diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0016-mt76-mt7915-reowrk-SER-debugfs-knob.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0016-mt76-mt7915-reowrk-SER-debugfs-knob.patch
new file mode 100755
index 0000000..d4c81d9
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0016-mt76-mt7915-reowrk-SER-debugfs-knob.patch
@@ -0,0 +1,278 @@
+From f3f9ccbb417cae6e503084e13d627b68a141b0bd Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Thu, 5 May 2022 11:45:23 +0800
+Subject: [PATCH 02/10] mt76: mt7915: reowrk SER debugfs knob
+
+1. get status of system recovery from firmware.
+2. add more recovery points.
+3. make knob per phy.
+
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+---
+ mt7915/debugfs.c | 106 ++++++++++++++++++++++++++++++++++++++++-------
+ mt7915/mcu.c     |   5 +--
+ mt7915/mcu.h     |  14 +++++++
+ mt7915/mmio.c    |   3 ++
+ mt7915/regs.h    |  18 +++++++-
+ 5 files changed, 126 insertions(+), 20 deletions(-)
+
+diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
+index 77bbeeed..b45181c1 100644
+--- a/mt7915/debugfs.c
++++ b/mt7915/debugfs.c
+@@ -44,35 +44,113 @@ mt7915_implicit_txbf_get(void *data, u64 *val)
+ DEFINE_DEBUGFS_ATTRIBUTE(fops_implicit_txbf, mt7915_implicit_txbf_get,
+ 			 mt7915_implicit_txbf_set, "%lld\n");
+ 
+-/* test knob of system layer 1/2 error recovery */
+-static int mt7915_ser_trigger_set(void *data, u64 val)
++/* test knob of system error recovery */
++static ssize_t
++mt7915_fw_ser_set(struct file *file, const char __user *user_buf,
++		  size_t count, loff_t *ppos)
+ {
+-	enum {
+-		SER_SET_RECOVER_L1 = 1,
+-		SER_SET_RECOVER_L2,
+-		SER_ENABLE = 2,
+-		SER_RECOVER
+-	};
+-	struct mt7915_dev *dev = data;
++	struct mt7915_phy *phy = file->private_data;
++	struct mt7915_dev *dev = phy->dev;
++	bool ext_phy = phy != &dev->phy;
++	char buf[16];
+ 	int ret = 0;
++	u16 val;
++
++	if (count >= sizeof(buf))
++		return -EINVAL;
++
++	if (copy_from_user(buf, user_buf, count))
++		return -EFAULT;
++
++	if (count && buf[count - 1] == '\n')
++		buf[count - 1] = '\0';
++	else
++		buf[count] = '\0';
++
++	if (kstrtou16(buf, 0, &val))
++		return -EINVAL;
+ 
+ 	switch (val) {
++	case SER_QUERY:
++		/* grab firmware SER stats */
++		ret = mt7915_mcu_set_ser(dev, 0, 0, ext_phy);
++		break;
+ 	case SER_SET_RECOVER_L1:
+ 	case SER_SET_RECOVER_L2:
+-		ret = mt7915_mcu_set_ser(dev, SER_ENABLE, BIT(val), 0);
++	case SER_SET_RECOVER_L3_RX_ABORT:
++	case SER_SET_RECOVER_L3_TX_ABORT:
++	case SER_SET_RECOVER_L3_TX_DISABLE:
++	case SER_SET_RECOVER_L3_BF:
++		ret = mt7915_mcu_set_ser(dev, SER_ENABLE, BIT(val), ext_phy);
+ 		if (ret)
+ 			return ret;
+ 
+-		return mt7915_mcu_set_ser(dev, SER_RECOVER, val, 0);
++		ret = mt7915_mcu_set_ser(dev, SER_RECOVER, val, ext_phy);
++		break;
+ 	default:
+ 		break;
+ 	}
+ 
++	return ret ? ret : count;
++}
++
++static ssize_t
++mt7915_fw_ser_get(struct file *file, char __user *user_buf,
++		  size_t count, loff_t *ppos)
++{
++	struct mt7915_phy *phy = file->private_data;
++	struct mt7915_dev *dev = phy->dev;
++	char *buff;
++	int desc = 0;
++	ssize_t ret;
++	static const size_t bufsz = 400;
++
++	buff = kmalloc(bufsz, GFP_KERNEL);
++	if (!buff)
++		return -ENOMEM;
++
++	desc += scnprintf(buff + desc, bufsz - desc,
++			  "::E  R , SER_STATUS        = 0x%08x\n",
++			  mt76_rr(dev, MT_SWDEF_SER_STATS));
++	desc += scnprintf(buff + desc, bufsz - desc,
++			  "::E  R , SER_PLE_ERR       = 0x%08x\n",
++			  mt76_rr(dev, MT_SWDEF_PLE_STATS));
++	desc += scnprintf(buff + desc, bufsz - desc,
++			  "::E  R , SER_PLE_ERR_1     = 0x%08x\n",
++			  mt76_rr(dev, MT_SWDEF_PLE1_STATS));
++	desc += scnprintf(buff + desc, bufsz - desc,
++			  "::E  R , SER_PLE_ERR_AMSDU = 0x%08x\n",
++			  mt76_rr(dev, MT_SWDEF_PLE_AMSDU_STATS));
++	desc += scnprintf(buff + desc, bufsz - desc,
++			  "::E  R , SER_PSE_ERR       = 0x%08x\n",
++			  mt76_rr(dev, MT_SWDEF_PSE_STATS));
++	desc += scnprintf(buff + desc, bufsz - desc,
++			  "::E  R , SER_PSE_ERR_1     = 0x%08x\n",
++			  mt76_rr(dev, MT_SWDEF_PSE1_STATS));
++	desc += scnprintf(buff + desc, bufsz - desc,
++			  "::E  R , SER_LMAC_WISR6_B0 = 0x%08x\n",
++			  mt76_rr(dev, MT_SWDEF_LAMC_WISR6_BN0_STATS));
++	desc += scnprintf(buff + desc, bufsz - desc,
++			  "::E  R , SER_LMAC_WISR6_B1 = 0x%08x\n",
++			  mt76_rr(dev, MT_SWDEF_LAMC_WISR6_BN1_STATS));
++	desc += scnprintf(buff + desc, bufsz - desc,
++			  "::E  R , SER_LMAC_WISR7_B0 = 0x%08x\n",
++			  mt76_rr(dev, MT_SWDEF_LAMC_WISR7_BN0_STATS));
++	desc += scnprintf(buff + desc, bufsz - desc,
++			  "::E  R , SER_LMAC_WISR7_B1 = 0x%08x\n",
++			  mt76_rr(dev, MT_SWDEF_LAMC_WISR7_BN1_STATS));
++
++	ret = simple_read_from_buffer(user_buf, count, ppos, buff, desc);
++	kfree(buff);
+ 	return ret;
+ }
+ 
+-DEFINE_DEBUGFS_ATTRIBUTE(fops_ser_trigger, NULL,
+-			 mt7915_ser_trigger_set, "%lld\n");
++static const struct file_operations mt7915_fw_ser_ops = {
++	.write = mt7915_fw_ser_set,
++	.read = mt7915_fw_ser_get,
++	.open = simple_open,
++	.llseek = default_llseek,
++};
+ 
+ static int
+ mt7915_radar_trigger(void *data, u64 val)
+@@ -914,6 +992,7 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+ 	debugfs_create_file("xmit-queues", 0400, dir, phy,
+ 			    &mt7915_xmit_queues_fops);
+ 	debugfs_create_file("tx_stats", 0400, dir, phy, &mt7915_tx_stats_fops);
++	debugfs_create_file("fw_ser", 0600, dir, phy, &mt7915_fw_ser_ops);
+ 	debugfs_create_file("fw_debug_wm", 0600, dir, dev, &fops_fw_debug_wm);
+ 	debugfs_create_file("fw_debug_wa", 0600, dir, dev, &fops_fw_debug_wa);
+ 	debugfs_create_file("fw_debug_bin", 0600, dir, dev, &fops_fw_debug_bin);
+@@ -927,7 +1006,6 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+ 			    &mt7915_rate_txpower_fops);
+ 	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
+ 				    mt7915_twt_stats);
+-	debugfs_create_file("ser_trigger", 0200, dir, dev, &fops_ser_trigger);
+ 	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
+ 
+ 	if (!dev->dbdc_support || phy->band_idx) {
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index c215bc9e..20f32f7f 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -2471,10 +2471,7 @@ int mt7915_mcu_init(struct mt7915_dev *dev)
+ 	/* force firmware operation mode into normal state,
+ 	 * which should be set before firmware download stage.
