diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch
index 66ab9ce..28a93cc 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0001-wifi-mt76-mt7996-add-eht-rx-rate-support.patch
@@ -1,7 +1,7 @@
-From 995b09b6a62700568b36cc2e4ae6b6063456942b Mon Sep 17 00:00:00 2001
+From c23474064033e8f22f599b19c0580b045968c831 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 10 Feb 2023 17:39:23 +0800
-Subject: [PATCH 01/19] wifi: mt76: mt7996: add eht rx rate support
+Subject: [PATCH 01/29] wifi: mt76: mt7996: add eht rx rate support
 
 Add support to report eht rx rate.
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0002-wifi-mt76-mt7996-let-non-bufferable-MMPDUs-use-corre.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0002-wifi-mt76-mt7996-let-non-bufferable-MMPDUs-use-corre.patch
index 872ef03..e2322e8 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0002-wifi-mt76-mt7996-let-non-bufferable-MMPDUs-use-corre.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0002-wifi-mt76-mt7996-let-non-bufferable-MMPDUs-use-corre.patch
@@ -1,7 +1,7 @@
-From 5b858f7f944144d99fb0ca1ef26d6b8c6719890c Mon Sep 17 00:00:00 2001
+From c31547ef67fd39b10eefc4516020383c822a55ee Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 16 Feb 2023 10:52:22 +0800
-Subject: [PATCH 02/19] wifi: mt76: mt7996: let non-bufferable MMPDUs use
+Subject: [PATCH 02/29] wifi: mt76: mt7996: let non-bufferable MMPDUs use
  correct hw queue
 
 non-bufferable MMPDUs are expected to use ALTX hw queue, but current
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0006-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0003-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch
similarity index 89%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0006-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0003-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch
index 65596f4..5ccaf1e 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0006-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0003-wifi-mt76-mt7996-fix-pointer-calculation-in-ie-count.patch
@@ -1,7 +1,7 @@
-From 00d76d4dc3cdb719b5fc234d9cf3bbef39f448ce Mon Sep 17 00:00:00 2001
+From 0c30c9dd897963c3524105599fa611aa5369b34e Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 13 Feb 2023 14:48:10 +0800
-Subject: [PATCH 06/19] wifi: mt76: mt7996: fix pointer calculation in ie
+Subject: [PATCH 03/29] wifi: mt76: mt7996: fix pointer calculation in ie
  countdown event
 
 Fix the tail and data pointers. The rxd->len in mt7996_mcu_rxd does not
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0016-wifi-mt76-mt7996-init-mpdu-density.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0004-wifi-mt76-mt7996-init-mpdu-density.patch
similarity index 80%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0016-wifi-mt76-mt7996-init-mpdu-density.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0004-wifi-mt76-mt7996-init-mpdu-density.patch
index 74992ab..299d240 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0016-wifi-mt76-mt7996-init-mpdu-density.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0004-wifi-mt76-mt7996-init-mpdu-density.patch
@@ -1,7 +1,7 @@
-From 322307272a4c4ccb627d6596220b0ab5bd4aed45 Mon Sep 17 00:00:00 2001
+From 39eb5f447d4cba23c684744800609c17bfb457e4 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 13 Feb 2023 09:46:40 +0800
-Subject: [PATCH 16/19] wifi: mt76: mt7996: init mpdu density
+Subject: [PATCH 04/29] wifi: mt76: mt7996: init mpdu density
 
 Init mpdu density based on the hardware capability to
 prevent hardware drop.
@@ -12,10 +12,10 @@
  1 file changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index ced38ac8..479b2cee 100644
+index 946da93e..de94e151 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
-@@ -374,10 +374,13 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
+@@ -196,10 +196,13 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
  
  	hw->max_tx_fragments = 4;
  
@@ -30,7 +30,7 @@
  
  	if (phy->mt76->cap.has_5ghz) {
  		phy->mt76->sband_5g.sband.ht_cap.cap |=
-@@ -389,6 +392,8 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
+@@ -211,6 +214,8 @@ mt7996_init_wiphy(struct ieee80211_hw *hw)
  			IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK |
  			IEEE80211_VHT_CAP_SHORT_GI_160 |
  			IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
@@ -39,7 +39,7 @@
  	}
  
  	mt76_set_stream_caps(phy->mt76, true);
-@@ -873,7 +878,7 @@ mt7996_init_he_caps(struct mt7996_phy *phy, enum nl80211_band band,
+@@ -689,7 +694,7 @@ mt7996_init_he_caps(struct mt7996_phy *phy, enum nl80211_band band,
  		u16 cap = IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
  			  IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS;
  
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0007-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0005-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch
similarity index 91%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0007-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0005-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch
index 7988196..dcd8cf1 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0007-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0005-wifi-mt76-mt7996-remove-mt7996_mcu_set_pm.patch
@@ -1,7 +1,7 @@
-From c2dafe57df1726acb80e30987bc8d678b86af14a Mon Sep 17 00:00:00 2001
+From 770f4020e030af0b930f761513275d6284a9344f Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Tue, 14 Feb 2023 18:35:43 +0800
-Subject: [PATCH 07/19] wifi: mt76: mt7996: remove mt7996_mcu_set_pm()
+Subject: [PATCH 05/29] wifi: mt76: mt7996: remove mt7996_mcu_set_pm()
 
 Currently using BSS_INFO_PS command will sometimes cause packet drop in
 hw rx queue.
@@ -17,10 +17,10 @@
  3 files changed, 35 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index a4fd9e24..44d23e1d 100644
+index 3e4da035..f13f67b2 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -56,10 +56,6 @@ static int mt7996_start(struct ieee80211_hw *hw)
+@@ -52,10 +52,6 @@ static int mt7996_start(struct ieee80211_hw *hw)
  
  	set_bit(MT76_STATE_RUNNING, &phy->mt76->state);
  
@@ -31,7 +31,7 @@
  	ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
  				     MT7996_WATCHDOG_TIME);
  
-@@ -85,10 +81,6 @@ static void mt7996_stop(struct ieee80211_hw *hw)
+@@ -79,10 +75,6 @@ static void mt7996_stop(struct ieee80211_hw *hw)
  
  	clear_bit(MT76_STATE_RUNNING, &phy->mt76->state);
  
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0015-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0006-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch
similarity index 89%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0015-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0006-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch
index 236cada..679e354 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0015-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0006-wifi-mt76-mt7996-fix-eeprom-antenna-bitfield-mask.patch
@@ -1,7 +1,7 @@
-From 763303e5fb846c92c22dd19ffec95d844103e425 Mon Sep 17 00:00:00 2001
+From 9a407d91aec5a9320d3522d5c5d12c99503355b2 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 23 Feb 2023 19:18:45 +0800
-Subject: [PATCH 15/19] wifi: mt76: mt7996: fix eeprom antenna bitfield mask
+Subject: [PATCH 06/29] wifi: mt76: mt7996: fix eeprom antenna bitfield mask
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0003-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0007-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
similarity index 85%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0003-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0007-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
index c91eb62..b9081c5 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0003-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0007-wifi-mt76-mt7996-reduce-repeated-bss_info-and-sta_re.patch
@@ -1,7 +1,7 @@
-From 09ef1c1248c8b38c5f2c6e624397e64e8938349f Mon Sep 17 00:00:00 2001
+From 0983321b5cc8138e316fce622c7cd1e12951b046 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 16 Feb 2023 00:39:01 +0800
-Subject: [PATCH 03/19] wifi: mt76: mt7996: reduce repeated bss_info and
+Subject: [PATCH 07/29] wifi: mt76: mt7996: reduce repeated bss_info and
  sta_rec commands
 
 Refine the flow of setting bss_info and sta_rec commands to prevent from
@@ -14,10 +14,10 @@
  1 file changed, 6 insertions(+), 15 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 3e4da035..e80ee19e 100644
+index f13f67b2..ab28ebeb 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
-@@ -241,8 +241,8 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+@@ -233,8 +233,8 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  	int idx = msta->wcid.idx;
  
@@ -27,7 +27,7 @@
  
  	if (vif == phy->monitor_vif)
  		phy->monitor_vif = NULL;
-@@ -510,17 +510,13 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+@@ -502,17 +502,13 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
  	/* station mode uses BSSID to map the wlan entry to a peer,
  	 * and then peer references bss_info_rfch to set bandwidth cap.
  	 */
@@ -50,7 +50,7 @@
  	if (changed & BSS_CHANGED_ERP_CTS_PROT)
  		mt7996_mac_enable_rtscts(dev, vif, info->use_cts_prot);
  
-@@ -533,11 +529,6 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+@@ -525,11 +521,6 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
  		}
  	}
  
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0004-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0008-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch
similarity index 76%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0004-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0008-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch
index cc366e3..5c63463 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0004-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0008-wifi-mt76-mt7996-move-radio-enable-command-to-mt7996.patch
@@ -1,7 +1,7 @@
-From c86f2243472f00fd2011cc44b89a87f7f6e2066a Mon Sep 17 00:00:00 2001
+From c3d13a89b2236a68d0cd5e0ed4e2ff8163ce7bf2 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 15 Feb 2023 18:38:04 +0800
-Subject: [PATCH 04/19] wifi: mt76: mt7996: move radio enable command to
+Subject: [PATCH 08/29] wifi: mt76: mt7996: move radio enable command to
  mt7996_start()
 
 The radio enable and disable commands are used for per-phy radio, so
@@ -14,7 +14,7 @@
  1 file changed, 6 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index e80ee19e..a4fd9e24 100644
+index ab28ebeb..44d23e1d 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -46,6 +46,10 @@ static int mt7996_start(struct ieee80211_hw *hw)
@@ -28,7 +28,7 @@
  	ret = mt7996_mcu_set_chan_info(phy, UNI_CHANNEL_RX_PATH);
  	if (ret)
  		goto out;
-@@ -77,6 +81,8 @@ static void mt7996_stop(struct ieee80211_hw *hw)
+@@ -73,6 +77,8 @@ static void mt7996_stop(struct ieee80211_hw *hw)
  
  	mutex_lock(&dev->mt76.mutex);
  
@@ -36,8 +36,8 @@
 +
  	clear_bit(MT76_STATE_RUNNING, &phy->mt76->state);
  
- 	ieee80211_iterate_interfaces(dev->mt76.hw,
-@@ -189,10 +195,6 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
+ 	mutex_unlock(&dev->mt76.mutex);
+@@ -181,10 +187,6 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
  	if (ret)
  		goto out;
  
@@ -48,7 +48,7 @@
  	dev->mt76.vif_mask |= BIT_ULL(mvif->mt76.idx);
  	phy->omac_mask |= BIT_ULL(mvif->mt76.omac_idx);
  
-@@ -248,7 +250,6 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+@@ -240,7 +242,6 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
  		phy->monitor_vif = NULL;
  
  	mt7996_mcu_add_dev_info(phy, vif, false);
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0005-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0009-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
similarity index 91%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0005-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0009-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
index 07dffec..4509388 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0005-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0009-wifi-mt76-connac-set-correct-muar_idx-for-connac3-ch.patch
@@ -1,7 +1,7 @@
-From 5d4c7f88b2066f4a8ec1769cf6c067d0e88abfa3 Mon Sep 17 00:00:00 2001
+From 0a3940d0eaa4fa234c30d27c4f06b001caf0e5a0 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 16 Feb 2023 13:53:14 +0800
-Subject: [PATCH 05/19] wifi: mt76: connac: set correct muar_idx for connac3
+Subject: [PATCH 09/29] wifi: mt76: connac: set correct muar_idx for connac3
  chipset
 
 Set the muar_idx to 0xe for the hw bcast/mcast station entry of connac3
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0008-wifi-mt76-mt7996-add-muru-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0010-wifi-mt76-mt7996-add-muru-support.patch
similarity index 97%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0008-wifi-mt76-mt7996-add-muru-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0010-wifi-mt76-mt7996-add-muru-support.patch
index 20d7f48..d8b0cb5 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0008-wifi-mt76-mt7996-add-muru-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0010-wifi-mt76-mt7996-add-muru-support.patch
@@ -1,7 +1,7 @@
-From b587a9f1615585f8db0fa98cc46791a3253ddac7 Mon Sep 17 00:00:00 2001
+From e625dc373c444f9b5ccb1334319ea53466bc5d4a Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
 Date: Mon, 28 Nov 2022 14:36:09 +0800
-Subject: [PATCH 08/19] wifi: mt76: mt7996: add muru support
+Subject: [PATCH 10/29] wifi: mt76: mt7996: add muru support
 
 Add sta_rec_muru() and related phy cap for MU and RU support.
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0009-wifi-mt76-mt7996-set-txd-v1.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0011-wifi-mt76-mt7996-set-txd-v1.patch
similarity index 92%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0009-wifi-mt76-mt7996-set-txd-v1.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0011-wifi-mt76-mt7996-set-txd-v1.patch
index cc7548a..acd0139 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0009-wifi-mt76-mt7996-set-txd-v1.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0011-wifi-mt76-mt7996-set-txd-v1.patch
@@ -1,7 +1,7 @@
-From 9a1a54c7df9babadd8f6ae066deb2b5e49715cb0 Mon Sep 17 00:00:00 2001
+From d6998e58f199c6f7bef7022ccae96d6679ef264f Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Feb 2023 10:40:33 +0800
-Subject: [PATCH 09/19] wifi: mt76: mt7996: set txd v1
+Subject: [PATCH 11/29] wifi: mt76: mt7996: set txd v1
 
 ---
  mt7996/mac.c | 3 +++
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0010-wifi-mt76-mt7996-add-thermal-protection-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0012-wifi-mt76-mt7996-add-thermal-protection-support.patch
similarity index 96%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0010-wifi-mt76-mt7996-add-thermal-protection-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0012-wifi-mt76-mt7996-add-thermal-protection-support.patch
index 319eb1f..9ab919e 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0010-wifi-mt76-mt7996-add-thermal-protection-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0012-wifi-mt76-mt7996-add-thermal-protection-support.patch
@@ -1,7 +1,7 @@
-From 1744b5397ad4240ce41bf88bfff2eef34d76d587 Mon Sep 17 00:00:00 2001
+From 43cb74cdfc3651a15f6dd2b22bff3a83a2464950 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 2 Feb 2023 21:20:31 +0800
-Subject: [PATCH 10/19] wifi: mt76: mt7996: add thermal protection support
+Subject: [PATCH 12/29] wifi: mt76: mt7996: add thermal protection support
 
 This commit includes the following changes:
 1. implement MTK thermal protection driver API
@@ -30,7 +30,7 @@
  
  #define MCU_UNI_CMD_EVENT			BIT(1)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 946da93e..5a22cd81 100644
+index de94e151..44165a35 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -41,6 +41,98 @@ static const struct ieee80211_iface_combination if_comb[] = {
@@ -132,7 +132,7 @@
  static void mt7996_led_set_config(struct led_classdev *led_cdev,
  				  u8 delay_on, u8 delay_off)
  {
-@@ -367,6 +459,10 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
+@@ -372,6 +464,10 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
  	if (ret)
  		goto error;
  
@@ -143,7 +143,7 @@
  	ret = mt7996_init_debugfs(phy);
  	if (ret)
  		goto error;
-@@ -387,6 +483,8 @@ mt7996_unregister_phy(struct mt7996_phy *phy, enum mt76_band_id band)
+@@ -392,6 +488,8 @@ mt7996_unregister_phy(struct mt7996_phy *phy, enum mt76_band_id band)
  	if (!phy)
  		return;
  
@@ -152,7 +152,7 @@
  	mphy = phy->dev->mt76.phys[band];
  	mt76_unregister_phy(mphy);
  	ieee80211_free_hw(mphy->hw);
-@@ -876,6 +974,10 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -881,6 +979,10 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
@@ -163,7 +163,7 @@
  	ieee80211_queue_work(mt76_hw(dev), &dev->init_work);
  
  	ret = mt7996_register_phy(dev, mt7996_phy2(dev), MT_BAND1);
-@@ -893,6 +995,9 @@ void mt7996_unregister_device(struct mt7996_dev *dev)
+@@ -898,6 +1000,9 @@ void mt7996_unregister_device(struct mt7996_dev *dev)
  {
  	mt7996_unregister_phy(mt7996_phy3(dev), MT_BAND2);
  	mt7996_unregister_phy(mt7996_phy2(dev), MT_BAND1);
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0011-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0013-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
similarity index 96%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0011-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0013-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
index 3de5b90..131536e 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0011-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0013-wifi-mt76-mt7996-add-thermal-sensor-device-support.patch
@@ -1,7 +1,7 @@
-From afdb511f0febad0e0cc5572461ab04794cf86852 Mon Sep 17 00:00:00 2001
+From f2ef3b6850401af359d0446ca86d882ef2a96ce7 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 2 Feb 2023 20:53:42 +0800
-Subject: [PATCH 11/19] wifi: mt76: mt7996: add thermal sensor device support
+Subject: [PATCH 13/29] wifi: mt76: mt7996: add thermal sensor device support
 
 ---
  mt7996/init.c | 87 +++++++++++++++++++++++++++++++++++++++++++++++++++
@@ -9,7 +9,7 @@
  2 files changed, 128 insertions(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 5a22cd81..631ada15 100644
+index 44165a35..7350194f 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -4,6 +4,8 @@
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0012-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0014-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch
similarity index 96%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0012-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0014-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch
index 728b4e0..a3f5531 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0012-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0014-wifi-mt76-mt7996-add-802.11s-mesh-amsdu-de-amsdu-sup.patch
@@ -1,7 +1,7 @@
-From f78111386b1ac57a459687b9d58e1804a80d4970 Mon Sep 17 00:00:00 2001
+From cd1bbd6253594e8836b072a947c0b8b1d278a615 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Feb 2023 11:34:51 +0800
-Subject: [PATCH 12/19] wifi: mt76: mt7996: add 802.11s mesh amsdu/de-amsdu
+Subject: [PATCH 14/29] wifi: mt76: mt7996: add 802.11s mesh amsdu/de-amsdu
  support
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0013-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0015-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch
similarity index 98%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0013-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0015-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch
index 93ec12d..2a07e16 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0013-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0015-wifi-mt76-mt7996-add-L0.5-system-error-recovery-supp.patch
@@ -1,7 +1,7 @@
-From 6b8dfe2580a782be754be7bcd44da6ad79dc4231 Mon Sep 17 00:00:00 2001
+From 56bbd0875ca8a21737d1b87c85eb38433c787e57 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 13 Feb 2023 18:00:25 +0800
-Subject: [PATCH 13/19] wifi: mt76: mt7996: add L0.5 system error recovery
+Subject: [PATCH 15/29] wifi: mt76: mt7996: add L0.5 system error recovery
  support
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
@@ -295,7 +295,7 @@
  {
  	mt7996_dma_disable(dev, true);
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 631ada15..ced38ac8 100644
+index 7350194f..479b2cee 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -278,8 +278,7 @@ static void mt7996_led_set_brightness(struct led_classdev *led_cdev,
@@ -308,7 +308,7 @@
  		    struct ieee80211_supported_band *sband)
  {
  	int i, nss = hweight8(dev->mphy.antenna_mask);
-@@ -429,7 +428,7 @@ mt7996_mac_init_band(struct mt7996_dev *dev, u8 band)
+@@ -434,7 +433,7 @@ mt7996_mac_init_band(struct mt7996_dev *dev, u8 band)
  	mt76_rmw(dev, MT_WTBLOFF_RSCR(band), mask, set);
  }
  
@@ -317,7 +317,7 @@
  {
  #define HIF_TXD_V2_1	4
  	int i;
-@@ -463,7 +462,7 @@ static void mt7996_mac_init(struct mt7996_dev *dev)
+@@ -468,7 +467,7 @@ static void mt7996_mac_init(struct mt7996_dev *dev)
  		mt7996_mac_init_band(dev, i);
  }
  
@@ -326,7 +326,7 @@
  {
  	int ret;
  
-@@ -1075,6 +1074,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
+@@ -1080,6 +1079,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0014-wifi-mt76-mt7996-add-dsp-firmware-download.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0016-wifi-mt76-mt7996-add-dsp-firmware-download.patch
similarity index 97%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0014-wifi-mt76-mt7996-add-dsp-firmware-download.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0016-wifi-mt76-mt7996-add-dsp-firmware-download.patch
index 8193a5a..67a5209 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0014-wifi-mt76-mt7996-add-dsp-firmware-download.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0016-wifi-mt76-mt7996-add-dsp-firmware-download.patch
@@ -1,7 +1,7 @@
-From 2d6ca0f6974ad4f6dcf110ccbbcbbc7185aa7655 Mon Sep 17 00:00:00 2001
+From 74dd56acd59a3c85279b5e21be789fbca5fdcc57 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 17 Feb 2023 14:13:38 +0800
-Subject: [PATCH 14/19] wifi: mt76: mt7996: add dsp firmware download
+Subject: [PATCH 16/29] wifi: mt76: mt7996: add dsp firmware download
 
 Add DSP firmware for phy related control. Without this patch,the
 firmware state would not be ready.
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0017-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0017-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch
index 0b179f4..6e63254 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0017-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0017-wifi-mt76-mt7996-fix-icv-error-when-enable-AP-and-ST.patch
@@ -1,46 +1,23 @@
-From b4af2c843368e7a787fc02ebde5a8ff41edf0a76 Mon Sep 17 00:00:00 2001
+From ce62eda4ead9fcb2374f5d0933da5416a48e64ed Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Thu, 2 Mar 2023 15:44:52 +0800
-Subject: [PATCH 17/19] wifi: mt76: mt7996: fix icv error when enable AP and
+Subject: [PATCH 17/29] wifi: mt76: mt7996: fix icv error when enable AP and
  STA simultaneously
 
 Fix mcu command content to prevent ICV error
-1. The legacy mld index needs to start from 16.
-2. The bmc_tx_wlan_idx needs to be the vif index rather
+The bmc_tx_wlan_idx needs to be the vif index rather
 than peer AP's index.
 
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
 ---
- mt7996/mcu.c | 12 +++++++++---
- 1 file changed, 9 insertions(+), 3 deletions(-)
+ mt7996/mcu.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 09800ff2..829f7be6 100644
+index 09800ff2..07c521c1 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -664,6 +664,7 @@ mt7996_mcu_bss_txcmd_tlv(struct sk_buff *skb, bool en)
- static void
- mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
- {
-+#define MT7996_LEGACY_MLD_IDX_START 16
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct bss_mld_tlv *mld;
- 	struct tlv *tlv;
-@@ -672,8 +673,12 @@ mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
- 
- 	mld = (struct bss_mld_tlv *)tlv;
- 	mld->group_mld_id = 0xff;
--	mld->own_mld_id = mvif->mt76.idx;
-+	mld->own_mld_id = MT7996_LEGACY_MLD_IDX_START + mvif->mt76.idx;
- 	mld->remap_idx = 0xff;
-+	if (vif->type == NL80211_IFTYPE_AP) {
-+		mld->group_mld_id = MT7996_LEGACY_MLD_IDX_START + mvif->mt76.idx;
-+		memcpy(mld->mac_addr, vif->bss_conf.bssid, ETH_ALEN);
-+	}
- }
- 
- static void
-@@ -744,6 +749,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -744,6 +744,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  	struct cfg80211_chan_def *chandef = &phy->chandef;
  	struct mt76_connac_bss_basic_tlv *bss;
  	u32 type = CONNECTION_INFRA_AP;
@@ -48,7 +25,7 @@
  	struct tlv *tlv;
  	int idx;
  
-@@ -763,7 +769,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -763,7 +764,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  				struct mt76_wcid *wcid;
  
  				wcid = (struct mt76_wcid *)sta->drv_priv;
@@ -57,7 +34,7 @@
  			}
  			rcu_read_unlock();
  		}
-@@ -783,7 +789,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+@@ -783,7 +784,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
  	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
  	bss->dtim_period = vif->bss_conf.dtim_period;
  	bss->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0018-wifi-mt76-mt7996-set-wcid-in-txp.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0018-wifi-mt76-mt7996-set-wcid-in-txp.patch
index 74f4e9e..9c284eb 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0018-wifi-mt76-mt7996-set-wcid-in-txp.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0018-wifi-mt76-mt7996-set-wcid-in-txp.patch
@@ -1,7 +1,7 @@
-From 68649746f1862d6c9b3e06492789aadde8c4d2e5 Mon Sep 17 00:00:00 2001
+From a940bcb3617bec4f302f1b271fce9d65f56cdd97 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 6 Mar 2023 15:52:26 +0800
-Subject: [PATCH 18/19] wifi: mt76: mt7996: set wcid in txp
+Subject: [PATCH 18/29] wifi: mt76: mt7996: set wcid in txp
 
