[][MAC80211][WiFi7][Misc][Fix release build fail because of mt76 version upgradation]

[Description]
Fix build fail because of mt76 version upgradation (2024-09-29)
WiFi7 version: 4.3.24.9

[Release-log]
N/A

Change-Id: I0b76dd048741064d0177c579a873644ae4214053
Reviewed-on: https://gerrit.mediatek.inc/c/openwrt/feeds/mtk_openwrt_feeds/+/9707333
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch
index ecb66b9..288c032 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch
@@ -1,7 +1,7 @@
-From a0ded7d35f8c449efc7180e7e589f850d371061c Mon Sep 17 00:00:00 2001
+From 943c075154f8b6569f9c0fc2ecc39742ba652bce Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 19 Sep 2023 11:21:23 +0800
-Subject: [PATCH 001/195] mtk: Revert "wifi: mt76: mt7996: fill txd by host
+Subject: [PATCH 001/223] mtk: Revert "wifi: mt76: mt7996: fill txd by host
  driver"
 
 This reverts commit 325a0c4931990d553487024c4f76c776492bdcc2.
@@ -10,10 +10,10 @@
  1 file changed, 9 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 0d21414e..109a74a9 100644
+index 4706ddef..29297c07 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -947,8 +947,11 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -958,8 +958,11 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  		return id;
  
  	pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb);
@@ -27,7 +27,7 @@
  
  	txp = (struct mt76_connac_txp_common *)(txwi + MT_TXD_SIZE);
  	for (i = 0; i < nbuf; i++) {
-@@ -965,8 +968,10 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -976,8 +979,10 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	}
  	txp->fw.nbuf = nbuf;
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0002-mtk-mt76-mt7996-fix-amsdu-information.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0002-mtk-mt76-mt7996-fix-amsdu-information.patch
index d37a465..238dab3 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0002-mtk-mt76-mt7996-fix-amsdu-information.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0002-mtk-mt76-mt7996-fix-amsdu-information.patch
@@ -1,13 +1,14 @@
-From 00fba946a929e4125cec0ccd4252478b3bdb28f2 Mon Sep 17 00:00:00 2001
+From afaacba412a34baf39e58b27003d4d09516a15c2 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 17 May 2024 15:28:06 +0800
-Subject: [PATCH 002/195] mtk: mt76: mt7996: fix amsdu information
+Subject: [PATCH 002/223] mtk: mt76: mt7996: fix amsdu information
 
 The amsdu information is common information for all bands so maintain
 it by main phy instead of calculating by each phy.
 Without this patch, the statistics of tx_amsdu_cnt and tx_amsdu would
 be incorrect.
 
+Change-Id: Iac324d9dd63ceb3a55b51c0210e3e547e20a71cb
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt76.h           |  3 ++-
@@ -16,10 +17,10 @@
  3 files changed, 11 insertions(+), 20 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 56cc2f95..2729b3f1 100644
+index 19c4f11c..063c45d2 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -929,6 +929,7 @@ struct mt76_dev {
+@@ -931,6 +931,7 @@ struct mt76_dev {
  	};
  };
  
@@ -27,7 +28,7 @@
  /* per-phy stats.  */
  struct mt76_mib_stats {
  	u32 ack_fail_cnt;
-@@ -988,7 +989,7 @@ struct mt76_mib_stats {
+@@ -990,7 +991,7 @@ struct mt76_mib_stats {
  	u32 rx_vec_queue_overflow_drop_cnt;
  	u32 rx_ba_cnt;
  
@@ -68,10 +69,10 @@
  
  	return 0;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 109a74a9..503e92c0 100644
+index 29297c07..cfcfc3ea 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2103,10 +2103,19 @@ void mt7996_mac_update_stats(struct mt7996_phy *phy)
+@@ -2114,10 +2114,19 @@ void mt7996_mac_update_stats(struct mt7996_phy *phy)
  {
  	struct mt76_mib_stats *mib = &phy->mib;
  	struct mt7996_dev *dev = phy->dev;
@@ -91,7 +92,7 @@
  	cnt = mt76_rr(dev, MT_MIB_RSCR1(band_idx));
  	mib->fcs_err_cnt += cnt;
  
-@@ -2212,12 +2221,6 @@ void mt7996_mac_update_stats(struct mt7996_phy *phy)
+@@ -2223,12 +2232,6 @@ void mt7996_mac_update_stats(struct mt7996_phy *phy)
  	cnt = mt76_rr(dev, MT_MIB_BSCR17(band_idx));
  	mib->tx_bf_fb_cpl_cnt += cnt;
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0003-mtk-mt76-mt7996-add-preamble-puncture-support-for-mt.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0003-mtk-mt76-mt7996-add-preamble-puncture-support-for-mt.patch
index aaca1a2..d87a708 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0003-mtk-mt76-mt7996-add-preamble-puncture-support-for-mt.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0003-mtk-mt76-mt7996-add-preamble-puncture-support-for-mt.patch
@@ -1,7 +1,7 @@
-From 8fb4b4af46e93996c998b17393d3ef6eeac0085e Mon Sep 17 00:00:00 2001
+From d03a551a2fc9723b1b26c254bdc64694f271068f Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Thu, 18 Apr 2024 11:16:24 +0800
-Subject: [PATCH 003/195] mtk: mt76: mt7996: add preamble puncture support for
+Subject: [PATCH 003/223] mtk: mt76: mt7996: add preamble puncture support for
  mt7996
 
 Add support configure preamble puncture feature through mcu commands.
@@ -19,10 +19,10 @@
  6 files changed, 61 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 66d70d6e..942a00de 100644
+index 1b0e80df..200eace5 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1283,6 +1283,7 @@ enum {
+@@ -1288,6 +1288,7 @@ enum {
  	MCU_UNI_CMD_CHANNEL_SWITCH = 0x34,
  	MCU_UNI_CMD_THERMAL = 0x35,
  	MCU_UNI_CMD_VOW = 0x37,
@@ -31,7 +31,7 @@
  	MCU_UNI_CMD_RRO = 0x57,
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 5e969732..a47b578c 100644
+index f6a010b6..f3744be6 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -389,6 +389,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -40,13 +40,13 @@
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER);
 +	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_PUNCT);
  
- 	if (!mdev->dev->of_node ||
- 	    !of_property_read_bool(mdev->dev->of_node,
+ 	if (mt7996_has_background_radar(phy->dev) &&
+ 	    (!mdev->dev->of_node ||
 diff --git a/mt7996/main.c b/mt7996/main.c
-index c1047316..a8a809a0 100644
+index 343e6c4b..334cc8c5 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -402,6 +402,11 @@ static int mt7996_config(struct ieee80211_hw *hw, u32 changed)
+@@ -394,6 +394,11 @@ static int mt7996_config(struct ieee80211_hw *hw, u32 changed)
  	int ret;
  
  	if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
@@ -59,10 +59,10 @@
  		if (ret)
  			return ret;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 0a1e23e8..92a50f21 100644
+index 5ac35af1..40915d1d 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4555,3 +4555,43 @@ int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode)
+@@ -4573,3 +4573,43 @@ int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode)
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_EXT_CMD(CP_SUPPORT),
  				 &cp_mode, sizeof(cp_mode), true);
  }
@@ -128,10 +128,10 @@
  #define MT7996_PATCH_SCRAMBLE_KEY	GENMASK(15, 8)
  #define MT7996_PATCH_AES_KEY		GENMASK(7, 0)
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index ab8c9070..3d5ed55e 100644
+index ad10329d..17dfbdc8 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -237,6 +237,9 @@ struct mt7996_phy {
+@@ -270,6 +270,9 @@ struct mt7996_phy {
  	struct mt76_channel_state state_ts;
  
  	bool has_aux_rx;
@@ -141,7 +141,7 @@
  };
  
  struct mt7996_dev {
-@@ -614,6 +617,7 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
+@@ -665,6 +668,7 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
  				     struct ieee80211_vif *vif,
  				     struct ieee80211_sta *sta);
  int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0004-mtk-mt76-mt7996-add-driver-support-for-wpa3-ocv-and-.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0004-mtk-mt76-mt7996-add-driver-support-for-wpa3-ocv-and-.patch
index 3b36368..75bae50 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0004-mtk-mt76-mt7996-add-driver-support-for-wpa3-ocv-and-.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0004-mtk-mt76-mt7996-add-driver-support-for-wpa3-ocv-and-.patch
@@ -1,7 +1,7 @@
-From 4ab036c9770cb3079c769230557025f7f99b3f50 Mon Sep 17 00:00:00 2001
+From 7952f4e661b7aff18120e0ad39a28e0a73e7ea31 Mon Sep 17 00:00:00 2001
 From: mtk23510 <rudra.shahi@mediatek.com>
 Date: Fri, 24 Mar 2023 19:18:53 +0800
-Subject: [PATCH 004/195] mtk: mt76: mt7996: add driver support for wpa3 ocv
+Subject: [PATCH 004/223] mtk: mt76: mt7996: add driver support for wpa3 ocv
  and bp mt76
 
 Signed-off-by: mtk23510 <rudra.shahi@mediatek.com>
@@ -10,7 +10,7 @@
  1 file changed, 2 insertions(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index a47b578c..2d7f42f7 100644
+index f3744be6..9bf38083 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -391,6 +391,8 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -19,9 +19,9 @@
  
 +	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION);
 +	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_PROTECTION);
- 	if (!mdev->dev->of_node ||
- 	    !of_property_read_bool(mdev->dev->of_node,
- 				   "mediatek,disable-radar-background"))
+ 	if (mt7996_has_background_radar(phy->dev) &&
+ 	    (!mdev->dev->of_node ||
+ 	     !of_property_read_bool(mdev->dev->of_node,
 -- 
 2.45.2
 
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0005-mtk-mt76-mt7996-enable-ser-query.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0005-mtk-mt76-mt7996-enable-ser-query.patch
index 043bbf3..39445e5 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0005-mtk-mt76-mt7996-enable-ser-query.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0005-mtk-mt76-mt7996-enable-ser-query.patch
@@ -1,7 +1,7 @@
-From 44cb6ea64577193e17bfe19b998ee64d54ebf03c Mon Sep 17 00:00:00 2001
+From c82a6b8993fa1785998459d79e9ba213e41fc4f7 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 30 Oct 2023 20:19:41 +0800
-Subject: [PATCH 005/195] mtk: mt76: mt7996: enable ser query
+Subject: [PATCH 005/223] mtk: mt76: mt7996: enable ser query
 
 Do not return -EINVAL when action is UNI_CMD_SER_QUERY for user
 to dump SER information from FW.
@@ -12,10 +12,10 @@
  1 file changed, 2 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 92a50f21..e12de227 100644
+index 40915d1d..a384d44a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3870,6 +3870,8 @@ int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 val, u8 band)
+@@ -3888,6 +3888,8 @@ int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 val, u8 band)
  	};
  
  	switch (action) {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0006-mtk-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0006-mtk-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
index d75ad0e..5e522ef 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0006-mtk-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0006-mtk-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
@@ -1,21 +1,22 @@
-From 79692077ae57b32e6ef56bab5ce7c43c6412b8f7 Mon Sep 17 00:00:00 2001
+From 9fbf0e20ece646083ad41f9a59aef3e1f295d00d Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Fri, 17 Nov 2023 11:01:04 +0800
-Subject: [PATCH 006/195] mtk: mt76: mt7996: Fix TGax HE-4.51.1_24G fail
+Subject: [PATCH 006/223] mtk: mt76: mt7996: Fix TGax HE-4.51.1_24G fail
 
 According to sta capability to decide to enable/disable wed pao when create ppe entry.
 without this patch, TGax HE-4.51.1_24G will test fail
 
+Change-Id: Ic51473fcc24757887f0f9f81a31b6f01dee2c845
 Signed-off-by: mtk27745 <rex.lu@mediatek.com>
 ---
  mt7996/main.c | 7 ++++++-
  1 file changed, 6 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index a8a809a0..91f0002a 100644
+index 334cc8c5..f8c07b34 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -1452,7 +1452,12 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1444,7 +1444,12 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->mtk_wdma.queue = 0;
  	path->mtk_wdma.wcid = msta->wcid.idx;
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0007-mtk-mt76-mt7996-add-support-for-different-variants.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0007-mtk-mt76-mt7996-add-support-for-different-variants.patch
index 338e4a1..b38735e 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0007-mtk-mt76-mt7996-add-support-for-different-variants.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0007-mtk-mt76-mt7996-add-support-for-different-variants.patch
@@ -1,7 +1,7 @@
-From c4406e45360f1c239b4178eabd9b5f55c0a7de85 Mon Sep 17 00:00:00 2001
+From f63be84654b80990d87723a8e6292b92952633aa Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 20 Jul 2023 17:27:22 +0800
-Subject: [PATCH 007/195] mtk: mt76: mt7996: add support for different variants
+Subject: [PATCH 007/223] mtk: mt76: mt7996: add support for different variants
 
 Add fem type (2i5i, 2i5e, 2e5e, ...)
 Add Kite default bin for each fem type since loading wrong default bin
@@ -24,18 +24,18 @@
 ifem: XX_DEFAULT_INT
 mixed fem: XX_DEFAULT_MIX
 
+Change-Id: I98caec6675670e3d1c0ee953bef2aeb71c3cf74e
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
- mt7996/eeprom.c | 40 +++++++++++++++++++++++++++++--
+ mt7996/eeprom.c | 29 ++++++++++++++++++++++++++++-
  mt7996/eeprom.h |  1 +
- mt7996/init.c   | 63 +++++++++++++++++++++++++++++++++++++++++++++++++
- mt7996/mcu.c    |  7 +++++-
- mt7996/mt7996.h | 43 ++++++++++++++++++++++++++++++---
- mt7996/regs.h   |  7 ++++++
- 6 files changed, 155 insertions(+), 6 deletions(-)
+ mt7996/init.c   |  2 +-
+ mt7996/mcu.c    |  3 +++
+ mt7996/mt7996.h | 16 ++++++++++++++++
+ 5 files changed, 49 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 4a823711..f38629e3 100644
+index da94751d..77dd6b20 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -9,14 +9,33 @@
@@ -73,31 +73,25 @@
  	default:
  		return -EINVAL;
  	}
-@@ -26,9 +45,22 @@ static char *mt7996_eeprom_name(struct mt7996_dev *dev)
- {
- 	switch (mt76_chip(&dev->mt76)) {
- 	case 0x7990:
-+		if (dev->chip_sku == MT7996_SKU_404)
+@@ -31,6 +50,8 @@ static char *mt7996_eeprom_name(struct mt7996_dev *dev)
+ 			if (dev->var.fem == MT7996_FEM_INT)
+ 				return MT7992_EEPROM_DEFAULT_23_INT;
+ 			return MT7992_EEPROM_DEFAULT_23;
++		case MT7992_VAR_TYPE_24:
++			return MT7992_EEPROM_DEFAULT_24;
+ 		case MT7992_VAR_TYPE_44:
+ 		default:
+ 			if (dev->var.fem == MT7996_FEM_INT)
+@@ -46,6 +67,8 @@ static char *mt7996_eeprom_name(struct mt7996_dev *dev)
+ 			if (dev->var.fem == MT7996_FEM_INT)
+ 				return MT7996_EEPROM_DEFAULT_233_INT;
+ 			return MT7996_EEPROM_DEFAULT_233;
++		case MT7996_VAR_TYPE_404:
 +			return MT7996_EEPROM_DEFAULT_404;
- 		return MT7996_EEPROM_DEFAULT;
- 	case 0x7992:
--		return MT7992_EEPROM_DEFAULT;
-+		if (dev->chip_sku == MT7992_SKU_23) {
-+			if (dev->fem_type == MT7996_FEM_INT)
-+				return MT7992_EEPROM_DEFAULT_23_INT;
-+			return MT7992_EEPROM_DEFAULT_23;
-+		} else if (dev->chip_sku == MT7992_SKU_44) {
-+			if (dev->fem_type == MT7996_FEM_INT)
-+				return MT7992_EEPROM_DEFAULT_INT;
-+			else if (dev->fem_type == MT7996_FEM_MIX)
-+				return MT7992_EEPROM_DEFAULT_MIX;
-+			return MT7992_EEPROM_DEFAULT;
-+		}
-+		return MT7992_EEPROM_DEFAULT_24;
- 	default:
- 		return MT7996_EEPROM_DEFAULT;
- 	}
-@@ -219,6 +251,10 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
+ 		case MT7996_VAR_TYPE_444:
+ 		default:
+ 			if (dev->var.fem == MT7996_FEM_INT)
+@@ -317,6 +340,10 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
  {
  	int ret;
  
@@ -106,10 +100,10 @@
 +		return ret;
 +
  	ret = mt7996_eeprom_load(dev);
- 	if (ret < 0) {
- 		if (ret != -EINVAL)
+ 	if (ret < 0)
+ 		return ret;
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 412d6e2f..72c38ad3 100644
+index 7a771ca2..8074a0ae 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -29,6 +29,7 @@ enum mt7996_eeprom_field {
@@ -121,160 +115,75 @@
  #define MT_EE_WIFI_CONF1_TX_PATH_BAND0		GENMASK(5, 3)
  #define MT_EE_WIFI_CONF2_TX_PATH_BAND1		GENMASK(2, 0)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 2d7f42f7..f80fba28 100644
+index 9bf38083..3a6f4f28 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -887,6 +887,65 @@ out:
- #endif
- }
- 
-+int mt7996_get_chip_sku(struct mt7996_dev *dev)
-+{
-+#define MT7976C_CHIP_VER	0x8a10
-+#define MT7976C_HL_CHIP_VER	0x8b00
-+#define MT7976C_PS_CHIP_VER	0x8c10
-+#define MT7976C_EFUSE_OFFSET	0x470
-+#define MT7976C_EFUSE_VALUE	0xc
-+	u32 regval, val = mt76_rr(dev, MT_PAD_GPIO);
-+	u16 adie_chip_id, adie_chip_ver;
-+	u8 adie_comb, adie_num, adie_idx = 0;
-+
-+	switch (mt76_chip(&dev->mt76)) {
-+	case 0x7990:
-+		adie_comb = FIELD_GET(MT_PAD_GPIO_ADIE_COMB, val);
-+		if (adie_comb <= 1)
-+			dev->chip_sku = MT7996_SKU_444;
-+		else
-+			dev->chip_sku = MT7996_SKU_404;
-+		break;
-+	case 0x7992:
-+		adie_comb = FIELD_GET(MT_PAD_GPIO_ADIE_COMB_7992, val);
-+		adie_num = FIELD_GET(MT_PAD_GPIO_ADIE_NUM_7992, val);
-+		adie_idx = !adie_num;
-+		if (adie_num)
-+			dev->chip_sku = MT7992_SKU_23;
-+		else if (adie_comb)
-+			dev->chip_sku = MT7992_SKU_44;
-+		else
-+			dev->chip_sku = MT7992_SKU_24;
-+		break;
-+	default:
-+		return -EINVAL;
-+	}
-+
-+	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state)) {
-+		u8 buf[MT7996_EEPROM_BLOCK_SIZE];
-+		u8 idx = MT7976C_EFUSE_OFFSET % MT7996_EEPROM_BLOCK_SIZE;
-+		bool is_7976c;
-+
-+		mt7996_mcu_rf_regval(dev, MT_ADIE_CHIP_ID(adie_idx), &regval, false);
-+		adie_chip_id = FIELD_GET(MT_ADIE_CHIP_ID_MASK, regval);
-+		adie_chip_ver = FIELD_GET(MT_ADIE_VERSION_MASK, regval);
-+		mt7996_mcu_get_eeprom(dev, MT7976C_EFUSE_OFFSET, buf);
-+		is_7976c = (adie_chip_ver == MT7976C_CHIP_VER) ||
-+			   (adie_chip_ver == MT7976C_HL_CHIP_VER) ||
-+			   (adie_chip_ver == MT7976C_PS_CHIP_VER) ||
-+			   (buf[idx] == MT7976C_EFUSE_VALUE);
-+		if (adie_chip_id == 0x7975 || (adie_chip_id == 0x7976 && is_7976c) ||
-+		    adie_chip_id == 0x7979)
-+			dev->fem_type = MT7996_FEM_INT;
-+		else if (adie_chip_id == 0x7977 && adie_comb == 1)
-+			dev->fem_type = MT7996_FEM_MIX;
-+		else
-+			dev->fem_type = MT7996_FEM_EXT;
-+	}
-+
-+	return 0;
-+}
-+
- static int mt7996_init_hardware(struct mt7996_dev *dev)
- {
- 	int ret, idx;
-@@ -902,6 +961,10 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
- 	INIT_LIST_HEAD(&dev->wed_rro.poll_list);
- 	spin_lock_init(&dev->wed_rro.lock);
- 
-+	ret = mt7996_get_chip_sku(dev);
-+	if (ret)
-+		return ret;
-+
- 	ret = mt7996_dma_init(dev);
- 	if (ret)
- 		return ret;
+@@ -906,7 +906,7 @@ static int mt7996_variant_type_init(struct mt7996_dev *dev)
+ 		else if (u32_get_bits(val, MT_PAD_GPIO_ADIE_COMB_7992))
+ 			var_type = MT7992_VAR_TYPE_44;
+ 		else
+-			return -EINVAL;
++			var_type = MT7992_VAR_TYPE_24;
+ 		break;
+ 	default:
+ 		return -EINVAL;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index e12de227..40d319bc 100644
+index a384d44a..dd428570 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -14,7 +14,12 @@
- 	char *_fw;						\
- 	switch (mt76_chip(&(_dev)->mt76)) {			\
- 	case 0x7992:						\
--		_fw = MT7992_##name;				\
-+		if ((_dev)->chip_sku == MT7992_SKU_23)		\
-+			_fw = MT7992_##name##_23;		\
-+		else if ((_dev)->chip_sku == MT7992_SKU_24)	\
+@@ -18,6 +18,9 @@
+ 		case MT7992_VAR_TYPE_23:			\
+ 			_fw = MT7992_##name##_23;		\
+ 			break;					\
++		case MT7992_VAR_TYPE_24:			\
 +			_fw = MT7992_##name##_24;		\
-+		else						\
-+			_fw = MT7992_##name;			\
- 		break;						\
- 	case 0x7990:						\
- 	default:						\
++			break;					\
+ 		default:					\
+ 			_fw = MT7992_##name;			\
+ 		}						\
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 3d5ed55e..3ee83e51 100644
+index 17dfbdc8..1dd618c2 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -39,8 +39,24 @@
- #define MT7992_FIRMWARE_DSP		"mediatek/mt7996/mt7992_dsp.bin"
- #define MT7992_ROM_PATCH		"mediatek/mt7996/mt7992_rom_patch.bin"
+@@ -49,16 +49,23 @@
+ #define MT7992_FIRMWARE_DSP_23		"mediatek/mt7996/mt7992_dsp_23.bin"
+ #define MT7992_ROM_PATCH_23		"mediatek/mt7996/mt7992_rom_patch_23.bin"
  
 +#define MT7992_FIRMWARE_WA_24		"mediatek/mt7996/mt7992_wa_24.bin"
 +#define MT7992_FIRMWARE_WM_24		"mediatek/mt7996/mt7992_wm_24.bin"
 +#define MT7992_FIRMWARE_DSP_24		"mediatek/mt7996/mt7992_dsp_24.bin"
 +#define MT7992_ROM_PATCH_24		"mediatek/mt7996/mt7992_rom_patch_24.bin"
 +
-+#define MT7992_FIRMWARE_WA_23		"mediatek/mt7996/mt7992_wa_23.bin"
-+#define MT7992_FIRMWARE_WM_23		"mediatek/mt7996/mt7992_wm_23.bin"
-+#define MT7992_FIRMWARE_DSP_23		"mediatek/mt7996/mt7992_dsp_23.bin"
-+#define MT7992_ROM_PATCH_23		"mediatek/mt7996/mt7992_rom_patch_23.bin"
-+
  #define MT7996_EEPROM_DEFAULT		"mediatek/mt7996/mt7996_eeprom.bin"
--#define MT7992_EEPROM_DEFAULT		"mediatek/mt7996/mt7992_eeprom.bin"
+ #define MT7996_EEPROM_DEFAULT_INT	"mediatek/mt7996/mt7996_eeprom_2i5i6i.bin"
+ #define MT7996_EEPROM_DEFAULT_233	"mediatek/mt7996/mt7996_eeprom_233.bin"
+ #define MT7996_EEPROM_DEFAULT_233_INT	"mediatek/mt7996/mt7996_eeprom_233_2i5i6i.bin"
 +#define MT7996_EEPROM_DEFAULT_404	"mediatek/mt7996/mt7996_eeprom_dual_404.bin"
-+#define MT7992_EEPROM_DEFAULT		"mediatek/mt7996/mt7992_eeprom.bin"
-+#define MT7992_EEPROM_DEFAULT_INT	"mediatek/mt7996/mt7992_eeprom_2i5i.bin"
-+#define MT7992_EEPROM_DEFAULT_MIX	"mediatek/mt7996/mt7992_eeprom_2i5e.bin"
+ 
+ #define MT7992_EEPROM_DEFAULT		"mediatek/mt7996/mt7992_eeprom.bin"
+ #define MT7992_EEPROM_DEFAULT_INT	"mediatek/mt7996/mt7992_eeprom_2i5i.bin"
+ #define MT7992_EEPROM_DEFAULT_MIX	"mediatek/mt7996/mt7992_eeprom_2i5e.bin"
+ #define MT7992_EEPROM_DEFAULT_23	"mediatek/mt7996/mt7992_eeprom_23.bin"
+ #define MT7992_EEPROM_DEFAULT_23_INT	"mediatek/mt7996/mt7992_eeprom_23_2i5i.bin"
 +#define MT7992_EEPROM_DEFAULT_24	"mediatek/mt7996/mt7992_eeprom_24_2i5i.bin"
-+#define MT7992_EEPROM_DEFAULT_23	"mediatek/mt7996/mt7992_eeprom_23.bin"
-+#define MT7992_EEPROM_DEFAULT_23_INT	"mediatek/mt7996/mt7992_eeprom_23_2i5i.bin"
+ 
  #define MT7996_EEPROM_SIZE		7680
  #define MT7996_EEPROM_BLOCK_SIZE	16
- #define MT7996_TOKEN_SIZE		16384
-@@ -89,6 +105,24 @@ struct mt7996_sta;
- struct mt7996_dfs_pulse;
- struct mt7996_dfs_pattern;
+@@ -117,11 +124,13 @@ enum mt7996_ram_type {
+ enum mt7996_var_type {
+ 	MT7996_VAR_TYPE_444,
+ 	MT7996_VAR_TYPE_233,
++	MT7996_VAR_TYPE_404,
+ };
  
-+enum mt7996_fem_type {
-+	MT7996_FEM_UNSET,
-+	MT7996_FEM_EXT,
-+	MT7996_FEM_INT,
-+	MT7996_FEM_MIX,
-+};
-+
-+enum mt7996_sku_type {
-+	MT7996_SKU_404,
-+	MT7996_SKU_444,
-+};
-+
-+enum mt7992_sku_type {
-+	MT7992_SKU_23,
-+	MT7992_SKU_24,
-+	MT7992_SKU_44,
-+};
-+
- enum mt7996_ram_type {
- 	MT7996_RAM_TYPE_WM,
- 	MT7996_RAM_TYPE_WA,
-@@ -261,6 +295,9 @@ struct mt7996_dev {
+ enum mt7992_var_type {
+ 	MT7992_VAR_TYPE_44,
+ 	MT7992_VAR_TYPE_23,
++	MT7992_VAR_TYPE_24,
+ };
+ 
+ enum mt7996_fem_type {
+@@ -294,6 +303,9 @@ struct mt7996_dev {
  	struct cfg80211_chan_def rdd2_chandef;
  	struct mt7996_phy *rdd2_phy;
  
@@ -284,17 +193,17 @@
  	u16 chainmask;
  	u8 chainshift[__MT_MAX_BAND];
  	u32 hif_idx;
-@@ -409,8 +446,7 @@ mt7996_band_valid(struct mt7996_dev *dev, u8 band)
+@@ -445,6 +457,9 @@ mt7996_band_valid(struct mt7996_dev *dev, u8 band)
+ 	if (is_mt7992(&dev->mt76))
  		return band <= MT_BAND1;
  
- 	/* tri-band support */
--	if (band <= MT_BAND2 &&
--	    mt76_get_field(dev, MT_PAD_GPIO, MT_PAD_GPIO_ADIE_COMB) <= 1)
-+	if (band <= MT_BAND2 && dev->chip_sku)
- 		return true;
++	if (dev->var.type == MT7996_VAR_TYPE_404 && band == MT_BAND1)
++		return false;
++
+ 	return band <= MT_BAND2;
+ }
  
- 	return band == MT_BAND0 || band == MT_BAND2;
-@@ -441,6 +477,7 @@ int mt7996_init_tx_queues(struct mt7996_phy *phy, int idx,
+@@ -492,6 +507,7 @@ int mt7996_init_tx_queues(struct mt7996_phy *phy, int idx,
  			  int n_desc, int ring_base, struct mtk_wed_device *wed);
  void mt7996_init_txpower(struct mt7996_phy *phy);
  int mt7996_txbf_init(struct mt7996_dev *dev);
@@ -302,24 +211,6 @@
  void mt7996_reset(struct mt7996_dev *dev);
  int mt7996_run(struct ieee80211_hw *hw);
  int mt7996_mcu_init(struct mt7996_dev *dev);
-diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 47b429d8..cf12c5e0 100644
---- a/mt7996/regs.h
-+++ b/mt7996/regs.h
-@@ -662,6 +662,13 @@ enum offs_rev {
- 
- #define MT_PAD_GPIO				0x700056f0
- #define MT_PAD_GPIO_ADIE_COMB			GENMASK(16, 15)
-+#define MT_PAD_GPIO_ADIE_COMB_7992		GENMASK(17, 16)
-+#define MT_PAD_GPIO_ADIE_NUM_7992		BIT(15)
-+
-+/* ADIE */
-+#define MT_ADIE_CHIP_ID(_idx)                  (0x0f00002c + ((_idx) << 28))
-+#define MT_ADIE_VERSION_MASK                   GENMASK(15, 0)
-+#define MT_ADIE_CHIP_ID_MASK                   GENMASK(31, 16)
- 
- #define MT_HW_REV				0x70010204
- #define MT_HW_REV1				0x8a00
 -- 
 2.45.2
 
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0008-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0008-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch
index dccdff6..5cb744f 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0008-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0008-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch
@@ -1,7 +1,7 @@
-From 3a7897fc930ad4e36287636f378c0e15cc7b2d84 Mon Sep 17 00:00:00 2001
+From 49c81a4e339f9646fb32faa00935e88ea8c91ec5 Mon Sep 17 00:00:00 2001
 From: "fancy.liu" <fancy.liu@mediatek.com>
 Date: Tue, 14 Nov 2023 10:13:24 +0800
-Subject: [PATCH 008/195] mtk: mt76: mt7996: ACS channel time too long on duty
+Subject: [PATCH 008/223] mtk: mt76: mt7996: ACS channel time too long on duty
  channel
 
 Step and issue:
@@ -41,7 +41,7 @@
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 7934b5aa..1a47fe8f 100644
+index 303f4385..dc1ef40d 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -927,6 +927,7 @@ int mt76_set_channel(struct mt76_phy *phy, struct cfg80211_chan_def *chandef,
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0009-mtk-mt76-mt7996-Fixed-null-pointer-dereference-issue.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0009-mtk-mt76-mt7996-Fixed-null-pointer-dereference-issue.patch
index b2885ca..cb70b1b 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0009-mtk-mt76-mt7996-Fixed-null-pointer-dereference-issue.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0009-mtk-mt76-mt7996-Fixed-null-pointer-dereference-issue.patch
@@ -1,7 +1,7 @@
-From f65c5ffa6546b1dfe908d41ba980ad2ea522a689 Mon Sep 17 00:00:00 2001
+From 6f5c66458edeadf97bd3f6acf55a3a9318b86d83 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 26 Oct 2023 10:08:10 +0800
-Subject: [PATCH 009/195] mtk: mt76: mt7996: Fixed null pointer dereference
+Subject: [PATCH 009/223] mtk: mt76: mt7996: Fixed null pointer dereference
  issue
 
 ---
@@ -9,10 +9,10 @@
  1 file changed, 7 insertions(+)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 91f0002a..1fb91e03 100644
+index f8c07b34..f18c0a08 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -1068,9 +1068,16 @@ static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
+@@ -1060,9 +1060,16 @@ static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
  				 struct ieee80211_sta *sta,
  				 u32 changed)
  {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0010-mtk-mt76-add-sanity-check-to-prevent-kernel-crash.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0010-mtk-mt76-add-sanity-check-to-prevent-kernel-crash.patch
index ae3efa8..46ba8c2 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0010-mtk-mt76-add-sanity-check-to-prevent-kernel-crash.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0010-mtk-mt76-add-sanity-check-to-prevent-kernel-crash.patch
@@ -1,11 +1,12 @@
-From a24fef23dc2a3362c5459f99ac3347855b31ab7a Mon Sep 17 00:00:00 2001
+From 8fb1feae687645a1c48070f2eebc44fcb7db080d Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 30 Oct 2023 11:06:19 +0800
-Subject: [PATCH 010/195] mtk: mt76: add sanity check to prevent kernel crash
+Subject: [PATCH 010/223] mtk: mt76: add sanity check to prevent kernel crash
 
 wcid may not be initialized when mac80211 calls mt76.tx and it would lead to
 kernel crash.
 
+Change-Id: I90004271c6e91620c6991195dd332780ce28380e
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  tx.c | 10 +++++++++-
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0011-mtk-mt76-mt7996-add-firmware-WA-s-coredump.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0011-mtk-mt76-mt7996-add-firmware-WA-s-coredump.patch
index 28d9003..804e1c3 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0011-mtk-mt76-mt7996-add-firmware-WA-s-coredump.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0011-mtk-mt76-mt7996-add-firmware-WA-s-coredump.patch
@@ -1,8 +1,9 @@
-From 9911d119b0373d2aae0a33d4dc599a55892386f9 Mon Sep 17 00:00:00 2001
+From 744e6ef280817a9010606e2d36573cc9206e8457 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Fri, 19 May 2023 14:16:50 +0800
-Subject: [PATCH 011/195] mtk: mt76: mt7996: add firmware WA's coredump.
+Subject: [PATCH 011/223] mtk: mt76: mt7996: add firmware WA's coredump.
 
+Change-Id: I51f115b4ae15bc0f871f93652570d72511dbf880
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
  mt7996/coredump.c | 180 ++++++++++++++++++++++++++++++----------------
@@ -428,10 +429,10 @@
  	return NULL;
  }
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 503e92c0..00396c82 100644
+index cfcfc3ea..dafc86f8 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2007,28 +2007,25 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2018,28 +2018,25 @@ void mt7996_mac_reset_work(struct work_struct *work)
  }
  
  /* firmware coredump */
@@ -464,7 +465,7 @@
  	if (!mem_region || !crash_data->memdump_buf_len) {
  		mutex_unlock(&dev->dump_mutex);
  		goto skip_memdump;
-@@ -2038,6 +2035,9 @@ void mt7996_mac_dump_work(struct work_struct *work)
+@@ -2049,6 +2046,9 @@ void mt7996_mac_dump_work(struct work_struct *work)
  	buf_len = crash_data->memdump_buf_len;
  
  	/* dumping memory content... */
@@ -474,7 +475,7 @@
  	memset(buf, 0, buf_len);
  	for (i = 0; i < num; i++) {
  		if (mem_region->len > buf_len) {
-@@ -2054,6 +2054,7 @@ void mt7996_mac_dump_work(struct work_struct *work)
+@@ -2065,6 +2065,7 @@ void mt7996_mac_dump_work(struct work_struct *work)
  		mt7996_memcpy_fromio(dev, buf, mem_region->start,
  				     mem_region->len);
  
@@ -482,7 +483,7 @@
  		hdr->start = mem_region->start;
  		hdr->len = mem_region->len;
  
-@@ -2070,8 +2071,20 @@ void mt7996_mac_dump_work(struct work_struct *work)
+@@ -2081,8 +2082,20 @@ void mt7996_mac_dump_work(struct work_struct *work)
  	mutex_unlock(&dev->dump_mutex);
  
  skip_memdump:
@@ -506,10 +507,10 @@
  }
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 40d319bc..dff8b971 100644
+index dd428570..46fb3a03 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2709,6 +2709,8 @@ static int mt7996_load_patch(struct mt7996_dev *dev)
+@@ -2719,6 +2719,8 @@ static int mt7996_load_patch(struct mt7996_dev *dev)
  
  	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
  		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
@@ -518,7 +519,7 @@
  
  	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
  		struct mt7996_patch_sec *sec;
-@@ -2835,6 +2837,9 @@ static int __mt7996_load_ram(struct mt7996_dev *dev, const char *fw_type,
+@@ -2845,6 +2847,9 @@ static int __mt7996_load_ram(struct mt7996_dev *dev, const char *fw_type,
  	}
  
  	hdr = (const void *)(fw->data + fw->size - sizeof(*hdr));
@@ -529,10 +530,10 @@
  		 fw_type, hdr->fw_ver, hdr->build_date);
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 3ee83e51..7592e7ed 100644
+index 1dd618c2..602f367d 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -84,6 +84,8 @@
+@@ -94,6 +94,8 @@
  #define MT7996_CRIT_TEMP		110
  #define MT7996_MAX_TEMP			120
  
@@ -541,15 +542,15 @@
  #define MT7996_RRO_MAX_SESSION		1024
  #define MT7996_RRO_WINDOW_MAX_LEN	1024
  #define MT7996_RRO_ADDR_ELEM_LEN	128
-@@ -127,6 +129,7 @@ enum mt7996_ram_type {
+@@ -119,6 +121,7 @@ enum mt7996_ram_type {
  	MT7996_RAM_TYPE_WM,
  	MT7996_RAM_TYPE_WA,
  	MT7996_RAM_TYPE_DSP,
 +	__MT7996_RAM_TYPE_MAX,
  };
  
- enum mt7996_txq_id {
-@@ -320,9 +323,11 @@ struct mt7996_dev {
+ enum mt7996_var_type {
+@@ -328,9 +331,11 @@ struct mt7996_dev {
  	struct mutex dump_mutex;
  #ifdef CONFIG_DEV_COREDUMP
  	struct {
@@ -563,7 +564,7 @@
  	struct list_head sta_rc_list;
  	struct list_head twt_list;
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index cf12c5e0..4c20a67d 100644
+index 06e307b5..3450a2fc 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -597,7 +597,8 @@ enum offs_rev {
@@ -576,7 +577,7 @@
  
  #define MT_SWDEF_BASE				0x00401400
  
-@@ -714,11 +715,15 @@ enum offs_rev {
+@@ -716,11 +717,15 @@ enum offs_rev {
  #define MT_WF_PHYRX_CSD_BAND_RXTD12_IRPI_SW_CLR		BIT(29)
  
  /* CONN MCU EXCP CON */
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0012-mtk-mt76-mt7996-for-build-pass.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0012-mtk-mt76-mt7996-for-build-pass.patch
index 21b2626..cee8d38 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0012-mtk-mt76-mt7996-for-build-pass.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0012-mtk-mt76-mt7996-for-build-pass.patch
@@ -1,8 +1,9 @@
-From e7ded1bf4fe9ad1dd36d948806ee551156442041 Mon Sep 17 00:00:00 2001
+From 5ef8895f1b5e8684b4f81ce52bffa28e629d966b Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 3 Nov 2022 00:27:17 +0800
-Subject: [PATCH 012/195] mtk: mt76: mt7996: for build pass
+Subject: [PATCH 012/223] mtk: mt76: mt7996: for build pass
 
+Change-Id: Ieb44c33ee6e6a2e6058c1ef528404c1a1cbcfdaf
 ---
  debugfs.c         | 3 +++
  dma.c             | 2 +-
@@ -45,7 +46,7 @@
  			goto free_frag;
  
 diff --git a/mcu.c b/mcu.c
-index 98da82b7..6f4aee29 100644
+index 3353012e..2bcce21f 100644
 --- a/mcu.c
 +++ b/mcu.c
 @@ -4,6 +4,7 @@
@@ -57,7 +58,7 @@
  struct sk_buff *
  __mt76_mcu_msg_alloc(struct mt76_dev *dev, const void *data,
 diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index 15921887..bc9e87f8 100644
+index 4e350f27..c2090378 100644
 --- a/mt7615/mcu.c
 +++ b/mt7615/mcu.c
 @@ -10,6 +10,7 @@
@@ -69,7 +70,7 @@
  static bool prefer_offload_fw = true;
  module_param(prefer_offload_fw, bool, 0644);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 864246f9..26a8acec 100644
+index 77f3e92d..07f52dd6 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -4,6 +4,7 @@
@@ -81,7 +82,7 @@
  int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
  {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7fc0e967..9c617de4 100644
+index 72c8e574..b04a960b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -6,6 +6,7 @@
@@ -108,19 +109,19 @@
  
  	mt7996_dma_enable(dev, false);
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index f38629e3..bd02eb00 100644
+index 77dd6b20..21379ce0 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -138,6 +138,7 @@ static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_dev *dev)
+@@ -249,6 +249,7 @@ static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_phy *phy,
  	if (ret)
  		return ret;
  
 +	cap = 0x4b249248;	/* internal hardcode */
  	if (cap) {
- 		dev->has_eht = !(cap & MODE_HE_ONLY);
- 		dev->wtbl_size_group = u32_get_bits(cap, WTBL_SIZE_GROUP);
+ 		u8 band_offs = phy->mt76->band_idx * 3;
+ 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index dff8b971..94b32ac2 100644
+index 46fb3a03..623d19f1 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -5,6 +5,7 @@
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0013-mtk-mt76-mt7996-add-debug-tool.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0013-mtk-mt76-mt7996-add-debug-tool.patch
index a31f495..7288efd 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0013-mtk-mt76-mt7996-add-debug-tool.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0013-mtk-mt76-mt7996-add-debug-tool.patch
@@ -1,7 +1,7 @@
-From aaa4a124d9d7e3aba6fb7ce9d4d93ef82aa11637 Mon Sep 17 00:00:00 2001
+From 1e463d48da75799dd89a9ba28eb37e1e18c4a40b Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 24 Mar 2023 14:02:32 +0800
-Subject: [PATCH 013/195] mtk: mt76: mt7996: add debug tool
+Subject: [PATCH 013/223] mtk: mt76: mt7996: add debug tool
 
 Add PSM bit in sta_info
 
@@ -50,6 +50,11 @@
 The fw_wm_info is used to dump fw status when wm crash. When wm crash,
 we are not able to use any mcu command.
 
+Change-Id: Ie10390b01f17db893dbfbf3221bf63a4bd1fe38f
+Change-Id: I4483f9f506ecbdbb49c2ceb99ec76c32b930c67e
+Change-Id: I00c760b31009142848e32b1249d305800585e7fd
+Change-Id: Ifddd4db86982d39f2d39d198b8f5d3e7028983c2
+Change-Id: I591b558a9eec2fbd46d166c9bb1580a94e22072c
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -77,10 +82,10 @@
  create mode 100644 mt7996/mtk_mcu.h
 
 diff --git a/mt76.h b/mt76.h
-index 2729b3f1..4360c9eb 100644
+index 063c45d2..f50f2117 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -408,6 +408,8 @@ struct mt76_txwi_cache {
+@@ -409,6 +409,8 @@ struct mt76_txwi_cache {
  		struct sk_buff *skb;
  		void *ptr;
  	};
@@ -392,10 +397,10 @@
  	hdr.timestamp = cpu_to_le32(mt76_rr(dev, MT_LPON_FRCR(0)));
  	hdr.len = *(__le16 *)data;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 00396c82..52ea6796 100644
+index dafc86f8..d1d45c98 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -945,6 +945,9 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -956,6 +956,9 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	id = mt76_token_consume(mdev, &t);
  	if (id < 0)
  		return id;
@@ -406,10 +411,10 @@
  	pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb);
  	memset(txwi_ptr, 0, MT_TXD_SIZE);
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 7592e7ed..e920dcca 100644
+index 602f367d..6c889427 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -362,6 +362,7 @@ struct mt7996_dev {
+@@ -370,6 +370,7 @@ struct mt7996_dev {
  	u8 fw_debug_wa;
  	u8 fw_debug_bin;
  	u16 fw_debug_seq;
@@ -417,10 +422,10 @@
  
  	struct dentry *debugfs_dir;
  	struct rchan *relay_fwlog;
-@@ -374,6 +375,17 @@ struct mt7996_dev {
- 	spinlock_t reg_lock;
- 
- 	u8 wtbl_size_group;
+@@ -386,6 +387,17 @@ struct mt7996_dev {
+ 		u8 type:4;
+ 		u8 fem:4;
+ 	} var;
 +
 +#ifdef CONFIG_MTK_DEBUG
 +	u16 wlan_idx;
@@ -435,7 +440,7 @@
  };
  
  enum {
-@@ -670,6 +682,7 @@ u32 mt7996_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -700,6 +712,7 @@ u32 mt7996_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  
  #ifdef CONFIG_MTK_DEBUG
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir);
@@ -2737,7 +2742,7 @@
 +#endif
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
 new file mode 100644
-index 00000000..64952a73
+index 00000000..d1f3d16c
 --- /dev/null
 +++ b/mt7996/mtk_debugfs.c
 @@ -0,0 +1,2506 @@
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0014-mtk-mt76-mt7996-add-check-for-hostapd-config-he_ldpc.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0014-mtk-mt76-mt7996-add-check-for-hostapd-config-he_ldpc.patch
index 3ab76ff..d381689 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0014-mtk-mt76-mt7996-add-check-for-hostapd-config-he_ldpc.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0014-mtk-mt76-mt7996-add-check-for-hostapd-config-he_ldpc.patch
@@ -1,7 +1,7 @@
-From 029e4626c005bfb8b70ab844f742333e63f01739 Mon Sep 17 00:00:00 2001
+From ef0c8f78bad493731f96c1c6c3659f106a99040a Mon Sep 17 00:00:00 2001
 From: "Allen.Ye" <allen.ye@mediatek.com>
 Date: Thu, 8 Jun 2023 17:32:33 +0800
-Subject: [PATCH 014/195] mtk: mt76: mt7996: add check for hostapd config
+Subject: [PATCH 014/223] mtk: mt76: mt7996: add check for hostapd config
  he_ldpc
 
 Add check for hostapd config he_ldpc.
@@ -9,16 +9,18 @@
 
 Add check for STA LDPC cap, if STA only have BCC we should not overwrite the phy_cap with config he_ldpc.
 
+Change-Id: Ibe7e40ec1dbb40bd3f3d96741e9933ec00b50df0
+Change-Id: I6d6f59df8897e3c00f2e0a1e3c6e5701e31c5e4b
 Signed-off-by: Allen.Ye <allen.ye@mediatek.com>
 ---
  mt7996/mcu.c | 12 +++++++++---
  1 file changed, 9 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 94b32ac2..0caba201 100644
+index 623d19f1..cefd4fad 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1188,7 +1188,8 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
+@@ -1198,7 +1198,8 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
  }
  
  static void
@@ -28,7 +30,7 @@
  {
  	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
  	struct ieee80211_he_mcs_nss_supp mcs_map;
-@@ -1208,6 +1209,11 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1218,6 +1219,11 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  		he->he_phy_cap[i] = elem->phy_cap_info[i];
  	}
  
@@ -40,7 +42,7 @@
  	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
  	switch (sta->deflink.bandwidth) {
  	case IEEE80211_STA_RX_BW_160:
-@@ -2113,7 +2119,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2123,7 +2129,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	 * update sta_rec_he here.
  	 */
  	if (changed)
@@ -49,7 +51,7 @@
  
  	/* sta_rec_ra accommodates BW, NSS and only MCS range format
  	 * i.e 0-{7,8,9} for VHT.
-@@ -2206,7 +2212,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2216,7 +2222,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  		/* starec amsdu */
  		mt7996_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
  		/* starec he */
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0015-mtk-mt76-mt7996-add-basic-testmode-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0015-mtk-mt76-mt7996-add-basic-testmode-support.patch
index 8b74a24..aecd31a 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0015-mtk-mt76-mt7996-add-basic-testmode-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0015-mtk-mt76-mt7996-add-basic-testmode-support.patch
@@ -1,7 +1,7 @@
-From 09ae50fef0e6e709c95f0c11dde9ad80b6dad416 Mon Sep 17 00:00:00 2001
+From 7f3e6ce10b137781002b339ab16c2bf078313c41 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Date: Wed, 28 Dec 2022 22:24:25 +0800
-Subject: [PATCH 015/195] mtk: mt76: mt7996: add basic testmode support
+Date: Thu, 26 Sep 2024 14:54:11 +0800
+Subject: [PATCH 015/223] mtk: mt76: mt7996: add basic testmode support
 
 Add testmode eeprom buffer mode support
 
@@ -14,6 +14,8 @@
 
 edcca return err in testmode; therefore, bypass it when we are in testmode idle state or testmode bf is on
 
+Change-Id: I0e09e7f5bc0fb9aa4e4ec906a0f5f169bcc261cb
+Change-Id: I849b11b4ccdecd2b7b525b29801c02b5207bbf91
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  eeprom.c          |   6 +-
@@ -21,25 +23,25 @@
  mt76.h            |  36 +++
  mt76_connac_mcu.h |   2 +
  mt7996/Makefile   |   1 +
- mt7996/eeprom.c   |  37 ++-
+ mt7996/eeprom.c   |  86 +++++-
  mt7996/eeprom.h   |   1 +
  mt7996/init.c     |   8 +
  mt7996/mac.c      |   3 +-
- mt7996/main.c     |  27 ++
- mt7996/mcu.c      |  59 +++-
+ mt7996/main.c     |  35 +++
+ mt7996/mcu.c      |  53 +++-
  mt7996/mcu.h      |  33 +++
- mt7996/mt7996.h   |  27 +-
+ mt7996/mt7996.h   |  27 ++
  mt7996/testmode.c | 740 ++++++++++++++++++++++++++++++++++++++++++++++
  mt7996/testmode.h | 299 +++++++++++++++++++
  testmode.c        | 126 ++++++--
  testmode.h        |  87 +++++-
  tools/fields.c    | 102 ++++++-
- 18 files changed, 1547 insertions(+), 50 deletions(-)
+ 18 files changed, 1602 insertions(+), 46 deletions(-)
  create mode 100644 mt7996/testmode.c
  create mode 100644 mt7996/testmode.h
 
 diff --git a/eeprom.c b/eeprom.c
-index 0bc66cc1..a0047d79 100644
+index ab4fab11..6bd2cc1a 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -94,8 +94,10 @@ int mt76_get_of_data_from_mtd(struct mt76_dev *dev, void *eep, int offset, int l
@@ -56,7 +58,7 @@
  
  out_put_node:
 diff --git a/mac80211.c b/mac80211.c
-index 1a47fe8f..e97e72c5 100644
+index dc1ef40d..5d9512d4 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -846,7 +846,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
@@ -70,10 +72,10 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index 4360c9eb..5168d29a 100644
+index f50f2117..f6ffccac 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -716,14 +716,21 @@ struct mt76_testmode_ops {
+@@ -718,14 +718,21 @@ struct mt76_testmode_ops {
  	int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
  			  enum mt76_testmode_state new_state);
  	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
@@ -95,7 +97,7 @@
  	u32 tx_count;
  	u16 tx_mpdu_len;
  
-@@ -733,6 +740,7 @@ struct mt76_testmode_data {
+@@ -735,6 +742,7 @@ struct mt76_testmode_data {
  	u8 tx_rate_sgi;
  	u8 tx_rate_ldpc;
  	u8 tx_rate_stbc;
@@ -103,7 +105,7 @@
  	u8 tx_ltf;
  
  	u8 tx_antenna_mask;
-@@ -742,6 +750,9 @@ struct mt76_testmode_data {
+@@ -744,6 +752,9 @@ struct mt76_testmode_data {
  	u32 tx_time;
  	u32 tx_ipg;
  
@@ -113,7 +115,7 @@
  	u32 freq_offset;
  
  	u8 tx_power[4];
-@@ -756,7 +767,16 @@ struct mt76_testmode_data {
+@@ -758,7 +769,16 @@ struct mt76_testmode_data {
  	struct {
  		u64 packets[__MT_RXQ_MAX];
  		u64 fcs_error[__MT_RXQ_MAX];
@@ -154,10 +156,10 @@
  {
  #ifdef CONFIG_NL80211_TESTMODE
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 942a00de..3b1cc02d 100644
+index 200eace5..873f59f7 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1279,12 +1279,14 @@ enum {
+@@ -1284,12 +1284,14 @@ enum {
  	MCU_UNI_CMD_EFUSE_CTRL = 0x2d,
  	MCU_UNI_CMD_RA = 0x2f,
  	MCU_UNI_CMD_MURU = 0x31,
@@ -184,7 +186,7 @@
  
  mt7996e-y += mtk_debugfs.o mtk_mcu.o
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index bd02eb00..e2790109 100644
+index 21379ce0..cb4fb702 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -6,6 +6,11 @@
@@ -207,63 +209,110 @@
 +		return MT7996_EEPROM_DEFAULT_TM;
 +
  	switch (mt76_chip(&dev->mt76)) {
- 	case 0x7990:
- 		if (dev->chip_sku == MT7996_SKU_404)
-@@ -92,21 +100,36 @@ out:
+ 	case 0x7992:
+ 		switch (dev->var.type) {
+@@ -171,6 +179,8 @@ mt7996_eeprom_check_or_use_default(struct mt7996_dev *dev, bool use_default)
+ 	dev_warn(dev->mt76.dev, "eeprom load fail, use default bin\n");
+ 	memcpy(eeprom, fw->data, MT7996_EEPROM_SIZE);
+ 	dev->flash_mode = true;
++	dev->eeprom_mode = DEFAULT_BIN_MODE;
++	eeprom[MT_EE_TESTMODE_EN] = dev->testmode_enable;
+ 
+ out:
+ 	release_firmware(fw);
+@@ -178,20 +188,84 @@ out:
  	return ret;
  }
  
 -static int mt7996_eeprom_load(struct mt7996_dev *dev)
-+int mt7996_eeprom_check_fw_mode(struct mt7996_dev *dev)
++static int
++mt7996_eeprom_load_bin(struct mt7996_dev *dev)
  {
-+	u8 *eeprom;
+-	bool use_default = false;
++	u8 *eeprom = dev->mt76.eeprom.data;
++	const struct firmware *fw = NULL;
  	int ret;
  
-+	/* load eeprom in flash or bin file mode to determine fw mode */
- 	ret = mt76_eeprom_init(&dev->mt76, MT7996_EEPROM_SIZE);
- 	if (ret < 0)
+-	ret = mt76_eeprom_init(&dev->mt76, MT7996_EEPROM_SIZE);
+-	if (ret < 0)
++	ret = request_firmware(&fw, dev->mt76.bin_file_name, dev->mt76.dev);
++	if (ret)
  		return ret;
  
- 	if (ret) {
- 		dev->flash_mode = true;
--	} else {
--		u8 free_block_num;
--		u32 block_num, i;
--		u32 eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;
-+		eeprom = dev->mt76.eeprom.data;
-+		/* testmode enable priority: eeprom field > module parameter */
-+		dev->testmode_enable = !mt7996_check_eeprom(dev) ? eeprom[MT_EE_TESTMODE_EN] :
-+								   testmode_enable;
+-	if (ret && !mt7996_check_eeprom(dev)) {
+-		dev->flash_mode = true;
++	if (!fw || !fw->data) {
++		dev_err(dev->mt76.dev, "Invalid bin %s\n", dev->mt76.bin_file_name);
++		ret = -EINVAL;
+ 		goto out;
+ 	}
+ 
++	memcpy(eeprom, fw->data, MT7996_EEPROM_SIZE);
++	dev->flash_mode = true;
++
++out:
++	release_firmware(fw);
++	return ret;
++}
++
++static int mt7996_eeprom_load_flash(struct mt7996_dev *dev)
++{
++	int ret = 1;
++
++	/* return > 0 for load success, return 0 for load failed, return < 0 for no memory */
++	dev->bin_file_mode = mt76_check_bin_file_mode(&dev->mt76);
++	if (dev->bin_file_mode) {
++		dev->mt76.eeprom.size = MT7996_EEPROM_SIZE;
++		dev->mt76.eeprom.data = devm_kzalloc(dev->mt76.dev, dev->mt76.eeprom.size,
++						     GFP_KERNEL);
++		if (!dev->mt76.eeprom.data)
++			return -ENOMEM;
++
++		if (mt7996_eeprom_load_bin(dev))
++			return 0;
++	} else {
++		ret = mt76_eeprom_init(&dev->mt76, MT7996_EEPROM_SIZE);
 +	}
 +
++	if (mt7996_check_eeprom(dev))
++		return 0;
++
++	return ret;
++}
++
++int mt7996_eeprom_check_fw_mode(struct mt7996_dev *dev)
++{
++	u8 *eeprom;
++	int ret;
++
++	dev->testmode_enable = testmode_enable;
++
++	/* load eeprom in flash or bin file mode to determine fw mode */
++	ret = mt7996_eeprom_load_flash(dev);
++	if (ret <= 0)
++		goto out;
++
++	dev->flash_mode = true;
++	dev->eeprom_mode = dev->bin_file_mode ? BIN_FILE_MODE : FLASH_MODE;
++	eeprom = dev->mt76.eeprom.data;
++	/* testmode enable priority: eeprom field > module parameter */
++	dev->testmode_enable = eeprom[MT_EE_TESTMODE_EN];
++
++out:
 +	return ret;
 +}
 +
 +static int mt7996_eeprom_load(struct mt7996_dev *dev)
 +{
++	bool use_default = false;
 +	int ret;
-+	u8 free_block_num;
-+	u32 block_num, i;
-+	u32 eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;
- 
++
 +	/* flash or bin file mode eeprom is loaded before mcu init */
-+	if (!dev->flash_mode) {
- 		ret = mt7996_mcu_get_eeprom_free_block(dev, &free_block_num);
- 		if (ret < 0)
- 			return ret;
-@@ -118,8 +141,8 @@ static int mt7996_eeprom_load(struct mt7996_dev *dev)
- 		/* read eeprom data from efuse */
- 		block_num = DIV_ROUND_UP(MT7996_EEPROM_SIZE, eeprom_blk_size);
- 		for (i = 0; i < block_num; i++) {
--			ret = mt7996_mcu_get_eeprom(dev, i * eeprom_blk_size);
--			if (ret < 0)
-+			ret = mt7996_mcu_get_eeprom(dev, i * eeprom_blk_size, NULL);
-+			if (ret && ret != -EINVAL)
- 				return ret;
- 		}
- 	}
+ 	if (!dev->flash_mode) {
+ 		u32 eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;
+ 		u32 block_num = DIV_ROUND_UP(MT7996_EEPROM_SIZE, eeprom_blk_size);
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 72c38ad3..de3ff4e2 100644
+index 8074a0ae..7f7a718f 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -14,6 +14,7 @@ enum mt7996_eeprom_field {
@@ -275,10 +324,10 @@
  	MT_EE_RATE_DELTA_2G =	0x1400,
  	MT_EE_RATE_DELTA_5G =	0x147d,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index f80fba28..ed7c7040 100644
+index 3a6f4f28..dc736a2d 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -971,6 +971,10 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
+@@ -983,6 +983,10 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
  
  	set_bit(MT76_STATE_INITIALIZED, &dev->mphy.state);
  
@@ -289,7 +338,7 @@
  	ret = mt7996_mcu_init(dev);
  	if (ret)
  		return ret;
-@@ -1420,6 +1424,10 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1436,6 +1440,10 @@ int mt7996_register_device(struct mt7996_dev *dev)
  
  	mt7996_init_wiphy(hw, &dev->mt76.mmio.wed);
  
@@ -301,21 +350,21 @@
  				   ARRAY_SIZE(mt76_rates));
  	if (ret)
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 52ea6796..a0fcd8aa 100644
+index d1d45c98..d73644f6 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -685,7 +685,8 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
+@@ -686,7 +686,8 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
  				     *info);
  	}
  
--	if (rxv && mode >= MT_PHY_TYPE_HE_SU && !(status->flag & RX_FLAG_8023))
-+	if (rxv && mode >= MT_PHY_TYPE_HE_SU && mode < MT_PHY_TYPE_EHT_SU &&
-+	    !(status->flag & RX_FLAG_8023))
- 		mt76_connac3_mac_decode_he_radiotap(skb, rxv, mode);
- 
- 	if (!status->wcid || !ieee80211_is_data_qos(fc) || hw_aggr)
+-	if (rxv && !(status->flag & RX_FLAG_8023)) {
++	if (rxv && !(status->flag & RX_FLAG_8023) &&
++	    (mode >= MT_PHY_TYPE_HE_SU && mode < MT_PHY_TYPE_EHT_SU)) {
+ 		switch (status->encoding) {
+ 		case RX_ENC_EHT:
+ 			mt76_connac3_mac_decode_eht_radiotap(skb, rxv, mode);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 1fb91e03..040b8abd 100644
+index f18c0a08..b7ae6e1a 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -23,6 +23,18 @@ static bool mt7996_dev_running(struct mt7996_dev *dev)
@@ -346,7 +395,29 @@
  	mt7996_mac_enable_nf(dev, phy->mt76->band_idx);
  
  	ret = mt7996_mcu_set_rts_thresh(phy, 0x92b);
-@@ -296,6 +310,11 @@ int mt7996_set_channel(struct mt76_phy *mphy)
+@@ -188,6 +202,10 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+ 
++	if (vif->type == NL80211_IFTYPE_MONITOR &&
++	    is_zero_ether_addr(vif->addr))
++		phy->monitor_vif = vif;
++
+ 	mvif->mt76.idx = __ffs64(~dev->mt76.vif_mask);
+ 	if (mvif->mt76.idx >= mt7996_max_interface_num(dev)) {
+ 		ret = -ENOSPC;
+@@ -266,6 +284,10 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+ 
+ 	mt7996_mcu_add_sta(dev, vif, NULL, false, false);
+ 	mt7996_mcu_add_bss_info(phy, vif, false);
++
++	if (vif == phy->monitor_vif)
++		phy->monitor_vif = NULL;
++
+ 	mt7996_mcu_add_dev_info(phy, vif, false);
+ 
+ 	rcu_assign_pointer(dev->mt76.wcid[idx], NULL);
+@@ -288,6 +310,11 @@ int mt7996_set_channel(struct mt76_phy *mphy)
  	struct mt7996_phy *phy = mphy->priv;
  	int ret;
  
@@ -358,7 +429,7 @@
  	ret = mt7996_mcu_set_chan_info(phy, UNI_CHANNEL_SWITCH);
  	if (ret)
  		goto out;
-@@ -402,6 +421,12 @@ static int mt7996_config(struct ieee80211_hw *hw, u32 changed)
+@@ -394,6 +421,12 @@ static int mt7996_config(struct ieee80211_hw *hw, u32 changed)
  	int ret;
  
  	if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
@@ -371,7 +442,7 @@
  		ret = mt7996_mcu_set_pp_en(phy, PP_USR_MODE,
  					   phy->mt76->chandef.punctured);
  		if (ret)
-@@ -1516,6 +1541,8 @@ const struct ieee80211_ops mt7996_ops = {
+@@ -1508,6 +1541,8 @@ const struct ieee80211_ops mt7996_ops = {
  	.sta_set_decap_offload = mt7996_sta_set_decap_offload,
  	.add_twt_setup = mt7996_mac_add_twt_setup,
  	.twt_teardown_request = mt7996_twt_teardown_request,
@@ -381,10 +452,10 @@
  	.sta_add_debugfs = mt7996_sta_add_debugfs,
  #endif
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 0caba201..ce60698f 100644
+index cefd4fad..214a39d5 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2870,8 +2870,12 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
+@@ -2880,8 +2880,12 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
  {
  	int ret;
  
@@ -399,12 +470,9 @@
  	if (ret)
  		return ret;
  
-@@ -3562,17 +3566,9 @@ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
- 				 &req, sizeof(req), true);
- }
+@@ -3574,15 +3578,7 @@ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
  
--int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset)
-+int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf)
+ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len)
  {
 -	struct {
 -		u8 _rsv[4];
@@ -419,26 +487,15 @@
  		.tag = cpu_to_le16(UNI_EFUSE_ACCESS),
  		.len = cpu_to_le16(sizeof(req) - 4),
  		.addr = cpu_to_le32(round_down(offset,
-@@ -3581,6 +3577,7 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset)
- 	struct sk_buff *skb;
- 	bool valid;
- 	int ret;
-+	u8 *buf = read_buf;
+@@ -3604,6 +3600,7 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_l
  
- 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
- 					MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL),
-@@ -3591,7 +3588,9 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset)
- 	valid = le32_to_cpu(*(__le32 *)(skb->data + 16));
- 	if (valid) {
- 		u32 addr = le32_to_cpu(*(__le32 *)(skb->data + 12));
--		u8 *buf = (u8 *)dev->mt76.eeprom.data + addr;
+ 		if (!buf)
+ 			buf = (u8 *)dev->mt76.eeprom.data + addr;
 +
-+		if (!buf)
-+			buf = (u8 *)dev->mt76.eeprom.data + addr;
+ 		if (!buf_len || buf_len > MT7996_EEPROM_BLOCK_SIZE)
+ 			buf_len = MT7996_EEPROM_BLOCK_SIZE;
  
- 		skb_pull(skb, 48);
- 		memcpy(buf, skb->data, MT7996_EEPROM_BLOCK_SIZE);
-@@ -4614,3 +4613,37 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
+@@ -4630,3 +4627,37 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(PP),
  				 &req, sizeof(req), false);
  }
@@ -530,36 +587,38 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index e920dcca..b4cf702c 100644
+index 6c889427..5f911515 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -32,21 +32,25 @@
+@@ -32,6 +32,7 @@
  #define MT7996_FIRMWARE_WA		"mediatek/mt7996/mt7996_wa.bin"
  #define MT7996_FIRMWARE_WM		"mediatek/mt7996/mt7996_wm.bin"
  #define MT7996_FIRMWARE_DSP		"mediatek/mt7996/mt7996_dsp.bin"
 +#define MT7996_FIRMWARE_WM_TM		"mediatek/mt7996/mt7996_wm_tm.bin"
  #define MT7996_ROM_PATCH		"mediatek/mt7996/mt7996_rom_patch.bin"
  
+ #define MT7996_FIRMWARE_WA_233		"mediatek/mt7996/mt7996_wa_233.bin"
+@@ -42,16 +43,19 @@
  #define MT7992_FIRMWARE_WA		"mediatek/mt7996/mt7992_wa.bin"
  #define MT7992_FIRMWARE_WM		"mediatek/mt7996/mt7992_wm.bin"
  #define MT7992_FIRMWARE_DSP		"mediatek/mt7996/mt7992_dsp.bin"
 +#define MT7992_FIRMWARE_WM_TM		"mediatek/mt7996/mt7992_wm_tm.bin"
  #define MT7992_ROM_PATCH		"mediatek/mt7996/mt7992_rom_patch.bin"
  
- #define MT7992_FIRMWARE_WA_24		"mediatek/mt7996/mt7992_wa_24.bin"
- #define MT7992_FIRMWARE_WM_24		"mediatek/mt7996/mt7992_wm_24.bin"
- #define MT7992_FIRMWARE_DSP_24		"mediatek/mt7996/mt7992_dsp_24.bin"
-+#define MT7992_FIRMWARE_WM_TM_24	"mediatek/mt7996/mt7992_wm_tm_24.bin"
- #define MT7992_ROM_PATCH_24		"mediatek/mt7996/mt7992_rom_patch_24.bin"
- 
  #define MT7992_FIRMWARE_WA_23		"mediatek/mt7996/mt7992_wa_23.bin"
  #define MT7992_FIRMWARE_WM_23		"mediatek/mt7996/mt7992_wm_23.bin"
  #define MT7992_FIRMWARE_DSP_23		"mediatek/mt7996/mt7992_dsp_23.bin"
 +#define MT7992_FIRMWARE_WM_TM_23	"mediatek/mt7996/mt7992_wm_tm_23.bin"
  #define MT7992_ROM_PATCH_23		"mediatek/mt7996/mt7992_rom_patch_23.bin"
  
+ #define MT7992_FIRMWARE_WA_24		"mediatek/mt7996/mt7992_wa_24.bin"
+ #define MT7992_FIRMWARE_WM_24		"mediatek/mt7996/mt7992_wm_24.bin"
+ #define MT7992_FIRMWARE_DSP_24		"mediatek/mt7996/mt7992_dsp_24.bin"
++#define MT7992_FIRMWARE_WM_TM_24	"mediatek/mt7996/mt7992_wm_tm_24.bin"
+ #define MT7992_ROM_PATCH_24		"mediatek/mt7996/mt7992_rom_patch_24.bin"
+ 
  #define MT7996_EEPROM_DEFAULT		"mediatek/mt7996/mt7996_eeprom.bin"
-@@ -127,6 +131,7 @@ enum mt7992_sku_type {
+@@ -119,6 +123,7 @@ struct mt7996_dfs_pattern;
  
  enum mt7996_ram_type {
  	MT7996_RAM_TYPE_WM,
@@ -567,7 +626,16 @@
  	MT7996_RAM_TYPE_WA,
  	MT7996_RAM_TYPE_DSP,
  	__MT7996_RAM_TYPE_MAX,
-@@ -277,6 +282,21 @@ struct mt7996_phy {
+@@ -258,6 +263,8 @@ struct mt7996_phy {
+ 
+ 	struct ieee80211_sband_iftype_data iftype[NUM_NL80211_BANDS][NUM_NL80211_IFTYPES];
+ 
++	struct ieee80211_vif *monitor_vif;
++
+ 	struct thermal_cooling_device *cdev;
+ 	u8 cdev_state;
+ 	u8 throttle_state;
+@@ -285,6 +292,21 @@ struct mt7996_phy {
  
  	u8 pp_mode;
  	u16 punct_bitmap;
@@ -589,7 +657,7 @@
  };
  
  struct mt7996_dev {
-@@ -357,6 +377,8 @@ struct mt7996_dev {
+@@ -365,6 +387,8 @@ struct mt7996_dev {
  		spinlock_t lock;
  	} wed_rro;
  
@@ -598,7 +666,7 @@
  	bool ibf;
  	u8 fw_debug_wm;
  	u8 fw_debug_wa;
-@@ -472,6 +494,7 @@ mt7996_band_valid(struct mt7996_dev *dev, u8 band)
+@@ -502,6 +526,7 @@ mt7996_has_background_radar(struct mt7996_dev *dev)
  extern const struct ieee80211_ops mt7996_ops;
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
@@ -606,7 +674,7 @@
  
  struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
  				     void __iomem *mem_base, u32 device_id);
-@@ -481,6 +504,7 @@ u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif);
+@@ -511,6 +536,7 @@ u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif);
  int mt7996_register_device(struct mt7996_dev *dev);
  void mt7996_unregister_device(struct mt7996_dev *dev);
  int mt7996_eeprom_init(struct mt7996_dev *dev);
@@ -614,16 +682,7 @@
  int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
  int mt7996_eeprom_get_target_power(struct mt7996_dev *dev,
  				   struct ieee80211_channel *chan);
-@@ -533,7 +557,7 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
- int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif,
- 			       struct ieee80211_sta *sta, void *data, u32 field);
- int mt7996_mcu_set_eeprom(struct mt7996_dev *dev);
--int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset);
-+int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf);
- int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num);
- int mt7996_mcu_get_chip_config(struct mt7996_dev *dev, u32 *cap);
- int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 set, u8 band);
-@@ -568,6 +592,7 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
+@@ -598,6 +624,7 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
  void mt7996_mcu_exit(struct mt7996_dev *dev);
  int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag);
  int mt7996_mcu_wed_rro_reset_sessions(struct mt7996_dev *dev, u16 id);
@@ -633,7 +692,7 @@
  {
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
 new file mode 100644
-index 00000000..98eebcee
+index 00000000..58f0ad26
 --- /dev/null
 +++ b/mt7996/testmode.c
 @@ -0,0 +1,740 @@
@@ -1324,7 +1383,7 @@
 +		req.addr = cpu_to_le32(i);
 +		memcpy(req.data, eeprom + i, MT76_TM_EEPROM_BLOCK_SIZE);
 +
-+		ret = mt7996_mcu_get_eeprom(dev, i, read_buf);
++		ret = mt7996_mcu_get_eeprom(dev, i, read_buf, sizeof(read_buf));
 +		if (ret < 0)
 +			return ret;
 +
@@ -1950,7 +2009,7 @@
  
  	if (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_POWER)) {
 diff --git a/testmode.h b/testmode.h
-index 5e2792d8..96872e8c 100644
+index 1b0bcae8..2873c903 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -5,7 +5,8 @@
@@ -2105,7 +2164,7 @@
   */
  enum mt76_testmode_tx_mode {
  	MT76_TM_TX_MODE_CCK,
-@@ -187,12 +251,33 @@ enum mt76_testmode_tx_mode {
+@@ -187,10 +251,31 @@ enum mt76_testmode_tx_mode {
  	MT76_TM_TX_MODE_HE_EXT_SU,
  	MT76_TM_TX_MODE_HE_TB,
  	MT76_TM_TX_MODE_HE_MU,
@@ -2136,8 +2195,6 @@
 +	MT76_TM_EEPROM_ACTION_MAX = NUM_MT76_TM_EEPROM_ACTION - 1,
 +};
 +
- extern const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS];
- 
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
 index e3f69089..055f90f3 100644
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0016-mtk-mt76-mt7996-add-testmode-pre-calibration-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0016-mtk-mt76-mt7996-add-testmode-pre-calibration-support.patch
index a0a0497..7bfffde 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0016-mtk-mt76-mt7996-add-testmode-pre-calibration-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0016-mtk-mt76-mt7996-add-testmode-pre-calibration-support.patch
@@ -1,9 +1,10 @@
-From 3149f3c002e4d6ff5941a5f54591a74e48371078 Mon Sep 17 00:00:00 2001
+From 3d599c8f98348aa22fde6d3fc9b0536467a6378c Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 31 Mar 2023 11:27:24 +0800
-Subject: [PATCH 016/195] mtk: mt76: mt7996: add testmode pre-calibration
+Subject: [PATCH 016/223] mtk: mt76: mt7996: add testmode pre-calibration
  support
 
+Change-Id: If8a6cc02fa20e35f079c826e0571e8c04c3f9c7e
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mac80211.c        |  21 ---
@@ -21,7 +22,7 @@
  12 files changed, 632 insertions(+), 23 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index e97e72c5..18428e44 100644
+index 5d9512d4..1d2477d6 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -6,27 +6,6 @@
@@ -53,10 +54,10 @@
  	CHAN2G(1, 2412),
  	CHAN2G(2, 2417),
 diff --git a/mt76.h b/mt76.h
-index 5168d29a..6086872e 100644
+index f6ffccac..8666ec2f 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -23,6 +23,27 @@
+@@ -24,6 +24,27 @@
  #include "util.h"
  #include "testmode.h"
  
@@ -84,7 +85,7 @@
  #define MT_MCU_RING_SIZE	32
  #define MT_RX_BUF_SIZE		2048
  #define MT_SKB_HEAD_LEN		256
-@@ -719,6 +740,7 @@ struct mt76_testmode_ops {
+@@ -721,6 +742,7 @@ struct mt76_testmode_ops {
  	void (*reset_rx_stats)(struct mt76_phy *phy);
  	void (*tx_stop)(struct mt76_phy *phy);
  	int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
@@ -93,10 +94,10 @@
  
  #define MT_TM_FW_RX_COUNT	BIT(0)
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 3b1cc02d..4e162210 100644
+index 873f59f7..c7fa7b26 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1053,8 +1053,10 @@ enum {
+@@ -1058,8 +1058,10 @@ enum {
  	MCU_UNI_EVENT_RDD_REPORT = 0x11,
  	MCU_UNI_EVENT_ROC = 0x27,
  	MCU_UNI_EVENT_TX_DONE = 0x2d,
@@ -108,7 +109,7 @@
  	MCU_UNI_EVENT_PER_STA_INFO = 0x6d,
  	MCU_UNI_EVENT_ALL_STA_INFO = 0x6e,
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index e2790109..80b9f6f9 100644
+index cb4fb702..31b8fd1a 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -12,6 +12,42 @@ static bool testmode_enable;
@@ -154,8 +155,8 @@
  static int mt7996_check_eeprom(struct mt7996_dev *dev)
  {
  #define FEM_INT				0
-@@ -74,6 +110,36 @@ static char *mt7996_eeprom_name(struct mt7996_dev *dev)
- 	}
+@@ -156,6 +192,36 @@ static bool mt7996_eeprom_variant_valid(struct mt7996_dev *dev, const u8 *def)
+ 	return true;
  }
  
 +int
@@ -189,10 +190,10 @@
 +}
 +
  static int
- mt7996_eeprom_load_default(struct mt7996_dev *dev)
+ mt7996_eeprom_check_or_use_default(struct mt7996_dev *dev, bool use_default)
  {
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index de3ff4e2..849b8bca 100644
+index 7f7a718f..c1cad4f9 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -14,6 +14,7 @@ enum mt7996_eeprom_field {
@@ -257,10 +258,10 @@
  #define MT_EE_WIFI_CONF2_TX_PATH_BAND1		GENMASK(2, 0)
  #define MT_EE_WIFI_CONF2_TX_PATH_BAND2		GENMASK(5, 3)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index ce60698f..763bdd73 100644
+index 214a39d5..08534fec 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -715,6 +715,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -725,6 +725,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	case MCU_UNI_EVENT_WED_RRO:
  		mt7996_mcu_wed_rro_event(dev, skb);
  		break;
@@ -273,10 +274,10 @@
  		break;
  	}
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index b4cf702c..c1159d69 100644
+index 5f911515..54b81c1e 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -389,6 +389,9 @@ struct mt7996_dev {
+@@ -399,6 +399,9 @@ struct mt7996_dev {
  	struct dentry *debugfs_dir;
  	struct rchan *relay_fwlog;
  
@@ -286,7 +287,7 @@
  	struct {
  		u16 table_mask;
  		u8 n_agrt;
-@@ -509,6 +512,7 @@ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
+@@ -541,6 +544,7 @@ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
  int mt7996_eeprom_get_target_power(struct mt7996_dev *dev,
  				   struct ieee80211_channel *chan);
  s8 mt7996_eeprom_get_power_delta(struct mt7996_dev *dev, int band);
@@ -294,7 +295,7 @@
  int mt7996_dma_init(struct mt7996_dev *dev);
  void mt7996_dma_reset(struct mt7996_dev *dev, bool force);
  void mt7996_dma_prefetch(struct mt7996_dev *dev);
-@@ -593,6 +597,9 @@ void mt7996_mcu_exit(struct mt7996_dev *dev);
+@@ -625,6 +629,9 @@ void mt7996_mcu_exit(struct mt7996_dev *dev);
  int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag);
  int mt7996_mcu_wed_rro_reset_sessions(struct mt7996_dev *dev, u16 id);
  int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
@@ -305,7 +306,7 @@
  static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
  {
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 98eebcee..a756ee10 100644
+index 58f0ad26..6969cba6 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
 @@ -7,6 +7,8 @@
@@ -857,7 +858,7 @@
  		err = -EINVAL;
  
 diff --git a/testmode.h b/testmode.h
-index 96872e8c..d6601cdc 100644
+index 2873c903..3348d0d5 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -220,6 +220,14 @@ enum mt76_testmode_state {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0017-mtk-mt76-mt7996-add-normal-mode-pre-calibration-supp.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0017-mtk-mt76-mt7996-add-normal-mode-pre-calibration-supp.patch
index 8f8fa03..aa08101 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0017-mtk-mt76-mt7996-add-normal-mode-pre-calibration-supp.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0017-mtk-mt76-mt7996-add-normal-mode-pre-calibration-supp.patch
@@ -1,7 +1,7 @@
-From 56c85188fc31d68ddfafdbd84f98bbc4694c870d Mon Sep 17 00:00:00 2001
+From 2d4b4838473a1a02b793b9ba214f03640419f5ba Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 1 Mar 2023 12:12:51 +0800
-Subject: [PATCH 017/195] mtk: mt76: mt7996: add normal mode pre-calibration
+Subject: [PATCH 017/223] mtk: mt76: mt7996: add normal mode pre-calibration
  support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -16,10 +16,10 @@
  7 files changed, 188 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 4e162210..5a116d0f 100644
+index c7fa7b26..a7d7ecce 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1289,6 +1289,7 @@ enum {
+@@ -1294,6 +1294,7 @@ enum {
  	MCU_UNI_CMD_PP = 0x38,
  	MCU_UNI_CMD_FIXED_RATE_TABLE = 0x40,
  	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
@@ -28,12 +28,12 @@
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
  	MCU_UNI_CMD_PER_STA_INFO = 0x6d,
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 80b9f6f9..454df971 100644
+index 31b8fd1a..5ff52577 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -356,6 +356,10 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
- 			return ret;
- 	}
+@@ -489,6 +489,10 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
+ 	if (ret < 0)
+ 		return ret;
  
 +	ret = mt7996_eeprom_load_precal(dev);
 +	if (ret)
@@ -43,7 +43,7 @@
  	if (ret < 0)
  		return ret;
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 849b8bca..58179c0c 100644
+index c1cad4f9..b3b9b854 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -25,6 +25,8 @@ enum mt7996_eeprom_field {
@@ -56,10 +56,10 @@
  
  #define MT_EE_WIFI_CONF0_TX_PATH		GENMASK(2, 0)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index ed7c7040..2749a5d7 100644
+index dc736a2d..a34e034d 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -987,6 +987,12 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
+@@ -1003,6 +1003,12 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
  	if (ret < 0)
  		return ret;
  
@@ -73,7 +73,7 @@
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7996_WTBL_STA);
  	if (idx)
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 040b8abd..342fedff 100644
+index b7ae6e1a..9ff9ae0e 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -310,6 +310,12 @@ int mt7996_set_channel(struct mt76_phy *mphy)
@@ -90,10 +90,10 @@
  		mt7996_tm_update_channel(phy);
  		goto out;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 763bdd73..a1573990 100644
+index 08534fec..b15075ab 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3636,6 +3636,172 @@ int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num)
+@@ -3650,6 +3650,172 @@ int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num)
  	return 0;
  }
  
@@ -267,10 +267,10 @@
  {
  #define NIC_CAP	3
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index c1159d69..da68daed 100644
+index 54b81c1e..8770839c 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -597,6 +597,9 @@ void mt7996_mcu_exit(struct mt7996_dev *dev);
+@@ -629,6 +629,9 @@ void mt7996_mcu_exit(struct mt7996_dev *dev);
  int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag);
  int mt7996_mcu_wed_rro_reset_sessions(struct mt7996_dev *dev, u16 id);
  int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0018-mtk-mt76-mt7996-enable-SCS-feature-for-mt7996-driver.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0018-mtk-mt76-mt7996-enable-SCS-feature-for-mt7996-driver.patch
index 645ed32..6d0dee2 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0018-mtk-mt76-mt7996-enable-SCS-feature-for-mt7996-driver.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0018-mtk-mt76-mt7996-enable-SCS-feature-for-mt7996-driver.patch
@@ -1,7 +1,7 @@
-From 3d349c01f30881c7ba9271f1f4eb686fee0a9315 Mon Sep 17 00:00:00 2001
+From 503baaaad8a49fcdcc2030a8eddacfec35c167b0 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 8 May 2023 09:03:50 +0800
-Subject: [PATCH 018/195] mtk: mt76: mt7996: enable SCS feature for mt7996
+Subject: [PATCH 018/223] mtk: mt76: mt7996: enable SCS feature for mt7996
  driver
 
 Enable Smart Carrier Sense algorithn by default to improve performance
@@ -20,10 +20,10 @@
  8 files changed, 148 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 5a116d0f..4c4fff39 100644
+index a7d7ecce..fcacd546 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1274,6 +1274,7 @@ enum {
+@@ -1279,6 +1279,7 @@ enum {
  	MCU_UNI_CMD_GET_STAT_INFO = 0x23,
  	MCU_UNI_CMD_SNIFFER = 0x24,
  	MCU_UNI_CMD_SR = 0x25,
@@ -32,10 +32,10 @@
  	MCU_UNI_CMD_SET_DBDC_PARMS = 0x28,
  	MCU_UNI_CMD_TXPOWER = 0x2b,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 2749a5d7..7e813960 100644
+index a34e034d..0a8e929a 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -1416,6 +1416,7 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1432,6 +1432,7 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	dev->mt76.phy.priv = &dev->phy;
  	INIT_WORK(&dev->rc_work, mt7996_mac_sta_rc_work);
  	INIT_DELAYED_WORK(&dev->mphy.mac_work, mt7996_mac_work);
@@ -44,10 +44,10 @@
  	INIT_LIST_HEAD(&dev->twt_list);
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index a0fcd8aa..fd8bce0e 100644
+index d73644f6..789caa44 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1804,6 +1804,7 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
+@@ -1815,6 +1815,7 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
  		cancel_delayed_work_sync(&phy2->mt76->mac_work);
  	if (phy3)
  		cancel_delayed_work_sync(&phy3->mt76->mac_work);
@@ -55,7 +55,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
  	for (i = 0; i < 10; i++) {
-@@ -1839,6 +1840,7 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
+@@ -1850,6 +1851,7 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
  		ieee80211_queue_delayed_work(phy3->mt76->hw,
  					     &phy3->mt76->mac_work,
  					     MT7996_WATCHDOG_TIME);
@@ -64,7 +64,7 @@
  
  void mt7996_mac_reset_work(struct work_struct *work)
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 342fedff..41975565 100644
+index 9ff9ae0e..a1c3874c 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -81,11 +81,17 @@ int mt7996_run(struct ieee80211_hw *hw)
@@ -85,7 +85,7 @@
  	if (!running)
  		mt7996_mac_reset_counters(phy);
  
-@@ -113,6 +119,7 @@ static void mt7996_stop(struct ieee80211_hw *hw)
+@@ -113,6 +119,7 @@ static void mt7996_stop(struct ieee80211_hw *hw, bool suspend)
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  
  	cancel_delayed_work_sync(&phy->mt76->mac_work);
@@ -94,10 +94,10 @@
  	mutex_lock(&dev->mt76.mutex);
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index a1573990..a24435ff 100644
+index b15075ab..98edae2c 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4818,3 +4818,108 @@ int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 da
+@@ -4832,3 +4832,108 @@ int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 da
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(TXPOWER),
  				 &req, sizeof(req), false);
  }
@@ -224,10 +224,10 @@
  #define MT7996_PATCH_SCRAMBLE_KEY	GENMASK(15, 8)
  #define MT7996_PATCH_AES_KEY		GENMASK(7, 0)
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index da68daed..7e3cea6e 100644
+index 8770839c..6cb6c724 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -233,6 +233,16 @@ struct mt7996_hif {
+@@ -243,6 +243,16 @@ struct mt7996_hif {
  	int irq;
  };
  
@@ -244,7 +244,7 @@
  struct mt7996_wed_rro_addr {
  	u32 head_low;
  	u32 head_high : 4;
-@@ -283,6 +293,8 @@ struct mt7996_phy {
+@@ -293,6 +303,8 @@ struct mt7996_phy {
  	u8 pp_mode;
  	u16 punct_bitmap;
  
@@ -253,7 +253,7 @@
  #ifdef CONFIG_NL80211_TESTMODE
  	struct {
  		u32 *reg_backup;
-@@ -329,6 +341,7 @@ struct mt7996_dev {
+@@ -339,6 +351,7 @@ struct mt7996_dev {
  	struct work_struct rc_work;
  	struct work_struct dump_work;
  	struct work_struct reset_work;
@@ -261,7 +261,7 @@
  	wait_queue_head_t reset_wait;
  	struct {
  		u32 state;
-@@ -603,6 +616,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy);
+@@ -635,6 +648,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy);
  #ifdef CONFIG_NL80211_TESTMODE
  void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb);
  #endif
@@ -271,7 +271,7 @@
  static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
  {
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 64952a73..8c576bac 100644
+index d1f3d16c..1807a744 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2429,6 +2429,16 @@ static int mt7996_token_read(struct seq_file *s, void *data)
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0019-mtk-mt76-mt7996-add-txpower-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0019-mtk-mt76-mt7996-add-txpower-support.patch
index 165a509..9c4eeda 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0019-mtk-mt76-mt7996-add-txpower-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0019-mtk-mt76-mt7996-add-txpower-support.patch
@@ -1,7 +1,7 @@
-From 07066d1b9dad62dfe8a77f85c1ddea4a6c390bf7 Mon Sep 17 00:00:00 2001
+From 5d3b2dafbf6b343983b999b19e94ad175c374bd3 Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Fri, 24 Mar 2023 23:35:30 +0800
-Subject: [PATCH 019/195] mtk: mt76: mt7996: add txpower support
+Subject: [PATCH 019/223] mtk: mt76: mt7996: add txpower support
 
 Add single sku and default enable sku.
 
@@ -15,6 +15,7 @@
 
 Fix wrong power value when user set limit close to path table limit.
 
