[][MAC80211][mt76][Add eBF/iBF certification and calibration with golden]

[Description]
Add eBF certification commands with golden device
Add iBF calibration and verification commands with golden device
Add normal mode bf station record and pfmu tag dump command via debugfs
Fix BW display error in debugfs tmac info dump function

[Release-log]
N/A

Change-Id: I992f52b439cfa467e159dbe54285a902087da5db
Reviewed-on: https://gerrit.mediatek.inc/c/openwrt/feeds/mtk_openwrt_feeds/+/6929902
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
index a2c4295..b1d6b8f 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -1,4 +1,4 @@
-From 6bcd3876554df7bbf16e84a3bcdcee1d534c07c3 Mon Sep 17 00:00:00 2001
+From 003d0ce3643f9516832b7b35ff0bbf6a77dd5784 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 22 Jun 2022 10:39:47 +0800
 Subject: [PATCH 1001/1009] mt76: mt7915: add mtk internal debug tools for mt76
@@ -13,10 +13,10 @@
  mt7915/mcu.h          |    4 +
  mt7915/mt7915.h       |   44 +
  mt7915/mt7915_debug.h | 1350 +++++++++++++++++++
- mt7915/mtk_debugfs.c  | 2925 +++++++++++++++++++++++++++++++++++++++++
+ mt7915/mtk_debugfs.c  | 2926 +++++++++++++++++++++++++++++++++++++++++
  mt7915/mtk_mcu.c      |   51 +
  tools/fwlog.c         |   44 +-
- 12 files changed, 4568 insertions(+), 13 deletions(-)
+ 12 files changed, 4569 insertions(+), 13 deletions(-)
  create mode 100644 mt7915/mt7915_debug.h
  create mode 100644 mt7915/mtk_debugfs.c
  create mode 100644 mt7915/mtk_mcu.c
@@ -243,7 +243,7 @@
  }
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 7589af4b..f6edab6e 100644
+index 7589af4..f6edab6 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -73,7 +73,11 @@ int mt7915_run(struct ieee80211_hw *hw)
@@ -259,7 +259,7 @@
  		goto out;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7c14a189..644e6a8f 100644
+index 7c14a18..644e6a8 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -199,6 +199,11 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -366,7 +366,7 @@
  
  enum mcu_mmps_mode {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 942d70c5..afe2ec7a 100644
+index 942d70c..afe2ec7 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -9,6 +9,7 @@
@@ -1790,10 +1790,10 @@
 +#endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
 new file mode 100644
-index 00000000..747a9014
+index 0000000..53f98d1
 --- /dev/null
 +++ b/mt7915/mtk_debugfs.c
-@@ -0,0 +1,2925 @@
+@@ -0,0 +1,2926 @@
 +#include<linux/inet.h>
 +#include "mt7915.h"
 +#include "mt7915_debug.h"
@@ -4177,7 +4177,8 @@
 +
 +	if (txd->txd_2 & MT_TXD2_FIX_RATE) {
 +		/* Fixed BandWidth mode [2:0] */
-+		printk("\t\tbw = %ld\n", FIELD_GET(MT_TXD6_BW, txd->txd_6));
++		printk("\t\tbw = %ld\n",
++		       FIELD_GET(MT_TXD6_BW, txd->txd_6) | (txd->txd_6 & MT_TXD6_FIXED_BW));
 +
 +		/* DYN_BW [3] */
 +		printk("\t\tdyn_bw = %d\n", (txd->txd_6 & MT_TXD6_DYN_BW) ? 1 : 0);
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1002-mt76-mt7915-csi-implement-csi-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
index 2d2ff62..7b87e5d 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
@@ -1,4 +1,4 @@
-From 0f4b3763251928d5b275289b651e0e924306b255 Mon Sep 17 00:00:00 2001
+From eb15520de9df333056e892aad7035b7e869388ac Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Jun 2022 20:13:02 +0800
 Subject: [PATCH 1002/1009] mt76: mt7915: csi: implement csi support
@@ -53,7 +53,7 @@
  mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 diff --git a/mt7915/init.c b/mt7915/init.c
-index b23a2fb8..844a92f8 100644
+index b23a2fb..844a92f 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -658,6 +658,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
@@ -131,7 +131,7 @@
  				   ARRAY_SIZE(mt76_rates));
  	if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 644e6a8f..788f3fbf 100644
+index 644e6a8..788f3fb 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -36,6 +36,10 @@ static bool sr_scene_detect = true;
@@ -352,7 +352,7 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index afe2ec7a..53e13151 100644
+index afe2ec7..53e1315 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -293,6 +293,20 @@ struct mt7915_phy {
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
index 8a3794a..460dc9e 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -68,7 +68,7 @@
 index 747a9014..176937ad 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2480,6 +2480,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
+@@ -2481,6 +2481,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -107,7 +107,7 @@
  static int mt7915_amsduinfo_read(struct seq_file *s, void *data)
  {
  	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-@@ -2859,6 +2891,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -2860,6 +2892,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
  
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1005-mt76-mt7915-certification-patches.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1005-mt76-mt7915-certification-patches.patch
index 7dad26c..5ad2834 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1005-mt76-mt7915-certification-patches.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1005-mt76-mt7915-certification-patches.patch
@@ -847,7 +847,7 @@
 index 176937ad..e24b4d78 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2486,7 +2486,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
+@@ -2487,7 +2487,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
  
         *val = dev->dbg.muru_onoff;
  
@@ -857,7 +857,7 @@
                 !!(dev->dbg.muru_onoff & MUMIMO_UL),
                 !!(dev->dbg.muru_onoff & MUMIMO_DL),
                 !!(dev->dbg.muru_onoff & OFDMA_UL),
-@@ -2499,8 +2500,8 @@ static int mt7915_muru_onoff_set(void *data, u64 val)
+@@ -2500,8 +2501,8 @@ static int mt7915_muru_onoff_set(void *data, u64 val)
  {
         struct mt7915_dev *dev = data;
  
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1009-mt76-mt7915-add-fw_version-dump.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1009-mt76-mt7915-add-fw_version-dump.patch
index 7342f39..71edc45 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1009-mt76-mt7915-add-fw_version-dump.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1009-mt76-mt7915-add-fw_version-dump.patch
@@ -62,7 +62,7 @@
 index e24b4d78..766b278b 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2721,6 +2721,22 @@ static int mt7915_agginfo_read_band1(struct seq_file *s, void *data)
+@@ -2722,6 +2722,22 @@ static int mt7915_agginfo_read_band1(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -85,7 +85,7 @@
  /*usage: <en> <num> <len>
  	en: BIT(16) 0: sw amsdu  1: hw amsdu
  	num: GENMASK(15, 8) range 1-8
-@@ -2954,6 +2970,9 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -2955,6 +2971,9 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
  
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1111-mt76-mt7915-rework-testmode-init-registers.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1111-mt76-mt7915-rework-testmode-init-registers.patch
index f61bb30..e280126 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1111-mt76-mt7915-rework-testmode-init-registers.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1111-mt76-mt7915-rework-testmode-init-registers.patch
@@ -1,7 +1,7 @@
-From fd4298af06b54637ba66f9980e4657af8085b7ac Mon Sep 17 00:00:00 2001
+From 467fb6d27e86221c3d58649a480409310724c863 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Jun 2022 19:46:26 +0800
-Subject: [PATCH 1111/1130] mt76: mt7915: rework testmode init registers
+Subject: [PATCH 1111/1131] mt76: mt7915: rework testmode init registers
 
 ---
  mac80211.c        |   3 +-
@@ -17,7 +17,7 @@
  10 files changed, 164 insertions(+), 35 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 7fe7f68a..19d9efb3 100644
+index 7fe7f68..19d9efb 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -775,7 +775,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
@@ -31,7 +31,7 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index beea57d5..4822ffb7 100644
+index beea57d..4822ffb 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -637,6 +637,8 @@ struct mt76_testmode_ops {
@@ -61,7 +61,7 @@
  };
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 18ae3acb..18d6c669 100644
+index 18ae3ac..18d6c66 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1188,6 +1188,7 @@ enum {
@@ -73,7 +73,7 @@
  	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
  	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index eaadd331..2e97db7b 100644
+index eaadd33..2e97db7 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -9,6 +9,7 @@
@@ -85,7 +85,7 @@
  	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
  };
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index afa558c9..07de3cbd 100644
+index afa558c..07de3cb 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -118,6 +118,7 @@ static const u32 mt7986_reg[] = {
@@ -105,7 +105,7 @@
  	[TMAC_ODTR]		= 0x0cc,
  	[TMAC_ATCR]		= 0x00c,
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index c8e478a5..d6a05f13 100644
+index c8e478a..d6a05f1 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -48,6 +48,7 @@ enum reg_rev {
@@ -153,7 +153,7 @@
  #define MT_AGG_ACR0(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR0))
  #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 0d76ae31..46939191 100644
+index 0d76ae3..4693919 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -30,7 +30,7 @@ struct reg_band {
@@ -378,7 +378,7 @@
  
  const struct mt76_testmode_ops mt7915_testmode_ops = {
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 5573ac30..a1c54c89 100644
+index 5573ac3..a1c54c8 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -33,6 +33,12 @@ struct mt7915_tm_clean_txq {
@@ -429,7 +429,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 0accc71a..1d0d5d30 100644
+index 0accc71..1d0d5d3 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -447,8 +447,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -453,7 +453,7 @@
  		return -EMSGSIZE;
  
 diff --git a/testmode.h b/testmode.h
-index 5e2792d8..89613266 100644
+index 5e2792d..8961326 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -101,6 +101,8 @@ enum mt76_testmode_attr {
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-testmode-additional-supports.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-testmode-additional-supports.patch
index 1d16580..c84432c 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-testmode-additional-supports.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-testmode-additional-supports.patch
@@ -1,7 +1,7 @@
-From 2da3e0606e1d6f6f4a31737bd0a2e154d92f3da6 Mon Sep 17 00:00:00 2001
+From ab3f1bc454c084857c212141eeca4c14c9ae33e1 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
-Subject: [PATCH 1112/1130] mt76: testmode: additional supports
+Subject: [PATCH 1112/1131] mt76: testmode: additional supports
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -27,7 +27,7 @@
  19 files changed, 1963 insertions(+), 147 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index fc24b353..dc8d8882 100644
+index fc24b35..dc8d888 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -539,8 +539,7 @@ free:
@@ -41,7 +41,7 @@
  #endif
  
 diff --git a/mac80211.c b/mac80211.c
-index 19d9efb3..2e0e011d 100644
+index 19d9efb..2e0e011 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -55,6 +55,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
@@ -71,7 +71,7 @@
  
  static const struct ieee80211_channel mt76_channels_6ghz[] = {
 diff --git a/mt76.h b/mt76.h
-index 4822ffb7..58258e19 100644
+index 4822ffb..58258e1 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -635,6 +635,21 @@ struct mt76_testmode_ops {
@@ -233,7 +233,7 @@
  static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
  {
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index cf6ec55f..291a7c12 100644
+index cf6ec55..291a7c1 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -394,6 +394,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
@@ -255,7 +255,7 @@
  		return;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 18d6c669..a8ce98c9 100644
+index 18d6c66..a8ce98c 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -994,6 +994,7 @@ enum {
@@ -275,7 +275,7 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
 diff --git a/mt7915/init.c b/mt7915/init.c
-index 00ddab78..e044f503 100644
+index 00ddab7..e044f50 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -687,7 +687,7 @@ static void mt7915_init_work(struct work_struct *work)
@@ -288,7 +288,7 @@
  	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
  	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index fc7b7903..0746e4b3 100644
+index fc7b790..0746e4b 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -628,16 +628,38 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
@@ -361,7 +361,7 @@
  		goto out;
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 2c4e3923..4c3d822e 100644
+index 2c4e392..4c3d822 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -238,7 +238,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
@@ -374,7 +374,7 @@
  		mvif->mt76.wmm_idx += 2;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7728e82e..85450ead 100644
+index 7728e82..85450ea 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -383,6 +383,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -415,7 +415,7 @@
  
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 2e97db7b..4d86c7f1 100644
+index 2e97db7..4d86c7f 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -8,10 +8,15 @@
@@ -472,7 +472,7 @@
  
  enum {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 07de3cbd..26881fdc 100644
+index 07de3cb..26881fd 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -132,6 +132,7 @@ static const u32 mt7915_offs[] = {
@@ -492,7 +492,7 @@
  	[AGG_PCR0]		= 0x040,
  	[AGG_ACR0]		= 0x054,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 9fdb80b5..4336f204 100644
+index 9fdb80b..4336f20 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -320,6 +320,9 @@ struct mt7915_phy {
@@ -538,7 +538,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index d6a05f13..e8768488 100644
+index d6a05f1..e876848 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -62,6 +62,7 @@ enum offs_rev {
@@ -559,7 +559,7 @@
  							  (_n) * 4))
  #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 46939191..e0ba088f 100644
+index 4693919..e0ba088 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -9,6 +9,9 @@
@@ -1898,7 +1898,7 @@
 +	.set_eeprom = mt7915_tm_set_eeprom,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index a1c54c89..01b08e9e 100644
+index a1c54c8..01b08e9 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -4,6 +4,8 @@
@@ -2213,7 +2213,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 1d0d5d30..7a9ed543 100644
+index 1d0d5d3..7a9ed54 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -27,28 +27,16 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -2680,7 +2680,7 @@
  		a = nla_nest_start(msg, MT76_TM_ATTR_TX_POWER);
  		if (!a)
 diff --git a/testmode.h b/testmode.h
-index 89613266..57949f2b 100644
+index 8961326..57949f2 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -6,6 +6,8 @@
@@ -2785,7 +2785,7 @@
 +
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
-index e3f69089..6e36ab27 100644
+index e3f6908..6e36ab2 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
@@ -2911,7 +2911,7 @@
  };
  
 diff --git a/tx.c b/tx.c
-index 1f309d05..6d55566f 100644
+index 1f309d0..6d55566 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -250,8 +250,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1113-mt76-testmode-add-pre-cal-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1113-mt76-testmode-add-pre-cal-support.patch
index 3073193..ff59b3c 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1113-mt76-testmode-add-pre-cal-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1113-mt76-testmode-add-pre-cal-support.patch
@@ -1,7 +1,7 @@
-From 5ce6e964e6204e498517acac37c4285fc7d0b398 Mon Sep 17 00:00:00 2001
+From 6f56f238f1638fae3ab10c4236ca03c1a0036833 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 31 Aug 2022 20:06:52 +0800
-Subject: [PATCH 1113/1130] mt76: testmode: add pre-cal support
+Subject: [PATCH 1113/1131] mt76: testmode: add pre-cal support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: Ibfbbc3443de994eeb4daa5e364b0a90f5d7d3bcd
@@ -20,7 +20,7 @@
  11 files changed, 562 insertions(+), 13 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 0a88048b..cb6ff17a 100644
+index 0a88048..cb6ff17 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -89,8 +89,10 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
@@ -37,7 +37,7 @@
  
  out_put_node:
 diff --git a/mt76.h b/mt76.h
-index 58258e19..89c85709 100644
+index 58258e1..89c8570 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -636,6 +636,7 @@ struct mt76_testmode_ops {
@@ -49,7 +49,7 @@
  
  struct mt76_testmode_entry_data {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index a8ce98c9..f42946ec 100644
+index a8ce98c..f42946e 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -990,6 +990,7 @@ enum {
@@ -61,7 +61,7 @@
  	MCU_EXT_EVENT_FW_LOG_2_HOST = 0x13,
  	MCU_EXT_EVENT_THERMAL_PROTECT = 0x22,
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index f3e56817..88aaa16a 100644
+index f3e5681..88aaa16 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -39,10 +39,18 @@ enum mt7915_eeprom_field {
@@ -114,7 +114,7 @@
  
  #endif
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 85450ead..8e3217b6 100644
+index 85450ea..8e3217b 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -387,6 +387,9 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -169,7 +169,7 @@
  
  	idx = mt7915_dpd_freq_idx(center_freq, chandef->width);
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 4336f204..b6c9fc50 100644
+index 4336f20..b6c9fc5 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -406,6 +406,10 @@ struct mt7915_dev {
@@ -192,7 +192,7 @@
  static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
  {
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index e0ba088f..a9e57e4b 100644
+index e0ba088..a9e57e4 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -5,6 +5,7 @@
@@ -667,7 +667,7 @@
 +	.dump_precal = mt7915_tm_dump_precal,
  };
 diff --git a/mt7915/testmode.h b/mt7915/testmode.h
-index 01b08e9e..d500987d 100644
+index 01b08e9..d500987 100644
 --- a/mt7915/testmode.h
 +++ b/mt7915/testmode.h
 @@ -81,6 +81,11 @@ struct tm_tx_cont {
@@ -735,7 +735,7 @@
  	TAM_ARB_OP_MODE_NORMAL = 1,
  	TAM_ARB_OP_MODE_TEST,
 diff --git a/testmode.c b/testmode.c
-index 7a9ed543..82b8e983 100644
+index 7a9ed54..82b8e98 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -763,6 +763,18 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
@@ -768,7 +768,7 @@
  
  	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
 diff --git a/testmode.h b/testmode.h
-index 57949f2b..e2190e72 100644
+index 57949f2..e2190e7 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -19,6 +19,7 @@
@@ -824,7 +824,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 6e36ab27..1be1ffd6 100644
+index 6e36ab2..1be1ffd 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -11,6 +11,14 @@ static const char * const testmode_state[] = {
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-testmode-add-iBF-command-mode-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-testmode-add-iBF-command-mode-support.patch
index b4cac7c..8065f09 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-testmode-add-iBF-command-mode-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-testmode-add-iBF-command-mode-support.patch
@@ -1,7 +1,7 @@
-From 84b363132a4c017a01c9cab9dbf46e7fd3948828 Mon Sep 17 00:00:00 2001
+From aea34329aaa1f61080141633f6f14db501ad3afd Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 12 Sep 2022 18:16:54 +0800
-Subject: [PATCH 1114/1130] mt76: testmode: add iBF command mode support
+Subject: [PATCH 1114/1131] mt76: testmode: add iBF command mode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Change-Id: I7eea1d6412563f889e5774e787e58ce9eba001bd
@@ -13,7 +13,7 @@
  4 files changed, 85 insertions(+), 7 deletions(-)
 
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index a9e57e4b..99582d9c 100644
+index a9e57e4..99582d9 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -701,6 +701,7 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
@@ -105,7 +105,7 @@
  		mt7915_tm_set_tx_len(phy, tx_time);
  
 diff --git a/testmode.c b/testmode.c
-index 82b8e983..aa874a83 100644
+index 82b8e98..aa874a8 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -530,6 +530,42 @@ out:
@@ -164,7 +164,7 @@
  		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TXBF_PARAM], rem) {
  			if (nla_len(cur) != 2 ||
 diff --git a/testmode.h b/testmode.h
-index e2190e72..5d1fe793 100644
+index e2190e7..5d1fe79 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -281,8 +281,10 @@ enum mt76_testmode_txbf_act {
@@ -179,7 +179,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 1be1ffd6..47fc69f9 100644
+index 1be1ffd..47fc69f 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -32,6 +32,20 @@ static const char * const testmode_tx_mode[] = {
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
index 0c66421..6e0c6a4 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1115-mt76-testmode-add-ZWDFS-test-mode-support.patch
@@ -1,7 +1,7 @@
-From cbe2aba76841beafd2503d79cc5b1a4bd15b709d Mon Sep 17 00:00:00 2001
+From fb8d76200e45c67fabe8b8d21a12f49d8011ce00 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 27 Oct 2022 17:42:07 +0800
-Subject: [PATCH 1115/1130] mt76: testmode: add ZWDFS test mode support
+Subject: [PATCH 1115/1131] mt76: testmode: add ZWDFS test mode support
 
 Change-Id: I14d104b7158a35acf6b0595357d07fb87f5a9d94
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -19,7 +19,7 @@
  10 files changed, 452 insertions(+), 1 deletion(-)
 
 diff --git a/mt76.h b/mt76.h
-index 89c85709..2bacc1b4 100644
+index 89c8570..2bacc1b 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -719,6 +719,15 @@ struct mt76_testmode_data {
@@ -39,7 +39,7 @@
  
  struct mt76_vif {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f42946ec..7853e074 100644
+index f42946e..7853e07 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1190,6 +1190,7 @@ enum {
@@ -59,7 +59,7 @@
  
  enum {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 8e3217b6..b8243e10 100644
+index 8e3217b..b8243e1 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2636,6 +2636,7 @@ mt7915_mcu_background_chain_ctrl(struct mt7915_phy *phy,
@@ -140,7 +140,7 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 4d86c7f1..9a485249 100644
+index 4d86c7f..9a48524 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -628,6 +628,52 @@ struct csi_data {
@@ -197,7 +197,7 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b6c9fc50..d845206e 100644
+index b6c9fc5..d845206 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -308,6 +308,7 @@ struct mt7915_phy {
@@ -219,7 +219,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
  int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index e8768488..f4b57099 100644
+index e876848..f4b5709 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
 @@ -1194,6 +1194,8 @@ enum offs_rev {
@@ -232,7 +232,7 @@
  #define MT_WF_PHY_BASE			0x83080000
  #define MT_WF_PHY(ofs)			(MT_WF_PHY_BASE + (ofs))
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 99582d9c..2ae6c07f 100644
+index 99582d9..2ae6c07 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -13,6 +13,12 @@ enum {
@@ -503,7 +503,7 @@
  