 Set correct wcid in txp for SDO to get wtbl.
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0019-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0019-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch
new file mode 100644
index 0000000..a3c95e4
--- /dev/null
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0019-wifi-mt76-mt7996-init-he-and-eht-cap-for-AP_VLAN.patch
@@ -0,0 +1,30 @@
+From 86aa4e386d09edc4948878e894782a86ba4f8506 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Fri, 17 Mar 2023 11:08:04 +0800
+Subject: [PATCH 19/29] wifi: mt76: mt7996: init he and eht cap for AP_VLAN
+
+Add AP_VLAN types in __mt7996_set_stream_he_eht_caps to
+initialize the ht and eht caps. Without this patch, the
+BA response from VLAN AP would not include the ADDBA
+extension tag.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt7996/init.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/mt7996/init.c b/mt7996/init.c
+index 479b2cee..381917a8 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -996,6 +996,7 @@ __mt7996_set_stream_he_eht_caps(struct mt7996_phy *phy,
+ 		switch (i) {
+ 		case NL80211_IFTYPE_STATION:
+ 		case NL80211_IFTYPE_AP:
++		case NL80211_IFTYPE_AP_VLAN:
+ #ifdef CONFIG_MAC80211_MESH
+ 		case NL80211_IFTYPE_MESH_POINT:
+ #endif
+-- 
+2.39.2
+
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0020-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0020-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch
new file mode 100644
index 0000000..807e1c2
--- /dev/null
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0020-wifi-mt76-mt7996-fix-beamform-mcu-cmd-configuration.patch
@@ -0,0 +1,29 @@
+From ffccfb05f1edb318d1c12437fc5554085ca264db Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Thu, 16 Mar 2023 16:09:51 +0800
+Subject: [PATCH 20/29] wifi: mt76: mt7996: fix beamform mcu cmd configuration
+
+bf_num means how many band can support beamform, so the value shall be 3.
+bf_bitmap represents which band can support beamform.
+---
+ mt7996/mcu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 07c521c1..ed1abe14 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -3506,8 +3506,8 @@ int mt7996_mcu_set_txbf(struct mt7996_dev *dev, u8 action)
+ 
+ 		tlv = mt7996_mcu_add_uni_tlv(skb, action, sizeof(*req_mod_en));
+ 		req_mod_en = (struct bf_mod_en_ctrl *)tlv;
+-		req_mod_en->bf_num = 2;
+-		req_mod_en->bf_bitmap = GENMASK(0, 0);
++		req_mod_en->bf_num = 3;
++		req_mod_en->bf_bitmap = GENMASK(2, 0);
+ 		break;
+ 	}
+ 	default:
+-- 
+2.39.2
+
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0021-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0021-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch
new file mode 100644
index 0000000..6f528ef
--- /dev/null
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0021-wifi-mt76-mt7996-Fix-using-the-wrong-phy-for-backgro.patch
@@ -0,0 +1,35 @@
+From 205e9952e06a64ef212ca0a01d5fc9319604bae4 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Tue, 7 Mar 2023 17:05:01 +0800
+Subject: [PATCH 21/29] wifi: mt76: mt7996: Fix using the wrong phy for
+ background radar event
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7996/mcu.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index ed1abe14..cc6c6a4a 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -339,10 +339,15 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
+ 	if (r->band_idx >= ARRAY_SIZE(dev->mt76.phys))
+ 		return;
+ 
+-	mphy = dev->mt76.phys[r->band_idx];
++	if (dev->rdd2_phy && r->band_idx == MT_RX_SEL2)
++		mphy = dev->rdd2_phy->mt76;
++	else
++		mphy = dev->mt76.phys[r->band_idx];
++
+ 	if (!mphy)
+ 		return;
+ 
++	/* TODO: check fw background chain's rdd idx */
+ 	if (r->band_idx == MT_RX_SEL2)
+ 		cfg80211_background_radar_event(mphy->hw->wiphy,
+ 						&dev->rdd2_chandef,
+-- 
+2.39.2
+
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0022-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0022-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch
new file mode 100644
index 0000000..5214415
--- /dev/null
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0022-wifi-mt76-mt7996-support-more-options-in-.set_bitrat.patch
@@ -0,0 +1,180 @@
+From 82f771fc993aea34d3cefb6fbc11ea855a653c1b Mon Sep 17 00:00:00 2001
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+Date: Tue, 20 Dec 2022 09:47:31 +0800
+Subject: [PATCH 22/29] wifi: mt76: mt7996: support more options in
+ .set_bitrate_mask()
+
+With this patch, driver can support runtime configuration for single
+rate, (HE)GI and HE_Ltf through .set_bitrate_mask(). Please noted that
+currently we do not support to fix any single parameter for EHT mode.
+---
+ mt7996/mcu.c | 139 ++++++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 137 insertions(+), 2 deletions(-)
+
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index cc6c6a4a..a0d468df 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -1616,6 +1616,136 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
+ 				     MCU_WM_UNI_CMD(RA), true);
+ }
+ 
++static int
++mt7996_mcu_set_part_fixed_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
++				    struct ieee80211_sta *sta, void *data, u32 field)
++{
++	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct sta_phy *phy = data;
++	struct sta_rec_ra_fixed *ra;
++	struct sk_buff *skb;
++	struct tlv *tlv;
++
++	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
++					      &msta->wcid,
++					      MT7996_STA_UPDATE_MAX_SIZE);
++
++	if (IS_ERR(skb))
++		return PTR_ERR(skb);
++
++	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
++	ra = (struct sta_rec_ra_fixed*)tlv;
++
++	switch (field) {
++	case RATE_PARAM_AUTO:
++		break;
++	case RATE_PARAM_FIXED:
++	case RATE_PARAM_FIXED_MCS:
++	case RATE_PARAM_FIXED_GI:
++	case RATE_PARAM_FIXED_HE_LTF:
++		if (phy)
++			ra->phy = *phy;
++		break;
++	default:
++		break;
++	}
++	ra->field = cpu_to_le32(field);
++
++	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
++				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
++}
++
++
++static int
++mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif,
++			       struct ieee80211_sta *sta)
++{
++	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
++	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
++	enum nl80211_band band = chandef->chan->band;
++	struct sta_phy phy = {};
++	int ret, nrates = 0;
++
++#define __sta_phy_bitrate_mask_check(_mcs, _gi, _ht, _he)			\
++	do {									\
++		u8 i, gi = mask->control[band]._gi;				\
++		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
++		for (i = 0; i <= sta->deflink.bandwidth; i++) {			\
++			phy.sgi |= gi << (i << (_he));				\
++			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
++		}								\
++		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {	\
++			if (!mask->control[band]._mcs[i])			\
++				continue;					\
++			nrates += hweight16(mask->control[band]._mcs[i]);	\
++			phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;		\
++			if (_ht)						\
++				phy.mcs += 8 * i;				\
++		}								\
++	} while (0)
++
++	if (sta->deflink.he_cap.has_he) {
++		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
++	} else if (sta->deflink.vht_cap.vht_supported) {
++		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
++	} else if (sta->deflink.ht_cap.ht_supported) {
++		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
++	} else {
++		nrates = hweight32(mask->control[band].legacy);
++		phy.mcs = ffs(mask->control[band].legacy) - 1;
++	}
++#undef __sta_phy_bitrate_mask_check
++
++	/* fall back to auto rate control */
++	if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
++	    mask->control[band].he_gi == GENMASK(7, 0) &&
++	    mask->control[band].he_ltf == GENMASK(7, 0) &&
++	    nrates != 1)
++		return 0;
++
++	/* fixed single rate */
++	if (nrates == 1) {
++		ret = mt7996_mcu_set_part_fixed_rate_ctrl(dev, vif, sta, &phy,
++							  RATE_PARAM_FIXED_MCS);
++		if (ret)
++			return ret;
++	}
++
++	/* fixed GI */
++	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
++	    mask->control[band].he_gi != GENMASK(7, 0)) {
++		struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++		u32 addr;
++
++		/* firmware updates only TXCMD but doesn't take WTBL into
++		 * account, so driver should update here to reflect the
++		 * actual txrate hardware sends out.
++		 */
++		addr = mt7996_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
++		if (sta->deflink.he_cap.has_he)
++			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
++		else
++			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
++
++		ret = mt7996_mcu_set_part_fixed_rate_ctrl(dev, vif, sta, &phy,
++							  RATE_PARAM_FIXED_GI);
++		if (ret)
++			return ret;
++	}
++
++	/* fixed HE_LTF */
++	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
++		ret = mt7996_mcu_set_part_fixed_rate_ctrl(dev, vif, sta, &phy,
++							  RATE_PARAM_FIXED_HE_LTF);
++		if (ret)
++			return ret;
++	}
++
++	return 0;
++}
++
+ static void
+ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+ 			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
+@@ -1725,6 +1855,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 	struct sk_buff *skb;
++	int ret;
+ 
+ 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
+ 					      &msta->wcid,
+@@ -1744,8 +1875,12 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ 	 */
+ 	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
+ 
+-	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
+-				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
++	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
++				    MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
++	if (ret)
++		return ret;
++
++	return mt7996_mcu_add_rate_ctrl_fixed(dev, vif, sta);
+ }
+ 
+ static int
+-- 
+2.39.2
+
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0023-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0023-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch
new file mode 100644
index 0000000..4e6194a
--- /dev/null
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0023-wifi-mt76-mt7996-fill-txwi-by-SW-temporarily.patch
@@ -0,0 +1,42 @@
+From 384684375a7f6e14c1359eb201a2567aeef72b4b Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Fri, 17 Mar 2023 11:16:44 +0800
+Subject: [PATCH 23/29] wifi: mt76: mt7996: fill txwi by SW temporarily
+
+If use WA to fill TXD, it cannot ping pass.
+Remove this patch after bug fix.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt7996/mac.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/mt7996/mac.c b/mt7996/mac.c
+index bb23f531..cddb1dfe 100644
+--- a/mt7996/mac.c
++++ b/mt7996/mac.c
+@@ -1137,9 +1137,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb);
+ 	memset(txwi_ptr, 0, MT_TXD_SIZE);
+ 	/* Transmit non qos data by 802.11 header and need to fill txd by host*/
+-	if (!is_8023 || pid >= MT_PACKET_ID_FIRST)
+-		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, qid,
+-				      pid, key, 0);
++	mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, qid,
++			      pid, key, 0);
+ 
+ 	txd[0] |= le32_encode_bits(1, MT_TXD0_VER);
+ 
+@@ -1152,8 +1151,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 
+ 	txp->fw.flags = cpu_to_le16(MT_CT_INFO_FROM_HOST);
+ 
+-	if (!is_8023 || pid >= MT_PACKET_ID_FIRST)
+-		txp->fw.flags |= cpu_to_le16(MT_CT_INFO_APPLY_TXD);
++	txp->fw.flags |= cpu_to_le16(MT_CT_INFO_APPLY_TXD);
+ 
+ 	if (!key)
+ 		txp->fw.flags |= cpu_to_le16(MT_CT_INFO_NONE_CIPHER_FRAME);
+-- 
+2.39.2
+
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0024-wifi-mt76-mt7996-update-wmm-queue-mapping.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0024-wifi-mt76-mt7996-update-wmm-queue-mapping.patch
new file mode 100644
index 0000000..83354d0
--- /dev/null
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0024-wifi-mt76-mt7996-update-wmm-queue-mapping.patch
@@ -0,0 +1,62 @@
+From 96c6a8e68b5fd3dacdb5239a6ce9a26e5a08c07f Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Mon, 20 Mar 2023 19:09:59 +0800
+Subject: [PATCH 24/29] wifi: mt76: mt7996: update wmm queue mapping
+
+The mac80211 use mac80211 queue (MQ) and the firmware
+use access class index (ACI) so convert the MQ to ACI
+in mt7996_conf_tx.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt7996/main.c | 11 +++++++++--
+ mt7996/mcu.c  |  2 +-
+ 2 files changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/mt7996/main.c b/mt7996/main.c
+index cb0e0d31..4e9536e7 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -197,7 +197,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
+ 	mvif->mt76.omac_idx = idx;
+ 	mvif->phy = phy;
+ 	mvif->mt76.band_idx = band_idx;
+-	mvif->mt76.wmm_idx = band_idx;
++	mvif->mt76.wmm_idx = vif->type != NL80211_IFTYPE_AP;
+ 
+ 	ret = mt7996_mcu_add_dev_info(phy, vif, true);
+ 	if (ret)
+@@ -419,9 +419,16 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	       const struct ieee80211_tx_queue_params *params)
+ {
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	const u8 MQ_to_ACI[IEEE80211_NUM_ACS] = {
++		[IEEE80211_AC_VO] = 3,
++		[IEEE80211_AC_VI] = 2,
++		[IEEE80211_AC_BE] = 0,
++		[IEEE80211_AC_BK] = 1,
++	};
+ 
+ 	/* no need to update right away, we'll get BSS_CHANGED_QOS */
+-	queue = mt76_connac_lmac_mapping(queue);
++	/* convert mac80211 queue to ACI */
++	queue = MQ_to_ACI[queue];
+ 	mvif->queue_params[queue] = *params;
+ 
+ 	return 0;
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index a0d468df..deb6e1eb 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -2902,7 +2902,7 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
+ 
+ 		e = (struct edca *)tlv;
+ 		e->set = WMM_PARAM_SET;
+-		e->queue = ac + mvif->mt76.wmm_idx * MT7996_MAX_WMM_SETS;
++		e->queue = ac;
+ 		e->aifs = q->aifs;
+ 		e->txop = cpu_to_le16(q->txop);
+ 
+-- 
+2.39.2
+
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0025-wifi-mt76-mt7996-enable-IDS-debug-log.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0025-wifi-mt76-mt7996-enable-IDS-debug-log.patch
new file mode 100644
index 0000000..44adc3c
--- /dev/null
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0025-wifi-mt76-mt7996-enable-IDS-debug-log.patch
@@ -0,0 +1,40 @@
+From 7d83cdb40941ae174a91ec95406f2f61bc6887d5 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Tue, 21 Mar 2023 15:04:45 +0800
+Subject: [PATCH 25/29] wifi: mt76: mt7996: enable IDS debug log
+
+---
+ mt7996/debugfs.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
+index f2c46a50..34c30a58 100644
+--- a/mt7996/debugfs.c
++++ b/mt7996/debugfs.c
+@@ -296,6 +296,12 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
+ 		DEBUG_SPL,
+ 		DEBUG_RPT_RX,
+ 		DEBUG_RPT_RA = 68,
++		DEBUG_IDS_PP = 93,
++		DEBUG_IDS_RA = 94,
++		DEBUG_IDS_BF = 95,
++		DEBUG_IDS_SR = 96,
++		DEBUG_IDS_RU = 97,
++		DEBUG_IDS_MUMIMO = 98,
+ 	} debug;
+ 	bool tx, rx, en;
+ 	int ret;
+@@ -315,8 +321,8 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
+ 	if (ret)
+ 		return ret;
+ 
+-	for (debug = DEBUG_TXCMD; debug <= DEBUG_RPT_RA; debug++) {
+-		if (debug == 67)
++	for (debug = DEBUG_TXCMD; debug <= DEBUG_IDS_MUMIMO; debug++) {
++		if (debug == 67 || (debug > DEBUG_RPT_RA && debug < DEBUG_IDS_PP))
+ 			continue;
+ 
+ 		if (debug == DEBUG_RPT_RX)
+-- 
+2.39.2
+
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0026-mt76-testmode-add-atenl-support-in-mt7996.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0026-mt76-testmode-add-atenl-support-in-mt7996.patch
new file mode 100644
index 0000000..272a8f2
--- /dev/null
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0026-mt76-testmode-add-atenl-support-in-mt7996.patch
@@ -0,0 +1,48 @@
+From 8ab802ff986da3c6ec8afbbe761df35b9f824ea6 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Wed, 28 Dec 2022 22:24:25 +0800
+Subject: [PATCH 26/29] mt76: testmode: add atenl support in mt7996
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ testmode.c | 3 ++-
+ testmode.h | 2 ++
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/testmode.c b/testmode.c
+index 0accc71a..0d2bae9f 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -612,7 +612,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ 
+ 	if (dev->test_mtd.name &&
+ 	    (nla_put_string(msg, MT76_TM_ATTR_MTD_PART, dev->test_mtd.name) ||
+-	     nla_put_u32(msg, MT76_TM_ATTR_MTD_OFFSET, dev->test_mtd.offset)))
++	     nla_put_u32(msg, MT76_TM_ATTR_MTD_OFFSET, dev->test_mtd.offset) ||
++	     nla_put_u8(msg, MT76_TM_ATTR_BAND_IDX, phy->band_idx)))
+ 		goto out;
+ 
+ 	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
+diff --git a/testmode.h b/testmode.h
+index 5e2792d8..a40cd74b 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -17,6 +17,7 @@
+  *
+  * @MT76_TM_ATTR_MTD_PART: mtd partition used for eeprom data (string)
+  * @MT76_TM_ATTR_MTD_OFFSET: offset of eeprom data within the partition (u32)
++ * @MT76_TM_ATTR_BAND_IDX: band idx of the chip (u8)
+  *
+  * @MT76_TM_ATTR_TX_COUNT: configured number of frames to send when setting
+  *	state to MT76_TM_STATE_TX_FRAMES (u32)
+@@ -56,6 +57,7 @@ enum mt76_testmode_attr {
+ 
+ 	MT76_TM_ATTR_MTD_PART,
+ 	MT76_TM_ATTR_MTD_OFFSET,
++	MT76_TM_ATTR_BAND_IDX,
+ 
+ 	MT76_TM_ATTR_TX_COUNT,
+ 	MT76_TM_ATTR_TX_LENGTH,
+-- 
+2.39.2
+
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0027-mt76-testmode-add-basic-testmode-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0027-mt76-testmode-add-basic-testmode-support.patch
new file mode 100644
index 0000000..6072f10
--- /dev/null
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0027-mt76-testmode-add-basic-testmode-support.patch
@@ -0,0 +1,1788 @@
+From 8913b802b0d59773c58e669b6d4e9be2154828a0 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Wed, 1 Mar 2023 11:59:16 +0800
+Subject: [PATCH 27/29] mt76: testmode: add basic testmode support
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ eeprom.c          |   6 +-
+ mac80211.c        |   3 +-
+ mt76.h            |  11 +
+ mt76_connac_mcu.h |   2 +
+ mt7996/Makefile   |   2 +
+ mt7996/eeprom.c   |  35 ++-
+ mt7996/eeprom.h   |   1 +
+ mt7996/init.c     |   7 +
+ mt7996/main.c     |  15 ++
+ mt7996/mcu.c      |  39 ++-
+ mt7996/mcu.h      |  27 ++
+ mt7996/mt7996.h   |  22 ++
+ mt7996/testmode.c | 615 ++++++++++++++++++++++++++++++++++++++++++++++
+ mt7996/testmode.h | 292 ++++++++++++++++++++++
+ testmode.c        |  45 +++-
+ testmode.h        |  60 +++++
+ tools/fields.c    |  92 +++++++
+ 17 files changed, 1257 insertions(+), 17 deletions(-)
+ create mode 100644 mt7996/testmode.c
+ create mode 100644 mt7996/testmode.h
+
+diff --git a/eeprom.c b/eeprom.c
+index ea54b7af..263e5089 100644
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -89,8 +89,10 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
+ 	}
+ 
+ #ifdef CONFIG_NL80211_TESTMODE
+-	dev->test_mtd.name = devm_kstrdup(dev->dev, part, GFP_KERNEL);
+-	dev->test_mtd.offset = offset;
++	if (len == dev->eeprom.size) {
++		dev->test_mtd.name = devm_kstrdup(dev->dev, part, GFP_KERNEL);
++		dev->test_mtd.offset = offset;
++	}
+ #endif
+ 
+ out_put_node:
+diff --git a/mac80211.c b/mac80211.c
+index e53166fc..a4b3d346 100644
+--- a/mac80211.c
++++ b/mac80211.c
+@@ -826,7 +826,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
+ 	}
+ 
+ #ifdef CONFIG_NL80211_TESTMODE
+-	if (phy->test.state == MT76_TM_STATE_RX_FRAMES) {
++	if (!(phy->test.flag & MT_TM_FW_RX_COUNT) &&
++	    phy->test.state == MT76_TM_STATE_RX_FRAMES) {
+ 		phy->test.rx_stats.packets[q]++;
+ 		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
+ 			phy->test.rx_stats.fcs_error[q]++;
+diff --git a/mt76.h b/mt76.h
+index c3d1313e..343bd910 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -652,8 +652,12 @@ struct mt76_testmode_ops {
+ 	int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
+ 			  enum mt76_testmode_state new_state);
+ 	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
++	void (*reset_rx_stats)(struct mt76_phy *phy);
++	void (*tx_stop)(struct mt76_phy *phy);
+ };
+ 
++#define MT_TM_FW_RX_COUNT	BIT(0)
++
+ struct mt76_testmode_data {
+ 	enum mt76_testmode_state state;
+ 
+@@ -669,6 +673,7 @@ struct mt76_testmode_data {
+ 	u8 tx_rate_sgi;
+ 	u8 tx_rate_ldpc;
+ 	u8 tx_rate_stbc;
++	u16 tx_preamble_puncture;
+ 	u8 tx_ltf;
+ 
+ 	u8 tx_antenna_mask;
+@@ -678,6 +683,9 @@ struct mt76_testmode_data {
+ 	u32 tx_time;
+ 	u32 tx_ipg;
+ 
++	bool ibf;
++	bool ebf;
++
+ 	u32 freq_offset;
+ 
+ 	u8 tx_power[4];
+@@ -692,7 +700,10 @@ struct mt76_testmode_data {
+ 	struct {
+ 		u64 packets[__MT_RXQ_MAX];
+ 		u64 fcs_error[__MT_RXQ_MAX];
++		u64 len_mismatch;
+ 	} rx_stats;
++	u8 flag;
++	u8 aid;
+ };
+ 
+ struct mt76_vif {
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 79dde31a..bfbf18d6 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1218,10 +1218,12 @@ enum {
+ 	MCU_UNI_CMD_EFUSE_CTRL = 0x2d,
+ 	MCU_UNI_CMD_RA = 0x2f,
+ 	MCU_UNI_CMD_MURU = 0x31,
++	MCU_UNI_CMD_TESTMODE_RX_STAT = 0x32,
+ 	MCU_UNI_CMD_BF = 0x33,
+ 	MCU_UNI_CMD_CHANNEL_SWITCH = 0x34,
+ 	MCU_UNI_CMD_THERMAL = 0x35,
+ 	MCU_UNI_CMD_VOW = 0x37,
++	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
+ 	MCU_UNI_CMD_RRO = 0x57,
+ 	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
+ };
+diff --git a/mt7996/Makefile b/mt7996/Makefile
+index bcb9a3c5..f9fb1b0d 100644
+--- a/mt7996/Makefile
++++ b/mt7996/Makefile
+@@ -4,3 +4,5 @@ obj-$(CONFIG_MT7996E) += mt7996e.o
+ 
+ mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
+ 	     debugfs.o mmio.o
++
++mt7996e-$(CONFIG_NL80211_TESTMODE) += testmode.o
+diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
+index 2e48c5a4..64e3c4e2 100644
+--- a/mt7996/eeprom.c
++++ b/mt7996/eeprom.c
+@@ -6,6 +6,11 @@
+ #include <linux/firmware.h>
+ #include "mt7996.h"
+ #include "eeprom.h"
++#include <linux/moduleparam.h>
++
++static bool testmode_enable;
++module_param(testmode_enable, bool, 0644);
++MODULE_PARM_DESC(testmode_enable, "Enable testmode");
+ 
+ static int mt7996_check_eeprom(struct mt7996_dev *dev)
+ {
+@@ -23,7 +28,10 @@ static int mt7996_check_eeprom(struct mt7996_dev *dev)
+ static char *mt7996_eeprom_name(struct mt7996_dev *dev)
+ {
+ 	/* reserve for future variants */
+-	return MT7996_EEPROM_DEFAULT;
++	if (dev->testmode_enable)
++		return MT7996_EEPROM_DEFAULT_TM;
++	else
++		return MT7996_EEPROM_DEFAULT;
+ }
+ 
+ static int
+@@ -52,21 +60,36 @@ out:
+ 	return ret;
+ }
+ 
+-static int mt7996_eeprom_load(struct mt7996_dev *dev)
++int mt7996_eeprom_check_fw_mode(struct mt7996_dev *dev)
+ {
++	u8 *eeprom;
+ 	int ret;
+ 
++	/* load eeprom in flash or bin file mode to determine fw mode */
+ 	ret = mt76_eeprom_init(&dev->mt76, MT7996_EEPROM_SIZE);
+ 	if (ret < 0)
+ 		return ret;
+ 
+ 	if (ret) {
+ 		dev->flash_mode = true;
+-	} else {
+-		u8 free_block_num;
+-		u32 block_num, i;
+-		u32 eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;
++		eeprom = dev->mt76.eeprom.data;
++		/* testmode enable priority: eeprom field > module parameter */
++		dev->testmode_enable = !mt7996_check_eeprom(dev) ? eeprom[MT_EE_TESTMODE_EN] :
++								   testmode_enable;
++	}
++
++	return ret;
++}
++
++static int mt7996_eeprom_load(struct mt7996_dev *dev)
++{
++	int ret;
++	u8 free_block_num;
++	u32 block_num, i;
++	u32 eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;
+ 
++	/* flash or bin file mode eeprom is loaded before mcu init */
++	if (!dev->flash_mode) {
+ 		ret = mt7996_mcu_get_eeprom_free_block(dev, &free_block_num);
+ 		if (ret < 0)
+ 			return ret;
+diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
+index cfc48698..f7497c9b 100644
+--- a/mt7996/eeprom.h
++++ b/mt7996/eeprom.h
+@@ -14,6 +14,7 @@ enum mt7996_eeprom_field {
+ 	MT_EE_MAC_ADDR =	0x004,
+ 	MT_EE_MAC_ADDR2 =	0x00a,
+ 	MT_EE_WIFI_CONF =	0x190,
++	MT_EE_TESTMODE_EN =	0x1af,
+ 	MT_EE_MAC_ADDR3 =	0x2c0,
+ 	MT_EE_RATE_DELTA_2G =	0x1400,
+ 	MT_EE_RATE_DELTA_5G =	0x147d,
+diff --git a/mt7996/init.c b/mt7996/init.c
+index 381917a8..29a6783c 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -621,6 +621,10 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
+ 
+ 	set_bit(MT76_STATE_INITIALIZED, &dev->mphy.state);
+ 
++	ret = mt7996_eeprom_check_fw_mode(dev);
++	if (ret < 0)
++		return ret;
++
+ 	ret = mt7996_mcu_init(dev);
+ 	if (ret)
+ 		return ret;
+@@ -1055,6 +1059,9 @@ int mt7996_register_device(struct mt7996_dev *dev)
+ 
+ 	mt7996_init_wiphy(hw);
+ 
++#ifdef CONFIG_NL80211_TESTMODE
++	dev->mt76.test_ops = &mt7996_testmode_ops;
++#endif
+ 	/* init led callbacks */
+ 	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
+ 		dev->mphy.leds.cdev.brightness_set = mt7996_led_set_brightness;
+diff --git a/mt7996/main.c b/mt7996/main.c
+index 4e9536e7..b24c75aa 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -22,6 +22,17 @@ static bool mt7996_dev_running(struct mt7996_dev *dev)
+ 	return phy && test_bit(MT76_STATE_RUNNING, &phy->mt76->state);
+ }
+ 
++static void mt7996_testmode_disable_all(struct mt7996_dev *dev)
++{
++	struct mt7996_phy *phy;
++	int i;
++
++	for (i = 0; i < __MT_MAX_BAND; i++) {
++		phy = __mt7996_phy(dev, i);
++		mt76_testmode_set_state(phy->mt76, MT76_TM_STATE_OFF);
++	}
++}
++
+ int mt7996_run(struct ieee80211_hw *hw)
+ {
+ 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
+@@ -36,6 +47,8 @@ int mt7996_run(struct ieee80211_hw *hw)
+ 			goto out;
+ 	}
+ 
++	mt7996_testmode_disable_all(dev);
++
+ 	mt7996_mac_enable_nf(dev, phy->mt76->band_idx);
+ 
+ 	ret = mt7996_mcu_set_rts_thresh(phy, 0x92b);
+@@ -1343,6 +1356,8 @@ const struct ieee80211_ops mt7996_ops = {
+ 	.sta_set_decap_offload = mt7996_sta_set_decap_offload,
+ 	.add_twt_setup = mt7996_mac_add_twt_setup,
+ 	.twt_teardown_request = mt7996_twt_teardown_request,
++	CFG80211_TESTMODE_CMD(mt76_testmode_cmd)
++	CFG80211_TESTMODE_DUMP(mt76_testmode_dump)
+ #ifdef CONFIG_MAC80211_DEBUGFS
+ 	.sta_add_debugfs = mt7996_sta_add_debugfs,
+ #endif
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index deb6e1eb..0a52afd1 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -2580,7 +2580,10 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
+ 		release_firmware(fw);						\
+ 	} while (0)
+ 
+-	LOAD_RAM(WM);
++	if (dev->testmode_enable)
++		LOAD_RAM(WM_TM);
++	else
++		LOAD_RAM(WM);
+ 	LOAD_RAM(DSP);
+ 	LOAD_RAM(WA);
+ #undef LOAD_RAM
+@@ -4109,3 +4112,37 @@ int mt7996_mcu_set_rro(struct mt7996_dev *dev, u16 tag, u8 val)
+ 	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(RRO), &req,
+ 				 sizeof(req), true);
+ }
++
++int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data)
++{
++	struct mt7996_dev *dev = phy->dev;
++	struct tx_power_ctrl req = {
++		.tag = cpu_to_le16(power_ctrl_id),
++		.len = cpu_to_le16(sizeof(req) - 4),
++		.power_ctrl_id = power_ctrl_id,
++		.band_idx = phy->mt76->band_idx,
++	};
++
++	switch (power_ctrl_id) {
++	case UNI_TXPOWER_SKU_POWER_LIMIT_CTRL:
++		req.sku_enable = !!data;
++		break;
++	case UNI_TXPOWER_PERCENTAGE_CTRL:
++		req.percentage_ctrl_enable = !!data;
++		break;
++	case UNI_TXPOWER_PERCENTAGE_DROP_CTRL:
++		req.power_drop_level = data;
++		break;
++	case UNI_TXPOWER_BACKOFF_POWER_LIMIT_CTRL:
++		req.bf_backoff_enable = !!data;
++		break;
++	case UNI_TXPOWER_ATE_MODE_CTRL:
++		req.ate_mode_enable = !!data;
++		break;
++	default:
++		req.sku_enable = !!data;
++	}
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(TXPOWER),
++				 &req, sizeof(req), false);
++}
+diff --git a/mt7996/mcu.h b/mt7996/mcu.h
+index 778deedf..ebc62713 100644
+--- a/mt7996/mcu.h
++++ b/mt7996/mcu.h
+@@ -686,6 +686,33 @@ enum {
+ 	UNI_CMD_THERMAL_PROTECT_DUTY_CONFIG,
+ };
+ 
++struct tx_power_ctrl {
++	u8 _rsv[4];
++
++	__le16 tag;
++	__le16 len;
++
++	u8 power_ctrl_id;
++	union {
++		bool sku_enable;
++		bool ate_mode_enable;
++		bool percentage_ctrl_enable;
++		bool bf_backoff_enable;
++		u8 power_drop_level;
++	};
++	u8 band_idx;
++	u8 rsv[1];
++} __packed;
++
++enum {
++	UNI_TXPOWER_SKU_POWER_LIMIT_CTRL = 0,
++	UNI_TXPOWER_PERCENTAGE_CTRL = 1,
++	UNI_TXPOWER_PERCENTAGE_DROP_CTRL = 2,
++	UNI_TXPOWER_BACKOFF_POWER_LIMIT_CTRL = 3,
++	UNI_TXPOWER_POWER_LIMIT_TABLE_CTRL = 4,
++	UNI_TXPOWER_ATE_MODE_CTRL = 6,
++};
++
+ enum {
+ 	UNI_CMD_ACCESS_REG_BASIC = 0x0,
+ 	UNI_CMD_ACCESS_RF_REG_BASIC,
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index c2f8900c..e3fd50f6 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -30,9 +30,11 @@
+ #define MT7996_FIRMWARE_WA		"mediatek/mt7996/mt7996_wa.bin"
+ #define MT7996_FIRMWARE_WM		"mediatek/mt7996/mt7996_wm.bin"
+ #define MT7996_FIRMWARE_DSP		"mediatek/mt7996/mt7996_dsp.bin"
++#define MT7996_FIRMWARE_WM_TM		"mediatek/mt7996/mt7996_wm_tm.bin"
+ #define MT7996_ROM_PATCH		"mediatek/mt7996/mt7996_rom_patch.bin"
+ 
+ #define MT7996_EEPROM_DEFAULT		"mediatek/mt7996/mt7996_eeprom.bin"
++#define MT7996_EEPROM_DEFAULT_TM	"mediatek/mt7996/mt7996_eeprom_tm.bin"
+ #define MT7996_EEPROM_SIZE		7680
+ #define MT7996_EEPROM_BLOCK_SIZE	16
+ #define MT7996_TOKEN_SIZE		8192
+@@ -58,6 +60,7 @@ struct mt7996_dfs_pattern;
+ 
+ enum mt7996_ram_type {
+ 	MT7996_RAM_TYPE_WM = 0,
++	MT7996_RAM_TYPE_WM_TM = MT7996_RAM_TYPE_WM,
+ 	MT7996_RAM_TYPE_WA,
+ 	MT7996_RAM_TYPE_DSP,
+ };
+@@ -245,6 +248,20 @@ struct mt7996_phy {
+ 
+ 	struct mib_stats mib;
+ 	struct mt76_channel_state state_ts;
++
++#ifdef CONFIG_NL80211_TESTMODE
++	struct {
++		u32 *reg_backup;
++
++		s32 last_freq_offset;
++		u8 last_rcpi[4];
++		s8 last_ib_rssi[4];
++		s8 last_wb_rssi[4];
++		u8 last_snr;
++
++		u8 spe_idx;
++	} test;
++#endif
+ };
+ 
+ struct mt7996_dev {
+@@ -296,6 +313,8 @@ struct mt7996_dev {
+ 	bool flash_mode:1;
+ 	bool has_eht:1;
+ 
++	bool testmode_enable;
++
+ 	bool ibf;
+ 	u8 fw_debug_wm;
+ 	u8 fw_debug_wa;
+@@ -401,6 +420,7 @@ mt7996_phy3(struct mt7996_dev *dev)
+ extern const struct ieee80211_ops mt7996_ops;
+ extern struct pci_driver mt7996_pci_driver;
+ extern struct pci_driver mt7996_hif_driver;
++extern const struct mt76_testmode_ops mt7996_testmode_ops;
+ 
+ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
+ 				     void __iomem *mem_base, u32 device_id);
+@@ -410,6 +430,7 @@ u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif);
+ int mt7996_register_device(struct mt7996_dev *dev);
+ void mt7996_unregister_device(struct mt7996_dev *dev);
+ int mt7996_eeprom_init(struct mt7996_dev *dev);
++int mt7996_eeprom_check_fw_mode(struct mt7996_dev *dev);
+ int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
+ int mt7996_eeprom_get_target_power(struct mt7996_dev *dev,
+ 				   struct ieee80211_channel *chan);
+@@ -485,6 +506,7 @@ int mt7996_mcu_fw_log_2_host(struct mt7996_dev *dev, u8 type, u8 ctrl);
+ int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
+ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
+ void mt7996_mcu_exit(struct mt7996_dev *dev);
++int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
+ 
+ static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
+ {
+diff --git a/mt7996/testmode.c b/mt7996/testmode.c
+new file mode 100644
+index 00000000..5dbbb788
+--- /dev/null
++++ b/mt7996/testmode.c
+@@ -0,0 +1,615 @@
++// SPDX-License-Identifier: ISC
++/*
++ * Copyright (C) 2022 MediaTek Inc.
++ */
++
++#include "mt7996.h"
++#include "mac.h"
++#include "mcu.h"
++#include "testmode.h"
++
++enum {
++	TM_CHANGED_TXPOWER,
++	TM_CHANGED_FREQ_OFFSET,
++	TM_CHANGED_TX_LENGTH,
++	TM_CHANGED_TX_TIME,
++
++	/* must be last */
++	NUM_TM_CHANGED
++};
++
++static const u8 tm_change_map[] = {
++	[TM_CHANGED_TXPOWER] = MT76_TM_ATTR_TX_POWER,
++	[TM_CHANGED_FREQ_OFFSET] = MT76_TM_ATTR_FREQ_OFFSET,
++	[TM_CHANGED_TX_LENGTH] = MT76_TM_ATTR_TX_LENGTH,
++	[TM_CHANGED_TX_TIME] = MT76_TM_ATTR_TX_TIME,
++};
++
++static u8 mt7996_tm_bw_mapping(enum nl80211_chan_width width, enum bw_mapping_method method)
++{
++	static const u8 width_to_bw[][NUM_BW_MAP] = {
++		[NL80211_CHAN_WIDTH_40] = {FW_CDBW_40MHZ, TM_CBW_40MHZ},
++		[NL80211_CHAN_WIDTH_80] = {FW_CDBW_80MHZ, TM_CBW_80MHZ},
++		[NL80211_CHAN_WIDTH_80P80] = {FW_CDBW_8080MHZ, TM_CBW_8080MHZ},
++		[NL80211_CHAN_WIDTH_160] = {FW_CDBW_160MHZ, TM_CBW_160MHZ},
++		[NL80211_CHAN_WIDTH_5] = {FW_CDBW_5MHZ, TM_CBW_5MHZ},
++		[NL80211_CHAN_WIDTH_10] = {FW_CDBW_10MHZ, TM_CBW_10MHZ},
++		[NL80211_CHAN_WIDTH_20] = {FW_CDBW_20MHZ, TM_CBW_20MHZ},
++		[NL80211_CHAN_WIDTH_20_NOHT] = {FW_CDBW_20MHZ, TM_CBW_20MHZ},
++		[NL80211_CHAN_WIDTH_320] = {FW_CDBW_320MHZ, TM_CBW_320MHZ},
++	};
++
++	if (width >= ARRAY_SIZE(width_to_bw))
++		return 0;
++
++	return width_to_bw[width][method];
++}
++
++static u8 mt7996_tm_rate_to_phy(u8 tx_rate_mode)
++{
++	static const u8 rate_to_phy[] = {
++		[MT76_TM_TX_MODE_CCK] = MT_PHY_TYPE_CCK,
++		[MT76_TM_TX_MODE_OFDM] = MT_PHY_TYPE_OFDM,
++		[MT76_TM_TX_MODE_HT] = MT_PHY_TYPE_HT,
++		[MT76_TM_TX_MODE_VHT] = MT_PHY_TYPE_VHT,
++		[MT76_TM_TX_MODE_HE_SU] = MT_PHY_TYPE_HE_SU,
++		[MT76_TM_TX_MODE_HE_EXT_SU] = MT_PHY_TYPE_HE_EXT_SU,
++		[MT76_TM_TX_MODE_HE_TB] = MT_PHY_TYPE_HE_TB,
++		[MT76_TM_TX_MODE_HE_MU] = MT_PHY_TYPE_HE_MU,
++		[MT76_TM_TX_MODE_EHT_SU] = MT_PHY_TYPE_EHT_SU,
++		[MT76_TM_TX_MODE_EHT_TRIG] = MT_PHY_TYPE_EHT_TRIG,
++		[MT76_TM_TX_MODE_EHT_MU] = MT_PHY_TYPE_EHT_MU,
++	};
++
++	if (tx_rate_mode > MT76_TM_TX_MODE_MAX)
++		return -EINVAL;
++
++	return rate_to_phy[tx_rate_mode];
++}
++
++static int
++mt7996_tm_set(struct mt7996_dev *dev, u32 func_idx, u32 data)
++{
++	struct mt7996_tm_req req = {
++		.rf_test = {
++			.tag = cpu_to_le16(UNI_RF_TEST_CTRL),
++			.len = cpu_to_le16(sizeof(req.rf_test)),
++			.action = RF_ACTION_SET,
++			.op.rf.func_idx = func_idx,
++			.op.rf.param.func_data = cpu_to_le32(data),
++		},
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(TESTMODE_CTRL), &req,
++				 sizeof(req), false);
++}
++
++static int
++mt7996_tm_get(struct mt7996_dev *dev, u32 func_idx, u32 data, u32 *result)
++{
++	struct mt7996_tm_req req = {
++		.rf_test = {
++			.tag = cpu_to_le16(UNI_RF_TEST_CTRL),
++			.len = cpu_to_le16(sizeof(req.rf_test)),
++			.action = RF_ACTION_GET,
++			.op.rf.func_idx = func_idx,
++			.op.rf.param.func_data = cpu_to_le32(data),
++		},
++	};
++	struct mt7996_tm_event *event;
++	struct sk_buff *skb;
++	int ret;
++
++	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WM_UNI_CMD_QUERY(TESTMODE_CTRL),
++					&req, sizeof(req), true, &skb);
++	if (ret)
++		return ret;
++
++	event = (struct mt7996_tm_event *)skb->data;
++	*result = event->result.payload_length;
++
++	dev_kfree_skb(skb);
++
++	return ret;
++}
++
++static void
++mt7996_tm_set_antenna(struct mt7996_phy *phy, u32 func_idx)
++{
++#define SPE_INDEX_MASK		BIT(31)
++#define RX_ANTENNA_MASK		GENMASK(20, 16)		/* RX antenna mask at most 5 bit */
++	struct mt7996_dev *dev = phy->dev;
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	u32 antenna_mask, idx = MT76_TM_ATTR_TX_ANTENNA;
++	bool is_antenna_set = td->param_set[idx / 32] & BIT(idx % 32);
++
++	if (!is_antenna_set)
++		return;
++
++	if (func_idx == SET_ID(TX_PATH))
++		antenna_mask = td->tx_spe_idx ? (SPE_INDEX_MASK | td->tx_spe_idx) :
++						td->tx_antenna_mask;
++	else if (func_idx == SET_ID(RX_PATH))
++		antenna_mask = u32_encode_bits(td->tx_antenna_mask, RX_ANTENNA_MASK);
++	else
++		return;
++
++	mt7996_tm_set(dev, func_idx, antenna_mask);
++}
++
++static void
++mt7996_tm_set_mac_addr(struct mt7996_dev *dev, u8 *addr, u32 func_idx)
++{
++#define REMAIN_PART_TAG		BIT(18)
++	u32 own_mac_first = 0, own_mac_remain = 0;
++	int len = sizeof(u32);
++
++	memcpy(&own_mac_first, addr, len);
++	mt7996_tm_set(dev, func_idx, own_mac_first);
++	/* Set the remain part of mac address */
++	memcpy(&own_mac_remain, addr + len, ETH_ALEN - len);
++	mt7996_tm_set(dev, func_idx | REMAIN_PART_TAG, own_mac_remain);
++}
++
++static int
++mt7996_tm_rf_switch_mode(struct mt7996_dev *dev, u32 op_mode)
++{
++	struct mt7996_tm_req req = {
++		.rf_test = {
++			.tag = cpu_to_le16(UNI_RF_TEST_CTRL),
++			.len = cpu_to_le16(sizeof(req.rf_test)),
++			.action = RF_ACTION_SWITCH_TO_RF_TEST,
++			.op.op_mode = cpu_to_le32(op_mode),
++		},
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(TESTMODE_CTRL), &req,
++				 sizeof(req), false);
++}
++
++static void
++mt7996_tm_init(struct mt7996_phy *phy, bool en)
++{
++#define POWER_CTRL(type)	UNI_TXPOWER_##type##_CTRL
++	struct mt7996_dev *dev = phy->dev;
++	u8 rf_test_mode = en ? RF_OPER_RF_TEST : RF_OPER_NORMAL;
++
++	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
++		return;
++
++	mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(ATE_MODE), en);
++	mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(SKU_POWER_LIMIT), !en);
++	mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(PERCENTAGE_DROP), 100);
++	mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(PERCENTAGE), !en);
++	mt7996_mcu_set_tx_power_ctrl(phy, POWER_CTRL(BACKOFF_POWER_LIMIT), !en);
++
++	mt7996_tm_rf_switch_mode(dev, rf_test_mode);
++
++	mt7996_mcu_add_bss_info(phy, phy->monitor_vif, en);
++	mt7996_mcu_add_sta(dev, phy->monitor_vif, NULL, en);
++
++	mt7996_tm_set(dev, SET_ID(BAND_IDX), phy->mt76->band_idx);
++
++	/* use firmware counter for RX stats */
++	phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
++}
++
++static void
++mt7996_tm_update_channel(struct mt7996_phy *phy)
++{
++#define CHAN_FREQ_BW_80P80_TAG		(SET_ID(CHAN_FREQ) | BIT(16))
++	struct mt7996_dev *dev = phy->dev;
++	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
++	struct ieee80211_channel *chan = chandef->chan;
++	u8 width = chandef->width;
++	static const u8 ch_band[] = {
++		[NL80211_BAND_2GHZ] = 0,
++		[NL80211_BAND_5GHZ] = 1,
++		[NL80211_BAND_6GHZ] = 2,
++	};
++
++	if (!chan || !chandef) {
++		dev_info(dev->mt76.dev, "chandef not found, channel update failed!\n");
++		return;
++	}
++
++	/* system bw */
++	mt7996_tm_set(dev, SET_ID(CBW), mt7996_tm_bw_mapping(width, BW_MAP_NL_TO_FW));
++
++	if (width == NL80211_CHAN_WIDTH_80P80) {
++		width = NL80211_CHAN_WIDTH_160;
++		mt7996_tm_set(dev, CHAN_FREQ_BW_80P80_TAG, chandef->center_freq2 * 1000);
++	}
++
++	/* TODO: define per-packet bw */
++	/* per-packet bw */
++	mt7996_tm_set(dev, SET_ID(DBW), mt7996_tm_bw_mapping(width, BW_MAP_NL_TO_FW));
++
++	/* control channel selection index */
++	mt7996_tm_set(dev, SET_ID(PRIMARY_CH), 0);
++	mt7996_tm_set(dev, SET_ID(BAND), ch_band[chan->band]);
++
++	/* trigger switch channel calibration */
++	mt7996_tm_set(dev, SET_ID(CHAN_FREQ), chandef->center_freq1 * 1000);
++
++	// TODO: update power limit table
++}
++
++static void
++mt7996_tm_tx_stop(struct mt76_phy *mphy)
++{
++	struct mt76_testmode_data *td = &mphy->test;
++	struct mt7996_phy *phy = mphy->priv;
++	struct mt7996_dev *dev = phy->dev;
++
++	mt7996_tm_set(dev, SET_ID(COMMAND), RF_CMD(STOP_TEST));
++	td->tx_pending = 0;
++}
++
++static void
++mt7996_tm_set_tx_frames(struct mt7996_phy *phy, bool en)
++{
++#define FRAME_CONTROL		0x88
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7996_dev *dev = phy->dev;
++
++	//TODO: RU operation, replace mcs, nss, and ldpc
++	if (en) {
++		mt7996_tm_set(dev, SET_ID(MAC_HEADER), FRAME_CONTROL);
++		mt7996_tm_set(dev, SET_ID(SEQ_CTRL), 0);
++		mt7996_tm_set(dev, SET_ID(TX_COUNT), td->tx_count);
++		mt7996_tm_set(dev, SET_ID(TX_MODE), mt7996_tm_rate_to_phy(td->tx_rate_mode));
++		mt7996_tm_set(dev, SET_ID(TX_RATE), td->tx_rate_idx);
++		mt7996_tm_set(dev, SET_ID(POWER), td->tx_power[0]);
++		mt7996_tm_set_antenna(phy, SET_ID(TX_PATH));
++		mt7996_tm_set(dev, SET_ID(STBC), td->tx_rate_stbc);
++		mt7996_tm_set(dev, SET_ID(ENCODE_MODE), td->tx_rate_ldpc);
++		mt7996_tm_set(dev, SET_ID(IBF_ENABLE), td->ibf);
++		mt7996_tm_set(dev, SET_ID(EBF_ENABLE), td->ebf);
++		mt7996_tm_set(dev, SET_ID(IPG), td->tx_ipg);
++		mt7996_tm_set(dev, SET_ID(GI), td->tx_rate_sgi);
++		mt7996_tm_set(dev, SET_ID(NSS), td->tx_rate_nss);
++		mt7996_tm_set(dev, SET_ID(AID_OFFSET), 0);
++		mt7996_tm_set(dev, SET_ID(PUNCTURE), td->tx_preamble_puncture);
++
++		mt7996_tm_set(dev, SET_ID(MAX_PE), 2);
++		mt7996_tm_set(dev, SET_ID(HW_TX_MODE), 0);
++		mt7996_tm_update_channel(phy);
++
++		/* trigger firmware to start TX */
++		mt7996_tm_set(dev, SET_ID(COMMAND), RF_CMD(START_TX));
++	} else {
++		mt7996_tm_tx_stop(phy->mt76);
++	}
++}
++
++static int
++mt7996_tm_rx_stats_user_ctrl(struct mt7996_phy *phy, u16 user_idx)
++{
++	struct mt7996_dev *dev = phy->dev;
++	struct mt7996_tm_rx_req req = {
++		.band = phy->mt76->band_idx,
++		.user_ctrl = {
++			.tag = cpu_to_le16(UNI_TM_RX_STAT_SET_USER_CTRL),
++			.len = cpu_to_le16(sizeof(req.user_ctrl)),
++			.band_idx = phy->mt76->band_idx,
++			.user_idx = cpu_to_le16(user_idx),
++		},
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(TESTMODE_RX_STAT), &req,
++				 sizeof(req), false);
++}
++
++static void
++mt7996_tm_set_rx_frames(struct mt7996_phy *phy, bool en)
++{
++#define RX_MU_DISABLE	0xf800
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7996_dev *dev = phy->dev;
++	int ret;
++
++	if (en) {
++		ret = mt7996_tm_rx_stats_user_ctrl(phy, td->aid);
++		if (ret) {
++			dev_info(dev->mt76.dev, "Set RX stats user control failed!\n");
++			return;
++		}
++
++		mt7996_tm_update_channel(phy);
++
++		if (td->tx_rate_mode >= MT76_TM_TX_MODE_HE_MU) {
++			if (td->aid)
++				ret = mt7996_tm_set(dev, SET_ID(RX_MU_AID), td->aid);
++			else
++				ret = mt7996_tm_set(dev, SET_ID(RX_MU_AID), RX_MU_DISABLE);
++		}
++		mt7996_tm_set(dev, SET_ID(TX_MODE), mt7996_tm_rate_to_phy(td->tx_rate_mode));
++		mt7996_tm_set(dev, SET_ID(GI), td->tx_rate_sgi);
++		mt7996_tm_set_antenna(phy, SET_ID(RX_PATH));
++		mt7996_tm_set(dev, SET_ID(MAX_PE), 2);
++
++		mt7996_tm_set_mac_addr(dev, td->addr[1], SET_ID(SA));
++
++		/* trigger firmware to start RX */
++		mt7996_tm_set(dev, SET_ID(COMMAND), RF_CMD(START_RX));
++	} else {
++		/* trigger firmware to stop RX */
++		mt7996_tm_set(dev, SET_ID(COMMAND), RF_CMD(STOP_TEST));
++	}
++}
++
++static void
++mt7996_tm_set_tx_cont(struct mt7996_phy *phy, bool en)
++{
++#define CONT_WAVE_MODE_OFDM	3
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7996_dev *dev = phy->dev;
++
++	if (en) {
++		mt7996_tm_update_channel(phy);
++		mt7996_tm_set(dev, SET_ID(TX_MODE), mt7996_tm_rate_to_phy(td->tx_rate_mode));
++		mt7996_tm_set(dev, SET_ID(TX_RATE), td->tx_rate_idx);
++		/* fix payload is OFDM */
++		mt7996_tm_set(dev, SET_ID(CONT_WAVE_MODE), CONT_WAVE_MODE_OFDM);
++		mt7996_tm_set(dev, SET_ID(ANT_MASK), td->tx_antenna_mask);
++
++		/* trigger firmware to start CONT TX */
++		mt7996_tm_set(dev, SET_ID(COMMAND), RF_CMD(CONT_WAVE));
++	} else {
++		/* trigger firmware to stop CONT TX  */
++		mt7996_tm_set(dev, SET_ID(COMMAND), RF_CMD(STOP_TEST));
++	}
++}
++
++static void
++mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
++{
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7996_dev *dev = phy->dev;
++	bool en = td->state != MT76_TM_STATE_OFF;
++
++	if (changed & BIT(TM_CHANGED_FREQ_OFFSET))
++		mt7996_tm_set(dev, SET_ID(FREQ_OFFSET), en ? td->freq_offset : 0);
++	if (changed & BIT(TM_CHANGED_TXPOWER))
++		mt7996_tm_set(dev, SET_ID(POWER), td->tx_power[0]);
++	if (changed & BIT(TM_CHANGED_TX_LENGTH)) {
++		mt7996_tm_set(dev, SET_ID(TX_LEN), td->tx_mpdu_len);
++		mt7996_tm_set(dev, SET_ID(TX_TIME), 0);
++	}
++	if (changed & BIT(TM_CHANGED_TX_TIME)) {
++		mt7996_tm_set(dev, SET_ID(TX_LEN), 0);
++		mt7996_tm_set(dev, SET_ID(TX_TIME), td->tx_time);
++	}
++}
++
++static int
++mt7996_tm_set_state(struct mt76_phy *mphy, enum mt76_testmode_state state)
++{
++	struct mt76_testmode_data *td = &mphy->test;
++	struct mt7996_phy *phy = mphy->priv;
++	enum mt76_testmode_state prev_state = td->state;
++
++	mphy->test.state = state;
++
++	if (prev_state != MT76_TM_STATE_OFF)
++		mt7996_tm_set(phy->dev, SET_ID(BAND_IDX), mphy->band_idx);
++
++	if (prev_state == MT76_TM_STATE_TX_FRAMES ||
++	    state == MT76_TM_STATE_TX_FRAMES)
++		mt7996_tm_set_tx_frames(phy, state == MT76_TM_STATE_TX_FRAMES);
++	else if (prev_state == MT76_TM_STATE_RX_FRAMES ||
++		 state == MT76_TM_STATE_RX_FRAMES)
++		mt7996_tm_set_rx_frames(phy, state == MT76_TM_STATE_RX_FRAMES);
++	else if (prev_state == MT76_TM_STATE_TX_CONT ||
++		 state == MT76_TM_STATE_TX_CONT)
++		mt7996_tm_set_tx_cont(phy, state == MT76_TM_STATE_TX_CONT);
++	else if (prev_state == MT76_TM_STATE_OFF ||
++		 state == MT76_TM_STATE_OFF)
++		mt7996_tm_init(phy, !(state == MT76_TM_STATE_OFF));
++
++	if ((state == MT76_TM_STATE_IDLE &&
++	     prev_state == MT76_TM_STATE_OFF) ||
++	    (state == MT76_TM_STATE_OFF &&
++	     prev_state == MT76_TM_STATE_IDLE)) {
++		u32 changed = 0;
++		int i;
++
++		for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
++			u16 cur = tm_change_map[i];
++
++			if (td->param_set[cur / 32] & BIT(cur % 32))
++				changed |= BIT(i);
++		}
++
++		mt7996_tm_update_params(phy, changed);
++	}
++
++	return 0;
++}
++
++static int
++mt7996_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
++		     enum mt76_testmode_state new_state)
++{
++	struct mt76_testmode_data *td = &mphy->test;
++	struct mt7996_phy *phy = mphy->priv;
++	struct mt7996_dev *dev = phy->dev;
++	u32 chainmask = mphy->chainmask, changed = 0;
++	u8 band_idx = phy->mt76->band_idx;
++	int i;
++
++	BUILD_BUG_ON(NUM_TM_CHANGED >= 32);
++
++	if (new_state == MT76_TM_STATE_OFF ||
++	    td->state == MT76_TM_STATE_OFF)
++		return 0;
++
++	chainmask = chainmask >> dev->chainshift[band_idx];
++	if (td->tx_antenna_mask > chainmask)
++		return -EINVAL;
++
++	for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
++		if (tb[tm_change_map[i]])
++			changed |= BIT(i);
++	}
++
++	mt7996_tm_set(dev, SET_ID(BAND_IDX), mphy->band_idx);
++	mt7996_tm_update_params(phy, changed);
++
++	return 0;
++}
++
++static int
++mt7996_tm_get_rx_stats(struct mt7996_phy *phy)
++{
++	struct mt7996_dev *dev = phy->dev;
++	struct mt7996_tm_rx_req req = {
++		.band = phy->mt76->band_idx,
++		.rx_stat_all = {
++			.tag = cpu_to_le16(UNI_TM_RX_STAT_GET_ALL_V2),
++			.len = cpu_to_le16(sizeof(req.rx_stat_all)),
++			.band_idx = phy->mt76->band_idx,
++		},
++	};
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7996_tm_rx_event *rx_stats;
++	struct mt7996_tm_rx_event_stat_all *rx_stats_all;
++	struct sk_buff *skb;
++	enum mt76_rxq_id qid;
++	int i, ret = 0;
++	u32 mac_rx_mdrdy_cnt;
++	u16 mac_rx_len_mismatch, fcs_err_count;
++
++	if (td->state != MT76_TM_STATE_RX_FRAMES)
++		return 0;
++
++	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WM_UNI_CMD_QUERY(TESTMODE_RX_STAT),
++					&req, sizeof(req), true, &skb);
++
++	if (ret)
++		return ret;
++
++	rx_stats = (struct mt7996_tm_rx_event *)skb->data;
++	rx_stats_all = &rx_stats->rx_stat_all;
++
++	phy->test.last_freq_offset = le32_to_cpu(rx_stats_all->user_info[0].freq_offset);
++	phy->test.last_snr = le32_to_cpu(rx_stats_all->user_info[0].snr);
++	for (i = 0; i < ARRAY_SIZE(phy->test.last_rcpi); i++) {
++		phy->test.last_rcpi[i] = le16_to_cpu(rx_stats_all->rxv_info[i].rcpi);
++		phy->test.last_ib_rssi[i] = rx_stats_all->fagc[i].ib_rssi;
++		phy->test.last_wb_rssi[i] = rx_stats_all->fagc[i].wb_rssi;
++	}
++
++	if (phy->mt76->band_idx == 2)
++		qid = MT_RXQ_BAND2;
++	else if (phy->mt76->band_idx == 1)
++		qid = MT_RXQ_BAND1;
++	else
++		qid = MT_RXQ_MAIN;
++
++	fcs_err_count = le16_to_cpu(rx_stats_all->band_info.mac_rx_fcs_err_cnt);
++	mac_rx_len_mismatch = le16_to_cpu(rx_stats_all->band_info.mac_rx_len_mismatch);
++	mac_rx_mdrdy_cnt = le32_to_cpu(rx_stats_all->band_info.mac_rx_mdrdy_cnt);
++	td->rx_stats.packets[qid] += mac_rx_mdrdy_cnt;
++	td->rx_stats.packets[qid] += fcs_err_count;
++	td->rx_stats.fcs_error[qid] += fcs_err_count;
++	td->rx_stats.len_mismatch += mac_rx_len_mismatch;
++
++	dev_kfree_skb(skb);
++
++	return ret;
++}
++
++static void
++mt7996_tm_reset_rx_stats(struct mt76_phy *mphy)
++{
++	struct mt7996_phy *phy = mphy->priv;
++	struct mt7996_dev *dev = phy->dev;
++
++	memset(&mphy->test.rx_stats, 0, sizeof(mphy->test.rx_stats));
++	mt7996_tm_set(dev, SET_ID(TRX_COUNTER_RESET), 0);
++}
++
++static int
++mt7996_tm_get_tx_stats(struct mt7996_phy *phy)
++{
++	struct mt7996_dev *dev = phy->dev;
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	int ret;
++
++	if (td->state != MT76_TM_STATE_TX_FRAMES)
++		return 0;
++
++	ret = mt7996_tm_get(dev, GET_ID(TXED_COUNT), 0, &td->tx_done);
++	if (ret)
++		return ret;
++
++	td->tx_pending = td->tx_count - td->tx_done;
++
++	return ret;
++}
++
++static int
++mt7996_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
++{
++	struct mt7996_phy *phy = mphy->priv;
++	void *rx, *rssi;
++	int i;
++
++	mt7996_tm_set(phy->dev, SET_ID(BAND_IDX), mphy->band_idx);
++	mt7996_tm_get_rx_stats(phy);
++	mt7996_tm_get_tx_stats(phy);
++
++	rx = nla_nest_start(msg, MT76_TM_STATS_ATTR_LAST_RX);
++	if (!rx)
++		return -ENOMEM;
++
++	if (nla_put_s32(msg, MT76_TM_RX_ATTR_FREQ_OFFSET, phy->test.last_freq_offset))
++		return -ENOMEM;
++
++	rssi = nla_nest_start(msg, MT76_TM_RX_ATTR_RCPI);
++	if (!rssi)
++		return -ENOMEM;
++
++	for (i = 0; i < ARRAY_SIZE(phy->test.last_rcpi); i++)
++		if (nla_put_u8(msg, i, phy->test.last_rcpi[i]))
++			return -ENOMEM;
++
++	nla_nest_end(msg, rssi);
++
++	rssi = nla_nest_start(msg, MT76_TM_RX_ATTR_IB_RSSI);
++	if (!rssi)
++		return -ENOMEM;
++
++	for (i = 0; i < ARRAY_SIZE(phy->test.last_ib_rssi); i++)
++		if (nla_put_s8(msg, i, phy->test.last_ib_rssi[i]))
++			return -ENOMEM;
++
++	nla_nest_end(msg, rssi);
++
++	rssi = nla_nest_start(msg, MT76_TM_RX_ATTR_WB_RSSI);
++	if (!rssi)
++		return -ENOMEM;
++
++	for (i = 0; i < ARRAY_SIZE(phy->test.last_wb_rssi); i++)
++		if (nla_put_s8(msg, i, phy->test.last_wb_rssi[i]))
++			return -ENOMEM;
++
++	nla_nest_end(msg, rssi);
++
++	if (nla_put_u8(msg, MT76_TM_RX_ATTR_SNR, phy->test.last_snr))
++		return -ENOMEM;
++
++	nla_nest_end(msg, rx);
++
++	return 0;
++}
++
++const struct mt76_testmode_ops mt7996_testmode_ops = {
++	.set_state = mt7996_tm_set_state,
++	.set_params = mt7996_tm_set_params,
++	.dump_stats = mt7996_tm_dump_stats,
++	.reset_rx_stats = mt7996_tm_reset_rx_stats,
++	.tx_stop = mt7996_tm_tx_stop,
++};
+diff --git a/mt7996/testmode.h b/mt7996/testmode.h
+new file mode 100644
+index 00000000..f381da56
+--- /dev/null
++++ b/mt7996/testmode.h
+@@ -0,0 +1,292 @@
++/* SPDX-License-Identifier: ISC */
++/* Copyright (C) 2020 MediaTek Inc. */
++
++#ifndef __MT7996_TESTMODE_H
++#define __MT7996_TESTMODE_H
++
++enum {
++	TM_CBW_20MHZ,
++	TM_CBW_40MHZ,
++	TM_CBW_80MHZ,
++	TM_CBW_10MHZ,
++	TM_CBW_5MHZ,
++	TM_CBW_160MHZ,
++	TM_CBW_8080MHZ,
++	TM_CBW_320MHZ = 12,
++};
++
++/* BW defined in FW hal_cal_flow_rom.h */
++enum {
++	FW_CDBW_20MHZ,
++	FW_CDBW_40MHZ,
++	FW_CDBW_80MHZ,
++	FW_CDBW_160MHZ,
++	FW_CDBW_320MHZ,
++	FW_CDBW_5MHZ,
++	FW_CDBW_10MHZ,
++	FW_CDBW_8080MHZ,
++};
++
++enum bw_mapping_method {
++	BW_MAP_NL_TO_FW,
++	BW_MAP_NL_TO_TM,
++
++	NUM_BW_MAP,
++};
++
++struct mt7996_tm_rf_test {
++	__le16 tag;
++	__le16 len;
++
++	u8 action;
++	u8 icap_len;
++	u8 _rsv[2];
++	union {
++		__le32 op_mode;
++		__le32 freq;
++
++		struct {
++			__le32 func_idx;
++			union {
++				__le32 func_data;
++				__le32 cal_dump;
++
++				u8 _pad[80];
++			} param;
++		} rf;
++	} op;
++} __packed;
++
++struct mt7996_tm_req {
++	u8 _rsv[4];
++
++	struct mt7996_tm_rf_test rf_test;
++} __packed;
++
++struct mt7996_tm_rf_test_result {
++	__le32 func_idx;
++	__le32 payload_length;
++	u8 event[0];
++};
++
++struct mt7996_tm_event {
++	u8 _rsv[4];
++
++	__le16 tag;
++	__le16 len;
++	struct mt7996_tm_rf_test_result result;
++} __packed;
++
++enum {
++	RF_ACTION_SWITCH_TO_RF_TEST,
++	RF_ACTION_IN_RF_TEST,
++	RF_ACTION_SET = 3,
++	RF_ACTION_GET,
++};
++
++enum {
++	RF_OPER_NORMAL,
++	RF_OPER_RF_TEST,
++	RF_OPER_ICAP,
++	RF_OPER_ICAP_OVERLAP,
++	RF_OPER_WIFI_SPECTRUM,
++};
++
++enum {
++	UNI_RF_TEST_CTRL,
++};
++
++#define RF_CMD(cmd)		RF_TEST_CMD_##cmd
++
++enum {
++	RF_TEST_CMD_STOP_TEST = 0,
++	RF_TEST_CMD_START_TX = 1,
++	RF_TEST_CMD_START_RX = 2,
++	RF_TEST_CMD_CONT_WAVE = 10,
++	RF_TEST_CMD_TX_COMMIT = 18,
++	RF_TEST_CMD_RX_COMMIT = 19,
++};
++
++#define SET_ID(id)		RF_TEST_ID_SET_##id
++#define GET_ID(id)		RF_TEST_ID_GET_##id
++
++enum {
++	RF_TEST_ID_SET_COMMAND = 1,
++	RF_TEST_ID_SET_POWER = 2,
++	RF_TEST_ID_SET_TX_RATE = 3,
++	RF_TEST_ID_SET_TX_MODE = 4,
++	RF_TEST_ID_SET_TX_LEN = 6,
++	RF_TEST_ID_SET_TX_COUNT = 7,
++	RF_TEST_ID_SET_IPG = 8,
++	RF_TEST_ID_SET_GI = 16,
++	RF_TEST_ID_SET_STBC = 17,
++	RF_TEST_ID_SET_CHAN_FREQ = 18,
++	RF_TEST_ID_GET_TXED_COUNT = 32,
++	RF_TEST_ID_SET_CONT_WAVE_MODE = 65,
++	RF_TEST_ID_SET_DA = 68,
++	RF_TEST_ID_SET_SA = 69,
++	RF_TEST_ID_SET_CBW = 71,
++	RF_TEST_ID_SET_DBW = 72,
++	RF_TEST_ID_SET_PRIMARY_CH = 73,
++	RF_TEST_ID_SET_ENCODE_MODE = 74,
++	RF_TEST_ID_SET_BAND = 90,
++	RF_TEST_ID_SET_TRX_COUNTER_RESET = 91,
++	RF_TEST_ID_SET_MAC_HEADER = 101,
++	RF_TEST_ID_SET_SEQ_CTRL = 102,
++	RF_TEST_ID_SET_BAND_IDX = 104,
++	RF_TEST_ID_SET_RX_PATH = 106,
++	RF_TEST_ID_SET_FREQ_OFFSET = 107,
++	RF_TEST_ID_GET_FREQ_OFFSET = 108,
++	RF_TEST_ID_SET_TX_PATH = 113,
++	RF_TEST_ID_SET_NSS = 114,
++	RF_TEST_ID_SET_ANT_MASK = 115,
++	RF_TEST_ID_SET_IBF_ENABLE = 126,
++	RF_TEST_ID_SET_EBF_ENABLE = 127,
++	RF_TEST_ID_GET_TX_POWER = 136,
++	RF_TEST_ID_SET_RX_MU_AID = 157,
++	RF_TEST_ID_SET_HW_TX_MODE = 167,
++	RF_TEST_ID_SET_PUNCTURE = 168,
++	RF_TEST_ID_SET_BSSID = 189,
++	RF_TEST_ID_SET_TX_TIME = 190,
++	RF_TEST_ID_SET_MAX_PE = 191,
++	RF_TEST_ID_SET_AID_OFFSET = 204,
++};
++
++struct mt7996_tm_rx_stat_user_ctrl {
++	__le16 tag;
++	__le16 len;
++
++	u8 band_idx;
++	u8 rsv;
++	__le16 user_idx;
++} __packed;
++
++struct mt7996_tm_rx_stat_all {
++	__le16 tag;
++	__le16 len;
++
++	u8 band_idx;
++	u8 rsv[3];
++} __packed;
++
++struct mt7996_tm_rx_req {
++	u8 band;
++	u8 _rsv[3];
++
++	union {
++		struct mt7996_tm_rx_stat_user_ctrl user_ctrl;
++		struct mt7996_tm_rx_stat_all rx_stat_all;
++	};
++} __packed;
++
++enum {
++	UNI_TM_RX_STAT_SET_USER_CTRL = 7,
++	UNI_TM_RX_STAT_GET_ALL_V2 = 9,
++};
++
++struct rx_band_info {
++	/* mac part */
++	__le16 mac_rx_fcs_err_cnt;
++	__le16 mac_rx_len_mismatch;
++	__le16 mac_rx_fcs_ok_cnt;
++	u8 rsv1[2];
++	__le32 mac_rx_mdrdy_cnt;
++
++	/* phy part */
++	__le16 phy_rx_fcs_err_cnt_cck;
++	__le16 phy_rx_fcs_err_cnt_ofdm;
++	__le16 phy_rx_pd_cck;
++	__le16 phy_rx_pd_ofdm;
++	__le16 phy_rx_sig_err_cck;
++	__le16 phy_rx_sfd_err_cck;
++	__le16 phy_rx_sig_err_ofdm;
++	__le16 phy_rx_tag_err_ofdm;
++	__le16 phy_rx_mdrdy_cnt_cck;
++	__le16 phy_rx_mdrdy_cnt_ofdm;
++} __packed;
++
++struct rx_band_info_ext {
++	/* mac part */
++	__le32 mac_rx_mpdu_cnt;
++
++	/* phy part */
++	u8 rsv[4];
++} __packed;
++
++struct rx_common_info {
++	__le16 rx_fifo_full;
++	u8 rsv[2];
++	__le32 aci_hit_low;
++	__le32 aci_hit_high;
++} __packed;
++
++struct rx_common_info_ext {
++	__le32 driver_rx_count;
++	__le32 sinr;
++	__le32 mu_pkt_count;
++
++	/* mac part */
++	u8 _rsv[4];
++
++	/* phy part */
++	u8 sig_mcs;
++	u8 rsv[3];
++} __packed;
++
++struct rx_rxv_info {
++	__le16 rcpi;
++	s16 rssi;
++	s16 snr;
++	s16 adc_rssi;
++} __packed;
++
++struct rx_rssi_info {
++	s8 ib_rssi;
++	s8 wb_rssi;
++	u8 rsv[2];
++} __packed;
++
++struct rx_user_info {
++	s32 freq_offset;
++	s32 snr;
++	__le32 fcs_err_count;
++} __packed;
++
++struct rx_user_info_ext {
++	s8 ne_var_db_all_user;
++	u8 rsv[3];
++} __packed;
++
++#define MAX_ANTENNA_NUM		8
++#define MAX_USER_NUM		16
++
++struct mt7996_tm_rx_event_stat_all {
++	__le16 tag;
++	__le16 len;
++
++	struct rx_band_info band_info;
++	struct rx_band_info_ext band_info_ext;
++	struct rx_common_info common_info;
++	struct rx_common_info_ext common_info_ext;
++
++	/* RXV info */
++	struct rx_rxv_info rxv_info[MAX_ANTENNA_NUM];
++
++	/* RSSI info */
++	struct rx_rssi_info fagc[MAX_ANTENNA_NUM];
++	struct rx_rssi_info inst[MAX_ANTENNA_NUM];
++
++	/* User info */
++	struct rx_user_info user_info[MAX_USER_NUM];
++	struct rx_user_info_ext user_info_ext[MAX_USER_NUM];
++} __packed;
++
++struct mt7996_tm_rx_event {
++	u8 _rsv[4];
++
++	union {
++		struct mt7996_tm_rx_event_stat_all rx_stat_all;
++	};
++} __packed;
++
++#endif
+diff --git a/testmode.c b/testmode.c
+index 0d2bae9f..007358bd 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -2,6 +2,7 @@
+ /* Copyright (C) 2020 Felix Fietkau <nbd@nbd.name> */
+ 
+ #include <linux/random.h>
++#include "mt76_connac.h"
+ #include "mt76.h"
+ 
+ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
+@@ -81,6 +82,11 @@ mt76_testmode_max_mpdu_len(struct mt76_phy *phy, u8 tx_rate_mode)
+ 		    IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991)
+ 			return IEEE80211_MAX_MPDU_LEN_VHT_7991;
+ 		return IEEE80211_MAX_MPDU_LEN_VHT_11454;
++	case MT76_TM_TX_MODE_EHT_SU:
++	case MT76_TM_TX_MODE_EHT_TRIG:
++	case MT76_TM_TX_MODE_EHT_MU:
++		/* TODO: check the limit */
++		return UINT_MAX;
+ 	case MT76_TM_TX_MODE_CCK:
+ 	case MT76_TM_TX_MODE_OFDM:
+ 	default:
+@@ -182,6 +188,9 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
+ 	u8 max_nss = hweight8(phy->antenna_mask);
+ 	int ret;
+ 
++	if (is_mt7996(phy->dev))
++		return 0;
++
+ 	ret = mt76_testmode_alloc_skb(phy, td->tx_mpdu_len);
+ 	if (ret)
+ 		return ret;
+@@ -274,7 +283,9 @@ mt76_testmode_tx_start(struct mt76_phy *phy)
+ 	td->tx_queued = 0;
+ 	td->tx_done = 0;
+ 	td->tx_pending = td->tx_count;
+-	mt76_worker_schedule(&dev->tx_worker);
++
++	if (!is_mt7996(dev))
++		mt76_worker_schedule(&dev->tx_worker);
+ }
+ 
+ static void
+@@ -283,6 +294,11 @@ mt76_testmode_tx_stop(struct mt76_phy *phy)
+ 	struct mt76_testmode_data *td = &phy->test;
+ 	struct mt76_dev *dev = phy->dev;
+ 
++	if (is_mt7996(dev) && dev->test_ops->tx_stop) {
++		dev->test_ops->tx_stop(phy);
++		return;
++	}
++
+ 	mt76_worker_disable(&dev->tx_worker);
+ 
+ 	td->tx_pending = 0;
+@@ -311,6 +327,7 @@ static void
+ mt76_testmode_init_defaults(struct mt76_phy *phy)
+ {
+ 	struct mt76_testmode_data *td = &phy->test;
++	u8 addr[ETH_ALEN] = {phy->band_idx, 0x11, 0x22, 0xaa, 0xbb, 0xcc};
+ 
+ 	if (td->tx_mpdu_len > 0)
+ 		return;
+@@ -318,11 +335,18 @@ mt76_testmode_init_defaults(struct mt76_phy *phy)
+ 	td->tx_mpdu_len = 1024;
+ 	td->tx_count = 1;
+ 	td->tx_rate_mode = MT76_TM_TX_MODE_OFDM;
++	td->tx_rate_idx = 7;
+ 	td->tx_rate_nss = 1;
++	/* 0xffff for OFDMA no puncture */
++	td->tx_preamble_puncture = ~(td->tx_preamble_puncture & 0);
++	td->tx_ipg = 50;
+ 
+-	memcpy(td->addr[0], phy->macaddr, ETH_ALEN);
+-	memcpy(td->addr[1], phy->macaddr, ETH_ALEN);
+-	memcpy(td->addr[2], phy->macaddr, ETH_ALEN);
++	/* rx stat user config */
++	td->aid = 1;
++
++	memcpy(td->addr[0], addr, ETH_ALEN);
++	memcpy(td->addr[1], addr, ETH_ALEN);
++	memcpy(td->addr[2], addr, ETH_ALEN);
+ }
+ 
+ static int
+@@ -352,7 +376,7 @@ __mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state)
+ 	if (state == MT76_TM_STATE_TX_FRAMES)
+ 		mt76_testmode_tx_start(phy);
+ 	else if (state == MT76_TM_STATE_RX_FRAMES) {
+-		memset(&phy->test.rx_stats, 0, sizeof(phy->test.rx_stats));
++		dev->test_ops->reset_rx_stats(phy);
+ 	}
+ 
+ 	phy->test.state = state;
+@@ -453,7 +477,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
+ 			   &td->tx_duty_cycle, 0, 99) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_POWER_CONTROL],
+-			   &td->tx_power_control, 0, 1))
++			   &td->tx_power_control, 0, 1) ||
++	    mt76_tm_get_u8(tb[MT76_TM_ATTR_AID], &td->aid, 0, 16))
+ 		goto out;
+ 
+ 	if (tb[MT76_TM_ATTR_TX_LENGTH]) {
+@@ -493,7 +518,9 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			    idx >= ARRAY_SIZE(td->tx_power))
+ 				goto out;
+ 
+-			td->tx_power[idx++] = nla_get_u8(cur);
++			err = mt76_tm_get_u8(cur, &td->tx_power[idx++], 0, 63);
++			if (err)
++				return err;
+ 		}
+ 	}
+ 
+@@ -560,6 +587,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
+ 	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_PACKETS, rx_packets,
+ 			      MT76_TM_STATS_ATTR_PAD) ||
+ 	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_FCS_ERROR, rx_fcs_error,
++			      MT76_TM_STATS_ATTR_PAD) ||
++	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_LEN_MISMATCH,
++			      td->rx_stats.len_mismatch,
+ 			      MT76_TM_STATS_ATTR_PAD))
+ 		return -EMSGSIZE;
+ 
+@@ -624,6 +654,7 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_SGI, td->tx_rate_sgi) ||
+ 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_LDPC, td->tx_rate_ldpc) ||
+ 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_STBC, td->tx_rate_stbc) ||
++	    nla_put_u8(msg, MT76_TM_ATTR_AID, td->aid) ||
+ 	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_LTF) &&
+ 	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
+ 	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_ANTENNA) &&
+diff --git a/testmode.h b/testmode.h
+index a40cd74b..8d0b9702 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -39,6 +39,11 @@
+  *
+  * @MT76_TM_ATTR_STATS: statistics (nested, see &enum mt76_testmode_stats_attr)
+  *
++ * @MT76_TM_ATTR_PRECAL: Pre-cal data (u8)
++ * @MT76_TM_ATTR_PRECAL_INFO: group size, dpd size, dpd_info, transmit size,
++ *                            eeprom cal indicator (u32),
++ *                            dpd_info = [dpd_per_chan_size, chan_num_2g,
++ *                                        chan_num_5g, chan_num_6g]
+  * @MT76_TM_ATTR_TX_SPE_IDX: tx spatial extension index (u8)
+  *
+  * @MT76_TM_ATTR_TX_DUTY_CYCLE: packet tx duty cycle (u8)
+@@ -48,6 +53,29 @@
+  * @MT76_TM_ATTR_DRV_DATA: driver specific netlink attrs (nested)
+  *
+  * @MT76_TM_ATTR_MAC_ADDRS: array of nested MAC addresses (nested)
++ *
++ * @MT76_TM_ATTR_EEPROM_ACTION: eeprom setting actions
++ *	(u8, see &enum mt76_testmode_eeprom_action)
++ * @MT76_TM_ATTR_EEPROM_OFFSET: offset of eeprom data block for writing (u32)
++ * @MT76_TM_ATTR_EEPROM_VAL: values for writing into a 16-byte data block
++ *	(nested, u8 attrs)
++ *
++ * @MT76_TM_ATTR_CFG: config testmode rf feature (nested, see &mt76_testmode_cfg)
++ * @MT76_TM_ATTR_TXBF_ACT: txbf setting actions (u8)
++ * @MT76_TM_ATTR_TXBF_PARAM: txbf parameters (nested)
++ *
++ * @MT76_TM_ATTR_OFF_CH_SCAN_CH: config the channel of background chain (ZWDFS) (u8)
++ * @MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH: config the center channel of background chain (ZWDFS) (u8)
++ * @MT76_TM_ATTR_OFF_CH_SCAN_BW: config the bandwidth of background chain (ZWDFS) (u8)
++ * @MT76_TM_ATTR_OFF_CH_SCAN_PATH: config the tx path of background chain (ZWDFS) (u8)
++ *
++ * @MT76_TM_ATTR_IPI_THRESHOLD: config the IPI index you want to read (u8)
++ * @MT76_TM_ATTR_IPI_PERIOD: config the time period for reading
++ *			     the histogram of specific IPI index (u8)
++ * @MT76_TM_ATTR_IPI_ANTENNA_INDEX: config the antenna index for reading
++ *				    the histogram of specific IPI index (u8)
++ * @MT76_TM_ATTR_IPI_RESET: Reset the IPI counter
++ *
+  */
+ enum mt76_testmode_attr {
+ 	MT76_TM_ATTR_UNSPEC,
+@@ -76,6 +104,8 @@ enum mt76_testmode_attr {
+ 	MT76_TM_ATTR_FREQ_OFFSET,
+ 
+ 	MT76_TM_ATTR_STATS,
++	MT76_TM_ATTR_PRECAL,
++	MT76_TM_ATTR_PRECAL_INFO,
+ 
+ 	MT76_TM_ATTR_TX_SPE_IDX,
+ 
+@@ -86,6 +116,27 @@ enum mt76_testmode_attr {
+ 	MT76_TM_ATTR_DRV_DATA,
+ 
+ 	MT76_TM_ATTR_MAC_ADDRS,
++	MT76_TM_ATTR_AID,
++	MT76_TM_ATTR_RU_ALLOC,
++	MT76_TM_ATTR_RU_IDX,
++
++	MT76_TM_ATTR_EEPROM_ACTION,
++	MT76_TM_ATTR_EEPROM_OFFSET,
++	MT76_TM_ATTR_EEPROM_VAL,
++
++	MT76_TM_ATTR_CFG,
++	MT76_TM_ATTR_TXBF_ACT,
++	MT76_TM_ATTR_TXBF_PARAM,
++
++	MT76_TM_ATTR_OFF_CH_SCAN_CH,
++	MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH,
++	MT76_TM_ATTR_OFF_CH_SCAN_BW,
++	MT76_TM_ATTR_OFF_CH_SCAN_PATH,
++
++	MT76_TM_ATTR_IPI_THRESHOLD,
++	MT76_TM_ATTR_IPI_PERIOD,
++	MT76_TM_ATTR_IPI_ANTENNA_INDEX,
++	MT76_TM_ATTR_IPI_RESET,
+ 
+ 	/* keep last */
+ 	NUM_MT76_TM_ATTRS,
+@@ -103,6 +154,8 @@ enum mt76_testmode_attr {
+  * @MT76_TM_STATS_ATTR_RX_FCS_ERROR: number of rx packets with FCS error (u64)
+  * @MT76_TM_STATS_ATTR_LAST_RX: information about the last received packet
+  *	see &enum mt76_testmode_rx_attr
++ * @MT76_TM_STATS_ATTR_RX_LEN_MISMATCH: number of rx packets with length
++ *	mismatch error (u64)
+  */
+ enum mt76_testmode_stats_attr {
+ 	MT76_TM_STATS_ATTR_UNSPEC,
+@@ -115,6 +168,7 @@ enum mt76_testmode_stats_attr {
+ 	MT76_TM_STATS_ATTR_RX_PACKETS,
+ 	MT76_TM_STATS_ATTR_RX_FCS_ERROR,
+ 	MT76_TM_STATS_ATTR_LAST_RX,
++	MT76_TM_STATS_ATTR_RX_LEN_MISMATCH,
+ 
+ 	/* keep last */
+ 	NUM_MT76_TM_STATS_ATTRS,
+@@ -179,6 +233,9 @@ enum mt76_testmode_state {
+  * @MT76_TM_TX_MODE_HE_EXT_SU: 802.11ax extended-range SU
+  * @MT76_TM_TX_MODE_HE_TB: 802.11ax trigger-based
+  * @MT76_TM_TX_MODE_HE_MU: 802.11ax multi-user MIMO
++ * @MT76_TM_TX_MODE_EHT_SU: 802.11be single-user MIMO
++ * @MT76_TM_TX_MODE_EHT_TRIG: 802.11be trigger-based
++ * @MT76_TM_TX_MODE_EHT_MU: 802.11be multi-user MIMO
+  */
+ enum mt76_testmode_tx_mode {
+ 	MT76_TM_TX_MODE_CCK,
+@@ -189,6 +246,9 @@ enum mt76_testmode_tx_mode {
+ 	MT76_TM_TX_MODE_HE_EXT_SU,
+ 	MT76_TM_TX_MODE_HE_TB,
+ 	MT76_TM_TX_MODE_HE_MU,
++	MT76_TM_TX_MODE_EHT_SU,
++	MT76_TM_TX_MODE_EHT_TRIG,
++	MT76_TM_TX_MODE_EHT_MU,
+ 
+ 	/* keep last */
+ 	NUM_MT76_TM_TX_MODES,
+diff --git a/tools/fields.c b/tools/fields.c
+index e3f69089..e5cf7c53 100644
+--- a/tools/fields.c
++++ b/tools/fields.c
+@@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
+ 	[MT76_TM_STATE_IDLE] = "idle",
+ 	[MT76_TM_STATE_TX_FRAMES] = "tx_frames",
+ 	[MT76_TM_STATE_RX_FRAMES] = "rx_frames",
++	[MT76_TM_STATE_TX_CONT] = "tx_cont",
+ };
+ 
+ static const char * const testmode_tx_mode[] = {
+@@ -21,6 +22,9 @@ static const char * const testmode_tx_mode[] = {
+ 	[MT76_TM_TX_MODE_HE_EXT_SU] = "he_ext_su",
+ 	[MT76_TM_TX_MODE_HE_TB] = "he_tb",
+ 	[MT76_TM_TX_MODE_HE_MU] = "he_mu",
++	[MT76_TM_TX_MODE_EHT_SU] = "eht_su",
++	[MT76_TM_TX_MODE_EHT_TRIG] = "eht_tb",
++	[MT76_TM_TX_MODE_EHT_MU] = "eht_mu",
+ };
+ 
+ static void print_enum(const struct tm_field *field, struct nlattr *attr)
+@@ -201,6 +205,62 @@ static void print_extra_stats(const struct tm_field *field, struct nlattr **tb)
+ 	printf("%srx_per=%.02f%%\n", prefix, 100 * failed / total);
+ }
+ 
++static bool parse_mac(const struct tm_field *field, int idx,
++		      struct nl_msg *msg, const char *val)
++{
++#define ETH_ALEN	6
++	bool ret = true;
++	char *str, *cur, *ap;
++	void *a;
++
++	str = strdup(val);
++	ap = str;
++
++	a = nla_nest_start(msg, idx);
++
++	idx = 0;
++	while ((cur = strsep(&ap, ",")) != NULL) {
++		unsigned char addr[ETH_ALEN];
++		char *val, *tmp = cur;
++		int i = 0;
++
++		while ((val = strsep(&tmp, ":")) != NULL) {
++			if (i >= ETH_ALEN)
++				break;
++
++			addr[i++] = strtoul(val, NULL, 16);
++		}
++
++		nla_put(msg, idx, ETH_ALEN, addr);
++
++		idx++;
++	}
++
++	nla_nest_end(msg, a);
++
++	free(str);
++
++	return ret;
++}
++
++static void print_mac(const struct tm_field *field, struct nlattr *attr)
++{
++#define MAC2STR(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5]
++#define MACSTR "%02x:%02x:%02x:%02x:%02x:%02x"
++	unsigned char addr[3][6];
++	struct nlattr *cur;
++	int idx = 0;
++	int rem;
++
++	nla_for_each_nested(cur, attr, rem) {
++		if (nla_len(cur) != 6)
++			continue;
++		memcpy(addr[idx++], nla_data(cur), 6);
++	}
++
++	printf("" MACSTR "," MACSTR "," MACSTR "",
++	       MAC2STR(addr[0]), MAC2STR(addr[1]), MAC2STR(addr[2]));
++}
+ 
+ #define FIELD_GENERIC(_field, _name, ...)	\
+ 	[FIELD_NAME(_field)] = {			\
+@@ -250,6 +310,13 @@ static void print_extra_stats(const struct tm_field *field, struct nlattr **tb)
+ 		 ##__VA_ARGS__				\
+ 	)
+ 
++#define FIELD_MAC(_field, _name)			\
++	[FIELD_NAME(_field)] = {			\
++		.name = _name,				\
++		.parse = parse_mac,			\
++		.print = print_mac			\
++	}
++
+ #define FIELD_NAME(_field) MT76_TM_RX_ATTR_##_field
+ static const struct tm_field rx_fields[NUM_MT76_TM_RX_ATTRS] = {
+ 	FIELD_RO(s32, FREQ_OFFSET, "freq_offset"),
+@@ -274,6 +341,7 @@ static const struct tm_field stats_fields[NUM_MT76_TM_STATS_ATTRS] = {
+ 	FIELD_RO(u32, TX_DONE, "tx_done"),
+ 	FIELD_RO(u64, RX_PACKETS, "rx_packets"),
+ 	FIELD_RO(u64, RX_FCS_ERROR, "rx_fcs_error"),
++	FIELD_RO(u64, RX_LEN_MISMATCH, "rx_len_mismatch"),
+ 	FIELD_NESTED_RO(LAST_RX, rx, "last_"),
+ };
+ static struct nla_policy stats_policy[NUM_MT76_TM_STATS_ATTRS] = {
+@@ -282,6 +350,7 @@ static struct nla_policy stats_policy[NUM_MT76_TM_STATS_ATTRS] = {
+ 	[MT76_TM_STATS_ATTR_TX_DONE] = { .type = NLA_U32 },
+ 	[MT76_TM_STATS_ATTR_RX_PACKETS] = { .type = NLA_U64 },
+ 	[MT76_TM_STATS_ATTR_RX_FCS_ERROR] = { .type = NLA_U64 },
++	[MT76_TM_STATS_ATTR_RX_LEN_MISMATCH] = { .type = NLA_U64 },
+ };
+ #undef FIELD_NAME
+ 
+@@ -300,12 +369,20 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
+ 	FIELD(u8, TX_RATE_LDPC, "tx_rate_ldpc"),
+ 	FIELD(u8, TX_RATE_STBC, "tx_rate_stbc"),
+ 	FIELD(u8, TX_LTF, "tx_ltf"),
++	FIELD(u8, TX_DUTY_CYCLE, "tx_duty_cycle"),
++	FIELD(u32, TX_IPG, "tx_ipg"),
++	FIELD(u32, TX_TIME, "tx_time"),
+ 	FIELD(u8, TX_POWER_CONTROL, "tx_power_control"),
+ 	FIELD_ARRAY(u8, TX_POWER, "tx_power"),
+ 	FIELD(u8, TX_ANTENNA, "tx_antenna"),
+ 	FIELD(u32, FREQ_OFFSET, "freq_offset"),
++	FIELD(u8, AID, "aid"),
++	FIELD(u8, RU_ALLOC, "ru_alloc"),
++	FIELD(u8, RU_IDX, "ru_idx"),
++	FIELD_MAC(MAC_ADDRS, "mac_addrs"),
+ 	FIELD_NESTED_RO(STATS, stats, "",
+ 			.print_extra = print_extra_stats),
++
+ };
+ #undef FIELD_NAME
+ 
+@@ -322,10 +399,25 @@ static struct nla_policy testdata_policy[NUM_MT76_TM_ATTRS] = {
+ 	[MT76_TM_ATTR_TX_RATE_LDPC] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_TX_RATE_STBC] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_TX_LTF] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_TX_DUTY_CYCLE] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_TX_IPG] = { .type = NLA_U32 },
++	[MT76_TM_ATTR_TX_TIME] = { .type = NLA_U32 },
+ 	[MT76_TM_ATTR_TX_POWER_CONTROL] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_TX_ANTENNA] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_TX_SPE_IDX] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_FREQ_OFFSET] = { .type = NLA_U32 },
++	[MT76_TM_ATTR_AID] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_RU_ALLOC] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_RU_IDX] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_STATS] = { .type = NLA_NESTED },
++	[MT76_TM_ATTR_TXBF_ACT] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_OFF_CH_SCAN_CH] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_OFF_CH_SCAN_BW] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_IPI_THRESHOLD] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_IPI_PERIOD] = { .type = NLA_U32 },
++	[MT76_TM_ATTR_IPI_ANTENNA_INDEX] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_IPI_RESET] = { .type = NLA_U8 },
+ };
+ 
+ const struct tm_field msg_field = {
+-- 
+2.39.2
+
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0028-mt76-testmode-add-chainmask-hacking-for-eagle-band-2.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0028-mt76-testmode-add-chainmask-hacking-for-eagle-band-2.patch
new file mode 100644
index 0000000..955da4f
--- /dev/null
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0028-mt76-testmode-add-chainmask-hacking-for-eagle-band-2.patch
@@ -0,0 +1,26 @@
+From ce6a6a9f16be09f992a937ddc7b8606158f1bd4b Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Thu, 9 Mar 2023 18:45:04 +0800
+Subject: [PATCH 28/29] mt76: testmode: add chainmask hacking for eagle band 2
+ 4T5R
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+---
+ mt7996/testmode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/mt7996/testmode.c b/mt7996/testmode.c
+index 5dbbb788..17212516 100644
+--- a/mt7996/testmode.c
++++ b/mt7996/testmode.c
+@@ -446,6 +446,7 @@ mt7996_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
+ 		return 0;
+ 
+ 	chainmask = chainmask >> dev->chainshift[band_idx];
++	chainmask = 0x1f;	/* hacking for eagle band2 4T5R */
+ 	if (td->tx_antenna_mask > chainmask)
+ 		return -EINVAL;
+ 
+-- 
+2.39.2
+
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0019-mt76-revert-page-pool-changes.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0029-mt76-revert-page-pool-changes.patch
similarity index 98%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0019-mt76-revert-page-pool-changes.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0029-mt76-revert-page-pool-changes.patch
index 20feead..b2c9629 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0019-mt76-revert-page-pool-changes.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0029-mt76-revert-page-pool-changes.patch
@@ -1,7 +1,7 @@
-From 175bf122ac5790e7e28dadecd9410370364bc16a Mon Sep 17 00:00:00 2001
+From be2fad591cace6a3ba5a2043e085fc143cff0a0e Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Feb 2023 15:34:43 +0800
-Subject: [PATCH 19/19] mt76: revert page pool changes
+Subject: [PATCH 29/29] mt76: revert page pool changes
 