+Change-Id: I5738cd3730f041f1f42d582e2b62d39b70861376
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Signed-off-by: Allen Ye <allen.ye@mediatek.com>
 ---
@@ -35,10 +36,10 @@
  14 files changed, 725 insertions(+), 27 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index a0047d79..11efe293 100644
+index 6bd2cc1a..85935dea 100644
 --- a/eeprom.c
 +++ b/eeprom.c
-@@ -305,9 +305,10 @@ mt76_apply_array_limit(s8 *pwr, size_t pwr_len, const __be32 *data,
+@@ -320,9 +320,10 @@ mt76_apply_array_limit(s8 *pwr, size_t pwr_len, const __be32 *data,
  static void
  mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
  			     const __be32 *data, size_t len, s8 target_power,
@@ -50,7 +51,7 @@
  
  	if (!data)
  		return;
-@@ -319,7 +320,7 @@ mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
+@@ -334,7 +335,7 @@ mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
  			break;
  
  		mt76_apply_array_limit(pwr + pwr_len * i, pwr_len, data + 1,
@@ -59,7 +60,7 @@
  		if (--cur > 0)
  			continue;
  
-@@ -335,6 +336,7 @@ mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
+@@ -350,6 +351,7 @@ mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
  s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  			      struct ieee80211_channel *chan,
  			      struct mt76_power_limits *dest,
@@ -67,7 +68,7 @@
  			      s8 target_power)
  {
  	struct mt76_dev *dev = phy->dev;
-@@ -342,16 +344,20 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+@@ -357,16 +359,20 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  	const __be32 *val;
  	char name[16];
  	u32 mcs_rates = dev->drv->mcs_rates;
@@ -91,7 +92,7 @@
  
  	if (!IS_ENABLED(CONFIG_OF))
  		return target_power;
-@@ -397,12 +403,44 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+@@ -412,12 +418,44 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  	val = mt76_get_of_array(np, "rates-mcs", &len, mcs_rates + 1);
  	mt76_apply_multi_array_limit(dest->mcs[0], ARRAY_SIZE(dest->mcs[0]),
  				     ARRAY_SIZE(dest->mcs), val, len,
@@ -140,10 +141,10 @@
  	return max_power;
  }
 diff --git a/mt76.h b/mt76.h
-index 6086872e..d04a9504 100644
+index 8666ec2f..ac2de858 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1077,6 +1077,14 @@ struct mt76_power_limits {
+@@ -1079,6 +1079,14 @@ struct mt76_power_limits {
  	s8 eht[16][16];
  };
  
@@ -158,7 +159,7 @@
  struct mt76_ethtool_worker_info {
  	u64 *data;
  	int idx;
-@@ -1693,6 +1701,7 @@ mt76_find_channel_node(struct device_node *np, struct ieee80211_channel *chan);
+@@ -1694,6 +1702,7 @@ mt76_find_channel_node(struct device_node *np, struct ieee80211_channel *chan);
  s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  			      struct ieee80211_channel *chan,
  			      struct mt76_power_limits *dest,
@@ -167,10 +168,10 @@
  
  static inline bool mt76_queue_is_rx(struct mt76_dev *dev, struct mt76_queue *q)
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 26a8acec..45510fa5 100644
+index 07f52dd6..c7145074 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -2157,7 +2157,7 @@ mt76_connac_mcu_rate_txpower_band(struct mt76_phy *phy,
+@@ -2160,7 +2160,7 @@ mt76_connac_mcu_rate_txpower_band(struct mt76_phy *phy,
  			sar_power = mt76_get_sar_power(phy, &chan, reg_power);
  
  			mt76_get_rate_power_limits(phy, &chan, limits,
@@ -180,10 +181,10 @@
  			tx_power_tlv.last_msg = ch_list[idx] == last_ch;
  			sku_tlbv.channel = ch_list[idx];
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 454df971..17485bfc 100644
+index 5ff52577..b091e30c 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -408,3 +408,37 @@ s8 mt7996_eeprom_get_power_delta(struct mt7996_dev *dev, int band)
+@@ -541,3 +541,37 @@ s8 mt7996_eeprom_get_power_delta(struct mt7996_dev *dev, int band)
  
  	return val & MT_EE_RATE_DELTA_SIGN ? delta : -delta;
  }
@@ -222,10 +223,10 @@
 +	[SKU_EHT3x996_484] = 16,
 +};
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 58179c0c..b19ff068 100644
+index b3b9b854..f3a9618b 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
-@@ -125,4 +125,46 @@ mt7996_get_channel_group_6g(int channel)
+@@ -127,4 +127,46 @@ mt7996_get_channel_group_6g(int channel)
  	return DIV_ROUND_UP(channel - 29, 32);
  }
  
@@ -273,7 +274,7 @@
 +
  #endif
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 7e813960..3b816070 100644
+index 0a8e929a..994d74cc 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -297,7 +297,12 @@ static void __mt7996_init_txpower(struct mt7996_phy *phy,
@@ -311,7 +312,7 @@
  	}
  }
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 41975565..6e4fc21d 100644
+index a1c3874c..e65b5bd7 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -85,6 +85,21 @@ int mt7996_run(struct ieee80211_hw *hw)
@@ -337,10 +338,10 @@
  
  	ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index a24435ff..d50c757d 100644
+index 98edae2c..59a24478 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4670,9 +4670,31 @@ int mt7996_mcu_wed_rro_reset_sessions(struct mt7996_dev *dev, u16 id)
+@@ -4684,9 +4684,31 @@ int mt7996_mcu_wed_rro_reset_sessions(struct mt7996_dev *dev, u16 id)
  				 sizeof(req), true);
  }
  
@@ -372,7 +373,7 @@
  	struct mt7996_dev *dev = phy->dev;
  	struct mt76_phy *mphy = phy->mt76;
  	struct ieee80211_hw *hw = mphy->hw;
-@@ -4692,13 +4714,22 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
+@@ -4706,13 +4728,22 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
  		.band_idx = phy->mt76->band_idx,
  	};
  	struct mt76_power_limits la = {};
@@ -400,7 +401,7 @@
  
  	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
  				 sizeof(req) + MT7996_SKU_PATH_NUM);
-@@ -4728,6 +4759,34 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
+@@ -4742,6 +4773,34 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
  	/* padding */
  	skb_put_zero(skb, MT7996_SKU_PATH_NUM - MT7996_SKU_RATE_NUM);
  
@@ -456,10 +457,10 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 7e3cea6e..547d3654 100644
+index 6cb6c724..a1a30b33 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -295,6 +295,9 @@ struct mt7996_phy {
+@@ -305,6 +305,9 @@ struct mt7996_phy {
  
  	struct mt7996_scs_ctrl scs_ctrl;
  
@@ -469,7 +470,7 @@
  #ifdef CONFIG_NL80211_TESTMODE
  	struct {
  		u32 *reg_backup;
-@@ -616,6 +619,7 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy);
+@@ -648,6 +651,7 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy);
  #ifdef CONFIG_NL80211_TESTMODE
  void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb);
  #endif
@@ -478,7 +479,7 @@
  void mt7996_mcu_scs_sta_poll(struct work_struct *work);
  
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 8c576bac..3558641c 100644
+index 1807a744..ad89eccd 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2439,6 +2439,364 @@ mt7996_scs_enable_set(void *data, u64 val)
@@ -998,10 +999,10 @@
  
  #endif
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 4c20a67d..8ec1dc1c 100644
+index 3450a2fc..539e799c 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
-@@ -693,24 +693,29 @@ enum offs_rev {
+@@ -695,24 +695,29 @@ enum offs_rev {
  						 ((_wf) << 16) + (ofs))
  #define MT_WF_PHYRX_CSD_IRPI(_band, _wf)	MT_WF_PHYRX_CSD(_band, _wf, 0x1000)
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0020-mtk-mt76-mt7996-add-binfile-mode-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0020-mtk-mt76-mt7996-add-binfile-mode-support.patch
index 4036866..c4f105c 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0020-mtk-mt76-mt7996-add-binfile-mode-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0020-mtk-mt76-mt7996-add-binfile-mode-support.patch
@@ -1,7 +1,7 @@
-From 9766b0cd3d2743aca078c4f1f4fd8ab83608e259 Mon Sep 17 00:00:00 2001
+From edd667417d5bf86af2b0c04679782614a6b8ef8f Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 31 Mar 2023 11:36:34 +0800
-Subject: [PATCH 020/195] mtk: mt76: mt7996: add binfile mode support
+Subject: [PATCH 020/223] mtk: mt76: mt7996: add binfile mode support
 
 Fix binfile cannot sync precal data to atenl
 Binfile is viewed as efuse mode in atenl, so atenl does not allocate
@@ -11,19 +11,21 @@
 
 Align upstream
 
+Change-Id: I06369a46f75c0707d9ababd8ade70d79a89b1a1c
+Change-Id: I4c8fd2b0a9956d2ee961b70cd28973e2e9410aca
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
- eeprom.c             |  25 +++++++++++
- mt76.h               |   3 ++
- mt7996/eeprom.c      | 103 ++++++++++++++++++++++++++++++++++++++++---
- mt7996/eeprom.h      |   7 +++
- mt7996/mt7996.h      |   3 ++
- mt7996/mtk_debugfs.c |  41 +++++++++++++++++
- testmode.h           |   2 +-
- 7 files changed, 178 insertions(+), 6 deletions(-)
+ eeprom.c             | 25 +++++++++++++++
+ mt76.h               |  3 ++
+ mt7996/eeprom.c      | 76 ++++++++++++++++++++++++++++++++++++++------
+ mt7996/eeprom.h      |  7 ++++
+ mt7996/mt7996.h      |  3 ++
+ mt7996/mtk_debugfs.c | 41 ++++++++++++++++++++++++
+ testmode.h           |  2 +-
+ 7 files changed, 147 insertions(+), 10 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 11efe293..3da94926 100644
+index 85935dea..4eb27782 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -161,6 +161,31 @@ static int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int len)
@@ -59,10 +61,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index d04a9504..19e837ee 100644
+index ac2de858..924f273b 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -971,6 +971,8 @@ struct mt76_dev {
+@@ -973,6 +973,8 @@ struct mt76_dev {
  		struct mt76_usb usb;
  		struct mt76_sdio sdio;
  	};
@@ -71,7 +73,7 @@
  };
  
  #define MT76_MAX_AMSDU_NUM 8
-@@ -1244,6 +1246,7 @@ void mt76_eeprom_override(struct mt76_phy *phy);
+@@ -1246,6 +1248,7 @@ void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_data_from_mtd(struct mt76_dev *dev, void *eep, int offset, int len);
  int mt76_get_of_data_from_nvmem(struct mt76_dev *dev, void *eep,
  				const char *cell_name, int len);
@@ -80,7 +82,7 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 17485bfc..5dc55646 100644
+index b091e30c..111fe401 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -82,10 +82,17 @@ static int mt7996_check_eeprom(struct mt7996_dev *dev)
@@ -103,8 +105,8 @@
 +	}
  
  	switch (mt76_chip(&dev->mt76)) {
- 	case 0x7990:
-@@ -152,7 +159,10 @@ mt7996_eeprom_load_default(struct mt7996_dev *dev)
+ 	case 0x7992:
+@@ -234,7 +241,10 @@ mt7996_eeprom_check_or_use_default(struct mt7996_dev *dev, bool use_default)
  		return ret;
  
  	if (!fw || !fw->data) {
@@ -116,75 +118,32 @@
  		ret = -EINVAL;
  		goto out;
  	}
-@@ -166,18 +176,45 @@ out:
- 	return ret;
- }
- 
-+static int mt7996_eeprom_load_flash(struct mt7996_dev *dev)
-+{
-+	int ret = 1;
-+
-+	/* return > 0 for load success, return 0 for load failed, return < 0 for non memory */
-+	dev->bin_file_mode = mt76_check_bin_file_mode(&dev->mt76);
-+	if (dev->bin_file_mode) {
-+		dev->mt76.eeprom.size = MT7996_EEPROM_SIZE;
-+		dev->mt76.eeprom.data = devm_kzalloc(dev->mt76.dev, dev->mt76.eeprom.size,
-+						     GFP_KERNEL);
-+		if (!dev->mt76.eeprom.data)
-+			return -ENOMEM;
-+
-+		if (mt7996_eeprom_load_default(dev))
-+			return 0;
-+
-+		if (mt7996_check_eeprom(dev))
-+			return 0;
-+	} else {
-+		ret = mt76_eeprom_init(&dev->mt76, MT7996_EEPROM_SIZE);
-+	}
-+
-+	return ret;
-+}
-+
- int mt7996_eeprom_check_fw_mode(struct mt7996_dev *dev)
- {
- 	u8 *eeprom;
- 	int ret;
- 
- 	/* load eeprom in flash or bin file mode to determine fw mode */
--	ret = mt76_eeprom_init(&dev->mt76, MT7996_EEPROM_SIZE);
-+	ret = mt7996_eeprom_load_flash(dev);
-+
- 	if (ret < 0)
- 		return ret;
- 
- 	if (ret) {
- 		dev->flash_mode = true;
-+		dev->eeprom_mode = dev->bin_file_mode ? BIN_FILE_MODE : FLASH_MODE;
- 		eeprom = dev->mt76.eeprom.data;
- 		/* testmode enable priority: eeprom field > module parameter */
- 		dev->testmode_enable = !mt7996_check_eeprom(dev) ? eeprom[MT_EE_TESTMODE_EN] :
-@@ -211,6 +248,7 @@ static int mt7996_eeprom_load(struct mt7996_dev *dev)
- 			if (ret && ret != -EINVAL)
- 				return ret;
+@@ -369,6 +379,7 @@ static int mt7996_eeprom_load(struct mt7996_dev *dev)
+ 				goto out;
+ 			}
  		}
 +		dev->eeprom_mode = EFUSE_MODE;
  	}
  
- 	return mt7996_check_eeprom(dev);
-@@ -337,6 +375,59 @@ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy)
+ out:
+@@ -477,22 +488,69 @@ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy)
  	return mt7996_eeprom_parse_band_config(phy);
  }
  
+-int mt7996_eeprom_init(struct mt7996_dev *dev)
 +static int
 +mt7996_eeprom_load_precal_binfile(struct mt7996_dev *dev, u32 offs, u32 size)
-+{
+ {
 +	const struct firmware *fw = NULL;
-+	int ret;
-+
+ 	int ret;
+ 
+-	ret = mt7996_get_chip_sku(dev);
 +	ret = request_firmware(&fw, dev->mt76.bin_file_name, dev->mt76.dev);
-+	if (ret)
-+		return ret;
-+
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = mt7996_eeprom_load(dev);
+-	if (ret < 0)
 +	if (!fw || !fw->data) {
 +		dev_err(dev->mt76.dev, "Invalid bin (bin file mode), load precal fail\n");
 +		ret = -EINVAL;
@@ -223,28 +182,30 @@
 +
 +	ret = mt76_get_of_data_from_mtd(mdev, dev->cal, offs, size);
 +	if (!ret)
-+		return ret;
-+
+ 		return ret;
+ 
+-	ret = mt7996_eeprom_load_precal(dev);
 +	return mt76_get_of_data_from_nvmem(mdev, dev->cal, "precal", size);
 +}
 +
- int mt7996_eeprom_init(struct mt7996_dev *dev)
- {
- 	int ret;
-@@ -351,6 +442,8 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
- 			return ret;
++int mt7996_eeprom_init(struct mt7996_dev *dev)
++{
++	int ret;
++
++	ret = mt7996_eeprom_load(dev);
+ 	if (ret)
+ 		return ret;
  
- 		dev_warn(dev->mt76.dev, "eeprom load fail, use default bin\n");
-+		dev->bin_file_mode = false;
-+		dev->eeprom_mode = DEFAULT_BIN_MODE;
- 		ret = mt7996_eeprom_load_default(dev);
- 		if (ret)
- 			return ret;
++	mt7996_eeprom_load_precal(dev);
++
+ 	ret = mt7996_eeprom_parse_hw_cap(dev, &dev->phy);
+ 	if (ret < 0)
+ 		return ret;
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index b19ff068..8f0f87b6 100644
+index f3a9618b..e90180a0 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
-@@ -102,6 +102,13 @@ enum mt7996_eeprom_band {
+@@ -104,6 +104,13 @@ enum mt7996_eeprom_band {
  	MT_EE_BAND_SEL_6GHZ,
  };
  
@@ -259,10 +220,10 @@
  mt7996_get_channel_group_5g(int channel)
  {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 547d3654..8342a340 100644
+index a1a30b33..efb4e74c 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -394,6 +394,8 @@ struct mt7996_dev {
+@@ -404,6 +404,8 @@ struct mt7996_dev {
  	} wed_rro;
  
  	bool testmode_enable;
@@ -271,7 +232,7 @@
  
  	bool ibf;
  	u8 fw_debug_wm;
-@@ -522,6 +524,7 @@ irqreturn_t mt7996_irq_handler(int irq, void *dev_instance);
+@@ -554,6 +556,7 @@ irqreturn_t mt7996_irq_handler(int irq, void *dev_instance);
  u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif);
  int mt7996_register_device(struct mt7996_dev *dev);
  void mt7996_unregister_device(struct mt7996_dev *dev);
@@ -280,7 +241,7 @@
  int mt7996_eeprom_check_fw_mode(struct mt7996_dev *dev);
  int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 3558641c..c096fb6c 100644
+index ad89eccd..078ff279 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2797,6 +2797,44 @@ static const struct file_operations mt7996_txpower_path_fops = {
@@ -339,7 +300,7 @@
  				    mt7996_wtbl_read);
  
 diff --git a/testmode.h b/testmode.h
-index d6601cdc..5d677f8c 100644
+index 3348d0d5..6d79832a 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -16,7 +16,7 @@
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0021-mtk-mt76-mt7996-add-testmode-ZWDFS-verification-supp.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0021-mtk-mt76-mt7996-add-testmode-ZWDFS-verification-supp.patch
index 786ae44..3178946 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0021-mtk-mt76-mt7996-add-testmode-ZWDFS-verification-supp.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0021-mtk-mt76-mt7996-add-testmode-ZWDFS-verification-supp.patch
@@ -1,7 +1,7 @@
-From c52377928da48fff8b3b2fa128f8eb1ead6ba206 Mon Sep 17 00:00:00 2001
+From 0ae2d7c2cf18d4ca07b05c7ea14fc0c2ea9e5ad7 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 22 Mar 2023 11:19:52 +0800
-Subject: [PATCH 021/195] mtk: mt76: mt7996: add testmode ZWDFS verification
+Subject: [PATCH 021/223] mtk: mt76: mt7996: add testmode ZWDFS verification
  support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -15,10 +15,10 @@
  6 files changed, 326 insertions(+), 12 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 19e837ee..e25fe82c 100644
+index 924f273b..2805d758 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -799,6 +799,14 @@ struct mt76_testmode_data {
+@@ -801,6 +801,14 @@ struct mt76_testmode_data {
  	} cfg;
  
  	u8 aid;
@@ -34,10 +34,10 @@
  
  struct mt76_vif {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 8342a340..a679fd18 100644
+index efb4e74c..1fe681cf 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -287,6 +287,7 @@ struct mt7996_phy {
+@@ -297,6 +297,7 @@ struct mt7996_phy {
  
  	struct mt76_mib_stats mib;
  	struct mt76_channel_state state_ts;
@@ -46,7 +46,7 @@
  	bool has_aux_rx;
  
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index a756ee10..836211f9 100644
+index 6969cba6..c4874eb3 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
 @@ -17,6 +17,12 @@ enum {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0022-mtk-mt76-mt7996-support-eagle-ZWDFS-on-iFEM.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0022-mtk-mt76-mt7996-support-eagle-ZWDFS-on-iFEM.patch
index 78b87d7..4bc7d88 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0022-mtk-mt76-mt7996-support-eagle-ZWDFS-on-iFEM.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0022-mtk-mt76-mt7996-support-eagle-ZWDFS-on-iFEM.patch
@@ -1,7 +1,7 @@
-From 3dff3d01f3c2b20a493b1cf74531f8cf193c60aa Mon Sep 17 00:00:00 2001
+From 0ed31af01bf9c0f5f040222fabee17af063f9eb8 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 5 Jul 2023 10:00:17 +0800
-Subject: [PATCH 022/195] mtk: mt76: mt7996: support eagle ZWDFS on iFEM
+Subject: [PATCH 022/223] mtk: mt76: mt7996: support eagle ZWDFS on iFEM
 
 Fix the case that control channel is not first chan during first
 interface setup.
@@ -15,7 +15,7 @@
  3 files changed, 67 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 6e4fc21d..f279cbd4 100644
+index e65b5bd7..ad4cd5dd 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1433,6 +1433,61 @@ mt7996_twt_teardown_request(struct ieee80211_hw *hw,
@@ -117,10 +117,10 @@
  		goto out;
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index d50c757d..a78c0707 100644
+index 59a24478..7ef6bb1f 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -372,12 +372,14 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -382,12 +382,14 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
  	if (!mphy)
  		return;
  
@@ -138,10 +138,10 @@
  }
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index a679fd18..2eeb8d12 100644
+index 1fe681cf..2ec72496 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -397,6 +397,7 @@ struct mt7996_dev {
+@@ -407,6 +407,7 @@ struct mt7996_dev {
  	bool testmode_enable;
  	bool bin_file_mode;
  	u8 eeprom_mode;
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0023-mtk-mt76-mt7996-refactor-eeprom-loading-flow-for-sku.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0023-mtk-mt76-mt7996-refactor-eeprom-loading-flow-for-sku.patch
index c99386d..b8a0ee1 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0023-mtk-mt76-mt7996-refactor-eeprom-loading-flow-for-sku.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0023-mtk-mt76-mt7996-refactor-eeprom-loading-flow-for-sku.patch
@@ -1,7 +1,7 @@
-From dc6ae38816bcdc401886ebcdc3c1c7825ed6cc02 Mon Sep 17 00:00:00 2001
+From f23ac5fb50b0764391e2aebeab3c748eb46a5dbf Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 11 Mar 2024 10:43:03 +0800
-Subject: [PATCH 023/195] mtk: mt76: mt7996: refactor eeprom loading flow for
+Subject: [PATCH 023/223] mtk: mt76: mt7996: refactor eeprom loading flow for
  sku checking
 
 Add eeprom sku checking mechanism to avoid using the
@@ -28,20 +28,19 @@
 2.
 Add Eagle BE19000 ifem default bin, add Eagle default bin bootstrip
 
+Change-Id: If1905086f2a876a593d07f23a5facad35067f94a
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
- mt7996/eeprom.c      | 207 ++++++++++++++++++++++++-------------------
- mt7996/eeprom.h      |  32 +++++++
- mt7996/mcu.c         |  18 +---
- mt7996/mt7996.h      |   1 +
- mt7996/mtk_debugfs.c |   2 +-
- 5 files changed, 150 insertions(+), 110 deletions(-)
+ mt7996/eeprom.c      | 37 +++----------------------------------
+ mt7996/mcu.c         |  2 +-
+ mt7996/mtk_debugfs.c |  3 +--
+ 3 files changed, 5 insertions(+), 37 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 5dc55646..f4641321 100644
+index 111fe401..da30be33 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -50,54 +50,84 @@ const u32 dpd_6g_bw320_ch_num = ARRAY_SIZE(dpd_6g_ch_list_bw320);
+@@ -50,33 +50,14 @@ const u32 dpd_6g_bw320_ch_num = ARRAY_SIZE(dpd_6g_ch_list_bw320);
  
  static int mt7996_check_eeprom(struct mt7996_dev *dev)
  {
@@ -76,98 +75,24 @@
  	default:
  		return -EINVAL;
  	}
- }
+@@ -84,16 +65,6 @@ static int mt7996_check_eeprom(struct mt7996_dev *dev)
  
--const char *mt7996_eeprom_name(struct mt7996_dev *dev)
-+static int mt7996_check_eeprom_sku(struct mt7996_dev *dev, const u8 *dflt)
+ const char *mt7996_eeprom_name(struct mt7996_dev *dev)
  {
 -	if (dev->bin_file_mode)
 -		return dev->mt76.bin_file_name;
-+#define FEM_INT				0
-+#define FEM_EXT				3
-+	u8 *eeprom = dev->mt76.eeprom.data;
-+	u8 i, fem[__MT_MAX_BAND], fem_type;
-+	u16 mac_addr[__MT_MAX_BAND] = {MT_EE_MAC_ADDR, MT_EE_MAC_ADDR2, MT_EE_MAC_ADDR3};
-+	int max_band = is_mt7996(&dev->mt76) ? __MT_MAX_BAND : 2;
-+
-+	if (dev->fem_type == MT7996_FEM_UNSET)
-+		return -EINVAL;
-+
-+	/* FEM type */
-+	for (i = 0; i < max_band; i++)
-+		fem[i] = eeprom[MT_EE_WIFI_CONF + 6 + i] & MT_EE_WIFI_PA_LNA_CONFIG;
-+
-+	if (fem[0] == FEM_EXT && fem[1] == FEM_EXT)
-+		fem_type = MT7996_FEM_EXT;
-+	else if (fem[0] == FEM_INT && fem[1] == FEM_INT)
-+		fem_type = MT7996_FEM_INT;
-+	else if (fem[0] == FEM_INT && fem[1] == FEM_EXT)
-+		fem_type = MT7996_FEM_MIX;
-+	else
-+		return -EINVAL;
- 
+-
 -	if (dev->testmode_enable) {
 -		if (is_mt7992(&dev->mt76))
 -			return MT7992_EEPROM_DEFAULT_TM;
 -		else
 -			return MT7996_EEPROM_DEFAULT_TM;
-+	if (dev->fem_type != fem_type)
-+		return -EINVAL;
-+
-+	/* RF path & stream */
-+	for (i = 0; i < max_band; i++) {
-+		u8 path, rx_path, nss;
-+		u8 dflt_path, dflt_rx_path, dflt_nss;
-+
-+		/* MAC address */
-+		if (ether_addr_equal(eeprom + mac_addr[i], dflt + mac_addr[i]))
-+			dev_warn(dev->mt76.dev,
-+				 "Currently using default MAC address for band %d\n", i);
-+
-+		mt7996_parse_eeprom_stream(eeprom, i, &path, &rx_path, &nss);
-+		mt7996_parse_eeprom_stream(dflt, i, &dflt_path, &dflt_rx_path, &dflt_nss);
-+		if (path > dflt_path || rx_path > dflt_rx_path || nss > dflt_nss) {
-+			dev_err(dev->mt76.dev,
-+				"Invalid path/stream configuration for band %d\n", i);
-+			return -EINVAL;
-+		} else if (path < dflt_path || rx_path < dflt_rx_path || nss < dflt_nss) {
-+			dev_warn(dev->mt76.dev,
-+				 "Restricted path/stream configuration for band %d\n", i);
-+			dev_warn(dev->mt76.dev,
-+				 "path: %u/%u, rx_path: %u/%u, nss: %u/%u\n",
-+				 path, dflt_path, rx_path, dflt_rx_path, nss, dflt_nss);
-+		}
- 	}
- 
-+	return 0;
-+}
-+
-+const char *mt7996_eeprom_name(struct mt7996_dev *dev)
-+{
+-	}
+-
  	switch (mt76_chip(&dev->mt76)) {
- 	case 0x7990:
- 		if (dev->chip_sku == MT7996_SKU_404)
- 			return MT7996_EEPROM_DEFAULT_404;
-+
-+		if (dev->fem_type == MT7996_FEM_INT)
-+			return MT7996_EEPROM_DEFAULT_INT;
- 		return MT7996_EEPROM_DEFAULT;
  	case 0x7992:
- 		if (dev->chip_sku == MT7992_SKU_23) {
-@@ -148,21 +178,18 @@ mt7996_get_dpd_per_band_size(struct mt7996_dev *dev, enum nl80211_band band)
- }
- 
- static int
--mt7996_eeprom_load_default(struct mt7996_dev *dev)
-+mt7996_eeprom_load_bin(struct mt7996_dev *dev)
- {
- 	u8 *eeprom = dev->mt76.eeprom.data;
- 	const struct firmware *fw = NULL;
- 	int ret;
- 
--	ret = request_firmware(&fw, mt7996_eeprom_name(dev), dev->mt76.dev);
-+	ret = request_firmware(&fw, dev->mt76.bin_file_name, dev->mt76.dev);
- 	if (ret)
+ 		switch (dev->var.type) {
+@@ -241,10 +212,7 @@ mt7996_eeprom_check_or_use_default(struct mt7996_dev *dev, bool use_default)
  		return ret;
  
  	if (!fw || !fw->data) {
@@ -175,286 +100,44 @@
 -			dev_err(dev->mt76.dev, "Invalid bin (bin file mode)\n");
 -		else
 -			dev_err(dev->mt76.dev, "Invalid default bin\n");
-+		dev_err(dev->mt76.dev, "Invalid bin %s\n", dev->mt76.bin_file_name);
++		dev_err(dev->mt76.dev, "Invalid default bin\n");
  		ret = -EINVAL;
  		goto out;
  	}
-@@ -180,7 +207,7 @@ static int mt7996_eeprom_load_flash(struct mt7996_dev *dev)
- {
- 	int ret = 1;
- 
--	/* return > 0 for load success, return 0 for load failed, return < 0 for non memory */
-+	/* return > 0 for load success, return 0 for load failed, return < 0 for no memory */
- 	dev->bin_file_mode = mt76_check_bin_file_mode(&dev->mt76);
- 	if (dev->bin_file_mode) {
- 		dev->mt76.eeprom.size = MT7996_EEPROM_SIZE;
-@@ -189,15 +216,15 @@ static int mt7996_eeprom_load_flash(struct mt7996_dev *dev)
- 		if (!dev->mt76.eeprom.data)
- 			return -ENOMEM;
- 
--		if (mt7996_eeprom_load_default(dev))
--			return 0;
--
--		if (mt7996_check_eeprom(dev))
-+		if (mt7996_eeprom_load_bin(dev))
- 			return 0;
- 	} else {
- 		ret = mt76_eeprom_init(&dev->mt76, MT7996_EEPROM_SIZE);
- 	}
- 
-+	if (mt7996_check_eeprom(dev))
-+		return 0;
-+
- 	return ret;
- }
- 
-@@ -206,30 +233,30 @@ int mt7996_eeprom_check_fw_mode(struct mt7996_dev *dev)
- 	u8 *eeprom;
- 	int ret;
- 
-+	dev->testmode_enable = testmode_enable;
-+
- 	/* load eeprom in flash or bin file mode to determine fw mode */
- 	ret = mt7996_eeprom_load_flash(dev);
-+	if (ret <= 0)
-+		goto out;
- 
--	if (ret < 0)
--		return ret;
--
--	if (ret) {
--		dev->flash_mode = true;
--		dev->eeprom_mode = dev->bin_file_mode ? BIN_FILE_MODE : FLASH_MODE;
--		eeprom = dev->mt76.eeprom.data;
--		/* testmode enable priority: eeprom field > module parameter */
--		dev->testmode_enable = !mt7996_check_eeprom(dev) ? eeprom[MT_EE_TESTMODE_EN] :
--								   testmode_enable;
--	}
-+	dev->flash_mode = true;
-+	dev->eeprom_mode = dev->bin_file_mode ? BIN_FILE_MODE : FLASH_MODE;
-+	eeprom = dev->mt76.eeprom.data;
-+	/* testmode enable priority: eeprom field > module parameter */
-+	dev->testmode_enable = eeprom[MT_EE_TESTMODE_EN];
- 
-+out:
- 	return ret;
- }
+@@ -254,6 +222,7 @@ mt7996_eeprom_check_or_use_default(struct mt7996_dev *dev, bool use_default)
  
- static int mt7996_eeprom_load(struct mt7996_dev *dev)
- {
-+	const struct firmware *fw = NULL;
- 	int ret;
--	u8 free_block_num;
- 	u32 block_num, i;
- 	u32 eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;
-+	u8 free_block_num, *eeprom = dev->mt76.eeprom.data;
- 
- 	/* flash or bin file mode eeprom is loaded before mcu init */
- 	if (!dev->flash_mode) {
-@@ -239,19 +266,49 @@ static int mt7996_eeprom_load(struct mt7996_dev *dev)
- 
- 		/* efuse info isn't enough */
- 		if (free_block_num >= 59)
--			return -EINVAL;
-+			goto dflt;
-+
-+		memset(eeprom, 0, MT7996_EEPROM_SIZE);
-+		/* check if efuse contains valid eeprom data */
-+		if (mt7996_mcu_get_eeprom(dev, 0, NULL) ||
-+		    mt7996_check_eeprom(dev))
-+			goto dflt;
- 
- 		/* read eeprom data from efuse */
- 		block_num = DIV_ROUND_UP(MT7996_EEPROM_SIZE, eeprom_blk_size);
--		for (i = 0; i < block_num; i++) {
-+		for (i = 1; i < block_num; i++) {
- 			ret = mt7996_mcu_get_eeprom(dev, i * eeprom_blk_size, NULL);
- 			if (ret && ret != -EINVAL)
--				return ret;
-+				goto dflt;
- 		}
- 		dev->eeprom_mode = EFUSE_MODE;
- 	}
- 
--	return mt7996_check_eeprom(dev);
-+dflt:
-+	ret = request_firmware(&fw, mt7996_eeprom_name(dev), dev->mt76.dev);
-+	if (ret)
-+		return ret;
-+
-+	if (!fw || !fw->data) {
-+		dev_err(dev->mt76.dev, "Invalid default bin\n");
-+		ret = -EINVAL;
-+		goto out;
-+	}
-+
-+	if (dev->eeprom_mode && !mt7996_check_eeprom_sku(dev, fw->data)) {
-+		ret = 0;
-+		goto out;
-+	}
-+
-+	memcpy(eeprom, fw->data, MT7996_EEPROM_SIZE);
+ 	dev_warn(dev->mt76.dev, "eeprom load fail, use default bin\n");
+ 	memcpy(eeprom, fw->data, MT7996_EEPROM_SIZE);
 +	dev->bin_file_mode = false;
-+	dev->flash_mode = true;
-+	dev->eeprom_mode = DEFAULT_BIN_MODE;
-+	eeprom[MT_EE_TESTMODE_EN] = dev->testmode_enable;
-+	dev_warn(dev->mt76.dev, "eeprom load fail, use default bin\n");
-+out:
-+	release_firmware(fw);
-+	return ret;
- }
- 
- static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_dev *dev)
-@@ -323,32 +380,7 @@ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy)
- 	int max_path = 5, max_nss = 4;
- 	int ret;
- 
--	switch (band_idx) {
--	case MT_BAND1:
--		path = FIELD_GET(MT_EE_WIFI_CONF2_TX_PATH_BAND1,
--				 eeprom[MT_EE_WIFI_CONF + 2]);
--		rx_path = FIELD_GET(MT_EE_WIFI_CONF3_RX_PATH_BAND1,
--				    eeprom[MT_EE_WIFI_CONF + 3]);
--		nss = FIELD_GET(MT_EE_WIFI_CONF5_STREAM_NUM_BAND1,
--				eeprom[MT_EE_WIFI_CONF + 5]);
--		break;
--	case MT_BAND2:
--		path = FIELD_GET(MT_EE_WIFI_CONF2_TX_PATH_BAND2,
--				 eeprom[MT_EE_WIFI_CONF + 2]);
--		rx_path = FIELD_GET(MT_EE_WIFI_CONF4_RX_PATH_BAND2,
--				    eeprom[MT_EE_WIFI_CONF + 4]);
--		nss = FIELD_GET(MT_EE_WIFI_CONF5_STREAM_NUM_BAND2,
--				eeprom[MT_EE_WIFI_CONF + 5]);
--		break;
--	default:
--		path = FIELD_GET(MT_EE_WIFI_CONF1_TX_PATH_BAND0,
--				 eeprom[MT_EE_WIFI_CONF + 1]);
--		rx_path = FIELD_GET(MT_EE_WIFI_CONF3_RX_PATH_BAND0,
--				    eeprom[MT_EE_WIFI_CONF + 3]);
--		nss = FIELD_GET(MT_EE_WIFI_CONF4_STREAM_NUM_BAND0,
--				eeprom[MT_EE_WIFI_CONF + 4]);
--		break;
--	}
-+	mt7996_parse_eeprom_stream(eeprom, band_idx, &path, &rx_path, &nss);
- 
- 	if (!path || path > max_path)
- 		path = max_path;
-@@ -437,17 +469,8 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
- 		return ret;
- 
- 	ret = mt7996_eeprom_load(dev);
--	if (ret < 0) {
--		if (ret != -EINVAL)
--			return ret;
--
--		dev_warn(dev->mt76.dev, "eeprom load fail, use default bin\n");
--		dev->bin_file_mode = false;
--		dev->eeprom_mode = DEFAULT_BIN_MODE;
--		ret = mt7996_eeprom_load_default(dev);
--		if (ret)
--			return ret;
--	}
-+	if (ret)
-+		return ret;
- 
- 	ret = mt7996_eeprom_load_precal(dev);
- 	if (ret)
-diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 8f0f87b6..03a4fd07 100644
---- a/mt7996/eeprom.h
-+++ b/mt7996/eeprom.h
-@@ -132,6 +132,38 @@ mt7996_get_channel_group_6g(int channel)
- 	return DIV_ROUND_UP(channel - 29, 32);
- }
- 
-+static inline void
-+mt7996_parse_eeprom_stream(const u8 *eep, int band_idx,
-+			   u8 *path, u8 *rx_path, u8 *nss)
-+{
-+	switch (band_idx) {
-+	case MT_BAND1:
-+		*path = FIELD_GET(MT_EE_WIFI_CONF2_TX_PATH_BAND1,
-+				  eep[MT_EE_WIFI_CONF + 2]);
-+		*rx_path = FIELD_GET(MT_EE_WIFI_CONF3_RX_PATH_BAND1,
-+				     eep[MT_EE_WIFI_CONF + 3]);
-+		*nss = FIELD_GET(MT_EE_WIFI_CONF5_STREAM_NUM_BAND1,
-+				 eep[MT_EE_WIFI_CONF + 5]);
-+		break;
-+	case MT_BAND2:
-+		*path = FIELD_GET(MT_EE_WIFI_CONF2_TX_PATH_BAND2,
-+				  eep[MT_EE_WIFI_CONF + 2]);
-+		*rx_path = FIELD_GET(MT_EE_WIFI_CONF4_RX_PATH_BAND2,
-+				     eep[MT_EE_WIFI_CONF + 4]);
-+		*nss = FIELD_GET(MT_EE_WIFI_CONF5_STREAM_NUM_BAND2,
-+				 eep[MT_EE_WIFI_CONF + 5]);
-+		break;
-+	default:
-+		*path = FIELD_GET(MT_EE_WIFI_CONF1_TX_PATH_BAND0,
-+				  eep[MT_EE_WIFI_CONF + 1]);
-+		*rx_path = FIELD_GET(MT_EE_WIFI_CONF3_RX_PATH_BAND0,
-+				     eep[MT_EE_WIFI_CONF + 3]);
-+		*nss = FIELD_GET(MT_EE_WIFI_CONF4_STREAM_NUM_BAND0,
-+				 eep[MT_EE_WIFI_CONF + 4]);
-+		break;
-+	}
-+}
-+
- enum mt7996_sku_rate_group {
- 	SKU_CCK,
- 	SKU_OFDM,
+ 	dev->flash_mode = true;
+ 	dev->eeprom_mode = DEFAULT_BIN_MODE;
+ 	eeprom[MT_EE_TESTMODE_EN] = dev->testmode_enable;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index a78c0707..7342a8e4 100644
+index 7ef6bb1f..1d4655ed 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3512,7 +3512,7 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
+@@ -3522,7 +3522,7 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
  				 &req, sizeof(req), true);
  }
  
 -static int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
-+int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
++int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
  {
  #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
  #define PAGE_IDX_MASK		GENMASK(4, 2)
-@@ -3557,22 +3557,6 @@ static int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
- 	return 0;
- }
- 
--int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
--{
--	struct mt7996_mcu_eeprom req = {
--		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
--		.len = cpu_to_le16(sizeof(req) - 4),
--		.buffer_mode = EE_MODE_EFUSE,
--		.format = EE_FORMAT_WHOLE
--	};
--
--	if (dev->flash_mode)
--		return mt7996_mcu_set_eeprom_flash(dev);
--
--	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(EFUSE_CTRL),
--				 &req, sizeof(req), true);
--}
--
- int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf)
- {
- 	struct mt7996_mcu_eeprom_info req = {
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 2eeb8d12..232af281 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -54,6 +54,7 @@
- #define MT7992_ROM_PATCH_23		"mediatek/mt7996/mt7992_rom_patch_23.bin"
- 
- #define MT7996_EEPROM_DEFAULT		"mediatek/mt7996/mt7996_eeprom.bin"
-+#define MT7996_EEPROM_DEFAULT_INT	"mediatek/mt7996/mt7996_eeprom_2i5i6i.bin"
- #define MT7996_EEPROM_DEFAULT_404	"mediatek/mt7996/mt7996_eeprom_dual_404.bin"
- #define MT7992_EEPROM_DEFAULT		"mediatek/mt7996/mt7992_eeprom.bin"
- #define MT7992_EEPROM_DEFAULT_INT	"mediatek/mt7996/mt7992_eeprom_2i5i.bin"
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index c096fb6c..053005dd 100644
+index 078ff279..60ec6bd4 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -2826,7 +2826,7 @@ static int mt7996_show_eeprom_mode(struct seq_file *s, void *data)
+@@ -340,7 +340,6 @@ static int mt7996_dump_version(struct seq_file *s, void *data)
+ 	u16 adie_chip_id, adie_chip_ver;
+ 	int adie_idx;
+ 	static const char * const fem_type[] = {
+-		[MT7996_FEM_UNSET] = "N/A",
+ 		[MT7996_FEM_EXT] = "eFEM",
+ 		[MT7996_FEM_INT] = "iFEM",
+ 		[MT7996_FEM_MIX] = "mixed FEM",
+@@ -2826,7 +2825,7 @@ static int mt7996_show_eeprom_mode(struct seq_file *s, void *data)
  			seq_printf(s, "   flash mode\n");
  		break;
  	case BIN_FILE_MODE:
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0024-mtk-mt76-mt7996-add-vendor-commands-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0024-mtk-mt76-mt7996-add-vendor-commands-support.patch
index 39baf59..77a5a5c 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0024-mtk-mt76-mt7996-add-vendor-commands-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0024-mtk-mt76-mt7996-add-vendor-commands-support.patch
@@ -1,7 +1,7 @@
-From 399e39ba918da294bd207a527e439db767ce6271 Mon Sep 17 00:00:00 2001
+From 4ae9d91e5d5faa7600dfa6fefc331e582d74b5c9 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 13 Dec 2022 15:17:43 +0800
-Subject: [PATCH 024/195] mtk: mt76: mt7996: add vendor commands support
+Subject: [PATCH 024/223] mtk: mt76: mt7996: add vendor commands support
 
 mtk: wifi: mt76: fix muru_onoff as all enabled by default
 
@@ -38,7 +38,7 @@
  mt76_connac_mcu.h |   2 +
  mt7996/Makefile   |   3 +-
  mt7996/init.c     |   9 +
- mt7996/mac.c      |   4 +
+ mt7996/mac.c      |   5 +
  mt7996/main.c     |   4 +
  mt7996/mcu.c      |  37 ++-
  mt7996/mcu.h      |  14 +
@@ -47,15 +47,15 @@
  mt7996/mtk_mcu.h  |  15 +
  mt7996/vendor.c   | 805 ++++++++++++++++++++++++++++++++++++++++++++++
  mt7996/vendor.h   | 153 +++++++++
- 12 files changed, 1180 insertions(+), 6 deletions(-)
+ 12 files changed, 1181 insertions(+), 6 deletions(-)
  create mode 100644 mt7996/vendor.c
  create mode 100644 mt7996/vendor.h
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 4c4fff39..bdb1c5a5 100644
+index fcacd546..e9afc27b 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1264,6 +1264,7 @@ enum {
+@@ -1269,6 +1269,7 @@ enum {
  	MCU_UNI_CMD_REG_ACCESS = 0x0d,
  	MCU_UNI_CMD_CHIP_CONFIG = 0x0e,
  	MCU_UNI_CMD_POWER_CTRL = 0x0f,
@@ -63,7 +63,7 @@
  	MCU_UNI_CMD_RX_HDR_TRANS = 0x12,
  	MCU_UNI_CMD_SER = 0x13,
  	MCU_UNI_CMD_TWT = 0x14,
-@@ -1296,6 +1297,7 @@ enum {
+@@ -1301,6 +1302,7 @@ enum {
  	MCU_UNI_CMD_PER_STA_INFO = 0x6d,
  	MCU_UNI_CMD_ALL_STA_INFO = 0x6e,
  	MCU_UNI_CMD_ASSERT_DUMP = 0x6f,
@@ -90,7 +90,7 @@
  mt7996e-$(CONFIG_DEV_COREDUMP) += coredump.o
  mt7996e-$(CONFIG_NL80211_TESTMODE) += testmode.o
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 3b816070..0cf054df 100644
+index 994d74cc..703c7af0 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -380,6 +380,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -101,7 +101,7 @@
  
  	hw->sta_data_size = sizeof(struct mt7996_sta);
  	hw->vif_data_size = sizeof(struct mt7996_vif);
-@@ -631,6 +632,10 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
+@@ -632,6 +633,10 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
  	if (ret)
  		goto error;
  
@@ -112,7 +112,7 @@
  	ret = mt76_register_phy(mphy, true, mt76_rates,
  				ARRAY_SIZE(mt76_rates));
  	if (ret)
-@@ -1447,6 +1452,10 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1463,6 +1468,10 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	dev->mt76.test_ops = &mt7996_testmode_ops;
  #endif
  
@@ -124,13 +124,14 @@
  				   ARRAY_SIZE(mt76_rates));
  	if (ret)
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index fd8bce0e..f0c0db75 100644
+index 789caa44..05d02af1 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -679,6 +679,10 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
- 			if (ieee80211_has_a4(fc) && is_mesh && status->amsdu)
+@@ -680,6 +680,11 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
  				*qos &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;
  		}
+ 		skb_set_mac_header(skb, (unsigned char *)hdr - skb->data);
++
 +#ifdef CONFIG_MTK_VENDOR
 +		if (phy->amnt_ctrl.enable && !ieee80211_is_beacon(fc))
 +			mt7996_vendor_amnt_fill_rx(phy, skb);
@@ -139,7 +140,7 @@
  		status->flag |= RX_FLAG_8023;
  		mt7996_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
 diff --git a/mt7996/main.c b/mt7996/main.c
-index f279cbd4..550b1f4e 100644
+index ad4cd5dd..67eab3df 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -749,6 +749,10 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -154,10 +155,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 7342a8e4..9fc64b96 100644
+index 1d4655ed..808ea178 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1378,6 +1378,8 @@ static void
+@@ -1388,6 +1388,8 @@ static void
  mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
  {
@@ -166,7 +167,7 @@
  	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
-@@ -1389,11 +1391,14 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1399,11 +1401,14 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
  
  	muru = (struct sta_rec_muru *)tlv;
@@ -186,7 +187,7 @@
  
  	if (sta->deflink.vht_cap.vht_supported)
  		muru->mimo_dl.vht_mu_bfee =
-@@ -4968,3 +4973,25 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
+@@ -4998,3 +5003,25 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
  	return mt76_mcu_send_msg(&phy->dev->mt76, MCU_WM_UNI_CMD(SCS),
  				 &req, sizeof(req), false);
  }
@@ -247,10 +248,10 @@
  };
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 232af281..2bc4c4b8 100644
+index 2ec72496..a559c76f 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -258,6 +258,34 @@ struct mt7996_wed_rro_session_id {
+@@ -267,6 +267,34 @@ struct mt7996_wed_rro_session_id {
  	u16 id;
  };
  
@@ -285,7 +286,7 @@
  struct mt7996_phy {
  	struct mt76_phy *mt76;
  	struct mt7996_dev *dev;
-@@ -300,6 +328,8 @@ struct mt7996_phy {
+@@ -309,6 +337,8 @@ struct mt7996_phy {
  	bool sku_limit_en;
  	bool sku_path_en;
  
@@ -294,7 +295,7 @@
  #ifdef CONFIG_NL80211_TESTMODE
  	struct {
  		u32 *reg_backup;
-@@ -314,6 +344,10 @@ struct mt7996_phy {
+@@ -323,6 +353,10 @@ struct mt7996_phy {
  		u8 spe_idx;
  	} test;
  #endif
@@ -305,7 +306,7 @@
  };
  
  struct mt7996_dev {
-@@ -740,6 +774,25 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+@@ -771,6 +805,25 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  			 bool hif2, int *irq);
  u32 mt7996_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0025-mtk-mt76-mt7996-add-debugfs-for-fw-coredump.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0025-mtk-mt76-mt7996-add-debugfs-for-fw-coredump.patch
index 3fdcb98..fa9b52b 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0025-mtk-mt76-mt7996-add-debugfs-for-fw-coredump.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0025-mtk-mt76-mt7996-add-debugfs-for-fw-coredump.patch
@@ -1,7 +1,7 @@
-From 8a547ad1fe50ae27776d9589e85ee7df8a69c4cc Mon Sep 17 00:00:00 2001
+From 63a51fd94d291a40f0514580c8f75f5e80d80886 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Fri, 19 May 2023 14:56:07 +0800
-Subject: [PATCH 025/195] mtk: mt76: mt7996: add debugfs for fw coredump.
+Subject: [PATCH 025/223] mtk: mt76: mt7996: add debugfs for fw coredump.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
@@ -64,10 +64,10 @@
  	desc += scnprintf(buff + desc, bufsz - desc,
  			  "\nlet's dump firmware SER statistics...\n");
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index f0c0db75..d9e8e751 100644
+index 05d02af1..e9f3942f 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2089,15 +2089,36 @@ void mt7996_mac_dump_work(struct work_struct *work)
+@@ -2101,15 +2101,36 @@ void mt7996_mac_dump_work(struct work_struct *work)
  	struct mt7996_dev *dev;
  
  	dev = container_of(work, struct mt7996_dev, dump_work);
@@ -107,7 +107,7 @@
  void mt7996_reset(struct mt7996_dev *dev)
  {
  	if (!dev->recovery.hw_init_done)
-@@ -2115,6 +2136,7 @@ void mt7996_reset(struct mt7996_dev *dev)
+@@ -2127,6 +2148,7 @@ void mt7996_reset(struct mt7996_dev *dev)
  
  		mt7996_irq_disable(dev, MT_INT_MCU_CMD);
  		queue_work(dev->mt76.wq, &dev->dump_work);
@@ -132,11 +132,11 @@
  	UNI_CMD_SER_ENABLE = 1,
  	UNI_CMD_SER_SET,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 2bc4c4b8..a2130598 100644
+index a559c76f..edd2ce33 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -138,6 +138,14 @@ enum mt7996_ram_type {
- 	__MT7996_RAM_TYPE_MAX,
+@@ -147,6 +147,14 @@ enum mt7996_fem_type {
+ 	MT7996_FEM_MIX,
  };
  
 +enum mt7996_coredump_state {
@@ -150,7 +150,7 @@
  enum mt7996_txq_id {
  	MT7996_TXQ_FWDL = 16,
  	MT7996_TXQ_MCU_WM,
-@@ -393,6 +401,7 @@ struct mt7996_dev {
+@@ -402,6 +410,7 @@ struct mt7996_dev {
  
  	/* protects coredump data */
  	struct mutex dump_mutex;
@@ -158,7 +158,7 @@
  #ifdef CONFIG_DEV_COREDUMP
  	struct {
  		struct mt7996_crash_data *crash_data[__MT7996_RAM_TYPE_MAX];
-@@ -580,6 +589,7 @@ void mt7996_init_txpower(struct mt7996_phy *phy);
+@@ -611,6 +620,7 @@ void mt7996_init_txpower(struct mt7996_phy *phy);
  int mt7996_txbf_init(struct mt7996_dev *dev);
  int mt7996_get_chip_sku(struct mt7996_dev *dev);
  void mt7996_reset(struct mt7996_dev *dev);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0026-mtk-mt76-mt7996-Add-mt7992-coredump-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0026-mtk-mt76-mt7996-Add-mt7992-coredump-support.patch
index 6057c2d..68f5e09 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0026-mtk-mt76-mt7996-Add-mt7992-coredump-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0026-mtk-mt76-mt7996-Add-mt7992-coredump-support.patch
@@ -1,11 +1,12 @@
-From f103ac8c2662732ee2ba789431fda9f308355c5e Mon Sep 17 00:00:00 2001
+From b421656ce76c53eb44a3e43d8399bb614109ad85 Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Mon, 25 Dec 2023 15:17:49 +0800
-Subject: [PATCH 026/195] mtk: mt76: mt7996: Add mt7992 coredump support
+Subject: [PATCH 026/223] mtk: mt76: mt7996: Add mt7992 coredump support
 
 1. Add mt7992 coredump support
 2. fixed if new ic have not support coredump, it may cause crash when remove module
 
+Change-Id: I2ae5425aac6be8ff69a2c411e796be308b558b6b
 Signed-off-by: Rex Lu <rex.lu@mediatek.com>
 ---
  mt7996/coredump.c | 80 ++++++++++++++++++++++++++++++++++++++---------
@@ -146,10 +147,10 @@
  }
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index a2130598..0d04013d 100644
+index edd2ce33..c011e8ec 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -229,6 +229,7 @@ struct mt7996_vif {
+@@ -238,6 +238,7 @@ struct mt7996_vif {
  struct mt7996_crash_data {
  	guid_t guid;
  	struct timespec64 timestamp;
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0027-mtk-mt76-mt7996-add-support-for-runtime-set-in-band-.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0027-mtk-mt76-mt7996-add-support-for-runtime-set-in-band-.patch
index d738cf9..cec3aec 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0027-mtk-mt76-mt7996-add-support-for-runtime-set-in-band-.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0027-mtk-mt76-mt7996-add-support-for-runtime-set-in-band-.patch
@@ -1,7 +1,7 @@
-From dbbaca285a74197ad2d833fdb83bf45f4f73e933 Mon Sep 17 00:00:00 2001
+From 83a6bd94bc5c54c1ddb9fb2db0c2746d3bb5812e Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 6 Jun 2023 16:57:10 +0800
-Subject: [PATCH 027/195] mtk: mt76: mt7996: add support for runtime set
+Subject: [PATCH 027/223] mtk: mt76: mt7996: add support for runtime set
  in-band discovery
 
 with this patch, AP can runtime set inband discovery via hostapd_cli
@@ -17,10 +17,10 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 9fc64b96..e743bcb2 100644
+index 808ea178..eb065ffc 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2614,8 +2614,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+@@ -2624,8 +2624,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
  	if (IS_ERR(rskb))
  		return PTR_ERR(rskb);
  
@@ -30,7 +30,7 @@
  		interval = vif->bss_conf.fils_discovery.max_interval;
  		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
  	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
-@@ -2650,7 +2649,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+@@ -2660,7 +2659,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
  	discov->tx_type = !!(changed & BSS_CHANGED_FILS_DISCOVERY);
  	discov->tx_interval = interval;
  	discov->prob_rsp_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0028-mtk-mt76-mt7996-add-support-spatial-reuse-debug-comm.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0028-mtk-mt76-mt7996-add-support-spatial-reuse-debug-comm.patch
index 21d5261..d09b064 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0028-mtk-mt76-mt7996-add-support-spatial-reuse-debug-comm.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0028-mtk-mt76-mt7996-add-support-spatial-reuse-debug-comm.patch
@@ -1,7 +1,7 @@
-From 075181f1c151b387ab88837c87678fc6ca15e051 Mon Sep 17 00:00:00 2001
+From a3f223f025ce2abc2dc0e42ab835a8cc5ef6d65a Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 10 Jul 2023 11:47:29 +0800
-Subject: [PATCH 028/195] mtk: mt76: mt7996: add support spatial reuse debug
+Subject: [PATCH 028/223] mtk: mt76: mt7996: add support spatial reuse debug
  commands
 
 This commit adds the following debug commands in debugfs:
@@ -16,6 +16,7 @@
 To learn more details of these commands, please check:
 https://wiki.mediatek.inc/display/APKB/mt76+Phy+feature+debug+Cheetsheet#mt76PhyfeaturedebugCheetsheet-SpatialReuse
 
+Change-Id: I5bf83013ea2788dfc93caaaef08486a4f97a3649
 ---
  mt76_connac_mcu.h    |   1 +
  mt7996/main.c        |   6 +++
@@ -27,10 +28,10 @@
  7 files changed, 270 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index bdb1c5a5..d99b338b 100644
+index e9afc27b..dd63d4a0 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1051,6 +1051,7 @@ enum {
+@@ -1056,6 +1056,7 @@ enum {
  	MCU_UNI_EVENT_BSS_BEACON_LOSS = 0x0c,
  	MCU_UNI_EVENT_SCAN_DONE = 0x0e,
  	MCU_UNI_EVENT_RDD_REPORT = 0x11,
@@ -39,7 +40,7 @@
  	MCU_UNI_EVENT_TX_DONE = 0x2d,
  	MCU_UNI_EVENT_BF = 0x33,
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 550b1f4e..72297aaa 100644
+index 67eab3df..6203e800 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -6,6 +6,9 @@
@@ -63,10 +64,10 @@
  						dev->dbg.sku_disable ? 0 : phy->sku_limit_en);
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index e743bcb2..23c2092d 100644
+index eb065ffc..78462729 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -717,6 +717,14 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -727,6 +727,14 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	case MCU_UNI_EVENT_WED_RRO:
  		mt7996_mcu_wed_rro_event(dev, skb);
  		break;
@@ -82,10 +83,10 @@
  	case MCU_UNI_EVENT_TESTMODE_CTRL:
  		mt7996_tm_rf_test_event(dev, skb);
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 0d04013d..3cfe8913 100644
+index c011e8ec..356935b2 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -357,6 +357,10 @@ struct mt7996_phy {
+@@ -366,6 +366,10 @@ struct mt7996_phy {
  	spinlock_t amnt_lock;
  	struct mt7996_air_monitor_ctrl amnt_ctrl;
  #endif
@@ -96,7 +97,7 @@
  };
  
  struct mt7996_dev {
-@@ -807,6 +811,8 @@ enum edcca_bw_id {
+@@ -838,6 +842,8 @@ enum edcca_bw_id {
  #ifdef CONFIG_MTK_DEBUG
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir);
  int mt7996_mcu_muru_dbg_info(struct mt7996_dev *dev, u16 item, u8 val);
@@ -106,10 +107,10 @@
  
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 053005dd..06dc794e 100644
+index 60ec6bd4..13ea6274 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -2835,6 +2835,83 @@ static int mt7996_show_eeprom_mode(struct seq_file *s, void *data)
+@@ -2834,6 +2834,83 @@ static int mt7996_show_eeprom_mode(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -193,7 +194,7 @@
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -2915,6 +2992,11 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -2914,6 +2991,11 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
  	debugfs_create_file("scs_enable", 0200, dir, phy, &fops_scs_enable);
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0029-mtk-mt76-mt7996-Establish-BA-in-VO-queue.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0029-mtk-mt76-mt7996-Establish-BA-in-VO-queue.patch
index 6ca6d89..800f01f 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0029-mtk-mt76-mt7996-Establish-BA-in-VO-queue.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0029-mtk-mt76-mt7996-Establish-BA-in-VO-queue.patch
@@ -1,17 +1,17 @@
-From 696044e6fb6acbf7329fdd36ceb533ec8a711f32 Mon Sep 17 00:00:00 2001
+From 836be9f533e2d5441088435050d0400711311301 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 1 Aug 2023 16:02:28 +0800
-Subject: [PATCH 029/195] mtk: mt76: mt7996: Establish BA in VO queue
+Subject: [PATCH 029/223] mtk: mt76: mt7996: Establish BA in VO queue
 
 ---
  mt7996/mac.c | 2 --
  1 file changed, 2 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index d9e8e751..8226e443 100644
+index e9f3942f..428ccb1a 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1041,8 +1041,6 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
+@@ -1053,8 +1053,6 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
  		return;
  
  	tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0030-mtk-mt76-mt7996-report-tx-and-rx-byte-to-tpt_led.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0030-mtk-mt76-mt7996-report-tx-and-rx-byte-to-tpt_led.patch
index f0a8378..009845a 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0030-mtk-mt76-mt7996-report-tx-and-rx-byte-to-tpt_led.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0030-mtk-mt76-mt7996-report-tx-and-rx-byte-to-tpt_led.patch
@@ -1,17 +1,17 @@
-From 95a2f18e7d90e7008c26770ec169b5ff61d4cc30 Mon Sep 17 00:00:00 2001
+From ccc0d8ca18a2fa4039f664f3806146aca97fd5a2 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Sat, 12 Aug 2023 04:17:22 +0800
-Subject: [PATCH 030/195] mtk: mt76: mt7996: report tx and rx byte to tpt_led
+Subject: [PATCH 030/223] mtk: mt76: mt7996: report tx and rx byte to tpt_led
 
 ---
  mt7996/mcu.c | 15 +++++++++++----
  1 file changed, 11 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 23c2092d..a03ac376 100644
+index 78462729..9e6f4d13 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -525,6 +525,8 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -535,6 +535,8 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  		u8 ac;
  		u16 wlan_idx;
  		struct mt76_wcid *wcid;
@@ -20,7 +20,7 @@
  
  		switch (le16_to_cpu(res->tag)) {
  		case UNI_ALL_STA_TXRX_RATE:
-@@ -544,11 +546,16 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -554,11 +556,16 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  			if (!wcid)
  				break;
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0031-mtk-mt76-mt7996-support-dup-wtbl.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0031-mtk-mt76-mt7996-support-dup-wtbl.patch
index aafc8b1..482a4b3 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0031-mtk-mt76-mt7996-support-dup-wtbl.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0031-mtk-mt76-mt7996-support-dup-wtbl.patch
@@ -1,8 +1,9 @@
-From 3ec82c9cc5e5a17f274fa63a2344cfd8ffc5d8ab Mon Sep 17 00:00:00 2001
+From 17af6c5607c9b5191323d600c1fa7456b8741830 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Sep 2023 00:52:46 +0800
-Subject: [PATCH 031/195] mtk: mt76: mt7996: support dup wtbl
+Subject: [PATCH 031/223] mtk: mt76: mt7996: support dup wtbl
 
+Change-Id: I14ba41ace8341c23c1cfb6e9c4fbb2d5e93a5714
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mt7996/init.c    |  1 +
@@ -11,10 +12,10 @@
  3 files changed, 25 insertions(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 0cf054df..0201d9fc 100644
+index 703c7af0..3421326a 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -688,6 +688,7 @@ static void mt7996_init_work(struct work_struct *work)
+@@ -689,6 +689,7 @@ static void mt7996_init_work(struct work_struct *work)
  	mt7996_mcu_set_eeprom(dev);
  	mt7996_mac_init(dev);
  	mt7996_txbf_init(dev);
@@ -23,10 +24,10 @@
  
  void mt7996_wfsys_reset(struct mt7996_dev *dev)
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 3cfe8913..47e07ea3 100644
+index 356935b2..7bc5504e 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -813,6 +813,7 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir);
+@@ -844,6 +844,7 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir);
  int mt7996_mcu_muru_dbg_info(struct mt7996_dev *dev, u16 item, u8 val);
  int mt7996_mcu_set_sr_enable(struct mt7996_phy *phy, u8 action, u64 val, bool set);
  void mt7996_mcu_rx_sr_event(struct mt7996_dev *dev, struct sk_buff *skb);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0032-mtk-mt76-try-more-times-when-send-message-timeout.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0032-mtk-mt76-try-more-times-when-send-message-timeout.patch
index 3a086b9..cf35c3d 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0032-mtk-mt76-try-more-times-when-send-message-timeout.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0032-mtk-mt76-try-more-times-when-send-message-timeout.patch
@@ -1,15 +1,16 @@
-From 5bb3fda146ed7d46a2d719c5847c9965af5346d2 Mon Sep 17 00:00:00 2001
+From 6a7e30cf77280b1eb10fd17347ba33759f0d9148 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Nov 2023 11:10:10 +0800
-Subject: [PATCH 032/195] mtk: mt76: try more times when send message timeout.
+Subject: [PATCH 032/223] mtk: mt76: try more times when send message timeout.
 
+Change-Id: Ib7c01e6c9f74f68d8404a3d8bada9e5a10c4e232
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
- dma.c        |  7 +++++--
- mcu.c        |  3 ++-
- mt7996/mac.c | 37 ++++++++++++-------------------------
+ dma.c        |  7 ++++--
+ mcu.c        | 70 +++++++++++++++++++++++++++-------------------------
+ mt7996/mac.c | 37 +++++++++------------------
  mt7996/mcu.c |  1 +
- 4 files changed, 20 insertions(+), 28 deletions(-)
+ 4 files changed, 54 insertions(+), 61 deletions(-)
 
 diff --git a/dma.c b/dma.c
 index 56044639..66c000ef 100644
@@ -39,7 +40,7 @@
  
  static int
 diff --git a/mcu.c b/mcu.c
-index 6f4aee29..93184cea 100644
+index 2bcce21f..fed363d0 100644
 --- a/mcu.c
 +++ b/mcu.c
 @@ -4,6 +4,7 @@
@@ -50,20 +51,103 @@
  #include <linux/moduleparam.h>
  
  struct sk_buff *
-@@ -93,7 +94,7 @@ int mt76_mcu_skb_send_and_get_msg(struct mt76_dev *dev, struct sk_buff *skb,
- retry:
- 	orig_skb = skb_get(skb);
- 	ret = dev->mcu_ops->mcu_skb_send_msg(dev, skb, cmd, &seq);
+@@ -75,7 +76,7 @@ int mt76_mcu_skb_send_and_get_msg(struct mt76_dev *dev, struct sk_buff *skb,
+ 				  struct sk_buff **ret_skb)
+ {
+ 	unsigned int retry = 0;
+-	struct sk_buff *orig_skb = NULL;
++	struct sk_buff *skb_tmp;
+ 	unsigned long expires;
+ 	int ret, seq;
+ 
+@@ -84,48 +85,49 @@ int mt76_mcu_skb_send_and_get_msg(struct mt76_dev *dev, struct sk_buff *skb,
+ 
+ 	mutex_lock(&dev->mcu.mutex);
+ 
+-	if (dev->mcu_ops->mcu_skb_prepare_msg) {
+-		orig_skb = skb;
+-		ret = dev->mcu_ops->mcu_skb_prepare_msg(dev, skb, cmd, &seq);
+-		if (ret < 0)
++	while (retry < dev->mcu_ops->max_retry) {
++		skb_tmp = mt76_mcu_msg_alloc(dev, skb->data, skb->len);
++		if (!skb_tmp)
+ 			goto out;
+-	}
+-
+-retry:
+-	/* orig skb might be needed for retry, mcu_skb_send_msg consumes it */
+-	if (orig_skb)
+-		skb_get(orig_skb);
+-	ret = dev->mcu_ops->mcu_skb_send_msg(dev, skb, cmd, &seq);
 -	if (ret < 0)
-+	if (ret < 0 && ret != -EAGAIN)
- 		goto out;
+-		goto out;
+-
+-	if (!wait_resp) {
+-		ret = 0;
+-		goto out;
+-	}
+-
+-	expires = jiffies + dev->mcu.timeout;
+ 
+-	do {
+-		skb = mt76_mcu_get_response(dev, expires);
+-		if (!skb && !test_bit(MT76_MCU_RESET, &dev->phy.state) &&
+-		    orig_skb && retry++ < dev->mcu_ops->max_retry) {
++		if (wait_resp && retry) {
++			if (test_bit(MT76_MCU_RESET, &dev->phy.state))
++				usleep_range(200000, 500000);
+ 			dev_err(dev->dev, "Retry message %08x (seq %d)\n",
+ 				cmd, seq);
+-			skb = orig_skb;
+-			goto retry;
+ 		}
  
- 	if (!wait_resp) {
+-		ret = dev->mcu_ops->mcu_parse_response(dev, cmd, skb, seq);
+-		if (!ret && ret_skb)
+-			*ret_skb = skb;
+-		else
+-			dev_kfree_skb(skb);
+-	} while (ret == -EAGAIN);
++		ret = dev->mcu_ops->mcu_skb_send_msg(dev, skb_tmp, cmd, &seq);
++		if (ret < 0 && ret != -EAGAIN)
++			goto out;
+ 
++		if (!wait_resp) {
++			ret = 0;
++			goto out;
++		}
++
++		expires = jiffies + dev->mcu.timeout;
++
++		do {
++			skb_tmp = mt76_mcu_get_response(dev, expires);
++			ret = dev->mcu_ops->mcu_parse_response(dev, cmd, skb_tmp, seq);
++			if (ret == -ETIMEDOUT)
++				break;
++
++			if (!ret && ret_skb)
++				*ret_skb = skb_tmp;
++			else
++				dev_kfree_skb(skb_tmp);
++
++			if (ret != -EAGAIN)
++				goto out;
++		} while (ret == -EAGAIN);
++
++		retry++;
++	}
+ 
+ out:
+-	dev_kfree_skb(orig_skb);
++	dev_kfree_skb(skb);
+ 	mutex_unlock(&dev->mcu.mutex);
+ 
+ 	return ret;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 8226e443..503a562a 100644
+index 428ccb1a..3c9ee0c8 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1793,13 +1793,24 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
+@@ -1805,13 +1805,24 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
  	phy3 = mt7996_phy3(dev);
  	dev->recovery.hw_full_reset = true;
  
@@ -89,7 +173,7 @@
  	cancel_work_sync(&dev->wed_rro.work);
  	cancel_delayed_work_sync(&dev->mphy.mac_work);
  	if (phy2)
-@@ -1902,16 +1913,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1914,16 +1925,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	set_bit(MT76_MCU_RESET, &dev->mphy.state);
  	wake_up(&dev->mt76.mcu.wait);
  
@@ -106,7 +190,7 @@
  	mt76_worker_disable(&dev->mt76.tx_worker);
  	mt76_for_each_q_rx(&dev->mt76, i) {
  		if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
-@@ -1922,8 +1923,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1934,8 +1935,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	}
  	napi_disable(&dev->mt76.tx_napi);
  
@@ -115,7 +199,7 @@
  	mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_STOPPED);
  
  	if (mt7996_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) {
-@@ -1996,20 +1995,8 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2008,20 +2007,8 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	if (phy3)
  		ieee80211_wake_queues(phy3->mt76->hw);
  
@@ -137,10 +221,10 @@
  		 wiphy_name(dev->mt76.hw->wiphy));
  }
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index a03ac376..e3519f13 100644
+index 9e6f4d13..08234b3a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3129,6 +3129,7 @@ int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
+@@ -3139,6 +3139,7 @@ int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
  int mt7996_mcu_init(struct mt7996_dev *dev)
  {
  	static const struct mt76_mcu_ops mt7996_mcu_ops = {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0033-mtk-mt76-mt7996-add-SER-overlap-handle.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0033-mtk-mt76-mt7996-add-SER-overlap-handle.patch
index 91de33a..b422e69 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0033-mtk-mt76-mt7996-add-SER-overlap-handle.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0033-mtk-mt76-mt7996-add-SER-overlap-handle.patch
@@ -1,7 +1,7 @@
-From 70af463858d745155fd78654b1bb8020271a0dc5 Mon Sep 17 00:00:00 2001
+From 0b6f875816c6849eaadae1cbf974ee1327af04f2 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 21 Nov 2023 09:55:46 +0800
-Subject: [PATCH 033/195] mtk: mt76: mt7996: add SER overlap handle
+Subject: [PATCH 033/223] mtk: mt76: mt7996: add SER overlap handle
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
@@ -11,10 +11,10 @@
  3 files changed, 21 insertions(+)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 503a562a..63408421 100644
+index 3c9ee0c8..2ce9e839 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1894,6 +1894,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1906,6 +1906,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
@@ -22,7 +22,7 @@
  	dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.",
  		 wiphy_name(dev->mt76.hw->wiphy));
  
-@@ -1911,6 +1912,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1923,6 +1924,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
  
  	set_bit(MT76_RESET, &dev->mphy.state);
  	set_bit(MT76_MCU_RESET, &dev->mphy.state);
@@ -33,7 +33,7 @@
  	wake_up(&dev->mt76.mcu.wait);
  
  	mt76_worker_disable(&dev->mt76.tx_worker);
-@@ -2106,6 +2111,9 @@ void mt7996_coredump(struct mt7996_dev *dev, u8 state)
+@@ -2118,6 +2123,9 @@ void mt7996_coredump(struct mt7996_dev *dev, u8 state)
  
  void mt7996_reset(struct mt7996_dev *dev)
  {
@@ -43,7 +43,7 @@
  	if (!dev->recovery.hw_init_done)
  		return;
  
-@@ -2125,6 +2133,9 @@ void mt7996_reset(struct mt7996_dev *dev)
+@@ -2137,6 +2145,9 @@ void mt7996_reset(struct mt7996_dev *dev)
  		return;
  	}
  
@@ -54,10 +54,10 @@
  	wake_up(&dev->reset_wait);
  }
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index e3519f13..823e982c 100644
+index 08234b3a..2a647b7b 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -246,6 +246,14 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+@@ -256,6 +256,14 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
  	u32 val;
  	u8 seq;
  
@@ -73,10 +73,10 @@
  
  	seq = ++dev->mt76.mcu.msg_seq & 0xf;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 47e07ea3..c08dd21b 100644
+index 7bc5504e..22d44542 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -397,6 +397,8 @@ struct mt7996_dev {
+@@ -406,6 +406,8 @@ struct mt7996_dev {
  	wait_queue_head_t reset_wait;
  	struct {
  		u32 state;
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0034-mtk-mt76-mt7996-kite-default-1-pcie-setting.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0034-mtk-mt76-mt7996-kite-default-1-pcie-setting.patch
index 7d38777..46316e8 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0034-mtk-mt76-mt7996-kite-default-1-pcie-setting.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0034-mtk-mt76-mt7996-kite-default-1-pcie-setting.patch
@@ -1,7 +1,7 @@
-From f2f1f1e43d488c3ebdccd87357a2789d99fcfc43 Mon Sep 17 00:00:00 2001
+From 7077356d80d23d074c2271e5d96697a8d02ad297 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 13 Jul 2023 16:36:36 +0800
-Subject: [PATCH 034/195] mtk: mt76: mt7996: kite default 1-pcie setting
+Subject: [PATCH 034/223] mtk: mt76: mt7996: kite default 1-pcie setting
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0035-mtk-mt76-mt7996-support-BF-MIMO-debug-commands.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0035-mtk-mt76-mt7996-support-BF-MIMO-debug-commands.patch
index 98832aa..c04e36f 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0035-mtk-mt76-mt7996-support-BF-MIMO-debug-commands.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0035-mtk-mt76-mt7996-support-BF-MIMO-debug-commands.patch
@@ -1,7 +1,7 @@
-From b9ef397a33c707e9746ad8e927e3310d225ca81b Mon Sep 17 00:00:00 2001
+From 3330075935bef71cea064ce4bf0d4453fdc2301a Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 3 Jan 2023 09:42:07 +0800
-Subject: [PATCH 035/195] mtk: mt76: mt7996: support BF/MIMO debug commands
+Subject: [PATCH 035/223] mtk: mt76: mt7996: support BF/MIMO debug commands
 
 This commit includes the following commands:
 1. starec_bf_read
@@ -17,6 +17,8 @@
 Fw gerrit change:
 https://gerrit.mediatek.inc/c/neptune/firmware/bora/wifi/core/+/8218143
 
+Change-Id: Id6cbaf16e4e6f63238a495ac9f45744e1dd38e9b
+Change-Id: I7ece7399370f2bd22d2564029025baeda27057a5
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -29,10 +31,10 @@
  6 files changed, 989 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 823e982c..11899d78 100644
+index 2a647b7b..baf71b0a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -744,6 +744,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -754,6 +754,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	case MCU_UNI_EVENT_TESTMODE_CTRL:
  		mt7996_tm_rf_test_event(dev, skb);
  		break;
@@ -62,10 +64,10 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index c08dd21b..390c7eba 100644
+index 22d44542..8d986dee 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -816,6 +816,11 @@ int mt7996_mcu_muru_dbg_info(struct mt7996_dev *dev, u16 item, u8 val);
+@@ -847,6 +847,11 @@ int mt7996_mcu_muru_dbg_info(struct mt7996_dev *dev, u16 item, u8 val);
  int mt7996_mcu_set_sr_enable(struct mt7996_phy *phy, u8 action, u64 val, bool set);
  void mt7996_mcu_rx_sr_event(struct mt7996_dev *dev, struct sk_buff *skb);
  int mt7996_mcu_set_dup_wtbl(struct mt7996_dev *dev);
@@ -78,10 +80,10 @@
  
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 06dc794e..b3cc8119 100644
+index 13ea6274..51449df4 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -2997,6 +2997,15 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -2996,6 +2996,15 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  	debugfs_create_file("sr_stats", 0400, dir, phy, &mt7996_sr_stats_fops);
  	debugfs_create_file("sr_scene_cond", 0400, dir, phy, &mt7996_sr_scene_cond_fops);
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0036-mtk-mt76-mt7996-add-build-the-following-MURU-mcu-com.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0036-mtk-mt76-mt7996-add-build-the-following-MURU-mcu-com.patch
index a209d97..1a3d22e 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0036-mtk-mt76-mt7996-add-build-the-following-MURU-mcu-com.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0036-mtk-mt76-mt7996-add-build-the-following-MURU-mcu-com.patch
@@ -1,13 +1,14 @@
-From ac6f7b11db498122fcbf3db3bbd153cad6451a91 Mon Sep 17 00:00:00 2001
+From e4a6bac2e1b29a00396adc9bdd1b276eb3e0ee4a Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 13 Jun 2023 14:49:02 +0800
-Subject: [PATCH 036/195] mtk: mt76: mt7996: add build the following MURU mcu
+Subject: [PATCH 036/223] mtk: mt76: mt7996: add build the following MURU mcu
  command tlvs
 
 It includes the following tlvs:
 1. MURU tlv id 0x10, 0x33, 0xC8, 0xC9, 0xCA, 0xCC, 0xCD
 2. BF tlv id 0x1c
 
+Change-Id: I0ae5cbed5b4370d39a6cfca50721873845659006
 ---
  mt7996/mcu.h         |   1 +
  mt7996/mt7996.h      |   3 ++
@@ -29,10 +30,10 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 390c7eba..f849cde7 100644
+index 8d986dee..ed998c0e 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -821,6 +821,9 @@ void mt7996_mcu_rx_bf_event(struct mt7996_dev *dev, struct sk_buff *skb);
+@@ -852,6 +852,9 @@ void mt7996_mcu_rx_bf_event(struct mt7996_dev *dev, struct sk_buff *skb);
  int mt7996_mcu_set_muru_fixed_rate_enable(struct mt7996_dev *dev, u8 action, int val);
  int mt7996_mcu_set_muru_fixed_rate_parameter(struct mt7996_dev *dev, u8 action, void *para);
  int mt7996_mcu_set_txbf_snd_info(struct mt7996_phy *phy, void *para);
@@ -43,10 +44,10 @@
  
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index b3cc8119..0e029d5d 100644
+index 51449df4..1c4e2c90 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -2912,6 +2912,127 @@ mt7996_sr_scene_cond_show(struct seq_file *file, void *data)
+@@ -2911,6 +2911,127 @@ mt7996_sr_scene_cond_show(struct seq_file *file, void *data)
  }
  DEFINE_SHOW_ATTRIBUTE(mt7996_sr_scene_cond);
  
@@ -174,7 +175,7 @@
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -3006,6 +3127,8 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -3005,6 +3126,8 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  	debugfs_create_file("bf_fbk_rpt", 0600, dir, phy, &fops_bf_fbk_rpt);
  	debugfs_create_file("pfmu_tag_read", 0600, dir, phy, &fops_bf_pfmu_tag_read);
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0037-mtk-mt76-mt7996-add-cert-patch.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0037-mtk-mt76-mt7996-add-cert-patch.patch
index 387122f..3e626f4 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0037-mtk-mt76-mt7996-add-cert-patch.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0037-mtk-mt76-mt7996-add-cert-patch.patch
@@ -1,7 +1,7 @@
-From 38a581a83e4c879be7b1c4ca197be71093d774e2 Mon Sep 17 00:00:00 2001
+From d55504a4ab7bd47bcc4c26859eda52302c4855a7 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 14 Aug 2023 13:36:58 +0800
-Subject: [PATCH 037/195] mtk: mt76: mt7996: add cert patch
+Subject: [PATCH 037/223] mtk: mt76: mt7996: add cert patch
 
 This patch includes TGac and TGax
 
@@ -26,6 +26,7 @@
 Logan set the band_bitmap to 7 in Wi-Fi 7 regardless of whether the UCC
 command specifies an interface.
 
+Change-Id: I9c2a04efa733a6de5c37a21ea71d9715edc27ddb
 Signed-off-by: ye he <ye.he@mediatek.com>
 Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 ---
@@ -41,7 +42,7 @@
  9 files changed, 779 insertions(+), 7 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 63408421..90e8e7b1 100644
+index 2ce9e839..484f91aa 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -10,6 +10,7 @@
@@ -52,7 +53,7 @@
  
  #define to_rssi(field, rcpi)	((FIELD_GET(field, rcpi) - 220) / 2)
  
-@@ -2284,6 +2285,14 @@ void mt7996_mac_update_stats(struct mt7996_phy *phy)
+@@ -2296,6 +2297,14 @@ void mt7996_mac_update_stats(struct mt7996_phy *phy)
  	}
  }
  
@@ -68,7 +69,7 @@
  {
  	struct mt7996_dev *dev = container_of(work, struct mt7996_dev, rc_work);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 72297aaa..b3313137 100644
+index 6203e800..dc00cc2f 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -602,6 +602,7 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -131,10 +132,10 @@
  
  void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 11899d78..12f64ed9 100644
+index baf71b0a..bfedfa3a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1352,6 +1352,10 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1362,6 +1362,10 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  {
  	struct sta_rec_vht *vht;
  	struct tlv *tlv;
@@ -145,7 +146,7 @@
  
  	/* For 6G band, this tlv is necessary to let hw work normally */
  	if (!sta->deflink.he_6ghz_capa.capa && !sta->deflink.vht_cap.vht_supported)
-@@ -1363,6 +1367,9 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1373,6 +1377,9 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
  	vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
  	vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
@@ -155,7 +156,7 @@
  }
  
  static void
-@@ -4446,6 +4453,27 @@ int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val)
+@@ -4476,6 +4483,27 @@ int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val)
  				 &req, sizeof(req), true);
  }
  
@@ -183,7 +184,7 @@
  int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable)
  {
  	struct {
-@@ -5013,6 +5041,18 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -5043,6 +5071,18 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  	val = FIELD_GET(RATE_CFG_VAL, *((u32 *)data));
  
  	switch (mode) {
@@ -239,10 +240,10 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index f849cde7..10b85569 100644
+index ed998c0e..a81e275d 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -354,6 +354,7 @@ struct mt7996_phy {
+@@ -363,6 +363,7 @@ struct mt7996_phy {
  	} test;
  #endif
  #ifdef CONFIG_MTK_VENDOR
@@ -250,7 +251,7 @@
  	spinlock_t amnt_lock;
  	struct mt7996_air_monitor_ctrl amnt_ctrl;
  #endif
-@@ -482,6 +483,9 @@ struct mt7996_dev {
+@@ -495,6 +496,9 @@ struct mt7996_dev {
  	} dbg;
  	const struct mt7996_dbg_reg_desc *dbg_reg;
  #endif
@@ -260,7 +261,7 @@
  };
  
  enum {
-@@ -679,6 +683,7 @@ void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb);
+@@ -710,6 +714,7 @@ void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb);
  int mt7996_mcu_get_tx_power_info(struct mt7996_phy *phy, u8 category, void *event);
  int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable);
  void mt7996_mcu_scs_sta_poll(struct work_struct *work);
@@ -268,7 +269,7 @@
  
  static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
  {
-@@ -797,6 +802,10 @@ void mt7996_vendor_register(struct mt7996_phy *phy);
+@@ -828,6 +833,10 @@ void mt7996_vendor_register(struct mt7996_phy *phy);
  void mt7996_vendor_amnt_fill_rx(struct mt7996_phy *phy, struct sk_buff *skb);
  int mt7996_vendor_amnt_sta_remove(struct mt7996_phy *phy,
  				  struct ieee80211_sta *sta);
@@ -279,7 +280,7 @@
  #endif
  
  int mt7996_mcu_edcca_enable(struct mt7996_phy *phy, bool enable);
-@@ -824,6 +833,10 @@ int mt7996_mcu_set_txbf_snd_info(struct mt7996_phy *phy, void *para);
+@@ -855,6 +864,10 @@ int mt7996_mcu_set_txbf_snd_info(struct mt7996_phy *phy, void *para);
  int mt7996_mcu_set_muru_cmd(struct mt7996_dev *dev, u16 action, int val);
  int mt7996_mcu_muru_set_prot_frame_thr(struct mt7996_dev *dev, u32 val);
  int mt7996_mcu_set_bypass_smthint(struct mt7996_phy *phy, u8 val);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0038-mtk-mt76-mt7996-add-testmode-bf-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0038-mtk-mt76-mt7996-add-testmode-bf-support.patch
index b7b653c..189f568 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0038-mtk-mt76-mt7996-add-testmode-bf-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0038-mtk-mt76-mt7996-add-testmode-bf-support.patch
@@ -1,7 +1,7 @@
-From 2a64b06cf3d56c5a9ac9fc5a78ff0cacfe9c1b8a Mon Sep 17 00:00:00 2001
+From 9cbfa34669e0afeabd5b880c3421258540f66356 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 6 Apr 2023 16:40:28 +0800
-Subject: [PATCH 038/195] mtk: mt76: mt7996: add testmode bf support
+Subject: [PATCH 038/223] mtk: mt76: mt7996: add testmode bf support
 
 Add iTest additional bf command
 
@@ -18,6 +18,7 @@
 Add testmode ibf 5T5R support for Kite BE7200 2i5i
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Change-Id: Id528088e029c507d3c9fdb92ddaa99a2e38d9eb3
 ---
  mt76.h               |   5 +
  mt76_connac_mcu.h    |   4 +-
@@ -26,20 +27,20 @@
  mt7996/mt7996.h      |  12 +-
  mt7996/mtk_debugfs.c |   6 +-
  mt7996/mtk_mcu.c     | 143 +++++++-
- mt7996/mtk_mcu.h     | 441 +++++++++++++++++++++++-
+ mt7996/mtk_mcu.h     | 441 ++++++++++++++++++++++-
  mt7996/regs.h        |   3 +
- mt7996/testmode.c    | 796 +++++++++++++++++++++++++++++++++++++++++--
- mt7996/testmode.h    |  19 ++
+ mt7996/testmode.c    | 812 +++++++++++++++++++++++++++++++++++++++++--
+ mt7996/testmode.h    |  19 +
  testmode.c           |  62 ++++
  testmode.h           |  53 +++
  tools/fields.c       |  37 ++
- 14 files changed, 1576 insertions(+), 59 deletions(-)
+ 14 files changed, 1590 insertions(+), 61 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index e25fe82c..063117fc 100644
+index 2805d758..7beefc59 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -772,6 +772,11 @@ struct mt76_testmode_data {
+@@ -774,6 +774,11 @@ struct mt76_testmode_data {
  	u32 tx_time;
  	u32 tx_ipg;
  
@@ -52,10 +53,10 @@
  	bool ebf;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index d99b338b..a3f1c5bd 100644
+index dd63d4a0..db152167 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -488,7 +488,8 @@ struct sta_rec_bf {
+@@ -493,7 +493,8 @@ struct sta_rec_bf {
  	bool codebook75_mu;
  
  	u8 he_ltf;
@@ -65,7 +66,7 @@
  } __packed;
  
  struct sta_rec_bfee {
-@@ -1291,6 +1292,7 @@ enum {
+@@ -1296,6 +1297,7 @@ enum {
  	MCU_UNI_CMD_VOW = 0x37,
  	MCU_UNI_CMD_PP = 0x38,
  	MCU_UNI_CMD_FIXED_RATE_TABLE = 0x40,
@@ -74,10 +75,10 @@
  	MCU_UNI_CMD_PRECAL_RESULT = 0x47,
  	MCU_UNI_CMD_RRO = 0x57,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 12f64ed9..09e386c0 100644
+index bfedfa3a..c0bd2d13 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1073,7 +1073,12 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -1083,7 +1083,12 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  	bss->hw_bss_idx = idx;
  
  	if (vif->type == NL80211_IFTYPE_MONITOR) {
@@ -91,7 +92,7 @@
  		return 0;
  	}
  
-@@ -4103,7 +4108,6 @@ int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 val, u8 band)
+@@ -4133,7 +4138,6 @@ int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 val, u8 band)
  int mt7996_mcu_set_txbf(struct mt7996_dev *dev, u8 action)
  {
  #define MT7996_BF_MAX_SIZE	sizeof(union bf_tag_tlv)
@@ -171,10 +172,10 @@
  	CMD_BAND_NONE,
  	CMD_BAND_24G,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 10b85569..27e93ad7 100644
+index a81e275d..32a0ffd8 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -486,6 +486,14 @@ struct mt7996_dev {
+@@ -499,6 +499,14 @@ struct mt7996_dev {
  #ifdef CONFIG_MTK_VENDOR
  	bool cert_mode;
  #endif
@@ -189,7 +190,7 @@
  };
  
  enum {
-@@ -825,7 +833,7 @@ int mt7996_mcu_muru_dbg_info(struct mt7996_dev *dev, u16 item, u8 val);
+@@ -856,7 +864,7 @@ int mt7996_mcu_muru_dbg_info(struct mt7996_dev *dev, u16 item, u8 val);
  int mt7996_mcu_set_sr_enable(struct mt7996_phy *phy, u8 action, u64 val, bool set);
  void mt7996_mcu_rx_sr_event(struct mt7996_dev *dev, struct sk_buff *skb);
  int mt7996_mcu_set_dup_wtbl(struct mt7996_dev *dev);
@@ -198,7 +199,7 @@
  void mt7996_mcu_rx_bf_event(struct mt7996_dev *dev, struct sk_buff *skb);
  int mt7996_mcu_set_muru_fixed_rate_enable(struct mt7996_dev *dev, u8 action, int val);
  int mt7996_mcu_set_muru_fixed_rate_parameter(struct mt7996_dev *dev, u8 action, void *para);
-@@ -837,10 +845,12 @@ int mt7996_mcu_set_rfeature_trig_type(struct mt7996_phy *phy, u8 enable, u8 trig
+@@ -868,10 +876,12 @@ int mt7996_mcu_set_rfeature_trig_type(struct mt7996_phy *phy, u8 enable, u8 trig
  void mt7996_mcu_set_ppdu_tx_type(struct mt7996_phy *phy, u8 ppdu_type);
  void mt7996_mcu_set_nusers_ofdma(struct mt7996_phy *phy, u8 type, u8 ofdma_user_cnt);
  void mt7996_mcu_set_cert(struct mt7996_phy *phy, u8 type);
@@ -212,10 +213,10 @@
 +
  #endif
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 0e029d5d..05cfc6ab 100644
+index 1c4e2c90..a59e3a18 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -2917,7 +2917,7 @@ mt7996_starec_bf_read_set(void *data, u64 wlan_idx)
+@@ -2916,7 +2916,7 @@ mt7996_starec_bf_read_set(void *data, u64 wlan_idx)
  {
  	struct mt7996_phy *phy = data;
  
@@ -224,7 +225,7 @@
  }
  DEFINE_DEBUGFS_ATTRIBUTE(fops_starec_bf_read, NULL,
  			 mt7996_starec_bf_read_set, "%lld\n");
-@@ -2961,7 +2961,7 @@ mt7996_bf_fbk_rpt_set(void *data, u64 wlan_idx)
+@@ -2960,7 +2960,7 @@ mt7996_bf_fbk_rpt_set(void *data, u64 wlan_idx)
  {
  	struct mt7996_phy *phy = data;
  
@@ -233,7 +234,7 @@
  }
  DEFINE_DEBUGFS_ATTRIBUTE(fops_bf_fbk_rpt, NULL,
  			 mt7996_bf_fbk_rpt_set, "%lld\n");
-@@ -2971,7 +2971,7 @@ mt7996_bf_pfmu_tag_read_set(void *data, u64 wlan_idx)
+@@ -2970,7 +2970,7 @@ mt7996_bf_pfmu_tag_read_set(void *data, u64 wlan_idx)
  {
  	struct mt7996_phy *phy = data;
  
@@ -899,7 +900,7 @@
  	__le16 wlan_idx0;
  	__le16 wlan_idx1;
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 8ec1dc1c..263737c5 100644
+index 539e799c..f55d4a94 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -326,6 +326,9 @@ enum offs_rev {
@@ -913,22 +914,28 @@
  #define MT_WF_RMAC_BASE(_band)			__BASE(WF_RMAC_BASE, (_band))
  #define MT_WF_RMAC(_band, ofs)			(MT_WF_RMAC_BASE(_band) + (ofs))
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 836211f9..5cec1eef 100644
+index c4874eb3..bace3afe 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -23,6 +23,7 @@ enum {
+@@ -23,6 +23,10 @@ enum {
  	TM_CHANGED_IPI_THRESHOLD,
  	TM_CHANGED_IPI_PERIOD,
  	TM_CHANGED_IPI_RESET,
 +	TM_CHANGED_TXBF_ACT,
++	TM_CHANGED_TX_ANTENNA,
++	TM_CHANGED_TX_RATE_NSS,
++	TM_CHANGED_TX_RATE_IDX,
  
  	/* must be last */
  	NUM_TM_CHANGED
-@@ -41,25 +42,31 @@ static const u8 tm_change_map[] = {
+@@ -41,25 +45,34 @@ static const u8 tm_change_map[] = {
  	[TM_CHANGED_IPI_THRESHOLD] = MT76_TM_ATTR_IPI_THRESHOLD,
  	[TM_CHANGED_IPI_PERIOD] = MT76_TM_ATTR_IPI_PERIOD,
  	[TM_CHANGED_IPI_RESET] = MT76_TM_ATTR_IPI_RESET,
 +	[TM_CHANGED_TXBF_ACT] = MT76_TM_ATTR_TXBF_ACT,
++	[TM_CHANGED_TX_ANTENNA] = MT76_TM_ATTR_TX_ANTENNA,
++	[TM_CHANGED_TX_RATE_NSS] = MT76_TM_ATTR_TX_RATE_NSS,
++	[TM_CHANGED_TX_RATE_IDX] = MT76_TM_ATTR_TX_RATE_IDX,
  };
  
  static void mt7996_tm_ipi_work(struct work_struct *work);
@@ -965,7 +972,7 @@
  	};
  
  	if (width >= ARRAY_SIZE(width_to_bw))
-@@ -68,26 +75,26 @@ static u32 mt7996_tm_bw_mapping(enum nl80211_chan_width width, enum bw_mapping_m
+@@ -68,26 +81,26 @@ static u32 mt7996_tm_bw_mapping(enum nl80211_chan_width width, enum bw_mapping_m
  	return width_to_bw[width][method];
  }
  
@@ -1006,7 +1013,18 @@
  }
  
  static int
-@@ -239,7 +246,7 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
+@@ -162,8 +175,8 @@ static void
+ mt7996_tm_set_antenna(struct mt7996_phy *phy, u32 func_idx)
+ {
+ #define SPE_INDEX_MASK		BIT(31)
+-#define TX_ANTENNA_MASK		GENMASK(3, 0)
+-#define RX_ANTENNA_MASK		GENMASK(20, 16)		/* RX antenna mask at most 5 bit */
++#define TX_ANTENNA_MASK		GENMASK(4, 0)
++#define RX_ANTENNA_MASK		GENMASK(20, 16)
+ 	struct mt7996_dev *dev = phy->dev;
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	u32 antenna_mask;
+@@ -239,7 +252,7 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
  		INIT_DELAYED_WORK(&phy->ipi_work, mt7996_tm_ipi_work);
  }
  
@@ -1015,7 +1033,7 @@
  mt7996_tm_update_channel(struct mt7996_phy *phy)
  {
  #define CHAN_FREQ_BW_80P80_TAG		(SET_ID(CHAN_FREQ) | BIT(16))
-@@ -303,7 +310,8 @@ mt7996_tm_set_tx_frames(struct mt7996_phy *phy, bool en)
+@@ -303,7 +316,8 @@ mt7996_tm_set_tx_frames(struct mt7996_phy *phy, bool en)
  		mt7996_tm_set(dev, SET_ID(MAC_HEADER), FRAME_CONTROL);
  		mt7996_tm_set(dev, SET_ID(SEQ_CTRL), 0);
  		mt7996_tm_set(dev, SET_ID(TX_COUNT), td->tx_count);
@@ -1025,7 +1043,7 @@
  		mt7996_tm_set(dev, SET_ID(TX_RATE), td->tx_rate_idx);
  
  		if (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_POWER))
-@@ -331,7 +339,8 @@ mt7996_tm_set_tx_frames(struct mt7996_phy *phy, bool en)
+@@ -331,7 +345,8 @@ mt7996_tm_set_tx_frames(struct mt7996_phy *phy, bool en)
  
  		mt7996_tm_set(dev, SET_ID(MAX_PE), 2);
  		mt7996_tm_set(dev, SET_ID(HW_TX_MODE), 0);
@@ -1035,7 +1053,7 @@
  
  		/* trigger firmware to start TX */
  		mt7996_tm_set(dev, SET_ID(COMMAND), RF_CMD(START_TX));
-@@ -373,7 +382,8 @@ mt7996_tm_set_rx_frames(struct mt7996_phy *phy, bool en)
+@@ -373,7 +388,8 @@ mt7996_tm_set_rx_frames(struct mt7996_phy *phy, bool en)
  			return;
  		}
  
@@ -1045,7 +1063,7 @@
  
  		if (td->tx_rate_mode >= MT76_TM_TX_MODE_HE_MU) {
  			if (td->aid)
-@@ -381,7 +391,8 @@ mt7996_tm_set_rx_frames(struct mt7996_phy *phy, bool en)
+@@ -381,7 +397,8 @@ mt7996_tm_set_rx_frames(struct mt7996_phy *phy, bool en)
  			else
  				ret = mt7996_tm_set(dev, SET_ID(RX_MU_AID), RX_MU_DISABLE);
  		}
@@ -1055,7 +1073,7 @@
  		mt7996_tm_set(dev, SET_ID(GI), td->tx_rate_sgi);
  		mt7996_tm_set_antenna(phy, SET_ID(RX_PATH));
  		mt7996_tm_set(dev, SET_ID(MAX_PE), 2);
-@@ -405,7 +416,8 @@ mt7996_tm_set_tx_cont(struct mt7996_phy *phy, bool en)
+@@ -405,7 +422,8 @@ mt7996_tm_set_tx_cont(struct mt7996_phy *phy, bool en)
  
  	if (en) {
  		mt7996_tm_update_channel(phy);
@@ -1065,7 +1083,7 @@
  		mt7996_tm_set(dev, SET_ID(TX_RATE), td->tx_rate_idx);
  		/* fix payload is OFDM */
  		mt7996_tm_set(dev, SET_ID(CONT_WAVE_MODE), CONT_WAVE_MODE_OFDM);
-@@ -1047,6 +1059,730 @@ mt7996_tm_set_ipi(struct mt7996_phy *phy)
+@@ -1047,6 +1065,728 @@ mt7996_tm_set_ipi(struct mt7996_phy *phy)
  	return 0;
  }
  
@@ -1196,6 +1214,7 @@
 +		if (nss == 5) {
 +			td->tx_rate_mode = MT76_TM_TX_MODE_VHT;
 +			td->tx_rate_idx = 7;
++			td->tx_rate_nss = 4;
 +		}
 +	} else {
 +		if (td->is_txbf_dut) {
@@ -1496,8 +1515,8 @@
 +static int
 +mt7996_tm_txbf_profile_update_all(struct mt7996_phy *phy, u16 *val)
 +{
-+	struct mt76_testmode_data *td = &phy->mt76->test;
-+	u8 nss = hweight8(td->tx_antenna_mask);
++	struct mt7996_dev *dev = phy->dev;
++	u8 nss = hweight16(phy->mt76->chainmask);
 +	u16 pfmu_idx = val[0];
 +	u16 subc_id = val[1];
 +	u16 angle11 = val[2];
@@ -1529,7 +1548,7 @@
 +		phi31 = (s16)(angle41 - angle31);
 +	}
 +
-+	pfmu_data = (s16 *)phy->dev->test.txbf_pfmu_data;
++	pfmu_data = (s16 *)dev->test.txbf_pfmu_data;
 +	pfmu_data += offs;
 +
 +	if (subc_id < 32)
@@ -1544,7 +1563,6 @@
 +		pfmu_data[4] = cpu_to_le16(phi41);
 +
 +	if (subc_id == MT7996_TXBF_SUBCAR_NUM - 1) {
-+		struct mt7996_dev *dev = phy->dev;
 +		struct mt7996_tm_bf_req req = {
 +			.pfmu_data_all = {
 +				.tag = cpu_to_le16(BF_PROFILE_WRITE_20M_ALL_5X5),
@@ -1644,8 +1662,6 @@
 +		if (!td->bf_ever_en) {
 +			mt7996_tm_set_rx_frames(phy, false);
 +			mt7996_tm_set_tx_frames(phy, false);
-+			td->ibf = false;
-+			td->ebf = false;
 +
 +			if (update)
 +				mt7996_tm_txbf_apply_tx(phy, 1, 0, 0, 0);
@@ -1796,12 +1812,20 @@
  static void
  mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
  {
-@@ -1086,6 +1822,8 @@ mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
+@@ -1086,6 +1826,16 @@ mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
  		mt7996_tm_set_ipi(phy);
  	if (changed & BIT(TM_CHANGED_IPI_RESET))
  		mt7996_tm_ipi_hist_ctrl(phy, NULL, RDD_SET_IPI_HIST_RESET);
 +	if (changed & BIT(TM_CHANGED_TXBF_ACT))
 +		mt7996_tm_set_txbf(phy);
++	if (changed & BIT(TM_CHANGED_TX_ANTENNA)) {
++		mt7996_tm_set_antenna(phy, SET_ID(TX_PATH));
++		mt7996_tm_set_antenna(phy, SET_ID(RX_PATH));
++	}
++	if (changed & BIT(TM_CHANGED_TX_RATE_NSS))
++		mt7996_tm_set(dev, SET_ID(NSS), td->tx_rate_nss);
++	if (changed & BIT(TM_CHANGED_TX_RATE_IDX))
++		mt7996_tm_set(dev, SET_ID(TX_RATE), td->tx_rate_idx);
  }
  
  static int
@@ -1849,7 +1873,7 @@
  	__le32 func_data;
  	u8 band_idx;
 diff --git a/testmode.c b/testmode.c
-index 69147f86..b9f71097 100644
+index 69147f86..9a7559bf 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -462,6 +462,44 @@ out:
@@ -1867,7 +1891,7 @@
 +	struct nlattr *cur;
 +	u16 tmp_val[PARAM_UNIT_5X5], *val = td->txbf_param;
 +	int idx, rem, ret, i = 0;
-+	int param_len = td->tx_antenna_mask == 31 ? PARAM_UNIT_5X5 : PARAM_UNIT;
++	int param_len = hweight16(phy->chainmask) == 5 ? PARAM_UNIT_5X5 : PARAM_UNIT;
 +
 +	memset(td->txbf_param, 0, sizeof(td->txbf_param));
 +	nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
@@ -1929,10 +1953,10 @@
  		err = dev->test_ops->set_params(phy, tb, state);
  		if (err)
 diff --git a/testmode.h b/testmode.h
-index 5d677f8c..bda7624a 100644
+index 6d79832a..794a74f9 100644
 --- a/testmode.h
 +++ b/testmode.h
-@@ -286,6 +286,59 @@ enum mt76_testmode_eeprom_action {
+@@ -286,4 +286,57 @@ enum mt76_testmode_eeprom_action {
  	MT76_TM_EEPROM_ACTION_MAX = NUM_MT76_TM_EEPROM_ACTION - 1,
  };
  
