diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
new file mode 100644
index 0000000..4b45104
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0001-mt76-mt7915-rework-testmode-init-registers.patch
@@ -0,0 +1,179 @@
+From 9d16552ff5dc96dd576d15f263ac1ae180ac615e Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Wed, 19 Jan 2022 15:46:06 +0800
+Subject: [PATCH 1/6] mt76: mt7915: rework testmode init registers
+
+---
+ mt7915/mmio.c     |  2 ++
+ mt7915/regs.h     | 16 +++++++++++++--
+ mt7915/testmode.c | 52 ++++++++++++++++++++++++++++++++++-------------
+ 3 files changed, 54 insertions(+), 16 deletions(-)
+
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 5062e0d8..2466907e 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -53,6 +53,7 @@ static const u32 mt7986_reg[] = {
+ };
+ 
+ static const u32 mt7915_offs[] = {
++	[TMAC_TCR2]		= 0x05c,
+ 	[TMAC_CDTR]		= 0x090,
+ 	[TMAC_ODTR]		= 0x094,
+ 	[TMAC_ATCR]		= 0x098,
+@@ -126,6 +127,7 @@ static const u32 mt7915_offs[] = {
+ };
+ 
+ static const u32 mt7916_offs[] = {
++	[TMAC_TCR2]		= 0x004,
+ 	[TMAC_CDTR]		= 0x0c8,
+ 	[TMAC_ODTR]		= 0x0cc,
+ 	[TMAC_ATCR]		= 0x00c,
+diff --git a/mt7915/regs.h b/mt7915/regs.h
+index e5f93c40..999dd7fc 100644
+--- a/mt7915/regs.h
++++ b/mt7915/regs.h
+@@ -34,6 +34,7 @@ enum reg_rev {
+ };
+ 
+ enum offs_rev {
++	TMAC_TCR2,
+ 	TMAC_CDTR,
+ 	TMAC_ODTR,
+ 	TMAC_ATCR,
+@@ -172,6 +173,12 @@ enum offs_rev {
+ #define MT_MDP_TO_HIF			0
+ #define MT_MDP_TO_WM			1
+ 
++#define MT_MDP_TOP_DBG_WDT_CTRL			MT_MDP(0x0d0)
++#define MT_MDP_TOP_DBG_WDT_CTRL_TDP_DIS_BLK	BIT(7)
++
++#define MT_MDP_TOP_DBG_CTRL			MT_MDP(0x0dc)
++#define MT_MDP_TOP_DBG_CTRL_ENQ_MODE		BIT(30)
++
+ /* TMAC: band 0(0x820e4000), band 1(0x820f4000) */
+ #define MT_WF_TMAC_BASE(_band)		((_band) ? 0x820f4000 : 0x820e4000)
+ #define MT_WF_TMAC(_band, ofs)		(MT_WF_TMAC_BASE(_band) + (ofs))
+@@ -180,6 +187,9 @@ enum offs_rev {
+ #define MT_TMAC_TCR0_TX_BLINK		GENMASK(7, 6)
+ #define MT_TMAC_TCR0_TBTT_STOP_CTRL	BIT(25)
+ 
++#define MT_TMAC_TCR2(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_TCR2))
++#define MT_TMAC_TCR2_SCH_DET_DIS	BIT(19)
++
+ #define MT_TMAC_CDTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_CDTR))
+  #define MT_TMAC_ODTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_ODTR))
+ #define MT_TIMEOUT_VAL_PLCP		GENMASK(15, 0)
+@@ -451,8 +461,10 @@ enum offs_rev {
+ #define MT_AGG_PCR0_VHT_PROT		BIT(13)
+ #define MT_AGG_PCR0_PTA_WIN_DIS		BIT(15)
+ 
+-#define MT_AGG_PCR1_RTS0_NUM_THRES	GENMASK(31, 23)
+-#define MT_AGG_PCR1_RTS0_LEN_THRES	GENMASK(19, 0)
++#define MT_AGG_PCR1_RTS0_NUM_THRES		GENMASK(31, 23)
++#define MT_AGG_PCR1_RTS0_LEN_THRES		GENMASK(19, 0)
++#define MT_AGG_PCR1_RTS0_NUM_THRES_MT7916	GENMASK(29, 24)
++#define MT_AGG_PCR1_RTS0_LEN_THRES_MT7916	GENMASK(22, 0)
+ 
+ #define MT_AGG_ACR0(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR0))
+ #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index 20f63644..8d7ec9e8 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -30,7 +30,7 @@ struct reg_band {
