[rdkb][common][bsp][Refactor and sync wifi from openwrt]

[Description]
86825828 [MAC80211][misc][update mt7996 to 20230616 trunk FW]
deb5be37 [MAC80211][hnat][Revert Flowblock framework patch]
aa832cd1 [MAC80211][misc][correct feeds.conf.default-21.02]
94f66edf [MAC80211][hnat][Sync Flowblock framework to the OpenWRT_trunk_20230525]
ac633261 [MAC80211][misc][update autobuild folder for WiFi7]
c087498b [MAC80211][core][Add WFA TGac VHT-4.2.16h-DFS required patch to Wi-Fi 7 codebase]
619f5d08 [MAC80211][hostapd][update hostapd patches for WiFi 7]
aff83495 [MAC80211][core][update mac80211 patches for WiFi 7]
8aa09e02 [MAC80211][mt76][update mt76 patches for WiFi 7]
5d52889f [MAC80211][hostapd][Add HE capabilities check]
43d9a75b [MAC80211][core][Add sta-assisted DFS state update mechanism in eagle]
7b658b94 [MAC80211][Rebase Patches][Fix patch fail]
4fdaa231 [MAC80211][mt76][Fix connac2 testmode issues]
1a3ecccc [MAC80211][hostapd][Fix hostapd auto ht patch misplaced issue]

[Release-log]

Change-Id: I9901dada2bbc330f99bdd7c95b4dfed52802d57b
diff --git a/recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-additional-supports.patch b/recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-additional-supports.patch
index cbdece6..7902ebc 100644
--- a/recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-additional-supports.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1010-wifi-mt76-testmode-additional-supports.patch
@@ -1,32 +1,32 @@
-From 29deaa7cb606cf334238cb36d89891fa80bef0fc Mon Sep 17 00:00:00 2001
+From c311d022536c9c6be72f8e4a134f9dbaed13cd6d Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
-Subject: [PATCH 1010/1033] wifi: mt76: testmode: additional supports
+Subject: [PATCH 1010/1014] wifi: mt76: testmode: additional supports
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  dma.c             |    3 +-
  mac80211.c        |   12 +
- mt76.h            |  108 ++++-
+ mt76.h            |  108 +++-
  mt76_connac_mcu.c |    4 +
  mt76_connac_mcu.h |    2 +
  mt7915/eeprom.c   |    2 +-
  mt7915/init.c     |    2 +-
  mt7915/mac.c      |   39 +-
  mt7915/main.c     |    2 +-
- mt7915/mcu.c      |   19 +-
+ mt7915/mcu.c      |   22 +-
  mt7915/mcu.h      |   29 +-
  mt7915/mmio.c     |    2 +
  mt7915/mt7915.h   |   16 +-
  mt7915/regs.h     |    3 +
- mt7915/testmode.c | 1184 ++++++++++++++++++++++++++++++++++++++++++---
+ mt7915/testmode.c | 1221 ++++++++++++++++++++++++++++++++++++++++++---
  mt7915/testmode.h |  278 +++++++++++
- testmode.c        |  280 +++++++++--
+ testmode.c        |  282 +++++++++--
  testmode.h        |   75 +++
  tools/fields.c    |   84 +++-
  tx.c              |    3 +-
- 20 files changed, 1991 insertions(+), 156 deletions(-)
+ 20 files changed, 2023 insertions(+), 166 deletions(-)
 
 diff --git a/dma.c b/dma.c
 index c9d2671..fc92e39 100644
@@ -398,7 +398,7 @@
  		mvif->mt76.wmm_idx += 2;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 5a68bb7..e4ab3e0 100644
+index 5a68bb7..5cea513 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -387,6 +387,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -421,7 +421,17 @@
  	    !rxd->seq)
  		mt7915_mcu_rx_unsolicited_event(dev, skb);
  	else
-@@ -2781,21 +2787,21 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
+@@ -2713,7 +2719,8 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
+ 	}
+ #endif
+ 
+-	if (mt76_connac_spe_idx(phy->mt76->antenna_mask))
++	if (mt76_connac_spe_idx(phy->mt76->antenna_mask) &&
++	    !mt76_testmode_enabled(phy->mt76))
+ 		req.tx_path_num = fls(phy->mt76->antenna_mask);
+ 
+ 	if (dev->mt76.hw->conf.flags & IEEE80211_CONF_MONITOR)
+@@ -2781,21 +2788,21 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
  	return 0;
  }
  
@@ -446,7 +456,7 @@
  {
  	struct mt7915_mcu_eeprom_info req = {
  		.addr = cpu_to_le32(round_down(offset,
-@@ -2804,7 +2810,7 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
+@@ -2804,7 +2811,7 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
  	struct mt7915_mcu_eeprom_info *res;
  	struct sk_buff *skb;
  	int ret;
@@ -455,7 +465,7 @@
  