@@ -1989,8 +2013,6 @@
 +	MT76_TM_TXBF_ACT_MAX = NUM_MT76_TM_TXBF_ACT - 1,
 +};
 +
- extern const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS];
- 
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
 index 77696ce7..f793d1a5 100644
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0039-mtk-mt76-mt7996-add-zwdfs-cert-mode.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0039-mtk-mt76-mt7996-add-zwdfs-cert-mode.patch
index 8abe3ef..7e6ac6a 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0039-mtk-mt76-mt7996-add-zwdfs-cert-mode.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0039-mtk-mt76-mt7996-add-zwdfs-cert-mode.patch
@@ -1,7 +1,7 @@
-From 88436d5806850055746dab3cd1400b76eca97979 Mon Sep 17 00:00:00 2001
+From fe038594fb92fae539bf05f86022953810e4e1e6 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 22 Sep 2023 12:33:06 +0800
-Subject: [PATCH 039/195] mtk: mt76: mt7996: add zwdfs cert mode
+Subject: [PATCH 039/223] mtk: mt76: mt7996: add zwdfs cert mode
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -13,10 +13,10 @@
  5 files changed, 100 insertions(+), 12 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 09e386c0..c4ac4b7f 100644
+index c0bd2d13..9e548100 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4502,18 +4502,7 @@ int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable)
+@@ -4532,18 +4532,7 @@ int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable)
  int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
  		       u8 rx_sel, u8 val)
  {
@@ -36,7 +36,7 @@
  		.tag = cpu_to_le16(UNI_RDD_CTRL_PARM),
  		.len = cpu_to_le16(sizeof(req) - 4),
  		.ctrl = cmd,
-@@ -4526,6 +4515,37 @@ int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
+@@ -4556,6 +4545,37 @@ int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
  				 &req, sizeof(req), true);
  }
  
@@ -100,10 +100,10 @@
  	u8 _rsv[4];
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 27e93ad7..ab60eb77 100644
+index 32a0ffd8..e406dc87 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -523,8 +523,11 @@ enum mt7996_rdd_cmd {
+@@ -536,8 +536,11 @@ enum mt7996_rdd_cmd {
  	RDD_READ_PULSE,
  	RDD_RESUME_BF,
  	RDD_IRQ_OFF,
@@ -115,7 +115,7 @@
  static inline struct mt7996_phy *
  mt7996_hw_phy(struct ieee80211_hw *hw)
  {
-@@ -666,6 +669,8 @@ int mt7996_mcu_set_thermal_protect(struct mt7996_phy *phy, bool enable);
+@@ -697,6 +700,8 @@ int mt7996_mcu_set_thermal_protect(struct mt7996_phy *phy, bool enable);
  int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy);
  int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
  		       u8 rx_sel, u8 val);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0040-mtk-mt76-mt7996-add-channel-68-96.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0040-mtk-mt76-mt7996-add-channel-68-96.patch
index f54efed..a97824b 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0040-mtk-mt76-mt7996-add-channel-68-96.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0040-mtk-mt76-mt7996-add-channel-68-96.patch
@@ -1,7 +1,7 @@
-From 61eca1d35212a7e73af941e2ceaeac73ca49ca5d Mon Sep 17 00:00:00 2001
+From 1836ddf781e91b41f66a1add7110bd24d133817c Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 11 Sep 2023 14:43:07 +0800
-Subject: [PATCH 040/195] mtk: mt76: mt7996: add channel 68 & 96
+Subject: [PATCH 040/223] mtk: mt76: mt7996: add channel 68 & 96
 
 ---
  mac80211.c        |  9 +++++++++
@@ -13,7 +13,7 @@
  6 files changed, 82 insertions(+), 9 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 18428e44..32ae1e52 100644
+index 1d2477d6..ee5aa608 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -34,6 +34,15 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
@@ -33,7 +33,7 @@
  	CHAN5G(104, 5520),
  	CHAN5G(108, 5540),
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index f4641321..8a0f6d39 100644
+index da30be33..b71961d9 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -18,6 +18,17 @@ const struct ieee80211_channel dpd_2g_ch_list_bw20[] = {
@@ -62,7 +62,7 @@
  const u32 dpd_5g_bw160_ch_num = ARRAY_SIZE(dpd_5g_ch_list_bw160);
  const u32 dpd_6g_bw160_ch_num = ARRAY_SIZE(dpd_6g_ch_list_bw160);
  const u32 dpd_6g_bw320_ch_num = ARRAY_SIZE(dpd_6g_ch_list_bw320);
-@@ -168,8 +180,8 @@ mt7996_get_dpd_per_band_size(struct mt7996_dev *dev, enum nl80211_band band)
+@@ -191,8 +203,8 @@ mt7996_get_dpd_per_band_size(struct mt7996_dev *dev, enum nl80211_band band)
  	if (band == NL80211_BAND_2GHZ)
  		dpd_size = dpd_2g_bw20_ch_num * DPD_PER_CH_BW20_SIZE;
  	else if (band == NL80211_BAND_5GHZ)
@@ -73,7 +73,7 @@
  	else
  		dpd_size = mphy->sband_6g.sband.n_channels * DPD_PER_CH_BW20_SIZE +
  			   (dpd_6g_bw160_ch_num + dpd_6g_bw320_ch_num) * DPD_PER_CH_GT_BW20_SIZE;
-@@ -431,6 +443,39 @@ out:
+@@ -481,6 +493,39 @@ out:
  	return ret;
  }
  
@@ -114,7 +114,7 @@
  {
  	struct mt76_dev *mdev = &dev->mt76;
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 03a4fd07..9a15b446 100644
+index e90180a0..782d847b 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -67,6 +67,8 @@ enum mt7996_eeprom_field {
@@ -127,10 +127,10 @@
  extern const u32 dpd_5g_bw160_ch_num;
  extern const struct ieee80211_channel dpd_6g_ch_list_bw160[];
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index c4ac4b7f..20ac22dd 100644
+index 9e548100..54a84966 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3772,7 +3772,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3802,7 +3802,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  		chan_list_size = mphy->sband_5g.sband.n_channels;
  		base_offset += dpd_size_2g;
  		if (bw == NL80211_CHAN_WIDTH_160) {
@@ -140,7 +140,7 @@
  			per_chan_size = DPD_PER_CH_GT_BW20_SIZE;
  			cal_id = RF_DPD_FLAT_5G_MEM_CAL;
  			chan_list = dpd_5g_ch_list_bw160;
-@@ -3781,6 +3782,9 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3811,6 +3812,9 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  			/* apply (center channel - 2)'s dpd cal data for bw 40/80 channels */
  			channel -= 2;
  		}
@@ -150,7 +150,7 @@
  		break;
  	case NL80211_BAND_6GHZ:
  		dpd_mask = MT_EE_WIFI_CAL_DPD_6G;
-@@ -3820,6 +3824,10 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3850,6 +3854,10 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  	if (idx == chan_list_size)
  		return -EINVAL;
  
@@ -162,10 +162,10 @@
  
  	for (i = 0; i < per_chan_size / MT_EE_CAL_UNIT; i++) {
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 5cec1eef..95d3bde0 100644
+index bace3afe..6de49afc 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -531,6 +531,11 @@ mt7996_tm_dpd_prek_send_req(struct mt7996_phy *phy, struct mt7996_tm_req *req,
+@@ -537,6 +537,11 @@ mt7996_tm_dpd_prek_send_req(struct mt7996_phy *phy, struct mt7996_tm_req *req,
  	memcpy(&chandef_backup, chandef, sizeof(struct cfg80211_chan_def));
  
  	for (i = 0; i < channel_size; i++) {
@@ -177,7 +177,7 @@
  		memcpy(chandef->chan, &chan_list[i], sizeof(struct ieee80211_channel));
  		chandef->width = width;
  
-@@ -612,7 +617,8 @@ mt7996_tm_dpd_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
+@@ -618,7 +623,8 @@ mt7996_tm_dpd_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
  						  NL80211_CHAN_WIDTH_20, RF_DPD_FLAT_5G_CAL);
  		if (ret)
  			return ret;
@@ -187,7 +187,7 @@
  		wait_event_timeout(mdev->mcu.wait,
  				   dev->cur_prek_offset == wait_on_prek_offset, 30 * HZ);
  
-@@ -868,6 +874,7 @@ mt7996_tm_get_center_chan(struct mt7996_phy *phy, struct cfg80211_chan_def *chan
+@@ -874,6 +880,7 @@ mt7996_tm_get_center_chan(struct mt7996_phy *phy, struct cfg80211_chan_def *chan
  	const struct ieee80211_channel *chan = mphy->sband_5g.sband.channels;
  	u32 bitmap, i, offset, width_mhz, size = mphy->sband_5g.sband.n_channels;
  	u16 first_control = 0, control_chan = chandef->chan->hw_value;
@@ -195,7 +195,7 @@
  
  	bitmap = mt7996_tm_bw_mapping(chandef->width, BW_MAP_NL_TO_CONTROL_BITMAP_5G);
  	if (!bitmap)
-@@ -877,7 +884,9 @@ mt7996_tm_get_center_chan(struct mt7996_phy *phy, struct cfg80211_chan_def *chan
+@@ -883,7 +890,9 @@ mt7996_tm_get_center_chan(struct mt7996_phy *phy, struct cfg80211_chan_def *chan
  	offset = width_mhz / 10 - 2;
  
  	for (i = 0; i < size; i++) {
@@ -206,7 +206,7 @@
  			continue;
  
  		if (control_chan >= chan[i].hw_value)
-@@ -886,7 +895,7 @@ mt7996_tm_get_center_chan(struct mt7996_phy *phy, struct cfg80211_chan_def *chan
+@@ -892,7 +901,7 @@ mt7996_tm_get_center_chan(struct mt7996_phy *phy, struct cfg80211_chan_def *chan
  			break;
  	}
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0041-mtk-mt76-mt7996-add-kite-testmode-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0041-mtk-mt76-mt7996-add-kite-testmode-support.patch
index cb58636..88296a5 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0041-mtk-mt76-mt7996-add-kite-testmode-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0041-mtk-mt76-mt7996-add-kite-testmode-support.patch
@@ -1,7 +1,7 @@
-From 34dca69065ed7d11afc1e6616f784c2a08aae139 Mon Sep 17 00:00:00 2001
+From fa32fd17aed1561a48cff42344e06d5ebf5a736d Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 12 Oct 2023 16:17:33 +0800
-Subject: [PATCH 041/195] mtk: mt76: mt7996: add kite testmode support
+Subject: [PATCH 041/223] mtk: mt76: mt7996: add kite testmode support
 
 Add Kite testmode support
 1. avoid entering connac 2 testmode flow in kite
@@ -18,7 +18,7 @@
  6 files changed, 202 insertions(+), 122 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 8a0f6d39..0d50d313 100644
+index b71961d9..7575dcb9 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -29,12 +29,39 @@ const struct ieee80211_channel dpd_5g_skip_ch_list[] = {
@@ -74,8 +74,8 @@
  static int mt7996_check_eeprom(struct mt7996_dev *dev)
  {
  	u8 *eeprom = dev->mt76.eeprom.data;
-@@ -159,36 +180,6 @@ const char *mt7996_eeprom_name(struct mt7996_dev *dev)
- 	}
+@@ -182,36 +203,6 @@ static bool mt7996_eeprom_variant_valid(struct mt7996_dev *dev, const u8 *def)
+ 	return true;
  }
  
 -int
@@ -109,10 +109,10 @@
 -}
 -
  static int
- mt7996_eeprom_load_bin(struct mt7996_dev *dev)
+ mt7996_eeprom_check_or_use_default(struct mt7996_dev *dev, bool use_default)
  {
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 9a15b446..fa9c31e7 100644
+index 782d847b..c3c248ca 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -45,36 +45,69 @@ enum mt7996_eeprom_field {
@@ -210,10 +210,10 @@
  #define RF_DPD_FLAT_CAL				BIT(28)
  #define RF_PRE_CAL				BIT(29)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 20ac22dd..b895c2a7 100644
+index 54a84966..87322283 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3741,13 +3741,11 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3771,13 +3771,11 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  	enum nl80211_chan_width bw = chandef->width;
  	const struct ieee80211_channel *chan_list;
  	u32 cal_id, chan_list_size, base_offset = 0, offs = MT_EE_DO_PRE_CAL;
@@ -229,7 +229,7 @@
  
  	switch (band) {
  	case NL80211_BAND_2GHZ:
-@@ -3763,27 +3761,35 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3793,27 +3791,35 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  			return 0;
  		cal_id = RF_DPD_FLAT_CAL;
  		chan_list = dpd_2g_ch_list_bw20;
@@ -271,7 +271,7 @@
  			return 0;
  		break;
  	case NL80211_BAND_6GHZ:
-@@ -3791,20 +3797,27 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3821,20 +3827,27 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  		cal_id = RF_DPD_FLAT_6G_CAL;
  		chan_list = mphy->sband_6g.sband.channels;
  		chan_list_size = mphy->sband_6g.sband.n_channels;
@@ -304,7 +304,7 @@
  		} else if (bw > NL80211_CHAN_WIDTH_20) {
  			/* apply (center channel - 2)'s dpd cal data for bw 40/80 channels */
  			channel -= 2;
-@@ -3824,9 +3837,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
+@@ -3854,9 +3867,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
  	if (idx == chan_list_size)
  		return -EINVAL;
  
@@ -317,10 +317,10 @@
  	cal += MT_EE_CAL_GROUP_SIZE + base_offset + idx * per_chan_size;
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index ab60eb77..a83e9f35 100644
+index e406dc87..981f496e 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -194,6 +194,19 @@ struct mt7996_twt_flow {
+@@ -203,6 +203,19 @@ struct mt7996_twt_flow {
  
  DECLARE_EWMA(avg_signal, 10, 8)
  
@@ -340,7 +340,7 @@
  struct mt7996_sta {
  	struct mt76_wcid wcid; /* must be first */
  
-@@ -463,6 +476,10 @@ struct mt7996_dev {
+@@ -472,6 +485,10 @@ struct mt7996_dev {
  
  	void *cal;
  	u32 cur_prek_offset;
@@ -351,7 +351,7 @@
  
  	struct {
  		u16 table_mask;
-@@ -599,7 +616,6 @@ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
+@@ -630,7 +647,6 @@ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
  int mt7996_eeprom_get_target_power(struct mt7996_dev *dev,
  				   struct ieee80211_channel *chan);
  s8 mt7996_eeprom_get_power_delta(struct mt7996_dev *dev, int band);
@@ -360,10 +360,10 @@
  void mt7996_dma_reset(struct mt7996_dev *dev, bool force);
  void mt7996_dma_prefetch(struct mt7996_dev *dev);
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 95d3bde0..9fa4edcd 100644
+index 6de49afc..5c0eb3cb 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -434,7 +434,7 @@ mt7996_tm_set_tx_cont(struct mt7996_phy *phy, bool en)
+@@ -440,7 +440,7 @@ mt7996_tm_set_tx_cont(struct mt7996_phy *phy, bool en)
  static int
  mt7996_tm_group_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
  {
@@ -372,7 +372,7 @@
  	u32 i, group_size, dpd_size, size, offs, *pre_cal;
  	int ret = 0;
  	struct mt7996_dev *dev = phy->dev;
-@@ -462,6 +462,9 @@ mt7996_tm_group_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
+@@ -468,6 +468,9 @@ mt7996_tm_group_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
  	dpd_size = MT_EE_CAL_DPD_SIZE;
  	size = group_size + dpd_size;
  	offs = MT_EE_DO_PRE_CAL;
@@ -382,7 +382,7 @@
  
  	switch (state) {
  	case MT76_TM_STATE_GROUP_PREK:
-@@ -476,13 +479,10 @@ mt7996_tm_group_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
+@@ -482,13 +485,10 @@ mt7996_tm_group_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
  		wait_event_timeout(mdev->mcu.wait, dev->cur_prek_offset == group_size,
  				   30 * HZ);
  
@@ -399,7 +399,7 @@
  		break;
  	case MT76_TM_STATE_GROUP_PREK_DUMP:
  		pre_cal = (u32 *)dev->cal;
-@@ -520,10 +520,12 @@ mt7996_tm_dpd_prek_send_req(struct mt7996_phy *phy, struct mt7996_tm_req *req,
+@@ -526,10 +526,12 @@ mt7996_tm_dpd_prek_send_req(struct mt7996_phy *phy, struct mt7996_tm_req *req,
  	struct mt76_phy *mphy = phy->mt76;
  	struct cfg80211_chan_def chandef_backup, *chandef = &mphy->chandef;
  	struct ieee80211_channel chan_backup;
@@ -413,7 +413,7 @@
  
  	req->rf_test.op.rf.param.cal_param.func_data = cpu_to_le32(func_data);
  
-@@ -533,7 +535,7 @@ mt7996_tm_dpd_prek_send_req(struct mt7996_phy *phy, struct mt7996_tm_req *req,
+@@ -539,7 +541,7 @@ mt7996_tm_dpd_prek_send_req(struct mt7996_phy *phy, struct mt7996_tm_req *req,
  	for (i = 0; i < channel_size; i++) {
  		if (chan_list[i].band == NL80211_BAND_5GHZ &&
  		    chan_list[i].hw_value >= dpd_5g_skip_ch_list[0].hw_value &&
@@ -422,7 +422,7 @@
  			continue;
  
  		memcpy(chandef->chan, &chan_list[i], sizeof(struct ieee80211_channel));
-@@ -602,11 +604,11 @@ mt7996_tm_dpd_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
+@@ -608,11 +610,11 @@ mt7996_tm_dpd_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
  	switch (state) {
  	case MT76_TM_STATE_DPD_2G:
  		ret = mt7996_tm_dpd_prek_send_req(phy, &req, dpd_2g_ch_list_bw20,
@@ -438,7 +438,7 @@
  
  		do_precal = MT_EE_WIFI_CAL_DPD_2G;
  		break;
-@@ -617,18 +619,27 @@ mt7996_tm_dpd_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
+@@ -623,18 +625,27 @@ mt7996_tm_dpd_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
  						  NL80211_CHAN_WIDTH_20, RF_DPD_FLAT_5G_CAL);
  		if (ret)
  			return ret;
@@ -474,7 +474,7 @@
  
  		do_precal = MT_EE_WIFI_CAL_DPD_5G;
  		break;
-@@ -639,27 +650,37 @@ mt7996_tm_dpd_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
+@@ -645,27 +656,37 @@ mt7996_tm_dpd_prek(struct mt7996_phy *phy, enum mt76_testmode_state state)
  						  NL80211_CHAN_WIDTH_20, RF_DPD_FLAT_6G_CAL);
  		if (ret)
  			return ret;
@@ -523,7 +523,7 @@
  
  		do_precal = MT_EE_WIFI_CAL_DPD_6G;
  		break;
-@@ -732,9 +753,9 @@ mt7996_tm_dump_precal(struct mt76_phy *mphy, struct sk_buff *msg, int flag, int
+@@ -738,9 +759,9 @@ mt7996_tm_dump_precal(struct mt76_phy *mphy, struct sk_buff *msg, int flag, int
  	eeprom = dev->mt76.eeprom.data;
  	offs = MT_EE_DO_PRE_CAL;
  
@@ -536,7 +536,7 @@
  
  	switch (type) {
  	case PREK_SYNC_ALL:
-@@ -810,9 +831,9 @@ mt7996_tm_re_cal_event(struct mt7996_dev *dev, struct mt7996_tm_rf_test_result *
+@@ -816,9 +837,9 @@ mt7996_tm_re_cal_event(struct mt7996_dev *dev, struct mt7996_tm_rf_test_result *
  	u8 *pre_cal;
  
  	pre_cal = dev->cal;
@@ -550,7 +550,7 @@
  	cal_idx = le32_to_cpu(data->cal_idx);
  	cal_type = le32_to_cpu(data->cal_type);
 diff --git a/testmode.c b/testmode.c
-index b9f71097..f1d162ce 100644
+index 9a7559bf..a1744755 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -37,6 +37,11 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0042-mtk-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for-CERT.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0042-mtk-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for-CERT.patch
index 8c04df6..7c54397 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0042-mtk-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for-CERT.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0042-mtk-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for-CERT.patch
@@ -1,7 +1,7 @@
-From 74ea29a51424803f9853b895b8c763c232867a2f Mon Sep 17 00:00:00 2001
+From 86493d14f89cf1c6916bdac4fe2ecfc1b20c84e6 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Tue, 14 Nov 2023 11:27:06 +0800
-Subject: [PATCH 042/195] mtk: mt76: mt7996: assign DEAUTH to ALTX queue for
+Subject: [PATCH 042/223] mtk: mt76: mt7996: assign DEAUTH to ALTX queue for
  CERT
 
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 10 insertions(+)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 90e8e7b1..bcddff23 100644
+index 484f91aa..f78591ff 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -747,6 +747,8 @@ static void
+@@ -759,6 +759,8 @@ static void
  mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
  			    struct sk_buff *skb, struct ieee80211_key_conf *key)
  {
@@ -22,7 +22,7 @@
  	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-@@ -756,6 +758,14 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
+@@ -768,6 +770,14 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
  	u8 fc_type, fc_stype;
  	u32 val;
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0043-mtk-mt76-mt7996-add-no_beacon-vendor-command-for-cer.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0043-mtk-mt76-mt7996-add-no_beacon-vendor-command-for-cer.patch
index f9b0f98..3197335 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0043-mtk-mt76-mt7996-add-no_beacon-vendor-command-for-cer.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0043-mtk-mt76-mt7996-add-no_beacon-vendor-command-for-cer.patch
@@ -1,7 +1,7 @@
-From 10e70842e50c8506f2a76d75299cebf26c96532f Mon Sep 17 00:00:00 2001
+From d75372c3491e32a67af73ce130cd36f03af82d51 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Nov 2023 22:42:09 +0800
-Subject: [PATCH 043/195] mtk: mt76: mt7996: add no_beacon vendor command for
+Subject: [PATCH 043/223] mtk: mt76: mt7996: add no_beacon vendor command for
  cert
 
 Add the vendor command to disable/enable beacon
@@ -12,6 +12,7 @@
 0: enable beacon
 1: disable beacon
 
+Change-Id: Ia16707317135aeb02d6a5f6d50983e5174cc9e77
 Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
 ---
  mt7996/mcu.c    | 11 +++++++++++
@@ -21,10 +22,10 @@
  4 files changed, 65 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index b895c2a7..69303379 100644
+index 87322283..9431f878 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -5106,4 +5106,15 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -5136,4 +5136,15 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  		break;
  	}
  }
@@ -41,10 +42,10 @@
 +}
  #endif
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index a83e9f35..73f5d7b1 100644
+index 981f496e..f6e7fbdd 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -835,6 +835,7 @@ void mt7996_set_wireless_amsdu(struct ieee80211_hw *hw, u8 en);
+@@ -866,6 +866,7 @@ void mt7996_set_wireless_amsdu(struct ieee80211_hw *hw, u8 en);
  void mt7996_mcu_set_mimo(struct mt7996_phy *phy);
  int mt7996_set_muru_cfg(struct mt7996_phy *phy, u8 action, u8 val);
  int mt7996_mcu_set_muru_cfg(struct mt7996_phy *phy, void *data);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0044-mtk-mt76-mt7996-add-adie-efuse-merge-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0044-mtk-mt76-mt7996-add-adie-efuse-merge-support.patch
index 874d006..099e068 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0044-mtk-mt76-mt7996-add-adie-efuse-merge-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0044-mtk-mt76-mt7996-add-adie-efuse-merge-support.patch
@@ -1,22 +1,23 @@
-From 5c1379250d94f65a0a1aa88be817075a6ea322ea Mon Sep 17 00:00:00 2001
+From 031841be718eb6736dec9c52744664433ed2a34e Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 24 Nov 2023 09:49:08 +0800
-Subject: [PATCH 044/195] mtk: mt76: mt7996: add adie efuse merge support
+Subject: [PATCH 044/223] mtk: mt76: mt7996: add adie efuse merge support
 
 Merge adie-dependent parameters in efuse into eeprom after FT.
 Note that Eagle BE14000 is not considered yet.
 Add efuse dump command.
 
+Change-Id: Ib088b90147c75d7437f40dd3569e3584c6ff9ab0
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mt7996/debugfs.c  |  41 +++++++++++++
  mt7996/eeprom.c   | 144 ++++++++++++++++++++++++++++++++++++++++++++++
- mt7996/mcu.c      |   6 +-
+ mt7996/main.c     |   4 +-
  mt7996/testmode.c |   8 ++-
- 4 files changed, 195 insertions(+), 4 deletions(-)
+ 4 files changed, 193 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 1f4bad62..58879695 100644
+index 1f4bad62..70a97d29 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -881,6 +881,46 @@ DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_muru_disable,
@@ -35,7 +36,7 @@
 +	u32 block_num;
 +
 +	mdev->otp.size = MT7996_EEPROM_SIZE;
-+	if (is_mt7996(&dev->mt76) && dev->chip_sku == MT7996_SKU_444)
++	if (is_mt7996(&dev->mt76) && dev->chip_sku == MT7996_VAR_TYPE_444)
 +		mdev->otp.size += 3 * MT_EE_CAL_UNIT;
 +
 +	if (!mdev->otp.data) {
@@ -75,10 +76,10 @@
  	if (phy->mt76->cap.has_5ghz) {
  		debugfs_create_u32("dfs_hw_pattern", 0400, dir,
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 0d50d313..8cdd6d96 100644
+index 7575dcb9..be87afe8 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -496,6 +496,146 @@ static int mt7996_eeprom_load_precal(struct mt7996_dev *dev)
+@@ -546,6 +546,146 @@ static int mt7996_eeprom_load_precal(struct mt7996_dev *dev)
  	return mt76_get_of_data_from_nvmem(mdev, dev->cal, "precal", size);
  }
  
@@ -147,7 +148,7 @@
 +		eep_offs[0] = eep_offs_list[adie_id];
 +
 +		/* adie 1 */
-+		if (dev->chip_sku != MT7996_SKU_404) {
++		if (dev->chip_sku != MT7996_VAR_TYPE_404) {
 +			adie_offs[1] = adie_offs_list[ADIE_7977];
 +			eep_offs[1] = eep_offs_list[ADIE_7977];
 +		}
@@ -159,10 +160,10 @@
 +	case 0x7992:
 +		adie_base = adie_base_7992;
 +		/* adie 0 */
-+		if (dev->chip_sku == MT7992_SKU_44 &&
++		if (dev->chip_sku == MT7992_VAR_TYPE_44 &&
 +		    dev->fem_type != MT7996_FEM_EXT)
 +			adie_id = ADIE_7975;
-+		else if (dev->chip_sku == MT7992_SKU_24)
++		else if (dev->chip_sku == MT7992_VAR_TYPE_24)
 +			adie_id = ADIE_7978;
 +		else
 +			adie_id = ADIE_7976;
@@ -170,10 +171,10 @@
 +		eep_offs[0] = eep_offs_list[adie_id];
 +
 +		/* adie 1 */
-+		if (dev->chip_sku == MT7992_SKU_44 &&
++		if (dev->chip_sku == MT7992_VAR_TYPE_44 &&
 +		    dev->fem_type != MT7996_FEM_INT)
 +			adie_id = ADIE_7977;
-+		else if (dev->chip_sku != MT7992_SKU_23)
++		else if (dev->chip_sku != MT7992_VAR_TYPE_23)
 +			adie_id = ADIE_7979;
 +		else
 +			break;
@@ -199,7 +200,7 @@
 +			if (adie_offs[band][i] == MT_EE_END_OFFSET)
 +				break;
 +
-+			if (is_mt7996(&dev->mt76) && dev->chip_sku == MT7996_SKU_444 &&
++			if (is_mt7996(&dev->mt76) && dev->chip_sku == MT7996_VAR_TYPE_444 &&
 +			    band == MT_BAND1)
 +				eep_offset -= MT_EE_7977BN_OFFSET;
 +
@@ -225,9 +226,9 @@
  int mt7996_eeprom_init(struct mt7996_dev *dev)
  {
  	int ret;
-@@ -512,6 +652,10 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
- 	if (ret)
- 		return ret;
+@@ -556,6 +696,10 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
+ 
+ 	mt7996_eeprom_load_precal(dev);
  
 +	ret = mt7996_apply_cal_free_data(dev);
 +	if (ret)
@@ -236,42 +237,31 @@
  	ret = mt7996_eeprom_parse_hw_cap(dev, &dev->phy);
  	if (ret < 0)
  		return ret;
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 69303379..a6558fee 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -3612,7 +3612,7 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf)
- 	};
- 	struct sk_buff *skb;
- 	bool valid;
--	int ret;
-+	int ret = 0;
- 	u8 *buf = read_buf;
- 
- 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
-@@ -3630,11 +3630,13 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf)
- 
- 		skb_pull(skb, 48);
- 		memcpy(buf, skb->data, MT7996_EEPROM_BLOCK_SIZE);
-+	} else {
-+		ret = -EINVAL;
- 	}
- 
- 	dev_kfree_skb(skb);
- 
--	return 0;
-+	return ret;
- }
- 
- int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num)
+diff --git a/mt7996/main.c b/mt7996/main.c
+index dc00cc2f..ea4679dd 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -1485,10 +1485,10 @@ mt7996_background_radar_handle_7975_ifem(struct ieee80211_hw *hw,
+ 	switch (mt76_chip(&dev->mt76)) {
+ 	case 0x7990:
+ 		is_ifem_adie = dev->fem_type == MT7996_FEM_INT &&
+-			       dev->chip_sku != MT7996_SKU_233;
++			       dev->chip_sku != MT7996_VAR_TYPE_233;
+ 		break;
+ 	case 0x7992:
+-		is_ifem_adie = dev->chip_sku == MT7992_SKU_44 &&
++		is_ifem_adie = dev->chip_sku == MT7992_VAR_TYPE_44 &&
+ 			       dev->fem_type != MT7996_FEM_EXT;
+ 		break;
+ 	default:
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 9fa4edcd..784a8bea 100644
+index 5c0eb3cb..5a8b6d0a 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -2116,8 +2116,12 @@ mt7996_tm_write_back_to_efuse(struct mt7996_dev *dev)
+@@ -2128,8 +2128,12 @@ mt7996_tm_write_back_to_efuse(struct mt7996_dev *dev)
  		memcpy(req.data, eeprom + i, MT76_TM_EEPROM_BLOCK_SIZE);
  
- 		ret = mt7996_mcu_get_eeprom(dev, i, read_buf);
+ 		ret = mt7996_mcu_get_eeprom(dev, i, read_buf, sizeof(read_buf));
 -		if (ret < 0)
 -			return ret;
 +		if (ret) {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0045-mtk-mt76-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0045-mtk-mt76-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch
index d27a9ea..1cebf18 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0045-mtk-mt76-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0045-mtk-mt76-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch
@@ -1,7 +1,7 @@
-From 339ed9899eee2a55da790d62e3460712110b2ab5 Mon Sep 17 00:00:00 2001
+From 9c8447672f6bb36113eccf7064f91b11ea980825 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 5 Dec 2023 16:48:33 +0800
-Subject: [PATCH 045/195] mtk: mt76: mt7996: add Eagle 2adie TBTC (BE14000)
+Subject: [PATCH 045/223] mtk: mt76: mt7996: add Eagle 2adie TBTC (BE14000)
  support
 
 Add fwdl/default eeprom load support for Eagle 2 adie TBTC
@@ -10,60 +10,46 @@
 Add Eagle 2adie TBTC group prek size
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Change-Id: I53479ad22aec81ba3f3028aa0aada86b175379f8
 ---
- mt7996/eeprom.c | 11 +++++++++--
+ mt7996/eeprom.c |  6 ++++--
  mt7996/eeprom.h | 12 ++++++++++++
- mt7996/init.c   |  5 +++++
- mt7996/mcu.c    |  5 +++++
- mt7996/mt7996.h |  9 +++++++++
- mt7996/regs.h   |  1 +
- 6 files changed, 41 insertions(+), 2 deletions(-)
+ mt7996/mt7996.h |  1 +
+ 3 files changed, 17 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 8cdd6d96..fb4d031f 100644
+index be87afe8..f1c29e8d 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -158,6 +158,11 @@ const char *mt7996_eeprom_name(struct mt7996_dev *dev)
- 	case 0x7990:
- 		if (dev->chip_sku == MT7996_SKU_404)
- 			return MT7996_EEPROM_DEFAULT_404;
-+		else if (dev->chip_sku == MT7996_SKU_233 &&
-+			 dev->fem_type == MT7996_FEM_INT)
-+			return MT7996_EEPROM_DEFAULT_233_INT;
-+		else if (dev->chip_sku == MT7996_SKU_233)
-+			return MT7996_EEPROM_DEFAULT_233;
- 
- 		if (dev->fem_type == MT7996_FEM_INT)
- 			return MT7996_EEPROM_DEFAULT_INT;
-@@ -450,6 +455,8 @@ static void mt7996_eeprom_init_precal(struct mt7996_dev *dev)
+@@ -500,6 +500,8 @@ static void mt7996_eeprom_init_precal(struct mt7996_dev *dev)
  	switch (mt76_chip(&dev->mt76)) {
  	case 0x7990:
  		dev->prek.rev = mt7996_prek_rev;
-+		if (dev->chip_sku == MT7996_SKU_233)
++		if (dev->chip_sku == MT7996_VAR_TYPE_233)
 +			dev->prek.rev = mt7996_prek_rev_233;
  		/* 5g & 6g bw 80 dpd channel list is not used */
  		dev->prek.dpd_ch_num[DPD_CH_NUM_BW320_6G] = ARRAY_SIZE(dpd_6g_ch_list_bw320);
  		break;
-@@ -553,7 +560,7 @@ static int mt7996_apply_cal_free_data(struct mt7996_dev *dev)
+@@ -603,7 +605,7 @@ static int mt7996_apply_cal_free_data(struct mt7996_dev *dev)
  	case 0x7990:
  		adie_base = adie_base_7996;
  		/* adie 0 */
 -		if (dev->fem_type == MT7996_FEM_INT)
-+		if (dev->fem_type == MT7996_FEM_INT && dev->chip_sku != MT7996_SKU_233)
++		if (dev->fem_type == MT7996_FEM_INT && dev->chip_sku != MT7996_VAR_TYPE_233)
  			adie_id = ADIE_7975;
  		else
  			adie_id = ADIE_7976;
-@@ -561,7 +568,7 @@ static int mt7996_apply_cal_free_data(struct mt7996_dev *dev)
+@@ -611,7 +613,7 @@ static int mt7996_apply_cal_free_data(struct mt7996_dev *dev)
  		eep_offs[0] = eep_offs_list[adie_id];
  
  		/* adie 1 */
--		if (dev->chip_sku != MT7996_SKU_404) {
-+		if (dev->chip_sku == MT7996_SKU_444) {
+-		if (dev->chip_sku != MT7996_VAR_TYPE_404) {
++		if (dev->chip_sku == MT7996_VAR_TYPE_444) {
  			adie_offs[1] = adie_offs_list[ADIE_7977];
  			eep_offs[1] = eep_offs_list[ADIE_7977];
  		}
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index fa9c31e7..43c9783c 100644
+index c3c248ca..788c33c8 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -70,6 +70,18 @@ static const u32 mt7996_prek_rev[] = {
@@ -85,84 +71,18 @@
  /* kite 2/5g config */
  static const u32 mt7992_prek_rev[] = {
  	[GROUP_SIZE_2G] =			4 * MT_EE_CAL_UNIT,
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 0201d9fc..342f15fb 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -918,6 +918,11 @@ int mt7996_get_chip_sku(struct mt7996_dev *dev)
- 
- 	switch (mt76_chip(&dev->mt76)) {
- 	case 0x7990:
-+		if (FIELD_GET(MT_PAD_GPIO_2ADIE_TBTC, val)) {
-+			dev->chip_sku = MT7996_SKU_233;
-+			break;
-+		}
-+
- 		adie_comb = FIELD_GET(MT_PAD_GPIO_ADIE_COMB, val);
- 		if (adie_comb <= 1)
- 			dev->chip_sku = MT7996_SKU_444;
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index a6558fee..8193ca68 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -23,6 +23,11 @@
- 			_fw = MT7992_##name;			\
- 		break;						\
- 	case 0x7990:						\
-+		if ((_dev)->chip_sku == MT7996_SKU_233)		\
-+			_fw = MT7996_##name##_233;		\
-+		else						\
-+			_fw = MT7996_##name;			\
-+		break;						\
- 	default:						\
- 		_fw = MT7996_##name;				\
- 		break;						\
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 73f5d7b1..a99e4ad9 100644
+index f6e7fbdd..81639a45 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -35,6 +35,12 @@
- #define MT7996_FIRMWARE_WM_TM		"mediatek/mt7996/mt7996_wm_tm.bin"
- #define MT7996_ROM_PATCH		"mediatek/mt7996/mt7996_rom_patch.bin"
- 
-+#define MT7996_FIRMWARE_WA_233		"mediatek/mt7996/mt7996_wa_233.bin"
-+#define MT7996_FIRMWARE_WM_233		"mediatek/mt7996/mt7996_wm_233.bin"
-+#define MT7996_FIRMWARE_DSP_233		MT7996_FIRMWARE_DSP
+@@ -38,6 +38,7 @@
+ #define MT7996_FIRMWARE_WA_233		"mediatek/mt7996/mt7996_wa_233.bin"
+ #define MT7996_FIRMWARE_WM_233		"mediatek/mt7996/mt7996_wm_233.bin"
+ #define MT7996_FIRMWARE_DSP_233		MT7996_FIRMWARE_DSP
 +#define MT7996_FIRMWARE_WM_TM_233	"mediatek/mt7996/mt7996_wm_tm_233.bin"
-+#define MT7996_ROM_PATCH_233		"mediatek/mt7996/mt7996_rom_patch_233.bin"
-+
- #define MT7992_FIRMWARE_WA		"mediatek/mt7996/mt7992_wa.bin"
- #define MT7992_FIRMWARE_WM		"mediatek/mt7996/mt7992_wm.bin"
- #define MT7992_FIRMWARE_DSP		"mediatek/mt7996/mt7992_dsp.bin"
-@@ -55,6 +61,8 @@
- 
- #define MT7996_EEPROM_DEFAULT		"mediatek/mt7996/mt7996_eeprom.bin"
- #define MT7996_EEPROM_DEFAULT_INT	"mediatek/mt7996/mt7996_eeprom_2i5i6i.bin"
-+#define MT7996_EEPROM_DEFAULT_233	"mediatek/mt7996/mt7996_eeprom_233.bin"
-+#define MT7996_EEPROM_DEFAULT_233_INT	"mediatek/mt7996/mt7996_eeprom_233_2i5i6i.bin"
- #define MT7996_EEPROM_DEFAULT_404	"mediatek/mt7996/mt7996_eeprom_dual_404.bin"
- #define MT7992_EEPROM_DEFAULT		"mediatek/mt7996/mt7992_eeprom.bin"
- #define MT7992_EEPROM_DEFAULT_INT	"mediatek/mt7996/mt7992_eeprom_2i5i.bin"
-@@ -122,6 +130,7 @@ enum mt7996_fem_type {
- enum mt7996_sku_type {
- 	MT7996_SKU_404,
- 	MT7996_SKU_444,
-+	MT7996_SKU_233,
- };
+ #define MT7996_ROM_PATCH_233		"mediatek/mt7996/mt7996_rom_patch_233.bin"
  
- enum mt7992_sku_type {
-diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 263737c5..91159c63 100644
---- a/mt7996/regs.h
-+++ b/mt7996/regs.h
-@@ -666,6 +666,7 @@ enum offs_rev {
- 
- #define MT_PAD_GPIO				0x700056f0
- #define MT_PAD_GPIO_ADIE_COMB			GENMASK(16, 15)
-+#define MT_PAD_GPIO_2ADIE_TBTC			BIT(19)
- #define MT_PAD_GPIO_ADIE_COMB_7992		GENMASK(17, 16)
- #define MT_PAD_GPIO_ADIE_NUM_7992		BIT(15)
- 
+ #define MT7992_FIRMWARE_WA		"mediatek/mt7996/mt7992_wa.bin"
 -- 
 2.45.2
 
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0046-mtk-mt76-mt7996-add-background-radar-hw-cap-check.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0046-mtk-mt76-mt7996-add-background-radar-hw-cap-check.patch
index 95b0c7d..7809621 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0046-mtk-mt76-mt7996-add-background-radar-hw-cap-check.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0046-mtk-mt76-mt7996-add-background-radar-hw-cap-check.patch
@@ -1,24 +1,23 @@
-From c58f74a0735403633715fe8576c5ce5a84720684 Mon Sep 17 00:00:00 2001
+From 4a0688cf495714841635247e4859335402f3118f Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 22 Dec 2023 17:27:10 +0800
-Subject: [PATCH 046/195] mtk: mt76: mt7996: add background radar hw cap check
+Subject: [PATCH 046/223] mtk: mt76: mt7996: add background radar hw cap check
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
- mt7996/debugfs.c |  5 +++++
- mt7996/init.c    |  7 ++++---
- mt7996/mt7996.h  | 20 ++++++++++++++++++++
- 3 files changed, 29 insertions(+), 3 deletions(-)
+ mt7996/debugfs.c | 5 +++++
+ mt7996/mt7996.h  | 3 ++-
+ 2 files changed, 7 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 58879695..6d119467 100644
+index 70a97d29..07970e1a 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -262,6 +262,11 @@ mt7996_rdd_monitor(struct seq_file *s, void *data)
  
  	mutex_lock(&dev->mt76.mutex);
  
-+	if (!mt7996_get_background_radar_cap(dev)) {
++	if (!mt7996_has_background_radar(dev)) {
 +		seq_puts(s, "no background radar capability\n");
 +		goto out;
 +	}
@@ -26,55 +25,20 @@
  	if (!cfg80211_chandef_valid(chandef)) {
  		ret = -EINVAL;
  		goto out;
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 342f15fb..ade07db7 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -406,9 +406,10 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
- 
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION);
- 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_PROTECTION);
--	if (!mdev->dev->of_node ||
--	    !of_property_read_bool(mdev->dev->of_node,
--				   "mediatek,disable-radar-background"))
-+	if (mt7996_get_background_radar_cap(phy->dev) &&
-+	    (!mdev->dev->of_node ||
-+	     !of_property_read_bool(mdev->dev->of_node,
-+				    "mediatek,disable-radar-background")))
- 		wiphy_ext_feature_set(wiphy,
- 				      NL80211_EXT_FEATURE_RADAR_BACKGROUND);
- 
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index a99e4ad9..a0a458f8 100644
+index 81639a45..142c390d 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -606,6 +606,26 @@ mt7996_band_valid(struct mt7996_dev *dev, u8 band)
- 	return band == MT_BAND0 || band == MT_BAND2;
- }
- 
-+static inline bool
-+mt7996_get_background_radar_cap(struct mt7996_dev *dev)
-+{
-+	switch (mt76_chip(&dev->mt76)) {
-+	case 0x7990:
-+		if (dev->chip_sku == MT7996_SKU_233)
-+			return 0;
-+		break;
-+	case 0x7992:
-+		if (dev->chip_sku == MT7992_SKU_23 ||
-+		    dev->chip_sku == MT7992_SKU_24)
-+			return 0;
-+		break;
-+	default:
-+		break;
-+	}
-+
-+	return 1;
-+}
-+
- extern const struct ieee80211_ops mt7996_ops;
- extern struct pci_driver mt7996_pci_driver;
- extern struct pci_driver mt7996_hif_driver;
+@@ -619,7 +619,8 @@ mt7996_has_background_radar(struct mt7996_dev *dev)
+ 			return false;
+ 		break;
+ 	case 0x7992:
+-		if (dev->var.type == MT7992_VAR_TYPE_23)
++		if (dev->var.type == MT7992_VAR_TYPE_23 ||
++		    dev->var.type == MT7992_VAR_TYPE_24)
+ 			return false;
+ 		break;
+ 	default:
 -- 
 2.45.2
 
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0047-mtk-mt76-mt7996-add-fallback-in-case-of-missing-prec.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0047-mtk-mt76-mt7996-add-fallback-in-case-of-missing-prec.patch
index 3b5e18b..0b7ad11 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0047-mtk-mt76-mt7996-add-fallback-in-case-of-missing-prec.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0047-mtk-mt76-mt7996-add-fallback-in-case-of-missing-prec.patch
@@ -1,7 +1,7 @@
-From 2e15f7a84c1df226ec919521bfecc2fa1dbed1cd Mon Sep 17 00:00:00 2001
+From f516af1b0691dcf72ad4a38ce5e6c06cb94ed9be Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 19 Mar 2024 17:33:49 +0800
-Subject: [PATCH 047/195] mtk: mt76: mt7996: add fallback in case of missing
+Subject: [PATCH 047/223] mtk: mt76: mt7996: add fallback in case of missing
  precal data
 
 Align Wi-Fi 6 upstream changes
@@ -9,16 +9,16 @@
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
- mt7996/eeprom.c | 30 +++++++++++++++++++++---------
+ mt7996/eeprom.c | 26 ++++++++++++++++++++------
  mt7996/init.c   |  2 +-
  mt7996/main.c   |  2 +-
- 3 files changed, 23 insertions(+), 11 deletions(-)
+ 3 files changed, 22 insertions(+), 8 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index fb4d031f..dffcd09d 100644
+index f1c29e8d..3ec146d0 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -490,17 +490,31 @@ static int mt7996_eeprom_load_precal(struct mt7996_dev *dev)
+@@ -535,17 +535,31 @@ static int mt7996_eeprom_load_precal(struct mt7996_dev *dev)
  	size = MT_EE_CAL_GROUP_SIZE + MT_EE_CAL_DPD_SIZE;
  
  	dev->cal = devm_kzalloc(mdev->dev, size, GFP_KERNEL);
@@ -41,7 +41,8 @@
  	if (!ret)
 -		return ret;
 +		return 0;
-+
+ 
+-	return mt76_get_of_data_from_nvmem(mdev, dev->cal, "precal", size);
 +	ret = mt76_get_of_data_from_nvmem(mdev, dev->cal, "precal", size);
 +	if (!ret)
 +		return 0;
@@ -50,28 +51,16 @@
 +	dev_warn(dev->mt76.dev, "Failed to load precal data: %d\n", ret);
 +	devm_kfree(dev->mt76.dev, dev->cal);
 +	dev->cal = NULL;
- 
--	return mt76_get_of_data_from_nvmem(mdev, dev->cal, "precal", size);
++
 +	return ret;
  }
  
  static int mt7996_apply_cal_free_data(struct mt7996_dev *dev)
-@@ -655,9 +669,7 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
- 	if (ret)
- 		return ret;
- 
--	ret = mt7996_eeprom_load_precal(dev);
--	if (ret)
--		return ret;
-+	mt7996_eeprom_load_precal(dev);
- 
- 	ret = mt7996_apply_cal_free_data(dev);
- 	if (ret)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index ade07db7..8b642ecc 100644
+index 3421326a..eac00df0 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -1011,7 +1011,7 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
+@@ -1021,7 +1021,7 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
  	if (ret < 0)
  		return ret;
  
@@ -81,7 +70,7 @@
  		if (ret)
  			return ret;
 diff --git a/mt7996/main.c b/mt7996/main.c
-index b3313137..2e7bcf93 100644
+index ea4679dd..f02f447e 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -338,7 +338,7 @@ int mt7996_set_channel(struct mt76_phy *mphy)
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0048-mtk-mt76-mt7996-add-kite-part-number-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0048-mtk-mt76-mt7996-add-kite-part-number-support.patch
index 184f09e..d349a87 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0048-mtk-mt76-mt7996-add-kite-part-number-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0048-mtk-mt76-mt7996-add-kite-part-number-support.patch
@@ -1,91 +1,25 @@
-From dc5691cf4bf514f4c0b1d1c0bb6693c83a5ba2dd Mon Sep 17 00:00:00 2001
+From 7251f2a0f7d1f5eda27611ff658328c2fe8edbf1 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 27 Mar 2024 17:50:16 +0800
-Subject: [PATCH 048/195] mtk: mt76: mt7996: add kite part number support
+Subject: [PATCH 048/223] mtk: mt76: mt7996: add kite part number support
 
+Change-Id: Ib06648398f18b47c324e18b476a57444d929608f
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
- mt7996/eeprom.c | 35 +++++++++++++++++++++++------------
- 1 file changed, 23 insertions(+), 12 deletions(-)
+ mt7996/eeprom.c | 1 -
+ 1 file changed, 1 deletion(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index dffcd09d..c4714982 100644
+index 3ec146d0..f9bd4d91 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -319,26 +319,39 @@ out:
- 	return ret;
- }
- 
--static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_dev *dev)
-+static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_phy *phy,
-+					    u8 *path, u8 *rx_path, u8 *nss)
- {
- #define MODE_HE_ONLY		BIT(0)
-+#define STREAM_MASK		GENMASK(2, 0)
-+#define STREAM_OFFSET		1
-+#define TX_PATH_OFFSET		10
-+#define RX_PATH_OFFSET		19
- #define WTBL_SIZE_GROUP		GENMASK(31, 28)
-+#define GET_STREAM_CAP(offs)	({				\
-+	typeof(offs) _offs = (offs);				\
-+	((cap & (STREAM_MASK << _offs)) >> _offs);		\
-+})
-+	struct mt7996_dev *dev = phy->dev;
- 	u32 cap = 0;
- 	int ret;
-+	u8 band_offs = phy->mt76->band_idx * hweight8(STREAM_MASK);
- 
- 	ret = mt7996_mcu_get_chip_config(dev, &cap);
+@@ -372,7 +372,6 @@ static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_phy *phy,
  	if (ret)
  		return ret;
  
 -	cap = 0x4b249248;	/* internal hardcode */
-+	dev->has_eht = true;
  	if (cap) {
- 		dev->has_eht = !(cap & MODE_HE_ONLY);
- 		dev->wtbl_size_group = u32_get_bits(cap, WTBL_SIZE_GROUP);
-+		*nss = min_t(u8, *nss, GET_STREAM_CAP(STREAM_OFFSET + band_offs));
-+		*path = min_t(u8, *path, GET_STREAM_CAP(TX_PATH_OFFSET + band_offs));
-+		*rx_path = min_t(u8, *rx_path, GET_STREAM_CAP(RX_PATH_OFFSET + band_offs));
- 	}
- 
--	if (dev->wtbl_size_group < 2 || dev->wtbl_size_group > 4 ||
--	    is_mt7992(&dev->mt76))
--		dev->wtbl_size_group = 2; /* set default */
-+	if (dev->wtbl_size_group < 2 || dev->wtbl_size_group > 4)
-+		dev->wtbl_size_group = is_mt7996(&dev->mt76) ? 4 : 2;	/* set default */
- 
- 	return 0;
- }
-@@ -382,13 +395,15 @@ static int mt7996_eeprom_parse_band_config(struct mt7996_phy *phy)
- 
- int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy)
- {
-+	struct mt76_phy *mphy = phy->mt76;
- 	u8 path, rx_path, nss, band_idx = phy->mt76->band_idx;
- 	u8 *eeprom = dev->mt76.eeprom.data;
--	struct mt76_phy *mphy = phy->mt76;
--	int max_path = 5, max_nss = 4;
--	int ret;
-+	int ret, max_path = 5, max_nss = 4;
- 
- 	mt7996_parse_eeprom_stream(eeprom, band_idx, &path, &rx_path, &nss);
-+	ret = mt7996_eeprom_parse_efuse_hw_cap(phy, &path, &rx_path, &nss);
-+	if (ret)
-+		return ret;
- 
- 	if (!path || path > max_path)
- 		path = max_path;
-@@ -408,10 +423,6 @@ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy)
- 		dev->chainshift[band_idx + 1] = dev->chainshift[band_idx] +
- 						hweight16(mphy->chainmask);
- 
--	ret = mt7996_eeprom_parse_efuse_hw_cap(dev);
--	if (ret)
--		return ret;
--
- 	return mt7996_eeprom_parse_band_config(phy);
- }
+ 		u8 band_offs = phy->mt76->band_idx * 3;
  
 -- 
 2.45.2
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0049-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0049-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
index a626aeb..49c9419 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0049-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0049-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
@@ -1,10 +1,11 @@
-From 5cc989d21562958fb51ebdc9f118bcc07a7e9a7e Mon Sep 17 00:00:00 2001
+From 4389fa86ef5bed621b9ced29ca66351819397575 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Feb 2023 19:49:22 +0800
-Subject: [PATCH 049/195] mtk: wifi: mt76: revert page_poll for kernel 5.4
+Subject: [PATCH 049/223] mtk: wifi: mt76: revert page_poll for kernel 5.4
 
 This reverts commit e8c10835cf062c577ddf426913788c39d30b4bd7.
 
+Change-Id: I4e5764fc545087f691fb4c2f43e7a9cefd1e1657
 ---
  dma.c         | 75 ++++++++++++++++++++++++++-------------------------
  mac80211.c    | 56 --------------------------------------
@@ -204,7 +205,7 @@
  
  	if (mtk_wed_device_active(&dev->mmio.wed))
 diff --git a/mac80211.c b/mac80211.c
-index 32ae1e52..ed25de4b 100644
+index ee5aa608..78e9a1ae 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -566,47 +566,6 @@ void mt76_unregister_phy(struct mt76_phy *phy)
@@ -255,7 +256,7 @@
  struct mt76_dev *
  mt76_alloc_device(struct device *pdev, unsigned int size,
  		  const struct ieee80211_ops *ops,
-@@ -1850,21 +1809,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
+@@ -1826,21 +1785,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  }
  EXPORT_SYMBOL_GPL(mt76_ethtool_worker);
  
@@ -278,10 +279,10 @@
  {
  	struct ieee80211_hw *hw = phy->hw;
 diff --git a/mt76.h b/mt76.h
-index 063117fc..c782d7d9 100644
+index 7beefc59..e06d5aaa 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -251,7 +251,7 @@ struct mt76_queue {
+@@ -252,7 +252,7 @@ struct mt76_queue {
  
  	dma_addr_t desc_dma;
  	struct sk_buff *rx_head;
@@ -290,7 +291,7 @@
  };
  
  struct mt76_mcu_ops {
-@@ -1615,7 +1615,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
+@@ -1616,7 +1616,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
  	return usb_bulk_msg(udev, pipe, data, len, actual_len, timeout);
  }
  
@@ -298,7 +299,7 @@
  void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  			 struct mt76_sta_stats *stats, bool eht);
  int mt76_skb_adjust_pad(struct sk_buff *skb, int pad);
-@@ -1773,25 +1772,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
+@@ -1774,25 +1773,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
  struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
  			  struct mt76_txwi_cache *r, dma_addr_t phys);
@@ -325,10 +326,10 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 9b4672b6..76634ee7 100644
+index d18ea5d4..8cb09d1b 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1416,22 +1416,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
+@@ -1421,22 +1421,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
  			   struct ieee80211_vif *vif,
  			   u32 sset, u8 *data)
  {
@@ -357,7 +358,7 @@
  }
  
  static void mt7915_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
-@@ -1459,7 +1456,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1464,7 +1461,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  		.idx = mvif->mt76.idx,
  	};
  	/* See mt7915_ampdu_stat_read_phy, etc */
@@ -366,7 +367,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
  
-@@ -1571,12 +1568,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
+@@ -1576,12 +1573,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
  		return;
  
  	ei += wi.worker_stat_count;
@@ -383,7 +384,7 @@
  
  static void
 diff --git a/usb.c b/usb.c
-index 58ff0682..0ca3b069 100644
+index f9e67b8c..47e43fdb 100644
 --- a/usb.c
 +++ b/usb.c
 @@ -318,27 +318,29 @@ mt76u_set_endpoints(struct usb_interface *intf,
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0050-mtk-mt76-rework-wed-rx-flow.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0050-mtk-mt76-rework-wed-rx-flow.patch
index 137d511..051af09 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0050-mtk-mt76-rework-wed-rx-flow.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0050-mtk-mt76-rework-wed-rx-flow.patch
@@ -1,8 +1,9 @@
-From 4349f061f18f983b2d67ffe3c7a0736d4ff26377 Mon Sep 17 00:00:00 2001
+From c21fcd823cc877e39068a92ffa440b7ad7f4bb45 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Feb 2023 13:37:23 +0800
-Subject: [PATCH 050/195] mtk: mt76: rework wed rx flow
+Subject: [PATCH 050/223] mtk: mt76: rework wed rx flow
 
+Change-Id: Icd787345c811cb5ad30d9c7c1c5f9e5298bd3be6
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
  dma.c           | 125 +++++++++++++++++++++++++++++++-----------------
@@ -259,7 +260,7 @@
  					 DMA_FROM_DEVICE);
  			skb_free_frag(buf);
 diff --git a/mac80211.c b/mac80211.c
-index ed25de4b..57621c28 100644
+index 78e9a1ae..b08a9388 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -596,7 +596,6 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
@@ -279,10 +280,10 @@
  	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
  		skb_queue_head_init(&dev->rx_skb[i]);
 diff --git a/mt76.h b/mt76.h
-index c782d7d9..f990ae4c 100644
+index e06d5aaa..260e198a 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -205,6 +205,7 @@ struct mt76_queue_entry {
+@@ -206,6 +206,7 @@ struct mt76_queue_entry {
  	};
  	union {
  		struct mt76_txwi_cache *txwi;
@@ -290,7 +291,7 @@
  		struct urb *urb;
  		int buf_sz;
  	};
-@@ -425,12 +426,16 @@ struct mt76_txwi_cache {
+@@ -426,12 +427,16 @@ struct mt76_txwi_cache {
  	struct list_head list;
  	dma_addr_t dma_addr;
  
@@ -312,7 +313,7 @@
  };
  
  struct mt76_rx_tid {
-@@ -523,6 +528,7 @@ struct mt76_driver_ops {
+@@ -524,6 +529,7 @@ struct mt76_driver_ops {
  	u16 txwi_size;
  	u16 token_size;
  	u8 mcs_rates;
@@ -320,7 +321,7 @@
  
  	void (*update_survey)(struct mt76_phy *phy);
  	int (*set_channel)(struct mt76_phy *phy);
-@@ -889,7 +895,6 @@ struct mt76_dev {
+@@ -891,7 +897,6 @@ struct mt76_dev {
  
  	struct ieee80211_hw *hw;
  
@@ -328,7 +329,7 @@
  	spinlock_t lock;
  	spinlock_t cc_lock;
  
-@@ -1575,8 +1580,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1576,8 +1581,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -339,7 +340,7 @@
  void mt76_free_pending_rxwi(struct mt76_dev *dev);
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
-@@ -1769,9 +1774,9 @@ struct mt76_txwi_cache *
+@@ -1770,9 +1775,9 @@ struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0051-mtk-mt76-change-wed-token-init-size-to-adapt-wed3.0.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0051-mtk-mt76-change-wed-token-init-size-to-adapt-wed3.0.patch
index cc84d05..3466f9a 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0051-mtk-mt76-change-wed-token-init-size-to-adapt-wed3.0.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0051-mtk-mt76-change-wed-token-init-size-to-adapt-wed3.0.patch
@@ -1,7 +1,7 @@
-From b80889302bf553148d0772bf569bda12d787bab2 Mon Sep 17 00:00:00 2001
+From f0d346f6709ddea1982ee44a69ee2c3da0d86b75 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Wed, 19 Apr 2023 17:13:41 +0800
-Subject: [PATCH 051/195] mtk: mt76: change wed token init size to adapt wed3.0
+Subject: [PATCH 051/223] mtk: mt76: change wed token init size to adapt wed3.0
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 ---
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0052-mtk-mt76-add-random-early-drop-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0052-mtk-mt76-add-random-early-drop-support.patch
index 09c74a6..891c45a 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0052-mtk-mt76-add-random-early-drop-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0052-mtk-mt76-add-random-early-drop-support.patch
@@ -1,7 +1,7 @@
-From bff0d80b5fcf8a71244283470dc3a96f06f2be23 Mon Sep 17 00:00:00 2001
+From 7a0d06e95d36c4d9f0b7bb8ae2adac2e2c7ec831 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 19 Apr 2023 18:32:41 +0800
-Subject: [PATCH 052/195] mtk: mt76: add random early drop support
+Subject: [PATCH 052/223] mtk: mt76: add random early drop support
 
 ---
  mt7996/debugfs.c     |  1 +
@@ -15,7 +15,7 @@
  8 files changed, 167 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 6d119467..3301701a 100644
+index 07970e1a..e328a056 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -633,6 +633,7 @@ mt7996_tx_stats_show(struct seq_file *file, void *data)
@@ -27,10 +27,10 @@
  	mt7996_txbf_stat_read_phy(phy, file);
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index bcddff23..0c2fee66 100644
+index f78591ff..1c0c2796 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1179,6 +1179,13 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+@@ -1191,6 +1191,13 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
  
  			wcid->stats.tx_retries += tx_retries;
  			wcid->stats.tx_failed += tx_failed;
@@ -45,10 +45,10 @@
  		}
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 8193ca68..bc456a30 100644
+index 9431f878..70e1984a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3152,8 +3152,8 @@ int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
+@@ -3157,8 +3157,8 @@ int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -59,7 +59,7 @@
  }
  
  int mt7996_mcu_init(struct mt7996_dev *dev)
-@@ -3186,6 +3186,83 @@ out:
+@@ -3191,6 +3191,83 @@ out:
  	skb_queue_purge(&dev->mt76.mcu.res_q);
  }
  
@@ -167,10 +167,10 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index a0a458f8..00d5f224 100644
+index 142c390d..8d222a0c 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -355,6 +355,7 @@ struct mt7996_phy {
+@@ -356,6 +356,7 @@ struct mt7996_phy {
  	u16 punct_bitmap;
  
  	struct mt7996_scs_ctrl scs_ctrl;
@@ -178,7 +178,7 @@
  
  	bool sku_limit_en;
  	bool sku_path_en;
-@@ -724,6 +725,7 @@ int mt7996_mcu_rf_regval(struct mt7996_dev *dev, u32 regidx, u32 *val, bool set)
+@@ -728,6 +729,7 @@ int mt7996_mcu_rf_regval(struct mt7996_dev *dev, u32 regidx, u32 *val, bool set)
  int mt7996_mcu_set_hdr_trans(struct mt7996_dev *dev, bool hdr_trans);
  int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val);
  int mt7996_mcu_wa_cmd(struct mt7996_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
@@ -186,7 +186,7 @@
  int mt7996_mcu_fw_log_2_host(struct mt7996_dev *dev, u8 type, u8 ctrl);
  int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
  int mt7996_mcu_trigger_assert(struct mt7996_dev *dev);
-@@ -897,11 +899,12 @@ void mt7996_mcu_set_ppdu_tx_type(struct mt7996_phy *phy, u8 ppdu_type);
+@@ -901,11 +903,12 @@ void mt7996_mcu_set_ppdu_tx_type(struct mt7996_phy *phy, u8 ppdu_type);
  void mt7996_mcu_set_nusers_ofdma(struct mt7996_phy *phy, u8 type, u8 ofdma_user_cnt);
  void mt7996_mcu_set_cert(struct mt7996_phy *phy, u8 type);
  void mt7996_tm_update_channel(struct mt7996_phy *phy);
@@ -201,10 +201,10 @@
 -
  #endif
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 05cfc6ab..1f754796 100644
+index a59e3a18..c1671e68 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -3033,6 +3033,27 @@ static int mt7996_muru_prot_thr_set(void *data, u64 val)
+@@ -3032,6 +3032,27 @@ static int mt7996_muru_prot_thr_set(void *data, u64 val)
  DEFINE_DEBUGFS_ATTRIBUTE(fops_muru_prot_thr, NULL,
  			 mt7996_muru_prot_thr_set, "%lld\n");
  
@@ -232,7 +232,7 @@
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -3109,6 +3130,8 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -3108,6 +3129,8 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  				    mt7996_wtbl_read);
  
  	debugfs_create_devm_seqfile(dev->mt76.dev, "token", dir, mt7996_token_read);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0053-mtk-mt76-mt7996-reset-addr_elem-when-delete-ba.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0053-mtk-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
index a4afe7e..ac96abf 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0053-mtk-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0053-mtk-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
@@ -1,7 +1,7 @@
-From cd5c2ff526ba35bfdac4761bf05a58272ac968d8 Mon Sep 17 00:00:00 2001
+From 82dd1101ce064f18bdcc47c7ef5779c407440bae Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 18 May 2023 15:01:47 +0800
-Subject: [PATCH 053/195] mtk: mt76: mt7996: reset addr_elem when delete ba
+Subject: [PATCH 053/223] mtk: mt76: mt7996: reset addr_elem when delete ba
 
 The old addr element info may be used when the signature is not equel to
 0xff, and sta will find error SDP cause the SDP/SDL=0 issue.
@@ -10,6 +10,8 @@
 Due to fw change the cmd format.
 https://gerrit.mediatek.inc/c/neptune/firmware/bora/wifi/custom/+/7969193
 
+Change-Id: I12fb27e28b2c0310f824e66af6103b4ceba3503e
+Change-Id: I456a5d3eb2320a2c40cf57247ba63083a6d50b2e
 Signed-off-by: mtk27745 <rex.lu@mediatek.com>
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 ---
@@ -18,10 +20,10 @@
  2 files changed, 47 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index f990ae4c..162f7883 100644
+index 260e198a..2798f9e5 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -452,6 +452,7 @@ struct mt76_rx_tid {
+@@ -453,6 +453,7 @@ struct mt76_rx_tid {
  	u16 nframes;
  
  	u8 num;
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0054-mtk-mt76-change-pcie0-R5-to-pcie1-to-get-6G-ICS.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0054-mtk-mt76-change-pcie0-R5-to-pcie1-to-get-6G-ICS.patch
index 7878907..599e161 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0054-mtk-mt76-change-pcie0-R5-to-pcie1-to-get-6G-ICS.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0054-mtk-mt76-change-pcie0-R5-to-pcie1-to-get-6G-ICS.patch
@@ -1,8 +1,9 @@
-From 9376b31cef8aedca93e559acd64a8dfd577c0c0c Mon Sep 17 00:00:00 2001
+From 161b4dc2bb1f3d69b57f195fbab8fc8f6dfbe2bc Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Fri, 6 Oct 2023 14:01:41 +0800
-Subject: [PATCH 054/195] mtk: mt76: change pcie0 R5 to pcie1 to get 6G ICS
+Subject: [PATCH 054/223] mtk: mt76: change pcie0 R5 to pcie1 to get 6G ICS
 
+Change-Id: I23a94e3e4b797b513a303b13e4c50e0a0d72bffb
 ---
  mt7996/dma.c  | 4 ++++
  mt7996/init.c | 6 ++----
@@ -25,7 +26,7 @@
  				       MT_RXQ_ID(MT_RXQ_BAND2),
  				       MT7996_RX_RING_SIZE,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 8b642ecc..6563974d 100644
+index eac00df0..f493a373 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -651,10 +651,8 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0055-mtk-mt76-add-SER-support-for-wed3.0.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0055-mtk-mt76-add-SER-support-for-wed3.0.patch
index e84e4c5..1020992 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0055-mtk-mt76-add-SER-support-for-wed3.0.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0055-mtk-mt76-add-SER-support-for-wed3.0.patch
@@ -1,8 +1,9 @@
-From 2ed3f4aa3a46d69a8da159ee1fe4568dba2d52dd Mon Sep 17 00:00:00 2001
+From ce0ee1b6c2ae27eb6416b6eaa0191e09170e900c Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Tue, 23 May 2023 12:06:29 +0800
-Subject: [PATCH 055/195] mtk: mt76: add SER support for wed3.0
+Subject: [PATCH 055/223] mtk: mt76: add SER support for wed3.0
 
+Change-Id: I2711b9dc336fca9a1ae32a8fbf27810a7e27b1e3
 ---
  dma.c         | 5 +++--
  mt7996/mmio.c | 1 +
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0056-mtk-mt76-find-rx-token-by-physical-address.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0056-mtk-mt76-find-rx-token-by-physical-address.patch
index 4da584e..3e66d5f 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0056-mtk-mt76-find-rx-token-by-physical-address.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0056-mtk-mt76-find-rx-token-by-physical-address.patch
@@ -1,12 +1,13 @@
-From 1e815825aa94dd511427fbcd1373c93702dc6732 Mon Sep 17 00:00:00 2001
+From a0322640da7756faf08c31cf93d69a61f766c545 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Wed, 19 Jul 2023 10:55:09 +0800
-Subject: [PATCH 056/195] mtk: mt76: find rx token by physical address
+Subject: [PATCH 056/223] mtk: mt76: find rx token by physical address
 
 The token id in RxDMAD may be incorrect when it is not the last frame in
 WED HW. Lookup correct token id by physical address in sdp0.
 Add len == 0 check to drop garbage frames
 
+Change-Id: I4cd90294ad24990826075e92a710cc4e301dcbb7
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  dma.c | 27 +++++++++++++++++++++++++--
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0057-mtk-mt76-mt7996-add-dma-mask-limitation.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0057-mtk-mt76-mt7996-add-dma-mask-limitation.patch
index f7712bf..b38d794 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0057-mtk-mt76-mt7996-add-dma-mask-limitation.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0057-mtk-mt76-mt7996-add-dma-mask-limitation.patch
@@ -1,7 +1,7 @@
-From 2fe6b04371e3472c855641f7d107893e34603a4f Mon Sep 17 00:00:00 2001
+From 8509256a66d237ebf813fc1ddd9d2a913465c02b Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 20 Jul 2023 10:25:50 +0800
-Subject: [PATCH 057/195] mtk: mt76: mt7996: add dma mask limitation
+Subject: [PATCH 057/223] mtk: mt76: mt7996: add dma mask limitation
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 ---
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0058-mtk-mt76-mt7996-add-per-bss-statistic-info.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0058-mtk-mt76-mt7996-add-per-bss-statistic-info.patch
index 88bbadc..dfae6e1 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0058-mtk-mt76-mt7996-add-per-bss-statistic-info.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0058-mtk-mt76-mt7996-add-per-bss-statistic-info.patch
@@ -1,7 +1,7 @@
-From beafd20e20fc970989623df11fd710d6b138eee2 Mon Sep 17 00:00:00 2001
+From 663d6e60f6a431146594178ffbbbf7fd54180c38 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Fri, 18 Aug 2023 10:17:08 +0800
-Subject: [PATCH 058/195] mtk: mt76: mt7996: add per bss statistic info
+Subject: [PATCH 058/223] mtk: mt76: mt7996: add per bss statistic info
 
 Whenever WED is enabled, unicast traffic might run through HW path.
 As a result, we need to count them using WM event.
@@ -22,7 +22,7 @@
  3 files changed, 37 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 6563974d..9d918268 100644
+index f493a373..f6cddac1 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -403,6 +403,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -34,7 +34,7 @@
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION);
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_PROTECTION);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 2e7bcf93..cdb49e21 100644
+index f02f447e..dcf1fc38 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -265,6 +265,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
@@ -46,10 +46,10 @@
  
  	mt7996_mac_wtbl_update(dev, idx,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index bc456a30..72d6cf58 100644
+index 70e1984a..8b84c9dc 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -524,6 +524,27 @@ mt7996_mcu_update_tx_gi(struct rate_info *rate, struct all_sta_trx_rate *mcu_rat
+@@ -529,6 +529,27 @@ mt7996_mcu_update_tx_gi(struct rate_info *rate, struct all_sta_trx_rate *mcu_rat
  	return 0;
  }
  
@@ -77,7 +77,7 @@
  static void
  mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  {
-@@ -539,7 +560,7 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -544,7 +565,7 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  		u16 wlan_idx;
  		struct mt76_wcid *wcid;
  		struct mt76_phy *mphy;
@@ -86,7 +86,7 @@
  
  		switch (le16_to_cpu(res->tag)) {
  		case UNI_ALL_STA_TXRX_RATE:
-@@ -567,6 +588,9 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -572,6 +593,9 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  				wcid->stats.tx_bytes += tx_bytes;
  				wcid->stats.rx_bytes += rx_bytes;
  
@@ -96,7 +96,7 @@
  				ieee80211_tpt_led_trig_tx(mphy->hw, tx_bytes);
  				ieee80211_tpt_led_trig_rx(mphy->hw, rx_bytes);
  			}
-@@ -578,10 +602,16 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -583,10 +607,16 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  			if (!wcid)
  				break;
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0059-mtk-mt76-mt7996-do-not-report-netdev-stats-on-monito.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0059-mtk-mt76-mt7996-do-not-report-netdev-stats-on-monito.patch
index ce5773b..7cede7a 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0059-mtk-mt76-mt7996-do-not-report-netdev-stats-on-monito.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0059-mtk-mt76-mt7996-do-not-report-netdev-stats-on-monito.patch
@@ -1,7 +1,7 @@
-From effa71792ae89a62c0f673149a474180b6a49551 Mon Sep 17 00:00:00 2001
+From 4fa8ea3f212978e36a7b9489505545f655d7e3e1 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 26 Oct 2023 17:27:43 +0800
-Subject: [PATCH 059/195] mtk: mt76: mt7996: do not report netdev stats on
+Subject: [PATCH 059/223] mtk: mt76: mt7996: do not report netdev stats on
  monitor vif
 
 This fixes the following NULL pointer crash when enabling monitor mode:
@@ -13,16 +13,17 @@
 [  205.613935]  napi_threaded_poll+0x80/0xe8
 [  205.617934]  kthread+0x124/0x128
 
+Change-Id: I66f2449401888255bf8d3edddc1d9f20bd8ba3e7
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mt7996/mcu.c | 3 +++
  1 file changed, 3 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 72d6cf58..c92fb5b1 100644
+index 8b84c9dc..6b7a5372 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -540,6 +540,9 @@ static inline void __mt7996_stat_to_netdev(struct mt76_phy *mphy,
+@@ -545,6 +545,9 @@ static inline void __mt7996_stat_to_netdev(struct mt76_phy *mphy,
  				   drv_priv);
  		wdev = ieee80211_vif_to_wdev(vif);
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0060-mtk-mt76-mt7996-add-support-for-HW-ATF.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0060-mtk-mt76-mt7996-add-support-for-HW-ATF.patch
index 424dc6d..3c7f0bd 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0060-mtk-mt76-mt7996-add-support-for-HW-ATF.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0060-mtk-mt76-mt7996-add-support-for-HW-ATF.patch
@@ -1,7 +1,7 @@
-From adf8a5973f5e6290656a51dc55abdd499b2d3fe2 Mon Sep 17 00:00:00 2001
+From e8d00b434ed9f3e4ac5bc4aa5486331bd948a4c3 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Mon, 11 Sep 2023 16:35:15 +0800
-Subject: [PATCH 060/195] mtk: mt76: mt7996: add support for HW-ATF
+Subject: [PATCH 060/223] mtk: mt76: mt7996: add support for HW-ATF
 
 ---
  mt7996/debugfs.c |  90 ++++++++++++++++
@@ -13,7 +13,7 @@
  6 files changed, 475 insertions(+), 26 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 3301701a..3b58b8ba 100644
+index e328a056..0ef8fee6 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -927,6 +927,91 @@ static const struct file_operations mt7996_efuse_ops = {
@@ -121,7 +121,7 @@
  	if (phy->mt76->cap.has_5ghz) {
  		debugfs_create_u32("dfs_hw_pattern", 0400, dir,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 9d918268..440c4b7c 100644
+index f6cddac1..ac0ef6c1 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -575,6 +575,37 @@ int mt7996_txbf_init(struct mt7996_dev *dev)
@@ -175,7 +175,7 @@
  	ret = mt7996_init_debugfs(phy);
  	if (ret)
  		goto error;
-@@ -1483,6 +1520,12 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1493,6 +1530,12 @@ int mt7996_register_device(struct mt7996_dev *dev)
  
  	dev->recovery.hw_init_done = true;
  
@@ -189,7 +189,7 @@
  	if (ret)
  		goto error;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 0c2fee66..dfc68a19 100644
+index 1c0c2796..094d6420 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -103,6 +103,7 @@ static void mt7996_mac_sta_poll(struct mt7996_dev *dev)
@@ -220,10 +220,10 @@
  
  		/* get signal strength of resp frames (CTS/BA/ACK) */
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index c92fb5b1..619ed2a4 100644
+index 6b7a5372..6b78357d 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2225,34 +2225,37 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2230,34 +2230,37 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  }
  
  static int
@@ -285,7 +285,7 @@
  }
  
  int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-@@ -2313,7 +2316,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2318,7 +2321,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  		mt7996_mcu_sta_bfee_tlv(dev, skb, vif, sta);
  	}
  
@@ -294,7 +294,7 @@
  	if (ret) {
  		dev_kfree_skb(skb);
  		return ret;
-@@ -5191,6 +5194,218 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
+@@ -5214,6 +5217,218 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
  				 &req, sizeof(req), false);
  }
  
@@ -526,10 +526,10 @@
  	UNI_VOW_RX_AT_AIRTIME_CLR_EN = 0x0e,
  	UNI_VOW_RED_ENABLE = 0x18,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 00d5f224..27f7e27b 100644
+index 8d222a0c..ed38a8ab 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -115,6 +115,12 @@
+@@ -117,6 +117,12 @@
  #define MT7996_RX_MSDU_PAGE_SIZE	(128 + \
  					 SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
  
@@ -542,7 +542,7 @@
  struct mt7996_vif;
  struct mt7996_sta;
  struct mt7996_dfs_pulse;
-@@ -216,6 +222,81 @@ enum mt7996_dpd_ch_num {
+@@ -217,6 +223,81 @@ enum mt7996_dpd_ch_num {
  	DPD_CH_NUM_TYPE_MAX,
  };
  
@@ -624,7 +624,7 @@
  struct mt7996_sta {
  	struct mt76_wcid wcid; /* must be first */
  
-@@ -235,6 +316,8 @@ struct mt7996_sta {
+@@ -236,6 +317,8 @@ struct mt7996_sta {
  		u8 flowid_mask;
  		struct mt7996_twt_flow flow[MT7996_MAX_STA_TWT_AGRT];
  	} twt;
@@ -633,15 +633,15 @@
  };
  
  struct mt7996_vif {
-@@ -500,6 +583,7 @@ struct mt7996_dev {
- 
- 	u8 wtbl_size_group;
+@@ -505,6 +588,7 @@ struct mt7996_dev {
+ 		u8 fem:4;
+ 	} var;
  
 +	struct mt7996_vow_ctrl vow;
  #ifdef CONFIG_MTK_DEBUG
  	u16 wlan_idx;
  	struct {
-@@ -740,10 +824,12 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy);
+@@ -744,10 +828,12 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy);
  #ifdef CONFIG_NL80211_TESTMODE
  void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb);
  #endif
@@ -655,7 +655,7 @@
  
  static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
  {
-@@ -793,6 +879,14 @@ static inline u16 mt7996_rx_chainmask(struct mt7996_phy *phy)
+@@ -797,6 +883,14 @@ static inline u16 mt7996_rx_chainmask(struct mt7996_phy *phy)
  	return tx_chainmask | (BIT(fls(tx_chainmask)) * phy->has_aux_rx);
  }
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0061-mtk-mt76-mt7996-add-SER0.5-support-w-wed3.0.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0061-mtk-mt76-mt7996-add-SER0.5-support-w-wed3.0.patch
index 044966c..fb1f214 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0061-mtk-mt76-mt7996-add-SER0.5-support-w-wed3.0.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0061-mtk-mt76-mt7996-add-SER0.5-support-w-wed3.0.patch
@@ -1,8 +1,9 @@
-From 885a1122a42e723fa996ae4fa4d304daa17dff8b Mon Sep 17 00:00:00 2001
+From 23ce8e7268d891e3d762e1058986a5850258c89b Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 12 Oct 2023 10:04:54 +0800
-Subject: [PATCH 061/195] mtk: mt76: mt7996: add SER0.5 support w/ wed3.0
+Subject: [PATCH 061/223] mtk: mt76: mt7996: add SER0.5 support w/ wed3.0
 
+Change-Id: I9b26cdbea6e8ee158a153fd153c2dea77b494f2f
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 ---
  dma.c           |   9 ++--
@@ -71,10 +72,10 @@
  		mt76_wed_dma_setup(dev, q, true);
  }
 diff --git a/mt76.h b/mt76.h
-index 162f7883..72cfea14 100644
+index 2798f9e5..8bf37558 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -304,7 +304,7 @@ struct mt76_queue_ops {
+@@ -305,7 +305,7 @@ struct mt76_queue_ops {
  
  	void (*kick)(struct mt76_dev *dev, struct mt76_queue *q);
  
@@ -83,7 +84,7 @@
  };
  
  enum mt76_phy_type {
-@@ -1757,8 +1757,13 @@ static inline bool mt76_queue_is_wed_rro_ind(struct mt76_queue *q)
+@@ -1758,8 +1758,13 @@ static inline bool mt76_queue_is_wed_rro_ind(struct mt76_queue *q)
  static inline bool mt76_queue_is_wed_rro_data(struct mt76_queue *q)
  {
  	return mt76_queue_is_wed_rro(q) &&
@@ -99,7 +100,7 @@
  }
  
  static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
-@@ -1767,7 +1772,8 @@ static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
+@@ -1768,7 +1773,8 @@ static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
  		return false;
  
  	return FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX ||
@@ -172,7 +173,7 @@
  	mt7996_dma_enable(dev, !force);
  }
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 440c4b7c..3b1f4273 100644
+index ac0ef6c1..b0c307fb 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -737,11 +737,91 @@ void mt7996_wfsys_reset(struct mt7996_dev *dev)
@@ -322,10 +323,10 @@
  #else
  	return 0;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index dfc68a19..be3fea21 100644
+index 094d6420..d58177ec 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1761,6 +1761,31 @@ mt7996_mac_restart(struct mt7996_dev *dev)
+@@ -1773,6 +1773,31 @@ mt7996_mac_restart(struct mt7996_dev *dev)
  	if (ret)
  		goto out;
  
@@ -358,10 +359,10 @@
  	ret = mt7996_mcu_set_eeprom(dev);
  	if (ret)
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 27f7e27b..e54e987a 100644
+index ed38a8ab..674f9de1 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -719,6 +719,7 @@ extern const struct mt76_testmode_ops mt7996_testmode_ops;
+@@ -723,6 +723,7 @@ extern const struct mt76_testmode_ops mt7996_testmode_ops;
  struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
  				     void __iomem *mem_base, u32 device_id);
  void mt7996_wfsys_reset(struct mt7996_dev *dev);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0062-mtk-mt76-mt7996-support-backaward-compatiable.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0062-mtk-mt76-mt7996-support-backaward-compatiable.patch
index 495fbd2..2313758 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0062-mtk-mt76-mt7996-support-backaward-compatiable.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0062-mtk-mt76-mt7996-support-backaward-compatiable.patch
@@ -1,7 +1,7 @@
-From cfcd4f3e2fd365b3a7b5cf079f37873b27ea471d Mon Sep 17 00:00:00 2001
+From 8078f6868b60b6468958fd0990c5a697e1ac12df Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Fri, 6 Oct 2023 20:59:42 +0800
-Subject: [PATCH 062/195] mtk: mt76: mt7996: support backaward compatiable
+Subject: [PATCH 062/223] mtk: mt76: mt7996: support backaward compatiable
 
 revert upstream wed trigger mode to polling mode
 
@@ -11,6 +11,8 @@
 [Release-log]
 N/A
 
+Change-Id: Ifd40df7094052b13e26f42f09908f6404917ad8e
+Change-Id: I337f41aa80758d00b4c8e7a5cc4d6faeb6f0a4a2
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 Signed-off-by: mtk27745 <rex.lu@mediatek.com>
 Signed-off-by: Rex Lu <rex.lu@mediatek.com>
@@ -25,10 +27,10 @@
  7 files changed, 24 insertions(+), 17 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 72cfea14..9b836667 100644
+index 8bf37558..e7901e57 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -53,6 +53,8 @@
+@@ -54,6 +54,8 @@
  
  #define MT76_TOKEN_FREE_THR	64
  
@@ -38,10 +40,10 @@
  #define MT_QFLAG_WED_TYPE	GENMASK(4, 2)
  #define MT_QFLAG_WED		BIT(5)
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index be3fea21..1792726c 100644
+index d58177ec..0c5fa02d 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1774,7 +1774,7 @@ mt7996_mac_restart(struct mt7996_dev *dev)
+@@ -1786,7 +1786,7 @@ mt7996_mac_restart(struct mt7996_dev *dev)
  		}
  
  		mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
@@ -50,7 +52,7 @@
  		mt7996_irq_enable(dev, wed_irq_mask);
  		mt7996_irq_disable(dev, 0);
  	}
-@@ -2006,6 +2006,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2018,6 +2018,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
  
  		mtk_wed_device_start_hw_rro(&dev->mt76.mmio.wed, wed_irq_mask,
  					    true);
@@ -59,10 +61,10 @@
  		mt7996_irq_disable(dev, 0);
  	}
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 619ed2a4..0c6adea6 100644
+index 6b78357d..be273181 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3260,7 +3260,7 @@ static int mt7996_mcu_wa_red_config(struct mt7996_dev *dev)
+@@ -3265,7 +3265,7 @@ static int mt7996_mcu_wa_red_config(struct mt7996_dev *dev)
  
  	if (!mtk_wed_device_active(&dev->mt76.mmio.wed))
  		req.token_per_src[RED_TOKEN_SRC_CNT - 1] =
@@ -123,10 +125,10 @@
  #else
  	return 0;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index e54e987a..1680e77f 100644
+index 674f9de1..1e17c291 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -74,6 +74,7 @@
+@@ -76,6 +76,7 @@
  #define MT7996_EEPROM_BLOCK_SIZE	16
  #define MT7996_TOKEN_SIZE		16384
  #define MT7996_HW_TOKEN_SIZE		8192
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0063-mtk-mt76-mt7996-add-wed-support-for-mt7992.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0063-mtk-mt76-mt7996-add-wed-support-for-mt7992.patch
index c95c05f..54343e8 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0063-mtk-mt76-mt7996-add-wed-support-for-mt7992.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0063-mtk-mt76-mt7996-add-wed-support-for-mt7992.patch
@@ -1,21 +1,22 @@
-From 69dd5c911bff46e3be698300bd74fc644149e6af Mon Sep 17 00:00:00 2001
+From efbc1e62252f25b9af9e812cd8a8ba61a9e043d0 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Fri, 8 Sep 2023 11:57:39 +0800
-Subject: [PATCH 063/195] mtk: mt76: mt7996: add wed support for mt7992
+Subject: [PATCH 063/223] mtk: mt76: mt7996: add wed support for mt7992
 
 Fix incomplete WED initialization for Kite band-1 RX ring.
 
+Change-Id: I2da06c9f1412f8392d1b55feea3ad8ff48ff90ad
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt7996/dma.c    | 91 +++++++++++++++++++++++++++++++++----------------
- mt7996/init.c   | 12 +++++++
+ mt7996/init.c   | 22 ++++++++++++
  mt7996/mac.c    |  4 +++
  mt7996/mmio.c   | 49 ++++++++++++++++++--------
  mt7996/mt7996.h | 10 +++++-
  mt7996/pci.c    | 10 ++++--
  mt7996/regs.h   | 14 +++++++-
- 7 files changed, 142 insertions(+), 48 deletions(-)
+ 7 files changed, 152 insertions(+), 48 deletions(-)
 
 diff --git a/mt7996/dma.c b/mt7996/dma.c
 index d9e1b17f..d62dc8ba 100644
@@ -166,7 +167,7 @@
  		if (mt7996_band_valid(dev, MT_BAND2)) {
  			/* rx rro data queue for band2 */
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 3b1f4273..f682423a 100644
+index b0c307fb..04c15432 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -815,6 +815,7 @@ void mt7996_rro_hw_init(struct mt7996_dev *dev)
@@ -195,11 +196,28 @@
  	ptr = dmam_alloc_coherent(dev->mt76.dma_dev,
  				  MT7996_RRO_WINDOW_MAX_LEN * sizeof(*addr),
  				  &dev->wed_rro.session.phy_addr,
+@@ -922,6 +934,16 @@ static void mt7996_wed_rro_free(struct mt7996_dev *dev)
+ 				   dev->wed_rro.addr_elem[i].phy_addr);
+ 	}
+ 
++	for (i = 0; i < ARRAY_SIZE(dev->wed_rro.msdu_pg); i++) {
++		if (!dev->wed_rro.msdu_pg[i].ptr)
++			continue;
++
++		dmam_free_coherent(dev->mt76.dma_dev,
++				   MT7996_RRO_MSDU_PG_SIZE_PER_CR,
++				   dev->wed_rro.msdu_pg[i].ptr,
++				   dev->wed_rro.msdu_pg[i].phy_addr);
++	}
++
+ 	if (!dev->wed_rro.session.ptr)
+ 		return;
+ 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 1792726c..1f3445bb 100644
+index 0c5fa02d..9f94f530 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2004,6 +2004,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2016,6 +2016,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
  
  		mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
  
@@ -303,10 +321,10 @@
  		dev->mt76.rx_token_size = MT7996_TOKEN_SIZE + wed->wlan.rx_npkt;
  	}
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 1680e77f..2f2122dc 100644
+index 1e17c291..7d0f7dda 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -122,6 +122,10 @@
+@@ -124,6 +124,10 @@
  #define MT7996_DRR_STA_AC2_QNTM_MASK	GENMASK(18, 16)
  #define MT7996_DRR_STA_AC3_QNTM_MASK	GENMASK(22, 20)
  
@@ -317,7 +335,7 @@
  struct mt7996_vif;
  struct mt7996_sta;
  struct mt7996_dfs_pulse;
-@@ -181,7 +185,7 @@ enum mt7996_rxq_id {
+@@ -182,7 +186,7 @@ enum mt7996_rxq_id {
  	MT7996_RXQ_BAND1 = 5, /* for mt7992 */
  	MT7996_RXQ_BAND2 = 5,
  	MT7996_RXQ_RRO_BAND0 = 8,
@@ -326,7 +344,7 @@
  	MT7996_RXQ_RRO_BAND2 = 6,
  	MT7996_RXQ_MSDU_PG_BAND0 = 10,
  	MT7996_RXQ_MSDU_PG_BAND1 = 11,
-@@ -547,6 +551,10 @@ struct mt7996_dev {
+@@ -548,6 +552,10 @@ struct mt7996_dev {
  			void *ptr;
  			dma_addr_t phy_addr;
  		} session;
@@ -374,7 +392,7 @@
  			goto free_wed_or_irq_vector;
  
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 91159c63..e6427a35 100644
+index f55d4a94..2ad8c069 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -77,6 +77,8 @@ enum offs_rev {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0064-mtk-mt76-add-2pcie-one-wed-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0064-mtk-mt76-add-2pcie-one-wed-support.patch
index ede8aa5..897e666 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0064-mtk-mt76-add-2pcie-one-wed-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0064-mtk-mt76-add-2pcie-one-wed-support.patch
@@ -1,7 +1,7 @@
-From 3737181b9d2b8c8ef2d1073722f1e8920796bf38 Mon Sep 17 00:00:00 2001
+From b6233b7c81cac3c7bc5147cf78ec403feb20e4a3 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Wed, 13 Sep 2023 17:35:43 +0800
-Subject: [PATCH 064/195] mtk: mt76: add 2pcie one wed support
+Subject: [PATCH 064/223] mtk: mt76: add 2pcie one wed support
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 ---
@@ -99,10 +99,10 @@
  //#define WF_WFDMA_MCU_DMA0_BASE                                 0x02000
  #define WF_WFDMA_MCU_DMA0_BASE                                 0x54000000
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 1f754796..06c0db3f 100644
+index c1671e68..5a140f51 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -558,14 +558,22 @@ mt7996_show_dma_info(struct seq_file *s, struct mt7996_dev *dev)
+@@ -557,14 +557,22 @@ mt7996_show_dma_info(struct seq_file *s, struct mt7996_dev *dev)
  		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING4_CTRL0_ADDR);
  	dump_dma_rx_ring_info(s, dev, "R5:Data1(MAC2H)", "Both",
  		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING5_CTRL0_ADDR);
@@ -129,7 +129,7 @@
  	dump_dma_rx_ring_info(s, dev, "R10:MSDU_PG0(MAC2H)", "Both",
  		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING10_CTRL0_ADDR);
  	dump_dma_rx_ring_info(s, dev, "R11:MSDU_PG1(MAC2H)", "Both",
-@@ -583,15 +591,18 @@ mt7996_show_dma_info(struct seq_file *s, struct mt7996_dev *dev)
+@@ -582,15 +590,18 @@ mt7996_show_dma_info(struct seq_file *s, struct mt7996_dev *dev)
  			WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING21_CTRL0_ADDR);
  		dump_dma_tx_ring_info(s, dev, "T22:TXD?(H2WA)", "AP",
  			WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING22_CTRL0_ADDR);
@@ -152,7 +152,7 @@
  
  	/* MCU DMA information */
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index e6427a35..cbd71706 100644
+index 2ad8c069..87bf0012 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -411,6 +411,7 @@ enum offs_rev {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0065-mtk-mt76-mt7996-Remove-wed-rro-ring-add-napi-at-init.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0065-mtk-mt76-mt7996-Remove-wed-rro-ring-add-napi-at-init.patch
index 3502237..62a315a 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0065-mtk-mt76-mt7996-Remove-wed-rro-ring-add-napi-at-init.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0065-mtk-mt76-mt7996-Remove-wed-rro-ring-add-napi-at-init.patch
@@ -1,7 +1,7 @@
-From 13ed5c386f3ac7b422c063f73a812c579be99da9 Mon Sep 17 00:00:00 2001
+From 3f8b5805f40b73b389e3355b61b76595fbff5b45 Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Mon, 6 Nov 2023 10:16:34 +0800
-Subject: [PATCH 065/195] mtk: mt76: mt7996: Remove wed rro ring add napi at
+Subject: [PATCH 065/223] mtk: mt76: mt7996: Remove wed rro ring add napi at
  init state
 
 without this patch. rro ring will add napi at initial state. once rro ring add napi, it will have chance to be used by host driver. if host driver accessed the ring data, it will cause some issue.
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0066-mtk-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0066-mtk-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch
index 3863b78..5d3a194 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0066-mtk-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0066-mtk-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch
@@ -1,7 +1,7 @@
-From 5337cab772c417fbc4cdecdb8a68ac4d6a5982a4 Mon Sep 17 00:00:00 2001
+From b6003ba133a517cea454233c6b951ea8acaf7cc0 Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Wed, 29 Nov 2023 13:56:52 +0800
-Subject: [PATCH 066/195] mtk: mt76: mt7996: Remove wed_stop during L1 SER
+Subject: [PATCH 066/223] mtk: mt76: mt7996: Remove wed_stop during L1 SER
 
 Align logan L1 SER flow. During L1 SER, didn't need to close wed interrupt.
 