 ---
  dma.c         | 72 ++++++++++++++++++++++++++-------------------------
@@ -214,7 +214,7 @@
  
  	mt76_free_pending_txwi(dev);
 diff --git a/mac80211.c b/mac80211.c
-index e53166fc..d69e7214 100644
+index a4b3d346..40fda9d0 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -4,7 +4,6 @@
@@ -273,7 +273,7 @@
  struct mt76_dev *
  mt76_alloc_device(struct device *pdev, unsigned int size,
  		  const struct ieee80211_ops *ops,
-@@ -1746,21 +1704,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
+@@ -1747,21 +1705,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  }
  EXPORT_SYMBOL_GPL(mt76_ethtool_worker);
  
@@ -296,7 +296,7 @@
  {
  	struct ieee80211_hw *hw = phy->hw;
 diff --git a/mt76.h b/mt76.h
-index c3d1313e..49da2caa 100644
+index 343bd910..3d96b33e 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -202,7 +202,7 @@ struct mt76_queue {
@@ -308,7 +308,7 @@
  };
  
  struct mt76_mcu_ops {
-@@ -1329,7 +1329,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
+@@ -1340,7 +1340,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
  	return usb_bulk_msg(udev, pipe, data, len, actual_len, timeout);
  }
  
@@ -316,7 +316,7 @@
  void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  			 struct mt76_sta_stats *stats, bool eht);
  int mt76_skb_adjust_pad(struct sk_buff *skb, int pad);
-@@ -1441,25 +1440,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
+@@ -1452,25 +1451,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
  struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
  			  struct mt76_txwi_cache *r, dma_addr_t phys);
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0999-mt76-mt7996-for-build-pass.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0999-mt76-mt7996-for-build-pass.patch
index 2f9a0c3..fea9eee 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0999-mt76-mt7996-for-build-pass.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/0999-mt76-mt7996-for-build-pass.patch
@@ -1,20 +1,21 @@
-From a126ad08af718c71b4b05261caefb68996044330 Mon Sep 17 00:00:00 2001
+From 5b6ee04d5043e2cbf4a7c0a0129e1dfbd7f33f2b Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 3 Nov 2022 00:27:17 +0800
-Subject: [PATCH] mt76: mt7996: for build pass
+Subject: [PATCH 0999/1001] mt76: mt7996: for build pass
 
 Change-Id: Ieb44c33ee6e6a2e6058c1ef528404c1a1cbcfdaf
 ---
  debugfs.c         | 3 +++
+ dma.c             | 2 +-
  eeprom.c          | 8 +++++++-
  mcu.c             | 1 +
  mt7615/mcu.c      | 1 +
  mt76_connac_mcu.c | 1 +
  mt7915/mcu.c      | 1 +
  mt7996/dma.c      | 4 ++--
- mt7996/eeprom.c   | 2 ++
+ mt7996/eeprom.c   | 1 +
  mt7996/mcu.c      | 1 +
- 9 files changed, 19 insertions(+), 3 deletions(-)
+ 10 files changed, 19 insertions(+), 4 deletions(-)
 
 diff --git a/debugfs.c b/debugfs.c
 index 79064a4d..e10d4cbc 100644
@@ -32,11 +33,24 @@
  
  	return 0;
  }
+diff --git a/dma.c b/dma.c
+index 7357b398..2fc70e23 100644
+--- a/dma.c
++++ b/dma.c
+@@ -856,7 +856,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+ 		    !(dev->drv->rx_check(dev, data, len)))
+ 			goto free_frag;
+ 
+-		skb = napi_build_skb(data, q->buf_size);
++		skb = build_skb(data, q->buf_size);
+ 		if (!skb)
+ 			goto free_frag;
+ 
 diff --git a/eeprom.c b/eeprom.c
-index ea54b7af..90d36c8d 100644
+index 263e5089..aa889258 100644
 --- a/eeprom.c
 +++ b/eeprom.c
-@@ -106,9 +106,15 @@ void
+@@ -108,9 +108,15 @@ void
  mt76_eeprom_override(struct mt76_phy *phy)
  {
  	struct mt76_dev *dev = phy->dev;
@@ -117,20 +131,19 @@
  
  	mt7996_dma_enable(dev);
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 2e48c5a4..e747cb9f 100644
+index 64e3c4e2..7bff504a 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
-@@ -98,6 +98,8 @@ static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_dev *dev)
+@@ -121,6 +121,7 @@ static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_dev *dev)
  	if (ret)
  		return ret;
  