+ 	 */
+-	if (is_mt7915(&dev->mt76))
+-		mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
+-	else
+-		mt76_wr(dev, MT_SWDEF_MODE_MT7916, MT_SWDEF_NORMAL_MODE);
++	mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
+ 
+ 	ret = mt7915_driver_own(dev, 0);
+ 	if (ret)
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index df7aefca..5cbc3ecf 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -464,6 +464,20 @@ enum {
+ 	MURU_GET_TXC_TX_STATS = 151,
+ };
+ 
++enum {
++	SER_QUERY,
++	/* recovery */
++	SER_SET_RECOVER_L1,
++	SER_SET_RECOVER_L2,
++	SER_SET_RECOVER_L3_RX_ABORT,
++	SER_SET_RECOVER_L3_TX_ABORT,
++	SER_SET_RECOVER_L3_TX_DISABLE,
++	SER_SET_RECOVER_L3_BF,
++	/* action */
++	SER_ENABLE = 2,
++	SER_RECOVER
++};
++
+ #define MT7915_BSS_UPDATE_MAX_SIZE	(sizeof(struct sta_req_hdr) +	\
+ 					 sizeof(struct bss_info_omac) +	\
+ 					 sizeof(struct bss_info_basic) +\
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 0bd32daa..2d733d32 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -22,6 +22,7 @@ static const u32 mt7915_reg[] = {
+ 	[WFDMA_EXT_CSR_ADDR]	= 0xd7000,
+ 	[CBTOP1_PHY_END]	= 0x77ffffff,
+ 	[INFRA_MCU_ADDR_END]	= 0x7c3fffff,
++	[SWDEF_BASE_ADDR]	= 0x41f200,
+ };
+ 
+ static const u32 mt7916_reg[] = {
+@@ -36,6 +37,7 @@ static const u32 mt7916_reg[] = {
+ 	[WFDMA_EXT_CSR_ADDR]	= 0xd7000,
+ 	[CBTOP1_PHY_END]	= 0x7fffffff,
+ 	[INFRA_MCU_ADDR_END]	= 0x7c085fff,
++	[SWDEF_BASE_ADDR]	= 0x411400,
+ };
+ 
+ static const u32 mt7986_reg[] = {
+@@ -50,6 +52,7 @@ static const u32 mt7986_reg[] = {
+ 	[WFDMA_EXT_CSR_ADDR]	= 0x27000,
+ 	[CBTOP1_PHY_END]	= 0x7fffffff,
+ 	[INFRA_MCU_ADDR_END]	= 0x7c085fff,
++	[SWDEF_BASE_ADDR]	= 0x411400,
+ };
+ 
+ static const u32 mt7915_offs[] = {
+diff --git a/mt7915/regs.h b/mt7915/regs.h
+index 97984aaf..4251cf78 100644
+--- a/mt7915/regs.h
++++ b/mt7915/regs.h
+@@ -30,6 +30,7 @@ enum reg_rev {
+ 	WFDMA_EXT_CSR_ADDR,
+ 	CBTOP1_PHY_END,
+ 	INFRA_MCU_ADDR_END,
++	SWDEF_BASE_ADDR,
+ 	__MT_REG_MAX,
+ };
+ 
+@@ -942,12 +943,25 @@ enum offs_rev {
+ #define MT_ADIE_TYPE_MASK		BIT(1)
+ 
+ /* FW MODE SYNC */
+-#define MT_SWDEF_MODE			0x41f23c
+-#define MT_SWDEF_MODE_MT7916		0x41143c
++#define MT_SWDEF_BASE			__REG(SWDEF_BASE_ADDR)
++
++#define MT_SWDEF(ofs)			(MT_SWDEF_BASE + (ofs))
++#define MT_SWDEF_MODE			MT_SWDEF(0x3c)
+ #define MT_SWDEF_NORMAL_MODE		0
+ #define MT_SWDEF_ICAP_MODE		1
+ #define MT_SWDEF_SPECTRUM_MODE		2
+ 
++#define MT_SWDEF_SER_STATS		MT_SWDEF(0x040)
++#define MT_SWDEF_PLE_STATS		MT_SWDEF(0x044)
++#define MT_SWDEF_PLE1_STATS		MT_SWDEF(0x048)
++#define MT_SWDEF_PLE_AMSDU_STATS	MT_SWDEF(0x04C)
++#define MT_SWDEF_PSE_STATS		MT_SWDEF(0x050)
++#define MT_SWDEF_PSE1_STATS		MT_SWDEF(0x054)
++#define MT_SWDEF_LAMC_WISR6_BN0_STATS	MT_SWDEF(0x058)
++#define MT_SWDEF_LAMC_WISR6_BN1_STATS	MT_SWDEF(0x05C)
++#define MT_SWDEF_LAMC_WISR7_BN0_STATS	MT_SWDEF(0x060)
++#define MT_SWDEF_LAMC_WISR7_BN1_STATS	MT_SWDEF(0x064)
++
+ #define MT_DIC_CMD_REG_BASE		0x41f000
+ #define MT_DIC_CMD_REG(ofs)		(MT_DIC_CMD_REG_BASE + (ofs))
+ #define MT_DIC_CMD_REG_CMD		MT_DIC_CMD_REG(0x10)
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0017-mt76-mt7615-mt7915-do-reset_work-with-mt76-s-work-qu.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0017-mt76-mt7615-mt7915-do-reset_work-with-mt76-s-work-qu.patch
new file mode 100755
index 0000000..9e20c45
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0017-mt76-mt7615-mt7915-do-reset_work-with-mt76-s-work-qu.patch
@@ -0,0 +1,43 @@
+From a56d23330b0ac01929a54c427bd338b02a7e727e Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Fri, 6 May 2022 21:06:55 +0800
+Subject: [PATCH 03/10] mt76: mt7615/mt7915: do reset_work with mt76's work
+ queue
+
+reset_work may be blocked when mcu message timeout occurs
+
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+---
+ mt7615/mmio.c | 2 +-
+ mt7915/mmio.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/mt7615/mmio.c b/mt7615/mmio.c
+index ce45c3bf..a208035e 100644
+--- a/mt7615/mmio.c
++++ b/mt7615/mmio.c
+@@ -145,7 +145,7 @@ static void mt7615_irq_tasklet(struct tasklet_struct *t)
+ 		return;
+ 
+ 	dev->reset_state = mcu_int;
+-	ieee80211_queue_work(mt76_hw(dev), &dev->reset_work);
++	queue_work(dev->mt76.wq, &dev->reset_work);
+ 	wake_up(&dev->reset_wait);
+ }
+ 
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 2d733d32..4d4537cd 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -612,7 +612,7 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
+ 		mt76_wr(dev, MT_MCU_CMD, val);
+ 		if (val & MT_MCU_CMD_ERROR_MASK) {
+ 			dev->reset_state = val;
+-			ieee80211_queue_work(mt76_hw(dev), &dev->reset_work);
++			queue_work(dev->mt76.wq, &dev->reset_work);
+ 			wake_up(&dev->reset_wait);
+ 		}
+ 	}
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1007-mt76-mt7915-add-L0.5-system-error-recovery-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1007-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
new file mode 100755
index 0000000..20ccd9d
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1007-mt76-mt7915-add-L0.5-system-error-recovery-support.patch
@@ -0,0 +1,935 @@
+From ce9d865db52e49410af55a3b348f00ed1511ccbc Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Thu, 5 May 2022 16:25:44 +0800
+Subject: [PATCH 04/10] mt76: mt7915: add L0.5 system error recovery support
+
+add L0.5 system error recovery support
+auto trigger l0.5 ser when detect fw exception or mem dma hang.