  	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
  					MCU_EXT_QUERY(EFUSE_ACCESS),
-@@ -2813,8 +2819,11 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
+@@ -2813,8 +2820,11 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
  		return ret;
  
  	res = (struct mt7915_mcu_eeprom_info *)skb->data;
@@ -595,7 +605,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index e7bc181..0339d4b 100644
+index e7bc181..b6f36f5 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -62,6 +62,7 @@ enum offs_rev {
@@ -611,12 +621,12 @@
  #define MT_WF_AGG(_band, ofs)		(MT_WF_AGG_BASE(_band) + (ofs))
  
 +#define MT_AGG_AALCR0(_band, _n)	MT_WF_AGG(_band, (__OFFS(AGG_AALCR0) +	\
-+			                                  (_n) * 4))
++							  (_n) * 4))
  #define MT_AGG_AWSCR0(_band, _n)	MT_WF_AGG(_band, (__OFFS(AGG_AWSCR0) +	\
  							  (_n) * 4))
  #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 4693919..c44f13f 100644
+index 4693919..62ef4db 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -9,6 +9,9 @@
@@ -639,7 +649,7 @@
  };
  
  struct reg_band {
-@@ -33,6 +39,38 @@ struct reg_band {
+@@ -33,6 +39,57 @@ struct reg_band {
  #define TM_REG_MAX_ID	20
  static struct reg_band reg_backup_list[TM_REG_MAX_ID];
  
@@ -664,6 +674,25 @@
 +	return width_to_bw[width];
 +}
 +
++static int
++mt7915_tm_check_antenna(struct mt7915_phy *phy)
++{
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7915_dev *dev = phy->dev;
++	u8 band_idx = phy->mt76->band_idx;
++	u32 chainmask = phy->mt76->chainmask;
++
++	chainmask = chainmask >> (dev->chainshift * band_idx);
++	if (td->tx_antenna_mask & ~chainmask) {
++		dev_err(dev->mt76.dev,
++			"tx antenna mask %d exceeds hardware limitation (chainmask %d)\n",
++			td->tx_antenna_mask, chainmask);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
 +static void
 +mt7915_tm_update_channel(struct mt7915_phy *phy)
 +{
@@ -678,7 +707,7 @@
  
  static int
  mt7915_tm_set_tx_power(struct mt7915_phy *phy)
-@@ -119,18 +157,28 @@ mt7915_tm_set_trx(struct mt7915_phy *phy, int type, bool en)
+@@ -119,18 +176,28 @@ mt7915_tm_set_trx(struct mt7915_phy *phy, int type, bool en)
  }
  
  static int
@@ -711,7 +740,7 @@
  }
  
  static int
-@@ -141,7 +189,7 @@ mt7915_tm_set_phy_count(struct mt7915_phy *phy, u8 control)
+@@ -141,7 +208,7 @@ mt7915_tm_set_phy_count(struct mt7915_phy *phy, u8 control)
  		.testmode_en = 1,
  		.param_idx = MCU_ATE_SET_PHY_COUNT,
  		.param.cfg.enable = control,
@@ -720,7 +749,7 @@
  	};
  
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
-@@ -182,12 +230,738 @@ mt7915_tm_set_tam_arb(struct mt7915_phy *phy, bool enable, bool mu)
+@@ -182,12 +249,738 @@ mt7915_tm_set_tam_arb(struct mt7915_phy *phy, bool enable, bool mu)
  	return mt7915_mcu_set_muru_ctrl(dev, MURU_SET_ARB_OP_MODE, op_mode);
  }
  
@@ -1461,7 +1490,7 @@
  	struct edca *e = &req.edca[0];
  
  	e->queue = qid + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
-@@ -263,7 +1037,8 @@ done:
+@@ -263,7 +1056,8 @@ done:
  
  	return mt7915_tm_set_wmm_qid(phy,
  				     mt76_connac_lmac_mapping(IEEE80211_AC_BE),
@@ -1471,7 +1500,7 @@
  }
  
  static int
-@@ -339,7 +1114,7 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
+@@ -339,7 +1133,7 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
  	bitrate = cfg80211_calculate_bitrate(&rate);
  	tx_len = bitrate * tx_time / 10 / 8;
  
@@ -1480,7 +1509,7 @@
  	if (ret)
  		return ret;
  
-@@ -458,64 +1233,227 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+@@ -458,64 +1252,227 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
  
  	phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
  
@@ -1580,7 +1609,7 @@
 +	comm->spe_idx = phy->test.spe_idx;
 +
 +	dl->bw = mt7915_tm_chan_bw(chandef->width);
-+	dl->gi = td->tx_rate_sgi;;
++	dl->gi = td->tx_rate_sgi;
 +	dl->ltf = td->tx_ltf;
 +	dl->tx_mode = MT_PHY_TYPE_HE_MU;
 +
@@ -1739,7 +1768,7 @@
  
  	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
  }
-@@ -544,10 +1482,6 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
+@@ -544,10 +1501,6 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
  		return ret;
  
  	rs_band = (struct mt7915_tm_rx_stat_band *)skb->data;
@@ -1750,7 +1779,7 @@
  
  	if (!clear) {
  		enum mt76_rxq_id q = req.band ? MT_RXQ_BAND1 : MT_RXQ_MAIN;
-@@ -562,13 +1496,61 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
+@@ -562,13 +1515,61 @@ mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
  	return 0;
  }
  