  static int
 diff --git a/testmode.c b/testmode.c
-index aa874a83..b19b872a 100644
+index aa874a8..b19b872 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -24,6 +24,13 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -567,7 +567,7 @@
  	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
  	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_ANTENNA) &&
 diff --git a/testmode.h b/testmode.h
-index 5d1fe793..27a00953 100644
+index 5d1fe79..27a0095 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -63,6 +63,20 @@
@@ -635,7 +635,7 @@
 +
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
-index 47fc69f9..6f07eed0 100644
+index 47fc69f..6f07eed 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -46,6 +46,14 @@ static const char * const testmode_txbf_act[] = {
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1116-mt76-testmode-add-iBF-eBF-cal-and-cert-commands-with.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1116-mt76-testmode-add-iBF-eBF-cal-and-cert-commands-with.patch
new file mode 100644
index 0000000..db71053
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1116-mt76-testmode-add-iBF-eBF-cal-and-cert-commands-with.patch
@@ -0,0 +1,1909 @@
+From e2c7b902b076265245b45e60d9554a6ec9432e28 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 15 Dec 2022 19:45:18 +0800
+Subject: [PATCH 1116/1131] mt76: testmode: add iBF/eBF cal and cert commands
+ with golden
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt76.h               |   4 +
+ mt76_connac_mcu.c    |   3 +
+ mt7915/mac.c         |   4 +-
+ mt7915/main.c        |  54 ++---
+ mt7915/mcu.c         |  29 ++-
+ mt7915/mcu.h         | 172 ++++++++++++++++
+ mt7915/mmio.c        |   2 +
+ mt7915/mt7915.h      |  14 +-
+ mt7915/mtk_debugfs.c |  35 ++++
+ mt7915/mtk_mcu.c     | 246 ++++++++++++++++++++++-
+ mt7915/regs.h        |   4 +
+ mt7915/testmode.c    | 458 ++++++++++++++++++++++++++++---------------
+ mt7915/testmode.h    | 134 +------------
+ testmode.c           |   1 +
+ testmode.h           |   9 +
+ tools/fields.c       |   9 +
+ 16 files changed, 855 insertions(+), 323 deletions(-)
+
+diff --git a/mt76.h b/mt76.h
+index 2bacc1b..c6aefbf 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -681,6 +681,7 @@ struct mt76_testmode_data {
+ 
+ 	struct list_head tm_entry_list;
+ 	struct mt76_wcid *cur_entry;
++	struct ieee80211_vif *second_vif;
+ 	u8 entry_num;
+ 	union {
+ 		struct mt76_testmode_entry_data ed;
+@@ -709,6 +710,9 @@ struct mt76_testmode_data {
+ 
+ 	u8 txbf_act;
+ 	u16 txbf_param[8];
++	bool is_txbf_dut;
++	bool bf_en;
++	bool ebf;
+ 
+ 	u32 tx_pending;
+ 	u32 tx_queued;
+diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
+index 291a7c1..14ce09e 100644
+--- a/mt76_connac_mcu.c
++++ b/mt76_connac_mcu.c
+@@ -2756,6 +2756,7 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
+ 	u32 type = vif->p2p ? NETWORK_P2P : NETWORK_INFRA;
+ 	struct bss_info_basic *bss;
+ 	struct tlv *tlv;
++	struct mt76_testmode_data *td = &phy->test;
+ 
+ 	tlv = mt76_connac_mcu_add_tlv(skb, BSS_INFO_BASIC, sizeof(*bss));
+ 	bss = (struct bss_info_basic *)tlv;
+@@ -2815,6 +2816,8 @@ int mt76_connac_mcu_bss_basic_tlv(struct sk_buff *skb,
+ 		bss->dtim_period = vif->bss_conf.dtim_period;
+ 		bss->phy_mode = mt76_connac_get_phy_mode(phy, vif,
+ 							 chandef->chan->band, NULL);
++	} else if (td->bf_en) {
++		memcpy(bss->bssid, vif->addr, ETH_ALEN);
+ 	} else {
+ 		memcpy(bss->bssid, phy->macaddr, ETH_ALEN);
+ 	}
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 0746e4b..013dfbd 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -753,8 +753,10 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+ 		val |= MT_TXD6_LDPC;
+ 
+ 	txwi[3] &= ~cpu_to_le32(MT_TXD3_SN_VALID);
+-	if (phy->test.bf_en)
++	if (td->bf_en && !td->ebf)
+ 		val |= MT_TXD6_TX_IBF | MT_TXD6_TX_EBF;
++	else if (td->bf_en && td->ebf)
++		val |= MT_TXD6_TX_EBF;
+ 
+ 	txwi[6] |= cpu_to_le32(val);
+ #endif
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 4c3d822..a347e77 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -205,46 +205,37 @@ static void mt7915_init_bitrate_mask(struct ieee80211_vif *vif)
+ 	}
+ }
+ 
+-static int mt7915_add_interface(struct ieee80211_hw *hw,
+-				struct ieee80211_vif *vif)
++int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_en)
+ {
+ 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
+-	struct mt7915_dev *dev = mt7915_hw_dev(hw);
+-	struct mt7915_phy *phy = mt7915_hw_phy(hw);
++	struct mt7915_dev *dev = phy->dev;
+ 	struct mt76_txq *mtxq;
+ 	bool ext_phy = phy != &dev->phy;
+ 	int idx, ret = 0;
+ 
+-	mutex_lock(&dev->mt76.mutex);
+-
+-	mt76_testmode_reset(phy->mt76, true);
+-
+-	if (vif->type == NL80211_IFTYPE_MONITOR &&
+-	    is_zero_ether_addr(vif->addr))
+-		phy->monitor_vif = vif;
++	/* To differentiate the mac address of TXD and TXCMD interface */
++	vif->addr[0] |= bf_en;
+ 
+ 	mvif->mt76.idx = __ffs64(~dev->mt76.vif_mask);
+-	if (mvif->mt76.idx >= (MT7915_MAX_INTERFACES << dev->dbdc_support)) {
+-		ret = -ENOSPC;
+-		goto out;
+-	}
++	if (mvif->mt76.idx >= (MT7915_MAX_INTERFACES << dev->dbdc_support))
++		return -ENOSPC;
+ 
+ 	idx = get_omac_idx(vif->type, phy->omac_mask);
+-	if (idx < 0) {
+-		ret = -ENOSPC;
+-		goto out;
+-	}
++	if (idx < 0)
++		return -ENOSPC;
++
+ 	mvif->mt76.omac_idx = idx;
+ 	mvif->phy = phy;
+ 	mvif->mt76.band_idx = phy->mt76->band_idx;
+ 
+-	mvif->mt76.wmm_idx = (vif->type != NL80211_IFTYPE_AP && vif->type != NL80211_IFTYPE_MONITOR);
++	mvif->mt76.wmm_idx = (vif->type != NL80211_IFTYPE_AP &&
++			      vif->type != NL80211_IFTYPE_MONITOR) || bf_en;
+ 	if (ext_phy)
+ 		mvif->mt76.wmm_idx += 2;
+ 
+ 	ret = mt7915_mcu_add_dev_info(phy, vif, true);
+ 	if (ret)
+-		goto out;
++		return ret;
+ 
+ 	dev->mt76.vif_mask |= BIT_ULL(mvif->mt76.idx);
+ 	phy->omac_mask |= BIT_ULL(mvif->mt76.omac_idx);
+@@ -279,7 +270,26 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+ 	mt7915_mcu_add_sta(dev, vif, NULL, true);
+ 	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
+ 
+-out:
++	return ret;
++}
++
++static int mt7915_add_interface(struct ieee80211_hw *hw,
++				struct ieee80211_vif *vif)
++{
++	struct mt7915_dev *dev = mt7915_hw_dev(hw);
++	struct mt7915_phy *phy = mt7915_hw_phy(hw);
++	int ret = 0;
++
++	mutex_lock(&dev->mt76.mutex);
++
++	mt76_testmode_reset(phy->mt76, true);
++
++	if (vif->type == NL80211_IFTYPE_MONITOR &&
++	    is_zero_ether_addr(vif->addr))
++		phy->monitor_vif = vif;
++
++	ret = mt7915_init_vif(phy, vif, false);
++
+ 	mutex_unlock(&dev->mt76.mutex);
+ 
+ 	return ret;
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index b8243e1..5d41ebf 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -193,6 +193,7 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+ 	int ret;
+ 
+ 	ret = mt76_connac2_mcu_fill_message(mdev, skb, cmd, wait_seq);
++
+ 	if (ret)
+ 		return ret;
+ 
+@@ -383,10 +384,12 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+ 	case MCU_EXT_EVENT_BCC_NOTIFY:
+ 		mt7915_mcu_rx_bcc_notify(dev, skb);
+ 		break;
+-#ifdef CONFIG_NL80211_TESTMODE
++#if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
+ 	case MCU_EXT_EVENT_BF_STATUS_READ:
+-		mt7915_tm_txbf_status_read(dev, skb);
++		mt7915_mcu_txbf_status_read(dev, skb);
+ 		break;
++#endif
++#ifdef CONFIG_NL80211_TESTMODE
+ 	case MCU_EXT_EVENT_RF_TEST:
+ 		mt7915_tm_rf_test_event(dev, skb);
+ 		break;
+@@ -673,11 +676,22 @@ int mt7915_mcu_add_bss_info(struct mt7915_phy *phy,
+ 	if (enable)
+ 		mt76_connac_mcu_bss_omac_tlv(skb, vif);
+ 
+-	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
+-				      mvif->sta.wcid.idx, enable);
++	if (vif->type == NL80211_IFTYPE_MONITOR) {
++		struct mt76_testmode_data *td = &phy->mt76->test;
++		struct mt76_wcid *wcid;
++
++		if (!td->aid || list_empty(&td->tm_entry_list))
++			wcid = &mvif->sta.wcid;
++		else
++			wcid = list_first_entry(&td->tm_entry_list, struct mt76_wcid, list);
+ 
+-	if (vif->type == NL80211_IFTYPE_MONITOR)
++		mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
++					      wcid->idx, enable);
+ 		goto out;
++	}
++
++	mt76_connac_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
++				      mvif->sta.wcid.idx, enable);
+ 
+ 	if (enable) {
+ 		mt7915_mcu_bss_rfch_tlv(skb, vif, phy);
+@@ -3403,6 +3417,7 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+ 
+ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
+ {
++#define MT_BF_PROCESSING	4
+ 	struct {
+ 		u8 action;
+ 		union {
+@@ -3429,7 +3444,6 @@ int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
+ 		.action = action,
+ 	};
+ 
+-#define MT_BF_PROCESSING	4
+ 	switch (action) {
+ 	case MT_BF_SOUNDING_ON:
+ 		req.snd.snd_mode = MT_BF_PROCESSING;
+@@ -4347,6 +4361,9 @@ int mt7915_mcu_set_txbf_sound_info(struct mt7915_phy *phy, u8 action,
+ 		req.he_opt = v2;
+ 		req.glo_opt = v3;
+ 		break;
++	case BF_SND_CFG_INF:
++		req.inf = v1;
++		break;
+ 	default:
+ 		return -EINVAL;
+ 	}
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 9a48524..a30f52d 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -475,10 +475,12 @@ enum {
+ };
+ 
+ enum {
++	MT_BF_SOUNDING_OFF = 0,
+ 	MT_BF_SOUNDING_ON = 1,
+ 	MT_BF_DATA_PACKET_APPLY = 2,
+ 	MT_BF_PFMU_TAG_READ = 5,
+ 	MT_BF_PFMU_TAG_WRITE = 6,
++	MT_BF_STA_REC_READ = 13,
+ 	MT_BF_PHASE_CAL = 14,
+ 	MT_BF_IBF_PHASE_COMP = 15,
+ 	MT_BF_PROFILE_WRITE_ALL = 17,
+@@ -486,6 +488,176 @@ enum {
+ 	MT_BF_MODULE_UPDATE = 25
+ };
+ 
++#if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
++struct mt7915_pfmu_tag1 {
++	__le32 pfmu_idx:10;
++	__le32 ebf:1;
++	__le32 data_bw:2;
++	__le32 lm:2;
++	__le32 is_mu:1;
++	__le32 nr:3, nc:3;
++	__le32 codebook:2;
++	__le32 ngroup:2;
++	__le32 _rsv:2;
++	__le32 invalid_prof:1;
++	__le32 rmsd:3;
++
++	__le32 col_id1:6, row_id1:10;
++	__le32 col_id2:6, row_id2:10;
++	__le32 col_id3:6, row_id3:10;
++	__le32 col_id4:6, row_id4:10;
++
++	__le32 ru_start_id:7;
++	__le32 _rsv1:1;
++	__le32 ru_end_id:7;
++	__le32 _rsv2:1;
++	__le32 mob_cal_en:1;
++	__le32 _rsv3:15;
++
++	__le32 snr_sts0:8, snr_sts1:8, snr_sts2:8, snr_sts3:8;
++	__le32 snr_sts4:8, snr_sts5:8, snr_sts6:8, snr_sts7:8;
++
++	__le32 _rsv4;
++} __packed;
++
++struct mt7915_pfmu_tag2 {
++	__le32 smart_ant:24;
++	__le32 se_idx:5;
++	__le32 _rsv:3;
++
++	__le32 _rsv1:8;
++	__le32 rmsd_thres:3;
++	__le32 _rsv2:5;
++	__le32 ibf_timeout:8;
++	__le32 _rsv3:8;
++
++	__le32 _rsv4:16;
++	__le32 ibf_data_bw:2;
++	__le32 ibf_nc:3;
++	__le32 ibf_nr:3;
++	__le32 ibf_ru:8;
++
++	__le32 mob_delta_t:8;
++	__le32 mob_lq_result:7;
++	__le32 _rsv5:1;
++	__le32 _rsv6:16;
++
++	__le32 _rsv7;
++} __packed;
++
++struct mt7915_pfmu_tag {
++	struct mt7915_pfmu_tag1 t1;
++	struct mt7915_pfmu_tag2 t2;
++};
++
++struct mt7915_bf_status_hdr {
++	u8 format_id;
++	u8 bw;
++	u16 subcarrier_idx;
++	bool bfer;
++	u8 rsv[3];
++} __packed;
++
++struct mt7915_bf_status {
++	struct mt7915_bf_status_hdr hdr;
++	u8 buf[1000];
++} __packed;
++
++struct mt7915_txbf_phase_out {
++	u8 c0_l;
++	u8 c1_l;
++	u8 c2_l;
++	u8 c3_l;
++	u8 c0_m;
++	u8 c1_m;
++	u8 c2_m;
++	u8 c3_m;
++	u8 c0_h;
++	u8 c1_h;
++	u8 c2_h;
++	u8 c3_h;
++	u8 c0_uh;
++	u8 c1_uh;
++	u8 c2_uh;
++	u8 c3_uh;
++};
++
++struct mt7915_txbf_phase {
++	u8 status;
++	struct {
++		u8 r0_uh;
++		u8 r0_h;
++		u8 r0_m;
++		u8 r0_l;
++		u8 r0_ul;
++		u8 r1_uh;
++		u8 r1_h;
++		u8 r1_m;
++		u8 r1_l;
++		u8 r1_ul;
++		u8 r2_uh;
++		u8 r2_h;
++		u8 r2_m;
++		u8 r2_l;
++		u8 r2_ul;
++		u8 r3_uh;
++		u8 r3_h;
++		u8 r3_m;
++		u8 r3_l;
++		u8 r3_ul;
++		u8 r2_uh_sx2;
++		u8 r2_h_sx2;
++		u8 r2_m_sx2;
++		u8 r2_l_sx2;
++		u8 r2_ul_sx2;
++		u8 r3_uh_sx2;
++		u8 r3_h_sx2;
++		u8 r3_m_sx2;
++		u8 r3_l_sx2;
++		u8 r3_ul_sx2;
++		u8 m_t0_h;
++		u8 m_t1_h;
++		u8 m_t2_h;
++		u8 m_t2_h_sx2;
++		u8 r0_reserved;
++		u8 r1_reserved;
++		u8 r2_reserved;
++		u8 r3_reserved;
++		u8 r2_sx2_reserved;
++		u8 r3_sx2_reserved;
++	} phase;
++};
++
++struct mt7915_pfmu_data {
++	__le16 subc_idx;
++	__le16 phi11;
++	__le16 phi21;
++	__le16 phi31;
++};
++
++struct mt7915_ibf_cal_info {
++	u8 format_id;
++	u8 group_l_m_n;
++	u8 group;
++	bool sx2;
++	u8 status;
++	u8 cal_type;
++	u8 _rsv[2];
++	u8 buf[1000];
++} __packed;
++
++enum {
++	IBF_PHASE_CAL_UNSPEC,
++	IBF_PHASE_CAL_NORMAL,
++	IBF_PHASE_CAL_VERIFY,
++	IBF_PHASE_CAL_NORMAL_INSTRUMENT,
++	IBF_PHASE_CAL_VERIFY_INSTRUMENT,
++};
++
++#define MT7915_TXBF_SUBCAR_NUM	64
++
++#endif
++
+ enum {
+ 	MURU_SET_ARB_OP_MODE = 14,
+ 	MURU_SET_PLATFORM_TYPE = 25,
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 26881fd..c1b421d 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -131,6 +131,7 @@ static const u32 mt7915_offs[] = {
+ 	[MDP_BNRCFR1]		= 0x074,
+ 	[ARB_DRNGR0]		= 0x194,
+ 	[ARB_SCR]		= 0x080,
++	[ARB_TQSAXM0]		= 0x030,
+ 	[RMAC_MIB_AIRTIME14]	= 0x3b8,
+ 	[AGG_AALCR0]		= 0x048,
+ 	[AGG_AWSCR0]		= 0x05c,
+@@ -207,6 +208,7 @@ static const u32 mt7916_offs[] = {
+ 	[MDP_BNRCFR1]		= 0x094,
+ 	[ARB_DRNGR0]		= 0x1e0,
+ 	[ARB_SCR]		= 0x000,
++	[ARB_TQSAXM0]		= 0x180,
+ 	[RMAC_MIB_AIRTIME14]	= 0x0398,
+ 	[AGG_AALCR0]		= 0x028,
+ 	[AGG_AWSCR0]		= 0x030,
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index d845206..ab1efe6 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -322,7 +322,6 @@ struct mt7915_phy {
+ 
+ 		u8 spe_idx;
+ 
+-		bool bf_en;
+ 		bool bf_ever_en;
+ 	} test;
+ #endif
+@@ -427,7 +426,7 @@ struct mt7915_dev {
+ 	void __iomem *dcm;
+ 	void __iomem *sku;
+ 
+-#ifdef CONFIG_NL80211_TESTMODE
++#if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
+ 	struct {
+ 		void *txbf_phase_cal;
+ 		void *txbf_pfmu_data;
+@@ -566,6 +565,7 @@ void mt7915_dma_prefetch(struct mt7915_dev *dev);
+ void mt7915_dma_cleanup(struct mt7915_dev *dev);
+ int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
+ int mt7915_txbf_init(struct mt7915_dev *dev);
++int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_en);
+ void mt7915_init_txpower(struct mt7915_dev *dev,
+ 			 struct ieee80211_supported_band *sband);
+ void mt7915_reset(struct mt7915_dev *dev);
+@@ -644,8 +644,10 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
+ void mt7915_mcu_exit(struct mt7915_dev *dev);
+-int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
++
++#ifdef CONFIG_NL80211_TESTMODE
+ void mt7915_tm_rf_test_event(struct mt7915_dev *dev, struct sk_buff *skb);
++#endif
+ 
+ static inline u16 mt7915_wtbl_size(struct mt7915_dev *dev)
+ {
+@@ -782,4 +784,10 @@ enum {
+ 
+ #endif
+ 
++#if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
++int mt7915_mcu_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb);
++int mt7915_mcu_txbf_profile_tag_read(struct mt7915_phy *phy, u8 pfmu_idx, bool bfer);
++int mt7915_mcu_txbf_sta_rec_read(struct mt7915_dev *dev, u16 wlan_idx);
++#endif
++
+ #endif
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+index 583bc19..a2ceb6f 100644
+--- a/mt7915/mtk_debugfs.c
++++ b/mt7915/mtk_debugfs.c
+@@ -2831,6 +2831,36 @@ mt7915_txpower_level_set(void *data, u64 val)
+ DEFINE_DEBUGFS_ATTRIBUTE(fops_txpower_level, NULL,
+ 			 mt7915_txpower_level_set, "%lld\n");
+ 
++static int
++mt7915_txbf_pfmu_tag_read(void *data, u64 val)
++{
++	struct mt7915_phy *phy = data;
++	u8 pfmu_idx = (u8)val;
++
++	pr_info("%s: %d pfmu_tag cmd sent out ---\n", __func__, __LINE__);
++	mt7915_mcu_txbf_profile_tag_read(phy, pfmu_idx, true);
++
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_txbf_pfmu_tag_idx, NULL,
++			 mt7915_txbf_pfmu_tag_read, "%llx\n");
++
++static int
++mt7915_txbf_sta_rec_read(void *data, u64 val)
++{
++	struct mt7915_dev *dev = data;
++	u16 wlan_idx = (u16)val;
++
++	pr_info("%s: %d sta_rec cmd sent out ---\n", __func__, __LINE__);
++	mt7915_mcu_txbf_sta_rec_read(dev, wlan_idx);
++
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_txbf_sta_rec, NULL,
++			 mt7915_txbf_sta_rec_read, "%llx\n");
++
+ /* usage: echo 0x[arg3][arg2][arg1] > fw_wa_set */
+ static int
+ mt7915_wa_set(void *data, u64 val)
+@@ -2969,6 +2999,11 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+ 	debugfs_create_file("txpower_level", 0400, dir, dev,
+ 			    &fops_txpower_level);
+ 
++	debugfs_create_file("txbf_pfmu_tag_idx", 0600, dir, phy,
++			    &fops_txbf_pfmu_tag_idx);
++	debugfs_create_file("txbf_sta_rec", 0600, dir, dev,
++			    &fops_txbf_sta_rec);
++
+ 	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
+ 
+ 	debugfs_create_devm_seqfile(dev->mt76.dev, "fw_version", dir,
+diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
+index 143dae2..906c872 100644
+--- a/mt7915/mtk_mcu.c
++++ b/mt7915/mtk_mcu.c
+@@ -1,9 +1,10 @@
+ #include <linux/firmware.h>
+ #include <linux/fs.h>
+-#include<linux/inet.h>
++#include <linux/inet.h>
+ #include "mt7915.h"
+ #include "mcu.h"
+ #include "mac.h"
++#include "testmode.h"
+ 
+ int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level)
+ {
+@@ -49,3 +50,246 @@ int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level)
+ 				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
+ 				 sizeof(req), true);
+ }
++
++#if defined CONFIG_NL80211_TESTMODE || defined MTK_DEBUG
++static void mt7915_txbf_dump_pfmu_tag(struct mt7915_dev *dev, struct mt7915_pfmu_tag *tag)
++{
++	u32 *raw_t1 = (u32 *)&tag->t1;
++	u32 *raw_t2 = (u32 *)&tag->t2;
++
++	dev_info(dev->mt76.dev, "=================== TXBf Profile Tag1 Info ==================\n");
++	dev_info(dev->mt76.dev,
++		 "DW0 = 0x%08x, DW1 = 0x%08x, DW2 = 0x%08x\n",
++		 raw_t1[0], raw_t1[1], raw_t1[2]);
++	dev_info(dev->mt76.dev,
++		 "DW4 = 0x%08x, DW5 = 0x%08x, DW6 = 0x%08x\n\n",
++		 raw_t1[3], raw_t1[4], raw_t1[5]);
++	dev_info(dev->mt76.dev, "PFMU ID = %d              Invalid status = %d\n",
++		 tag->t1.pfmu_idx, tag->t1.invalid_prof);
++	dev_info(dev->mt76.dev, "iBf/eBf = %d\n\n", tag->t1.ebf);
++	dev_info(dev->mt76.dev, "DBW   = %d\n", tag->t1.data_bw);
++	dev_info(dev->mt76.dev, "SU/MU = %d\n", tag->t1.is_mu);
++	dev_info(dev->mt76.dev, "RMSD  = %d\n", tag->t1.rmsd);
++	dev_info(dev->mt76.dev,
++		 "nrow = %d, ncol = %d, ng = %d, LM = %d, CodeBook = %d MobCalEn = %d\n",
++		 tag->t1.nr, tag->t1.nc, tag->t1.ngroup, tag->t1.lm, tag->t1.codebook,
++		 tag->t1.mob_cal_en);
++	dev_info(dev->mt76.dev, "RU start = %d, RU end = %d\n",
++		 tag->t1.ru_start_id, tag->t1.ru_end_id);
++	dev_info(dev->mt76.dev, "Mem Col1 = %d, Mem Row1 = %d, Mem Col2 = %d, Mem Row2 = %d\n",
++		 tag->t1.col_id1, tag->t1.row_id1, tag->t1.col_id2, tag->t1.row_id2);
++	dev_info(dev->mt76.dev, "Mem Col3 = %d, Mem Row3 = %d, Mem Col4 = %d, Mem Row4 = %d\n\n",
++		 tag->t1.col_id3, tag->t1.row_id3, tag->t1.col_id4, tag->t1.row_id4);
++	dev_info(dev->mt76.dev,
++		 "STS0_SNR = 0x%02x, STS1_SNR = 0x%02x, STS2_SNR = 0x%02x, STS3_SNR = 0x%02x\n",
++		 tag->t1.snr_sts0, tag->t1.snr_sts1, tag->t1.snr_sts2, tag->t1.snr_sts3);
++	dev_info(dev->mt76.dev,
++		 "STS4_SNR = 0x%02x, STS5_SNR = 0x%02x, STS6_SNR = 0x%02x, STS7_SNR = 0x%02x\n",
++		 tag->t1.snr_sts4, tag->t1.snr_sts5, tag->t1.snr_sts6, tag->t1.snr_sts7);
++	dev_info(dev->mt76.dev, "=============================================================\n");
++
++	dev_info(dev->mt76.dev, "=================== TXBf Profile Tag2 Info ==================\n");
++	dev_info(dev->mt76.dev,
++		 "DW0 = 0x%08x, DW1 = 0x%08x, DW2 = 0x%08x\n",
++		 raw_t2[0], raw_t2[1], raw_t2[2]);
++	dev_info(dev->mt76.dev,
++		 "DW3 = 0x%08x, DW4 = 0x%08x, DW5 = 0x%08x\n\n",
++		 raw_t2[3], raw_t2[4], raw_t2[5]);
++	dev_info(dev->mt76.dev, "Smart antenna ID = 0x%x,  SE index = %d\n",
++		 tag->t2.smart_ant, tag->t2.se_idx);
++	dev_info(dev->mt76.dev, "RMSD threshold = %d\n", tag->t2.rmsd_thres);
++	dev_info(dev->mt76.dev, "Timeout = 0x%x\n", tag->t2.ibf_timeout);
++	dev_info(dev->mt76.dev, "Desired BW = %d, Desired Ncol = %d, Desired Nrow = %d\n",
++		 tag->t2.ibf_data_bw, tag->t2.ibf_nc, tag->t2.ibf_nr);
++	dev_info(dev->mt76.dev, "Desired RU Allocation = %d\n", tag->t2.ibf_ru);
++	dev_info(dev->mt76.dev, "Mobility DeltaT = %d, Mobility LQ = %d\n",
++		 tag->t2.mob_delta_t, tag->t2.mob_lq_result);
++	dev_info(dev->mt76.dev, "=============================================================\n");
++}
++
++static void mt7915_txbf_dump_sta_rec(struct mt7915_dev *dev, struct sta_rec_bf *sta_info)
++{
++	dev_info(dev->mt76.dev, "===================== BF Station Record =====================\n");
++	dev_info(dev->mt76.dev, "pfmu           = %d\n", sta_info->pfmu);
++	dev_info(dev->mt76.dev, "su_mu          = %d\n", sta_info->su_mu);
++	dev_info(dev->mt76.dev, "bf_cap         = %d\n", sta_info->bf_cap);
++	dev_info(dev->mt76.dev, "sounding_phy   = %d\n", sta_info->sounding_phy);
++	dev_info(dev->mt76.dev, "ndpa_rate      = %d\n", sta_info->ndpa_rate);
++	dev_info(dev->mt76.dev, "ndp_rate       = %d\n", sta_info->ndp_rate);
++	dev_info(dev->mt76.dev, "rept_poll_rate = %d\n", sta_info->rept_poll_rate);