+
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+---
+ mt7915/debugfs.c |  88 ++++++++++++---
+ mt7915/dma.c     |  48 ++++++++
+ mt7915/init.c    |   8 +-
+ mt7915/mac.c     | 280 +++++++++++++++++++++++++++++++++++++----------
+ mt7915/main.c    |  20 +++-
+ mt7915/mcu.c     |  96 ++++++++++++++--
+ mt7915/mcu.h     |   3 +-
+ mt7915/mmio.c    |   8 +-
+ mt7915/mt7915.h  |  23 ++++
+ mt7915/regs.h    |  16 +++
+ 10 files changed, 493 insertions(+), 97 deletions(-)
+
+diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
+index b45181c1..f07df470 100644
+--- a/mt7915/debugfs.c
++++ b/mt7915/debugfs.c
+@@ -49,12 +49,17 @@ static ssize_t
+ mt7915_fw_ser_set(struct file *file, const char __user *user_buf,
+ 		  size_t count, loff_t *ppos)
+ {
++#define SER_LEVEL	GENMASK(3, 0)
++#define SER_ACTION	GENMASK(11, 8)
++
+ 	struct mt7915_phy *phy = file->private_data;
+ 	struct mt7915_dev *dev = phy->dev;
+-	bool ext_phy = phy != &dev->phy;
++	u8 ser_action, ser_set, set_val;
++	u8 band_idx = phy->band_idx;
+ 	char buf[16];
+ 	int ret = 0;
+ 	u16 val;
++	u32 intr;
+ 
+ 	if (count >= sizeof(buf))
+ 		return -EINVAL;
+@@ -70,28 +75,71 @@ mt7915_fw_ser_set(struct file *file, const char __user *user_buf,
+ 	if (kstrtou16(buf, 0, &val))
+ 		return -EINVAL;
+ 
+-	switch (val) {
++	ser_action = FIELD_GET(SER_ACTION, val);
++	ser_set = set_val = FIELD_GET(SER_LEVEL, val);
++
++	switch (ser_action) {
+ 	case SER_QUERY:
+ 		/* grab firmware SER stats */
+-		ret = mt7915_mcu_set_ser(dev, 0, 0, ext_phy);
++		ser_set = 0;
+ 		break;
+-	case SER_SET_RECOVER_L1:
+-	case SER_SET_RECOVER_L2:
+-	case SER_SET_RECOVER_L3_RX_ABORT:
+-	case SER_SET_RECOVER_L3_TX_ABORT:
+-	case SER_SET_RECOVER_L3_TX_DISABLE:
+-	case SER_SET_RECOVER_L3_BF:
+-		ret = mt7915_mcu_set_ser(dev, SER_ENABLE, BIT(val), ext_phy);
+-		if (ret)
+-			return ret;
+-
+-		ret = mt7915_mcu_set_ser(dev, SER_RECOVER, val, ext_phy);
++	case SER_SET:
++		/*
++		 * 0x100: disable system error recovery function.
++		 * 0x101: enable system error recovery function.
++		 * 0x103: enable l0.5 recover function.
++		 */
++		ser_set = !!set_val;
++
++		dev->ser.reset_enable = ser_set;
++		intr = mt76_rr(dev, MT_WFDMA0_MCU_HOST_INT_ENA);
++		if (dev->ser.reset_enable)
++			intr |= MT_MCU_CMD_WDT_MASK;
++		else
++			intr &= ~MT_MCU_CMD_WDT_MASK;
++		mt76_set(dev, MT_WFDMA0_MCU_HOST_INT_ENA, intr);
+ 		break;
+-	default:
++	case SER_ENABLE:
++		/*
++		 * 0x200: enable system error tracking.
++		 * 0x201: enable system error L1 recover.
++		 * 0x202: enable system error L2 recover.
++		 * 0x203: enable system error L3 rx abort.
++		 * 0x204: enable system error L3 tx abort.
++		 * 0x205: enable system error L3 tx disable.
++		 * 0x206: enable system error L3 bf recover.
++		 * 0x207: enable system error all recover.
++		 */
++		ser_set = set_val > 7 ? 0x7f : BIT(set_val);
++		break;
++	case SER_RECOVER:
++		/*
++		 * 0x300: trigger L0.5 recover.
++		 * 0x301: trigger L1 recover.
++		 * 0x302: trigger L2 recover.
++		 * 0x303: trigger L3 rx abort.
++		 * 0x304: trigger L3 tx abort
++		 * 0x305: trigger L3 tx disable.
++		 * 0x306: trigger L3 bf recover.
++		 */
++		if (!ser_set) {
++			if (dev->ser.reset_enable) {
++				dev->reset_state |= MT_MCU_CMD_WDT_MASK;
++				mt7915_reset(dev);
++			} else {
++				dev_info(dev->mt76.dev, "SER: chip full recovery not enable\n");
++			}
++			goto out;
++		}
+ 		break;
++	default:
++		goto out;
+ 	}
+-
+-	return ret ? ret : count;
++	ret = mt7915_mcu_set_ser(dev, ser_action, ser_set, band_idx);
++	if (ret)
++		return ret;
++out:
++	return count;
+ }
+ 
+ static ssize_t
+@@ -140,6 +188,12 @@ mt7915_fw_ser_get(struct file *file, char __user *user_buf,
+ 			  "::E  R , SER_LMAC_WISR7_B1 = 0x%08x\n",
+ 			  mt76_rr(dev, MT_SWDEF_LAMC_WISR7_BN1_STATS));
+ 
++	desc += scnprintf(buff + desc, bufsz - desc,
++			  "\nWF RESET STATUS: EN %d, WM %d, WA %d\n",
++			  dev->ser.reset_enable,
++			  dev->ser.wf_reset_wm_count,
++			  dev->ser.wf_reset_wa_count);
++
+ 	ret = simple_read_from_buffer(user_buf, count, ppos, buff, desc);
+ 	kfree(buff);
+ 	return ret;
+diff --git a/mt7915/dma.c b/mt7915/dma.c
+index c2d655cd..9e3d14db 100644
+--- a/mt7915/dma.c
++++ b/mt7915/dma.c
+@@ -486,6 +486,54 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+ 	return 0;
+ }
+ 
++int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
++{
++	struct mt76_phy *mphy_ext = dev->mt76.phy2;
++	int i;
++
++	/* clean up hw queues */
++	for (i = 0; i < ARRAY_SIZE(dev->mt76.phy.q_tx); i++) {
++		mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[i], true);
++		if (mphy_ext)
++			mt76_queue_tx_cleanup(dev, mphy_ext->q_tx[i], true);
++	}
++
++	for (i = 0; i < ARRAY_SIZE(dev->mt76.q_mcu); i++)
++		mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[i], true);
++
++	mt76_for_each_q_rx(&dev->mt76, i)
++		mt76_queue_rx_cleanup(dev, &dev->mt76.q_rx[i]);
++
++	/* reset wfsys */
++	if (force)
++		mt7915_wfsys_reset(dev);
++
++	/* disable wfdma */
++	mt7915_dma_disable(dev, force);
++
++	/* reset hw queues */
++	for (i = 0; i < __MT_TXQ_MAX; i++) {
++		mt76_queue_reset(dev, dev->mphy.q_tx[i]);
++		if (mphy_ext)
++			mt76_queue_reset(dev, mphy_ext->q_tx[i]);
++	}
++
++	for (i = 0; i < __MT_MCUQ_MAX; i++)
++		mt76_queue_reset(dev, dev->mt76.q_mcu[i]);
++
++	mt76_for_each_q_rx(&dev->mt76, i)
++		mt76_queue_reset(dev, &dev->mt76.q_rx[i]);
++
++	mt76_tx_status_check(&dev->mt76, true);
++
++	mt7915_dma_enable(dev);
++
++	mt76_for_each_q_rx(&dev->mt76, i)
++		mt76_queue_rx_reset(dev, i);
++
++	return 0;
++}
++
+ void mt7915_dma_cleanup(struct mt7915_dev *dev)
+ {
+ 	mt7915_dma_disable(dev, true);
+diff --git a/mt7915/init.c b/mt7915/init.c
+index 1c956d3d..4984ec8f 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -262,7 +262,7 @@ static void mt7915_led_set_brightness(struct led_classdev *led_cdev,
+ 		mt7915_led_set_config(led_cdev, 0xff, 0);
+ }
+ 
+-static void
++void
+ mt7915_init_txpower(struct mt7915_dev *dev,
+ 		    struct ieee80211_supported_band *sband)
+ {
+@@ -441,7 +441,7 @@ mt7915_mac_init_band(struct mt7915_dev *dev, u8 band)
+ 	mt76_clear(dev, MT_DMA_DCR0(band), MT_DMA_DCR0_RXD_G5_EN);
+ }
+ 
+-static void mt7915_mac_init(struct mt7915_dev *dev)
++void mt7915_mac_init(struct mt7915_dev *dev)
+ {
+ 	int i;
+ 	u32 rx_len = is_mt7915(&dev->mt76) ? 0x400 : 0x680;
+@@ -471,7 +471,7 @@ static void mt7915_mac_init(struct mt7915_dev *dev)