@@ -1813,7 +1842,7 @@
  
  		/* read-clear */
  		mt7915_tm_get_rx_stats(phy, true);
-@@ -576,9 +1558,12 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+@@ -576,9 +1577,12 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
  		/* clear fw count */
  		mt7915_tm_set_phy_count(phy, 0);
  		mt7915_tm_set_phy_count(phy, 1);
@@ -1828,7 +1857,7 @@
  }
  
  static int
-@@ -617,34 +1602,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
+@@ -617,34 +1621,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
  	tx_cont->tx_ant = td->tx_antenna_mask;
  	tx_cont->band = band;
  
@@ -1864,7 +1893,7 @@
  
  	if (!en) {
  		req.op.rf.param.func_data = cpu_to_le32(band);
-@@ -728,6 +1686,12 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+@@ -728,6 +1705,12 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  		mt7915_tm_set_freq_offset(phy, en, en ? td->freq_offset : 0);
  	if (changed & BIT(TM_CHANGED_TXPOWER))
  		mt7915_tm_set_tx_power(phy);
@@ -1877,7 +1906,7 @@
  }
  
  static int
-@@ -737,6 +1701,11 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+@@ -737,6 +1720,11 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
  	struct mt7915_phy *phy = mphy->priv;
  	enum mt76_testmode_state prev_state = td->state;
  
@@ -1889,7 +1918,53 @@
  	mphy->test.state = state;
  
  	if (prev_state == MT76_TM_STATE_TX_FRAMES ||
-@@ -807,6 +1776,7 @@ static int
+@@ -757,7 +1745,7 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+ 	    (state == MT76_TM_STATE_OFF &&
+ 	     prev_state == MT76_TM_STATE_IDLE)) {
+ 		u32 changed = 0;
+-		int i;
++		int i, ret;
+ 
+ 		for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
+ 			u16 cur = tm_change_map[i];
+@@ -766,6 +1754,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+ 				changed |= BIT(i);
+ 		}
+ 
++		ret = mt7915_tm_check_antenna(phy);
++		if (ret)
++			return ret;
++
+ 		mt7915_tm_update_params(phy, changed);
+ 	}
+ 
+@@ -778,10 +1770,8 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
+ {
+ 	struct mt76_testmode_data *td = &mphy->test;
+ 	struct mt7915_phy *phy = mphy->priv;
+-	struct mt7915_dev *dev = phy->dev;
+-	u32 chainmask = mphy->chainmask, changed = 0;
+-	bool ext_phy = phy != &dev->phy;
+-	int i;
++	u32 changed = 0;
++	int i, ret;
+ 
+ 	BUILD_BUG_ON(NUM_TM_CHANGED >= 32);
+ 
+@@ -789,9 +1779,9 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
+ 	    td->state == MT76_TM_STATE_OFF)
+ 		return 0;
+ 
+-	chainmask = ext_phy ? chainmask >> dev->chainshift : chainmask;
+-	if (td->tx_antenna_mask > chainmask)
+-		return -EINVAL;
++	ret = mt7915_tm_check_antenna(phy);
++	if (ret)
++		return ret;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
+ 		if (tb[tm_change_map[i]])
+@@ -807,6 +1797,7 @@ static int
  mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  {
  	struct mt7915_phy *phy = mphy->priv;
@@ -1897,7 +1972,7 @@
  	void *rx, *rssi;
  	int i;
  
-@@ -852,11 +1822,75 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+@@ -852,11 +1843,75 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  
  	nla_nest_end(msg, rx);
  
@@ -1974,7 +2049,7 @@
 +	.set_eeprom = mt7915_tm_set_eeprom,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index a1c54c8..01b08e9 100644
+index a1c54c8..eb0e043 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -4,6 +4,8 @@
@@ -2121,12 +2196,12 @@
 +/* Common Config */
 +/* #define MURU_COMM_PPDU_FMT		BIT(0) */
 +/* #define MURU_COMM_SCH_TYPE		BIT(1) */
-+/* #define MURU_COMM_BAND			BIT(2) */
-+/* #define MURU_COMM_WMM			BIT(3) */
++/* #define MURU_COMM_BAND		BIT(2) */
++/* #define MURU_COMM_WMM		BIT(3) */
 +/* #define MURU_COMM_SPE_IDX		BIT(4) */
 +/* #define MURU_COMM_PROC_TYPE		BIT(5) */
 +/* #define MURU_COMM_SET		(MURU_COMM_PPDU_FMT | MURU_COMM_BAND | \ */
-+/* 				 MURU_COMM_WMM | MURU_COMM_SPE_IDX) */
++/*					 MURU_COMM_WMM | MURU_COMM_SPE_IDX) */
 +/* DL Config */
 +#define MURU_DL_BW			BIT(0)
 +#define MURU_DL_GI			BIT(1)
@@ -2289,7 +2364,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 1d0d5d3..fd3b9b2 100644
+index 1d0d5d3..97f65fd 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -27,28 +27,16 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -2340,8 +2415,8 @@
  		td->tx_queued++;
 +
 +		if (td->tx_rate_mode != MT76_TM_TX_MODE_HE_MU)
-+		    if (td->tx_queued - td->tx_done >= limit)
-+			    break;
++			if (td->tx_queued - td->tx_done >= limit)
++				break;
  	}
  