-+	/* for internal testing */
-+	cap = 0x4b249248;
++	cap = 0x4b249248;	/* internal hardcode */
  	if (cap) {
  		dev->has_eht = !(cap & MODE_HE_ONLY);
  		dev->wtbl_size_group = u32_get_bits(cap, WTBL_SIZE_GROUP);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 829f7be6..0d9d309f 100644
+index 0a52afd1..cc948395 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -5,6 +5,7 @@
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/1000-mt76-mt7996-add-debug-tool.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/1000-mt76-mt7996-add-debug-tool.patch
new file mode 100644
index 0000000..2adf0f2
--- /dev/null
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/1000-mt76-mt7996-add-debug-tool.patch
@@ -0,0 +1,4824 @@
+From 6187d3505e8023d0fec2fb5e0abb56e3d1376755 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Fri, 24 Mar 2023 14:02:32 +0800
+Subject: [PATCH 1000/1001] mt76: mt7996: add debug tool
+
+Change-Id: Ie10390b01f17db893dbfbf3221bf63a4bd1fe38f
+---
+ mt7996/Makefile      |    3 +
+ mt7996/debugfs.c     |   31 +-
+ mt7996/mcu.c         |    4 +
+ mt7996/mt7996.h      |   15 +
+ mt7996/mtk_debug.h   | 2166 ++++++++++++++++++++++++++++++++++++++
+ mt7996/mtk_debugfs.c | 2344 ++++++++++++++++++++++++++++++++++++++++++
+ mt7996/mtk_mcu.c     |   18 +
+ mt7996/mtk_mcu.h     |   16 +
+ tools/fwlog.c        |   25 +-
+ 9 files changed, 4606 insertions(+), 16 deletions(-)
+ create mode 100644 mt7996/mtk_debug.h
+ create mode 100644 mt7996/mtk_debugfs.c
+ create mode 100644 mt7996/mtk_mcu.c
+ create mode 100644 mt7996/mtk_mcu.h
+
+diff --git a/mt7996/Makefile b/mt7996/Makefile
+index f9fb1b0d..5056e179 100644
+--- a/mt7996/Makefile
++++ b/mt7996/Makefile
+@@ -1,4 +1,5 @@
+ # SPDX-License-Identifier: ISC
++EXTRA_CFLAGS += -DCONFIG_MTK_DEBUG
+ 
+ obj-$(CONFIG_MT7996E) += mt7996e.o
+ 
+@@ -6,3 +7,5 @@ mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
+ 	     debugfs.o mmio.o
+ 
+ mt7996e-$(CONFIG_NL80211_TESTMODE) += testmode.o
++
++mt7996e-y += mtk_debugfs.o mtk_mcu.o
+diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
+index 34c30a58..6d04f274 100644
+--- a/mt7996/debugfs.c
++++ b/mt7996/debugfs.c
+@@ -307,6 +307,9 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
+ 	int ret;
+ 
+ 	dev->fw_debug_wm = val ? MCU_FW_LOG_TO_HOST : 0;
++#ifdef CONFIG_MTK_DEBUG
++	dev->fw_debug_wm = val;
++#endif
+ 
+ 	if (dev->fw_debug_bin)
+ 		val = MCU_FW_LOG_RELAY;
+@@ -413,16 +416,22 @@ mt7996_fw_debug_bin_set(void *data, u64 val)
+ 	};
+ 	struct mt7996_dev *dev = data;
+ 
+-	if (!dev->relay_fwlog)
++	if (!dev->relay_fwlog) {
+ 		dev->relay_fwlog = relay_open("fwlog_data", dev->debugfs_dir,
+ 					      1500, 512, &relay_cb, NULL);
+-	if (!dev->relay_fwlog)
+-		return -ENOMEM;
++		if (!dev->relay_fwlog)
++			return -ENOMEM;
++	}
+ 
+ 	dev->fw_debug_bin = val;
+ 
+ 	relay_reset(dev->relay_fwlog);
+ 
++	if (dev->relay_fwlog && !val) {
++		relay_close(dev->relay_fwlog);
++		dev->relay_fwlog = NULL;
++	}
++
+ 	return mt7996_fw_debug_wm_set(dev, dev->fw_debug_wm);
+ }
+ 
+@@ -827,8 +836,13 @@ int mt7996_init_debugfs(struct mt7996_phy *phy)
+ 					    mt7996_rdd_monitor);
+ 	}
+ 
+-	if (phy == &dev->phy)
++	if (phy == &dev->phy) {
+ 		dev->debugfs_dir = dir;
++#ifdef CONFIG_MTK_DEBUG
++		debugfs_create_u16("wlan_idx", 0600, dir, &dev->wlan_idx);
++		mt7996_mtk_init_debugfs(phy, dir);
++#endif
++	}
+ 
+ 	return 0;
+ }
+@@ -842,6 +856,12 @@ mt7996_debugfs_write_fwlog(struct mt7996_dev *dev, const void *hdr, int hdrlen,
+ 	void *dest;
+ 
+ 	spin_lock_irqsave(&lock, flags);
++
++	if (!dev->relay_fwlog) {
++		spin_unlock_irqrestore(&lock, flags);
++		return;
++	}
++
+ 	dest = relay_reserve(dev->relay_fwlog, hdrlen + len + 4);
+ 	if (dest) {
+ 		*(u32 *)dest = hdrlen + len;
+@@ -874,9 +894,6 @@ void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int
+ 		.msg_type = cpu_to_le16(PKT_TYPE_RX_FW_MONITOR),
+ 	};
+ 
+-	if (!dev->relay_fwlog)
+-		return;
+-
+ 	hdr.serial_id = cpu_to_le16(dev->fw_debug_seq++);
+ 	hdr.timestamp = cpu_to_le32(mt76_rr(dev, MT_LPON_FRCR(0)));
+ 	hdr.len = *(__le16 *)data;
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index cc948395..1461ba8e 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -2437,6 +2437,7 @@ static int mt7996_load_patch(struct mt7996_dev *dev)
+ 
+ 	dev_info(dev->mt76.dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
+ 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
++	memcpy(dev->dbg.patch_build_date, hdr->build_date, sizeof(dev->dbg.patch_build_date));
+ 
+ 	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
+ 		struct mt7996_patch_sec *sec;
+@@ -2566,6 +2567,9 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
+ 		hdr = (const struct mt7996_fw_trailer *)			\
+ 				(fw->data + fw->size - sizeof(*hdr));		\
+ 										\
++		memcpy(dev->dbg.ram_build_date[MT7996_RAM_TYPE_##_type],	\
++		       hdr->build_date,						\
++		       sizeof(dev->dbg.ram_build_date[MT7996_RAM_TYPE_##_type]));\
+ 		dev_info(dev->mt76.dev,						\
+ 			 "%s Firmware Version: %.10s, Build Time: %.15s\n",	\
+ 			 #_type, hdr->fw_ver, hdr->build_date);			\
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index e3fd50f6..8b76d69a 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -333,6 +333,17 @@ struct mt7996_dev {
+ 	u32 reg_l2_backup;
+ 
+ 	u8 wtbl_size_group;
++
++#ifdef CONFIG_MTK_DEBUG
++	u16 wlan_idx;
++	struct {
++		char patch_build_date[16];
++		char ram_build_date[3][15];
++		u32 fw_dbg_module;
++		u8 fw_dbg_lv;
++		u32 bcn_total_cnt[__MT_MAX_BAND];
++	} dbg;
++#endif
+ };
+ 
+ enum {
+@@ -596,4 +607,8 @@ void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			    struct ieee80211_sta *sta, struct dentry *dir);
+ #endif
+ 
++#ifdef CONFIG_MTK_DEBUG
++int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir);
++#endif
++
+ #endif
+diff --git a/mt7996/mtk_debug.h b/mt7996/mtk_debug.h
+new file mode 100644
+index 00000000..a48bac50
+--- /dev/null
++++ b/mt7996/mtk_debug.h
+@@ -0,0 +1,2166 @@
++#ifndef __MTK_DEBUG_H
++#define __MTK_DEBUG_H
++
++#ifdef CONFIG_MTK_DEBUG
++#define NO_SHIFT_DEFINE 0xFFFFFFFF
++#define BITS(m, n)              (~(BIT(m)-1) & ((BIT(n) - 1) | BIT(n)))
++
++#define GET_FIELD(_field, _reg)	\
++	({	\
++		(((_reg) & (_field##_MASK)) >> (_field##_SHIFT));	\
++	})
++
++/* AGG */
++#define BN0_WF_AGG_TOP_BASE                                    0x820e2000
++#define BN1_WF_AGG_TOP_BASE                                    0x820f2000
++#define IP1_BN0_WF_AGG_TOP_BASE                                0x830e2000
++
++#define BN0_WF_AGG_TOP_SCR_ADDR                                (BN0_WF_AGG_TOP_BASE + 0x0) // 2000
++#define BN0_WF_AGG_TOP_SCR0_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x4) // 2004
++#define BN0_WF_AGG_TOP_SCR1_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x8) // 2008
++#define BN0_WF_AGG_TOP_BCR_ADDR                                (BN0_WF_AGG_TOP_BASE + 0xc) // 200C
++#define BN0_WF_AGG_TOP_BWCR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x10) // 2010
++#define BN0_WF_AGG_TOP_ARCR0_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x14) // 2014
++#define BN0_WF_AGG_TOP_ARUCR_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x18) // 2018
++#define BN0_WF_AGG_TOP_ARDCR_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x1c) // 201C
++#define BN0_WF_AGG_TOP_AALCR0_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x20) // 2020
++#define BN0_WF_AGG_TOP_AALCR1_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x24) // 2024
++#define BN0_WF_AGG_TOP_PCR0_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x28) // 2028
++#define BN0_WF_AGG_TOP_PCR1_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x2c) // 202C
++#define BN0_WF_AGG_TOP_TTCR0_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x30) // 2030
++#define BN0_WF_AGG_TOP_TTCR1_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x34) // 2034
++#define BN0_WF_AGG_TOP_ACR1_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x38) // 2038
++#define BN0_WF_AGG_TOP_ACR4_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x3c) // 203C
++#define BN0_WF_AGG_TOP_ACR5_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x40) // 2040
++#define BN0_WF_AGG_TOP_ACR6_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x44) // 2044
++#define BN0_WF_AGG_TOP_ACR8_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x4c) // 204C
++#define BN0_WF_AGG_TOP_MRCR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x50) // 2050
++#define BN0_WF_AGG_TOP_MMPDR_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x54) // 2054
++#define BN0_WF_AGG_TOP_GFPDR_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x58) // 2058
++#define BN0_WF_AGG_TOP_VHTPDR_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x5c) // 205C
++#define BN0_WF_AGG_TOP_HEPDR_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x60) // 2060
++#define BN0_WF_AGG_TOP_CTCR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x64) // 2064
++#define BN0_WF_AGG_TOP_ATCR3_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x68) // 2068
++#define BN0_WF_AGG_TOP_SRCR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x6c) // 206C
++#define BN0_WF_AGG_TOP_VBCR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x70) // 2070
++#define BN0_WF_AGG_TOP_TCR_ADDR                                (BN0_WF_AGG_TOP_BASE + 0x74) // 2074
++#define BN0_WF_AGG_TOP_SRHS_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x78) // 2078
++#define BN0_WF_AGG_TOP_DBRCR0_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x7c) // 207C
++#define BN0_WF_AGG_TOP_DBRCR1_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x80) // 2080
++#define BN0_WF_AGG_TOP_CTETCR_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x84) // 2084
++#define BN0_WF_AGG_TOP_WPDR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x88) // 2088
++#define BN0_WF_AGG_TOP_PLRPDR_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x8c) // 208C
++#define BN0_WF_AGG_TOP_CECR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x90) // 2090
++#define BN0_WF_AGG_TOP_OMRCR0_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x94) // 2094
++#define BN0_WF_AGG_TOP_OMRCR1_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x98) // 2098
++#define BN0_WF_AGG_TOP_OMRCR2_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x9c) // 209C
++#define BN0_WF_AGG_TOP_OMRCR3_ADDR                             (BN0_WF_AGG_TOP_BASE + 0xa0) // 20A0
++#define BN0_WF_AGG_TOP_TMCR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0xa4) // 20A4
++#define BN0_WF_AGG_TOP_TWTCR_ADDR                              (BN0_WF_AGG_TOP_BASE + 0xa8) // 20A8
++#define BN0_WF_AGG_TOP_TWTSTACR_ADDR                           (BN0_WF_AGG_TOP_BASE + 0xac) // 20AC
++#define BN0_WF_AGG_TOP_TWTE0TB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xb0) // 20B0
++#define BN0_WF_AGG_TOP_TWTE1TB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xb4) // 20B4
++#define BN0_WF_AGG_TOP_TWTE2TB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xb8) // 20B8
++#define BN0_WF_AGG_TOP_TWTE3TB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xbc) // 20BC
++#define BN0_WF_AGG_TOP_TWTE4TB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xc0) // 20C0
++#define BN0_WF_AGG_TOP_TWTE5TB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xc4) // 20C4
++#define BN0_WF_AGG_TOP_TWTE6TB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xc8) // 20C8
++#define BN0_WF_AGG_TOP_TWTE7TB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xcc) // 20CC
++#define BN0_WF_AGG_TOP_TWTE8TB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xd0) // 20D0
++#define BN0_WF_AGG_TOP_TWTE9TB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xd4) // 20D4
++#define BN0_WF_AGG_TOP_TWTEATB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xd8) // 20D8
++#define BN0_WF_AGG_TOP_TWTEBTB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xdc) // 20DC
++#define BN0_WF_AGG_TOP_TWTECTB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xe0) // 20E0
++#define BN0_WF_AGG_TOP_TWTEDTB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xe4) // 20E4
++#define BN0_WF_AGG_TOP_TWTEETB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xe8) // 20E8
++#define BN0_WF_AGG_TOP_TWTEFTB_ADDR                            (BN0_WF_AGG_TOP_BASE + 0xec) // 20EC
++#define BN0_WF_AGG_TOP_AALCR2_ADDR                             (BN0_WF_AGG_TOP_BASE + 0xf0) // 20F0
++#define BN0_WF_AGG_TOP_AALCR3_ADDR                             (BN0_WF_AGG_TOP_BASE + 0xf4) // 20F4
++#define BN0_WF_AGG_TOP_AALCR4_ADDR                             (BN0_WF_AGG_TOP_BASE + 0xf8) // 20F8
++#define BN0_WF_AGG_TOP_AALCR5_ADDR                             (BN0_WF_AGG_TOP_BASE + 0xfc) // 20FC
++#define BN0_WF_AGG_TOP_AALCR6_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x100) // 2100
++#define BN0_WF_AGG_TOP_AALCR7_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x104) // 2104
++#define BN0_WF_AGG_TOP_ATCR0_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x108) // 2108
++#define BN0_WF_AGG_TOP_ATCR1_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x10c) // 210C
++#define BN0_WF_AGG_TOP_TCCR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x110) // 2110
++#define BN0_WF_AGG_TOP_TFCR_ADDR                               (BN0_WF_AGG_TOP_BASE + 0x114) // 2114
++#define BN0_WF_AGG_TOP_MUCR0_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x118) // 2118
++#define BN0_WF_AGG_TOP_MUCR1_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x11c) // 211C
++#define BN0_WF_AGG_TOP_CSDCR0_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x120) // 2120
++#define BN0_WF_AGG_TOP_CSDCR1_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x124) // 2124
++#define BN0_WF_AGG_TOP_CSDCR2_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x128) // 2128
++#define BN0_WF_AGG_TOP_CSDCR3_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x12c) // 212C
++#define BN0_WF_AGG_TOP_CSDCR4_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x130) // 2130
++#define BN0_WF_AGG_TOP_DYNSCR_ADDR                             (BN0_WF_AGG_TOP_BASE + 0x178) // 2178
++#define BN0_WF_AGG_TOP_DYNSSCR_ADDR                            (BN0_WF_AGG_TOP_BASE + 0x198) // 2198
++#define BN0_WF_AGG_TOP_TCDCNT0_ADDR                            (BN0_WF_AGG_TOP_BASE + 0x2c8) // 22C8
++#define BN0_WF_AGG_TOP_TCDCNT1_ADDR                            (BN0_WF_AGG_TOP_BASE + 0x2cc) // 22CC
++#define BN0_WF_AGG_TOP_TCSR0_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x2d0) // 22D0
++#define BN0_WF_AGG_TOP_TCSR1_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x2d4) // 22D4
++#define BN0_WF_AGG_TOP_TCSR2_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x2d8) // 22D8
++#define BN0_WF_AGG_TOP_DCR_ADDR                                (BN0_WF_AGG_TOP_BASE + 0x2e4) // 22E4
++#define BN0_WF_AGG_TOP_SMDCR_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x2e8) // 22E8
++#define BN0_WF_AGG_TOP_TXCMDSMCR_ADDR                          (BN0_WF_AGG_TOP_BASE + 0x2ec) // 22EC
++#define BN0_WF_AGG_TOP_SMCR0_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x2f0) // 22F0
++#define BN0_WF_AGG_TOP_SMCR1_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x2f4) // 22F4
++#define BN0_WF_AGG_TOP_SMCR2_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x2f8) // 22F8
++#define BN0_WF_AGG_TOP_SMCR3_ADDR                              (BN0_WF_AGG_TOP_BASE + 0x2fc) // 22FC
++
++#define BN0_WF_AGG_TOP_AALCR0_AC01_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR0_ADDR
++#define BN0_WF_AGG_TOP_AALCR0_AC01_AGG_LIMIT_MASK              0x03FF0000                // AC01_AGG_LIMIT[25..16]
++#define BN0_WF_AGG_TOP_AALCR0_AC01_AGG_LIMIT_SHFT              16
++#define BN0_WF_AGG_TOP_AALCR0_AC00_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR0_ADDR
++#define BN0_WF_AGG_TOP_AALCR0_AC00_AGG_LIMIT_MASK              0x000003FF                // AC00_AGG_LIMIT[9..0]
++#define BN0_WF_AGG_TOP_AALCR0_AC00_AGG_LIMIT_SHFT              0
++
++#define BN0_WF_AGG_TOP_AALCR1_AC03_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR1_ADDR
++#define BN0_WF_AGG_TOP_AALCR1_AC03_AGG_LIMIT_MASK              0x03FF0000                // AC03_AGG_LIMIT[25..16]
++#define BN0_WF_AGG_TOP_AALCR1_AC03_AGG_LIMIT_SHFT              16
++#define BN0_WF_AGG_TOP_AALCR1_AC02_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR1_ADDR
++#define BN0_WF_AGG_TOP_AALCR1_AC02_AGG_LIMIT_MASK              0x000003FF                // AC02_AGG_LIMIT[9..0]
++#define BN0_WF_AGG_TOP_AALCR1_AC02_AGG_LIMIT_SHFT              0
++
++#define BN0_WF_AGG_TOP_AALCR2_AC11_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR2_ADDR
++#define BN0_WF_AGG_TOP_AALCR2_AC11_AGG_LIMIT_MASK              0x03FF0000                // AC11_AGG_LIMIT[25..16]
++#define BN0_WF_AGG_TOP_AALCR2_AC11_AGG_LIMIT_SHFT              16
++#define BN0_WF_AGG_TOP_AALCR2_AC10_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR2_ADDR
++#define BN0_WF_AGG_TOP_AALCR2_AC10_AGG_LIMIT_MASK              0x000003FF                // AC10_AGG_LIMIT[9..0]
++#define BN0_WF_AGG_TOP_AALCR2_AC10_AGG_LIMIT_SHFT              0
++
++#define BN0_WF_AGG_TOP_AALCR3_AC13_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR3_ADDR
++#define BN0_WF_AGG_TOP_AALCR3_AC13_AGG_LIMIT_MASK              0x03FF0000                // AC13_AGG_LIMIT[25..16]
++#define BN0_WF_AGG_TOP_AALCR3_AC13_AGG_LIMIT_SHFT              16
++#define BN0_WF_AGG_TOP_AALCR3_AC12_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR3_ADDR
++#define BN0_WF_AGG_TOP_AALCR3_AC12_AGG_LIMIT_MASK              0x000003FF                // AC12_AGG_LIMIT[9..0]
++#define BN0_WF_AGG_TOP_AALCR3_AC12_AGG_LIMIT_SHFT              0
++
++#define BN0_WF_AGG_TOP_AALCR4_AC21_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR4_ADDR
++#define BN0_WF_AGG_TOP_AALCR4_AC21_AGG_LIMIT_MASK              0x03FF0000                // AC21_AGG_LIMIT[25..16]
++#define BN0_WF_AGG_TOP_AALCR4_AC21_AGG_LIMIT_SHFT              16
++#define BN0_WF_AGG_TOP_AALCR4_AC20_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR4_ADDR
++#define BN0_WF_AGG_TOP_AALCR4_AC20_AGG_LIMIT_MASK              0x000003FF                // AC20_AGG_LIMIT[9..0]
++#define BN0_WF_AGG_TOP_AALCR4_AC20_AGG_LIMIT_SHFT              0
++
++#define BN0_WF_AGG_TOP_AALCR5_AC23_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR5_ADDR
++#define BN0_WF_AGG_TOP_AALCR5_AC23_AGG_LIMIT_MASK              0x03FF0000                // AC23_AGG_LIMIT[25..16]
++#define BN0_WF_AGG_TOP_AALCR5_AC23_AGG_LIMIT_SHFT              16
++#define BN0_WF_AGG_TOP_AALCR5_AC22_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR5_ADDR
++#define BN0_WF_AGG_TOP_AALCR5_AC22_AGG_LIMIT_MASK              0x000003FF                // AC22_AGG_LIMIT[9..0]
++#define BN0_WF_AGG_TOP_AALCR5_AC22_AGG_LIMIT_SHFT              0
++
++#define BN0_WF_AGG_TOP_AALCR6_AC31_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR6_ADDR
++#define BN0_WF_AGG_TOP_AALCR6_AC31_AGG_LIMIT_MASK              0x03FF0000                // AC31_AGG_LIMIT[25..16]
++#define BN0_WF_AGG_TOP_AALCR6_AC31_AGG_LIMIT_SHFT              16
++#define BN0_WF_AGG_TOP_AALCR6_AC30_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR6_ADDR
++#define BN0_WF_AGG_TOP_AALCR6_AC30_AGG_LIMIT_MASK              0x000003FF                // AC30_AGG_LIMIT[9..0]
++#define BN0_WF_AGG_TOP_AALCR6_AC30_AGG_LIMIT_SHFT              0
++#define BN0_WF_AGG_TOP_AALCR7_AC33_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR7_ADDR
++#define BN0_WF_AGG_TOP_AALCR7_AC33_AGG_LIMIT_MASK              0x03FF0000                // AC33_AGG_LIMIT[25..16]
++#define BN0_WF_AGG_TOP_AALCR7_AC33_AGG_LIMIT_SHFT              16
++#define BN0_WF_AGG_TOP_AALCR7_AC32_AGG_LIMIT_ADDR              BN0_WF_AGG_TOP_AALCR7_ADDR
++#define BN0_WF_AGG_TOP_AALCR7_AC32_AGG_LIMIT_MASK              0x000003FF                // AC32_AGG_LIMIT[9..0]
++#define BN0_WF_AGG_TOP_AALCR7_AC32_AGG_LIMIT_SHFT              0
++
++/* DMA */
++struct queue_desc {
++	u32 hw_desc_base;
++	u16 ring_size;
++	char *const ring_info;
++};
++// HOST DMA
++//#define CONN_INFRA_REMAPPING_OFFSET 0x64000000
++//#define WF_WFDMA_HOST_DMA0_BASE (0x18024000 + CONN_INFRA_REMAPPING_OFFSET)
++#define WF_WFDMA_HOST_DMA0_BASE                                0xd4000
++
++#define WF_WFDMA_HOST_DMA0_HOST_INT_STA_ADDR                                   \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x200) /* 4200 */
++#define WF_WFDMA_HOST_DMA0_HOST_INT_ENA_ADDR                                   \
++	(WF_WFDMA_HOST_DMA0_BASE + 0X204) /* 4204 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_ADDR                                  \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x208) /* 4208 */
++
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_ADDR                      \
++	WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK                      \
++	0x00000008 /* RX_DMA_BUSY[3] */
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT 3
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_ADDR                        \
++	WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_MASK                        \
++	0x00000004 /* RX_DMA_EN[2] */
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_SHFT 2
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_ADDR                      \
++	WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK                      \
++	0x00000002 /* TX_DMA_BUSY[1] */
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT 1
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_ADDR                        \
++	WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_MASK                        \
++	0x00000001 /* TX_DMA_EN[0] */
++#define WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_SHFT 0
++
++
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING0_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x300) /* 4300 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING0_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x304) /* 4304 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING0_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x308) /* 4308 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING0_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x30c) /* 430C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING1_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x310) /* 4310 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING1_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x314) /* 4314 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING1_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x318) /* 4318 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING1_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x31c) /* 431C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING2_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x320) /* 4320 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING2_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x324) /* 4324 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING2_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x328) /* 4328 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING2_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x32c) /* 432C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING3_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x330) /* 4330 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING3_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x334) /* 4334 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING3_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x338) /* 4338 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING3_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x33c) /* 433C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING4_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x340) /* 4340 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING4_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x344) /* 4344 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING4_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x348) /* 4348 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING4_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x34c) /* 434C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING5_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x350) /* 4350 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING5_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x354) /* 4354 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING5_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x358) /* 4358 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING5_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x35c) /* 435C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING6_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x360) /* 4360 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING6_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x364) /* 4364 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING6_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x368) /* 4368 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING6_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x36c) /* 436C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING16_CTRL0_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x400) /* 4400 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING16_CTRL1_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x404) /* 4404 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING16_CTRL2_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x408) /* 4408 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING16_CTRL3_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x40c) /* 440C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING17_CTRL0_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x410) /* 4410 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING17_CTRL1_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x414) /* 4414 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING17_CTRL2_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x418) /* 4418 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING17_CTRL3_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x41c) /* 441C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING18_CTRL0_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x420) /* 4420 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING18_CTRL1_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x424) /* 4424 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING18_CTRL2_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x428) /* 4428 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING18_CTRL3_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x42c) /* 442C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING19_CTRL0_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x430) /* 4430 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING19_CTRL1_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x434) /* 4434 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING19_CTRL2_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x438) /* 4438 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING19_CTRL3_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x43c) /* 443C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING20_CTRL0_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x440) /* 4440 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING20_CTRL1_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x444) /* 4444 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING20_CTRL2_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x448) /* 4448 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING20_CTRL3_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x44c) /* 444C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING21_CTRL0_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x450) /* 4450 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING21_CTRL1_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x454) /* 4454 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING21_CTRL2_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x458) /* 4458 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING21_CTRL3_ADDR                          \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x45c) /* 445c */
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING22_CTRL0_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x460) // 4460
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING22_CTRL1_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x464) // 4464
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING22_CTRL2_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x468) // 4468
++#define WF_WFDMA_HOST_DMA0_WPDMA_TX_RING22_CTRL3_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x46c) // 446C
++
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING0_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x500) /* 4500 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING0_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x504) /* 4504 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING0_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x508) /* 4508 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING0_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x50c) /* 450C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING1_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x510) /* 4510 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING1_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x514) /* 4514 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING1_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x518) /* 4518 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING1_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x51c) /* 451C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING2_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x520) /* 4520 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING2_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x524) /* 4524 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING2_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x528) /* 4528 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING2_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x52C) /* 452C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING3_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x530) /* 4530 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING3_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x534) /* 4534 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING3_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x538) /* 4538 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING3_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x53C) /* 453C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING4_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x540) /* 4540 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING4_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x544) /* 4544 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING4_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x548) /* 4548 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING4_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x54c) /* 454C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING5_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x550) /* 4550 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING5_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x554) /* 4554 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING5_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x558) /* 4558 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING5_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x55c) /* 455C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING6_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x560) /* 4560 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING6_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x564) /* 4564 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING6_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x568) /* 4568 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING6_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x56c) /* 456C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING7_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x570) /* 4570 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING7_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x574) /* 4574 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING7_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x578) /* 4578 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING7_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x57c) /* 457C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING8_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x580) /* 4580 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING8_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x584) /* 4584 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING8_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x588) /* 4588 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING8_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x58c) /* 458C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING9_CTRL0_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x590) /* 4590 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING9_CTRL1_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x594) /* 4594 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING9_CTRL2_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x598) /* 4598 */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING9_CTRL3_ADDR                           \
++	(WF_WFDMA_HOST_DMA0_BASE + 0x59c) /* 459C */
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING10_CTRL0_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5a0) // 45A0
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING10_CTRL1_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5a4) // 45A4
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING10_CTRL2_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5a8) // 45A8
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING10_CTRL3_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5ac) // 45AC
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING11_CTRL0_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5b0) // 45B0
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING11_CTRL1_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5b4) // 45B4
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING11_CTRL2_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5b8) // 45B8
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING11_CTRL3_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5bc) // 45BC
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING12_CTRL0_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5C0) // 45C0
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING12_CTRL1_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5C4) // 45C4
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING12_CTRL2_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5C8) // 45C8
++#define WF_WFDMA_HOST_DMA0_WPDMA_RX_RING12_CTRL3_ADDR          (WF_WFDMA_HOST_DMA0_BASE + 0x5CC) // 45CC
++
++// HOST PCIE1 DMA
++#define WF_WFDMA_HOST_DMA0_PCIE1_BASE				0xd8000
++
++#define WF_WFDMA_HOST_DMA0_PCIE1_HOST_INT_STA_ADDR		(WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x200) // 8200
++#define WF_WFDMA_HOST_DMA0_PCIE1_HOST_INT_ENA_ADDR		(WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0X204) // 8204
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_ADDR		(WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x208) // 8208
++
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_PDMA_BT_SIZE_SHFT	4
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK		0x00000008
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT		3
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_RX_DMA_EN_MASK		0x00000004
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_RX_DMA_EN_SHFT		2
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK		0x00000002
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT		1
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_TX_DMA_EN_MASK		0x00000001
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_TX_DMA_EN_SHFT		0
++
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING21_CTRL0_ADDR    (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x450) // 8450
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING21_CTRL1_ADDR    (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x454) // 8454
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING21_CTRL2_ADDR    (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x458) // 8458
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING21_CTRL3_ADDR    (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x45c) // 845C
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING22_CTRL0_ADDR    (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x460) // 8460
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING22_CTRL1_ADDR    (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x464) // 8464
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING22_CTRL2_ADDR    (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x468) // 8468
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING22_CTRL3_ADDR    (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x46c) // 846C
++
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING3_CTRL0_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x530) // 8530
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING3_CTRL1_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x534) // 8534
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING3_CTRL2_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x538) // 8538
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING3_CTRL3_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x53C) // 853C
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING5_CTRL0_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x550) // 8550
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING5_CTRL1_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x554) // 8554
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING5_CTRL2_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x558) // 8558
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING5_CTRL3_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x55c) // 855C
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING6_CTRL0_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x560) // 8560
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING6_CTRL1_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x564) // 8564
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING6_CTRL2_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x568) // 8568
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING6_CTRL3_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x56c) // 856C
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING7_CTRL0_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x570) // 8570
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING7_CTRL1_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x574) // 8574
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING7_CTRL2_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x578) // 8578
++#define WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING7_CTRL3_ADDR     (WF_WFDMA_HOST_DMA0_PCIE1_BASE + 0x57c) // 857C
++//MCU DMA
++//#define WF_WFDMA_MCU_DMA0_BASE                                 0x02000
++#define WF_WFDMA_MCU_DMA0_BASE                                 0x54000000
++
++#define WF_WFDMA_MCU_DMA0_HOST_INT_STA_ADDR                    (WF_WFDMA_MCU_DMA0_BASE + 0x200) // 0200
++#define WF_WFDMA_MCU_DMA0_HOST_INT_ENA_ADDR                    (WF_WFDMA_MCU_DMA0_BASE + 0X204) // 0204
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR                   (WF_WFDMA_MCU_DMA0_BASE + 0x208) // 0208
++
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_ADDR       WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK       0x00000008                // RX_DMA_BUSY[3]
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT       3
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_ADDR         WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_MASK         0x00000004                // RX_DMA_EN[2]
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_SHFT         2
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_ADDR       WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK       0x00000002                // TX_DMA_BUSY[1]
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT       1
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_ADDR         WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_MASK         0x00000001                // TX_DMA_EN[0]
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_SHFT         0
++
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING0_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x300) // 0300
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING0_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x304) // 0304
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING0_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x308) // 0308
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING0_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x30c) // 030C
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING1_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x310) // 0310
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING1_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x314) // 0314
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING1_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x318) // 0318
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING1_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x31c) // 031C
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING2_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x320) // 0320
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING2_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x324) // 0324
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING2_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x328) // 0328
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING2_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x32c) // 032C
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING3_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x330) // 0330
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING3_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x334) // 0334
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING3_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x338) // 0338
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING3_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x33c) // 033C
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING4_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x340) // 0340
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING4_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x344) // 0344
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING4_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x348) // 0348
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING4_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x34c) // 034C
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING5_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x350) // 0350
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING5_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x354) // 0354
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING5_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x358) // 0358
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING5_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x35c) // 035C
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING6_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x360) // 0360
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING6_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x364) // 0364
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING6_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x368) // 0368
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING6_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x36c) // 036C
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING7_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x370) // 0370
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING7_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x374) // 0374
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING7_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x378) // 0378
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING7_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x37c) // 037C
++
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING0_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x500) // 0500
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING0_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x504) // 0504
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING0_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x508) // 0508
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING0_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x50c) // 050C
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING1_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x510) // 0510
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING1_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x514) // 0514
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING1_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x518) // 0518
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING1_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x51c) // 051C
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING2_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x520) // 0520
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING2_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x524) // 0524
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING2_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x528) // 0528
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING2_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x52C) // 052C
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING3_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x530) // 0530
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING3_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x534) // 0534
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING3_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x538) // 0538
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING3_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x53C) // 053C
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING4_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x540) // 0540
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING4_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x544) // 0544
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING4_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x548) // 0548
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING4_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x54C) // 054C
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING5_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x550) // 0550
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING5_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x554) // 0554
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING5_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x558) // 0558
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING5_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x55C) // 055C
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING6_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x560) // 0560
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING6_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x564) // 0564
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING6_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x568) // 0568
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING6_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x56c) // 056C
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING7_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x570) // 0570
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING7_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x574) // 0574
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING7_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x578) // 0578
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING7_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x57c) // 057C
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING8_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x580) // 0580
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING8_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x584) // 0584
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING8_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x588) // 0588
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING8_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x58c) // 058C
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING9_CTRL0_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x590) // 0590
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING9_CTRL1_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x594) // 0594
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING9_CTRL2_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x598) // 0598
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING9_CTRL3_ADDR            (WF_WFDMA_MCU_DMA0_BASE + 0x59c) // 059C
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING10_CTRL0_ADDR           (WF_WFDMA_MCU_DMA0_BASE + 0x5A0) // 05A0
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING10_CTRL1_ADDR           (WF_WFDMA_MCU_DMA0_BASE + 0x5A4) // 05A4
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING10_CTRL2_ADDR           (WF_WFDMA_MCU_DMA0_BASE + 0x5A8) // 05A8
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING10_CTRL3_ADDR           (WF_WFDMA_MCU_DMA0_BASE + 0x5Ac) // 05AC
++
++// MEM DMA
++#define WF_WFDMA_MEM_DMA_BASE                                  0x58000000
++
++#define WF_WFDMA_MEM_DMA_HOST_INT_STA_ADDR                     (WF_WFDMA_MEM_DMA_BASE + 0x200) // 0200
++#define WF_WFDMA_MEM_DMA_HOST_INT_ENA_ADDR                     (WF_WFDMA_MEM_DMA_BASE + 0X204) // 0204
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_ADDR                    (WF_WFDMA_MEM_DMA_BASE + 0x208) // 0208
