7615/mcu.c      | 1 +
+ mt76_connac_mcu.c | 1 +
+ mt7915/mcu.c      | 1 +
+ mt7996/dma.c      | 4 ++--
+ mt7996/eeprom.c   | 1 +
+ mt7996/mcu.c      | 1 +
+ 10 files changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/debugfs.c b/debugfs.c
+index 79064a4d..e10d4cbc 100644
+--- a/debugfs.c
++++ b/debugfs.c
+@@ -33,8 +33,11 @@ mt76_napi_threaded_set(void *data, u64 val)
+ 	if (!mt76_is_mmio(dev))
+ 		return -EOPNOTSUPP;
+ 
++#if 0
++	/* need to backport patch from networking stack */
+ 	if (dev->napi_dev.threaded != val)
+ 		return dev_set_threaded(&dev->napi_dev, val);
++#endif
+ 
+ 	return 0;
+ }
+diff --git a/dma.c b/dma.c
+index f560d37d..ffc5b553 100644
+--- a/dma.c
++++ b/dma.c
+@@ -858,7 +858,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+ 		    !(dev->drv->rx_check(dev, data, len)))
+ 			goto free_frag;
+ 
+-		skb = napi_build_skb(data, q->buf_size);
++		skb = build_skb(data, q->buf_size);
+ 		if (!skb)
+ 			goto free_frag;
+ 
+diff --git a/eeprom.c b/eeprom.c
+index 263e5089..aa889258 100644
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -108,9 +108,15 @@ void
+ mt76_eeprom_override(struct mt76_phy *phy)
+ {
+ 	struct mt76_dev *dev = phy->dev;
++#ifdef CONFIG_OF
+ 	struct device_node *np = dev->dev->of_node;
++	const u8 *mac = NULL;
+ 
+-	of_get_mac_address(np, phy->macaddr);
++	if (np)
++		mac = of_get_mac_address(np);
++	if (!IS_ERR_OR_NULL(mac))
++		ether_addr_copy(phy->macaddr, mac);
++#endif
+ 
+ 	if (!is_valid_ether_addr(phy->macaddr)) {
+ 		eth_random_addr(phy->macaddr);
+diff --git a/mcu.c b/mcu.c
+index a8cafa39..fa4b0544 100644
+--- a/mcu.c
++++ b/mcu.c
+@@ -4,6 +4,7 @@
+  */
+ 
+ #include "mt76.h"
++#include <linux/moduleparam.h>
+ 
+ struct sk_buff *
+ __mt76_mcu_msg_alloc(struct mt76_dev *dev, const void *data,
+diff --git a/mt7615/mcu.c b/mt7615/mcu.c
+index 8d745c97..86061e95 100644
+--- a/mt7615/mcu.c
++++ b/mt7615/mcu.c
+@@ -10,6 +10,7 @@
+ #include "mcu.h"
+ #include "mac.h"
+ #include "eeprom.h"
++#include <linux/moduleparam.h>
+ 
+ static bool prefer_offload_fw = true;
+ module_param(prefer_offload_fw, bool, 0644);
+diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
+index 5fab6772..c24dac10 100644
+--- a/mt76_connac_mcu.c
++++ b/mt76_connac_mcu.c
+@@ -4,6 +4,7 @@
+ #include <linux/firmware.h>
+ #include "mt76_connac2_mac.h"
+ #include "mt76_connac_mcu.h"
++#include <linux/module.h>
+ 
+ int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
+ {
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index aa706ff6..e8c1e572 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -6,6 +6,7 @@
+ #include "mcu.h"
+ #include "mac.h"
+ #include "eeprom.h"
++#include <linux/moduleparam.h>
+ 
+ #define fw_name(_dev, name, ...)	({			\
+ 	char *_fw;						\
+diff --git a/mt7996/dma.c b/mt7996/dma.c
+index 53414346..733d1228 100644
+--- a/mt7996/dma.c
++++ b/mt7996/dma.c
+@@ -343,8 +343,8 @@ int mt7996_dma_init(struct mt7996_dev *dev)
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	netif_napi_add_tx(&dev->mt76.tx_napi_dev, &dev->mt76.tx_napi,
+-			  mt7996_poll_tx);
++	netif_tx_napi_add(&dev->mt76.tx_napi_dev, &dev->mt76.tx_napi,
++			  mt7996_poll_tx, NAPI_POLL_WEIGHT);
+ 	napi_enable(&dev->mt76.tx_napi);
+ 
+ 	mt7996_dma_enable(dev);
+diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
+index f5e95460..50f2227f 100644
+--- a/mt7996/eeprom.c
++++ b/mt7996/eeprom.c
+@@ -121,6 +121,7 @@ static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_dev *dev)
+ 	if (ret)
+ 		return ret;
+ 
++	cap = 0x4b249248;	/* internal hardcode */
+ 	if (cap) {
+ 		dev->has_eht = !(cap & MODE_HE_ONLY);
+ 		dev->wtbl_size_group = u32_get_bits(cap, WTBL_SIZE_GROUP);
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 24adeb12..f2bfbd8a 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -5,6 +5,7 @@
+ 
+ #include <linux/firmware.h>
+ #include <linux/fs.h>
++#include <linux/moduleparam.h>
+ #include "mt7996.h"
+ #include "mcu.h"
+ #include "mac.h"
+-- 
+2.39.2
+
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/1000-wifi-mt76-mt7996-add-debug-tool.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/1000-mt76-mt7996-add-debug-tool.patch
similarity index 99%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/1000-wifi-mt76-mt7996-add-debug-tool.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/1000-mt76-mt7996-add-debug-tool.patch
index 31111b4..018c7b9 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/1000-wifi-mt76-mt7996-add-debug-tool.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/1000-mt76-mt7996-add-debug-tool.patch
@@ -1,7 +1,7 @@
-From c31edeef8cd035268a52e3343e00d03e5b5ce6a5 Mon Sep 17 00:00:00 2001
+From 9cf11ae2bfdf56babbdfe4fe03f61f492c06ce1a Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 24 Mar 2023 14:02:32 +0800
-Subject: [PATCH 1000/1001] wifi: mt76: mt7996: add debug tool
+Subject: [PATCH 1000/1001] mt76: mt7996: add debug tool
 
