diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-testmode-additional-supports.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-testmode-additional-supports.patch
index 743b087..e2dcba6 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-testmode-additional-supports.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-testmode-additional-supports.patch
@@ -1,7 +1,7 @@
-From 6a285836d16bb46349603858116df5305787e774 Mon Sep 17 00:00:00 2001
+From 219040e9aa5a584809fce08c86d6a6279cf7fe8a Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
-Subject: [PATCH 1112/1132] mt76: testmode: additional supports
+Subject: [PATCH 1112/1133] mt76: testmode: additional supports
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -11,21 +11,22 @@
  mt76.h            |  108 ++++-
  mt76_connac_mcu.c |    4 +
  mt76_connac_mcu.h |    2 +
+ mt7915/eeprom.c   |    2 +-
  mt7915/init.c     |    2 +-
  mt7915/mac.c      |   39 +-
  mt7915/main.c     |    2 +-
- mt7915/mcu.c      |   10 +-
+ mt7915/mcu.c      |   19 +-
  mt7915/mcu.h      |   28 +-
  mt7915/mmio.c     |    2 +
- mt7915/mt7915.h   |   14 +-
+ mt7915/mt7915.h   |   16 +-
  mt7915/regs.h     |    3 +
- mt7915/testmode.c | 1177 ++++++++++++++++++++++++++++++++++++++++++---
+ mt7915/testmode.c | 1184 ++++++++++++++++++++++++++++++++++++++++++---
  mt7915/testmode.h |  278 +++++++++++
  testmode.c        |  280 +++++++++--
  testmode.h        |   75 +++
  tools/fields.c    |   84 +++-
  tx.c              |    3 +-
- 19 files changed, 1975 insertions(+), 151 deletions(-)
+ 20 files changed, 1990 insertions(+), 156 deletions(-)
 
 diff --git a/dma.c b/dma.c
 index df2ca73..fe65e0f 100644
@@ -275,6 +276,19 @@
  	MCU_EXT_CMD_CERT_CFG = 0xb7,
  	MCU_EXT_CMD_CSI_CTRL = 0xc2,
  };
+diff --git a/mt7915/eeprom.c b/mt7915/eeprom.c
+index a796289..f1b1471 100644
+--- a/mt7915/eeprom.c
++++ b/mt7915/eeprom.c
+@@ -126,7 +126,7 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev)
+ 		/* read eeprom data from efuse */
+ 		block_num = DIV_ROUND_UP(eeprom_size, eeprom_blk_size);
+ 		for (i = 0; i < block_num; i++) {
+-			ret = mt7915_mcu_get_eeprom(dev, i * eeprom_blk_size);
++			ret = mt7915_mcu_get_eeprom(dev, i * eeprom_blk_size, NULL);
+ 			if (ret < 0)
+ 				return ret;
+ 		}
 diff --git a/mt7915/init.c b/mt7915/init.c
 index 1177e4e..f40d09c 100644
 --- a/mt7915/init.c
@@ -371,7 +385,7 @@
  		goto out;
  
 diff --git a/mt7915/main.c b/mt7915/main.c
-index f0cbfbe..651887c 100644
+index 3a9f343..8789444 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -238,7 +238,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw,
@@ -384,7 +398,7 @@
  		mvif->mt76.wmm_idx += 2;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 7b7916c..ec695c7 100644
+index b0cdd4a..6f9acd8 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -383,6 +383,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -407,7 +421,7 @@
  	    !rxd->seq)
  		mt7915_mcu_rx_unsolicited_event(dev, skb);
  	else
-@@ -2850,14 +2856,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
+@@ -2860,21 +2866,21 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
  	return 0;
  }
  
@@ -424,8 +438,38 @@
  		return mt7915_mcu_set_eeprom_flash(dev);
  