  	dev->queue_ops->kick(dev, q);
@@ -2368,7 +2443,7 @@
 +		q = phy->q_tx[qid];
 +		spin_lock_bh(&q->lock);
 +		mt76_testmode_queue_tx(phy, &phy->dev->global_wcid,
-+				td->tx_skb, q, qid, tx_queued_limit);
++				       td->tx_skb, q, qid, tx_queued_limit);
 +		spin_unlock_bh(&q->lock);
 +
 +		return;
@@ -2387,7 +2462,7 @@
 +
 +	mt76_testmode_queue_tx(phy, td->cur_entry, ed->tx_skb, q, qid, tx_queued_limit);
 +
-+	if (td->tx_pending % td->tx_count == 0 || is_mu)
++	if ((td->tx_count != UINT_MAX && td->tx_pending % td->tx_count == 0) || is_mu)
 +		td->cur_entry = list_next_entry(td->cur_entry, list);
  
  	spin_unlock_bh(&q->lock);
@@ -2686,7 +2761,7 @@
 +
 +		if (!tb[MT76_TM_ATTR_TXBF_PARAM] ||
 +		    mt76_tm_get_u8(tb[MT76_TM_ATTR_TXBF_ACT], &td->txbf_act,
-+		    0, MT76_TM_TXBF_ACT_MAX))
++				   0, MT76_TM_TXBF_ACT_MAX))
 +			goto out;
 +
 +		memset(td->txbf_param, 0, sizeof(td->txbf_param));
@@ -2743,10 +2818,14 @@
  	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_STBC, td->tx_rate_stbc) ||
  	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_LTF) &&
  	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
-@@ -643,6 +824,15 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
- 	     nla_put_u8(msg, MT76_TM_ATTR_FREQ_OFFSET, td->freq_offset)))
- 		goto out;
- 
+@@ -640,7 +821,16 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ 	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_POWER_CONTROL) &&
+ 	     nla_put_u8(msg, MT76_TM_ATTR_TX_POWER_CONTROL, td->tx_power_control)) ||
+ 	    (mt76_testmode_param_present(td, MT76_TM_ATTR_FREQ_OFFSET) &&
+-	     nla_put_u8(msg, MT76_TM_ATTR_FREQ_OFFSET, td->freq_offset)))
++	     nla_put_u32(msg, MT76_TM_ATTR_FREQ_OFFSET, td->freq_offset)))
++		goto out;
++
 +	if (nla_put_u32(msg, MT76_TM_ATTR_TX_LENGTH, ed->tx_mpdu_len) ||
 +	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_NSS, ed->tx_rate_nss) ||
 +	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_IDX, ed->tx_rate_idx) ||
@@ -2754,13 +2833,11 @@
 +	    nla_put_u8(msg, MT76_TM_ATTR_AID, ed->aid) ||
 +	    nla_put_u8(msg, MT76_TM_ATTR_RU_ALLOC, ed->ru_alloc) ||
 +	    nla_put_u8(msg, MT76_TM_ATTR_RU_IDX, ed->ru_idx))
-+		goto out;
-+
+ 		goto out;
+ 
  	if (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_POWER)) {
- 		a = nla_nest_start(msg, MT76_TM_ATTR_TX_POWER);
- 		if (!a)
 diff --git a/testmode.h b/testmode.h
-index 8961326..57949f2 100644
+index 8961326..8c55fa0 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -6,6 +6,8 @@
@@ -2778,10 +2855,10 @@
   * @MT76_TM_ATTR_MAC_ADDRS: array of nested MAC addresses (nested)
 + *
 + * @MT76_TM_ATTR_EEPROM_ACTION: eeprom setting actions
-+ * 	(u8, see &enum mt76_testmode_eeprom_action)
++ *	(u8, see &enum mt76_testmode_eeprom_action)
 + * @MT76_TM_ATTR_EEPROM_OFFSET: offset of eeprom data block for writing (u32)
 + * @MT76_TM_ATTR_EEPROM_VAL: values for writing into a 16-byte data block
-+ * 	(nested, u8 attrs)
++ *	(nested, u8 attrs)
 + *
 + * @MT76_TM_ATTR_CFG: config testmode rf feature (nested, see &mt76_testmode_cfg)
 + *
@@ -2814,7 +2891,7 @@
 + * enum mt76_testmode_eeprom_action - eeprom setting actions
 + *
 + * @MT76_TM_EEPROM_ACTION_UPDATE_DATA: update rf values to specific
-+ * 	eeprom data block
++ *	eeprom data block
 + * @MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE: send updated eeprom data to fw
 + * @MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE: write eeprom data back to efuse
 + */
@@ -2832,7 +2909,7 @@
 + * enum mt76_testmode_cfg - packet tx phy mode
 + *
 + * @MT76_TM_EEPROM_ACTION_UPDATE_DATA: update rf values to specific
-+ * 	eeprom data block
++ *	eeprom data block
 + * @MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE: send updated eeprom data to fw
 + * @MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE: write eeprom data back to efuse
 + */
diff --git a/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-pre-cal-support.patch b/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-pre-cal-support.patch
index ac7b121..82e8e7d 100644
--- a/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-pre-cal-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1011-wifi-mt76-testmode-add-pre-cal-support.patch
@@ -1,10 +1,9 @@
-From 0b10a07db9b3c9dd93861d71da449c521e228b3e Mon Sep 17 00:00:00 2001
+From b933c76718db1c21ecaaf0cddfa4d598617153ea Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 31 Aug 2022 20:06:52 +0800
-Subject: [PATCH 1011/1033] wifi: mt76: testmode: add pre-cal support
+Subject: [PATCH 1011/1014] wifi: mt76: testmode: add pre-cal support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Change-Id: Ibfbbc3443de994eeb4daa5e364b0a90f5d7d3bcd
 ---
  eeprom.c          |   6 +-
  mt76.h            |   1 +
@@ -114,7 +113,7 @@
  