@@ -11,10 +11,10 @@
  1 file changed, 6 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 1f3445bb..25f036bd 100644
+index 9f94f530..c72f70db 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1947,12 +1947,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1959,12 +1959,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.",
  		 wiphy_name(dev->mt76.hw->wiphy));
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0067-mtk-mt76-mt7996-Refactor-rro-del-ba-command-format.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0067-mtk-mt76-mt7996-Refactor-rro-del-ba-command-format.patch
index e3d730f..c3dbca6 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0067-mtk-mt76-mt7996-Refactor-rro-del-ba-command-format.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0067-mtk-mt76-mt7996-Refactor-rro-del-ba-command-format.patch
@@ -1,11 +1,12 @@
-From 357ee3d2dd92fb9026578020c6997969ec13527b Mon Sep 17 00:00:00 2001
+From 1dbc5ac676194b3b46685104dc3fdc9f4b2dc06a Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Wed, 29 Nov 2023 15:51:04 +0800
-Subject: [PATCH 067/195] mtk: mt76: mt7996: Refactor rro del ba command format
+Subject: [PATCH 067/223] mtk: mt76: mt7996: Refactor rro del ba command format
 
 1. remove unused struct
 2. refactor upstream del ba command format
 
+Change-Id: Iab75446a54dd0bf3aa95dc80f32d7d80b6f7fc8b
 Signed-off-by: Rex Lu <rex.lu@mediatek.com>
 ---
  mt7996/mcu.h | 50 +++-----------------------------------------------
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0068-mtk-mt76-mt7996-get-airtime-and-RSSI-via-MCU-command.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0068-mtk-mt76-mt7996-get-airtime-and-RSSI-via-MCU-command.patch
index d91df08..cb7b351 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0068-mtk-mt76-mt7996-get-airtime-and-RSSI-via-MCU-command.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0068-mtk-mt76-mt7996-get-airtime-and-RSSI-via-MCU-command.patch
@@ -1,13 +1,14 @@
-From 4a426ebb37626e39873acb53c53056b694978ddb Mon Sep 17 00:00:00 2001
+From 5b0810ecadc01482ef25b7e063ebe69f42e39a8e Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Fri, 17 Nov 2023 18:08:06 +0800
-Subject: [PATCH 068/195] mtk: mt76: mt7996: get airtime and RSSI via MCU
+Subject: [PATCH 068/223] mtk: mt76: mt7996: get airtime and RSSI via MCU
  commands
 
 Direct access to WTBL for airtime and RSSI may cause synchronization issue with FW.
 Moreover, frequent access to WTBL, whenever TX-Free-Done event is received, leads to heavy CPU overheads.
 Therefore, indirect access to WTBL, through FW, with lower frequence is performed.
 
+Change-Id: I978e7432603742fae9c753f055ff3087cf6b632c
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Signed-off-by: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 ---
@@ -23,10 +24,10 @@
  9 files changed, 336 insertions(+), 142 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 9b836667..10f46a66 100644
+index e7901e57..aad7f557 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -335,11 +335,13 @@ struct mt76_sta_stats {
+@@ -336,11 +336,13 @@ struct mt76_sta_stats {
  	u32 tx_packets;		/* unit: MSDU */
  	u32 tx_retries;
  	u32 tx_failed;
@@ -64,10 +65,10 @@
  mtxq_to_txq(struct mt76_txq *mtxq)
  {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index a3f1c5bd..c21641b3 100644
+index db152167..adecb0ed 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1382,11 +1382,23 @@ enum {
+@@ -1387,11 +1387,23 @@ enum {
  	UNI_OFFLOAD_OFFLOAD_BMC_RPY_DETECT,
  };
  
@@ -93,7 +94,7 @@
  	UNI_ALL_STA_GI_MODE,
  	UNI_ALL_STA_TXRX_MSDU_COUNT,
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 3b58b8ba..8f8608fa 100644
+index 0ef8fee6..e46a0fb9 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -979,12 +979,11 @@ mt7996_airtime_read(struct seq_file *s, void *data)
@@ -135,7 +136,7 @@
  	rcu_read_unlock();
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 25f036bd..06a86146 100644
+index c72f70db..8b753148 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -12,8 +12,6 @@
@@ -258,7 +259,7 @@
  void mt7996_mac_enable_rtscts(struct mt7996_dev *dev,
  			      struct ieee80211_vif *vif, bool enable)
  {
-@@ -1209,8 +1103,6 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+@@ -1221,8 +1115,6 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
  		}
  	}
  
@@ -267,7 +268,7 @@
  	if (wake)
  		mt76_set_tx_blocked(&dev->mt76, false);
  
-@@ -2379,31 +2271,42 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+@@ -2391,31 +2283,42 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  
  void mt7996_mac_work(struct work_struct *work)
  {
@@ -324,10 +325,10 @@
  	ieee80211_queue_delayed_work(mphy->hw, &mphy->mac_work,
  				     MT7996_WATCHDOG_TIME);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 0c6adea6..4ffae1b6 100644
+index be273181..db877d75 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -563,7 +563,8 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -568,7 +568,8 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  		u16 wlan_idx;
  		struct mt76_wcid *wcid;
  		struct mt76_phy *mphy;
@@ -337,7 +338,7 @@
  
  		switch (le16_to_cpu(res->tag)) {
  		case UNI_ALL_STA_TXRX_RATE:
-@@ -584,7 +585,7 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -589,7 +590,7 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  				break;
  
  			mphy = mt76_dev_phy(&dev->mt76, wcid->phy_idx);
@@ -346,7 +347,7 @@
  				tx_bytes = le32_to_cpu(res->adm_stat[i].tx_bytes[ac]);
  				rx_bytes = le32_to_cpu(res->adm_stat[i].rx_bytes[ac]);
  
-@@ -616,6 +617,24 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -621,6 +622,24 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  			__mt7996_stat_to_netdev(mphy, wcid, 0, 0,
  						tx_packets, rx_packets);
  			break;
@@ -371,7 +372,7 @@
  		default:
  			break;
  		}
-@@ -2244,8 +2263,6 @@ mt7996_mcu_sta_init_vow(struct mt7996_phy *phy, struct mt7996_sta *msta)
+@@ -2249,8 +2268,6 @@ mt7996_mcu_sta_init_vow(struct mt7996_phy *phy, struct mt7996_sta *msta)
  	vow->drr_quantum[IEEE80211_AC_VI] = VOW_DRR_QUANTUM_IDX1;
  	vow->drr_quantum[IEEE80211_AC_BE] = VOW_DRR_QUANTUM_IDX2;
  	vow->drr_quantum[IEEE80211_AC_BK] = VOW_DRR_QUANTUM_IDX2;
@@ -380,7 +381,7 @@
  
  	ret = mt7996_mcu_set_vow_drr_ctrl(phy, msta, VOW_DRR_CTRL_STA_BSS_GROUP);
  	if (ret)
-@@ -4845,9 +4862,139 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val)
+@@ -4868,9 +4885,139 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val)
  				 sizeof(req), true);
  }
  
@@ -522,7 +523,7 @@
  	struct {
  		u8 _rsv[4];
  
-@@ -4858,7 +5005,7 @@ int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag)
+@@ -4881,7 +5028,7 @@ int mt7996_mcu_get_all_sta_info(struct mt7996_phy *phy, u16 tag)
  		.len = cpu_to_le16(sizeof(req) - 4),
  	};
  
@@ -574,10 +575,10 @@
  } __packed;
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 2f2122dc..42a4ad42 100644
+index 7d0f7dda..f6d3bd19 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -126,6 +126,8 @@
+@@ -128,6 +128,8 @@
  #define MT7996_RRO_MSDU_PG_CR_CNT 8
  #define MT7996_RRO_MSDU_PG_SIZE_PER_CR 0x10000
  
@@ -586,7 +587,7 @@
  struct mt7996_vif;
  struct mt7996_sta;
  struct mt7996_dfs_pulse;
-@@ -298,8 +300,6 @@ struct mt7996_vow_sta_ctrl {
+@@ -299,8 +301,6 @@ struct mt7996_vow_sta_ctrl {
  	bool paused;
  	u8 bss_grp_idx;
  	u8 drr_quantum[IEEE80211_NUM_ACS];
@@ -595,7 +596,7 @@
  };
  
  struct mt7996_sta {
-@@ -308,7 +308,6 @@ struct mt7996_sta {
+@@ -309,7 +309,6 @@ struct mt7996_sta {
  	struct mt7996_vif *vif;
  
  	struct list_head rc_list;
@@ -603,7 +604,7 @@
  
  	int ack_signal;
  	struct ewma_avg_signal avg_ack_signal;
-@@ -405,6 +404,21 @@ struct mt7996_air_monitor_ctrl {
+@@ -406,6 +405,21 @@ struct mt7996_air_monitor_ctrl {
  };
  #endif
  
@@ -625,7 +626,7 @@
  struct mt7996_phy {
  	struct mt76_phy *mt76;
  	struct mt7996_dev *dev;
-@@ -600,6 +614,7 @@ struct mt7996_dev {
+@@ -605,6 +619,7 @@ struct mt7996_dev {
  		u32 fw_dbg_module;
  		u8 fw_dbg_lv;
  		u32 bcn_total_cnt[__MT_MAX_BAND];
@@ -633,7 +634,7 @@
  	} dbg;
  	const struct mt7996_dbg_reg_desc *dbg_reg;
  #endif
-@@ -825,7 +840,10 @@ int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
+@@ -829,7 +844,10 @@ int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
  int mt7996_mcu_trigger_assert(struct mt7996_dev *dev);
  void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
  void mt7996_mcu_exit(struct mt7996_dev *dev);
@@ -646,10 +647,10 @@
  int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
  int mt7996_mcu_get_tx_power_info(struct mt7996_phy *phy, u8 category, void *event);
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 06c0db3f..275beb48 100644
+index 5a140f51..4ce4ac0d 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -3065,6 +3065,69 @@ mt7996_vow_drr_dbg(void *data, u64 val)
+@@ -3064,6 +3064,69 @@ mt7996_vow_drr_dbg(void *data, u64 val)
  DEFINE_DEBUGFS_ATTRIBUTE(fops_vow_drr_dbg, NULL,
  			 mt7996_vow_drr_dbg, "%lld\n");
  
@@ -719,7 +720,7 @@
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -3163,6 +3226,14 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -3162,6 +3225,14 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  
  	debugfs_create_file("muru_prot_thr", 0200, dir, phy, &fops_muru_prot_thr);
  
@@ -735,7 +736,7 @@
  }
  
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index cbd71706..a001d9fd 100644
+index 87bf0012..96438cca 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -122,6 +122,8 @@ enum offs_rev {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0069-mtk-mt76-mt7996-add-support-for-WMM-PBC-configuratio.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0069-mtk-mt76-mt7996-add-support-for-WMM-PBC-configuratio.patch
index 6a01de3..364a360 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0069-mtk-mt76-mt7996-add-support-for-WMM-PBC-configuratio.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0069-mtk-mt76-mt7996-add-support-for-WMM-PBC-configuratio.patch
@@ -1,12 +1,13 @@
-From 88b2bb56a0fc4d5ed59a9d3689691df8b7dbf552 Mon Sep 17 00:00:00 2001
+From 33a4c8e5ec36b3265e10e324e141e26b5941848f Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Thu, 4 Jan 2024 09:47:00 +0800
-Subject: [PATCH 069/195] mtk: mt76: mt7996: add support for WMM PBC
+Subject: [PATCH 069/223] mtk: mt76: mt7996: add support for WMM PBC
  configuration
 
 Query per-AC-queue packet statistics from WA, and determine if multi-AC transmission is ongoing.
 If it is, enable WMM mode in WA. Otherwise, disable WMM mode.
 
+Change-Id: I1852a45dc0e64780af5f091fd749ceab59697dbb
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt76_connac_mcu.h |  2 ++
@@ -18,10 +19,10 @@
  6 files changed, 105 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index c21641b3..edf55b72 100644
+index adecb0ed..c9cea5bb 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1037,6 +1037,7 @@ enum {
+@@ -1042,6 +1042,7 @@ enum {
  	MCU_EXT_EVENT_ASSERT_DUMP = 0x23,
  	MCU_EXT_EVENT_RDD_REPORT = 0x3a,
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
@@ -29,7 +30,7 @@
  	MCU_EXT_EVENT_WA_TX_STAT = 0x74,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
  	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
-@@ -1236,6 +1237,7 @@ enum {
+@@ -1241,6 +1242,7 @@ enum {
  	MCU_EXT_CMD_TXDPD_CAL = 0x60,
  	MCU_EXT_CMD_CAL_CACHE = 0x67,
  	MCU_EXT_CMD_RED_ENABLE = 0x68,
@@ -38,10 +39,10 @@
  	MCU_EXT_CMD_SET_RADAR_TH = 0x7c,
  	MCU_EXT_CMD_SET_RDD_PATTERN = 0x7d,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index f682423a..7c273f9c 100644
+index 04c15432..6d5e4c40 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -1536,6 +1536,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1556,6 +1556,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	INIT_WORK(&dev->dump_work, mt7996_mac_dump_work);
  	mutex_init(&dev->dump_mutex);
  
@@ -51,10 +52,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 06a86146..099e97ef 100644
+index 8b753148..bc0f0020 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2298,6 +2298,10 @@ void mt7996_mac_work(struct work_struct *work)
+@@ -2310,6 +2310,10 @@ void mt7996_mac_work(struct work_struct *work)
  					mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_ADM_STAT);
  					mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_MSDU_COUNT);
  				}
@@ -66,10 +67,10 @@
  			           test_bit(MT76_STATE_RUNNING, &mdev->phys[i]->state))
  				break;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 4ffae1b6..94ab526e 100644
+index db877d75..47f8a7cd 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -669,6 +669,82 @@ mt7996_mcu_rx_thermal_notify(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -674,6 +674,82 @@ mt7996_mcu_rx_thermal_notify(struct mt7996_dev *dev, struct sk_buff *skb)
  	phy->throttle_state = n->duty_percent;
  }
  
@@ -152,7 +153,7 @@
  static void
  mt7996_mcu_rx_ext_event(struct mt7996_dev *dev, struct sk_buff *skb)
  {
-@@ -678,6 +754,8 @@ mt7996_mcu_rx_ext_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -683,6 +759,8 @@ mt7996_mcu_rx_ext_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	case MCU_EXT_EVENT_FW_LOG_2_HOST:
  		mt7996_mcu_rx_log_message(dev, skb);
  		break;
@@ -192,11 +193,11 @@
  	MCU_WA_PARAM_RED_CONFIG = 0x40,
  };
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 42a4ad42..510de136 100644
+index f6d3bd19..ba3a639b 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -607,6 +607,9 @@ struct mt7996_dev {
- 	u8 wtbl_size_group;
+@@ -612,6 +612,9 @@ struct mt7996_dev {
+ 	} var;
  
  	struct mt7996_vow_ctrl vow;
 +
@@ -205,7 +206,7 @@
  #ifdef CONFIG_MTK_DEBUG
  	u16 wlan_idx;
  	struct {
-@@ -858,6 +861,7 @@ int mt7996_mcu_set_band_confg(struct mt7996_phy *phy, u16 option, bool enable);
+@@ -862,6 +865,7 @@ int mt7996_mcu_set_band_confg(struct mt7996_phy *phy, u16 option, bool enable);
  int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy, struct mt7996_sta *msta,
  	                        enum vow_drr_ctrl_id id);
  int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0070-mtk-mt76-mt7996-eagle-support-extra-option_type.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0070-mtk-mt76-mt7996-eagle-support-extra-option_type.patch
index 2cfe38c..1118304 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0070-mtk-mt76-mt7996-eagle-support-extra-option_type.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0070-mtk-mt76-mt7996-eagle-support-extra-option_type.patch
@@ -1,7 +1,7 @@
-From e9acc1d3f7c0c98ddd5a6500252e8d6f5b71ba5a Mon Sep 17 00:00:00 2001
+From 3ae943ca695746f6ff54a926d73a1a6b94d6411c Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Thu, 1 Feb 2024 10:32:42 +0800
-Subject: [PATCH 070/195] mtk: mt76: mt7996: eagle support extra option_type
+Subject: [PATCH 070/223] mtk: mt76: mt7996: eagle support extra option_type
 
 1. eagle + mt7988d option_type 2 support
 2. eagle single pcie support
@@ -10,6 +10,8 @@
 
 (cherry picked from commit 31d64e0f571eb06ed67f4916bc12fbcfe1263c47)
 
+Change-Id: I1c8fa6769aa0b192b32738aec0b14c86572a493b
+Change-Id: Ib8e741b3c9eba3c796704351259f926c1e4e9d69
 Signed-off-by: Rex Lu <rex.lu@mediatek.com>
 ---
  mt7996/dma.c    | 51 +++++++++++++++++++++++++++++++++----
@@ -109,7 +111,7 @@
  		mt76_wr(dev, MT_WFDMA0_PAUSE_RX_Q_45_TH + hif1_ofs, 0xc000c);
  		mt76_wr(dev, MT_WFDMA0_PAUSE_RX_Q_67_TH + hif1_ofs, 0x10008);
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 7c273f9c..910ffccf 100644
+index 6d5e4c40..96b209e6 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -513,7 +513,7 @@ static void mt7996_mac_init_basic_rates(struct mt7996_dev *dev)
@@ -203,7 +205,7 @@
  	}
  
  	mphy = mt76_alloc_phy(&dev->mt76, sizeof(*phy), &mt7996_ops, band);
-@@ -1060,6 +1096,9 @@ int mt7996_get_chip_sku(struct mt7996_dev *dev)
+@@ -1076,6 +1112,9 @@ static int mt7996_variant_fem_init(struct mt7996_dev *dev)
  static int mt7996_init_hardware(struct mt7996_dev *dev)
  {
  	int ret, idx;
@@ -214,7 +216,7 @@
  	mt76_wr(dev, MT_INT_SOURCE_CSR, ~0);
  	if (is_mt7992(&dev->mt76)) {
 diff --git a/mt7996/main.c b/mt7996/main.c
-index cdb49e21..b094161f 100644
+index dcf1fc38..a53eaa55 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1595,8 +1595,19 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
@@ -240,7 +242,7 @@
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 510de136..1c63f66a 100644
+index ba3a639b..eb9a5634 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -8,6 +8,7 @@
@@ -251,7 +253,7 @@
  #include "../mt76_connac.h"
  #include "regs.h"
  
-@@ -350,6 +351,8 @@ struct mt7996_hif {
+@@ -351,6 +352,8 @@ struct mt7996_hif {
  	struct device *dev;
  	void __iomem *regs;
  	int irq;
@@ -260,7 +262,7 @@
  };
  
  struct mt7996_scs_ctrl {
-@@ -580,6 +583,8 @@ struct mt7996_dev {
+@@ -581,6 +584,8 @@ struct mt7996_dev {
  	u8 eeprom_mode;
  	u32 bg_nxt_freq;
  
@@ -290,7 +292,7 @@
  	list_add(&hif->list, &hif_list);
  	spin_unlock_bh(&hif_lock);
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index a001d9fd..a0e4b3e1 100644
+index 96438cca..3a1568c3 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -435,6 +435,7 @@ enum offs_rev {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0071-mtk-mt76-mt7996-support-enable-disable-thermal-prote.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0071-mtk-mt76-mt7996-support-enable-disable-thermal-prote.patch
index 8ca2898..c5deee4 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0071-mtk-mt76-mt7996-support-enable-disable-thermal-prote.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0071-mtk-mt76-mt7996-support-enable-disable-thermal-prote.patch
@@ -1,7 +1,7 @@
-From 5bc9f4f0aaa6f2494bcdd6493c61d6441ac7ba63 Mon Sep 17 00:00:00 2001
+From 93cd3c23453725f003318b5556ad09b56e3995a6 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 27 Jul 2023 19:35:32 +0800
-Subject: [PATCH 071/195] mtk: mt76: mt7996: support enable/disable thermal
+Subject: [PATCH 071/223] mtk: mt76: mt7996: support enable/disable thermal
  protection mechanism
 
 This commit adds a new debugfs thermal_enable to enable/disable thermal
@@ -24,7 +24,7 @@
  3 files changed, 47 insertions(+)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index b094161f..5ef4bfc4 100644
+index a53eaa55..e5b32d33 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -91,6 +91,7 @@ int mt7996_run(struct ieee80211_hw *hw)
@@ -36,10 +36,10 @@
  	ret = mt7996_mcu_set_tx_power_ctrl(phy, UNI_TXPOWER_SKU_POWER_LIMIT_CTRL,
  						dev->dbg.sku_disable ? 0 : phy->sku_limit_en);
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 1c63f66a..55f47bd3 100644
+index eb9a5634..94735872 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -489,6 +489,7 @@ struct mt7996_phy {
+@@ -490,6 +490,7 @@ struct mt7996_phy {
  #ifdef CONFIG_MTK_DEBUG
  	bool sr_enable:1;
  	bool enhanced_sr_enable:1;
@@ -48,10 +48,10 @@
  };
  
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 275beb48..66ab74d2 100644
+index 4ce4ac0d..196038d4 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -3128,6 +3128,49 @@ mt7996_show_rro_mib(struct seq_file *s, void *data)
+@@ -3127,6 +3127,49 @@ mt7996_show_rro_mib(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -101,7 +101,7 @@
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -3234,6 +3277,8 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -3233,6 +3276,8 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  					    mt7996_show_rro_mib);
  	}
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0072-mtk-mt76-mt7996-support-thermal-recal-debug-command.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0072-mtk-mt76-mt7996-support-thermal-recal-debug-command.patch
index 35db38d..6115142 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0072-mtk-mt76-mt7996-support-thermal-recal-debug-command.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0072-mtk-mt76-mt7996-support-thermal-recal-debug-command.patch
@@ -1,7 +1,7 @@
-From 53c49d00cffb1a1d25f05a6b8a1e4539130462e8 Mon Sep 17 00:00:00 2001
+From 3ee40687fd7064508306f1008c14433ccf7253d4 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 4 Jan 2024 19:53:37 +0800
-Subject: [PATCH 072/195] mtk: mt76: mt7996: support thermal recal debug
+Subject: [PATCH 072/223] mtk: mt76: mt7996: support thermal recal debug
  command
 
 Add support thermal recal debug command.
@@ -14,6 +14,7 @@
 1 = enable
 2 = manual trigger
 
+Change-Id: Ief064633dd7ab0faeb298ac3902ca1b399e70365
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
  mt76_connac_mcu.h    |  1 +
@@ -23,10 +24,10 @@
  4 files changed, 40 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index edf55b72..57f6f857 100644
+index c9cea5bb..11a1224a 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1297,6 +1297,7 @@ enum {
+@@ -1302,6 +1302,7 @@ enum {
  	MCU_UNI_CMD_TESTMODE_TRX_PARAM = 0x42,
  	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
  	MCU_UNI_CMD_PRECAL_RESULT = 0x47,
@@ -35,10 +36,10 @@
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
  	MCU_UNI_CMD_PER_STA_INFO = 0x6d,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 55f47bd3..da2b082d 100644
+index 94735872..82ff4e99 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1033,6 +1033,7 @@ void mt7996_mcu_set_cert(struct mt7996_phy *phy, u8 type);
+@@ -1037,6 +1037,7 @@ void mt7996_mcu_set_cert(struct mt7996_phy *phy, u8 type);
  void mt7996_tm_update_channel(struct mt7996_phy *phy);
  
  int mt7996_mcu_set_vow_drr_dbg(struct mt7996_dev *dev, u32 val);
@@ -47,10 +48,10 @@
  
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 66ab74d2..cc1224ed 100644
+index 196038d4..bc9a0f04 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -3171,6 +3171,22 @@ out:
+@@ -3170,6 +3170,22 @@ out:
  DEFINE_DEBUGFS_ATTRIBUTE(fops_thermal_enable, mt7996_thermal_enable_get,
  			 mt7996_thermal_enable_set, "%lld\n");
  
@@ -73,7 +74,7 @@
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -3278,6 +3294,7 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -3277,6 +3293,7 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  	}
  
  	debugfs_create_file("thermal_enable", 0600, dir, phy, &fops_thermal_enable);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0073-mtk-mt76-mt7996-add-kite-two-pcie-with-two-wed-suppo.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0073-mtk-mt76-mt7996-add-kite-two-pcie-with-two-wed-suppo.patch
index 33d121a..0f9bedd 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0073-mtk-mt76-mt7996-add-kite-two-pcie-with-two-wed-suppo.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0073-mtk-mt76-mt7996-add-kite-two-pcie-with-two-wed-suppo.patch
@@ -1,7 +1,7 @@
-From fb145457e927992a62ba35c4f448ef38ed97ab1f Mon Sep 17 00:00:00 2001
+From 4f6f8ddf1d26b8dac9d405f6c73457adab2660cc Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Tue, 19 Mar 2024 13:16:12 +0800
-Subject: [PATCH 073/195] mtk: mt76: mt7996: add kite two pcie with two wed
+Subject: [PATCH 073/223] mtk: mt76: mt7996: add kite two pcie with two wed
  support
 
 Signed-off-by: Rex Lu <rex.lu@mediatek.com>
@@ -131,7 +131,7 @@
  				       MT_RXQ_ID(MT_RXQ_BAND1_WA),
  				       MT7996_RX_MCU_RING_SIZE,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 910ffccf..1e4e6e78 100644
+index 96b209e6..48798711 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -527,39 +527,46 @@ void mt7996_mac_init(struct mt7996_dev *dev)
@@ -222,7 +222,7 @@
  				wed = &dev->mt76.mmio.wed_hif2;
  			}
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 5ef4bfc4..1ef54c73 100644
+index e5b32d33..3a274ba7 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1596,7 +1596,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
@@ -310,7 +310,7 @@
  		if (ret < 0)
  			goto free_wed_or_irq_vector;
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index a0e4b3e1..e1893517 100644
+index 3a1568c3..a0b57e59 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -525,6 +525,7 @@ enum offs_rev {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0074-mtk-mt76-add-support-to-enable-index-FW-log-for-Cons.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0074-mtk-mt76-add-support-to-enable-index-FW-log-for-Cons.patch
index 8372246..7ab34bf 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0074-mtk-mt76-add-support-to-enable-index-FW-log-for-Cons.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0074-mtk-mt76-add-support-to-enable-index-FW-log-for-Cons.patch
@@ -1,7 +1,7 @@
-From 3f188dc11bb0989fc8b74585aba8993a3ac65c67 Mon Sep 17 00:00:00 2001
+From ec4ace4cb79cc70a766eaf648b56b9db3836a254 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Thu, 11 Jan 2024 08:55:13 +0800
-Subject: [PATCH 074/195] mtk: mt76: add support to enable index FW log for
+Subject: [PATCH 074/223] mtk: mt76: add support to enable index FW log for
  ConsysPlanet
 
 Add support to enable and record index FW log, which is the input for ConsysPlanet, via mt76-test command.
@@ -25,6 +25,7 @@
 - Driver Log: log message printed at driver layer
 	- Location: /tmp/log/clog_(timestamp)/WIFI_KERNEL_(timestamp).clog
 
+Change-Id: I5d72c844e920cdcbaed4c65f734de8f041e6f384
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt7996/debugfs.c  |  90 +++++++++++++++++--
@@ -38,7 +39,7 @@
  8 files changed, 295 insertions(+), 69 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 8f8608fa..7395f6df 100644
+index e46a0fb9..7e8e91ca 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -430,8 +430,8 @@ create_buf_file_cb(const char *filename, struct dentry *parent, umode_t mode,
@@ -168,10 +169,10 @@
  	return true;
  }
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 099e97ef..564f080d 100644
+index bc0f0020..4ea44f8d 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2279,11 +2279,9 @@ void mt7996_mac_work(struct work_struct *work)
+@@ -2291,11 +2291,9 @@ void mt7996_mac_work(struct work_struct *work)
  	mutex_lock(&mdev->mutex);
  
  	mt76_update_survey(mphy);
@@ -184,7 +185,7 @@
  		mt7996_mac_update_stats(phy);
  
  		/* Update DEV-wise information only in
-@@ -2302,6 +2300,12 @@ void mt7996_mac_work(struct work_struct *work)
+@@ -2314,6 +2312,12 @@ void mt7996_mac_work(struct work_struct *work)
  				if (mt7996_mcu_wa_cmd(phy->dev, MCU_WA_PARAM_CMD(QUERY), MCU_WA_PARAM_BSS_ACQ_PKT_CNT,
  				                      BSS_ACQ_PKT_CNT_BSS_BITMAP_ALL | BSS_ACQ_PKT_CNT_READ_CLR, 0))
  					dev_err(mdev->dev, "Failed to query per-AC-queue packet counts.\n");
@@ -198,10 +199,10 @@
  			           test_bit(MT76_STATE_RUNNING, &mdev->phys[i]->state))
  				break;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 94ab526e..de05785b 100644
+index 47f8a7cd..d559df86 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -400,6 +400,7 @@ static void
+@@ -405,6 +405,7 @@ static void
  mt7996_mcu_rx_log_message(struct mt7996_dev *dev, struct sk_buff *skb)
  {
  #define UNI_EVENT_FW_LOG_FORMAT 0
@@ -209,7 +210,7 @@
  	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
  	const char *data = (char *)&rxd[1] + 4, *type;
  	struct tlv *tlv = (struct tlv *)data;
-@@ -411,7 +412,8 @@ mt7996_mcu_rx_log_message(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -416,7 +417,8 @@ mt7996_mcu_rx_log_message(struct mt7996_dev *dev, struct sk_buff *skb)
  		goto out;
  	}
  
@@ -219,7 +220,7 @@
  		return;
  
  	data += sizeof(*tlv) + 4;
-@@ -3189,6 +3191,36 @@ int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level)
+@@ -3194,6 +3196,36 @@ int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level)
  				 sizeof(data), false);
  }
  
@@ -279,10 +280,10 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index da2b082d..4288f69e 100644
+index 82ff4e99..4e99830f 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -592,9 +592,11 @@ struct mt7996_dev {
+@@ -593,9 +593,11 @@ struct mt7996_dev {
  	u8 fw_debug_bin;
  	u16 fw_debug_seq;
  	bool fw_debug_muru_disable;
@@ -294,7 +295,7 @@
  
  	void *cal;
  	u32 cur_prek_offset;
-@@ -846,6 +848,7 @@ int mt7996_mcu_wa_cmd(struct mt7996_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
+@@ -850,6 +852,7 @@ int mt7996_mcu_wa_cmd(struct mt7996_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
  int mt7996_mcu_red_config(struct mt7996_dev *dev, bool enable);
  int mt7996_mcu_fw_log_2_host(struct mt7996_dev *dev, u8 type, u8 ctrl);
  int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0075-mtk-mt76-mt7996-implement-and-switch-to-hw-scan-call.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0075-mtk-mt76-mt7996-implement-and-switch-to-hw-scan-call.patch
index 6fa1732..9977a88 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0075-mtk-mt76-mt7996-implement-and-switch-to-hw-scan-call.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0075-mtk-mt76-mt7996-implement-and-switch-to-hw-scan-call.patch
@@ -1,7 +1,7 @@
-From 4e322e2774025752108caa1572029f6fd016bde3 Mon Sep 17 00:00:00 2001
+From 953012de13153dbc078b6fe3cc64d6d44e2d251f Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 3 Nov 2023 21:44:45 +0800
-Subject: [PATCH 075/195] mtk: mt76: mt7996: implement and switch to hw scan
+Subject: [PATCH 075/223] mtk: mt76: mt7996: implement and switch to hw scan
  callbacks
 
 To support MLO, hw_scan callbacks are mandatory. However, the
@@ -13,6 +13,7 @@
 request should be unicast.
 This works for ML probe request, which should be unicast.
 
+Change-Id: Ic096b10e4a82211be4c5c435d3e34e0a76ea3b9e
 Co-developed-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Co-developed-by: Peter Chiu <chui-hao.chiu@mediatek.com>
@@ -30,7 +31,7 @@
  8 files changed, 256 insertions(+), 11 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 57621c28..65af28d2 100644
+index b08a9388..cad85f19 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -820,7 +820,7 @@ bool mt76_has_tx_pending(struct mt76_phy *phy)
@@ -51,7 +52,7 @@
  void mt76_update_survey_active_time(struct mt76_phy *phy, ktime_t time)
  {
 diff --git a/mt76.h b/mt76.h
-index 10f46a66..3ce102d0 100644
+index aad7f557..36e92dfe 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -1483,6 +1483,8 @@ void mt76_release_buffered_frames(struct ieee80211_hw *hw,
@@ -64,7 +65,7 @@
  void mt76_update_survey_active_time(struct mt76_phy *phy, ktime_t time);
  int mt76_get_survey(struct ieee80211_hw *hw, int idx,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 1e4e6e78..2b396d94 100644
+index 48798711..a188fa1d 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -459,6 +459,9 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -85,7 +86,7 @@
  
  	ret = mt7996_eeprom_parse_hw_cap(dev, phy);
  	if (ret)
-@@ -1574,6 +1578,7 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1594,6 +1598,7 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	dev->mt76.phy.priv = &dev->phy;
  	INIT_WORK(&dev->rc_work, mt7996_mac_sta_rc_work);
  	INIT_DELAYED_WORK(&dev->mphy.mac_work, mt7996_mac_work);
@@ -94,10 +95,10 @@
  	INIT_LIST_HEAD(&dev->sta_rc_list);
  	INIT_LIST_HEAD(&dev->twt_list);
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 564f080d..7578cbb0 100644
+index 4ea44f8d..5c29fe7f 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2693,3 +2693,144 @@ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
+@@ -2705,3 +2705,144 @@ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
  	dev->twt.table_mask &= ~BIT(flow->table_id);
  	dev->twt.n_agrt--;
  }
@@ -243,7 +244,7 @@
 +	ieee80211_queue_delayed_work(hw, &phy->scan_work, duration);
 +}
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 1ef54c73..ea07d8a3 100644
+index 3a274ba7..475763e4 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -312,6 +312,8 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
@@ -399,10 +400,10 @@
  	.get_txpower = mt76_get_txpower,
  	.channel_switch_beacon = mt7996_channel_switch_beacon,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index de05785b..ed0e721e 100644
+index d559df86..746fc223 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3781,7 +3781,8 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
+@@ -3786,7 +3786,8 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
  	if (phy->mt76->hw->conf.flags & IEEE80211_CONF_MONITOR)
  		req.switch_reason = CH_SWITCH_NORMAL;
  	else if (phy->mt76->offchannel ||
@@ -426,10 +427,10 @@
  	struct mt7996_dev *dev;
  	struct mt76_dev *mdev;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 4288f69e..f94cb496 100644
+index 4e99830f..87b166aa 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -459,6 +459,13 @@ struct mt7996_phy {
+@@ -460,6 +460,13 @@ struct mt7996_phy {
  	u8 pp_mode;
  	u16 punct_bitmap;
  
@@ -443,7 +444,7 @@
  	struct mt7996_scs_ctrl scs_ctrl;
  	u32 red_drop;
  
-@@ -807,7 +814,7 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+@@ -811,7 +818,7 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
  			    struct ieee80211_he_obss_pd *he_obss_pd);
  int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  			     struct ieee80211_sta *sta, bool changed);
@@ -452,7 +453,7 @@
  int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag);
  int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif);
  int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
-@@ -965,6 +972,8 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+@@ -969,6 +976,8 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  			 struct sk_buff *skb, u32 *info);
  bool mt7996_rx_check(struct mt76_dev *mdev, void *data, int len);
  void mt7996_stats_work(struct work_struct *work);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0076-mtk-mt76-mt7996-implement-and-switch-to-chanctx-call.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0076-mtk-mt76-mt7996-implement-and-switch-to-chanctx-call.patch
index d5bdceb..0a5ab02 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0076-mtk-mt76-mt7996-implement-and-switch-to-chanctx-call.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0076-mtk-mt76-mt7996-implement-and-switch-to-chanctx-call.patch
@@ -1,13 +1,14 @@
-From fe29ca1d56a277b57b511b07c19b3be3217c75ba Mon Sep 17 00:00:00 2001
+From f6889bcb95884df285d628c93b78fe28a5008262 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Nov 2023 16:17:11 +0800
-Subject: [PATCH 076/195] mtk: mt76: mt7996: implement and switch to chanctx
+Subject: [PATCH 076/223] mtk: mt76: mt7996: implement and switch to chanctx
  callbacks
 
 To support MLO, chanctx callbacks are mandatory, since one VIF (MLD) could
 operate on multiple channels (links).
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
+Change-Id: Ie4530a3bc2ac9e51045184d5aecca14118177042
 Co-developed-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -20,7 +21,7 @@
  5 files changed, 211 insertions(+), 18 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 2b396d94..d18db618 100644
+index a188fa1d..7afbd46a 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -384,6 +384,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -71,7 +72,7 @@
  	ret = mt7996_thermal_init(phy);
  	if (ret)
  		goto error;
-@@ -1609,6 +1629,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1629,6 +1649,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -81,10 +82,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 7578cbb0..fc6e383b 100644
+index 5c29fe7f..7cfc25ba 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2785,7 +2785,10 @@ void mt7996_scan_work(struct work_struct *work)
+@@ -2797,7 +2797,10 @@ void mt7996_scan_work(struct work_struct *work)
  		mt7996_scan_complete(phy, false);
  		mutex_unlock(&phy->dev->mt76.mutex);
  
@@ -96,7 +97,7 @@
  
  		return;
  	}
-@@ -2797,7 +2800,10 @@ void mt7996_scan_work(struct work_struct *work)
+@@ -2809,7 +2812,10 @@ void mt7996_scan_work(struct work_struct *work)
  		phy->scan_chan = NULL;
  		mutex_unlock(&phy->dev->mt76.mutex);
  
@@ -109,7 +110,7 @@
  		ieee80211_queue_delayed_work(hw, &phy->scan_work, HZ / 10);
  
 diff --git a/mt7996/main.c b/mt7996/main.c
-index ea07d8a3..8884c6c4 100644
+index 475763e4..cbd64681 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -76,6 +76,11 @@ int mt7996_run(struct ieee80211_hw *hw)
@@ -317,10 +318,10 @@
 +	.switch_vif_chanctx = mt7996_switch_vif_chanctx,
  };
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index ed0e721e..95284a59 100644
+index 746fc223..ba53c3fc 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -5299,7 +5299,7 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
+@@ -5322,7 +5322,7 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
  		.bitmap = cpu_to_le16(bitmap),
  	};
  
@@ -330,10 +331,10 @@
  		return 0;
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index f94cb496..3597bbbf 100644
+index 87b166aa..07790257 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -333,6 +333,8 @@ struct mt7996_vif {
+@@ -334,6 +334,8 @@ struct mt7996_vif {
  
  	struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS];
  	struct cfg80211_bitrate_mask bitrate_mask;
@@ -342,7 +343,7 @@
  };
  
  /* crash-dump */
-@@ -422,6 +424,14 @@ struct mt7996_rro_ba_session {
+@@ -423,6 +425,14 @@ struct mt7996_rro_ba_session {
  	u32 last_in_rxtime :12;
  };
  
@@ -357,7 +358,7 @@
  struct mt7996_phy {
  	struct mt76_phy *mt76;
  	struct mt7996_dev *dev;
-@@ -465,6 +475,7 @@ struct mt7996_phy {
+@@ -466,6 +476,7 @@ struct mt7996_phy {
  	struct cfg80211_scan_request *scan_req;
  	struct ieee80211_vif *scan_vif;
  	int scan_chan_idx;
@@ -365,8 +366,8 @@
  
  	struct mt7996_scs_ctrl scs_ctrl;
  	u32 red_drop;
-@@ -753,6 +764,12 @@ mt7996_get_background_radar_cap(struct mt7996_dev *dev)
- 	return 1;
+@@ -757,6 +768,12 @@ mt7996_has_background_radar(struct mt7996_dev *dev)
+ 	return true;
  }
  
 +static inline struct mt7996_chanctx *
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0077-mtk-mt76-mt7996-use-.sta_state-to-replace-.sta_add-a.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0077-mtk-mt76-mt7996-use-.sta_state-to-replace-.sta_add-a.patch
index a4e2903..0508cee 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0077-mtk-mt76-mt7996-use-.sta_state-to-replace-.sta_add-a.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0077-mtk-mt76-mt7996-use-.sta_state-to-replace-.sta_add-a.patch
@@ -1,7 +1,7 @@
-From dddb6dd71066e36b6d5978bd1422655638654fcd Mon Sep 17 00:00:00 2001
+From 2819a489bf4d70e8407cdc07d2d77b3b40441669 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 8 Nov 2023 18:52:26 +0800
-Subject: [PATCH 077/195] mtk: mt76: mt7996: use .sta_state to replace .sta_add
+Subject: [PATCH 077/223] mtk: mt76: mt7996: use .sta_state to replace .sta_add
  and .sta_remove
 
 MAC80211 mostly uses MLD address through TX path, and leaves the header
@@ -13,6 +13,7 @@
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
+Change-Id: I8a0faef919843f2c7d5ff3256702a3bf8384ea60
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mt7996/main.c   | 55 +++++++++++++++++++++----------------------------
@@ -21,7 +22,7 @@
  3 files changed, 26 insertions(+), 32 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 8884c6c4..e093be48 100644
+index cbd64681..5edfbc4b 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -782,7 +782,7 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -131,10 +132,10 @@
  		.update_survey = mt7996_update_channel,
  		// .set_channel = mt7996_set_channel,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 3597bbbf..4d7617ca 100644
+index 07790257..7d416f30 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -967,6 +967,8 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+@@ -971,6 +971,8 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
  void mt7996_mac_set_coverage_class(struct mt7996_phy *phy);
  int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		       struct ieee80211_sta *sta);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0078-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0078-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch
index 53baa03..8e80fdc 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0078-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0078-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch
@@ -1,7 +1,7 @@
-From 6c7dbf532c929aa9faa90b9cc99b350494e8b8b9 Mon Sep 17 00:00:00 2001
+From 2aa446d88555e199c973a8b46ece2749a7aff2b4 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 24 Nov 2023 11:31:55 +0800
-Subject: [PATCH 078/195] mtk: mt76: mt7996: switch to per-link data structure
+Subject: [PATCH 078/223] mtk: mt76: mt7996: switch to per-link data structure
  of vif
 
 Introduce struct mt7996_bss_conf, data structure for per-link BSS.
@@ -22,7 +22,7 @@
  7 files changed, 463 insertions(+), 363 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 7395f6df..5d4d69ea 100644
+index 7e8e91ca..792ace03 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -726,7 +726,7 @@ static void
@@ -71,7 +71,7 @@
  	char buf[100];
  	int ret;
 diff --git a/mt7996/init.c b/mt7996/init.c
-index d18db618..86bb0661 100644
+index 7afbd46a..f5bff109 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -630,11 +630,11 @@ static int mt7996_vow_init(struct mt7996_phy *phy)
@@ -89,10 +89,10 @@
  		return ret;
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index fc6e383b..5fbcfc74 100644
+index 7cfc25ba..8f743125 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -900,8 +900,9 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -912,8 +912,9 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  
  	if (vif) {
  		struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -103,7 +103,7 @@
  	}
  
  	txp->fw.token = cpu_to_le16(id);
-@@ -1515,12 +1516,15 @@ static void
+@@ -1527,12 +1528,15 @@ static void
  mt7996_update_vif_beacon(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
  	struct ieee80211_hw *hw = priv;
@@ -120,7 +120,7 @@
  		break;
  	default:
  		break;
-@@ -2237,6 +2241,8 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+@@ -2249,6 +2253,8 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  	struct mt7996_dev *dev = container_of(work, struct mt7996_dev, rc_work);
  	struct ieee80211_sta *sta;
  	struct ieee80211_vif *vif;
@@ -129,7 +129,7 @@
  	struct mt7996_sta *msta;
  	u32 changed;
  	LIST_HEAD(list);
-@@ -2253,14 +2259,16 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+@@ -2265,14 +2271,16 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  
  		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
  		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
@@ -148,7 +148,7 @@
  						   RATE_PARAM_MMPS_UPDATE);
  
  		spin_lock_bh(&dev->mt76.sta_poll_lock);
-@@ -2643,7 +2651,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+@@ -2655,7 +2663,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  
  		flow->sched = true;
  		flow->start_tsf = mt7996_mac_twt_sched_list_add(dev, flow);
@@ -157,7 +157,7 @@
  		div_u64_rem(curr_tsf - flow->start_tsf, interval, &rem);
  		flow_tsf = curr_tsf + interval - rem;
  		twt_agrt->twt = cpu_to_le64(flow_tsf);
-@@ -2652,7 +2660,8 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+@@ -2664,7 +2672,8 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  	}
  	flow->tsf = le64_to_cpu(twt_agrt->twt);
  
@@ -167,7 +167,7 @@
  		goto unlock;
  
  	setup_cmd = TWT_SETUP_CMD_ACCEPT;
-@@ -2674,6 +2683,7 @@ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
+@@ -2686,6 +2695,7 @@ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
  				  u8 flowid)
  {
  	struct mt7996_twt_flow *flow;
@@ -175,7 +175,7 @@
  
  	lockdep_assert_held(&dev->mt76.mutex);
  
-@@ -2684,8 +2694,7 @@ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
+@@ -2696,8 +2706,7 @@ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
  		return;
  
  	flow = &msta->twt.flow[flowid];
@@ -186,7 +186,7 @@
  
  	list_del_init(&flow->list);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index e093be48..2e6bb41e 100644
+index 5edfbc4b..8d919dd0 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -205,29 +205,30 @@ static int get_omac_idx(enum nl80211_iftype type, u64 mask)
@@ -884,10 +884,10 @@
  
  	mutex_unlock(&phy->dev->mt76.mutex);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 95284a59..21c93c1c 100644
+index ba53c3fc..b2eed253 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -117,12 +117,12 @@ mt7996_mcu_get_sta_nss(u16 mcs_map)
+@@ -122,12 +122,12 @@ mt7996_mcu_get_sta_nss(u16 mcs_map)
  }
  
  static void
@@ -905,7 +905,7 @@
  	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
  
  	for (nss = 0; nss < max_nss; nss++) {
-@@ -922,8 +922,7 @@ mt7996_mcu_add_uni_tlv(struct sk_buff *skb, u16 tag, u16 len)
+@@ -927,8 +927,7 @@ mt7996_mcu_add_uni_tlv(struct sk_buff *skb, u16 tag, u16 len)
  }
  
  static void
@@ -915,7 +915,7 @@
  {
  	static const u8 rlm_ch_band[] = {
  		[NL80211_BAND_2GHZ] = 1,
-@@ -953,8 +952,7 @@ mt7996_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+@@ -958,8 +957,7 @@ mt7996_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
  }
  
  static void
@@ -925,7 +925,7 @@
  {
  	struct bss_ra_tlv *ra;
  	struct tlv *tlv;
-@@ -966,7 +964,7 @@ mt7996_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+@@ -971,7 +969,7 @@ mt7996_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
  }
  
  static void
@@ -934,7 +934,7 @@
  		      struct mt7996_phy *phy)
  {
  #define DEFAULT_HE_PE_DURATION		4
-@@ -975,16 +973,16 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+@@ -980,16 +978,16 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
  	struct bss_info_uni_he *he;
  	struct tlv *tlv;
  
@@ -954,7 +954,7 @@
  	if (!he->he_rts_thres)
  		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
  
-@@ -994,13 +992,13 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+@@ -999,13 +997,13 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
  }
  
  static void
@@ -970,7 +970,7 @@
  		return;
  
  	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_11V_MBSSID, sizeof(*mbssid));
-@@ -1008,23 +1006,21 @@ mt7996_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+@@ -1013,23 +1011,21 @@ mt7996_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
  	mbssid = (struct bss_info_uni_mbssid *)tlv;
  
  	if (enable) {
@@ -998,7 +998,7 @@
  
  	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_RATE, sizeof(*bmc));
  
-@@ -1048,9 +1044,9 @@ mt7996_mcu_bss_txcmd_tlv(struct sk_buff *skb, bool en)
+@@ -1053,9 +1049,9 @@ mt7996_mcu_bss_txcmd_tlv(struct sk_buff *skb, bool en)
  }
  
  static void
@@ -1010,7 +1010,7 @@
  	struct bss_mld_tlv *mld;
  	struct tlv *tlv;
  
-@@ -1058,33 +1054,30 @@ mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
+@@ -1063,33 +1059,30 @@ mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
  
  	mld = (struct bss_mld_tlv *)tlv;
  	mld->group_mld_id = 0xff;
@@ -1051,7 +1051,7 @@
  	struct {
  		struct {
  			u8 band;
-@@ -1109,9 +1102,6 @@ mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+@@ -1114,9 +1107,6 @@ mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_vif *vif,
  		.entry_add = true,
  	};
  
@@ -1061,7 +1061,7 @@
  	if (enable)
  		memcpy(req.addr, addr, ETH_ALEN);
  
-@@ -1120,10 +1110,8 @@ mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+@@ -1125,10 +1115,8 @@ mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_vif *vif,
  }
  
  static void
@@ -1073,7 +1073,7 @@
  	struct bss_ifs_time_tlv *ifs_time;
  	struct tlv *tlv;
  	bool is_2ghz = phy->mt76->chandef.chan->band == NL80211_BAND_2GHZ;
-@@ -1149,12 +1137,13 @@ mt7996_mcu_bss_ifs_timing_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
+@@ -1154,12 +1142,13 @@ mt7996_mcu_bss_ifs_timing_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
  
  static int
  mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
@@ -1089,7 +1089,7 @@
  	struct cfg80211_chan_def *chandef = &phy->chandef;
  	struct mt76_connac_bss_basic_tlv *bss;
  	u32 type = CONNECTION_INFRA_AP;
-@@ -1171,8 +1160,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -1176,8 +1165,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  		if (enable) {
  			rcu_read_lock();
  			if (!sta)
@@ -1099,7 +1099,7 @@
  			/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
  			if (sta) {
  				struct mt76_wcid *wcid;
-@@ -1195,18 +1183,17 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -1200,18 +1188,17 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*bss));
  
  	bss = (struct mt76_connac_bss_basic_tlv *)tlv;
@@ -1123,7 +1123,7 @@
  	bss->hw_bss_idx = idx;
  
  	if (vif->type == NL80211_IFTYPE_MONITOR) {
-@@ -1219,9 +1206,9 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -1224,9 +1211,9 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  		return 0;
  	}
  
@@ -1136,7 +1136,7 @@
  	bss->phymode = mt76_connac_get_phy_mode(phy, vif,
  						chandef->chan->band, NULL);
  	bss->phymode_ext = mt76_connac_get_phy_mode_ext(phy, vif,
-@@ -1248,63 +1235,64 @@ __mt7996_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
+@@ -1253,63 +1240,64 @@ __mt7996_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
  }
  
  int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
@@ -1220,7 +1220,7 @@
  
  	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
  				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
-@@ -1346,12 +1334,12 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
+@@ -1351,12 +1339,12 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  			 bool enable)
  {
  	struct mt7996_sta *msta = (struct mt7996_sta *)params->sta->drv_priv;
@@ -1235,7 +1235,7 @@
  }
  
  int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
-@@ -1359,13 +1347,14 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
+@@ -1364,13 +1352,14 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
  			 bool enable)
  {
  	struct mt7996_sta *msta = (struct mt7996_sta *)params->sta->drv_priv;
@@ -1253,7 +1253,7 @@
  		      struct ieee80211_sta *sta)
  {
  	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
-@@ -1386,9 +1375,9 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+@@ -1391,9 +1380,9 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
  		he->he_phy_cap[i] = elem->phy_cap_info[i];
  	}
  
@@ -1265,7 +1265,7 @@
  				 IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD);
  
  	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
-@@ -1396,16 +1385,16 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+@@ -1401,16 +1390,16 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
@@ -1285,7 +1285,7 @@
  					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
  					  le16_to_cpu(mcs_map.rx_mcs_80));
  		break;
-@@ -1496,7 +1485,7 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1501,7 +1490,7 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct tlv *tlv;
  #ifdef CONFIG_MTK_VENDOR
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
@@ -1294,7 +1294,7 @@
  #endif
  
  	/* For 6G band, this tlv is necessary to let hw work normally */
-@@ -1553,25 +1542,26 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1558,25 +1547,26 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  
  static void
  mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
@@ -1330,7 +1330,7 @@
  			       !!(phy->muru_onoff & MUMIMO_DL);
  	muru->cfg.mimo_ul_en = !!(phy->muru_onoff & MUMIMO_UL);
  	muru->cfg.ofdma_dl_en = !!(phy->muru_onoff & OFDMA_DL);
-@@ -1612,13 +1602,14 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1617,13 +1607,14 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  }
  
  static inline bool
@@ -1348,7 +1348,7 @@
  		return false;
  
  	if (!bfee && sts < 2)
-@@ -1629,10 +1620,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+@@ -1634,10 +1625,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
  		struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
  
  		if (bfee)
@@ -1361,7 +1361,7 @@
  			       EHT_PHY(CAP0_SU_BEAMFORMEE, pe->phy_cap_info[0]);
  	}
  
-@@ -1640,10 +1631,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+@@ -1645,10 +1636,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
  		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
  
  		if (bfee)
@@ -1374,7 +1374,7 @@
  			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
  	}
  
-@@ -1651,10 +1642,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+@@ -1656,10 +1647,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
  		u32 cap = sta->deflink.vht_cap.cap;
  
  		if (bfee)
@@ -1387,7 +1387,7 @@
  			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
  	}
  
-@@ -1850,10 +1841,10 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+@@ -1855,10 +1846,10 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  
  static void
  mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
@@ -1401,7 +1401,7 @@
  	int tx_ant = hweight16(phy->mt76->chainmask) - 1;
  	struct sta_rec_bf *bf;
  	struct tlv *tlv;
-@@ -1868,7 +1859,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1873,7 +1864,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
  		return;
  
@@ -1410,7 +1410,7 @@
  	if (!ebf && !dev->ibf)
  		return;
  
-@@ -1880,9 +1871,9 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1885,9 +1876,9 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	 * ht: iBF only, since mac80211 lacks of eBF support
  	 */
  	if (sta->deflink.eht_cap.has_eht && ebf)
@@ -1422,7 +1422,7 @@
  	else if (sta->deflink.vht_cap.vht_supported)
  		mt7996_mcu_sta_bfer_vht(sta, phy, bf, ebf);
  	else if (sta->deflink.ht_cap.ht_supported)
-@@ -1921,10 +1912,10 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1926,10 +1917,10 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  
  static void
  mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
@@ -1436,7 +1436,7 @@
  	int tx_ant = hweight8(phy->mt76->antenna_mask) - 1;
  	struct sta_rec_bfee *bfee;
  	struct tlv *tlv;
-@@ -1933,7 +1924,7 @@ mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1938,7 +1929,7 @@ mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
  		return;
  
@@ -1445,7 +1445,7 @@
  		return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
-@@ -2055,17 +2046,17 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
+@@ -2060,17 +2051,17 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
  				     MCU_WM_UNI_CMD(RA), true);
  }
  
@@ -1466,7 +1466,7 @@
  					      &msta->wcid,
  					      MT7996_STA_UPDATE_MAX_SIZE);
  	if (IS_ERR(skb))
-@@ -2097,12 +2088,13 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif
+@@ -2102,12 +2093,13 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif
  }
  
  static int
@@ -1484,7 +1484,7 @@
  	enum nl80211_band band = chandef->chan->band;
  	struct sta_phy_uni phy = {};
  	int ret, nrates = 0;
-@@ -2144,7 +2136,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
+@@ -2149,7 +2141,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
  
  	/* fixed single rate */
  	if (nrates == 1) {
@@ -1493,7 +1493,7 @@
  						 RATE_PARAM_FIXED_MCS);
  		if (ret)
  			return ret;
-@@ -2166,7 +2158,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
+@@ -2171,7 +2163,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
  		else
  			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
  
@@ -1502,7 +1502,7 @@
  						 RATE_PARAM_FIXED_GI);
  		if (ret)
  			return ret;
-@@ -2174,7 +2166,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
+@@ -2179,7 +2171,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
  
  	/* fixed HE_LTF */
  	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
@@ -1511,7 +1511,7 @@
  						 RATE_PARAM_FIXED_HE_LTF);
  		if (ret)
  			return ret;
-@@ -2185,13 +2177,14 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
+@@ -2190,13 +2182,14 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
  
  static void
  mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
@@ -1530,7 +1530,7 @@
  	enum nl80211_band band = chandef->chan->band;
  	struct sta_rec_ra_uni *ra;
  	struct tlv *tlv;
-@@ -2203,7 +2196,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+@@ -2208,7 +2201,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  
  	ra->valid = true;
  	ra->auto_rate = true;
@@ -1539,7 +1539,7 @@
  	ra->channel = chandef->chan->hw_value;
  	ra->bw = (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_320) ?
  		 CMD_CBW_320MHZ : sta->deflink.bandwidth;
-@@ -2242,7 +2235,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+@@ -2247,7 +2240,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  			cap |= STA_CAP_TX_STBC;
  		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
  			cap |= STA_CAP_RX_STBC;
@@ -1548,7 +1548,7 @@
  		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
  			cap |= STA_CAP_LDPC;
  
-@@ -2268,7 +2261,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+@@ -2273,7 +2266,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  			cap |= STA_CAP_VHT_TX_STBC;
  		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
  			cap |= STA_CAP_VHT_RX_STBC;
@@ -1557,7 +1557,7 @@
  		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
  			cap |= STA_CAP_VHT_LDPC;
  
-@@ -2289,15 +2282,16 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+@@ -2294,15 +2287,16 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  	memset(ra->rx_rcpi, INIT_RCPI, sizeof(ra->rx_rcpi));
  }
  
@@ -1577,7 +1577,7 @@
  					      &msta->wcid,
  					      MT7996_STA_UPDATE_MAX_SIZE);
  	if (IS_ERR(skb))
-@@ -2308,26 +2302,27 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2313,26 +2307,27 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	 * update sta_rec_he here.
  	 */
  	if (changed)
@@ -1610,7 +1610,7 @@
  	int ret;
  
  	/* Assignment of STA BSS group index aligns FW.
-@@ -2344,20 +2339,22 @@ mt7996_mcu_sta_init_vow(struct mt7996_phy *phy, struct mt7996_sta *msta)
+@@ -2349,20 +2344,22 @@ mt7996_mcu_sta_init_vow(struct mt7996_phy *phy, struct mt7996_sta *msta)
  	vow->drr_quantum[IEEE80211_AC_BE] = VOW_DRR_QUANTUM_IDX2;
  	vow->drr_quantum[IEEE80211_AC_BK] = VOW_DRR_QUANTUM_IDX2;
  
@@ -1638,7 +1638,7 @@
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct ieee80211_link_sta *link_sta;
  	struct mt7996_sta *msta;
-@@ -2368,7 +2365,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2373,7 +2370,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mvif->sta;
  	link_sta = sta ? &sta->deflink : NULL;
  
@@ -1647,7 +1647,7 @@
  					      &msta->wcid,
  					      MT7996_STA_UPDATE_MAX_SIZE);
  	if (IS_ERR(skb))
-@@ -2392,7 +2389,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2397,7 +2394,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  		/* starec hdrt mode */
  		mt7996_mcu_sta_hdrt_tlv(dev, skb);
  		/* starec bfer */
@@ -1656,7 +1656,7 @@
  		/* starec ht */
  		mt7996_mcu_sta_ht_tlv(skb, sta);
  		/* starec vht */
-@@ -2402,18 +2399,18 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2407,18 +2404,18 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  		/* starec amsdu */
  		mt7996_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
  		/* starec he */
@@ -1679,7 +1679,7 @@
  	if (ret) {
  		dev_kfree_skb(skb);
  		return ret;
-@@ -2468,16 +2465,15 @@ mt7996_mcu_sta_key_tlv(struct mt76_wcid *wcid,
+@@ -2473,16 +2470,15 @@ mt7996_mcu_sta_key_tlv(struct mt76_wcid *wcid,
  	return 0;
  }
  
@@ -1699,7 +1699,7 @@
  	if (IS_ERR(skb))
  		return PTR_ERR(skb);
  
-@@ -2488,17 +2484,18 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
+@@ -2493,17 +2489,18 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
  	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
  }
  
@@ -1722,7 +1722,7 @@
  	if (IS_ERR(skb))
  		return PTR_ERR(skb);
  
-@@ -2522,10 +2519,11 @@ static int mt7996_mcu_get_pn(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2527,10 +2524,11 @@ static int mt7996_mcu_get_pn(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	return 0;
  }
  
@@ -1736,7 +1736,7 @@
  	struct mt7996_mcu_bcn_prot_tlv *bcn_prot;
  	struct sk_buff *skb;
  	struct tlv *tlv;
-@@ -2534,7 +2532,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
+@@ -2539,7 +2537,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
  		  sizeof(struct mt7996_mcu_bcn_prot_tlv);
  	int ret;
  
@@ -1745,7 +1745,7 @@
  	if (IS_ERR(skb))
  		return PTR_ERR(skb);
  
-@@ -2542,7 +2540,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
+@@ -2547,7 +2545,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
  
  	bcn_prot = (struct mt7996_mcu_bcn_prot_tlv *)tlv;
  
@@ -1754,7 +1754,7 @@
  	if (ret) {
  		dev_kfree_skb(skb);
  		return ret;
-@@ -2575,10 +2573,10 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
+@@ -2580,10 +2578,10 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
  				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
  }
  int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
@@ -1767,7 +1767,7 @@
  	struct {
  		struct req_hdr {
  			u8 omac_idx;
-@@ -2594,8 +2592,8 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
+@@ -2599,8 +2597,8 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
  		} __packed tlv;
  	} data = {
  		.hdr = {
@@ -1778,7 +1778,7 @@
  		},
  		.tlv = {
  			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
-@@ -2604,16 +2602,16 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
+@@ -2609,16 +2607,16 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
  		},
  	};
  
@@ -1799,7 +1799,7 @@
  			 struct sk_buff *skb,
  			 struct ieee80211_mutable_offsets *offs)
  {
-@@ -2624,7 +2622,7 @@ mt7996_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
+@@ -2629,7 +2627,7 @@ mt7996_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
  	if (!offs->cntdwn_counter_offs[0])
  		return;
  
@@ -1808,7 +1808,7 @@
  
  	tlv = mt7996_mcu_add_uni_tlv(rskb, tag, sizeof(*info));
  
-@@ -2634,14 +2632,15 @@ mt7996_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
+@@ -2639,14 +2637,15 @@ mt7996_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
  
  static void
  mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
@@ -1826,7 +1826,7 @@
  		return;
  
  	tlv = mt7996_mcu_add_uni_tlv(rskb, UNI_BSS_INFO_BCN_MBSSID, sizeof(*mbss));
-@@ -2686,7 +2685,7 @@ mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
+@@ -2691,7 +2690,7 @@ mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
  }
  
  static void
@@ -1835,7 +1835,7 @@
  		       struct sk_buff *rskb, struct sk_buff *skb,
  		       struct bss_bcn_content_tlv *bcn,
  		       struct ieee80211_mutable_offsets *offs)
-@@ -2700,9 +2699,9 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2705,9 +2704,9 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	if (offs->cntdwn_counter_offs[0]) {
  		u16 offset = offs->cntdwn_counter_offs[0];
  
@@ -1847,7 +1847,7 @@
  			bcn->bcc_ie_pos = cpu_to_le16(offset - 3);
  	}
  
-@@ -2714,11 +2713,11 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -2719,11 +2718,11 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  }
  
  int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
@@ -1861,7 +1861,7 @@
  	struct ieee80211_mutable_offsets offs;
  	struct ieee80211_tx_info *info;
  	struct sk_buff *skb, *rskb;
-@@ -2726,15 +2725,15 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+@@ -2731,15 +2730,15 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  	struct bss_bcn_content_tlv *bcn;
  	int len;
  
@@ -1880,7 +1880,7 @@
  	if (!skb) {
  		dev_kfree_skb(rskb);
  		return -EINVAL;
-@@ -2757,9 +2756,9 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+@@ -2762,9 +2761,9 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  	if (!en)
  		goto out;
  
@@ -1893,7 +1893,7 @@
  out:
  	dev_kfree_skb(skb);
  	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
-@@ -2767,14 +2766,15 @@ out:
+@@ -2772,14 +2771,15 @@ out:
  }
  
  int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
@@ -1912,7 +1912,7 @@
  	enum nl80211_band band = chandef->chan->band;
  	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
  	struct bss_inband_discovery_tlv *discov;
-@@ -2784,20 +2784,20 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+@@ -2789,20 +2789,20 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
  	u8 *buf, interval;
  	int len;
  
@@ -1938,7 +1938,7 @@
  		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
  	}
  
-@@ -3462,7 +3462,7 @@ int mt7996_mcu_set_hdr_trans(struct mt7996_dev *dev, bool hdr_trans)
+@@ -3467,7 +3467,7 @@ int mt7996_mcu_set_hdr_trans(struct mt7996_dev *dev, bool hdr_trans)
  				     MCU_WM_UNI_CMD(RX_HDR_TRANS), true);
  }
  
@@ -1947,7 +1947,7 @@
  {
  #define MCU_EDCA_AC_PARAM	0
  #define WMM_AIFS_SET		BIT(0)
-@@ -3471,12 +3471,11 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
+@@ -3476,12 +3476,11 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
  #define WMM_TXOP_SET		BIT(3)
  #define WMM_PARAM_SET		(WMM_AIFS_SET | WMM_CW_MIN_SET | \
  				 WMM_CW_MAX_SET | WMM_TXOP_SET)
@@ -1961,7 +1961,7 @@
  	};
  	struct sk_buff *skb;
  	int len = sizeof(hdr) + IEEE80211_NUM_ACS * sizeof(struct edca);
-@@ -3489,7 +3488,7 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
+@@ -3494,7 +3493,7 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
  	skb_put_data(skb, &hdr, sizeof(hdr));
  
  	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
@@ -1970,7 +1970,7 @@
  		struct edca *e;
  		struct tlv *tlv;
  
-@@ -4502,12 +4501,12 @@ mt7996_mcu_set_obss_spr_pd(struct mt7996_phy *phy,
+@@ -4525,12 +4524,12 @@ mt7996_mcu_set_obss_spr_pd(struct mt7996_phy *phy,
  }
  
  static int
@@ -1986,7 +1986,7 @@
  	struct {
  		u8 band_idx;
  		u8 __rsv[3];
-@@ -4579,7 +4578,8 @@ mt7996_mcu_set_obss_spr_bitmap(struct mt7996_phy *phy,
+@@ -4602,7 +4601,8 @@ mt7996_mcu_set_obss_spr_bitmap(struct mt7996_phy *phy,
  				 sizeof(req), true);
  }
  
@@ -1996,7 +1996,7 @@
  			    struct ieee80211_he_obss_pd *he_obss_pd)
  {
  	int ret;
-@@ -4613,7 +4613,7 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+@@ -4636,7 +4636,7 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
  		return ret;
  
  	/* Set SR prohibit */
@@ -2005,7 +2005,7 @@
  	if (ret)
  		return ret;
  
-@@ -4621,16 +4621,16 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+@@ -4644,16 +4644,16 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
  	return mt7996_mcu_set_obss_spr_bitmap(phy, he_obss_pd);
  }
  
@@ -2025,7 +2025,7 @@
  	if (IS_ERR(skb))
  		return PTR_ERR(skb);
  
-@@ -4649,7 +4649,7 @@ int mt7996_mcu_update_bss_color(struct mt7996_dev *dev, struct ieee80211_vif *vi
+@@ -4672,7 +4672,7 @@ int mt7996_mcu_update_bss_color(struct mt7996_dev *dev, struct ieee80211_vif *vi
  #define TWT_AGRT_PROTECT	BIT(2)
  
  int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
@@ -2034,7 +2034,7 @@
  			       struct mt7996_twt_flow *flow,
  			       int cmd)
  {
-@@ -4680,12 +4680,12 @@ int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
+@@ -4703,12 +4703,12 @@ int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
  		.len = cpu_to_le16(sizeof(req) - 4),
  		.tbl_idx = flow->table_id,
  		.cmd = cmd,
@@ -2050,7 +2050,7 @@
  		.start_tsf = cpu_to_le64(flow->tsf),
  		.mantissa = flow->mantissa,
  		.exponent = flow->exp,
-@@ -4816,15 +4816,15 @@ int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev, bool disable
+@@ -4839,15 +4839,15 @@ int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev, bool disable
  
  int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
  				     struct ieee80211_vif *vif,
@@ -2069,7 +2069,7 @@
  					      &msta->wcid,
  					      MT7996_STA_UPDATE_MAX_SIZE);
  	if (IS_ERR(skb))
-@@ -5452,8 +5452,9 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
+@@ -5475,8 +5475,9 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
  				 &req, sizeof(req), false);
  }
  
@@ -2081,7 +2081,7 @@
  {
  	struct mt7996_vow_sta_ctrl *vow = msta ? &msta->vow : NULL;
  	u32 val = 0;
-@@ -5479,9 +5480,9 @@ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy, struct mt7996_sta *msta,
+@@ -5502,9 +5503,9 @@ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy, struct mt7996_sta *msta,
  		.len = cpu_to_le16(sizeof(req) - 4),
  		.wlan_idx = cpu_to_le16(msta ? msta->wcid.idx : 0),
  		.band_idx = phy->mt76->band_idx,
@@ -2093,7 +2093,7 @@
  	};
  
  	switch (id) {
-@@ -5669,7 +5670,7 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -5692,7 +5693,7 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  {
  	u8 mode, val;
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -2102,7 +2102,7 @@
  
  	mode = FIELD_GET(RATE_CFG_MODE, *((u32 *)data));
  	val = FIELD_GET(RATE_CFG_VAL, *((u32 *)data));
-@@ -5700,11 +5701,11 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -5723,11 +5724,11 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  {
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -2117,10 +2117,10 @@
  }
  #endif
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 4d7617ca..bf457817 100644
+index 7d416f30..be966c18 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -325,18 +325,25 @@ struct mt7996_sta {
+@@ -326,18 +326,25 @@ struct mt7996_sta {
  	struct mt7996_vow_sta_ctrl vow;
  };
  
@@ -2149,7 +2149,7 @@
  /* crash-dump */
  struct mt7996_crash_data {
  	guid_t guid;
-@@ -770,6 +777,13 @@ mt7996_chanctx_get(struct ieee80211_chanctx_conf *ctx)
+@@ -774,6 +781,13 @@ mt7996_chanctx_get(struct ieee80211_chanctx_conf *ctx)
  	return (struct mt7996_chanctx *)&ctx->drv_priv;
  }
  
@@ -2163,7 +2163,7 @@
  extern const struct ieee80211_ops mt7996_ops;
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
-@@ -780,7 +794,7 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
+@@ -784,7 +798,7 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
  void mt7996_wfsys_reset(struct mt7996_dev *dev);
  void mt7996_rro_hw_init(struct mt7996_dev *dev);
  irqreturn_t mt7996_irq_handler(int irq, void *dev_instance);
@@ -2172,7 +2172,7 @@
  int mt7996_register_device(struct mt7996_dev *dev);
  void mt7996_unregister_device(struct mt7996_dev *dev);
  const char *mt7996_eeprom_name(struct mt7996_dev *dev);
-@@ -806,37 +820,47 @@ int mt7996_run(struct ieee80211_hw *hw);
+@@ -810,37 +824,47 @@ int mt7996_run(struct ieee80211_hw *hw);
  int mt7996_mcu_init(struct mt7996_dev *dev);
  int mt7996_mcu_init_firmware(struct mt7996_dev *dev);
  int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
@@ -2232,8 +2232,8 @@
 +			       struct mt7996_bss_conf *mconf,
  			       struct ieee80211_sta *sta, void *data, u32 field);
  int mt7996_mcu_set_eeprom(struct mt7996_dev *dev);
- int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf);
-@@ -851,7 +875,7 @@ int mt7996_mcu_set_radar_th(struct mt7996_dev *dev, int index,
+ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len);
+@@ -855,7 +879,7 @@ int mt7996_mcu_set_radar_th(struct mt7996_dev *dev, int index,
  			    const struct mt7996_dfs_pattern *pattern);
  int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable);
  int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val);
@@ -2242,7 +2242,7 @@
  int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch);
  int mt7996_mcu_get_temperature(struct mt7996_phy *phy);
  int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state);
-@@ -891,8 +915,9 @@ void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb);
+@@ -895,8 +919,9 @@ void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb);
  int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable);
  void mt7996_mcu_scs_sta_poll(struct work_struct *work);
  int mt7996_mcu_set_band_confg(struct mt7996_phy *phy, u16 option, bool enable);
@@ -2254,7 +2254,7 @@
  int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy);
  void mt7996_mcu_wmm_pbc_work(struct work_struct *work);
  
-@@ -1001,13 +1026,16 @@ void mt7996_update_channel(struct mt76_phy *mphy);
+@@ -1005,13 +1030,16 @@ void mt7996_update_channel(struct mt76_phy *mphy);
  int mt7996_init_debugfs(struct mt7996_phy *phy);
  void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int len);
  bool mt7996_debugfs_rx_log(struct mt7996_dev *dev, const void *data, int len);
@@ -2274,10 +2274,10 @@
  int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode);
  int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 784a8bea..bf55b430 100644
+index 5a8b6d0a..042da4e4 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -223,6 +223,7 @@ static void
+@@ -229,6 +229,7 @@ static void
  mt7996_tm_init(struct mt7996_phy *phy, bool en)
  {
  	struct mt7996_dev *dev = phy->dev;
@@ -2285,7 +2285,7 @@
  	u8 rf_test_mode = en ? RF_OPER_RF_TEST : RF_OPER_NORMAL;
  
  	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
-@@ -234,8 +235,8 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
+@@ -240,8 +241,8 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
  
  	mt7996_tm_rf_switch_mode(dev, rf_test_mode);
  
@@ -2296,7 +2296,7 @@
  
  	mt7996_tm_set(dev, SET_ID(BAND_IDX), phy->mt76->band_idx);
  
-@@ -1179,13 +1180,13 @@ mt7996_tm_txbf_init(struct mt7996_phy *phy, u16 *val)
+@@ -1185,13 +1186,13 @@ mt7996_tm_txbf_init(struct mt7996_phy *phy, u16 *val)
  	mt7996_tm_set_mac_addr(dev, td->addr[2], SET_ID(BSSID));
  
  	/* bss idx & omac idx should be set to band idx for ibf cal */
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0079-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0079-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch
index dc31e3d..f88fbcf 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0079-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0079-mtk-mt76-mt7996-switch-to-per-link-data-structure-of.patch
@@ -1,13 +1,14 @@
-From 064ae3485688826f45140ef82bb3d84e44dffc1f Mon Sep 17 00:00:00 2001
+From ca4c360d853ec0678da7b08c9b524334b931eeda Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 27 Nov 2023 10:43:34 +0800
-Subject: [PATCH 079/195] mtk: mt76: mt7996: switch to per-link data structure
+Subject: [PATCH 079/223] mtk: mt76: mt7996: switch to per-link data structure
  of sta
 
 Introduce struct mt7996_link_sta, data structure for per-link STA.
 Note that mt7996_sta now represents a peer legacy or MLD device.
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
+Change-Id: I3929a2e3d1bd092581175f60fb900690f22b57d6
 Co-developed-by: Bo Jiao <Bo.Jiao@mediatek.com>
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -21,7 +22,7 @@
  6 files changed, 461 insertions(+), 368 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 5d4d69ea..62658dbc 100644
+index 792ace03..786bdc38 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -726,14 +726,15 @@ static void
@@ -96,7 +97,7 @@
  	phy.ltf = cpu_to_le16(ltf);
  	phy.ldpc = phy.ldpc ? 7 : 0;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 5fbcfc74..fbe6c0bd 100644
+index 8f743125..8b682842 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -54,7 +54,7 @@ static const struct mt7996_dfs_radar_spec jp_radar_specs = {
@@ -161,7 +162,7 @@
  				      &dev->mt76.sta_poll_list);
  		spin_unlock_bh(&dev->mt76.sta_poll_lock);
  	}
-@@ -586,7 +585,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
+@@ -588,7 +587,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
  #endif
  	} else {
  		status->flag |= RX_FLAG_8023;
@@ -170,7 +171,7 @@
  				     *info);
  	}
  
-@@ -945,6 +944,7 @@ static void
+@@ -957,6 +956,7 @@ static void
  mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
  {
  	struct mt7996_sta *msta;
@@ -178,7 +179,7 @@
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  	bool is_8023 = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP;
  	u16 fc, tid;
-@@ -973,7 +973,8 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
+@@ -985,7 +985,8 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
  		return;
  
  	msta = (struct mt7996_sta *)sta->drv_priv;
@@ -188,7 +189,7 @@
  		ieee80211_start_tx_ba_session(sta, tid, 0);
  }
  
-@@ -1051,7 +1052,7 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+@@ -1063,7 +1064,7 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
  		 */
  		info = le32_to_cpu(*cur_info);
  		if (info & MT_TXFREE_INFO_PAIR) {
@@ -197,7 +198,7 @@
  			u16 idx;
  
  			idx = FIELD_GET(MT_TXFREE_INFO_WLAN_ID, info);
-@@ -1060,10 +1061,10 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+@@ -1072,10 +1073,10 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
  			if (!sta)
  				continue;
  
@@ -211,7 +212,7 @@
  					      &mdev->sta_poll_list);
  			spin_unlock_bh(&mdev->sta_poll_lock);
  			continue;
-@@ -1268,7 +1269,7 @@ out:
+@@ -1280,7 +1281,7 @@ out:
  
  static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
  {
@@ -220,7 +221,7 @@
  	struct mt76_wcid *wcid;
  	__le32 *txs_data = data;
  	u16 wcidx;
-@@ -1289,16 +1290,15 @@ static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
+@@ -1301,16 +1302,15 @@ static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
  	if (!wcid)
  		goto out;
  
@@ -240,7 +241,7 @@
  	spin_unlock_bh(&dev->mt76.sta_poll_lock);
  
  out:
-@@ -2242,8 +2242,9 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+@@ -2254,8 +2254,9 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  	struct ieee80211_sta *sta;
  	struct ieee80211_vif *vif;
  	struct ieee80211_bss_conf *conf;
@@ -251,7 +252,7 @@
  	u32 changed;
  	LIST_HEAD(list);
  
-@@ -2251,24 +2252,25 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+@@ -2263,24 +2264,25 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  	list_splice_init(&dev->sta_rc_list, &list);
  
  	while (!list_empty(&list)) {
@@ -286,7 +287,7 @@
  						   RATE_PARAM_MMPS_UPDATE);
  
  		spin_lock_bh(&dev->mt76.sta_poll_lock);
-@@ -2561,7 +2563,7 @@ static int mt7996_mac_check_twt_req(struct ieee80211_twt_setup *twt)
+@@ -2573,7 +2575,7 @@ static int mt7996_mac_check_twt_req(struct ieee80211_twt_setup *twt)
  }
  
  static bool
@@ -295,7 +296,7 @@
  			   struct ieee80211_twt_params *twt_agrt)
  {
  	u16 type = le16_to_cpu(twt_agrt->req_type);
-@@ -2572,10 +2574,10 @@ mt7996_mac_twt_param_equal(struct mt7996_sta *msta,
+@@ -2584,10 +2586,10 @@ mt7996_mac_twt_param_equal(struct mt7996_sta *msta,
  	for (i = 0; i < MT7996_MAX_STA_TWT_AGRT; i++) {
  		struct mt7996_twt_flow *f;
  
@@ -308,7 +309,7 @@
  		if (f->duration == twt_agrt->min_twt_dur &&
  		    f->mantissa == twt_agrt->mantissa &&
  		    f->exp == exp &&
-@@ -2594,6 +2596,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+@@ -2606,6 +2608,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  {
  	enum ieee80211_twt_setup_cmd setup_cmd = TWT_SETUP_CMD_REJECT;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
@@ -316,7 +317,7 @@
  	struct ieee80211_twt_params *twt_agrt = (void *)twt->params;
  	u16 req_type = le16_to_cpu(twt_agrt->req_type);
  	enum ieee80211_twt_setup_cmd sta_setup_cmd;
-@@ -2605,11 +2608,12 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+@@ -2617,11 +2620,12 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  		goto out;
  
  	mutex_lock(&dev->mt76.mutex);
@@ -330,7 +331,7 @@
  		goto unlock;
  
  	if (twt_agrt->min_twt_dur < MT7996_MIN_TWT_DUR) {
-@@ -2618,10 +2622,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+@@ -2630,10 +2634,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  		goto unlock;
  	}
  
@@ -343,7 +344,7 @@
  	twt_agrt->req_type &= ~cpu_to_le16(IEEE80211_TWT_REQTYPE_FLOWID);
  	twt_agrt->req_type |= le16_encode_bits(flowid,
  					       IEEE80211_TWT_REQTYPE_FLOWID);
-@@ -2630,10 +2634,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+@@ -2642,10 +2646,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  	exp = FIELD_GET(IEEE80211_TWT_REQTYPE_WAKE_INT_EXP, req_type);
  	sta_setup_cmd = FIELD_GET(IEEE80211_TWT_REQTYPE_SETUP_CMD, req_type);
  
@@ -356,7 +357,7 @@
  	flow->table_id = table_id;
  	flow->id = flowid;
  	flow->duration = twt_agrt->min_twt_dur;
-@@ -2651,7 +2655,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+@@ -2663,7 +2667,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  
  		flow->sched = true;
  		flow->start_tsf = mt7996_mac_twt_sched_list_add(dev, flow);
@@ -365,7 +366,7 @@
  		div_u64_rem(curr_tsf - flow->start_tsf, interval, &rem);
  		flow_tsf = curr_tsf + interval - rem;
  		twt_agrt->twt = cpu_to_le64(flow_tsf);
-@@ -2660,13 +2664,13 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+@@ -2672,13 +2676,13 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  	}
  	flow->tsf = le64_to_cpu(twt_agrt->twt);
  
@@ -381,7 +382,7 @@
  	dev->twt.n_agrt++;
  
  unlock:
-@@ -2679,26 +2683,25 @@ out:
+@@ -2691,26 +2695,25 @@ out:
  }
  
  void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
@@ -414,7 +415,7 @@
  	dev->twt.table_mask &= ~BIT(flow->table_id);
  	dev->twt.n_agrt--;
  }
-@@ -2711,7 +2714,7 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
+@@ -2723,7 +2726,7 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
  	struct cfg80211_scan_request *req = phy->scan_req;
  	struct ieee80211_vif *vif = phy->scan_vif;
  	struct mt7996_vif *mvif;
@@ -423,7 +424,7 @@
  	struct ieee80211_tx_info *info;
  	struct sk_buff *skb;
  
-@@ -2719,7 +2722,6 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
+@@ -2731,7 +2734,6 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
  		return;
  
  	mvif = (struct mt7996_vif *)vif->drv_priv;
@@ -431,7 +432,7 @@
  
  	skb = ieee80211_probereq_get(hw, vif->addr,
  				     ssid->ssid, ssid->ssid_len, req->ie_len);
-@@ -2752,7 +2754,8 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
+@@ -2764,7 +2766,8 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
  	}
  
  	local_bh_disable();
@@ -442,7 +443,7 @@
  
  	rcu_read_unlock();
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 2e6bb41e..e5a95de1 100644
+index 8d919dd0..98afb057 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -229,6 +229,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
@@ -1004,10 +1005,10 @@
  		path->mtk_wdma.amsdu = 0;
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 21c93c1c..5b392dee 100644
+index b2eed253..ced769b4 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -117,13 +117,13 @@ mt7996_mcu_get_sta_nss(u16 mcs_map)
+@@ -122,13 +122,13 @@ mt7996_mcu_get_sta_nss(u16 mcs_map)
  }
  
  static void
@@ -1023,7 +1024,7 @@
  
  	for (nss = 0; nss < max_nss; nss++) {
  		int mcs;
-@@ -166,11 +166,11 @@ mt7996_mcu_set_sta_he_mcs(struct ieee80211_sta *sta,
+@@ -171,11 +171,11 @@ mt7996_mcu_set_sta_he_mcs(struct ieee80211_sta *sta,
  }
  
  static void
@@ -1039,7 +1040,7 @@
  
  	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
  		switch (mcs_map & 0x3) {
-@@ -192,13 +192,13 @@ mt7996_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
+@@ -197,13 +197,13 @@ mt7996_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
  }
  
  static void
@@ -1056,7 +1057,7 @@
  }
  
  static int
-@@ -531,14 +531,14 @@ static inline void __mt7996_stat_to_netdev(struct mt76_phy *mphy,
+@@ -536,14 +536,14 @@ static inline void __mt7996_stat_to_netdev(struct mt76_phy *mphy,
  					   u32 tx_bytes, u32 rx_bytes,
  					   u32 tx_packets, u32 rx_packets)
  {
@@ -1074,7 +1075,7 @@
  				   drv_priv);
  		wdev = ieee80211_vif_to_wdev(vif);
  
-@@ -1236,10 +1236,10 @@ __mt7996_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
+@@ -1241,10 +1241,10 @@ __mt7996_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
  
  int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
  			    struct ieee80211_bss_conf *conf,
@@ -1087,7 +1088,7 @@
  	struct mt7996_dev *dev = phy->dev;
  	struct sk_buff *skb;
  
-@@ -1255,7 +1255,7 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
+@@ -1260,7 +1260,7 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
  
  	/* bss_basic must be first */
  	mt7996_mcu_bss_basic_tlv(skb, conf, mconf, NULL, phy->mt76,
@@ -1096,7 +1097,7 @@
  	mt7996_mcu_bss_sec_tlv(skb, mconf);
  
  	if (vif->type == NL80211_IFTYPE_MONITOR)
-@@ -1335,9 +1335,10 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
+@@ -1340,9 +1340,10 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  {
  	struct mt7996_sta *msta = (struct mt7996_sta *)params->sta->drv_priv;
  	struct mt7996_bss_conf *mconf = mconf_dereference_protected(msta->vif, 0);
@@ -1108,7 +1109,7 @@
  
  	return mt7996_mcu_sta_ba(dev, &mconf->mt76, params, enable, true);
  }
-@@ -1355,15 +1356,15 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
+@@ -1360,15 +1361,15 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
  static void
  mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
  		      struct mt7996_bss_conf *mconf,
@@ -1127,7 +1128,7 @@
  		return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_V2, sizeof(*he));
-@@ -1380,21 +1381,21 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
+@@ -1385,21 +1386,21 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
  		u8p_replace_bits(&he->he_phy_cap[1], conf->he_ldpc,
  				 IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD);
  
@@ -1154,7 +1155,7 @@
  					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
  					  le16_to_cpu(mcs_map.rx_mcs_80));
  		break;
-@@ -1404,24 +1405,25 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
+@@ -1409,24 +1410,25 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
  }
  
  static void
@@ -1185,7 +1186,7 @@
  	struct ieee80211_vif *vif = container_of((void *)msta->vif,
  						 struct ieee80211_vif, drv_priv);
  	struct ieee80211_eht_mcs_nss_supp *mcs_map;
-@@ -1429,11 +1431,11 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1434,11 +1436,11 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct sta_rec_eht *eht;
  	struct tlv *tlv;
  
@@ -1200,7 +1201,7 @@
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT, sizeof(*eht));
  
-@@ -1444,7 +1446,7 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1449,7 +1451,7 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
  
  	if (vif->type != NL80211_IFTYPE_STATION &&
@@ -1209,7 +1210,7 @@
  	     (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G |
  	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
  	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
-@@ -1460,44 +1462,44 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1465,44 +1467,44 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  }
  
  static void
@@ -1265,7 +1266,7 @@
  #ifdef CONFIG_MTK_VENDOR
  	vht->rts_bw_sig = phy->rts_bw_sig;
  #endif
-@@ -1505,9 +1507,10 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -1510,9 +1512,10 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  
  static void
  mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
@@ -1278,7 +1279,7 @@
  	struct sta_rec_amsdu *amsdu;
  	struct tlv *tlv;
  
-@@ -1516,16 +1519,16 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1521,16 +1524,16 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	    vif->type != NL80211_IFTYPE_AP)
  		return;
  
@@ -1298,7 +1299,7 @@
  	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
  		amsdu->max_mpdu_size =
  			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
-@@ -1544,10 +1547,10 @@ static void
+@@ -1549,10 +1552,10 @@ static void
  mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  			struct ieee80211_bss_conf *conf,
  			struct mt7996_bss_conf *mconf,
@@ -1311,7 +1312,7 @@
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
  
-@@ -1567,11 +1570,11 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1572,11 +1575,11 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	muru->cfg.ofdma_dl_en = !!(phy->muru_onoff & OFDMA_DL);
  	muru->cfg.ofdma_ul_en = !!(phy->muru_onoff & OFDMA_UL);
  
@@ -1326,7 +1327,7 @@
  		return;
  
  	muru->mimo_dl.partial_bw_dl_mimo =
-@@ -1604,7 +1607,7 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1609,7 +1612,7 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  static inline bool
  mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
  			struct mt7996_bss_conf *mconf,
@@ -1335,7 +1336,7 @@
  {
  	int sts = hweight16(phy->mt76->chainmask);
  
-@@ -1615,8 +1618,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
+@@ -1620,8 +1623,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
  	if (!bfee && sts < 2)
  		return false;
  
@@ -1346,7 +1347,7 @@
  		struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
  
  		if (bfee)
-@@ -1627,8 +1630,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
+@@ -1632,8 +1635,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
  			       EHT_PHY(CAP0_SU_BEAMFORMEE, pe->phy_cap_info[0]);
  	}
  
@@ -1357,7 +1358,7 @@
  
  		if (bfee)
  			return conf->he_su_beamformee &&
-@@ -1638,8 +1641,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
+@@ -1643,8 +1646,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
  			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
  	}
  
@@ -1368,7 +1369,7 @@
  
  		if (bfee)
  			return conf->vht_su_beamformee &&
-@@ -1662,10 +1665,10 @@ mt7996_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
+@@ -1667,10 +1670,10 @@ mt7996_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
  }
  
  static void
@@ -1382,7 +1383,7 @@
  	u8 n = 0;
  
  	bf->tx_mode = MT_PHY_TYPE_HT;
-@@ -1687,10 +1690,11 @@ mt7996_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
+@@ -1692,10 +1695,11 @@ mt7996_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
  }
  
  static void
@@ -1397,7 +1398,7 @@
  	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
  	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
  	u8 nss_mcs = mt7996_mcu_get_sta_nss(mcs_map);
-@@ -1711,23 +1715,24 @@ mt7996_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
+@@ -1716,23 +1720,24 @@ mt7996_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
  		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  		bf->ibf_ncol = bf->ncol;
  
@@ -1427,7 +1428,7 @@
  	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
  	const struct ieee80211_sta_he_cap *vc =
  		mt76_connac_get_he_phy_cap(phy->mt76, vif);
-@@ -1752,7 +1757,7 @@ mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+@@ -1757,7 +1762,7 @@ mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  	bf->ibf_ncol = bf->ncol;
  
@@ -1436,7 +1437,7 @@
  		return;
  
  	/* go over for 160MHz and 80p80 */
-@@ -1784,10 +1789,11 @@ mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+@@ -1789,10 +1794,11 @@ mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  }
  
  static void
@@ -1451,7 +1452,7 @@
  	struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
  	struct ieee80211_eht_mcs_nss_supp *eht_nss = &pc->eht_mcs_nss_supp;
  	const struct ieee80211_sta_eht_cap *vc =
-@@ -1810,10 +1816,10 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+@@ -1815,10 +1821,10 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  	bf->ibf_ncol = bf->ncol;
  
@@ -1464,7 +1465,7 @@
  	case IEEE80211_STA_RX_BW_160:
  		snd_dim = EHT_PHY(CAP2_SOUNDING_DIM_160MHZ_MASK, ve->phy_cap_info[2]);
  		sts = EHT_PHY(CAP1_BEAMFORMEE_SS_160MHZ_MASK, pe->phy_cap_info[1]);
-@@ -1842,7 +1848,7 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+@@ -1847,7 +1853,7 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  static void
  mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  			struct ieee80211_bss_conf *conf, struct mt7996_bss_conf *mconf,
@@ -1473,7 +1474,7 @@
  {
  	struct mt7996_phy *phy = mconf->phy;
  	int tx_ant = hweight16(phy->mt76->chainmask) - 1;
-@@ -1856,10 +1862,10 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1861,10 +1867,10 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	};
  	bool ebf;
  
@@ -1486,7 +1487,7 @@
  	if (!ebf && !dev->ibf)
  		return;
  
-@@ -1870,23 +1876,23 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1875,23 +1881,23 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	 * vht: support eBF and iBF
  	 * ht: iBF only, since mac80211 lacks of eBF support
  	 */
@@ -1521,7 +1522,7 @@
  		bf->ibf_timeout = 0x48;
  	else
  		bf->ibf_timeout = 0x18;
-@@ -1896,7 +1902,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1901,7 +1907,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	else
  		bf->mem_20m = matrix[bf->nrow][bf->ncol];
  
@@ -1530,7 +1531,7 @@
  	case IEEE80211_STA_RX_BW_160:
  	case IEEE80211_STA_RX_BW_80:
  		bf->mem_total = bf->mem_20m * 2;
-@@ -1913,7 +1919,8 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1918,7 +1924,8 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  static void
  mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  			struct ieee80211_bss_conf *conf,
@@ -1540,7 +1541,7 @@
  {
  	struct mt7996_phy *phy = mconf->phy;
  	int tx_ant = hweight8(phy->mt76->antenna_mask) - 1;
-@@ -1921,22 +1928,22 @@ mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1926,22 +1933,22 @@ mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
  	u8 nrow = 0;
  
@@ -1569,7 +1570,7 @@
  
  		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
  				 pc->cap);
-@@ -1973,25 +1980,24 @@ mt7996_mcu_sta_hdrt_tlv(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -1978,25 +1985,24 @@ mt7996_mcu_sta_hdrt_tlv(struct mt7996_dev *dev, struct sk_buff *skb)
  static void
  mt7996_mcu_sta_hdr_trans_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  			     struct ieee80211_vif *vif,
@@ -1600,7 +1601,7 @@
  	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
  	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
  		hdr_trans->to_ds = true;
-@@ -2048,16 +2054,17 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
+@@ -2053,16 +2059,17 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
  
  int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
  			       struct mt7996_bss_conf *mconf,
@@ -1621,7 +1622,7 @@
  					      MT7996_STA_UPDATE_MAX_SIZE);
  	if (IS_ERR(skb))
  		return PTR_ERR(skb);
-@@ -2076,7 +2083,7 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
+@@ -2081,7 +2088,7 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
  			ra->phy = *phy;
  		break;
  	case RATE_PARAM_MMPS_UPDATE:
@@ -1630,7 +1631,7 @@
  		break;
  	default:
  		break;
-@@ -2091,7 +2098,8 @@ static int
+@@ -2096,7 +2103,8 @@ static int
  mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
  			       struct ieee80211_bss_conf *conf,
  			       struct mt7996_bss_conf *mconf,
@@ -1640,7 +1641,7 @@
  {
  	struct cfg80211_chan_def *chandef = &mconf->phy->mt76->chandef;
  	struct cfg80211_bitrate_mask *mask = &mconf->bitrate_mask;
-@@ -2115,11 +2123,11 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
+@@ -2120,11 +2128,11 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
  		}								\
  	} while (0)
  