++
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_ADDR        WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK        0x00000008                // RX_DMA_BUSY[3]
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT        3
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_ADDR          WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_MASK          0x00000004                // RX_DMA_EN[2]
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_SHFT          2
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_ADDR        WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK        0x00000002                // TX_DMA_BUSY[1]
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT        1
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_ADDR          WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_ADDR
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_MASK          0x00000001                // TX_DMA_EN[0]
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_SHFT          0
++
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING0_CTRL0_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x300) // 0300
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING0_CTRL1_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x304) // 0304
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING0_CTRL2_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x308) // 0308
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING0_CTRL3_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x30c) // 030C
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING1_CTRL0_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x310) // 0310
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING1_CTRL1_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x314) // 0314
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING1_CTRL2_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x318) // 0318
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING1_CTRL3_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x31c) // 031C
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING2_CTRL0_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x320) // 0320
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING2_CTRL1_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x324) // 0324
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING2_CTRL2_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x328) // 0328
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING2_CTRL3_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x32c) // 032C
++
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING0_CTRL0_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x500) // 0500
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING0_CTRL1_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x504) // 0504
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING0_CTRL2_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x508) // 0508
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING0_CTRL3_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x50c) // 050C
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING1_CTRL0_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x510) // 0510
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING1_CTRL1_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x514) // 0514
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING1_CTRL2_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x518) // 0518
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING1_CTRL3_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x51c) // 051C
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING2_CTRL0_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x520) // 0520
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING2_CTRL1_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x524) // 0524
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING2_CTRL2_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x528) // 0528
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING2_CTRL3_ADDR             (WF_WFDMA_MEM_DMA_BASE + 0x52C) // 052C
++
++/* MIB */
++#define WF_UMIB_TOP_BASE                                       0x820cd000
++#define BN0_WF_MIB_TOP_BASE                                    0x820ed000
++#define BN1_WF_MIB_TOP_BASE                                    0x820fd000
++#define IP1_BN0_WF_MIB_TOP_BASE                                0x830ed000
++
++#define WF_UMIB_TOP_B0BROCR_ADDR                               (WF_UMIB_TOP_BASE + 0x484) // D484
++#define WF_UMIB_TOP_B0BRBCR_ADDR                               (WF_UMIB_TOP_BASE + 0x4D4) // D4D4
++#define WF_UMIB_TOP_B0BRDCR_ADDR                               (WF_UMIB_TOP_BASE + 0x524) // D524
++#define WF_UMIB_TOP_B1BROCR_ADDR                               (WF_UMIB_TOP_BASE + 0x5E8) // D5E8
++#define WF_UMIB_TOP_B2BROCR_ADDR                               (WF_UMIB_TOP_BASE + 0x74C) // D74C
++
++#define BN0_WF_MIB_TOP_M0SCR0_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x000) // D000
++#define BN0_WF_MIB_TOP_M0SDR6_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x020) // D020
++#define BN0_WF_MIB_TOP_M0SDR9_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x024) // D024
++#define BN0_WF_MIB_TOP_M0SDR18_ADDR                            (BN0_WF_MIB_TOP_BASE + 0x030) // D030
++#define BN0_WF_MIB_TOP_BTOCR_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x400) // D400
++#define BN0_WF_MIB_TOP_BTBCR_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x450) // D450
++#define BN0_WF_MIB_TOP_BTDCR_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x590) // D590
++#define BN0_WF_MIB_TOP_BTCR_ADDR                               (BN0_WF_MIB_TOP_BASE + 0x5A0) // D5A0
++#define BN0_WF_MIB_TOP_RVSR0_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x720) // D720
++
++#define BN0_WF_MIB_TOP_TSCR0_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6B0) // D6B0
++#define BN0_WF_MIB_TOP_TSCR3_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6BC) // D6BC
++#define BN0_WF_MIB_TOP_TSCR4_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6C0) // D6C0
++#define BN0_WF_MIB_TOP_TSCR5_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6C4) // D6C4
++#define BN0_WF_MIB_TOP_TSCR6_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6C8) // D6C8
++#define BN0_WF_MIB_TOP_TSCR7_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6D0) // D6D0
++#define BN0_WF_MIB_TOP_TSCR8_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6CC) // D6CC
++
++#define BN0_WF_MIB_TOP_TBCR0_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6EC) // D6EC
++#define BN0_WF_MIB_TOP_TBCR1_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6F0) // D6F0
++#define BN0_WF_MIB_TOP_TBCR2_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6F4) // D6F4
++#define BN0_WF_MIB_TOP_TBCR3_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6F8) // D6F8
++#define BN0_WF_MIB_TOP_TBCR4_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x6FC) // D6FC
++
++#define BN0_WF_MIB_TOP_TDRCR0_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x728) // D728
++#define BN0_WF_MIB_TOP_TDRCR1_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x72C) // D72C
++#define BN0_WF_MIB_TOP_TDRCR2_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x730) // D730
++#define BN0_WF_MIB_TOP_TDRCR3_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x734) // D734
++#define BN0_WF_MIB_TOP_TDRCR4_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x738) // D738
++
++#define BN0_WF_MIB_TOP_BTSCR0_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x5E0) // D5E0
++#define BN0_WF_MIB_TOP_BTSCR1_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x5F0) // D5F0
++#define BN0_WF_MIB_TOP_BTSCR2_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x600) // D600
++#define BN0_WF_MIB_TOP_BTSCR3_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x610) // D610
++#define BN0_WF_MIB_TOP_BTSCR4_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x620) // D620
++#define BN0_WF_MIB_TOP_BTSCR5_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x788) // D788
++#define BN0_WF_MIB_TOP_BTSCR6_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x798) // D798
++
++#define BN0_WF_MIB_TOP_RSCR1_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x7AC) // D7AC
++#define BN0_WF_MIB_TOP_BSCR2_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9D4) // D9D4
++#define BN0_WF_MIB_TOP_TSCR18_ADDR                             (BN0_WF_MIB_TOP_BASE + 0xA1C) // DA1C
++
++#define BN0_WF_MIB_TOP_MSR0_ADDR                               (BN0_WF_MIB_TOP_BASE + 0xA64) // DA64
++#define BN0_WF_MIB_TOP_MSR1_ADDR                               (BN0_WF_MIB_TOP_BASE + 0xA68) // DA68
++#define BN0_WF_MIB_TOP_MSR2_ADDR                               (BN0_WF_MIB_TOP_BASE + 0xA6C) // DA6C
++#define BN0_WF_MIB_TOP_MCTR5_ADDR                              (BN0_WF_MIB_TOP_BASE + 0xA70) // DA70
++#define BN0_WF_MIB_TOP_MCTR6_ADDR                              (BN0_WF_MIB_TOP_BASE + 0xA74) // DA74
++
++#define BN0_WF_MIB_TOP_RSCR26_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x950) // D950
++#define BN0_WF_MIB_TOP_RSCR27_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x954) // D954
++#define BN0_WF_MIB_TOP_RSCR28_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x958) // D958
++#define BN0_WF_MIB_TOP_RSCR31_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x964) // D964
++#define BN0_WF_MIB_TOP_RSCR33_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x96C) // D96C
++#define BN0_WF_MIB_TOP_RSCR35_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x974) // D974
++#define BN0_WF_MIB_TOP_RSCR36_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x978) // D978
++
++#define BN0_WF_MIB_TOP_TSCR3_AMPDU_MPDU_COUNT_MASK             0xFFFFFFFF                // AMPDU_MPDU_COUNT[31..0]
++#define BN0_WF_MIB_TOP_TSCR4_AMPDU_ACKED_COUNT_MASK            0xFFFFFFFF                // AMPDU_ACKED_COUNT[31..0]
++#define BN0_WF_MIB_TOP_M0SDR6_CHANNEL_IDLE_COUNT_MASK          0x0000FFFF                // CHANNEL_IDLE_COUNT[15..0]
++#define BN0_WF_MIB_TOP_M0SDR9_CCA_NAV_TX_TIME_MASK             0x00FFFFFF                // CCA_NAV_TX_TIME[23..0]
++#define BN0_WF_MIB_TOP_RSCR26_RX_MDRDY_COUNT_MASK              0xFFFFFFFF                // RX_MDRDY_COUNT[31..0]
++#define BN0_WF_MIB_TOP_MSR0_CCK_MDRDY_TIME_MASK                0xFFFFFFFF                // CCK_MDRDY_TIME[31..0]
++#define BN0_WF_MIB_TOP_MSR1_OFDM_LG_MIXED_VHT_MDRDY_TIME_MASK  0xFFFFFFFF                // OFDM_LG_MIXED_VHT_MDRDY_TIME[31..0]
++#define BN0_WF_MIB_TOP_MSR2_OFDM_GREEN_MDRDY_TIME_MASK         0xFFFFFFFF                // OFDM_GREEN_MDRDY_TIME[31..0]
++#define BN0_WF_MIB_TOP_MCTR5_P_CCA_TIME_MASK                   0xFFFFFFFF                // P_CCA_TIME[31..0]
++#define BN0_WF_MIB_TOP_MCTR6_S_CCA_TIME_MASK                   0xFFFFFFFF                // S_CCA_TIME[31..0]
++#define BN0_WF_MIB_TOP_M0SDR18_P_ED_TIME_MASK                  0x00FFFFFF                // P_ED_TIME[23..0]
++#define BN0_WF_MIB_TOP_TSCR18_BEACONTXCOUNT_MASK               0xFFFFFFFF                // BEACONTXCOUNT[31..0]
++#define BN0_WF_MIB_TOP_TBCR0_TX_20MHZ_CNT_MASK                 0xFFFFFFFF                // TX_20MHZ_CNT[31..0]
++#define BN0_WF_MIB_TOP_TBCR1_TX_40MHZ_CNT_MASK                 0xFFFFFFFF                // TX_40MHZ_CNT[31..0]
++#define BN0_WF_MIB_TOP_TBCR2_TX_80MHZ_CNT_MASK                 0xFFFFFFFF                // TX_80MHZ_CNT[31..0]
++#define BN0_WF_MIB_TOP_TBCR3_TX_160MHZ_CNT_MASK                0xFFFFFFFF                // TX_160MHZ_CNT[31..0]
++#define BN0_WF_MIB_TOP_TBCR4_TX_320MHZ_CNT_MASK                0xFFFFFFFF                // TX_320MHZ_CNT[31..0]
++#define BN0_WF_MIB_TOP_BSCR2_MUBF_TX_COUNT_MASK                0xFFFFFFFF                // MUBF_TX_COUNT[31..0]
++#define BN0_WF_MIB_TOP_RVSR0_VEC_MISS_COUNT_MASK               0xFFFFFFFF                // VEC_MISS_COUNT[31..0]
++#define BN0_WF_MIB_TOP_RSCR35_DELIMITER_FAIL_COUNT_MASK        0xFFFFFFFF                // DELIMITER_FAIL_COUNT[31..0]
++#define BN0_WF_MIB_TOP_RSCR1_RX_FCS_ERROR_COUNT_MASK           0xFFFFFFFF                // RX_FCS_ERROR_COUNT[31..0]
++#define BN0_WF_MIB_TOP_RSCR33_RX_FIFO_FULL_COUNT_MASK          0xFFFFFFFF                // RX_FIFO_FULL_COUNT[31..0]
++#define BN0_WF_MIB_TOP_RSCR36_RX_LEN_MISMATCH_MASK             0xFFFFFFFF                // RX_LEN_MISMATCH[31..0]
++#define BN0_WF_MIB_TOP_RSCR31_RX_MPDU_COUNT_MASK               0xFFFFFFFF                // RX_MPDU_COUNT[31..0]
++#define BN0_WF_MIB_TOP_BTSCR5_RTSTXCOUNTn_MASK                 0xFFFFFFFF                // RTSTXCOUNTn[31..0]
++#define BN0_WF_MIB_TOP_BTSCR6_RTSRETRYCOUNTn_MASK              0xFFFFFFFF                // RTSRETRYCOUNTn[31..0]
++#define BN0_WF_MIB_TOP_BTSCR0_BAMISSCOUNTn_MASK                0xFFFFFFFF                // BAMISSCOUNTn[31..0]
++#define BN0_WF_MIB_TOP_BTSCR1_ACKFAILCOUNTn_MASK               0xFFFFFFFF                // ACKFAILCOUNTn[31..0]
++#define BN0_WF_MIB_TOP_BTSCR2_FRAMERETRYCOUNTn_MASK            0xFFFFFFFF                // FRAMERETRYCOUNTn[31..0]
++#define BN0_WF_MIB_TOP_BTSCR3_FRAMERETRY2COUNTn_MASK           0xFFFFFFFF                // FRAMERETRY2COUNTn[31..0]
++#define BN0_WF_MIB_TOP_BTSCR4_FRAMERETRY3COUNTn_MASK           0xFFFFFFFF                // FRAMERETRY3COUNTn[31..0]
++#define BN0_WF_MIB_TOP_TRARC0_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x0B0) // D0B0
++#define BN0_WF_MIB_TOP_TRARC1_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x0B4) // D0B4
++#define BN0_WF_MIB_TOP_TRARC2_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x0B8) // D0B8
++#define BN0_WF_MIB_TOP_TRARC3_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x0BC) // D0BC
++#define BN0_WF_MIB_TOP_TRARC4_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x0C0) // D0C0
++#define BN0_WF_MIB_TOP_TRARC5_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x0C4) // D0C4
++#define BN0_WF_MIB_TOP_TRARC6_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x0C8) // D0C8
++#define BN0_WF_MIB_TOP_TRARC7_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x0CC) // D0CC
++
++#define BN0_WF_MIB_TOP_TRDR0_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9B4) // D9B4
++#define BN0_WF_MIB_TOP_TRDR1_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9B8) // D9B8
++#define BN0_WF_MIB_TOP_TRDR2_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9BC) // D9BC
++#define BN0_WF_MIB_TOP_TRDR3_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9C0) // D9C0
++#define BN0_WF_MIB_TOP_TRDR4_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9C4) // D9C4
++#define BN0_WF_MIB_TOP_TRDR5_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9C8) // D9C8
++#define BN0_WF_MIB_TOP_TRDR6_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9CC) // D9CC
++#define BN0_WF_MIB_TOP_TRDR7_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9D0) // D9D0
++#define BN0_WF_MIB_TOP_TRDR8_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9D4) // D9D4
++#define BN0_WF_MIB_TOP_TRDR9_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x9D8) // D9D8
++#define BN0_WF_MIB_TOP_TRDR10_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x9DC) // D9DC
++#define BN0_WF_MIB_TOP_TRDR11_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x9E0) // D9E0
++#define BN0_WF_MIB_TOP_TRDR12_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x9E4) // D9E4
++#define BN0_WF_MIB_TOP_TRDR13_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x9E8) // D9E8
++#define BN0_WF_MIB_TOP_TRDR14_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x9EC) // D9EC
++#define BN0_WF_MIB_TOP_TRDR15_ADDR                             (BN0_WF_MIB_TOP_BASE + 0x9F0) // D9F0
++
++#define BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_1_ADDR              BN0_WF_MIB_TOP_TRARC0_ADDR
++#define BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_1_MASK              0x03FF0000                // AGG_RANG_SEL_1[25..16]
++#define BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_1_SHFT              16
++#define BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_0_ADDR              BN0_WF_MIB_TOP_TRARC0_ADDR
++#define BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_0_MASK              0x000003FF                // AGG_RANG_SEL_0[9..0]
++#define BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_0_SHFT              0
++
++#define BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_3_ADDR              BN0_WF_MIB_TOP_TRARC1_ADDR
++#define BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_3_MASK              0x03FF0000                // AGG_RANG_SEL_3[25..16]
++#define BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_3_SHFT              16
++#define BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_2_ADDR              BN0_WF_MIB_TOP_TRARC1_ADDR
++#define BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_2_MASK              0x000003FF                // AGG_RANG_SEL_2[9..0]
++#define BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_2_SHFT              0
++
++#define BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_5_ADDR              BN0_WF_MIB_TOP_TRARC2_ADDR
++#define BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_5_MASK              0x03FF0000                // AGG_RANG_SEL_5[25..16]
++#define BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_5_SHFT              16
++#define BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_4_ADDR              BN0_WF_MIB_TOP_TRARC2_ADDR
++#define BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_4_MASK              0x000003FF                // AGG_RANG_SEL_4[9..0]
++#define BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_4_SHFT              0
++
++#define BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_7_ADDR              BN0_WF_MIB_TOP_TRARC3_ADDR
++#define BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_7_MASK              0x03FF0000                // AGG_RANG_SEL_7[25..16]
++#define BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_7_SHFT              16
++#define BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_6_ADDR              BN0_WF_MIB_TOP_TRARC3_ADDR
++#define BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_6_MASK              0x000003FF                // AGG_RANG_SEL_6[9..0]
++#define BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_6_SHFT              0
++
++#define BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_9_ADDR              BN0_WF_MIB_TOP_TRARC4_ADDR
++#define BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_9_MASK              0x03FF0000                // AGG_RANG_SEL_9[25..16]
++#define BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_9_SHFT              16
++#define BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_8_ADDR              BN0_WF_MIB_TOP_TRARC4_ADDR
++#define BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_8_MASK              0x000003FF                // AGG_RANG_SEL_8[9..0]
++#define BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_8_SHFT              0
++
++#define BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_11_ADDR             BN0_WF_MIB_TOP_TRARC5_ADDR
++#define BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_11_MASK             0x03FF0000                // AGG_RANG_SEL_11[25..16]
++#define BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_11_SHFT             16
++#define BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_10_ADDR             BN0_WF_MIB_TOP_TRARC5_ADDR
++#define BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_10_MASK             0x000003FF                // AGG_RANG_SEL_10[9..0]
++#define BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_10_SHFT             0
++
++#define BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_13_ADDR             BN0_WF_MIB_TOP_TRARC6_ADDR
++#define BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_13_MASK             0x03FF0000                // AGG_RANG_SEL_13[25..16]
++#define BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_13_SHFT             16
++#define BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_12_ADDR             BN0_WF_MIB_TOP_TRARC6_ADDR
++#define BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_12_MASK             0x000003FF                // AGG_RANG_SEL_12[9..0]
++#define BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_12_SHFT             0
++
++#define BN0_WF_MIB_TOP_TRARC7_AGG_RANG_SEL_14_ADDR             BN0_WF_MIB_TOP_TRARC7_ADDR
++#define BN0_WF_MIB_TOP_TRARC7_AGG_RANG_SEL_14_MASK             0x000003FF                // AGG_RANG_SEL_14[9..0]
++#define BN0_WF_MIB_TOP_TRARC7_AGG_RANG_SEL_14_SHFT             0
++
++/* RRO TOP */
++#define WF_RRO_TOP_BASE                                        0xA000 /*0x820C2000 */
++#define WF_RRO_TOP_IND_CMD_0_CTRL0_ADDR                        (WF_RRO_TOP_BASE + 0x40) // 2040
++											//
++/* WTBL */
++enum mt7996_wtbl_type {
++	WTBL_TYPE_LMAC, 	/* WTBL in LMAC */
++	WTBL_TYPE_UMAC, 	/* WTBL in UMAC */
++	WTBL_TYPE_KEY,		/* Key Table */
++	MAX_NUM_WTBL_TYPE
++};
++
++struct berse_wtbl_parse {
++	u8 *name;
++	u32 mask;
++	u32 shift;
++	u8 new_line;
++};
++
++enum muar_idx {
++	MUAR_INDEX_OWN_MAC_ADDR_0 = 0,
++	MUAR_INDEX_OWN_MAC_ADDR_1,
++	MUAR_INDEX_OWN_MAC_ADDR_2,
++	MUAR_INDEX_OWN_MAC_ADDR_3,
++	MUAR_INDEX_OWN_MAC_ADDR_4,
++	MUAR_INDEX_OWN_MAC_ADDR_BC_MC = 0xE,
++	MUAR_INDEX_UNMATCHED = 0xF,
++	MUAR_INDEX_OWN_MAC_ADDR_11 = 0x11,
++	MUAR_INDEX_OWN_MAC_ADDR_12,
++	MUAR_INDEX_OWN_MAC_ADDR_13,
++	MUAR_INDEX_OWN_MAC_ADDR_14,
++	MUAR_INDEX_OWN_MAC_ADDR_15,
++	MUAR_INDEX_OWN_MAC_ADDR_16,
++	MUAR_INDEX_OWN_MAC_ADDR_17,
++	MUAR_INDEX_OWN_MAC_ADDR_18,
++	MUAR_INDEX_OWN_MAC_ADDR_19,
++	MUAR_INDEX_OWN_MAC_ADDR_1A,
++	MUAR_INDEX_OWN_MAC_ADDR_1B,
++	MUAR_INDEX_OWN_MAC_ADDR_1C,
++	MUAR_INDEX_OWN_MAC_ADDR_1D,
++	MUAR_INDEX_OWN_MAC_ADDR_1E,
++	MUAR_INDEX_OWN_MAC_ADDR_1F,
++	MUAR_INDEX_OWN_MAC_ADDR_20,
++	MUAR_INDEX_OWN_MAC_ADDR_21,
++	MUAR_INDEX_OWN_MAC_ADDR_22,
++	MUAR_INDEX_OWN_MAC_ADDR_23,
++	MUAR_INDEX_OWN_MAC_ADDR_24,
++	MUAR_INDEX_OWN_MAC_ADDR_25,
++	MUAR_INDEX_OWN_MAC_ADDR_26,
++	MUAR_INDEX_OWN_MAC_ADDR_27,
++	MUAR_INDEX_OWN_MAC_ADDR_28,
++	MUAR_INDEX_OWN_MAC_ADDR_29,
++	MUAR_INDEX_OWN_MAC_ADDR_2A,
++	MUAR_INDEX_OWN_MAC_ADDR_2B,
++	MUAR_INDEX_OWN_MAC_ADDR_2C,
++	MUAR_INDEX_OWN_MAC_ADDR_2D,
++	MUAR_INDEX_OWN_MAC_ADDR_2E,
++	MUAR_INDEX_OWN_MAC_ADDR_2F
++};
++
++enum cipher_suit {
++	IGTK_CIPHER_SUIT_NONE = 0,
++	IGTK_CIPHER_SUIT_BIP,
++	IGTK_CIPHER_SUIT_BIP_256
++};
++
++#define LWTBL_LEN_IN_DW			36
++#define UWTBL_LEN_IN_DW			10
++
++#define MT_DBG_WTBL_BASE		0x820D8000
++
++#define MT_DBG_WTBLON_TOP_BASE		0x820d4000
++#define MT_DBG_WTBLON_TOP_WDUCR_ADDR	(MT_DBG_WTBLON_TOP_BASE + 0x0370) // 4370
++#define MT_DBG_WTBLON_TOP_WDUCR_GROUP	GENMASK(4, 0)
++
++#define MT_DBG_UWTBL_TOP_BASE		0x820c4000
++#define MT_DBG_UWTBL_TOP_WDUCR_ADDR	(MT_DBG_UWTBL_TOP_BASE + 0x0104) // 4104
++#define MT_DBG_UWTBL_TOP_WDUCR_GROUP	GENMASK(5, 0)
++#define MT_DBG_UWTBL_TOP_WDUCR_TARGET	BIT(31)
++
++#define LWTBL_IDX2BASE_ID		GENMASK(14, 8)
++#define LWTBL_IDX2BASE_DW		GENMASK(7, 2)
++#define LWTBL_IDX2BASE(_id, _dw)	(MT_DBG_WTBL_BASE | \
++					FIELD_PREP(LWTBL_IDX2BASE_ID, _id) | \
++					FIELD_PREP(LWTBL_IDX2BASE_DW, _dw))
++
++#define UWTBL_IDX2BASE_ID		GENMASK(12, 6)
++#define UWTBL_IDX2BASE_DW		GENMASK(5, 2)
++#define UWTBL_IDX2BASE(_id, _dw)	(MT_DBG_UWTBL_TOP_BASE | 0x2000 | \
++					FIELD_PREP(UWTBL_IDX2BASE_ID, _id) | \
++					FIELD_PREP(UWTBL_IDX2BASE_DW, _dw))
++
++#define KEYTBL_IDX2BASE_KEY		GENMASK(12, 6)
++#define KEYTBL_IDX2BASE_DW		GENMASK(5, 2)
++#define KEYTBL_IDX2BASE(_key, _dw)	(MT_DBG_UWTBL_TOP_BASE | 0x2000 | \
++					FIELD_PREP(KEYTBL_IDX2BASE_KEY, _key) | \
++					FIELD_PREP(KEYTBL_IDX2BASE_DW, _dw))
++
++// UMAC WTBL
++// DW0
++#define WF_UWTBL_PEER_MLD_ADDRESS_47_32__DW                         0
++#define WF_UWTBL_PEER_MLD_ADDRESS_47_32__ADDR                       0
++#define WF_UWTBL_PEER_MLD_ADDRESS_47_32__MASK                       0x0000ffff // 15- 0
++#define WF_UWTBL_PEER_MLD_ADDRESS_47_32__SHIFT                      0
++#define WF_UWTBL_OWN_MLD_ID_DW                                      0
++#define WF_UWTBL_OWN_MLD_ID_ADDR                                    0
++#define WF_UWTBL_OWN_MLD_ID_MASK                                    0x003f0000 // 21-16
++#define WF_UWTBL_OWN_MLD_ID_SHIFT                                   16
++// DW1
++#define WF_UWTBL_PEER_MLD_ADDRESS_31_0__DW                          1
++#define WF_UWTBL_PEER_MLD_ADDRESS_31_0__ADDR                        4
++#define WF_UWTBL_PEER_MLD_ADDRESS_31_0__MASK                        0xffffffff // 31- 0
++#define WF_UWTBL_PEER_MLD_ADDRESS_31_0__SHIFT                       0
++// DW2
++#define WF_UWTBL_PN_31_0__DW                                        2
++#define WF_UWTBL_PN_31_0__ADDR                                      8
++#define WF_UWTBL_PN_31_0__MASK                                      0xffffffff // 31- 0
++#define WF_UWTBL_PN_31_0__SHIFT                                     0
++// DW3
++#define WF_UWTBL_PN_47_32__DW                                       3
++#define WF_UWTBL_PN_47_32__ADDR                                     12
++#define WF_UWTBL_PN_47_32__MASK                                     0x0000ffff // 15- 0
++#define WF_UWTBL_PN_47_32__SHIFT                                    0
++#define WF_UWTBL_COM_SN_DW                                          3
++#define WF_UWTBL_COM_SN_ADDR                                        12
++#define WF_UWTBL_COM_SN_MASK                                        0x0fff0000 // 27-16
++#define WF_UWTBL_COM_SN_SHIFT                                       16
++// DW4
++#define WF_UWTBL_TID0_SN_DW                                         4
++#define WF_UWTBL_TID0_SN_ADDR                                       16
++#define WF_UWTBL_TID0_SN_MASK                                       0x00000fff // 11- 0
++#define WF_UWTBL_TID0_SN_SHIFT                                      0
++#define WF_UWTBL_RX_BIPN_31_0__DW                                   4
++#define WF_UWTBL_RX_BIPN_31_0__ADDR                                 16
++#define WF_UWTBL_RX_BIPN_31_0__MASK                                 0xffffffff // 31- 0
++#define WF_UWTBL_RX_BIPN_31_0__SHIFT                                0
++#define WF_UWTBL_TID1_SN_DW                                         4
++#define WF_UWTBL_TID1_SN_ADDR                                       16
++#define WF_UWTBL_TID1_SN_MASK                                       0x00fff000 // 23-12
++#define WF_UWTBL_TID1_SN_SHIFT                                      12
++#define WF_UWTBL_TID2_SN_7_0__DW                                    4
++#define WF_UWTBL_TID2_SN_7_0__ADDR                                  16
++#define WF_UWTBL_TID2_SN_7_0__MASK                                  0xff000000 // 31-24
++#define WF_UWTBL_TID2_SN_7_0__SHIFT                                 24
++// DW5
++#define WF_UWTBL_TID2_SN_11_8__DW                                   5
++#define WF_UWTBL_TID2_SN_11_8__ADDR                                 20
++#define WF_UWTBL_TID2_SN_11_8__MASK                                 0x0000000f //  3- 0
++#define WF_UWTBL_TID2_SN_11_8__SHIFT                                0
++#define WF_UWTBL_RX_BIPN_47_32__DW                                  5
++#define WF_UWTBL_RX_BIPN_47_32__ADDR                                20
++#define WF_UWTBL_RX_BIPN_47_32__MASK                                0x0000ffff // 15- 0
++#define WF_UWTBL_RX_BIPN_47_32__SHIFT                               0
++#define WF_UWTBL_TID3_SN_DW                                         5
++#define WF_UWTBL_TID3_SN_ADDR                                       20
++#define WF_UWTBL_TID3_SN_MASK                                       0x0000fff0 // 15- 4
++#define WF_UWTBL_TID3_SN_SHIFT                                      4
++#define WF_UWTBL_TID4_SN_DW                                         5
++#define WF_UWTBL_TID4_SN_ADDR                                       20
++#define WF_UWTBL_TID4_SN_MASK                                       0x0fff0000 // 27-16
++#define WF_UWTBL_TID4_SN_SHIFT                                      16
++#define WF_UWTBL_TID5_SN_3_0__DW                                    5
++#define WF_UWTBL_TID5_SN_3_0__ADDR                                  20
++#define WF_UWTBL_TID5_SN_3_0__MASK                                  0xf0000000 // 31-28
++#define WF_UWTBL_TID5_SN_3_0__SHIFT                                 28
++// DW6
++#define WF_UWTBL_TID5_SN_11_4__DW                                   6
++#define WF_UWTBL_TID5_SN_11_4__ADDR                                 24
++#define WF_UWTBL_TID5_SN_11_4__MASK                                 0x000000ff //  7- 0
++#define WF_UWTBL_TID5_SN_11_4__SHIFT                                0
++#define WF_UWTBL_KEY_LOC2_DW                                        6
++#define WF_UWTBL_KEY_LOC2_ADDR                                      24
++#define WF_UWTBL_KEY_LOC2_MASK                                      0x00001fff // 12- 0
++#define WF_UWTBL_KEY_LOC2_SHIFT                                     0
++#define WF_UWTBL_TID6_SN_DW                                         6
++#define WF_UWTBL_TID6_SN_ADDR                                       24
++#define WF_UWTBL_TID6_SN_MASK                                       0x000fff00 // 19- 8
++#define WF_UWTBL_TID6_SN_SHIFT                                      8
++#define WF_UWTBL_TID7_SN_DW                                         6
++#define WF_UWTBL_TID7_SN_ADDR                                       24
++#define WF_UWTBL_TID7_SN_MASK                                       0xfff00000 // 31-20
++#define WF_UWTBL_TID7_SN_SHIFT                                      20
++// DW7
++#define WF_UWTBL_KEY_LOC0_DW                                        7
++#define WF_UWTBL_KEY_LOC0_ADDR                                      28
++#define WF_UWTBL_KEY_LOC0_MASK                                      0x00001fff // 12- 0
++#define WF_UWTBL_KEY_LOC0_SHIFT                                     0
++#define WF_UWTBL_KEY_LOC1_DW                                        7
++#define WF_UWTBL_KEY_LOC1_ADDR                                      28
++#define WF_UWTBL_KEY_LOC1_MASK                                      0x1fff0000 // 28-16
++#define WF_UWTBL_KEY_LOC1_SHIFT                                     16
++// DW8
++#define WF_UWTBL_AMSDU_CFG_DW                                       8
++#define WF_UWTBL_AMSDU_CFG_ADDR                                     32
++#define WF_UWTBL_AMSDU_CFG_MASK                                     0x00000fff // 11- 0
++#define WF_UWTBL_AMSDU_CFG_SHIFT                                    0
++#define WF_UWTBL_WMM_Q_DW                                           8
++#define WF_UWTBL_WMM_Q_ADDR                                         32
++#define WF_UWTBL_WMM_Q_MASK                                         0x06000000 // 26-25
++#define WF_UWTBL_WMM_Q_SHIFT                                        25
++#define WF_UWTBL_QOS_DW                                             8
++#define WF_UWTBL_QOS_ADDR                                           32
++#define WF_UWTBL_QOS_MASK                                           0x08000000 // 27-27
++#define WF_UWTBL_QOS_SHIFT                                          27
++#define WF_UWTBL_HT_DW                                              8
++#define WF_UWTBL_HT_ADDR                                            32
++#define WF_UWTBL_HT_MASK                                            0x10000000 // 28-28
++#define WF_UWTBL_HT_SHIFT                                           28
++#define WF_UWTBL_HDRT_MODE_DW                                       8
++#define WF_UWTBL_HDRT_MODE_ADDR                                     32
++#define WF_UWTBL_HDRT_MODE_MASK                                     0x20000000 // 29-29
++#define WF_UWTBL_HDRT_MODE_SHIFT                                    29
++// DW9
++#define WF_UWTBL_RELATED_IDX0_DW                                    9
++#define WF_UWTBL_RELATED_IDX0_ADDR                                  36
++#define WF_UWTBL_RELATED_IDX0_MASK                                  0x00000fff // 11- 0
++#define WF_UWTBL_RELATED_IDX0_SHIFT                                 0
++#define WF_UWTBL_RELATED_BAND0_DW                                   9
++#define WF_UWTBL_RELATED_BAND0_ADDR                                 36
++#define WF_UWTBL_RELATED_BAND0_MASK                                 0x00003000 // 13-12
++#define WF_UWTBL_RELATED_BAND0_SHIFT                                12
++#define WF_UWTBL_PRIMARY_MLD_BAND_DW                                9
++#define WF_UWTBL_PRIMARY_MLD_BAND_ADDR                              36
++#define WF_UWTBL_PRIMARY_MLD_BAND_MASK                              0x0000c000 // 15-14
++#define WF_UWTBL_PRIMARY_MLD_BAND_SHIFT                             14
++#define WF_UWTBL_RELATED_IDX1_DW                                    9
++#define WF_UWTBL_RELATED_IDX1_ADDR                                  36
++#define WF_UWTBL_RELATED_IDX1_MASK                                  0x0fff0000 // 27-16
++#define WF_UWTBL_RELATED_IDX1_SHIFT                                 16
++#define WF_UWTBL_RELATED_BAND1_DW                                   9
++#define WF_UWTBL_RELATED_BAND1_ADDR                                 36
++#define WF_UWTBL_RELATED_BAND1_MASK                                 0x30000000 // 29-28
++#define WF_UWTBL_RELATED_BAND1_SHIFT                                28
++#define WF_UWTBL_SECONDARY_MLD_BAND_DW                              9
++#define WF_UWTBL_SECONDARY_MLD_BAND_ADDR                            36
++#define WF_UWTBL_SECONDARY_MLD_BAND_MASK                            0xc0000000 // 31-30
++#define WF_UWTBL_SECONDARY_MLD_BAND_SHIFT                           30
++
++/* LMAC WTBL */
++// DW0
++#define WF_LWTBL_PEER_LINK_ADDRESS_47_32__DW                        0
++#define WF_LWTBL_PEER_LINK_ADDRESS_47_32__ADDR                      0
++#define WF_LWTBL_PEER_LINK_ADDRESS_47_32__MASK \
++	0x0000ffff // 15- 0
++#define WF_LWTBL_PEER_LINK_ADDRESS_47_32__SHIFT                     0
++#define WF_LWTBL_MUAR_DW                                            0
++#define WF_LWTBL_MUAR_ADDR                                          0
++#define WF_LWTBL_MUAR_MASK \
++	0x003f0000 // 21-16
++#define WF_LWTBL_MUAR_SHIFT                                         16
++#define WF_LWTBL_RCA1_DW                                            0
++#define WF_LWTBL_RCA1_ADDR                                          0
++#define WF_LWTBL_RCA1_MASK \
++	0x00400000 // 22-22
++#define WF_LWTBL_RCA1_SHIFT                                         22
++#define WF_LWTBL_KID_DW                                             0
++#define WF_LWTBL_KID_ADDR                                           0
++#define WF_LWTBL_KID_MASK \
++	0x01800000 // 24-23
++#define WF_LWTBL_KID_SHIFT                                          23
++#define WF_LWTBL_RCID_DW                                            0
++#define WF_LWTBL_RCID_ADDR                                          0
++#define WF_LWTBL_RCID_MASK \
++	0x02000000 // 25-25
++#define WF_LWTBL_RCID_SHIFT                                         25
++#define WF_LWTBL_BAND_DW                                            0
++#define WF_LWTBL_BAND_ADDR                                          0
++#define WF_LWTBL_BAND_MASK \
++	0x0c000000 // 27-26
++#define WF_LWTBL_BAND_SHIFT                                         26
++#define WF_LWTBL_RV_DW                                              0
++#define WF_LWTBL_RV_ADDR                                            0
++#define WF_LWTBL_RV_MASK \
++	0x10000000 // 28-28
++#define WF_LWTBL_RV_SHIFT                                           28
++#define WF_LWTBL_RCA2_DW                                            0
++#define WF_LWTBL_RCA2_ADDR                                          0
++#define WF_LWTBL_RCA2_MASK \
++	0x20000000 // 29-29
++#define WF_LWTBL_RCA2_SHIFT                                         29
++#define WF_LWTBL_WPI_FLAG_DW                                        0
++#define WF_LWTBL_WPI_FLAG_ADDR                                      0
++#define WF_LWTBL_WPI_FLAG_MASK \
++	0x40000000 // 30-30
++#define WF_LWTBL_WPI_FLAG_SHIFT                                     30
++// DW1
++#define WF_LWTBL_PEER_LINK_ADDRESS_31_0__DW                         1
++#define WF_LWTBL_PEER_LINK_ADDRESS_31_0__ADDR                       4
++#define WF_LWTBL_PEER_LINK_ADDRESS_31_0__MASK \
++	0xffffffff // 31- 0
++#define WF_LWTBL_PEER_LINK_ADDRESS_31_0__SHIFT                      0
++// DW2
++#define WF_LWTBL_AID_DW                                             2
++#define WF_LWTBL_AID_ADDR                                           8
++#define WF_LWTBL_AID_MASK \
++	0x00000fff // 11- 0
++#define WF_LWTBL_AID_SHIFT                                          0
++#define WF_LWTBL_GID_SU_DW                                          2
++#define WF_LWTBL_GID_SU_ADDR                                        8
++#define WF_LWTBL_GID_SU_MASK \
++	0x00001000 // 12-12
++#define WF_LWTBL_GID_SU_SHIFT                                       12
++#define WF_LWTBL_SPP_EN_DW                                          2
++#define WF_LWTBL_SPP_EN_ADDR                                        8
++#define WF_LWTBL_SPP_EN_MASK \
++	0x00002000 // 13-13
++#define WF_LWTBL_SPP_EN_SHIFT                                       13
++#define WF_LWTBL_WPI_EVEN_DW                                        2
++#define WF_LWTBL_WPI_EVEN_ADDR                                      8
++#define WF_LWTBL_WPI_EVEN_MASK \
++	0x00004000 // 14-14
++#define WF_LWTBL_WPI_EVEN_SHIFT                                     14
++#define WF_LWTBL_AAD_OM_DW                                          2
++#define WF_LWTBL_AAD_OM_ADDR                                        8
++#define WF_LWTBL_AAD_OM_MASK \
++	0x00008000 // 15-15
++#define WF_LWTBL_AAD_OM_SHIFT                                       15
++#define WF_LWTBL_CIPHER_SUIT_PGTK_DW                                2
++#define WF_LWTBL_CIPHER_SUIT_PGTK_ADDR                              8
++#define WF_LWTBL_CIPHER_SUIT_PGTK_MASK \
++	0x001f0000 // 20-16
++#define WF_LWTBL_CIPHER_SUIT_PGTK_SHIFT                             16
++#define WF_LWTBL_FD_DW                                              2
++#define WF_LWTBL_FD_ADDR                                            8
++#define WF_LWTBL_FD_MASK \
++	0x00200000 // 21-21
++#define WF_LWTBL_FD_SHIFT                                           21
++#define WF_LWTBL_TD_DW                                              2
++#define WF_LWTBL_TD_ADDR                                            8
++#define WF_LWTBL_TD_MASK \
++	0x00400000 // 22-22
++#define WF_LWTBL_TD_SHIFT                                           22
++#define WF_LWTBL_SW_DW                                              2
++#define WF_LWTBL_SW_ADDR                                            8
++#define WF_LWTBL_SW_MASK \
++	0x00800000 // 23-23
++#define WF_LWTBL_SW_SHIFT                                           23
++#define WF_LWTBL_UL_DW                                              2
++#define WF_LWTBL_UL_ADDR                                            8
++#define WF_LWTBL_UL_MASK \
++	0x01000000 // 24-24
++#define WF_LWTBL_UL_SHIFT                                           24
++#define WF_LWTBL_TX_PS_DW                                           2
++#define WF_LWTBL_TX_PS_ADDR                                         8
++#define WF_LWTBL_TX_PS_MASK \
++	0x02000000 // 25-25
++#define WF_LWTBL_TX_PS_SHIFT                                        25
++#define WF_LWTBL_QOS_DW                                             2
++#define WF_LWTBL_QOS_ADDR                                           8
++#define WF_LWTBL_QOS_MASK \
++	0x04000000 // 26-26
++#define WF_LWTBL_QOS_SHIFT                                          26
++#define WF_LWTBL_HT_DW                                              2
++#define WF_LWTBL_HT_ADDR                                            8
++#define WF_LWTBL_HT_MASK \
++	0x08000000 // 27-27
++#define WF_LWTBL_HT_SHIFT                                           27
++#define WF_LWTBL_VHT_DW                                             2
++#define WF_LWTBL_VHT_ADDR                                           8
++#define WF_LWTBL_VHT_MASK \
++	0x10000000 // 28-28
++#define WF_LWTBL_VHT_SHIFT                                          28
++#define WF_LWTBL_HE_DW                                              2
++#define WF_LWTBL_HE_ADDR                                            8
++#define WF_LWTBL_HE_MASK \
++	0x20000000 // 29-29
++#define WF_LWTBL_HE_SHIFT                                           29
++#define WF_LWTBL_EHT_DW                                             2
++#define WF_LWTBL_EHT_ADDR                                           8
++#define WF_LWTBL_EHT_MASK \
++	0x40000000 // 30-30
++#define WF_LWTBL_EHT_SHIFT                                          30
++#define WF_LWTBL_MESH_DW                                            2
++#define WF_LWTBL_MESH_ADDR                                          8
++#define WF_LWTBL_MESH_MASK \
++	0x80000000 // 31-31
++#define WF_LWTBL_MESH_SHIFT                                         31
++// DW3
++#define WF_LWTBL_WMM_Q_DW                                           3
++#define WF_LWTBL_WMM_Q_ADDR                                         12
++#define WF_LWTBL_WMM_Q_MASK \
++	0x00000003 // 1- 0
++#define WF_LWTBL_WMM_Q_SHIFT                                        0
++#define WF_LWTBL_EHT_SIG_MCS_DW                                     3
++#define WF_LWTBL_EHT_SIG_MCS_ADDR                                   12
++#define WF_LWTBL_EHT_SIG_MCS_MASK \
++	0x0000000c // 3- 2
++#define WF_LWTBL_EHT_SIG_MCS_SHIFT                                  2
++#define WF_LWTBL_HDRT_MODE_DW                                       3
++#define WF_LWTBL_HDRT_MODE_ADDR                                     12
++#define WF_LWTBL_HDRT_MODE_MASK \
++	0x00000010 // 4- 4
++#define WF_LWTBL_HDRT_MODE_SHIFT                                    4
++#define WF_LWTBL_BEAM_CHG_DW                                        3
++#define WF_LWTBL_BEAM_CHG_ADDR                                      12
++#define WF_LWTBL_BEAM_CHG_MASK \
++	0x00000020 // 5- 5
++#define WF_LWTBL_BEAM_CHG_SHIFT                                     5
++#define WF_LWTBL_EHT_LTF_SYM_NUM_OPT_DW                             3
++#define WF_LWTBL_EHT_LTF_SYM_NUM_OPT_ADDR                           12
++#define WF_LWTBL_EHT_LTF_SYM_NUM_OPT_MASK \
++	0x000000c0 // 7- 6
++#define WF_LWTBL_EHT_LTF_SYM_NUM_OPT_SHIFT                          6
++#define WF_LWTBL_PFMU_IDX_DW                                        3
++#define WF_LWTBL_PFMU_IDX_ADDR                                      12
++#define WF_LWTBL_PFMU_IDX_MASK \
++	0x0000ff00 // 15- 8
++#define WF_LWTBL_PFMU_IDX_SHIFT                                     8
++#define WF_LWTBL_ULPF_IDX_DW                                        3
++#define WF_LWTBL_ULPF_IDX_ADDR                                      12
++#define WF_LWTBL_ULPF_IDX_MASK \
++	0x00ff0000 // 23-16
++#define WF_LWTBL_ULPF_IDX_SHIFT                                     16
++#define WF_LWTBL_RIBF_DW                                            3
++#define WF_LWTBL_RIBF_ADDR                                          12
++#define WF_LWTBL_RIBF_MASK \
++	0x01000000 // 24-24
++#define WF_LWTBL_RIBF_SHIFT                                         24
++#define WF_LWTBL_ULPF_DW                                            3
++#define WF_LWTBL_ULPF_ADDR                                          12
++#define WF_LWTBL_ULPF_MASK \
++	0x02000000 // 25-25
++#define WF_LWTBL_ULPF_SHIFT                                         25
++#define WF_LWTBL_TBF_HT_DW                                          3
++#define WF_LWTBL_TBF_HT_ADDR                                        12
++#define WF_LWTBL_TBF_HT_MASK \
++	0x08000000 // 27-27
++#define WF_LWTBL_TBF_HT_SHIFT                                       27
++#define WF_LWTBL_TBF_VHT_DW                                         3
++#define WF_LWTBL_TBF_VHT_ADDR                                       12
++#define WF_LWTBL_TBF_VHT_MASK \
++	0x10000000 // 28-28
++#define WF_LWTBL_TBF_VHT_SHIFT                                      28
++#define WF_LWTBL_TBF_HE_DW                                          3
++#define WF_LWTBL_TBF_HE_ADDR                                        12
++#define WF_LWTBL_TBF_HE_MASK \
++	0x20000000 // 29-29
++#define WF_LWTBL_TBF_HE_SHIFT                                       29
++#define WF_LWTBL_TBF_EHT_DW                                         3
++#define WF_LWTBL_TBF_EHT_ADDR                                       12
++#define WF_LWTBL_TBF_EHT_MASK \
++	0x40000000 // 30-30
++#define WF_LWTBL_TBF_EHT_SHIFT                                      30
++#define WF_LWTBL_IGN_FBK_DW                                         3
++#define WF_LWTBL_IGN_FBK_ADDR                                       12
++#define WF_LWTBL_IGN_FBK_MASK \
++	0x80000000 // 31-31
++#define WF_LWTBL_IGN_FBK_SHIFT                                      31
++// DW4
++#define WF_LWTBL_ANT_ID0_DW                                         4
++#define WF_LWTBL_ANT_ID0_ADDR                                       16
++#define WF_LWTBL_ANT_ID0_MASK \
++	0x00000007 // 2- 0
++#define WF_LWTBL_ANT_ID0_SHIFT                                      0
++#define WF_LWTBL_ANT_ID1_DW                                         4
++#define WF_LWTBL_ANT_ID1_ADDR                                       16
++#define WF_LWTBL_ANT_ID1_MASK \
++	0x00000038 // 5- 3
++#define WF_LWTBL_ANT_ID1_SHIFT                                      3
++#define WF_LWTBL_ANT_ID2_DW                                         4
++#define WF_LWTBL_ANT_ID2_ADDR                                       16
++#define WF_LWTBL_ANT_ID2_MASK \
++	0x000001c0 // 8- 6
++#define WF_LWTBL_ANT_ID2_SHIFT                                      6
++#define WF_LWTBL_ANT_ID3_DW                                         4
++#define WF_LWTBL_ANT_ID3_ADDR                                       16
++#define WF_LWTBL_ANT_ID3_MASK \
++	0x00000e00 // 11- 9
++#define WF_LWTBL_ANT_ID3_SHIFT                                      9
++#define WF_LWTBL_ANT_ID4_DW                                         4
++#define WF_LWTBL_ANT_ID4_ADDR                                       16
++#define WF_LWTBL_ANT_ID4_MASK \
++	0x00007000 // 14-12
++#define WF_LWTBL_ANT_ID4_SHIFT                                      12
++#define WF_LWTBL_ANT_ID5_DW                                         4
++#define WF_LWTBL_ANT_ID5_ADDR                                       16
++#define WF_LWTBL_ANT_ID5_MASK \
++	0x00038000 // 17-15
++#define WF_LWTBL_ANT_ID5_SHIFT                                      15
++#define WF_LWTBL_ANT_ID6_DW                                         4
++#define WF_LWTBL_ANT_ID6_ADDR                                       16
++#define WF_LWTBL_ANT_ID6_MASK \
++	0x001c0000 // 20-18
++#define WF_LWTBL_ANT_ID6_SHIFT                                      18
++#define WF_LWTBL_ANT_ID7_DW                                         4
++#define WF_LWTBL_ANT_ID7_ADDR                                       16
++#define WF_LWTBL_ANT_ID7_MASK \
++	0x00e00000 // 23-21
++#define WF_LWTBL_ANT_ID7_SHIFT                                      21
++#define WF_LWTBL_PE_DW                                              4
++#define WF_LWTBL_PE_ADDR                                            16
++#define WF_LWTBL_PE_MASK \
++	0x03000000 // 25-24
++#define WF_LWTBL_PE_SHIFT                                           24
++#define WF_LWTBL_DIS_RHTR_DW                                        4
++#define WF_LWTBL_DIS_RHTR_ADDR                                      16
++#define WF_LWTBL_DIS_RHTR_MASK \
++	0x04000000 // 26-26
++#define WF_LWTBL_DIS_RHTR_SHIFT                                     26
++#define WF_LWTBL_LDPC_HT_DW                                         4
++#define WF_LWTBL_LDPC_HT_ADDR                                       16
++#define WF_LWTBL_LDPC_HT_MASK \
++	0x08000000 // 27-27
++#define WF_LWTBL_LDPC_HT_SHIFT                                      27
++#define WF_LWTBL_LDPC_VHT_DW                                        4
++#define WF_LWTBL_LDPC_VHT_ADDR                                      16
++#define WF_LWTBL_LDPC_VHT_MASK \
++	0x10000000 // 28-28
++#define WF_LWTBL_LDPC_VHT_SHIFT                                     28
++#define WF_LWTBL_LDPC_HE_DW                                         4
++#define WF_LWTBL_LDPC_HE_ADDR                                       16
++#define WF_LWTBL_LDPC_HE_MASK \
++	0x20000000 // 29-29
++#define WF_LWTBL_LDPC_HE_SHIFT                                      29
++#define WF_LWTBL_LDPC_EHT_DW                                        4
++#define WF_LWTBL_LDPC_EHT_ADDR                                      16
++#define WF_LWTBL_LDPC_EHT_MASK \
++	0x40000000 // 30-30
++#define WF_LWTBL_LDPC_EHT_SHIFT                                     30
++// DW5
++#define WF_LWTBL_AF_DW                                              5
++#define WF_LWTBL_AF_ADDR                                            20
++#define WF_LWTBL_AF_MASK \
++	0x00000007 // 2- 0
++#define WF_LWTBL_AF_SHIFT                                           0
++#define WF_LWTBL_AF_HE_DW                                           5
++#define WF_LWTBL_AF_HE_ADDR                                         20
++#define WF_LWTBL_AF_HE_MASK \
++	0x00000018 // 4- 3
++#define WF_LWTBL_AF_HE_SHIFT                                        3
++#define WF_LWTBL_RTS_DW                                             5
++#define WF_LWTBL_RTS_ADDR                                           20
++#define WF_LWTBL_RTS_MASK \
++	0x00000020 // 5- 5
++#define WF_LWTBL_RTS_SHIFT                                          5
++#define WF_LWTBL_SMPS_DW                                            5
++#define WF_LWTBL_SMPS_ADDR                                          20
++#define WF_LWTBL_SMPS_MASK \
++	0x00000040 // 6- 6
++#define WF_LWTBL_SMPS_SHIFT                                         6
++#define WF_LWTBL_DYN_BW_DW                                          5
++#define WF_LWTBL_DYN_BW_ADDR                                        20
++#define WF_LWTBL_DYN_BW_MASK \
++	0x00000080 // 7- 7
++#define WF_LWTBL_DYN_BW_SHIFT                                       7
++#define WF_LWTBL_MMSS_DW                                            5
++#define WF_LWTBL_MMSS_ADDR                                          20
++#define WF_LWTBL_MMSS_MASK \
++	0x00000700 // 10- 8
++#define WF_LWTBL_MMSS_SHIFT                                         8
++#define WF_LWTBL_USR_DW                                             5
++#define WF_LWTBL_USR_ADDR                                           20
++#define WF_LWTBL_USR_MASK \
++	0x00000800 // 11-11
++#define WF_LWTBL_USR_SHIFT                                          11
++#define WF_LWTBL_SR_R_DW                                            5
++#define WF_LWTBL_SR_R_ADDR                                          20
++#define WF_LWTBL_SR_R_MASK \
++	0x00007000 // 14-12
++#define WF_LWTBL_SR_R_SHIFT                                         12
++#define WF_LWTBL_SR_ABORT_DW                                        5