+ 	}
+ }
+ 
+-static int mt7915_txbf_init(struct mt7915_dev *dev)
++int mt7915_txbf_init(struct mt7915_dev *dev)
+ {
+ 	int ret;
+ 
+@@ -1112,6 +1112,8 @@ int mt7915_register_device(struct mt7915_dev *dev)
+ 
+ 	mt7915_init_debugfs(&dev->phy);
+ 
++	dev->ser.hw_init_done = true;
++
+ 	return 0;
+ 
+ unreg_thermal:
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index de5f3f10..1a1798d2 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -3,6 +3,7 @@
+ 
+ #include <linux/etherdevice.h>
+ #include <linux/timekeeping.h>
++#include <linux/pci.h>
+ #include "mt7915.h"
+ #include "../dma.h"
+ #include "mac.h"
+@@ -2037,85 +2038,188 @@ mt7915_update_beacons(struct mt7915_dev *dev)
+ 		mt7915_update_vif_beacon, dev->mt76.phy2->hw);
+ }
+ 
+-static void
+-mt7915_dma_reset(struct mt7915_dev *dev)
++void mt7915_tx_token_put(struct mt7915_dev *dev)
+ {
+-	struct mt76_phy *mphy_ext = dev->mt76.phy2;
+-	u32 hif1_ofs = MT_WFDMA0_PCIE1(0) - MT_WFDMA0(0);
+-	int i;
++	struct mt76_txwi_cache *txwi;
++	int id;
+ 
+-	mt76_clear(dev, MT_WFDMA0_GLO_CFG,
+-		   MT_WFDMA0_GLO_CFG_TX_DMA_EN |
+-		   MT_WFDMA0_GLO_CFG_RX_DMA_EN);
++	spin_lock_bh(&dev->mt76.token_lock);
++	idr_for_each_entry(&dev->mt76.token, txwi, id) {
++		mt7915_txwi_free(dev, txwi, NULL, NULL);
++		dev->mt76.token_count--;
++	}
++	spin_unlock_bh(&dev->mt76.token_lock);
++	idr_destroy(&dev->mt76.token);
++}
+ 
+-	if (is_mt7915(&dev->mt76))
+-		mt76_clear(dev, MT_WFDMA1_GLO_CFG,
+-			   MT_WFDMA1_GLO_CFG_TX_DMA_EN |
+-			   MT_WFDMA1_GLO_CFG_RX_DMA_EN);
++static int
++mt7915_mac_reset(struct mt7915_dev *dev)
++{
++	struct mt7915_phy *phy2;
++	struct mt76_phy *ext_phy;
++	struct mt76_dev *mdev = &dev->mt76;
++	int i, ret;
++	u32 irq_mask;
++
++	ext_phy = dev->mt76.phy2;
++	phy2 = ext_phy ? ext_phy->priv : NULL;
++
++	/* irq disable */
++	mt76_wr(dev, MT_INT_MASK_CSR, 0x0);
++	mt76_wr(dev, MT_INT_SOURCE_CSR, ~0);
+ 	if (dev->hif2) {
+-		mt76_clear(dev, MT_WFDMA0_GLO_CFG + hif1_ofs,
+-			   MT_WFDMA0_GLO_CFG_TX_DMA_EN |
+-			   MT_WFDMA0_GLO_CFG_RX_DMA_EN);
++		mt76_wr(dev, MT_INT1_MASK_CSR, 0x0);
++		mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0);
++	}
++	if (dev_is_pci(mdev->dev)) {
++		mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0x0);
++		if (dev->hif2)
++			mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0x0);
++	}
+ 
+-		if (is_mt7915(&dev->mt76))
+-			mt76_clear(dev, MT_WFDMA1_GLO_CFG + hif1_ofs,
+-				   MT_WFDMA1_GLO_CFG_TX_DMA_EN |
+-				   MT_WFDMA1_GLO_CFG_RX_DMA_EN);
++	set_bit(MT76_RESET, &dev->mphy.state);
++	set_bit(MT76_MCU_RESET, &dev->mphy.state);
++	wake_up(&dev->mt76.mcu.wait);
++	if (ext_phy) {
++		set_bit(MT76_RESET, &ext_phy->state);
++		set_bit(MT76_MCU_RESET, &ext_phy->state);
+ 	}
+ 
+-	usleep_range(1000, 2000);
++	/* lock/unlock all queues to ensure that no tx is pending */
++	mt76_txq_schedule_all(&dev->mphy);
++	if (ext_phy)
++		mt76_txq_schedule_all(ext_phy);
+ 
+-	for (i = 0; i < __MT_TXQ_MAX; i++) {
+-		mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[i], true);
+-		if (mphy_ext)
+-			mt76_queue_tx_cleanup(dev, mphy_ext->q_tx[i], true);
++	/* disable all tx/rx napi */
++	mt76_worker_disable(&dev->mt76.tx_worker);
++	mt76_for_each_q_rx(mdev, i) {
++		if (mdev->q_rx[i].ndesc)
++			napi_disable(&dev->mt76.napi[i]);
+ 	}
++	napi_disable(&dev->mt76.tx_napi);
+ 
+-	for (i = 0; i < __MT_MCUQ_MAX; i++)
+-		mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[i], true);
+-
+-	mt76_for_each_q_rx(&dev->mt76, i)
+-		mt76_queue_rx_reset(dev, i);
++	/* token reinit */
++	mt7915_tx_token_put(dev);
++	idr_init(&dev->mt76.token);
+ 
+-	mt76_tx_status_check(&dev->mt76, true);
++	mt7915_dma_reset(dev, true);
+ 
+-	/* re-init prefetch settings after reset */
+-	mt7915_dma_prefetch(dev);
++	local_bh_disable();
++	mt76_for_each_q_rx(mdev, i) {
++		if (mdev->q_rx[i].ndesc) {
++			napi_enable(&dev->mt76.napi[i]);
++			napi_schedule(&dev->mt76.napi[i]);
++		}
++	}
++	local_bh_enable();
++	clear_bit(MT76_MCU_RESET, &dev->mphy.state);
++	clear_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
+ 
+-	mt76_set(dev, MT_WFDMA0_GLO_CFG,
+-		 MT_WFDMA0_GLO_CFG_TX_DMA_EN | MT_WFDMA0_GLO_CFG_RX_DMA_EN);
+-	if (is_mt7915(&dev->mt76))
+-		mt76_set(dev, MT_WFDMA1_GLO_CFG,
+-			 MT_WFDMA1_GLO_CFG_TX_DMA_EN |
+-			 MT_WFDMA1_GLO_CFG_RX_DMA_EN |
+-			 MT_WFDMA1_GLO_CFG_OMIT_TX_INFO |
+-			 MT_WFDMA1_GLO_CFG_OMIT_RX_INFO);
++	mt76_wr(dev, MT_INT_MASK_CSR, dev->mt76.mmio.irqmask);
++	mt76_wr(dev, MT_INT_SOURCE_CSR, ~0);
+ 	if (dev->hif2) {
+-		mt76_set(dev, MT_WFDMA0_GLO_CFG + hif1_ofs,
+-			 MT_WFDMA0_GLO_CFG_TX_DMA_EN |
+-			 MT_WFDMA0_GLO_CFG_RX_DMA_EN);
++		mt76_wr(dev, MT_INT1_MASK_CSR, irq_mask);
++		mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0);
++	}
++	if (dev_is_pci(mdev->dev)) {
++		mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0xff);
++		if (dev->hif2)
++			mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0xff);
++	}
++
++	/* load firmware */
++	ret = mt7915_run_firmware(dev);
++	if (ret)
++		goto out;
++
++	/* set the necessary init items */
++	ret = mt7915_mcu_set_eeprom(dev, dev->flash_mode);
++	if (ret)
++		goto out;
++
++	mt7915_mac_init(dev);
++	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
++	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
++	ret = mt7915_txbf_init(dev);
+ 
+-		if (is_mt7915(&dev->mt76))
+-			mt76_set(dev, MT_WFDMA1_GLO_CFG + hif1_ofs,
+-				 MT_WFDMA1_GLO_CFG_TX_DMA_EN |
+-				 MT_WFDMA1_GLO_CFG_RX_DMA_EN |
+-				 MT_WFDMA1_GLO_CFG_OMIT_TX_INFO |
+-				 MT_WFDMA1_GLO_CFG_OMIT_RX_INFO);
++	if (test_bit(MT76_STATE_RUNNING, &dev->mphy.state)) {
++		ret = __mt7915_start(dev->mphy.hw);
++		if (ret)
++			goto out;
++	}
++
++	if (ext_phy && test_bit(MT76_STATE_RUNNING, &ext_phy->state)) {
++		ret = __mt7915_start(ext_phy->hw);
++		if (ret)
++			goto out;
+ 	}
++
++out:
++	/* reset done */
++	clear_bit(MT76_RESET, &dev->mphy.state);
++	if (phy2)
++		clear_bit(MT76_RESET, &phy2->mt76->state);
++
++	local_bh_disable();
++	napi_enable(&dev->mt76.tx_napi);
++	napi_schedule(&dev->mt76.tx_napi);
++	local_bh_enable();
++
++	mt76_worker_enable(&dev->mt76.tx_worker);
++
++	return ret;
+ }
+ 
+-void mt7915_tx_token_put(struct mt7915_dev *dev)
++static void
++mt7915_mac_full_reset(struct mt7915_dev *dev)
+ {
+-	struct mt76_txwi_cache *txwi;
+-	int id;
++	struct mt7915_phy *phy2;