@@ -1655,7 +1656,7 @@
  		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
  	} else {
  		nrates = hweight32(mask->control[band].legacy);
-@@ -2136,8 +2144,8 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
+@@ -2141,8 +2149,8 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
  
  	/* fixed single rate */
  	if (nrates == 1) {
@@ -1666,7 +1667,7 @@
  		if (ret)
  			return ret;
  	}
-@@ -2145,29 +2153,28 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
+@@ -2150,29 +2158,28 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
  	/* fixed GI */
  	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
  	    mask->control[band].he_gi != GENMASK(7, 0)) {
@@ -1702,7 +1703,7 @@
  		if (ret)
  			return ret;
  	}
-@@ -2179,7 +2186,7 @@ static void
+@@ -2184,7 +2191,7 @@ static void
  mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  			     struct ieee80211_bss_conf *conf,
  			     struct mt7996_bss_conf *mconf,
@@ -1711,7 +1712,7 @@
  {
  #define INIT_RCPI 180
  	struct mt76_phy *mphy = mconf->phy->mt76;
-@@ -2188,20 +2195,20 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+@@ -2193,20 +2200,20 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  	enum nl80211_band band = chandef->chan->band;
  	struct sta_rec_ra_uni *ra;
  	struct tlv *tlv;
@@ -1738,7 +1739,7 @@
  
  	if (supp_rate) {
  		supp_rate &= mask->control[band].legacy;
-@@ -2221,60 +2228,60 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+@@ -2226,60 +2233,60 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  		}
  	}
  
@@ -1819,7 +1820,7 @@
  					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
  	}
  	ra->sta_cap = cpu_to_le32(cap);
-@@ -2285,14 +2292,14 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+@@ -2290,14 +2297,14 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  			     struct ieee80211_bss_conf *conf,
  			     struct mt7996_bss_conf *mconf,
@@ -1837,7 +1838,7 @@
  					      MT7996_STA_UPDATE_MAX_SIZE);
  	if (IS_ERR(skb))
  		return PTR_ERR(skb);
-@@ -2302,26 +2309,27 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+@@ -2307,26 +2314,27 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  	 * update sta_rec_he here.
  	 */
  	if (changed)
@@ -1870,7 +1871,7 @@
  	u8 omac_idx = mconf->mt76.omac_idx;
  	int ret;
  
-@@ -2339,34 +2347,29 @@ mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf, struct mt7996_sta *msta)
+@@ -2344,34 +2352,29 @@ mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf, struct mt7996_sta *msta)
  	vow->drr_quantum[IEEE80211_AC_BE] = VOW_DRR_QUANTUM_IDX2;
  	vow->drr_quantum[IEEE80211_AC_BK] = VOW_DRR_QUANTUM_IDX2;
  
@@ -1912,7 +1913,7 @@
  					      MT7996_STA_UPDATE_MAX_SIZE);
  	if (IS_ERR(skb))
  		return PTR_ERR(skb);
-@@ -2380,37 +2383,37 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+@@ -2385,37 +2388,37 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  		goto out;
  
  	/* starec hdr trans */
@@ -1963,7 +1964,7 @@
  	if (ret) {
  		dev_kfree_skb(skb);
  		return ret;
-@@ -2486,16 +2489,16 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
+@@ -2491,16 +2494,16 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
  
  static int mt7996_mcu_get_pn(struct mt7996_dev *dev,
  			     struct ieee80211_bss_conf *conf,
@@ -1983,7 +1984,7 @@
  	if (IS_ERR(skb))
  		return PTR_ERR(skb);
  
-@@ -2522,6 +2525,7 @@ static int mt7996_mcu_get_pn(struct mt7996_dev *dev,
+@@ -2527,6 +2530,7 @@ static int mt7996_mcu_get_pn(struct mt7996_dev *dev,
  int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
  			       struct ieee80211_bss_conf *conf,
  			       struct mt7996_bss_conf *mconf,
@@ -1991,7 +1992,7 @@
  			       struct ieee80211_key_conf *key)
  {
  	struct mt7996_mcu_bcn_prot_tlv *bcn_prot;
-@@ -2540,7 +2544,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
+@@ -2545,7 +2549,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
  
  	bcn_prot = (struct mt7996_mcu_bcn_prot_tlv *)tlv;
  
@@ -2000,7 +2001,7 @@
  	if (ret) {
  		dev_kfree_skb(skb);
  		return ret;
-@@ -4817,21 +4821,18 @@ int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev, bool disable
+@@ -4840,21 +4844,18 @@ int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev, bool disable
  int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
  				     struct ieee80211_vif *vif,
  				     struct mt7996_bss_conf *mconf,
@@ -2025,7 +2026,7 @@
  	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
  				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
  }
-@@ -5020,7 +5021,7 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
+@@ -5043,7 +5044,7 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
  	switch (tag) {
  	case UNI_PER_STA_RSSI:
  		for (i = 0; i < sta_num; ++i) {
@@ -2034,7 +2035,7 @@
  			struct mt76_phy *phy;
  			s8 rssi[4];
  			u8 *rcpi;
-@@ -5034,10 +5035,10 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
+@@ -5057,10 +5058,10 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
  				rssi[2] = to_rssi(MT_PRXV_RCPI0, rcpi[2]);
  				rssi[3] = to_rssi(MT_PRXV_RCPI0, rcpi[3]);
  
@@ -2049,7 +2050,7 @@
  			} else {
  				ret = -EINVAL;
  				dev_err(dev->dev, "Failed to update RSSI for "
-@@ -5059,7 +5060,7 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
+@@ -5082,7 +5083,7 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
  {
  	u16 sta_list[PER_STA_INFO_MAX_NUM];
  	LIST_HEAD(sta_poll_list);
@@ -2058,7 +2059,7 @@
  	int i, ret;
  	bool empty = false;
  
-@@ -5079,13 +5080,13 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
+@@ -5102,13 +5103,13 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
  				empty = true;
  				break;
  			}
@@ -2076,7 +2077,7 @@
  		}
  
  		ret = mt7996_mcu_get_per_sta_info(dev, UNI_PER_STA_RSSI,
-@@ -5375,10 +5376,18 @@ int mt7996_mcu_set_scs_stats(struct mt7996_phy *phy)
+@@ -5398,10 +5399,18 @@ int mt7996_mcu_set_scs_stats(struct mt7996_phy *phy)
  void mt7996_sta_rssi_work(void *data, struct ieee80211_sta *sta)
  {
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
@@ -2097,7 +2098,7 @@
  }
  
  void mt7996_mcu_scs_sta_poll(struct work_struct *work)
-@@ -5454,9 +5463,10 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
+@@ -5477,9 +5486,10 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
  
  int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
  				struct mt7996_bss_conf *mconf,
@@ -2110,7 +2111,7 @@
  	u32 val = 0;
  	struct {
  		u8 __rsv1[4];
-@@ -5478,11 +5488,11 @@ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
+@@ -5501,11 +5511,11 @@ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
  	} __packed req = {
  		.tag = cpu_to_le16(UNI_VOW_DRR_CTRL),
  		.len = cpu_to_le16(sizeof(req) - 4),
@@ -2126,10 +2127,10 @@
  
  	switch (id) {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index bf457817..fb16758a 100644
+index be966c18..d86e24e3 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -303,10 +303,10 @@ struct mt7996_vow_sta_ctrl {
+@@ -304,10 +304,10 @@ struct mt7996_vow_sta_ctrl {
  	u8 drr_quantum[IEEE80211_NUM_ACS];
  };
  
@@ -2142,7 +2143,7 @@
  
  	struct list_head rc_list;
  
-@@ -325,6 +325,13 @@ struct mt7996_sta {
+@@ -326,6 +326,13 @@ struct mt7996_sta {
  	struct mt7996_vow_sta_ctrl vow;
  };
  
@@ -2156,7 +2157,7 @@
  struct mt7996_bss_conf {
  	struct mt76_vif mt76; /* must be first */
  
-@@ -784,6 +791,13 @@ mconf_dereference_protected(struct mt7996_vif *mvif, u8 link_id)
+@@ -788,6 +795,13 @@ mconf_dereference_protected(struct mt7996_vif *mvif, u8 link_id)
  					 lockdep_is_held(&mvif->dev->mt76.mutex));
  }
  
@@ -2170,7 +2171,7 @@
  extern const struct ieee80211_ops mt7996_ops;
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
-@@ -828,10 +842,12 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
+@@ -832,10 +846,12 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
  			    struct mt7996_bss_conf *mconf, bool enable);
  int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
  			    struct ieee80211_bss_conf *conf,
@@ -2186,7 +2187,7 @@
  int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  			 struct ieee80211_ampdu_params *params,
  			 bool add);
-@@ -853,7 +869,8 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy,
+@@ -857,7 +873,8 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy,
  int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  			     struct ieee80211_bss_conf *conf,
  			     struct mt7996_bss_conf *mconf,
@@ -2196,7 +2197,7 @@
  int mt7996_set_channel(struct mt7996_phy *phy, struct cfg80211_chan_def *chandef);
  int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag);
  int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct mt7996_bss_conf *mconf);
-@@ -861,7 +878,9 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
+@@ -865,7 +882,9 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
  				   void *data, u16 version);
  int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
  			       struct mt7996_bss_conf *mconf,
@@ -2205,9 +2206,9 @@
 +			       struct mt7996_link_sta *mlink, void *data,
 +			       u32 field);
  int mt7996_mcu_set_eeprom(struct mt7996_dev *dev);
- int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf);
+ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len);
  int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num);
-@@ -917,7 +936,8 @@ void mt7996_mcu_scs_sta_poll(struct work_struct *work);
+@@ -921,7 +940,8 @@ void mt7996_mcu_scs_sta_poll(struct work_struct *work);
  int mt7996_mcu_set_band_confg(struct mt7996_phy *phy, u16 option, bool enable);
  int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
  				struct mt7996_bss_conf *mconf,
@@ -2217,7 +2218,7 @@
  int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy);
  void mt7996_mcu_wmm_pbc_work(struct work_struct *work);
  
-@@ -984,7 +1004,7 @@ void mt7996_mac_reset_counters(struct mt7996_phy *phy);
+@@ -988,7 +1008,7 @@ void mt7996_mac_reset_counters(struct mt7996_phy *phy);
  void mt7996_mac_cca_stats_reset(struct mt7996_phy *phy);
  void mt7996_mac_enable_nf(struct mt7996_dev *dev, u8 band);
  void mt7996_mac_enable_rtscts(struct mt7996_dev *dev,
@@ -2226,7 +2227,7 @@
  void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
  			   struct sk_buff *skb, struct mt76_wcid *wcid,
  			   struct ieee80211_key_conf *key, int pid,
-@@ -1002,8 +1022,7 @@ void mt7996_mac_dump_work(struct work_struct *work);
+@@ -1006,8 +1026,7 @@ void mt7996_mac_dump_work(struct work_struct *work);
  void mt7996_mac_sta_rc_work(struct work_struct *work);
  void mt7996_mac_update_stats(struct mt7996_phy *phy);
  void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
@@ -2236,7 +2237,7 @@
  void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  			      struct ieee80211_sta *sta,
  			      struct ieee80211_twt_setup *twt);
-@@ -1032,11 +1051,12 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
+@@ -1036,11 +1055,12 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
  int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
  			       struct ieee80211_bss_conf *conf,
  			       struct mt7996_bss_conf *mconf,
@@ -2251,10 +2252,10 @@
  int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
  #ifdef CONFIG_MAC80211_DEBUGFS
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index bf55b430..ba17f947 100644
+index 042da4e4..be224373 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -235,8 +235,8 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
+@@ -241,8 +241,8 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
  
  	mt7996_tm_rf_switch_mode(dev, rf_test_mode);
  
@@ -2265,7 +2266,7 @@
  
  	mt7996_tm_set(dev, SET_ID(BAND_IDX), phy->mt76->band_idx);
  
-@@ -1186,7 +1186,7 @@ mt7996_tm_txbf_init(struct mt7996_phy *phy, u16 *val)
+@@ -1192,7 +1192,7 @@ mt7996_tm_txbf_init(struct mt7996_phy *phy, u16 *val)
  	phy->omac_mask |= BIT_ULL(mvif->deflink.mt76.omac_idx);
  
  	mt7996_mcu_add_dev_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, true);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0080-mtk-mt76-extend-wcid-and-sta-flow-for-MLO-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0080-mtk-mt76-extend-wcid-and-sta-flow-for-MLO-support.patch
index 5eccb42..1e46e08 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0080-mtk-mt76-extend-wcid-and-sta-flow-for-MLO-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0080-mtk-mt76-extend-wcid-and-sta-flow-for-MLO-support.patch
@@ -1,12 +1,13 @@
-From ac429429bc7ff29101669265edd8e7f2b61a4330 Mon Sep 17 00:00:00 2001
+From 9e98b6657ff1144c273e85a2b0b04c05c813443b Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 29 Nov 2023 11:04:50 +0800
-Subject: [PATCH 080/195] mtk: mt76: extend wcid and sta flow for MLO support
+Subject: [PATCH 080/223] mtk: mt76: extend wcid and sta flow for MLO support
 
 Add link related info to wcid, and split sta connection flow of common
 parts for MLO supported chipsets.
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
+Change-Id: Ibe6854ba471516ae64b94bed32c5e9ac1f5fc1c3
 Co-developed-by: Bo Jiao <Bo.Jiao@mediatek.com>
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -15,7 +16,7 @@
  1 file changed, 7 insertions(+), 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 65af28d2..f91ba9dc 100644
+index cad85f19..ec73fe00 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -1393,6 +1393,9 @@ mt76_sta_add(struct mt76_phy *phy, struct ieee80211_vif *vif,
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0081-mtk-mt76-mt7996-enable-MLO-capability.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0081-mtk-mt76-mt7996-enable-MLO-capability.patch
index dc5761f..ff5469a 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0081-mtk-mt76-mt7996-enable-MLO-capability.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0081-mtk-mt76-mt7996-enable-MLO-capability.patch
@@ -1,7 +1,7 @@
-From d2c2f9ea59a2481274d0d07e4490361045533dbf Mon Sep 17 00:00:00 2001
+From e58436183460b0f31ba597c8dba7b839101f494f Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 30 Nov 2023 16:31:17 +0800
-Subject: [PATCH 081/195] mtk: mt76: mt7996: enable MLO capability
+Subject: [PATCH 081/223] mtk: mt76: mt7996: enable MLO capability
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
@@ -12,10 +12,10 @@
  2 files changed, 42 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index c4714982..cd93a3c2 100644
+index f9bd4d91..8272ead2 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -390,6 +390,12 @@ static int mt7996_eeprom_parse_band_config(struct mt7996_phy *phy)
+@@ -422,6 +422,12 @@ static int mt7996_eeprom_parse_band_config(struct mt7996_phy *phy)
  		break;
  	}
  
@@ -29,7 +29,7 @@
  }
  
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 86bb0661..2fe869c9 100644
+index f5bff109..cedadefc 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -35,7 +35,7 @@ static const struct ieee80211_iface_combination if_comb[] = {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0082-mtk-mt76-mt7996-support-multi-link-vif-links-and-MLO.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0082-mtk-mt76-mt7996-support-multi-link-vif-links-and-MLO.patch
index 3fa7fd5..7d6ed45 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0082-mtk-mt76-mt7996-support-multi-link-vif-links-and-MLO.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0082-mtk-mt76-mt7996-support-multi-link-vif-links-and-MLO.patch
@@ -1,7 +1,7 @@
-From 2459c5a19c77524c82244b1663613927b1adfc80 Mon Sep 17 00:00:00 2001
+From 59199b2eabeb1d8ce11bf644c4ecd565a385c663 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 23 Nov 2023 18:22:11 +0800
-Subject: [PATCH 082/195] mtk: mt76: mt7996: support multi-link vif links and
+Subject: [PATCH 082/223] mtk: mt76: mt7996: support multi-link vif links and
  MLO bss callbacks
 
 Rework add/remove interface functions to add/remove bss_conf functions,
@@ -18,7 +18,7 @@
  3 files changed, 267 insertions(+), 66 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index e5a95de1..983dcb44 100644
+index 98afb057..dc7ee54c 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -205,6 +205,38 @@ static int get_omac_idx(enum nl80211_iftype type, u64 mask)
@@ -489,10 +489,10 @@
 +	.change_vif_links = mt7996_change_vif_links,
  };
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 5b392dee..b0d4227f 100644
+index ced769b4..081e9ca9 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1047,15 +1047,23 @@ static void
+@@ -1052,15 +1052,23 @@ static void
  mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
  		       struct mt7996_bss_conf *mconf)
  {
@@ -520,7 +520,7 @@
  }
  
  static void
-@@ -1136,13 +1144,11 @@ mt7996_mcu_bss_ifs_timing_tlv(struct sk_buff *skb, struct mt7996_phy *phy)
+@@ -1141,13 +1149,11 @@ mt7996_mcu_bss_ifs_timing_tlv(struct sk_buff *skb, struct mt7996_phy *phy)
  }
  
  static int
@@ -538,7 +538,7 @@
  	struct ieee80211_vif *vif = conf->vif;
  	struct cfg80211_chan_def *chandef = &phy->chandef;
  	struct mt76_connac_bss_basic_tlv *bss;
-@@ -1254,8 +1260,7 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
+@@ -1259,8 +1265,7 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
  		return PTR_ERR(skb);
  
  	/* bss_basic must be first */
@@ -549,10 +549,10 @@
  
  	if (vif->type == NL80211_IFTYPE_MONITOR)
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index fb16758a..526600fe 100644
+index d86e24e3..9b9b1f8f 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -341,6 +341,9 @@ struct mt7996_bss_conf {
+@@ -342,6 +342,9 @@ struct mt7996_bss_conf {
  	struct cfg80211_bitrate_mask bitrate_mask;
  
  	struct mt7996_chanctx *chanctx;
@@ -562,7 +562,7 @@
  };
  
  struct mt7996_vif {
-@@ -349,6 +352,10 @@ struct mt7996_vif {
+@@ -350,6 +353,10 @@ struct mt7996_vif {
  
  	struct mt7996_sta sta;
  	struct mt7996_dev *dev;
@@ -573,7 +573,7 @@
  };
  
  /* crash-dump */
-@@ -550,6 +557,8 @@ struct mt7996_dev {
+@@ -551,6 +558,8 @@ struct mt7996_dev {
  	u16 chainmask;
  	u8 chainshift[__MT_MAX_BAND];
  	u32 hif_idx;
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0083-mtk-mt76-mt7996-support-multi-link-sta-links-and-MLO.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0083-mtk-mt76-mt7996-support-multi-link-sta-links-and-MLO.patch
index 55ad805..19b0be2 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0083-mtk-mt76-mt7996-support-multi-link-sta-links-and-MLO.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0083-mtk-mt76-mt7996-support-multi-link-sta-links-and-MLO.patch
@@ -1,7 +1,7 @@
-From 5ea577e00e49d805815e548e6f37fea57ff69064 Mon Sep 17 00:00:00 2001
+From 62e749b2b89a799e0d137983f4dabc1eeb3ebad8 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 29 Nov 2023 10:12:39 +0800
-Subject: [PATCH 083/195] mtk: mt76: mt7996: support multi-link sta links and
+Subject: [PATCH 083/223] mtk: mt76: mt7996: support multi-link sta links and
  MLO sta callbacks
 
 Rework add_sta functions to add_link_sta functions, and support
@@ -19,7 +19,7 @@
  4 files changed, 400 insertions(+), 71 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 983dcb44..101e7725 100644
+index dc7ee54c..106e8534 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -926,42 +926,234 @@ mt7996_channel_switch_beacon(struct ieee80211_hw *hw,
@@ -395,10 +395,10 @@
 +	.change_sta_links = mt7996_change_sta_links,
  };
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index b0d4227f..e10ba1c0 100644
+index 081e9ca9..96d4d5b0 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2428,6 +2428,123 @@ out:
+@@ -2433,6 +2433,123 @@ out:
  				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
  }
  
@@ -563,10 +563,10 @@
  	__le16 tag;
  	__le16 len;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 526600fe..b49e6257 100644
+index 9b9b1f8f..f6933418 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -330,6 +330,8 @@ struct mt7996_sta {
+@@ -331,6 +331,8 @@ struct mt7996_sta {
  	struct mt7996_link_sta __rcu *link[IEEE80211_MLD_MAX_NUM_LINKS];
  
  	struct mt7996_vif *vif;
@@ -575,7 +575,7 @@
  };
  
  struct mt7996_bss_conf {
-@@ -857,6 +859,9 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+@@ -861,6 +863,9 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  		       struct mt7996_bss_conf *mconf,
  		       struct ieee80211_link_sta *link_sta,
  		       struct mt7996_link_sta *mlink, bool enable, bool newly);
@@ -585,7 +585,7 @@
  int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  			 struct ieee80211_ampdu_params *params,
  			 bool add);
-@@ -880,6 +885,8 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+@@ -884,6 +889,8 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  			     struct mt7996_bss_conf *mconf,
  			     struct ieee80211_link_sta *link_sta,
  			     struct mt7996_link_sta *mlink, bool changed);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0084-mtk-mt76-mt7996-introduce-mt7996_band_phy-for-ch-ban.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0084-mtk-mt76-mt7996-introduce-mt7996_band_phy-for-ch-ban.patch
index 13e9077..96da326 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0084-mtk-mt76-mt7996-introduce-mt7996_band_phy-for-ch-ban.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0084-mtk-mt76-mt7996-introduce-mt7996_band_phy-for-ch-ban.patch
@@ -1,7 +1,7 @@
-From b15d3f32c0e1b842be7e65aea9c5e0dfe68280a1 Mon Sep 17 00:00:00 2001
+From a77bf1528855525590647055a6d5c4b760946efc Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 1 Dec 2023 16:01:53 +0800
-Subject: [PATCH 084/195] mtk: mt76: mt7996: introduce mt7996_band_phy() for ch
+Subject: [PATCH 084/223] mtk: mt76: mt7996: introduce mt7996_band_phy() for ch
  band and phy mapping
 
 For MLO devices, one ieee80211_hw can be mapped to several bands, and
@@ -16,7 +16,7 @@
  2 files changed, 112 insertions(+), 59 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 101e7725..bc8b986d 100644
+index 106e8534..ae1b2875 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -41,9 +41,8 @@ static void mt7996_testmode_disable_all(struct mt7996_dev *dev)
@@ -152,7 +152,7 @@
  	return ret;
  }
 @@ -143,18 +152,29 @@ static int mt7996_start(struct ieee80211_hw *hw)
- static void mt7996_stop(struct ieee80211_hw *hw)
+ static void mt7996_stop(struct ieee80211_hw *hw, bool suspend)
  {
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
 -	struct mt7996_phy *phy = mt7996_hw_phy(hw);
@@ -234,11 +234,11 @@
  	int ret;
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index b49e6257..c7437a72 100644
+index f6933418..38b924b5 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -789,6 +789,28 @@ mt7996_get_background_radar_cap(struct mt7996_dev *dev)
- 	return 1;
+@@ -793,6 +793,28 @@ mt7996_has_background_radar(struct mt7996_dev *dev)
+ 	return true;
  }
  
 +static inline struct mt7996_phy *
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0085-mtk-mt76-mt7996-rework-ieee80211_ops-callbacks-for-l.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0085-mtk-mt76-mt7996-rework-ieee80211_ops-callbacks-for-l.patch
index e0c74d1..f87ae95 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0085-mtk-mt76-mt7996-rework-ieee80211_ops-callbacks-for-l.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0085-mtk-mt76-mt7996-rework-ieee80211_ops-callbacks-for-l.patch
@@ -1,7 +1,7 @@
-From c4b86237826c77c6b53c3974683db6c00cafc101 Mon Sep 17 00:00:00 2001
+From 088cb092b3a6b3387d2d6f7ee5100ac803ff626a Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 1 Dec 2023 17:26:43 +0800
-Subject: [PATCH 085/195] mtk: mt76: mt7996: rework ieee80211_ops callbacks for
+Subject: [PATCH 085/223] mtk: mt76: mt7996: rework ieee80211_ops callbacks for
  link consideration
 
 Extend ieee80211 callback functions to support multi-link operation.
@@ -15,7 +15,7 @@
  1 file changed, 204 insertions(+), 109 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index bc8b986d..44b21821 100644
+index ae1b2875..580cb2a5 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -566,7 +566,6 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0086-mtk-mt76-mt7996-rework-TXD-for-multi-link-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0086-mtk-mt76-mt7996-rework-TXD-for-multi-link-support.patch
index d00e750..9b5eeed 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0086-mtk-mt76-mt7996-rework-TXD-for-multi-link-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0086-mtk-mt76-mt7996-rework-TXD-for-multi-link-support.patch
@@ -1,7 +1,7 @@
-From 7f2ba60d358a1a4519c386d795ee1ed37fed3434 Mon Sep 17 00:00:00 2001
+From ee502aed06bf89606b05b5ac3e2d89b766de7772 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 4 Dec 2023 11:25:54 +0800
-Subject: [PATCH 086/195] mtk: mt76: mt7996: rework TXD for multi-link support
+Subject: [PATCH 086/223] mtk: mt76: mt7996: rework TXD for multi-link support
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
@@ -14,10 +14,10 @@
  2 files changed, 73 insertions(+), 24 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index fbe6c0bd..b0ad48dd 100644
+index 8b682842..26878e29 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -615,9 +615,8 @@ mt7996_mac_write_txwi_8023(struct mt7996_dev *dev, __le32 *txwi,
+@@ -627,9 +627,8 @@ mt7996_mac_write_txwi_8023(struct mt7996_dev *dev, __le32 *txwi,
  	u32 val;
  
  	if (wcid->sta) {
@@ -28,7 +28,7 @@
  		wmm = sta->wme;
  	}
  
-@@ -727,6 +726,10 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
+@@ -739,6 +738,10 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
  		txwi[3] |= cpu_to_le32(val);
  		txwi[3] &= ~cpu_to_le32(MT_TXD3_HW_AMSDU);
  	}
@@ -39,7 +39,7 @@
  }
  
  void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
-@@ -736,10 +739,12 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+@@ -748,10 +751,12 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
  {
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  	struct ieee80211_vif *vif = info->control.vif;
@@ -53,7 +53,7 @@
  	u16 tx_count = 15;
  	u32 val;
  	bool inband_disc = !!(changed & (BSS_CHANGED_UNSOL_BCAST_PROBE_RESP |
-@@ -747,11 +752,16 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+@@ -759,11 +764,16 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
  	bool beacon = !!(changed & (BSS_CHANGED_BEACON |
  				    BSS_CHANGED_BEACON_ENABLED)) && (!inband_disc);
  
@@ -75,7 +75,7 @@
  	}
  
  	if (inband_disc) {
-@@ -798,7 +808,10 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+@@ -810,7 +820,10 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
  		val |= MT_TXD5_TX_STATUS_HOST;
  	txwi[5] = cpu_to_le32(val);
  
@@ -87,7 +87,7 @@
  	if (is_mt7996(&dev->mt76))
  		val |= FIELD_PREP(MT_TXD6_MSDU_CNT, 1);
  	else
-@@ -817,16 +830,18 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+@@ -829,16 +842,18 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
  			     is_multicast_ether_addr(hdr->addr1);
  		u8 idx = MT7996_BASIC_RATES_TBL;
  
@@ -112,7 +112,7 @@
  		txwi[6] |= cpu_to_le32(val);
  		txwi[3] |= cpu_to_le32(MT_TXD3_BA_DISABLE);
  	}
-@@ -842,17 +857,48 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -854,17 +869,48 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
  	struct ieee80211_key_conf *key = info->control.hw_key;
  	struct ieee80211_vif *vif = info->control.vif;
@@ -163,7 +163,7 @@
  
  	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
  	t->skb = tx_info->skb;
-@@ -897,13 +943,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -909,13 +955,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	if (!is_8023 && ieee80211_is_mgmt(hdr->frame_control))
  		txp->fw.flags |= cpu_to_le16(MT_CT_INFO_MGMT_FRAME);
  
@@ -179,10 +179,10 @@
  	txp->fw.rept_wds_wcid = cpu_to_le16(sta ? wcid->idx : 0xfff);
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index c7437a72..ec853d3b 100644
+index 38b924b5..bde3bec1 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -831,6 +831,15 @@ mlink_dereference_protected(struct mt7996_sta *msta, u8 link_id)
+@@ -835,6 +835,15 @@ mlink_dereference_protected(struct mt7996_sta *msta, u8 link_id)
  					 lockdep_is_held(&msta->vif->dev->mt76.mutex));
  }
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0087-mtk-mt76-mt7996-rework-TXS-for-multi-link-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0087-mtk-mt76-mt7996-rework-TXS-for-multi-link-support.patch
index 04b1fc6..8191d6a 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0087-mtk-mt76-mt7996-rework-TXS-for-multi-link-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0087-mtk-mt76-mt7996-rework-TXS-for-multi-link-support.patch
@@ -1,7 +1,7 @@
-From d9e2b7930aac891a9fa9b21f4c62a81ddc79872b Mon Sep 17 00:00:00 2001
+From 40622f831dbacee3a7b35c3786fd81d0abf733bd Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 4 Dec 2023 11:57:38 +0800
-Subject: [PATCH 087/195] mtk: mt76: mt7996: rework TXS for multi-link support
+Subject: [PATCH 087/223] mtk: mt76: mt7996: rework TXS for multi-link support
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
@@ -25,10 +25,10 @@
  3 files changed, 34 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index b0ad48dd..c910f353 100644
+index 26878e29..92628e17 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1195,7 +1195,7 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
+@@ -1207,7 +1207,7 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
  		struct ieee80211_sta *sta;
  		u8 tid;
  
@@ -37,7 +37,7 @@
  		tid = FIELD_GET(MT_TXS0_TID, txs);
  		ieee80211_refresh_tx_agg_session_timer(sta, tid);
  	}
-@@ -1335,7 +1335,7 @@ static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
+@@ -1347,7 +1347,7 @@ static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
  	if (!wcid->sta)
  		goto out;
  
@@ -47,7 +47,7 @@
  	if (list_empty(&mlink->wcid.poll_list))
  		list_add_tail(&mlink->wcid.poll_list, &dev->mt76.sta_poll_list);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 44b21821..33b4be55 100644
+index 580cb2a5..cadfee9f 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -2319,6 +2319,7 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -59,10 +59,10 @@
  	if (mt7996_hw_phy(hw) == phy)
  		mvif->master_link_id = link_id;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index ec853d3b..c26aa3a7 100644
+index bde3bec1..f83308de 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -358,6 +358,8 @@ struct mt7996_vif {
+@@ -359,6 +359,8 @@ struct mt7996_vif {
  	u8 master_link_id;
  	u8 group_mld_id;
  	u8 mld_remap_id;
@@ -71,7 +71,7 @@
  };
  
  /* crash-dump */
-@@ -840,6 +842,35 @@ wcid_to_mlink(struct mt76_wcid *wcid)
+@@ -844,6 +846,35 @@ wcid_to_mlink(struct mt76_wcid *wcid)
  	return container_of(wcid, struct mt7996_link_sta, wcid);
  }
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0088-mtk-mt76-mt7996-rework-RXD-for-multi-link-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0088-mtk-mt76-mt7996-rework-RXD-for-multi-link-support.patch
index ab8a8b4..ab34986 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0088-mtk-mt76-mt7996-rework-RXD-for-multi-link-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0088-mtk-mt76-mt7996-rework-RXD-for-multi-link-support.patch
@@ -1,7 +1,7 @@
-From 9477b7613c8abf0c59f9d2df6feb698324c27405 Mon Sep 17 00:00:00 2001
+From c30c021612cad8eefe3cae1b4cca929ab5a2d7fd Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 4 Dec 2023 14:50:47 +0800
-Subject: [PATCH 088/195] mtk: mt76: mt7996: rework RXD for multi-link support
+Subject: [PATCH 088/223] mtk: mt76: mt7996: rework RXD for multi-link support
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
@@ -13,7 +13,7 @@
  1 file changed, 2 insertions(+), 25 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index c910f353..8d6a153c 100644
+index 92628e17..98cd7e3b 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -51,29 +51,6 @@ static const struct mt7996_dfs_radar_spec jp_radar_specs = {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0089-mtk-mt76-mt7996-rework-mac-functions-for-multi-link-.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0089-mtk-mt76-mt7996-rework-mac-functions-for-multi-link-.patch
index c5f6c4e..29c724a 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0089-mtk-mt76-mt7996-rework-mac-functions-for-multi-link-.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0089-mtk-mt76-mt7996-rework-mac-functions-for-multi-link-.patch
@@ -1,7 +1,7 @@
-From 50e619b7a372a1a8561c70d302e76c94b381fdbc Mon Sep 17 00:00:00 2001
+From 83a66d966beb9a326c0a75641d21e562306cc8ab Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 4 Dec 2023 18:31:02 +0800
-Subject: [PATCH 089/195] mtk: mt76: mt7996: rework mac functions for
+Subject: [PATCH 089/223] mtk: mt76: mt7996: rework mac functions for
  multi-link support
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
@@ -14,7 +14,7 @@
  1 file changed, 65 insertions(+), 26 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 8d6a153c..6d0506fc 100644
+index 98cd7e3b..c4cd5bc2 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -85,10 +85,11 @@ static int mt7996_reverse_frag0_hdr_trans(struct sk_buff *skb, u16 hdr_gap)
@@ -57,7 +57,7 @@
  		break;
  	case IEEE80211_FCTL_FROMDS:
  		ether_addr_copy(hdr.addr3, eth_hdr->h_source);
-@@ -958,15 +962,21 @@ u32 mt7996_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+@@ -970,15 +974,21 @@ u32 mt7996_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
  }
  
  static void
@@ -81,7 +81,7 @@
  		return;
  
  	tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
-@@ -990,17 +1000,17 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
+@@ -1002,17 +1012,17 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
  		return;
  
  	msta = (struct mt7996_sta *)sta->drv_priv;
@@ -102,7 +102,7 @@
  	__le32 *txwi;
  	u16 wcid_idx;
  
-@@ -1010,11 +1020,10 @@ mt7996_txwi_free(struct mt7996_dev *dev, struct mt76_txwi_cache *t,
+@@ -1022,11 +1032,10 @@ mt7996_txwi_free(struct mt7996_dev *dev, struct mt76_txwi_cache *t,
  
  	txwi = (__le32 *)mt76_get_txwi_ptr(mdev, t);
  	if (sta) {
@@ -115,7 +115,7 @@
  	} else {
  		wcid_idx = le32_get_bits(txwi[9], MT_TXD9_WLAN_IDX);
  	}
-@@ -1069,7 +1078,9 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+@@ -1081,7 +1090,9 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
  		 */
  		info = le32_to_cpu(*cur_info);
  		if (info & MT_TXFREE_INFO_PAIR) {
@@ -126,7 +126,7 @@
  			u16 idx;
  
  			idx = FIELD_GET(MT_TXFREE_INFO_WLAN_ID, info);
-@@ -1078,11 +1089,17 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+@@ -1090,11 +1101,17 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
  			if (!sta)
  				continue;
  
@@ -148,7 +148,7 @@
  			spin_unlock_bh(&mdev->sta_poll_lock);
  			continue;
  		} else if (info & MT_TXFREE_INFO_HEADER) {
-@@ -1118,7 +1135,8 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+@@ -1130,7 +1147,8 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
  			if (!txwi)
  				continue;
  
@@ -158,7 +158,7 @@
  		}
  	}
  
-@@ -1533,19 +1551,29 @@ static void
+@@ -1545,19 +1563,29 @@ static void
  mt7996_update_vif_beacon(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
  	struct ieee80211_hw *hw = priv;
@@ -191,7 +191,7 @@
  }
  
  static void
-@@ -1581,7 +1609,7 @@ void mt7996_tx_token_put(struct mt7996_dev *dev)
+@@ -1593,7 +1621,7 @@ void mt7996_tx_token_put(struct mt7996_dev *dev)
  
  	spin_lock_bh(&dev->mt76.token_lock);
  	idr_for_each_entry(&dev->mt76.token, txwi, id) {
@@ -200,7 +200,7 @@
  		dev->mt76.token_count--;
  	}
  	spin_unlock_bh(&dev->mt76.token_lock);
-@@ -2265,21 +2293,31 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+@@ -2277,21 +2305,31 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  	u32 changed;
  	LIST_HEAD(list);
  
@@ -236,7 +236,7 @@
  
  		if (changed & (IEEE80211_RC_SUPP_RATES_CHANGED |
  			       IEEE80211_RC_NSS_CHANGED |
-@@ -2294,6 +2332,7 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+@@ -2306,6 +2344,7 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  	}
  
  	spin_unlock_bh(&dev->mt76.sta_poll_lock);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0090-mtk-mt76-rework-mcu-functions-for-multi-link-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0090-mtk-mt76-rework-mcu-functions-for-multi-link-support.patch
index c81859c..646fbf5 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0090-mtk-mt76-rework-mcu-functions-for-multi-link-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0090-mtk-mt76-rework-mcu-functions-for-multi-link-support.patch
@@ -1,11 +1,12 @@
-From 4fb64585d5ee1edd161cd4dec1f6b2395507b0aa Mon Sep 17 00:00:00 2001
+From d3bc0fc0ebebd8cff5549930cb7b5c336fb2b5f4 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 7 Dec 2023 15:39:03 +0800
-Subject: [PATCH 090/195] mtk: mt76: rework mcu functions for multi-link
+Subject: [PATCH 090/223] mtk: mt76: rework mcu functions for multi-link
  support
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
+Change-Id: I05afbe5a71c12f8d0a5d2132e0ff002361371e4a
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mt76_connac_mcu.c | 10 +++----
@@ -14,7 +15,7 @@
  3 files changed, 56 insertions(+), 26 deletions(-)
 
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 45510fa5..30770bd2 100644
+index c7145074..0c89222b 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -370,10 +370,11 @@ void mt76_connac_mcu_bss_omac_tlv(struct sk_buff *skb,
@@ -53,10 +54,10 @@
  					      info->newly);
  	if (info->sta && info->enable)
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 57f6f857..f019184f 100644
+index 11a1224a..ff8a314c 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1923,7 +1923,7 @@ mt76_connac_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
+@@ -1928,7 +1928,7 @@ mt76_connac_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
  int mt76_connac_mcu_set_channel_domain(struct mt76_phy *phy);
  int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif);
  void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
@@ -66,10 +67,10 @@
  				   int state, bool newly);
  void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index e10ba1c0..477003b1 100644
+index 96d4d5b0..7b77cab2 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1169,10 +1169,12 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
+@@ -1174,10 +1174,12 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
  				sta = ieee80211_find_sta(vif, conf->bssid);
  			/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
  			if (sta) {
@@ -85,7 +86,7 @@
  			}
  			rcu_read_unlock();
  		}
-@@ -1306,9 +1308,8 @@ int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct mt7996_bss_conf *mconf)
+@@ -1311,9 +1313,8 @@ int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct mt7996_bss_conf *mconf)
  static int
  mt7996_mcu_sta_ba(struct mt7996_dev *dev, struct mt76_vif *mvif,
  		  struct ieee80211_ampdu_params *params,
@@ -96,7 +97,7 @@
  	struct sta_rec_ba_uni *ba;
  	struct sk_buff *skb;
  	struct tlv *tlv;
-@@ -1338,24 +1339,53 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
+@@ -1343,24 +1344,53 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  			 struct ieee80211_ampdu_params *params,
  			 bool enable)
  {
@@ -159,7 +160,7 @@
  }
  
  static void
-@@ -2381,7 +2411,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+@@ -2386,7 +2416,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  
  	/* starec basic */
  	conn_state = enable ? CONN_STATE_PORT_SECURE : CONN_STATE_DISCONNECT;
@@ -168,7 +169,7 @@
  				      conn_state, newly);
  
  	if (!enable)
-@@ -2843,7 +2873,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+@@ -2848,7 +2878,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  			  struct mt7996_bss_conf *mconf, int en)
  {
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
@@ -177,7 +178,7 @@
  	struct ieee80211_mutable_offsets offs;
  	struct ieee80211_tx_info *info;
  	struct sk_buff *skb, *rskb;
-@@ -2859,7 +2889,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+@@ -2864,7 +2894,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  	if (IS_ERR(rskb))
  		return PTR_ERR(rskb);
  
@@ -186,7 +187,7 @@
  	if (!skb) {
  		dev_kfree_skb(rskb);
  		return -EINVAL;
-@@ -2897,9 +2927,9 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+@@ -2902,9 +2932,9 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
  {
  #define OFFLOAD_TX_MODE_SU	BIT(0)
  #define OFFLOAD_TX_MODE_MU	BIT(1)
@@ -198,7 +199,7 @@
  	struct cfg80211_chan_def *chandef = &mconf->phy->mt76->chandef;
  	enum nl80211_band band = chandef->chan->band;
  	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
-@@ -5158,7 +5188,7 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
+@@ -5181,7 +5211,7 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
  				rssi[3] = to_rssi(MT_PRXV_RCPI0, rcpi[3]);
  
  				mlink = container_of(wcid, struct mt7996_link_sta, wcid);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0091-mtk-mt76-rework-connac-helpers.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0091-mtk-mt76-rework-connac-helpers.patch
index fef07f1..b1e017c 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0091-mtk-mt76-rework-connac-helpers.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0091-mtk-mt76-rework-connac-helpers.patch
@@ -1,7 +1,7 @@
-From 6a069411fc774df4bef2be41a76c501909ce7a88 Mon Sep 17 00:00:00 2001
+From 2e58003c154277e36f759a53975c61cbecb9af02 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 11 Dec 2023 18:45:00 +0800
-Subject: [PATCH 091/195] mtk: mt76: rework connac helpers
+Subject: [PATCH 091/223] mtk: mt76: rework connac helpers
 
 Rework connac helpers related to rate and phymode.
 This is a preliminary patch to add MLO support for mt7996 chipsets.
@@ -33,7 +33,7 @@
  bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
  			       __le32 *txs_data);
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index a3db6525..a598f859 100644
+index a72551ba..e58570c2 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
 @@ -291,12 +291,11 @@ EXPORT_SYMBOL_GPL(mt76_connac_init_tx_queues);
@@ -51,8 +51,8 @@
 +	struct cfg80211_chan_def *chandef = &mphy->chandef;
  	u8 nss = 0, mode = 0, band = chandef->chan->band;
  	int rateidx = 0, mcast_rate;
- 
-@@ -304,14 +303,14 @@ u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy,
+ 	int offset = 0;
+@@ -305,14 +304,14 @@ u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy,
  		goto legacy;
  
  	if (is_mt7921(mphy->dev)) {
@@ -69,7 +69,7 @@
  
  		__bitrate_mask_check(he_mcs, HE_SU);
  		__bitrate_mask_check(vht_mcs, VHT);
-@@ -323,11 +322,11 @@ u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy,
+@@ -324,11 +323,11 @@ u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy,
  		}
  	}
  
@@ -82,8 +82,8 @@
 +		rateidx = ffs(conf->basic_rates) - 1;
  
  legacy:
- 	rateidx = mt76_calculate_default_rate(mphy, vif, rateidx);
-@@ -569,7 +568,7 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
+ 	if (band != NL80211_BAND_2GHZ)
+@@ -581,7 +580,7 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
  		struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  		bool multicast = ieee80211_is_data(hdr->frame_control) &&
  				 is_multicast_ether_addr(hdr->addr1);
@@ -93,10 +93,10 @@
  		u32 val = MT_TXD6_FIXED_BW;
  
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 30770bd2..426baf0e 100644
+index 0c89222b..e4e6c0d3 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
-@@ -1365,7 +1365,7 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1368,7 +1368,7 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
  }
  EXPORT_SYMBOL_GPL(mt76_connac_get_phy_mode);
  
@@ -105,7 +105,7 @@
  				enum nl80211_band band)
  {
  	const struct ieee80211_sta_eht_cap *eht_cap;
-@@ -1376,9 +1376,9 @@ u8 mt76_connac_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1379,9 +1379,9 @@ u8 mt76_connac_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
  		mode |= PHY_MODE_AX_6G;
  
  	sband = phy->hw->wiphy->bands[band];
@@ -118,10 +118,10 @@
  
  	switch (band) {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f019184f..19c65db4 100644
+index ff8a314c..1dcd1696 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -2036,7 +2036,7 @@ mt76_connac_get_eht_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif);
+@@ -2041,7 +2041,7 @@ mt76_connac_get_eht_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif);
  u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
  			    enum nl80211_band band,
  			    struct ieee80211_link_sta *sta);
@@ -131,10 +131,10 @@
  
  int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
 diff --git a/mt7925/main.c b/mt7925/main.c
-index 38a30153..94c2db63 100644
+index 791c8b00..147b71e7 100644
 --- a/mt7925/main.c
 +++ b/mt7925/main.c
-@@ -793,7 +793,7 @@ mt7925_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -806,7 +806,7 @@ mt7925_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	u16 rate;
  	u8 i, idx, ht;
  
@@ -144,7 +144,7 @@
  
  	if (beacon && ht) {
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 33b4be55..7f7eeeb6 100644
+index cadfee9f..68234032 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -802,7 +802,7 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_bss_conf *conf,
@@ -157,10 +157,10 @@
  	if (beacon) {
  		struct mt7996_phy *phy = mphy->priv;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 477003b1..0c22410d 100644
+index 7b77cab2..edaf8814 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1219,7 +1219,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
+@@ -1224,7 +1224,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
  	bss->dtim_period = conf->dtim_period;
  	bss->phymode = mt76_connac_get_phy_mode(phy, vif,
  						chandef->chan->band, NULL);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0092-mtk-mt76-mt7996-handle-mapping-for-hw-and-phy.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0092-mtk-mt76-mt7996-handle-mapping-for-hw-and-phy.patch
index f7e941e..2214557 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0092-mtk-mt76-mt7996-handle-mapping-for-hw-and-phy.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0092-mtk-mt76-mt7996-handle-mapping-for-hw-and-phy.patch
@@ -1,7 +1,7 @@
-From 25793fd66b88e1d561ee9d55e41508e95f919332 Mon Sep 17 00:00:00 2001
+From eb1ff9f088a5f55389f499e53b63b5f183025a61 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 5 Dec 2023 13:56:51 +0800
-Subject: [PATCH 092/195] mtk: mt76: mt7996: handle mapping for hw and phy
+Subject: [PATCH 092/223] mtk: mt76: mt7996: handle mapping for hw and phy
 
 We've used mt7996_band_phy() to do mapping from ieee80211_hw to mt7996_phy,
 and this patch is a temporal workaround for opposite direction.
@@ -16,7 +16,7 @@
  4 files changed, 60 insertions(+), 13 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index f91ba9dc..ac56a398 100644
+index ec73fe00..03632279 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -823,9 +823,13 @@ EXPORT_SYMBOL_GPL(mt76_has_tx_pending);
@@ -55,10 +55,10 @@
  
  static void
 diff --git a/mt76.h b/mt76.h
-index 3ce102d0..ae214f7e 100644
+index 36e92dfe..9fa411cb 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -841,6 +841,7 @@ struct mt76_vif {
+@@ -843,6 +843,7 @@ struct mt76_vif {
  struct mt76_phy {
  	struct ieee80211_hw *hw;
  	struct mt76_dev *dev;
@@ -83,10 +83,10 @@
  mt76_get_txwi_ptr(struct mt76_dev *dev, struct mt76_txwi_cache *t)
  {
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 6d0506fc..c0c0df2f 100644
+index c4cd5bc2..f9aa0e57 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2382,7 +2382,10 @@ void mt7996_mac_work(struct work_struct *work)
+@@ -2394,7 +2394,10 @@ void mt7996_mac_work(struct work_struct *work)
  
  	mt76_tx_status_check(mdev, false);
  
@@ -98,7 +98,7 @@
  				     MT7996_WATCHDOG_TIME);
  }
  
-@@ -2801,7 +2804,7 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
+@@ -2813,7 +2816,7 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
  	skb_set_queue_mapping(skb, IEEE80211_AC_VO);
  
  	rcu_read_lock();
@@ -108,10 +108,10 @@
  				      NULL)) {
  		rcu_read_unlock();
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 7f7eeeb6..76a74399 100644
+index 68234032..01c736a9 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -173,6 +173,7 @@ static void mt7996_stop(struct ieee80211_hw *hw)
+@@ -173,6 +173,7 @@ static void mt7996_stop(struct ieee80211_hw *hw, bool suspend)
  		mutex_lock(&dev->mt76.mutex);
  		mt7996_mcu_set_radio_en(phy, false);
  		clear_bit(MT76_STATE_RUNNING, &phy->mt76->state);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0093-mtk-mt76-mt7996-handle-mapping-for-hw-and-vif.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0093-mtk-mt76-mt7996-handle-mapping-for-hw-and-vif.patch
index 4e99ccc..fed2615 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0093-mtk-mt76-mt7996-handle-mapping-for-hw-and-vif.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0093-mtk-mt76-mt7996-handle-mapping-for-hw-and-vif.patch
@@ -1,7 +1,7 @@
-From 2a3b941c0132f6fa65c12aadc969eaa94348a3b5 Mon Sep 17 00:00:00 2001
+From d1ceb708475e11cf159886d4c9e6ce78c4d3030d Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 8 Dec 2023 18:08:13 +0800
-Subject: [PATCH 093/195] mtk: mt76: mt7996: handle mapping for hw and vif
+Subject: [PATCH 093/223] mtk: mt76: mt7996: handle mapping for hw and vif
 
 We have several temporal workarounds for ieee80211_hw and mt76_phy
 mappings. For legacy MBSS cases, we also need a method to do the
@@ -37,7 +37,7 @@
  	ieee80211_tx_status_ext(hw, &status);
  	spin_unlock_bh(&dev->rx_lock);
 diff --git a/mac80211.c b/mac80211.c
-index ac56a398..d4efd1dd 100644
+index 03632279..b1af346a 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -1546,7 +1546,7 @@ void mt76_wcid_cleanup(struct mt76_dev *dev, struct mt76_wcid *wcid)
@@ -50,10 +50,10 @@
  	}
  }
 diff --git a/mt76.h b/mt76.h
-index ae214f7e..3e593321 100644
+index 9fa411cb..2dea07a3 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -566,6 +566,9 @@ struct mt76_driver_ops {
+@@ -567,6 +567,9 @@ struct mt76_driver_ops {
  
  	void (*sta_remove)(struct mt76_dev *dev, struct ieee80211_vif *vif,
  			   struct ieee80211_sta *sta);
@@ -63,7 +63,7 @@
  };
  
  struct mt76_channel_state {
-@@ -1601,14 +1604,21 @@ static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
+@@ -1602,14 +1605,21 @@ extern const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS];
  
  /* internal */
  static inline struct ieee80211_hw *
@@ -88,10 +88,10 @@
  }
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index c0c0df2f..5417e741 100644
+index f9aa0e57..a48e4f44 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2845,13 +2845,23 @@ static void mt7996_scan_check_sta(void *data, struct ieee80211_sta *sta)
+@@ -2857,13 +2857,23 @@ static void mt7996_scan_check_sta(void *data, struct ieee80211_sta *sta)
  void mt7996_scan_work(struct work_struct *work)
  {
  	struct mt7996_phy *phy = container_of(work, struct mt7996_phy, scan_work.work);
@@ -116,7 +116,7 @@
  	if (phy->scan_chan_idx >= req->n_channels) {
  		mt7996_scan_complete(phy, false);
  		mutex_unlock(&phy->dev->mt76.mutex);
-@@ -2911,3 +2921,15 @@ void mt7996_scan_work(struct work_struct *work)
+@@ -2923,3 +2933,15 @@ void mt7996_scan_work(struct work_struct *work)
  
  	ieee80211_queue_delayed_work(hw, &phy->scan_work, duration);
  }
@@ -133,7 +133,7 @@
 +	}
 +}
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 76a74399..af72ad1a 100644
+index 01c736a9..cabd5729 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -444,6 +444,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
@@ -145,10 +145,10 @@
  
  	ret = mt7996_add_bss_conf(phy, vif, &vif->bss_conf);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 0c22410d..93589bb5 100644
+index edaf8814..e7ee970b 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2950,11 +2950,11 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+@@ -2955,11 +2955,11 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
  
  	if (changed & BSS_CHANGED_FILS_DISCOVERY) {
  		interval = conf->fils_discovery.max_interval;
@@ -175,10 +175,10 @@
  	struct mt7996_dev *dev;
  	struct mt76_dev *mdev;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index c26aa3a7..4d49cd78 100644
+index f83308de..9dd4d478 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -354,6 +354,7 @@ struct mt7996_vif {
+@@ -355,6 +355,7 @@ struct mt7996_vif {
  
  	struct mt7996_sta sta;
  	struct mt7996_dev *dev;
@@ -186,7 +186,7 @@
  
  	u8 master_link_id;
  	u8 group_mld_id;
-@@ -901,6 +902,8 @@ int mt7996_init_tx_queues(struct mt7996_phy *phy, int idx,
+@@ -905,6 +906,8 @@ int mt7996_init_tx_queues(struct mt7996_phy *phy, int idx,
  void mt7996_init_txpower(struct mt7996_phy *phy);
  int mt7996_txbf_init(struct mt7996_dev *dev);
  int mt7996_get_chip_sku(struct mt7996_dev *dev);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0094-mtk-mt76-mt7996-rework-scanning-parts-for-MLD-STA-su.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0094-mtk-mt76-mt7996-rework-scanning-parts-for-MLD-STA-su.patch
index 851c8b9..8dc2209 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0094-mtk-mt76-mt7996-rework-scanning-parts-for-MLD-STA-su.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0094-mtk-mt76-mt7996-rework-scanning-parts-for-MLD-STA-su.patch
@@ -1,7 +1,7 @@
-From da9972cc7cd5059078be0006c0ffa93e056225bf Mon Sep 17 00:00:00 2001
+From 2dd9be1a2d916ec0ca58ec933f55154db6a40bf9 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 13 Dec 2023 16:58:31 +0800
-Subject: [PATCH 094/195] mtk: mt76: mt7996: rework scanning parts for MLD STA
+Subject: [PATCH 094/223] mtk: mt76: mt7996: rework scanning parts for MLD STA
  support
 
 During the first scanning, the STA VIF is still a legacy interface,
@@ -9,6 +9,7 @@
 here to let the legacy interface be abled to scan all bands.
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
+Change-Id: Iff7f98918eb52e9510eaa9b55e2fa769f8b7039d
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mt7996/mac.c  | 44 +++++++++++++++++++++++---------------------
@@ -16,10 +17,10 @@
  2 files changed, 57 insertions(+), 22 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 5417e741..36d2e0b3 100644
+index a48e4f44..a30b7dfa 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2769,23 +2769,40 @@ static void
+@@ -2781,23 +2781,40 @@ static void
  mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
  		       const u8 *dst)
  {
@@ -63,7 +64,7 @@
  
  	if (is_unicast_ether_addr(dst)) {
  		struct ieee80211_hdr_3addr *hdr =
-@@ -2803,36 +2820,21 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
+@@ -2815,36 +2832,21 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
  
  	skb_set_queue_mapping(skb, IEEE80211_AC_VO);
  
@@ -104,7 +105,7 @@
  {
  	bool *has_sta = data;
 diff --git a/mt7996/main.c b/mt7996/main.c
-index af72ad1a..e40d7fa4 100644
+index cabd5729..9ce7c6fb 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -2193,12 +2193,28 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0095-mtk-mt76-mt7996-implement-mld-address-translation.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0095-mtk-mt76-mt7996-implement-mld-address-translation.patch
index 3ba5347..0045fb2 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0095-mtk-mt76-mt7996-implement-mld-address-translation.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0095-mtk-mt76-mt7996-implement-mld-address-translation.patch
@@ -1,7 +1,7 @@
-From 7208863a19adbc607ad707417d365ab1e0a01624 Mon Sep 17 00:00:00 2001
+From e5e8751f543d8558637b4b8438f1f2f518effc2b Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 7 Dec 2023 16:31:56 +0800
-Subject: [PATCH 095/195] mtk: mt76: mt7996: implement mld address translation
+Subject: [PATCH 095/223] mtk: mt76: mt7996: implement mld address translation
 
 Do the MLD to link address translation for EAPOL and management frames
 in driver.
@@ -18,10 +18,10 @@
  2 files changed, 66 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 36d2e0b3..a306ad71 100644
+index a30b7dfa..9c256655 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -898,6 +898,26 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -910,6 +910,26 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key,
  				      pid, qid, 0);
  
@@ -49,7 +49,7 @@
  	for (i = 0; i < nbuf; i++) {
  		u16 len;
 diff --git a/mt7996/main.c b/mt7996/main.c
-index e40d7fa4..102e3d1d 100644
+index 9ce7c6fb..75e571b0 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1316,14 +1316,56 @@ static void mt7996_tx(struct ieee80211_hw *hw,
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0096-mtk-mt76-mt7996-use-BSS_CHANGED_TXPOWER-for-txpower-.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0096-mtk-mt76-mt7996-use-BSS_CHANGED_TXPOWER-for-txpower-.patch
index fd28c02..455160b 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0096-mtk-mt76-mt7996-use-BSS_CHANGED_TXPOWER-for-txpower-.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0096-mtk-mt76-mt7996-use-BSS_CHANGED_TXPOWER-for-txpower-.patch
@@ -1,7 +1,7 @@
-From c7b4b79f16d61220c62470c8a06dc578abcb79d4 Mon Sep 17 00:00:00 2001
+From bb16725ec128a46c3205d1cb67f152799bc58bb6 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 27 Feb 2024 18:07:11 +0800
-Subject: [PATCH 096/195] mtk: mt76: mt7996: use BSS_CHANGED_TXPOWER for
+Subject: [PATCH 096/223] mtk: mt76: mt7996: use BSS_CHANGED_TXPOWER for
  txpower setting
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
@@ -15,7 +15,7 @@
  4 files changed, 9 insertions(+), 13 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 102e3d1d..b2197a58 100644
+index 75e571b0..5c2bc2b0 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -665,14 +665,6 @@ static int mt7996_config(struct ieee80211_hw *hw, u32 changed)
@@ -52,10 +52,10 @@
  	mutex_unlock(&dev->mt76.mutex);
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 93589bb5..4234f727 100644
+index e7ee970b..d9edba0c 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -5313,7 +5313,8 @@ mt7996_update_max_txpower_cur(struct mt7996_phy *phy, int tx_power)
+@@ -5336,7 +5336,8 @@ mt7996_update_max_txpower_cur(struct mt7996_phy *phy, int tx_power)
  		mphy->txpower_cur = e2p_power_limit;
  }
  
@@ -65,7 +65,7 @@
  {
  #define TX_POWER_LIMIT_TABLE_RATE	0
  #define TX_POWER_LIMIT_TABLE_PATH	1
-@@ -5342,7 +5343,7 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
+@@ -5365,7 +5366,7 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
  
  	if (hw->conf.power_level == INT_MIN)
  		hw->conf.power_level = 127;
@@ -75,10 +75,10 @@
  	if (phy->sku_limit_en) {
  		txpower_limit = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 4d49cd78..725d5d5f 100644
+index 9dd4d478..ba954623 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -980,7 +980,8 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch);
+@@ -984,7 +984,8 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch);
  int mt7996_mcu_get_temperature(struct mt7996_phy *phy);
  int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state);
  int mt7996_mcu_set_thermal_protect(struct mt7996_phy *phy, bool enable);
@@ -89,10 +89,10 @@
  		       u8 rx_sel, u8 val);
  int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev,
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index ba17f947..0565ebc9 100644
+index be224373..799e443c 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -1830,7 +1830,7 @@ mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
+@@ -1834,7 +1834,7 @@ mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
  		mt7996_tm_update_channel(phy);
  		mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(SKU_POWER_LIMIT), td->sku_en);
  		mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(BACKOFF_POWER_LIMIT), td->sku_en);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0097-mtk-mt76-mt7996-temp-support-for-single-wiphy.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0097-mtk-mt76-mt7996-temp-support-for-single-wiphy.patch
index 1b9f47e..ee07409 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0097-mtk-mt76-mt7996-temp-support-for-single-wiphy.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0097-mtk-mt76-mt7996-temp-support-for-single-wiphy.patch
@@ -1,11 +1,12 @@
-From 55a2e1852f48c51839a335c92c7291ae4c08b80f Mon Sep 17 00:00:00 2001
+From 0764c048b72deb7ee2f988a4c6f708c661182f81 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 28 Mar 2024 18:50:04 +0800
-Subject: [PATCH 097/195] mtk: mt76: mt7996: temp support for single wiphy
+Subject: [PATCH 097/223] mtk: mt76: mt7996: temp support for single wiphy
 
 Add temporal single wiphy for simultaneously supporting MLD and legacy
 interfaces.
 
+Change-Id: I21cda8d1e35aff924aa028d2554ae966be263717
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mac80211.c      |  9 -----
@@ -18,7 +19,7 @@
  7 files changed, 86 insertions(+), 80 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index d4efd1dd..cc4c4b31 100644
+index b1af346a..a98fe4fb 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -823,13 +823,9 @@ EXPORT_SYMBOL_GPL(mt76_has_tx_pending);
@@ -48,10 +49,10 @@
  }
  EXPORT_SYMBOL_GPL(mt76_channel_state);
 diff --git a/mt76.h b/mt76.h
-index 3e593321..c43efdfb 100644
+index 2dea07a3..b65a6b0a 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -843,8 +843,8 @@ struct mt76_vif {
+@@ -845,8 +845,8 @@ struct mt76_vif {
  
  struct mt76_phy {
  	struct ieee80211_hw *hw;
@@ -78,10 +79,10 @@
  mt76_get_txwi_ptr(struct mt76_dev *dev, struct mt76_txwi_cache *t)
  {
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index cd93a3c2..c4714982 100644
+index 8272ead2..f9bd4d91 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -390,12 +390,6 @@ static int mt7996_eeprom_parse_band_config(struct mt7996_phy *phy)
+@@ -422,12 +422,6 @@ static int mt7996_eeprom_parse_band_config(struct mt7996_phy *phy)
  		break;
  	}
  
@@ -95,7 +96,7 @@
  }
  
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 2fe869c9..f75aa568 100644
+index cedadefc..f26687df 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -19,13 +19,13 @@ static const struct ieee80211_iface_limit if_limits[] = {
@@ -153,7 +154,7 @@
  	mt7996_unregister_thermal(phy);
  
  	mphy = phy->dev->mt76.phys[band];
-@@ -1677,6 +1684,12 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1697,6 +1704,12 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -166,7 +167,7 @@
  	ieee80211_queue_work(mt76_hw(dev), &dev->init_work);
  
  	dev->recovery.hw_init_done = true;
-@@ -1706,11 +1719,11 @@ error:
+@@ -1726,11 +1739,11 @@ error:
  void mt7996_unregister_device(struct mt7996_dev *dev)
  {
  	cancel_work_sync(&dev->wed_rro.work);
@@ -181,10 +182,10 @@
  	mt7996_mcu_exit(dev);
  	mt7996_tx_token_put(dev);
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index a306ad71..24df5bb5 100644
+index 9c256655..f5725b3c 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2402,10 +2402,7 @@ void mt7996_mac_work(struct work_struct *work)
+@@ -2414,10 +2414,7 @@ void mt7996_mac_work(struct work_struct *work)
  
  	mt76_tx_status_check(mdev, false);
  
@@ -197,7 +198,7 @@
  }
  
 diff --git a/mt7996/main.c b/mt7996/main.c
-index b2197a58..66d2b993 100644
+index 5c2bc2b0..d9cd7df1 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -140,6 +140,10 @@ static int mt7996_start(struct ieee80211_hw *hw)
@@ -211,7 +212,7 @@
  	flush_work(&dev->init_work);
  
  	mutex_lock(&dev->mt76.mutex);
-@@ -154,6 +158,10 @@ static void mt7996_stop(struct ieee80211_hw *hw)
+@@ -154,6 +158,10 @@ static void mt7996_stop(struct ieee80211_hw *hw, bool suspend)
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	int band;
  
@@ -222,7 +223,7 @@
  	cancel_delayed_work_sync(&dev->scs_work);
  
  	for (band = 0; band < NUM_NL80211_BANDS; band++) {
-@@ -173,7 +181,6 @@ static void mt7996_stop(struct ieee80211_hw *hw)
+@@ -173,7 +181,6 @@ static void mt7996_stop(struct ieee80211_hw *hw, bool suspend)
  		mutex_lock(&dev->mt76.mutex);
  		mt7996_mcu_set_radio_en(phy, false);
  		clear_bit(MT76_STATE_RUNNING, &phy->mt76->state);
@@ -422,10 +423,10 @@
  		mutex_unlock(&phy->dev->mt76.mutex);
  		return -ENOSPC;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 725d5d5f..9be34307 100644
+index ba954623..66908ad2 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -795,21 +795,19 @@ mt7996_get_background_radar_cap(struct mt7996_dev *dev)
+@@ -799,21 +799,19 @@ mt7996_has_background_radar(struct mt7996_dev *dev)
  static inline struct mt7996_phy *
  mt7996_band_phy(struct ieee80211_hw *hw, enum nl80211_band band)
  {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0098-mtk-mt76-mt7996-implement-ieee80211_ops-for-link-deb.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0098-mtk-mt76-mt7996-implement-ieee80211_ops-for-link-deb.patch
index e00c607..3023032 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0098-mtk-mt76-mt7996-implement-ieee80211_ops-for-link-deb.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0098-mtk-mt76-mt7996-implement-ieee80211_ops-for-link-deb.patch
@@ -1,7 +1,7 @@
-From 404390abd784a5f0bb92a4bc2dffa90fe6380bf7 Mon Sep 17 00:00:00 2001
+From 063ce389fe9a412cb67f97ca6d0d5143dddb22ca Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 29 Dec 2023 18:37:41 +0800
-Subject: [PATCH 098/195] mtk: mt76: mt7996: implement ieee80211_ops for link
+Subject: [PATCH 098/223] mtk: mt76: mt7996: implement ieee80211_ops for link
  debugfs
 
 Add .link_sta_add_debugfs and .link_add_debugfs for per-link STA and BSS
@@ -18,7 +18,7 @@
  5 files changed, 214 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 62658dbc..fe8fea5d 100644
+index 786bdc38..ab8732dd 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -1294,4 +1294,205 @@ void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -228,10 +228,10 @@
 +}
  #endif
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 24df5bb5..3b3aa01b 100644
+index f5725b3c..b8cf557b 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2378,10 +2378,10 @@ void mt7996_mac_work(struct work_struct *work)
+@@ -2390,10 +2390,10 @@ void mt7996_mac_work(struct work_struct *work)
  				mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_RATE);
  				mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_AIRTIME);
  				mt7996_mcu_get_rssi(mdev);
@@ -245,7 +245,7 @@
  				if (mt7996_mcu_wa_cmd(phy->dev, MCU_WA_PARAM_CMD(QUERY), MCU_WA_PARAM_BSS_ACQ_PKT_CNT,
  				                      BSS_ACQ_PKT_CNT_BSS_BITMAP_ALL | BSS_ACQ_PKT_CNT_READ_CLR, 0))
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 66d2b993..70607a48 100644
+index d9cd7df1..fe5bfd72 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -2629,6 +2629,8 @@ const struct ieee80211_ops mt7996_ops = {
@@ -258,10 +258,10 @@
  	.set_radar_background = mt7996_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 4234f727..65eade0d 100644
+index d9edba0c..9359a251 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -616,8 +616,10 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -621,8 +621,10 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  			wcid->stats.tx_packets += tx_packets;
  			wcid->stats.rx_packets += rx_packets;
  
@@ -275,10 +275,10 @@
  		case UNI_ALL_STA_TXRX_AIRTIME:
  			wlan_idx = le16_to_cpu(res->airtime[i].wlan_idx);
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 9be34307..c52193e4 100644
+index 66908ad2..c94853f2 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1142,6 +1142,11 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
+@@ -1146,6 +1146,11 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
  #ifdef CONFIG_MAC80211_DEBUGFS
  void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0099-mtk-mt76-mt7996-support-multi-link-channel-switch.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0099-mtk-mt76-mt7996-support-multi-link-channel-switch.patch
index 8c8261e..a58349a 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0099-mtk-mt76-mt7996-support-multi-link-channel-switch.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0099-mtk-mt76-mt7996-support-multi-link-channel-switch.patch
@@ -1,7 +1,7 @@
-From 566cd00d1fed9f6c8f6cd4265ca99910e9716082 Mon Sep 17 00:00:00 2001
+From 70a14f12eef8b505890f654876a7f89432070bbf Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 19 Jan 2024 14:04:03 +0800
-Subject: [PATCH 099/195] mtk: mt76: mt7996: support multi-link channel switch
+Subject: [PATCH 099/223] mtk: mt76: mt7996: support multi-link channel switch
 
 mtk: wifi: mt76: mt7996: remove the limitation of radar detect width for mlo
 
@@ -27,10 +27,10 @@
  4 files changed, 22 insertions(+), 7 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index cc4c4b31..0651760f 100644
+index a98fe4fb..a2b111c0 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1825,7 +1825,7 @@ enum mt76_dfs_state mt76_phy_dfs_state(struct mt76_phy *phy)
+@@ -1801,7 +1801,7 @@ enum mt76_dfs_state mt76_phy_dfs_state(struct mt76_phy *phy)
  	    test_bit(MT76_SCANNING, &phy->state))
  		return MT_DFS_STATE_DISABLED;
  
@@ -40,10 +40,10 @@
  		    (phy->chandef.chan->flags & IEEE80211_CHAN_RADAR))
  			return MT_DFS_STATE_ACTIVE;
 diff --git a/mt76.h b/mt76.h
-index c43efdfb..4d495a7b 100644
+index b65a6b0a..bc263bd4 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -860,6 +860,7 @@ struct mt76_phy {
+@@ -862,6 +862,7 @@ struct mt76_phy {
  
  	struct mt76_channel_state *chan_state;
  	enum mt76_dfs_state dfs_state;
@@ -52,7 +52,7 @@
  
  	u32 aggr_stats[32];
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 70607a48..74f48ce6 100644
+index fe5bfd72..e3f30b23 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -2143,7 +2143,7 @@ static int
@@ -105,10 +105,10 @@
  	new_ctx->chandef = vifs->new_ctx->def;
  	new_ctx->phy = phy;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 65eade0d..23664b60 100644
+index 9359a251..d897098e 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -357,10 +357,18 @@ int mt7996_mcu_wa_cmd(struct mt7996_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
+@@ -362,10 +362,18 @@ int mt7996_mcu_wa_cmd(struct mt7996_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
  static void
  mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -129,7 +129,7 @@
  }
  
  static void
-@@ -475,7 +483,7 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -480,7 +488,7 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
  		case UNI_EVENT_IE_COUNTDOWN_CSA:
  			ieee80211_iterate_active_interfaces_atomic(mphy->hw,
  					IEEE80211_IFACE_ITER_RESUME_ALL,
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0100-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0100-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch
index 5e54a60..d5ed3fd 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0100-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0100-mtk-mt76-mt7996-ACS-channel-time-too-long-on-duty-ch.patch
@@ -1,7 +1,7 @@
-From 3bc1a8a320d5865a6ef834e2a6b028ae61cc1fcf Mon Sep 17 00:00:00 2001
+From 8e4e5598fe8695f1234e35849916b1a3fcc862f5 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Thu, 22 Feb 2024 11:09:10 +0800
-Subject: [PATCH 100/195] mtk: mt76: mt7996: ACS channel time too long on duty
+Subject: [PATCH 100/223] mtk: mt76: mt7996: ACS channel time too long on duty
  channel
 
 This problem happens in SW scan and was already fixed.
@@ -15,7 +15,7 @@
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 74f48ce6..8e7d5d25 100644
+index e3f30b23..6fad94b8 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -499,6 +499,7 @@ static void ___mt7996_set_channel(struct mt7996_phy *phy,
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0101-mtk-mt76-mt7996-add-beacon-monitoring-in-driver-for-.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0101-mtk-mt76-mt7996-add-beacon-monitoring-in-driver-for-.patch
index 03de392..66d8cff 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0101-mtk-mt76-mt7996-add-beacon-monitoring-in-driver-for-.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0101-mtk-mt76-mt7996-add-beacon-monitoring-in-driver-for-.patch
@@ -1,7 +1,7 @@
-From f3162f3d669ee8eadc3d5e2f3af3f27aeb1e32f6 Mon Sep 17 00:00:00 2001
+From cad5f671fef13c087e4e38058944cac48fecf479 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 20 Feb 2024 10:08:01 +0800
-Subject: [PATCH 101/195] mtk: mt76: mt7996: add beacon monitoring in driver
+Subject: [PATCH 101/223] mtk: mt76: mt7996: add beacon monitoring in driver
  for mlo
 
 Add beacon monitoring in driver since mac80211 does not
@@ -27,6 +27,9 @@
 5. Add address sanity check before sending nullfunc.
 6. Add cancel_delayed_work in more place.
 
+Change-Id: I52211987abd6309bbb23dc648af3f377adf8982a
+Change-Id: I3e79716609e8a8a53199e8558c07711df2f4bd47
+Change-Id: Ifff48bc6d64050dce29da19461933a13bc99b255
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mt7996/mac.c    | 217 +++++++++++++++++++++++++++++++++++++++++++++++-
@@ -35,7 +38,7 @@
  3 files changed, 290 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 3b3aa01b..803f7ce3 100644
+index b8cf557b..1cf84fe5 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -559,6 +559,32 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
@@ -69,9 +72,9 @@
 +				}
 +			}
  		}
- #ifdef CONFIG_MTK_VENDOR
- 		if (phy->amnt_ctrl.enable && !ieee80211_is_beacon(fc))
-@@ -709,7 +735,8 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
+ 		skb_set_mac_header(skb, (unsigned char *)hdr - skb->data);
+ 
+@@ -721,7 +747,8 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
  	}
  
  	if (ieee80211_vif_is_mld(info->control.vif) &&
@@ -81,7 +84,7 @@
  		txwi[5] |= cpu_to_le32(MT_TXD5_FL);
  }
  
-@@ -1194,6 +1221,10 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
+@@ -1206,6 +1233,10 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
  	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) == 0) {
  		skb = mt76_tx_status_skb_get(mdev, wcid, pid, &list);
  		if (skb) {
@@ -92,7 +95,7 @@
  			info = IEEE80211_SKB_CB(skb);
  			if (!(txs & MT_TXS0_ACK_ERROR_MASK))
  				info->flags |= IEEE80211_TX_STAT_ACK;
-@@ -1203,6 +1234,18 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
+@@ -1215,6 +1246,18 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
  				!!(info->flags & IEEE80211_TX_STAT_ACK);
  
  			info->status.rates[0].idx = -1;
@@ -111,7 +114,7 @@
  		}
  	}
  
-@@ -2941,6 +2984,178 @@ void mt7996_scan_work(struct work_struct *work)
+@@ -2953,6 +2996,178 @@ void mt7996_scan_work(struct work_struct *work)
  	ieee80211_queue_delayed_work(hw, &phy->scan_work, duration);
  }
  
@@ -291,7 +294,7 @@
  		   struct ieee80211_hw **hw)
  {
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 8e7d5d25..466b051b 100644
+index 6fad94b8..67948343 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -452,6 +452,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
@@ -391,10 +394,10 @@
  	.remove_chanctx = mt7996_remove_chanctx,
  	.change_chanctx = mt7996_change_chanctx,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index c52193e4..fc36da8d 100644
+index c94853f2..2a638a4a 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -129,6 +129,10 @@
+@@ -131,6 +131,10 @@
  
  #define to_rssi(field, rcpi)	((FIELD_GET(field, rcpi) - 220) / 2)
  
@@ -405,7 +408,7 @@
  struct mt7996_vif;
  struct mt7996_sta;
  struct mt7996_dfs_pulse;
-@@ -361,6 +365,14 @@ struct mt7996_vif {
+@@ -362,6 +366,14 @@ struct mt7996_vif {
  	u8 mld_remap_id;
  
  	u8 band_to_link[__MT_MAX_BAND];
@@ -420,7 +423,7 @@
  };
  
  /* crash-dump */
-@@ -1117,6 +1129,7 @@ bool mt7996_rx_check(struct mt76_dev *mdev, void *data, int len);
+@@ -1121,6 +1133,7 @@ bool mt7996_rx_check(struct mt76_dev *mdev, void *data, int len);
  void mt7996_stats_work(struct work_struct *work);
  void mt7996_scan_work(struct work_struct *work);
  void mt7996_scan_complete(struct mt7996_phy *phy, bool aborted);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0102-mtk-mt76-mt7996-support-band_idx-option-for-set_mu-g.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0102-mtk-mt76-mt7996-support-band_idx-option-for-set_mu-g.patch
index 3508d54..95329b4 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0102-mtk-mt76-mt7996-support-band_idx-option-for-set_mu-g.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0102-mtk-mt76-mt7996-support-band_idx-option-for-set_mu-g.patch
@@ -1,12 +1,13 @@
-From 848ec204ea1564992b480c8fcf31b0eb482c01d4 Mon Sep 17 00:00:00 2001
+From 7b4305017b499ad805701f6022ed92b1e5746aa2 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 4 Mar 2024 16:21:16 +0800
-Subject: [PATCH 102/195] mtk: mt76: mt7996: support band_idx option for
+Subject: [PATCH 102/223] mtk: mt76: mt7996: support band_idx option for
  set_mu/get_mu vendor command
 
 The vendor command set_mu and get_mu should be executed with band_idx.
 With band_idx, driver can access the corrsponding phy by band_idx.
 
+Change-Id: Id33d5efd3752e767fc11e852836d9939e4d6a088
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
  mt7996/mcu.c    | 26 +++++++++++++++++++-------
@@ -16,10 +17,10 @@
  4 files changed, 56 insertions(+), 12 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 23664b60..c18cb5eb 100644
+index d897098e..48837d41 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -5841,12 +5841,23 @@ int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy)
+@@ -5864,12 +5864,23 @@ int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy)
  #ifdef CONFIG_MTK_VENDOR
  void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -45,7 +46,7 @@
  
  	switch (mode) {
  	case RATE_PARAM_FIXED_OFDMA:
-@@ -5862,13 +5873,14 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -5885,13 +5896,14 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  			phy->muru_onoff |= MUMIMO_UL;
  		break;
  	case RATE_PARAM_AUTO_MU:
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0103-mtk-mt76-mt7996-tmp-disable-VOW.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0103-mtk-mt76-mt7996-tmp-disable-VOW.patch
index 7e70025..6682f9b 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0103-mtk-mt76-mt7996-tmp-disable-VOW.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0103-mtk-mt76-mt7996-tmp-disable-VOW.patch
@@ -1,7 +1,7 @@
-From ed9f51e22cb299abd50f01849eecbdce4d6d1b27 Mon Sep 17 00:00:00 2001
+From ab265243158a3d44bd5c0a55d0e92bd6decbb3e2 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 20 Mar 2024 22:56:44 +0800
-Subject: [PATCH 103/195] mtk: mt76: mt7996: tmp disable VOW
+Subject: [PATCH 103/223] mtk: mt76: mt7996: tmp disable VOW
 
 FW will return failed when legacy 5G station connects after legacy 2G
 station, need to check.
@@ -12,10 +12,10 @@
  1 file changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index c18cb5eb..a46d524a 100644
+index 48837d41..54b0272c 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2369,6 +2369,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+@@ -2374,6 +2374,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  	return mt7996_mcu_add_rate_ctrl_fixed(dev, conf, mconf, link_sta, mlink);
  }
  
@@ -23,7 +23,7 @@
  static int
  mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf,
  			struct mt7996_link_sta *mlink)
-@@ -2402,6 +2403,7 @@ mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf,
+@@ -2407,6 +2408,7 @@ mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf,
  
  	return mt7996_mcu_set_vow_drr_ctrl(phy, mconf, mlink, VOW_DRR_CTRL_STA_ALL);
  }
@@ -31,7 +31,7 @@
  
  int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  		       struct mt7996_bss_conf *mconf,
-@@ -2411,7 +2413,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+@@ -2416,7 +2418,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  	struct ieee80211_vif *vif = conf->vif;
  	struct sk_buff *skb;
  	int conn_state;
@@ -40,7 +40,7 @@
  
  	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
  					      &mlink->wcid,
-@@ -2458,11 +2460,13 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+@@ -2463,11 +2465,13 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  		mt7996_mcu_sta_bfee_tlv(dev, skb, conf, mconf, link_sta);
  	}
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0104-mtk-mt76-mt7996-enable-ampdu-limit-to-avoid-BA-bound.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0104-mtk-mt76-mt7996-enable-ampdu-limit-to-avoid-BA-bound.patch
index 464fd08..1e446d4 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0104-mtk-mt76-mt7996-enable-ampdu-limit-to-avoid-BA-bound.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0104-mtk-mt76-mt7996-enable-ampdu-limit-to-avoid-BA-bound.patch
@@ -1,7 +1,7 @@
-From c25c4145f1d45b2491de2da90a09ed64b982ab75 Mon Sep 17 00:00:00 2001
+From bd12a6bbc6783a69d6ab5630b7b7ffda53da88d5 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 1 Apr 2024 17:00:21 +0800
-Subject: [PATCH 104/195] mtk: mt76: mt7996: enable ampdu limit to avoid BA
+Subject: [PATCH 104/223] mtk: mt76: mt7996: enable ampdu limit to avoid BA
  bound issue
 
 [Description]
@@ -25,6 +25,7 @@
 [Release-log]
 N/A
 
+Change-Id: I64ea1d5df012c1eb9462391e5e9c20658ed7f4fe
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt76_connac_mcu.h |  1 +
@@ -33,10 +34,10 @@
  3 files changed, 95 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 19c65db4..654f16ff 100644
+index 1dcd1696..f6b472ef 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -829,6 +829,7 @@ enum {
+@@ -834,6 +834,7 @@ enum {
  	STA_REC_KEY_V3 = 0x27,
  	STA_REC_HDRT = 0x28,
  	STA_REC_HDR_TRANS = 0x2B,
@@ -45,10 +46,10 @@
  };
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index a46d524a..de20cc7c 100644
+index 54b0272c..8034c8ab 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1344,6 +1344,85 @@ mt7996_mcu_sta_ba(struct mt7996_dev *dev, struct mt76_vif *mvif,
+@@ -1349,6 +1349,85 @@ mt7996_mcu_sta_ba(struct mt7996_dev *dev, struct mt76_vif *mvif,
  				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
  }
  
@@ -134,7 +135,7 @@
  /** starec & wtbl **/
  int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  			 struct ieee80211_ampdu_params *params,
-@@ -1353,6 +1432,7 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
+@@ -1358,6 +1437,7 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
  	unsigned long valid_links = sta->valid_links ?: BIT(0);
  	unsigned int link_id;
@@ -142,7 +143,7 @@
  
  	for_each_set_bit(link_id, &valid_links, IEEE80211_MLD_MAX_NUM_LINKS) {
  		struct mt7996_link_sta *mlink =
-@@ -1368,6 +1448,12 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
+@@ -1373,6 +1453,12 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  					&mlink->wcid, enable, true);
  		if (ret)
  			return ret;
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0105-mtk-mt76-mt7996-Fix-get_txpower-wrong-result-in-sing.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0105-mtk-mt76-mt7996-Fix-get_txpower-wrong-result-in-sing.patch
index 97f894f..d147e2f 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0105-mtk-mt76-mt7996-Fix-get_txpower-wrong-result-in-sing.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0105-mtk-mt76-mt7996-Fix-get_txpower-wrong-result-in-sing.patch
@@ -1,7 +1,7 @@
-From 0329e5904dd0a154155041583a5e615d8a4453c1 Mon Sep 17 00:00:00 2001
+From 67c0e729c31b13fc348746b398857c353e43dab1 Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Mon, 8 Apr 2024 16:56:09 +0800
-Subject: [PATCH 105/195] mtk: mt76: mt7996: Fix get_txpower wrong result in
+Subject: [PATCH 105/223] mtk: mt76: mt7996: Fix get_txpower wrong result in
  single wiphy and legacy mode
 
 Fix get_txpower wrong result in single wiphy and legacy mode.
@@ -9,12 +9,13 @@
 
 Temporarily use link 0 bss due to mac80211 didn't pass link id here.
 
+Change-Id: I306897ded276b0e5aee191339f18f0f25ca322f2
 ---
  mt7996/main.c | 28 +++++++++++++++++++++++++++-
  1 file changed, 27 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 466b051b..5f9997ba 100644
+index 67948343..b7096901 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -982,6 +982,32 @@ out:
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0106-mtk-mt76-mt7996-Add-connac3-csi-feature.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0106-mtk-mt76-mt7996-Add-connac3-csi-feature.patch
index 13c9df5..e7146ca 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0106-mtk-mt76-mt7996-Add-connac3-csi-feature.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0106-mtk-mt76-mt7996-Add-connac3-csi-feature.patch
@@ -1,7 +1,7 @@
-From 1a8e69613ad804b4dd94250ecb0888a3f6fc0448 Mon Sep 17 00:00:00 2001
+From c16fd657d9955992ab12c22ac068c7f9d0035ed3 Mon Sep 17 00:00:00 2001
 From: mtk20656 <chank.chen@mediatek.com>
 Date: Sat, 20 Jan 2024 12:03:24 +0800
-Subject: [PATCH 106/195] mtk: mt76: mt7996: Add connac3 csi feature.
+Subject: [PATCH 106/223] mtk: mt76: mt7996: Add connac3 csi feature.
 
 1. format align to wifi6.
 2. add bw320 support.
@@ -9,6 +9,8 @@
 
 Fix csi bug with single wiphy design.
 
+Change-Id: If37ac6de4781c3673671707ee3ee243dda8163f8
+Change-Id: I7761e2883bb08939917432df075062fb78de3bee
 Signed-off-by: mtk20656 <chank.chen@mediatek.com>
 ---
  mt76_connac_mcu.h |   2 +
@@ -22,10 +24,10 @@
  8 files changed, 951 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 654f16ff..6c1a4126 100644
+index f6b472ef..11c147cd 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1061,6 +1061,7 @@ enum {
+@@ -1066,6 +1066,7 @@ enum {
  	MCU_UNI_EVENT_THERMAL = 0x35,
  	MCU_UNI_EVENT_NIC_CAPAB = 0x43,
  	MCU_UNI_EVENT_TESTMODE_CTRL = 0x46,
@@ -33,7 +35,7 @@
  	MCU_UNI_EVENT_WED_RRO = 0x57,
  	MCU_UNI_EVENT_PER_STA_INFO = 0x6d,
  	MCU_UNI_EVENT_ALL_STA_INFO = 0x6e,
-@@ -1298,6 +1299,7 @@ enum {
+@@ -1303,6 +1304,7 @@ enum {
  	MCU_UNI_CMD_TESTMODE_TRX_PARAM = 0x42,
  	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
  	MCU_UNI_CMD_PRECAL_RESULT = 0x47,
@@ -42,7 +44,7 @@
  	MCU_UNI_CMD_RRO = 0x57,
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index f75aa568..a1941869 100644
+index f26687df..211ad40c 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -807,6 +807,24 @@ error:
@@ -82,7 +84,7 @@
  
  	mphy = phy->dev->mt76.phys[band];
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 5f9997ba..b0e93d74 100644
+index b7096901..32a37936 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1306,6 +1306,9 @@ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -96,10 +98,10 @@
  }
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index de20cc7c..79011ea1 100644
+index 8034c8ab..56bb32a0 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -653,6 +653,263 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -658,6 +658,263 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	}
  }
  
@@ -363,7 +365,7 @@
  static void
  mt7996_mcu_rx_thermal_notify(struct mt7996_dev *dev, struct sk_buff *skb)
  {
-@@ -896,6 +1153,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -901,6 +1158,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	case MCU_UNI_EVENT_BF:
  		mt7996_mcu_rx_bf_event(dev, skb);
  		break;
@@ -375,7 +377,7 @@
  #endif
  	default:
  		break;
-@@ -5983,4 +6245,207 @@ void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+@@ -6006,4 +6268,207 @@ void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  
  	mt7996_mcu_add_beacon(hw, &vif->bss_conf, &mvif->deflink, val);
  }
@@ -698,10 +700,10 @@
 +
  #endif
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index fc36da8d..7d1cfab4 100644
+index 2a638a4a..eb38427b 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -445,6 +445,47 @@ struct mt7996_air_monitor_ctrl {
+@@ -446,6 +446,47 @@ struct mt7996_air_monitor_ctrl {
  	struct mt7996_air_monitor_group group[MT7996_AIR_MONITOR_MAX_GROUP];
  	struct mt7996_air_monitor_entry entry[MT7996_AIR_MONITOR_MAX_ENTRY];
  };
@@ -749,7 +751,7 @@
  #endif
  
  struct mt7996_rro_ba_session {
-@@ -541,6 +582,18 @@ struct mt7996_phy {
+@@ -542,6 +583,18 @@ struct mt7996_phy {
  	u8 rts_bw_sig;
  	spinlock_t amnt_lock;
  	struct mt7996_air_monitor_ctrl amnt_ctrl;
@@ -768,7 +770,7 @@
  #endif
  #ifdef CONFIG_MTK_DEBUG
  	bool sr_enable:1;
-@@ -1176,6 +1229,8 @@ void mt7996_mcu_set_mimo(struct mt7996_phy *phy);
+@@ -1180,6 +1233,8 @@ void mt7996_mcu_set_mimo(struct mt7996_phy *phy);
  int mt7996_set_muru_cfg(struct mt7996_phy *phy, u8 action, u8 val);
  int mt7996_mcu_set_muru_cfg(struct mt7996_phy *phy, void *data);
  void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0107-mtk-mt76-mt7996-add-more-debug-info-for-MLO.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0107-mtk-mt76-mt7996-add-more-debug-info-for-MLO.patch
index 2ddeab5..a1f4a1f 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0107-mtk-mt76-mt7996-add-more-debug-info-for-MLO.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0107-mtk-mt76-mt7996-add-more-debug-info-for-MLO.patch
@@ -1,8 +1,9 @@
-From ecf3e3e20187a0398969e6b97b346b4a44c3b02e Mon Sep 17 00:00:00 2001
+From 7aa62c926e4323d8a19bac3c286903ec3d266503 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 22 Apr 2024 11:06:48 +0800
-Subject: [PATCH 107/195] mtk: mt76: mt7996: add more debug info for MLO
+Subject: [PATCH 107/223] mtk: mt76: mt7996: add more debug info for MLO
 
+Change-Id: Id61889262c153f28fca8f209319137d86e8b9c36
 ---
  mt76_connac_mcu.c    |    1 +
  mt76_connac_mcu.h    |    1 +
@@ -19,7 +20,7 @@
  12 files changed, 1856 insertions(+), 18 deletions(-)
 
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 426baf0e..76117b6c 100644
+index e4e6c0d3..b62a1ac8 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -428,6 +428,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
@@ -31,10 +32,10 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_basic_tlv);
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 6c1a4126..36d126ae 100644
+index 11c147cd..86a2fdf8 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1295,6 +1295,7 @@ enum {
+@@ -1300,6 +1300,7 @@ enum {
  	MCU_UNI_CMD_THERMAL = 0x35,
  	MCU_UNI_CMD_VOW = 0x37,
  	MCU_UNI_CMD_PP = 0x38,
@@ -43,7 +44,7 @@
  	MCU_UNI_CMD_TESTMODE_TRX_PARAM = 0x42,
  	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index fe8fea5d..63b8887d 100644
+index ab8732dd..db41e378 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -314,15 +314,17 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
@@ -126,7 +127,7 @@
  	if (is_fwlog) {
  		if (dev->relay_fwlog)
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 803f7ce3..6462c64c 100644
+index 1cf84fe5..cd139111 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -331,6 +331,10 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
@@ -151,7 +152,7 @@
  	if (hdr_trans && ieee80211_has_morefrags(fc)) {
  		if (mt7996_reverse_frag0_hdr_trans(skb, hdr_gap))
  			return -EINVAL;
-@@ -982,6 +990,13 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -994,6 +1002,13 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	tx_info->buf[1].skip_unmap = true;
  	tx_info->nbuf = MT_CT_DMA_BUF_NUM;
  
@@ -166,7 +167,7 @@
  }
  
 diff --git a/mt7996/main.c b/mt7996/main.c
-index b0e93d74..af975af0 100644
+index 32a37936..0c5ddda1 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -433,6 +433,9 @@ static int mt7996_add_bss_conf(struct mt7996_phy *phy,
@@ -233,10 +234,10 @@
  
  	if (rem)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 79011ea1..fccf43a9 100644
+index 56bb32a0..956bd396 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -333,6 +333,10 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+@@ -338,6 +338,10 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
  		mcu_txd->s2d_index = MCU_S2D_H2N;
  
  exit:
@@ -247,7 +248,7 @@
  	if (wait_seq)
  		*wait_seq = seq;
  
-@@ -1120,6 +1124,10 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -1125,6 +1129,10 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
  {
  	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
  
@@ -258,7 +259,7 @@
  	switch (rxd->eid) {
  	case MCU_UNI_EVENT_FW_LOG_2_HOST:
  		mt7996_mcu_rx_log_message(dev, skb);
-@@ -1336,6 +1344,8 @@ mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+@@ -1341,6 +1349,8 @@ mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
  	}
  
  	mld->own_mld_id = mconf->own_mld_id;
@@ -267,7 +268,7 @@
  }
  
  static void
-@@ -1487,6 +1497,10 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
+@@ -1492,6 +1502,10 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
  	}
  
  	memcpy(bss->bssid, conf->bssid, ETH_ALEN);
@@ -278,7 +279,7 @@
  	bss->bcn_interval = cpu_to_le16(conf->beacon_int);
  	bss->dtim_period = conf->dtim_period;
  	bss->phymode = mt76_connac_get_phy_mode(phy, vif,
-@@ -2773,6 +2787,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+@@ -2778,6 +2792,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  	conn_state = enable ? CONN_STATE_PORT_SECURE : CONN_STATE_DISCONNECT;
  	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, conf, link_sta,
  				      conn_state, newly);
@@ -287,7 +288,7 @@
  
  	if (!enable)
  		goto out;
-@@ -2855,12 +2871,16 @@ mt7996_mcu_sta_mld_setup_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -2860,12 +2876,16 @@ mt7996_mcu_sta_mld_setup_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	mld_setup->link_num = hweight16(sta->valid_links);
  
  	mld_setup_link = (struct mld_setup_link *)mld_setup->link_info;
@@ -304,7 +305,7 @@
  		mld_setup_link++;
  	}
  }
-@@ -3124,6 +3144,8 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
+@@ -3129,6 +3149,8 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
  		return mt7996_mcu_muar_config(phy, conf, mconf, false, enable);
  
  	memcpy(data.tlv.omac_addr, conf->addr, ETH_ALEN);
@@ -313,7 +314,7 @@
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WMWA_UNI_CMD(DEV_INFO_UPDATE),
  				 &data, sizeof(data), true);
  }
-@@ -3228,6 +3250,11 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+@@ -3233,6 +3255,11 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  			      BSS_CHANGED_BEACON);
  
  	memcpy(buf + MT_TXD_SIZE, skb->data, skb->len);
@@ -345,10 +346,10 @@
  	UNI_CMD_SR_ENABLE = 0x1,
  	UNI_CMD_SR_ENABLE_SD,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 7d1cfab4..adfa38dc 100644
+index eb38427b..00023a5e 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -737,6 +737,14 @@ struct mt7996_dev {
+@@ -742,6 +742,14 @@ struct mt7996_dev {
  		u8 fw_dbg_lv;
  		u32 bcn_total_cnt[__MT_MAX_BAND];
  		u32 sid;
@@ -363,7 +364,7 @@
  	} dbg;
  	const struct mt7996_dbg_reg_desc *dbg_reg;
  #endif
-@@ -935,6 +943,8 @@ mt7996_get_link_wcid(struct mt7996_dev *dev, u16 idx, u8 band_idx)
+@@ -939,6 +947,8 @@ mt7996_get_link_wcid(struct mt7996_dev *dev, u16 idx, u8 band_idx)
  	return &mlink->wcid;
  }
  
@@ -372,7 +373,7 @@
  extern const struct ieee80211_ops mt7996_ops;
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
-@@ -1266,6 +1276,18 @@ void mt7996_tm_update_channel(struct mt7996_phy *phy);
+@@ -1270,6 +1280,18 @@ void mt7996_tm_update_channel(struct mt7996_phy *phy);
  
  int mt7996_mcu_set_vow_drr_dbg(struct mt7996_dev *dev, u32 val);
  int mt7996_mcu_thermal_debug(struct mt7996_dev *dev, u8 mode, u8 action);
@@ -1061,10 +1062,10 @@
 +
  #endif
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index cc1224ed..c7f5b56e 100644
+index bc9a0f04..f9c5b238 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -3187,6 +3187,1038 @@ mt7996_thermal_recal_set(void *data, u64 val)
+@@ -3186,6 +3186,1038 @@ mt7996_thermal_recal_set(void *data, u64 val)
  DEFINE_DEBUGFS_ATTRIBUTE(fops_thermal_recal, NULL,
  			 mt7996_thermal_recal_set, "%llu\n");
  
@@ -2103,7 +2104,7 @@
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -3295,6 +4327,24 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -3294,6 +4326,24 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  
  	debugfs_create_file("thermal_enable", 0600, dir, phy, &fops_thermal_enable);
  	debugfs_create_file("thermal_recal", 0200, dir, dev, &fops_thermal_recal);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0108-mtk-mt76-add-internal-debug-tool.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0108-mtk-mt76-add-internal-debug-tool.patch
index b3b1766..37f7759 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0108-mtk-mt76-add-internal-debug-tool.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0108-mtk-mt76-add-internal-debug-tool.patch
@@ -1,7 +1,7 @@
-From 431cb708f42f51a88c60f0fbd0737ea79fea4e58 Mon Sep 17 00:00:00 2001
+From 9ba1059c52cbf12123e8b3531291623e692fe1d9 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 22 Apr 2024 12:22:05 +0800
-Subject: [PATCH 108/195] mtk: mt76: add internal debug tool
+Subject: [PATCH 108/223] mtk: mt76: add internal debug tool
 
 Add the following DebugFS knobs:
 - reset_counter: reset TX/RX statistical counters in FW, WTBL, and MT76.
@@ -49,6 +49,10 @@
 Because Kite only supports 512 STAs, the number of AC_QUEUE_EMPTY CRs is less than that of Eagle.
 Consequently, some related macros have to be revised to prevent reading wrong CRs.
 