++#define WF_LWTBL_SR_ABORT_ADDR                                      20
++#define WF_LWTBL_SR_ABORT_MASK \
++	0x00008000 // 15-15
++#define WF_LWTBL_SR_ABORT_SHIFT                                     15
++#define WF_LWTBL_TX_POWER_OFFSET_DW                                 5
++#define WF_LWTBL_TX_POWER_OFFSET_ADDR                               20
++#define WF_LWTBL_TX_POWER_OFFSET_MASK \
++	0x003f0000 // 21-16
++#define WF_LWTBL_TX_POWER_OFFSET_SHIFT                              16
++#define WF_LWTBL_LTF_EHT_DW                                         5
++#define WF_LWTBL_LTF_EHT_ADDR                                       20
++#define WF_LWTBL_LTF_EHT_MASK \
++	0x00c00000 // 23-22
++#define WF_LWTBL_LTF_EHT_SHIFT                                      22
++#define WF_LWTBL_GI_EHT_DW                                          5
++#define WF_LWTBL_GI_EHT_ADDR                                        20
++#define WF_LWTBL_GI_EHT_MASK \
++	0x03000000 // 25-24
++#define WF_LWTBL_GI_EHT_SHIFT                                       24
++#define WF_LWTBL_DOPPL_DW                                           5
++#define WF_LWTBL_DOPPL_ADDR                                         20
++#define WF_LWTBL_DOPPL_MASK \
++	0x04000000 // 26-26
++#define WF_LWTBL_DOPPL_SHIFT                                        26
++#define WF_LWTBL_TXOP_PS_CAP_DW                                     5
++#define WF_LWTBL_TXOP_PS_CAP_ADDR                                   20
++#define WF_LWTBL_TXOP_PS_CAP_MASK \
++	0x08000000 // 27-27
++#define WF_LWTBL_TXOP_PS_CAP_SHIFT                                  27
++#define WF_LWTBL_DU_I_PSM_DW                                        5
++#define WF_LWTBL_DU_I_PSM_ADDR                                      20
++#define WF_LWTBL_DU_I_PSM_MASK \
++	0x10000000 // 28-28
++#define WF_LWTBL_DU_I_PSM_SHIFT                                     28
++#define WF_LWTBL_I_PSM_DW                                           5
++#define WF_LWTBL_I_PSM_ADDR                                         20
++#define WF_LWTBL_I_PSM_MASK \
++	0x20000000 // 29-29
++#define WF_LWTBL_I_PSM_SHIFT                                        29
++#define WF_LWTBL_PSM_DW                                             5
++#define WF_LWTBL_PSM_ADDR                                           20
++#define WF_LWTBL_PSM_MASK \
++	0x40000000 // 30-30
++#define WF_LWTBL_PSM_SHIFT                                          30
++#define WF_LWTBL_SKIP_TX_DW                                         5
++#define WF_LWTBL_SKIP_TX_ADDR                                       20
++#define WF_LWTBL_SKIP_TX_MASK \
++	0x80000000 // 31-31
++#define WF_LWTBL_SKIP_TX_SHIFT                                      31
++// DW6
++#define WF_LWTBL_CBRN_DW                                            6
++#define WF_LWTBL_CBRN_ADDR                                          24
++#define WF_LWTBL_CBRN_MASK \
++	0x00000007 // 2- 0
++#define WF_LWTBL_CBRN_SHIFT                                         0
++#define WF_LWTBL_DBNSS_EN_DW                                        6
++#define WF_LWTBL_DBNSS_EN_ADDR                                      24
++#define WF_LWTBL_DBNSS_EN_MASK \
++	0x00000008 // 3- 3
++#define WF_LWTBL_DBNSS_EN_SHIFT                                     3
++#define WF_LWTBL_BAF_EN_DW                                          6
++#define WF_LWTBL_BAF_EN_ADDR                                        24
++#define WF_LWTBL_BAF_EN_MASK \
++	0x00000010 // 4- 4
++#define WF_LWTBL_BAF_EN_SHIFT                                       4
++#define WF_LWTBL_RDGBA_DW                                           6
++#define WF_LWTBL_RDGBA_ADDR                                         24
++#define WF_LWTBL_RDGBA_MASK \
++	0x00000020 // 5- 5
++#define WF_LWTBL_RDGBA_SHIFT                                        5
++#define WF_LWTBL_R_DW                                               6
++#define WF_LWTBL_R_ADDR                                             24
++#define WF_LWTBL_R_MASK \
++	0x00000040 // 6- 6
++#define WF_LWTBL_R_SHIFT                                            6
++#define WF_LWTBL_SPE_IDX_DW                                         6
++#define WF_LWTBL_SPE_IDX_ADDR                                       24
++#define WF_LWTBL_SPE_IDX_MASK \
++	0x00000f80 // 11- 7
++#define WF_LWTBL_SPE_IDX_SHIFT                                      7
++#define WF_LWTBL_G2_DW                                              6
++#define WF_LWTBL_G2_ADDR                                            24
++#define WF_LWTBL_G2_MASK \
++	0x00001000 // 12-12
++#define WF_LWTBL_G2_SHIFT                                           12
++#define WF_LWTBL_G4_DW                                              6
++#define WF_LWTBL_G4_ADDR                                            24
++#define WF_LWTBL_G4_MASK \
++	0x00002000 // 13-13
++#define WF_LWTBL_G4_SHIFT                                           13
++#define WF_LWTBL_G8_DW                                              6
++#define WF_LWTBL_G8_ADDR                                            24
++#define WF_LWTBL_G8_MASK \
++	0x00004000 // 14-14
++#define WF_LWTBL_G8_SHIFT                                           14
++#define WF_LWTBL_G16_DW                                             6
++#define WF_LWTBL_G16_ADDR                                           24
++#define WF_LWTBL_G16_MASK \
++	0x00008000 // 15-15
++#define WF_LWTBL_G16_SHIFT                                          15
++#define WF_LWTBL_G2_LTF_DW                                          6
++#define WF_LWTBL_G2_LTF_ADDR                                        24
++#define WF_LWTBL_G2_LTF_MASK \
++	0x00030000 // 17-16
++#define WF_LWTBL_G2_LTF_SHIFT                                       16
++#define WF_LWTBL_G4_LTF_DW                                          6
++#define WF_LWTBL_G4_LTF_ADDR                                        24
++#define WF_LWTBL_G4_LTF_MASK \
++	0x000c0000 // 19-18
++#define WF_LWTBL_G4_LTF_SHIFT                                       18
++#define WF_LWTBL_G8_LTF_DW                                          6
++#define WF_LWTBL_G8_LTF_ADDR                                        24
++#define WF_LWTBL_G8_LTF_MASK \
++	0x00300000 // 21-20
++#define WF_LWTBL_G8_LTF_SHIFT                                       20
++#define WF_LWTBL_G16_LTF_DW                                         6
++#define WF_LWTBL_G16_LTF_ADDR                                       24
++#define WF_LWTBL_G16_LTF_MASK \
++	0x00c00000 // 23-22
++#define WF_LWTBL_G16_LTF_SHIFT                                      22
++#define WF_LWTBL_G2_HE_DW                                           6
++#define WF_LWTBL_G2_HE_ADDR                                         24
++#define WF_LWTBL_G2_HE_MASK \
++	0x03000000 // 25-24
++#define WF_LWTBL_G2_HE_SHIFT                                        24
++#define WF_LWTBL_G4_HE_DW                                           6
++#define WF_LWTBL_G4_HE_ADDR                                         24
++#define WF_LWTBL_G4_HE_MASK \
++	0x0c000000 // 27-26
++#define WF_LWTBL_G4_HE_SHIFT                                        26
++#define WF_LWTBL_G8_HE_DW                                           6
++#define WF_LWTBL_G8_HE_ADDR                                         24
++#define WF_LWTBL_G8_HE_MASK \
++	0x30000000 // 29-28
++#define WF_LWTBL_G8_HE_SHIFT                                        28
++#define WF_LWTBL_G16_HE_DW                                          6
++#define WF_LWTBL_G16_HE_ADDR                                        24
++#define WF_LWTBL_G16_HE_MASK \
++	0xc0000000 // 31-30
++#define WF_LWTBL_G16_HE_SHIFT                                       30
++// DW7
++#define WF_LWTBL_BA_WIN_SIZE0_DW                                    7
++#define WF_LWTBL_BA_WIN_SIZE0_ADDR                                  28
++#define WF_LWTBL_BA_WIN_SIZE0_MASK \
++	0x0000000f // 3- 0
++#define WF_LWTBL_BA_WIN_SIZE0_SHIFT                                 0
++#define WF_LWTBL_BA_WIN_SIZE1_DW                                    7
++#define WF_LWTBL_BA_WIN_SIZE1_ADDR                                  28
++#define WF_LWTBL_BA_WIN_SIZE1_MASK \
++	0x000000f0 // 7- 4
++#define WF_LWTBL_BA_WIN_SIZE1_SHIFT                                 4
++#define WF_LWTBL_BA_WIN_SIZE2_DW                                    7
++#define WF_LWTBL_BA_WIN_SIZE2_ADDR                                  28
++#define WF_LWTBL_BA_WIN_SIZE2_MASK \
++	0x00000f00 // 11- 8
++#define WF_LWTBL_BA_WIN_SIZE2_SHIFT                                 8
++#define WF_LWTBL_BA_WIN_SIZE3_DW                                    7
++#define WF_LWTBL_BA_WIN_SIZE3_ADDR                                  28
++#define WF_LWTBL_BA_WIN_SIZE3_MASK \
++	0x0000f000 // 15-12
++#define WF_LWTBL_BA_WIN_SIZE3_SHIFT                                 12
++#define WF_LWTBL_BA_WIN_SIZE4_DW                                    7
++#define WF_LWTBL_BA_WIN_SIZE4_ADDR                                  28
++#define WF_LWTBL_BA_WIN_SIZE4_MASK \
++	0x000f0000 // 19-16
++#define WF_LWTBL_BA_WIN_SIZE4_SHIFT                                 16
++#define WF_LWTBL_BA_WIN_SIZE5_DW                                    7
++#define WF_LWTBL_BA_WIN_SIZE5_ADDR                                  28
++#define WF_LWTBL_BA_WIN_SIZE5_MASK \
++	0x00f00000 // 23-20
++#define WF_LWTBL_BA_WIN_SIZE5_SHIFT                                 20
++#define WF_LWTBL_BA_WIN_SIZE6_DW                                    7
++#define WF_LWTBL_BA_WIN_SIZE6_ADDR                                  28
++#define WF_LWTBL_BA_WIN_SIZE6_MASK \
++	0x0f000000 // 27-24
++#define WF_LWTBL_BA_WIN_SIZE6_SHIFT                                 24
++#define WF_LWTBL_BA_WIN_SIZE7_DW                                    7
++#define WF_LWTBL_BA_WIN_SIZE7_ADDR                                  28
++#define WF_LWTBL_BA_WIN_SIZE7_MASK \
++	0xf0000000 // 31-28
++#define WF_LWTBL_BA_WIN_SIZE7_SHIFT                                 28
++// DW8
++#define WF_LWTBL_AC0_RTS_FAIL_CNT_DW                                8
++#define WF_LWTBL_AC0_RTS_FAIL_CNT_ADDR                              32
++#define WF_LWTBL_AC0_RTS_FAIL_CNT_MASK \
++	0x0000001f // 4- 0
++#define WF_LWTBL_AC0_RTS_FAIL_CNT_SHIFT                             0
++#define WF_LWTBL_AC1_RTS_FAIL_CNT_DW                                8
++#define WF_LWTBL_AC1_RTS_FAIL_CNT_ADDR                              32
++#define WF_LWTBL_AC1_RTS_FAIL_CNT_MASK \
++	0x000003e0 // 9- 5
++#define WF_LWTBL_AC1_RTS_FAIL_CNT_SHIFT                             5
++#define WF_LWTBL_AC2_RTS_FAIL_CNT_DW                                8
++#define WF_LWTBL_AC2_RTS_FAIL_CNT_ADDR                              32
++#define WF_LWTBL_AC2_RTS_FAIL_CNT_MASK \
++	0x00007c00 // 14-10
++#define WF_LWTBL_AC2_RTS_FAIL_CNT_SHIFT                             10
++#define WF_LWTBL_AC3_RTS_FAIL_CNT_DW                                8
++#define WF_LWTBL_AC3_RTS_FAIL_CNT_ADDR                              32
++#define WF_LWTBL_AC3_RTS_FAIL_CNT_MASK \
++	0x000f8000 // 19-15
++#define WF_LWTBL_AC3_RTS_FAIL_CNT_SHIFT                             15
++#define WF_LWTBL_PARTIAL_AID_DW                                     8
++#define WF_LWTBL_PARTIAL_AID_ADDR                                   32
++#define WF_LWTBL_PARTIAL_AID_MASK \
++	0x1ff00000 // 28-20
++#define WF_LWTBL_PARTIAL_AID_SHIFT                                  20
++#define WF_LWTBL_CHK_PER_DW                                         8
++#define WF_LWTBL_CHK_PER_ADDR                                       32
++#define WF_LWTBL_CHK_PER_MASK \
++	0x80000000 // 31-31
++#define WF_LWTBL_CHK_PER_SHIFT                                      31
++// DW9
++#define WF_LWTBL_RX_AVG_MPDU_SIZE_DW                                9
++#define WF_LWTBL_RX_AVG_MPDU_SIZE_ADDR                              36
++#define WF_LWTBL_RX_AVG_MPDU_SIZE_MASK \
++	0x00003fff // 13- 0
++#define WF_LWTBL_RX_AVG_MPDU_SIZE_SHIFT                             0
++#define WF_LWTBL_PRITX_SW_MODE_DW                                   9
++#define WF_LWTBL_PRITX_SW_MODE_ADDR                                 36
++#define WF_LWTBL_PRITX_SW_MODE_MASK \
++	0x00008000 // 15-15
++#define WF_LWTBL_PRITX_SW_MODE_SHIFT                                15
++#define WF_LWTBL_PRITX_ERSU_DW                                      9
++#define WF_LWTBL_PRITX_ERSU_ADDR                                    36
++#define WF_LWTBL_PRITX_ERSU_MASK \
++	0x00010000 // 16-16
++#define WF_LWTBL_PRITX_ERSU_SHIFT                                   16
++#define WF_LWTBL_PRITX_PLR_DW                                       9
++#define WF_LWTBL_PRITX_PLR_ADDR                                     36
++#define WF_LWTBL_PRITX_PLR_MASK \
++	0x00020000 // 17-17
++#define WF_LWTBL_PRITX_PLR_SHIFT                                    17
++#define WF_LWTBL_PRITX_DCM_DW                                       9
++#define WF_LWTBL_PRITX_DCM_ADDR                                     36
++#define WF_LWTBL_PRITX_DCM_MASK \
++	0x00040000 // 18-18
++#define WF_LWTBL_PRITX_DCM_SHIFT                                    18
++#define WF_LWTBL_PRITX_ER106T_DW                                    9
++#define WF_LWTBL_PRITX_ER106T_ADDR                                  36
++#define WF_LWTBL_PRITX_ER106T_MASK \
++	0x00080000 // 19-19
++#define WF_LWTBL_PRITX_ER106T_SHIFT                                 19
++#define WF_LWTBL_FCAP_DW                                            9
++#define WF_LWTBL_FCAP_ADDR                                          36
++#define WF_LWTBL_FCAP_MASK \
++	0x00700000 // 22-20
++#define WF_LWTBL_FCAP_SHIFT                                         20
++#define WF_LWTBL_MPDU_FAIL_CNT_DW                                   9
++#define WF_LWTBL_MPDU_FAIL_CNT_ADDR                                 36
++#define WF_LWTBL_MPDU_FAIL_CNT_MASK \
++	0x03800000 // 25-23
++#define WF_LWTBL_MPDU_FAIL_CNT_SHIFT                                23
++#define WF_LWTBL_MPDU_OK_CNT_DW                                     9
++#define WF_LWTBL_MPDU_OK_CNT_ADDR                                   36
++#define WF_LWTBL_MPDU_OK_CNT_MASK \
++	0x1c000000 // 28-26
++#define WF_LWTBL_MPDU_OK_CNT_SHIFT                                  26
++#define WF_LWTBL_RATE_IDX_DW                                        9
++#define WF_LWTBL_RATE_IDX_ADDR                                      36
++#define WF_LWTBL_RATE_IDX_MASK \
++	0xe0000000 // 31-29
++#define WF_LWTBL_RATE_IDX_SHIFT                                     29
++// DW10
++#define WF_LWTBL_RATE1_DW                                           10
++#define WF_LWTBL_RATE1_ADDR                                         40
++#define WF_LWTBL_RATE1_MASK \
++	0x00007fff // 14- 0
++#define WF_LWTBL_RATE1_SHIFT                                        0
++#define WF_LWTBL_RATE2_DW                                           10
++#define WF_LWTBL_RATE2_ADDR                                         40
++#define WF_LWTBL_RATE2_MASK \
++	0x7fff0000 // 30-16
++#define WF_LWTBL_RATE2_SHIFT                                        16
++// DW11
++#define WF_LWTBL_RATE3_DW                                           11
++#define WF_LWTBL_RATE3_ADDR                                         44
++#define WF_LWTBL_RATE3_MASK \
++	0x00007fff // 14- 0
++#define WF_LWTBL_RATE3_SHIFT                                        0
++#define WF_LWTBL_RATE4_DW                                           11
++#define WF_LWTBL_RATE4_ADDR                                         44
++#define WF_LWTBL_RATE4_MASK \
++	0x7fff0000 // 30-16
++#define WF_LWTBL_RATE4_SHIFT                                        16
++// DW12
++#define WF_LWTBL_RATE5_DW                                           12
++#define WF_LWTBL_RATE5_ADDR                                         48
++#define WF_LWTBL_RATE5_MASK \
++	0x00007fff // 14- 0
++#define WF_LWTBL_RATE5_SHIFT                                        0
++#define WF_LWTBL_RATE6_DW                                           12
++#define WF_LWTBL_RATE6_ADDR                                         48
++#define WF_LWTBL_RATE6_MASK \
++	0x7fff0000 // 30-16
++#define WF_LWTBL_RATE6_SHIFT                                        16
++// DW13
++#define WF_LWTBL_RATE7_DW                                           13
++#define WF_LWTBL_RATE7_ADDR                                         52
++#define WF_LWTBL_RATE7_MASK \
++	0x00007fff // 14- 0
++#define WF_LWTBL_RATE7_SHIFT                                        0
++#define WF_LWTBL_RATE8_DW                                           13
++#define WF_LWTBL_RATE8_ADDR                                         52
++#define WF_LWTBL_RATE8_MASK \
++	0x7fff0000 // 30-16
++#define WF_LWTBL_RATE8_SHIFT                                        16
++// DW14
++#define WF_LWTBL_RATE1_TX_CNT_DW                                    14
++#define WF_LWTBL_RATE1_TX_CNT_ADDR                                  56
++#define WF_LWTBL_RATE1_TX_CNT_MASK \
++	0x0000ffff // 15- 0
++#define WF_LWTBL_RATE1_TX_CNT_SHIFT                                 0
++#define WF_LWTBL_CIPHER_SUIT_IGTK_DW                                14
++#define WF_LWTBL_CIPHER_SUIT_IGTK_ADDR                              56
++#define WF_LWTBL_CIPHER_SUIT_IGTK_MASK \
++	0x00003000 // 13-12
++#define WF_LWTBL_CIPHER_SUIT_IGTK_SHIFT                             12
++#define WF_LWTBL_CIPHER_SUIT_BIGTK_DW                               14
++#define WF_LWTBL_CIPHER_SUIT_BIGTK_ADDR                             56
++#define WF_LWTBL_CIPHER_SUIT_BIGTK_MASK \
++	0x0000c000 // 15-14
++#define WF_LWTBL_CIPHER_SUIT_BIGTK_SHIFT                            14
++#define WF_LWTBL_RATE1_FAIL_CNT_DW                                  14
++#define WF_LWTBL_RATE1_FAIL_CNT_ADDR                                56
++#define WF_LWTBL_RATE1_FAIL_CNT_MASK \
++	0xffff0000 // 31-16
++#define WF_LWTBL_RATE1_FAIL_CNT_SHIFT                               16
++// DW15
++#define WF_LWTBL_RATE2_OK_CNT_DW                                    15
++#define WF_LWTBL_RATE2_OK_CNT_ADDR                                  60
++#define WF_LWTBL_RATE2_OK_CNT_MASK \
++	0x0000ffff // 15- 0
++#define WF_LWTBL_RATE2_OK_CNT_SHIFT                                 0
++#define WF_LWTBL_RATE3_OK_CNT_DW                                    15
++#define WF_LWTBL_RATE3_OK_CNT_ADDR                                  60
++#define WF_LWTBL_RATE3_OK_CNT_MASK \
++	0xffff0000 // 31-16
++#define WF_LWTBL_RATE3_OK_CNT_SHIFT                                 16
++// DW16
++#define WF_LWTBL_CURRENT_BW_TX_CNT_DW                               16
++#define WF_LWTBL_CURRENT_BW_TX_CNT_ADDR                             64
++#define WF_LWTBL_CURRENT_BW_TX_CNT_MASK \
++	0x0000ffff // 15- 0
++#define WF_LWTBL_CURRENT_BW_TX_CNT_SHIFT                            0
++#define WF_LWTBL_CURRENT_BW_FAIL_CNT_DW                             16
++#define WF_LWTBL_CURRENT_BW_FAIL_CNT_ADDR                           64
++#define WF_LWTBL_CURRENT_BW_FAIL_CNT_MASK \
++	0xffff0000 // 31-16
++#define WF_LWTBL_CURRENT_BW_FAIL_CNT_SHIFT                          16
++// DW17
++#define WF_LWTBL_OTHER_BW_TX_CNT_DW                                 17
++#define WF_LWTBL_OTHER_BW_TX_CNT_ADDR                               68
++#define WF_LWTBL_OTHER_BW_TX_CNT_MASK \
++	0x0000ffff // 15- 0
++#define WF_LWTBL_OTHER_BW_TX_CNT_SHIFT                              0
++#define WF_LWTBL_OTHER_BW_FAIL_CNT_DW                               17
++#define WF_LWTBL_OTHER_BW_FAIL_CNT_ADDR                             68
++#define WF_LWTBL_OTHER_BW_FAIL_CNT_MASK \
++	0xffff0000 // 31-16
++#define WF_LWTBL_OTHER_BW_FAIL_CNT_SHIFT                            16
++// DW18
++#define WF_LWTBL_RTS_OK_CNT_DW                                      18
++#define WF_LWTBL_RTS_OK_CNT_ADDR                                    72
++#define WF_LWTBL_RTS_OK_CNT_MASK \
++	0x0000ffff // 15- 0
++#define WF_LWTBL_RTS_OK_CNT_SHIFT                                   0
++#define WF_LWTBL_RTS_FAIL_CNT_DW                                    18
++#define WF_LWTBL_RTS_FAIL_CNT_ADDR                                  72
++#define WF_LWTBL_RTS_FAIL_CNT_MASK \
++	0xffff0000 // 31-16
++#define WF_LWTBL_RTS_FAIL_CNT_SHIFT                                 16
++// DW19
++#define WF_LWTBL_DATA_RETRY_CNT_DW                                  19
++#define WF_LWTBL_DATA_RETRY_CNT_ADDR                                76
++#define WF_LWTBL_DATA_RETRY_CNT_MASK \
++	0x0000ffff // 15- 0
++#define WF_LWTBL_DATA_RETRY_CNT_SHIFT                               0
++#define WF_LWTBL_MGNT_RETRY_CNT_DW                                  19
++#define WF_LWTBL_MGNT_RETRY_CNT_ADDR                                76
++#define WF_LWTBL_MGNT_RETRY_CNT_MASK \
++	0xffff0000 // 31-16
++#define WF_LWTBL_MGNT_RETRY_CNT_SHIFT                               16
++// DW20
++#define WF_LWTBL_AC0_CTT_CDT_CRB_DW                                 20
++#define WF_LWTBL_AC0_CTT_CDT_CRB_ADDR                               80
++#define WF_LWTBL_AC0_CTT_CDT_CRB_MASK \
++	0xffffffff // 31- 0
++#define WF_LWTBL_AC0_CTT_CDT_CRB_SHIFT                              0
++// DW21
++// DO NOT process repeat field(adm[0])
++// DW22
++#define WF_LWTBL_AC1_CTT_CDT_CRB_DW                                 22
++#define WF_LWTBL_AC1_CTT_CDT_CRB_ADDR                               88
++#define WF_LWTBL_AC1_CTT_CDT_CRB_MASK \
++	0xffffffff // 31- 0
++#define WF_LWTBL_AC1_CTT_CDT_CRB_SHIFT                              0
++// DW23
++// DO NOT process repeat field(adm[1])
++// DW24
++#define WF_LWTBL_AC2_CTT_CDT_CRB_DW                                 24
++#define WF_LWTBL_AC2_CTT_CDT_CRB_ADDR                               96
++#define WF_LWTBL_AC2_CTT_CDT_CRB_MASK \
++	0xffffffff // 31- 0
++#define WF_LWTBL_AC2_CTT_CDT_CRB_SHIFT                              0
++// DW25
++// DO NOT process repeat field(adm[2])
++// DW26
++#define WF_LWTBL_AC3_CTT_CDT_CRB_DW                                 26
++#define WF_LWTBL_AC3_CTT_CDT_CRB_ADDR                               104
++#define WF_LWTBL_AC3_CTT_CDT_CRB_MASK \
++	0xffffffff // 31- 0
++#define WF_LWTBL_AC3_CTT_CDT_CRB_SHIFT                              0
++// DW27
++// DO NOT process repeat field(adm[3])
++// DW28
++#define WF_LWTBL_RELATED_IDX0_DW                                    28
++#define WF_LWTBL_RELATED_IDX0_ADDR                                  112
++#define WF_LWTBL_RELATED_IDX0_MASK \
++	0x00000fff // 11- 0
++#define WF_LWTBL_RELATED_IDX0_SHIFT                                 0
++#define WF_LWTBL_RELATED_BAND0_DW                                   28
++#define WF_LWTBL_RELATED_BAND0_ADDR                                 112
++#define WF_LWTBL_RELATED_BAND0_MASK \
++	0x00003000 // 13-12
++#define WF_LWTBL_RELATED_BAND0_SHIFT                                12
++#define WF_LWTBL_PRIMARY_MLD_BAND_DW                                28
++#define WF_LWTBL_PRIMARY_MLD_BAND_ADDR                              112
++#define WF_LWTBL_PRIMARY_MLD_BAND_MASK \
++	0x0000c000 // 15-14
++#define WF_LWTBL_PRIMARY_MLD_BAND_SHIFT                             14
++#define WF_LWTBL_RELATED_IDX1_DW                                    28
++#define WF_LWTBL_RELATED_IDX1_ADDR                                  112
++#define WF_LWTBL_RELATED_IDX1_MASK \
++	0x0fff0000 // 27-16
++#define WF_LWTBL_RELATED_IDX1_SHIFT                                 16
++#define WF_LWTBL_RELATED_BAND1_DW                                   28
++#define WF_LWTBL_RELATED_BAND1_ADDR                                 112
++#define WF_LWTBL_RELATED_BAND1_MASK \
++	0x30000000 // 29-28
++#define WF_LWTBL_RELATED_BAND1_SHIFT                                28
++#define WF_LWTBL_SECONDARY_MLD_BAND_DW                              28
++#define WF_LWTBL_SECONDARY_MLD_BAND_ADDR                            112
++#define WF_LWTBL_SECONDARY_MLD_BAND_MASK \
++	0xc0000000 // 31-30
++#define WF_LWTBL_SECONDARY_MLD_BAND_SHIFT                           30
++// DW29
++#define WF_LWTBL_DISPATCH_POLICY0_DW                                29
++#define WF_LWTBL_DISPATCH_POLICY0_ADDR                              116
++#define WF_LWTBL_DISPATCH_POLICY0_MASK \
++	0x00000003 // 1- 0
++#define WF_LWTBL_DISPATCH_POLICY0_SHIFT                             0
++#define WF_LWTBL_DISPATCH_POLICY1_DW                                29
++#define WF_LWTBL_DISPATCH_POLICY1_ADDR                              116
++#define WF_LWTBL_DISPATCH_POLICY1_MASK \
++	0x0000000c // 3- 2
++#define WF_LWTBL_DISPATCH_POLICY1_SHIFT                             2
++#define WF_LWTBL_DISPATCH_POLICY2_DW                                29
++#define WF_LWTBL_DISPATCH_POLICY2_ADDR                              116
++#define WF_LWTBL_DISPATCH_POLICY2_MASK \
++	0x00000030 // 5- 4
++#define WF_LWTBL_DISPATCH_POLICY2_SHIFT                             4
++#define WF_LWTBL_DISPATCH_POLICY3_DW                                29
++#define WF_LWTBL_DISPATCH_POLICY3_ADDR                              116
++#define WF_LWTBL_DISPATCH_POLICY3_MASK \
++	0x000000c0 // 7- 6
++#define WF_LWTBL_DISPATCH_POLICY3_SHIFT                             6
++#define WF_LWTBL_DISPATCH_POLICY4_DW                                29
++#define WF_LWTBL_DISPATCH_POLICY4_ADDR                              116
++#define WF_LWTBL_DISPATCH_POLICY4_MASK \
++	0x00000300 // 9- 8
++#define WF_LWTBL_DISPATCH_POLICY4_SHIFT                             8
++#define WF_LWTBL_DISPATCH_POLICY5_DW                                29
++#define WF_LWTBL_DISPATCH_POLICY5_ADDR                              116
++#define WF_LWTBL_DISPATCH_POLICY5_MASK \
++	0x00000c00 // 11-10
++#define WF_LWTBL_DISPATCH_POLICY5_SHIFT                             10
++#define WF_LWTBL_DISPATCH_POLICY6_DW                                29
++#define WF_LWTBL_DISPATCH_POLICY6_ADDR                              116
++#define WF_LWTBL_DISPATCH_POLICY6_MASK \
++	0x00003000 // 13-12
++#define WF_LWTBL_DISPATCH_POLICY6_SHIFT                             12
++#define WF_LWTBL_DISPATCH_POLICY7_DW                                29
++#define WF_LWTBL_DISPATCH_POLICY7_ADDR                              116
++#define WF_LWTBL_DISPATCH_POLICY7_MASK \
++	0x0000c000 // 15-14
++#define WF_LWTBL_DISPATCH_POLICY7_SHIFT                             14
++#define WF_LWTBL_OWN_MLD_ID_DW                                      29
++#define WF_LWTBL_OWN_MLD_ID_ADDR                                    116
++#define WF_LWTBL_OWN_MLD_ID_MASK \
++	0x003f0000 // 21-16
++#define WF_LWTBL_OWN_MLD_ID_SHIFT                                   16
++#define WF_LWTBL_EMLSR0_DW                                          29
++#define WF_LWTBL_EMLSR0_ADDR                                        116
++#define WF_LWTBL_EMLSR0_MASK \
++	0x00400000 // 22-22
++#define WF_LWTBL_EMLSR0_SHIFT                                       22
++#define WF_LWTBL_EMLMR0_DW                                          29
++#define WF_LWTBL_EMLMR0_ADDR                                        116
++#define WF_LWTBL_EMLMR0_MASK \
++	0x00800000 // 23-23
++#define WF_LWTBL_EMLMR0_SHIFT                                       23
++#define WF_LWTBL_EMLSR1_DW                                          29
++#define WF_LWTBL_EMLSR1_ADDR                                        116
++#define WF_LWTBL_EMLSR1_MASK \
++	0x01000000 // 24-24
++#define WF_LWTBL_EMLSR1_SHIFT                                       24
++#define WF_LWTBL_EMLMR1_DW                                          29
++#define WF_LWTBL_EMLMR1_ADDR                                        116
++#define WF_LWTBL_EMLMR1_MASK \
++	0x02000000 // 25-25
++#define WF_LWTBL_EMLMR1_SHIFT                                       25
++#define WF_LWTBL_EMLSR2_DW                                          29
++#define WF_LWTBL_EMLSR2_ADDR                                        116
++#define WF_LWTBL_EMLSR2_MASK \
++	0x04000000 // 26-26
++#define WF_LWTBL_EMLSR2_SHIFT                                       26
++#define WF_LWTBL_EMLMR2_DW                                          29
++#define WF_LWTBL_EMLMR2_ADDR                                        116
++#define WF_LWTBL_EMLMR2_MASK \
++	0x08000000 // 27-27
++#define WF_LWTBL_EMLMR2_SHIFT                                       27
++#define WF_LWTBL_STR_BITMAP_DW                                      29
++#define WF_LWTBL_STR_BITMAP_ADDR                                    116
++#define WF_LWTBL_STR_BITMAP_MASK \
++	0xe0000000 // 31-29
++#define WF_LWTBL_STR_BITMAP_SHIFT                                   29
++// DW30
++#define WF_LWTBL_DISPATCH_ORDER_DW                                  30
++#define WF_LWTBL_DISPATCH_ORDER_ADDR                                120
++#define WF_LWTBL_DISPATCH_ORDER_MASK \
++	0x0000007f // 6- 0
++#define WF_LWTBL_DISPATCH_ORDER_SHIFT                               0
++#define WF_LWTBL_DISPATCH_RATIO_DW                                  30
++#define WF_LWTBL_DISPATCH_RATIO_ADDR                                120
++#define WF_LWTBL_DISPATCH_RATIO_MASK \
++	0x00003f80 // 13- 7
++#define WF_LWTBL_DISPATCH_RATIO_SHIFT                               7
++#define WF_LWTBL_LINK_MGF_DW                                        30
++#define WF_LWTBL_LINK_MGF_ADDR                                      120
++#define WF_LWTBL_LINK_MGF_MASK \
++	0xffff0000 // 31-16
++#define WF_LWTBL_LINK_MGF_SHIFT                                     16
++// DW31
++#define WF_LWTBL_NEGOTIATED_WINSIZE0_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE0_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE0_MASK \
++	0x00000007 // 2- 0
++#define WF_LWTBL_NEGOTIATED_WINSIZE0_SHIFT                          0
++#define WF_LWTBL_NEGOTIATED_WINSIZE1_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE1_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE1_MASK \
++	0x00000038 // 5- 3
++#define WF_LWTBL_NEGOTIATED_WINSIZE1_SHIFT                          3
++#define WF_LWTBL_NEGOTIATED_WINSIZE2_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE2_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE2_MASK \
++	0x000001c0 // 8- 6
++#define WF_LWTBL_NEGOTIATED_WINSIZE2_SHIFT                          6
++#define WF_LWTBL_NEGOTIATED_WINSIZE3_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE3_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE3_MASK \
++	0x00000e00 // 11- 9
++#define WF_LWTBL_NEGOTIATED_WINSIZE3_SHIFT                          9
++#define WF_LWTBL_NEGOTIATED_WINSIZE4_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE4_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE4_MASK \
++	0x00007000 // 14-12
++#define WF_LWTBL_NEGOTIATED_WINSIZE4_SHIFT                          12
++#define WF_LWTBL_NEGOTIATED_WINSIZE5_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE5_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE5_MASK \
++	0x00038000 // 17-15
++#define WF_LWTBL_NEGOTIATED_WINSIZE5_SHIFT                          15
++#define WF_LWTBL_NEGOTIATED_WINSIZE6_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE6_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE6_MASK \
++	0x001c0000 // 20-18
++#define WF_LWTBL_NEGOTIATED_WINSIZE6_SHIFT                          18
++#define WF_LWTBL_NEGOTIATED_WINSIZE7_DW                             31
++#define WF_LWTBL_NEGOTIATED_WINSIZE7_ADDR                           124
++#define WF_LWTBL_NEGOTIATED_WINSIZE7_MASK \
++	0x00e00000 // 23-21
++#define WF_LWTBL_NEGOTIATED_WINSIZE7_SHIFT                          21
++#define WF_LWTBL_CASCAD_DW                                          31
++#define WF_LWTBL_CASCAD_ADDR                                        124
++#define WF_LWTBL_CASCAD_MASK \
++	0x02000000 // 25-25
++#define WF_LWTBL_CASCAD_SHIFT                                       25
++#define WF_LWTBL_ALL_ACK_DW                                         31
++#define WF_LWTBL_ALL_ACK_ADDR                                       124
++#define WF_LWTBL_ALL_ACK_MASK \
++	0x04000000 // 26-26
++#define WF_LWTBL_ALL_ACK_SHIFT                                      26
++#define WF_LWTBL_MPDU_SIZE_DW                                       31
++#define WF_LWTBL_MPDU_SIZE_ADDR                                     124
++#define WF_LWTBL_MPDU_SIZE_MASK \
++	0x18000000 // 28-27
++#define WF_LWTBL_MPDU_SIZE_SHIFT                                    27
++#define WF_LWTBL_BA_MODE_DW                                         31
++#define WF_LWTBL_BA_MODE_ADDR                                       124
++#define WF_LWTBL_BA_MODE_MASK \
++	0xe0000000 // 31-29
++#define WF_LWTBL_BA_MODE_SHIFT                                      29
++// DW32
++#define WF_LWTBL_OM_INFO_DW                                         32
++#define WF_LWTBL_OM_INFO_ADDR                                       128
++#define WF_LWTBL_OM_INFO_MASK \
++	0x00000fff // 11- 0
++#define WF_LWTBL_OM_INFO_SHIFT                                      0
++#define WF_LWTBL_RXD_DUP_FOR_OM_CHG_DW                              32
++#define WF_LWTBL_RXD_DUP_FOR_OM_CHG_ADDR                            128
++#define WF_LWTBL_RXD_DUP_FOR_OM_CHG_MASK \
++	0x00001000 // 12-12
++#define WF_LWTBL_RXD_DUP_FOR_OM_CHG_SHIFT                           12
++#define WF_LWTBL_RXD_DUP_WHITE_LIST_DW                              32
++#define WF_LWTBL_RXD_DUP_WHITE_LIST_ADDR                            128
++#define WF_LWTBL_RXD_DUP_WHITE_LIST_MASK \
++	0x01ffe000 // 24-13
++#define WF_LWTBL_RXD_DUP_WHITE_LIST_SHIFT                           13
++#define WF_LWTBL_RXD_DUP_MODE_DW                                    32
++#define WF_LWTBL_RXD_DUP_MODE_ADDR                                  128
++#define WF_LWTBL_RXD_DUP_MODE_MASK \
++	0x06000000 // 26-25
++#define WF_LWTBL_RXD_DUP_MODE_SHIFT                                 25
++#define WF_LWTBL_DROP_DW                                            32
++#define WF_LWTBL_DROP_ADDR                                          128
++#define WF_LWTBL_DROP_MASK \
++	0x40000000 // 30-30
++#define WF_LWTBL_DROP_SHIFT                                         30
++#define WF_LWTBL_ACK_EN_DW                                          32
++#define WF_LWTBL_ACK_EN_ADDR                                        128
++#define WF_LWTBL_ACK_EN_MASK \
++	0x80000000 // 31-31
++#define WF_LWTBL_ACK_EN_SHIFT                                       31
++// DW33
++#define WF_LWTBL_USER_RSSI_DW                                       33
++#define WF_LWTBL_USER_RSSI_ADDR                                     132
++#define WF_LWTBL_USER_RSSI_MASK \
++	0x000001ff // 8- 0
++#define WF_LWTBL_USER_RSSI_SHIFT                                    0
++#define WF_LWTBL_USER_SNR_DW                                        33
++#define WF_LWTBL_USER_SNR_ADDR                                      132
++#define WF_LWTBL_USER_SNR_MASK \
++	0x00007e00 // 14- 9
++#define WF_LWTBL_USER_SNR_SHIFT                                     9
++#define WF_LWTBL_RAPID_REACTION_RATE_DW                             33
++#define WF_LWTBL_RAPID_REACTION_RATE_ADDR                           132
++#define WF_LWTBL_RAPID_REACTION_RATE_MASK \
++	0x0fff0000 // 27-16
++#define WF_LWTBL_RAPID_REACTION_RATE_SHIFT                          16
++#define WF_LWTBL_HT_AMSDU_DW                                        33
++#define WF_LWTBL_HT_AMSDU_ADDR                                      132
++#define WF_LWTBL_HT_AMSDU_MASK \
++	0x40000000 // 30-30
++#define WF_LWTBL_HT_AMSDU_SHIFT                                     30
++#define WF_LWTBL_AMSDU_CROSS_LG_DW                                  33
++#define WF_LWTBL_AMSDU_CROSS_LG_ADDR                                132
++#define WF_LWTBL_AMSDU_CROSS_LG_MASK \
++	0x80000000 // 31-31
++#define WF_LWTBL_AMSDU_CROSS_LG_SHIFT                               31
++// DW34
++#define WF_LWTBL_RESP_RCPI0_DW                                      34
++#define WF_LWTBL_RESP_RCPI0_ADDR                                    136
++#define WF_LWTBL_RESP_RCPI0_MASK \
++	0x000000ff // 7- 0
++#define WF_LWTBL_RESP_RCPI0_SHIFT                                   0
++#define WF_LWTBL_RESP_RCPI1_DW                                      34
++#define WF_LWTBL_RESP_RCPI1_ADDR                                    136
++#define WF_LWTBL_RESP_RCPI1_MASK \
++	0x0000ff00 // 15- 8
++#define WF_LWTBL_RESP_RCPI1_SHIFT                                   8
++#define WF_LWTBL_RESP_RCPI2_DW                                      34
++#define WF_LWTBL_RESP_RCPI2_ADDR                                    136
++#define WF_LWTBL_RESP_RCPI2_MASK \
++	0x00ff0000 // 23-16
++#define WF_LWTBL_RESP_RCPI2_SHIFT                                   16
++#define WF_LWTBL_RESP_RCPI3_DW                                      34
++#define WF_LWTBL_RESP_RCPI3_ADDR                                    136
++#define WF_LWTBL_RESP_RCPI3_MASK \
++	0xff000000 // 31-24
++#define WF_LWTBL_RESP_RCPI3_SHIFT                                   24
++// DW35
++#define WF_LWTBL_SNR_RX0_DW                                         35
++#define WF_LWTBL_SNR_RX0_ADDR                                       140
++#define WF_LWTBL_SNR_RX0_MASK \
++	0x0000003f // 5- 0
++#define WF_LWTBL_SNR_RX0_SHIFT                                      0
++#define WF_LWTBL_SNR_RX1_DW                                         35
++#define WF_LWTBL_SNR_RX1_ADDR                                       140
++#define WF_LWTBL_SNR_RX1_MASK \
++	0x00000fc0 // 11- 6
++#define WF_LWTBL_SNR_RX1_SHIFT                                      6
++#define WF_LWTBL_SNR_RX2_DW                                         35
++#define WF_LWTBL_SNR_RX2_ADDR                                       140
++#define WF_LWTBL_SNR_RX2_MASK \
++	0x0003f000 // 17-12
++#define WF_LWTBL_SNR_RX2_SHIFT                                      12
++#define WF_LWTBL_SNR_RX3_DW                                         35
++#define WF_LWTBL_SNR_RX3_ADDR                                       140
++#define WF_LWTBL_SNR_RX3_MASK \
++	0x00fc0000 // 23-18
++#define WF_LWTBL_SNR_RX3_SHIFT                                      18
++
++/* WTBL Group - Packet Number */
++/* DW 2 */
++#define WTBL_PN0_MASK                   BITS(0, 7)
++#define WTBL_PN0_OFFSET                 0
++#define WTBL_PN1_MASK                   BITS(8, 15)
++#define WTBL_PN1_OFFSET                 8
++#define WTBL_PN2_MASK                   BITS(16, 23)
++#define WTBL_PN2_OFFSET                 16
++#define WTBL_PN3_MASK                   BITS(24, 31)
++#define WTBL_PN3_OFFSET                 24
++
++/* DW 3 */
++#define WTBL_PN4_MASK                   BITS(0, 7)
++#define WTBL_PN4_OFFSET                 0
++#define WTBL_PN5_MASK                   BITS(8, 15)
++#define WTBL_PN5_OFFSET                 8
++
++/* DW 4 */
++#define WTBL_BIPN0_MASK                 BITS(0, 7)
++#define WTBL_BIPN0_OFFSET               0
++#define WTBL_BIPN1_MASK                 BITS(8, 15)
++#define WTBL_BIPN1_OFFSET               8
++#define WTBL_BIPN2_MASK                 BITS(16, 23)
++#define WTBL_BIPN2_OFFSET               16
++#define WTBL_BIPN3_MASK                 BITS(24, 31)
++#define WTBL_BIPN3_OFFSET               24
++
++/* DW 5 */
++#define WTBL_BIPN4_MASK                 BITS(0, 7)
++#define WTBL_BIPN4_OFFSET               0
++#define WTBL_BIPN5_MASK                 BITS(8, 15)
++#define WTBL_BIPN5_OFFSET               8
++
++/* UWTBL DW 6 */
++#define WTBL_AMSDU_LEN_MASK             BITS(0, 5)
++#define WTBL_AMSDU_LEN_OFFSET           0
++#define WTBL_AMSDU_NUM_MASK             BITS(6, 10)
++#define WTBL_AMSDU_NUM_OFFSET           6
++#define WTBL_AMSDU_EN_MASK              BIT(11)
++#define WTBL_AMSDU_EN_OFFSET            11
++
++/* LWTBL Rate field */
++#define WTBL_RATE_TX_RATE_MASK          BITS(0, 5)
++#define WTBL_RATE_TX_RATE_OFFSET        0
++#define WTBL_RATE_TX_MODE_MASK          BITS(6, 9)
++#define WTBL_RATE_TX_MODE_OFFSET        6
++#define WTBL_RATE_NSTS_MASK             BITS(10, 13)
++#define WTBL_RATE_NSTS_OFFSET           10
++#define WTBL_RATE_STBC_MASK             BIT(14)
++#define WTBL_RATE_STBC_OFFSET           14
++
++/***** WTBL(LMAC) DW Offset *****/
++/* LMAC WTBL Group - Peer Unique Information */
++#define WTBL_GROUP_PEER_INFO_DW_0               0
++#define WTBL_GROUP_PEER_INFO_DW_1               1
++
++/* WTBL Group - TxRx Capability/Information */
++#define WTBL_GROUP_TRX_CAP_DW_2                 2
++#define WTBL_GROUP_TRX_CAP_DW_3                 3
++#define WTBL_GROUP_TRX_CAP_DW_4                 4
++#define WTBL_GROUP_TRX_CAP_DW_5                 5
++#define WTBL_GROUP_TRX_CAP_DW_6                 6
++#define WTBL_GROUP_TRX_CAP_DW_7                 7
++#define WTBL_GROUP_TRX_CAP_DW_8                 8
++#define WTBL_GROUP_TRX_CAP_DW_9                 9
++
++/* WTBL Group - Auto Rate Table*/
++#define WTBL_GROUP_AUTO_RATE_1_2                10
++#define WTBL_GROUP_AUTO_RATE_3_4                11
++#define WTBL_GROUP_AUTO_RATE_5_6                12
++#define WTBL_GROUP_AUTO_RATE_7_8                13
++
++/* WTBL Group - Tx Counter */
++#define WTBL_GROUP_TX_CNT_LINE_1                14
++#define WTBL_GROUP_TX_CNT_LINE_2                15
++#define WTBL_GROUP_TX_CNT_LINE_3                16
++#define WTBL_GROUP_TX_CNT_LINE_4                17
++#define WTBL_GROUP_TX_CNT_LINE_5                18
++#define WTBL_GROUP_TX_CNT_LINE_6                19
++
++/* WTBL Group - Admission Control Counter */
++#define WTBL_GROUP_ADM_CNT_LINE_1               20
++#define WTBL_GROUP_ADM_CNT_LINE_2               21
++#define WTBL_GROUP_ADM_CNT_LINE_3               22
++#define WTBL_GROUP_ADM_CNT_LINE_4               23
++#define WTBL_GROUP_ADM_CNT_LINE_5               24
++#define WTBL_GROUP_ADM_CNT_LINE_6               25
++#define WTBL_GROUP_ADM_CNT_LINE_7               26
++#define WTBL_GROUP_ADM_CNT_LINE_8               27
++
++/* WTBL Group -MLO Info */
++#define WTBL_GROUP_MLO_INFO_LINE_1              28
++#define WTBL_GROUP_MLO_INFO_LINE_2              29
++#define WTBL_GROUP_MLO_INFO_LINE_3              30
++
++/* WTBL Group -RESP Info */
++#define WTBL_GROUP_RESP_INFO_DW_31              31
++
++/* WTBL Group -RX DUP Info */
++#define WTBL_GROUP_RX_DUP_INFO_DW_32            32
++
++/* WTBL Group - Rx Statistics Counter */
++#define WTBL_GROUP_RX_STAT_CNT_LINE_1           33
++#define WTBL_GROUP_RX_STAT_CNT_LINE_2           34
++#define WTBL_GROUP_RX_STAT_CNT_LINE_3           35
++
++/* UWTBL Group - HW AMSDU */
++#define UWTBL_HW_AMSDU_DW                       WF_UWTBL_AMSDU_CFG_DW
++
++/* LWTBL DW 4 */
++#define WTBL_DIS_RHTR                           WF_LWTBL_DIS_RHTR_MASK
++
++/* UWTBL DW 5 */
++#define WTBL_KEY_LINK_DW_KEY_LOC0_MASK          BITS(0, 10)
++#define WTBL_PSM				WF_LWTBL_PSM_MASK
++
++/* Need to sync with FW define */
++#define INVALID_KEY_ENTRY                       WTBL_KEY_LINK_DW_KEY_LOC0_MASK
++
++// RATE
++#define WTBL_RATE_TX_RATE_MASK          	BITS(0, 5)
++#define WTBL_RATE_TX_RATE_OFFSET        	0
++#define WTBL_RATE_TX_MODE_MASK          	BITS(6, 9)
++#define WTBL_RATE_TX_MODE_OFFSET        	6
++#define WTBL_RATE_NSTS_MASK             	BITS(10, 13)
++#define WTBL_RATE_NSTS_OFFSET           	10
++#define WTBL_RATE_STBC_MASK            	 	BIT(14)
++#define WTBL_RATE_STBC_OFFSET          	 	14
++#endif
++
++#endif
+diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
+new file mode 100644
+index 00000000..080f756e
+--- /dev/null
++++ b/mt7996/mtk_debugfs.c
+@@ -0,0 +1,2344 @@
++// SPDX-License-Identifier: ISC
++/*
++ * Copyright (C) 2023 MediaTek Inc.
++ */
++#include "mt7996.h"
++#include "../mt76.h"
++#include "mcu.h"
++#include "mac.h"
++#include "eeprom.h"
++#include "mtk_debug.h"
++#include "mtk_mcu.h"
++
++#ifdef CONFIG_MTK_DEBUG
++
++/* AGG INFO */
++static int
++mt7996_agginfo_read_per_band(struct seq_file *s, int band_idx)
++{
++	struct mt7996_dev *dev = dev_get_drvdata(s->private);
++	u64 total_burst, total_ampdu, ampdu_cnt[16];
++	u32 value, idx, row_idx, col_idx, start_range, agg_rang_sel[16], burst_cnt[16], band_offset = 0;
++	u8 readFW = 0, partial_str[16] = {}, full_str[64] = {};
++
++	switch (band_idx) {
++	case 0:
++		band_offset = 0;
++		break;
++	case 1:
++		band_offset = BN1_WF_AGG_TOP_BASE - BN0_WF_AGG_TOP_BASE;
++		break;
++	case 2:
++		band_offset = IP1_BN0_WF_AGG_TOP_BASE - BN0_WF_AGG_TOP_BASE;
++		break;
++	default:
++		return 0;
++	}
++
++	seq_printf(s, "Band %d AGG Status\n", band_idx);
++	seq_printf(s, "===============================\n");
++	value = mt76_rr(dev, BN0_WF_AGG_TOP_AALCR0_ADDR + band_offset);
++	seq_printf(s, "AC00 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR0_AC00_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR0_AC00_AGG_LIMIT_SHFT);
++	seq_printf(s, "AC01 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR0_AC01_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR0_AC01_AGG_LIMIT_SHFT);
++	value = mt76_rr(dev, BN0_WF_AGG_TOP_AALCR1_ADDR + band_offset);
++	seq_printf(s, "AC02 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR1_AC02_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR1_AC02_AGG_LIMIT_SHFT);
++	seq_printf(s, "AC03 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR1_AC03_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR1_AC03_AGG_LIMIT_SHFT);
++	value = mt76_rr(dev, BN0_WF_AGG_TOP_AALCR2_ADDR + band_offset);
++	seq_printf(s, "AC10 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR2_AC10_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR2_AC10_AGG_LIMIT_SHFT);
++	seq_printf(s, "AC11 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR2_AC11_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR2_AC11_AGG_LIMIT_SHFT);
++	value = mt76_rr(dev, BN0_WF_AGG_TOP_AALCR3_ADDR + band_offset);
++	seq_printf(s, "AC12 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR3_AC12_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR3_AC12_AGG_LIMIT_SHFT);
++	seq_printf(s, "AC13 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR3_AC13_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR3_AC13_AGG_LIMIT_SHFT);
++	value = mt76_rr(dev, BN0_WF_AGG_TOP_AALCR4_ADDR + band_offset);
++	seq_printf(s, "AC20 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR4_AC20_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR4_AC20_AGG_LIMIT_SHFT);
++	seq_printf(s, "AC21 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR4_AC21_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR4_AC21_AGG_LIMIT_SHFT);
++	value = mt76_rr(dev, BN0_WF_AGG_TOP_AALCR5_ADDR + band_offset);
++	seq_printf(s, "AC22 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR5_AC22_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR5_AC22_AGG_LIMIT_SHFT);
++	seq_printf(s, "AC23 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR5_AC23_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR5_AC23_AGG_LIMIT_SHFT);
++	value = mt76_rr(dev, BN0_WF_AGG_TOP_AALCR6_ADDR + band_offset);
++	seq_printf(s, "AC30 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR6_AC30_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR6_AC30_AGG_LIMIT_SHFT);
++	seq_printf(s, "AC31 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR6_AC31_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR6_AC31_AGG_LIMIT_SHFT);
++	value = mt76_rr(dev, BN0_WF_AGG_TOP_AALCR7_ADDR + band_offset);
++	seq_printf(s, "AC32 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR7_AC32_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR7_AC32_AGG_LIMIT_SHFT);
++	seq_printf(s, "AC33 Agg limit = %d\t", (value & BN0_WF_AGG_TOP_AALCR7_AC33_AGG_LIMIT_MASK) >>  BN0_WF_AGG_TOP_AALCR7_AC33_AGG_LIMIT_SHFT);
++
++	switch (band_idx) {
++	case 0:
++		band_offset = 0;
++		break;
++	case 1:
++		band_offset = BN1_WF_MIB_TOP_BASE - BN0_WF_MIB_TOP_BASE;
++		break;
++	case 2:
++		band_offset = IP1_BN0_WF_MIB_TOP_BASE - BN0_WF_MIB_TOP_BASE;
++		break;
++	default:
++		return 0;
++	}
++
++	seq_printf(s, "===AMPDU Related Counters===\n");
++
++	if (readFW) {
++		/* BELLWETHER TODO: Wait MIB counter API implement complete */
++	} else {
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC0_ADDR + band_offset);
++		agg_rang_sel[0] = (value & BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_0_MASK) >> BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_0_SHFT;
++		agg_rang_sel[1] = (value & BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_1_MASK) >> BN0_WF_MIB_TOP_TRARC0_AGG_RANG_SEL_1_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC1_ADDR + band_offset);
++		agg_rang_sel[2] = (value & BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_2_MASK) >> BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_2_SHFT;
++		agg_rang_sel[3] = (value & BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_3_MASK) >> BN0_WF_MIB_TOP_TRARC1_AGG_RANG_SEL_3_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC2_ADDR + band_offset);
++		agg_rang_sel[4] = (value & BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_4_MASK) >> BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_4_SHFT;
++		agg_rang_sel[5] = (value & BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_5_MASK) >> BN0_WF_MIB_TOP_TRARC2_AGG_RANG_SEL_5_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC3_ADDR + band_offset);
++		agg_rang_sel[6] = (value & BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_6_MASK) >> BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_6_SHFT;
++		agg_rang_sel[7] = (value & BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_7_MASK) >> BN0_WF_MIB_TOP_TRARC3_AGG_RANG_SEL_7_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC4_ADDR + band_offset);
++		agg_rang_sel[8] = (value & BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_8_MASK) >> BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_8_SHFT;
++		agg_rang_sel[9] = (value & BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_9_MASK) >> BN0_WF_MIB_TOP_TRARC4_AGG_RANG_SEL_9_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC5_ADDR + band_offset);
++		agg_rang_sel[10] = (value & BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_10_MASK) >> BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_10_SHFT;
++		agg_rang_sel[11] = (value & BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_11_MASK) >> BN0_WF_MIB_TOP_TRARC5_AGG_RANG_SEL_11_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC6_ADDR + band_offset);
++		agg_rang_sel[12] = (value & BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_12_MASK) >> BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_12_SHFT;
++		agg_rang_sel[13] = (value & BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_13_MASK) >> BN0_WF_MIB_TOP_TRARC6_AGG_RANG_SEL_13_SHFT;
++		value = mt76_rr(dev, BN0_WF_MIB_TOP_TRARC7_ADDR + band_offset);
++		agg_rang_sel[14] = (value & BN0_WF_MIB_TOP_TRARC7_AGG_RANG_SEL_14_MASK) >> BN0_WF_MIB_TOP_TRARC7_AGG_RANG_SEL_14_SHFT;
++
++		burst_cnt[0] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR0_ADDR + band_offset);
++		burst_cnt[1] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR1_ADDR + band_offset);
++		burst_cnt[2] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR2_ADDR + band_offset);
++		burst_cnt[3] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR3_ADDR + band_offset);
++		burst_cnt[4] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR4_ADDR + band_offset);
++		burst_cnt[5] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR5_ADDR + band_offset);
++		burst_cnt[6] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR6_ADDR + band_offset);
++		burst_cnt[7] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR7_ADDR + band_offset);
++		burst_cnt[8] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR8_ADDR + band_offset);
++		burst_cnt[9] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR9_ADDR + band_offset);