++	dev_info(dev->mt76.dev, "tx_mode        = %d\n", sta_info->tx_mode);
++	dev_info(dev->mt76.dev, "ncol           = %d\n", sta_info->ncol);
++	dev_info(dev->mt76.dev, "nrow           = %d\n", sta_info->nrow);
++	dev_info(dev->mt76.dev, "bw             = %d\n", sta_info->bw);
++	dev_info(dev->mt76.dev, "mem_total      = %d\n", sta_info->mem_total);
++	dev_info(dev->mt76.dev, "mem_20m        = %d\n", sta_info->mem_20m);
++	dev_info(dev->mt76.dev, "mem_row0       = %d\n", sta_info->mem[0].row);
++	dev_info(dev->mt76.dev, "mem_col0       = %d\n", sta_info->mem[0].col);
++	dev_info(dev->mt76.dev, "mem_row1       = %d\n", sta_info->mem[1].row);
++	dev_info(dev->mt76.dev, "mem_col1       = %d\n", sta_info->mem[1].col);
++	dev_info(dev->mt76.dev, "mem_row2       = %d\n", sta_info->mem[2].row);
++	dev_info(dev->mt76.dev, "mem_col2       = %d\n", sta_info->mem[2].col);
++	dev_info(dev->mt76.dev, "mem_row3       = %d\n", sta_info->mem[3].row);
++	dev_info(dev->mt76.dev, "mem_col3       = %d\n", sta_info->mem[3].col);
++	dev_info(dev->mt76.dev, "smart_ant      = 0x%x\n", sta_info->smart_ant);
++	dev_info(dev->mt76.dev, "se_idx         = %d\n", sta_info->se_idx);
++	dev_info(dev->mt76.dev, "auto_sounding  = %d\n", sta_info->auto_sounding);
++	dev_info(dev->mt76.dev, "ibf_timeout    = 0x%x\n", sta_info->ibf_timeout);
++	dev_info(dev->mt76.dev, "ibf_dbw        = %d\n", sta_info->ibf_dbw);
++	dev_info(dev->mt76.dev, "ibf_ncol       = %d\n", sta_info->ibf_ncol);
++	dev_info(dev->mt76.dev, "ibf_nrow       = %d\n", sta_info->ibf_nrow);
++	dev_info(dev->mt76.dev, "nrow_gt_bw80   = %d\n", sta_info->nrow_gt_bw80);
++	dev_info(dev->mt76.dev, "ncol_gt_bw80   = %d\n", sta_info->ncol_gt_bw80);
++	dev_info(dev->mt76.dev, "ru_start_idx   = %d\n", sta_info->ru_start_idx);
++	dev_info(dev->mt76.dev, "trigger_su     = %d\n", sta_info->trigger_su);
++	dev_info(dev->mt76.dev, "trigger_mu     = %d\n", sta_info->trigger_mu);
++	dev_info(dev->mt76.dev, "ng16_su        = %d\n", sta_info->ng16_su);
++	dev_info(dev->mt76.dev, "ng16_mu        = %d\n", sta_info->ng16_mu);
++	dev_info(dev->mt76.dev, "codebook42_su  = %d\n", sta_info->codebook42_su);
++	dev_info(dev->mt76.dev, "codebook75_mu  = %d\n", sta_info->codebook75_mu);
++	dev_info(dev->mt76.dev, "he_ltf         = %d\n", sta_info->he_ltf);
++	dev_info(dev->mt76.dev, "=============================================================\n");
++}
++
++static void mt7915_txbf_dump_cal_phase(struct mt7915_dev *dev,
++				       struct mt7915_txbf_phase *phase, int group)
++{
++	dev_info(dev->mt76.dev, "Group %d and Group M\n", group);
++	dev_info(dev->mt76.dev, "m_t0_h = %d\n", phase->phase.m_t0_h);
++	dev_info(dev->mt76.dev, "m_t1_h = %d\n", phase->phase.m_t1_h);
++	dev_info(dev->mt76.dev, "m_t2_h = %d\n", phase->phase.m_t2_h);
++
++	dev_info(dev->mt76.dev, "r0_uh = %d\n", phase->phase.r0_uh);
++	dev_info(dev->mt76.dev, "r0_h = %d\n", phase->phase.r0_h);
++	dev_info(dev->mt76.dev, "r0_m = %d\n", phase->phase.r0_m);
++	dev_info(dev->mt76.dev, "r0_l = %d\n", phase->phase.r0_l);
++
++	dev_info(dev->mt76.dev, "r1_uh = %d\n", phase->phase.r1_uh);
++	dev_info(dev->mt76.dev, "r1_h = %d\n", phase->phase.r1_h);
++	dev_info(dev->mt76.dev, "r1_m = %d\n", phase->phase.r1_m);
++	dev_info(dev->mt76.dev, "r1_l = %d\n", phase->phase.r1_l);
++
++	dev_info(dev->mt76.dev, "r2_uh = %d\n", phase->phase.r2_uh);
++	dev_info(dev->mt76.dev, "r2_h = %d\n", phase->phase.r2_h);
++	dev_info(dev->mt76.dev, "r2_m = %d\n", phase->phase.r2_m);
++	dev_info(dev->mt76.dev, "r2_l = %d\n", phase->phase.r2_l);
++
++	dev_info(dev->mt76.dev, "r3_uh = %d\n", phase->phase.r3_uh);
++	dev_info(dev->mt76.dev, "r3_h = %d\n", phase->phase.r3_h);
++	dev_info(dev->mt76.dev, "r3_m = %d\n", phase->phase.r3_m);
++	dev_info(dev->mt76.dev, "r3_l = %d\n", phase->phase.r3_l);
++	dev_info(dev->mt76.dev, "r3_ul = %d\n", phase->phase.r3_ul);
++}
++
++int mt7915_mcu_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb)
++{
++#define BF_PFMU_TAG	16
++#define BF_STA_REC	20
++#define BF_CAL_PHASE	21
++#define GROUP_M		1
++	u8 format_id;
++
++	skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
++	format_id = *(u8 *)skb->data;
++
++	if (format_id == BF_PFMU_TAG) {
++		struct mt7915_pfmu_tag *pfmu_tag;
++
++		skb_pull(skb, 8);
++		pfmu_tag = (struct mt7915_pfmu_tag *)skb->data;
++		mt7915_txbf_dump_pfmu_tag(dev, pfmu_tag);
++		if (dev->test.txbf_pfmu_tag)
++			memcpy(dev->test.txbf_pfmu_tag, pfmu_tag, sizeof(struct mt7915_pfmu_tag));
++	} else if (format_id == BF_STA_REC) {
++		struct sta_rec_bf *sta_rec;
++
++		skb_pull(skb, sizeof(struct mt7915_bf_status_hdr));
++		/* padding 4 byte since bf_status->buf does not contain tag & len */
++		skb_push(skb, 4);
++		sta_rec = (struct sta_rec_bf *)skb->data;
++
++		mt7915_txbf_dump_sta_rec(dev, sta_rec);
++	} else if (format_id == BF_CAL_PHASE) {
++		u8 phase_out_len = sizeof(struct mt7915_txbf_phase_out);
++		struct mt7915_ibf_cal_info *cal;
++		struct mt7915_txbf_phase_out phase_out;
++		struct mt7915_txbf_phase *phase =
++			(struct mt7915_txbf_phase *)dev->test.txbf_phase_cal;
++
++		cal = (struct mt7915_ibf_cal_info *)skb->data;
++		memcpy(&phase_out, cal->buf, phase_out_len);
++		switch (cal->cal_type) {
++		case IBF_PHASE_CAL_NORMAL:
++		case IBF_PHASE_CAL_NORMAL_INSTRUMENT:
++			/* Only calibrate group M */
++			if (cal->group_l_m_n != GROUP_M)
++				break;
++			phase = &phase[cal->group];
++			memcpy(&phase->phase, cal->buf + phase_out_len, sizeof(phase->phase));
++			phase->status = cal->status;
++
++			dev_info(dev->mt76.dev, "Calibrated result = %d\n", phase->status);
++			mt7915_txbf_dump_cal_phase(dev, phase, cal->group);
++			break;
++		case IBF_PHASE_CAL_VERIFY:
++		case IBF_PHASE_CAL_VERIFY_INSTRUMENT:
++			dev_info(dev->mt76.dev, "Verification result = %d\n", cal->status);
++			break;
++		default:
++			break;
++		}
++
++		dev_info(dev->mt76.dev, "c0_h = %d, c1_h = %d, c2_h = %d\n",
++			 phase_out.c0_h, phase_out.c1_h, phase_out.c2_h);
++		dev_info(dev->mt76.dev, "c0_m = %d, c1_m = %d, c2_m = %d\n",
++			 phase_out.c0_m, phase_out.c1_m, phase_out.c2_m);
++		dev_info(dev->mt76.dev, "c0_l = %d, c1_l = %d, c2_l = %d\n",
++			 phase_out.c0_l, phase_out.c1_l, phase_out.c2_l);
++		dev_info(dev->mt76.dev, "c3_m = %d, c3_h = %d\n", phase_out.c3_m, phase_out.c3_h);
++	}
++
++	wake_up(&dev->mt76.tx_wait);
++
++	return 0;
++}
++
++int mt7915_mcu_txbf_profile_tag_read(struct mt7915_phy *phy, u8 pfmu_idx, bool bfer)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		u8 format_id;
++		u8 pfmu_idx;
++		bool bfer;
++		u8 dbdc_idx;
++	} __packed req = {
++		.format_id = MT_BF_PFMU_TAG_READ,
++		.pfmu_idx = pfmu_idx,
++		.bfer = bfer,
++		.dbdc_idx = phy->mt76->band_idx,
++	};
++	struct mt7915_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
++
++	/* Reset to 0 for mt7915_tm_txbf_profile_tag_write wait_event */
++	tag->t1.pfmu_idx = 0;
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
++				 sizeof(req), true);
++}
++
++int mt7915_mcu_txbf_sta_rec_read(struct mt7915_dev *dev, u16 wlan_idx)
++{
++	struct {
++		u8 action;
++		u8 wlan_idx_lo;
++		u8 wlan_idx_hi;
++		u8 rsv[5];
++	} __packed req = {
++		.action = MT_BF_STA_REC_READ,
++		.wlan_idx_lo = to_wcid_lo(wlan_idx),
++		.wlan_idx_hi = to_wcid_hi(wlan_idx),
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
++				 sizeof(req), true);
++}
++#endif
+diff --git a/mt7915/regs.h b/mt7915/regs.h
+index f4b5709..007fd4d 100644
+--- a/mt7915/regs.h
++++ b/mt7915/regs.h
+@@ -61,6 +61,7 @@ enum offs_rev {
+ 	MDP_BNRCFR1,
+ 	ARB_DRNGR0,
+ 	ARB_SCR,
++	ARB_TQSAXM0,
+ 	RMAC_MIB_AIRTIME14,
+ 	AGG_AALCR0,
+ 	AGG_AWSCR0,
+@@ -530,6 +531,9 @@ enum offs_rev {
+ #define MT_ARB_DRNGR0(_band, _n)	MT_WF_ARB(_band, (__OFFS(ARB_DRNGR0) +	\
+ 							  (_n) * 4))
+ 
++#define MT_ARB_TQSAXM0(_band)		MT_WF_ARB(_band, __OFFS(ARB_TQSAXM0))
++#define MT_ARB_TQSAXM_ALTX_START_MASK	GENMASK(12, 8)
++
+ /* RMAC: band 0(0x820e5000), band 1(0x820f5000) */
+ #define MT_WF_RMAC_BASE(_band)		((_band) ? 0x820f5000 : 0x820e5000)
+ #define MT_WF_RMAC(_band, ofs)		(MT_WF_RMAC_BASE(_band) + (ofs))
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index 2ae6c07..70382b9 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -53,6 +53,8 @@ struct reg_band {
+ static struct reg_band reg_backup_list[TM_REG_MAX_ID];
+ 
+ static void mt7915_tm_update_entry(struct mt7915_phy *phy);
++static int mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode, bool bf_sounding);
++static int mt7915_tm_txbf_set_rate(struct mt7915_phy *phy, struct mt76_wcid *wcid);
+ 
+ static u8 mt7915_tm_chan_bw(enum nl80211_chan_width width)
+ {
+@@ -73,6 +75,25 @@ static u8 mt7915_tm_chan_bw(enum nl80211_chan_width width)
+ 	return width_to_bw[width];
+ }
+ 
++static u8 mt7915_tm_rate_to_phy(u8 tx_rate_mode)
++{
++	static const u8 rate_to_phy[] = {
++		[MT76_TM_TX_MODE_CCK] = MT_PHY_TYPE_CCK,
++		[MT76_TM_TX_MODE_OFDM] = MT_PHY_TYPE_OFDM,
++		[MT76_TM_TX_MODE_HT] = MT_PHY_TYPE_HT,
++		[MT76_TM_TX_MODE_VHT] = MT_PHY_TYPE_VHT,
++		[MT76_TM_TX_MODE_HE_SU] = MT_PHY_TYPE_HE_SU,
++		[MT76_TM_TX_MODE_HE_EXT_SU] = MT_PHY_TYPE_HE_EXT_SU,
++		[MT76_TM_TX_MODE_HE_TB] = MT_PHY_TYPE_HE_TB,
++		[MT76_TM_TX_MODE_HE_MU] = MT_PHY_TYPE_HE_MU,
++	};
++
++	if (tx_rate_mode > MT76_TM_TX_MODE_MAX)
++		return -EINVAL;
++
++	return rate_to_phy[tx_rate_mode];
++}
++
+ static void
+ mt7915_tm_update_channel(struct mt7915_phy *phy)
+ {
+@@ -273,17 +294,33 @@ mt7915_tm_add_txbf(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
+ 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
+ 	struct mt7915_dev *dev = phy->dev;
++	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	struct sk_buff *skb;
+ 	struct sta_rec_bf *bf;
+ 	struct tlv *tlv;
+-	u8 ndp_rate;
++	u8 ndp_rate, ndpa_rate, rept_poll_rate, bf_bw;
++
++	if (td->tx_rate_mode == MT76_TM_TX_MODE_HE_SU) {
++		rept_poll_rate = 0x49;
++		ndpa_rate = 0x49;
++		ndp_rate = 0;
++	} else if (td->tx_rate_mode == MT76_TM_TX_MODE_VHT) {
++		rept_poll_rate = 0x9;
++		ndpa_rate = 0x9;
++		ndp_rate = 0;
++	} else {
++		rept_poll_rate = 0;
++		ndpa_rate = 0;
++		if (nr == 1)
++			ndp_rate = 8;
++		else if (nr == 2)
++			ndp_rate = 16;
++		else
++			ndp_rate = 24;
++	}
+ 
+-	if (nr == 1)
+-		ndp_rate = 8;
+-	else if (nr == 2)
+-		ndp_rate = 16;
+-	else
+-		ndp_rate = 24;
++	/* TODO: check 160Hz */
++	bf_bw = mt7915_tm_chan_bw(phy->mt76->chandef.width);
+ 
+ 	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
+ 					    &msta->wcid);
+@@ -299,8 +336,11 @@ mt7915_tm_add_txbf(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+ 	bf->ncol = nc;
+ 	bf->nrow = nr;
+ 	bf->ndp_rate = ndp_rate;
++	bf->ndpa_rate = ndpa_rate;
++	bf->rept_poll_rate = rept_poll_rate;
++	bf->bw = bf_bw;
+ 	bf->ibf_timeout = 0xff;
+-	bf->tx_mode = MT_PHY_TYPE_HT;
++	bf->tx_mode = mt7915_tm_rate_to_phy(td->tx_rate_mode);
+ 
+ 	if (ebf) {
+ 		bf->mem[0].row = 0;
+@@ -353,11 +393,8 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
+ 	}
+ 
+ 	memcpy(sta->addr, ed->addr[0], ETH_ALEN);
+-	if (phy->test.bf_en) {
+-		u8 addr[ETH_ALEN] = {0x00, 0x11, 0x11, 0x11, 0x11, 0x11};
+-
+-		memcpy(sta->addr, addr, ETH_ALEN);
+-	}
++	if (td->bf_en)
++		memcpy(sta->addr, td->addr[0], ETH_ALEN);
+ 
+ 	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HT)
+ 		memcpy(&sta->deflink.ht_cap, &sband->ht_cap, sizeof(sta->deflink.ht_cap));
+@@ -382,6 +419,14 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
+ 	list_add_tail(&msta->wcid.list, &td->tm_entry_list);
+ 	td->entry_num++;
+ 
++	mt7915_mcu_add_bss_info(phy, phy->monitor_vif, true);
++
++	if (td->bf_en) {
++		mt7915_tm_set_ipg_params(phy, td->tx_ipg, td->tx_rate_mode, true);
++		mt7915_tm_set_tam_arb(phy, td->bf_en, 0);
++		mt7915_tm_txbf_set_rate(phy, &msta->wcid);
++	}
++
+ 	return 0;
+ }
+ 
+@@ -451,7 +496,7 @@ mt7915_tm_update_entry(struct mt7915_phy *phy)
+ 	struct mt76_testmode_entry_data *ed, tmp;
+ 	struct mt76_wcid *wcid, *last;
+ 
+-	if (!td->aid || phy->test.bf_en)
++	if (!td->aid || td->bf_en)
+ 		return;
+ 
+ 	memcpy(&tmp, &td->ed, sizeof(tmp));
+@@ -472,20 +517,30 @@ mt7915_tm_update_entry(struct mt7915_phy *phy)
+ static int
+ mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
+ {
++#define EBF_BBP_RX_OFFSET	0x10280
++#define EBF_BBP_RX_ENABLE	(BIT(0) | BIT(15))
++#define WF1			BIT(1)
++#define WF2			BIT(2)
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	struct mt7915_dev *dev = phy->dev;
++	struct mt76_phy *mphy = phy->mt76;
+ 	bool enable = val[0];
+ 	void *phase_cal, *pfmu_data, *pfmu_tag;
+-	u8 addr[ETH_ALEN] = {0x00, 0x22, 0x22, 0x22, 0x22, 0x22};
++	u8 sub_addr = td->is_txbf_dut ? TXBF_DUT_MAC_SUBADDR : TXBF_GOLDEN_MAC_SUBADDR;
++	u8 peer_addr = td->is_txbf_dut ? TXBF_GOLDEN_MAC_SUBADDR : TXBF_DUT_MAC_SUBADDR;
++	u8 bss_addr = TXBF_DUT_MAC_SUBADDR;
++	u8 addr[ETH_ALEN] = {0x00, sub_addr, sub_addr, sub_addr, sub_addr, sub_addr};
++	u8 bssid[ETH_ALEN] = {0x00, bss_addr, bss_addr, bss_addr, bss_addr, bss_addr};
++	u8 peer_addrs[ETH_ALEN] = {0x00, peer_addr, peer_addr, peer_addr, peer_addr, peer_addr};
+ 
+ 	if (!enable) {
+-		phy->test.bf_en = 0;
++		td->bf_en = 0;
+ 		return 0;
+ 	}
+ 
+ 	if (!dev->test.txbf_phase_cal) {
+ 		phase_cal = devm_kzalloc(dev->mt76.dev,
+-					 sizeof(struct mt7915_tm_txbf_phase) *
++					 sizeof(struct mt7915_txbf_phase) *
+ 					 MAX_PHASE_GROUP_NUM,
+ 					 GFP_KERNEL);
+ 		if (!phase_cal)
+@@ -495,7 +550,10 @@ mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
+ 	}
+ 
+ 	if (!dev->test.txbf_pfmu_data) {
+-		pfmu_data = devm_kzalloc(dev->mt76.dev, 512, GFP_KERNEL);
++		pfmu_data = devm_kzalloc(dev->mt76.dev,
++					 sizeof(struct mt7915_pfmu_data) *
++					 MT7915_TXBF_SUBCAR_NUM,
++					 GFP_KERNEL);
+ 		if (!pfmu_data)
+ 			return -ENOMEM;
+ 
+@@ -504,21 +562,77 @@ mt7915_tm_txbf_init(struct mt7915_phy *phy, u16 *val)
+ 
+ 	if (!dev->test.txbf_pfmu_tag) {
+ 		pfmu_tag = devm_kzalloc(dev->mt76.dev,
+-					sizeof(struct mt7915_tm_pfmu_tag), GFP_KERNEL);
++					sizeof(struct mt7915_pfmu_tag), GFP_KERNEL);
+ 		if (!pfmu_tag)
+ 			return -ENOMEM;
+ 
+ 		dev->test.txbf_pfmu_tag = pfmu_tag;
+ 	}
+ 
++	td->bf_en = 1;
++	memcpy(td->addr[0], peer_addrs, ETH_ALEN);
++	memcpy(td->addr[1], addr, ETH_ALEN);
++	memcpy(td->addr[2], bssid, ETH_ALEN);
+ 	memcpy(phy->monitor_vif->addr, addr, ETH_ALEN);
+ 	mt7915_mcu_add_dev_info(phy, phy->monitor_vif, true);
+ 
+-	td->tx_rate_mode = MT76_TM_TX_MODE_HT;
+-	td->tx_mpdu_len = 1024;
+-	td->tx_rate_sgi = 0;
+-	td->tx_ipg = 100;
+-	phy->test.bf_en = 1;
++	/* Add second interface in wtbl for using TXCMD to transmit sounding */
++	td->second_vif = kzalloc(sizeof(*td->second_vif) + sizeof(struct mt7915_vif), GFP_KERNEL);
++	memcpy(td->second_vif, phy->monitor_vif, sizeof(*td->second_vif));
++	mt7915_init_vif(phy, td->second_vif, td->bf_en);
++
++	if (td->ebf && !td->is_txbf_dut) {
++		bool is_160hz = val[1];
++
++		/* Turn On BBP CR for RX */
++		mt76_set(dev, EBF_BBP_RX_OFFSET, EBF_BBP_RX_ENABLE);
++		dev_info(dev->mt76.dev, "Set BBP RX CR = %x\n", mt76_rr(dev, EBF_BBP_RX_OFFSET));
++
++		/* Set TX antenna mask of golden: default use WF0 only */
++		td->tx_antenna_mask = 1;
++		if (is_mt7915(&dev->mt76)) {
++			/* Add WF1/WF2 for dbdc/single band in BW 160 */
++			td->tx_antenna_mask |= is_160hz & (dev->dbdc_support ? WF1 : WF2);
++			/* Shift to WF2/WF3 for dbdc band 1 */
++			td->tx_antenna_mask <<= 2 * phy->mt76->band_idx;
++		}
++	} else if (td->ebf && td->is_txbf_dut) {
++		/* Enable ETxBF Capability */
++		dev->ibf = false;
++		mt7915_mcu_set_txbf(dev, MT_BF_TYPE_UPDATE);
++		/* Set TX antenna mask of DUT */
++		td->tx_antenna_mask = mphy->chainmask >> (dev->chainshift * phy->mt76->band_idx);
++		td->tx_spe_idx = phy->mt76->band_idx ? 25 : 24;
++		/* Shift to WF2/WF3 for dbdc band 1, Nss = 2 */
++		if ((hweight8(td->tx_antenna_mask) == 2) && phy->mt76->band_idx)
++			td->tx_antenna_mask <<= 2;
++	} else {
++		if (td->is_txbf_dut) {
++			int nss;
++
++			/* Enable ITxBF Capability */
++			dev->ibf = true;
++			mt7915_mcu_set_txbf(dev, MT_BF_TYPE_UPDATE);
++			td->tx_antenna_mask = mphy->chainmask >> (dev->chainshift *
++								  phy->mt76->band_idx);
++			nss = hweight8(td->tx_antenna_mask);
++			if (nss > 1 && nss <= 4)
++				td->tx_rate_idx = 15 + 8 * (nss - 2);
++			else
++				td->tx_rate_idx = 31;
++		} else {
++			td->tx_antenna_mask  = 1;
++			mt76_set(dev, EBF_BBP_RX_OFFSET, EBF_BBP_RX_ENABLE);
++			dev_info(dev->mt76.dev, "Set BBP RX CR = %x\n",
++				 mt76_rr(dev, EBF_BBP_RX_OFFSET));
++		}
++		td->tx_rate_mode = MT76_TM_TX_MODE_HT;
++		td->tx_mpdu_len = 1024;
++		td->tx_rate_sgi = 0;
++		td->tx_ipg = 100;
++	}
++
++	mt7915_mcu_add_bss_info(phy, phy->monitor_vif, true);
+ 
+ 	return mt7915_tm_set_trx(phy, TM_MAC_TX, true);
+ }
+@@ -545,8 +659,7 @@ mt7915_tm_txbf_phase_comp(struct mt7915_phy *phy, u16 *val)
+ 		.read_from_e2p = val[3],
+ 		.disable = val[4],
+ 	};
+-	struct mt7915_tm_txbf_phase *phase =
+-		(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
++	struct mt7915_txbf_phase *phase = (struct mt7915_txbf_phase *)dev->test.txbf_phase_cal;
+ 
+ 	wait_event_timeout(dev->mt76.tx_wait, phase[val[2]].status != 0, HZ);
+ 	memcpy(req.buf, &phase[val[2]].phase, sizeof(req.buf));
+@@ -559,32 +672,9 @@ mt7915_tm_txbf_phase_comp(struct mt7915_phy *phy, u16 *val)
+ 				 sizeof(req), true);
+ }
+ 
+-static int
+-mt7915_tm_txbf_profile_tag_read(struct mt7915_phy *phy, u8 pfmu_idx)
+-{
+-	struct mt7915_dev *dev = phy->dev;
+-	struct {
+-		u8 format_id;
+-		u8 pfmu_idx;
+-		bool bfer;
+-		u8 dbdc_idx;
+-	} __packed req = {
+-		.format_id = MT_BF_PFMU_TAG_READ,
+-		.pfmu_idx = pfmu_idx,
+-		.bfer = 1,
+-		.dbdc_idx = phy != &dev->phy,
+-	};
+-	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
+-
+-	tag->t1.pfmu_idx = 0;
+-
+-	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
+-				 sizeof(req), true);
+-}
+-
+ static int
+ mt7915_tm_txbf_profile_tag_write(struct mt7915_phy *phy, u8 pfmu_idx,
+-				 struct mt7915_tm_pfmu_tag *tag)
++				 struct mt7915_pfmu_tag *tag)
+ {
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct {
+@@ -611,8 +701,6 @@ static int
+ mt7915_tm_txbf_apply_tx(struct mt7915_phy *phy, u16 wlan_idx, bool ebf,
+ 			bool ibf, bool phase_cal)
+ {
+-#define to_wcid_lo(id)			FIELD_GET(GENMASK(7, 0), (u16)id)
+-#define to_wcid_hi(id)			FIELD_GET(GENMASK(9, 8), (u16)id)
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct {
+ 		u8 category;
+@@ -641,14 +729,15 @@ static int mt7915_tm_txbf_set_rate(struct mt7915_phy *phy,
+ {
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct mt76_testmode_entry_data *ed = mt76_testmode_entry_data(phy->mt76, wcid);
++	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	struct ieee80211_sta *sta = wcid_to_sta(wcid);
+ 	struct sta_phy rate = {};
+ 
+ 	if (!sta)
+ 		return 0;
+ 
+-	rate.type = MT_PHY_TYPE_HT;
+-	rate.bw = mt7915_tm_chan_bw(phy->mt76->chandef.width);
++	rate.type = mt7915_tm_rate_to_phy(td->tx_rate_mode);
++	rate.bw = mt7915_tm_chan_bw(phy->mt76->chandef.width);		/* TODO: check 160Hz */
+ 	rate.nss = ed->tx_rate_nss;
+ 	rate.mcs = ed->tx_rate_idx;
+ 	rate.ldpc = (rate.bw || ed->tx_rate_ldpc) * GENMASK(2, 0);
+@@ -662,13 +751,14 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
+ {
+ 	bool bf_on = val[0], update = val[3];
+ 	/* u16 wlan_idx = val[2]; */
+-	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
++	struct mt7915_dev *dev = phy->dev;
++	struct mt7915_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	struct mt76_wcid *wcid;
+ 
+ 	if (bf_on) {
+ 		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
+-		mt7915_tm_txbf_profile_tag_read(phy, 2);
++		mt7915_mcu_txbf_profile_tag_read(phy, 2, true);
+ 		tag->t1.invalid_prof = false;
+ 		mt7915_tm_txbf_profile_tag_write(phy, 2, tag);
+ 
+@@ -683,7 +773,7 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
+ 		} else {
+ 			phy->test.bf_ever_en = false;
+ 
+-			mt7915_tm_txbf_profile_tag_read(phy, 2);
++			mt7915_mcu_txbf_profile_tag_read(phy, 2, true);
+ 			tag->t1.invalid_prof = true;
+ 			mt7915_tm_txbf_profile_tag_write(phy, 2, tag);
+ 		}
+@@ -698,6 +788,7 @@ mt7915_tm_txbf_set_tx(struct mt7915_phy *phy, u16 *val)
+ static int
+ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+ {
++#define MT_ARB_IBF_ENABLE	(BIT(0) | GENMASK(9, 8))
+ 	static const u8 mode_to_lm[] = {
+ 		[MT76_TM_TX_MODE_CCK] = 0,
+ 		[MT76_TM_TX_MODE_OFDM] = 0,
+@@ -711,7 +802,8 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	struct mt76_wcid *wcid;
+ 	struct ieee80211_vif *vif = phy->monitor_vif;
+-	struct mt7915_tm_pfmu_tag *tag = phy->dev->test.txbf_pfmu_tag;
++	struct mt7915_dev *dev = phy->dev;
++	struct mt7915_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