  #endif
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index e4ab3e0..abb54eb 100644
+index 5cea513..2a515e3 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -391,6 +391,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -127,7 +126,7 @@
  #endif
  	default:
  		break;
-@@ -2887,7 +2890,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
+@@ -2888,7 +2891,7 @@ int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
  	u32 total = MT_EE_CAL_GROUP_SIZE;
  
@@ -136,7 +135,7 @@
  		return 0;
  
  	/*
-@@ -2967,11 +2970,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -2968,11 +2971,29 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  {
  	struct mt7915_dev *dev = phy->dev;
  	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
@@ -192,7 +191,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index c44f13f..146c4d3 100644
+index 62ef4db..b2d26ff 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -5,6 +5,7 @@
@@ -203,7 +202,7 @@
  
  enum {
  	TM_CHANGED_TXPOWER,
-@@ -1580,18 +1581,16 @@ mt7915_tm_rf_switch_mode(struct mt7915_dev *dev, u32 oper)
+@@ -1599,18 +1600,16 @@ mt7915_tm_rf_switch_mode(struct mt7915_dev *dev, u32 oper)
  static int
  mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
  {
@@ -224,7 +223,7 @@
  		.icap_len = 120,
  		.op.rf.func_idx = cpu_to_le32(func_idx),
  	};
-@@ -1676,6 +1675,316 @@ out:
+@@ -1695,6 +1694,316 @@ out:
  				 sizeof(req), true);
  }
  
@@ -541,7 +540,7 @@
  static void
  mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  {
-@@ -1720,6 +2029,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
+@@ -1739,6 +2048,10 @@ mt7915_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
  	else if (prev_state == MT76_TM_STATE_OFF ||
  		 state == MT76_TM_STATE_OFF)
  		mt7915_tm_init(phy, !(state == MT76_TM_STATE_OFF));
@@ -552,7 +551,7 @@
  
  	if ((state == MT76_TM_STATE_IDLE &&
  	     prev_state == MT76_TM_STATE_OFF) ||
-@@ -1888,9 +2201,113 @@ mt7915_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
+@@ -1909,9 +2222,113 @@ mt7915_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
  	return ret;
  }
  
@@ -667,7 +666,7 @@
 +	.dump_precal = mt7915_tm_dump_precal,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 01b08e9..d500987 100644
+index eb0e043..7569826 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -81,6 +81,11 @@ struct tm_tx_cont {
@@ -735,7 +734,7 @@
  	TAM_ARB_OP_MODE_NORMAL = 1,
  	TAM_ARB_OP_MODE_TEST,
 diff --git a/testmode.c b/testmode.c
-index fd3b9b2..b5a919a 100644
+index 97f65fd..21362bd 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -766,6 +766,18 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
@@ -768,7 +767,7 @@
  
  	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
 diff --git a/testmode.h b/testmode.h
-index 57949f2..34936e5 100644
+index 8c55fa0..109a556 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -19,6 +19,7 @@
diff --git a/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-iBF-command-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-iBF-command-mode-support.patch
index 5a4d921..fb2113a 100644
--- a/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-iBF-command-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1012-wifi-mt76-testmode-add-iBF-command-mode-support.patch
@@ -1,10 +1,9 @@
-From 5537367425c0e52ce5da53612e4aaa1bc756c39f Mon Sep 17 00:00:00 2001
+From e44d59d15e90c11b1466b12ac9401922c11504f6 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 12 Sep 2022 18:16:54 +0800
-Subject: [PATCH 1012/1033] wifi: mt76: testmode: add iBF command mode support
+Subject: [PATCH 1012/1014] wifi: mt76: testmode: add iBF command mode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
-Change-Id: I7eea1d6412563f889e5774e787e58ce9eba001bd
 ---
  mt7915/testmode.c | 21 ++++++++++++++-------
  testmode.c        | 41 +++++++++++++++++++++++++++++++++++++++++
@@ -13,10 +12,10 @@
  4 files changed, 85 insertions(+), 7 deletions(-)
 