++	struct mt76_phy *ext_phy;
++	int i;
+ 
+-	spin_lock_bh(&dev->mt76.token_lock);
+-	idr_for_each_entry(&dev->mt76.token, txwi, id) {
+-		mt7915_txwi_free(dev, txwi, NULL, NULL);
+-		dev->mt76.token_count--;
++	ext_phy = dev->mt76.phy2;
++	phy2 = ext_phy ? ext_phy->priv : NULL;
++
++	dev->ser.hw_full_reset = true;
++	if (READ_ONCE(dev->reset_state) & MT_MCU_CMD_WA_WDT)
++		dev->ser.wf_reset_wa_count++;
++	else
++		dev->ser.wf_reset_wm_count++;
++
++	wake_up(&dev->mt76.mcu.wait);
++	ieee80211_stop_queues(mt76_hw(dev));
++	if (ext_phy)
++		ieee80211_stop_queues(ext_phy->hw);
++
++	cancel_delayed_work_sync(&dev->mphy.mac_work);
++	if (ext_phy)
++		cancel_delayed_work_sync(&ext_phy->mac_work);
++
++	mutex_lock(&dev->mt76.mutex);
++	for (i = 0; i < 10; i++) {
++		if (!mt7915_mac_reset(dev))
++			break;
+ 	}
+-	spin_unlock_bh(&dev->mt76.token_lock);
+-	idr_destroy(&dev->mt76.token);
++	mutex_unlock(&dev->mt76.mutex);
++
++	if (i == 10)
++		dev_err(dev->mt76.dev, "chip full reset failed\n");
++
++	ieee80211_restart_hw(mt76_hw(dev));
++	if (ext_phy)
++		ieee80211_restart_hw(ext_phy->hw);
++
++	ieee80211_wake_queues(mt76_hw(dev));
++	if (ext_phy)
++		ieee80211_wake_queues(ext_phy->hw);
++
++	dev->ser.hw_full_reset = false;
++	ieee80211_queue_delayed_work(mt76_hw(dev), &dev->mphy.mac_work,
++				     MT7915_WATCHDOG_TIME);
++	if (ext_phy)
++		ieee80211_queue_delayed_work(ext_phy->hw,
++					     &ext_phy->mac_work,
++					     MT7915_WATCHDOG_TIME);
+ }
+ 
+ /* system error recovery */
+@@ -2129,6 +2233,36 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ 	ext_phy = dev->mt76.phy2;
+ 	phy2 = ext_phy ? ext_phy->priv : NULL;
+ 
++	/* chip full reset */
++	if (dev->ser.reset_type == SER_TYPE_FULL_RESET) {
++		u32 intr;
++
++		/* disable WA/WM WDT */
++		intr = mt76_rr(dev, MT_WFDMA0_MCU_HOST_INT_ENA);
++		intr &= ~MT_MCU_CMD_WDT_MASK;
++		mt76_set(dev, MT_WFDMA0_MCU_HOST_INT_ENA, intr);
++
++		mt7915_mac_full_reset(dev);
++
++		/* enable the mcu irq*/
++		mt7915_irq_enable(dev, MT_INT_MCU_CMD);
++		mt7915_irq_disable(dev, 0);
++
++		/* re-enable WA/WM WDT */
++		intr = mt76_rr(dev, MT_WFDMA0_MCU_HOST_INT_ENA);
++		intr |= MT_MCU_CMD_WDT_MASK;
++		mt76_set(dev, MT_WFDMA0_MCU_HOST_INT_ENA, intr);
++
++		dev->reset_state = MT_MCU_CMD_NORMAL_STATE;
++		dev->ser.reset_type = SER_TYPE_NONE;
++		dev_info(dev->mt76.dev, "SER: chip full reset completed, WM %d, WA %d\n",
++			 dev->ser.wf_reset_wm_count,
++			 dev->ser.wf_reset_wa_count);
++		return;
++	}
++
++	/* chip partial reset */
++	dev->ser.reset_type = SER_TYPE_NONE;
+ 	if (!(READ_ONCE(dev->reset_state) & MT_MCU_CMD_STOP_DMA))
+ 		return;
+ 
+@@ -2155,7 +2289,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ 	mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_STOPPED);
+ 
+ 	if (mt7915_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) {
+-		mt7915_dma_reset(dev);
++		mt7915_dma_reset(dev, false);
+ 
+ 		mt7915_tx_token_put(dev);
+ 		idr_init(&dev->mt76.token);
+@@ -2206,6 +2340,34 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ 					     MT7915_WATCHDOG_TIME);
+ }
+ 
++void mt7915_reset(struct mt7915_dev *dev)
++{
++	if (!dev->ser.hw_init_done)
++		return;
++
++	if (dev->ser.hw_full_reset)
++		return;
++
++	/* wm/wa exception: do full recovery */
++	if (READ_ONCE(dev->reset_state) & MT_MCU_CMD_WDT_MASK) {
++		dev_info(dev->mt76.dev, "SER: chip full recovery start, WM %d, WA %d\n",
++			 dev->ser.wf_reset_wm_count,
++			 dev->ser.wf_reset_wa_count);
++
++		dev->ser.reset_type = SER_TYPE_FULL_RESET;
++
++		mt7915_irq_disable(dev, MT_INT_MCU_CMD);
++		queue_work(dev->mt76.wq, &dev->reset_work);
++		return;
++	}
++
++	dev_info(dev->mt76.dev, "SER: chip partial recovery, reset_state(0x%08X)\n",
++		READ_ONCE(dev->reset_state));
++	dev->ser.reset_type = SER_TYPE_PARTIAL_RESET;
++	queue_work(dev->mt76.wq, &dev->reset_work);
++	wake_up(&dev->reset_wait);
++}
++
+ void mt7915_mac_update_stats(struct mt7915_phy *phy)
+ {
+ 	struct mt7915_dev *dev = phy->dev;
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 78bf5ffa..eabcd785 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -20,17 +20,13 @@ static bool mt7915_dev_running(struct mt7915_dev *dev)
+ 	return phy && test_bit(MT76_STATE_RUNNING, &phy->mt76->state);
+ }
+ 
+-static int mt7915_start(struct ieee80211_hw *hw)
++int __mt7915_start(struct ieee80211_hw *hw)
+ {
+ 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
+ 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
+ 	bool running;
+ 	int ret;
+ 
+-	flush_work(&dev->init_work);
+-
+-	mutex_lock(&dev->mt76.mutex);
+-
+ 	running = mt7915_dev_running(dev);
+ 
+ 	if (!running) {
+@@ -80,6 +76,19 @@ static int mt7915_start(struct ieee80211_hw *hw)
+ 		mt7915_mac_reset_counters(phy);
+ 
+ out:
++	return ret;
++}
++
++static int mt7915_start(struct ieee80211_hw *hw)
++{
++	struct mt7915_dev *dev = mt7915_hw_dev(hw);
++	bool running;
++	int ret;
++
++	flush_work(&dev->init_work);
++
++	mutex_lock(&dev->mt76.mutex);
++	ret = __mt7915_start(hw);
+ 	mutex_unlock(&dev->mt76.mutex);
+ 
+ 	return ret;
+@@ -91,6 +100,7 @@ static void mt7915_stop(struct ieee80211_hw *hw)
+ 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
+ 
+ 	cancel_delayed_work_sync(&phy->mt76->mac_work);
++	cancel_work_sync(&dev->reset_work);
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+ 
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 20f32f7f..b29776e9 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -203,19 +203,90 @@ mt7915_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
+ 		ht_mcs[nss] = sta->ht_cap.mcs.rx_mask[nss] & mask[nss];
+ }
+ 
++static int
++mt7915_fw_exception_chk(struct mt7915_dev *dev)
++{
++	u32 reg_val;
++
++	reg_val = mt76_rr(dev, MT_EXCEPTION_ADDR);
++
++	if (is_mt7915(&dev->mt76))
++		reg_val >>= 8;
++
++	return !!(reg_val & 0xff);
++}
++
++static void
++mt7915_fw_heart_beat_chk(struct mt7915_dev *dev)
++{
++#define WM_TIMEOUT_COUNT_CHECK 5
++#define WM_HANG_COUNT_CHECK 9
++	static u32 cidx_rec[5], didx_rec[5];
++	u32 cnt, cidx, didx, queue;
++	u32 idx, i;
++
++	if (dev->ser.hw_full_reset)
++		return;
++
++	if (dev->ser.cmd_fail_cnt >= WM_TIMEOUT_COUNT_CHECK) {
++		cnt = mt76_rr(dev, WF_WFDMA_MEM_DMA_RX_RING_CTL + 4);
++		cidx = mt76_rr(dev, WF_WFDMA_MEM_DMA_RX_RING_CTL + 8);
++		didx = mt76_rr(dev, WF_WFDMA_MEM_DMA_RX_RING_CTL + 12);
++		queue = (didx > cidx) ?