+ 	u8 pfmu_idx = val[0], nc = val[2], nr;
+ 	bool is_atenl = val[6];
+ 	int ret;
+@@ -729,11 +821,15 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+ 	tag->t1.nr = nr;
+ 	tag->t1.nc = nc;
+ 	tag->t1.invalid_prof = true;
+-
+-	tag->t1.snr_sts4 = 0xc0;
+-	tag->t1.snr_sts5 = 0xff;
+-	tag->t1.snr_sts6 = 0xff;
+-	tag->t1.snr_sts7 = 0xff;
++	tag->t1.data_bw = mt7915_tm_chan_bw(phy->mt76->chandef.width); /* TODO: check 160Hz */
++	tag->t2.se_idx = td->tx_spe_idx;
++
++	if (is_atenl) {
++		tag->t1.snr_sts4 = 0xc0;
++		tag->t1.snr_sts5 = 0xff;
++		tag->t1.snr_sts6 = 0xff;
++		tag->t1.snr_sts7 = 0xff;
++	}
+ 
+ 	if (ebf) {
+ 		tag->t1.row_id1 = 0;
+@@ -761,6 +857,19 @@ mt7915_tm_txbf_profile_update(struct mt7915_phy *phy, u16 *val, bool ebf)
+ 	if (ret)
+ 		return ret;
+ 
++	if (td->ebf) {
++		mt76_set(dev, MT_ARB_TQSAXM0(phy->mt76->band_idx), MT_ARB_TQSAXM_ALTX_START_MASK);
++		dev_info(dev->mt76.dev, "Set TX queue start CR for AX management (0x%x) = 0x%x\n",
++			 MT_ARB_TQSAXM0(phy->mt76->band_idx),
++			 mt76_rr(dev, MT_ARB_TQSAXM0(phy->mt76->band_idx)));
++	} else if (!td->ebf && ebf) {
++		/* iBF's ebf profile update */
++		mt76_set(dev, MT_ARB_TQSAXM0(phy->mt76->band_idx), MT_ARB_IBF_ENABLE);
++		dev_info(dev->mt76.dev, "Set TX queue start CR for AX management (0x%x) = 0x%x\n",
++			 MT_ARB_TQSAXM0(phy->mt76->band_idx),
++			 mt76_rr(dev, MT_ARB_TQSAXM0(phy->mt76->band_idx)));
++	}
++
+ 	if (!ebf && is_atenl)
+ 		return mt7915_tm_txbf_apply_tx(phy, 1, false, true, true);
+ 
+@@ -778,7 +887,7 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
+ 		u8 category;
+ 		u8 group_l_m_n;
+ 		u8 group;
+-		bool sx2;
++		bool dbdc_idx;
+ 		u8 cal_type;
+ 		u8 lna_gain_level;
+ 		u8 _rsv[2];
+@@ -786,12 +895,12 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
+ 		.category = MT_BF_PHASE_CAL,
+ 		.group = val[0],
+ 		.group_l_m_n = val[1],
+-		.sx2 = val[2],
++		.dbdc_idx = phy->mt76->band_idx,
+ 		.cal_type = val[3],
+ 		.lna_gain_level = val[4],
+ 	};
+-	struct mt7915_tm_txbf_phase *phase =
+-		(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
++	struct mt7915_txbf_phase *phase =
++		(struct mt7915_txbf_phase *)dev->test.txbf_phase_cal;
+ 
+ 	phase[req.group].status = 0;
+ 
+@@ -799,53 +908,10 @@ mt7915_tm_txbf_phase_cal(struct mt7915_phy *phy, u16 *val)
+ 				 sizeof(req), true);
+ }
+ 
+-int mt7915_tm_txbf_status_read(struct mt7915_dev *dev, struct sk_buff *skb)
+-{
+-#define BF_PFMU_TAG	16
+-#define BF_CAL_PHASE	21
+-	u8 format_id;
+-
+-	skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
+-	format_id = *(u8 *)skb->data;
+-
+-	if (format_id == BF_PFMU_TAG) {
+-		struct mt7915_tm_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
+-
+-		skb_pull(skb, 8);
+-		memcpy(tag, skb->data, sizeof(struct mt7915_tm_pfmu_tag));
+-	} else if (format_id == BF_CAL_PHASE) {
+-		struct mt7915_tm_ibf_cal_info *cal;
+-		struct mt7915_tm_txbf_phase *phase =
+-			(struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
+-
+-		cal = (struct mt7915_tm_ibf_cal_info *)skb->data;
+-		switch (cal->cal_type) {
+-		case IBF_PHASE_CAL_NORMAL:
+-		case IBF_PHASE_CAL_NORMAL_INSTRUMENT:
+-			if (cal->group_l_m_n != GROUP_M)
+-				break;
+-			phase = &phase[cal->group];
+-			memcpy(&phase->phase, cal->buf + 16, sizeof(phase->phase));
+-			phase->status = cal->status;
+-			/* for passing iTest script */
+-			dev_info(dev->mt76.dev, "Calibrated result = %d\n", phase->status);
+-			break;
+-		case IBF_PHASE_CAL_VERIFY:
+-		case IBF_PHASE_CAL_VERIFY_INSTRUMENT:
+-			break;
+-		default:
+-			break;
+-		}
+-	}
+-
+-	wake_up(&dev->mt76.tx_wait);
+-
+-	return 0;
+-}
+-
+ static int
+ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+ {
++#define MT7915_TXBF_PFMU_DATA_LEN	(MT7915_TXBF_SUBCAR_NUM * sizeof(struct mt7915_pfmu_data))
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	u16 pfmu_idx = val[0];
+ 	u16 subc_id = val[1];
+@@ -854,9 +920,9 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+ 	u16 angle31 = val[4];
+ 	u16 angle41 = val[5];
+ 	s16 phi11 = 0, phi21 = 0, phi31 = 0;
+-	struct mt7915_tm_pfmu_data *pfmu_data;
++	struct mt7915_pfmu_data *pfmu_data;
+ 
+-	if (subc_id > 63)
++	if (subc_id > MT7915_TXBF_SUBCAR_NUM - 1)
+ 		return -EINVAL;
+ 
+ 	if (td->tx_antenna_mask == 2) {
+@@ -870,7 +936,7 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+ 		phi31 = (s16)(angle41 - angle31);
+ 	}
+ 
+-	pfmu_data = (struct mt7915_tm_pfmu_data *)phy->dev->test.txbf_pfmu_data;
++	pfmu_data = (struct mt7915_pfmu_data *)phy->dev->test.txbf_pfmu_data;
+ 	pfmu_data = &pfmu_data[subc_id];
+ 
+ 	if (subc_id < 32)
+@@ -880,21 +946,21 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+ 	pfmu_data->phi11 = cpu_to_le16(phi11);
+ 	pfmu_data->phi21 = cpu_to_le16(phi21);
+ 	pfmu_data->phi31 = cpu_to_le16(phi31);
+-	if (subc_id == 63) {
++	if (subc_id == MT7915_TXBF_SUBCAR_NUM - 1) {
+ 		struct mt7915_dev *dev = phy->dev;
+ 		struct {
+ 			u8 format_id;
+ 			u8 pfmu_idx;
+ 			u8 dbdc_idx;
+ 			u8 _rsv;
+-			u8 buf[512];
++			u8 buf[MT7915_TXBF_PFMU_DATA_LEN];
+ 		} __packed req = {
+ 			.format_id = MT_BF_PROFILE_WRITE_ALL,
+ 			.pfmu_idx = pfmu_idx,
+ 			.dbdc_idx = phy != &dev->phy,
+ 		};
+ 
+-		memcpy(req.buf, dev->test.txbf_pfmu_data, 512);
++		memcpy(req.buf, dev->test.txbf_pfmu_data, MT7915_TXBF_PFMU_DATA_LEN);
+ 
+ 		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION),
+ 					 &req, sizeof(req), true);
+@@ -906,7 +972,7 @@ mt7915_tm_txbf_profile_update_all(struct mt7915_phy *phy, u16 *val)
+ static int
+ mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
+ {
+-	struct mt7915_tm_txbf_phase *phase, *p;
++	struct mt7915_txbf_phase *phase, *p;
+ 	struct mt7915_dev *dev = phy->dev;
+ 	u8 *eeprom = dev->mt76.eeprom.data;
+ 	u16 offset;
+@@ -916,7 +982,7 @@ mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
+ 	is_7976 = mt7915_check_adie(dev, false) || is_mt7916(&dev->mt76);
+ 	offset = is_7976 ? 0x60a : 0x651;
+ 
+-	phase = (struct mt7915_tm_txbf_phase *)dev->test.txbf_phase_cal;
++	phase = (struct mt7915_txbf_phase *)dev->test.txbf_phase_cal;
+ 	for (i = 0; i < MAX_PHASE_GROUP_NUM; i++) {
+ 		p = &phase[i];
+ 
+@@ -931,17 +997,75 @@ mt7915_tm_txbf_e2p_update(struct mt7915_phy *phy)
+ 	return 0;
+ }
+ 
++static int
++mt7915_tm_trigger_sounding(struct mt7915_phy *phy, u16 *val, bool en)
++{
++	struct mt7915_dev *dev = phy->dev;
++	u8 sounding_mode = val[0];
++	u8 MU_num = val[1];
++	u32 sounding_interval = (u32)val[2] << 2;	/* input unit: 4ms */
++	enum sounding_mode {
++		SU_SOUNDING,
++		MU_SOUNDING,
++		SU_PERIODIC_SOUNDING,
++		MU_PERIODIC_SOUNDING,
++		BF_PROCESSING,
++		TXCMD_NONTB_SU_SOUNDING,
++		TXCMD_VHT_MU_SOUNDING,
++		TXCMD_TB_PER_BRP_SOUNDING,
++		TXCMD_TB_SOUNDING,
++
++		/* keep last */
++		NUM_SOUNDING_MODE,
++		SOUNDING_MODE_MAX = NUM_SOUNDING_MODE - 1,
++	};
++	struct {
++		u8 cmd_category_id;
++		u8 sounding_mode;
++		u8 MU_num;
++		u8 rsv;
++		u8 wlan_idx[4];
++		u32 sounding_interval;		/* unit: ms */
++	} __packed req = {
++		.cmd_category_id = en ? MT_BF_SOUNDING_ON : MT_BF_SOUNDING_OFF,
++		.sounding_mode = sounding_mode,
++		.MU_num = MU_num,
++		.sounding_interval = cpu_to_le32(sounding_interval),
++		.wlan_idx[0] = val[3],
++		.wlan_idx[1] = val[4],
++		.wlan_idx[2] = val[5],
++		.wlan_idx[3] = val[6],
++	};
++
++	if (sounding_mode > SOUNDING_MODE_MAX)
++		return -EINVAL;
++
++	/* Enable Tx MAC HW before trigger sounding */
++	if (en)
++		mt7915_tm_set_trx(phy, TM_MAC_TX, true);
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION),
++				 &req, sizeof(req), true);
++}
++
+ static int
+ mt7915_tm_set_txbf(struct mt7915_phy *phy)
+ {
++#define TXBF_IS_DUT_MASK	BIT(0)
++#define TXBF_EBF_MASK		BIT(1)
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+ 	u16 *val = td->txbf_param;
+ 
+-	pr_info("ibf cal process: act = %u, val = %u, %u, %u, %u, %u, %u\n",
+-		td->txbf_act, val[0], val[1], val[2], val[3], val[4], val[5]);
++	dev_info(phy->dev->mt76.dev, "ibf cal process: act = %u, val = %u, %u, %u, %u, %u, %u\n",
++		 td->txbf_act, val[0], val[1], val[2], val[3], val[4], val[5], val[6]);
+ 
+ 	switch (td->txbf_act) {
++	case MT76_TM_TXBF_ACT_GOLDEN_INIT:
+ 	case MT76_TM_TXBF_ACT_INIT:
++	case MT76_TM_TX_EBF_ACT_GOLDEN_INIT:
++	case MT76_TM_TX_EBF_ACT_INIT:
++		td->ebf = !!u32_get_bits(td->txbf_act, TXBF_EBF_MASK);
++		td->is_txbf_dut = !!u32_get_bits(td->txbf_act, TXBF_IS_DUT_MASK);
+ 		return mt7915_tm_txbf_init(phy, val);
+ 	case MT76_TM_TXBF_ACT_UPDATE_CH:
+ 		mt7915_tm_update_channel(phy);
+@@ -967,6 +1091,36 @@ mt7915_tm_set_txbf(struct mt7915_phy *phy)
+ 
+ 		return mt7915_tm_txbf_apply_tx(phy, wlan_idx, ebf, ibf, phase_cal);
+ 	}
++	case MT76_TM_TXBF_ACT_TRIGGER_SOUNDING:
++		return mt7915_tm_trigger_sounding(phy, val, true);
++	case MT76_TM_TXBF_ACT_STOP_SOUNDING:
++		memset(val, 0, sizeof(td->txbf_param));
++		return mt7915_tm_trigger_sounding(phy, val, false);
++	case MT76_TM_TXBF_ACT_PROFILE_TAG_READ:
++	case MT76_TM_TXBF_ACT_PROFILE_TAG_WRITE:
++	case MT76_TM_TXBF_ACT_PROFILE_TAG_INVALID: {
++		u8 pfmu_idx = val[0];
++		bool bfer = !!val[1];
++		struct mt7915_dev *dev = phy->dev;
++		struct mt7915_pfmu_tag *tag = dev->test.txbf_pfmu_tag;
++
++		if (!tag) {
++			dev_err(dev->mt76.dev,
++				"pfmu tag is not initialized!\n");
++			return 0;
++		}
++
++		if (td->txbf_act == MT76_TM_TXBF_ACT_PROFILE_TAG_WRITE)
++			return mt7915_tm_txbf_profile_tag_write(phy, pfmu_idx, tag);
++		else if (td->txbf_act == MT76_TM_TXBF_ACT_PROFILE_TAG_READ)
++			return mt7915_mcu_txbf_profile_tag_read(phy, pfmu_idx, bfer);
++
++		tag->t1.invalid_prof = !!val[0];
++
++		return 0;
++	}
++	case MT76_TM_TXBF_ACT_STA_REC_READ:
++		return mt7915_mcu_txbf_sta_rec_read(phy->dev, val[0]);
+ 	default:
+ 		break;
+ 	};
+@@ -1186,9 +1340,10 @@ mt7915_tm_set_ipi(struct mt7915_phy *phy)
+ 
+ static int
+ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
+-		      u16 cw_max, u16 txop, u8 tx_cmd)
++		      u16 cw_max, u16 txop, u8 tx_cmd, bool bf_sounding)
+ {
+-	struct mt7915_vif *mvif = (struct mt7915_vif *)phy->monitor_vif->drv_priv;
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7915_vif *mvif;
+ 	struct mt7915_mcu_tx req = {
+ 		.valid = true,
+ 		.mode = tx_cmd,
+@@ -1196,6 +1351,9 @@ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
+ 	};
+ 	struct edca *e = &req.edca[0];
+ 
++	mvif = bf_sounding ? (struct mt7915_vif *)td->second_vif->drv_priv :
++			     (struct mt7915_vif *)phy->monitor_vif->drv_priv;
++
+ 	e->queue = qid + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
+ 	e->set = WMM_PARAM_SET;
+ 
+@@ -1208,17 +1366,19 @@ mt7915_tm_set_wmm_qid(struct mt7915_phy *phy, u8 qid, u8 aifs, u8 cw_min,
+ }
+ 
+ static int
+-mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode)
++mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode, bool bf_sounding)
+ {
+ #define TM_DEFAULT_SIFS	10
+ #define TM_MAX_SIFS	127
+ #define TM_MAX_AIFSN	0xf
+ #define TM_MIN_AIFSN	0x1
+ #define BBP_PROC_TIME	1500
++#define TM_DEFAULT_CW	1
+ 	struct mt7915_dev *dev = phy->dev;
+ 	u8 sig_ext = (mode == MT76_TM_TX_MODE_CCK) ? 0 : 6;
+ 	u8 slot_time = 9, sifs = TM_DEFAULT_SIFS;
+ 	u8 aifsn = TM_MIN_AIFSN;
++	bool tx_cmd;
+ 	u8 band = phy->mt76->band_idx;
+ 	u32 i2t_time, tr2t_time, txv_time;
+ 	u16 cw = 0;
+@@ -1232,6 +1392,7 @@ mt7915_tm_set_ipg_params(struct mt7915_phy *phy, u32 ipg, u8 mode)
+ 	ipg -= sig_ext;
+ 
+ 	if (ipg <= (TM_MAX_SIFS + slot_time)) {
++		cw = TM_DEFAULT_CW;
+ 		sifs = ipg - slot_time;
+ 	} else {
+ 		u32 val = (ipg + slot_time) / slot_time;
+@@ -1267,10 +1428,12 @@ done:
+ 
+ 	mt7915_tm_set_slot_time(phy, slot_time, sifs);
+ 
++	/* HE MU data and iBF/eBF sounding packet use TXCMD */
++	tx_cmd = (mode == MT76_TM_TX_MODE_HE_MU) || bf_sounding;
++
+ 	return mt7915_tm_set_wmm_qid(phy,
+ 				     mt76_connac_lmac_mapping(IEEE80211_AC_BE),
+-				     aifsn, cw, cw, 0,
+-				     mode == MT76_TM_TX_MODE_HE_MU);
++				     aifsn, cw, cw, 0, tx_cmd, bf_sounding);
+ }
+ 
+ static int
+@@ -1469,7 +1632,7 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+ 
+ 		phy->mt76->test.aid = 0;
+ 		phy->mt76->test.tx_mpdu_len = 0;
+-		phy->test.bf_en = 0;
++		phy->mt76->test.bf_en = 0;
+ 		mt7915_tm_set_entry(phy);
+ 	} else {
+ 		INIT_DELAYED_WORK(&phy->ipi_work, mt7915_tm_ipi_work);
+@@ -1654,7 +1817,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ 		u32 tx_time = td->tx_time, ipg = td->tx_ipg;
+ 		u8 duty_cycle = td->tx_duty_cycle;
+ 
+-		if (!phy->test.bf_en)
++		if (!td->bf_en)
+ 			mt7915_tm_update_channel(phy);
+ 
+ 		if (td->tx_spe_idx)
+@@ -1669,7 +1832,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ 			if (duty_cycle < 100)
+ 				tx_time = duty_cycle * ipg / (100 - duty_cycle);
+ 		}
+-		mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode);
++		mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode, false);
+ 		mt7915_tm_set_tx_len(phy, tx_time);
+ 
+ 		if (ipg)
+@@ -1688,6 +1851,9 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ 		mt7915_tm_tx_frames_mu(phy, en);
+ 
+ 	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
++
++	if (td->bf_en)
++		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
+ }
+ 
+ static int
+@@ -1779,7 +1945,7 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+ 	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
+ 
+ 	if (en) {
+-		if (!phy->test.bf_en)
++		if (!td->bf_en || !td->is_txbf_dut)
+ 			mt7915_tm_update_channel(phy);
+ 		if (td->aid)
+ 			mt7915_tm_set_rx_user_idx(phy, td->aid);
+@@ -1796,6 +1962,9 @@ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+ 		mt7915_tm_set_muru_aid(phy, en ? td->aid : 0xf800);
+ 
+ 	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
++
++	if (td->bf_en)
++		mt7915_tm_set_trx(phy, TM_MAC_TX, en);
+ }
+ 
+ static int
+@@ -1855,34 +2024,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en)
+ 		rate_idx = sband->bitrates[idx].hw_value & 0xff;
+ 	}
+ 
+-	switch (td->tx_rate_mode) {
+-	case MT76_TM_TX_MODE_CCK:
+-		mode = MT_PHY_TYPE_CCK;
+-		break;
+-	case MT76_TM_TX_MODE_OFDM:
+-		mode = MT_PHY_TYPE_OFDM;
+-		break;
+-	case MT76_TM_TX_MODE_HT:
+-		mode = MT_PHY_TYPE_HT;
+-		break;
+-	case MT76_TM_TX_MODE_VHT:
+-		mode = MT_PHY_TYPE_VHT;
+-		break;
+-	case MT76_TM_TX_MODE_HE_SU:
+-		mode = MT_PHY_TYPE_HE_SU;
+-		break;
+-	case MT76_TM_TX_MODE_HE_EXT_SU:
+-		mode = MT_PHY_TYPE_HE_EXT_SU;
+-		break;
+-	case MT76_TM_TX_MODE_HE_TB:
+-		mode = MT_PHY_TYPE_HE_TB;
+-		break;
+-	case MT76_TM_TX_MODE_HE_MU:
+-		mode = MT_PHY_TYPE_HE_MU;
+-		break;
+-	default:
+-		return -EINVAL;
+-	}
++	mode = mt7915_tm_rate_to_phy(td->tx_rate_mode);
+ 
+ 	rateval =  mode << 6 | rate_idx;
+ 	tx_cont->rateval = cpu_to_le16(rateval);
+diff --git a/mt7915/testmode.h b/mt7915/testmode.h
+index d500987..1982369 100644
+--- a/mt7915/testmode.h
++++ b/mt7915/testmode.h
+@@ -311,137 +311,7 @@ struct mt7915_tm_muru {
+ 
+ #define MAX_PHASE_GROUP_NUM	9
+ 
+-struct mt7915_tm_txbf_phase {
+-	u8 status;
+-	struct {
+-		u8 r0_uh;
+-		u8 r0_h;
+-		u8 r0_m;
+-		u8 r0_l;
+-		u8 r0_ul;
+-		u8 r1_uh;
+-		u8 r1_h;
+-		u8 r1_m;
+-		u8 r1_l;
+-		u8 r1_ul;
+-		u8 r2_uh;
+-		u8 r2_h;
+-		u8 r2_m;
+-		u8 r2_l;
+-		u8 r2_ul;
+-		u8 r3_uh;
+-		u8 r3_h;
+-		u8 r3_m;
+-		u8 r3_l;
+-		u8 r3_ul;
+-		u8 r2_uh_sx2;
+-		u8 r2_h_sx2;
+-		u8 r2_m_sx2;
+-		u8 r2_l_sx2;
+-		u8 r2_ul_sx2;
+-		u8 r3_uh_sx2;
+-		u8 r3_h_sx2;
+-		u8 r3_m_sx2;
+-		u8 r3_l_sx2;
+-		u8 r3_ul_sx2;
+-		u8 m_t0_h;
+-		u8 m_t1_h;
+-		u8 m_t2_h;
+-		u8 m_t2_h_sx2;
+-		u8 r0_reserved;
+-		u8 r1_reserved;
+-		u8 r2_reserved;
+-		u8 r3_reserved;
+-		u8 r2_sx2_reserved;
+-		u8 r3_sx2_reserved;
+-	} phase;
+-};
+-
+-struct mt7915_tm_pfmu_tag1 {
+-	__le32 pfmu_idx:10;
+-	__le32 ebf:1;
+-	__le32 data_bw:2;
+-	__le32 lm:2;
+-	__le32 is_mu:1;
+-	__le32 nr:3, nc:3;
+-	__le32 codebook:2;
+-	__le32 ngroup:2;
+-	__le32 _rsv:2;
+-	__le32 invalid_prof:1;
+-	__le32 rmsd:3;
+-
+-	__le32 col_id1:6, row_id1:10;
+-	__le32 col_id2:6, row_id2:10;
+-	__le32 col_id3:6, row_id3:10;
+-	__le32 col_id4:6, row_id4:10;
+-
+-	__le32 ru_start_id:7;
+-	__le32 _rsv1:1;
+-	__le32 ru_end_id:7;
+-	__le32 _rsv2:1;
+-	__le32 mob_cal_en:1;
+-	__le32 _rsv3:15;
+-
+-	__le32 snr_sts0:8, snr_sts1:8, snr_sts2:8, snr_sts3:8;
+-	__le32 snr_sts4:8, snr_sts5:8, snr_sts6:8, snr_sts7:8;
+-
+-	__le32 _rsv4;
+-} __packed;
+-
+-struct mt7915_tm_pfmu_tag2 {
+-	__le32 smart_ant:24;
+-	__le32 se_idx:5;
+-	__le32 _rsv:3;
+-
+-	__le32 _rsv1:8;
+-	__le32 rmsd_thres:3;
+-	__le32 _rsv2:5;
+-	__le32 ibf_timeout:8;
+-	__le32 _rsv3:8;
+-
+-	__le32 _rsv4:16;
+-	__le32 ibf_data_bw:2;
+-	__le32 ibf_nc:3;
+-	__le32 ibf_nr:3;
+-	__le32 ibf_ru:8;
+-
+-	__le32 mob_delta_t:8;
+-	__le32 mob_lq_result:7;
+-	__le32 _rsv5:1;
+-	__le32 _rsv6:16;
+-
+-	__le32 _rsv7;
+-} __packed;
+-
+-struct mt7915_tm_pfmu_tag {
+-	struct mt7915_tm_pfmu_tag1 t1;
+-	struct mt7915_tm_pfmu_tag2 t2;
+-};
+-
+-struct mt7915_tm_pfmu_data {
+-	__le16 subc_idx;
+-	__le16 phi11;
+-	__le16 phi21;
+-	__le16 phi31;
+-};
+-
+-struct mt7915_tm_ibf_cal_info {
+-	u8 format_id;
+-	u8 group_l_m_n;
+-	u8 group;
+-	bool sx2;
+-	u8 status;
+-	u8 cal_type;
+-	u8 _rsv[2];
+-	u8 buf[1000];
+-} __packed;
+-
+-enum {
+-	IBF_PHASE_CAL_UNSPEC,
+-	IBF_PHASE_CAL_NORMAL,
+-	IBF_PHASE_CAL_VERIFY,
+-	IBF_PHASE_CAL_NORMAL_INSTRUMENT,
+-	IBF_PHASE_CAL_VERIFY_INSTRUMENT,
+-};
++#define TXBF_DUT_MAC_SUBADDR		0x22
++#define TXBF_GOLDEN_MAC_SUBADDR		0x11
+ 
+ #endif
+diff --git a/testmode.c b/testmode.c
+index b19b872..ed5ceee 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -191,6 +191,7 @@ mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len,
+ 
+ 	hdr = __skb_put_zero(head, sizeof(*hdr));
+ 	hdr->frame_control = cpu_to_le16(fc);
++
+ 	memcpy(hdr->addr1, addr[0], ETH_ALEN);
+ 	memcpy(hdr->addr2, addr[1], ETH_ALEN);
+ 	memcpy(hdr->addr3, addr[2], ETH_ALEN);
+diff --git a/testmode.h b/testmode.h
+index 27a0095..e1ebbd5 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -299,7 +299,10 @@ enum mt76_testmode_cfg {
+ };
+ 
+ enum mt76_testmode_txbf_act {
++	MT76_TM_TXBF_ACT_GOLDEN_INIT,
+ 	MT76_TM_TXBF_ACT_INIT,
++	MT76_TM_TX_EBF_ACT_GOLDEN_INIT,
++	MT76_TM_TX_EBF_ACT_INIT,
+ 	MT76_TM_TXBF_ACT_UPDATE_CH,
+ 	MT76_TM_TXBF_ACT_PHASE_COMP,
+ 	MT76_TM_TXBF_ACT_TX_PREP,
+@@ -310,6 +313,12 @@ enum mt76_testmode_txbf_act {
+ 	MT76_TM_TXBF_ACT_PROF_UPDATE_ALL,
+ 	MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD,
+ 	MT76_TM_TXBF_ACT_E2P_UPDATE,
++	MT76_TM_TXBF_ACT_TRIGGER_SOUNDING,
++	MT76_TM_TXBF_ACT_STOP_SOUNDING,
++	MT76_TM_TXBF_ACT_PROFILE_TAG_READ,
++	MT76_TM_TXBF_ACT_PROFILE_TAG_WRITE,
++	MT76_TM_TXBF_ACT_PROFILE_TAG_INVALID,
++	MT76_TM_TXBF_ACT_STA_REC_READ,
+ 
+ 	/* keep last */
+ 	NUM_MT76_TM_TXBF_ACT,
+diff --git a/tools/fields.c b/tools/fields.c
+index 6f07eed..7211ec5 100644
+--- a/tools/fields.c
++++ b/tools/fields.c
+@@ -33,7 +33,10 @@ static const char * const testmode_tx_mode[] = {
+ };
+ 
+ static const char * const testmode_txbf_act[] = {
++	[MT76_TM_TXBF_ACT_GOLDEN_INIT] = "golden_init",
+ 	[MT76_TM_TXBF_ACT_INIT] = "init",
++	[MT76_TM_TX_EBF_ACT_GOLDEN_INIT] = "ebf_golden_init",
++	[MT76_TM_TX_EBF_ACT_INIT] = "ebf_init",
+ 	[MT76_TM_TXBF_ACT_UPDATE_CH] = "update_ch",
+ 	[MT76_TM_TXBF_ACT_PHASE_COMP] = "phase_comp",
+ 	[MT76_TM_TXBF_ACT_TX_PREP] = "tx_prep",
+@@ -44,6 +47,12 @@ static const char * const testmode_txbf_act[] = {
+ 	[MT76_TM_TXBF_ACT_PROF_UPDATE_ALL] = "prof_update",
+ 	[MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD] = "prof_update_all",
+ 	[MT76_TM_TXBF_ACT_E2P_UPDATE] = "e2p_update",
++	[MT76_TM_TXBF_ACT_TRIGGER_SOUNDING] = "trigger_sounding",
++	[MT76_TM_TXBF_ACT_STOP_SOUNDING] = "stop_sounding",
++	[MT76_TM_TXBF_ACT_PROFILE_TAG_READ] = "pfmu_tag_read",
++	[MT76_TM_TXBF_ACT_PROFILE_TAG_WRITE] = "pfmu_tag_write",
++	[MT76_TM_TXBF_ACT_PROFILE_TAG_INVALID] = "set_invalid_prof",
++	[MT76_TM_TXBF_ACT_STA_REC_READ] = "sta_rec_read",
+ };
+ 
+ static const char * const testmode_offchan_bw[] = {
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1117-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
similarity index 70%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/1117-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
index b03d51e..0b559a2 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1116-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1117-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch
@@ -1,17 +1,17 @@
-From 10382082b0c8b43ed82fb908f7a91fe29520feb6 Mon Sep 17 00:00:00 2001
+From 739f8f70a5436610c3104d943a548acf2da2a6b0 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Sun, 24 Apr 2022 10:07:00 +0800
-Subject: [PATCH 1116/1130] mt76: mt7915: init rssi in WTBL when add station
+Subject: [PATCH 1117/1131] mt76: mt7915: init rssi in WTBL when add station
 