+Change-Id: I22331b413b0583c4209f733ad197369fa8939d97
+Change-Id: Ic01c288fda25886a9c384441704cb7a9f86f6209
+Change-Id: I3515144170aad82c23d38a6eedad8843f818058d
+Change-Id: Iea052180b469e8ae8ba759ddb4bcf028fce3dace
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -83,7 +87,7 @@
 -mt7996e-y += mtk_debugfs.o mtk_mcu.o
 +mt7996e-y += mtk_debugfs.o mtk_mcu.o mtk_debugfs_i.o
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 63b8887d..2c553cf3 100644
+index db41e378..7e545f61 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -1118,8 +1118,12 @@ int mt7996_init_debugfs(struct mt7996_phy *phy)
@@ -101,7 +105,7 @@
  #ifdef CONFIG_MTK_DEBUG
  	debugfs_create_u16("wlan_idx", 0600, dir, &dev->wlan_idx);
 diff --git a/mt7996/init.c b/mt7996/init.c
-index a1941869..057d20db 100644
+index 211ad40c..1d31e96a 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -886,6 +886,10 @@ void mt7996_rro_hw_init(struct mt7996_dev *dev)
@@ -116,7 +120,7 @@
  		mt76_clear(dev, WF_RRO_AXI_MST_CFG, WF_RRO_AXI_MST_CFG_DIDX_OK);
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 6462c64c..c6816ab5 100644
+index cd139111..2e27e3b3 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -334,6 +334,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
@@ -127,7 +131,7 @@
  #endif
  	hw_aggr = status->aggr;
  	memset(status, 0, sizeof(*status));
-@@ -995,6 +996,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1007,6 +1008,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  		mt7996_packet_log_to_host(dev, txwi, MT_TXD_SIZE, PKT_BIN_DEBUG_TXD, 0);
  	if (dev->dbg.dump_tx_pkt)
  		mt7996_packet_log_to_host(dev, t->skb->data, t->skb->len, PKT_BIN_DEBUG_TX, 0);
@@ -136,10 +140,10 @@
  
  	return 0;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index adfa38dc..d0dac279 100644
+index 00023a5e..e23ed8e7 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -101,6 +101,7 @@
+@@ -103,6 +103,7 @@
  
  #define MT7996_BUILD_TIME_LEN		24
  
@@ -147,7 +151,7 @@
  #define MT7996_RRO_MAX_SESSION		1024
  #define MT7996_RRO_WINDOW_MAX_LEN	1024
  #define MT7996_RRO_ADDR_ELEM_LEN	128
-@@ -688,6 +689,9 @@ struct mt7996_dev {
+@@ -689,6 +690,9 @@ struct mt7996_dev {
  		struct work_struct work;
  		struct list_head poll_list;
  		spinlock_t lock;
@@ -157,7 +161,7 @@
  	} wed_rro;
  
  	bool testmode_enable;
-@@ -744,7 +748,11 @@ struct mt7996_dev {
+@@ -749,7 +753,11 @@ struct mt7996_dev {
  		bool dump_tx_pkt:1;
  		bool dump_rx_pkt:1;
  		bool dump_rx_raw:1;
@@ -169,7 +173,7 @@
  	} dbg;
  	const struct mt7996_dbg_reg_desc *dbg_reg;
  #endif
-@@ -1288,6 +1296,10 @@ enum {
+@@ -1292,6 +1300,10 @@ enum {
  };
  
  void mt7996_packet_log_to_host(struct mt7996_dev *dev, const void *data, int len, int type, int des_len);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0109-mtk-mt76-mt7996-add-linux-tracing-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0109-mtk-mt76-mt7996-add-linux-tracing-support.patch
index f07df34..9705ef9 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0109-mtk-mt76-mt7996-add-linux-tracing-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0109-mtk-mt76-mt7996-add-linux-tracing-support.patch
@@ -1,10 +1,11 @@
-From 41a4b7e9661fa0224080411228744909407d9528 Mon Sep 17 00:00:00 2001
+From 72119323570a647a238c6d3dfb2c07c190e062c4 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 7 Sep 2022 12:13:20 +0800
-Subject: [PATCH 109/195] mtk: mt76: mt7996: add linux tracing support
+Subject: [PATCH 109/223] mtk: mt76: mt7996: add linux tracing support
 
 Add static tracepoint support for besra.
 
+Change-Id: I3209ba360b49c28e49c7cf464ea130aeba993ef7
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  agg-rx.c              |   2 +
@@ -40,7 +41,7 @@
  	if (!tid->started) {
  		if (sn_less)
 diff --git a/mac80211.c b/mac80211.c
-index 0651760f..1ebfed0d 100644
+index a2b111c0..75674462 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -5,6 +5,7 @@
@@ -78,7 +79,7 @@
 -mt7996e-y += mtk_debugfs.o mtk_mcu.o mtk_debugfs_i.o
 +mt7996e-y += mtk_debugfs.o mtk_mcu.o mtk_debugfs_i.o trace.o
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index c6816ab5..6ba07156 100644
+index 2e27e3b3..1c0d3676 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -11,6 +11,7 @@
@@ -98,16 +99,16 @@
  	if (!test_bit(MT76_STATE_RUNNING, &mphy->state))
  		return -EINVAL;
  
-@@ -609,6 +612,8 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
- 	    !(status->flag & RX_FLAG_8023))
- 		mt76_connac3_mac_decode_he_radiotap(skb, rxv, mode);
+@@ -621,6 +624,8 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
+ 		}
+ 	}
  
 +	trace_mt7996_fill_rx_done(phy, status->seqno, hdr_gap);
 +
  	if (!status->wcid || !ieee80211_is_data_qos(fc) || hw_aggr)
  		return 0;
  
-@@ -998,6 +1003,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1010,6 +1015,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  		mt7996_packet_log_to_host(dev, t->skb->data, t->skb->len, PKT_BIN_DEBUG_TX, 0);
  	mt7996_dump_bmac_txd_info(NULL, dev, (__le32 *)txwi, true, false);
  #endif
@@ -116,7 +117,7 @@
  	return 0;
  }
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index fccf43a9..8b889645 100644
+index 956bd396..d1aa19cb 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -10,6 +10,7 @@
@@ -127,7 +128,7 @@
  
  #define fw_name(_dev, name, ...)	({			\
  	char *_fw;						\
-@@ -305,6 +306,9 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+@@ -310,6 +311,9 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
  		else if (cmd & __MCU_CMD_FIELD_WM)
  			uni_txd->s2d_index = MCU_S2D_H2N;
  
@@ -137,7 +138,7 @@
  		goto exit;
  	}
  
-@@ -332,6 +336,8 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+@@ -337,6 +341,8 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
  	else
  		mcu_txd->s2d_index = MCU_S2D_H2N;
  
@@ -146,7 +147,7 @@
  exit:
  #ifdef CONFIG_MTK_DEBUG
  	if (dev->dbg.dump_mcu_pkt)
-@@ -1177,6 +1183,8 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -1182,6 +1188,8 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb)
  {
  	struct mt7996_mcu_rxd *rxd = (struct mt7996_mcu_rxd *)skb->data;
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0110-mtk-mt76-temp-changes-for-SQC-period.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0110-mtk-mt76-temp-changes-for-SQC-period.patch
index 5fdfedf..7d25362 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0110-mtk-mt76-temp-changes-for-SQC-period.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0110-mtk-mt76-temp-changes-for-SQC-period.patch
@@ -1,7 +1,7 @@
-From 5c02274ea31d05411a7206d01fc7d680fa580fd4 Mon Sep 17 00:00:00 2001
+From 1ee4eb8cb63f275f929b3f7aabbdb0df66ed1f2f Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Fri, 9 Jun 2023 14:11:30 +0800
-Subject: [PATCH 110/195] mtk: mt76: temp changes for SQC period
+Subject: [PATCH 110/223] mtk: mt76: temp changes for SQC period
 
 mtk: wifi: mt76: mt7996: For SQC test Disable single sku
 
@@ -17,6 +17,8 @@
 
 mtk: wifi: mt76: mt7996: add SER flow log for debug during the SQC period.
 
+Change-Id: I052e7284b3f6adfa4414e64445fa1f24f92fc8a7
+Change-Id: If68052b181c63d989ce3173bb5b19168e662e540
 Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
 Signed-off-by: mtk27745 <rex.lu@mediatek.com>
 ---
@@ -115,10 +117,10 @@
  
  void mt7996_dma_cleanup(struct mt7996_dev *dev)
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 6ba07156..fc83cea1 100644
+index 1c0d3676..ac61869d 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1980,6 +1980,9 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -1992,6 +1992,9 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	if (phy3)
  		ieee80211_stop_queues(phy3->mt76->hw);
  
@@ -128,7 +130,7 @@
  	set_bit(MT76_RESET, &dev->mphy.state);
  	set_bit(MT76_MCU_RESET, &dev->mphy.state);
  	if (phy2)
-@@ -1989,6 +1992,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2001,6 +2004,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	wake_up(&dev->mt76.mcu.wait);
  
  	mt76_worker_disable(&dev->mt76.tx_worker);
@@ -139,7 +141,7 @@
  	mt76_for_each_q_rx(&dev->mt76, i) {
  		if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
  		    mt76_queue_is_wed_rro(&dev->mt76.q_rx[i]))
-@@ -1998,14 +2005,30 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2010,14 +2017,30 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	}
  	napi_disable(&dev->mt76.tx_napi);
  
@@ -170,7 +172,7 @@
  		mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_INIT);
  		mt7996_wait_reset_state(dev, MT_MCU_CMD_RECOVERY_DONE);
  	}
-@@ -2016,6 +2039,9 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2028,6 +2051,9 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	/* enable DMA Tx/Tx and interrupt */
  	mt7996_dma_start(dev, false, false);
  
@@ -180,7 +182,7 @@
  	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
  		u32 wed_irq_mask = MT_INT_RRO_RX_DONE | MT_INT_TX_DONE_BAND2 |
  				   dev->mt76.mmio.irqmask;
-@@ -2042,6 +2068,9 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2054,6 +2080,9 @@ void mt7996_mac_reset_work(struct work_struct *work)
  				     MT_INT_TX_RX_DONE_EXT);
  	}
  
@@ -191,10 +193,10 @@
  	clear_bit(MT76_RESET, &dev->mphy.state);
  	if (phy2)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 8b889645..1921d3d4 100644
+index d1aa19cb..d56630e9 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3852,11 +3852,11 @@ int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
+@@ -3857,11 +3857,11 @@ int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
  		return ret;
  
  	set_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
@@ -209,10 +211,10 @@
  		return ret;
  
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index c7f5b56e..0820e0d0 100644
+index f9c5b238..0cf48193 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -4298,6 +4298,7 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -4297,6 +4297,7 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  	debugfs_create_file("red", 0200, dir, dev, &fops_red_config);
  	debugfs_create_file("vow_drr_dbg", 0200, dir, dev, &fops_vow_drr_dbg);
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0111-mtk-mt76-mt7996-remain-multiple-wiphy-model-for-test.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0111-mtk-mt76-mt7996-remain-multiple-wiphy-model-for-test.patch
index 83c88d7..4ac10cb 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0111-mtk-mt76-mt7996-remain-multiple-wiphy-model-for-test.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0111-mtk-mt76-mt7996-remain-multiple-wiphy-model-for-test.patch
@@ -1,7 +1,7 @@
-From f1215a598d4dc7184d6b0d4dd6e438680b701e91 Mon Sep 17 00:00:00 2001
+From 2437744f9744acc7ca65d991906a17f7f5d123d5 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 22 Apr 2024 16:49:48 +0800
-Subject: [PATCH 111/195] mtk: mt76: mt7996: remain multiple wiphy model for
+Subject: [PATCH 111/223] mtk: mt76: mt7996: remain multiple wiphy model for
  testmode
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -12,7 +12,7 @@
  3 files changed, 22 insertions(+), 14 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 057d20db..9da12f07 100644
+index 1d31e96a..c5c12ba0 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -795,9 +795,11 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
@@ -43,7 +43,7 @@
  #ifdef CONFIG_MTK_VENDOR
  	mt7996_unregister_csi(phy);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index af975af0..71705ca4 100644
+index 0c5ddda1..0b62858b 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -140,8 +140,8 @@ static int mt7996_start(struct ieee80211_hw *hw)
@@ -57,7 +57,7 @@
  		return -1;
  
  	flush_work(&dev->init_work);
-@@ -158,8 +158,8 @@ static void mt7996_stop(struct ieee80211_hw *hw)
+@@ -158,8 +158,8 @@ static void mt7996_stop(struct ieee80211_hw *hw, bool suspend)
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	int band;
  
@@ -82,10 +82,10 @@
  	mvif->dev = dev;
  	mvif->hw = hw;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index d0dac279..316e87a5 100644
+index e23ed8e7..b8699b65 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -876,16 +876,15 @@ mt7996_get_background_radar_cap(struct mt7996_dev *dev)
+@@ -880,16 +880,15 @@ mt7996_has_background_radar(struct mt7996_dev *dev)
  static inline struct mt7996_phy *
  mt7996_band_phy(struct ieee80211_hw *hw, enum nl80211_band band)
  {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0112-mtk-mt76-mt7996-enable-ibf-capability-for-mt7992.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0112-mtk-mt76-mt7996-enable-ibf-capability-for-mt7992.patch
index 927e6c9..e28f39c 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0112-mtk-mt76-mt7996-enable-ibf-capability-for-mt7992.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0112-mtk-mt76-mt7996-enable-ibf-capability-for-mt7992.patch
@@ -1,22 +1,23 @@
-From 2dbb5ff45f8caa0d792a84587be73052348b7798 Mon Sep 17 00:00:00 2001
+From 349f51f541c02b1a3f72cce4e2f70110a0f39252 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 23 Apr 2024 09:19:25 +0800
-Subject: [PATCH 112/195] mtk: mt76: mt7996: enable ibf capability for mt7992
+Subject: [PATCH 112/223] mtk: mt76: mt7996: enable ibf capability for mt7992
 
 For the specific sku of mt7992, it supports both ibf and ebf
 functionality. The firmware algorithm may decide which type is better
 according to the station's beamform capability.
 
+Change-Id: I4b38ddf5059b5eafd5fc4cacb1add2a6d0ea3836
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
  mt7996/mcu.c | 7 ++++++-
  1 file changed, 6 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 1921d3d4..2de29a9f 100644
+index d56630e9..f9ed473a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2265,6 +2265,8 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -2270,6 +2270,8 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  			struct ieee80211_bss_conf *conf, struct mt7996_bss_conf *mconf,
  			struct ieee80211_link_sta *link_sta)
  {
@@ -25,7 +26,7 @@
  	struct mt7996_phy *phy = mconf->phy;
  	int tx_ant = hweight16(phy->mt76->chainmask) - 1;
  	struct sta_rec_bf *bf;
-@@ -2302,7 +2304,10 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -2307,7 +2309,10 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	else
  		return;
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0113-mtk-mt76-remove-the-limitation-for-legacy-AP-sacn.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0113-mtk-mt76-remove-the-limitation-for-legacy-AP-sacn.patch
index d2b79a7..f991a92 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0113-mtk-mt76-remove-the-limitation-for-legacy-AP-sacn.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0113-mtk-mt76-remove-the-limitation-for-legacy-AP-sacn.patch
@@ -1,7 +1,7 @@
-From 4e7c099a8f378c02d24a567b32555198cf5ccd5f Mon Sep 17 00:00:00 2001
+From da809c32e3531e217dbf22a9c5c372999c4642cb Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Thu, 2 May 2024 15:40:21 +0800
-Subject: [PATCH 113/195] mtk: mt76: remove the limitation for legacy AP sacn
+Subject: [PATCH 113/223] mtk: mt76: remove the limitation for legacy AP sacn
 
 The limitation was used to prevent resource conflict in multiple wiphys
 architecture. It becomes single wiphy and the limitation seems to be
@@ -10,16 +10,17 @@
 Furthermore, legacy APs need to scan due to features like ACS, so remove
 the limitations
 
+Change-Id: I319823e5cf06c9bcce3bb55c6e7b51a5f18b85da
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt7996/mac.c | 7 -------
  1 file changed, 7 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index fc83cea1..bba16975 100644
+index ac61869d..901c70e5 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2968,13 +2968,6 @@ void mt7996_scan_work(struct work_struct *work)
+@@ -2980,13 +2980,6 @@ void mt7996_scan_work(struct work_struct *work)
  	bool has_sta = false, active_scan = false;
  
  	mutex_lock(&phy->dev->mt76.mutex);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0114-mtk-mt76-add-support-for-get_survey-in-single-wiphy-.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0114-mtk-mt76-add-support-for-get_survey-in-single-wiphy-.patch
index 3475566..02216b8 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0114-mtk-mt76-add-support-for-get_survey-in-single-wiphy-.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0114-mtk-mt76-add-support-for-get_survey-in-single-wiphy-.patch
@@ -1,7 +1,7 @@
-From 10c2fcb00dfda8e26074d487a725cd00605ab1d1 Mon Sep 17 00:00:00 2001
+From be22e24f74bc54660f8034e345dfadcae73b2101 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Thu, 2 May 2024 15:22:22 +0800
-Subject: [PATCH 114/195] mtk: mt76: add support for get_survey in single wiphy
+Subject: [PATCH 114/223] mtk: mt76: add support for get_survey in single wiphy
  architecture
 
 ---
@@ -9,7 +9,7 @@
  1 file changed, 35 insertions(+), 10 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 1ebfed0d..8dcf4f06 100644
+index 75674462..f986d5fd 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -937,19 +937,44 @@ int mt76_get_survey(struct ieee80211_hw *hw, int idx,
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0115-mtk-mt76-mt7996-add-critical-update-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0115-mtk-mt76-mt7996-add-critical-update-support.patch
index f157abb..397fde1 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0115-mtk-mt76-mt7996-add-critical-update-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0115-mtk-mt76-mt7996-add-critical-update-support.patch
@@ -1,7 +1,7 @@
-From cb1179a4d2e81331cc202df0226a02c6081f0b9c Mon Sep 17 00:00:00 2001
+From d4e9a9535f8f51d6a4adabee9efc1a61b0798490 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 23 Apr 2024 15:22:24 +0800
-Subject: [PATCH 115/195] mtk: mt76: mt7996: add critical update support
+Subject: [PATCH 115/223] mtk: mt76: mt7996: add critical update support
 
 Add critical update support
 modification: wmm configuration
@@ -17,6 +17,8 @@
 Also, modify the bpcc check since channel switch will add the bpcc twice
 (before CSA and after CSA).
 
+Change-Id: Ibf92803d444ad672dd235f3584eec25a385082f4
+Change-Id: Id6ecd3de03bee0c2f412dd4dd1a57783c5d65fcf
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -28,10 +30,10 @@
  5 files changed, 208 insertions(+), 30 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 36d126ae..70c2c6d7 100644
+index 86a2fdf8..0a4bf9b7 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1380,6 +1380,8 @@ enum {
+@@ -1385,6 +1385,8 @@ enum {
  	UNI_BSS_INFO_OFFLOAD = 25,
  	UNI_BSS_INFO_MLD = 26,
  	UNI_BSS_INFO_PM_DISABLE = 27,
@@ -41,7 +43,7 @@
  
  enum {
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 71705ca4..2159e1bf 100644
+index 0b62858b..9a265710 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -370,6 +370,7 @@ static int mt7996_add_bss_conf(struct mt7996_phy *phy,
@@ -193,10 +195,10 @@
  
  static int
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 2de29a9f..10c54608 100644
+index f9ed473a..ea399a0b 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -370,6 +370,7 @@ mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
+@@ -375,6 +375,7 @@ mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  	struct mt76_phy *mphy = (struct mt76_phy *)priv;
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct ieee80211_bss_conf *link_conf;
@@ -204,7 +206,7 @@
  	int link_id, band_idx = mphy->band_idx;
  
  	link_id = mvif->band_to_link[band_idx];
-@@ -378,7 +379,16 @@ mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
+@@ -383,7 +384,16 @@ mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  	if (!link_conf || !link_conf->csa_active || vif->type == NL80211_IFTYPE_STATION)
  		return;
  
@@ -221,7 +223,7 @@
  }
  
  static void
-@@ -3237,6 +3247,93 @@ mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
+@@ -3242,6 +3252,93 @@ mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
  	}
  }
  
@@ -315,7 +317,7 @@
  static void
  mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  		       struct sk_buff *rskb, struct sk_buff *skb,
-@@ -3317,6 +3414,8 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+@@ -3322,6 +3419,8 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  	mt7996_mcu_beacon_cont(dev, conf, rskb, skb, bcn, &offs);
  	mt7996_mcu_beacon_mbss(rskb, skb, conf, bcn, &offs);
  	mt7996_mcu_beacon_cntdwn(conf, rskb, skb, &offs);
@@ -369,10 +371,10 @@
  					 MT7996_BEACON_UPDATE_SIZE)
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 316e87a5..65d6a526 100644
+index b8699b65..4815cf7b 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -351,6 +351,7 @@ struct mt7996_bss_conf {
+@@ -352,6 +352,7 @@ struct mt7996_bss_conf {
  
  	u8 link_id;
  	u8 own_mld_id;
@@ -380,7 +382,7 @@
  };
  
  struct mt7996_vif {
-@@ -365,6 +366,9 @@ struct mt7996_vif {
+@@ -366,6 +367,9 @@ struct mt7996_vif {
  	u8 group_mld_id;
  	u8 mld_remap_id;
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0116-mtk-mt76-mt7996-Add-support-for-EMLSR.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0116-mtk-mt76-mt7996-Add-support-for-EMLSR.patch
index cf07cac..d3ced0b 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0116-mtk-mt76-mt7996-Add-support-for-EMLSR.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0116-mtk-mt76-mt7996-Add-support-for-EMLSR.patch
@@ -1,12 +1,13 @@
-From b8d5e5dc43fbefe1a6d537cc174ab1881b8415d8 Mon Sep 17 00:00:00 2001
+From 05cc12c0f48dae0a560f1eca2ad2a49f80f614bf Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 Date: Tue, 7 May 2024 15:47:23 +0800
-Subject: [PATCH 116/195] mtk: mt76: mt7996: Add support for EMLSR
+Subject: [PATCH 116/223] mtk: mt76: mt7996: Add support for EMLSR
 
 1. Register the EMLSR capability
 2. Set the EML capability of the station to firmware
 3. Process the EML Operating Mode Notification frame
 
+Change-Id: I0584c29abcc1956ae17f481639744ee8252e8adb
 Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 ---
  mt76_connac_mcu.h |  8 ++++++
@@ -18,10 +19,10 @@
  6 files changed, 166 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 70c2c6d7..07811d63 100644
+index 0a4bf9b7..2daa09cc 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -624,6 +624,13 @@ struct sta_rec_tx_proc {
+@@ -629,6 +629,13 @@ struct sta_rec_tx_proc {
  	__le32 flag;
  } __packed;
  
@@ -35,7 +36,7 @@
  /* wtbl_rec */
  
  struct wtbl_req_hdr {
-@@ -828,6 +835,7 @@ enum {
+@@ -833,6 +840,7 @@ enum {
  	STA_REC_PN_INFO = 0x26,
  	STA_REC_KEY_V3 = 0x27,
  	STA_REC_HDRT = 0x28,
@@ -44,7 +45,7 @@
  	STA_REC_TX_CAP = 0x2f,
  	STA_REC_MAX_NUM
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 9da12f07..2e624def 100644
+index c5c12ba0..c8eb7523 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -64,6 +64,7 @@ static const struct wiphy_iftype_ext_capab mt7996_iftypes_ext_capa[] = {
@@ -56,10 +57,10 @@
  		/* the max number of simultaneous links is defined as the
  		 * maximum number of affiliated APs minus 1.
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 10c54608..b1f5499e 100644
+index ea399a0b..76f0bb7e 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2921,9 +2921,10 @@ mt7996_mcu_sta_eht_mld_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -2926,9 +2926,10 @@ mt7996_mcu_sta_eht_mld_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  
  	for (i = 0; i < ARRAY_SIZE(eht_mld->str_cap); i++)
  		eht_mld->str_cap[i] = 0x7;
@@ -71,7 +72,7 @@
  	*/
  }
  
-@@ -6329,6 +6330,63 @@ int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy)
+@@ -6352,6 +6353,63 @@ int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy)
  	                         &req, sizeof(req), true);
  }
  
@@ -136,10 +137,10 @@
  void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 65d6a526..6150816d 100644
+index 4815cf7b..94121471 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -410,6 +410,23 @@ enum {
+@@ -411,6 +411,23 @@ enum {
  	SCS_ENABLE,
  };
  
@@ -163,7 +164,7 @@
  struct mt7996_wed_rro_addr {
  	u32 head_low;
  	u32 head_high : 4;
-@@ -1226,6 +1243,8 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
+@@ -1230,6 +1247,8 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
  				     struct mt7996_link_sta *mlink);
  int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode);
  int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0117-mtk-mt76-mt7996-add-max-mpdu-len-capability.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0117-mtk-mt76-mt7996-add-max-mpdu-len-capability.patch
index d6dc5a9..120d25a 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0117-mtk-mt76-mt7996-add-max-mpdu-len-capability.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0117-mtk-mt76-mt7996-add-max-mpdu-len-capability.patch
@@ -1,21 +1,22 @@
-From 11f6f78a9dbd26fed668feca484c3221930451a9 Mon Sep 17 00:00:00 2001
+From ce78d5c76700d61fa752c2ac34e53c87ed88f37d Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 9 May 2024 11:16:10 +0800
-Subject: [PATCH 117/195] mtk: mt76: mt7996: add max mpdu len capability
+Subject: [PATCH 117/223] mtk: mt76: mt7996: add max mpdu len capability
 
 Set max mpdu len to 11454 according to hardware capability.
 Without this patch, the max ampdu length would be 3895 and hurt performance.
 
+Change-Id: I78048302f18280078c7024b7670277fefe4e5165
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/init.c | 4 +++-
  1 file changed, 3 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 2e624def..6e20a174 100644
+index c8eb7523..e674361a 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -1519,7 +1519,9 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
+@@ -1539,7 +1539,9 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
  
  	eht_cap_elem->mac_cap_info[0] =
  		IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0118-mtk-mt76-mt7996-add-correct-bss_conf-for-legacy-AP-s.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0118-mtk-mt76-mt7996-add-correct-bss_conf-for-legacy-AP-s.patch
index 4725c18..86ada93 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0118-mtk-mt76-mt7996-add-correct-bss_conf-for-legacy-AP-s.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0118-mtk-mt76-mt7996-add-correct-bss_conf-for-legacy-AP-s.patch
@@ -1,7 +1,7 @@
-From 3ce46676d88687155a41f698d96a44ee5f59a614 Mon Sep 17 00:00:00 2001
+From c8d1e3084599c7dbd74dd8408d0786e09851f177 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Fri, 10 May 2024 13:35:56 +0800
-Subject: [PATCH 118/195] mtk: mt76: mt7996: add correct bss_conf for legacy AP
+Subject: [PATCH 118/223] mtk: mt76: mt7996: add correct bss_conf for legacy AP
  scan
 
 If the legacy AP interface is added but not yet started, its bss_conf
@@ -20,13 +20,15 @@
 removed. And if the bss_conf is not exist, or it just be removed, it's
 added and assigned to the scanning phy.
 
+Change-Id: I34ebdbfeabe6aa5c4068de55d7f1eb8e549c0505
+Change-Id: I10bbb34a87f828e43459501709ac6473c920f49f
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt7996/main.c | 21 +++++++++++++--------
  1 file changed, 13 insertions(+), 8 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 2159e1bf..0c2b3f41 100644
+index 9a265710..2b16385d 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -2367,15 +2367,20 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0119-mtk-mt76-mt7996-fix-set-beacon-mcu-command.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0119-mtk-mt76-mt7996-fix-set-beacon-mcu-command.patch
index d89ac66..1b39d7f 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0119-mtk-mt76-mt7996-fix-set-beacon-mcu-command.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0119-mtk-mt76-mt7996-fix-set-beacon-mcu-command.patch
@@ -1,7 +1,7 @@
-From e7bab0b5a81c2f11cbe630460a189c43f932f01c Mon Sep 17 00:00:00 2001
+From 50cf21c286aa55676fa5a341781c5e72aa4758f5 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Tue, 14 May 2024 10:52:43 +0800
-Subject: [PATCH 119/195] mtk: mt76: mt7996: fix set beacon mcu command
+Subject: [PATCH 119/223] mtk: mt76: mt7996: fix set beacon mcu command
 
 When stopping AP, mac80211 frees beacon template before it calls
 driver's stop_ap operation. In other words, on the path of stopping
@@ -12,16 +12,17 @@
 This commit refactors mt7996_mcu_add_beacon() so that FW can be
 correctly informed when disabling AP interface.
 
+Change-Id: I7a381f959e50579266aa1fa4c2a3f9a907f4318e
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt7996/mcu.c | 26 +++++++++++++++-----------
  1 file changed, 15 insertions(+), 11 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index b1f5499e..2d1d7555 100644
+index 76f0bb7e..1dcc367e 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3379,7 +3379,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+@@ -3384,7 +3384,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  	struct sk_buff *skb, *rskb;
  	struct tlv *tlv;
  	struct bss_bcn_content_tlv *bcn;
@@ -30,7 +31,7 @@
  
  	if (conf->nontransmitted)
  		return 0;
-@@ -3390,28 +3390,32 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+@@ -3395,28 +3395,32 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  		return PTR_ERR(rskb);
  
  	skb = ieee80211_beacon_get_template(hw, conf->vif, &offs, conf->link_id);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0120-mtk-mt76-fix-incorrect-setting-of-antenna-capability.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0120-mtk-mt76-fix-incorrect-setting-of-antenna-capability.patch
index b269401..a46553e 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0120-mtk-mt76-fix-incorrect-setting-of-antenna-capability.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0120-mtk-mt76-fix-incorrect-setting-of-antenna-capability.patch
@@ -1,20 +1,21 @@
-From 5235fc0652ceff4ec0512e695bb674402ebf3f85 Mon Sep 17 00:00:00 2001
+From 6c2e3e0211da74d06132593d9783e0f62179ee81 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Tue, 14 May 2024 14:12:28 +0800
-Subject: [PATCH 120/195] mtk: mt76: fix incorrect setting of antenna
+Subject: [PATCH 120/223] mtk: mt76: fix incorrect setting of antenna
  capability
 
 Due to current implementation of single-wiphy architecture, only one antenna capability can be set for all PHYs via mt7996_set_antenna().
 Therefore, if antenna capabilities of PHYs are different, some may be set wrong.
 Thus, temporarily make mt7996_set_antenna() dummy.
 
+Change-Id: Ib41f767daf7ff42423bb6e5ec6c5c8c213fba714
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt7996/main.c | 4 ++++
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 0c2b3f41..071227c6 100644
+index 2b16385d..3a85b025 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1674,6 +1674,10 @@ mt7996_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0121-mtk-mt76-mt7996-fix-stop_tx_ba_session-warning.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0121-mtk-mt76-mt7996-fix-stop_tx_ba_session-warning.patch
index f5a0192..c1f4116 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0121-mtk-mt76-mt7996-fix-stop_tx_ba_session-warning.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0121-mtk-mt76-mt7996-fix-stop_tx_ba_session-warning.patch
@@ -1,7 +1,7 @@
-From 2b2b0ec0d5869c11c14b89d81ba00cada60a443d Mon Sep 17 00:00:00 2001
+From 6ae2f546b249738b3c1f3ad573dd2ce4d2020558 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 15 May 2024 11:10:17 +0800
-Subject: [PATCH 121/195] mtk: mt76: mt7996: fix stop_tx_ba_session warning
+Subject: [PATCH 121/223] mtk: mt76: mt7996: fix stop_tx_ba_session warning
 
 ---
  mt7996/main.c | 11 +++++++----
@@ -9,7 +9,7 @@
  2 files changed, 13 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 071227c6..6889085d 100644
+index 3a85b025..3f93eda0 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1079,7 +1079,8 @@ static void mt7996_remove_link_sta(struct mt7996_dev *dev,
@@ -53,10 +53,10 @@
  }
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 2d1d7555..443ffc28 100644
+index 1dcc367e..d9d29c4e 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1735,6 +1735,9 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
+@@ -1740,6 +1740,9 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  			mconf_dereference_protected(msta->vif, link_id);
  		int ret;
  
@@ -66,7 +66,7 @@
  		if (enable && !params->amsdu)
  			mlink->wcid.amsdu = false;
  
-@@ -1769,6 +1772,9 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
+@@ -1774,6 +1777,9 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
  			mconf_dereference_protected(msta->vif, link_id);
  		int ret;
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0122-mtk-mt76-mt7996-do-software-link-addr-translation-fo.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0122-mtk-mt76-mt7996-do-software-link-addr-translation-fo.patch
index 3d047fb..b0c0f55 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0122-mtk-mt76-mt7996-do-software-link-addr-translation-fo.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0122-mtk-mt76-mt7996-do-software-link-addr-translation-fo.patch
@@ -1,7 +1,7 @@
-From 7183414aabb25db08454cc77776398afcfa09219 Mon Sep 17 00:00:00 2001
+From a6b712a367b0e76ac5982f846f096ab936138c16 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 15 May 2024 17:47:33 +0800
-Subject: [PATCH 122/195] mtk: mt76: mt7996: do software link addr translation
+Subject: [PATCH 122/223] mtk: mt76: mt7996: do software link addr translation
  for EAPOL
 
 Previously, we do HW link address translation for EAPOL addr1 and addr2,
@@ -17,6 +17,8 @@
 
 Assign EAPOL's SA/DA to MLD address.
 
+Change-Id: Ibb63beb37f80075da8c0e1535fde74f9710f92f5
+Change-Id: I307146d0f88ecca0f0ea592b9157b6a7e8009fbb
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
@@ -25,10 +27,10 @@
  1 file changed, 31 insertions(+), 15 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index bba16975..020203ec 100644
+index 901c70e5..02045b84 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -831,7 +831,8 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+@@ -843,7 +843,8 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
  	txwi[5] = cpu_to_le32(val);
  
  	val = MT_TXD6_DAS;
@@ -38,7 +40,7 @@
  		val |= MT_TXD6_DIS_MAT;
  
  	if (is_mt7996(&dev->mt76))
-@@ -939,23 +940,38 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -951,23 +952,38 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key,
  				      pid, qid, 0);
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0123-mtk-mt76-mt7996-add-per-band-debugfs-folder.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0123-mtk-mt76-mt7996-add-per-band-debugfs-folder.patch
index 5ccf92e..933099c 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0123-mtk-mt76-mt7996-add-per-band-debugfs-folder.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0123-mtk-mt76-mt7996-add-per-band-debugfs-folder.patch
@@ -1,10 +1,11 @@
-From a169a549cb048d2915df5ee683506b3c7bac840e Mon Sep 17 00:00:00 2001
+From bfbeab14fc5c4a9caab56873328caee7fb407721 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 16 May 2024 18:03:19 +0800
-Subject: [PATCH 123/195] mtk: mt76: mt7996: add per-band debugfs folder
+Subject: [PATCH 123/223] mtk: mt76: mt7996: add per-band debugfs folder
 
 Add per-band debugfs folder and  move upstream debugfs knob to it.
 
+Change-Id: I4bafff017c6d1264cffab18a5ac6748cc0661c8f
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/debugfs.c | 43 +++++++++++++++++++++++++++++++------------
@@ -13,7 +14,7 @@
  3 files changed, 42 insertions(+), 18 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 2c553cf3..9d74f659 100644
+index 7e545f61..d2b38efb 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -1073,21 +1073,49 @@ mt7996_airtime_read(struct seq_file *s, void *data)
@@ -89,7 +90,7 @@
  			    &fops_fw_debug_muru_disable);
  
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 6e20a174..01795404 100644
+index e674361a..9a2e51f8 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -787,7 +787,7 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
@@ -101,7 +102,7 @@
  	if (ret)
  		goto error;
  
-@@ -1708,6 +1708,14 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1728,6 +1728,14 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -116,7 +117,7 @@
  	ret = mt7996_register_phy(dev, mt7996_phy2(dev), MT_BAND1);
  	if (ret)
  		return ret;
-@@ -1732,10 +1740,6 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1752,10 +1760,6 @@ int mt7996_register_device(struct mt7996_dev *dev)
  			goto error;
  	}
  
@@ -128,10 +129,10 @@
  	if (ret)
  		goto error;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 6150816d..4c898486 100644
+index 94121471..ef41beee 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1226,7 +1226,8 @@ int mt7996_dfs_init_radar_detector(struct mt7996_phy *phy);
+@@ -1230,7 +1230,8 @@ int mt7996_dfs_init_radar_detector(struct mt7996_phy *phy);
  void mt7996_set_stream_he_eht_caps(struct mt7996_phy *phy);
  void mt7996_set_stream_vht_txbf_caps(struct mt7996_phy *phy);
  void mt7996_update_channel(struct mt76_phy *mphy);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0124-mtk-mt76-mt7996-move-internal-debugfs-knob-to-per-ba.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0124-mtk-mt76-mt7996-move-internal-debugfs-knob-to-per-ba.patch
index a5ca1fb..0af54d5 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0124-mtk-mt76-mt7996-move-internal-debugfs-knob-to-per-ba.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0124-mtk-mt76-mt7996-move-internal-debugfs-knob-to-per-ba.patch
@@ -1,9 +1,10 @@
-From 165ee7b202aa4062ef0602ad97b7ad348a58e036 Mon Sep 17 00:00:00 2001
+From 4a9412a2376d1a0c1c642cc2dea242b059a7463d Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 16 May 2024 18:04:28 +0800
-Subject: [PATCH 124/195] mtk: mt76: mt7996: move internal debugfs knob to
+Subject: [PATCH 124/223] mtk: mt76: mt7996: move internal debugfs knob to
  per-band folder
 
+Change-Id: I03efc222cd57035aa089babbc94c70e807494763
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/debugfs.c     |   5 +-
@@ -12,7 +13,7 @@
  3 files changed, 44 insertions(+), 81 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 9d74f659..71dc0449 100644
+index d2b38efb..9a62dfda 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -1105,6 +1105,9 @@ int mt7996_init_band_debugfs(struct mt7996_phy *phy)
@@ -35,10 +36,10 @@
  
  	return 0;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 4c898486..e8f970f6 100644
+index ef41beee..21be14d0 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1286,7 +1286,8 @@ enum edcca_bw_id {
+@@ -1290,7 +1290,8 @@ enum edcca_bw_id {
  };
  
  #ifdef CONFIG_MTK_DEBUG
@@ -49,7 +50,7 @@
  int mt7996_mcu_set_sr_enable(struct mt7996_phy *phy, u8 action, u64 val, bool set);
  void mt7996_mcu_rx_sr_event(struct mt7996_dev *dev, struct sk_buff *skb);
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 0820e0d0..59c6db73 100644
+index 0cf48193..06fa83bb 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -14,13 +14,14 @@
@@ -96,7 +97,7 @@
  
  /* AMSDU INFO */
  static int mt7996_amsdu_result_read(struct seq_file *s, void *data)
-@@ -704,10 +688,12 @@ static int mt7996_trinfo_read(struct seq_file *s, void *data)
+@@ -703,10 +687,12 @@ static int mt7996_trinfo_read(struct seq_file *s, void *data)
  }
  
  /* MIB INFO */
@@ -111,7 +112,7 @@
  	u8 bss_nums = BSS_NUM;
  	u32 idx;
  	u32 mac_val, band_offset = 0, band_offset_umib = 0;
-@@ -920,24 +906,7 @@ static int mt7996_mibinfo_read_per_band(struct seq_file *s, int band_idx)
+@@ -919,24 +905,7 @@ static int mt7996_mibinfo_read_per_band(struct seq_file *s, int band_idx)
  
  	return 0;
  }
@@ -137,7 +138,7 @@
  
  /* WTBL INFO */
  static int
-@@ -3036,9 +3005,9 @@ static const struct file_operations fops_muru_fixed_group_rate = {
+@@ -3035,9 +3004,9 @@ static const struct file_operations fops_muru_fixed_group_rate = {
  
  static int mt7996_muru_prot_thr_set(void *data, u64 val)
  {
@@ -149,7 +150,7 @@
  }
  
  DEFINE_DEBUGFS_ATTRIBUTE(fops_muru_prot_thr, NULL,
-@@ -4219,9 +4188,32 @@ mt7996_drr_info(struct seq_file *s, void *data)
+@@ -4218,9 +4187,32 @@ mt7996_drr_info(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -184,7 +185,7 @@
  	u32 device_id = (dev->mt76.rev) >> 16;
  	int i = 0;
  	static const struct mt7996_dbg_reg_desc dbg_reg_s[] = {
-@@ -4246,13 +4238,6 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -4245,13 +4237,6 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  		WTBL_LMAC_DW9 = WTBL_LMAC_DW9_7992;
  	}
  
@@ -198,7 +199,7 @@
  	/* amsdu */
  	debugfs_create_devm_seqfile(dev->mt76.dev, "amsdu_info", dir,
  				    mt7996_amsdu_result_read);
-@@ -4270,24 +4255,12 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -4269,24 +4254,12 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  	debugfs_create_devm_seqfile(dev->mt76.dev, "fw_wm_info", dir,
  				    mt7996_fw_wm_info_read);
  
@@ -223,7 +224,7 @@
  	debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
  				    mt7996_show_eeprom_mode);
  
-@@ -4300,23 +4273,12 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -4299,23 +4272,12 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  
  	dev->dbg.sku_disable = true; /* For SQC */
  	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
@@ -248,7 +249,7 @@
  
  	if (dev->has_rro) {
  		debugfs_create_u32("rro_sid", 0600, dir, &dev->dbg.sid);
-@@ -4326,7 +4288,6 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -4325,7 +4287,6 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  					    mt7996_show_rro_mib);
  	}
  
@@ -256,7 +257,7 @@
  	debugfs_create_file("thermal_recal", 0200, dir, dev, &fops_thermal_recal);
  	debugfs_create_file("reset_counter", 0200, dir, dev, &fops_reset_counter);
  
-@@ -4346,8 +4307,6 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -4345,8 +4306,6 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  	debugfs_create_file("amsdu_para", 0600, dir, dev, &fops_amsdu_para);
  	debugfs_create_devm_seqfile(dev->mt76.dev, "hw_amsdu_info", dir,
  	                            mt7996_hw_amsdu_info_read);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0125-mtk-mt76-mt7996-refactor-amsdu-debugfs.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0125-mtk-mt76-mt7996-refactor-amsdu-debugfs.patch
index de09207..5670dc8 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0125-mtk-mt76-mt7996-refactor-amsdu-debugfs.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0125-mtk-mt76-mt7996-refactor-amsdu-debugfs.patch
@@ -1,7 +1,7 @@
-From dddf544dc31a7960dfa0ed93c2f06ecf61d356c5 Mon Sep 17 00:00:00 2001
+From e7b50308230e874028c65233d5e2f7a7d1ad6479 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 17 May 2024 17:34:03 +0800
-Subject: [PATCH 125/195] mtk: mt76: mt7996: refactor amsdu debugfs
+Subject: [PATCH 125/223] mtk: mt76: mt7996: refactor amsdu debugfs
 
 1. Remove hw_amsdu_info which is duplicated with amsdu_info.
 
@@ -9,13 +9,14 @@
    If amsdu_info read CR directly, the CR would be cleared and the
    mt7996_mac_work cannot get correct value.
 
+Change-Id: Ie83e861f32fa7ede075916f2393df51e39bebbad
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/mtk_debugfs.c | 63 ++++++++++++++++----------------------------
  1 file changed, 22 insertions(+), 41 deletions(-)
 
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 59c6db73..a7cbde3e 100644
+index 06fa83bb..9d8c1942 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -210,28 +210,35 @@ DEFINE_SHOW_ATTRIBUTE(mt7996_agginfo);
@@ -69,7 +70,7 @@
  	return 0;
  }
  
-@@ -3342,30 +3349,6 @@ static const struct file_operations fops_amsdu_para = {
+@@ -3341,30 +3348,6 @@ static const struct file_operations fops_amsdu_para = {
  	.llseek = default_llseek,
  };
  
@@ -100,7 +101,7 @@
  /* PSE INFO */
  static struct bmac_queue_info_t pse_queue_empty_info[] = {
  	{"CPU Q0",  ENUM_UMAC_CPU_PORT_1,     ENUM_UMAC_CTX_Q_0},
-@@ -4305,8 +4288,6 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
+@@ -4304,8 +4287,6 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
  	/* amsdu */
  	debugfs_create_file("amsdu_algo", 0600, dir, dev, &fops_amsdu_algo);
  	debugfs_create_file("amsdu_para", 0600, dir, dev, &fops_amsdu_para);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0126-mtk-mt76-mt7996-trigger-channel-calibration-for-DFS-.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0126-mtk-mt76-mt7996-trigger-channel-calibration-for-DFS-.patch
index 629b707..11e2f62 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0126-mtk-mt76-mt7996-trigger-channel-calibration-for-DFS-.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0126-mtk-mt76-mt7996-trigger-channel-calibration-for-DFS-.patch
@@ -1,13 +1,14 @@
-From 40a89e1294c2d8d4eebd2ee580643ae240ff9178 Mon Sep 17 00:00:00 2001
+From 799a94c158a9c9df4586f8efec1cf586a7ad29d9 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 17 May 2024 14:49:50 +0800
-Subject: [PATCH 126/195] mtk: mt76: mt7996: trigger channel calibration for
+Subject: [PATCH 126/223] mtk: mt76: mt7996: trigger channel calibration for
  DFS link after sta is associated
 
 Trigger channel calibration (set channel with switch reason = NORMAL)
 for DFS link after STA is associated.
 Without this patch, 5G link might have high PER during T.P. test
 
+Change-Id: I65ed79767049f4fdd31ac95a93496d1ccdc39699
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mt7996/main.c     | 15 +++++++++++----
@@ -17,7 +18,7 @@
  4 files changed, 18 insertions(+), 10 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 6889085d..3fb43606 100644
+index 3f93eda0..f45f6c02 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -82,12 +82,12 @@ int mt7996_run(struct ieee80211_hw *hw)
@@ -64,10 +65,10 @@
  
  			ieee80211_queue_delayed_work(hw, &mvif->beacon_mon_work,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 443ffc28..55ee7348 100644
+index d9d29c4e..a6f2c157 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4400,7 +4400,7 @@ int mt7996_mcu_rdd_background_enable(struct mt7996_phy *phy,
+@@ -4405,7 +4405,7 @@ int mt7996_mcu_rdd_background_enable(struct mt7996_phy *phy,
  				  0, region);
  }
  
@@ -76,7 +77,7 @@
  {
  	static const u8 ch_band[] = {
  		[NL80211_BAND_2GHZ] = 0,
-@@ -4411,6 +4411,8 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
+@@ -4416,6 +4416,8 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
  	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
  	int freq1 = chandef->center_freq1;
  	u8 band_idx = phy->mt76->band_idx;
@@ -85,7 +86,7 @@
  	struct {
  		/* fixed field */
  		u8 __rsv[4];
-@@ -4451,8 +4453,7 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
+@@ -4456,8 +4458,7 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
  		 phy->mt76->hw->conf.flags & IEEE80211_CONF_IDLE ||
  		 phy->scan_chan)
  		req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
@@ -96,10 +97,10 @@
  	else
  		req.switch_reason = CH_SWITCH_NORMAL;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index e8f970f6..3d1eb84a 100644
+index 21be14d0..07c72d2b 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1054,7 +1054,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+@@ -1058,7 +1058,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  int mt7996_mcu_add_mld_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  			   struct ieee80211_sta *sta, unsigned long add);
  int mt7996_set_channel(struct mt7996_phy *phy, struct cfg80211_chan_def *chandef);
@@ -109,10 +110,10 @@
  int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
  				   void *data, u16 version);
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 0565ebc9..8b35d125 100644
+index 799e443c..c68619cb 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -544,7 +544,7 @@ mt7996_tm_dpd_prek_send_req(struct mt7996_phy *phy, struct mt7996_tm_req *req,
+@@ -550,7 +550,7 @@ mt7996_tm_dpd_prek_send_req(struct mt7996_phy *phy, struct mt7996_tm_req *req,
  
  		/* set channel switch reason */
  		mphy->hw->conf.flags |= IEEE80211_CONF_OFFCHANNEL;
@@ -121,7 +122,7 @@
  
  		ret = mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(TESTMODE_CTRL), req,
  					sizeof(*req), false);
-@@ -558,7 +558,7 @@ out:
+@@ -564,7 +564,7 @@ out:
  	mphy->hw->conf.flags &= ~IEEE80211_CONF_OFFCHANNEL;
  	memcpy(chandef, &chandef_backup, sizeof(struct cfg80211_chan_def));
  	memcpy(chandef->chan, &chan_backup, sizeof(struct ieee80211_channel));
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0127-mtk-mt76-mt7996-do-not-remove-bss_info-and-starec-wh.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0127-mtk-mt76-mt7996-do-not-remove-bss_info-and-starec-wh.patch
index 4064012..acef98c 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0127-mtk-mt76-mt7996-do-not-remove-bss_info-and-starec-wh.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0127-mtk-mt76-mt7996-do-not-remove-bss_info-and-starec-wh.patch
@@ -1,7 +1,7 @@
-From f4e81ab46a04b48b55db92ab8c21f1eec32fa581 Mon Sep 17 00:00:00 2001
+From ebc64cf0ebe700231a5b94b299abb49b8db88308 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 22 May 2024 18:22:51 +0800
-Subject: [PATCH 127/195] mtk: mt76: mt7996: do not remove bss_info and starec
+Subject: [PATCH 127/223] mtk: mt76: mt7996: do not remove bss_info and starec
  when assign_vif_chanctx
 
 When STA interface re-connect from rootAP, it would unsign/assign vif
@@ -10,13 +10,14 @@
 be cleared. But the hostapd does not remove interface so it would not
 set key again.
 
+Change-Id: Icdd599f163268e7f313589f0ca35a2f220e2b783
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/main.c | 17 +++++++++++++----
  1 file changed, 13 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 3fb43606..8fcb550c 100644
+index f45f6c02..be0864a0 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -338,6 +338,9 @@ static int mt7996_add_bss_conf(struct mt7996_phy *phy,
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0128-mtk-mt76-mt7996-remove-chanctx-in-mt7996_bss_conf.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0128-mtk-mt76-mt7996-remove-chanctx-in-mt7996_bss_conf.patch
index 8d46e3e..30d4ef1 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0128-mtk-mt76-mt7996-remove-chanctx-in-mt7996_bss_conf.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0128-mtk-mt76-mt7996-remove-chanctx-in-mt7996_bss_conf.patch
@@ -1,12 +1,13 @@
-From 3912ce59f38df518d8c4f07f9e4ab0e836b48505 Mon Sep 17 00:00:00 2001
+From 279a649bea9faaab320a88c2dfeedd83668d059c Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 28 May 2024 09:33:11 +0800
-Subject: [PATCH 128/195] mtk: mt76: mt7996: remove chanctx in mt7996_bss_conf
+Subject: [PATCH 128/223] mtk: mt76: mt7996: remove chanctx in mt7996_bss_conf
 
 Different vif under the same phy cannot use different chanctx.
 So it is better to maintain the chanctx in mt7996_phy.
 Instead of mconf->chanctx, get the chanctx by mconf->phy->chanctx.
 
+Change-Id: Ic66dbd007a7c7b5832161197e695d5c0e1dba522
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/main.c   | 8 +-------
@@ -14,7 +15,7 @@
  2 files changed, 1 insertion(+), 9 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 8fcb550c..b45f63f6 100644
+index be0864a0..2b272cc4 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -2540,8 +2540,6 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -54,10 +55,10 @@
  					mt7996_mcu_set_chan_info(phy, UNI_CHANNEL_SWITCH,
  								 true);
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 3d1eb84a..eba48c10 100644
+index 07c72d2b..9f58a793 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -347,8 +347,6 @@ struct mt7996_bss_conf {
+@@ -348,8 +348,6 @@ struct mt7996_bss_conf {
  	struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS];
  	struct cfg80211_bitrate_mask bitrate_mask;
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0129-mtk-mt76-mt7996-temporarily-disable-EPCS.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0129-mtk-mt76-mt7996-temporarily-disable-EPCS.patch
index 1bc804b..1697db6 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0129-mtk-mt76-mt7996-temporarily-disable-EPCS.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0129-mtk-mt76-mt7996-temporarily-disable-EPCS.patch
@@ -1,20 +1,21 @@
-From fde0f927b3fbda642696071b4a6bc5804ba45bae Mon Sep 17 00:00:00 2001
+From b10446fafd8688cdcfc358bd7a293cb3cc69aa6c Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Tue, 28 May 2024 15:58:57 +0800
-Subject: [PATCH 129/195] mtk: mt76: mt7996: temporarily disable EPCS
+Subject: [PATCH 129/223] mtk: mt76: mt7996: temporarily disable EPCS
 
 EPCS is not yet ready, so do not claim to support it.
 
+Change-Id: I2b3f9d87b1f3de17da178b9b6eddeaecdb5c14cd
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt7996/init.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 01795404..7cf3a37e 100644
+index 9a2e51f8..32c79bd8 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -1518,7 +1518,7 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
+@@ -1538,7 +1538,7 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
  	eht_cap->has_eht = true;
  
  	eht_cap_elem->mac_cap_info[0] =
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0130-mtk-mt76-mt7996-fix-kite-can-t-handle-11v-beacon-on-.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0130-mtk-mt76-mt7996-fix-kite-can-t-handle-11v-beacon-on-.patch
index d07f390..b9f377e 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0130-mtk-mt76-mt7996-fix-kite-can-t-handle-11v-beacon-on-.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0130-mtk-mt76-mt7996-fix-kite-can-t-handle-11v-beacon-on-.patch
@@ -1,7 +1,7 @@
-From 3a050e7a77a7a7bd581cbd2df93d7f850de6609c Mon Sep 17 00:00:00 2001
+From f703aab4906d08ae441eb0c710c288db45445cae Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Thu, 30 May 2024 17:39:38 +0800
-Subject: [PATCH 130/195] mtk: mt76: mt7996: fix kite can't handle 11v beacon
+Subject: [PATCH 130/223] mtk: mt76: mt7996: fix kite can't handle 11v beacon
  on sta side
 
 this hw flag SUPPORTS_MULTI_BSSID need to set. otherwise cfg80211_parse_mbssid_data will not handle 11v mbss beacon
@@ -12,7 +12,7 @@
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 7cf3a37e..cc696a69 100644
+index 32c79bd8..001f0d9c 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -48,6 +48,7 @@ static const struct ieee80211_iface_combination if_comb[] = {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0131-mtk-mt76-mt7996-add-post-channel-switch-for-DFS-chan.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0131-mtk-mt76-mt7996-add-post-channel-switch-for-DFS-chan.patch
index 0011bd1..421aa70 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0131-mtk-mt76-mt7996-add-post-channel-switch-for-DFS-chan.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0131-mtk-mt76-mt7996-add-post-channel-switch-for-DFS-chan.patch
@@ -1,7 +1,7 @@
-From 4418f34a63a62d1e1ea6709ba41a8d65705af010 Mon Sep 17 00:00:00 2001
+From 00ef78d4d0738e36f529950b754e0042bdd57a68 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 21 Feb 2024 13:41:23 +0800
-Subject: [PATCH 131/195] mtk: mt76: mt7996: add post channel switch for DFS
+Subject: [PATCH 131/223] mtk: mt76: mt7996: add post channel switch for DFS
  channel switching
 
 Add post channel switch callback for DFS channel switch support
@@ -17,7 +17,7 @@
  2 files changed, 17 insertions(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index cc696a69..0ee2acfb 100644
+index 001f0d9c..420c23c9 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -451,6 +451,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -29,7 +29,7 @@
  	hw->max_tx_fragments = 4;
  
 diff --git a/mt7996/main.c b/mt7996/main.c
-index b45f63f6..de465de6 100644
+index 2b272cc4..485c87f9 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1078,6 +1078,21 @@ fail:
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0132-mtk-mt76-mt7996-update-testmode-bf-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0132-mtk-mt76-mt7996-update-testmode-bf-support.patch
index f01b2fe..40e7ee1 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0132-mtk-mt76-mt7996-update-testmode-bf-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0132-mtk-mt76-mt7996-update-testmode-bf-support.patch
@@ -1,13 +1,14 @@
-From a82d1a19307277e1d99816431a393e0ea3468f0f Mon Sep 17 00:00:00 2001
+From 04a4a2672095e1b0162153655874ba194370ffc2 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 3 Jun 2024 16:40:38 +0800
-Subject: [PATCH 132/195] mtk: mt76: mt7996: update testmode bf support
+Subject: [PATCH 132/223] mtk: mt76: mt7996: update testmode bf support
 
 Fix bssid & omac idx to band idx when testmode is enabled
 
 Add support for per-packet bw & primary channel selection index configuration
 This is used for ibf calibaration of group 9 ~ 13 in Kite
 
+Change-Id: Ib993f75d331b1fa22b7c07197321f91c8dae46ec
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mt76.h            |  3 +++
@@ -19,10 +20,10 @@
  6 files changed, 98 insertions(+), 34 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 4d495a7b..9832a39b 100644
+index bc263bd4..526b6298 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -794,6 +794,9 @@ struct mt76_testmode_data {
+@@ -796,6 +796,9 @@ struct mt76_testmode_data {
  	bool ibf;
  	bool ebf;
  
@@ -33,7 +34,7 @@
  
  	u8 tx_power[4];
 diff --git a/mt7996/main.c b/mt7996/main.c
-index de465de6..657dea86 100644
+index 485c87f9..f67e1b5d 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -349,16 +349,27 @@ static int mt7996_add_bss_conf(struct mt7996_phy *phy,
@@ -74,10 +75,10 @@
  
  	mconf->own_mld_id = get_own_mld_idx(dev->mld_id_mask, false);
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 8b35d125..b956915e 100644
+index c68619cb..240227a9 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -235,8 +235,10 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
+@@ -241,8 +241,10 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
  
  	mt7996_tm_rf_switch_mode(dev, rf_test_mode);
  
@@ -90,7 +91,7 @@
  
  	mt7996_tm_set(dev, SET_ID(BAND_IDX), phy->mt76->band_idx);
  
-@@ -252,9 +254,11 @@ mt7996_tm_update_channel(struct mt7996_phy *phy)
+@@ -258,9 +260,11 @@ mt7996_tm_update_channel(struct mt7996_phy *phy)
  {
  #define CHAN_FREQ_BW_80P80_TAG		(SET_ID(CHAN_FREQ) | BIT(16))
  	struct mt7996_dev *dev = phy->dev;
@@ -103,7 +104,7 @@
  	static const u8 ch_band[] = {
  		[NL80211_BAND_2GHZ] = 0,
  		[NL80211_BAND_5GHZ] = 1,
-@@ -274,18 +278,37 @@ mt7996_tm_update_channel(struct mt7996_phy *phy)
+@@ -280,18 +284,37 @@ mt7996_tm_update_channel(struct mt7996_phy *phy)
  		mt7996_tm_set(dev, CHAN_FREQ_BW_80P80_TAG, chandef->center_freq2 * 1000);
  	}
  
@@ -147,7 +148,7 @@
  }
  
  static void
-@@ -1179,14 +1202,9 @@ mt7996_tm_txbf_init(struct mt7996_phy *phy, u16 *val)
+@@ -1185,14 +1208,9 @@ mt7996_tm_txbf_init(struct mt7996_phy *phy, u16 *val)
  	mt7996_tm_set_mac_addr(dev, td->addr[1], SET_ID(SA));
  	mt7996_tm_set_mac_addr(dev, td->addr[2], SET_ID(BSSID));
  
@@ -164,7 +165,7 @@
  
  	if (td->ibf) {
  		if (td->is_txbf_dut) {
-@@ -1360,7 +1378,8 @@ mt7996_tm_add_txbf_sta(struct mt7996_phy *phy, u8 pfmu_idx, u8 nr, u8 nc, bool e
+@@ -1367,7 +1385,8 @@ mt7996_tm_add_txbf_sta(struct mt7996_phy *phy, u8 pfmu_idx, u8 nr, u8 nc, bool e
  			.tx_mode = mt7996_tm_rate_mapping(td->tx_rate_mode, RATE_MODE_TO_PHY),
  		},
  	};
@@ -174,7 +175,7 @@
  
  	if ((td->tx_rate_mode == MT76_TM_TX_MODE_HE_SU ||
  	     td->tx_rate_mode == MT76_TM_TX_MODE_EHT_SU) && !td->ibf) {
-@@ -1390,11 +1409,12 @@ mt7996_tm_add_txbf_sta(struct mt7996_phy *phy, u8 pfmu_idx, u8 nr, u8 nc, bool e
+@@ -1397,11 +1416,12 @@ mt7996_tm_add_txbf_sta(struct mt7996_phy *phy, u8 pfmu_idx, u8 nr, u8 nc, bool e
  		}
  	}
  
@@ -189,7 +190,7 @@
  	req.bf.tx_mode = (td->tx_rate_mode == MT76_TM_TX_MODE_EHT_SU) ? 0xf : req.bf.tx_mode;
  
  	if (ebf) {
-@@ -1421,6 +1441,7 @@ mt7996_tm_txbf_profile_update(struct mt7996_phy *phy, u16 *val, bool ebf)
+@@ -1428,6 +1448,7 @@ mt7996_tm_txbf_profile_update(struct mt7996_phy *phy, u16 *val, bool ebf)
  	struct mt7996_dev *dev = phy->dev;
  	struct mt7996_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
  	u8 rate, pfmu_idx = val[0], nc = val[2], nr;
@@ -197,7 +198,7 @@
  	int ret;
  	bool is_atenl = val[5];
  
-@@ -1439,7 +1460,9 @@ mt7996_tm_txbf_profile_update(struct mt7996_phy *phy, u16 *val, bool ebf)
+@@ -1446,7 +1467,9 @@ mt7996_tm_txbf_profile_update(struct mt7996_phy *phy, u16 *val, bool ebf)
  	tag->t1.nr = nr;
  	tag->t1.nc = nc;
  	tag->t1.invalid_prof = true;
@@ -209,7 +210,7 @@
  
  	if (ebf) {
 diff --git a/testmode.c b/testmode.c
-index f1d162ce..f7237cc0 100644
+index a1744755..2834400f 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -25,6 +25,8 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -260,7 +261,7 @@
  	     nla_put_u32(msg, MT76_TM_ATTR_FREQ_OFFSET, td->freq_offset)))
  		goto out;
 diff --git a/testmode.h b/testmode.h
-index bda7624a..ed2068e5 100644
+index 794a74f9..44f9984c 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -37,6 +37,9 @@
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0133-mtk-mt76-mt7996-add-mlo-related-debugfs-knob.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0133-mtk-mt76-mt7996-add-mlo-related-debugfs-knob.patch
index 989cea9..819ecfb 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0133-mtk-mt76-mt7996-add-mlo-related-debugfs-knob.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0133-mtk-mt76-mt7996-add-mlo-related-debugfs-knob.patch
@@ -1,7 +1,7 @@
-From 3961a01420a3e81edff2699033b4a753966d7c3e Mon Sep 17 00:00:00 2001
+From 4f2f27ccf6133c9f51f798a872387aa15337b923 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 27 May 2024 19:06:04 +0800
-Subject: [PATCH 133/195] mtk: mt76: mt7996: add mlo related debugfs knob
+Subject: [PATCH 133/223] mtk: mt76: mt7996: add mlo related debugfs knob
 
 Add the following debugfs knob
 Per-bss link info
@@ -21,7 +21,7 @@
  3 files changed, 119 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 71dc0449..6eb395c4 100644
+index 9a62dfda..bafbcda1 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -1330,11 +1330,128 @@ mt7996_queues_show(struct seq_file *s, void *data)
@@ -162,7 +162,7 @@
  	seq_printf(file, "\t\tMPDU Fails: %u (PER: %u.%u%%)\n", stats->tx_failed,
  		   stats->tx_mpdus ? stats->tx_failed * 1000 / stats->tx_mpdus / 10 : 0,
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 657dea86..f4788cc5 100644
+index f67e1b5d..915a9f4f 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -2845,6 +2845,7 @@ const struct ieee80211_ops mt7996_ops = {
@@ -174,10 +174,10 @@
  	.set_radar_background = mt7996_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index eba48c10..0f9dba69 100644
+index 9f58a793..984ae79e 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1247,6 +1247,7 @@ int mt7996_mcu_set_eml_omn(struct ieee80211_hw *hw, struct ieee80211_vif *vif, u
+@@ -1251,6 +1251,7 @@ int mt7996_mcu_set_eml_omn(struct ieee80211_hw *hw, struct ieee80211_vif *vif, u
  #ifdef CONFIG_MAC80211_DEBUGFS
  void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0134-mtk-mt76-mt7996-add-debugfs-knob-to-show-mlo-related.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0134-mtk-mt76-mt7996-add-debugfs-knob-to-show-mlo-related.patch
index d75eb32..ca24c64 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0134-mtk-mt76-mt7996-add-debugfs-knob-to-show-mlo-related.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0134-mtk-mt76-mt7996-add-debugfs-knob-to-show-mlo-related.patch
@@ -1,7 +1,7 @@
-From 520697cc29dd26a59d5c2451b6a9b344d1a2418a Mon Sep 17 00:00:00 2001
+From c2753e78a28cc8efca84dcf1e7d33dff6ccfa528 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 29 May 2024 18:45:50 +0800
-Subject: [PATCH 134/195] mtk: mt76: mt7996: add debugfs knob to show mlo
+Subject: [PATCH 134/223] mtk: mt76: mt7996: add debugfs knob to show mlo
  related table
 
 Add the following debugfs knob
@@ -9,6 +9,7 @@
 - /sys/kernel/debug/ieee80211/phy0/mt76/band0/agg_table
 - /sys/kernel/debug/ieee80211/phy0/mt76/band0/rmac_table
 
+Change-Id: Ia161e56146f7a9e8c5d124e161230d202ae1d0a8
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/debugfs.c       |  3 +-
@@ -18,7 +19,7 @@
  4 files changed, 119 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 6eb395c4..968174e6 100644
+index bafbcda1..240c6d46 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -1107,6 +1107,7 @@ int mt7996_init_band_debugfs(struct mt7996_phy *phy)
@@ -39,10 +40,10 @@
  	}
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 0f9dba69..1aa845f3 100644
+index 984ae79e..8af3c400 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1322,7 +1322,8 @@ void mt7996_packet_log_to_host(struct mt7996_dev *dev, const void *data, int len
+@@ -1326,7 +1326,8 @@ void mt7996_packet_log_to_host(struct mt7996_dev *dev, const void *data, int len
  void mt7996_dump_bmac_rxd_info(struct mt7996_dev *dev, __le32 *rxd);
  void mt7996_dump_bmac_txd_info(struct seq_file *s, struct mt7996_dev *dev,
  			       __le32 *txd, bool is_hif_txd, bool dump_txp);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0135-mtk-mt76-mt7996-add-debugfs-knob-to-set-agc.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0135-mtk-mt76-mt7996-add-debugfs-knob-to-set-agc.patch
index cab14d5..4aa3e88 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0135-mtk-mt76-mt7996-add-debugfs-knob-to-set-agc.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0135-mtk-mt76-mt7996-add-debugfs-knob-to-set-agc.patch
@@ -1,12 +1,13 @@
-From fdd360d332af913968d8c6bbc607f5c8c0da6abf Mon Sep 17 00:00:00 2001
+From 4483bcc086666bb2eaf40774c30d35d60911524b Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 31 May 2024 10:55:03 +0800
-Subject: [PATCH 135/195] mtk: mt76: mt7996: add debugfs knob to set agc
+Subject: [PATCH 135/223] mtk: mt76: mt7996: add debugfs knob to set agc
 
 Add the following debugfs knob
 - /sys/kernel/debug/ieee80211/phy0/mt76/mlo_agc_tx
 - /sys/kernel/debug/ieee80211/phy0/mt76/mlo_agc_trig
 
+Change-Id: I7e847be11b3083b6d776e7b00c6089dec3ad1a41
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt76_connac_mcu.h      |   1 +
@@ -17,10 +18,10 @@
  5 files changed, 131 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 07811d63..063bfe75 100644
+index 2daa09cc..73cf311a 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1312,6 +1312,7 @@ enum {
+@@ -1317,6 +1317,7 @@ enum {
  	MCU_UNI_CMD_THERMAL_CAL = 0x4c,
  	MCU_UNI_CMD_RRO = 0x57,
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
@@ -60,10 +61,10 @@
  #define MT7996_PATCH_SCRAMBLE_KEY	GENMASK(15, 8)
  #define MT7996_PATCH_AES_KEY		GENMASK(7, 0)
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 1aa845f3..47c6c3cf 100644
+index 8af3c400..7bb17126 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1324,6 +1324,7 @@ void mt7996_dump_bmac_txd_info(struct seq_file *s, struct mt7996_dev *dev,
+@@ -1328,6 +1328,7 @@ void mt7996_dump_bmac_txd_info(struct seq_file *s, struct mt7996_dev *dev,
  			       __le32 *txd, bool is_hif_txd, bool dump_txp);
  int mt7996_mtk_init_dev_debugfs_internal(struct mt7996_phy *phy, struct dentry *dir);
  int mt7996_mtk_init_band_debugfs_internal(struct mt7996_phy *phy, struct dentry *dir);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0136-mtk-mt76-mt7996-set-unused-band-to-UNSPECIFIED-in-ba.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0136-mtk-mt76-mt7996-set-unused-band-to-UNSPECIFIED-in-ba.patch
index 06fcdd5..9bc37e1 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0136-mtk-mt76-mt7996-set-unused-band-to-UNSPECIFIED-in-ba.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0136-mtk-mt76-mt7996-set-unused-band-to-UNSPECIFIED-in-ba.patch
@@ -1,9 +1,10 @@
-From 97b9e161947f8965479a76aa0643341243da2f21 Mon Sep 17 00:00:00 2001
+From c179e8dd87acac5c2a7d04bb7e58722da862fc95 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 5 Jun 2024 10:11:13 +0800
-Subject: [PATCH 136/195] mtk: mt76: mt7996: set unused band to UNSPECIFIED in
+Subject: [PATCH 136/223] mtk: mt76: mt7996: set unused band to UNSPECIFIED in
  band_to_link
 
+Change-Id: I21190c5952a9c2f2a7f5f619f8d1fb23dd127c6f
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/main.c   | 4 ++++
@@ -12,7 +13,7 @@
  3 files changed, 10 insertions(+)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index f4788cc5..5fd59539 100644
+index 915a9f4f..9ad4a9d6 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -482,6 +482,8 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
@@ -34,10 +35,10 @@
  	if (!mvif->cs_ready_links)
  		mvif->cs_link_id = link_id;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 55ee7348..7e441cb5 100644
+index a6f2c157..a62b5f9e 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -374,6 +374,9 @@ mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
+@@ -379,6 +379,9 @@ mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  	int link_id, band_idx = mphy->band_idx;
  
  	link_id = mvif->band_to_link[band_idx];
@@ -48,10 +49,10 @@
  
  	if (!link_conf || !link_conf->csa_active || vif->type == NL80211_IFTYPE_STATION)
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 47c6c3cf..aa655424 100644
+index 7bb17126..3ff9cb68 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -962,6 +962,9 @@ mt7996_get_link_wcid(struct mt7996_dev *dev, u16 idx, u8 band_idx)
+@@ -966,6 +966,9 @@ mt7996_get_link_wcid(struct mt7996_dev *dev, u16 idx, u8 band_idx)
  
  	mlink = wcid_to_mlink(wcid);
  	link_id = mlink->sta->vif->band_to_link[band_idx];
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0137-mtk-mt76-mt7996-support-per-link-report-of-bss-color.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0137-mtk-mt76-mt7996-support-per-link-report-of-bss-color.patch
index 8598843..6839514 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0137-mtk-mt76-mt7996-support-per-link-report-of-bss-color.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0137-mtk-mt76-mt7996-support-per-link-report-of-bss-color.patch
@@ -1,21 +1,22 @@
-From cd6befef837a39ba0c7c8ba91d901a0d10cb2da9 Mon Sep 17 00:00:00 2001
+From c481c255433c20d071b76c82d8c4f4372a13fd17 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 5 Jun 2024 19:11:13 +0800
-Subject: [PATCH 137/195] mtk: mt76: mt7996: support per-link report of bss
+Subject: [PATCH 137/223] mtk: mt76: mt7996: support per-link report of bss
  color change
 
 ieee80211_color_change_finish() has been extended for per-link support.
 
+Change-Id: I8bfd562b617773a370fcc3e732d6335ed082a909
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mt7996/mcu.c | 17 ++++++++++++++---
  1 file changed, 14 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 7e441cb5..854b9ddf 100644
+index a62b5f9e..043f8d5c 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -472,10 +472,21 @@ out:
+@@ -477,10 +477,21 @@ out:
  static void
  mt7996_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -34,12 +35,12 @@
 +	    vif->type == NL80211_IFTYPE_STATION)
  		return;
  
--	ieee80211_color_change_finish(vif);
+-	ieee80211_color_change_finish(vif, 0);
 +	ieee80211_color_change_finish(vif, link_id);
  }
  
  static void
-@@ -511,7 +522,7 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -516,7 +527,7 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
  		case UNI_EVENT_IE_COUNTDOWN_BCC:
  			ieee80211_iterate_active_interfaces_atomic(mphy->hw,
  					IEEE80211_IFACE_ITER_RESUME_ALL,
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0138-mtk-mt76-mt7996-Fix-inconsistent-QoS-mapping-between.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0138-mtk-mt76-mt7996-Fix-inconsistent-QoS-mapping-between.patch
index ae31e70..64030e7 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0138-mtk-mt76-mt7996-Fix-inconsistent-QoS-mapping-between.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0138-mtk-mt76-mt7996-Fix-inconsistent-QoS-mapping-between.patch
@@ -1,7 +1,7 @@
-From 4e18f649282ca5e6beef9f99ceeb346ad33bf746 Mon Sep 17 00:00:00 2001
+From 0f060bd8db3e101c30617548032f00adabcd9ffa Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Fri, 7 Jun 2024 13:51:25 +0800
-Subject: [PATCH 138/195] mtk: mt76: mt7996: Fix inconsistent QoS mapping
+Subject: [PATCH 138/223] mtk: mt76: mt7996: Fix inconsistent QoS mapping
  between SW and HW
 
 Fix inconsistent QoS mapping between SW and HW.
@@ -16,6 +16,8 @@
 so it will set zero to fw. Once the value of dscp is 57. mac80211 will correspond to tid 7.
 and fw will correspond to tid 0.
 
+Change-Id: Ied5b9caab869985cbbca55b401805af6787afef3
+Change-Id: I6d9066c6afdfc7bb1c4523e9bc8dec40111abd25
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Signed-off-by: Rex Lu <rex.lu@mediatek.com>
 ---
@@ -26,10 +28,10 @@
  4 files changed, 94 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 063bfe75..80dbd987 100644
+index 73cf311a..1971c7bf 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1262,6 +1262,7 @@ enum {
+@@ -1267,6 +1267,7 @@ enum {
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
  	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
@@ -38,7 +40,7 @@
  
  enum {
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 5fd59539..9562f27a 100644
+index 9ad4a9d6..c1c62d32 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -2369,6 +2369,9 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
@@ -92,10 +94,10 @@
 +	.set_qos_map = mt7996_set_qos_map,
  };
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 854b9ddf..f85e2b87 100644
+index 043f8d5c..edbe9cbe 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -6670,4 +6670,59 @@ int mt7996_mcu_set_csi(struct mt7996_phy *phy, u8 mode,
+@@ -6693,4 +6693,59 @@ int mt7996_mcu_set_csi(struct mt7996_phy *phy, u8 mode,
  		return -EINVAL;
  	}
  }
@@ -156,10 +158,10 @@
 +}
  #endif
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index aa655424..5c326286 100644
+index 3ff9cb68..d97df22f 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -134,6 +134,8 @@
+@@ -136,6 +136,8 @@
  #define MT7996_MAX_PROBE_TIMEOUT	500
  #define MT7996_MAX_PROBE_TRIES		2
  
@@ -168,7 +170,7 @@
  struct mt7996_vif;
  struct mt7996_sta;
  struct mt7996_dfs_pulse;
-@@ -376,6 +378,9 @@ struct mt7996_vif {
+@@ -377,6 +379,9 @@ struct mt7996_vif {
  	void *probe[__MT_MAX_BAND];
  	unsigned long probe_send_time[__MT_MAX_BAND];
  	int probe_send_count[__MT_MAX_BAND];
@@ -178,7 +180,7 @@
  };
  
  /* crash-dump */
-@@ -1333,5 +1338,6 @@ int mt7996_mcu_mlo_agc(struct mt7996_dev *dev, const void *data, int len);
+@@ -1337,5 +1342,6 @@ int mt7996_mcu_mlo_agc(struct mt7996_dev *dev, const void *data, int len);
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  int mt7996_dma_rro_init(struct mt7996_dev *dev);
  #endif /* CONFIG_NET_MEDIATEK_SOC_WED */
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0139-mtk-mt76-mt7996-add-support-for-MLD-interface-to-sca.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0139-mtk-mt76-mt7996-add-support-for-MLD-interface-to-sca.patch
index 28defbf..366eea1 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0139-mtk-mt76-mt7996-add-support-for-MLD-interface-to-sca.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0139-mtk-mt76-mt7996-add-support-for-MLD-interface-to-sca.patch
@@ -1,7 +1,7 @@
-From 5ad2b55a5ed4a89d65ad990eb369a869a2b7b028 Mon Sep 17 00:00:00 2001
+From 648d4259da57439452141aeaeed96722d96c1c56 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Thu, 30 May 2024 15:26:34 +0800
-Subject: [PATCH 139/195] mtk: mt76: mt7996: add support for MLD interface to
+Subject: [PATCH 139/223] mtk: mt76: mt7996: add support for MLD interface to
  scan
 
 Before queueing a HW scan work, mt7996_hw_scan() should make sure that
@@ -20,13 +20,14 @@
 mt7996_bss_conf is not yet allocated. In such a case we also use the
 default link to scan, and delete it once the scan is finished.
 
+Change-Id: I32a4b9e5f9f1d05993587631f5d1a347af8869cb
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt7996/main.c | 79 +++++++++++++++++++++++++++++++++++++++++++++++++--
  1 file changed, 77 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 9562f27a..1e505dbe 100644
+index c1c62d32..5ddf3a1b 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -2379,10 +2379,24 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0140-mtk-mt76-mt7996-add-per-link-txpower-config.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0140-mtk-mt76-mt7996-add-per-link-txpower-config.patch
index 82900bc..71363f4 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0140-mtk-mt76-mt7996-add-per-link-txpower-config.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0140-mtk-mt76-mt7996-add-per-link-txpower-config.patch
@@ -1,7 +1,7 @@
-From 0e3c5520b964d14a42de78e57ef72917ff8bfc38 Mon Sep 17 00:00:00 2001
+From 20c5dfdc5afbb01b853689dd45f1826e9644a87b Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 11 Jun 2024 17:04:00 +0800
-Subject: [PATCH 140/195] mtk: mt76: mt7996: add per-link txpower config
+Subject: [PATCH 140/223] mtk: mt76: mt7996: add per-link txpower config
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -9,7 +9,7 @@
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 1e505dbe..376aa193 100644
+index 5ddf3a1b..ed64cf06 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1016,7 +1016,7 @@ out:
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0141-mtk-mt76-mt7996-update-TX-RX-rates-via-MCU-command.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0141-mtk-mt76-mt7996-update-TX-RX-rates-via-MCU-command.patch
index f89880b..f23c7ee 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0141-mtk-mt76-mt7996-update-TX-RX-rates-via-MCU-command.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0141-mtk-mt76-mt7996-update-TX-RX-rates-via-MCU-command.patch
@@ -1,7 +1,7 @@
-From 9eb4af2c6b0942add0749f9e21edf8728ba6807d Mon Sep 17 00:00:00 2001
+From c394984fc5a6e52aa435ead825e617fb3a0e7b81 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Fri, 7 Jun 2024 10:44:45 +0800
-Subject: [PATCH 141/195] mtk: mt76: mt7996: update TX/RX rates via MCU command
+Subject: [PATCH 141/223] mtk: mt76: mt7996: update TX/RX rates via MCU command
 
 Update TX/RX rates via MCU command to address following issues:
 1. TX rate was originally updated via TXS. However in MLO connection, WCID from TXS may not represent the actually used link.
@@ -10,6 +10,7 @@
 Original TX-rate update via TXS is removed.
 Still, RX-rate update via RXD is not removed, because mac80211 requires driver to provide such information for each received frame.
 
+Change-Id: I505f2882ada89770093ed0a31eb73ac4aff8b568
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt76.h        |   1 +
@@ -19,10 +20,10 @@
  4 files changed, 161 insertions(+), 131 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 9832a39b..1322fa30 100644
+index 526b6298..de6f2be0 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -373,6 +373,7 @@ struct mt76_wcid {
+@@ -374,6 +374,7 @@ struct mt76_wcid {
  	int inactive_count;
  
  	struct rate_info rate;
@@ -31,10 +32,10 @@
  
  	u16 idx;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 020203ec..484b679b 100644
+index 02045b84..39336832 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1242,15 +1242,12 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
+@@ -1254,15 +1254,12 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
  		       int pid, __le32 *txs_data)
  {
  	struct mt76_sta_stats *stats = &wcid->stats;
@@ -52,7 +53,7 @@
  
  	txs = le32_to_cpu(txs_data[0]);
  
-@@ -1298,105 +1295,23 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
+@@ -1310,105 +1307,23 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
  	}
  
  	txrate = FIELD_GET(MT_TXS0_TX_RATE, txs);
@@ -173,7 +174,7 @@
  		mt76_tx_status_skb_done(mdev, skb, &list);
  	mt76_tx_status_unlock(mdev, &list);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 376aa193..f6f2c26c 100644
+index ed64cf06..05917cc8 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1769,32 +1769,24 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
@@ -220,10 +221,10 @@
  	sinfo->tx_failed = mlink->wcid.stats.tx_failed;
  	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index f85e2b87..6fd69e10 100644
+index edbe9cbe..ee27b5df 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -532,42 +532,164 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -537,42 +537,164 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb)
  }
  
  static int
@@ -272,7 +273,7 @@
  	case MT_PHY_TYPE_HE_MU:
 -		if (mcu_rate->tx_gi > NL80211_RATE_INFO_HE_GI_3_2)
 +		tmp_rate.mcs = mcs & GENMASK(3, 0);
-+		if (tmp_rate.mcs > 11 || gi > NL80211_RATE_INFO_HE_GI_3_2)
++		if (tmp_rate.mcs > 13 || gi > NL80211_RATE_INFO_HE_GI_3_2)
  			return -EINVAL;
 -		rate->he_gi = mcu_rate->tx_gi;
 +
@@ -285,7 +286,7 @@
  	case MT_PHY_TYPE_EHT_MU:
 -		if (mcu_rate->tx_gi > NL80211_RATE_INFO_EHT_GI_3_2)
 +		tmp_rate.mcs = mcs & GENMASK(3, 0);
-+		if (tmp_rate.mcs > 13 || gi > NL80211_RATE_INFO_EHT_GI_3_2)
++		if (tmp_rate.mcs > 15 || gi > NL80211_RATE_INFO_EHT_GI_3_2)
  			return -EINVAL;
 -		rate->eht_gi = mcu_rate->tx_gi;
 +
@@ -398,7 +399,7 @@
  static inline void __mt7996_stat_to_netdev(struct mt76_phy *mphy,
  					   struct mt76_wcid *wcid,
  					   u32 tx_bytes, u32 rx_bytes,
-@@ -618,8 +740,8 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -623,8 +745,8 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  			if (!wcid)
  				break;
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0142-mtk-mt76-mt7996-add-link-information-when-dump-stati.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0142-mtk-mt76-mt7996-add-link-information-when-dump-stati.patch
index ec2b758..9ce1f11 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0142-mtk-mt76-mt7996-add-link-information-when-dump-stati.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0142-mtk-mt76-mt7996-add-link-information-when-dump-stati.patch
@@ -1,7 +1,7 @@
-From 2de2ec0cb55821375cf4a91e7f0b128473d636be Mon Sep 17 00:00:00 2001
+From ff2647b012eddbe530dd4b900506911fa91c8329 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 11 Jun 2024 18:09:57 +0800
-Subject: [PATCH 142/195] mtk: mt76: mt7996: add link information when dump
+Subject: [PATCH 142/223] mtk: mt76: mt7996: add link information when dump
  station
 
 Report following per-link information to mac80211:
@@ -12,6 +12,8 @@
 - TX/RX airtime
 - per-link per-antenna average data-frame RSSI to mac80211.
 
+Change-Id: I3a0c5e014dcad4683cf19859e452e771c49d4ba6
+Change-Id: I5c7c282b97ec8a82b0a54ff5e9bbf0858461c832
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
@@ -19,7 +21,7 @@
  1 file changed, 78 insertions(+)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index f6f2c26c..93d920aa 100644
+index 05917cc8..380a6ca0 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1817,6 +1817,83 @@ out:
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0143-mtk-mt76-mt7996-add-per-link-RX-MPDU-statistics.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0143-mtk-mt76-mt7996-add-per-link-RX-MPDU-statistics.patch
index bdf3815..bb0bde1 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0143-mtk-mt76-mt7996-add-per-link-RX-MPDU-statistics.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0143-mtk-mt76-mt7996-add-per-link-RX-MPDU-statistics.patch
@@ -1,10 +1,11 @@
-From 2d86ff82afeeb8308d9b37a27b0ce851fb09f6f6 Mon Sep 17 00:00:00 2001
+From 9e31f71efd5909af8d8916285f0816914fd15bac Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Tue, 23 Jul 2024 16:37:57 +0800
-Subject: [PATCH 143/195] mtk: mt76: mt7996: add per-link RX MPDU statistics
+Subject: [PATCH 143/223] mtk: mt76: mt7996: add per-link RX MPDU statistics
 
 Add per-link RX MPDU total/failed counts.
 
+Change-Id: Ibe9acae34bf9eff17da651ec8c33b6a9a9f6f785
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt76.h            |  2 ++
@@ -15,10 +16,10 @@
  5 files changed, 22 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index 1322fa30..e9366d2c 100644
+index de6f2be0..ce34cccc 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -339,6 +339,8 @@ struct mt76_sta_stats {
+@@ -340,6 +340,8 @@ struct mt76_sta_stats {
  	/* WED RX */
  	u64 rx_bytes;
  	u32 rx_packets;
@@ -28,10 +29,10 @@
  	u32 rx_drops;
  	u64 rx_airtime;
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 80dbd987..8e57fa2c 100644
+index 1971c7bf..931b29eb 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1421,6 +1421,8 @@ enum UNI_ALL_STA_INFO_TAG {
+@@ -1426,6 +1426,8 @@ enum UNI_ALL_STA_INFO_TAG {
  	UNI_ALL_STA_DATA_TX_RETRY_COUNT,
  	UNI_ALL_STA_GI_MODE,
  	UNI_ALL_STA_TXRX_MSDU_COUNT,
@@ -41,10 +42,10 @@
  };
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 484b679b..a0406700 100644
+index 39336832..966cf314 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2408,6 +2408,7 @@ void mt7996_mac_work(struct work_struct *work)
+@@ -2420,6 +2420,7 @@ void mt7996_mac_work(struct work_struct *work)
  					mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_ADM_STAT);
  					mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_MSDU_COUNT);
  				// }
@@ -53,10 +54,10 @@
  				if (mt7996_mcu_wa_cmd(phy->dev, MCU_WA_PARAM_CMD(QUERY), MCU_WA_PARAM_BSS_ACQ_PKT_CNT,
  				                      BSS_ACQ_PKT_CNT_BSS_BITMAP_ALL | BSS_ACQ_PKT_CNT_READ_CLR, 0))
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 6fd69e10..27987b25 100644
+index ee27b5df..4a99671f 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -803,6 +803,16 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -808,6 +808,16 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
  				                               tx_airtime, rx_airtime);
  			}
  			break;
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0144-mtk-mt76-mt7996-support-link_id-for-mt7996_set_bitra.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0144-mtk-mt76-mt7996-support-link_id-for-mt7996_set_bitra.patch
index da2075b..4e9a59b 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0144-mtk-mt76-mt7996-support-link_id-for-mt7996_set_bitra.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0144-mtk-mt76-mt7996-support-link_id-for-mt7996_set_bitra.patch
@@ -1,12 +1,13 @@
-From f9a3de2b156e9266cfd8b16955b60fce90d566df Mon Sep 17 00:00:00 2001
+From cd89b66b8dac6cbb4569d61c7f23b06692410adf Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 7 Jun 2024 13:23:55 +0800
-Subject: [PATCH 144/195] mtk: mt76: mt7996: support link_id for
+Subject: [PATCH 144/223] mtk: mt76: mt7996: support link_id for
  mt7996_set_bitrate_mask
 
 Add support new argument link_id for set_bitrate_mask within
 ieee80211_ops.
 
+Change-Id: Ic164e7e332e273992965bb5f7b89ca2fce1f1e53
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
  mt7996/main.c   | 34 ++++++++++++++++++++++++++--------
@@ -14,7 +15,7 @@
  2 files changed, 31 insertions(+), 8 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 93d920aa..87247597 100644
+index 380a6ca0..118c7d67 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1899,17 +1899,21 @@ static void mt7996_sta_rc_work(void *data, struct ieee80211_sta *sta)
@@ -100,10 +101,10 @@
  
  	return 0;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 5c326286..8125dacc 100644
+index d97df22f..ccea70af 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -444,6 +444,11 @@ struct mt7996_wed_rro_session_id {
+@@ -445,6 +445,11 @@ struct mt7996_wed_rro_session_id {
  	u16 id;
  };
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0145-mtk-mt76-mt7996-add-per-radio-antenna-config.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0145-mtk-mt76-mt7996-add-per-radio-antenna-config.patch
index 0907289..bee539b 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0145-mtk-mt76-mt7996-add-per-radio-antenna-config.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0145-mtk-mt76-mt7996-add-per-radio-antenna-config.patch
@@ -1,10 +1,11 @@
-From 14657b9acfe1dc5db4c7f5a53e970213103fbb2b Mon Sep 17 00:00:00 2001
+From 31c98d0e5f309c927880c4781a4c9323b6d41981 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 11 Jun 2024 17:04:22 +0800
-Subject: [PATCH 145/195] mtk: mt76: mt7996: add per-radio antenna config
+Subject: [PATCH 145/223] mtk: mt76: mt7996: add per-radio antenna config
 
 Add per-radio antenna config
 
+Change-Id: Id82ffe0ebc453e77a16a0a9c04edad8c45ad3079
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mac80211.c      | 19 ++++++++++++++++---
@@ -17,7 +18,7 @@
  7 files changed, 47 insertions(+), 29 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 8dcf4f06..04a24544 100644
+index f986d5fd..a555bec2 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -431,8 +431,8 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
@@ -59,10 +60,10 @@
  	*rx_ant = phy->antenna_mask;
  	mutex_unlock(&dev->mutex);
 diff --git a/mt76.h b/mt76.h
-index e9366d2c..3099199c 100644
+index ce34cccc..8e71c2ce 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -875,6 +875,7 @@ struct mt76_phy {
+@@ -877,6 +877,7 @@ struct mt76_phy {
  	struct mt76_sband sband_2g;
  	struct mt76_sband sband_5g;
  	struct mt76_sband sband_6g;
@@ -80,10 +81,10 @@
  void mt76_insert_ccmp_hdr(struct sk_buff *skb, u8 key_id);
  int mt76_get_rate(struct mt76_dev *dev,
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index c4714982..e8e1d85a 100644
+index f9bd4d91..72a21fcf 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -378,12 +378,15 @@ static int mt7996_eeprom_parse_band_config(struct mt7996_phy *phy)
+@@ -410,12 +410,15 @@ static int mt7996_eeprom_parse_band_config(struct mt7996_phy *phy)
  	switch (val) {
  	case MT_EE_BAND_SEL_2GHZ:
  		phy->mt76->cap.has_2ghz = true;
@@ -100,7 +101,7 @@
  	default:
  		ret = -EINVAL;
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 0ee2acfb..55eb32cb 100644
+index 420c23c9..18a86afe 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -392,8 +392,10 @@ static void
@@ -171,7 +172,7 @@
  	wiphy->max_scan_ssids = 4;
  	wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 87247597..6317ec7f 100644
+index 118c7d67..d73fd9d6 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1705,14 +1705,11 @@ mt7996_set_coverage_class(struct ieee80211_hw *hw, s16 coverage_class)
@@ -211,10 +212,10 @@
  			continue;
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 27987b25..99bad18e 100644
+index 4a99671f..28bccc15 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2430,6 +2430,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -2435,6 +2435,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  #define EBF_MODE	BIT(0)
  #define IBF_MODE	BIT(1)
  	struct mt7996_phy *phy = mconf->phy;
@@ -222,7 +223,7 @@
  	int tx_ant = hweight16(phy->mt76->chainmask) - 1;
  	struct sta_rec_bf *bf;
  	struct tlv *tlv;
-@@ -2468,7 +2469,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -2473,7 +2474,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  
  	bf->bf_cap = ebf ? EBF_MODE : (dev->ibf ? IBF_MODE : 0);
  	if (is_mt7992(&dev->mt76) &&
@@ -232,10 +233,10 @@
  	bf->bw = link_sta->bandwidth;
  	bf->ibf_dbw = link_sta->bandwidth;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 8125dacc..30f19d1c 100644
+index ccea70af..c20206c6 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1173,9 +1173,10 @@ void mt7996_memcpy_fromio(struct mt7996_dev *dev, void *buf, u32 offset,
+@@ -1177,9 +1177,10 @@ void mt7996_memcpy_fromio(struct mt7996_dev *dev, void *buf, u32 offset,
  
  static inline u16 mt7996_rx_chainmask(struct mt7996_phy *phy)
  {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0146-mtk-mt76-mt7996-rework-debug-prints.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0146-mtk-mt76-mt7996-rework-debug-prints.patch
index 7b8e81b..28f11c6 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0146-mtk-mt76-mt7996-rework-debug-prints.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0146-mtk-mt76-mt7996-rework-debug-prints.patch
@@ -1,11 +1,12 @@
-From ddf5723d93ddcebe9db926765aad0f703c10312d Mon Sep 17 00:00:00 2001
+From 28b5dc0783ecf0b3b173c76b9138f769ec6345f3 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 19 Jun 2024 12:04:46 +0800
-Subject: [PATCH 146/195] mtk: mt76: mt7996: rework debug prints
+Subject: [PATCH 146/223] mtk: mt76: mt7996: rework debug prints
 
 Trim debug messages, and move some of them (especially mcu cmd) into
 tracing log.
 