++			(didx - cidx - 1) : (didx - cidx + cnt - 1);
++
++		idx = (dev->ser.cmd_fail_cnt - WM_TIMEOUT_COUNT_CHECK) % 5;
++		cidx_rec[idx] = cidx;
++		didx_rec[idx] = didx;
++
++		if ((cnt - 1) == queue &&
++		    dev->ser.cmd_fail_cnt >= WM_HANG_COUNT_CHECK) {
++
++			for (i = 0; i < 5; i++) {
++				if (cidx_rec[i] != cidx ||
++				    didx_rec[i] != didx)
++					return;
++			}
++			dev_err(dev->mt76.dev, "detect mem dma hang!\n");
++			if (dev->ser.reset_enable) {
++				dev->reset_state |= MT_MCU_CMD_WDT_MASK;
++				mt7915_reset(dev);
++			}
++			dev->ser.cmd_fail_cnt = 0;
++		}
++	}
++}
++
+ static int
+ mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
+ 			  struct sk_buff *skb, int seq)
+ {
++	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
+ 	struct mt7915_mcu_rxd *rxd;
+ 	int ret = 0;
+ 
+ 	if (!skb) {
+ 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
+ 			cmd, seq);
++
++		dev->ser.cmd_fail_cnt++;
++
++		if (dev->ser.cmd_fail_cnt < 5) {
++			int exp_type = mt7915_fw_exception_chk(dev);
++
++			dev_err(mdev->dev, "Fw is status(%d)\n", exp_type);
++			if (exp_type && dev->ser.reset_enable) {
++				dev->reset_state |= MT_MCU_CMD_WDT_MASK;
++				mt7915_reset(dev);
++			}
++		}
++		mt7915_fw_heart_beat_chk(dev);
++
+ 		return -ETIMEDOUT;
+ 	}
+ 
++	dev->ser.cmd_fail_cnt = 0;
++
+ 	rxd = (struct mt7915_mcu_rxd *)skb->data;
+ 	if (seq != rxd->seq)
+ 		return -EAGAIN;
+@@ -2456,18 +2527,10 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
+ 				 sizeof(req), true);
+ }
+ 
+-int mt7915_mcu_init(struct mt7915_dev *dev)
++int mt7915_run_firmware(struct mt7915_dev *dev)
+ {
+-	static const struct mt76_mcu_ops mt7915_mcu_ops = {
+-		.headroom = sizeof(struct mt7915_mcu_txd),
+-		.mcu_skb_send_msg = mt7915_mcu_send_message,
+-		.mcu_parse_response = mt7915_mcu_parse_response,
+-		.mcu_restart = mt76_connac_mcu_restart,
+-	};
+ 	int ret;
+ 
+-	dev->mt76.mcu_ops = &mt7915_mcu_ops;
+-
+ 	/* force firmware operation mode into normal state,
+ 	 * which should be set before firmware download stage.
+ 	 */
+@@ -2516,6 +2579,21 @@ int mt7915_mcu_init(struct mt7915_dev *dev)
+ 				 MCU_WA_PARAM_RED, 0, 0);
+ }
+ 
++int mt7915_mcu_init(struct mt7915_dev *dev)
++{
++	static const struct mt76_mcu_ops mt7915_mcu_ops = {
++		.headroom = sizeof(struct mt7915_mcu_txd),
++		.mcu_skb_send_msg = mt7915_mcu_send_message,
++		.mcu_parse_response = mt7915_mcu_parse_response,
++		.mcu_restart = mt76_connac_mcu_restart,
++	};
++	int ret;
++
++	dev->mt76.mcu_ops = &mt7915_mcu_ops;
++
++	return mt7915_run_firmware(dev);
++}
++
+ void mt7915_mcu_exit(struct mt7915_dev *dev)
+ {
+ 	__mt76_mcu_restart(&dev->mt76);
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 5cbc3ecf..229b9d72 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -466,8 +466,9 @@ enum {
+ 
+ enum {
+ 	SER_QUERY,
++	SER_SET,
+ 	/* recovery */
+-	SER_SET_RECOVER_L1,
++	SER_SET_RECOVER_L1 = 1,
+ 	SER_SET_RECOVER_L2,
+ 	SER_SET_RECOVER_L3_RX_ABORT,
+ 	SER_SET_RECOVER_L3_TX_ABORT,
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 4d4537cd..b3de3a7a 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -23,6 +23,7 @@ static const u32 mt7915_reg[] = {
+ 	[CBTOP1_PHY_END]	= 0x77ffffff,
+ 	[INFRA_MCU_ADDR_END]	= 0x7c3fffff,
+ 	[SWDEF_BASE_ADDR]	= 0x41f200,
++	[EXCEPTION_BASE_ADDR]	= 0x219848,
+ };
+ 
+ static const u32 mt7916_reg[] = {
+@@ -38,6 +39,7 @@ static const u32 mt7916_reg[] = {
+ 	[CBTOP1_PHY_END]	= 0x7fffffff,
+ 	[INFRA_MCU_ADDR_END]	= 0x7c085fff,
+ 	[SWDEF_BASE_ADDR]	= 0x411400,
++	[EXCEPTION_BASE_ADDR]	= 0x022050BC,
+ };
+ 
+ static const u32 mt7986_reg[] = {
+@@ -53,6 +55,7 @@ static const u32 mt7986_reg[] = {
+ 	[CBTOP1_PHY_END]	= 0x7fffffff,
+ 	[INFRA_MCU_ADDR_END]	= 0x7c085fff,
+ 	[SWDEF_BASE_ADDR]	= 0x411400,
++	[EXCEPTION_BASE_ADDR]	= 0x02204FFC,
+ };
+ 
+ static const u32 mt7915_offs[] = {
+@@ -610,10 +613,9 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
+ 		u32 val = mt76_rr(dev, MT_MCU_CMD);
+ 
+ 		mt76_wr(dev, MT_MCU_CMD, val);
+-		if (val & MT_MCU_CMD_ERROR_MASK) {
++		if (val & (MT_MCU_CMD_ERROR_MASK | MT_MCU_CMD_WDT_MASK)) {
+ 			dev->reset_state = val;
+-			queue_work(dev->mt76.wq, &dev->reset_work);
+-			wake_up(&dev->reset_wait);
++			mt7915_reset(dev);
+ 		}
+ 	}
+ }
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index e5f89161..7f7ecdfe 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -297,6 +297,15 @@ struct mt7915_dev {
+ 	struct work_struct reset_work;
+ 	wait_queue_head_t reset_wait;
+ 	u32 reset_state;
++	struct {
++		bool hw_full_reset:1;
++		bool hw_init_done:1;
++		bool reset_enable:1;
++		u32 reset_type;
++		u32 cmd_fail_cnt;
++		u32 wf_reset_wm_count;
++		u32 wf_reset_wa_count;
++	}ser;
+ 
+ 	struct list_head sta_rc_list;
+ 	struct list_head sta_poll_list;
+@@ -335,6 +344,12 @@ enum {
+ 	__MT_WFDMA_MAX,
+ };
+ 
++enum {
++	SER_TYPE_NONE,
++	SER_TYPE_PARTIAL_RESET,
++	SER_TYPE_FULL_RESET,
++};
++
+ enum {
+ 	MT_CTX0,
+ 	MT_HIF0 = 0x0,
+@@ -446,6 +461,14 @@ s8 mt7915_eeprom_get_power_delta(struct mt7915_dev *dev, int band);
+ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2);
+ void mt7915_dma_prefetch(struct mt7915_dev *dev);
+ void mt7915_dma_cleanup(struct mt7915_dev *dev);
++void mt7915_reset(struct mt7915_dev *dev);
++int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
++int __mt7915_start(struct ieee80211_hw *hw);
++void mt7915_init_txpower(struct mt7915_dev *dev,
++		    struct ieee80211_supported_band *sband);
++int mt7915_txbf_init(struct mt7915_dev *dev);
++void mt7915_mac_init(struct mt7915_dev *dev);
++int mt7915_run_firmware(struct mt7915_dev *dev);
+ int mt7915_mcu_init(struct mt7915_dev *dev);
+ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+ 			       struct mt7915_vif *mvif,
+diff --git a/mt7915/regs.h b/mt7915/regs.h
+index 4251cf78..99834310 100644
+--- a/mt7915/regs.h
++++ b/mt7915/regs.h
+@@ -31,6 +31,7 @@ enum reg_rev {
+ 	CBTOP1_PHY_END,
+ 	INFRA_MCU_ADDR_END,
+ 	SWDEF_BASE_ADDR,
++	EXCEPTION_BASE_ADDR,
+ 	__MT_REG_MAX,
+ };
+ 
+@@ -112,6 +113,11 @@ enum offs_rev {
+ #define __REG(id)			(dev->reg.reg_rev[(id)])
+ #define __OFFS(id)			(dev->reg.offs_rev[(id)])
+ 
++/* MEM WFDMA */
++#define WF_WFDMA_MEM_DMA		0x58000000
++
++#define WF_WFDMA_MEM_DMA_RX_RING_CTL	(WF_WFDMA_MEM_DMA + (0x510))
++
+ /* MCU WFDMA0 */
+ #define MT_MCU_WFDMA0_BASE		0x2000
+ #define MT_MCU_WFDMA0(ofs)		(MT_MCU_WFDMA0_BASE + (ofs))
+@@ -556,6 +562,10 @@ enum offs_rev {
+ #define MT_WFDMA0_PRI_DLY_INT_CFG1	MT_WFDMA0(0x2f4)
+ #define MT_WFDMA0_PRI_DLY_INT_CFG2	MT_WFDMA0(0x2f8)
+ 