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 146c4d3..6a18cdb 100644
+index b2d26ff..40a3a06 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
-@@ -701,6 +701,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+@@ -720,6 +720,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
  	struct ieee80211_vif *vif = phy->monitor_vif;
  	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
  	u8 pfmu_idx = val[0], nc = val[2], nr;
@@ -24,7 +23,7 @@
  	int ret;
  
  	if (td->tx_antenna_mask == 3)
-@@ -748,7 +749,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+@@ -767,7 +768,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
  	if (ret)
  		return ret;
  
@@ -33,7 +32,7 @@
  		return mt7915_tm_txbf_apply_tx(phy, 1, false, true, true);
  
  	return 0;
-@@ -775,7 +776,7 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
+@@ -794,7 +795,7 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
  		.group_l_m_n = val[1],
  		.sx2 = val[2],
  		.cal_type = val[3],
@@ -42,7 +41,7 @@
  	};
  	struct mt7915_tm_txbf_phase *phase =
  		(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
-@@ -814,6 +815,8 @@ int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -833,6 +834,8 @@ int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb)
  			phase = &phase[cal->group];
  			memcpy(&phase->phase, cal->buf + 16, sizeof(phase->phase));
  			phase->status = cal->status;
@@ -51,7 +50,7 @@
  			break;
  		case IBF_PHASE_CAL_VERIFY:
  		case IBF_PHASE_CAL_VERIFY_INSTRUMENT:
-@@ -865,7 +868,6 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+@@ -884,7 +887,6 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
  	pfmu_data->phi11 = cpu_to_le16(phi11);
  	pfmu_data->phi21 = cpu_to_le16(phi21);
  	pfmu_data->phi31 = cpu_to_le16(phi31);
@@ -59,7 +58,7 @@
  	if (subc_id == 63) {
  		struct mt7915_dev *dev = phy->dev;
  		struct {
-@@ -923,8 +925,8 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
+@@ -942,8 +944,8 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
  	struct mt76_testmode_data *td = &phy->mt76->test;
  	u16 *val = td->txbf_param;
  
@@ -70,7 +69,7 @@
  
  	switch (td->txbf_act) {
  	case MT76_TM_TXBF_ACT_INIT:
-@@ -942,10 +944,17 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
+@@ -961,10 +963,17 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
  		return mt7915_tm_txbf_profile_update(phy, val, true);
  	case MT76_TM_TXBF_ACT_PHASE_CAL:
  		return mt7915_tm_txbf_phase_cal(phy, val);
@@ -88,7 +87,7 @@
  	default:
  		break;
  	};
-@@ -1072,7 +1081,6 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
+@@ -1091,7 +1100,6 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
  		rate.legacy = sband->bitrates[rate.mcs].bitrate;
  		break;
  	case MT76_TM_TX_MODE_HT:
@@ -96,7 +95,7 @@
  		flags |= RATE_INFO_FLAGS_MCS;
  
  		if (td->tx_rate_sgi)
-@@ -1437,7 +1445,6 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+@@ -1456,7 +1464,6 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
  			if (duty_cycle < 100)
  				tx_time = duty_cycle * ipg / (100 - duty_cycle);
  		}
@@ -105,7 +104,7 @@
  		mt7915_tm_set_tx_len(phy, tx_time);
  
 diff --git a/testmode.c b/testmode.c
-index b5a919a..f1982ac 100644
+index 21362bd..39cacb2 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -533,6 +533,42 @@ out:
@@ -152,7 +151,7 @@
  		      void *data, int len)
  {
 @@ -671,6 +707,11 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 		    0, MT76_TM_TXBF_ACT_MAX))
+ 				   0, MT76_TM_TXBF_ACT_MAX))
  			goto out;
  
 +		if (td->txbf_act == MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD) {
@@ -164,7 +163,7 @@
  		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
  			if (nla_len(cur) != 2 ||
 diff --git a/testmode.h b/testmode.h
-index 34936e5..bbfb313 100644
+index 109a556..d2675dd 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -281,8 +281,10 @@ enum mt76_testmode_txbf_act {
diff --git a/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch b/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch
index 164b46a..f920fd6 100644
--- a/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1013-wifi-mt76-testmode-add-ZWDFS-test-mode-support.patch
@@ -1,22 +1,21 @@
-From 32e4319f0e34cb0a1ebb2dbb45c6561a96196a52 Mon Sep 17 00:00:00 2001
+From ee654a359005c8f5e48cc34a42dc76a6550d7e7f Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 27 Oct 2022 17:42:07 +0800
-Subject: [PATCH 1013/1033] wifi: mt76: testmode: add ZWDFS test mode support
+Subject: [PATCH 1013/1014] wifi: mt76: testmode: add ZWDFS test mode support
 