 ---
  mt7915/main.c | 4 ++++
  1 file changed, 4 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 4c3d822e..f1829cea 100644
+index a347e77..eae1377 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -682,6 +682,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -692,6 +692,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_phy *phy;
  #endif
  	int ret, idx;
@@ -19,7 +19,7 @@
  
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
  	if (idx < 0)
-@@ -705,6 +706,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -715,6 +716,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	if (ret)
  		return ret;
  
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1118-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
similarity index 75%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/1118-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
index bbb5f29..fc83b98 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1117-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1118-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch
@@ -1,7 +1,7 @@
-From 3dacb4c2ed33b7409a61a340f31ab62fc635d9e9 Mon Sep 17 00:00:00 2001
+From 7fce8f839fffb7e2128edb70ffae075f74f73f2e Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 4 Aug 2022 14:08:11 +0800
-Subject: [PATCH 1117/1130] mt76: mt7915: reduce TWT SP sent to FW for cert
+Subject: [PATCH 1118/1131] mt76: mt7915: reduce TWT SP sent to FW for cert
 
 Set TWT SP duration to 88 percent to prevent HW sends PPDU over TWT SP.
 
@@ -11,10 +11,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index b8243e10..49b72af9 100644
+index 5d41ebf..2d363c4 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3797,7 +3797,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3811,7 +3811,7 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  		.own_mac_idx = mvif->mt76.omac_idx,
  		.flowid = flow->id,
  		.peer_id = cpu_to_le16(flow->wcid),
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1119-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
similarity index 79%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/1119-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
index 6b6d403..0ea6537 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1118-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1119-mt76-connac-airtime-fairness-feature-off-in-mac80211.patch
@@ -1,7 +1,7 @@
-From a6e29c928e60a3611726d02f1d47cad8526f9e82 Mon Sep 17 00:00:00 2001
+From f073e6475caa7f66a7707d79d283170a662a35f7 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 6 May 2022 15:58:42 +0800
-Subject: [PATCH 1118/1130] mt76: connac: airtime fairness feature off in
+Subject: [PATCH 1119/1131] mt76: connac: airtime fairness feature off in
  mac80211
 
 ---
@@ -9,7 +9,7 @@
  1 file changed, 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 2e0e011d..de9ef237 100644
+index 2e0e011..de9ef23 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -435,7 +435,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1120-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
similarity index 91%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/1120-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
index d263a51..c0c01c6 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1119-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1120-mt76-mt7915-add-mt7986-and-mt7916-pre-calibration.patch
@@ -1,7 +1,7 @@
-From 8d55158a142d839bab5232646ca5657155daac3e Mon Sep 17 00:00:00 2001
+From a5db0f0eadc5827f7a82b62cc6ce47ab646932cd Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 20 May 2022 19:19:25 +0800
-Subject: [PATCH 1119/1130] mt76: mt7915: add mt7986 and mt7916 pre-calibration
+Subject: [PATCH 1120/1131] mt76: mt7915: add mt7986 and mt7916 pre-calibration
 
 Add pre-calibration for mt7986 and mt7916. It has different data size
 with mt7915. Group cal needs 54k and 94k for 2G + 5G and 2G + 6G,
@@ -15,7 +15,7 @@
  3 files changed, 62 insertions(+), 26 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 24efa280..7bdd4d52 100644
+index 24efa28..7bdd4d5 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -9,23 +9,22 @@ static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
@@ -50,7 +50,7 @@
  
  static int mt7915_check_eeprom(struct mt7915_dev *dev)
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index 88aaa16a..fdae347e 100644
+index 88aaa16..fdae347 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -19,6 +19,7 @@ enum mt7915_eeprom_field {
@@ -62,10 +62,10 @@
  	MT_EE_RATE_DELTA_5G =	0x29d,
  	MT_EE_TX0_POWER_2G =	0x2fc,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 49b72af9..9fb21cba 100644
+index 2d363c4..4c64655 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2903,7 +2903,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
+@@ -2917,7 +2917,8 @@ static int mt7915_mcu_set_pre_cal(struct mt7915_dev *dev, u8 idx,
  int mt7915_mcu_apply_group_cal(struct mt7915_dev *dev)
  {
  	u8 idx = 0, *cal = dev->cal, *eep = dev->mt76.eeprom.data;
@@ -75,7 +75,7 @@
  
  	if (!(eep[offs] & MT_EE_WIFI_CAL_GROUP))
  		return 0;
-@@ -2941,9 +2942,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
+@@ -2955,9 +2956,9 @@ static int mt7915_find_freq_idx(const u16 *freqs, int n_freqs, u16 cur)
  	return -1;
  }
  
@@ -87,7 +87,7 @@
  		5180, 5200, 5220, 5240,
  		5260, 5280, 5300, 5320,
  		5500, 5520, 5540, 5560,
-@@ -2951,34 +2952,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
+@@ -2965,34 +2966,69 @@ static int mt7915_dpd_freq_idx(u16 freq, u8 bw)
  		5660, 5680, 5700, 5745,
  		5765, 5785, 5805, 5825
  	};
@@ -167,7 +167,7 @@
  }
  
  int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
-@@ -3010,24 +3046,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
+@@ -3024,24 +3060,24 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy)
  	if (!(eep[offs] & dpd_mask))
  		return 0;
  
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1120-mt76-mt7915-add-phy-capability-vendor-command.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1121-mt76-mt7915-add-phy-capability-vendor-command.patch
similarity index 94%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/1121-mt76-mt7915-add-phy-capability-vendor-command.patch
index 67def39..04e140e 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1120-mt76-mt7915-add-phy-capability-vendor-command.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1121-mt76-mt7915-add-phy-capability-vendor-command.patch
@@ -1,7 +1,7 @@
-From d5cc407dc6cd86e101eed32bc83a16a3cc5d9a7e Mon Sep 17 00:00:00 2001
+From c56838fd1909945d3faf9e0097ced4820255ccb2 Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
 Date: Tue, 12 Jul 2022 10:04:35 -0700
-Subject: [PATCH 1120/1130] mt76: mt7915: add phy capability vendor command
+Subject: [PATCH 1121/1131] mt76: mt7915: add phy capability vendor command
 
 ---
  mt7915/mt7915.h |  1 +
@@ -10,7 +10,7 @@
  3 files changed, 78 insertions(+)
 
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index d845206e..66a76cba 100644
+index ab1efe6..e977e5c 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -11,6 +11,7 @@
@@ -22,7 +22,7 @@
  #define MT7916_WTBL_SIZE		544
  #define MT7915_WTBL_RESERVED		(mt7915_wtbl_size(dev) - 1)
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index c7551848..77d71e48 100644
+index c755184..77d71e4 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -50,6 +50,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
@@ -99,7 +99,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index a8e4ebf9..719b851f 100644
+index a8e4ebf..719b851 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -9,6 +9,7 @@ enum mtk_nl80211_vendor_subcmds {
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1122-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
similarity index 94%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/1122-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
index 24fbd21..0ebb293 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1121-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1122-mt76-mt7915-add-vendor-subcmd-EDCCA-ctrl-enable-thre.patch
@@ -1,7 +1,7 @@
-From af149d1b40396d7dc123699ce3edfdea5f210622 Mon Sep 17 00:00:00 2001
+From 3d100a915cc49091e875b11d9bc53af45879b7a5 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Fri, 24 Jun 2022 11:15:45 +0800
-Subject: [PATCH 1121/1130] mt76: mt7915: add vendor subcmd EDCCA ctrl
+Subject: [PATCH 1122/1131] mt76: mt7915: add vendor subcmd EDCCA ctrl
  enable/threshold/compensation
 
 Change-Id: I06a3f94d5e444be894200e2b6588d76ed38d09d0
@@ -16,7 +16,7 @@
  7 files changed, 264 insertions(+), 1 deletion(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 7853e074..88bfd09f 100644
+index 7853e07..88bfd09 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1200,6 +1200,7 @@ enum {
@@ -28,10 +28,10 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/main.c b/mt7915/main.c
-index f1829cea..9467dbe2 100644
+index eae1377..09cf35c 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -469,6 +469,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
+@@ -479,6 +479,9 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
  			mutex_unlock(&dev->mt76.mutex);
  		}
  #endif
@@ -42,10 +42,10 @@
  		ret = mt7915_set_channel(phy);
  		if (ret)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 9fb21cba..b4c563a7 100644
+index 4c64655..dddab7d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4576,3 +4576,75 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
+@@ -4593,3 +4593,75 @@ int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool w
  
  	return 0;
  }
@@ -122,10 +122,10 @@
 +	return 0;
 +}
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 9a485249..33e33d89 100644
+index a30f52d..391aed9 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -885,6 +885,27 @@ enum {
+@@ -1057,6 +1057,27 @@ enum {
     MURU_DL_INIT,
     MURU_UL_INIT,
  };
@@ -154,10 +154,10 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 66a76cba..ac19b78e 100644
+index e977e5c..4c370bb 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -759,7 +759,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
+@@ -761,7 +761,8 @@ void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
  int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  				  struct ieee80211_sta *sta);
  #endif
@@ -168,7 +168,7 @@
  int mt7915_mcu_ipi_hist_scan(struct mt7915_phy *phy, void *data, u8 mode, bool wait_resp);
  
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 77d71e48..2484e25f 100644
+index 77d71e4..2484e25 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -62,6 +62,24 @@ phy_capa_dump_policy[NUM_MTK_VENDOR_ATTRS_PHY_CAPA_DUMP] = {
@@ -325,7 +325,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 719b851f..72319717 100644
+index 719b851..7231971 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -2,6 +2,7 @@
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1122-mt76-mt7915-implement-bin-file-mode.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1123-mt76-mt7915-implement-bin-file-mode.patch
similarity index 94%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/1122-mt76-mt7915-implement-bin-file-mode.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/1123-mt76-mt7915-implement-bin-file-mode.patch
index af10651..f94fef6 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1122-mt76-mt7915-implement-bin-file-mode.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1123-mt76-mt7915-implement-bin-file-mode.patch
@@ -1,7 +1,7 @@
-From 8cd5ff67f77f8b66aaf30c1fbf0bbb833dca74e7 Mon Sep 17 00:00:00 2001
+From 2d0433d68fed7b477af18a53b7c4434fc86d5baf Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 7 Jul 2022 11:09:59 +0800
-Subject: [PATCH 1122/1130] mt76: mt7915: implement bin file mode
+Subject: [PATCH 1123/1131] mt76: mt7915: implement bin file mode
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -14,7 +14,7 @@
  6 files changed, 142 insertions(+), 32 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index cb6ff17a..aac70efb 100644
+index cb6ff17..aac70ef 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -104,6 +104,24 @@ out_put_node:
@@ -43,10 +43,10 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index 2bacc1b4..d102333b 100644
+index c6aefbf..0534ece 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1029,6 +1029,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+@@ -1033,6 +1033,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
  int mt76_eeprom_init(struct mt76_dev *dev, int len);
  void mt76_eeprom_override(struct mt76_phy *phy);
  int mt76_get_of_eeprom(struct mt76_dev *dev, void *data, int offset, int len);
@@ -55,7 +55,7 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 7bdd4d52..64a7750b 100644
+index 7bdd4d5..64a7750 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -42,33 +42,6 @@ static int mt7915_check_eeprom(struct mt7915_dev *dev)
@@ -152,7 +152,7 @@
  		if (ret)
  			return ret;
 diff --git a/mt7915/eeprom.h b/mt7915/eeprom.h
-index fdae347e..f228926b 100644
+index fdae347..f228926 100644
 --- a/mt7915/eeprom.h
 +++ b/mt7915/eeprom.h
 @@ -108,6 +108,13 @@ enum mt7915_sku_rate_group {
@@ -214,7 +214,7 @@
  