 Change-Id: Ie10390b01f17db893dbfbf3221bf63a4bd1fe38f
 ---
@@ -21,7 +21,7 @@
  create mode 100644 mt7996/mtk_mcu.h
 
 diff --git a/mt7996/Makefile b/mt7996/Makefile
-index f9fb1b0..5056e17 100644
+index bed9efd6..9ef0b824 100644
 --- a/mt7996/Makefile
 +++ b/mt7996/Makefile
 @@ -1,4 +1,5 @@
@@ -30,17 +30,17 @@
  
  obj-$(CONFIG_MT7996E) += mt7996e.o
  
-@@ -6,3 +7,5 @@ mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
- 	     debugfs.o mmio.o
+@@ -8,3 +9,5 @@ mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
+ mt7996e-$(CONFIG_DEV_COREDUMP) += coredump.o
  
  mt7996e-$(CONFIG_NL80211_TESTMODE) += testmode.o
 +
 +mt7996e-y += mtk_debugfs.o mtk_mcu.o
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 34c30a5..6d04f27 100644
+index 04220180..0bfded17 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
-@@ -307,6 +307,9 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
+@@ -301,6 +301,9 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
  	int ret;
  
  	dev->fw_debug_wm = val ? MCU_FW_LOG_TO_HOST : 0;
@@ -50,7 +50,7 @@
  
  	if (dev->fw_debug_bin)
  		val = MCU_FW_LOG_RELAY;
-@@ -413,16 +416,22 @@ mt7996_fw_debug_bin_set(void *data, u64 val)
+@@ -407,16 +410,22 @@ mt7996_fw_debug_bin_set(void *data, u64 val)
  	};
  	struct mt7996_dev *dev = data;
  
@@ -76,7 +76,7 @@
  	return mt7996_fw_debug_wm_set(dev, dev->fw_debug_wm);
  }
  
-@@ -827,8 +836,13 @@ int mt7996_init_debugfs(struct mt7996_phy *phy)
+@@ -821,8 +830,13 @@ int mt7996_init_debugfs(struct mt7996_phy *phy)
  					    mt7996_rdd_monitor);
  	}
  