++#define MT_WFDMA0_MCU_HOST_INT_ENA	MT_WFDMA0(0x1f4)
++#define MT_WFDMA0_MT_WA_WDT_INT		BIT(31)
++#define MT_WFDMA0_MT_WM_WDT_INT		BIT(30)
++
+ /* WFDMA1 */
+ #define MT_WFDMA1_BASE			0xd5000
+ #define MT_WFDMA1(ofs)			(MT_WFDMA1_BASE + (ofs))
+@@ -701,6 +711,10 @@ enum offs_rev {
+ #define MT_MCU_CMD_NORMAL_STATE		BIT(5)
+ #define MT_MCU_CMD_ERROR_MASK		GENMASK(5, 1)
+ 
++#define MT_MCU_CMD_WA_WDT		BIT(31)
++#define MT_MCU_CMD_WM_WDT		BIT(30)
++#define MT_MCU_CMD_WDT_MASK		GENMASK(31, 30)
++
+ /* TOP RGU */
+ #define MT_TOP_RGU_BASE			0x18000000
+ #define MT_TOP_PWR_CTRL			(MT_TOP_RGU_BASE + (0x0))
+@@ -974,6 +988,8 @@ enum offs_rev {
+ #define MT_CPU_UTIL_PEAK_IDLE_CNT	MT_CPU_UTIL(0x0c)
+ #define MT_CPU_UTIL_CTRL		MT_CPU_UTIL(0x1c)
+ 
++#define MT_EXCEPTION_ADDR		__REG(EXCEPTION_BASE_ADDR)
++
+ /* LED */
+ #define MT_LED_TOP_BASE			0x18013000
+ #define MT_LED_PHYS(_n)			(MT_LED_TOP_BASE + (_n))
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-mt7915-add-debugfs-for-ser-show-and-ser-trigger.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-mt7915-add-debugfs-for-ser-show-and-ser-trigger.patch
deleted file mode 100644
index 2cf5216..0000000
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-mt7915-add-debugfs-for-ser-show-and-ser-trigger.patch
+++ /dev/null
@@ -1,230 +0,0 @@
-From 7af1b6dfec852291fa4d2a21cba350a46a1b7c49 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Wed, 4 May 2022 20:39:07 +0800
-Subject: [PATCH] mt76: mt7915: add debugfs for ser show and ser trigger
-
----
- mt7915/debugfs.c | 103 ++++++++++++++++++++++++++++++++++++++++++++++-
- mt7915/mcu.c     |   5 +--
- mt7915/mmio.c    |   3 ++
- mt7915/regs.h    |  18 ++++++++-
- 4 files changed, 122 insertions(+), 7 deletions(-)
-
-diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index e8e26ac1..61e1c126 100644
---- a/mt7915/debugfs.c
-+++ b/mt7915/debugfs.c
-@@ -47,7 +47,8 @@ mt7915_implicit_txbf_get(void *data, u64 *val)
- DEFINE_DEBUGFS_ATTRIBUTE(fops_implicit_txbf, mt7915_implicit_txbf_get,
- 			 mt7915_implicit_txbf_set, "%lld\n");
- 
--/* test knob of system layer 1/2 error recovery */
-+/* test knob of system layer 0.5/1/2 error recovery */
-+/*
- static int mt7915_ser_trigger_set(void *data, u64 val)
- {
- 	enum {
-@@ -74,9 +75,107 @@ static int mt7915_ser_trigger_set(void *data, u64 val)
- 	return ret;
- }
- 
-+*/
-+static int mt7915_ser_trigger_set(void *data, u64 val)
-+{
-+#define SER_SET		GENMASK(3, 0)
-+#define SER_BAND	GENMASK(7, 4)
-+#define SER_ACTION	GENMASK(11, 8)
-+	enum {
-+		SER_ACTION_SET = 1,
-+		SER_ACTION_SET_MASK = 2,
-+		SER_ACTION_TRIGGER = 3,
-+	};
-+
-+	struct mt7915_dev *dev = data;
-+	u8 ser_action, ser_band, ser_set, set_val;
-+
-+	ser_action = FIELD_GET(SER_ACTION, val);
-+	ser_set = set_val = FIELD_GET(SER_SET, val);
-+	ser_band = (ser_action == SER_ACTION_TRIGGER) ?
-+		   FIELD_GET(SER_BAND, val) : 0;
-+
-+	if (ser_band > 1)
-+		return -1;
-+
-+	switch (ser_action) {
-+	case SER_ACTION_SET:
-+		/*
-+		 * 0x100: disable system error recovery function.
-+		 * 0x101: enable system error recovery function.
-+		 */
-+		ser_set = !!set_val;
-+		break;
-+	case SER_ACTION_SET_MASK:
-+		/*
-+		 * 0x200: enable system error tracking.
-+		 * 0x201: enable system error L1 recover.
-+		 * 0x202: enable system error L2 recover.
-+		 * 0x203: enable system error L3 rx abort.
-+		 * 0x204: enable system error L3 tx abort.
-+		 * 0x205: enable system error L3 tx disable.
-+		 * 0x206: enable system error L3 bf recover.
-+		 * 0x207: enable system error all recover.
-+		 */
-+		ser_set = set_val > 7 ? 0x7f : BIT(set_val);
-+		break;
-+	case SER_ACTION_TRIGGER:
-+		/*
-+		 * 0x301/0x311: trigger L1 recover for band0/band1.
-+		 * 0x302/0x312: trigger L2 recover for band0/band1.
-+		 * 0x303/0x313: trigger L3 rx abort for band0/band1.
-+		 * 0x304/0x314: trigger L3 tx abort for band0/band1.
-+		 * 0x305/0x315: trigger L3 tx disable for band0/band1.
-+		 * 0x306/0x316: trigger L3 bf recover for band0/band1.
-+		 */
-+		if (ser_set > 6)
-+			return -1;
-+		break;
-+	default:
-+		return -1;
-+	}
-+
-+	return mt7915_mcu_set_ser(dev, ser_action, ser_set, ser_band);
-+}
-+
- DEFINE_DEBUGFS_ATTRIBUTE(fops_ser_trigger, NULL,
- 			 mt7915_ser_trigger_set, "%lld\n");
- 
-+static int
-+mt7915_ser_stats_show(struct seq_file *s, void *data)
-+{
-+#define	SER_ACTION_QUERY	0
-+	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-+	int ret = 0;
-+
-+	/* get more info from firmware */
-+	ret = mt7915_mcu_set_ser(dev, SER_ACTION_QUERY, 0, 0);
-+	msleep(100);
-+
-+	seq_printf(s, "::E  R , SER_STATUS        = 0x%08X\n",
-+		   mt76_rr(dev, MT_SWDEF_SER_STATUS));
-+	seq_printf(s, "::E  R , SER_PLE_ERR       = 0x%08X\n",
-+		   mt76_rr(dev, MT_SWDEF_PLE_STATUS));
-+	seq_printf(s, "::E  R , SER_PLE_ERR_1     = 0x%08X\n",
-+		   mt76_rr(dev, MT_SWDEF_PLE1_STATUS));
-+	seq_printf(s, "::E  R , SER_PLE_ERR_AMSDU = 0x%08X\n",
-+		   mt76_rr(dev, MT_SWDEF_PLE_AMSDU_STATUS));
-+	seq_printf(s, "::E  R , SER_PSE_ERR       = 0x%08X\n",
-+		   mt76_rr(dev, MT_SWDEF_PSE_STATUS));
-+	seq_printf(s, "::E  R , SER_PSE_ERR_1     = 0x%08X\n",
-+		   mt76_rr(dev, MT_SWDEF_PSE1_STATUS));
-+	seq_printf(s, "::E  R , SER_LMAC_WISR6_B0 = 0x%08X\n",
-+		   mt76_rr(dev, MT_SWDEF_LAMC_WISR6_BN0_STATUS));
-+	seq_printf(s, "::E  R , SER_LMAC_WISR6_B1 = 0x%08X\n",
-+		   mt76_rr(dev, MT_SWDEF_LAMC_WISR6_BN1_STATUS));
-+	seq_printf(s, "::E  R , SER_LMAC_WISR7_B0 = 0x%08X\n",
-+		   mt76_rr(dev, MT_SWDEF_LAMC_WISR7_BN0_STATUS));
-+	seq_printf(s, "::E  R , SER_LMAC_WISR7_B1 = 0x%08X\n",
-+		   mt76_rr(dev, MT_SWDEF_LAMC_WISR7_BN1_STATUS));
-+
-+	return ret;
-+}
-+
- static int
- mt7915_radar_trigger(void *data, u64 val)
- {
-@@ -943,6 +1042,8 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
- 	debugfs_create_file("xmit-queues", 0400, dir, phy,
- 			    &mt7915_xmit_queues_fops);
- 	debugfs_create_file("tx_stats", 0400, dir, phy, &mt7915_tx_stats_fops);
-+	debugfs_create_devm_seqfile(dev->mt76.dev, "ser_show", dir,
-+				    mt7915_ser_stats_show);
- 	debugfs_create_file("fw_debug_wm", 0600, dir, dev, &fops_fw_debug_wm);
- 	debugfs_create_file("fw_debug_wa", 0600, dir, dev, &fops_fw_debug_wa);
- 	debugfs_create_file("fw_debug_bin", 0600, dir, dev, &fops_fw_debug_bin);
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 681ede23..10450bd7 100755
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -2487,10 +2487,7 @@ int mt7915_mcu_init(struct mt7915_dev *dev)
- 	/* force firmware operation mode into normal state,
- 	 * which should be set before firmware download stage.