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index ac19b78e..ed2c71ec 100644
+index 4c370bb..5563bcf 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -42,15 +42,24 @@
@@ -245,7 +245,7 @@
  #define MT7915_EEPROM_SIZE		3584
  #define MT7916_EEPROM_SIZE		4096
  
-@@ -401,6 +410,8 @@ struct mt7915_dev {
+@@ -400,6 +409,8 @@ struct mt7915_dev {
  
  	bool dbdc_support;
  	bool flash_mode;
@@ -255,7 +255,7 @@
  	bool ibf;
  
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 766b278b..a3846bc9 100644
+index a2ceb6f..7567666 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -3,6 +3,7 @@
@@ -266,7 +266,7 @@
  
  #ifdef MTK_DEBUG
  #define LWTBL_IDX2BASE_ID		GENMASK(14, 8)
-@@ -2893,6 +2894,44 @@ mt7915_wa_debug(void *data, u64 val)
+@@ -2924,6 +2925,44 @@ mt7915_wa_debug(void *data, u64 val)
  DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_debug, NULL, mt7915_wa_debug,
  			 "0x%llx\n");
  
@@ -311,7 +311,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -2973,6 +3012,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3009,6 +3048,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  	debugfs_create_devm_seqfile(dev->mt76.dev, "fw_version", dir,
  				    mt7915_dump_version);
  
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1123-mt76-mt7915-initialize-wcid.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1124-mt76-mt7915-initialize-wcid.patch
similarity index 72%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/1123-mt76-mt7915-initialize-wcid.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/1124-mt76-mt7915-initialize-wcid.patch
index dc915f6..589fa47 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1123-mt76-mt7915-initialize-wcid.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1124-mt76-mt7915-initialize-wcid.patch
@@ -1,7 +1,7 @@
-From 61b3afb7359cdb973c3fc8eafb2b2a6331dee1dc Mon Sep 17 00:00:00 2001
+From ee3d72e824333538795e6bc487ae5103485f9f28 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 12 Jul 2022 13:56:07 +0800
-Subject: [PATCH 1123/1130] mt76: mt7915: initialize wcid
+Subject: [PATCH 1124/1131] mt76: mt7915: initialize wcid
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -9,10 +9,10 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 0746e4b3..22dd66e3 100644
+index 013dfbd..9d4cfa1 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1030,7 +1030,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1032,7 +1032,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  		info = le32_to_cpu(*cur_info);
  		if (info & MT_TX_FREE_PAIR) {
  			struct mt7915_sta *msta;
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1124-mt76-mt7915-Add-hemu-dump-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1125-mt76-mt7915-Add-hemu-dump-support.patch
similarity index 91%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/1124-mt76-mt7915-Add-hemu-dump-support.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/1125-mt76-mt7915-Add-hemu-dump-support.patch
index 33509a8..c1242fc 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1124-mt76-mt7915-Add-hemu-dump-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1125-mt76-mt7915-Add-hemu-dump-support.patch
@@ -1,7 +1,7 @@
-From 1055812945cc9a185f6f95d2b66a3d4088e442aa Mon Sep 17 00:00:00 2001
+From 001bfbcae27083c1ac5ffca0705bcf7447390875 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Thu, 11 Aug 2022 18:09:45 -0700
-Subject: [PATCH 1124/1130] mt76: mt7915: Add hemu dump support
+Subject: [PATCH 1125/1131] mt76: mt7915: Add hemu dump support
 
 Change-Id: I521214f3feb6f0d528a9f550255050ffd1ec96d2
 ---
@@ -10,7 +10,7 @@
  2 files changed, 26 insertions(+)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 2484e25f..f7becce9 100644
+index 2484e25..f7becce 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -37,6 +37,7 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -60,7 +60,7 @@
  		.maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 72319717..c19ffe72 100644
+index 7231971..c19ffe7 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -72,6 +72,7 @@ enum mtk_vendor_attr_hemu_ctrl {
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1126-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
similarity index 93%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/1126-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
index 271a6df..ce989a0 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1125-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1126-mt76-mt7915-add-vendor-subcmd-three-wire-PTA-ctrl.patch
@@ -1,7 +1,7 @@
-From 27222b75e81973d1fedd83bfbff047f3a4efdb2f Mon Sep 17 00:00:00 2001
+From 6b291bc1729634a2dd05297e72e5366fdffbedd8 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 28 Oct 2022 10:15:56 +0800
-Subject: [PATCH 1125/1130] mt76: mt7915: add vendor subcmd three wire (PTA)
+Subject: [PATCH 1126/1131] mt76: mt7915: add vendor subcmd three wire (PTA)
  ctrl
 
 Change-Id: Ic1044698f294455594a0c6254f55326fdab90580
@@ -16,7 +16,7 @@
  6 files changed, 111 insertions(+), 29 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 88bfd09f..5cff1a45 100644
+index 88bfd09..5cff1a4 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1199,7 +1199,7 @@ enum {
@@ -29,10 +29,10 @@
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index b4c563a7..8885067b 100644
+index dddab7d..36a33f6 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -4258,37 +4258,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
+@@ -4272,37 +4272,33 @@ void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
  			&req, sizeof(req), false);
  }
  
@@ -94,10 +94,10 @@
  
  void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 33e33d89..08476eb6 100644
+index 391aed9..025a03b 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -674,6 +674,35 @@ struct mt7915_mcu_rdd_ipi_scan {
+@@ -846,6 +846,35 @@ struct mt7915_mcu_rdd_ipi_scan {
  	u8 tx_assert_time;						/* unit: us */
  } __packed;
  
@@ -134,10 +134,10 @@
  #define OFDMA_DL                       BIT(0)
  #define OFDMA_UL                       BIT(1)
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index ed2c71ec..2718b42c 100644
+index 5563bcf..6649633 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -762,6 +762,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
+@@ -764,6 +764,7 @@ void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
  void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
  int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
  void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
@@ -146,7 +146,7 @@
  void mt7915_vendor_register(struct mt7915_phy *phy);
  int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index f7becce9..fb760e17 100644
+index f7becce..fb760e1 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -40,6 +40,11 @@ hemu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_HEMU_CTRL] = {
@@ -229,7 +229,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index c19ffe72..d96e5c23 100644
+index c19ffe7..d96e5c2 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -12,6 +12,7 @@ enum mtk_nl80211_vendor_subcmds {
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1127-mt76-mt7915-add-ibf-control-vendor-cmd.patch
similarity index 95%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/1127-mt76-mt7915-add-ibf-control-vendor-cmd.patch
index 2cbb4b2..464738c 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1126-mt76-mt7915-add-ibf-control-vendor-cmd.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1127-mt76-mt7915-add-ibf-control-vendor-cmd.patch
@@ -1,7 +1,7 @@
-From 56b0454342ea298a068b7bb9bbd9c8f184df5f25 Mon Sep 17 00:00:00 2001
+From 79f3a7b9a187ba21601f1407ba59b59eca622903 Mon Sep 17 00:00:00 2001
 From: mtk27835 <shurong.wen@mediatek.com>
 Date: Wed, 7 Sep 2022 14:01:29 -0700
-Subject: [PATCH 1126/1130] mt76: mt7915: add ibf control vendor cmd
+Subject: [PATCH 1127/1131] mt76: mt7915: add ibf control vendor cmd
 
 Signed-off-by: mtk27835 <shurong.wen@mediatek.com>
 ---
@@ -10,7 +10,7 @@
  2 files changed, 89 insertions(+), 1 deletion(-)
 
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index fb760e17..22af66d5 100644
+index fb760e1..22af66d 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -86,6 +86,11 @@ edcca_dump_policy[NUM_MTK_VENDOR_ATTRS_EDCCA_DUMP] = {
@@ -100,7 +100,7 @@
  };
  
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index d96e5c23..949c8853 100644
+index d96e5c2..949c885 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -12,7 +12,8 @@ enum mtk_nl80211_vendor_subcmds {
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1128-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
similarity index 90%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/1128-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
index 84775f5..5dd548f 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1127-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1128-mt76-mt7915-add-E3-re-bonding-for-low-yield-rate-iss.patch
@@ -1,7 +1,7 @@
-From 1b3a030e1a19cc22d93b8b579f0ef38616aca2f9 Mon Sep 17 00:00:00 2001
+From 69dc3315bb6da4143d55f59a75ab32379bf47633 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 13 Oct 2022 13:22:05 +0800
-Subject: [PATCH 1127/1130] mt76: mt7915: add E3 re-bonding for low yield rate
+Subject: [PATCH 1128/1131] mt76: mt7915: add E3 re-bonding for low yield rate
  issue
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -12,7 +12,7 @@
  3 files changed, 38 insertions(+), 5 deletions(-)
 
 diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
-index 64a7750b..efa9c173 100644
+index 64a7750..efa9c17 100644
 --- a/mt7915/eeprom.c
 +++ b/mt7915/eeprom.c
 @@ -99,7 +99,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
@@ -64,10 +64,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 8885067b..0db72efc 100644
+index 36a33f6..cb47ae6 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2822,7 +2822,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
+@@ -2836,7 +2836,7 @@ int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
  				 &req, sizeof(req), true);
  }
  
@@ -76,7 +76,7 @@
  {
  	struct mt7915_mcu_eeprom_info req = {
  		.addr = cpu_to_le32(round_down(offset,
-@@ -2840,8 +2840,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
+@@ -2854,8 +2854,15 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
  		return ret;
  
  	res = (struct mt7915_mcu_eeprom_info *)skb->data;
@@ -95,10 +95,10 @@
  
  	return 0;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2718b42c..f618e99a 100644
+index 6649633..c10010a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -566,6 +566,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
+@@ -565,6 +565,7 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
  
  int mt7915_register_device(struct mt7915_dev *dev);
  void mt7915_unregister_device(struct mt7915_dev *dev);
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1129-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
similarity index 83%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/1129-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
index 2247f64..e947c72 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1128-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1129-mt76-mt7915-support-on-off-SW-ACI-through-debugfs.patch
@@ -1,7 +1,7 @@
-From 6bd6737abdf42fc5e645a8e5de1a31cfb9f0b37c Mon Sep 17 00:00:00 2001
+From 930b5135d665aa19001ce13082cbc07e6afb1bf0 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Fri, 14 Oct 2022 11:15:13 +0800
-Subject: [PATCH 1128/1130] mt76: mt7915: support on off SW ACI through debugfs
+Subject: [PATCH 1129/1131] mt76: mt7915: support on off SW ACI through debugfs
 
 Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Change-Id: I8a9c277c41d1ba76f9737d8af6f42e5e8f00ba64
@@ -11,7 +11,7 @@
  2 files changed, 22 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 5cff1a45..98b00747 100644
+index 5cff1a4..98b0074 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1201,6 +1201,7 @@ enum {
@@ -23,10 +23,10 @@
  	MCU_EXT_CMD_IPI_HIST_SCAN = 0xc5,
  };
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index a3846bc9..e247683f 100644
+index 7567666..19cc8cb 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2932,6 +2932,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
+@@ -2963,6 +2963,25 @@ static int mt7915_show_eeprom_mode(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -52,7 +52,7 @@
  int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  {
  	struct mt7915_dev *dev = phy->dev;
-@@ -3014,6 +3033,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -3050,6 +3069,8 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	debugfs_create_devm_seqfile(dev->mt76.dev, "eeprom_mode", dir,
  				    mt7915_show_eeprom_mode);
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1130-mt76-mt7915-add-bf-backoff-limit-table-support.patch
similarity index 94%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/1130-mt76-mt7915-add-bf-backoff-limit-table-support.patch
index 1a0ab6f..ec01b7b 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1129-mt76-mt7915-add-bf-backoff-limit-table-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1130-mt76-mt7915-add-bf-backoff-limit-table-support.patch
@@ -1,7 +1,7 @@
-From 07242a2b8b8b276886f9013d52f3f1017895b636 Mon Sep 17 00:00:00 2001
+From 7aa31cddd2410fc6fad53d02f4bd728dd134802f Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 5 Dec 2022 18:21:51 +0800
-Subject: [PATCH 1129/1130] mt76: mt7915: add bf backoff limit table support
+Subject: [PATCH 1130/1131] mt76: mt7915: add bf backoff limit table support
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -14,7 +14,7 @@
  6 files changed, 203 insertions(+), 37 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index aac70efb..6290156f 100644
+index aac70ef..6290156 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -308,7 +308,8 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
@@ -57,10 +57,10 @@
  }
  EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
 diff --git a/mt76.h b/mt76.h
-index d102333b..01baceaf 100644
+index 0534ece..dbeb9e0 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -900,6 +900,14 @@ struct mt76_power_limits {
+@@ -904,6 +904,14 @@ struct mt76_power_limits {
  	s8 ofdm[8];
  	s8 mcs[4][10];
  	s8 ru[7][12];
@@ -76,7 +76,7 @@
  
  struct mt76_ethtool_worker_info {
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index f1f3f2f3..3ef2148b 100644
+index f1f3f2f..3ef2148 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -1024,7 +1024,7 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf,
@@ -188,10 +188,10 @@
  				    mt7915_twt_stats);
  	debugfs_create_file("rf_regval", 0600, dir, dev, &fops_rf_regval);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 0db72efc..519ead54 100644
+index cb47ae6..1ed6b5f 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3267,7 +3267,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3281,7 +3281,8 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  	int ret;
  	s8 txpower_sku[MT7915_SKU_RATE_NUM];
  
@@ -201,7 +201,7 @@
  	if (ret)
  		return ret;
  
-@@ -3309,51 +3310,98 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3323,51 +3324,98 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy)
  {
@@ -325,7 +325,7 @@
  	struct mt7915_dev *dev = phy->dev;
  	struct {
  		u8 format_id;
-@@ -3362,10 +3410,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+@@ -3376,10 +3424,9 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
  		u8 _rsv;
  	} __packed req = {
  		.format_id = TX_POWER_LIMIT_INFO,
@@ -337,7 +337,7 @@
  	struct sk_buff *skb;
  	int ret, i;
  
-@@ -3375,9 +3422,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
+@@ -3389,9 +3436,15 @@ int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len)
  	if (ret)
  		return ret;
  
@@ -356,7 +356,7 @@
  
  	dev_kfree_skb(skb);
  
-@@ -3419,9 +3472,18 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
+@@ -3433,9 +3486,18 @@ int mt7915_mcu_set_sku_en(struct mt7915_phy *phy, bool enable)
  		.band_idx = phy->mt76->band_idx,
  		.sku_enable = enable,
  	};
@@ -376,7 +376,7 @@
  				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
  				 sizeof(req), true);
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 08476eb6..d110e210 100644
+index 025a03b..b33e671 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -446,12 +446,18 @@ enum {
@@ -399,7 +399,7 @@
  	SPR_ENABLE = 0x1,
  	SPR_ENABLE_SD = 0x3,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index f618e99a..b3d86841 100644
+index c10010a..4722fe3 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -73,6 +73,7 @@
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1130-amsdu-set-and-get-control.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1131-mt76-mt7915-amsdu-set-and-get-control.patch
similarity index 92%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/1130-amsdu-set-and-get-control.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/1131-mt76-mt7915-amsdu-set-and-get-control.patch
index f606ef0..6fe7f57 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1130-amsdu-set-and-get-control.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1131-mt76-mt7915-amsdu-set-and-get-control.patch
@@ -1,7 +1,7 @@
-From cb186f0e59654c1f054179bd2ef49bdbadeffe8f Mon Sep 17 00:00:00 2001
+From 110011fac66d02b592732a19d1bee5441a69b2f3 Mon Sep 17 00:00:00 2001
 From: TomLiu <tomml.liu@mediatek.com>
 Date: Wed, 14 Dec 2022 00:44:07 -0800
-Subject: [PATCH 1130/1130] amsdu set and get control
+Subject: [PATCH 1131/1131] mt76: mt7915: amsdu set and get control
 
 ---
  mt7915/mac.c    | 10 ++++++++++
@@ -11,10 +11,10 @@
  4 files changed, 54 insertions(+)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 22dd66e3..42927d48 100644
+index 9d4cfa1..a0df785 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -2051,6 +2051,16 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
+@@ -2053,6 +2053,16 @@ static void mt7915_mac_severe_check(struct mt7915_phy *phy)
  	phy->trb_ts = trb;
  }
  
@@ -32,10 +32,10 @@
  void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta)
  {
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b3d86841..b4849a57 100644
+index 4722fe3..00a41e8 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -753,6 +753,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -755,6 +755,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  			 bool pci, int *irq);
  
  #ifdef CONFIG_MTK_VENDOR
@@ -44,7 +44,7 @@
  void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
  void mt7915_mcu_set_rfeature_starec(void *data, struct mt7915_dev *dev,
 diff --git a/mt7915/vendor.c b/mt7915/vendor.c
-index 22af66d5..a1f526c9 100644
+index 22af66d..a1f526c 100644
 --- a/mt7915/vendor.c
 +++ b/mt7915/vendor.c
 @@ -30,10 +30,16 @@ wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
@@ -109,7 +109,7 @@
  		.maxattr = MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX,
  	},
 diff --git a/mt7915/vendor.h b/mt7915/vendor.h
-index 949c8853..cbff910b 100644
+index 949c885..cbff910 100644
 --- a/mt7915/vendor.h
 +++ b/mt7915/vendor.h
 @@ -74,6 +74,7 @@ enum mtk_vendor_attr_wireless_ctrl {
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3001-mt76-mt7915-wed-add-wed-tx-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3001-mt76-mt7915-wed-add-wed-tx-support.patch
index c8a5d33..6060472 100755
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3001-mt76-mt7915-wed-add-wed-tx-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3001-mt76-mt7915-wed-add-wed-tx-support.patch
@@ -1,4 +1,4 @@
-From e269684340c45879b482ba1e8b7a880cf7027ef7 Mon Sep 17 00:00:00 2001
+From 8a702290f450715984398ddc9f130a7d1789675c Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 10:38:53 +0800
 Subject: [PATCH 3001/3012] mt76: mt7915: wed: add wed tx support
@@ -12,7 +12,7 @@
  4 files changed, 13 insertions(+), 8 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 8ba883b0..f70987dd 100644
+index 8ba883b..f70987d 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -116,6 +116,7 @@ struct mt76_connac_sta_key_conf {
@@ -24,10 +24,10 @@
  struct mt76_connac_fw_txp {
  	__le16 flags;
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 42927d48..fb2cdefb 100644
+index a0df785..0984357 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -889,9 +889,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+@@ -891,9 +891,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
  
  	txp->token = cpu_to_le16(token_id);
  	txp->nbuf = 1;
@@ -39,7 +39,7 @@
  }
  
  static void
-@@ -1007,6 +1007,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1009,6 +1009,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  	LIST_HEAD(free_list);
  	void *end = data + len;
  	bool v3, wake = false;
@@ -47,7 +47,7 @@
  	u16 total, count = 0;
  	u32 txd = le32_to_cpu(free->txd);
  	__le32 *cur_info;
-@@ -1062,12 +1063,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1064,12 +1065,14 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  			txwi = mt76_token_release(mdev, msdu, &wake);
  			if (!txwi)
  				continue;
@@ -65,10 +65,10 @@
  
  static void
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 9467dbe2..0a09400c 100644
+index 09cf35c..2dd78ca 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1523,14 +1523,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1533,14 +1533,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
  
@@ -86,7 +86,7 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 26881fdc..ac574722 100644
+index c1b421d..04411e7 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -11,7 +11,7 @@
@@ -98,7 +98,7 @@
  module_param(wed_enable, bool, 0644);
  MODULE_PARM_DESC(wed_enable, "Enable Wireless Ethernet Dispatch support");
  
-@@ -580,7 +580,7 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
+@@ -582,7 +582,7 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
  	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
  
  	spin_lock_bh(&dev->mt76.token_lock);
@@ -107,7 +107,7 @@
  	spin_unlock_bh(&dev->mt76.token_lock);
  
  	/* MT_TXD5_TX_STATUS_HOST (MPDU format) has higher priority than
-@@ -790,6 +790,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -792,6 +792,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  
  	*irq = wed->irq;
  	dev->mt76.dma_dev = wed->dev;
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch
index b98b8b6..0a98a0b 100755
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch
@@ -1,4 +1,4 @@
-From 34abc0e25e54078353f9c1458e4743f95bf70bfd Mon Sep 17 00:00:00 2001
+From 4b030fb81d6c1cd9a307cd8d432bdf91cc4a2ca2 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 17:51:26 +0800
 Subject: [PATCH 3002/3012] mt76: mt7915: wed: add wds support when wed is
@@ -15,7 +15,7 @@
  6 files changed, 81 insertions(+), 8 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 01baceaf..7b222e73 100644
+index dbeb9e0..e9e72e4 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -60,6 +60,12 @@ enum mt76_wed_type {
@@ -32,10 +32,10 @@
  	u32 (*rr)(struct mt76_dev *dev, u32 offset);
  	void (*wr)(struct mt76_dev *dev, u32 offset, u32 val);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 0a09400c..eef899b7 100644
+index 2dd78ca..eef4c3b 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -686,8 +686,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -696,8 +696,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  #endif
  	int ret, idx;
  	u32 addr;
@@ -52,7 +52,7 @@
  	if (idx < 0)
  		return -ENOSPC;
  
-@@ -1159,6 +1166,13 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
+@@ -1169,6 +1176,13 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
  	else
  		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
  
@@ -66,7 +66,7 @@
  	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
  }
  
-@@ -1530,8 +1544,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1540,8 +1554,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->dev = ctx->dev;
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
  	path->mtk_wdma.bss = mvif->mt76.idx;
@@ -81,10 +81,10 @@
  	ctx->dev = NULL;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 519ead54..8ceea94d 100644
+index 1ed6b5f..b2d6412 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2350,8 +2350,17 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2364,8 +2364,17 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -105,7 +105,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index d110e210..edb8b510 100644
+index b33e671..f2f88cc 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -284,6 +284,7 @@ enum {
@@ -117,7 +117,7 @@
  	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
  	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
 diff --git a/util.c b/util.c
-index 58196442..5cd5ede0 100644
+index 5819644..5cd5ede 100644
 --- a/util.c
 +++ b/util.c
 @@ -42,9 +42,14 @@ bool __mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val,
@@ -185,7 +185,7 @@
  int mt76_get_min_avg_rssi(struct mt76_dev *dev, bool ext_phy)
  {
 diff --git a/util.h b/util.h
-index 260965dd..99b7263c 100644
+index 260965d..99b7263 100644
 --- a/util.h
 +++ b/util.h
 @@ -27,7 +27,12 @@ enum {
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
index d53a993..1751daf 100755
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
@@ -1,4 +1,4 @@
-From 6e14cb1fc0fb334c92192fc7440fa8b574c0961a Mon Sep 17 00:00:00 2001
+From 45284499b2a634f956b6bab777dc25f3062ef95e Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 12:05:06 +0800
 Subject: [PATCH 3003/3012] mt76: connac: wed: add wed rx copy skb
@@ -9,7 +9,7 @@
  1 file changed, 18 insertions(+), 5 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index dc8d8882..53c7528f 100644
+index dc8d888..53c7528 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -386,9 +386,12 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
index 5968a25..86dc2fb 100755
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
@@ -1,4 +1,4 @@
-From 8c091cc9de6df7422329aa07c7473abfdbae0f9a Mon Sep 17 00:00:00 2001
+From 40cd6c14ad8b1d8e2439a2b58ff664afcde14817 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 19 May 2022 13:44:42 +0800
 Subject: [PATCH 3004/3012] mt76: mt7915: wed: add fill receive path to report
@@ -10,10 +10,10 @@
  1 file changed, 19 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index eef899b7..37852cd0 100644
+index eef4c3b..7dd3973 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1555,6 +1555,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1565,6 +1565,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  
  	return 0;
  }
@@ -38,7 +38,7 @@
  #endif
  
  const struct ieee80211_ops mt7915_ops = {
-@@ -1607,5 +1625,6 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1617,5 +1635,6 @@ const struct ieee80211_ops mt7915_ops = {
  	.set_radar_background = mt7915_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
  	.net_fill_forward_path = mt7915_net_fill_forward_path,
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
index e3719db..1bba016 100755
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
@@ -1,4 +1,4 @@
-From 12cb12d5877545432441a314ea73efb4bc973219 Mon Sep 17 00:00:00 2001
+From 7883f81319f8d55905e1dcb9203948e2746c655c Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:07:46 +0800
 Subject: [PATCH 3005/3012] mt76: mt7915: wed: add ser support when wed on
@@ -15,7 +15,7 @@
  7 files changed, 76 insertions(+), 14 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 53c7528f..35beec72 100644
+index 53c7528..35beec7 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -165,7 +165,7 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
@@ -109,7 +109,7 @@
  	if (!q->rx_head)
  		return;
 diff --git a/dma.h b/dma.h
-index 53c6ce25..4b9bc7f4 100644
+index 53c6ce2..4b9bc7f 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -56,5 +56,6 @@ enum mt76_mcu_evt_type {
@@ -120,10 +120,10 @@
  