@@ -91,7 +91,7 @@
  
  	return 0;
  }
-@@ -842,6 +856,12 @@ mt7996_debugfs_write_fwlog(struct mt7996_dev *dev, const void *hdr, int hdrlen,
+@@ -836,6 +850,12 @@ mt7996_debugfs_write_fwlog(struct mt7996_dev *dev, const void *hdr, int hdrlen,
  	void *dest;
  
  	spin_lock_irqsave(&lock, flags);
@@ -104,7 +104,7 @@
  	dest = relay_reserve(dev->relay_fwlog, hdrlen + len + 4);
  	if (dest) {
  		*(u32 *)dest = hdrlen + len;
-@@ -874,9 +894,6 @@ void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int
+@@ -868,9 +888,6 @@ void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int
  		.msg_type = cpu_to_le16(PKT_TYPE_RX_FW_MONITOR),
  	};
  
@@ -115,10 +115,10 @@
  	hdr.timestamp = cpu_to_le32(mt76_rr(dev, MT_LPON_FRCR(0)));
  	hdr.len = *(__le16 *)data;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index cc94839..1461ba8 100644
+index f2bfbd8a..ef779cf9 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2437,6 +2437,7 @@ static int mt7996_load_patch(struct mt7996_dev *dev)
+@@ -2324,6 +2324,7 @@ static int mt7996_load_patch(struct mt7996_dev *dev)
  
  	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
  		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
@@ -126,7 +126,7 @@
  
  	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
  		struct mt7996_patch_sec *sec;
-@@ -2566,6 +2567,9 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
+@@ -2453,6 +2454,9 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
  		hdr = (const struct mt7996_fw_trailer *)			\
  				(fw->data + fw->size - sizeof(*hdr));		\
  										\
@@ -137,10 +137,10 @@
  			 "%s Firmware Version: %.10s, Build Time: %.15s\n",	\
  			 #_type, hdr->fw_ver, hdr->build_date);			\
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index e3fd50f..8b76d69 100644
+index 9bf3bf1a..1ac54520 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -333,6 +333,17 @@ struct mt7996_dev {
+@@ -339,6 +339,17 @@ struct mt7996_dev {
  	u32 reg_l2_backup;
  
  	u8 wtbl_size_group;
@@ -158,7 +158,7 @@
  };
  
  enum {
-@@ -596,4 +607,8 @@ void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -608,4 +619,8 @@ void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
  #endif
  
@@ -169,7 +169,7 @@
  #endif
 diff --git a/mt7996/mtk_debug.h b/mt7996/mtk_debug.h
 new file mode 100644
-index 0000000..a48bac5
+index 00000000..a48bac50
 --- /dev/null
 +++ b/mt7996/mtk_debug.h
 @@ -0,0 +1,2166 @@
@@ -2341,7 +2341,7 @@
 +#endif
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
 new file mode 100644
-index 0000000..080f756
+index 00000000..080f756e
 --- /dev/null
 +++ b/mt7996/mtk_debugfs.c
 @@ -0,0 +1,2344 @@
@@ -4691,7 +4691,7 @@
 +#endif
 diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
 new file mode 100644
-index 0000000..e887016
+index 00000000..e8870166
 --- /dev/null
 +++ b/mt7996/mtk_mcu.c
 @@ -0,0 +1,18 @@
@@ -4715,7 +4715,7 @@
 +#endif
 diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
 new file mode 100644
-index 0000000..e741aa2
+index 00000000..e741aa27
 --- /dev/null
 +++ b/mt7996/mtk_mcu.h
 @@ -0,0 +1,16 @@
@@ -4736,7 +4736,7 @@
 +
 +#endif
 diff --git a/tools/fwlog.c b/tools/fwlog.c
-index e5d4a10..3c6a61d 100644
+index e5d4a105..3c6a61d7 100644
 --- a/tools/fwlog.c
 +++ b/tools/fwlog.c
 @@ -26,7 +26,7 @@ static const char *debugfs_path(const char *phyname, const char *file)
@@ -4820,5 +4820,5 @@
  	return ret;
  }
 -- 
-2.18.0
+2.39.2
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/1001-wifi-mt76-mt7996-add-txpower-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/1001-mt76-mt7996-add-txpower-support.patch
similarity index 95%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/1001-wifi-mt76-mt7996-add-txpower-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/1001-mt76-mt7996-add-txpower-support.patch
index 4829d35..a9a371d 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/1001-wifi-mt76-mt7996-add-txpower-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/1001-mt76-mt7996-add-txpower-support.patch
@@ -1,7 +1,7 @@
-From 9443665b4459780c945eff91ac20812a5336dc18 Mon Sep 17 00:00:00 2001
+From 0169bc58ed8089fc7ca07d08a0ce90a02db4a3dd Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 24 Mar 2023 23:35:30 +0800
-Subject: [PATCH 1001/1001] wifi: mt76: mt7996: add txpower support
+Subject: [PATCH 1001/1001] mt76: mt7996: add txpower support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: Ic3e7b17f3664fa7f774137572f885359fa2ec93b
@@ -17,10 +17,10 @@
  8 files changed, 423 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 7bff504..670e0db 100644
+index 50f2227f..c8f65b98 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -284,3 +284,37 @@ s8 mt7996_eeprom_get_power_delta(struct mt7996_dev *dev, int band)
+@@ -280,3 +280,37 @@ s8 mt7996_eeprom_get_power_delta(struct mt7996_dev *dev, int band)
  