+Change-Id: I1cf15113a43990fdf201722738e32f08b9118b8f
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mt76_connac_mcu.c |  1 -
@@ -16,7 +17,7 @@
  5 files changed, 67 insertions(+), 49 deletions(-)
 
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 76117b6c..426baf0e 100644
+index b62a1ac8..e4e6c0d3 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -428,7 +428,6 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
@@ -28,10 +29,10 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_basic_tlv);
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index a0406700..960b02dd 100644
+index 966cf314..0a96b5de 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2930,9 +2930,6 @@ void mt7996_scan_work(struct work_struct *work)
+@@ -2942,9 +2942,6 @@ void mt7996_scan_work(struct work_struct *work)
  		return;
  	}
  
@@ -42,7 +43,7 @@
  
  	if (!req->n_ssids ||
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 6317ec7f..f6422b1f 100644
+index d73fd9d6..647e0e8a 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -297,6 +297,9 @@ static void mt7996_remove_bss_conf(struct ieee80211_vif *vif,
@@ -241,10 +242,10 @@
  
  	if (rem)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 99bad18e..596f58cc 100644
+index 28bccc15..6149f227 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -382,7 +382,6 @@ mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
+@@ -387,7 +387,6 @@ mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  	if (!link_conf || !link_conf->csa_active || vif->type == NL80211_IFTYPE_STATION)
  		return;
  
@@ -252,7 +253,7 @@
  	mvif->cs_ready_links = 0;
  	mvif->cs_link_id = IEEE80211_LINK_UNSPECIFIED;
  	ieee80211_csa_finish(vif, link_id);
-@@ -1508,8 +1507,8 @@ mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+@@ -1513,8 +1512,8 @@ mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
  	}
  
  	mld->own_mld_id = mconf->own_mld_id;
@@ -263,7 +264,7 @@
  }
  
  static void
-@@ -1662,8 +1661,8 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
+@@ -1667,8 +1666,8 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
  
  	memcpy(bss->bssid, conf->bssid, ETH_ALEN);
  
@@ -274,7 +275,7 @@
  
  	bss->bcn_interval = cpu_to_le16(conf->beacon_int);
  	bss->dtim_period = conf->dtim_period;
-@@ -1802,8 +1801,6 @@ mt7996_mcu_sta_tx_cap(struct mt7996_dev *dev, struct mt76_vif *mvif,
+@@ -1807,8 +1806,6 @@ mt7996_mcu_sta_tx_cap(struct mt7996_dev *dev, struct mt76_vif *mvif,
  	tx_cap = (struct sta_rec_tx_cap *)tlv;
  	tx_cap->ampdu_limit_en = true;
  
@@ -283,7 +284,7 @@
  	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
  				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
  }
-@@ -2963,8 +2960,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+@@ -2968,8 +2965,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  	conn_state = enable ? CONN_STATE_PORT_SECURE : CONN_STATE_DISCONNECT;
  	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, conf, link_sta,
  				      conn_state, newly);
@@ -294,7 +295,7 @@
  
  	if (!enable)
  		goto out;
-@@ -3024,6 +3021,8 @@ mt7996_mcu_sta_mld_setup_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -3029,6 +3026,8 @@ mt7996_mcu_sta_mld_setup_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
  	unsigned long valid_links = sta->valid_links;
  	unsigned int link_id;
@@ -303,7 +304,7 @@
  
  	mlink = mlink_dereference_protected(msta, msta->pri_link);
  	if (!mlink)
-@@ -3047,15 +3046,16 @@ mt7996_mcu_sta_mld_setup_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -3052,15 +3051,16 @@ mt7996_mcu_sta_mld_setup_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	mld_setup->link_num = hweight16(sta->valid_links);
  
  	mld_setup_link = (struct mld_setup_link *)mld_setup->link_info;
@@ -323,7 +324,7 @@
  		link_id, mld_setup_link->wcid, mld_setup_link->bss_idx);
  		mld_setup_link++;
  	}
-@@ -3321,8 +3321,8 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
+@@ -3326,8 +3326,8 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
  		return mt7996_mcu_muar_config(phy, conf, mconf, false, enable);
  
  	memcpy(data.tlv.omac_addr, conf->addr, ETH_ALEN);
@@ -334,7 +335,7 @@
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WMWA_UNI_CMD(DEV_INFO_UPDATE),
  				 &data, sizeof(data), true);
  }
-@@ -6536,10 +6536,10 @@ int mt7996_mcu_set_eml_omn(struct ieee80211_hw *hw,
+@@ -6559,10 +6559,10 @@ int mt7996_mcu_set_eml_omn(struct ieee80211_hw *hw,
  		}
  	}
  
@@ -350,10 +351,10 @@
  	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
  			MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 30f19d1c..2ad48f96 100644
+index c20206c6..d56d9715 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -982,7 +982,15 @@ mt7996_get_link_wcid(struct mt7996_dev *dev, u16 idx, u8 band_idx)
+@@ -986,7 +986,15 @@ mt7996_get_link_wcid(struct mt7996_dev *dev, u16 idx, u8 band_idx)
  	return &mlink->wcid;
  }
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0147-mtk-mt76-mt7996-support-configure-trigger-frame-type.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0147-mtk-mt76-mt7996-support-configure-trigger-frame-type.patch
index 780d2d6..c77006d 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0147-mtk-mt76-mt7996-support-configure-trigger-frame-type.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0147-mtk-mt76-mt7996-support-configure-trigger-frame-type.patch
@@ -1,7 +1,7 @@
-From 45b20bc2834471a96bb27e35fffd4e95c7ec229f Mon Sep 17 00:00:00 2001
+From 4ea48c70592eb0d0907dddfeffc11686e42328d0 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 7 May 2024 10:00:09 +0800
-Subject: [PATCH 147/195] mtk: mt76: mt7996: support configure trigger frame
+Subject: [PATCH 147/223] mtk: mt76: mt7996: support configure trigger frame
  type
 
 Support receiving an nl80211 subcmd
@@ -13,6 +13,7 @@
 The purpose of this commit is for WiFi 7 R1 cert UL-RU and UL-MU test
 cases.
 
+Change-Id: Iaf9b276b852bcfe3f5e0123db8d5dc77cc136a81
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
  mt7996/mtk_mcu.c | 1 +
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0148-mtk-mt76-mt7996-support-configure-coding-type-for-wi.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0148-mtk-mt76-mt7996-support-configure-coding-type-for-wi.patch
index 860532a..0833a39 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0148-mtk-mt76-mt7996-support-configure-coding-type-for-wi.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0148-mtk-mt76-mt7996-support-configure-coding-type-for-wi.patch
@@ -1,7 +1,7 @@
-From 25892ea2ec0136f91d1f5cbc11b05b7a96aa8deb Mon Sep 17 00:00:00 2001
+From 5838cde9b267f8792119865a8224308b569899b0 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 7 Jun 2024 13:24:04 +0800
-Subject: [PATCH 148/195] mtk: mt76: mt7996: support configure coding type for
+Subject: [PATCH 148/223] mtk: mt76: mt7996: support configure coding type for
  wifi7 r1 cert
 
 This commit includes two changes for WiFi7 cert fix rate test cases.
@@ -17,6 +17,8 @@
 cert_mode to determine whether we are currently using multiple user
 space commands to fix the partial rate.
 
+Change-Id: I8fbeb1ce639922c0a224eb5b9e849fbdcf50272d
+Change-Id: Ifb75c34a767ab6ad5597237e70a3673586fcb499
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
  mt7996/mac.c     | 10 ++++++++++
@@ -29,10 +31,10 @@
  7 files changed, 82 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 960b02dd..c59cc7cc 100644
+index 0a96b5de..19484081 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2373,6 +2373,16 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+@@ -2385,6 +2385,16 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  		if (changed & IEEE80211_RC_SMPS_CHANGED)
  			mt7996_mcu_set_fixed_field(dev, mconf, link_sta, mlink, NULL,
  						   RATE_PARAM_MMPS_UPDATE);
@@ -50,10 +52,10 @@
  		spin_lock_bh(&dev->mt76.sta_poll_lock);
  	}
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 596f58cc..12ab9fcd 100644
+index 6149f227..94746005 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2659,6 +2659,7 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
+@@ -2664,6 +2664,7 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
  	case RATE_PARAM_FIXED_MCS:
  	case RATE_PARAM_FIXED_GI:
  	case RATE_PARAM_FIXED_HE_LTF:
@@ -61,7 +63,7 @@
  		if (phy)
  			ra->phy = *phy;
  		break;
-@@ -2884,6 +2885,12 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+@@ -2889,6 +2890,12 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  	if (IS_ERR(skb))
  		return PTR_ERR(skb);
  
@@ -87,10 +89,10 @@
  #ifdef CONFIG_MTK_VENDOR
  	RATE_PARAM_FIXED_MIMO = 30,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 2ad48f96..a7c6a32d 100644
+index d56d9715..0b3df44a 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -516,6 +516,8 @@ struct csi_data {
+@@ -517,6 +517,8 @@ struct csi_data {
  
  	struct list_head node;
  };
@@ -99,7 +101,7 @@
  #endif
  
  struct mt7996_rro_ba_session {
-@@ -786,7 +788,8 @@ struct mt7996_dev {
+@@ -791,7 +793,8 @@ struct mt7996_dev {
  	const struct mt7996_dbg_reg_desc *dbg_reg;
  #endif
  #ifdef CONFIG_MTK_VENDOR
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0149-mtk-mt76-mt7996-record-RSSI-and-SNR.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0149-mtk-mt76-mt7996-record-RSSI-and-SNR.patch
index 9aad105..21983e5 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0149-mtk-mt76-mt7996-record-RSSI-and-SNR.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0149-mtk-mt76-mt7996-record-RSSI-and-SNR.patch
@@ -1,13 +1,14 @@
-From 04b31a4bc7572c567068dcbfe0dc9fcb4396e930 Mon Sep 17 00:00:00 2001
+From bd67084cff9aa21fe1b714ebcfe771aad0286e11 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Thu, 13 Jun 2024 17:27:03 +0800
-Subject: [PATCH 149/195] mtk: mt76: mt7996: record RSSI and SNR
+Subject: [PATCH 149/223] mtk: mt76: mt7996: record RSSI and SNR
 
 RSSI and SNR information were incomplete.
 - RSSI: per-antenna ACK-frame RSSI was not reported.
 - SNR: unavailable.
 Therefore, get and record these signal statuses in order to show them for debugging purposes.
 
+Change-Id: I8997b8433f5af6769792e158ebf03a7f54eb3210
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt7996/mac.c    |  9 +++++-
@@ -17,7 +18,7 @@
  4 files changed, 70 insertions(+), 32 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index c59cc7cc..017e3465 100644
+index 19484081..c341a553 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -493,6 +493,13 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
@@ -34,7 +35,7 @@
  		/* RXD Group 5 - C-RXV */
  		if (rxd1 & MT_RXD1_NORMAL_GROUP_5) {
  			rxd += 24;
-@@ -2413,7 +2420,7 @@ void mt7996_mac_work(struct work_struct *work)
+@@ -2425,7 +2432,7 @@ void mt7996_mac_work(struct work_struct *work)
  			if (i == mphy->band_idx) {
  				mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_RATE);
  				mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_AIRTIME);
@@ -44,10 +45,10 @@
  					mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_ADM_STAT);
  					mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_MSDU_COUNT);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 12ab9fcd..3219ae8a 100644
+index 94746005..db975daa 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -5794,14 +5794,15 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val)
+@@ -5817,14 +5817,15 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val)
  }
  
  int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
@@ -65,7 +66,7 @@
  	struct {
  		u8 __rsv1;
  		u8 unsolicit;
-@@ -5840,23 +5841,18 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
+@@ -5863,23 +5864,18 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
  	switch (tag) {
  	case UNI_PER_STA_RSSI:
  		for (i = 0; i < sta_num; ++i) {
@@ -99,7 +100,7 @@
  				ewma_avg_signal_add(&mlink->avg_ack_signal, -mlink->ack_signal);
  			} else {
  				ret = -EINVAL;
-@@ -5865,6 +5861,21 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
+@@ -5888,6 +5884,21 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
  			}
  		}
  		break;
@@ -121,7 +122,7 @@
  	default:
  		ret = -EINVAL;
  		dev_err(dev->dev, "Unknown UNI_PER_STA_INFO_TAG: %d\n", tag);
-@@ -5875,7 +5886,7 @@ out:
+@@ -5898,7 +5909,7 @@ out:
  	return ret;
  }
  
@@ -130,7 +131,7 @@
  {
  	u16 sta_list[PER_STA_INFO_MAX_NUM];
  	LIST_HEAD(sta_poll_list);
-@@ -5900,8 +5911,8 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
+@@ -5923,8 +5934,8 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
  				break;
  			}
  			mlink = list_first_entry(&sta_poll_list,
@@ -141,7 +142,7 @@
  			list_del_init(&mlink->wcid.poll_list);
  			spin_unlock_bh(&dev->sta_poll_lock);
  
-@@ -5909,16 +5920,23 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
+@@ -5932,16 +5943,23 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
  		}
  
  		ret = mt7996_mcu_get_per_sta_info(dev, UNI_PER_STA_RSSI,
@@ -202,10 +203,10 @@
  } __packed;
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index a7c6a32d..1a0b9d3a 100644
+index 0b3df44a..ee43c9e0 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -317,9 +317,15 @@ struct mt7996_link_sta {
+@@ -318,9 +318,15 @@ struct mt7996_link_sta {
  
  	struct list_head rc_list;
  
@@ -221,7 +222,7 @@
  	unsigned long changed;
  
  	struct mt76_connac_sta_key_conf bip;
-@@ -1126,7 +1132,7 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
+@@ -1130,7 +1136,7 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
  void mt7996_mcu_exit(struct mt7996_dev *dev);
  int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
  	                        u16 sta_num, u16 *sta_list);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0150-mtk-mt76-mt7996-support-find-the-mt7996_phy-by-link_.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0150-mtk-mt76-mt7996-support-find-the-mt7996_phy-by-link_.patch
index 6887f66..1045b99 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0150-mtk-mt76-mt7996-support-find-the-mt7996_phy-by-link_.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0150-mtk-mt76-mt7996-support-find-the-mt7996_phy-by-link_.patch
@@ -1,7 +1,7 @@
-From fcf94a4c0d4add289ab76cef46fc782ca3425d8e Mon Sep 17 00:00:00 2001
+From 5538043f91de86efa859432e4473f020bdcd23c3 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 20 Jun 2024 10:55:07 +0800
-Subject: [PATCH 150/195] mtk: mt76: mt7996: support find the mt7996_phy by
+Subject: [PATCH 150/223] mtk: mt76: mt7996: support find the mt7996_phy by
  link_id for vendor command
 
 Add support to find the corresponding phy by link_id. This commit is for
@@ -11,6 +11,8 @@
 
 Fix the way to find the band_idx if WiFi7 AP is non-MLD mode.
 
+Change-Id: Iee16822ac76f5feecd0d7c6996f5b6d800d6cf44
+Change-Id: Iac6380de23107135acc7b2b03cc448e3b50cd45c
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
  mt7996/mt7996.h      |  5 +++--
@@ -20,10 +22,10 @@
  4 files changed, 30 insertions(+), 18 deletions(-)
 
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 1a0b9d3a..22f4d53a 100644
+index ee43c9e0..b0d9b0bd 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1326,11 +1326,12 @@ int mt7996_mcu_set_txbf_internal(struct mt7996_phy *phy, u8 action, int idx, boo
+@@ -1330,11 +1330,12 @@ int mt7996_mcu_set_txbf_internal(struct mt7996_phy *phy, u8 action, int idx, boo
  void mt7996_mcu_rx_bf_event(struct mt7996_dev *dev, struct sk_buff *skb);
  int mt7996_mcu_set_muru_fixed_rate_enable(struct mt7996_dev *dev, u8 action, int val);
  int mt7996_mcu_set_muru_fixed_rate_parameter(struct mt7996_dev *dev, u8 action, void *para);
@@ -39,10 +41,10 @@
  void mt7996_mcu_set_nusers_ofdma(struct mt7996_phy *phy, u8 type, u8 ofdma_user_cnt);
  void mt7996_mcu_set_cert(struct mt7996_phy *phy, u8 type);
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index a7cbde3e..9bd35c91 100644
+index 9d8c1942..f13f09e1 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -2929,7 +2929,7 @@ mt7996_bf_txsnd_info_set(struct file *file,
+@@ -2928,7 +2928,7 @@ mt7996_bf_txsnd_info_set(struct file *file,
  	else
  		buf[count] = '\0';
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0151-mtk-mt76-mt7996-workaround-for-get_tsf-crash-issue.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0151-mtk-mt76-mt7996-workaround-for-get_tsf-crash-issue.patch
index 8648330..0b8ea2c 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0151-mtk-mt76-mt7996-workaround-for-get_tsf-crash-issue.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0151-mtk-mt76-mt7996-workaround-for-get_tsf-crash-issue.patch
@@ -1,14 +1,14 @@
-From 2538c34446dda26f649aafc7f9a2c4757d8876b3 Mon Sep 17 00:00:00 2001
+From 2f3676a2b60827dfd02540af2e0325e50161ff6a Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Mon, 24 Jun 2024 11:09:50 +0800
-Subject: [PATCH 151/195] mtk: mt76: mt7996: workaround for get_tsf crash issue
+Subject: [PATCH 151/223] mtk: mt76: mt7996: workaround for get_tsf crash issue
 
 ---
  mt7996/main.c | 15 ++++++++++++---
  1 file changed, 12 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index f6422b1f..0d8adfba 100644
+index 647e0e8a..455beb74 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1634,11 +1634,20 @@ mt7996_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0152-mtk-mt76-add-debugfs-for-tx-drop-counters.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0152-mtk-mt76-add-debugfs-for-tx-drop-counters.patch
index a164054..b753114 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0152-mtk-mt76-add-debugfs-for-tx-drop-counters.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0152-mtk-mt76-add-debugfs-for-tx-drop-counters.patch
@@ -1,8 +1,9 @@
-From d2c9006a5bfe9e236d999caa097627bb18e51f0d Mon Sep 17 00:00:00 2001
+From e126a0d9cd5d6a25caf5db58a5cc5edb6b22cc16 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 13 Jun 2024 17:47:13 +0800
-Subject: [PATCH 152/195] mtk: mt76: add debugfs for tx drop counters
+Subject: [PATCH 152/223] mtk: mt76: add debugfs for tx drop counters
 
+Change-Id: I1d375169cca29fb58544edfbd235ef3e058a130a
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  dma.c                | 22 +++++++++---
@@ -86,7 +87,7 @@
  				tx_info.info, tx_info.skb, t);
  
 diff --git a/mac80211.c b/mac80211.c
-index 04a24544..6412a002 100644
+index a555bec2..93ff77be 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -417,6 +417,7 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
@@ -106,10 +107,10 @@
  	init_waitqueue_head(&dev->tx_wait);
  
 diff --git a/mt76.h b/mt76.h
-index 3099199c..576e9d58 100644
+index 8e71c2ce..8e78ba86 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -847,6 +847,31 @@ struct mt76_vif {
+@@ -849,6 +849,31 @@ struct mt76_vif {
  	struct ieee80211_chanctx_conf *ctx;
  };
  
@@ -141,7 +142,7 @@
  struct mt76_phy {
  	struct ieee80211_hw *hw;
  	struct ieee80211_hw *ori_hw;
-@@ -904,6 +929,7 @@ struct mt76_phy {
+@@ -906,6 +931,7 @@ struct mt76_phy {
  		bool al;
  		u8 pin;
  	} leds;
@@ -149,7 +150,7 @@
  };
  
  struct mt76_dev {
-@@ -1008,6 +1034,7 @@ struct mt76_dev {
+@@ -1010,6 +1036,7 @@ struct mt76_dev {
  	};
  
  	const char *bin_file_name;
@@ -158,10 +159,10 @@
  
  #define MT76_MAX_AMSDU_NUM 8
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 017e3465..0f282f16 100644
+index c341a553..a78ebefc 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -897,11 +897,15 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -909,11 +909,15 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	u8 *txwi = (u8 *)txwi_ptr;
  	u8 link_id;
  
@@ -179,7 +180,7 @@
  
  	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mvif->sta;
  	if (ieee80211_is_data_qos(hdr->frame_control) && sta->mlo) {
-@@ -927,15 +931,19 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -939,15 +943,19 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	}
  
  	mconf = rcu_dereference(mvif->link[wcid->link_id]);
@@ -201,7 +202,7 @@
  #ifdef CONFIG_MTK_DEBUG
  	t->jiffies = jiffies;
  #endif
-@@ -957,8 +965,10 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -969,8 +977,10 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  
  		conf = rcu_dereference(vif->link_conf[wcid->link_id]);
  		link_sta = rcu_dereference(sta->link[wcid->link_id]);
@@ -214,7 +215,7 @@
  		dma_sync_single_for_cpu(mdev->dma_dev, tx_info->buf[1].addr,
  					tx_info->buf[1].len, DMA_TO_DEVICE);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 0d8adfba..b04ce154 100644
+index 455beb74..8fb68880 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1427,11 +1427,13 @@ static void mt7996_tx(struct ieee80211_hw *hw,
@@ -253,10 +254,10 @@
  }
  
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 9bd35c91..759b9d8f 100644
+index f13f09e1..d15d403b 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -4163,6 +4163,83 @@ out:
+@@ -4162,6 +4162,83 @@ out:
  	return ret;
  }
  
@@ -340,7 +341,7 @@
  /* DRR */
  static int
  mt7996_drr_info(struct seq_file *s, void *data)
-@@ -4288,6 +4365,9 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
+@@ -4287,6 +4364,9 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
  	/* amsdu */
  	debugfs_create_file("amsdu_algo", 0600, dir, dev, &fops_amsdu_algo);
  	debugfs_create_file("amsdu_para", 0600, dir, dev, &fops_amsdu_para);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0153-mtk-mt76-add-debugfs-for-rx-drop-counters.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0153-mtk-mt76-add-debugfs-for-rx-drop-counters.patch
index d10e059..a78ee58 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0153-mtk-mt76-add-debugfs-for-rx-drop-counters.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0153-mtk-mt76-add-debugfs-for-rx-drop-counters.patch
@@ -1,8 +1,9 @@
-From f48e21ac138f2b05fe0d04416a357f0c67c242f4 Mon Sep 17 00:00:00 2001
+From b230d11d8c61d395043c5463a780f7bcabfc7196 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 23 May 2024 02:33:47 +0800
-Subject: [PATCH 153/195] mtk: mt76: add debugfs for rx drop counters
+Subject: [PATCH 153/223] mtk: mt76: add debugfs for rx drop counters
 
+Change-Id: I23c494a80095c680cfe7765b5898fb044a4b73da
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  agg-rx.c             |  9 +++++
@@ -233,7 +234,7 @@
  
  #endif
 diff --git a/mac80211.c b/mac80211.c
-index 6412a002..58babaf0 100644
+index 93ff77be..6190822c 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -418,6 +418,7 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
@@ -287,10 +288,10 @@
  
  static void
 diff --git a/mt76.h b/mt76.h
-index 576e9d58..88464896 100644
+index 8e78ba86..62ae2662 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -187,6 +187,34 @@ enum mt76_dfs_state {
+@@ -188,6 +188,34 @@ enum mt76_dfs_state {
  	MT_DFS_STATE_ACTIVE,
  };
  
@@ -325,7 +326,7 @@
  struct mt76_queue_buf {
  	dma_addr_t addr;
  	u16 len:15,
-@@ -255,6 +283,8 @@ struct mt76_queue {
+@@ -256,6 +284,8 @@ struct mt76_queue {
  	dma_addr_t desc_dma;
  	struct sk_buff *rx_head;
  	struct page_frag_cache rx_page;
@@ -334,7 +335,7 @@
  };
  
  struct mt76_mcu_ops {
-@@ -872,6 +902,14 @@ struct mt76_tx_debug {
+@@ -874,6 +904,14 @@ struct mt76_tx_debug {
  	spinlock_t lock;
  };
  
@@ -349,7 +350,7 @@
  struct mt76_phy {
  	struct ieee80211_hw *hw;
  	struct ieee80211_hw *ori_hw;
-@@ -930,6 +968,7 @@ struct mt76_phy {
+@@ -932,6 +970,7 @@ struct mt76_phy {
  		u8 pin;
  	} leds;
  	struct mt76_tx_debug tx_dbg_stats;
@@ -358,10 +359,10 @@
  
  struct mt76_dev {
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 0f282f16..2f37d31c 100644
+index a78ebefc..ee505a55 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1410,9 +1410,11 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+@@ -1422,9 +1422,11 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  			 struct sk_buff *skb, u32 *info)
  {
  	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
@@ -373,7 +374,7 @@
  
  	type = le32_get_bits(rxd[0], MT_RXD0_PKT_TYPE);
  	if (type != PKT_TYPE_NORMAL) {
-@@ -1447,12 +1449,23 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+@@ -1459,12 +1461,23 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  		dev_kfree_skb(skb);
  		break;
  	case PKT_TYPE_NORMAL:
@@ -398,10 +399,10 @@
  		break;
  	}
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 759b9d8f..b16ea5fe 100644
+index d15d403b..422518f5 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -4240,6 +4240,84 @@ out:
+@@ -4239,6 +4239,84 @@ out:
  }
  DEFINE_SHOW_ATTRIBUTE(mt7996_tx_drop);
  
@@ -486,7 +487,7 @@
  /* DRR */
  static int
  mt7996_drr_info(struct seq_file *s, void *data)
-@@ -4368,6 +4446,7 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
+@@ -4367,6 +4445,7 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
  
  	/* Drop counters */
  	debugfs_create_file("tx_drop_stats", 0400, dir, dev, &mt7996_tx_drop_fops);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0154-mtk-mt76-mt7996-add-support-for-remain-on-channel-op.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0154-mtk-mt76-mt7996-add-support-for-remain-on-channel-op.patch
index c9c2774..f68f239 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0154-mtk-mt76-mt7996-add-support-for-remain-on-channel-op.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0154-mtk-mt76-mt7996-add-support-for-remain-on-channel-op.patch
@@ -1,7 +1,7 @@
-From 0d9252454a9ab6c9c70f07bf58ff3a1fe1487342 Mon Sep 17 00:00:00 2001
+From 78e6f75e8e5114ed78257bf708655084fe36dcd1 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Fri, 7 Jun 2024 15:24:00 +0800
-Subject: [PATCH 154/195] mtk: mt76: mt7996: add support for remain-on-channel
+Subject: [PATCH 154/223] mtk: mt76: mt7996: add support for remain-on-channel
  operation
 
 Remain-on-channel operation allows interface to temporarily leave the
@@ -17,6 +17,7 @@
 3. The MLd STA can remain on full-band channels even if it does not have
    connection on that band. In such case, the default link is used.
 
+Change-Id: Idefe2623133ada2646612e2f13452257ca83b992
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt7996/init.c   |   4 ++
@@ -25,7 +26,7 @@
  3 files changed, 181 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 55eb32cb..5f38374f 100644
+index 18a86afe..fe2958f5 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -498,6 +498,8 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -45,7 +46,7 @@
  
  	ret = mt7996_eeprom_parse_hw_cap(dev, phy);
  	if (ret)
-@@ -1676,6 +1679,7 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1696,6 +1699,7 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	INIT_WORK(&dev->rc_work, mt7996_mac_sta_rc_work);
  	INIT_DELAYED_WORK(&dev->mphy.mac_work, mt7996_mac_work);
  	INIT_DELAYED_WORK(&dev->phy.scan_work, mt7996_scan_work);
@@ -54,7 +55,7 @@
  	INIT_LIST_HEAD(&dev->sta_rc_list);
  	INIT_LIST_HEAD(&dev->twt_list);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index b04ce154..c7c2ad98 100644
+index 8fb68880..ff4ef55d 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -505,6 +505,7 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
@@ -281,10 +282,10 @@
  	.get_txpower = mt7996_get_txpower,
  	.channel_switch_beacon = mt7996_channel_switch_beacon,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 22f4d53a..062c0087 100644
+index b0d9b0bd..251a3c70 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -597,6 +597,10 @@ struct mt7996_phy {
+@@ -598,6 +598,10 @@ struct mt7996_phy {
  	struct mt7996_scs_ctrl scs_ctrl;
  	u32 red_drop;
  
@@ -295,7 +296,7 @@
  	bool sku_limit_en;
  	bool sku_path_en;
  
-@@ -1249,6 +1253,7 @@ bool mt7996_rx_check(struct mt76_dev *mdev, void *data, int len);
+@@ -1253,6 +1257,7 @@ bool mt7996_rx_check(struct mt76_dev *mdev, void *data, int len);
  void mt7996_stats_work(struct work_struct *work);
  void mt7996_scan_work(struct work_struct *work);
  void mt7996_scan_complete(struct mt7996_phy *phy, bool aborted);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0155-mtk-mt76-mt7996-rework-the-setting-flow-of-starec-RA.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0155-mtk-mt76-mt7996-rework-the-setting-flow-of-starec-RA.patch
index cddb2a5..4cb45ec 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0155-mtk-mt76-mt7996-rework-the-setting-flow-of-starec-RA.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0155-mtk-mt76-mt7996-rework-the-setting-flow-of-starec-RA.patch
@@ -1,7 +1,7 @@
-From bcb9d42e610ec78f53fafccf4e399a56be22611d Mon Sep 17 00:00:00 2001
+From 6d567ce5c36ea5a0c26cb2b55063bbc383adbca7 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 26 Jun 2024 19:09:46 +0800
-Subject: [PATCH 155/195] mtk: mt76: mt7996: rework the setting flow of starec
+Subject: [PATCH 155/223] mtk: mt76: mt7996: rework the setting flow of starec
  RA and MLD tags
 
 1. STA_REC_RA and STA_REC_MLD tags need to be set when newly is true,
@@ -10,6 +10,7 @@
 
 2. This patch also tries to fix random EAPOL timeout issue.
 
+Change-Id: Icffce3a25d0290b42c84c5ff94bbb5e6762f1f9d
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mt7996/main.c   |   4 --
@@ -19,7 +20,7 @@
  4 files changed, 83 insertions(+), 113 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index c7c2ad98..2643a72e 100644
+index ff4ef55d..103902b7 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1318,10 +1318,6 @@ mt7996_mac_sta_add_links(struct mt7996_dev *dev, struct ieee80211_vif *vif,
@@ -34,10 +35,10 @@
  error:
  	mt7996_mac_sta_remove_links(dev, vif, sta, add);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 3219ae8a..29f9a5f8 100644
+index db975daa..bad8e030 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -2911,6 +2911,77 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+@@ -2916,6 +2916,77 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  	return mt7996_mcu_add_rate_ctrl_fixed(dev, conf, mconf, link_sta, mlink);
  }
  
@@ -115,7 +116,7 @@
  #if 0
  static int
  mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf,
-@@ -2980,6 +3051,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+@@ -2985,6 +3056,8 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  
  	/* tag order is in accordance with firmware dependency. */
  	if (link_sta) {
@@ -124,7 +125,7 @@
  		/* starec hdrt mode */
  		mt7996_mcu_sta_hdrt_tlv(dev, skb);
  		/* starec bfer */
-@@ -2989,7 +3062,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+@@ -2994,7 +3067,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  		/* starec vht */
  		mt7996_mcu_sta_vht_tlv(skb, link_sta);
  		/* starec uapsd */
@@ -133,7 +134,7 @@
  		/* starec amsdu */
  		mt7996_mcu_sta_amsdu_tlv(dev, skb, vif, link_sta, mlink);
  		/* starec he */
-@@ -3002,6 +3075,12 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+@@ -3007,6 +3080,12 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  		mt7996_mcu_sta_muru_tlv(dev, skb, conf, mconf, link_sta);
  		/* starec bfee */
  		mt7996_mcu_sta_bfee_tlv(dev, skb, conf, mconf, link_sta);
@@ -146,7 +147,7 @@
  	}
  
  #if 0
-@@ -3016,112 +3095,6 @@ out:
+@@ -3021,112 +3100,6 @@ out:
  				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
  }
  
@@ -274,10 +275,10 @@
  
  #define MT7996_MAX_BEACON_SIZE		1338
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 062c0087..50011283 100644
+index 251a3c70..edd9c7c9 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1083,8 +1083,6 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+@@ -1087,8 +1087,6 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  			     struct mt7996_bss_conf *mconf,
  			     struct ieee80211_link_sta *link_sta,
  			     struct mt7996_link_sta *mlink, bool changed);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0156-mtk-mt76-mt7996-Fix-NULL-pointer-crash-when-mac-tx-f.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0156-mtk-mt76-mt7996-Fix-NULL-pointer-crash-when-mac-tx-f.patch
index d7474a6..36029cf 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0156-mtk-mt76-mt7996-Fix-NULL-pointer-crash-when-mac-tx-f.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0156-mtk-mt76-mt7996-Fix-NULL-pointer-crash-when-mac-tx-f.patch
@@ -1,7 +1,7 @@
-From d36548b47e367d6602d37e43352b5f0fb13eab9b Mon Sep 17 00:00:00 2001
+From 59aecb430cc995720c5fa10353fb68372952f0df Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Thu, 27 Jun 2024 14:54:38 +0800
-Subject: [PATCH 156/195] mtk: mt76: mt7996: Fix NULL pointer crash when mac tx
+Subject: [PATCH 156/223] mtk: mt76: mt7996: Fix NULL pointer crash when mac tx
  free with a msta that has been removed.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
@@ -10,10 +10,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 2f37d31c..12cc60cb 100644
+index ee505a55..3cd034cd 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1200,7 +1200,7 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+@@ -1212,7 +1212,7 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
  				struct mt7996_link_sta *mlink =
  					rcu_dereference(msta->link[link_id]);
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0157-mtk-mt76-mt7996-update-adie-efuse-merge-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0157-mtk-mt76-mt7996-update-adie-efuse-merge-support.patch
index 883c23d..40f9db6 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0157-mtk-mt76-mt7996-update-adie-efuse-merge-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0157-mtk-mt76-mt7996-update-adie-efuse-merge-support.patch
@@ -1,22 +1,23 @@
-From f31212f07e23f72c904afd1dca22666668ff18b5 Mon Sep 17 00:00:00 2001
+From b930141330014c5e7402fe75bd05e2f2a9705a81 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 14 Jun 2024 10:14:31 +0800
-Subject: [PATCH 157/195] mtk: mt76: mt7996: update adie efuse merge support
+Subject: [PATCH 157/223] mtk: mt76: mt7996: update adie efuse merge support
 
 Refactor efuse merge due to FW supporting the efuse merge mcu command
 
+Change-Id: I99f3c3577826f505e402c884cc1f4815f519d2bc
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
- mt7996/eeprom.c | 144 -----------------------------------------
- mt7996/mcu.c    | 167 +++++++++++++++++++++++++++++++++++++++++++++++-
+ mt7996/eeprom.c | 144 --------------------------------------------
+ mt7996/mcu.c    | 155 +++++++++++++++++++++++++++++++++++++++++++++++-
  mt7996/mcu.h    |   1 +
- 3 files changed, 167 insertions(+), 145 deletions(-)
+ 3 files changed, 153 insertions(+), 147 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index e8e1d85a..fb0f2953 100644
+index 72a21fcf..327a36b2 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -531,146 +531,6 @@ fail:
+@@ -564,146 +564,6 @@ fail:
  	return ret;
  }
  
@@ -77,7 +78,7 @@
 -	case 0x7990:
 -		adie_base = adie_base_7996;
 -		/* adie 0 */
--		if (dev->fem_type == MT7996_FEM_INT && dev->chip_sku != MT7996_SKU_233)
+-		if (dev->fem_type == MT7996_FEM_INT && dev->chip_sku != MT7996_VAR_TYPE_233)
 -			adie_id = ADIE_7975;
 -		else
 -			adie_id = ADIE_7976;
@@ -85,7 +86,7 @@
 -		eep_offs[0] = eep_offs_list[adie_id];
 -
 -		/* adie 1 */
--		if (dev->chip_sku == MT7996_SKU_444) {
+-		if (dev->chip_sku == MT7996_VAR_TYPE_444) {
 -			adie_offs[1] = adie_offs_list[ADIE_7977];
 -			eep_offs[1] = eep_offs_list[ADIE_7977];
 -		}
@@ -97,10 +98,10 @@
 -	case 0x7992:
 -		adie_base = adie_base_7992;
 -		/* adie 0 */
--		if (dev->chip_sku == MT7992_SKU_44 &&
+-		if (dev->chip_sku == MT7992_VAR_TYPE_44 &&
 -		    dev->fem_type != MT7996_FEM_EXT)
 -			adie_id = ADIE_7975;
--		else if (dev->chip_sku == MT7992_SKU_24)
+-		else if (dev->chip_sku == MT7992_VAR_TYPE_24)
 -			adie_id = ADIE_7978;
 -		else
 -			adie_id = ADIE_7976;
@@ -108,10 +109,10 @@
 -		eep_offs[0] = eep_offs_list[adie_id];
 -
 -		/* adie 1 */
--		if (dev->chip_sku == MT7992_SKU_44 &&
+-		if (dev->chip_sku == MT7992_VAR_TYPE_44 &&
 -		    dev->fem_type != MT7996_FEM_INT)
 -			adie_id = ADIE_7977;
--		else if (dev->chip_sku != MT7992_SKU_23)
+-		else if (dev->chip_sku != MT7992_VAR_TYPE_23)
 -			adie_id = ADIE_7979;
 -		else
 -			break;
@@ -137,7 +138,7 @@
 -			if (adie_offs[band][i] == MT_EE_END_OFFSET)
 -				break;
 -
--			if (is_mt7996(&dev->mt76) && dev->chip_sku == MT7996_SKU_444 &&
+-			if (is_mt7996(&dev->mt76) && dev->chip_sku == MT7996_VAR_TYPE_444 &&
 -			    band == MT_BAND1)
 -				eep_offset -= MT_EE_7977BN_OFFSET;
 -
@@ -163,7 +164,7 @@
  int mt7996_eeprom_init(struct mt7996_dev *dev)
  {
  	int ret;
-@@ -685,10 +545,6 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
+@@ -714,10 +574,6 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
  
  	mt7996_eeprom_load_precal(dev);
  
@@ -175,14 +176,13 @@
  	if (ret < 0)
  		return ret;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 29f9a5f8..fe04ffbb 100644
+index bad8e030..9194886b 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -4598,7 +4598,151 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag, bool sta)
+@@ -4603,6 +4603,150 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag, bool sta)
  				 &req, sizeof(req), true);
  }
  
--int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
 +static int mt7996_mcu_set_cal_free_data(struct mt7996_dev *dev)
 +{
 +#define MT_EE_CAL_FREE_MAX_SIZE		30
@@ -238,7 +238,7 @@
 +	case 0x7990:
 +		adie_base = adie_base_7996;
 +		/* adie 0 */
-+		if (dev->fem_type == MT7996_FEM_INT && dev->chip_sku != MT7996_SKU_233)
++		if (dev->fem_type == MT7996_FEM_INT && dev->chip_sku != MT7996_VAR_TYPE_233)
 +			adie_id = ADIE_7975;
 +		else
 +			adie_id = ADIE_7976;
@@ -246,7 +246,7 @@
 +		eep_offs[0] = eep_offs_list[adie_id];
 +
 +		/* adie 1 */
-+		if (dev->chip_sku == MT7996_SKU_444) {
++		if (dev->chip_sku == MT7996_VAR_TYPE_444) {
 +			adie_offs[1] = adie_offs_list[ADIE_7977];
 +			eep_offs[1] = eep_offs_list[ADIE_7977];
 +		}
@@ -258,10 +258,10 @@
 +	case 0x7992:
 +		adie_base = adie_base_7992;
 +		/* adie 0 */
-+		if (dev->chip_sku == MT7992_SKU_44 &&
++		if (dev->chip_sku == MT7992_VAR_TYPE_44 &&
 +		    dev->fem_type != MT7996_FEM_EXT)
 +			adie_id = ADIE_7975;
-+		else if (dev->chip_sku == MT7992_SKU_24)
++		else if (dev->chip_sku == MT7992_VAR_TYPE_24)
 +			adie_id = ADIE_7978;
 +		else
 +			adie_id = ADIE_7976;
@@ -269,10 +269,10 @@
 +		eep_offs[0] = eep_offs_list[adie_id];
 +
 +		/* adie 1 */
-+		if (dev->chip_sku == MT7992_SKU_44 &&
++		if (dev->chip_sku == MT7992_VAR_TYPE_44 &&
 +		    dev->fem_type != MT7996_FEM_INT)
 +			adie_id = ADIE_7977;
-+		else if (dev->chip_sku != MT7992_SKU_23)
++		else if (dev->chip_sku != MT7992_VAR_TYPE_23)
 +			adie_id = ADIE_7979;
 +		else
 +			break;
@@ -311,7 +311,7 @@
 +			if (adie_offs[band][i] == MT_EE_END_OFFSET)
 +				break;
 +
-+			if (is_mt7996(&dev->mt76) && dev->chip_sku == MT7996_SKU_444 &&
++			if (is_mt7996(&dev->mt76) && dev->chip_sku == MT7996_VAR_TYPE_444 &&
 +			    band == MT_BAND1)
 +				eep_offset -= MT_EE_7977BN_OFFSET;
 +
@@ -327,38 +327,30 @@
 +	return 0;
 +}
 +
-+int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
+ int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
  {
  #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
- #define PAGE_IDX_MASK		GENMASK(4, 2)
-@@ -4643,6 +4787,27 @@ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
- 	return 0;
- }
- 
-+int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
-+{
-+	struct mt7996_mcu_eeprom req = {
-+		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
-+		.len = cpu_to_le16(sizeof(req) - 4),
-+		.buffer_mode = EE_MODE_EFUSE,
-+		.format = EE_FORMAT_WHOLE
-+	};
+@@ -4656,12 +4800,17 @@ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
+ 		.buffer_mode = EE_MODE_EFUSE,
+ 		.format = EE_FORMAT_WHOLE
+ 	};
 +	int ret;
-+
-+	if (dev->flash_mode)
+ 
+ 	if (dev->flash_mode)
+-		return mt7996_mcu_set_eeprom_flash(dev);
 +		ret = mt7996_mcu_set_eeprom_flash(dev);
 +	else
 +		ret = mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(EFUSE_CTRL),
 +					&req, sizeof(req), true);
 +	if (ret)
 +		return ret;
-+
+ 
+-	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(EFUSE_CTRL),
+-				 &req, sizeof(req), true);
 +	return mt7996_mcu_set_cal_free_data(dev);
-+}
-+
- int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf)
- {
- 	struct mt7996_mcu_eeprom_info req = {
+ }
+ 
+ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len)
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
 index 05b29c90..d99e9a60 100644
 --- a/mt7996/mcu.h
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0158-mtk-mt76-mt7996-support-handle-link_id-in-ap_wireles.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0158-mtk-mt76-mt7996-support-handle-link_id-in-ap_wireles.patch
index 2f21f59..27a87a7 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0158-mtk-mt76-mt7996-support-handle-link_id-in-ap_wireles.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0158-mtk-mt76-mt7996-support-handle-link_id-in-ap_wireles.patch
@@ -1,7 +1,7 @@
-From a6266e4b14f911b0b9b0869f5b81948fe39f6b46 Mon Sep 17 00:00:00 2001
+From e2ca291d9edba04731cbec32d52ad00c13e5d1c9 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 14 Jun 2024 14:54:44 +0800
-Subject: [PATCH 158/195] mtk: mt76: mt7996: support handle link_id in
+Subject: [PATCH 158/223] mtk: mt76: mt7996: support handle link_id in
  ap_wireless vendor cmd
 
 Add support handle link_id in ap_wireless vendor command. The link_id is
@@ -11,6 +11,7 @@
 This commit also refactor some functions, changing the parameter from
 phy to dev since phy is not required.
 
+Change-Id: I8d86ca45d2417d155114f27b13e7172565264e3f
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
  mt7996/mt7996.h  | 12 +++++------
@@ -20,10 +21,10 @@
  4 files changed, 73 insertions(+), 44 deletions(-)
 
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 50011283..fe97bea1 100644
+index edd9c7c9..c122989d 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1300,8 +1300,8 @@ int mt7996_vendor_amnt_sta_remove(struct mt7996_phy *phy,
+@@ -1304,8 +1304,8 @@ int mt7996_vendor_amnt_sta_remove(struct mt7996_phy *phy,
  				  struct ieee80211_sta *sta);
  void mt7996_set_wireless_amsdu(struct ieee80211_hw *hw, u8 en);
  void mt7996_mcu_set_mimo(struct mt7996_phy *phy);
@@ -34,7 +35,7 @@
  void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
  int mt7996_mcu_set_csi(struct mt7996_phy *phy, u8 mode,
  		       u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
-@@ -1332,12 +1332,12 @@ int mt7996_mcu_set_muru_fixed_rate_parameter(struct mt7996_dev *dev, u8 action,
+@@ -1336,12 +1336,12 @@ int mt7996_mcu_set_muru_fixed_rate_parameter(struct mt7996_dev *dev, u8 action,
  int mt7996_mcu_set_txbf_snd_info(struct mt7996_dev *dev, void *para);
  int mt7996_mcu_set_muru_cmd(struct mt7996_dev *dev, u16 action, int val);
  int mt7996_mcu_muru_set_prot_frame_thr(struct mt7996_dev *dev, u32 val);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0159-mtk-mt76-mt7996-fix-incorrect-indexing-of-MIB-FW-eve.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0159-mtk-mt76-mt7996-fix-incorrect-indexing-of-MIB-FW-eve.patch
index 097f952..9941a17 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0159-mtk-mt76-mt7996-fix-incorrect-indexing-of-MIB-FW-eve.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0159-mtk-mt76-mt7996-fix-incorrect-indexing-of-MIB-FW-eve.patch
@@ -1,21 +1,22 @@
-From c98e115c139b2d3ad055e96ac9f8c2ae349bc274 Mon Sep 17 00:00:00 2001
+From 2986830e53280e7c49ef3893108a631d19d88023 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Fri, 28 Jun 2024 18:03:41 +0800
-Subject: [PATCH 159/195] mtk: mt76: mt7996: fix incorrect indexing of MIB FW
+Subject: [PATCH 159/223] mtk: mt76: mt7996: fix incorrect indexing of MIB FW
  event
 
 When porting channel state reporting from Wi-Fi 6 to Wi-Fi 7 codebase, indexing of FW event of MIB data was not properly handled.
 
+Change-Id: I4fbc68505d072c0f393d20c625aa58c66934f557
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt7996/mcu.c | 45 +++++++++++++++++++++++++++++----------------
  1 file changed, 29 insertions(+), 16 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index fe04ffbb..c65154f8 100644
+index 9194886b..723a7ad9 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -5109,6 +5109,13 @@ int mt7996_mcu_get_chip_config(struct mt7996_dev *dev, u32 *cap)
+@@ -5116,6 +5116,13 @@ int mt7996_mcu_get_chip_config(struct mt7996_dev *dev, u32 *cap)
  
  int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch)
  {
@@ -29,7 +30,7 @@
  	struct {
  		struct {
  			u8 band;
-@@ -5118,16 +5125,15 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch)
+@@ -5125,16 +5132,15 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch)
  			__le16 tag;
  			__le16 len;
  			__le32 offs;
@@ -51,7 +52,7 @@
  	};
  	struct mt76_channel_state *state = phy->mt76->chan_state;
  	struct mt76_channel_state *state_ts = &phy->state_ts;
-@@ -5136,7 +5142,7 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch)
+@@ -5143,7 +5149,7 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch)
  	struct sk_buff *skb;
  	int i, ret;
  
@@ -60,7 +61,7 @@
  		req.data[i].tag = cpu_to_le16(UNI_CMD_MIB_DATA);
  		req.data[i].len = cpu_to_le16(sizeof(req.data[i]));
  		req.data[i].offs = cpu_to_le32(offs[i]);
-@@ -5155,17 +5161,24 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch)
+@@ -5162,17 +5168,24 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch)
  		goto out;
  
  #define __res_u64(s) le64_to_cpu(res[s].data)
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0160-mtk-mt76-mt7996-support-muru-dbg-info-debug-commands.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0160-mtk-mt76-mt7996-support-muru-dbg-info-debug-commands.patch
index 96dee3a..1f278bd 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0160-mtk-mt76-mt7996-support-muru-dbg-info-debug-commands.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0160-mtk-mt76-mt7996-support-muru-dbg-info-debug-commands.patch
@@ -1,7 +1,7 @@
-From 5a7c1ec113c29bee213b4019746e0c6f00235bd7 Mon Sep 17 00:00:00 2001
+From ef4a19e3bb7aebd2ceb745cefc45fd7000db2014 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 3 Jun 2024 15:18:05 +0800
-Subject: [PATCH 160/195] mtk: mt76: mt7996: support muru dbg info debug
+Subject: [PATCH 160/223] mtk: mt76: mt7996: support muru dbg info debug
  commands
 
 Support enable muru debug functionality by debugfs.
@@ -10,16 +10,17 @@
 
 The purpose of this commit is for WiFi 7 R1 cert UL-MU test cases.
 
+Change-Id: Id7877a3c6d4e45585bfe14885b2eaea2620dfd5b
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
  mt7996/mtk_debugfs.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
  1 file changed, 44 insertions(+)
 
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index b16ea5fe..b698c68a 100644
+index 422518f5..02a6ee81 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -4326,6 +4326,48 @@ mt7996_drr_info(struct seq_file *s, void *data)
+@@ -4325,6 +4325,48 @@ mt7996_drr_info(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -68,7 +69,7 @@
  void mt7996_mtk_init_band_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	/* agg */
-@@ -4447,6 +4489,8 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
+@@ -4446,6 +4488,8 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
  	/* Drop counters */
  	debugfs_create_file("tx_drop_stats", 0400, dir, dev, &mt7996_tx_drop_fops);
  	debugfs_create_file("rx_drop_stats", 0400, dir, dev, &mt7996_rx_drop_fops);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0161-mtk-mt76-mt7996-add-kite-if_comb.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0161-mtk-mt76-mt7996-add-kite-if_comb.patch
index b3d82d9..d4a1f0d 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0161-mtk-mt76-mt7996-add-kite-if_comb.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0161-mtk-mt76-mt7996-add-kite-if_comb.patch
@@ -1,7 +1,7 @@
-From 1ac072d1cf5a9bd9724853aaaf6b1f25f20cb866 Mon Sep 17 00:00:00 2001
+From fe7a769deaeb995f9657dc160ec670192464e8e4 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 3 Jul 2024 10:34:39 +0800
-Subject: [PATCH 161/195] mtk: mt76: mt7996: add kite if_comb
+Subject: [PATCH 161/223] mtk: mt76: mt7996: add kite if_comb
 
 Add Kite (dual band) if_comb
 
@@ -11,7 +11,7 @@
  1 file changed, 30 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 5f38374f..f923ce66 100644
+index fe2958f5..18847ff5 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -46,6 +46,22 @@ static const struct ieee80211_iface_combination if_comb[] = {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0162-mtk-mt76-mt7996-change-source-of-per-WCID-TX-MPDU-st.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0162-mtk-mt76-mt7996-change-source-of-per-WCID-TX-MPDU-st.patch
index 1af3cc4..33c0bc7 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0162-mtk-mt76-mt7996-change-source-of-per-WCID-TX-MPDU-st.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0162-mtk-mt76-mt7996-change-source-of-per-WCID-TX-MPDU-st.patch
@@ -1,11 +1,12 @@
-From fcb507ba443b3d2d19248ad38b20c6bd9dc71292 Mon Sep 17 00:00:00 2001
+From ce85a854c7b07de8cb560417a038a2c9870c61e5 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Mon, 17 Jun 2024 17:16:19 +0800
-Subject: [PATCH 162/195] mtk: mt76: mt7996: change source of per-WCID TX MPDU
+Subject: [PATCH 162/223] mtk: mt76: mt7996: change source of per-WCID TX MPDU
  statistics
 
 Change source of per-WCID TX MPDU statistics from TX-free-done event to PPDU TXS, because WCID from TX-free-done event may not represent the actually used link.
 
+Change-Id: If4276b3cc779f79f29c7354c9ac2140a2fd8d852
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt76.h             |  1 +
@@ -14,10 +15,10 @@
  3 files changed, 33 insertions(+), 23 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 88464896..250e9f8f 100644
+index 62ae2662..c3b71cc3 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -363,6 +363,7 @@ struct mt76_sta_stats {
+@@ -364,6 +364,7 @@ struct mt76_sta_stats {
  	u64 tx_bytes;
  	/* WED TX */
  	u32 tx_packets;		/* unit: MSDU */
@@ -42,10 +43,10 @@
  #define MT_CT_INFO_COPY_HOST_TXD_ALL	BIT(1)
  #define MT_CT_INFO_MGMT_FRAME		BIT(2)
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 12cc60cb..97cd5e23 100644
+index 3cd034cd..87e671a3 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1206,19 +1206,9 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+@@ -1218,19 +1218,9 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
  			spin_unlock_bh(&mdev->sta_poll_lock);
  			continue;
  		} else if (info & MT_TXFREE_INFO_HEADER) {
@@ -65,7 +66,7 @@
  			if (FIELD_GET(MT_TXFREE_INFO_STAT, info) == 2) {
  				struct mt7996_phy *mphy =
  					__mt7996_phy(dev, wcid->phy_idx);
-@@ -1256,9 +1246,10 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+@@ -1268,9 +1258,10 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
  
  static bool
  mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
@@ -78,7 +79,7 @@
  	struct mt76_dev *mdev = &dev->mt76;
  	struct ieee80211_tx_info *info;
  	struct sk_buff_head list;
-@@ -1270,8 +1261,9 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
+@@ -1282,8 +1273,9 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
  
  	mt76_tx_status_lock(mdev, &list);
  
@@ -90,7 +91,7 @@
  		skb = mt76_tx_status_skb_get(mdev, wcid, pid, &list);
  		if (skb) {
  			struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-@@ -1300,6 +1292,15 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
+@@ -1312,6 +1304,15 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
  				mvif->probe_send_count[wcid->phy_idx] = 0;
  			}
  		}
@@ -106,7 +107,7 @@
  	}
  
  	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && wcid->sta) {
-@@ -1331,6 +1332,7 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
+@@ -1343,6 +1344,7 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
  
  	if (skb)
  		mt76_tx_status_skb_done(mdev, skb, &list);
@@ -114,7 +115,7 @@
  	mt76_tx_status_unlock(mdev, &list);
  
  	return !!skb;
-@@ -1338,13 +1340,13 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
+@@ -1350,13 +1352,13 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
  
  static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
  {
@@ -131,7 +132,7 @@
  	pid = le32_get_bits(txs_data[3], MT_TXS3_PID);
  
  	if (pid < MT_PACKET_ID_NO_SKB)
-@@ -1359,17 +1361,19 @@ static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
+@@ -1371,17 +1373,19 @@ static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
  	if (!wcid)
  		goto out;
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0163-mtk-mt76-mt7996-update-preamble-puncture-support-for.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0163-mtk-mt76-mt7996-update-preamble-puncture-support-for.patch
index c36148e..b8184c9 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0163-mtk-mt76-mt7996-update-preamble-puncture-support-for.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0163-mtk-mt76-mt7996-update-preamble-puncture-support-for.patch
@@ -1,7 +1,7 @@
-From 6005e96634290a47590309fa2985e0992f9597e5 Mon Sep 17 00:00:00 2001
+From 8908556d4135d7aee178baa3bfb9d3025d1611d9 Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Tue, 28 May 2024 15:31:39 +0800
-Subject: [PATCH 163/195] mtk: mt76: mt7996: update preamble puncture support
+Subject: [PATCH 163/223] mtk: mt76: mt7996: update preamble puncture support
  for mt7996
 
 Add pp station mode support. Current fw only support one bitmap on a band.
@@ -10,6 +10,9 @@
 same bitmap setting.
 Current PP_DSCB_CTRL cmd only use bitmap value in fw implementation.
 
+Change-Id: I93fe7d37d6d0945b92c11e0ff9ee8a35340ddaf2
+Change-Id: I93f61b8bcaa79808745850921b0c18d187bc7113
+Change-Id: I04f1746ad52fef57720e8531d861078934c139c2
 Signed-off-by: Allen Ye <allen.ye@mediatek.com>
 ---
  mt76_connac_mcu.h |   1 +
@@ -20,10 +23,10 @@
  5 files changed, 165 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 8e57fa2c..781b0178 100644
+index 931b29eb..cc644edf 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1071,6 +1071,7 @@ enum {
+@@ -1076,6 +1076,7 @@ enum {
  	MCU_UNI_EVENT_TESTMODE_CTRL = 0x46,
  	MCU_UNI_EVENT_CSI_REPORT = 0x4A,
  	MCU_UNI_EVENT_WED_RRO = 0x57,
@@ -32,7 +35,7 @@
  	MCU_UNI_EVENT_ALL_STA_INFO = 0x6e,
  };
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 2643a72e..926879c9 100644
+index 103902b7..562137a5 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1241,6 +1241,12 @@ static int mt7996_add_link_sta(struct mt7996_dev *dev,
@@ -86,10 +89,10 @@
  		if (ret)
  			goto out;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index c65154f8..2f8d155c 100644
+index 723a7ad9..fce92046 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1280,6 +1280,39 @@ mt7996_mcu_wed_rro_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -1285,6 +1285,39 @@ mt7996_mcu_wed_rro_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	}
  }
  
@@ -129,7 +132,7 @@
  static void
  mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
  {
-@@ -1305,6 +1338,9 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -1310,6 +1343,9 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	case MCU_UNI_EVENT_WED_RRO:
  		mt7996_mcu_wed_rro_event(dev, skb);
  		break;
@@ -139,7 +142,7 @@
  #ifdef CONFIG_MTK_DEBUG
  	case MCU_UNI_EVENT_SR:
  		mt7996_mcu_rx_sr_event(dev, skb);
-@@ -6277,7 +6313,8 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
+@@ -6284,7 +6320,8 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
  		u8 force_bitmap_ctrl;
  		u8 auto_mode;
  		__le16 bitmap;
@@ -149,7 +152,7 @@
  	} __packed req = {
  		.tag = cpu_to_le16(UNI_CMD_PP_EN_CTRL),
  		.len = cpu_to_le16(sizeof(req) - 4),
-@@ -6287,6 +6324,7 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
+@@ -6294,6 +6331,7 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
  		.force_bitmap_ctrl = (mode == PP_USR_MODE) ? 2 : 0,
  		.auto_mode = pp_auto,
  		.bitmap = cpu_to_le16(bitmap),
@@ -157,7 +160,7 @@
  	};
  
  	if (phy->chanctx->chandef.chan->band == NL80211_BAND_2GHZ ||
-@@ -6303,6 +6341,73 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
+@@ -6310,6 +6348,73 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
  				 &req, sizeof(req), false);
  }
  
@@ -284,10 +287,10 @@
  	UNI_CMD_SCS_SEND_DATA,
  	UNI_CMD_SCS_SET_PD_THR_RANGE = 2,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index fe97bea1..9ff7fdae 100644
+index c122989d..58151ed0 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1276,6 +1276,8 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
+@@ -1280,6 +1280,8 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
  				     struct mt7996_link_sta *mlink);
  int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode);
  int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0164-mtk-mt76-Add-dynamic-pp-vendor-and-debug-pp-algo-cmd.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0164-mtk-mt76-Add-dynamic-pp-vendor-and-debug-pp-algo-cmd.patch
index 6bd86f7..f0528a9 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0164-mtk-mt76-Add-dynamic-pp-vendor-and-debug-pp-algo-cmd.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0164-mtk-mt76-Add-dynamic-pp-vendor-and-debug-pp-algo-cmd.patch
@@ -1,7 +1,7 @@
-From 96a648bbee9243a761e4c4e1fd7daef131fa469b Mon Sep 17 00:00:00 2001
+From fdf267776932e3bab7c0d87f2c9c8a96ac9a4e0f Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Tue, 28 May 2024 15:39:06 +0800
-Subject: [PATCH 164/195] mtk: mt76: Add dynamic pp vendor and debug pp algo
+Subject: [PATCH 164/223] mtk: mt76: Add dynamic pp vendor and debug pp algo
  cmd support
 
 Add dynamic pp vendor and debug pp algo cmd support.
@@ -13,6 +13,8 @@
 mt76 just ignore the event. Once the sta connect to ap, the sta part would
 send a new fw cmd to update the pp bitmap.
 
+Change-Id: I3574940a3f4165f136df8e07a819a32a5bc02b41
+Change-Id: I1e9955ac0cecafa481fe851502880f6ea1a44469
 Signed-off-by: Allen Ye <allen.ye@mediatek.com>
 ---
  mt7996/mcu.c         |  70 ++++++++++++++++++++++++++++-
@@ -24,10 +26,10 @@
  6 files changed, 205 insertions(+), 30 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 2f8d155c..e26e8cd3 100644
+index fce92046..77d3b2c8 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1280,6 +1280,39 @@ mt7996_mcu_wed_rro_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -1285,6 +1285,39 @@ mt7996_mcu_wed_rro_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	}
  }
  
@@ -67,7 +69,7 @@
  static void
  mt7996_mcu_pp_event(struct mt7996_dev *dev, struct sk_buff *skb)
  {
-@@ -1306,9 +1339,13 @@ mt7996_mcu_pp_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -1311,9 +1344,13 @@ mt7996_mcu_pp_event(struct mt7996_dev *dev, struct sk_buff *skb)
  		if (phy->punct_bitmap == report_bitmap)
  			return;
  
@@ -83,7 +85,7 @@
  		break;
  	}
  }
-@@ -6408,6 +6445,35 @@ int mt7996_mcu_set_pp_sta_dscb(struct mt7996_phy *phy,
+@@ -6415,6 +6452,35 @@ int mt7996_mcu_set_pp_sta_dscb(struct mt7996_phy *phy,
  				 &req, sizeof(req), false);
  }
  
@@ -183,10 +185,10 @@
  	UNI_CMD_SCS_SEND_DATA,
  	UNI_CMD_SCS_SET_PD_THR_RANGE = 2,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 9ff7fdae..31b20dcb 100644
+index 58151ed0..755b4cf0 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1278,6 +1278,7 @@ int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode);
+@@ -1282,6 +1282,7 @@ int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode);
  int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
  int mt7996_mcu_set_pp_sta_dscb(struct mt7996_phy *phy, struct cfg80211_chan_def *chandef,
  			       u8 omac_idx);
@@ -194,7 +196,7 @@
  int mt7996_mcu_set_eml_omn(struct ieee80211_hw *hw, struct ieee80211_vif *vif, u8 link_id,
  			   struct ieee80211_sta *sta, struct mt7996_eml_omn *eml_omn);
  #ifdef CONFIG_MAC80211_DEBUGFS
-@@ -1307,6 +1308,7 @@ int mt7996_mcu_set_muru_cfg(struct mt7996_dev *dev, void *data);
+@@ -1311,6 +1312,7 @@ int mt7996_mcu_set_muru_cfg(struct mt7996_dev *dev, void *data);
  void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
  int mt7996_mcu_set_csi(struct mt7996_phy *phy, u8 mode,
  		       u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
@@ -203,10 +205,10 @@
  
  int mt7996_mcu_edcca_enable(struct mt7996_phy *phy, bool enable);
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index b698c68a..093f3c69 100644
+index 02a6ee81..2ded5f79 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -4368,6 +4368,18 @@ static const struct file_operations fops_muru_dbg_info = {
+@@ -4367,6 +4367,18 @@ static const struct file_operations fops_muru_dbg_info = {
  	.llseek = default_llseek,
  };
  
@@ -225,7 +227,7 @@
  void mt7996_mtk_init_band_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	/* agg */
-@@ -4390,6 +4402,8 @@ void mt7996_mtk_init_band_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+@@ -4389,6 +4401,8 @@ void mt7996_mtk_init_band_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  
  	debugfs_create_file("thermal_enable", 0600, dir, phy, &fops_thermal_enable);
  	debugfs_create_file("scs_enable", 0200, dir, phy, &fops_scs_enable);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0165-mtk-mt76-mt7996-disable-MAT-and-set-force-link-for-4.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0165-mtk-mt76-mt7996-disable-MAT-and-set-force-link-for-4.patch
index eeeffaa..8d58295 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0165-mtk-mt76-mt7996-disable-MAT-and-set-force-link-for-4.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0165-mtk-mt76-mt7996-disable-MAT-and-set-force-link-for-4.patch
@@ -1,7 +1,7 @@
-From 6b24303ab899924acf4f9ac52c59c06a856a3551 Mon Sep 17 00:00:00 2001
+From 05542b2127e52eae086612d666891b8f84f357e9 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Mon, 8 Jul 2024 11:05:31 +0800
-Subject: [PATCH 165/195] mtk: mt76: mt7996: disable MAT and set force-link for
+Subject: [PATCH 165/223] mtk: mt76: mt7996: disable MAT and set force-link for
  4-addr NULL func data frame
 
 This is a temporary solution to solve a WDS connection problem.
@@ -13,16 +13,17 @@
 
 Disabling MAT can prevent the connection problem.
 
+Change-Id: Ie62f8cc5e0ace41a24e61a4dc8127387a1703650
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt7996/mac.c | 6 ++++++
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 97cd5e23..a8985a3b 100644
+index 87e671a3..1f225756 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -759,6 +759,12 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
+@@ -771,6 +771,12 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
  	    (multicast || unlikely(skb->protocol == cpu_to_be16(ETH_P_PAE)) ||
  	     info->flags & IEEE80211_TX_CTL_INJECTED))
  		txwi[5] |= cpu_to_le32(MT_TXD5_FL);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0166-mtk-mt76-mt7996-add-per-STA-TX-MSDU-failed-and-retri.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0166-mtk-mt76-mt7996-add-per-STA-TX-MSDU-failed-and-retri.patch
index 213af86..8433a4e 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0166-mtk-mt76-mt7996-add-per-STA-TX-MSDU-failed-and-retri.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0166-mtk-mt76-mt7996-add-per-STA-TX-MSDU-failed-and-retri.patch
@@ -1,11 +1,12 @@
-From 339a5e3289b3225955aa2632c4955f347ddec553 Mon Sep 17 00:00:00 2001
+From e785b2395e3f293ce49ddab807fee0f3bda779d6 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Thu, 4 Jul 2024 14:00:16 +0800
-Subject: [PATCH 166/195] mtk: mt76: mt7996: add per-STA TX MSDU failed and
+Subject: [PATCH 166/223] mtk: mt76: mt7996: add per-STA TX MSDU failed and
  retried counts
 
 Record per-STA TX MSDU failed and retried counts for debugging.
 
+Change-Id: I888a86a8d858ff80d16fbb590229cb35ae07ce19
 Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 ---
  mt76.h            |  2 ++
@@ -17,10 +18,10 @@
  6 files changed, 68 insertions(+), 59 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 250e9f8f..181e07ed 100644
+index c3b71cc3..27c990df 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -363,6 +363,8 @@ struct mt76_sta_stats {
+@@ -364,6 +364,8 @@ struct mt76_sta_stats {
  	u64 tx_bytes;
  	/* WED TX */
  	u32 tx_packets;		/* unit: MSDU */
@@ -30,10 +31,10 @@
  	u32 tx_retries;
  	u32 tx_failed;
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 781b0178..73173ee1 100644
+index cc644edf..302567e3 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1402,6 +1402,8 @@ enum {
+@@ -1407,6 +1407,8 @@ enum {
  	UNI_OFFLOAD_OFFLOAD_BMC_RPY_DETECT,
  };
  
@@ -42,7 +43,7 @@
  enum UNI_PER_STA_INFO_TAG {
  	UNI_PER_STA_RSSI,
  	UNI_PER_STA_CONTENTION_RX_RATE,
-@@ -1411,6 +1413,7 @@ enum UNI_PER_STA_INFO_TAG {
+@@ -1416,6 +1418,7 @@ enum UNI_PER_STA_INFO_TAG {
  	UNI_PER_STA_TX_CNT,
  	UNI_PER_STA_TID_SN_GET,
  	UNI_PER_STA_TID_SN_SET,
@@ -51,10 +52,10 @@
  };
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index a8985a3b..fae24cad 100644
+index 1f225756..8c68e08e 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -2431,6 +2431,43 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+@@ -2443,6 +2443,43 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  	rcu_read_unlock();
  }
  
@@ -98,7 +99,7 @@
  void mt7996_mac_work(struct work_struct *work)
  {
  	struct mt76_phy *mphy = (struct mt76_phy *)container_of(work, struct mt76_phy,
-@@ -2453,7 +2490,7 @@ void mt7996_mac_work(struct work_struct *work)
+@@ -2465,7 +2502,7 @@ void mt7996_mac_work(struct work_struct *work)
  			if (i == mphy->band_idx) {
  				mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_RATE);
  				mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_AIRTIME);
@@ -108,10 +109,10 @@
  					mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_ADM_STAT);
  					mt7996_mcu_get_all_sta_info(mdev, UNI_ALL_STA_TXRX_MSDU_COUNT);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index e26e8cd3..b78416fe 100644
+index 77d3b2c8..3fcc7fac 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -6020,7 +6020,6 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val)
+@@ -6027,7 +6027,6 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u16 val)
  int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
  				u16 sta_num, u16 *sta_list)
  {
@@ -119,7 +120,7 @@
  	struct mt7996_mcu_per_sta_info_event *res;
  	struct mt7996_link_sta *mlink;
  	struct mt76_wcid *wcid;
-@@ -6100,6 +6099,23 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
+@@ -6107,6 +6106,23 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
  			}
  		}
  		break;
@@ -143,7 +144,7 @@
  	default:
  		ret = -EINVAL;
  		dev_err(dev->dev, "Unknown UNI_PER_STA_INFO_TAG: %d\n", tag);
-@@ -6110,62 +6126,6 @@ out:
+@@ -6117,62 +6133,6 @@ out:
  	return ret;
  }
  
@@ -233,10 +234,10 @@
  } __packed;
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 31b20dcb..a04067d4 100644
+index 755b4cf0..a02e976a 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1134,7 +1134,6 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
+@@ -1138,7 +1138,6 @@ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
  void mt7996_mcu_exit(struct mt7996_dev *dev);
  int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
  	                        u16 sta_num, u16 *sta_list);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0167-mtk-mt76-mt7996-fill-in-sn-into-txd-for-MLD-multicas.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0167-mtk-mt76-mt7996-fill-in-sn-into-txd-for-MLD-multicas.patch
index cf43dbb..00e7840 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0167-mtk-mt76-mt7996-fill-in-sn-into-txd-for-MLD-multicas.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0167-mtk-mt76-mt7996-fill-in-sn-into-txd-for-MLD-multicas.patch
@@ -1,19 +1,20 @@
-From f14248c84e23ad24747a3319ebaaef110510ac56 Mon Sep 17 00:00:00 2001
+From 261d876ae90ba658963a1aae901a4f513e56684e Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 15 Jul 2024 11:42:47 +0800
-Subject: [PATCH 167/195] mtk: mt76: mt7996: fill in sn into txd for MLD
+Subject: [PATCH 167/223] mtk: mt76: mt7996: fill in sn into txd for MLD
  multicast packet
 
+Change-Id: I09d3dd71aee227f7b8ef06756064b0d4079e7d54
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/mac.c | 9 +++++++--
  1 file changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index fae24cad..c91c550d 100644
+index 8c68e08e..1952cb0c 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -681,6 +681,7 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
+@@ -693,6 +693,7 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
  	bool multicast = is_multicast_ether_addr(hdr->addr1);
  	u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
  	__le16 fc = hdr->frame_control, sc = hdr->seq_ctrl;
@@ -21,7 +22,7 @@
  	u8 fc_type, fc_stype;
  	u32 val;
  
-@@ -739,9 +740,13 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
+@@ -751,9 +752,13 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
  		txwi[3] |= cpu_to_le32(MT_TXD3_REM_TX_COUNT);
  	}
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0168-mtk-mt76-mt7996-fix-potential-null-pointer.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0168-mtk-mt76-mt7996-fix-potential-null-pointer.patch
index b9475c1..418c92e 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0168-mtk-mt76-mt7996-fix-potential-null-pointer.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0168-mtk-mt76-mt7996-fix-potential-null-pointer.patch
@@ -1,10 +1,12 @@
-From 91d42e911cea5261c13e24ba727de84912b1690f Mon Sep 17 00:00:00 2001
+From 4de8ef89ddae7299fbf92927aaa6bf226e10bef0 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 9 Jul 2024 14:54:39 +0800
-Subject: [PATCH 168/195] mtk: mt76: mt7996: fix potential null pointer
+Subject: [PATCH 168/223] mtk: mt76: mt7996: fix potential null pointer
 
 Fix more parts that might have null pointer access.
 
+Change-Id: Iba945d07cb0b5816cf6cd48f1148edefd9a02d1e
+Change-Id: I7fc4c0b8bc5eda41fa142560995ffc327c188b7f
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -14,10 +16,10 @@
  3 files changed, 16 insertions(+)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index c91c550d..657a19c1 100644
+index 1952cb0c..1a3c661f 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1115,6 +1115,9 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb,
+@@ -1127,6 +1127,9 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb,
  
  	msta = (struct mt7996_sta *)sta->drv_priv;
  	mlink = rcu_dereference(msta->link[msta->pri_link]);
@@ -28,7 +30,7 @@
  		ieee80211_start_tx_ba_session(sta, tid, 0);
  }
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 926879c9..68817847 100644
+index 562137a5..c95e7e35 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -518,9 +518,12 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
@@ -73,10 +75,10 @@
  	}
  	spin_unlock_bh(&dev->mt76.status_lock);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index b78416fe..81e0e710 100644
+index 3fcc7fac..856168f6 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3027,6 +3027,9 @@ mt7996_mcu_sta_mld_setup_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -3032,6 +3032,9 @@ mt7996_mcu_sta_mld_setup_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  		mlink = mlink_dereference_protected(msta, link_id);
  		mconf = mconf_dereference_protected(msta->vif, link_id);
  
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0169-mtk-mt76-mt7996-Fix-legacy-action-frame-wrong-addres.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0169-mtk-mt76-mt7996-Fix-legacy-action-frame-wrong-addres.patch
index 5b5bc21..01f7688 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0169-mtk-mt76-mt7996-Fix-legacy-action-frame-wrong-addres.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0169-mtk-mt76-mt7996-Fix-legacy-action-frame-wrong-addres.patch
@@ -1,22 +1,23 @@
-From 856314619eb12a445f78f382e7dd9a49a6e0868f Mon Sep 17 00:00:00 2001
+From 9134d34ad3ad49037980ec5e37437753dc583a4b Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Wed, 17 Jul 2024 11:36:11 +0800
-Subject: [PATCH 169/195] mtk: mt76: mt7996: Fix legacy action frame wrong
+Subject: [PATCH 169/223] mtk: mt76: mt7996: Fix legacy action frame wrong
  address translation
 
 For non-associated STA send unicast ANQP request, AP should use unicast
 to response, so mt76 sould tell fw not translate frames of this type.
 
+Change-Id: Ie39964538d2b8bcf5a00566b6874e4e4341a4ad4
 Signed-off-by: Allen Ye <allen.ye@mediatek.com>
 ---
  mt7996/mac.c | 8 ++++++--
  1 file changed, 6 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 657a19c1..e571bbfa 100644
+index 1a3c661f..406a1275 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -671,7 +671,8 @@ mt7996_mac_write_txwi_8023(struct mt7996_dev *dev, __le32 *txwi,
+@@ -683,7 +683,8 @@ mt7996_mac_write_txwi_8023(struct mt7996_dev *dev, __le32 *txwi,
  
  static void
  mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
@@ -26,7 +27,7 @@
  {
  	struct mt76_phy *mphy =
  		mt76_dev_phy(&dev->mt76, le32_get_bits(txwi[1], MT_TXD1_TGID));
-@@ -770,6 +771,9 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
+@@ -782,6 +783,9 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
  		txwi[5] |= cpu_to_le32(MT_TXD5_FL);
  		txwi[6] |= cpu_to_le32(MT_TXD6_DIS_MAT);
  	}
@@ -36,7 +37,7 @@
  }
  
  void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
-@@ -863,7 +867,7 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+@@ -875,7 +879,7 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
  	if (is_8023)
  		mt7996_mac_write_txwi_8023(dev, txwi, skb, wcid);
  	else
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0170-mtk-mt76-mt7996-add-AP-affiliated-link-removal-suppo.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0170-mtk-mt76-mt7996-add-AP-affiliated-link-removal-suppo.patch
index b2ac065..1819f12 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0170-mtk-mt76-mt7996-add-AP-affiliated-link-removal-suppo.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0170-mtk-mt76-mt7996-add-AP-affiliated-link-removal-suppo.patch
@@ -1,11 +1,12 @@
-From 2b400c5ef3bebaf40134792b2fe9a3b3e8a128bb Mon Sep 17 00:00:00 2001
+From a025d78199c2a329723707c689075c34d7c780e5 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 31 May 2024 18:14:59 +0800
-Subject: [PATCH 170/195] mtk: mt76: mt7996: add AP affiliated link removal
+Subject: [PATCH 170/223] mtk: mt76: mt7996: add AP affiliated link removal
  support
 
 Add support for ap link removal of MLD reconfiguration.
 
+Change-Id: I27a611dcf6698f89f6a3a67f893a166d2afe6b1f
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  mt76_connac_mcu.h |   3 +
@@ -16,10 +17,10 @@
  5 files changed, 367 insertions(+), 12 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 73173ee1..0f370f1e 100644
+index 302567e3..4976d944 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1074,6 +1074,7 @@ enum {
+@@ -1079,6 +1079,7 @@ enum {
  	MCU_UNI_EVENT_PP = 0x5a,
  	MCU_UNI_EVENT_PER_STA_INFO = 0x6d,
  	MCU_UNI_EVENT_ALL_STA_INFO = 0x6e,
@@ -27,7 +28,7 @@
  };
  
  #define MCU_UNI_CMD_EVENT			BIT(1)
-@@ -1319,6 +1320,7 @@ enum {
+@@ -1324,6 +1325,7 @@ enum {
  	MCU_UNI_CMD_ALL_STA_INFO = 0x6e,
  	MCU_UNI_CMD_ASSERT_DUMP = 0x6f,
  	MCU_UNI_CMD_PTA_3WIRE_CTRL = 0x78,
@@ -35,7 +36,7 @@
  };
  
  enum {
-@@ -1393,6 +1395,7 @@ enum {
+@@ -1398,6 +1400,7 @@ enum {
  	UNI_BSS_INFO_PM_DISABLE = 27,
  	UNI_BSS_INFO_BCN_CRIT_UPDATE = 32,
  	UNI_BSS_INFO_BCN_STA_PROF_CSA = 37,
@@ -44,7 +45,7 @@
  
  enum {
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 68817847..f19162c3 100644
+index c95e7e35..6ad4558b 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -319,6 +319,21 @@ static void mt7996_remove_bss_conf(struct ieee80211_vif *vif,
@@ -163,10 +164,10 @@
  	if (ret)
  		goto remove;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 81e0e710..ef8c830c 100644
+index 856168f6..417c38a3 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1350,6 +1350,48 @@ mt7996_mcu_pp_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -1355,6 +1355,48 @@ mt7996_mcu_pp_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	}
  }
  
@@ -215,7 +216,7 @@
  static void
  mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
  {
-@@ -1378,6 +1420,9 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -1383,6 +1425,9 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	case MCU_UNI_EVENT_PP:
  		mt7996_mcu_pp_event(dev, skb);
  		break;
@@ -225,7 +226,7 @@
  #ifdef CONFIG_MTK_DEBUG
  	case MCU_UNI_EVENT_SR:
  		mt7996_mcu_rx_sr_event(dev, skb);
-@@ -3171,6 +3216,44 @@ out:
+@@ -3176,6 +3221,44 @@ out:
  				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
  }
  
@@ -270,7 +271,7 @@
  int mt7996_mcu_teardown_mld_sta(struct mt7996_dev *dev,
  				struct mt7996_bss_conf *mconf,
  				struct mt7996_link_sta *mlink)
-@@ -3383,6 +3466,51 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
+@@ -3388,6 +3471,51 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
  				 &data, sizeof(data), true);
  }
  
@@ -322,7 +323,7 @@
  static void
  mt7996_mcu_beacon_cntdwn(struct ieee80211_bss_conf *conf, struct sk_buff *rskb,
  			 struct sk_buff *skb,
-@@ -3577,6 +3705,94 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+@@ -3582,6 +3710,94 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
  		mt7996_packet_log_to_host(dev, skb->data, skb->len, PKT_BIN_DEBUG_TX, 0);
  }
  
@@ -417,7 +418,7 @@
  int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  			  struct ieee80211_bss_conf *conf,
  			  struct mt7996_bss_conf *mconf, int en)
-@@ -3630,6 +3846,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+@@ -3635,6 +3851,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  	mt7996_mcu_beacon_cntdwn(conf, rskb, skb, &offs);
  	mt7996_mcu_beacon_sta_prof_csa(rskb, conf, &offs);
  	mt7996_mcu_beacon_crit_update(rskb, skb, conf, mconf, &offs);
@@ -547,10 +548,10 @@
  	u8 _rsv[4];
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index a04067d4..54ba5e4d 100644
+index a02e976a..a7655a61 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1083,6 +1083,8 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+@@ -1087,6 +1087,8 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  			     struct mt7996_bss_conf *mconf,
  			     struct ieee80211_link_sta *link_sta,
  			     struct mt7996_link_sta *mlink, bool changed);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0171-mtk-mt76-mt7996-add-support-for-AP-A-TTLM.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0171-mtk-mt76-mt7996-add-support-for-AP-A-TTLM.patch
index 05d8385..4365a84 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0171-mtk-mt76-mt7996-add-support-for-AP-A-TTLM.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0171-mtk-mt76-mt7996-add-support-for-AP-A-TTLM.patch
@@ -1,7 +1,7 @@
-From 571db38fd39e395ccedcf58cf568358799ccd158 Mon Sep 17 00:00:00 2001
+From 54aea6e753436bff0a258c753d2b8da3daea72f8 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Fri, 28 Jun 2024 13:45:15 +0800
-Subject: [PATCH 171/195] mtk: mt76: mt7996: add support for AP A-TTLM
+Subject: [PATCH 171/223] mtk: mt76: mt7996: add support for AP A-TTLM
 
 This add support for AP A-TTLM support by following actions
 1. request at2lm resource to FW and get switch time TSF value
@@ -9,6 +9,7 @@
    switch time erxpired and AT2LM end
 3. provide TTLM offset to FW if TTLM needs count down.
 
+Change-Id: Iea8e8e767d09a8bb2aa8ee1d0252e35be239417d
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt76_connac_mcu.h |   1 +
@@ -19,10 +20,10 @@
  5 files changed, 214 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 0f370f1e..caab3b54 100644
+index 4976d944..18758ff2 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1396,6 +1396,7 @@ enum {
+@@ -1401,6 +1401,7 @@ enum {
  	UNI_BSS_INFO_BCN_CRIT_UPDATE = 32,
  	UNI_BSS_INFO_BCN_STA_PROF_CSA = 37,
  	UNI_BSS_INFO_BCN_ML_RECONF = 38,
@@ -31,7 +32,7 @@
  
  enum {
 diff --git a/mt7996/main.c b/mt7996/main.c
-index f19162c3..725be540 100644
+index 6ad4558b..c6cb5104 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -3171,6 +3171,19 @@ out:
@@ -61,10 +62,10 @@
 +	.set_attlm = mt7996_set_attlm,
  };
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index ef8c830c..9bc3c434 100644
+index 417c38a3..0e8e2c06 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -1362,6 +1362,22 @@ mt7996_mcu_mld_reconf_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
+@@ -1367,6 +1367,22 @@ mt7996_mcu_mld_reconf_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  	ieee80211_links_removed(vif, le16_to_cpu(reconf->link_bitmap));
  }
  
@@ -87,7 +88,7 @@
  static void
  mt7996_mcu_mld_event(struct mt7996_dev *dev, struct sk_buff *skb)
  {
-@@ -1376,9 +1392,15 @@ mt7996_mcu_mld_event(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -1381,9 +1397,15 @@ mt7996_mcu_mld_event(struct mt7996_dev *dev, struct sk_buff *skb)
  	len = skb->len;
  
  	while (len > 0 && le16_to_cpu(tlv->len) <= len) {
@@ -104,7 +105,7 @@
  			ieee80211_iterate_active_interfaces_atomic(dev->mt76.hw,
  					IEEE80211_IFACE_ITER_RESUME_ALL,
  					mt7996_mcu_mld_reconf_finish, &data);
-@@ -3511,6 +3533,91 @@ mt7996_mcu_mld_reconf(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -3516,6 +3538,91 @@ mt7996_mcu_mld_reconf(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_WM_UNI_CMD(MLD), true);
  }
  
@@ -196,7 +197,7 @@
  static void
  mt7996_mcu_beacon_cntdwn(struct ieee80211_bss_conf *conf, struct sk_buff *rskb,
  			 struct sk_buff *skb,
-@@ -3793,6 +3900,48 @@ mt7996_mcu_beacon_ml_reconf(struct mt7996_dev *dev,
+@@ -3798,6 +3905,48 @@ mt7996_mcu_beacon_ml_reconf(struct mt7996_dev *dev,
  	}
  }
  
@@ -245,7 +246,7 @@
  int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  			  struct ieee80211_bss_conf *conf,
  			  struct mt7996_bss_conf *mconf, int en)
-@@ -3847,6 +3996,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+@@ -3852,6 +4001,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
  	mt7996_mcu_beacon_sta_prof_csa(rskb, conf, &offs);
  	mt7996_mcu_beacon_crit_update(rskb, skb, conf, mconf, &offs);
  	mt7996_mcu_beacon_ml_reconf(dev, conf, rskb, skb, &offs);
@@ -339,10 +340,10 @@
  };
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 54ba5e4d..4f80eed6 100644
+index a7655a61..15c4e557 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1154,6 +1154,8 @@ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
+@@ -1158,6 +1158,8 @@ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
  				enum vow_drr_ctrl_id id);
  int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy);
  void mt7996_mcu_wmm_pbc_work(struct work_struct *work);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0172-mtk-mt76-mt7996-leave-ps-when-4-address-is-establish.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0172-mtk-mt76-mt7996-leave-ps-when-4-address-is-establish.patch
index 1b97604..f7fb35f 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0172-mtk-mt76-mt7996-leave-ps-when-4-address-is-establish.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0172-mtk-mt76-mt7996-leave-ps-when-4-address-is-establish.patch
@@ -1,7 +1,7 @@
-From 755aa4cbe54c046ae2d2d0f5e31da81b277a3692 Mon Sep 17 00:00:00 2001
+From 4b29092cc31d34967152a3062966d987fc5352eb Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 18 Jul 2024 10:29:22 +0800
-Subject: [PATCH 172/195] mtk: mt76: mt7996: leave ps when 4 address is
+Subject: [PATCH 172/223] mtk: mt76: mt7996: leave ps when 4 address is
  established
 
 Because the 4 address non-amsdu packet does not have bssid field, the
@@ -9,6 +9,7 @@
 leave PS mode due to HW design. Wake up non-setup link when receiving
 4 address null data to prevent this issue.
 
+Change-Id: I94308432b73e647363fd0e2db281c54becdf1ec8
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt76_connac_mcu.h |  1 +
@@ -19,10 +20,10 @@
  5 files changed, 30 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index caab3b54..4980ca12 100644
+index 18758ff2..69c8389f 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -838,6 +838,7 @@ enum {
+@@ -843,6 +843,7 @@ enum {
  	STA_REC_EML_OP = 0x29,
  	STA_REC_HDR_TRANS = 0x2B,
  	STA_REC_TX_CAP = 0x2f,
@@ -31,7 +32,7 @@
  };
  
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 725be540..4b3f1790 100644
+index c6cb5104..21d65f78 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -2081,6 +2081,9 @@ static void mt7996_sta_set_4addr(struct ieee80211_hw *hw,
@@ -45,10 +46,10 @@
  	mutex_unlock(&dev->mt76.mutex);
  }
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 9bc3c434..d9b97f36 100644
+index 0e8e2c06..b47aa7d6 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -6250,6 +6250,24 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
+@@ -6257,6 +6257,24 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
  				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
  }
  
@@ -91,10 +92,10 @@
  	__le16 tag;
  	__le16 len;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 4f80eed6..97b91fbc 100644
+index 15c4e557..21019bc2 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1277,6 +1277,8 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
+@@ -1281,6 +1281,8 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
  				     struct ieee80211_vif *vif,
  				     struct mt7996_bss_conf *mconf,
  				     struct mt7996_link_sta *mlink);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0173-mtk-mt76-mt7996-add-debugfs-knob-to-set-and-dump-txo.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0173-mtk-mt76-mt7996-add-debugfs-knob-to-set-and-dump-txo.patch
index 0bfc4d9..687d1ff 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0173-mtk-mt76-mt7996-add-debugfs-knob-to-set-and-dump-txo.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0173-mtk-mt76-mt7996-add-debugfs-knob-to-set-and-dump-txo.patch
@@ -1,9 +1,10 @@
-From abdbf987ba80b309adbaa3e53d7b6c27f47f91fc Mon Sep 17 00:00:00 2001
+From c8d33542d7f89e4404f932beb1883093f4c723a1 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 17 Jul 2024 16:57:24 +0800
-Subject: [PATCH 173/195] mtk: mt76: mt7996: add debugfs knob to set and dump
+Subject: [PATCH 173/223] mtk: mt76: mt7996: add debugfs knob to set and dump
  txop
 
+Change-Id: Iaf4fa82556c9ee4433de29f1ebe125e91c743284
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/mtk_debug_i.h   |   8 ++++
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0174-mtk-mt76-mt7996-add-mcu-command-to-set-bssid-mapping.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0174-mtk-mt76-mt7996-add-mcu-command-to-set-bssid-mapping.patch
index 6e5a613..9d09a4f 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0174-mtk-mt76-mt7996-add-mcu-command-to-set-bssid-mapping.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0174-mtk-mt76-mt7996-add-mcu-command-to-set-bssid-mapping.patch
@@ -1,13 +1,14 @@
-From 2010b74cd20bfe8ab263b47baa7d546c3506f2fa Mon Sep 17 00:00:00 2001
+From 848a43638c737f72cf30a53b855f0f09ee7be729 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 22 Jul 2024 10:47:45 +0800
-Subject: [PATCH 174/195] mtk: mt76: mt7996: add mcu command to set bssid
+Subject: [PATCH 174/223] mtk: mt76: mt7996: add mcu command to set bssid
  mapping address
 
 When receiving 4 address non-amsdu packet, there is no bssid in the address
 field. Set mcu command to use A1 as bssid when receiving 4 address non-amsdu
 packet.
 
+Change-Id: I599c9ea5a1a7cecc206b099ea13c583d71fd274b
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt7996/init.c   |  7 +++++++
@@ -17,7 +18,7 @@
  4 files changed, 35 insertions(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index f923ce66..25f772af 100644
+index 18847ff5..d7a1d7cd 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -539,6 +539,9 @@ mt7996_mac_init_band(struct mt7996_dev *dev, u8 band)
@@ -42,10 +43,10 @@
  
  static void mt7996_mac_init_basic_rates(struct mt7996_dev *dev)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index d9b97f36..1dfb6dcc 100644
+index b47aa7d6..dc1af0be 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -6120,6 +6120,32 @@ int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
+@@ -6127,6 +6127,32 @@ int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -91,10 +92,10 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 97b91fbc..0535a875 100644
+index 21019bc2..b9b52d17 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1108,6 +1108,7 @@ int mt7996_mcu_set_radar_th(struct mt7996_dev *dev, int index,
+@@ -1112,6 +1112,7 @@ int mt7996_mcu_set_radar_th(struct mt7996_dev *dev, int index,
  			    const struct mt7996_dfs_pattern *pattern);
  int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable);
  int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0175-mtk-mt76-mt7996-Temporary-fix-init-txpwoer-for-singl.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0175-mtk-mt76-mt7996-Temporary-fix-init-txpwoer-for-singl.patch
index 967e042..ebf90c9 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0175-mtk-mt76-mt7996-Temporary-fix-init-txpwoer-for-singl.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0175-mtk-mt76-mt7996-Temporary-fix-init-txpwoer-for-singl.patch
@@ -1,18 +1,19 @@
-From e0fb5d71238bfd50d122e9f938e0078cb2f88bca Mon Sep 17 00:00:00 2001
+From ece67fdae758e7e94b3a00148e9d205c8cff3228 Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Mon, 22 Jul 2024 19:33:07 +0800
-Subject: [PATCH 175/195] mtk: mt76: mt7996: Temporary fix init txpwoer for
+Subject: [PATCH 175/223] mtk: mt76: mt7996: Temporary fix init txpwoer for
  single wiphy
 
 This patch can be removed after the real single wiphy finished.
 