- 	 */
--	if (is_mt7915(&dev->mt76))
--		mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
--	else
--		mt76_wr(dev, MT_SWDEF_MODE_MT7916, MT_SWDEF_NORMAL_MODE);
-+	mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
- 
- 	ret = mt7915_driver_own(dev, 0);
- 	if (ret)
-diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 0bd32daa..2d733d32 100644
---- a/mt7915/mmio.c
-+++ b/mt7915/mmio.c
-@@ -22,6 +22,7 @@ static const u32 mt7915_reg[] = {
- 	[WFDMA_EXT_CSR_ADDR]	= 0xd7000,
- 	[CBTOP1_PHY_END]	= 0x77ffffff,
- 	[INFRA_MCU_ADDR_END]	= 0x7c3fffff,
-+	[SWDEF_BASE_ADDR]	= 0x41f200,
- };
- 
- static const u32 mt7916_reg[] = {
-@@ -36,6 +37,7 @@ static const u32 mt7916_reg[] = {
- 	[WFDMA_EXT_CSR_ADDR]	= 0xd7000,
- 	[CBTOP1_PHY_END]	= 0x7fffffff,
- 	[INFRA_MCU_ADDR_END]	= 0x7c085fff,
-+	[SWDEF_BASE_ADDR]	= 0x411400,
- };
- 
- static const u32 mt7986_reg[] = {
-@@ -50,6 +52,7 @@ static const u32 mt7986_reg[] = {
- 	[WFDMA_EXT_CSR_ADDR]	= 0x27000,
- 	[CBTOP1_PHY_END]	= 0x7fffffff,
- 	[INFRA_MCU_ADDR_END]	= 0x7c085fff,
-+	[SWDEF_BASE_ADDR]	= 0x411400,
- };
- 
- static const u32 mt7915_offs[] = {
-diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 97984aaf..ee212c99 100644
---- a/mt7915/regs.h
-+++ b/mt7915/regs.h
-@@ -30,6 +30,7 @@ enum reg_rev {
- 	WFDMA_EXT_CSR_ADDR,
- 	CBTOP1_PHY_END,
- 	INFRA_MCU_ADDR_END,
-+	SWDEF_BASE_ADDR,
- 	__MT_REG_MAX,
- };
- 
-@@ -942,12 +943,25 @@ enum offs_rev {
- #define MT_ADIE_TYPE_MASK		BIT(1)
- 
- /* FW MODE SYNC */
--#define MT_SWDEF_MODE			0x41f23c
--#define MT_SWDEF_MODE_MT7916		0x41143c
-+#define MT_SWDEF_BASE			__REG(SWDEF_BASE_ADDR)
-+
-+#define MT_SWDEF(ofs)			(MT_SWDEF_BASE + (ofs))
-+#define MT_SWDEF_MODE			MT_SWDEF(0x3c)
- #define MT_SWDEF_NORMAL_MODE		0
- #define MT_SWDEF_ICAP_MODE		1
- #define MT_SWDEF_SPECTRUM_MODE		2
- 
-+#define MT_SWDEF_SER_STATUS		MT_SWDEF(0x040)
-+#define MT_SWDEF_PLE_STATUS		MT_SWDEF(0x044)
-+#define MT_SWDEF_PLE1_STATUS		MT_SWDEF(0x048)
-+#define MT_SWDEF_PLE_AMSDU_STATUS	MT_SWDEF(0x04C)
-+#define MT_SWDEF_PSE_STATUS		MT_SWDEF(0x050)
-+#define MT_SWDEF_PSE1_STATUS		MT_SWDEF(0x054)
-+#define MT_SWDEF_LAMC_WISR6_BN0_STATUS	MT_SWDEF(0x058)
-+#define MT_SWDEF_LAMC_WISR6_BN1_STATUS	MT_SWDEF(0x05C)
-+#define MT_SWDEF_LAMC_WISR7_BN0_STATUS	MT_SWDEF(0x060)
-+#define MT_SWDEF_LAMC_WISR7_BN1_STATUS	MT_SWDEF(0x064)
-+
- #define MT_DIC_CMD_REG_BASE		0x41f000
- #define MT_DIC_CMD_REG(ofs)		(MT_DIC_CMD_REG_BASE + (ofs))
- #define MT_DIC_CMD_REG_CMD		MT_DIC_CMD_REG(0x10)
--- 
-2.18.0
-
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-drop-packetes-when-TWT-stations-use-more.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-drop-packetes-when-TWT-stations-use-more.patch
old mode 100644
new mode 100755
index 1785a61..9de9b75
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-drop-packetes-when-TWT-stations-use-more.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-drop-packetes-when-TWT-stations-use-more.patch
@@ -1,8 +1,8 @@
-From bbfc52d9e15334a0e72884754be04b8df335de39 Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Fri, 6 May 2022 15:53:07 +0800
-Subject: [PATCH 1114/1116] mt76: mt7915: drop packetes when TWT stations use
- more token then 128
+From fa3b5a740661e91e59b68ffab139cc1e32a0cd6e Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Mon, 9 May 2022 13:37:09 +0800
+Subject: [PATCH 08/10] mt76: mt7915: drop packetes when TWT stations use more
+ token then 128
 
 ---
  mt7915/mac.c    | 21 ++++++++++++++++++---
@@ -10,10 +10,10 @@
  2 files changed, 20 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index b899697c..1935acff 100644
+index db35eb14..2ee49b82 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1303,6 +1303,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1306,6 +1306,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
  	struct ieee80211_key_conf *key = info->control.hw_key;
  	struct ieee80211_vif *vif = info->control.vif;
@@ -21,7 +21,7 @@
  	struct mt76_txwi_cache *t;
  	struct mt7915_txp *txp;
  	int id, i, nbuf = tx_info->nbuf - 1;
-@@ -1316,8 +1317,6 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1319,8 +1320,6 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  		wcid = &dev->mt76.global_wcid;
  
  	if (sta) {
@@ -30,9 +30,9 @@
  		msta = (struct mt7915_sta *)sta->drv_priv;
  
  		if (time_after(jiffies, msta->jiffies + HZ / 4)) {
-@@ -1329,10 +1328,22 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- 	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
- 	t->skb = tx_info->skb;
+@@ -1336,10 +1335,22 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	    mgmt->u.action.category == 0xff)
+ 		return -1;
  
 +	spin_lock_bh(&mdev->token_lock);
 +	if (msta && msta->twt.flowid_mask && msta->token_count > 128) {
@@ -53,7 +53,7 @@
  	pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb);
  	mt7915_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, pid, key,
  			      false);
-@@ -1524,6 +1535,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1531,6 +1542,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  	struct mt76_dev *mdev = &dev->mt76;
  	struct mt76_txwi_cache *txwi;
  	struct ieee80211_sta *sta = NULL;
@@ -61,7 +61,7 @@
  	LIST_HEAD(free_list);
  	void *end = data + len;
  	bool v3, wake = false;
-@@ -1547,7 +1559,6 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1554,7 +1566,6 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  		 * 1'b0: msdu_id with the same 'wcid pair' as above.
  		 */
  		if (info & MT_TX_FREE_PAIR) {
@@ -69,7 +69,7 @@
  			struct mt76_wcid *wcid;
  			u16 idx;
  
-@@ -1583,6 +1594,10 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1590,6 +1601,10 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  			txwi = mt76_token_release(mdev, msdu, &wake);
  			if (!txwi)
  				continue;
@@ -81,7 +81,7 @@
  			mt7915_txwi_free(dev, txwi, sta, &free_list);
  		}
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 24276da5..0feccb17 100644
+index bc7f746f..56f6ba6c 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -136,6 +136,8 @@ struct mt7915_sta {