-Change-Id: I14d104b7158a35acf6b0595357d07fb87f5a9d94
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
  mt76.h            |   9 ++
  mt76_connac_mcu.h |   2 +
- mt7915/mcu.c      |  66 +++++++++++++
- mt7915/mcu.h      |  46 +++++++++
+ mt7915/mcu.c      |  66 +++++++++++
+ mt7915/mcu.h      |  46 ++++++++
  mt7915/mt7915.h   |   4 +
  mt7915/regs.h     |   2 +
- mt7915/testmode.c | 232 ++++++++++++++++++++++++++++++++++++++++++++++
- testmode.c        |  25 ++++-
- testmode.h        |  45 +++++++++
- tools/fields.c    |  22 +++++
- 10 files changed, 452 insertions(+), 1 deletion(-)
+ mt7915/testmode.c | 288 ++++++++++++++++++++++++++++++++++++++++++++++
+ testmode.c        |  25 +++-
+ testmode.h        |  45 ++++++++
+ tools/fields.c    |  22 ++++
+ 10 files changed, 508 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
 index c632852..f4412a2 100644
@@ -59,7 +58,7 @@
  
  enum {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index abb54eb..2432e57 100644
+index 2a515e3..cb70af5 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2619,6 +2619,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
@@ -70,7 +69,7 @@
  		req.band_idx = phy->mt76->band_idx;
  		req.scan_mode = 2;
  		break;
-@@ -4601,3 +4602,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
+@@ -4602,3 +4603,68 @@ int mt7915_mcu_set_amsdu_algo(struct mt7915_dev *dev, u16 wcid, u8 enable)
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MEC_CTRL), &req, sizeof(req), true);
  }
  #endif
@@ -219,7 +218,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 0339d4b..0798b08 100644
+index b6f36f5..a7e8598 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -1205,6 +1205,8 @@ enum offs_rev {
@@ -232,7 +231,7 @@
  #define MT_WF_PHY_BASE			0x83080000
  #define MT_WF_PHY(ofs)			(MT_WF_PHY_BASE + (ofs))
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 6a18cdb..09b0e98 100644
+index 40a3a06..b98aaaa 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -13,6 +13,12 @@ enum {
@@ -261,12 +260,53 @@
  };
  
  struct reg_band {
-@@ -962,6 +974,216 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
+@@ -981,6 +993,272 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
  	return 0;
  }
  
++static u8
++mt7915_tm_get_center_chan(struct mt7915_phy *phy, struct cfg80211_chan_def *chandef,
++			  int width_mhz)
++{
++	struct mt76_phy *mphy = phy->mt76;
++	const struct ieee80211_channel *chan = mphy->sband_5g.sband.channels;
++	u32 bitmap, i, offset, size = 32;
++	u16 first_control = 0, control_chan = chandef->chan->hw_value;
++	static const u32 width_to_bitmap[] = {
++		[NL80211_CHAN_WIDTH_20_NOHT] = 0x0,
++		[NL80211_CHAN_WIDTH_20] = 0x0,
++		[NL80211_CHAN_WIDTH_40] = 0x55554055,
++		[NL80211_CHAN_WIDTH_80] = 0x44444011,
++		[NL80211_CHAN_WIDTH_80P80] = 0x0,
++		[NL80211_CHAN_WIDTH_160] = 0x04004001,
++	};
++
++	bitmap = width_to_bitmap[chandef->width];
++	if (!bitmap)
++		return control_chan;
++
++	offset = width_mhz / 10 - 2;
++	for (i = 0; i < size; i++) {
++		if (!((1 << i) & bitmap))
++			continue;
++
++		if (control_chan >= chan[i].hw_value)
++			first_control = chan[i].hw_value;
++		else
++			break;
++	}
++
++	if (chandef->width == NL80211_CHAN_WIDTH_40 &&
++	    control_chan >= chan[size].hw_value)
++		return chan[size].hw_value + offset;
++	else if (first_control == 0)
++		return control_chan;
++
++	return first_control + offset;
++}
++
 +static int
-+mt7915_tm_set_offchan(struct mt7915_phy *phy)
++mt7915_tm_set_offchan(struct mt7915_phy *phy, bool no_center)
 +{
 +	struct mt76_phy *mphy = phy->mt76;
 +	struct mt7915_dev *dev = phy->dev;
@@ -293,10 +333,24 @@
 +
 +	chandef.width = td->offchan_bw;
 +	width_mhz = bw_to_mhz[chandef.width];
-+	chandef.center_freq1 = freq;
 +	chan = ieee80211_get_channel(hw->wiphy, freq);
++	if (!chan) {
++		ret = -EINVAL;
++		dev_info(dev->mt76.dev, "Failed to set offchan (invalid control channel)!\n");
++		goto out;
++	}
 +	chandef.chan = chan;
 +
++	if (no_center)
++		td->offchan_center_ch = mt7915_tm_get_center_chan(phy, &chandef, width_mhz);
++	chandef.center_freq1 = ieee80211_channel_to_frequency(td->offchan_center_ch,
++							      NL80211_BAND_5GHZ);
++	if (!cfg80211_chandef_valid(&chandef)) {
++		ret = -EINVAL;
++		dev_info(dev->mt76.dev, "Failed to set offchan, chandef is invalid!\n");
++		goto out;
++	}
++
 +	memset(&dev->rdd2_chandef, 0, sizeof(struct cfg80211_chan_def));
 +
 +	ret = mt7915_mcu_rdd_background_enable(phy, &chandef);
@@ -311,6 +365,7 @@
 +
 +out:
 +	td->offchan_ch = 0;
++	td->offchan_center_ch = 0;
 +	td->offchan_bw = 0;
 +
 +	return ret;
@@ -478,7 +533,7 @@
  static int
  mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
  		      u16 cw_max, u16 txop, u8 tx_cmd)
-@@ -1249,6 +1471,8 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+@@ -1268,6 +1546,8 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
  		phy->mt76->test.tx_mpdu_len = 0;
  		phy->test.bf_en = 0;
  		mt7915_tm_set_entry(phy);
@@ -487,13 +542,13 @@
  	}
  }
  