  #endif
 diff --git a/mt76.h b/mt76.h
-index 7b222e73..75975cb5 100644
+index e9e72e4..686005d 100644
 --- a/mt76.h
 +++ b/mt76.h
-@@ -1395,6 +1395,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1399,6 +1399,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
  struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
@@ -132,7 +132,7 @@
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index e3fa0649..1ae6c339 100644
+index e3fa064..1ae6c33 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -4,6 +4,7 @@
@@ -211,10 +211,10 @@
  }
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index fb2cdefb..7a257b80 100644
+index 0984357..0d0ae7a 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -894,6 +894,18 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
+@@ -896,6 +896,18 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
  	return MT_TXD_TXP_BUF_SIZE;
  }
  
@@ -233,7 +233,7 @@
  static void
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
-@@ -1633,6 +1645,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
+@@ -1635,6 +1647,12 @@ void mt7915_mac_reset_work(struct work_struct *work)
  	if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA))
  		return;
  
@@ -247,10 +247,10 @@
  	if (ext_phy)
  		ieee80211_stop_queues(ext_phy->hw);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index ac574722..ecc38e05 100644
+index 04411e7..e0761e8 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -617,6 +617,8 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+@@ -619,6 +619,8 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
  		mt76_put_rxwi(&dev->mt76, t);
  	}
  
@@ -259,7 +259,7 @@
  	if (!wed->rx_buf_ring.rx_page.va)
  		return;
  
-@@ -782,6 +784,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -784,6 +786,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  	wed->wlan.init_rx_buf = mt7915_mmio_wed_init_rx_buf;
  	wed->wlan.release_rx_buf = mt7915_mmio_wed_release_rx_buf;
  	wed->wlan.update_wo_rx_stats = mt7915_mmio_wed_update_rx_stats;
@@ -268,10 +268,10 @@
  	dev->mt76.rx_token_size = wed->wlan.rx_npkt;
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index b4849a57..bee3099a 100644
+index 00a41e8..73806ae 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -564,6 +564,7 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
+@@ -563,6 +563,7 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
  irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
  u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
  u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
index 8894a02..6e34978 100755
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
@@ -1,4 +1,4 @@
-From fd28cb1c96c3a5efffdfb0ecd2e9351a93da9c0a Mon Sep 17 00:00:00 2001
+From 7a2f7d7f2ae97179af8eb6efbe97c9cef5e47553 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 2 Sep 2022 14:40:40 +0800
 Subject: [PATCH 3006/3012] mt76: mt7915: wed: enable red per-band token drop
@@ -16,10 +16,10 @@
  3 files changed, 50 insertions(+), 11 deletions(-)
 
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 8ceea94d..b20b48c2 100644
+index b2d6412..1164eff 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2360,8 +2360,17 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2374,8 +2374,17 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  						dev->mt76.mmio.wed.rev_id, 0);
  		if (ret)
  			return ret;
@@ -37,7 +37,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
  		return ret;
-@@ -2371,12 +2380,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2385,12 +2394,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -51,7 +51,7 @@
  }
  
  int mt7915_mcu_init(struct mt7915_dev *dev)
-@@ -4516,6 +4520,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
+@@ -4533,6 +4537,35 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
  
  	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), wait_resp);
  }
@@ -87,7 +87,7 @@
  
  int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  {
-@@ -4526,17 +4559,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
+@@ -4543,17 +4576,21 @@ int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
  	u32 red_type = enabled > 0 ? RED_BY_WA_ENABLE : RED_DISABLE;
  	__le32 req = cpu_to_le32(red_type);
  
@@ -114,7 +114,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index edb8b510..7963a700 100644
+index f2f88cc..572cc16 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -285,6 +285,7 @@ enum {
@@ -126,10 +126,10 @@
  	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
  	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index bee3099a..74b4aec1 100644
+index 73806ae..3683ef0 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -778,13 +778,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
+@@ -780,13 +780,14 @@ int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
  #endif
  int mt7915_mcu_set_edcca(struct mt7915_phy *phy, int mode, u8 *value, s8 compensation);
  int mt7915_mcu_get_edcca(struct mt7915_phy *phy, u8 mode, s8 *value);
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
index 28c4368..d5b9a5a 100755
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3007-mt76-mt7915-wed-update-mt7916-trinfo-when-hw-path-en.patch
@@ -1,4 +1,4 @@
-From 3783d4f9606d6b83668f877a547b6ac8ff251e17 Mon Sep 17 00:00:00 2001
+From 67f34e5bf328bb94782ecdc7fd9de002043336e5 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 22 Sep 2022 09:54:53 +0800
 Subject: [PATCH 3007/3012] mt76: mt7915: wed: update mt7916 trinfo when hw
@@ -10,7 +10,7 @@
  2 files changed, 23 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
-index ecdc02ab..0a1ee808 100644
+index ecdc02a..0a1ee80 100644
 --- a/mt7915/mt7915_debug.h
 +++ b/mt7915/mt7915_debug.h
 @@ -133,6 +133,8 @@ enum dbg_reg_rev {
@@ -57,7 +57,7 @@
  #define MT_DBG_INT_SOURCE_CSR			__DBG_REG(dev, DBG_INT_SOURCE_CSR)
  #define MT_DBG_INT_MASK_CSR			__DBG_REG(dev, DBG_INT_MASK_CSR)
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index e247683f..e00570e3 100644
+index 19cc8cb..919cae4 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -856,12 +856,22 @@ mt7986_show_host_dma_info(struct seq_file *s, struct mt7915_dev *dev)
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
index 3e22dd6..ca92d2f 100755
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3008-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
@@ -1,4 +1,4 @@
-From 60a940a918fa6075342341cc1a8127f35b92296d Mon Sep 17 00:00:00 2001
+From 70a2e04b891b4f9d3cc9f49a19ace0c34a991455 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:32:35 +0800
 Subject: [PATCH 3008/3012] mt76: mt7915: wed: find rx token by physical
@@ -13,7 +13,7 @@
  1 file changed, 20 insertions(+), 1 deletion(-)
 
 diff --git a/dma.c b/dma.c
-index 35beec72..327ed3bc 100644
+index 35beec7..327ed3b 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -376,10 +376,29 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
index 2fa04e2..69daa96 100755
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3009-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
@@ -1,4 +1,4 @@
-From 10d82a8120c5998c64c6ce5a377d5b2cf925edc9 Mon Sep 17 00:00:00 2001
+From 9d35036537b2d7865f995a95f48487f7cd3ee91d Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 25 Nov 2022 14:37:58 +0800
 Subject: [PATCH 3009/3012] mt76: mt7915: wed: drop scatter and gather frame
@@ -14,7 +14,7 @@
  3 files changed, 11 insertions(+)
 
 diff --git a/dma.c b/dma.c
-index 327ed3bc..0914266a 100644
+index 327ed3b..0914266 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -420,6 +420,15 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
@@ -34,7 +34,7 @@
  	} else {
  		buf = e->buf;
 diff --git a/dma.h b/dma.h
-index 4b9bc7f4..ce8ac426 100644
+index 4b9bc7f..ce8ac42 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -19,6 +19,7 @@
@@ -46,7 +46,7 @@
  #define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
  #define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
 diff --git a/mt76.h b/mt76.h
-index 75975cb5..f1795778 100644
+index 686005d..13c5ca3 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -30,6 +30,7 @@
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
index b26bd9f..d9f759b 100755
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3010-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
@@ -1,4 +1,4 @@
-From c510cd542b26e25208aed3a07b8a653fd8d36276 Mon Sep 17 00:00:00 2001
+From 829e658c7cfa9b9b0180495b8b791d11be7cc537 Mon Sep 17 00:00:00 2001
 From: Lian Chen <lian.chen@mediatek.com>
 Date: Mon, 7 Nov 2022 14:47:44 +0800
 Subject: [PATCH 3010/3012] mt76: mt7915: wed: HW ATF support for mt7986
@@ -8,15 +8,15 @@
  mt76_connac_mcu.h    |   2 +
  mt7915/debugfs.c     | 405 +++++++++++++++++++++++++++++++++++++++++++
  mt7915/init.c        |  39 +++++
- mt7915/main.c        |  16 ++
+ mt7915/main.c        |  15 ++
  mt7915/mcu.c         | 165 ++++++++++++++++++
  mt7915/mt7915.h      |  68 ++++++++
  mt7915/mtk_debugfs.c | 133 +++++++++++++-
- 7 files changed, 827 insertions(+), 1 deletion(-)
+ 7 files changed, 826 insertions(+), 1 deletion(-)
  mode change 100644 => 100755 mt7915/init.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 98b00747..239643b9 100644
+index 98b0074..239643b 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1159,6 +1159,7 @@ enum {
@@ -36,7 +36,7 @@
  	MCU_EXT_CMD_EFUSE_FREE_BLOCK = 0x4f,
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 3ef2148b..b178036c 100644
+index 3ef2148..b178036 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -12,6 +12,10 @@
@@ -468,7 +468,7 @@
 diff --git a/mt7915/init.c b/mt7915/init.c
 old mode 100644
 new mode 100755
-index e044f503..ef752e10
+index e044f50..ef752e1
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -563,10 +563,46 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
@@ -529,29 +529,28 @@
  
  int mt7915_txbf_init(struct mt7915_dev *dev)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 37852cd0..8965e8c2 100644
+index 7dd3973..c87f04b 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -210,6 +210,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+@@ -209,6 +209,7 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
- 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
+ 	struct mt7915_dev *dev = phy->dev;
 +	struct wiphy *wiphy = dev->phy.mt76->hw->wiphy;
- 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt76_txq *mtxq;
  	bool ext_phy = phy != &dev->phy;
-@@ -279,6 +280,10 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
+ 	int idx, ret = 0;
+@@ -270,6 +271,9 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
  	mt7915_mcu_add_sta(dev, vif, NULL, true);
  	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
  
-+	if (mt7915_is_atf_default_on(wiphy, dev)) {
++	if (mt7915_is_atf_default_on(wiphy, dev))
 +		mt7915_mcu_set_vow_band(dev, mvif);
-+	}
 +
- out:
- 	mutex_unlock(&dev->mt76.mutex);
+ 	return ret;
+ }
  
-@@ -681,6 +686,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -691,6 +695,7 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
  	bool ext_phy = mvif->phy != &dev->phy;
@@ -559,7 +558,7 @@
  #ifdef CONFIG_MTK_VENDOR
  	struct mt7915_phy *phy;
  #endif
-@@ -732,6 +738,16 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+@@ -742,6 +747,16 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
  		mt7915_mcu_set_mimo(phy, 0);
  	}
  #endif
@@ -577,10 +576,10 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index b20b48c2..bd63ebed 100644
+index 1164eff..aacc237 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3519,6 +3519,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3533,6 +3533,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  				 &req, sizeof(req), false);
  }
  
@@ -751,9 +750,9 @@
 +
  int mt7915_mcu_set_txbf(struct mt7915_dev *dev, u8 action)
  {
- 	struct {
+ #define MT_BF_PROCESSING	4
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 74b4aec1..f02d1721 100644
+index 3683ef0..b2bcf02 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -135,6 +135,58 @@ struct mt7915_twt_flow {
@@ -823,7 +822,7 @@
  };
  
  struct mt7915_vif_cap {
-@@ -470,6 +523,8 @@ struct mt7915_dev {
+@@ -469,6 +522,8 @@ struct mt7915_dev {
  	} dbg;
  	const struct mt7915_dbg_reg_desc *dbg_reg;
  #endif
@@ -832,7 +831,7 @@
  };
  
  enum {
-@@ -502,6 +557,15 @@ enum mt7915_rdd_cmd {
+@@ -501,6 +556,15 @@ enum mt7915_rdd_cmd {
  	RDD_IRQ_OFF,
  };
  
@@ -860,7 +859,7 @@
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
  int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index e00570e3..d6f2fe78 100644
+index 919cae4..c8df2d0 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -1301,7 +1301,6 @@ static EMPTY_QUEUE_INFO_T ple_txcmd_queue_empty_info[] = {
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
index 23ea841..53b8f94 100755
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3011-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
@@ -1,4 +1,4 @@
-From 1e397fb74a9767a88ba75b2fab49da730fc6abe8 Mon Sep 17 00:00:00 2001
+From 676544f0e3f7fdcd4d8f90d4d80e00a60839346b Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 2 Dec 2022 17:17:06 +0800
 Subject: [PATCH 3011/3012] mt76: mt7915: wed: add mt7916 2 pcie support when
@@ -15,7 +15,7 @@
  3 files changed, 13 insertions(+), 8 deletions(-)
 
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 1ae6c339..36260085 100644
+index 1ae6c33..3626008 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -88,8 +88,12 @@ static void mt7915_dma_config(struct mt7915_dev *dev)
@@ -34,10 +34,10 @@
  				   MT7916_RXQ_MCU_WA_MAIN);
  			TXQ_CONFIG(0, WFDMA0, MT_INT_WED_TX_DONE_BAND0,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index bd63ebed..558e6c69 100644
+index aacc237..4185961 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2351,7 +2351,8 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2365,7 +2365,8 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  		return ret;
  
  	if (mtk_wed_device_active(&dev->mt76.mmio.wed)) {
@@ -48,10 +48,10 @@
  						0, 0, 0);
  		else
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index ecc38e05..992beca3 100644
+index e0761e8..02261b7 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -964,13 +964,13 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
+@@ -966,13 +966,13 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
  	struct mt7915_dev *dev = dev_instance;
  	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
  
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3012-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3012-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch
index 56fc3a4..9aec8e0 100755
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3012-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3012-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch
@@ -1,4 +1,4 @@
-From f1ecb69d4f84e6e103cf233bd34fa87bce5b5dbb Mon Sep 17 00:00:00 2001
+From bb55e2125bd43a6082d57f0069e41331efd89bda Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Wed, 14 Dec 2022 17:19:00 +0800
 Subject: [PATCH 3012/3012] mt76: mt7915: wed: add rxwi for further in chip rro
@@ -16,7 +16,7 @@
  7 files changed, 86 insertions(+), 78 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 0914266a..7ef272e2 100644
+index 0914266..7ef272e 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -59,17 +59,17 @@ mt76_alloc_txwi(struct mt76_dev *dev)
@@ -263,7 +263,7 @@
  					 DMA_FROM_DEVICE);
  			skb_free_frag(buf);
 diff --git a/mac80211.c b/mac80211.c
-index de9ef237..818f4f0c 100644
+index de9ef23..818f4f0 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -597,7 +597,6 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
@@ -283,7 +283,7 @@
  	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
  		skb_queue_head_init(&dev->rx_skb[i]);
 diff --git a/mt76.h b/mt76.h
-index f1795778..42364b81 100644
+index 13c5ca3..a7b2135 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -166,6 +166,7 @@ struct mt76_queue_entry {
@@ -322,7 +322,7 @@
  
  	void (*update_survey)(struct mt76_phy *phy);
  
-@@ -805,7 +812,6 @@ struct mt76_dev {
+@@ -809,7 +816,6 @@ struct mt76_dev {
  
  	struct ieee80211_hw *hw;
  
@@ -330,7 +330,7 @@
  	spinlock_t lock;
  	spinlock_t cc_lock;
  
-@@ -1394,8 +1400,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+@@ -1398,8 +1404,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
  }
  
  void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
@@ -341,7 +341,7 @@
  void mt76_free_pending_rxwi(struct mt76_dev *dev);
  void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  		      struct napi_struct *napi);
-@@ -1541,9 +1547,9 @@ struct mt76_txwi_cache *
+@@ -1545,9 +1551,9 @@ struct mt76_txwi_cache *
  mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
  int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
@@ -354,7 +354,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 36260085..9cbd3625 100644
+index 3626008..9cbd362 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -492,7 +492,6 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -374,10 +374,10 @@
  
  		/* rx data queue for band1 */
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 992beca3..ba728dd0 100644
+index 02261b7..6f80f07 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -603,18 +603,18 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
+@@ -605,18 +605,18 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
  
  	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
  	for (i = 0; i < dev->mt76.rx_token_size; i++) {
@@ -403,7 +403,7 @@
  	}
  
  	mt76_free_pending_rxwi(&dev->mt76);
-@@ -639,7 +639,7 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+@@ -641,7 +641,7 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
  				sizeof(struct skb_shared_info));
  
  	for (i = 0; i < size; i++) {
@@ -412,7 +412,7 @@
  		dma_addr_t phy_addr;
  		int token;
  		void *ptr;
-@@ -658,7 +658,7 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
+@@ -660,7 +660,7 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
  		}
  
  		desc->buf0 = cpu_to_le32(phy_addr);
@@ -421,7 +421,7 @@
  		if (token < 0) {
  			dma_unmap_single(dev->mt76.dma_dev, phy_addr,
  					 wed->wlan.rx_size, DMA_TO_DEVICE);
-@@ -786,7 +786,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+@@ -788,7 +788,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
  	wed->wlan.update_wo_rx_stats = mt7915_mmio_wed_update_rx_stats;
  	wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
  
@@ -430,7 +430,7 @@
  
  	if (mtk_wed_device_attach(wed))
  		return 0;
-@@ -992,6 +992,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
+@@ -994,6 +994,7 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
  				SURVEY_INFO_TIME_RX |
  				SURVEY_INFO_TIME_BSS_RX,
  		.token_size = MT7915_TOKEN_SIZE,
@@ -439,7 +439,7 @@
  		.tx_complete_skb = mt76_connac_tx_complete_skb,
  		.rx_skb = mt7915_queue_rx_skb,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index f02d1721..8db52741 100644
+index b2bcf02..1559164 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -65,6 +65,7 @@
@@ -451,7 +451,7 @@
  #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
  #define MT7915_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
 diff --git a/tx.c b/tx.c
-index 6d55566f..a72b7779 100644
+index 6d55566..a72b777 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -756,16 +756,16 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/4000-mt76-revert-get_of_mac_addr.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/4000-mt76-revert-get_of_mac_addr.patch
index 5ebfb9e..40c8721 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/4000-mt76-revert-get_of_mac_addr.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/4000-mt76-revert-get_of_mac_addr.patch
@@ -1,4 +1,4 @@
-From 7aa9a88eabbde806abfd12b184da25962e436c39 Mon Sep 17 00:00:00 2001
+From 5a110b8b371198d76abc49a14ecf91e811ed06b0 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 10:51:46 +0800
 Subject: [PATCH 4000/4002] mt76: revert get_of_mac_addr
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/4001-mt76-include-header-files-for-module-param.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/4001-mt76-include-header-files-for-module-param.patch
index 26294c5..0dac952 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/4001-mt76-include-header-files-for-module-param.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/4001-mt76-include-header-files-for-module-param.patch
@@ -1,4 +1,4 @@
-From d53ccb460be3361ad41ce64ffd6bd476e752c42d Mon Sep 17 00:00:00 2001
+From 41cc950cb93f75c1b037710cc3058b96514a3352 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 10:38:13 +0800
 Subject: [PATCH 4001/4002] mt76: include header files for module param
@@ -35,7 +35,7 @@
  static bool prefer_offload_fw = true;
  module_param(prefer_offload_fw, bool, 0644);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 291a7c12..56493774 100644
+index 14ce09e..d406013 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -4,6 +4,7 @@
@@ -47,7 +47,7 @@
  int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
  {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 558e6c69..57d8e66e 100644
+index 4185961..0ba822d 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -6,6 +6,7 @@
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/4002-mt76-revert-for-backports-5.15-wireless-stack.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/4002-mt76-revert-for-backports-5.15-wireless-stack.patch
index d8bc572..f0633f1 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/4002-mt76-revert-for-backports-5.15-wireless-stack.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/4002-mt76-revert-for-backports-5.15-wireless-stack.patch
@@ -1,4 +1,4 @@
-From cb2f69a621248ae9d46baffa2ce9ddbc9e307f08 Mon Sep 17 00:00:00 2001
+From c396d72c946d9a67df4a7e52d994daa5ec415e2d Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 12 Dec 2022 18:17:12 +0800
 Subject: [PATCH 4002/4002] mt76: revert for backports-5.15 wireless stack
@@ -39,7 +39,7 @@
  	return 0;
  }
 diff --git a/dma.c b/dma.c
-index 7ef272e2..8b9fdfc5 100644
+index 7ef272e..8b9fdfc 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -941,7 +941,7 @@ mt76_dma_init(struct mt76_dev *dev,
@@ -52,7 +52,7 @@
  		napi_enable(&dev->napi[i]);
  	}
 diff --git a/mac80211.c b/mac80211.c
-index 818f4f0c..909ab259 100644
+index 818f4f0..909ab25 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -1508,7 +1508,7 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
@@ -160,7 +160,7 @@
  		.bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int),
  	};
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 56493774..99851dc0 100644
+index d406013..703ca73 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -197,7 +197,7 @@ int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif)
@@ -541,7 +541,7 @@
  	field = RATE_PARAM_FIXED;
  
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 9cbd3625..5743dc54 100644
+index 9cbd362..5743dc5 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -553,8 +553,8 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -556,7 +556,7 @@
  
  	mt7915_dma_enable(dev);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index ef752e10..9ccbc7bc 100755
+index ef752e1..9ccbc7b 100755
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -1152,8 +1152,7 @@ mt7915_init_he_caps(struct mt7915_phy *phy, enum nl80211_band band,
@@ -570,10 +570,10 @@
  
  		if (band == NL80211_BAND_6GHZ) {
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 7a257b80..0ef0fab0 100644
+index 0d0ae7a..d759912 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -913,7 +913,7 @@ mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
+@@ -915,7 +915,7 @@ mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  	u16 fc, tid;
  	u32 val;
  
@@ -583,10 +583,10 @@
  
  	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 8965e8c2..b1086d26 100644
+index c87f04b..28509d9 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -514,7 +514,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
+@@ -523,7 +523,7 @@ static int mt7915_config(struct ieee80211_hw *hw, u32 changed)
  
  static int
  mt7915_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -595,7 +595,7 @@
  	       const struct ieee80211_tx_queue_params *params)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
-@@ -609,7 +609,7 @@ mt7915_update_bss_color(struct ieee80211_hw *hw,
+@@ -618,7 +618,7 @@ mt7915_update_bss_color(struct ieee80211_hw *hw,
  static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
  				    struct ieee80211_vif *vif,
  				    struct ieee80211_bss_conf *info,
@@ -604,7 +604,7 @@
  {
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
-@@ -629,7 +629,7 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
+@@ -638,7 +638,7 @@ static void mt7915_bss_info_changed(struct ieee80211_hw *hw,
  	}
  
  	if (changed & BSS_CHANGED_ASSOC)
@@ -613,7 +613,7 @@
  
  	if (changed & BSS_CHANGED_ERP_CTS_PROT)
  		mt7915_mac_enable_rtscts(dev, vif, info->use_cts_prot);
-@@ -1214,10 +1214,10 @@ static int mt7915_sta_set_txpwr(struct ieee80211_hw *hw,
+@@ -1223,10 +1223,10 @@ static int mt7915_sta_set_txpwr(struct ieee80211_hw *hw,
  {
  	struct mt7915_phy *phy = mt7915_hw_phy(hw);
  	struct mt7915_dev *dev = mt7915_hw_dev(hw);
@@ -627,7 +627,7 @@
  
  	mutex_lock(&dev->mt76.mutex);
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 57d8e66e..392a5f07 100644
+index 0ba822d..bb2ddcf 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -64,7 +64,7 @@ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
@@ -681,7 +681,7 @@
  }
  
  static int
-@@ -230,7 +230,7 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
+@@ -231,7 +231,7 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
  static void
  mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -690,7 +690,7 @@
  		ieee80211_csa_finish(vif);
  }
  