++		burst_cnt[10] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR10_ADDR + band_offset);
++		burst_cnt[11] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR11_ADDR + band_offset);
++		burst_cnt[12] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR12_ADDR + band_offset);
++		burst_cnt[13] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR13_ADDR + band_offset);
++		burst_cnt[14] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR14_ADDR + band_offset);
++		burst_cnt[15] = mt76_rr(dev, BN0_WF_MIB_TOP_TRDR15_ADDR + band_offset);
++	}
++
++	start_range = 1;
++	total_burst = 0;
++	total_ampdu = 0;
++	agg_rang_sel[15] = 1023;
++
++	/* Need to add 1 after read from AGG_RANG_SEL CR */
++	for (idx = 0; idx < 16; idx++) {
++		agg_rang_sel[idx]++;
++		total_burst += burst_cnt[idx];
++
++		if (start_range == agg_rang_sel[idx])
++			ampdu_cnt[idx] = (u64) start_range * burst_cnt[idx];
++		else
++			ampdu_cnt[idx] = (u64) ((start_range + agg_rang_sel[idx]) >> 1) * burst_cnt[idx];
++
++		start_range = agg_rang_sel[idx] + 1;
++		total_ampdu += ampdu_cnt[idx];
++	}
++
++	start_range = 1;
++	sprintf(full_str, "%13s ", "Tx Agg Range:");
++
++	for (row_idx = 0; row_idx < 4; row_idx++) {
++		for (col_idx = 0; col_idx < 4; col_idx++, idx++) {
++			idx = 4 * row_idx + col_idx;
++
++			if (start_range == agg_rang_sel[idx])
++				sprintf(partial_str, "%d", agg_rang_sel[idx]);
++			else
++				sprintf(partial_str, "%d~%d", start_range, agg_rang_sel[idx]);
++
++			start_range = agg_rang_sel[idx] + 1;
++			sprintf(full_str + strlen(full_str), "%-11s ", partial_str);
++		}
++
++		idx = 4 * row_idx;
++
++		seq_printf(s, "%s\n", full_str);
++		seq_printf(s, "%13s 0x%-9x 0x%-9x 0x%-9x 0x%-9x\n",
++			row_idx ? "" : "Burst count:",
++			burst_cnt[idx], burst_cnt[idx + 1],
++			burst_cnt[idx + 2], burst_cnt[idx + 3]);
++
++		if (total_burst != 0) {
++			if (row_idx == 0)
++				sprintf(full_str, "%13s ",
++					"Burst ratio:");
++			else
++				sprintf(full_str, "%13s ", "");
++
++			for (col_idx = 0; col_idx < 4; col_idx++) {
++				u64 count = (u64) burst_cnt[idx + col_idx] * 100;
++
++				sprintf(partial_str, "(%llu%%)",
++					div64_u64(count, total_burst));
++				sprintf(full_str + strlen(full_str),
++					"%-11s ", partial_str);
++			}
++
++			seq_printf(s, "%s\n", full_str);
++
++			if (row_idx == 0)
++				sprintf(full_str, "%13s ",
++					"MDPU ratio:");
++			else
++				sprintf(full_str, "%13s ", "");
++
++			for (col_idx = 0; col_idx < 4; col_idx++) {
++				u64 count = ampdu_cnt[idx + col_idx] * 100;
++
++				sprintf(partial_str, "(%llu%%)",
++					div64_u64(count, total_ampdu));
++				sprintf(full_str + strlen(full_str),
++					"%-11s ", partial_str);
++			}
++
++			seq_printf(s, "%s\n", full_str);
++		}
++
++		sprintf(full_str, "%13s ", "");
++	}
++
++	return 0;
++}
++
++static int mt7996_agginfo_read_band0(struct seq_file *s, void *data)
++{
++	mt7996_agginfo_read_per_band(s, MT_BAND0);
++	return 0;
++}
++
++static int mt7996_agginfo_read_band1(struct seq_file *s, void *data)
++{
++	mt7996_agginfo_read_per_band(s, MT_BAND1);
++	return 0;
++}
++
++static int mt7996_agginfo_read_band2(struct seq_file *s, void *data)
++{
++	mt7996_agginfo_read_per_band(s, MT_BAND2);
++	return 0;
++}
++
++/* AMSDU INFO */
++static int mt7996_amsdu_result_read(struct seq_file *s, void *data)
++{
++#define HW_MSDU_CNT_ADDR 0xf400
++#define HW_MSDU_NUM_MAX 33
++	struct mt7996_dev *dev = dev_get_drvdata(s->private);
++	u32 ple_stat[HW_MSDU_NUM_MAX] = {0}, total_amsdu = 0;
++	u8 i;
++
++	for (i = 0; i < HW_MSDU_NUM_MAX; i++)
++		ple_stat[i] = mt76_rr(dev, HW_MSDU_CNT_ADDR + i * 0x04);
++
++	seq_printf(s, "TXD counter status of MSDU:\n");
++
++	for (i = 0; i < HW_MSDU_NUM_MAX; i++)
++		total_amsdu += ple_stat[i];
++
++	for (i = 0; i < HW_MSDU_NUM_MAX; i++) {
++		seq_printf(s, "AMSDU pack count of %d MSDU in TXD: 0x%x ", i, ple_stat[i]);
++		if (total_amsdu != 0)
++			seq_printf(s, "(%d%%)\n", ple_stat[i] * 100 / total_amsdu);
++		else
++			seq_printf(s, "\n");
++	}
++
++	return 0;
++}
++
++/* DBG MODLE */
++static int
++mt7996_fw_debug_module_set(void *data, u64 module)
++{
++	struct mt7996_dev *dev = data;
++
++	dev->dbg.fw_dbg_module = module;
++	return 0;
++}
++
++static int
++mt7996_fw_debug_module_get(void *data, u64 *module)
++{
++	struct mt7996_dev *dev = data;
++
++	*module = dev->dbg.fw_dbg_module;
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_module, mt7996_fw_debug_module_get,
++			 mt7996_fw_debug_module_set, "%lld\n");
++
++static int
++mt7996_fw_debug_level_set(void *data, u64 level)
++{
++	struct mt7996_dev *dev = data;
++
++	dev->dbg.fw_dbg_lv = level;
++	mt7996_mcu_fw_dbg_ctrl(dev, dev->dbg.fw_dbg_module, dev->dbg.fw_dbg_lv);
++	return 0;
++}
++
++static int
++mt7996_fw_debug_level_get(void *data, u64 *level)
++{
++	struct mt7996_dev *dev = data;
++
++	*level = dev->dbg.fw_dbg_lv;
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_level, mt7996_fw_debug_level_get,
++			 mt7996_fw_debug_level_set, "%lld\n");
++
++/* usage: echo 0x[arg3][arg2][arg1] > fw_wa_set */
++static int
++mt7996_wa_set(void *data, u64 val)
++{
++	struct mt7996_dev *dev = data;
++	u32 arg1, arg2, arg3;
++
++	arg1 = FIELD_GET(GENMASK_ULL(7, 0), val);
++	arg2 = FIELD_GET(GENMASK_ULL(15, 8), val);
++	arg3 = FIELD_GET(GENMASK_ULL(23, 16), val);
++
++	return mt7996_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
++				arg1, arg2, arg3);
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_set, NULL, mt7996_wa_set,
++			 "0x%llx\n");
++
++/* usage: echo 0x[arg3][arg2][arg1] > fw_wa_query */
++static int
++mt7996_wa_query(void *data, u64 val)
++{
++	struct mt7996_dev *dev = data;
++	u32 arg1, arg2, arg3;
++
++	arg1 = FIELD_GET(GENMASK_ULL(7, 0), val);
++	arg2 = FIELD_GET(GENMASK_ULL(15, 8), val);
++	arg3 = FIELD_GET(GENMASK_ULL(23, 16), val);
++
++	return mt7996_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(QUERY),
++				arg1, arg2, arg3);
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_query, NULL, mt7996_wa_query,
++			 "0x%llx\n");
++
++static int mt7996_dump_version(struct seq_file *s, void *data)
++{
++	struct mt7996_dev *dev = dev_get_drvdata(s->private);
++	seq_printf(s, "Version: 3.3.10.0\n");
++
++	if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
++		return 0;
++
++	seq_printf(s, "Rom Patch Build Time: %.16s\n", dev->dbg.patch_build_date);
++	seq_printf(s, "WM Patch Build Time: %.15s\n",
++		   dev->dbg.ram_build_date[MT7996_RAM_TYPE_WM]);
++	seq_printf(s, "WA Patch Build Time: %.15s\n",
++		   dev->dbg.ram_build_date[MT7996_RAM_TYPE_WA]);
++	seq_printf(s, "DSP Patch Build Time: %.15s\n",
++		   dev->dbg.ram_build_date[MT7996_RAM_TYPE_DSP]);
++	return 0;
++}
++
++/* dma info dump */
++const struct queue_desc mt7902_tx_ring_layout[] = {
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_TX_RING18_CTRL0_ADDR,
++	 .ring_size = 2048,
++	 .ring_info = "band0 TXD"
++	},
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_TX_RING19_CTRL0_ADDR,
++	 .ring_size = 2048,
++	 .ring_info = "band1 TXD"
++	},
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_TX_RING21_CTRL0_ADDR,
++	 .ring_size = 2048,
++	 .ring_info = "band2 TXD"
++	},
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_TX_RING16_CTRL0_ADDR,
++	 .ring_size = 128,
++	 .ring_info = "FWDL"
++	},
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_TX_RING17_CTRL0_ADDR,
++	 .ring_size = 256,
++	 .ring_info = "cmd to WM"
++	},
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_TX_RING20_CTRL0_ADDR,
++	 .ring_size = 256,
++	 .ring_info = "cmd to WA"
++	}
++};
++
++const struct queue_desc mt7902_rx_ring_layout[] = {
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_RX_RING4_CTRL0_ADDR,
++	 .ring_size = 1536,
++	 .ring_info = "band0 RX data"
++	},
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_RX_RING5_CTRL0_ADDR,
++	 .ring_size = 1536,
++	 .ring_info = "band1 RX data"
++	},
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_RX_RING8_CTRL0_ADDR,
++	 .ring_size = 1536,
++	 .ring_info = "band2 RX data"
++	},
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_RX_RING0_CTRL0_ADDR,
++	 .ring_size = 512,
++	 .ring_info = "event from WM"
++	},
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_RX_RING1_CTRL0_ADDR,
++	 .ring_size = 1024,
++	 .ring_info = "event from WA"
++	},
++	{
++	 .hw_desc_base = WF_WFDMA_HOST_DMA0_WPDMA_RX_RING2_CTRL0_ADDR,
++	 .ring_size = 1024,
++	 .ring_info = "band0/1/2 tx free done"
++	},
++};
++
++static void
++dump_dma_tx_ring_info(struct seq_file *s, struct mt7996_dev *dev,  char *str1, char *str2, u32 ring_base)
++{
++	u32 base, cnt, cidx, didx, queue_cnt;
++
++	base= mt76_rr(dev, ring_base);
++	cnt = mt76_rr(dev, ring_base + 4);
++	cidx = mt76_rr(dev, ring_base + 8);
++	didx = mt76_rr(dev, ring_base + 12);
++	queue_cnt = (cidx >= didx) ? (cidx - didx) : (cidx - didx + cnt);
++
++	seq_printf(s, "%20s %6s %10x %15x %10x %10x %10x\n", str1, str2, base, cnt, cidx, didx, queue_cnt);
++}
++
++static void
++dump_dma_rx_ring_info(struct seq_file *s, struct mt7996_dev *dev,  char *str1, char *str2, u32 ring_base)
++{
++	u32 base, ctrl1, cnt, cidx, didx, queue_cnt;
++
++	base= mt76_rr(dev, ring_base);
++	ctrl1 = mt76_rr(dev, ring_base + 4);
++	cidx = mt76_rr(dev, ring_base + 8) & 0xfff;
++	didx = mt76_rr(dev, ring_base + 12) & 0xfff;
++	cnt = ctrl1 & 0xfff;
++	queue_cnt = (didx > cidx) ? (didx - cidx - 1) : (didx - cidx + cnt - 1);
++
++	seq_printf(s, "%20s %6s %10x %10x(%3x) %10x %10x %10x\n",
++		   str1, str2, base, ctrl1, cnt, cidx, didx, queue_cnt);
++}
++
++static void
++mt7996_show_dma_info(struct seq_file *s, struct mt7996_dev *dev)
++{
++	u32 sys_ctrl[10];
++
++	/* HOST DMA0 information */
++	sys_ctrl[0] = mt76_rr(dev, WF_WFDMA_HOST_DMA0_HOST_INT_STA_ADDR);
++	sys_ctrl[1] = mt76_rr(dev, WF_WFDMA_HOST_DMA0_HOST_INT_ENA_ADDR);
++	sys_ctrl[2] = mt76_rr(dev, WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_ADDR);
++
++	seq_printf(s, "HOST_DMA Configuration\n");
++	seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
++		"DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
++	seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
++		"DMA0", sys_ctrl[0], sys_ctrl[1], sys_ctrl[2],
++		(sys_ctrl[2] & WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_MASK)
++			>> WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
++		(sys_ctrl[2] & WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_MASK)
++			>> WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
++		(sys_ctrl[2] & WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK)
++			>> WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
++		(sys_ctrl[2] & WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK)
++			>> WF_WFDMA_HOST_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
++
++	if (dev->hif2) {
++		/* HOST DMA1 information */
++		sys_ctrl[0] = mt76_rr(dev, WF_WFDMA_HOST_DMA0_PCIE1_HOST_INT_STA_ADDR);
++		sys_ctrl[1] = mt76_rr(dev, WF_WFDMA_HOST_DMA0_PCIE1_HOST_INT_ENA_ADDR);
++		sys_ctrl[2] = mt76_rr(dev, WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_ADDR);
++
++		seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
++			"DMA0P1", sys_ctrl[0], sys_ctrl[1], sys_ctrl[2],
++			(sys_ctrl[2] & WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_TX_DMA_EN_MASK)
++				>> WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
++			(sys_ctrl[2] & WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_RX_DMA_EN_MASK)
++				>> WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
++			(sys_ctrl[2] & WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK)
++				>> WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
++			(sys_ctrl[2] & WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK)
++				>> WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
++	}
++
++	seq_printf(s, "HOST_DMA0 Ring Configuration\n");
++	seq_printf(s, "%20s %6s %10s %15s %10s %10s %10s\n",
++		"Name", "Used", "Base", "Ctrl1(Cnt)", "CIDX", "DIDX", "QCnt");
++	dump_dma_tx_ring_info(s, dev, "T0:TXD0(H2MAC)", "STA",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING0_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T1:TXD1(H2MAC)", "STA",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING1_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T2:TXD2(H2MAC)", "STA",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING2_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T3:", "STA",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING3_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T4:", "STA",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING4_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T5:", "STA",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING5_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T6:", "STA",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING6_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T16:FWDL", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING16_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T17:Cmd(H2WM)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING17_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T18:TXD0(H2WA)", "AP",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING18_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T19:TXD1(H2WA)", "AP",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING19_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T20:Cmd(H2WA)", "AP",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING20_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T21:TXD2(H2WA)", "AP",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING21_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T22:TXD3(H2WA)", "AP",
++		WF_WFDMA_HOST_DMA0_WPDMA_TX_RING22_CTRL0_ADDR);
++
++
++	dump_dma_rx_ring_info(s, dev, "R0:Event(WM2H)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING0_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R1:Event(WA2H)", "AP",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING1_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R2:TxDone0(WA2H)", "AP",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING2_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R3:TxDone1(WA2H)", "AP",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING3_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R4:Data0(MAC2H)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING4_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R5:Data1(MAC2H)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING5_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R6:BUF1(MAC2H)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING6_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R7:TxDone1(MAC2H)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING7_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R8:BUF0(MAC2H)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING8_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R9:TxDone0(MAC2H)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING9_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R10:MSDU_PG0(MAC2H)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING10_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R11:MSDU_PG1(MAC2H)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING11_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R12:MSDU_PG2(MAC2H)", "Both",
++		WF_WFDMA_HOST_DMA0_WPDMA_RX_RING12_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "IND:IND_CMD(MAC2H)", "Both",
++		WF_RRO_TOP_IND_CMD_0_CTRL0_ADDR);
++
++	if (dev->hif2) {
++		seq_printf(s, "HOST_DMA0 PCIe1 Ring Configuration\n");
++		seq_printf(s, "%20s %6s %10s %15s %10s %10s %10s\n",
++			"Name", "Used", "Base", "Ctrl1(Cnt)", "CIDX", "DIDX", "QCnt");
++		dump_dma_tx_ring_info(s, dev, "T21:TXD2(H2WA)", "AP",
++			WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING21_CTRL0_ADDR);
++		dump_dma_tx_ring_info(s, dev, "T22:TXD?(H2WA)", "AP",
++			WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_TX_RING22_CTRL0_ADDR);
++
++		dump_dma_rx_ring_info(s, dev, "R3:TxDone1(WA2H)", "AP",
++			WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING3_CTRL0_ADDR);
++		dump_dma_rx_ring_info(s, dev, "R5:Data1(MAC2H)", "Both",
++			WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING5_CTRL0_ADDR);
++		dump_dma_rx_ring_info(s, dev, "R6:BUF1(MAC2H)", "Both",
++			WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING6_CTRL0_ADDR);
++		dump_dma_rx_ring_info(s, dev, "R7:TxDone1(MAC2H)", "Both",
++			WF_WFDMA_HOST_DMA0_PCIE1_WPDMA_RX_RING7_CTRL0_ADDR);
++	}
++
++	/* MCU DMA information */
++	sys_ctrl[0] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR);
++	sys_ctrl[1] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_HOST_INT_STA_ADDR);
++	sys_ctrl[2] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_HOST_INT_ENA_ADDR);
++
++	seq_printf(s, "MCU_DMA Configuration\n");
++	seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
++		"DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
++	seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
++		"DMA0", sys_ctrl[1], sys_ctrl[2], sys_ctrl[0],
++		(sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_MASK)
++			>> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
++		(sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_MASK)
++			>> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
++		(sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK)
++			>> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
++		(sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK)
++			>> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
++
++	seq_printf(s, "MCU_DMA0 Ring Configuration\n");
++	seq_printf(s, "%20s %6s %10s %15s %10s %10s %10s\n",
++		"Name", "Used", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++	dump_dma_tx_ring_info(s, dev, "T0:Event(WM2H)", "Both",
++		WF_WFDMA_MCU_DMA0_WPDMA_TX_RING0_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T1:Event(WA2H)", "AP",
++		WF_WFDMA_MCU_DMA0_WPDMA_TX_RING1_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T2:TxDone0(WA2H)", "AP",
++		WF_WFDMA_MCU_DMA0_WPDMA_TX_RING2_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T3:TxDone1(WA2H)", "AP",
++		WF_WFDMA_MCU_DMA0_WPDMA_TX_RING3_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T4:TXD(WM2MAC)", "Both",
++		WF_WFDMA_MCU_DMA0_WPDMA_TX_RING4_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T5:TXCMD(WM2MAC)", "Both",
++		WF_WFDMA_MCU_DMA0_WPDMA_TX_RING5_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T6:TXD(WA2MAC)", "AP",
++		WF_WFDMA_MCU_DMA0_WPDMA_TX_RING6_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R0:FWDL", "Both",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING0_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R1:Cmd(H2WM)", "Both",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING1_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R2:TXD0(H2WA)", "AP",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING2_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R3:TXD1(H2WA)", "AP",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING3_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R4:Cmd(H2WA)", "AP",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING4_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R5:Data0(MAC2WM)", "Both",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING5_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R6:TxDone(MAC2WM)", "Both",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING6_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R7:SPL/RPT(MAC2WM)", "Both",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING7_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R8:TxDone(MAC2WA)", "AP",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING8_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R9:Data1(MAC2WM)", "Both",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING9_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R10:TXD2(H2WA)", "AP",
++		WF_WFDMA_MCU_DMA0_WPDMA_RX_RING10_CTRL0_ADDR);
++
++	/* MEM DMA information */
++	sys_ctrl[0] = mt76_rr(dev, WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_ADDR);
++	sys_ctrl[1] = mt76_rr(dev, WF_WFDMA_MEM_DMA_HOST_INT_STA_ADDR);
++	sys_ctrl[2] = mt76_rr(dev, WF_WFDMA_MEM_DMA_HOST_INT_ENA_ADDR);
++
++	seq_printf(s, "MEM_DMA Configuration\n");
++	seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
++		"DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
++	seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
++		"MEM", sys_ctrl[1], sys_ctrl[2], sys_ctrl[0],
++		(sys_ctrl[0] & WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_MASK)
++			>> WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
++		(sys_ctrl[0] & WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_MASK)
++			>> WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
++		(sys_ctrl[0] & WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK)
++			>> WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
++		(sys_ctrl[0] & WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK)
++			>> WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
++
++	seq_printf(s, "MEM_DMA Ring Configuration\n");
++	seq_printf(s, "%20s %6s %10s %10s %10s %10s %10s\n",
++		"Name", "Used", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++	dump_dma_tx_ring_info(s, dev, "T0:CmdEvent(WM2WA)", "AP",
++		WF_WFDMA_MEM_DMA_WPDMA_TX_RING0_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T1:CmdEvent(WA2WM)", "AP",
++		WF_WFDMA_MEM_DMA_WPDMA_TX_RING1_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R0:CmdEvent(WM2WA)", "AP",
++		WF_WFDMA_MEM_DMA_WPDMA_RX_RING0_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R1:CmdEvent(WA2WM)", "AP",
++		WF_WFDMA_MEM_DMA_WPDMA_RX_RING1_CTRL0_ADDR);
++}
++
++static int mt7996_trinfo_read(struct seq_file *s, void *data)
++{
++	struct mt7996_dev *dev = dev_get_drvdata(s->private);
++	mt7996_show_dma_info(s, dev);
++	return 0;
++}
++
++/* MIB INFO */
++static int mt7996_mibinfo_read_per_band(struct seq_file *s, int band_idx)
++{
++#define BSS_NUM	4
++	struct mt7996_dev *dev = dev_get_drvdata(s->private);
++	u8 bss_nums = BSS_NUM;
++	u32 idx;
++	u32 mac_val, band_offset = 0, band_offset_umib = 0;
++	u32 msdr6, msdr9, msdr18;
++	u32 rvsr0, rscr26, rscr35, mctr5, mctr6, msr0, msr1, msr2;
++	u32 tbcr0, tbcr1, tbcr2, tbcr3, tbcr4;
++	u32 btscr[7];
++	u32 tdrcr[5];
++	u32 mbtocr[16], mbtbcr[16], mbrocr[16], mbrbcr[16];
++	u32 btcr, btbcr, brocr, brbcr, btdcr, brdcr;
++	u32 mu_cnt[5];
++	u32 ampdu_cnt[3];
++	u64 per;
++
++	switch (band_idx) {
++	case 0:
++		band_offset = 0;
++		band_offset_umib = 0;
++		break;
++	case 1:
++		band_offset = BN1_WF_MIB_TOP_BASE - BN0_WF_MIB_TOP_BASE;
++		band_offset_umib = WF_UMIB_TOP_B1BROCR_ADDR - WF_UMIB_TOP_B0BROCR_ADDR;
++		break;
++	case 2:
++		band_offset = IP1_BN0_WF_MIB_TOP_BASE - BN0_WF_MIB_TOP_BASE;
++		band_offset_umib = WF_UMIB_TOP_B2BROCR_ADDR - WF_UMIB_TOP_B0BROCR_ADDR;
++		break;
++	default:
++		return true;
++	}
++
++	seq_printf(s, "Band %d MIB Status\n", band_idx);
++	seq_printf(s, "===============================\n");
++	mac_val = mt76_rr(dev, BN0_WF_MIB_TOP_M0SCR0_ADDR + band_offset);
++	seq_printf(s, "MIB Status Control=0x%x\n", mac_val);
++
++	msdr6 = mt76_rr(dev, BN0_WF_MIB_TOP_M0SDR6_ADDR + band_offset);
++	rvsr0 = mt76_rr(dev, BN0_WF_MIB_TOP_RVSR0_ADDR + band_offset);
++	rscr35 = mt76_rr(dev, BN0_WF_MIB_TOP_RSCR35_ADDR + band_offset);
++	msdr9 = mt76_rr(dev, BN0_WF_MIB_TOP_M0SDR9_ADDR + band_offset);
++	rscr26 = mt76_rr(dev, BN0_WF_MIB_TOP_RSCR26_ADDR + band_offset);
++	mctr5 = mt76_rr(dev, BN0_WF_MIB_TOP_MCTR5_ADDR + band_offset);
++	mctr6 = mt76_rr(dev, BN0_WF_MIB_TOP_MCTR6_ADDR + band_offset);
++	msdr18 = mt76_rr(dev, BN0_WF_MIB_TOP_M0SDR18_ADDR + band_offset);
++	msr0 = mt76_rr(dev, BN0_WF_MIB_TOP_MSR0_ADDR + band_offset);
++	msr1 = mt76_rr(dev, BN0_WF_MIB_TOP_MSR1_ADDR + band_offset);
++	msr2 = mt76_rr(dev, BN0_WF_MIB_TOP_MSR2_ADDR + band_offset);
++	ampdu_cnt[0] = mt76_rr(dev, BN0_WF_MIB_TOP_TSCR0_ADDR + band_offset);
++	ampdu_cnt[1] = mt76_rr(dev, BN0_WF_MIB_TOP_TSCR3_ADDR + band_offset);
++	ampdu_cnt[2] = mt76_rr(dev, BN0_WF_MIB_TOP_TSCR4_ADDR + band_offset);
++	ampdu_cnt[1] &= BN0_WF_MIB_TOP_TSCR3_AMPDU_MPDU_COUNT_MASK;
++	ampdu_cnt[2] &= BN0_WF_MIB_TOP_TSCR4_AMPDU_ACKED_COUNT_MASK;
++
++	seq_printf(s, "===Phy/Timing Related Counters===\n");
++	seq_printf(s, "\tChannelIdleCnt=0x%x\n",
++		msdr6 & BN0_WF_MIB_TOP_M0SDR6_CHANNEL_IDLE_COUNT_MASK);
++	seq_printf(s, "\tCCA_NAV_Tx_Time=0x%x\n",
++		msdr9 & BN0_WF_MIB_TOP_M0SDR9_CCA_NAV_TX_TIME_MASK);
++	seq_printf(s, "\tRx_MDRDY_CNT=0x%x\n",
++		rscr26 & BN0_WF_MIB_TOP_RSCR26_RX_MDRDY_COUNT_MASK);
++	seq_printf(s, "\tCCK_MDRDY_TIME=0x%x, OFDM_MDRDY_TIME=0x%x",
++		msr0 & BN0_WF_MIB_TOP_MSR0_CCK_MDRDY_TIME_MASK,
++		msr1 & BN0_WF_MIB_TOP_MSR1_OFDM_LG_MIXED_VHT_MDRDY_TIME_MASK);
++	seq_printf(s, ", OFDM_GREEN_MDRDY_TIME=0x%x\n",
++		msr2 & BN0_WF_MIB_TOP_MSR2_OFDM_GREEN_MDRDY_TIME_MASK);
++	seq_printf(s, "\tPrim CCA Time=0x%x\n",
++		mctr5 & BN0_WF_MIB_TOP_MCTR5_P_CCA_TIME_MASK);
++	seq_printf(s, "\tSec CCA Time=0x%x\n",
++		mctr6 & BN0_WF_MIB_TOP_MCTR6_S_CCA_TIME_MASK);
++	seq_printf(s, "\tPrim ED Time=0x%x\n",
++		msdr18 & BN0_WF_MIB_TOP_M0SDR18_P_ED_TIME_MASK);
++
++	seq_printf(s, "===Tx Related Counters(Generic)===\n");
++	mac_val = mt76_rr(dev, BN0_WF_MIB_TOP_TSCR18_ADDR + band_offset);
++	dev->dbg.bcn_total_cnt[band_idx] +=
++		(mac_val & BN0_WF_MIB_TOP_TSCR18_BEACONTXCOUNT_MASK);
++	seq_printf(s, "\tBeaconTxCnt=0x%x\n", dev->dbg.bcn_total_cnt[band_idx]);
++	dev->dbg.bcn_total_cnt[band_idx] = 0;
++
++	tbcr0 = mt76_rr(dev, BN0_WF_MIB_TOP_TBCR0_ADDR + band_offset);
++	seq_printf(s, "\tTx 20MHz Cnt=0x%x\n",
++		tbcr0 & BN0_WF_MIB_TOP_TBCR0_TX_20MHZ_CNT_MASK);
++	tbcr1 = mt76_rr(dev, BN0_WF_MIB_TOP_TBCR1_ADDR + band_offset);
++	seq_printf(s, "\tTx 40MHz Cnt=0x%x\n",
++		tbcr1 & BN0_WF_MIB_TOP_TBCR1_TX_40MHZ_CNT_MASK);
++	tbcr2 = mt76_rr(dev, BN0_WF_MIB_TOP_TBCR2_ADDR + band_offset);
++	seq_printf(s, "\tTx 80MHz Cnt=0x%x\n",
++		tbcr2 & BN0_WF_MIB_TOP_TBCR2_TX_80MHZ_CNT_MASK);
++	tbcr3 = mt76_rr(dev, BN0_WF_MIB_TOP_TBCR3_ADDR + band_offset);
++	seq_printf(s, "\tTx 160MHz Cnt=0x%x\n",
++		tbcr3 & BN0_WF_MIB_TOP_TBCR3_TX_160MHZ_CNT_MASK);
++	tbcr4 = mt76_rr(dev, BN0_WF_MIB_TOP_TBCR4_ADDR + band_offset);
++	seq_printf(s, "\tTx 320MHz Cnt=0x%x\n",
++		tbcr4 & BN0_WF_MIB_TOP_TBCR4_TX_320MHZ_CNT_MASK);
++	seq_printf(s, "\tAMPDU Cnt=0x%x\n", ampdu_cnt[0]);
++	seq_printf(s, "\tAMPDU MPDU Cnt=0x%x\n", ampdu_cnt[1]);
++	seq_printf(s, "\tAMPDU MPDU Ack Cnt=0x%x\n", ampdu_cnt[2]);
++	per = (ampdu_cnt[2] == 0 ?
++		0 : 1000 * (ampdu_cnt[1] - ampdu_cnt[2]) / ampdu_cnt[1]);
++	seq_printf(s, "\tAMPDU MPDU PER=%llu.%1llu%%\n", per / 10, per % 10);
++
++	seq_printf(s, "===MU Related Counters===\n");
++	mu_cnt[0] = mt76_rr(dev, BN0_WF_MIB_TOP_BSCR2_ADDR + band_offset);
++	mu_cnt[1] = mt76_rr(dev, BN0_WF_MIB_TOP_TSCR5_ADDR + band_offset);
++	mu_cnt[2] = mt76_rr(dev, BN0_WF_MIB_TOP_TSCR6_ADDR + band_offset);
++	mu_cnt[3] = mt76_rr(dev, BN0_WF_MIB_TOP_TSCR8_ADDR + band_offset);
++	mu_cnt[4] = mt76_rr(dev, BN0_WF_MIB_TOP_TSCR7_ADDR + band_offset);
++
++	seq_printf(s, "\tMUBF_TX_COUNT=0x%x\n",
++		mu_cnt[0] & BN0_WF_MIB_TOP_BSCR2_MUBF_TX_COUNT_MASK);
++	seq_printf(s, "\tMU_TX_MPDU_COUNT(Ok+Fail)=0x%x\n", mu_cnt[1]);
++	seq_printf(s, "\tMU_TX_OK_MPDU_COUNT=0x%x\n", mu_cnt[2]);
++	seq_printf(s, "\tMU_TO_MU_FAIL_PPDU_COUNT=0x%x\n", mu_cnt[3]);
++	seq_printf(s, "\tSU_TX_OK_MPDU_COUNT=0x%x\n", mu_cnt[4]);
++
++	seq_printf(s, "===Rx Related Counters(Generic)===\n");
++	seq_printf(s, "\tVector Mismacth Cnt=0x%x\n",
++		rvsr0 & BN0_WF_MIB_TOP_RVSR0_VEC_MISS_COUNT_MASK);
++	seq_printf(s, "\tDelimiter Fail Cnt=0x%x\n",
++		rscr35 & BN0_WF_MIB_TOP_RSCR35_DELIMITER_FAIL_COUNT_MASK);
++
++	mac_val = mt76_rr(dev, BN0_WF_MIB_TOP_RSCR1_ADDR + band_offset);
++	seq_printf(s, "\tRxFCSErrCnt=0x%x\n",
++		(mac_val & BN0_WF_MIB_TOP_RSCR1_RX_FCS_ERROR_COUNT_MASK));
++	mac_val = mt76_rr(dev, BN0_WF_MIB_TOP_RSCR33_ADDR + band_offset);
++	seq_printf(s, "\tRxFifoFullCnt=0x%x\n",
++		(mac_val & BN0_WF_MIB_TOP_RSCR33_RX_FIFO_FULL_COUNT_MASK));
++	mac_val = mt76_rr(dev, BN0_WF_MIB_TOP_RSCR36_ADDR + band_offset);
++	seq_printf(s, "\tRxLenMismatch=0x%x\n",
++		(mac_val & BN0_WF_MIB_TOP_RSCR36_RX_LEN_MISMATCH_MASK));
++	mac_val = mt76_rr(dev, BN0_WF_MIB_TOP_RSCR31_ADDR + band_offset);
++	seq_printf(s, "\tRxMPDUCnt=0x%x\n",
++		(mac_val & BN0_WF_MIB_TOP_RSCR31_RX_MPDU_COUNT_MASK));
++	mac_val = mt76_rr(dev, BN0_WF_MIB_TOP_RSCR27_ADDR + band_offset);
++	seq_printf(s, "\tRx AMPDU Cnt=0x%x\n", mac_val);
++	mac_val = mt76_rr(dev, BN0_WF_MIB_TOP_RSCR28_ADDR + band_offset);
++	seq_printf(s, "\tRx Total ByteCnt=0x%x\n", mac_val);
++
++
++	/* Per-BSS T/RX Counters */
++	seq_printf(s, "===Per-BSS Related Tx/Rx Counters===\n");
++	seq_printf(s, "BSS Idx TxCnt/DataCnt TxByteCnt RxOkCnt/DataCnt RxByteCnt\n");
++	for (idx = 0; idx < bss_nums; idx++) {
++		btcr = mt76_rr(dev, BN0_WF_MIB_TOP_BTCR_ADDR + band_offset + idx * 4);
++		btdcr = mt76_rr(dev, BN0_WF_MIB_TOP_BTDCR_ADDR + band_offset + idx * 4);
++		btbcr = mt76_rr(dev, BN0_WF_MIB_TOP_BTBCR_ADDR + band_offset + idx * 4);
++
++		brocr = mt76_rr(dev, WF_UMIB_TOP_B0BROCR_ADDR + band_offset_umib + idx * 4);
++		brdcr = mt76_rr(dev, WF_UMIB_TOP_B0BRDCR_ADDR + band_offset_umib + idx * 4);
++		brbcr = mt76_rr(dev, WF_UMIB_TOP_B0BRBCR_ADDR + band_offset_umib + idx * 4);
++
++		seq_printf(s, "%d\t 0x%x/0x%x\t 0x%x \t 0x%x/0x%x \t 0x%x\n",
++			idx, btcr, btdcr, btbcr, brocr, brdcr, brbcr);
++	}
++
++	seq_printf(s, "===Per-BSS Related MIB Counters===\n");
++	seq_printf(s, "BSS Idx RTSTx/RetryCnt BAMissCnt AckFailCnt FrmRetry1/2/3Cnt\n");
++
++	/* Per-BSS TX Status */
++	for (idx = 0; idx < bss_nums; idx++) {
++		btscr[0] = mt76_rr(dev, BN0_WF_MIB_TOP_BTSCR5_ADDR + band_offset + idx * 4);
++		btscr[1] = mt76_rr(dev, BN0_WF_MIB_TOP_BTSCR6_ADDR + band_offset + idx * 4);
++		btscr[2] = mt76_rr(dev, BN0_WF_MIB_TOP_BTSCR0_ADDR + band_offset + idx * 4);
++		btscr[3] = mt76_rr(dev, BN0_WF_MIB_TOP_BTSCR1_ADDR + band_offset + idx * 4);
++		btscr[4] = mt76_rr(dev, BN0_WF_MIB_TOP_BTSCR2_ADDR + band_offset + idx * 4);
++		btscr[5] = mt76_rr(dev, BN0_WF_MIB_TOP_BTSCR3_ADDR + band_offset + idx * 4);
++		btscr[6] = mt76_rr(dev, BN0_WF_MIB_TOP_BTSCR4_ADDR + band_offset + idx * 4);
++
++		seq_printf(s, "%d:\t0x%x/0x%x  0x%x \t 0x%x \t  0x%x/0x%x/0x%x\n",
++			idx, (btscr[0] & BN0_WF_MIB_TOP_BTSCR5_RTSTXCOUNTn_MASK),
++			(btscr[1] & BN0_WF_MIB_TOP_BTSCR6_RTSRETRYCOUNTn_MASK),
++			(btscr[2] & BN0_WF_MIB_TOP_BTSCR0_BAMISSCOUNTn_MASK),
++			(btscr[3] & BN0_WF_MIB_TOP_BTSCR1_ACKFAILCOUNTn_MASK),
++			(btscr[4] & BN0_WF_MIB_TOP_BTSCR2_FRAMERETRYCOUNTn_MASK),
++			(btscr[5] & BN0_WF_MIB_TOP_BTSCR3_FRAMERETRY2COUNTn_MASK),
++			(btscr[6] & BN0_WF_MIB_TOP_BTSCR4_FRAMERETRY3COUNTn_MASK));
++	}
++
++	/* Dummy delimiter insertion result */
++	seq_printf(s, "===Dummy delimiter insertion result===\n");
++	tdrcr[0] = mt76_rr(dev, BN0_WF_MIB_TOP_TDRCR0_ADDR + band_offset);
++	tdrcr[1] = mt76_rr(dev, BN0_WF_MIB_TOP_TDRCR1_ADDR + band_offset);
++	tdrcr[2] = mt76_rr(dev, BN0_WF_MIB_TOP_TDRCR2_ADDR + band_offset);
++	tdrcr[3] = mt76_rr(dev, BN0_WF_MIB_TOP_TDRCR3_ADDR + band_offset);
++	tdrcr[4] = mt76_rr(dev, BN0_WF_MIB_TOP_TDRCR4_ADDR + band_offset);
++
++	seq_printf(s, "Range0 = %d\t Range1 = %d\t Range2 = %d\t Range3 = %d\t Range4 = %d\n",
++		tdrcr[0],
++		tdrcr[1],
++		tdrcr[2],
++		tdrcr[3],
++		tdrcr[4]);
++
++	/* Per-MBSS T/RX Counters */
++	seq_printf(s, "===Per-MBSS Related Tx/Rx Counters===\n");
++	seq_printf(s, "MBSSIdx   TxOkCnt  TxByteCnt  RxOkCnt  RxByteCnt\n");
++
++	for (idx = 0; idx < 16; idx++) {
++		mbtocr[idx] = mt76_rr(dev, BN0_WF_MIB_TOP_BTOCR_ADDR + band_offset + (bss_nums + idx) * 4);
++		mbtbcr[idx] = mt76_rr(dev, BN0_WF_MIB_TOP_BTBCR_ADDR + band_offset + (bss_nums + idx) * 4);
++
++		mbrocr[idx] = mt76_rr(dev, WF_UMIB_TOP_B0BROCR_ADDR + band_offset_umib + (bss_nums + idx) * 4);
++		mbrbcr[idx] = mt76_rr(dev, WF_UMIB_TOP_B0BRBCR_ADDR + band_offset_umib + (bss_nums + idx) * 4);
++	}
++
++	for (idx = 0; idx < 16; idx++) {
++		seq_printf(s, "%d\t 0x%x\t 0x%x \t 0x%x \t 0x%x\n",
++			idx, mbtocr[idx], mbtbcr[idx], mbrocr[idx], mbrbcr[idx]);
++	}
++
++	return 0;
++}
++
++static int mt7996_mibinfo_band0(struct seq_file *s, void *data)
++{
++	mt7996_mibinfo_read_per_band(s, MT_BAND0);
++	return 0;
++}
++
++static int mt7996_mibinfo_band1(struct seq_file *s, void *data)
++{
++	mt7996_mibinfo_read_per_band(s, MT_BAND1);
++	return 0;
++}
++
++static int mt7996_mibinfo_band2(struct seq_file *s, void *data)
++{
++	mt7996_mibinfo_read_per_band(s, MT_BAND2);
++	return 0;
++}
++
++/* WTBL INFO */
++static int
++mt7996_wtbl_read_raw(struct mt7996_dev *dev, u16 idx,
++		     enum mt7996_wtbl_type type, u16 start_dw,
++		     u16 len, void *buf)
++{
++	u32 *dest_cpy = (u32 *)buf;
++	u32 size_dw = len;
++	u32 src = 0;
++
++	if (!buf)
++		return 0xFF;
++
++	if (type == WTBL_TYPE_LMAC) {
++		mt76_wr(dev, MT_DBG_WTBLON_TOP_WDUCR_ADDR,
++			FIELD_PREP(MT_DBG_WTBLON_TOP_WDUCR_GROUP, (idx >> 7)));
++		src = LWTBL_IDX2BASE(idx, start_dw);
++	} else if (type == WTBL_TYPE_UMAC) {
++		mt76_wr(dev,  MT_DBG_UWTBL_TOP_WDUCR_ADDR,
++			FIELD_PREP(MT_DBG_UWTBL_TOP_WDUCR_GROUP, (idx >> 7)));
++		src = UWTBL_IDX2BASE(idx, start_dw);
++	} else if (type == WTBL_TYPE_KEY) {
++		mt76_wr(dev,  MT_DBG_UWTBL_TOP_WDUCR_ADDR,
++			MT_DBG_UWTBL_TOP_WDUCR_TARGET |
++			FIELD_PREP(MT_DBG_UWTBL_TOP_WDUCR_GROUP, (idx >> 7)));
++		src = KEYTBL_IDX2BASE(idx, start_dw);
++	}
++
++	while (size_dw--) {
++		*dest_cpy++ = mt76_rr(dev, src);
++		src += 4;
++	};
++
++	return 0;
++}
++
++#if 0
++static int
++mt7996_wtbl_write_raw(struct mt7996_dev *dev, u16 idx,
++			  enum mt7996_wtbl_type type, u16 start_dw,
++			  u32 val)
++{
++	u32 addr = 0;
++
++	if (type == WTBL_TYPE_LMAC) {
++		mt76_wr(dev, MT_DBG_WTBLON_TOP_WDUCR_ADDR,
++			FIELD_PREP(MT_DBG_WTBLON_TOP_WDUCR_GROUP, (idx >> 7)));
++		addr = LWTBL_IDX2BASE(idx, start_dw);
++	} else if (type == WTBL_TYPE_UMAC) {
++		mt76_wr(dev, MT_DBG_UWTBL_TOP_WDUCR_ADDR,
++			FIELD_PREP(MT_DBG_UWTBL_TOP_WDUCR_GROUP, (idx >> 7)));
++		addr = UWTBL_IDX2BASE(idx, start_dw);
++	} else if (type == WTBL_TYPE_KEY) {
++		mt76_wr(dev, MT_DBG_UWTBL_TOP_WDUCR_ADDR,
++			MT_DBG_UWTBL_TOP_WDUCR_TARGET |
++			FIELD_PREP(MT_DBG_UWTBL_TOP_WDUCR_GROUP, (idx >> 7)));
++		addr = KEYTBL_IDX2BASE(idx, start_dw);
++	}
++
++	mt76_wr(dev, addr, val);
++
++	return 0;
++}
++#endif
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW0[] = {
++	{"MUAR_IDX",    WF_LWTBL_MUAR_MASK, WF_LWTBL_MUAR_SHIFT,false},
++	{"RCA1",        WF_LWTBL_RCA1_MASK, NO_SHIFT_DEFINE,	false},
++	{"KID",         WF_LWTBL_KID_MASK,  WF_LWTBL_KID_SHIFT,	false},
++	{"RCID",        WF_LWTBL_RCID_MASK, NO_SHIFT_DEFINE,	false},
++	{"BAND",        WF_LWTBL_BAND_MASK, WF_LWTBL_BAND_SHIFT,false},
++	{"RV",          WF_LWTBL_RV_MASK,   NO_SHIFT_DEFINE,	false},
++	{"RCA2",        WF_LWTBL_RCA2_MASK, NO_SHIFT_DEFINE,	false},
++	{"WPI_FLAG",    WF_LWTBL_WPI_FLAG_MASK, NO_SHIFT_DEFINE,true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw0_1(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LinkAddr: %02x:%02x:%02x:%02x:%02x:%02x(D0[B0~15], D1[B0~31])\n",
++		lwtbl[4], lwtbl[5], lwtbl[6], lwtbl[7], lwtbl[0], lwtbl[1]);
++
++	/* LMAC WTBL DW 0 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 0/1\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_PEER_INFO_DW_0*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW0[i].name) {
++
++		if (WTBL_LMAC_DW0[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW0[i].name,
++					 (dw_value & WTBL_LMAC_DW0[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW0[i].name,
++					  (dw_value & WTBL_LMAC_DW0[i].mask) >> WTBL_LMAC_DW0[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW2[] = {
++	{"AID",                 WF_LWTBL_AID_MASK,              WF_LWTBL_AID_SHIFT,	false},
++	{"GID_SU",              WF_LWTBL_GID_SU_MASK,           NO_SHIFT_DEFINE,	false},
++	{"SPP_EN",              WF_LWTBL_SPP_EN_MASK,           NO_SHIFT_DEFINE,	false},
++	{"WPI_EVEN",            WF_LWTBL_WPI_EVEN_MASK,         NO_SHIFT_DEFINE,	false},
++	{"AAD_OM",              WF_LWTBL_AAD_OM_MASK,           NO_SHIFT_DEFINE,	false},
++	{"CIPHER_PGTK",WF_LWTBL_CIPHER_SUIT_PGTK_MASK, WF_LWTBL_CIPHER_SUIT_PGTK_SHIFT,	true},
++	{"FROM_DS",             WF_LWTBL_FD_MASK,               NO_SHIFT_DEFINE,	false},
++	{"TO_DS",               WF_LWTBL_TD_MASK,               NO_SHIFT_DEFINE,	false},
++	{"SW",                  WF_LWTBL_SW_MASK,               NO_SHIFT_DEFINE,	false},
++	{"UL",                  WF_LWTBL_UL_MASK,               NO_SHIFT_DEFINE,	false},
++	{"TX_POWER_SAVE",       WF_LWTBL_TX_PS_MASK,            NO_SHIFT_DEFINE,	true},
++	{"QOS",                 WF_LWTBL_QOS_MASK,              NO_SHIFT_DEFINE,	false},
++	{"HT",                  WF_LWTBL_HT_MASK,               NO_SHIFT_DEFINE,	false},
++	{"VHT",                 WF_LWTBL_VHT_MASK,              NO_SHIFT_DEFINE,	false},
++	{"HE",                  WF_LWTBL_HE_MASK,               NO_SHIFT_DEFINE,	false},
++	{"EHT",                 WF_LWTBL_EHT_MASK,              NO_SHIFT_DEFINE,	false},
++	{"MESH",                WF_LWTBL_MESH_MASK,             NO_SHIFT_DEFINE,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw2(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 2 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 2\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_TRX_CAP_DW_2*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW2[i].name) {
++
++		if (WTBL_LMAC_DW2[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW2[i].name,
++					 (dw_value & WTBL_LMAC_DW2[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW2[i].name,
++					  (dw_value & WTBL_LMAC_DW2[i].mask) >> WTBL_LMAC_DW2[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW3[] = {
++	{"WMM_Q",           WF_LWTBL_WMM_Q_MASK,		WF_LWTBL_WMM_Q_SHIFT,		false},
++	{"EHT_SIG_MCS",     WF_LWTBL_EHT_SIG_MCS_MASK,		WF_LWTBL_EHT_SIG_MCS_SHIFT,	false},
++	{"HDRT_MODE",       WF_LWTBL_HDRT_MODE_MASK,		NO_SHIFT_DEFINE,		false},
++	{"BEAM_CHG",        WF_LWTBL_BEAM_CHG_MASK,		NO_SHIFT_DEFINE,		false},
++	{"EHT_LTF_SYM_NUM", WF_LWTBL_EHT_LTF_SYM_NUM_OPT_MASK,  WF_LWTBL_EHT_LTF_SYM_NUM_OPT_SHIFT,	true},
++	{"PFMU_IDX",	    WF_LWTBL_PFMU_IDX_MASK,		WF_LWTBL_PFMU_IDX_SHIFT,	false},
++	{"ULPF_IDX",	    WF_LWTBL_ULPF_IDX_MASK,		WF_LWTBL_ULPF_IDX_SHIFT,	false},
++	{"RIBF",	    WF_LWTBL_RIBF_MASK,			NO_SHIFT_DEFINE,		false},
++	{"ULPF",	    WF_LWTBL_ULPF_MASK,			NO_SHIFT_DEFINE,		true},
++	{"TBF_HT",          WF_LWTBL_TBF_HT_MASK,		NO_SHIFT_DEFINE,		false},
++	{"TBF_VHT",         WF_LWTBL_TBF_VHT_MASK,		NO_SHIFT_DEFINE,		false},
++	{"TBF_HE",          WF_LWTBL_TBF_HE_MASK,		NO_SHIFT_DEFINE,		false},
++	{"TBF_EHT",         WF_LWTBL_TBF_EHT_MASK,		NO_SHIFT_DEFINE,		false},
++	{"IGN_FBK",         WF_LWTBL_IGN_FBK_MASK,		NO_SHIFT_DEFINE,		true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw3(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 3 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 3\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_TRX_CAP_DW_3*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW3[i].name) {
++
++		if (WTBL_LMAC_DW3[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW3[i].name,
++					 (dw_value & WTBL_LMAC_DW3[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW3[i].name,
++					  (dw_value & WTBL_LMAC_DW3[i].mask) >> WTBL_LMAC_DW3[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW4[] = {
++	{"ANT_ID_STS0",     WF_LWTBL_ANT_ID0_MASK,      WF_LWTBL_ANT_ID0_SHIFT,	false},
++	{"STS1",            WF_LWTBL_ANT_ID1_MASK,      WF_LWTBL_ANT_ID1_SHIFT,	false},
++	{"STS2",            WF_LWTBL_ANT_ID2_MASK,      WF_LWTBL_ANT_ID2_SHIFT,	false},
++	{"STS3",            WF_LWTBL_ANT_ID3_MASK,      WF_LWTBL_ANT_ID3_SHIFT,	true},
++	{"ANT_ID_STS4",     WF_LWTBL_ANT_ID4_MASK,      WF_LWTBL_ANT_ID4_SHIFT,	false},
++	{"STS5",            WF_LWTBL_ANT_ID5_MASK,      WF_LWTBL_ANT_ID5_SHIFT,	false},
++	{"STS6",            WF_LWTBL_ANT_ID6_MASK,      WF_LWTBL_ANT_ID6_SHIFT,	false},
++	{"STS7",            WF_LWTBL_ANT_ID7_MASK,      WF_LWTBL_ANT_ID7_SHIFT,	true},
++	{"PE",              WF_LWTBL_PE_MASK,           WF_LWTBL_PE_SHIFT,	false},
++	{"DIS_RHTR",        WF_LWTBL_DIS_RHTR_MASK,     NO_SHIFT_DEFINE,	false},
++	{"LDPC_HT",         WF_LWTBL_LDPC_HT_MASK,      NO_SHIFT_DEFINE,	false},
++	{"LDPC_VHT",        WF_LWTBL_LDPC_VHT_MASK,     NO_SHIFT_DEFINE,	false},
++	{"LDPC_HE",         WF_LWTBL_LDPC_HE_MASK,      NO_SHIFT_DEFINE,	false},
++	{"LDPC_EHT",	    WF_LWTBL_LDPC_EHT_MASK,	NO_SHIFT_DEFINE,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw4(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 4 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 4\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_TRX_CAP_DW_4*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW4[i].name) {
++		if (WTBL_LMAC_DW4[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW4[i].name,
++					 (dw_value & WTBL_LMAC_DW4[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW4[i].name,
++					  (dw_value & WTBL_LMAC_DW4[i].mask) >> WTBL_LMAC_DW4[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW5[] = {
++	{"AF",                  WF_LWTBL_AF_MASK,           WF_LWTBL_AF_SHIFT,	false},
++	{"AF_HE",               WF_LWTBL_AF_HE_MASK,        WF_LWTBL_AF_HE_SHIFT,false},
++	{"RTS",                 WF_LWTBL_RTS_MASK,          NO_SHIFT_DEFINE,	false},
++	{"SMPS",                WF_LWTBL_SMPS_MASK,         NO_SHIFT_DEFINE,	false},
++	{"DYN_BW",              WF_LWTBL_DYN_BW_MASK,       NO_SHIFT_DEFINE,	true},
++	{"MMSS",                WF_LWTBL_MMSS_MASK,         WF_LWTBL_MMSS_SHIFT,false},
++	{"USR",                 WF_LWTBL_USR_MASK,          NO_SHIFT_DEFINE,	false},
++	{"SR_RATE",             WF_LWTBL_SR_R_MASK,         WF_LWTBL_SR_R_SHIFT,false},
++	{"SR_ABORT",            WF_LWTBL_SR_ABORT_MASK,     NO_SHIFT_DEFINE,	true},
++	{"TX_POWER_OFFSET",     WF_LWTBL_TX_POWER_OFFSET_MASK,  WF_LWTBL_TX_POWER_OFFSET_SHIFT,	false},
++	{"LTF_EHT",		WF_LWTBL_LTF_EHT_MASK,      WF_LWTBL_LTF_EHT_SHIFT, false},
++	{"GI_EHT",		WF_LWTBL_GI_EHT_MASK,       WF_LWTBL_GI_EHT_SHIFT, false},
++	{"DOPPL",               WF_LWTBL_DOPPL_MASK,        NO_SHIFT_DEFINE,	false},
++	{"TXOP_PS_CAP",         WF_LWTBL_TXOP_PS_CAP_MASK,  NO_SHIFT_DEFINE,	false},
++	{"DONOT_UPDATE_I_PSM",  WF_LWTBL_DU_I_PSM_MASK,     NO_SHIFT_DEFINE,	true},
++	{"I_PSM",               WF_LWTBL_I_PSM_MASK,        NO_SHIFT_DEFINE,	false},
++	{"PSM",                 WF_LWTBL_PSM_MASK,          NO_SHIFT_DEFINE,	false},
++	{"SKIP_TX",             WF_LWTBL_SKIP_TX_MASK,      NO_SHIFT_DEFINE,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw5(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 5 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 5\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_TRX_CAP_DW_5*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW5[i].name) {
++		if (WTBL_LMAC_DW5[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW5[i].name,
++					 (dw_value & WTBL_LMAC_DW5[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW5[i].name,
++					  (dw_value & WTBL_LMAC_DW5[i].mask) >> WTBL_LMAC_DW5[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW6[] = {
++	{"CBRN",        WF_LWTBL_CBRN_MASK,	    WF_LWTBL_CBRN_SHIFT,	false},
++	{"DBNSS_EN",    WF_LWTBL_DBNSS_EN_MASK, NO_SHIFT_DEFINE,	false},
++	{"BAF_EN",      WF_LWTBL_BAF_EN_MASK,   NO_SHIFT_DEFINE,	false},
++	{"RDGBA",       WF_LWTBL_RDGBA_MASK,    NO_SHIFT_DEFINE,	false},
++	{"RDG",         WF_LWTBL_R_MASK,        NO_SHIFT_DEFINE,	false},
++	{"SPE_IDX",     WF_LWTBL_SPE_IDX_MASK,  WF_LWTBL_SPE_IDX_SHIFT,	true},
++	{"G2",          WF_LWTBL_G2_MASK,       NO_SHIFT_DEFINE,	false},
++	{"G4",          WF_LWTBL_G4_MASK,       NO_SHIFT_DEFINE,	false},
++	{"G8",          WF_LWTBL_G8_MASK,       NO_SHIFT_DEFINE,	false},
++	{"G16",         WF_LWTBL_G16_MASK,      NO_SHIFT_DEFINE,	true},
++	{"G2_LTF",      WF_LWTBL_G2_LTF_MASK,   WF_LWTBL_G2_LTF_SHIFT,	false},
++	{"G4_LTF",      WF_LWTBL_G4_LTF_MASK,   WF_LWTBL_G4_LTF_SHIFT,	false},
++	{"G8_LTF",      WF_LWTBL_G8_LTF_MASK,   WF_LWTBL_G8_LTF_SHIFT,	false},
++	{"G16_LTF",     WF_LWTBL_G16_LTF_MASK,  WF_LWTBL_G16_LTF_SHIFT,	true},
++	{"G2_HE",       WF_LWTBL_G2_HE_MASK,    WF_LWTBL_G2_HE_SHIFT,	false},
++	{"G4_HE",       WF_LWTBL_G4_HE_MASK,    WF_LWTBL_G4_HE_SHIFT,	false},
++	{"G8_HE",       WF_LWTBL_G8_HE_MASK,    WF_LWTBL_G8_HE_SHIFT,	false},
++	{"G16_HE",      WF_LWTBL_G16_HE_MASK,   WF_LWTBL_G16_HE_SHIFT,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw6(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 6 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 6\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_TRX_CAP_DW_6*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW6[i].name) {
++		if (WTBL_LMAC_DW6[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW6[i].name,
++					 (dw_value & WTBL_LMAC_DW6[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW6[i].name,
++					  (dw_value & WTBL_LMAC_DW6[i].mask) >> WTBL_LMAC_DW6[i].shift);
++		i++;
++	}
++}
++
++static void parse_fmac_lwtbl_dw7(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	int i = 0;
++
++	/* LMAC WTBL DW 7 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 7\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_TRX_CAP_DW_7*4]);
++	dw_value = *addr;
++
++	for (i = 0; i < 8; i++) {
++		seq_printf(s, "\tBA_WIN_SIZE%u:%lu\n", i, ((dw_value & BITS(i*4, i*4+3)) >> i*4));
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW8[] = {
++	{"RTS_FAIL_CNT_AC0",    WF_LWTBL_AC0_RTS_FAIL_CNT_MASK,	WF_LWTBL_AC0_RTS_FAIL_CNT_SHIFT,	false},
++	{"AC1",                 WF_LWTBL_AC1_RTS_FAIL_CNT_MASK,	WF_LWTBL_AC1_RTS_FAIL_CNT_SHIFT,	false},
++	{"AC2",                 WF_LWTBL_AC2_RTS_FAIL_CNT_MASK,	WF_LWTBL_AC2_RTS_FAIL_CNT_SHIFT,	false},
++	{"AC3",                 WF_LWTBL_AC3_RTS_FAIL_CNT_MASK,	WF_LWTBL_AC3_RTS_FAIL_CNT_SHIFT,	true},
++	{"PARTIAL_AID",         WF_LWTBL_PARTIAL_AID_MASK,		WF_LWTBL_PARTIAL_AID_SHIFT,	false},
++	{"CHK_PER",             WF_LWTBL_CHK_PER_MASK,		NO_SHIFT_DEFINE,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw8(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 8 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 8\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_TRX_CAP_DW_8*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW8[i].name) {
++		if (WTBL_LMAC_DW8[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW8[i].name,
++					 (dw_value & WTBL_LMAC_DW8[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW8[i].name,
++					  (dw_value & WTBL_LMAC_DW8[i].mask) >> WTBL_LMAC_DW8[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW9[] = {
++	{"RX_AVG_MPDU_SIZE",    WF_LWTBL_RX_AVG_MPDU_SIZE_MASK,    WF_LWTBL_RX_AVG_MPDU_SIZE_SHIFT,	false},
++	{"PRITX_SW_MODE",       WF_LWTBL_PRITX_SW_MODE_MASK,       NO_SHIFT_DEFINE,	false},
++	{"PRITX_ERSU",	    WF_LWTBL_PRITX_ERSU_MASK,	       NO_SHIFT_DEFINE,	false},
++	{"PRITX_PLR",           WF_LWTBL_PRITX_PLR_MASK,           NO_SHIFT_DEFINE,	true},
++	{"PRITX_DCM",           WF_LWTBL_PRITX_DCM_MASK,           NO_SHIFT_DEFINE,	false},
++	{"PRITX_ER106T",        WF_LWTBL_PRITX_ER106T_MASK,        NO_SHIFT_DEFINE,	true},
++	/* {"FCAP(0:20 1:~40)",    WTBL_FCAP_20_TO_160_MHZ,	WTBL_FCAP_20_TO_160_MHZ_OFFSET}, */
++	{"MPDU_FAIL_CNT",       WF_LWTBL_MPDU_FAIL_CNT_MASK,       WF_LWTBL_MPDU_FAIL_CNT_SHIFT,	false},
++	{"MPDU_OK_CNT",         WF_LWTBL_MPDU_OK_CNT_MASK,         WF_LWTBL_MPDU_OK_CNT_SHIFT,	false},
++	{"RATE_IDX",            WF_LWTBL_RATE_IDX_MASK,            WF_LWTBL_RATE_IDX_SHIFT,	true},
++	{NULL,}
++};
++
++char *fcap_name[] = {"20MHz", "20/40MHz", "20/40/80MHz", "20/40/80/160/80+80MHz", "20/40/80/160/80+80/320MHz"};
++
++static void parse_fmac_lwtbl_dw9(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 9 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 9\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_TRX_CAP_DW_9*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW9[i].name) {
++		if (WTBL_LMAC_DW9[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW9[i].name,
++					 (dw_value & WTBL_LMAC_DW9[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW9[i].name,
++					  (dw_value & WTBL_LMAC_DW9[i].mask) >> WTBL_LMAC_DW9[i].shift);
++		i++;
++	}
++
++	/* FCAP parser */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "FCAP:%s\n", fcap_name[(dw_value & WF_LWTBL_FCAP_MASK) >> WF_LWTBL_FCAP_SHIFT]);
++}
++
++#define HW_TX_RATE_TO_MODE(_x)			(((_x) & WTBL_RATE_TX_MODE_MASK) >> WTBL_RATE_TX_MODE_OFFSET)
++#define HW_TX_RATE_TO_MCS(_x, _mode)		((_x) & WTBL_RATE_TX_RATE_MASK >> WTBL_RATE_TX_RATE_OFFSET)
++#define HW_TX_RATE_TO_NSS(_x)			(((_x) & WTBL_RATE_NSTS_MASK) >> WTBL_RATE_NSTS_OFFSET)
++#define HW_TX_RATE_TO_STBC(_x)			(((_x) & WTBL_RATE_STBC_MASK) >> WTBL_RATE_STBC_OFFSET)
++
++#define MAX_TX_MODE 16
++static char *HW_TX_MODE_STR[] = {"CCK", "OFDM", "HT-Mix", "HT-GF", "VHT",
++				 "N/A", "N/A", "N/A",
++				 "HE_SU", "HE_EXT_SU", "HE_TRIG", "HE_MU",
++				 "N/A",
++				 "EHT_EXT_SU", "EHT_TRIG", "EHT_MU",
++				 "N/A"};
++static char *HW_TX_RATE_CCK_STR[] = {"1M", "2Mlong", "5.5Mlong", "11Mlong", "N/A", "2Mshort", "5.5Mshort", "11Mshort", "N/A"};
++static char *HW_TX_RATE_OFDM_STR[] = {"6M", "9M", "12M", "18M", "24M", "36M", "48M", "54M", "N/A"};
++
++static char *hw_rate_ofdm_str(uint16_t ofdm_idx)
++{
++	switch (ofdm_idx) {
++	case 11: /* 6M */
++		return HW_TX_RATE_OFDM_STR[0];
++
++	case 15: /* 9M */
++		return HW_TX_RATE_OFDM_STR[1];
++
++	case 10: /* 12M */
++		return HW_TX_RATE_OFDM_STR[2];
++
++	case 14: /* 18M */
++		return HW_TX_RATE_OFDM_STR[3];
++
++	case 9: /* 24M */
++		return HW_TX_RATE_OFDM_STR[4];
++
++	case 13: /* 36M */
++		return HW_TX_RATE_OFDM_STR[5];
++
++	case 8: /* 48M */
++		return HW_TX_RATE_OFDM_STR[6];
++
++	case 12: /* 54M */
++		return HW_TX_RATE_OFDM_STR[7];
++
++	default:
++		return HW_TX_RATE_OFDM_STR[8];
++	}
++}
++
++static char *hw_rate_str(u8 mode, uint16_t rate_idx)
++{
++	if (mode == 0)
++		return rate_idx < 8 ? HW_TX_RATE_CCK_STR[rate_idx] : HW_TX_RATE_CCK_STR[8];
++	else if (mode == 1)
++		return hw_rate_ofdm_str(rate_idx);
++	else
++		return "MCS";
++}
++
++static void
++parse_rate(struct seq_file *s, uint16_t rate_idx, uint16_t txrate)
++{
++	uint16_t txmode, mcs, nss, stbc;
++
++	txmode = HW_TX_RATE_TO_MODE(txrate);
++	mcs = HW_TX_RATE_TO_MCS(txrate, txmode);
++	nss = HW_TX_RATE_TO_NSS(txrate);
++	stbc = HW_TX_RATE_TO_STBC(txrate);
++
++	seq_printf(s, "\tRate%d(0x%x):TxMode=%d(%s), TxRate=%d(%s), Nsts=%d, STBC=%d\n",
++			  rate_idx + 1, txrate,
++			  txmode, (txmode < MAX_TX_MODE ? HW_TX_MODE_STR[txmode] : HW_TX_MODE_STR[MAX_TX_MODE]),
++			  mcs, hw_rate_str(txmode, mcs), nss, stbc);
++}
++
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW10[] = {
++	{"RATE1",       WF_LWTBL_RATE1_MASK,        WF_LWTBL_RATE1_SHIFT},
++	{"RATE2",       WF_LWTBL_RATE2_MASK,        WF_LWTBL_RATE2_SHIFT},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw10(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 10 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 10\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_AUTO_RATE_1_2*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW10[i].name) {