-@@ -2008,6 +2232,14 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+@@ -2027,6 +2307,14 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
  		mt7915_tm_set_cfg(phy);
  	if (changed & BIT(TM_CHANGED_TXBF_ACT))
  		mt7915_tm_set_txbf(phy);
 +	if ((changed & BIT(TM_CHANGED_OFF_CHAN_CH)) &&
 +	    (changed & BIT(TM_CHANGED_OFF_CHAN_BW)))
-+		mt7915_tm_set_offchan(phy);
++		mt7915_tm_set_offchan(phy, !(changed & BIT(TM_CHANGED_OFF_CHAN_CENTER_CH)));
 +	if ((changed & BIT(TM_CHANGED_IPI_THRESHOLD)) &&
 +	    (changed & BIT(TM_CHANGED_IPI_PERIOD)))
 +		mt7915_tm_set_ipi(phy);
@@ -503,7 +558,7 @@
  
  static int
 diff --git a/testmode.c b/testmode.c
-index f1982ac..503d714 100644
+index 39cacb2..293ad98 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -24,6 +24,13 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -567,11 +622,11 @@
  	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
  	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_ANTENNA) &&
 diff --git a/testmode.h b/testmode.h
-index bbfb313..e03fa6d 100644
+index d2675dd..97e7596 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -63,6 +63,20 @@
-  * 	(nested, u8 attrs)
+  *	(nested, u8 attrs)
   *
   * @MT76_TM_ATTR_CFG: config testmode rf feature (nested, see &mt76_testmode_cfg)
 + * @MT76_TM_ATTR_TXBF_ACT: txbf setting actions (u8)
diff --git a/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch b/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
index 3ae285a..1163a02 100644
--- a/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1014-wifi-mt76-testmode-add-iBF-eBF-cal-and-cert-commands.patch
@@ -1,4 +1,4 @@
-From 4340e9c467389c104e62d7cd060a5494d83f24bf Mon Sep 17 00:00:00 2001
+From 44b3c5fed9a9c63e7da34004d265669f241a2886 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 15 Dec 2022 19:45:18 +0800
 Subject: [PATCH] wifi: mt76: testmode: add iBF/eBF cal and cert commands with
@@ -836,7 +836,7 @@
 +}
 +#endif
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index 0d90251e..a0d5324b 100644
+index a7e8598..5d91b80 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -61,6 +61,7 @@ enum offs_rev {
@@ -858,7 +858,7 @@
  #define MT_WF_RMAC_BASE(_band)		((_band) ? 0x820f5000 : 0x820e5000)
  #define MT_WF_RMAC(_band, ofs)		(MT_WF_RMAC_BASE(_band) + (ofs))
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 09b0e98e..b99bed54 100644
+index b98aaaa..5665da7 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -53,6 +53,8 @@ struct reg_band {
@@ -1491,7 +1491,7 @@
  
 -	pr_info("ibf cal process: act = %u, val = %u, %u, %u, %u, %u, %u\n",
 -		td->txbf_act, val[0], val[1], val[2], val[3], val[4], val[5]);
-+	dev_info(phy->dev->mt76.dev, "ibf cal process: act = %u, val = %u, %u, %u, %u, %u, %u\n",
++	dev_info(phy->dev->mt76.dev, "ibf cal process: act = %u, val = %u, %u, %u, %u, %u, %u, %u\n",
 +		 td->txbf_act, val[0], val[1], val[2], val[3], val[4], val[5], val[6]);
  
  	switch (td->txbf_act) {
@@ -1701,7 +1701,7 @@
  	rateval =  mode << 6 | rate_idx;
  	tx_cont->rateval = cpu_to_le16(rateval);
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index d500987d..19823694 100644
+index 7569826..5aba13c 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -311,137 +311,7 @@ struct mt7915_tm_muru {
@@ -1845,7 +1845,7 @@
  
  #endif
 diff --git a/testmode.c b/testmode.c
-index 503d714b..91638083 100644
+index 293ad98..f16c6ea 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -194,6 +194,7 @@ mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len,
@@ -1857,7 +1857,7 @@
  	memcpy(hdr->addr2, addr[1], ETH_ALEN);
  	memcpy(hdr->addr3, addr[2], ETH_ALEN);
 diff --git a/testmode.h b/testmode.h
-index e03fa6df..0e96173b 100644
+index 97e7596..e13920e 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -299,7 +299,10 @@ enum mt76_testmode_cfg {