-@@ -331,7 +331,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
+@@ -332,7 +332,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
  static void
  mt7915_mcu_cca_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -699,7 +699,7 @@
  		return;
  
  	ieee80211_color_change_finish(vif);
-@@ -731,13 +731,13 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -745,13 +745,13 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  		      struct ieee80211_vif *vif)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -715,7 +715,7 @@
  		return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE, sizeof(*he));
-@@ -823,8 +823,8 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+@@ -837,8 +837,8 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
  
  	he->he_cap = cpu_to_le32(cap);
  
@@ -726,7 +726,7 @@
  	case IEEE80211_STA_RX_BW_160:
  		if (elem->phy_cap_info[0] &
  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-@@ -874,7 +874,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -888,7 +888,7 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  			struct ieee80211_sta *sta, struct ieee80211_vif *vif)
  {
  	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
@@ -735,7 +735,7 @@
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
  
-@@ -898,11 +898,11 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -912,11 +912,11 @@ mt7915_mcu_sta_muru_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	muru->cfg.ofdma_dl_en = !!(dev->dbg.muru_onoff & OFDMA_DL);
  	muru->cfg.ofdma_ul_en = !!(dev->dbg.muru_onoff & OFDMA_UL);
  
@@ -750,7 +750,7 @@
  		return;
  
  	muru->mimo_dl.partial_bw_dl_mimo =
-@@ -936,13 +936,13 @@ mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -950,13 +950,13 @@ mt7915_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct sta_rec_ht *ht;
  	struct tlv *tlv;
  
@@ -766,7 +766,7 @@
  }
  
  static void
-@@ -951,15 +951,15 @@ mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+@@ -965,15 +965,15 @@ mt7915_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  	struct sta_rec_vht *vht;
  	struct tlv *tlv;
  
@@ -786,7 +786,7 @@
  }
  
  static void
-@@ -974,7 +974,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -988,7 +988,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	    vif->type != NL80211_IFTYPE_AP)
  		return;
  
@@ -795,7 +795,7 @@
  	    return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
-@@ -983,7 +983,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -997,7 +997,7 @@ mt7915_mcu_sta_amsdu_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	amsdu->amsdu_en = true;
  	msta->wcid.amsdu = true;
  
@@ -804,7 +804,7 @@
  	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
  		if (!is_mt7915(&dev->mt76)) {
  			amsdu->max_mpdu_size =
-@@ -1046,8 +1046,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -1060,8 +1060,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  	if (!bfee && tx_ant < 2)
  		return false;
  
@@ -815,7 +815,7 @@
  
  		if (bfee)
  			return mvif->cap.he_su_ebfee &&
-@@ -1057,8 +1057,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
+@@ -1071,8 +1071,8 @@ mt7915_is_ebf_supported(struct mt7915_phy *phy, struct ieee80211_vif *vif,
  			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
  	}
  
@@ -826,7 +826,7 @@
  
  		if (bfee)
  			return mvif->cap.vht_su_ebfee &&
-@@ -1084,7 +1084,7 @@ static void
+@@ -1098,7 +1098,7 @@ static void
  mt7915_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  		       struct sta_rec_bf *bf)
  {
@@ -835,7 +835,7 @@
  	u8 n = 0;
  
  	bf->tx_mode = MT_PHY_TYPE_HT;
-@@ -1109,7 +1109,7 @@ static void
+@@ -1123,7 +1123,7 @@ static void
  mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  			struct sta_rec_bf *bf, bool explicit)
  {
@@ -844,7 +844,7 @@
  	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
  	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
  	u8 nss_mcs = mt7915_mcu_get_sta_nss(mcs_map);
-@@ -1130,14 +1130,14 @@ mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
+@@ -1144,14 +1144,14 @@ mt7915_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7915_phy *phy,
  		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  		bf->ibf_ncol = bf->ncol;
  
@@ -861,7 +861,7 @@
  			bf->ibf_nrow = 1;
  	}
  }
-@@ -1146,7 +1146,7 @@ static void
+@@ -1160,7 +1160,7 @@ static void
  mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  		       struct mt7915_phy *phy, struct sta_rec_bf *bf)
  {
@@ -870,7 +870,7 @@
  	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
  	const struct ieee80211_sta_he_cap *vc =
  		mt76_connac_get_he_phy_cap(phy->mt76, vif);
-@@ -1171,7 +1171,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+@@ -1185,7 +1185,7 @@ mt7915_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
  	bf->ibf_ncol = bf->ncol;
  
@@ -879,7 +879,7 @@
  		return;
  
  	/* go over for 160MHz and 80p80 */
-@@ -1219,7 +1219,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1233,7 +1233,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	};
  	bool ebf;
  
@@ -888,7 +888,7 @@
  		return;
  
  	ebf = mt7915_is_ebf_supported(phy, vif, sta, false);
-@@ -1233,21 +1233,21 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1247,21 +1247,21 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	 * vht: support eBF and iBF
  	 * ht: iBF only, since mac80211 lacks of eBF support
  	 */
@@ -916,7 +916,7 @@
  		bf->ibf_timeout = 0x48;
  	else
  		bf->ibf_timeout = 0x18;
-@@ -1257,7 +1257,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1271,7 +1271,7 @@ mt7915_mcu_sta_bfer_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	else
  		bf->mem_20m = matrix[bf->nrow][bf->ncol];
  
@@ -925,7 +925,7 @@
  	case IEEE80211_STA_RX_BW_160:
  	case IEEE80211_STA_RX_BW_80:
  		bf->mem_total = bf->mem_20m * 2;
-@@ -1282,7 +1282,7 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1296,7 +1296,7 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
  	u8 nrow = 0;
  
@@ -934,7 +934,7 @@
  		return;
  
  	if (!mt7915_is_ebf_supported(phy, vif, sta, true))
-@@ -1291,13 +1291,13 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
+@@ -1305,13 +1305,13 @@ mt7915_mcu_sta_bfee_tlv(struct mt7915_dev *dev, struct sk_buff *skb,
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
  	bfee = (struct sta_rec_bfee *)tlv;
  
@@ -952,7 +952,7 @@
  
  		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
  				 pc->cap);
-@@ -1353,7 +1353,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -1367,7 +1367,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  			ra->phy = *phy;
  		break;
  	case RATE_PARAM_MMPS_UPDATE:
@@ -961,7 +961,7 @@
  		break;
  	case RATE_PARAM_SPE_UPDATE:
  		ra->spe_idx = *(u8 *)data;
-@@ -1428,7 +1428,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1442,7 +1442,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  	do {									\
  		u8 i, gi = mask->control[band]._gi;				\
  		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
@@ -970,7 +970,7 @@
  			phy.sgi |= gi << (i << (_he));				\
  			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
  		}								\
-@@ -1442,11 +1442,11 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1456,11 +1456,11 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  		}								\
  	} while (0)
  
@@ -985,7 +985,7 @@
  		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
  	} else {
  		nrates = hweight32(mask->control[band].legacy);
-@@ -1480,7 +1480,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+@@ -1494,7 +1494,7 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
  		 * actual txrate hardware sends out.
  		 */
  		addr = mt7915_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
@@ -994,7 +994,7 @@
  			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
  		else
  			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
-@@ -1513,7 +1513,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1527,7 +1527,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  	enum nl80211_band band = chandef->chan->band;
  	struct sta_rec_ra *ra;
  	struct tlv *tlv;
@@ -1003,7 +1003,7 @@
  	u32 cap = sta->wme ? STA_CAP_WMM : 0;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
-@@ -1523,9 +1523,9 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1537,9 +1537,9 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  	ra->auto_rate = true;
  	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
  	ra->channel = chandef->chan->hw_value;
@@ -1016,7 +1016,7 @@
  
  	if (supp_rate) {
  		supp_rate &= mask->control[band].legacy;
-@@ -1545,22 +1545,22 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1559,22 +1559,22 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  		}
  	}
  
@@ -1047,7 +1047,7 @@
  			cap |= STA_CAP_LDPC;
  
  		mt7915_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
-@@ -1568,37 +1568,37 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+@@ -1582,37 +1582,37 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
  		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
  	}
  
@@ -1095,7 +1095,7 @@
  					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
  	}
  
-@@ -1807,7 +1807,7 @@ mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
+@@ -1821,7 +1821,7 @@ mt7915_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
  	if (!offs->cntdwn_counter_offs[0])
  		return;
  
@@ -1104,7 +1104,7 @@
  	tlv = mt7915_mcu_add_nested_subtlv(rskb, sub_tag, sizeof(*info),
  					   &bcn->sub_ntlv, &bcn->len);
  	info = (struct bss_info_bcn_cntdwn *)tlv;
-@@ -1892,9 +1892,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+@@ -1906,9 +1906,9 @@ mt7915_mcu_beacon_cont(struct mt7915_dev *dev, struct ieee80211_vif *vif,
  	if (offs->cntdwn_counter_offs[0]) {
  		u16 offset = offs->cntdwn_counter_offs[0];
  
@@ -1116,7 +1116,7 @@
  			cont->bcc_ofs = cpu_to_le16(offset - 3);
  	}
  
-@@ -2078,7 +2078,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -2092,7 +2092,7 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	if (!en)
  		goto out;
  
@@ -1125,7 +1125,7 @@
  	if (!skb)
  		return -EINVAL;
  
-@@ -3294,17 +3294,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
+@@ -3308,17 +3308,17 @@ int mt7915_mcu_set_txpower_frame(struct mt7915_phy *phy,
  	if (txpower) {
  		u32 offs, len, i;
  
@@ -1147,11 +1147,11 @@
  					len = sku_len[SKU_HE_RU242] * 4;
  				}
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 2ae6c07f..75be1ed9 100644
+index 70382b9..5c71116 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
-@@ -360,12 +360,12 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
- 	}
+@@ -397,12 +397,12 @@ mt7915_tm_entry_add(struct mt7915_phy *phy, u8 aid)
+ 		memcpy(sta->addr, td->addr[0], ETH_ALEN);
  
  	if (td->tx_rate_mode >= MT76_TM_TX_MODE_HT)
 -		memcpy(&sta->deflink.ht_cap, &sband->ht_cap, sizeof(sta->deflink.ht_cap));
@@ -1168,7 +1168,7 @@
  	sta->wme = 1;
  
 diff --git a/tx.c b/tx.c
-index a72b7779..04b6f2e7 100644
+index a72b777..04b6f2e 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -60,20 +60,15 @@ mt76_tx_status_unlock(struct mt76_dev *dev, struct sk_buff_head *list)
diff --git a/feed/atenl/files/iwpriv.sh b/feed/atenl/files/iwpriv.sh
index d42c32b..949c371 100755
--- a/feed/atenl/files/iwpriv.sh
+++ b/feed/atenl/files/iwpriv.sh
@@ -155,7 +155,10 @@
             elif [ "${new_idx}" = "1" ]; then
                 # raix0 & rai0 becomes raix0
                 if [[ $interface_ori == "rai"* ]]; then
-                    new_phy_idx=1
+                    # For AX8400 => don't change phy idx
+                    if [ ${start_idx_7986} != "1" ]; then
+                        new_phy_idx=1
+                    fi
                 # rax0 & ra0 becomes rax0
                 elif [[ $interface_ori == "ra"* ]]; then
                     new_phy_idx=$((start_idx_7986+1))
@@ -200,21 +203,24 @@
 }
 
 function convert_tx_mode() {
-    if [ "$1" = "0" ]; then
+    # Remove leading zeros
+    local tx_mode=$(echo $1 | sed 's/^0*//')
+
+    if [ "$tx_mode" = "0" ]; then
         echo "cck"
-    elif [ "$1" = "1" ]; then
+    elif [ "$tx_mode" = "1" ]; then
         echo "ofdm"
-    elif [ "$1" = "2" ]; then
+    elif [ "$tx_mode" = "2" ]; then
         echo "ht"
-    elif [ "$1" = "4" ]; then
+    elif [ "$tx_mode" = "4" ]; then
         echo "vht"
-    elif [ "$1" = "8" ]; then
+    elif [ "$tx_mode" = "8" ]; then
         echo "he_su"
-    elif [ "$1" = "9" ]; then
+    elif [ "$tx_mode" = "9" ]; then
         echo "he_er"
-    elif [ "$1" = "10" ]; then
+    elif [ "$tx_mode" = "10" ]; then
         echo "he_tb"
-    elif [ "$1" = "11" ]; then
+    elif [ "$tx_mode" = "11" ]; then
         echo "he_mu"
     else
         echo "undefined"
@@ -305,11 +311,30 @@
     local base_chan=1
     local control_freq=0
     local base_freq=0
+    local band=$(echo $1 | sed s/:/' '/g | cut -d " " -f 2)
+    local temp=$((phy_idx+1))
 
-    if [ -z ${ctrl_band_idx} ]; then
-        local band=$(echo $1 | sed s/:/' '/g | cut -d " " -f 2)
-    else
-        local band=$ctrl_band_idx
+    # Handle ATECTRLBANDIDX
+    if [ ! -z ${ctrl_band_idx} ]; then
+        if [ "${ctrl_band_idx}" == "1" ] && [ ${band} == "0" ]; then
+            local temp=$(cat "/etc/config/wireless"| grep "option band" | sed -n ${temp}p | cut -c 15)
+            if [ "${temp}" == "2" ]; then
+                local band=0
+            elif [ "${temp}" == "5" ]; then
+                local band=1
+            elif [ "${temp}" == "6" ]; then
+                local band=2
+            else
+                echo "iwpriv wrapper band translate error!"
+            fi
+        else
+            # mt7915 in AX8400 case: band should be determined by only the input band
+            if [ "${start_idx_7986}" == "1" ] && [ ${phy_idx} == "0" ]; then
+                local band=$((band))
+            else
+                local band=$((ctrl_band_idx * band))
+            fi
+        fi
     fi
 
     if [[ $1 != *":"* ]] || [ "${band}" = "0" ]; then
@@ -625,12 +650,17 @@
     case ${cmd} in
         "ATETxBfInit")
             new_cmd="init"
-            new_param=1
+            new_param="1"
+            do_cmd "mt76-test phy${phy_idx} set state=idle"
+            ;;
+        "ATETxBfGdInit")
+            new_cmd="golden_init"
+            new_param="1"
             do_cmd "mt76-test phy${phy_idx} set state=idle"
             ;;
         "ATEIBFPhaseComp")
             new_cmd="phase_comp"
-            new_param="${new_param} aid=1"
+            new_param="${new_param}"
             ;;
         "ATEEBfProfileConfig")
             new_cmd="ebf_prof_update"
@@ -670,6 +700,77 @@
         "ATEIBFPhaseE2pUpdate")
             new_cmd="e2p_update"
             ;;
+        "ATEIBFPhaseVerify")
+            local group=${new_param:0:2}
+            local group_l_m_h=${new_param:3:2}
+            local band_idx=${new_param:6:2}
+            local phase_cal_type=${new_param:9:2}
+            local LNA_gain_level=${new_param:12:2}
+            local read_from_e2p=${new_param:15:2}
+
+            do_cmd "mt76-test phy${phy_idx} set txbf_act=phase_comp txbf_param=1,${band_idx},${group},${read_from_e2p},0"
+            new_cmd="phase_cal"
+            new_param="${group},${group_l_m_h},${band_idx},${phase_cal_type},${LNA_gain_level}"
+            ;;
+        "TxBfProfileTagRead")
+            new_cmd="pfmu_tag_read"
+            ;;
+        "TxBfProfileTagWrite")
+            new_cmd="pfmu_tag_write"
+            ;;
+        "TxBfProfileTagInValid")
+            new_cmd="set_invalid_prof"
+            ;;
+        "StaRecBfRead")
+            new_cmd="sta_rec_read"
+            ;;
+        "TriggerSounding")
+            new_cmd="trigger_sounding"
+            ;;
+        "StopSounding")
+            new_cmd="stop_sounding"
+            new_param="0"
+            ;;
+        "ATEConTxETxBfGdProc")
+            local tx_rate_mode=$(convert_tx_mode ${new_param:0:2})
+            local tx_rate_idx=${new_param:3:2}
+            local bw=$(echo ${new_param:6:2} | sed 's/^0//')
+            local channel=${new_param:9:3}
+            local channel2=${new_param:13:3}
+            local band=${new_param:17}
+
+            new_cmd="ebf_golden_init"
+            do_ate_work "ATESTART"
+            do_cmd "mt76-test phy${phy_idx} set state=idle"
+            record_config "ATETXBW" ${bw} ${iwpriv_file}
+            convert_channel "${channel}:${band}"
+            if [ "${bw}" = "5" ]; then
+                new_param="1,1"
+            else
+                new_param="1,0"
+            fi
+            do_cmd "mt76-test phy${phy_idx} set tx_rate_mode=${tx_rate_mode} tx_rate_idx=${tx_rate_idx} tx_rate_sgi=0"
+            ;;
+        "ATEConTxETxBfInitProc")
+            local tx_rate_mode=$(convert_tx_mode ${new_param:0:2})
+            local tx_rate_idx=${new_param:3:2}
+            local bw=$(echo ${new_param:6:2} | sed 's/^0//')
+            local tx_rate_nss=${new_param:9:2}
+            local tx_stream=${new_param:12:2}
+            local tx_power=${new_param:15:2}
+            local channel=${new_param:18:3}
+            local channel2=${new_param:22:3}
+            local band=${new_param:26:1}
+            local tx_length=${new_param:28:5}
+
+            new_cmd="ebf_init"
+            do_ate_work "ATESTART"
+            do_cmd "mt76-test phy${phy_idx} set state=idle"
+            record_config "ATETXBW" ${bw} ${iwpriv_file}
+            convert_channel "${channel}:${band}"
+            new_param="1"
+            do_cmd "mt76-test phy${phy_idx} set tx_rate_mode=${tx_rate_mode} tx_rate_idx=${tx_rate_idx} tx_rate_nss=${tx_rate_nss} tx_rate_sgi=0 tx_rate_ldpc=1 tx_power=${tx_power},0,0,0 tx_count=10000000 tx_length=${tx_length} tx_ipg=4"
+            ;;
         *)
     esac
 
@@ -677,6 +778,24 @@
 
     if [ "${cmd}" = "ATETxPacketWithBf" ]; then
         do_cmd "mt76-test phy${phy_idx} set state=tx_frames"
+    elif [ "${cmd}" = "ATEConTxETxBfInitProc" ]; then
+        do_cmd "mt76-test phy${phy_idx} set aid=1"
+        do_cmd "mt76-test phy${phy_idx} set txbf_act=stop_sounding txbf_param=1"
+        do_cmd "mt76-test phy${phy_idx} set txbf_act=update_ch txbf_param=1"
+        do_cmd "mt76-test phy${phy_idx} set txbf_act=ebf_prof_update txbf_param=0,0,0"
+        do_cmd "mt76-test phy${phy_idx} set txbf_act=apply_tx txbf_param=1,1,0,0,0"
+        do_cmd "mt76-test phy${phy_idx} set txbf_act=pfmu_tag_read txbf_param=0,1"
+        do_cmd "mt76-test phy${phy_idx} set txbf_act=sta_rec_read txbf_param=1"
+        do_cmd "mt76-test phy${phy_idx} set txbf_act=trigger_sounding txbf_param=0,1,0,1,0,0,0"
+        do_cmd "mt76-test phy${phy_idx} set txbf_act=trigger_sounding txbf_param=2,1,ff,1,0,0,0"
+        do_cmd "mt76-test phy${phy_idx} set state=rx_frames"
+    elif [ "${cmd}" = "ATEConTxETxBfGdProc" ]; then
+        do_cmd "mt76-test phy${phy_idx} set aid=1"
+        do_cmd "mt76-test phy${phy_idx} set state=rx_frames"
+    elif [ "${cmd}" = "ATETxBfInit" ]; then
+        do_cmd "mt76-test phy${phy_idx} set aid=1"
+    elif [ "${cmd}" = "ATETxBfGdInit" ]; then
+        do_cmd "mt76-test phy${phy_idx} set aid=1"
     fi
 }
 
@@ -834,6 +953,9 @@
                 exit
             fi
             param_new=${param}
+            if [ "${cmd}" = "ATETXCNT" ] && [ "${param}" = "0" ]; then
+                param_new="10000000"
+            fi
             ;;
         "ATETXANT"|"ATERXANT")
             cmd_new="tx_antenna"
@@ -883,9 +1005,11 @@
             convert_dfs ${cmd} ${param}
             skip=1
             ;;
-        "ATETxBfInit"|"ATEIBFPhaseComp"|"ATEEBfProfileConfig"|"ATEIBfProfileConfig"| \
-        "TxBfTxApply"|"ATETxPacketWithBf"|"TxBfProfileData20MAllWrite"|"ATEIBfInstCal"|\
-        "ATEIBfGdCal"|"ATEIBFPhaseE2pUpdate")
+        "ATETxBfInit"|"ATETxBfGdInit"|"ATEIBFPhaseComp"|"ATEEBfProfileConfig"|"ATEIBfProfileConfig"| \
+        "TxBfTxApply"|"ATETxPacketWithBf"|"TxBfProfileData20MAllWrite"|"ATEIBfInstCal"| \
+        "ATEIBfGdCal"|"ATEIBFPhaseE2pUpdate"|"TriggerSounding"|"StopSounding"| \
+        "StaRecBfRead"|"TxBfProfileTagInValid"|"TxBfProfileTagWrite"|"TxBfProfileTagRead"| \
+        "ATEIBFPhaseVerify"|"ATEConTxETxBfGdProc"|"ATEConTxETxBfInitProc")
             convert_ibf ${cmd} ${param}
             skip=1
             ;;
@@ -913,8 +1037,16 @@
     fi
 
 elif [ "${cmd_type}" = "show" ]; then
-    do_cmd "mt76-test ${interface} dump"
-    do_cmd "mt76-test ${interface} dump stats"
+    if [ "${cmd}" = "wtbl" ]; then
+        wlan_idx=/sys/kernel/debug/ieee80211/phy${phy_idx}/mt76/wlan_idx
+        wtbl_info=/sys/kernel/debug/ieee80211/phy${phy_idx}/mt76/wtbl_info
+
+        do_cmd "echo ${param} > ${wlan_idx}"
+        do_cmd "cat ${wtbl_info}"
+    else
+        do_cmd "mt76-test ${interface} dump"
+        do_cmd "mt76-test ${interface} dump stats"
+    fi
 
 elif [ "${cmd_type}" = "e2p" ]; then
     offset=$(printf "0x%s" ${cmd})
diff --git a/feed/atenl/src/nl.h b/feed/atenl/src/nl.h
index 44a0a3f..1c774c9 100644
--- a/feed/atenl/src/nl.h
+++ b/feed/atenl/src/nl.h
@@ -266,7 +266,10 @@
 };
 
 enum mt76_testmode_txbf_act {
+	MT76_TM_TXBF_ACT_GOLDEN_INIT,
 	MT76_TM_TXBF_ACT_INIT,
+	MT76_TM_TX_EBF_ACT_GOLDEN_INIT,
+	MT76_TM_TX_EBF_ACT_INIT,
 	MT76_TM_TXBF_ACT_UPDATE_CH,
 	MT76_TM_TXBF_ACT_PHASE_COMP,
 	MT76_TM_TXBF_ACT_TX_PREP,
@@ -277,6 +280,12 @@
 	MT76_TM_TXBF_ACT_PROF_UPDATE_ALL,
 	MT76_TM_TXBF_ACT_PROF_UPDATE_ALL_CMD,
 	MT76_TM_TXBF_ACT_E2P_UPDATE,
+	MT76_TM_TXBF_ACT_TRIGGER_SOUNDING,
+	MT76_TM_TXBF_ACT_STOP_SOUNDING,
+	MT76_TM_TXBF_ACT_PROFILE_TAG_READ,
+	MT76_TM_TXBF_ACT_PROFILE_TAG_WRITE,
+	MT76_TM_TXBF_ACT_PROFILE_TAG_INVALID,
+	MT76_TM_TXBF_ACT_STA_REC_READ,
 
 	/* keep last */
 	NUM_MT76_TM_TXBF_ACT,