+Change-Id: I6eaaa33c0cd1b212bb0ddffb6b42f44c8b3a71f9
 Signed-off-by: Allen Ye <allen.ye@mediatek.com>
 ---
  mt7996/init.c | 21 +++++++++++++++------
  1 file changed, 15 insertions(+), 6 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 25f772af..e0cbcaaa 100644
+index d7a1d7cd..64c28ba4 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -373,15 +373,24 @@ static void __mt7996_init_txpower(struct mt7996_phy *phy,
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0176-mtk-mt76-mt7996-Add-lpi-support-with-sku_idx-and-enh.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0176-mtk-mt76-mt7996-Add-lpi-support-with-sku_idx-and-enh.patch
index 5dce10e..50c352a 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0176-mtk-mt76-mt7996-Add-lpi-support-with-sku_idx-and-enh.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0176-mtk-mt76-mt7996-Add-lpi-support-with-sku_idx-and-enh.patch
@@ -1,7 +1,7 @@
-From 57b17637f4ccd63e18957713a5947a76a2227359 Mon Sep 17 00:00:00 2001
+From b6751afce073f71139c40e17b05b25950b037a28 Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Fri, 12 Jul 2024 16:58:57 +0800
-Subject: [PATCH 176/195] mtk: mt76: mt7996: Add lpi support with sku_idx and
+Subject: [PATCH 176/223] mtk: mt76: mt7996: Add lpi support with sku_idx and
  enhancement
 
 Add lpi support with sku_idx and enhancement.
@@ -10,6 +10,7 @@
 3. Add lpi mode mamangement from enhancement that use 1T to transmit mgmt
 from in 80 MHz.
 
+Change-Id: I2ca15f6a6dd11976c65347fca88abcb3ac66097d
 Signed-off-by: Allen Ye <allen.ye@mediatek.com>
 ---
  eeprom.c             |  13 +++--
@@ -29,10 +30,10 @@
  14 files changed, 286 insertions(+), 30 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 3da94926..888e2d92 100644
+index 4eb27782..469af710 100644
 --- a/eeprom.c
 +++ b/eeprom.c
-@@ -218,8 +218,9 @@ static bool mt76_string_prop_find(struct property *prop, const char *str)
+@@ -233,8 +233,9 @@ static bool mt76_string_prop_find(struct property *prop, const char *str)
  }
  
  struct device_node *
@@ -43,7 +44,7 @@
  	struct device_node *np = dev->dev->of_node;
  	const char *const region_names[] = {
  		[NL80211_DFS_UNSET] = "ww",
-@@ -229,6 +230,7 @@ mt76_find_power_limits_node(struct mt76_dev *dev)
+@@ -244,6 +245,7 @@ mt76_find_power_limits_node(struct mt76_dev *dev)
  	};
  	struct device_node *cur, *fallback = NULL;
  	const char *region_name = NULL;
@@ -51,7 +52,7 @@
  
  	if (dev->region < ARRAY_SIZE(region_names))
  		region_name = region_names[dev->region];
-@@ -237,15 +239,20 @@ mt76_find_power_limits_node(struct mt76_dev *dev)
+@@ -252,15 +254,20 @@ mt76_find_power_limits_node(struct mt76_dev *dev)
  	if (!np)
  		return NULL;
  
@@ -72,7 +73,7 @@
  		if (mt76_string_prop_find(country, dev->alpha2) ||
  		    mt76_string_prop_find(regd, region_name)) {
  			of_node_put(np);
-@@ -322,7 +329,7 @@ mt76_apply_array_limit(s8 *pwr, size_t pwr_len, const __be32 *data,
+@@ -337,7 +344,7 @@ mt76_apply_array_limit(s8 *pwr, size_t pwr_len, const __be32 *data,
  
  	for (i = 0; i < pwr_len; i++) {
  		pwr[i] = min_t(s8, target_power,
@@ -81,7 +82,7 @@
  		*max_power = max(*max_power, pwr[i]);
  	}
  }
-@@ -387,7 +394,7 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+@@ -402,7 +409,7 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  	if (!IS_ENABLED(CONFIG_OF))
  		return target_power;
  
@@ -91,10 +92,10 @@
  		return target_power;
  
 diff --git a/mt76.h b/mt76.h
-index 181e07ed..a9c94213 100644
+index 27c990df..14f409ba 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -946,6 +946,7 @@ struct mt76_phy {
+@@ -948,6 +948,7 @@ struct mt76_phy {
  	u8 macaddr[ETH_ALEN];
  
  	int txpower_cur;
@@ -102,7 +103,7 @@
  	u8 antenna_mask;
  	u16 chainmask;
  
-@@ -1060,6 +1061,10 @@ struct mt76_dev {
+@@ -1062,6 +1063,10 @@ struct mt76_dev {
  
  	u32 rxfilter;
  
@@ -113,7 +114,7 @@
  #ifdef CONFIG_NL80211_TESTMODE
  	const struct mt76_testmode_ops *test_ops;
  	struct {
-@@ -1825,7 +1830,7 @@ mt76_mcu_skb_send_msg(struct mt76_dev *dev, struct sk_buff *skb, int cmd,
+@@ -1826,7 +1831,7 @@ mt76_mcu_skb_send_msg(struct mt76_dev *dev, struct sk_buff *skb, int cmd,
  void mt76_set_irq_mask(struct mt76_dev *dev, u32 addr, u32 clear, u32 set);
  
  struct device_node *
@@ -146,7 +147,7 @@
  #define MT_CT_INFO_COPY_HOST_TXD_ALL	BIT(1)
  #define MT_CT_INFO_MGMT_FRAME		BIT(2)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index e0cbcaaa..f1b9b0e0 100644
+index 64c28ba4..b63316b4 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -347,7 +347,7 @@ static void __mt7996_init_txpower(struct mt7996_phy *phy,
@@ -159,10 +160,10 @@
  		struct ieee80211_channel *chan = &sband->channels[i];
  		int target_power = mt7996_eeprom_get_target_power(dev, chan);
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index e571bbfa..32f5b859 100644
+index 406a1275..295bff24 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -885,8 +885,13 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+@@ -897,8 +897,13 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
  		}
  
  		val = FIELD_PREP(MT_TXD6_TX_RATE, idx) | MT_TXD6_FIXED_BW;
@@ -177,7 +178,7 @@
  		txwi[3] |= cpu_to_le32(MT_TXD3_BA_DISABLE);
  	}
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 4b3f1790..db8aeaef 100644
+index 21d65f78..2b92b686 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -878,6 +878,7 @@ static u8
@@ -207,10 +208,10 @@
  out:
  	mutex_unlock(&dev->mt76.mutex);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 1dfb6dcc..b19614d3 100644
+index dc1af0be..c6b6f405 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -6313,7 +6313,7 @@ int mt7996_mcu_set_fixed_rate_table(struct mt7996_phy *phy, u8 table_idx,
+@@ -6320,7 +6320,7 @@ int mt7996_mcu_set_fixed_rate_table(struct mt7996_phy *phy, u8 table_idx,
  
  	if (beacon) {
  		req.spe_idx_sel = SPE_IXD_SELECT_TXD;
@@ -219,7 +220,7 @@
  		phy->beacon_rate = rate_idx;
  	} else {
  		req.spe_idx_sel = SPE_IXD_SELECT_BMC_WTBL;
-@@ -6596,14 +6596,29 @@ mt7996_update_max_txpower_cur(struct mt7996_phy *phy, int tx_power)
+@@ -6603,14 +6603,29 @@ mt7996_update_max_txpower_cur(struct mt7996_phy *phy, int tx_power)
  		mphy->txpower_cur = e2p_power_limit;
  }
  
@@ -251,7 +252,7 @@
  	struct tx_power_limit_table_ctrl {
  		u8 __rsv1[4];
  
-@@ -6624,9 +6639,9 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
+@@ -6631,9 +6646,9 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
  	struct sk_buff *skb;
  	int i, ret, txpower_limit;
  
@@ -264,7 +265,7 @@
  
  	if (phy->sku_limit_en) {
  		txpower_limit = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
-@@ -6645,7 +6660,36 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
+@@ -6652,7 +6667,36 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
  	skb_put_data(skb, &req, sizeof(req));
  	/* cck and ofdm */
  	skb_put_data(skb, &la.cck, sizeof(la.cck));
@@ -302,7 +303,7 @@
  	/* ht20 */
  	skb_put_data(skb, &la.mcs[0], 8);
  	/* ht40 */
-@@ -6682,8 +6726,41 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
+@@ -6689,8 +6733,41 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
  
  	skb_put_data(skb, &req, sizeof(req));
  	skb_put_data(skb, &la_path.cck, sizeof(la_path.cck));
@@ -346,7 +347,7 @@
  
  	for (i = 0; i < 32; i++) {
  		bool bf = i % 2;
-@@ -6697,6 +6774,31 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
+@@ -6704,6 +6781,31 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
  				     MCU_WM_UNI_CMD(TXPOWER), true);
  }
  
@@ -391,10 +392,10 @@
  };
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 0535a875..57f7ae67 100644
+index b9b52d17..8b7486a1 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1115,7 +1115,7 @@ int mt7996_mcu_get_temperature(struct mt7996_phy *phy);
+@@ -1119,7 +1119,7 @@ int mt7996_mcu_get_temperature(struct mt7996_phy *phy);
  int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state);
  int mt7996_mcu_set_thermal_protect(struct mt7996_phy *phy, bool enable);
  int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
@@ -403,7 +404,7 @@
  int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 index,
  		       u8 rx_sel, u8 val);
  int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev,
-@@ -1315,6 +1315,7 @@ void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
+@@ -1319,6 +1319,7 @@ void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
  int mt7996_mcu_set_csi(struct mt7996_phy *phy, u8 mode,
  		       u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
  int mt7996_vendor_pp_bitmap_update(struct mt7996_phy *phy, u16 bitmap);
@@ -412,10 +413,10 @@
  
  int mt7996_mcu_edcca_enable(struct mt7996_phy *phy, bool enable);
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 093f3c69..fa8de2db 100644
+index 2ded5f79..78450935 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -2509,7 +2509,7 @@ mt7996_get_txpower_info(struct file *file, char __user *user_buf,
+@@ -2508,7 +2508,7 @@ mt7996_get_txpower_info(struct file *file, char __user *user_buf,
  	len += scnprintf(buf + len, size - len,
  			 "    Theraml Compensation Value: %d\n",
  			 basic_info->thermal_compensate_value);
@@ -424,7 +425,7 @@
  	len += scnprintf(buf + len, size - len,
  			 "    RegDB:  %s\n",
  			 !np ? "enable" : "disable");
-@@ -4505,6 +4505,7 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
+@@ -4504,6 +4504,7 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
  	debugfs_create_file("rx_drop_stats", 0400, dir, dev, &mt7996_rx_drop_fops);
  
  	debugfs_create_file("muru_dbg", 0200, dir, dev, &fops_muru_dbg_info);
@@ -433,10 +434,10 @@
  
  #endif
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index b956915e..cf9ec9ac 100644
+index 240227a9..1674e129 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -1853,7 +1853,7 @@ mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
+@@ -1857,7 +1857,7 @@ mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
  		mt7996_tm_update_channel(phy);
  		mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(SKU_POWER_LIMIT), td->sku_en);
  		mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(BACKOFF_POWER_LIMIT), td->sku_en);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0177-mtk-mt76-mt7996-Add-Triggered-Uplink-Access-Optimiza.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0177-mtk-mt76-mt7996-Add-Triggered-Uplink-Access-Optimiza.patch
index 3b17402..53d656d 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0177-mtk-mt76-mt7996-Add-Triggered-Uplink-Access-Optimiza.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0177-mtk-mt76-mt7996-Add-Triggered-Uplink-Access-Optimiza.patch
@@ -1,11 +1,12 @@
-From 0ff1be7c026a503f5285fe0bf5de72d9e3fd9c04 Mon Sep 17 00:00:00 2001
+From 80c870cb7dc5faa9b045a1a44322fc07f5f8aed3 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 2 Jul 2024 10:06:26 +0800
-Subject: [PATCH 177/195] mtk: mt76: mt7996: Add Triggered Uplink Access
+Subject: [PATCH 177/223] mtk: mt76: mt7996: Add Triggered Uplink Access
  Optimization support
 
 Add TUAO feature, which is a subset of SCS procedure support.
 
+Change-Id: I7932b147d399e39e4b91f5dd97edea6f307122d3
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
 ---
  mt7996/init.c    | 25 ++++++++++-----
@@ -17,7 +18,7 @@
  6 files changed, 173 insertions(+), 7 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index f1b9b0e0..2f43c0ff 100644
+index b63316b4..ae86c0eb 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -62,7 +62,14 @@ static const struct ieee80211_iface_combination if_comb_7992[] = {
@@ -59,7 +60,7 @@
  		.eml_capabilities = IEEE80211_EML_CAP_EMLSR_SUPP,
  		.mld_capa_and_ops = 2,
  		/* the max number of simultaneous links is defined as the
-@@ -1573,6 +1580,10 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
+@@ -1593,6 +1600,10 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
  		u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_11454,
  			       IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK);
  
@@ -71,10 +72,10 @@
  		IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
  		IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 57f7ae67..b752b187 100644
+index 8b7486a1..8f8cd7ae 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -524,6 +524,9 @@ struct csi_data {
+@@ -525,6 +525,9 @@ struct csi_data {
  };
  
  int mt7996_set_coding_type(struct ieee80211_hw *hw, u8 coding_type, u8 link_id);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0178-mtk-mt76-mt7996-add-per-band-token-limit.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0178-mtk-mt76-mt7996-add-per-band-token-limit.patch
index 998adf4..883ab46 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0178-mtk-mt76-mt7996-add-per-band-token-limit.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0178-mtk-mt76-mt7996-add-per-band-token-limit.patch
@@ -1,13 +1,15 @@
-From c1e6598d6177a133f4cbfd1d9730b124796f93e0 Mon Sep 17 00:00:00 2001
+From 0d130b8ba58d84007b12bd6984b94b756c5d6d3b Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 30 Jul 2024 19:49:39 +0800
-Subject: [PATCH 178/195] mtk: mt76: mt7996: add per-band token limit
+Subject: [PATCH 178/223] mtk: mt76: mt7996: add per-band token limit
 
 Add a threshold for per-band token count.
 The bands use the same token pool so a band cannot transmit if
 the other band occupy too many tokens. With this patch, we can
 prevent a band from interfering with the other band.
 
+Change-Id: I53ba83b2144c7576274b0f4b736f201a6ab79b0c
+Change-Id: Ic3974b881fb099f0749ebf97c690141c234b6d1e
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
  mt76.h               |  6 +++++-
@@ -19,10 +21,10 @@
  6 files changed, 40 insertions(+), 7 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index a9c94213..a0289617 100644
+index 14f409ba..5d7b8c4c 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -467,6 +467,7 @@ struct mt76_txwi_cache {
+@@ -468,6 +468,7 @@ struct mt76_txwi_cache {
  	dma_addr_t dma_addr;
  
  	unsigned long jiffies;
@@ -30,7 +32,7 @@
  
  	struct sk_buff *skb;
  };
-@@ -973,6 +974,7 @@ struct mt76_phy {
+@@ -975,6 +976,7 @@ struct mt76_phy {
  	} leds;
  	struct mt76_tx_debug tx_dbg_stats;
  	struct mt76_rx_debug rx_dbg_stats;
@@ -38,7 +40,7 @@
  };
  
  struct mt76_dev {
-@@ -1022,6 +1024,7 @@ struct mt76_dev {
+@@ -1024,6 +1026,7 @@ struct mt76_dev {
  	u16 wed_token_count;
  	u16 token_count;
  	u16 token_size;
@@ -46,7 +48,7 @@
  
  	spinlock_t rx_token_lock;
  	struct idr rx_token;
-@@ -1894,7 +1897,8 @@ static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
+@@ -1895,7 +1898,8 @@ static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
  
  struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
@@ -57,10 +59,10 @@
  struct mt76_rxwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 2f43c0ff..bad4b1b7 100644
+index ae86c0eb..6e8791c8 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -1770,6 +1770,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1790,6 +1790,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -70,10 +72,10 @@
  	if (ret)
  		goto error;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 32f5b859..f9344f28 100644
+index 295bff24..ac51e27d 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -959,7 +959,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -971,7 +971,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
  	t->skb = tx_info->skb;
  
@@ -82,7 +84,7 @@
  	if (id < 0) {
  		mdev->tx_dbg_stats.tx_drop[MT_TX_DROP_GET_TOKEN_FAIL]++;
  		return id;
-@@ -1683,8 +1683,11 @@ void mt7996_tx_token_put(struct mt7996_dev *dev)
+@@ -1695,8 +1695,11 @@ void mt7996_tx_token_put(struct mt7996_dev *dev)
  
  	spin_lock_bh(&dev->mt76.token_lock);
  	idr_for_each_entry(&dev->mt76.token, txwi, id) {
@@ -95,10 +97,10 @@
  	spin_unlock_bh(&dev->mt76.token_lock);
  	idr_destroy(&dev->mt76.token);
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index b752b187..ca0193c9 100644
+index 8f8cd7ae..38f62d89 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -76,6 +76,7 @@
+@@ -78,6 +78,7 @@
  #define MT7996_TOKEN_SIZE		16384
  #define MT7996_HW_TOKEN_SIZE		8192
  #define MT7996_SW_TOKEN_SIZE		15360
@@ -107,10 +109,10 @@
  #define MT7996_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
  #define MT7996_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index fa8de2db..a4703b07 100644
+index 78450935..96a4a514 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -2401,7 +2401,7 @@ static int mt7996_sta_info(struct seq_file *s, void *data)
+@@ -2400,7 +2400,7 @@ static int mt7996_sta_info(struct seq_file *s, void *data)
  static int mt7996_token_read(struct seq_file *s, void *data)
  {
  	struct mt7996_dev *dev = dev_get_drvdata(s->private);
@@ -119,7 +121,7 @@
  	struct mt76_txwi_cache *txwi;
  
  	seq_printf(s, "Token from host:\n");
-@@ -2410,8 +2410,18 @@ static int mt7996_token_read(struct seq_file *s, void *data)
+@@ -2409,8 +2409,18 @@ static int mt7996_token_read(struct seq_file *s, void *data)
  		seq_printf(s, "%4d (pending time %u ms)\n", msdu_id,
  			   jiffies_to_msecs(jiffies - txwi->jiffies));
  	}
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0179-mtk-mt76-sync-with-upstream-changes.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0179-mtk-mt76-sync-with-upstream-changes.patch
index ad8a7f6..07714b3 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0179-mtk-mt76-sync-with-upstream-changes.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0179-mtk-mt76-sync-with-upstream-changes.patch
@@ -1,32 +1,19 @@
-From df167af4849b81662e8a5768a086bb9740883b9d Mon Sep 17 00:00:00 2001
+From dd6e1e68ae6daf98e724d37d7fb099f2b825b094 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 31 Jul 2024 11:19:53 +0800
-Subject: [PATCH 179/195] mtk: mt76: sync with upstream changes
+Subject: [PATCH 179/223] mtk: mt76: sync with upstream changes
 
+Change-Id: I0d1b5ad073e0e2b6f74fca5e800f0b3365151814
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
- mt7996/main.c | 2 +-
- mt7996/mcu.c  | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
+ mt7996/mcu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
 
-diff --git a/mt7996/main.c b/mt7996/main.c
-index db8aeaef..3e29bf39 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -153,7 +153,7 @@ static int mt7996_start(struct ieee80211_hw *hw)
- 	return ret;
- }
- 
--static void mt7996_stop(struct ieee80211_hw *hw)
-+static void mt7996_stop(struct ieee80211_hw *hw, bool suspend)
- {
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	int band;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index b19614d3..190f87e0 100644
+index c6b6f405..47f8b5cc 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -421,7 +421,7 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
+@@ -426,7 +426,7 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
  						&dev->rdd2_chandef,
  						GFP_ATOMIC);
  	} else {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0180-mtk-mt76-mt7996-record-per-antenna-average-data-fram.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0180-mtk-mt76-mt7996-record-per-antenna-average-data-fram.patch
index aea03fc..7d1b622 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0180-mtk-mt76-mt7996-record-per-antenna-average-data-fram.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0180-mtk-mt76-mt7996-record-per-antenna-average-data-fram.patch
@@ -1,7 +1,7 @@
-From ccbfd127da10d9d15699f57355055768c83e623e Mon Sep 17 00:00:00 2001
+From a8a7baa9433713f20bd0e8f6f78972097d0f0820 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Thu, 1 Aug 2024 09:11:02 +0800
-Subject: [PATCH 180/195] mtk: mt76: mt7996: record per-antenna average
+Subject: [PATCH 180/223] mtk: mt76: mt7996: record per-antenna average
  data-frame RSSI
 
 Record per-antenna average data-frame RSSI.
@@ -14,7 +14,7 @@
  3 files changed, 13 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index f9344f28..27b4e99f 100644
+index ac51e27d..58b462e8 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -494,10 +494,17 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
@@ -36,7 +36,7 @@
  
  		/* RXD Group 5 - C-RXV */
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 3e29bf39..9720fd0a 100644
+index 2b92b686..ed0f9154 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1230,7 +1230,7 @@ static int mt7996_add_link_sta(struct mt7996_dev *dev,
@@ -59,10 +59,10 @@
  
  	return 0;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index ca0193c9..f144fa08 100644
+index 38f62d89..59f0be0a 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -320,6 +320,8 @@ struct mt7996_link_sta {
+@@ -321,6 +321,8 @@ struct mt7996_link_sta {
  
  	s8 chain_signal[IEEE80211_MAX_CHAINS];
  	int signal;
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0181-mtk-mt76-mt7996-remove-default-bss_conf-when-link-be.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0181-mtk-mt76-mt7996-remove-default-bss_conf-when-link-be.patch
index 1e3e2a6..e78c343 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0181-mtk-mt76-mt7996-remove-default-bss_conf-when-link-be.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0181-mtk-mt76-mt7996-remove-default-bss_conf-when-link-be.patch
@@ -1,16 +1,17 @@
-From b316b903776f64a85558778dc86a1e6e1080d91e Mon Sep 17 00:00:00 2001
+From f8be713871266a7834ad070e6ed737ddc51aeb92 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Mon, 5 Aug 2024 14:54:43 +0800
-Subject: [PATCH 181/195] mtk: mt76: mt7996: remove default bss_conf when link
+Subject: [PATCH 181/223] mtk: mt76: mt7996: remove default bss_conf when link
  becomes MLD
 
+Change-Id: I192aab47adfa038f0ca9320cd5840f1e624a618d
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt7996/main.c | 6 ++++++
  1 file changed, 6 insertions(+)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 9720fd0a..09d0d452 100644
+index ed0f9154..7678059b 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -3128,6 +3128,12 @@ mt7996_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0182-mtk-mt76-mt7996-pass-vif-cfg.assoc-to-mt7996_mac_sta.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0182-mtk-mt76-mt7996-pass-vif-cfg.assoc-to-mt7996_mac_sta.patch
index 46e0751..c7a101e 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0182-mtk-mt76-mt7996-pass-vif-cfg.assoc-to-mt7996_mac_sta.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0182-mtk-mt76-mt7996-pass-vif-cfg.assoc-to-mt7996_mac_sta.patch
@@ -1,20 +1,21 @@
-From a9867d555060ac13b51f2bbeb9361e1445a9e18a Mon Sep 17 00:00:00 2001
+From 582927a3040724713a313cd346dd8f63c907c044 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Mon, 5 Aug 2024 14:55:10 +0800
-Subject: [PATCH 182/195] mtk: mt76: mt7996: pass vif->cfg.assoc to
+Subject: [PATCH 182/223] mtk: mt76: mt7996: pass vif->cfg.assoc to
  mt7996_mac_sta_add_links
 
 Link management functions might leverage mt7996_change_sta_links to
 update sta's links, so the 'assoc' argument of mt7996_mac_sta_add_links()
 should be dynamic decieded by vif->cfg.assoc.
 
+Change-Id: I89028f7f705384c26bc0ba35820d6478abf0c359
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt7996/main.c | 4 +++-
  1 file changed, 3 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 09d0d452..89768856 100644
+index 7678059b..7d4352c7 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -3161,6 +3161,7 @@ mt7996_change_sta_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0183-mtk-mt76-mt7996-separate-hwrro-from-wed.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0183-mtk-mt76-mt7996-separate-hwrro-from-wed.patch
index b412597..a037dff 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0183-mtk-mt76-mt7996-separate-hwrro-from-wed.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0183-mtk-mt76-mt7996-separate-hwrro-from-wed.patch
@@ -1,7 +1,7 @@
-From 5dd3c8f766568fdfee2999aa469dc15890349761 Mon Sep 17 00:00:00 2001
+From 1d7510d986c174a852a91d51415019538c4bd95b Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Tue, 6 Aug 2024 10:06:10 +0800
-Subject: [PATCH 183/195] mtk: mt76: mt7996: separate hwrro from wed
+Subject: [PATCH 183/223] mtk: mt76: mt7996: separate hwrro from wed
 
 1. separate hwrro from wed
 2. support mt7996/mt7992 run hwrro 3.0 without wed
@@ -223,7 +223,7 @@
  #define MT_DMA_WED_IND_REASON		GENMASK(15, 12)
  
 diff --git a/mac80211.c b/mac80211.c
-index 58babaf0..fd2e23e5 100644
+index 6190822c..d87aba36 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -732,6 +732,7 @@ static void mt76_rx_release_amsdu(struct mt76_phy *phy, enum mt76_rxq_id q)
@@ -246,10 +246,10 @@
  }
  
 diff --git a/mt76.h b/mt76.h
-index a0289617..6b612286 100644
+index 5d7b8c4c..50d52776 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -276,6 +276,7 @@ struct mt76_queue {
+@@ -277,6 +277,7 @@ struct mt76_queue {
  
  	u8 buf_offset;
  	u16 flags;
@@ -257,7 +257,7 @@
  
  	struct mtk_wed_device *wed;
  	u32 wed_regs;
-@@ -332,6 +333,9 @@ struct mt76_queue_ops {
+@@ -333,6 +334,9 @@ struct mt76_queue_ops {
  	void (*tx_cleanup)(struct mt76_dev *dev, struct mt76_queue *q,
  			   bool flush);
  
@@ -267,7 +267,7 @@
  	void (*rx_cleanup)(struct mt76_dev *dev, struct mt76_queue *q);
  
  	void (*kick)(struct mt76_dev *dev, struct mt76_queue *q);
-@@ -477,6 +481,7 @@ struct mt76_rxwi_cache {
+@@ -478,6 +482,7 @@ struct mt76_rxwi_cache {
  	dma_addr_t dma_addr;
  
  	void *ptr;
@@ -275,7 +275,7 @@
  };
  
  struct mt76_rx_tid {
-@@ -590,6 +595,10 @@ struct mt76_driver_ops {
+@@ -591,6 +596,10 @@ struct mt76_driver_ops {
  	void (*rx_skb)(struct mt76_dev *dev, enum mt76_rxq_id q,
  		       struct sk_buff *skb, u32 *info);
  
@@ -286,7 +286,7 @@
  	void (*rx_poll_complete)(struct mt76_dev *dev, enum mt76_rxq_id q);
  
  	void (*sta_ps)(struct mt76_dev *dev, struct ieee80211_sta *sta,
-@@ -1319,6 +1328,7 @@ static inline int mt76_wed_dma_setup(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -1321,6 +1330,7 @@ static inline int mt76_wed_dma_setup(struct mt76_dev *dev, struct mt76_queue *q,
  #define mt76_tx_queue_skb(dev, ...)	(dev)->mt76.queue_ops->tx_queue_skb(&((dev)->mphy), __VA_ARGS__)
  #define mt76_queue_rx_reset(dev, ...)	(dev)->mt76.queue_ops->rx_reset(&((dev)->mt76), __VA_ARGS__)
  #define mt76_queue_tx_cleanup(dev, ...)	(dev)->mt76.queue_ops->tx_cleanup(&((dev)->mt76), __VA_ARGS__)
@@ -294,7 +294,7 @@
  #define mt76_queue_rx_cleanup(dev, ...)	(dev)->mt76.queue_ops->rx_cleanup(&((dev)->mt76), __VA_ARGS__)
  #define mt76_queue_kick(dev, ...)	(dev)->mt76.queue_ops->kick(&((dev)->mt76), __VA_ARGS__)
  #define mt76_queue_reset(dev, ...)	(dev)->mt76.queue_ops->reset_q(&((dev)->mt76), __VA_ARGS__)
-@@ -1886,13 +1896,8 @@ static inline bool mt76_queue_is_wed_rro_msdu_pg(struct mt76_queue *q)
+@@ -1887,13 +1897,8 @@ static inline bool mt76_queue_is_wed_rro_msdu_pg(struct mt76_queue *q)
  
  static inline bool mt76_queue_is_wed_rx(struct mt76_queue *q)
  {
@@ -482,7 +482,7 @@
  
  	if (!force)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index bad4b1b7..0e647356 100644
+index 6e8791c8..ddceddff 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -931,7 +931,6 @@ void mt7996_wfsys_reset(struct mt7996_dev *dev)
@@ -608,7 +608,7 @@
  	for (i = 0; i < ARRAY_SIZE(dev->wed_rro.ba_bitmap); i++) {
  		if (!dev->wed_rro.ba_bitmap[i].ptr)
  			continue;
-@@ -1138,12 +1131,10 @@ static void mt7996_wed_rro_free(struct mt7996_dev *dev)
+@@ -1148,12 +1141,10 @@ static void mt7996_wed_rro_free(struct mt7996_dev *dev)
  			   sizeof(struct mt7996_wed_rro_addr),
  			   dev->wed_rro.session.ptr,
  			   dev->wed_rro.session.phy_addr);
@@ -621,15 +621,15 @@
  	struct mt7996_dev *dev;
  	LIST_HEAD(list);
  
-@@ -1186,7 +1177,6 @@ reset:
+@@ -1196,7 +1187,6 @@ reset:
  out:
  		kfree(e);
  	}
 -#endif
  }
  
- int mt7996_get_chip_sku(struct mt7996_dev *dev)
-@@ -1828,6 +1818,10 @@ void mt7996_unregister_device(struct mt7996_dev *dev)
+ static int mt7996_variant_type_init(struct mt7996_dev *dev)
+@@ -1848,6 +1838,10 @@ void mt7996_unregister_device(struct mt7996_dev *dev)
  	mt7996_mcu_exit(dev);
  	mt7996_tx_token_put(dev);
  	mt7996_dma_cleanup(dev);
@@ -641,10 +641,10 @@
  
  	mt76_free_device(&dev->mt76);
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 27b4e99f..c0f282d1 100644
+index 58b462e8..b0b664e7 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -1505,6 +1505,387 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+@@ -1517,6 +1517,387 @@ void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  	}
  }
  
@@ -1032,7 +1032,7 @@
  void mt7996_mac_cca_stats_reset(struct mt7996_phy *phy)
  {
  	struct mt7996_dev *dev = phy->dev;
-@@ -2040,6 +2421,9 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2052,6 +2433,9 @@ void mt7996_mac_reset_work(struct work_struct *work)
  	dev_info(dev->mt76.dev,"%s L1 SER dma start done.",
  		 wiphy_name(dev->mt76.hw->wiphy));
  
@@ -1042,7 +1042,7 @@
  	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
  		u32 wed_irq_mask = MT_INT_RRO_RX_DONE | MT_INT_TX_DONE_BAND2 |
  				   dev->mt76.mmio.irqmask;
-@@ -2049,10 +2433,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
+@@ -2061,10 +2445,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
  
  		mt76_wr(dev, MT_INT_MASK_CSR, wed_irq_mask);
  
@@ -1067,10 +1067,10 @@
  		.sta_event = mt7996_mac_sta_event,
  		.sta_remove = mt7996_mac_sta_remove,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index f144fa08..26fb4b5b 100644
+index 59f0be0a..b115e7dd 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -102,6 +102,7 @@
+@@ -104,6 +104,7 @@
  
  #define MT7996_BUILD_TIME_LEN		24
  
@@ -1078,7 +1078,7 @@
  #define MT7996_RRO_MSDU_PG_HASH_SIZE	127
  #define MT7996_RRO_MAX_SESSION		1024
  #define MT7996_RRO_WINDOW_MAX_LEN	1024
-@@ -532,6 +533,33 @@ int mt7996_mcu_set_muru_qos_cfg(struct mt7996_dev *dev, u16 wlan_idx, u8 dir,
+@@ -533,6 +534,33 @@ int mt7996_mcu_set_muru_qos_cfg(struct mt7996_dev *dev, u16 wlan_idx, u8 dir,
  				u8 scs_id, u8 req_type, u8 *qos_ie, u8 qos_ie_len);
  #endif
  
@@ -1112,7 +1112,7 @@
  struct mt7996_rro_ba_session {
  	u32 ack_sn         :12;
  	u32 win_sz         :3;
-@@ -547,6 +575,26 @@ struct mt7996_rro_ba_session {
+@@ -548,6 +576,26 @@ struct mt7996_rro_ba_session {
  	u32 last_in_rxtime :12;
  };
  
@@ -1139,7 +1139,7 @@
  struct mt7996_chanctx {
  	struct cfg80211_chan_def chandef;
  	struct mt7996_phy *phy;
-@@ -1257,6 +1305,11 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1261,6 +1309,11 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  void mt7996_tx_token_put(struct mt7996_dev *dev);
  void mt7996_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  			 struct sk_buff *skb, u32 *info);
@@ -1174,7 +1174,7 @@
  	mt7996_wfsys_reset(dev);
  	hif2 = mt7996_pci_init_hif2(pdev);
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index e1893517..0ea055ba 100644
+index a0b57e59..e86d5df3 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -561,6 +561,7 @@ enum offs_rev {
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0184-mtk-mt76-mt7996-ignore-vif.dormant_links-in-mt7996_c.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0184-mtk-mt76-mt7996-ignore-vif.dormant_links-in-mt7996_c.patch
index 95c1df8..858e4c2 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0184-mtk-mt76-mt7996-ignore-vif.dormant_links-in-mt7996_c.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0184-mtk-mt76-mt7996-ignore-vif.dormant_links-in-mt7996_c.patch
@@ -1,19 +1,20 @@
-From ac3fdf60ece97f416f03a921b1691adb3da7eaaa Mon Sep 17 00:00:00 2001
+From 986d45c9ebf4793cababd01b338ff9a6b90ba449 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Mon, 5 Aug 2024 14:56:19 +0800
-Subject: [PATCH 184/195] mtk: mt76: mt7996: ignore vif.dormant_links in
+Subject: [PATCH 184/223] mtk: mt76: mt7996: ignore vif.dormant_links in
  mt7996_change_vif_links
 
 The dormant links are disabled for reasons like TTLM, and might become
 active in the near future, so we do not remove their bss_conf here.
 
+Change-Id: Ida947815bce7bfc3fb9772175ac105eb82ff16c1
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt7996/main.c | 5 +++--
  1 file changed, 3 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 89768856..8c67e495 100644
+index 7d4352c7..a7c2043f 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -3106,11 +3106,12 @@ mt7996_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0185-mtk-mt76-mt7996-add-Adv-TTLM-support-for-STA.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0185-mtk-mt76-mt7996-add-Adv-TTLM-support-for-STA.patch
index 54addda..7a046ae 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0185-mtk-mt76-mt7996-add-Adv-TTLM-support-for-STA.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0185-mtk-mt76-mt7996-add-Adv-TTLM-support-for-STA.patch
@@ -1,13 +1,14 @@
-From 70944a40375745238bac308ba53268a5a27225e9 Mon Sep 17 00:00:00 2001
+From cbe2fdac92d74596b378fbdc027434210d31d88b Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Mon, 5 Aug 2024 15:03:55 +0800
-Subject: [PATCH 185/195] mtk: mt76: mt7996: add Adv-TTLM support for STA
+Subject: [PATCH 185/223] mtk: mt76: mt7996: add Adv-TTLM support for STA
 
 1. add the handling for valid_link and TTLM changing in vif_cfg_changed
    callback.
 2. send peer-mld request for default mapping and Adv-TTLM. Neg-TTLM will
    be supported in further commit.
 
+Change-Id: I067331888f0cdb27826ca36cacb3897096835d94
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
 ---
  mt76_connac_mcu.h |  1 +
@@ -18,10 +19,10 @@
  5 files changed, 92 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 4980ca12..f0ae306c 100644
+index 69c8389f..68d7c31d 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1322,6 +1322,7 @@ enum {
+@@ -1327,6 +1327,7 @@ enum {
  	MCU_UNI_CMD_ASSERT_DUMP = 0x6f,
  	MCU_UNI_CMD_PTA_3WIRE_CTRL = 0x78,
  	MCU_UNI_CMD_MLD = 0x82,
@@ -30,7 +31,7 @@
  
  enum {
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 8c67e495..a4e052c6 100644
+index a7c2043f..290dff6e 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -957,6 +957,9 @@ static void mt7996_vif_cfg_changed(struct ieee80211_hw *hw,
@@ -44,10 +45,10 @@
  }
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 190f87e0..084480ed 100644
+index 47f8b5cc..265f39a6 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -3618,6 +3618,70 @@ int mt7996_mcu_mld_set_attlm(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+@@ -3623,6 +3623,70 @@ int mt7996_mcu_mld_set_attlm(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  	return ret;
  }
  
@@ -152,10 +153,10 @@
  	u8 _rsv[4];
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 26fb4b5b..f8d18217 100644
+index b115e7dd..1e52377a 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1211,6 +1211,8 @@ int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy);
+@@ -1215,6 +1215,8 @@ int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy);
  void mt7996_mcu_wmm_pbc_work(struct work_struct *work);
  int mt7996_mcu_mld_set_attlm(struct mt7996_dev *dev, struct ieee80211_vif *vif,
  			     u16 disabled_links, u16 switch_time, u32 duration);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0186-mtk-mt76-mt7996-Add-AFC-and-lpi-power-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0186-mtk-mt76-mt7996-Add-AFC-and-lpi-power-support.patch
index a16b248..ddc45f4 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0186-mtk-mt76-mt7996-Add-AFC-and-lpi-power-support.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0186-mtk-mt76-mt7996-Add-AFC-and-lpi-power-support.patch
@@ -1,7 +1,7 @@
-From 39d6aef0b197cbb8a03d07b351bc9bcf71a769d0 Mon Sep 17 00:00:00 2001
+From 4f43eb23f373930534372c1b82787f2da37c940d Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Thu, 1 Aug 2024 11:25:03 +0800
-Subject: [PATCH 186/195] mtk: mt76: mt7996: Add AFC and lpi power support
+Subject: [PATCH 186/223] mtk: mt76: mt7996: Add AFC and lpi power support
 
 This patch receiving and storing the power table from hostapd vendor cmd.
 The power table would be use to compare the sku table in standard power
@@ -25,6 +25,8 @@
 Add the bf on value offset logic. The offset is antenna/beamform gain
 offset = 10 * (log(num of ant) - log(num of NSS)).
 
+Change-Id: Ibc6e9adb149bec02d3443d6e0309c9ac122a925b
+Change-Id: Ic24ee5f95eb5c11d1031428ee1d4f3fc9ff39e11
 Signed-off-by: Allen Ye <allen.ye@mediatek.com>
 ---
  mt76.h               |   2 +
@@ -39,10 +41,10 @@
  9 files changed, 429 insertions(+), 25 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 6b612286..8a9da4c4 100644
+index 50d52776..a465785f 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1076,6 +1076,8 @@ struct mt76_dev {
+@@ -1078,6 +1078,8 @@ struct mt76_dev {
  	bool lpi_psd;
  	bool lpi_bcn_enhance;
  	bool mgmt_pwr_enhance;
@@ -52,10 +54,10 @@
  #ifdef CONFIG_NL80211_TESTMODE
  	const struct mt76_testmode_ops *test_ops;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index c0f282d1..60223bea 100644
+index b0b664e7..5d40b8f1 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -896,7 +896,7 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+@@ -908,7 +908,7 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
  		if (mcast)
  			val |= MT_TXD6_DIS_MAT;
  		if (dev->mt76.phys[band_idx]->cap.has_6ghz &&
@@ -65,7 +67,7 @@
  			val |= FIELD_PREP(MT_TXD6_BW, FW_CDBW_80MHZ);
  		txwi[6] |= cpu_to_le32(val);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index a4e052c6..f03b4ca9 100644
+index 290dff6e..812d8269 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -891,7 +891,7 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_bss_conf *conf,
@@ -78,10 +80,10 @@
  
  		/* odd index for driver, even index for firmware */
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 084480ed..debd570f 100644
+index 265f39a6..725f2f31 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -6377,7 +6377,8 @@ int mt7996_mcu_set_fixed_rate_table(struct mt7996_phy *phy, u8 table_idx,
+@@ -6384,7 +6384,8 @@ int mt7996_mcu_set_fixed_rate_table(struct mt7996_phy *phy, u8 table_idx,
  
  	if (beacon) {
  		req.spe_idx_sel = SPE_IXD_SELECT_TXD;
@@ -91,7 +93,7 @@
  		phy->beacon_rate = rate_idx;
  	} else {
  		req.spe_idx_sel = SPE_IXD_SELECT_BMC_WTBL;
-@@ -6660,6 +6661,126 @@ mt7996_update_max_txpower_cur(struct mt7996_phy *phy, int tx_power)
+@@ -6667,6 +6668,126 @@ mt7996_update_max_txpower_cur(struct mt7996_phy *phy, int tx_power)
  		mphy->txpower_cur = e2p_power_limit;
  }
  
@@ -218,7 +220,7 @@
  bool mt7996_is_psd_country(char *country)
  {
  	char psd_country_list[][3] = {"US", "KR", "BR", "CL", "MY", ""};
-@@ -6707,15 +6828,22 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
+@@ -6714,15 +6835,22 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
  		txpower_setting = 127;
  	txpower_limit = mt7996_get_power_bound(phy, txpower_setting);
  
@@ -246,7 +248,7 @@
  	skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
  				 sizeof(req) + MT7996_SKU_PATH_NUM);
  	if (!skb)
-@@ -6728,7 +6856,7 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
+@@ -6735,7 +6863,7 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
  	/* FW would compensate for PSD countries
  	 * driver doesn't need to do it
  	 */
@@ -255,7 +257,7 @@
  	    !mt7996_is_psd_country(dev->mt76.alpha2)) {
  		switch (mphy->chandef.width) {
  		case NL80211_CHAN_WIDTH_20:
-@@ -6794,7 +6922,7 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
+@@ -6801,7 +6929,7 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
  	/* FW would NOT compensate in the case of BF backoff table
  	 * driver needs to compensate for LPI PSD
  	 */
@@ -264,7 +266,7 @@
  		switch (mphy->chandef.width) {
  		case NL80211_CHAN_WIDTH_20:
  			skb_put_data(skb, &la_path.ru[5], sizeof(la_path.ofdm));
-@@ -6856,13 +6984,53 @@ int mt7996_mcu_set_lpi_psd(struct mt7996_phy *phy, u8 enable)
+@@ -6863,13 +6991,53 @@ int mt7996_mcu_set_lpi_psd(struct mt7996_phy *phy, u8 enable)
  		.tag = cpu_to_le16(UNI_BAND_CONFIG_LPI_CTRL),
  		.len = cpu_to_le16(sizeof(req) - 4),
  		.lpi_enable = enable,
@@ -470,10 +472,10 @@
  	UNI_CMD_ACCESS_REG_BASIC = 0x0,
  	UNI_CMD_ACCESS_RF_REG_BASIC,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index f8d18217..18e3f4f0 100644
+index 1e52377a..b841cc2a 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -1170,6 +1170,8 @@ int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state);
+@@ -1174,6 +1174,8 @@ int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state);
  int mt7996_mcu_set_thermal_protect(struct mt7996_phy *phy, bool enable);
  int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy,
  			       int txpower_setting);
@@ -483,10 +485,10 @@
  		       u8 rx_sel, u8 val);
  int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev,
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index a4703b07..63e63a33 100644
+index 96a4a514..5338d0bd 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
-@@ -2523,6 +2523,11 @@ mt7996_get_txpower_info(struct file *file, char __user *user_buf,
+@@ -2522,6 +2522,11 @@ mt7996_get_txpower_info(struct file *file, char __user *user_buf,
  	len += scnprintf(buf + len, size - len,
  			 "    RegDB:  %s\n",
  			 !np ? "enable" : "disable");
@@ -498,7 +500,7 @@
  	ret = simple_read_from_buffer(user_buf, count, ppos, buf, len);
  
  out:
-@@ -4390,6 +4395,37 @@ static int mt7996_pp_alg_show(struct seq_file *s, void *data)
+@@ -4389,6 +4394,37 @@ static int mt7996_pp_alg_show(struct seq_file *s, void *data)
  }
  DEFINE_SHOW_ATTRIBUTE(mt7996_pp_alg);
  
@@ -536,7 +538,7 @@
  void mt7996_mtk_init_band_debugfs(struct mt7996_phy *phy, struct dentry *dir)
  {
  	/* agg */
-@@ -4516,6 +4552,7 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
+@@ -4515,6 +4551,7 @@ void mt7996_mtk_init_dev_debugfs(struct mt7996_dev *dev, struct dentry *dir)
  
  	debugfs_create_file("muru_dbg", 0200, dir, dev, &fops_muru_dbg_info);
  	debugfs_create_bool("mgmt_pwr_enhance", 0600, dir, &dev->mt76.mgmt_pwr_enhance);
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0187-mtk-mt76-do-not-report-ACK-when-TXS-is-lost.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0187-mtk-mt76-do-not-report-ACK-when-TXS-is-lost.patch
index 1eb161a..059a790 100644
--- a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0187-mtk-mt76-do-not-report-ACK-when-TXS-is-lost.patch
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0187-mtk-mt76-do-not-report-ACK-when-TXS-is-lost.patch
@@ -1,7 +1,7 @@
-From b23689c18b06792b7134ee380d2d6277f0780184 Mon Sep 17 00:00:00 2001
+From 6bd9e4f92817c054a87abc52b59b20219585aff4 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 13 Aug 2024 18:55:00 +0800
-Subject: [PATCH 187/195] mtk: mt76: do not report ACK when TXS is lost
+Subject: [PATCH 187/223] mtk: mt76: do not report ACK when TXS is lost
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0188-mtk-mt76-mt7996-fix-ldpc-setting.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0188-mtk-mt76-mt7996-fix-ldpc-setting.patch
new file mode 100644
index 0000000..9f0d62e
--- /dev/null
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0188-mtk-mt76-mt7996-fix-ldpc-setting.patch
@@ -0,0 +1,33 @@
+From 1e59567d865e9e23c193919f8ce2d84e8d4d52f5 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Wed, 28 Aug 2024 13:58:30 +0800
+Subject: [PATCH 188/223] mtk: mt76: mt7996: fix ldpc setting
+
+The non-AP interfaces would not update conf->vht_ldpc so they never set
+STA_CAP_VHT_LDPC even if peer-station support LDPC.
+Check conf->vht_ldpc only if it is using AP interface.
+
+Without this patch, station only uses BCC to transmit packet in VHT mode.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Change-Id: I00574c95a8cded18a3272e5aa27582ab4d618899
+---
+ mt7996/mcu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 725f2f31..b0e9617d 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -2994,7 +2994,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+ 			cap |= STA_CAP_VHT_TX_STBC;
+ 		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
+ 			cap |= STA_CAP_VHT_RX_STBC;
+-		if (conf->vht_ldpc &&
++		if ((conf->vif->type != NL80211_IFTYPE_AP || conf->vht_ldpc) &&
+ 		    (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
+ 			cap |= STA_CAP_VHT_LDPC;
+ 
+-- 
+2.45.2
+
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0189-mtk-mt76-mt7996-add-external-eeprom-support.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0189-mtk-mt76-mt7996-add-external-eeprom-support.patch
new file mode 100644
index 0000000..54d2da6
--- /dev/null
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0189-mtk-mt76-mt7996-add-external-eeprom-support.patch
@@ -0,0 +1,669 @@
+From 47862d9e7019f0e7524beb819bc875404cf687bd Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 22 Aug 2024 23:22:46 +0800
+Subject: [PATCH 189/223] mtk: mt76: mt7996: add external eeprom support
+
+Add external eeprom support
+For Kite and Griffin, efuse mode is not supported due to the lack of
+space in efuse.
+So, an additional external eeprom is added for user to store their
+golden eeprom.
+
+Note that the FW currently has some issues with writing to the ext
+eeprom, so the write back function of ext eeprom is not yet linked
+to any command.
+A write back command will be added once the FW fixes the issue.
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Change-Id: Ie36469700f9620806e6513ffaf076338841ba7c3
+---
+ debugfs.c            |   2 +
+ mt76.h               |   1 +
+ mt76_connac_mcu.h    |   1 +
+ mt7996/debugfs.c     |  57 ++++++++++++++++++-
+ mt7996/eeprom.c      |  35 +++++++-----
+ mt7996/eeprom.h      |   7 ---
+ mt7996/init.c        |   3 +-
+ mt7996/mcu.c         | 130 ++++++++++++++++++++++++++++++++++---------
+ mt7996/mcu.h         |  35 +++++++++++-
+ mt7996/mt7996.h      |  30 +++++++++-
+ mt7996/mtk_debugfs.c |   3 +
+ mt7996/testmode.c    |  39 ++++++++-----
+ testmode.h           |   2 +
+ 13 files changed, 277 insertions(+), 68 deletions(-)
+
+diff --git a/debugfs.c b/debugfs.c
+index ac5207e5..2ded5c03 100644
+--- a/debugfs.c
++++ b/debugfs.c
+@@ -121,6 +121,8 @@ mt76_register_debugfs_fops(struct mt76_phy *phy,
+ 	debugfs_create_blob("eeprom", 0400, dir, &dev->eeprom);
+ 	if (dev->otp.data)
+ 		debugfs_create_blob("otp", 0400, dir, &dev->otp);
++	if (dev->ext_eeprom.data)
++		debugfs_create_blob("ext_eeprom", 0400, dir, &dev->ext_eeprom);
+ 	debugfs_create_devm_seqfile(dev->dev, "rx-queues", dir,
+ 				    mt76_rx_queues_read);
+ 
+diff --git a/mt76.h b/mt76.h
+index a465785f..c319ba26 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -1065,6 +1065,7 @@ struct mt76_dev {
+ 
+ 	struct debugfs_blob_wrapper eeprom;
+ 	struct debugfs_blob_wrapper otp;
++	struct debugfs_blob_wrapper ext_eeprom;
+ 
+ 	char alpha2[3];
+ 	enum nl80211_dfs_regions region;
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 68d7c31d..25d5f9f9 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1325,6 +1325,7 @@ enum {
+ 	MCU_UNI_CMD_PER_STA_INFO = 0x6d,
+ 	MCU_UNI_CMD_ALL_STA_INFO = 0x6e,
+ 	MCU_UNI_CMD_ASSERT_DUMP = 0x6f,
++	MCU_UNI_CMD_EXT_EEPROM_CTRL  = 0x74,
+ 	MCU_UNI_CMD_PTA_3WIRE_CTRL = 0x78,
+ 	MCU_UNI_CMD_MLD = 0x82,
+ 	MCU_UNI_CMD_PEER_MLD = 0x83,
+diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
+index 240c6d46..d06fb587 100644
+--- a/mt7996/debugfs.c
++++ b/mt7996/debugfs.c
+@@ -972,7 +972,9 @@ mt7996_efuse_get(struct file *file, char __user *user_buf,
+ 		block_num = DIV_ROUND_UP(mdev->otp.size, MT7996_EEPROM_BLOCK_SIZE);
+ 		for (i = 0; i < block_num; i++) {
+ 			buff = mdev->otp.data + i * MT7996_EEPROM_BLOCK_SIZE;
+-			ret = mt7996_mcu_get_eeprom(dev, i * MT7996_EEPROM_BLOCK_SIZE, buff);
++			ret = mt7996_mcu_get_eeprom(dev, i * MT7996_EEPROM_BLOCK_SIZE,
++						    buff, MT7996_EEPROM_BLOCK_SIZE,
++						    EFUSE_MODE);
+ 			if (ret && ret != -EINVAL)
+ 				return ret;
+ 		}
+@@ -989,6 +991,58 @@ static const struct file_operations mt7996_efuse_ops = {
+ 	.llseek = default_llseek,
+ };
+ 
++static ssize_t
++mt7996_ext_eeprom_get(struct file *file, char __user *user_buf,
++		      size_t count, loff_t *ppos)
++{
++	struct mt7996_dev *dev = file->private_data;
++	struct mt76_dev *mdev = &dev->mt76;
++	u8 *buff = mdev->ext_eeprom.data;
++	u32 block_num, block_size = MT7996_EXT_EEPROM_BLOCK_SIZE;
++	int i;
++	ssize_t ret;
++
++	if (!mt7996_has_ext_eeprom(dev)) {
++		dev_info(dev->mt76.dev, "No external eeprom device found\n");
++		return 0;
++	}
++
++	mdev->ext_eeprom.size = MT7996_EEPROM_SIZE;
++
++	if (!mdev->ext_eeprom.data) {
++		mdev->ext_eeprom.data = devm_kzalloc(mdev->dev,
++						     mdev->ext_eeprom.size,
++						     GFP_KERNEL);
++		if (!mdev->ext_eeprom.data)
++			return -ENOMEM;
++
++		block_num = DIV_ROUND_UP(mdev->ext_eeprom.size, block_size);
++		for (i = 0; i < block_num; i++) {
++			u32 buf_len = block_size;
++			u32 offset = i * block_size;
++
++			if (offset + block_size > mdev->ext_eeprom.size)
++				buf_len = mdev->ext_eeprom.size % block_size;
++			buff = mdev->ext_eeprom.data + offset;
++			ret = mt7996_mcu_get_eeprom(dev, offset, buff, buf_len,
++						    EXT_EEPROM_MODE);
++			if (ret && ret != -EINVAL)
++				return ret;
++		}
++	}
++
++	ret = simple_read_from_buffer(user_buf, count, ppos,
++				      mdev->ext_eeprom.data, mdev->ext_eeprom.size);
++
++	return ret;
++}
++
++static const struct file_operations mt7996_ext_eeprom_ops = {
++	.read = mt7996_ext_eeprom_get,
++	.open = simple_open,
++	.llseek = default_llseek,
++};
++
+ static int
+ mt7996_vow_info_read(struct seq_file *s, void *data)
+ {
+@@ -1133,6 +1187,7 @@ int mt7996_init_dev_debugfs(struct mt7996_phy *phy)
+ 				    mt7996_twt_stats);
+ 	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
+ 	debugfs_create_file("otp", 0400, dir, dev, &mt7996_efuse_ops);
++	debugfs_create_file("ext_eeprom", 0400, dir, dev, &mt7996_ext_eeprom_ops);
+ 	debugfs_create_devm_seqfile(dev->mt76.dev, "vow_info", dir,
+ 	                            mt7996_vow_info_read);
+ 	debugfs_create_devm_seqfile(dev->mt76.dev, "airtime", dir,
+diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
+index 327a36b2..db98db21 100644
+--- a/mt7996/eeprom.c
++++ b/mt7996/eeprom.c
+@@ -315,43 +315,52 @@ static int mt7996_eeprom_load(struct mt7996_dev *dev)
+ 
+ 	/* flash or bin file mode eeprom is loaded before mcu init */
+ 	if (!dev->flash_mode) {
+-		u32 eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;
+-		u32 block_num = DIV_ROUND_UP(MT7996_EEPROM_SIZE, eeprom_blk_size);
++		u32 eeprom_blk_size, block_num;
+ 		u8 free_block_num;
+ 		int i;
+ 
+ 		memset(dev->mt76.eeprom.data, 0, MT7996_EEPROM_SIZE);
+-		ret = mt7996_mcu_get_eeprom_free_block(dev, &free_block_num);
+-		if (ret < 0)
+-			return ret;
+-
+-		/* efuse info isn't enough */
+-		if (free_block_num >= 59) {
+-			use_default = true;
+-			goto out;
++		if (!mt7996_has_ext_eeprom(dev)) {
++			/* efuse mode */
++			dev->eeprom_mode = EFUSE_MODE;
++			eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;
++			ret = mt7996_mcu_get_efuse_free_block(dev, &free_block_num);
++			if (ret < 0)
++				return ret;
++
++			/* efuse info isn't enough */
++			if (free_block_num >= 59) {
++				use_default = true;
++				goto out;
++			}
++		} else {
++			/* external eeprom mode */
++			dev->eeprom_mode = EXT_EEPROM_MODE;
++			eeprom_blk_size = MT7996_EXT_EEPROM_BLOCK_SIZE;
+ 		}
+ 
+ 		/* check if eeprom data from fw is valid */
+-		if (mt7996_mcu_get_eeprom(dev, 0, NULL, 0) ||
++		if (mt7996_mcu_get_eeprom(dev, 0, NULL, eeprom_blk_size,
++					  dev->eeprom_mode) ||
+ 		    mt7996_check_eeprom(dev)) {
+ 			use_default = true;
+ 			goto out;
+ 		}
+ 
+ 		/* read eeprom data from fw */
++		block_num = DIV_ROUND_UP(MT7996_EEPROM_SIZE, eeprom_blk_size);
+ 		for (i = 1; i < block_num; i++) {
+ 			u32 len = eeprom_blk_size;
+ 
+ 			if (i == block_num - 1)
+ 				len = MT7996_EEPROM_SIZE % eeprom_blk_size;
+ 			ret = mt7996_mcu_get_eeprom(dev, i * eeprom_blk_size,
+-						    NULL, len);
++						    NULL, len, dev->eeprom_mode);
+ 			if (ret && ret != -EINVAL) {
+ 				use_default = true;
+ 				goto out;
+ 			}
+ 		}
+-		dev->eeprom_mode = EFUSE_MODE;
+ 	}
+ 
+ out:
+diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
+index 788c33c8..15b6620d 100644
+--- a/mt7996/eeprom.h
++++ b/mt7996/eeprom.h
+@@ -151,13 +151,6 @@ enum mt7996_eeprom_band {
+ 	MT_EE_BAND_SEL_6GHZ,
+ };
+ 
+-enum mt7915_eeprom_mode {
+-	DEFAULT_BIN_MODE,
+-	EFUSE_MODE,
+-	FLASH_MODE,
+-	BIN_FILE_MODE,
+-};
+-
+ static inline int
+ mt7996_get_channel_group_5g(int channel)
+ {
+diff --git a/mt7996/init.c b/mt7996/init.c
+index ddceddff..f739afd2 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -1238,7 +1238,8 @@ static int mt7996_variant_fem_init(struct mt7996_dev *dev)
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = mt7996_mcu_get_eeprom(dev, MT7976C_EFUSE_OFFSET, buf, sizeof(buf));
++	ret = mt7996_mcu_get_eeprom(dev, MT7976C_EFUSE_OFFSET, buf, sizeof(buf),
++				    EFUSE_MODE);
+ 	if (ret && ret != -EINVAL)
+ 		return ret;
+ 
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index b0e9617d..01969464 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -5259,7 +5259,7 @@ int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
+ #define MAX_PAGE_IDX_MASK	GENMASK(7, 5)
+ #define PAGE_IDX_MASK		GENMASK(4, 2)
+ #define PER_PAGE_SIZE		0x400
+-	struct mt7996_mcu_eeprom req = {
++	struct mt7996_mcu_eeprom_update req = {
+ 		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
+ 		.buffer_mode = EE_MODE_BUFFER
+ 	};
+@@ -5301,7 +5301,7 @@ int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
+ 
+ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
+ {
+-	struct mt7996_mcu_eeprom req = {
++	struct mt7996_mcu_eeprom_update req = {
+ 		.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
+ 		.len = cpu_to_le16(sizeof(req) - 4),
+ 		.buffer_mode = EE_MODE_EFUSE,
+@@ -5309,7 +5309,7 @@ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
+ 	};
+ 	int ret;
+ 
+-	if (dev->flash_mode)
++	if (dev->flash_mode || mt7996_has_ext_eeprom(dev))
+ 		ret = mt7996_mcu_set_eeprom_flash(dev);
+ 	else
+ 		ret = mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(EFUSE_CTRL),
+@@ -5320,36 +5320,64 @@ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
+ 	return mt7996_mcu_set_cal_free_data(dev);
+ }
+ 
+-int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len)
++int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len,
++			  enum mt7996_eeprom_mode mode)
+ {
+-	struct mt7996_mcu_eeprom_info req = {
+-		.tag = cpu_to_le16(UNI_EFUSE_ACCESS),
+-		.len = cpu_to_le16(sizeof(req) - 4),
+-		.addr = cpu_to_le32(round_down(offset,
+-				    MT7996_EEPROM_BLOCK_SIZE)),
+-	};
++	struct mt7996_mcu_eeprom_access req;
++	struct mt7996_mcu_eeprom_access_event *event;
+ 	struct sk_buff *skb;
+-	bool valid;
+-	int ret;
++	int ret, cmd;
+ 
+-	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
+-					MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL),
+-					&req, sizeof(req), true, &skb);
++	switch (mode) {
++	case EFUSE_MODE:
++		req.info.tag = cpu_to_le16(UNI_EFUSE_ACCESS);
++		req.info.len = cpu_to_le16(sizeof(req) - 4);
++		req.info.addr = cpu_to_le32(round_down(offset, MT7996_EEPROM_BLOCK_SIZE));
++		cmd = MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL);
++		break;
++	case EXT_EEPROM_MODE:
++		req.info.tag = cpu_to_le16(UNI_EXT_EEPROM_ACCESS);
++		req.info.len = cpu_to_le16(sizeof(req) - 4);
++		req.info.addr = cpu_to_le32(round_down(offset, MT7996_EXT_EEPROM_BLOCK_SIZE));
++		req.eeprom.ext_eeprom.data_len = cpu_to_le32(buf_len);
++		cmd = MCU_WM_UNI_CMD_QUERY(EXT_EEPROM_CTRL);
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	ret = mt76_mcu_send_and_get_msg(&dev->mt76, cmd, &req,
++					sizeof(req), true, &skb);
+ 	if (ret)
+ 		return ret;
+ 
+-	valid = le32_to_cpu(*(__le32 *)(skb->data + 16));
+-	if (valid) {
+-		u32 addr = le32_to_cpu(*(__le32 *)(skb->data + 12));
+-
+-		if (!buf)
+-			buf = (u8 *)dev->mt76.eeprom.data + addr;
++	event = (struct mt7996_mcu_eeprom_access_event *)skb->data;
++	if (event->valid) {
++		u32 addr = le32_to_cpu(event->addr);
++		u32 ret_len = le32_to_cpu(event->eeprom.ext_eeprom.data_len);
+ 
+-		if (!buf_len || buf_len > MT7996_EEPROM_BLOCK_SIZE)
+-			buf_len = MT7996_EEPROM_BLOCK_SIZE;
++		switch (mode) {
++		case EFUSE_MODE:
++			if (!buf)
++				buf = (u8 *)dev->mt76.eeprom.data + addr;
++			if (!buf_len || buf_len > MT7996_EEPROM_BLOCK_SIZE)
++				buf_len = MT7996_EEPROM_BLOCK_SIZE;
+ 
+-		skb_pull(skb, 48);
+-		memcpy(buf, skb->data, buf_len);
++			memcpy(buf, event->eeprom.efuse, buf_len);
++			break;
++		case EXT_EEPROM_MODE:
++			if (!buf)
++				buf = (u8 *)dev->mt76.ext_eeprom.data + addr;
++			if (!buf_len || buf_len > MT7996_EXT_EEPROM_BLOCK_SIZE)
++				buf_len = MT7996_EXT_EEPROM_BLOCK_SIZE;
++
++			memcpy(buf, event->eeprom.ext_eeprom.data,
++			       ret_len < buf_len ? ret_len : buf_len);
++			break;
++		default:
++			ret = -EINVAL;
++			break;
++		}
+ 	} else {
+ 		ret = -EINVAL;
+ 	}
+@@ -5359,7 +5387,57 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_l
+ 	return ret;
+ }
+ 
+-int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num)
++int
++mt7996_mcu_write_ext_eeprom(struct mt7996_dev *dev, u32 offset,
++			    u32 data_len, u8 *write_buf)
++{
++	struct mt7996_mcu_eeprom_access req = {
++		.info.tag = cpu_to_le16(UNI_EXT_EEPROM_ACCESS),
++		.info.len = cpu_to_le16(sizeof(req) - 4 +
++					MT7996_EXT_EEPROM_BLOCK_SIZE),
++	};
++	u32 block_num, block_size = MT7996_EXT_EEPROM_BLOCK_SIZE;
++	u8 *buf = write_buf;
++	int i, ret = -EINVAL;
++	int msg_len = sizeof(req) + block_size;
++
++	if (!mt7996_has_ext_eeprom(dev))
++		return ret;
++
++	if (!buf)
++		buf = (u8 *)dev->mt76.eeprom.data + offset;
++
++	block_num = DIV_ROUND_UP(data_len, block_size);
++	for (i = 0; i < block_num; i++) {
++		struct sk_buff *skb;
++		u32 buf_len = block_size;
++		u32 block_offs = i * block_size;
++
++		if (block_offs + block_size > data_len)
++			buf_len = data_len % block_size;
++
++		req.info.addr = cpu_to_le32(offset + block_offs);
++		req.eeprom.ext_eeprom.data_len = cpu_to_le32(buf_len);
++
++		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, msg_len);
++		if (!skb)
++			return -ENOMEM;
++
++		skb_put_data(skb, &req, sizeof(req));
++		skb_put_data(skb, buf, buf_len);
++
++		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
++					    MCU_WM_UNI_CMD(EXT_EEPROM_CTRL), false);
++		if (ret)
++			return ret;
++
++		buf += buf_len;
++	}
++
++	return 0;
++}
++
++int mt7996_mcu_get_efuse_free_block(struct mt7996_dev *dev, u8 *block_num)
+ {
+ 	struct {
+ 		u8 _rsv[4];
+diff --git a/mt7996/mcu.h b/mt7996/mcu.h
+index 33ba3774..f405b0cd 100644
+--- a/mt7996/mcu.h
++++ b/mt7996/mcu.h
+@@ -161,7 +161,7 @@ struct mt7996_mcu_background_chain_ctrl {
+ 	u8 rsv[2];
+ } __packed;
+ 
+-struct mt7996_mcu_eeprom {
++struct mt7996_mcu_eeprom_update {
+ 	u8 _rsv[4];
+ 
+ 	__le16 tag;
+@@ -171,6 +171,14 @@ struct mt7996_mcu_eeprom {
+ 	__le16 buf_len;
+ } __packed;
+ 
++union eeprom_data {
++	struct {
++		__le32 data_len;
++		DECLARE_FLEX_ARRAY(u8, data);
++	} ext_eeprom;
++	DECLARE_FLEX_ARRAY(u8, efuse);
++} __packed;
++
+ struct mt7996_mcu_eeprom_info {
+ 	u8 _rsv[4];
+ 
+@@ -178,7 +186,26 @@ struct mt7996_mcu_eeprom_info {
+ 	__le16 len;
+ 	__le32 addr;
+ 	__le32 valid;
+-	u8 data[MT7996_EEPROM_BLOCK_SIZE];
++} __packed;
++
++struct mt7996_mcu_eeprom_access {
++	struct mt7996_mcu_eeprom_info info;
++	union eeprom_data eeprom;
++} __packed;
++
++struct mt7996_mcu_eeprom_access_event {
++	u8 _rsv[4];
++
++	__le16 tag;
++	__le16 len;
++	__le32 version;
++	__le32 addr;
++	__le32 valid;
++	__le32 size;
++	__le32 magic_no;
++	__le32 type;
++	__le32 rsv[4];
++	union eeprom_data eeprom;
+ } __packed;
+ 
+ struct mt7996_mcu_phy_rx_info {
+@@ -1091,6 +1118,10 @@ enum {
+ 	UNI_EFUSE_PATCH,
+ };
+ 
++enum {
++	UNI_EXT_EEPROM_ACCESS = 1,
++};
++
+ enum {
+ 	UNI_VOW_DRR_CTRL,
+ 	UNI_VOW_FEATURE_CTRL,
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index b841cc2a..a0f2f251 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -74,7 +74,8 @@
+ #define MT7992_EEPROM_DEFAULT_24	"mediatek/mt7996/mt7992_eeprom_24_2i5i.bin"
+ 
+ #define MT7996_EEPROM_SIZE		7680
+-#define MT7996_EEPROM_BLOCK_SIZE	16
++#define MT7996_EEPROM_BLOCK_SIZE		16
++#define MT7996_EXT_EEPROM_BLOCK_SIZE	1024
+ #define MT7996_TOKEN_SIZE		16384
+ #define MT7996_HW_TOKEN_SIZE		8192
+ #define MT7996_SW_TOKEN_SIZE		15360
+@@ -171,6 +172,14 @@ enum mt7996_fem_type {
+ 	MT7996_FEM_MIX,
+ };
+ 
++enum mt7996_eeprom_mode {
++	DEFAULT_BIN_MODE,
++	EFUSE_MODE,
++	FLASH_MODE,
++	BIN_FILE_MODE,
++	EXT_EEPROM_MODE,
++};
++
+ enum mt7996_coredump_state {
+ 	MT7996_COREDUMP_IDLE = 0,
+ 	MT7996_COREDUMP_MANUAL_WA,
+@@ -973,6 +982,18 @@ mt7996_has_background_radar(struct mt7996_dev *dev)
+ 	return true;
+ }
+ 
++static inline bool
++mt7996_has_ext_eeprom(struct mt7996_dev *dev)
++{
++	switch (mt76_chip(&dev->mt76)) {
++	case 0x7990:
++		return false;
++	case 0x7992:
++	default:
++		return true;
++	}
++}
++
+ static inline struct mt7996_phy *
+ mt7996_band_phy(struct ieee80211_hw *hw, enum nl80211_band band)
+ {
+@@ -1154,8 +1175,11 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
+ 			       struct mt7996_link_sta *mlink, void *data,
+ 			       u32 field);
+ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev);
+-int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len);
+-int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num);
++int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len,
++			  enum mt7996_eeprom_mode mode);
++int mt7996_mcu_get_efuse_free_block(struct mt7996_dev *dev, u8 *block_num);
++int mt7996_mcu_write_ext_eeprom(struct mt7996_dev *dev, u32 offset,
++				u32 data_len, u8 *write_buf);
+ int mt7996_mcu_get_chip_config(struct mt7996_dev *dev, u32 *cap);
+ int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 set, u8 band);
+ int mt7996_mcu_set_txbf(struct mt7996_dev *dev, u8 action);
+diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
+index 5338d0bd..4996774f 100644
+--- a/mt7996/mtk_debugfs.c
++++ b/mt7996/mtk_debugfs.c
+@@ -2829,6 +2829,9 @@ static int mt7996_show_eeprom_mode(struct seq_file *s, void *data)
+ 	case BIN_FILE_MODE:
+ 		seq_printf(s, "   bin file mode\n   filename = %s\n", dev->mt76.bin_file_name);
+ 		break;
++	case EXT_EEPROM_MODE:
++		seq_printf(s, "   external eeprom mode\n");
++		break;
+ 	default:
+ 		break;
+ 	}
+diff --git a/mt7996/testmode.c b/mt7996/testmode.c
+index 1674e129..b3692637 100644
+--- a/mt7996/testmode.c
++++ b/mt7996/testmode.c
+@@ -2138,37 +2138,43 @@ mt7996_tm_write_back_to_efuse(struct mt7996_dev *dev)
+ {
+ 	struct mt7996_mcu_eeprom_info req = {
+ 		.tag = cpu_to_le16(UNI_EFUSE_ACCESS),
+-		.len = cpu_to_le16(sizeof(req) - 4),
++		.len = cpu_to_le16(sizeof(req) - 4 +
++				   MT76_TM_EEPROM_BLOCK_SIZE),
+ 	};
+ 	u8 read_buf[MT76_TM_EEPROM_BLOCK_SIZE], *eeprom = dev->mt76.eeprom.data;
++	int msg_len = sizeof(req) + MT76_TM_EEPROM_BLOCK_SIZE;
+ 	int i, ret = -EINVAL;
+ 
+ 	/* prevent from damaging chip id in efuse */
+ 	if (mt76_chip(&dev->mt76) != get_unaligned_le16(eeprom))
+-		goto out;
++		return ret;
+ 
+ 	for (i = 0; i < MT7996_EEPROM_SIZE; i += MT76_TM_EEPROM_BLOCK_SIZE) {
+-		req.addr = cpu_to_le32(i);
+-		memcpy(req.data, eeprom + i, MT76_TM_EEPROM_BLOCK_SIZE);
++		struct sk_buff *skb;
+ 
+-		ret = mt7996_mcu_get_eeprom(dev, i, read_buf, sizeof(read_buf));
+-		if (ret) {
+-			if (ret != -EINVAL)
+-				return ret;
+-
+-			memset(read_buf, 0, MT76_TM_EEPROM_BLOCK_SIZE);
+-		}
++		memset(read_buf, 0, MT76_TM_EEPROM_BLOCK_SIZE);
++		ret = mt7996_mcu_get_eeprom(dev, i, read_buf, sizeof(read_buf),
++					    EFUSE_MODE);
++		if (ret && ret != -EINVAL)
++			return ret;
+ 
+-		if (!memcmp(req.data, read_buf, MT76_TM_EEPROM_BLOCK_SIZE))
++		if (!memcmp(eeprom + i, read_buf, MT76_TM_EEPROM_BLOCK_SIZE))
+ 			continue;
+ 
+-		ret = mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(EFUSE_CTRL),
+-					&req, sizeof(req), true);
++		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, msg_len);
++		if (!skb)
++			return -ENOMEM;
++
++		req.addr = cpu_to_le32(i);
++		skb_put_data(skb, &req, sizeof(req));
++		skb_put_data(skb, eeprom + i, MT76_TM_EEPROM_BLOCK_SIZE);
++
++		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
++					    MCU_WM_UNI_CMD(EFUSE_CTRL), true);
+ 		if (ret)
+ 			return ret;
+ 	}
+ 
+-out:
+ 	return ret;
+ }
+ 
+@@ -2193,6 +2199,9 @@ mt7996_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
+ 	case MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE:
+ 		ret = mt7996_tm_write_back_to_efuse(dev);
+ 		break;
++	case MT76_TM_EEPROM_ACTION_WRITE_TO_EXT_EEPROM:
++		ret = mt7996_mcu_write_ext_eeprom(dev, 0, MT7996_EEPROM_SIZE, NULL);
++		break;
+ 	default:
+ 		break;
+ 	}
+diff --git a/testmode.h b/testmode.h
+index 44f9984c..8e751bbf 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -281,11 +281,13 @@ enum mt76_testmode_tx_mode {
+  *	eeprom data block
+  * @MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE: send updated eeprom data to fw
+  * @MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE: write eeprom data back to efuse
++ * @MT76_TM_EEPROM_ACTION_WRITE_TO_EXT_EEPROM: write eeprom data back to external eeprom
+  */
+ enum mt76_testmode_eeprom_action {
+ 	MT76_TM_EEPROM_ACTION_UPDATE_DATA,
+ 	MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE,
+ 	MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE,
++	MT76_TM_EEPROM_ACTION_WRITE_TO_EXT_EEPROM,
+ 
+ 	/* keep last */
+ 	NUM_MT76_TM_EEPROM_ACTION,
+-- 
+2.45.2
+
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0190-mtk-mt76-mt7996-add-efuse-write-protection.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0190-mtk-mt76-mt7996-add-efuse-write-protection.patch
new file mode 100644
index 0000000..72a2d92
--- /dev/null
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0190-mtk-mt76-mt7996-add-efuse-write-protection.patch
@@ -0,0 +1,271 @@
+From 617b4824df541129e545daa0015d43d2e625350b Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 29 Aug 2024 09:47:44 +0800
+Subject: [PATCH 190/223] mtk: mt76: mt7996: add efuse write protection
+
+Add efuse write protection in case that the user overwritten
+the FT value stored in efuse.
+Reference change list (Logan):
+https://gerrit.mediatek.inc/c/neptune/wlan_driver/logan/+/9473737
+https://gerrit.mediatek.inc/c/neptune/wlan_driver/logan/+/9497426
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Change-Id: If50d6965da8d9488d44c9da77a4bfca9906da9bc
+---
+ mt7996/mcu.c      |  11 +---
+ mt7996/mt7996.h   |  23 ++++++++
+ mt7996/testmode.c | 135 ++++++++++++++++++++++++++++++++++++++++++----
+ mt7996/testmode.h |   6 +++
+ 4 files changed, 157 insertions(+), 18 deletions(-)
+
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 01969464..b27b74d3 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -5115,13 +5115,6 @@ static int mt7996_mcu_set_cal_free_data(struct mt7996_dev *dev)
+ #define MT_EE_CAL_FREE_MAX_SIZE		30
+ #define MT_EE_7977BN_OFFSET		(0x1200 - 0x500)
+ #define MT_EE_END_OFFSET		0xffff
+-	enum adie_type {
+-		ADIE_7975,
+-		ADIE_7976,
+-		ADIE_7977,
+-		ADIE_7978,
+-		ADIE_7979,
+-	};
+ 	static const u16 adie_offs_list[][MT_EE_CAL_FREE_MAX_SIZE] = {
+ 		[ADIE_7975] = {0x5cd, 0x5cf, 0x5d1, 0x5d3, 0x6c0, 0x6c1, 0x6c2, 0x6c3,
+ 			       0x7a1, 0x7a6, 0x7a8, 0x7aa, -1},
+@@ -5151,10 +5144,10 @@ static int mt7996_mcu_set_cal_free_data(struct mt7996_dev *dev)
+ 			       0x127a, 0x127b, 0x127c, 0x127e, 0x1280, -1},
+ 	};
+ 	static const u16 adie_base_7996[] = {
+-		0x400, 0x1e00, 0x1200
++		EFUSE_BASE_OFFS_ADIE0, EFUSE_BASE_OFFS_ADIE1, EFUSE_BASE_OFFS_ADIE2
+ 	};
+ 	static const u16 adie_base_7992[] = {
+-		0x400, 0x1200, 0x0
++		EFUSE_BASE_OFFS_ADIE0, EFUSE_BASE_OFFS_ADIE1_7992, 0x0
+ 	};
+ 	static const u16 *adie_offs[__MT_MAX_BAND];
+ 	static const u16 *eep_offs[__MT_MAX_BAND];
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index a0f2f251..592b3673 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -180,6 +180,29 @@ enum mt7996_eeprom_mode {
+ 	EXT_EEPROM_MODE,
+ };
+ 
++enum mt7996_ddie_type {
++	DDIE_7996,
++	DDIE_7992,
++	DDIE_TYPE_NUM,
++};
++
++enum mt7996_adie_type {
++	ADIE_7975,
++	ADIE_7976,
++	ADIE_7977,
++	ADIE_7978,
++	ADIE_7979,
++	ADIE_TYPE_NUM,
++};
++
++enum mt7996_efuse_base_offs {
++	EFUSE_BASE_OFFS_DDIE = 0x0,
++	EFUSE_BASE_OFFS_ADIE0 = 0x400,
++	EFUSE_BASE_OFFS_ADIE2 = 0x1200,
++	EFUSE_BASE_OFFS_ADIE1_7992 = 0x1200,
++	EFUSE_BASE_OFFS_ADIE1 = 0x1e00,
++};
++
+ enum mt7996_coredump_state {
+ 	MT7996_COREDUMP_IDLE = 0,
+ 	MT7996_COREDUMP_MANUAL_WA,
+diff --git a/mt7996/testmode.c b/mt7996/testmode.c
+index b3692637..6f9900a6 100644
+--- a/mt7996/testmode.c
++++ b/mt7996/testmode.c
+@@ -2133,6 +2133,127 @@ mt7996_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+ 	return 0;
+ }
+ 
++static bool
++mt7996_tm_efuse_update_is_valid(struct mt7996_dev *dev, u32 offset, u8 *write_buf)
++{
++#define PROT_OFFS_MAX_SIZE	8
++#define EFUSE_PROT_END_OFFSET	0xffff
++#define EFUSE_PROT_ALL_MASK	GENMASK(15, 0)
++	static const struct efuse_region ddie_prot_offs[][PROT_OFFS_MAX_SIZE] = {
++		[DDIE_7996] = {{.start = 0x10, .end = 0x18f, .prot_mask = -1},
++			       {.start = 0x1b0, .end = 0x2bf, .prot_mask = -1},
++			       {.start = 0x2c0, .end = 0x2cf, .prot_mask = GENMASK(15, 6)},
++			       {.start = 0x2d0, .end = 0x2ff, .prot_mask = -1},
++			       {.start = 0x300, .end = 0x30f, .prot_mask = GENMASK(15, 1)},
++			       {.start = 0x310, .end = 0x31f, .prot_mask = GENMASK(15, 1)},
++			       {.start = 0x320, .end = 0x3ff, .prot_mask = -1},
++			       {.start = -1}},
++		[DDIE_7992] = {{.start = 0x10, .end = 0x18f, .prot_mask = -1},
++			       {.start = 0x1b0, .end = 0x3ff, .prot_mask = -1},
++			       {.start = -1}},
++	};
++	static const struct efuse_region adie_prot_offs[][PROT_OFFS_MAX_SIZE] = {
++		[ADIE_7975] = {{.start = 0x5c0, .end = 0x62f, .prot_mask = -1},
++			       {.start = 0x6c0, .end = 0x6ff, .prot_mask = -1},
++			       {.start = 0x7a0, .end = 0x7af, .prot_mask = BIT(1) | BIT(9)},
++			       {.start = 0x7b0, .end = 0x7bf, .prot_mask = -1},
++			       {.start = -1}},
++		[ADIE_7976] = {{.start = 0x0, .end = 0x7f, .prot_mask = -1},
++			       {.start = 0x790, .end = 0x79f,
++				.prot_mask = GENMASK(15, 10) | GENMASK(8, 0)},
++			       {.start = 0x7a0, .end = 0x7af,
++				.prot_mask = BIT(6) | BIT(8) | BIT(10)},
++			       {.start = 0x7b0, .end = 0x7bf, .prot_mask = -1},
++			       {.start = -1}},
++		[ADIE_7977] = {{.start = 0x0, .end = 0x5f, .prot_mask = -1},
++			       {.start = 0x60, .end = 0x6f, .prot_mask = GENMASK(14, 0)},
++			       {.start = 0x70, .end = 0x7f,
++				.prot_mask = GENMASK(15, 14) | GENMASK(12, 0)},
++			       {.start = 0x80, .end = 0x10f, .prot_mask = -1},
++			       {.start = -1}},
++	};
++	static const struct efuse_region *prot_offs;
++	u8 read_buf[MT76_TM_EEPROM_BLOCK_SIZE], *eeprom = dev->mt76.eeprom.data;
++	int ret, i = 0;
++	u16 base;
++
++	if (!write_buf)
++		return false;
++
++	memset(read_buf, 0, MT76_TM_EEPROM_BLOCK_SIZE);
++	ret = mt7996_mcu_get_eeprom(dev, offset, read_buf,
++				    MT76_TM_EEPROM_BLOCK_SIZE, EFUSE_MODE);
++	if (ret && ret != -EINVAL)
++		return false;
++
++	/* no change in this block, so skip it */
++	if (!memcmp(eeprom + offset, read_buf, MT76_TM_EEPROM_BLOCK_SIZE))
++		return false;
++
++	memcpy(write_buf, eeprom + offset, MT76_TM_EEPROM_BLOCK_SIZE);
++
++	switch (mt76_chip(&dev->mt76)) {
++	case 0x7990:
++		if (offset < EFUSE_BASE_OFFS_ADIE0) {
++			base = EFUSE_BASE_OFFS_DDIE;
++			prot_offs = ddie_prot_offs[DDIE_7996];
++		} else if (offset >= EFUSE_BASE_OFFS_ADIE0 &&
++			   offset < EFUSE_BASE_OFFS_ADIE2) {
++			base = EFUSE_BASE_OFFS_ADIE0;
++			if (dev->chip_sku == MT7996_VAR_TYPE_233 ||
++			    dev->fem_type == MT7996_FEM_EXT)
++				prot_offs = adie_prot_offs[ADIE_7976];
++			else
++				prot_offs = adie_prot_offs[ADIE_7975];
++		} else if (offset >= EFUSE_BASE_OFFS_ADIE2 &&
++			   offset < EFUSE_BASE_OFFS_ADIE1) {
++			base = EFUSE_BASE_OFFS_ADIE2;
++			prot_offs = adie_prot_offs[ADIE_7977];
++		} else {
++			base = EFUSE_BASE_OFFS_ADIE1;
++			prot_offs = adie_prot_offs[ADIE_7977];
++		}
++		break;
++	case 0x7992:
++		/* block all the adie region in efuse for kite */
++		if (offset >= EFUSE_BASE_OFFS_ADIE0)
++			return false;
++		base = EFUSE_BASE_OFFS_DDIE;
++		prot_offs = ddie_prot_offs[DDIE_7992];
++		break;
++	default:
++		return false;
++	}
++
++	/* check efuse protection */
++	while (prot_offs[i].start != EFUSE_PROT_END_OFFSET) {
++		if (offset >= prot_offs[i].start + base &&
++		    offset <= prot_offs[i].end + base) {
++			unsigned long prot_mask = prot_offs[i].prot_mask;
++			int j;
++
++			if (prot_mask == EFUSE_PROT_ALL_MASK)
++				return false;
++
++			for_each_set_bit(j, &prot_mask, MT76_TM_EEPROM_BLOCK_SIZE) {
++				if (write_buf[j] != read_buf[j]) {
++					write_buf[j] = read_buf[j];
++					dev_warn(dev->mt76.dev,
++						 "offset %x is invalid to write\n",
++						 offset + j);
++				}
++			}
++			break;
++		}
++		i++;
++	}
++
++	if (!memcmp(read_buf, write_buf, MT76_TM_EEPROM_BLOCK_SIZE))
++		return false;
++
++	return true;
++}
++
+ static int
+ mt7996_tm_write_back_to_efuse(struct mt7996_dev *dev)
+ {
+@@ -2141,8 +2262,9 @@ mt7996_tm_write_back_to_efuse(struct mt7996_dev *dev)
+ 		.len = cpu_to_le16(sizeof(req) - 4 +
+ 				   MT76_TM_EEPROM_BLOCK_SIZE),
+ 	};
+-	u8 read_buf[MT76_TM_EEPROM_BLOCK_SIZE], *eeprom = dev->mt76.eeprom.data;
+ 	int msg_len = sizeof(req) + MT76_TM_EEPROM_BLOCK_SIZE;
++	u8 *eeprom = dev->mt76.eeprom.data;
++	u8 write_buf[MT76_TM_EEPROM_BLOCK_SIZE];
+ 	int i, ret = -EINVAL;
+ 
+ 	/* prevent from damaging chip id in efuse */
+@@ -2152,13 +2274,8 @@ mt7996_tm_write_back_to_efuse(struct mt7996_dev *dev)
+ 	for (i = 0; i < MT7996_EEPROM_SIZE; i += MT76_TM_EEPROM_BLOCK_SIZE) {
+ 		struct sk_buff *skb;
+ 
+-		memset(read_buf, 0, MT76_TM_EEPROM_BLOCK_SIZE);
+-		ret = mt7996_mcu_get_eeprom(dev, i, read_buf, sizeof(read_buf),
+-					    EFUSE_MODE);
+-		if (ret && ret != -EINVAL)
+-			return ret;
+-
+-		if (!memcmp(eeprom + i, read_buf, MT76_TM_EEPROM_BLOCK_SIZE))
++		memset(write_buf, 0, MT76_TM_EEPROM_BLOCK_SIZE);
++		if (!mt7996_tm_efuse_update_is_valid(dev, i, write_buf))
+ 			continue;
+ 
+ 		skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, msg_len);
+@@ -2167,7 +2284,7 @@ mt7996_tm_write_back_to_efuse(struct mt7996_dev *dev)
+ 
+ 		req.addr = cpu_to_le32(i);
+ 		skb_put_data(skb, &req, sizeof(req));
+-		skb_put_data(skb, eeprom + i, MT76_TM_EEPROM_BLOCK_SIZE);
++		skb_put_data(skb, write_buf, MT76_TM_EEPROM_BLOCK_SIZE);
+ 
+ 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
+ 					    MCU_WM_UNI_CMD(EFUSE_CTRL), true);
+diff --git a/mt7996/testmode.h b/mt7996/testmode.h
+index 5c720da7..154392dc 100644
+--- a/mt7996/testmode.h
++++ b/mt7996/testmode.h
+@@ -363,4 +363,10 @@ struct mt7996_tm_rdd_ipi_ctrl {
+ 	__le32 tx_assert_time;		/* unit: us */
+ } __packed;
+ 
++struct efuse_region {
++	u16 start;
++	u16 end;
++	u16 prot_mask;
++};
++
+ #endif
+-- 
+2.45.2
+
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0191-mtk-mt76-mt7996-fix-the-capability-of-reception-of-E.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0191-mtk-mt76-mt7996-fix-the-capability-of-reception-of-E.patch
new file mode 100644
index 0000000..d5c42df
--- /dev/null
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0191-mtk-mt76-mt7996-fix-the-capability-of-reception-of-E.patch
@@ -0,0 +1,49 @@
+From eaaf030c560747704321c51c00e275da3d7a8217 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Tue, 3 Sep 2024 15:36:56 +0800
+Subject: [PATCH 191/223] mtk: mt76: mt7996: fix the capability of reception of
+ EHT MU PPDU
+
+This commit includes two changes. First, enable "EHT MU PPDU With 4x
+EHT-LTF And 0.8us GI" in EHT Phy capabilities element since hardware
+can support. Second, fix the value of "Maximum number of supported
+EHT LTFs" in the same element, where the previous setting of 3 in
+Bit 3-4 was incorrect.
+
+Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
+
+---
+ mt7996/init.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/mt7996/init.c b/mt7996/init.c
+index f739afd2..2db4b3b5 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -1636,21 +1636,20 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
+ 		IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK;
+ 
+ 	eht_cap_elem->phy_cap_info[4] =
++		IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
+ 		u8_encode_bits(min_t(int, sts - 1, 2),
+ 			       IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK);
+ 
+ 	eht_cap_elem->phy_cap_info[5] =
+ 		u8_encode_bits(IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_16US,
+ 			       IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK) |
+-		u8_encode_bits(u8_get_bits(0x11, GENMASK(1, 0)),
++		u8_encode_bits(u8_get_bits(1, GENMASK(1, 0)),
+ 			       IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK);
+ 
+ 	val = width == NL80211_CHAN_WIDTH_320 ? 0xf :
+ 	      width == NL80211_CHAN_WIDTH_160 ? 0x7 :
+ 	      width == NL80211_CHAN_WIDTH_80 ? 0x3 : 0x1;
+ 	eht_cap_elem->phy_cap_info[6] =
+-		u8_encode_bits(u8_get_bits(0x11, GENMASK(4, 2)),
+-			       IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK) |
+ 		u8_encode_bits(val, IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK);
+ 
+ 	val = u8_encode_bits(nss, IEEE80211_EHT_MCS_NSS_RX) |
+-- 
+2.45.2
+
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0192-mtk-mt76-mt7996-fix-HE-Phy-capability.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0192-mtk-mt76-mt7996-fix-HE-Phy-capability.patch
new file mode 100644
index 0000000..a9f0fad
--- /dev/null
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0192-mtk-mt76-mt7996-fix-HE-Phy-capability.patch
@@ -0,0 +1,41 @@
+From d46fc9a7335c94d5be16414e8898122d23c74b47 Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Wed, 4 Sep 2024 13:44:32 +0800
+Subject: [PATCH 192/223] mtk: mt76: mt7996: fix HE Phy capability
+
+Set HE SU PPDU And HE MU PPDU With 4x HE-LTF And 0.8 us GI within HE PHY
+Capabilities element as 1 since hardware can support.
+
+Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
+
+---
+ mt7996/init.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/mt7996/init.c b/mt7996/init.c
+index 2db4b3b5..6c8a9b48 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -1477,6 +1477,9 @@ mt7996_init_he_caps(struct mt7996_phy *phy, enum nl80211_band band,
+ 	he_cap_elem->phy_cap_info[2] = IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
+ 				       IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ;
+ 
++	he_cap_elem->phy_cap_info[7] =
++			IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI;
++
+ 	switch (iftype) {
+ 	case NL80211_IFTYPE_AP:
+ 		he_cap_elem->mac_cap_info[0] |= IEEE80211_HE_MAC_CAP0_TWT_RES;
+@@ -1516,8 +1519,7 @@ mt7996_init_he_caps(struct mt7996_phy *phy, enum nl80211_band band,
+ 			IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE |
+ 			IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT;
+ 		he_cap_elem->phy_cap_info[7] |=
+-			IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP |
+-			IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI;
++			IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP;
+ 		he_cap_elem->phy_cap_info[8] |=
+ 			IEEE80211_HE_PHY_CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G |
+ 			IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU |
+-- 
+2.45.2
+
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0193-mtk-mt76-mt7996-fix-potential-crash-issue-in-mt7996_.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0193-mtk-mt76-mt7996-fix-potential-crash-issue-in-mt7996_.patch
new file mode 100644
index 0000000..089bba0
--- /dev/null
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0193-mtk-mt76-mt7996-fix-potential-crash-issue-in-mt7996_.patch
@@ -0,0 +1,31 @@
+From e70e972add40eb5db6463cf156ae19b8dc9bc67c Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Thu, 5 Sep 2024 15:46:10 +0800
+Subject: [PATCH 193/223] mtk: mt76: mt7996: fix potential crash issue in
+ mt7996_tx_prepare_skb()
+
+This commit aims to fix potential NULL pointer issue of sta, especially
+when the sta keeps conencting and disconneting.
+
+Change-Id: I4407e2b39dd75f161c9cf4d93c652949ca9ddcf6
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7996/mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mt7996/mac.c b/mt7996/mac.c
+index 5d40b8f1..b6980584 100644
+--- a/mt7996/mac.c
++++ b/mt7996/mac.c
+@@ -947,7 +947,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	}
+ 
+ 	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mvif->sta;
+-	if (ieee80211_is_data_qos(hdr->frame_control) && sta->mlo) {
++	if ((is_8023 || ieee80211_is_data_qos(hdr->frame_control)) && sta && sta->mlo) {
+ 		if (unlikely(tx_info->skb->protocol == cpu_to_be16(ETH_P_PAE))) {
+ 			link_id = msta->pri_link;
+ 		} else {
+-- 
+2.45.2
+
diff --git a/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0194-mtk-mt76-mt7996-Fix-call-trace-happened-when-wed-att.patch b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0194-mtk-mt76-mt7996-Fix-call-trace-happened-when-wed-att.patch
new file mode 100644
index 0000000..3c5755d
--- /dev/null
+++ b/autobuild/autobuild_5.4_mac80211_release/mt7988_wifi7_mac80211_mlo/package/kernel/mt76/patches/0194-mtk-mt76-mt7996-Fix-call-trace-happened-when-wed-att.patch
@@ -0,0 +1,33 @@
+From eccfceec92bda3da9fa815c1ec55b1c74a0f3254 Mon Sep 17 00:00:00 2001
+From: Rex Lu <rex.lu@mediatek.com>
+Date: Fri, 6 Sep 2024 15:32:05 +0800
+Subject: [PATCH 194/223] mtk: mt76: mt7996: Fix call trace happened when wed
+ attach fail
+
+1. when we attech wed0 fail, we will not going to attach wed1
+
+Signed-off-by: Rex Lu <rex.lu@mediatek.com>
+---
+ mt7996/mmio.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/mt7996/mmio.c b/mt7996/mmio.c
+index c84c1bbb..8eff971d 100644
+--- a/mt7996/mmio.c
++++ b/mt7996/mmio.c
+@@ -449,8 +449,11 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
+ 		wed->wlan.reset_complete = mt76_wed_reset_complete;
+ 	}
+ 
+-	if (mtk_wed_device_attach(wed))
++	if (mtk_wed_device_attach(wed)) {
++		wed_enable = false;
++		dev->has_rro = false;
+ 		return 0;
++	}
+ 
+ 	*irq = wed->irq;
+ 	dev->mt76.dma_dev = wed->dev;
+-- 
+2.45.2
+