  	return val & MT_EE_RATE_DELTA_SIGN ? delta : -delta;
  }
@@ -59,10 +59,10 @@
 +	[SKU_EHT3x996_484] = 16,
 +};
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index f7497c9..b5852da 100644
+index 0f8f0cd8..54e180fb 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
-@@ -73,4 +73,46 @@ mt7996_get_channel_group_6g(int channel)
+@@ -72,4 +72,46 @@ mt7996_get_channel_group_6g(int channel)
  	return DIV_ROUND_UP(channel - 29, 32);
  }
  
@@ -110,7 +110,7 @@
 +
  #endif
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index ebc6271..476e007 100644
+index ebc62713..476e007b 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -698,6 +698,7 @@ struct tx_power_ctrl {
@@ -130,10 +130,10 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 8b76d69..d5be582 100644
+index 1ac54520..9bed13a1 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -53,6 +53,8 @@
+@@ -57,6 +57,8 @@
  #define MT7996_CRIT_TEMP		110
  #define MT7996_MAX_TEMP			120
  
@@ -142,7 +142,7 @@
  struct mt7996_vif;
  struct mt7996_sta;
  struct mt7996_dfs_pulse;
-@@ -518,6 +520,7 @@ int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
+@@ -525,6 +527,7 @@ int mt7996_mcu_trigger_assert(struct mt7996_dev *dev);
  void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
  void mt7996_mcu_exit(struct mt7996_dev *dev);
  int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
@@ -151,7 +151,7 @@
  static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
  {
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 080f756..c05f846 100644
+index 080f756e..c05f8465 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2296,6 +2296,232 @@ static int mt7996_sta_info(struct seq_file *s, void *data)
@@ -398,7 +398,7 @@
  	debugfs_create_devm_seqfile(dev->mt76.dev, "wtbl_info", dir,
  				    mt7996_wtbl_read);
 diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
-index e887016..f772243 100644
+index e8870166..f772243b 100644
 --- a/mt7996/mtk_mcu.c
 +++ b/mt7996/mtk_mcu.c
 @@ -12,7 +12,30 @@
@@ -433,7 +433,7 @@
  
  #endif
 diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
-index e741aa2..1fa449e 100644
+index e741aa27..1fa449ea 100644
 --- a/mt7996/mtk_mcu.h
 +++ b/mt7996/mtk_mcu.h
 @@ -10,6 +10,84 @@
@@ -522,10 +522,10 @@
  #endif
  
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 0775ca5..03e8329 100644
+index d1d3d154..d01cc8c9 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
-@@ -543,15 +543,22 @@ enum base_rev {
+@@ -557,15 +557,22 @@ enum base_rev {
  
  #define MT_PCIE1_MAC_INT_ENABLE			MT_PCIE1_MAC(0x188)
  
@@ -552,7 +552,7 @@
  /* PHYRX CSD */
  #define MT_WF_PHYRX_CSD_BASE			0x83000000
  #define MT_WF_PHYRX_CSD(_band, _wf, ofs)	(MT_WF_PHYRX_CSD_BASE + \
-@@ -560,7 +567,7 @@ enum base_rev {
+@@ -574,7 +581,7 @@ enum base_rev {
  #define MT_WF_PHYRX_CSD_IRPI(_band, _wf)	MT_WF_PHYRX_CSD(_band, _wf, 0x1000)
  
  /* PHYRX CSD BAND */
@@ -562,5 +562,5 @@
  #define MT_WF_PHYRX_CSD_BAND_RXTD12_IRPI_SW_CLR		BIT(29)
  
 -- 
-2.18.0
+2.39.2