++		parse_rate(s, i, (dw_value & WTBL_LMAC_DW10[i].mask) >> WTBL_LMAC_DW10[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW11[] = {
++	{"RATE3",       WF_LWTBL_RATE3_MASK,        WF_LWTBL_RATE3_SHIFT},
++	{"RATE4",       WF_LWTBL_RATE4_MASK,        WF_LWTBL_RATE4_SHIFT},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw11(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 11 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 11\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_AUTO_RATE_3_4*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW11[i].name) {
++		parse_rate(s, i+2, (dw_value & WTBL_LMAC_DW11[i].mask) >> WTBL_LMAC_DW11[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW12[] = {
++	{"RATE5",       WF_LWTBL_RATE5_MASK,        WF_LWTBL_RATE5_SHIFT},
++	{"RATE6",       WF_LWTBL_RATE6_MASK,        WF_LWTBL_RATE6_SHIFT},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw12(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 12 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 12\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_AUTO_RATE_5_6*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW12[i].name) {
++		parse_rate(s, i+4, (dw_value & WTBL_LMAC_DW12[i].mask) >> WTBL_LMAC_DW12[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW13[] = {
++	{"RATE7",       WF_LWTBL_RATE7_MASK,        WF_LWTBL_RATE7_SHIFT},
++	{"RATE8",       WF_LWTBL_RATE8_MASK,        WF_LWTBL_RATE8_SHIFT},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw13(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 13 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 13\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_AUTO_RATE_7_8*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW13[i].name) {
++		parse_rate(s, i+6, (dw_value & WTBL_LMAC_DW13[i].mask) >> WTBL_LMAC_DW13[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW14_BMC[] = {
++	{"CIPHER_IGTK",         WF_LWTBL_CIPHER_SUIT_IGTK_MASK,    WF_LWTBL_CIPHER_SUIT_IGTK_SHIFT,		false},
++	{"CIPHER_BIGTK",        WF_LWTBL_CIPHER_SUIT_BIGTK_MASK,   WF_LWTBL_CIPHER_SUIT_BIGTK_SHIFT,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw14(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr, *muar_addr = 0;
++	u32 dw_value, muar_dw_value = 0;
++	u16 i = 0;
++
++	/* DUMP DW14 for BMC entry only */
++	muar_addr = (u32 *)&(lwtbl[WF_LWTBL_MUAR_DW*4]);
++	muar_dw_value = *muar_addr;
++	if (((muar_dw_value & WF_LWTBL_MUAR_MASK) >> WF_LWTBL_MUAR_SHIFT)
++		== MUAR_INDEX_OWN_MAC_ADDR_BC_MC) {
++		/* LMAC WTBL DW 14 */
++		seq_printf(s, "\t\n");
++		seq_printf(s, "LWTBL DW 14\n");
++		addr = (u32 *)&(lwtbl[WF_LWTBL_CIPHER_SUIT_IGTK_DW*4]);
++		dw_value = *addr;
++
++		while (WTBL_LMAC_DW14_BMC[i].name) {
++			parse_rate(s, i+6, (dw_value & WTBL_LMAC_DW14_BMC[i].mask) >> WTBL_LMAC_DW14_BMC[i].shift);
++			i++;
++		}
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW28[] = {
++	{"RELATED_IDX0",	WF_LWTBL_RELATED_IDX0_MASK,		WF_LWTBL_RELATED_IDX0_SHIFT,	false},
++	{"RELATED_BAND0",	WF_LWTBL_RELATED_BAND0_MASK,		WF_LWTBL_RELATED_BAND0_SHIFT,	false},
++	{"PRI_MLD_BAND",    WF_LWTBL_PRIMARY_MLD_BAND_MASK,		WF_LWTBL_PRIMARY_MLD_BAND_SHIFT,	true},
++	{"RELATED_IDX0",	WF_LWTBL_RELATED_IDX1_MASK,		WF_LWTBL_RELATED_IDX1_SHIFT,	false},
++	{"RELATED_BAND1",   WF_LWTBL_RELATED_BAND1_MASK,		WF_LWTBL_RELATED_BAND1_SHIFT,	false},
++	{"SEC_MLD_BAND",	WF_LWTBL_SECONDARY_MLD_BAND_MASK,	WF_LWTBL_SECONDARY_MLD_BAND_SHIFT,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw28(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 28 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 28\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_MLO_INFO_LINE_1*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW28[i].name) {
++		if (WTBL_LMAC_DW28[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW28[i].name,
++				(dw_value & WTBL_LMAC_DW28[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW28[i].name,
++				(dw_value & WTBL_LMAC_DW28[i].mask) >>
++					WTBL_LMAC_DW28[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW29[] = {
++	{"DISPATCH_POLICY_MLD_TID0", WF_LWTBL_DISPATCH_POLICY0_MASK,	WF_LWTBL_DISPATCH_POLICY0_SHIFT,	false},
++	{"MLD_TID1",	WF_LWTBL_DISPATCH_POLICY1_MASK,		WF_LWTBL_DISPATCH_POLICY1_SHIFT,	false},
++	{"MLD_TID2",	WF_LWTBL_DISPATCH_POLICY2_MASK,		WF_LWTBL_DISPATCH_POLICY2_SHIFT,	false},
++	{"MLD_TID3",	WF_LWTBL_DISPATCH_POLICY3_MASK,	WF_LWTBL_DISPATCH_POLICY3_SHIFT,	true},
++	{"MLD_TID4",	WF_LWTBL_DISPATCH_POLICY4_MASK,		WF_LWTBL_DISPATCH_POLICY4_SHIFT,	false},
++	{"MLD_TID5",	WF_LWTBL_DISPATCH_POLICY5_MASK,		WF_LWTBL_DISPATCH_POLICY5_SHIFT,	false},
++	{"MLD_TID6",	WF_LWTBL_DISPATCH_POLICY6_MASK,		WF_LWTBL_DISPATCH_POLICY6_SHIFT,	false},
++	{"MLD_TID7",	WF_LWTBL_DISPATCH_POLICY7_MASK,		WF_LWTBL_DISPATCH_POLICY7_SHIFT,	true},
++	{"OMLD_ID",		WF_LWTBL_OWN_MLD_ID_MASK,	WF_LWTBL_OWN_MLD_ID_SHIFT,	false},
++	{"EMLSR0",		WF_LWTBL_EMLSR0_MASK,		NO_SHIFT_DEFINE,	false},
++	{"EMLMR0",		WF_LWTBL_EMLMR0_MASK,		NO_SHIFT_DEFINE,	false},
++	{"EMLSR1",		WF_LWTBL_EMLSR1_MASK,		NO_SHIFT_DEFINE,	false},
++	{"EMLMR1",		WF_LWTBL_EMLMR1_MASK,		NO_SHIFT_DEFINE,	true},
++	{"EMLSR2",		WF_LWTBL_EMLSR2_MASK,		NO_SHIFT_DEFINE,	false},
++	{"EMLMR2",		WF_LWTBL_EMLMR2_MASK,		NO_SHIFT_DEFINE,	false},
++	{"STR_BITMAP",	WF_LWTBL_STR_BITMAP_MASK,	WF_LWTBL_STR_BITMAP_SHIFT,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw29(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 29 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 29\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_MLO_INFO_LINE_2*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW29[i].name) {
++		if (WTBL_LMAC_DW29[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW29[i].name,
++				(dw_value & WTBL_LMAC_DW29[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW29[i].name,
++				(dw_value & WTBL_LMAC_DW29[i].mask) >>
++					WTBL_LMAC_DW29[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW30[] = {
++	{"DISPATCH_ORDER",	WF_LWTBL_DISPATCH_ORDER_MASK,	WF_LWTBL_DISPATCH_ORDER_SHIFT,	false},
++	{"DISPATCH_RATIO",	WF_LWTBL_DISPATCH_RATIO_MASK,	WF_LWTBL_DISPATCH_RATIO_SHIFT,	false},
++	{"LINK_MGF",		WF_LWTBL_LINK_MGF_MASK,		WF_LWTBL_LINK_MGF_SHIFT,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw30(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 30 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 30\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_MLO_INFO_LINE_3*4]);
++	dw_value = *addr;
++
++
++	while (WTBL_LMAC_DW30[i].name) {
++		if (WTBL_LMAC_DW30[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW30[i].name,
++				(dw_value & WTBL_LMAC_DW30[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW30[i].name,
++				(dw_value & WTBL_LMAC_DW30[i].mask) >> WTBL_LMAC_DW30[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW31[] = {
++	{"NEGO_WINSIZE0",	WF_LWTBL_NEGOTIATED_WINSIZE0_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE0_SHIFT,    false},
++	{"WINSIZE1",	WF_LWTBL_NEGOTIATED_WINSIZE1_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE1_SHIFT,    false},
++	{"WINSIZE2",	WF_LWTBL_NEGOTIATED_WINSIZE2_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE2_SHIFT,    false},
++	{"WINSIZE3",	WF_LWTBL_NEGOTIATED_WINSIZE3_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE3_SHIFT,    true},
++	{"WINSIZE4",	WF_LWTBL_NEGOTIATED_WINSIZE4_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE4_SHIFT,    false},
++	{"WINSIZE5",	WF_LWTBL_NEGOTIATED_WINSIZE5_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE5_SHIFT,    false},
++	{"WINSIZE6",	WF_LWTBL_NEGOTIATED_WINSIZE6_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE6_SHIFT,    false},
++	{"WINSIZE7",	WF_LWTBL_NEGOTIATED_WINSIZE7_MASK,	WF_LWTBL_NEGOTIATED_WINSIZE7_SHIFT,    true},
++	{"CASCAD",	        WF_LWTBL_CASCAD_MASK,			NO_SHIFT_DEFINE,    false},
++	{"ALL_ACK",	        WF_LWTBL_ALL_ACK_MASK,			NO_SHIFT_DEFINE,    false},
++	{"MPDU_SIZE",	WF_LWTBL_MPDU_SIZE_MASK,		WF_LWTBL_MPDU_SIZE_SHIFT,  false},
++	{"BA_MODE",		WF_LWTBL_BA_MODE_MASK,			WF_LWTBL_BA_MODE_SHIFT,  true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw31(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 31 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 31\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_RESP_INFO_DW_31*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW31[i].name) {
++		if (WTBL_LMAC_DW31[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW31[i].name,
++				(dw_value & WTBL_LMAC_DW31[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW31[i].name,
++				(dw_value & WTBL_LMAC_DW31[i].mask) >>
++					WTBL_LMAC_DW31[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW32[] = {
++	{"OM_INFO",			WF_LWTBL_OM_INFO_MASK,			WF_LWTBL_OM_INFO_SHIFT,		false},
++	{"OM_RXD_DUP_MODE",		WF_LWTBL_RXD_DUP_FOR_OM_CHG_MASK,	NO_SHIFT_DEFINE,		false},
++	{"RXD_DUP_WHITE_LIST",	WF_LWTBL_RXD_DUP_WHITE_LIST_MASK,	WF_LWTBL_RXD_DUP_WHITE_LIST_SHIFT,	false},
++	{"RXD_DUP_MODE",		WF_LWTBL_RXD_DUP_MODE_MASK,		WF_LWTBL_RXD_DUP_MODE_SHIFT,	false},
++	{"DROP",			WF_LWTBL_DROP_MASK,			NO_SHIFT_DEFINE,		false},
++	{"ACK_EN",			WF_LWTBL_ACK_EN_MASK,			NO_SHIFT_DEFINE,		true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw32(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 32 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 32\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_RX_DUP_INFO_DW_32*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW32[i].name) {
++		if (WTBL_LMAC_DW32[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW32[i].name,
++				(dw_value & WTBL_LMAC_DW32[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW32[i].name,
++				(dw_value & WTBL_LMAC_DW32[i].mask) >>
++					WTBL_LMAC_DW32[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW33[] = {
++	{"USER_RSSI",                   WF_LWTBL_USER_RSSI_MASK,            WF_LWTBL_USER_RSSI_SHIFT,	false},
++	{"USER_SNR",                    WF_LWTBL_USER_SNR_MASK,             WF_LWTBL_USER_SNR_SHIFT,	false},
++	{"RAPID_REACTION_RATE",         WF_LWTBL_RAPID_REACTION_RATE_MASK,  WF_LWTBL_RAPID_REACTION_RATE_SHIFT,	true},
++	{"HT_AMSDU(Read Only)",         WF_LWTBL_HT_AMSDU_MASK,             NO_SHIFT_DEFINE,	false},
++	{"AMSDU_CROSS_LG(Read Only)",   WF_LWTBL_AMSDU_CROSS_LG_MASK,       NO_SHIFT_DEFINE,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw33(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 33 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 33\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_RX_STAT_CNT_LINE_1*4]);
++	dw_value = *addr;
++
++	while (WTBL_LMAC_DW33[i].name) {
++		if (WTBL_LMAC_DW33[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW33[i].name,
++				(dw_value & WTBL_LMAC_DW33[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW33[i].name,
++				(dw_value & WTBL_LMAC_DW33[i].mask) >>
++					WTBL_LMAC_DW33[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW34[] = {
++	{"RESP_RCPI0",	WF_LWTBL_RESP_RCPI0_MASK,	WF_LWTBL_RESP_RCPI0_SHIFT,	false},
++	{"RCPI1",	WF_LWTBL_RESP_RCPI1_MASK,	WF_LWTBL_RESP_RCPI1_SHIFT,	false},
++	{"RCPI2",	WF_LWTBL_RESP_RCPI2_MASK,	WF_LWTBL_RESP_RCPI2_SHIFT,	false},
++	{"RCPI3",	WF_LWTBL_RESP_RCPI3_MASK,	WF_LWTBL_RESP_RCPI3_SHIFT,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw34(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 34 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 34\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_RX_STAT_CNT_LINE_2*4]);
++	dw_value = *addr;
++
++
++	while (WTBL_LMAC_DW34[i].name) {
++		if (WTBL_LMAC_DW34[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW34[i].name,
++				(dw_value & WTBL_LMAC_DW34[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW34[i].name,
++				(dw_value & WTBL_LMAC_DW34[i].mask) >>
++					WTBL_LMAC_DW34[i].shift);
++		i++;
++	}
++}
++
++static const struct berse_wtbl_parse WTBL_LMAC_DW35[] = {
++	{"SNR 0",	WF_LWTBL_SNR_RX0_MASK,		WF_LWTBL_SNR_RX0_SHIFT,	false},
++	{"SNR 1",	WF_LWTBL_SNR_RX1_MASK,		WF_LWTBL_SNR_RX1_SHIFT,	false},
++	{"SNR 2",	WF_LWTBL_SNR_RX2_MASK,		WF_LWTBL_SNR_RX2_SHIFT,	false},
++	{"SNR 3",	WF_LWTBL_SNR_RX3_MASK,		WF_LWTBL_SNR_RX3_SHIFT,	true},
++	{NULL,}
++};
++
++static void parse_fmac_lwtbl_dw35(struct seq_file *s, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	/* LMAC WTBL DW 35 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "LWTBL DW 35\n");
++	addr = (u32 *)&(lwtbl[WTBL_GROUP_RX_STAT_CNT_LINE_3*4]);
++	dw_value = *addr;
++
++
++	while (WTBL_LMAC_DW35[i].name) {
++		if (WTBL_LMAC_DW35[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_LMAC_DW35[i].name,
++				(dw_value & WTBL_LMAC_DW35[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW35[i].name,
++				(dw_value & WTBL_LMAC_DW35[i].mask) >>
++					WTBL_LMAC_DW35[i].shift);
++		i++;
++	}
++}
++
++static void parse_fmac_lwtbl_rx_stats(struct seq_file *s, u8 *lwtbl)
++{
++	parse_fmac_lwtbl_dw33(s, lwtbl);
++	parse_fmac_lwtbl_dw34(s, lwtbl);
++	parse_fmac_lwtbl_dw35(s, lwtbl);
++}
++
++static void parse_fmac_lwtbl_mlo_info(struct seq_file *s, u8 *lwtbl)
++{
++	parse_fmac_lwtbl_dw28(s, lwtbl);
++	parse_fmac_lwtbl_dw29(s, lwtbl);
++	parse_fmac_lwtbl_dw30(s, lwtbl);
++}
++
++static const struct berse_wtbl_parse WTBL_UMAC_DW9[] = {
++	{"RELATED_IDX0",	WF_UWTBL_RELATED_IDX0_MASK,		WF_UWTBL_RELATED_IDX0_SHIFT,	false},
++	{"RELATED_BAND0",	WF_UWTBL_RELATED_BAND0_MASK,		WF_UWTBL_RELATED_BAND0_SHIFT,	false},
++	{"PRI_MLD_BAND",    WF_UWTBL_PRIMARY_MLD_BAND_MASK,		WF_UWTBL_PRIMARY_MLD_BAND_SHIFT,	true},
++	{"RELATED_IDX0",	WF_UWTBL_RELATED_IDX1_MASK,		WF_UWTBL_RELATED_IDX1_SHIFT,	false},
++	{"RELATED_BAND1",   WF_UWTBL_RELATED_BAND1_MASK,		WF_UWTBL_RELATED_BAND1_SHIFT,	false},
++	{"SEC_MLD_BAND",	WF_UWTBL_SECONDARY_MLD_BAND_MASK,	WF_UWTBL_SECONDARY_MLD_BAND_SHIFT,	true},
++	{NULL,}
++};
++
++static void parse_fmac_uwtbl_mlo_info(struct seq_file *s, u8 *uwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	seq_printf(s, "\t\n");
++	seq_printf(s, "MldAddr: %02x:%02x:%02x:%02x:%02x:%02x(D0[B0~15], D1[B0~31])\n",
++		uwtbl[4], uwtbl[5], uwtbl[6], uwtbl[7], uwtbl[0], uwtbl[1]);
++
++	/* UMAC WTBL DW 0 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "UWTBL DW 0\n");
++	addr = (u32 *)&(uwtbl[WF_UWTBL_OWN_MLD_ID_DW*4]);
++	dw_value = *addr;
++
++	seq_printf(s, "\t%s:%u\n", "OMLD_ID",
++		(dw_value & WF_UWTBL_OWN_MLD_ID_MASK) >> WF_UWTBL_OWN_MLD_ID_SHIFT);
++
++	/* UMAC WTBL DW 9 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "UWTBL DW 9\n");
++	addr = (u32 *)&(uwtbl[WF_UWTBL_RELATED_IDX0_DW*4]);
++	dw_value = *addr;
++
++	while (WTBL_UMAC_DW9[i].name) {
++
++		if (WTBL_UMAC_DW9[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_UMAC_DW9[i].name,
++				(dw_value & WTBL_UMAC_DW9[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_UMAC_DW9[i].name,
++				 (dw_value & WTBL_UMAC_DW9[i].mask) >>
++					WTBL_UMAC_DW9[i].shift);
++		i++;
++	}
++}
++
++static bool
++is_wtbl_bigtk_exist(u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++
++	addr = (u32 *)&(lwtbl[WF_LWTBL_MUAR_DW*4]);
++	dw_value = *addr;
++	if (((dw_value & WF_LWTBL_MUAR_MASK) >> WF_LWTBL_MUAR_SHIFT) ==
++					MUAR_INDEX_OWN_MAC_ADDR_BC_MC) {
++		addr = (u32 *)&(lwtbl[WF_LWTBL_CIPHER_SUIT_BIGTK_DW*4]);
++		dw_value = *addr;
++		if (((dw_value & WF_LWTBL_CIPHER_SUIT_BIGTK_MASK) >>
++			WF_LWTBL_CIPHER_SUIT_BIGTK_SHIFT) != IGTK_CIPHER_SUIT_NONE)
++			return true;
++	}
++
++	return false;
++}
++
++static const struct berse_wtbl_parse WTBL_UMAC_DW2[] = {
++	{"PN0",		WTBL_PN0_MASK,		WTBL_PN0_OFFSET,	false},
++	{"PN1",		WTBL_PN1_MASK,		WTBL_PN1_OFFSET,	false},
++	{"PN2",		WTBL_PN2_MASK,		WTBL_PN2_OFFSET,	true},
++	{"PN3",		WTBL_PN3_MASK,		WTBL_PN3_OFFSET,	false},
++	{NULL,}
++};
++
++static const struct berse_wtbl_parse WTBL_UMAC_DW3[] = {
++	{"PN4",     WTBL_PN4_MASK,      WTBL_PN4_OFFSET,	false},
++	{"PN5",     WTBL_PN5_MASK,      WTBL_PN5_OFFSET,	true},
++	{NULL,}
++};
++
++static const struct berse_wtbl_parse WTBL_UMAC_DW4_BIPN[] = {
++	{"BIPN0",	WTBL_BIPN0_MASK,	WTBL_BIPN0_OFFSET,	false},
++	{"BIPN1",	WTBL_BIPN1_MASK,	WTBL_BIPN1_OFFSET,	false},
++	{"BIPN2",	WTBL_BIPN2_MASK,	WTBL_BIPN2_OFFSET,	true},
++	{"BIPN3",	WTBL_BIPN3_MASK,	WTBL_BIPN3_OFFSET,	false},
++	{NULL,}
++};
++
++static const struct berse_wtbl_parse WTBL_UMAC_DW5_BIPN[] = {
++	{"BIPN4",	WTBL_BIPN0_MASK,	WTBL_BIPN0_OFFSET,	false},
++	{"BIPN5",	WTBL_BIPN1_MASK,	WTBL_BIPN1_OFFSET,	true},
++	{NULL,}
++};
++
++static void parse_fmac_uwtbl_pn(struct seq_file *s, u8 *uwtbl, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u16 i = 0;
++
++	seq_printf(s, "\t\n");
++	seq_printf(s, "UWTBL PN\n");
++
++	/* UMAC WTBL DW 2/3 */
++	addr = (u32 *)&(uwtbl[WF_UWTBL_PN_31_0__DW*4]);
++	dw_value = *addr;
++
++	while (WTBL_UMAC_DW2[i].name) {
++		seq_printf(s, "\t%s:%u\n", WTBL_UMAC_DW2[i].name,
++			(dw_value & WTBL_UMAC_DW2[i].mask) >>
++				WTBL_UMAC_DW2[i].shift);
++		i++;
++	}
++
++	i = 0;
++	addr = (u32 *)&(uwtbl[WF_UWTBL_PN_47_32__DW*4]);
++	dw_value = *addr;
++
++	while (WTBL_UMAC_DW3[i].name) {
++		seq_printf(s, "\t%s:%u\n", WTBL_UMAC_DW3[i].name,
++			 (dw_value & WTBL_UMAC_DW3[i].mask) >>
++			WTBL_UMAC_DW3[i].shift);
++		i++;
++	}
++
++
++	/* UMAC WTBL DW 4/5 for BIGTK */
++	if (is_wtbl_bigtk_exist(lwtbl) == true) {
++		i = 0;
++		addr = (u32 *)&(uwtbl[WF_UWTBL_RX_BIPN_31_0__DW*4]);
++		dw_value = *addr;
++
++		while (WTBL_UMAC_DW4_BIPN[i].name) {
++			seq_printf(s, "\t%s:%u\n", WTBL_UMAC_DW4_BIPN[i].name,
++				(dw_value & WTBL_UMAC_DW4_BIPN[i].mask) >>
++					WTBL_UMAC_DW4_BIPN[i].shift);
++			i++;
++		}
++
++		i = 0;
++		addr = (u32 *)&(uwtbl[WF_UWTBL_RX_BIPN_47_32__DW*4]);
++		dw_value = *addr;
++
++		while (WTBL_UMAC_DW5_BIPN[i].name) {
++			seq_printf(s, "\t%s:%u\n", WTBL_UMAC_DW5_BIPN[i].name,
++				(dw_value & WTBL_UMAC_DW5_BIPN[i].mask) >>
++				WTBL_UMAC_DW5_BIPN[i].shift);
++			i++;
++		}
++	}
++}
++
++static void parse_fmac_uwtbl_sn(struct seq_file *s, u8 *uwtbl)
++{
++	u32 *addr = 0;
++	u32 u2SN = 0;
++
++	/* UMAC WTBL DW SN part */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "UWTBL SN\n");
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_TID0_SN_DW*4]);
++	u2SN = ((*addr) & WF_UWTBL_TID0_SN_MASK) >> WF_UWTBL_TID0_SN_SHIFT;
++	seq_printf(s, "\t%s:%u\n", "TID0_AC0_SN", u2SN);
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_TID1_SN_DW*4]);
++	u2SN = ((*addr) & WF_UWTBL_TID1_SN_MASK) >> WF_UWTBL_TID1_SN_SHIFT;
++	seq_printf(s, "\t%s:%u\n", "TID1_AC1_SN", u2SN);
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_TID2_SN_7_0__DW*4]);
++	u2SN = ((*addr) & WF_UWTBL_TID2_SN_7_0__MASK) >>
++				WF_UWTBL_TID2_SN_7_0__SHIFT;
++	addr = (u32 *)&(uwtbl[WF_UWTBL_TID2_SN_11_8__DW*4]);
++	u2SN |= (((*addr) & WF_UWTBL_TID2_SN_11_8__MASK) >>
++			WF_UWTBL_TID2_SN_11_8__SHIFT) << 8;
++	seq_printf(s, "\t%s:%u\n", "TID2_AC2_SN", u2SN);
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_TID3_SN_DW*4]);
++	u2SN = ((*addr) & WF_UWTBL_TID3_SN_MASK) >> WF_UWTBL_TID3_SN_SHIFT;
++	seq_printf(s, "\t%s:%u\n", "TID3_AC3_SN", u2SN);
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_TID4_SN_DW*4]);
++	u2SN = ((*addr) & WF_UWTBL_TID4_SN_MASK) >> WF_UWTBL_TID4_SN_SHIFT;
++	seq_printf(s, "\t%s:%u\n", "TID4_SN", u2SN);
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_TID5_SN_3_0__DW*4]);
++	u2SN = ((*addr) & WF_UWTBL_TID5_SN_3_0__MASK) >>
++				WF_UWTBL_TID5_SN_3_0__SHIFT;
++	addr = (u32 *)&(uwtbl[WF_UWTBL_TID5_SN_11_4__DW*4]);
++	u2SN |= (((*addr) & WF_UWTBL_TID5_SN_11_4__MASK) >>
++				WF_UWTBL_TID5_SN_11_4__SHIFT) << 4;
++	seq_printf(s, "\t%s:%u\n", "TID5_SN", u2SN);
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_TID6_SN_DW*4]);
++	u2SN = ((*addr) & WF_UWTBL_TID6_SN_MASK) >> WF_UWTBL_TID6_SN_SHIFT;
++	seq_printf(s, "\t%s:%u\n", "TID6_SN", u2SN);
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_TID7_SN_DW*4]);
++	u2SN = ((*addr) & WF_UWTBL_TID7_SN_MASK) >> WF_UWTBL_TID7_SN_SHIFT;
++	seq_printf(s, "\t%s:%u\n", "TID7_SN", u2SN);
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_COM_SN_DW*4]);
++	u2SN = ((*addr) & WF_UWTBL_COM_SN_MASK) >> WF_UWTBL_COM_SN_SHIFT;
++	seq_printf(s, "\t%s:%u\n", "COM_SN", u2SN);
++}
++
++static void dump_key_table(
++	struct seq_file *s,
++	uint16_t keyloc0,
++	uint16_t keyloc1,
++	uint16_t keyloc2
++)
++{
++#define ONE_KEY_ENTRY_LEN_IN_DW                8
++	struct mt7996_dev *dev = dev_get_drvdata(s->private);
++	u8 keytbl[ONE_KEY_ENTRY_LEN_IN_DW*4] = {0};
++	uint16_t x;
++
++	seq_printf(s, "\t\n");
++	seq_printf(s, "\t%s:%d\n", "keyloc0", keyloc0);
++	if (keyloc0 != INVALID_KEY_ENTRY) {
++
++		/* Don't swap below two lines, halWtblReadRaw will
++		* write new value WF_WTBLON_TOP_WDUCR_ADDR
++		*/
++		mt7996_wtbl_read_raw(dev, keyloc0,
++			WTBL_TYPE_KEY, 0, ONE_KEY_ENTRY_LEN_IN_DW, keytbl);
++		seq_printf(s, "\t\tKEY WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
++			MT_DBG_UWTBL_TOP_WDUCR_ADDR,
++			mt76_rr(dev, MT_DBG_UWTBL_TOP_WDUCR_ADDR),
++			KEYTBL_IDX2BASE(keyloc0, 0));
++		for (x = 0; x < ONE_KEY_ENTRY_LEN_IN_DW; x++) {
++			seq_printf(s, "\t\tDW%02d: %02x %02x %02x %02x\n",
++				x,
++				keytbl[x * 4 + 3],
++				keytbl[x * 4 + 2],
++				keytbl[x * 4 + 1],
++				keytbl[x * 4]);
++		}
++	}
++
++	seq_printf(s, "\t%s:%d\n", "keyloc1", keyloc1);
++	if (keyloc1 != INVALID_KEY_ENTRY) {
++		/* Don't swap below two lines, halWtblReadRaw will
++		* write new value WF_WTBLON_TOP_WDUCR_ADDR
++		*/
++		mt7996_wtbl_read_raw(dev, keyloc1,
++			WTBL_TYPE_KEY, 0, ONE_KEY_ENTRY_LEN_IN_DW, keytbl);
++		seq_printf(s, "\t\tKEY WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
++			MT_DBG_UWTBL_TOP_WDUCR_ADDR,
++			mt76_rr(dev, MT_DBG_UWTBL_TOP_WDUCR_ADDR),
++			KEYTBL_IDX2BASE(keyloc1, 0));
++		for (x = 0; x < ONE_KEY_ENTRY_LEN_IN_DW; x++) {
++			seq_printf(s, "\t\tDW%02d: %02x %02x %02x %02x\n",
++				x,
++				keytbl[x * 4 + 3],
++				keytbl[x * 4 + 2],
++				keytbl[x * 4 + 1],
++				keytbl[x * 4]);
++		}
++	}
++
++	seq_printf(s, "\t%s:%d\n", "keyloc2", keyloc2);
++	if (keyloc2 != INVALID_KEY_ENTRY) {
++		/* Don't swap below two lines, halWtblReadRaw will
++		* write new value WF_WTBLON_TOP_WDUCR_ADDR
++		*/
++		mt7996_wtbl_read_raw(dev, keyloc2,
++			WTBL_TYPE_KEY, 0, ONE_KEY_ENTRY_LEN_IN_DW, keytbl);
++		seq_printf(s, "\t\tKEY WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
++			MT_DBG_UWTBL_TOP_WDUCR_ADDR,
++			mt76_rr(dev, MT_DBG_UWTBL_TOP_WDUCR_ADDR),
++			KEYTBL_IDX2BASE(keyloc2, 0));
++		for (x = 0; x < ONE_KEY_ENTRY_LEN_IN_DW; x++) {
++			seq_printf(s, "\t\tDW%02d: %02x %02x %02x %02x\n",
++				x,
++				keytbl[x * 4 + 3],
++				keytbl[x * 4 + 2],
++				keytbl[x * 4 + 1],
++				keytbl[x * 4]);
++		}
++	}
++}
++
++static void parse_fmac_uwtbl_key_info(struct seq_file *s, u8 *uwtbl, u8 *lwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	uint16_t keyloc0 = INVALID_KEY_ENTRY;
++	uint16_t keyloc1 = INVALID_KEY_ENTRY;
++	uint16_t keyloc2 = INVALID_KEY_ENTRY;
++
++	/* UMAC WTBL DW 7 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "UWTBL key info\n");
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_KEY_LOC0_DW*4]);
++	dw_value = *addr;
++	keyloc0 = (dw_value & WF_UWTBL_KEY_LOC0_MASK) >> WF_UWTBL_KEY_LOC0_SHIFT;
++	keyloc1 = (dw_value & WF_UWTBL_KEY_LOC1_MASK) >> WF_UWTBL_KEY_LOC1_SHIFT;
++
++	seq_printf(s, "\t%s:%u/%u\n", "Key Loc 0/1", keyloc0, keyloc1);
++
++	/* UMAC WTBL DW 6 for BIGTK */
++	if (is_wtbl_bigtk_exist(lwtbl) == true) {
++		keyloc2 = (dw_value & WF_UWTBL_KEY_LOC2_MASK) >>
++			WF_UWTBL_KEY_LOC2_SHIFT;
++		seq_printf(s, "\t%s:%u\n", "Key Loc 2", keyloc2);
++	}
++
++	/* Parse KEY link */
++	dump_key_table(s, keyloc0, keyloc1, keyloc2);
++}
++
++static const struct berse_wtbl_parse WTBL_UMAC_DW8[] = {
++	{"UWTBL_WMM_Q",		WF_UWTBL_WMM_Q_MASK,		WF_UWTBL_WMM_Q_SHIFT,	false},
++	{"UWTBL_QOS",		WF_UWTBL_QOS_MASK,		NO_SHIFT_DEFINE,	false},
++	{"UWTBL_HT_VHT_HE",	WF_UWTBL_HT_MASK,		NO_SHIFT_DEFINE,	false},
++	{"UWTBL_HDRT_MODE",	WF_UWTBL_HDRT_MODE_MASK,	NO_SHIFT_DEFINE,	true},
++	{NULL,}
++};
++
++static void parse_fmac_uwtbl_msdu_info(struct seq_file *s, u8 *uwtbl)
++{
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u32 amsdu_len = 0;
++	u16 i = 0;
++
++	/* UMAC WTBL DW 8 */
++	seq_printf(s, "\t\n");
++	seq_printf(s, "UWTBL DW8\n");
++
++	addr = (u32 *)&(uwtbl[WF_UWTBL_AMSDU_CFG_DW*4]);
++	dw_value = *addr;
++
++	while (WTBL_UMAC_DW8[i].name) {
++
++		if (WTBL_UMAC_DW8[i].shift == NO_SHIFT_DEFINE)
++			seq_printf(s, "\t%s:%d\n", WTBL_UMAC_DW8[i].name,
++				(dw_value & WTBL_UMAC_DW8[i].mask) ? 1 : 0);
++		else
++			seq_printf(s, "\t%s:%u\n", WTBL_UMAC_DW8[i].name,
++				(dw_value & WTBL_UMAC_DW8[i].mask) >>
++					WTBL_UMAC_DW8[i].shift);
++		i++;
++	}
++
++	/* UMAC WTBL DW 8 - AMSDU_CFG */
++	seq_printf(s, "\t%s:%d\n", "HW AMSDU Enable",
++				(dw_value & WTBL_AMSDU_EN_MASK) ? 1 : 0);
++
++	amsdu_len = (dw_value & WTBL_AMSDU_LEN_MASK) >> WTBL_AMSDU_LEN_OFFSET;
++	if (amsdu_len == 0)
++		seq_printf(s, "\t%s:invalid (WTBL value=0x%x)\n", "HW AMSDU Len",
++			amsdu_len);
++	else if (amsdu_len == 1)
++		seq_printf(s, "\t%s:%d~%d (WTBL value=0x%x)\n", "HW AMSDU Len",
++			1,
++			255,
++			amsdu_len);
++	else if (amsdu_len == 2)
++		seq_printf(s, "\t%s:%d~%d (WTBL value=0x%x)\n", "HW AMSDU Len",
++			256,
++			511,
++			amsdu_len);
++	else if (amsdu_len == 3)
++		seq_printf(s, "\t%s:%d~%d (WTBL value=0x%x)\n", "HW AMSDU Len",
++			512,
++			767,
++			amsdu_len);
++	else
++		seq_printf(s, "\t%s:%d~%d (WTBL value=0x%x)\n", "HW AMSDU Len",
++			256 * (amsdu_len - 1),
++			256 * (amsdu_len - 1) + 255,
++			amsdu_len);
++
++	seq_printf(s, "\t%s:%lu (WTBL value=0x%lx)\n", "HW AMSDU Num",
++		((dw_value & WTBL_AMSDU_NUM_MASK) >> WTBL_AMSDU_NUM_OFFSET) + 1,
++		(dw_value & WTBL_AMSDU_NUM_MASK) >> WTBL_AMSDU_NUM_OFFSET);
++}
++
++static int mt7996_wtbl_read(struct seq_file *s, void *data)
++{
++	struct mt7996_dev *dev = dev_get_drvdata(s->private);
++	u8 lwtbl[LWTBL_LEN_IN_DW * 4] = {0};
++	u8 uwtbl[UWTBL_LEN_IN_DW * 4] = {0};
++	int x;
++
++	mt7996_wtbl_read_raw(dev, dev->wlan_idx, WTBL_TYPE_LMAC, 0,
++				 LWTBL_LEN_IN_DW, lwtbl);
++	seq_printf(s, "Dump WTBL info of WLAN_IDX:%d\n", dev->wlan_idx);
++	seq_printf(s, "LMAC WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
++		   MT_DBG_WTBLON_TOP_WDUCR_ADDR,
++		   mt76_rr(dev, MT_DBG_WTBLON_TOP_WDUCR_ADDR),
++		   LWTBL_IDX2BASE(dev->wlan_idx, 0));
++	for (x = 0; x < LWTBL_LEN_IN_DW; x++) {
++		seq_printf(s, "DW%02d: %02x %02x %02x %02x\n",
++			   x,
++			   lwtbl[x * 4 + 3],
++			   lwtbl[x * 4 + 2],
++			   lwtbl[x * 4 + 1],
++			   lwtbl[x * 4]);
++	}
++
++	/* Parse LWTBL */
++	parse_fmac_lwtbl_dw0_1(s, lwtbl);
++	parse_fmac_lwtbl_dw2(s, lwtbl);
++	parse_fmac_lwtbl_dw3(s, lwtbl);
++	parse_fmac_lwtbl_dw4(s, lwtbl);
++	parse_fmac_lwtbl_dw5(s, lwtbl);
++	parse_fmac_lwtbl_dw6(s, lwtbl);
++	parse_fmac_lwtbl_dw7(s, lwtbl);
++	parse_fmac_lwtbl_dw8(s, lwtbl);
++	parse_fmac_lwtbl_dw9(s, lwtbl);
++	parse_fmac_lwtbl_dw10(s, lwtbl);
++	parse_fmac_lwtbl_dw11(s, lwtbl);
++	parse_fmac_lwtbl_dw12(s, lwtbl);
++	parse_fmac_lwtbl_dw13(s, lwtbl);
++	parse_fmac_lwtbl_dw14(s, lwtbl);
++	parse_fmac_lwtbl_mlo_info(s, lwtbl);
++	parse_fmac_lwtbl_dw31(s, lwtbl);
++	parse_fmac_lwtbl_dw32(s, lwtbl);
++	parse_fmac_lwtbl_rx_stats(s, lwtbl);
++
++	mt7996_wtbl_read_raw(dev, dev->wlan_idx, WTBL_TYPE_UMAC, 0,
++				 UWTBL_LEN_IN_DW, uwtbl);
++	seq_printf(s, "Dump WTBL info of WLAN_IDX:%d\n", dev->wlan_idx);
++	seq_printf(s, "UMAC WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
++		   MT_DBG_UWTBL_TOP_WDUCR_ADDR,
++		   mt76_rr(dev, MT_DBG_UWTBL_TOP_WDUCR_ADDR),
++		   UWTBL_IDX2BASE(dev->wlan_idx, 0));
++	for (x = 0; x < UWTBL_LEN_IN_DW; x++) {
++		seq_printf(s, "DW%02d: %02x %02x %02x %02x\n",
++			   x,
++			   uwtbl[x * 4 + 3],
++			   uwtbl[x * 4 + 2],
++			   uwtbl[x * 4 + 1],
++			   uwtbl[x * 4]);
++	}
++
++	/* Parse UWTBL */
++	parse_fmac_uwtbl_mlo_info(s, uwtbl);
++	parse_fmac_uwtbl_pn(s, uwtbl, lwtbl);
++	parse_fmac_uwtbl_sn(s, uwtbl);
++	parse_fmac_uwtbl_key_info(s, uwtbl, lwtbl);
++	parse_fmac_uwtbl_msdu_info(s, uwtbl);
++
++	return 0;
++}
++
++static int mt7996_sta_info(struct seq_file *s, void *data)
++{
++	struct mt7996_dev *dev = dev_get_drvdata(s->private);
++	u8 lwtbl[LWTBL_LEN_IN_DW*4] = {0};
++	u16 i = 0;
++
++	for (i=0; i < mt7996_wtbl_size(dev); i++) {
++		mt7996_wtbl_read_raw(dev, i, WTBL_TYPE_LMAC, 0,
++				     LWTBL_LEN_IN_DW, lwtbl);
++
++		if (lwtbl[4] || lwtbl[5] || lwtbl[6] || lwtbl[7] || lwtbl[0] || lwtbl[1]) {
++			u32 *addr = (u32 *)&(lwtbl[WTBL_GROUP_TRX_CAP_DW_2*4]);
++			u32 dw_value = *addr;
++
++			seq_printf(s, "wcid:%d\tAddr: %02x:%02x:%02x:%02x:%02x:%02x",
++					i, lwtbl[4], lwtbl[5], lwtbl[6], lwtbl[7], lwtbl[0], lwtbl[1]);
++			seq_printf(s, "\t%s:%u\n", WTBL_LMAC_DW2[0].name,
++					(dw_value & WTBL_LMAC_DW2[0].mask) >> WTBL_LMAC_DW2[0].shift);
++		}
++	}
++
++	return 0;
++}
++
++int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
++{
++	struct mt7996_dev *dev = phy->dev;
++
++	mt7996_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
++
++	/* agg */
++	debugfs_create_devm_seqfile(dev->mt76.dev, "agg_info0", dir,
++				    mt7996_agginfo_read_band0);
++	debugfs_create_devm_seqfile(dev->mt76.dev, "agg_info1", dir,
++				    mt7996_agginfo_read_band1);
++	debugfs_create_devm_seqfile(dev->mt76.dev, "agg_info2", dir,
++				    mt7996_agginfo_read_band2);
++	/* amsdu */
++	debugfs_create_devm_seqfile(dev->mt76.dev, "amsdu_info", dir,
++				    mt7996_amsdu_result_read);
++
++	debugfs_create_file("fw_debug_module", 0600, dir, dev,
++			    &fops_fw_debug_module);
++	debugfs_create_file("fw_debug_level", 0600, dir, dev,
++			    &fops_fw_debug_level);
++	debugfs_create_file("fw_wa_query", 0600, dir, dev, &fops_wa_query);
++	debugfs_create_file("fw_wa_set", 0600, dir, dev, &fops_wa_set);
++	debugfs_create_devm_seqfile(dev->mt76.dev, "fw_version", dir,
++				    mt7996_dump_version);
++
++	debugfs_create_devm_seqfile(dev->mt76.dev, "mib_info0", dir,
++				    mt7996_mibinfo_band0);
++	debugfs_create_devm_seqfile(dev->mt76.dev, "mib_info1", dir,
++				    mt7996_mibinfo_band1);
++	debugfs_create_devm_seqfile(dev->mt76.dev, "mib_info2", dir,
++				    mt7996_mibinfo_band2);
++
++	debugfs_create_devm_seqfile(dev->mt76.dev, "sta_info", dir,
++				    mt7996_sta_info);
++
++	debugfs_create_devm_seqfile(dev->mt76.dev, "tr_info", dir,
++				    mt7996_trinfo_read);
++
++	debugfs_create_devm_seqfile(dev->mt76.dev, "wtbl_info", dir,
++				    mt7996_wtbl_read);
++
++	return 0;
++}
++
++#endif
+diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
+new file mode 100644
+index 00000000..e8870166
+--- /dev/null
++++ b/mt7996/mtk_mcu.c
+@@ -0,0 +1,18 @@
++// SPDX-License-Identifier: ISC
++/*
++ * Copyright (C) 2023 MediaTek Inc.
++ */
++
++#include <linux/firmware.h>
++#include <linux/fs.h>
++#include "mt7996.h"
++#include "mcu.h"
++#include "mac.h"
++#include "mtk_mcu.h"
++
++#ifdef CONFIG_MTK_DEBUG
++
++
++
++
++#endif
+diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
+new file mode 100644
+index 00000000..e741aa27
+--- /dev/null
++++ b/mt7996/mtk_mcu.h
+@@ -0,0 +1,16 @@
++/* SPDX-License-Identifier: ISC */
++/*
++ * Copyright (C) 2023 MediaTek Inc.
++ */
++
++#ifndef __MT7996_MTK_MCU_H
++#define __MT7996_MTK_MCU_H
++
++#include "../mt76_connac_mcu.h"
++
++#ifdef CONFIG_MTK_DEBUG
++
++
++#endif
++
++#endif
+diff --git a/tools/fwlog.c b/tools/fwlog.c
+index e5d4a105..3c6a61d7 100644
+--- a/tools/fwlog.c
++++ b/tools/fwlog.c
+@@ -26,7 +26,7 @@ static const char *debugfs_path(const char *phyname, const char *file)
+ 	return path;
+ }
+ 
+-static int mt76_set_fwlog_en(const char *phyname, bool en)
++static int mt76_set_fwlog_en(const char *phyname, bool en, char *val)
+ {
+ 	FILE *f = fopen(debugfs_path(phyname, "fw_debug_bin"), "w");
+ 
+@@ -35,7 +35,13 @@ static int mt76_set_fwlog_en(const char *phyname, bool en)
+ 		return 1;
+ 	}
+ 
+-	fprintf(f, "7");
++	if (en && val)
++		fprintf(f, "%s", val);
++	else if (en)
++		fprintf(f, "7");
++	else
++		fprintf(f, "0");
++
+ 	fclose(f);
+ 
+ 	return 0;
+@@ -76,6 +82,7 @@ static void handle_signal(int sig)
+ 
+ int mt76_fwlog(const char *phyname, int argc, char **argv)
+ {
++#define BUF_SIZE 1504
+ 	struct sockaddr_in local = {
+ 		.sin_family = AF_INET,
+ 		.sin_addr.s_addr = INADDR_ANY,
+@@ -84,9 +91,9 @@ int mt76_fwlog(const char *phyname, int argc, char **argv)
+ 		.sin_family = AF_INET,
+ 		.sin_port = htons(55688),
+ 	};
+-	char buf[1504];
++	char *buf = calloc(BUF_SIZE, sizeof(char));
+ 	int ret = 0;
+-	int yes = 1;
++	/* int yes = 1; */
+ 	int s, fd;
+ 
+ 	if (argc < 1) {
+@@ -105,13 +112,13 @@ int mt76_fwlog(const char *phyname, int argc, char **argv)
+ 		return 1;
+ 	}
+ 
+-	setsockopt(s, SOL_SOCKET, SO_BROADCAST, &yes, sizeof(yes));
++	/* setsockopt(s, SOL_SOCKET, SO_BROADCAST, &yes, sizeof(yes)); */
+ 	if (bind(s, (struct sockaddr *)&local, sizeof(local)) < 0) {
+ 		perror("bind");
+ 		return 1;
+ 	}
+ 
+-	if (mt76_set_fwlog_en(phyname, true))
++	if (mt76_set_fwlog_en(phyname, true, argv[1]))
+ 		return 1;
+ 
+ 	fd = open(debugfs_path(phyname, "fwlog_data"), O_RDONLY);
+@@ -145,8 +152,8 @@ int mt76_fwlog(const char *phyname, int argc, char **argv)
+ 		if (!r)
+ 			continue;
+ 
+-		if (len > sizeof(buf)) {
+-			fprintf(stderr, "Length error: %d > %d\n", len, (int)sizeof(buf));
++		if (len > BUF_SIZE) {
++			fprintf(stderr, "Length error: %d > %d\n", len, BUF_SIZE);
+ 			ret = 1;
+ 			break;
+ 		}
+@@ -171,7 +178,7 @@ int mt76_fwlog(const char *phyname, int argc, char **argv)
+ 	close(fd);
+ 
+ out:
+-	mt76_set_fwlog_en(phyname, false);
++	mt76_set_fwlog_en(phyname, false, NULL);
+ 
+ 	return ret;
+ }
+-- 
+2.39.2
+
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/1001-mt76-mt7996-add-txpower-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/1001-mt76-mt7996-add-txpower-support.patch
new file mode 100644
index 0000000..f162ca4
--- /dev/null
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211/package/kernel/mt76/patches/1001-mt76-mt7996-add-txpower-support.patch
@@ -0,0 +1,566 @@
+From d7cae77110e06d64cf5046278e905aeb676ef594 Mon Sep 17 00:00:00 2001
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Date: Fri, 24 Mar 2023 23:35:30 +0800
+Subject: [PATCH 1001/1001] mt76: mt7996: add txpower support
+
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Change-Id: Ic3e7b17f3664fa7f774137572f885359fa2ec93b
+---
+ mt7996/eeprom.c      |  34 +++++++
+ mt7996/eeprom.h      |  42 ++++++++
+ mt7996/mcu.h         |   2 +
+ mt7996/mt7996.h      |   3 +
+ mt7996/mtk_debugfs.c | 229 +++++++++++++++++++++++++++++++++++++++++++
+ mt7996/mtk_mcu.c     |  23 +++++
+ mt7996/mtk_mcu.h     |  78 +++++++++++++++
+ mt7996/regs.h        |  17 +++-
+ 8 files changed, 423 insertions(+), 5 deletions(-)
+
+diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
+index 7bff504a..670e0db3 100644
+--- a/mt7996/eeprom.c
++++ b/mt7996/eeprom.c
+@@ -284,3 +284,37 @@ s8 mt7996_eeprom_get_power_delta(struct mt7996_dev *dev, int band)
+ 
+ 	return val & MT_EE_RATE_DELTA_SIGN ? delta : -delta;
+ }
++
++const u8 mt7996_sku_group_len[] = {
++	[SKU_CCK] = 4,
++	[SKU_OFDM] = 8,
++	[SKU_HT20] = 8,
++	[SKU_HT40] = 9,
++	[SKU_VHT20] = 12,
++	[SKU_VHT40] = 12,
++	[SKU_VHT80] = 12,
++	[SKU_VHT160] = 12,
++	[SKU_HE26] = 12,
++	[SKU_HE52] = 12,
++	[SKU_HE106] = 12,
++	[SKU_HE242] = 12,
++	[SKU_HE484] = 12,
++	[SKU_HE996] = 12,
++	[SKU_HE2x996] = 12,
++	[SKU_EHT26] = 16,
++	[SKU_EHT52] = 16,
++	[SKU_EHT106] = 16,
++	[SKU_EHT242] = 16,
++	[SKU_EHT484] = 16,
++	[SKU_EHT996] = 16,
++	[SKU_EHT2x996] = 16,
++	[SKU_EHT4x996] = 16,
++	[SKU_EHT26_52] = 16,
++	[SKU_EHT26_106] = 16,
++	[SKU_EHT484_242] = 16,
++	[SKU_EHT996_484] = 16,
++	[SKU_EHT996_484_242] = 16,
++	[SKU_EHT2x996_484] = 16,
++	[SKU_EHT3x996] = 16,
++	[SKU_EHT3x996_484] = 16,
++};
+diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
+index f7497c9b..b5852da5 100644
+--- a/mt7996/eeprom.h
++++ b/mt7996/eeprom.h
+@@ -73,4 +73,46 @@ mt7996_get_channel_group_6g(int channel)
+ 	return DIV_ROUND_UP(channel - 29, 32);
+ }
+ 
++enum mt7996_sku_rate_group {
++	SKU_CCK,
++	SKU_OFDM,
++
++	SKU_HT20,
++	SKU_HT40,
++
++	SKU_VHT20,
++	SKU_VHT40,
++	SKU_VHT80,
++	SKU_VHT160,
++
++	SKU_HE26,
++	SKU_HE52,
++	SKU_HE106,
++	SKU_HE242,
++	SKU_HE484,
++	SKU_HE996,
++	SKU_HE2x996,
++
++	SKU_EHT26,
++	SKU_EHT52,
++	SKU_EHT106,
++	SKU_EHT242,
++	SKU_EHT484,
++	SKU_EHT996,
++	SKU_EHT2x996,
++	SKU_EHT4x996,
++	SKU_EHT26_52,
++	SKU_EHT26_106,
++	SKU_EHT484_242,
++	SKU_EHT996_484,
++	SKU_EHT996_484_242,
++	SKU_EHT2x996_484,
++	SKU_EHT3x996,
++	SKU_EHT3x996_484,
++
++	MAX_SKU_RATE_GROUP_NUM,
++};
++
++extern const u8 mt7996_sku_group_len[MAX_SKU_RATE_GROUP_NUM];
++
+ #endif
+diff --git a/mt7996/mcu.h b/mt7996/mcu.h
+index ebc62713..476e007b 100644
+--- a/mt7996/mcu.h
++++ b/mt7996/mcu.h
+@@ -698,6 +698,7 @@ struct tx_power_ctrl {
+ 		bool ate_mode_enable;
+ 		bool percentage_ctrl_enable;
+ 		bool bf_backoff_enable;
++		u8 show_info_category;
+ 		u8 power_drop_level;
+ 	};
+ 	u8 band_idx;
+@@ -711,6 +712,7 @@ enum {
+ 	UNI_TXPOWER_BACKOFF_POWER_LIMIT_CTRL = 3,
+ 	UNI_TXPOWER_POWER_LIMIT_TABLE_CTRL = 4,
+ 	UNI_TXPOWER_ATE_MODE_CTRL = 6,
++	UNI_TXPOWER_SHOW_INFO = 7,
+ };
+ 
+ enum {
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index 8b76d69a..d5be582d 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -53,6 +53,8 @@
+ #define MT7996_CRIT_TEMP		110
+ #define MT7996_MAX_TEMP			120
+ 
++#define MT7996_SKU_RATE_NUM		417
++
+ struct mt7996_vif;
+ struct mt7996_sta;
+ struct mt7996_dfs_pulse;
+@@ -518,6 +520,7 @@ int mt7996_mcu_fw_dbg_ctrl(struct mt7996_dev *dev, u32 module, u8 level);
+ void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
+ void mt7996_mcu_exit(struct mt7996_dev *dev);
+ int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
++int mt7996_mcu_get_tx_power_info(struct mt7996_phy *phy, u8 category, void *event);
+ 
+ static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
+ {
+diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
+index 080f756e..c05f8465 100644
+--- a/mt7996/mtk_debugfs.c
++++ b/mt7996/mtk_debugfs.c
+@@ -2296,6 +2296,232 @@ static int mt7996_sta_info(struct seq_file *s, void *data)
+ 	return 0;
+ }
+ 
++static int
++mt7996_txpower_level_set(void *data, u64 val)
++{
++	struct mt7996_phy *phy = data;
++	int ret;
++
++	if (val > 100)
++		return -EINVAL;
++
++	ret = mt7996_mcu_set_tx_power_ctrl(phy, UNI_TXPOWER_PERCENTAGE_CTRL, !!val);
++	if (ret)
++		return ret;
++
++	return mt7996_mcu_set_tx_power_ctrl(phy, UNI_TXPOWER_PERCENTAGE_DROP_CTRL, val);
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_txpower_level, NULL,
++			 mt7996_txpower_level_set, "%lld\n");
++
++static ssize_t
++mt7996_get_txpower_info(struct file *file, char __user *user_buf,
++			size_t count, loff_t *ppos)
++{
++	struct mt7996_phy *phy = file->private_data;
++	struct mt7996_mcu_txpower_event *event;
++	struct txpower_basic_info *basic_info;
++	static const size_t size = 2048;
++	int len = 0;
++	ssize_t ret;
++	char *buf;
++
++	buf = kzalloc(size, GFP_KERNEL);
++	event = kzalloc(sizeof(*event), GFP_KERNEL);
++	if (!buf || !event)
++		return -ENOMEM;
++
++	ret = mt7996_mcu_get_tx_power_info(phy, BASIC_INFO, event);
++	if (ret ||
++	    le32_to_cpu(event->basic_info.category) != UNI_TXPOWER_BASIC_INFO)
++		goto out;
++
++	basic_info = &event->basic_info;
++
++	len += scnprintf(buf + len, size - len,
++			 "======================== BASIC INFO ========================\n");
++	len += scnprintf(buf + len, size - len, "    Band Index: %d, Channel Band: %d\n",
++			 basic_info->band_idx, basic_info->band);
++	len += scnprintf(buf + len, size - len, "    PA Type: %s\n",
++			 basic_info->is_epa ? "ePA" : "iPA");
++	len += scnprintf(buf + len, size - len, "    LNA Type: %s\n",
++			 basic_info->is_elna ? "eLNA" : "iLNA");
++
++	len += scnprintf(buf + len, size - len,
++			 "------------------------------------------------------------\n");
++	len += scnprintf(buf + len, size - len, "    SKU: %s\n",
++			 basic_info->sku_enable ? "enable" : "disable");
++	len += scnprintf(buf + len, size - len, "    Percentage Control: %s\n",
++			 basic_info->percentage_ctrl_enable ? "enable" : "disable");
++	len += scnprintf(buf + len, size - len, "    Power Drop: %d [dBm]\n",
++			 basic_info->power_drop_level >> 1);
++	len += scnprintf(buf + len, size - len, "    Backoff: %s\n",
++			 basic_info->bf_backoff_enable ? "enable" : "disable");
++	len += scnprintf(buf + len, size - len, "    TX Front-end Loss:  %d, %d, %d, %d\n",
++			 basic_info->front_end_loss_tx[0], basic_info->front_end_loss_tx[1],
++			 basic_info->front_end_loss_tx[2], basic_info->front_end_loss_tx[3]);
++	len += scnprintf(buf + len, size - len, "    RX Front-end Loss:  %d, %d, %d, %d\n",
++			 basic_info->front_end_loss_rx[0], basic_info->front_end_loss_rx[1],
++			 basic_info->front_end_loss_rx[2], basic_info->front_end_loss_rx[3]);
++	len += scnprintf(buf + len, size - len,
++			 "    MU TX Power Mode:  %s\n",
++			 basic_info->mu_tx_power_manual_enable ? "manual" : "auto");
++	len += scnprintf(buf + len, size - len,
++			 "    MU TX Power (Auto / Manual): %d / %d [0.5 dBm]\n",
++			 basic_info->mu_tx_power_auto, basic_info->mu_tx_power_manual);
++	len += scnprintf(buf + len, size - len,
++			 "    Thermal Compensation:  %s\n",
++			 basic_info->thermal_compensate_enable ? "enable" : "disable");
++	len += scnprintf(buf + len, size - len,
++			 "    Theraml Compensation Value: %d\n",
++			 basic_info->thermal_compensate_value);
++
++	ret = simple_read_from_buffer(user_buf, count, ppos, buf, len);
++
++out:
++	kfree(buf);
++	kfree(event);
++	return ret;
++}
++
++static const struct file_operations mt7996_txpower_info_fops = {
++	.read = mt7996_get_txpower_info,
++	.open = simple_open,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++#define mt7996_txpower_puts(rate)							\
++({											\
++	len += scnprintf(buf + len, size - len, "%-21s:", #rate " (TMAC)");		\
++	for (i = 0; i < mt7996_sku_group_len[SKU_##rate]; i++, offs++)			\
++		len += scnprintf(buf + len, size - len, " %6d",				\
++				 event->phy_rate_info.frame_power[offs][band_idx]);	\
++	len += scnprintf(buf + len, size - len, "\n");					\
++})
++
++static ssize_t
++mt7996_get_txpower_sku(struct file *file, char __user *user_buf,
++		       size_t count, loff_t *ppos)
++{
++	struct mt7996_phy *phy = file->private_data;
++	struct mt7996_dev *dev = phy->dev;
++	struct mt7996_mcu_txpower_event *event;
++	u8 band_idx = phy->mt76->band_idx;
++	static const size_t size = 5120;
++	int i, offs = 0, len = 0;
++	ssize_t ret;
++	char *buf;
++	u32 reg;
++
++	buf = kzalloc(size, GFP_KERNEL);
++	event = kzalloc(sizeof(*event), GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	ret = mt7996_mcu_get_tx_power_info(phy, PHY_RATE_INFO, event);
++	if (ret ||
++	    le32_to_cpu(event->phy_rate_info.category) != UNI_TXPOWER_PHY_RATE_INFO)
++		goto out;
++
++	len += scnprintf(buf + len, size - len,
++			 "\nPhy %d TX Power Table (Channel %d)\n",
++			 band_idx, phy->mt76->chandef.chan->hw_value);
++	len += scnprintf(buf + len, size - len, "%-21s  %6s %6s %6s %6s\n",
++			 " ", "1m", "2m", "5m", "11m");
++	mt7996_txpower_puts(CCK);
++
++	len += scnprintf(buf + len, size - len,
++			 "%-21s  %6s %6s %6s %6s %6s %6s %6s %6s\n",
++			 " ", "6m", "9m", "12m", "18m", "24m", "36m", "48m",
++			 "54m");
++	mt7996_txpower_puts(OFDM);
++
++	len += scnprintf(buf + len, size - len,
++			 "%-21s  %6s %6s %6s %6s %6s %6s %6s %6s\n",
++			 " ", "mcs0", "mcs1", "mcs2", "mcs3", "mcs4",
++			 "mcs5", "mcs6", "mcs7");
++	mt7996_txpower_puts(HT20);
++
++	len += scnprintf(buf + len, size - len,
++			 "%-21s  %6s %6s %6s %6s %6s %6s %6s %6s %6s\n",
++			 " ", "mcs0", "mcs1", "mcs2", "mcs3", "mcs4", "mcs5",
++			 "mcs6", "mcs7", "mcs32");
++	mt7996_txpower_puts(HT40);
++
++	len += scnprintf(buf + len, size - len,
++			 "%-21s  %6s %6s %6s %6s %6s %6s %6s %6s %6s %6s %6s %6s\n",
++			 " ", "mcs0", "mcs1", "mcs2", "mcs3", "mcs4", "mcs5",
++			 "mcs6", "mcs7", "mcs8", "mcs9", "mcs10", "mcs11");
++	mt7996_txpower_puts(VHT20);
++	mt7996_txpower_puts(VHT40);
++	mt7996_txpower_puts(VHT80);
++	mt7996_txpower_puts(VHT160);
++	mt7996_txpower_puts(HE26);
++	mt7996_txpower_puts(HE52);
++	mt7996_txpower_puts(HE106);
++	mt7996_txpower_puts(HE242);
++	mt7996_txpower_puts(HE484);
++	mt7996_txpower_puts(HE996);
++	mt7996_txpower_puts(HE2x996);
++
++	len += scnprintf(buf + len, size - len,
++			 "%-21s  %6s %6s %6s %6s %6s %6s %6s %6s ",
++			 " ", "mcs0", "mcs1", "mcs2", "mcs3", "mcs4", "mcs5", "mcs6", "mcs7");
++	len += scnprintf(buf + len, size - len,
++			 "%6s %6s %6s %6s %6s %6s %6s %6s\n",
++			 "mcs8", "mcs9", "mcs10", "mcs11", "mcs12", "mcs13", "mcs14", "mcs15");
++	mt7996_txpower_puts(EHT26);
++	mt7996_txpower_puts(EHT52);
++	mt7996_txpower_puts(EHT106);
++	mt7996_txpower_puts(EHT242);
++	mt7996_txpower_puts(EHT484);
++	mt7996_txpower_puts(EHT996);
++	mt7996_txpower_puts(EHT2x996);
++	mt7996_txpower_puts(EHT4x996);
++	mt7996_txpower_puts(EHT26_52);
++	mt7996_txpower_puts(EHT26_106);
++	mt7996_txpower_puts(EHT484_242);
++	mt7996_txpower_puts(EHT996_484);
++	mt7996_txpower_puts(EHT996_484_242);
++	mt7996_txpower_puts(EHT2x996_484);
++	mt7996_txpower_puts(EHT3x996);
++	mt7996_txpower_puts(EHT3x996_484);
++
++	len += scnprintf(buf + len, size - len, "\nePA Gain: %d\n",
++			 event->phy_rate_info.epa_gain);
++	len += scnprintf(buf + len, size - len, "Max Power Bound: %d\n",
++			 event->phy_rate_info.max_power_bound);
++	len += scnprintf(buf + len, size - len, "Min Power Bound: %d\n",
++			 event->phy_rate_info.min_power_bound);
++
++	reg = MT_WF_PHYDFE_BAND_TPC_CTRL_STAT0(band_idx);
++	len += scnprintf(buf + len, size - len,
++			 "BBP TX Power (target power from TMAC)  : %6ld [0.5 dBm]\n",
++			 mt76_get_field(dev, reg, MT_WF_PHY_TPC_POWER_TMAC));
++	len += scnprintf(buf + len, size - len,
++			 "BBP TX Power (target power from RMAC)  : %6ld [0.5 dBm]\n",
++			 mt76_get_field(dev, reg, MT_WF_PHY_TPC_POWER_RMAC));
++	len += scnprintf(buf + len, size - len,
++			 "BBP TX Power (TSSI module power input)  : %6ld [0.5 dBm]\n",
++			 mt76_get_field(dev, reg, MT_WF_PHY_TPC_POWER_TSSI));
++
++	ret = simple_read_from_buffer(user_buf, count, ppos, buf, len);
++
++out:
++	kfree(buf);
++	kfree(event);
++	return ret;
++}
++
++static const struct file_operations mt7996_txpower_sku_fops = {
++	.read = mt7996_get_txpower_sku,
++	.open = simple_open,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
+ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+ {
+ 	struct mt7996_dev *dev = phy->dev;
+@@ -2334,6 +2560,9 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir)
+ 
+ 	debugfs_create_devm_seqfile(dev->mt76.dev, "tr_info", dir,
+ 				    mt7996_trinfo_read);
++	debugfs_create_file("txpower_level", 0600, dir, phy, &fops_txpower_level);
++	debugfs_create_file("txpower_info", 0600, dir, phy, &mt7996_txpower_info_fops);
++	debugfs_create_file("txpower_sku", 0600, dir, phy, &mt7996_txpower_sku_fops);
+ 
+ 	debugfs_create_devm_seqfile(dev->mt76.dev, "wtbl_info", dir,
+ 				    mt7996_wtbl_read);
+diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
+index e8870166..f772243b 100644
+--- a/mt7996/mtk_mcu.c
++++ b/mt7996/mtk_mcu.c
+@@ -12,7 +12,30 @@
+ 
+ #ifdef CONFIG_MTK_DEBUG
+ 
++int mt7996_mcu_get_tx_power_info(struct mt7996_phy *phy, u8 category, void *event)
++{
++	struct mt7996_dev *dev = phy->dev;
++	struct tx_power_ctrl req = {
++		.tag = cpu_to_le16(UNI_TXPOWER_SHOW_INFO),
++		.len = cpu_to_le16(sizeof(req) - 4),
++		.power_ctrl_id = UNI_TXPOWER_SHOW_INFO,
++		.show_info_category = category,
++		.band_idx = phy->mt76->band_idx,
++	};
++	struct sk_buff *skb;
++	int ret;
+ 
++	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
++					MCU_WM_UNI_CMD_QUERY(TXPOWER),
++					&req, sizeof(req), true, &skb);
++	if (ret)
++		return ret;
+ 
++	memcpy(event, skb->data, sizeof(struct mt7996_mcu_txpower_event));
++
++	dev_kfree_skb(skb);
++
++	return 0;
++}
+ 
+ #endif
+diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
+index e741aa27..1fa449ea 100644
+--- a/mt7996/mtk_mcu.h
++++ b/mt7996/mtk_mcu.h
+@@ -10,6 +10,84 @@
+ 
+ #ifdef CONFIG_MTK_DEBUG
+ 
++struct txpower_basic_info {
++	u8 category;
++	u8 rsv1;
++
++	/* basic info */
++	u8 band_idx;
++	u8 band;
++
++	/* board type info */
++	bool is_epa;
++	bool is_elna;
++
++	/* power percentage info */
++	bool percentage_ctrl_enable;
++	u8 power_drop_level;
++
++	/* frond-end loss TX info */
++	u8 front_end_loss_tx[4];
++
++	/* frond-end loss RX info */
++	u8 front_end_loss_rx[4];
++
++	/* thermal info */
++	bool thermal_compensate_enable;
++	u8 thermal_compensate_value;
++	u8 rsv2;
++
++	/* TX power max/min limit info */
++	u8 max_power_bound;
++	u8 min_power_bound;
++
++	/* power limit info */
++	bool sku_enable;
++	bool bf_backoff_enable;
++
++	/* MU TX power info */
++	bool mu_tx_power_manual_enable;
++	u8 mu_tx_power_auto;
++	u8 mu_tx_power_manual;
++	u8 rsv3;
++};
++
++struct txpower_phy_rate_info {
++	u8 category;
++	u8 band_idx;
++	u8 band;
++	u8 epa_gain;
++
++	/* rate power info [dBm] */
++	s8 frame_power[MT7996_SKU_RATE_NUM][__MT_MAX_BAND];
++
++	/* TX power max/min limit info */
++	s8 max_power_bound;
++	s8 min_power_bound;
++	u8 rsv1;
++};
++
++struct mt7996_mcu_txpower_event {
++	u8 _rsv[4];
++
++	__le16 tag;
++	__le16 len;
++
++	union {
++		struct txpower_basic_info basic_info;
++		struct txpower_phy_rate_info phy_rate_info;
++	};
++};
++
++enum txpower_category {
++	BASIC_INFO,
++	PHY_RATE_INFO = 2,
++};
++
++enum txpower_event {
++	UNI_TXPOWER_BASIC_INFO = 0,
++	UNI_TXPOWER_PHY_RATE_INFO = 5,
++};
+ 
+ #endif
+ 
+diff --git a/mt7996/regs.h b/mt7996/regs.h
+index 0775ca58..03e8329e 100644
+--- a/mt7996/regs.h
++++ b/mt7996/regs.h
+@@ -543,15 +543,22 @@ enum base_rev {
+ 
+ #define MT_PCIE1_MAC_INT_ENABLE			MT_PCIE1_MAC(0x188)
+ 
+-/* PHYRX CTRL */
+-#define MT_WF_PHYRX_BAND_BASE			0x83080000
+-#define MT_WF_PHYRX_BAND(_band, ofs)		(MT_WF_PHYRX_BAND_BASE + \
++/* PHY CTRL */
++#define MT_WF_PHY_BAND_BASE			0x83080000
++#define MT_WF_PHY_BAND(_band, ofs)		(MT_WF_PHY_BAND_BASE + \
+ 						 ((_band) << 20) + (ofs))
+ 
+-#define MT_WF_PHYRX_BAND_RX_CTRL1(_band)	MT_WF_PHYRX_BAND(_band, 0x2004)
++/* PHYRX CTRL */
++#define MT_WF_PHYRX_BAND_RX_CTRL1(_band)	MT_WF_PHY_BAND(_band, 0x2004)
+ #define MT_WF_PHYRX_BAND_RX_CTRL1_IPI_EN	GENMASK(2, 0)
+ #define MT_WF_PHYRX_BAND_RX_CTRL1_STSCNT_EN	GENMASK(11, 9)
+ 
++/* PHYDFE CTRL */
++#define MT_WF_PHYDFE_BAND_TPC_CTRL_STAT0(_phy)	MT_WF_PHY_BAND(_phy, 0xe7a0)
++#define MT_WF_PHY_TPC_POWER_TMAC		GENMASK(15, 8)
++#define MT_WF_PHY_TPC_POWER_RMAC		GENMASK(23, 16)
++#define MT_WF_PHY_TPC_POWER_TSSI		GENMASK(31, 24)
++
+ /* PHYRX CSD */
+ #define MT_WF_PHYRX_CSD_BASE			0x83000000
+ #define MT_WF_PHYRX_CSD(_band, _wf, ofs)	(MT_WF_PHYRX_CSD_BASE + \
+@@ -560,7 +567,7 @@ enum base_rev {
+ #define MT_WF_PHYRX_CSD_IRPI(_band, _wf)	MT_WF_PHYRX_CSD(_band, _wf, 0x1000)
+ 
+ /* PHYRX CSD BAND */
+-#define MT_WF_PHYRX_CSD_BAND_RXTD12(_band)		MT_WF_PHYRX_BAND(_band, 0x8230)
++#define MT_WF_PHYRX_CSD_BAND_RXTD12(_band)		MT_WF_PHY_BAND(_band, 0x8230)
+ #define MT_WF_PHYRX_CSD_BAND_RXTD12_IRPI_SW_CLR_ONLY	BIT(18)
+ #define MT_WF_PHYRX_CSD_BAND_RXTD12_IRPI_SW_CLR		BIT(29)
+ 
+-- 
+2.39.2
+