  	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
+ 				 &req, sizeof(req), true);
+ }
+ 
+-int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
++int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset, u8 *read_buf)
+ {
+ 	struct mt7915_mcu_eeprom_info req = {
+ 		.addr = cpu_to_le32(round_down(offset,
+@@ -2883,7 +2889,7 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
+ 	struct mt7915_mcu_eeprom_info *res;
+ 	struct sk_buff *skb;
+ 	int ret;
+-	u8 *buf;
++	u8 *buf = read_buf;
+ 
+ 	ret = mt76_mcu_send_and_get_msg(&dev->mt76,
+ 					MCU_EXT_QUERY(EFUSE_ACCESS),
+@@ -2892,8 +2898,11 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset)
+ 		return ret;
+ 
+ 	res = (struct mt7915_mcu_eeprom_info *)skb->data;
+-	buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
++
++	if (!buf)
++		buf = dev->mt76.eeprom.data + le32_to_cpu(res->addr);
+ 	memcpy(buf, res->data, MT7915_EEPROM_BLOCK_SIZE);
++
+ 	dev_kfree_skb(skb);
+ 
+ 	return 0;
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 3c16d21..0a99cb3 100644
+index 99d733b..dd6a44d 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -8,10 +8,15 @@
@@ -457,7 +501,7 @@
  	MT_BF_TYPE_UPDATE = 20,
  	MT_BF_MODULE_UPDATE = 25
  };
-@@ -718,10 +729,19 @@ struct mt7915_muru {
+@@ -717,10 +728,19 @@ struct mt7915_muru {
  #define MURU_OFDMA_SCH_TYPE_UL          BIT(1)
  
  /* Common Config */
@@ -502,7 +546,7 @@
  	[AGG_PCR0]		= 0x040,
  	[AGG_ACR0]		= 0x054,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 8b292c3..9d9c5fc 100644
+index 055cbb5..416606a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -323,6 +323,9 @@ struct mt7915_phy {
@@ -530,16 +574,18 @@
  #ifdef MTK_DEBUG
  	u16 wlan_idx;
  	struct {
-@@ -592,7 +603,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+@@ -594,8 +605,8 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
  				   struct ieee80211_vif *vif,
  				   struct ieee80211_sta *sta,
  				   void *data, u32 field);
 -int mt7915_mcu_set_eeprom(struct mt7915_dev *dev);
+-int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset);
 +int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode);
- int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset);
++int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset, u8 *read_buf);
  int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
  int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
-@@ -630,6 +641,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+ 		       bool hdr_trans);
+@@ -632,6 +643,7 @@ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
  int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
  void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
  void mt7915_mcu_exit(struct mt7915_dev *dev);
@@ -569,7 +615,7 @@
  							  (_n) * 4))
  #define MT_AGG_PCR0(_band, _n)		MT_WF_AGG(_band, (__OFFS(AGG_PCR0) +	\
 diff --git a/mt7915/testmode.c b/mt7915/testmode.c
-index 4693919..9317a8e 100644
+index 4693919..1ed2ea8 100644
 --- a/mt7915/testmode.c
 +++ b/mt7915/testmode.c
 @@ -9,6 +9,9 @@
@@ -1850,7 +1896,7 @@
  	void *rx, *rssi;
  	int i;
  
-@@ -852,11 +1822,68 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+@@ -852,11 +1822,75 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
  
  	nla_nest_end(msg, rx);
  
@@ -1864,7 +1910,7 @@
 +mt7915_tm_write_back_to_efuse(struct mt7915_dev *dev)
 +{
 +	struct mt7915_mcu_eeprom_info req = {};
-+	u8 *eeprom = dev->mt76.eeprom.data;
++	u8 read_buf[MT76_TM_EEPROM_BLOCK_SIZE], *eeprom = dev->mt76.eeprom.data;
 +	int i, ret = -EINVAL;
 +
 +	/* prevent from damaging chip id in efuse */
@@ -1873,7 +1919,14 @@
 +
 +	for (i = 0; i < mt7915_eeprom_size(dev); i += MT76_TM_EEPROM_BLOCK_SIZE) {
 +		req.addr = cpu_to_le32(i);
-+		memcpy(&req.data, eeprom + i, MT76_TM_EEPROM_BLOCK_SIZE);
++		memcpy(req.data, eeprom + i, MT76_TM_EEPROM_BLOCK_SIZE);
++
++		ret = mt7915_mcu_get_eeprom(dev, i, read_buf);
++		if (ret < 0)
++			return ret;
++
++		if (!memcmp(req.data, read_buf, MT76_TM_EEPROM_BLOCK_SIZE))
++			continue;
 +
 +		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_ACCESS),
 +					&req, sizeof(req), true);