+ 		{ _list.band[0] = MT_##_reg(0, _idx);	\
+ 		  _list.band[1] = MT_##_reg(1, _idx); }
+ 
+-#define TM_REG_MAX_ID	17
++#define TM_REG_MAX_ID	20
+ static struct reg_band reg_backup_list[TM_REG_MAX_ID];
+ 
+ 
+@@ -334,7 +334,7 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+ {
+ 	int n_regs = ARRAY_SIZE(reg_backup_list);
+ 	struct mt7915_dev *dev = phy->dev;
+-	u32 *b = phy->test.reg_backup;
++	u32 *b = phy->test.reg_backup, val;
+ 	int i;
+ 
+ 	REG_BAND_IDX(reg_backup_list[0], AGG_PCR0, 0);
+@@ -346,18 +346,28 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+ 	REG_BAND(reg_backup_list[6], AGG_MRCR);
+ 	REG_BAND(reg_backup_list[7], TMAC_TFCR0);
+ 	REG_BAND(reg_backup_list[8], TMAC_TCR0);
+-	REG_BAND(reg_backup_list[9], AGG_ATCR1);
+-	REG_BAND(reg_backup_list[10], AGG_ATCR3);
+-	REG_BAND(reg_backup_list[11], TMAC_TRCR0);
+-	REG_BAND(reg_backup_list[12], TMAC_ICR0);
+-	REG_BAND_IDX(reg_backup_list[13], ARB_DRNGR0, 0);
+-	REG_BAND_IDX(reg_backup_list[14], ARB_DRNGR0, 1);
+-	REG_BAND(reg_backup_list[15], WF_RFCR);
+-	REG_BAND(reg_backup_list[16], WF_RFCR1);
++	REG_BAND(reg_backup_list[9], TMAC_TCR2);
++	REG_BAND(reg_backup_list[10], AGG_ATCR1);
++	REG_BAND(reg_backup_list[11], AGG_ATCR3);
++	REG_BAND(reg_backup_list[12], TMAC_TRCR0);
++	REG_BAND(reg_backup_list[13], TMAC_ICR0);
++	REG_BAND_IDX(reg_backup_list[14], ARB_DRNGR0, 0);
++	REG_BAND_IDX(reg_backup_list[15], ARB_DRNGR0, 1);
++	REG_BAND(reg_backup_list[16], WF_RFCR);
++	REG_BAND(reg_backup_list[17], WF_RFCR1);
++
++	if (is_mt7916(&dev->mt76)) {
++		reg_backup_list[18].band[phy->band_idx] = MT_MDP_TOP_DBG_WDT_CTRL;
++		reg_backup_list[19].band[phy->band_idx] = MT_MDP_TOP_DBG_CTRL;
++	}
+ 
+ 	if (phy->mt76->test.state == MT76_TM_STATE_OFF) {
+-		for (i = 0; i < n_regs; i++)
+-			mt76_wr(dev, reg_backup_list[i].band[phy->band_idx], b[i]);
++		for (i = 0; i < n_regs; i++) {
++			u8 reg = reg_backup_list[i].band[phy->band_idx];
++
++			if (reg)
++				mt76_wr(dev, reg, b[i]);
++		}
+ 		return;
+ 	}
+ 
+@@ -377,8 +387,13 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+ 		   MT_AGG_PCR0_BW40_PROT | MT_AGG_PCR0_BW80_PROT);
+ 	mt76_set(dev, MT_AGG_PCR0(phy->band_idx, 0), MT_AGG_PCR0_PTA_WIN_DIS);
+ 
+-	mt76_wr(dev, MT_AGG_PCR0(phy->band_idx, 1), MT_AGG_PCR1_RTS0_NUM_THRES |
+-		MT_AGG_PCR1_RTS0_LEN_THRES);
++	if (is_mt7915(&dev->mt76))
++		val = MT_AGG_PCR1_RTS0_NUM_THRES | MT_AGG_PCR1_RTS0_LEN_THRES;
++	else
++		val = MT_AGG_PCR1_RTS0_NUM_THRES_MT7916 |
++		      MT_AGG_PCR1_RTS0_LEN_THRES_MT7916;
++
++	mt76_wr(dev, MT_AGG_PCR0(phy->band_idx, 1), val);
+ 
+ 	mt76_clear(dev, MT_AGG_MRCR(phy->band_idx), MT_AGG_MRCR_BAR_CNT_LIMIT |
+ 		   MT_AGG_MRCR_LAST_RTS_CTS_RN | MT_AGG_MRCR_RTS_FAIL_LIMIT |
+@@ -391,10 +406,19 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+ 
+ 	mt76_wr(dev, MT_TMAC_TFCR0(phy->band_idx), 0);
+ 	mt76_clear(dev, MT_TMAC_TCR0(phy->band_idx), MT_TMAC_TCR0_TBTT_STOP_CTRL);
++	mt76_set(dev, MT_TMAC_TCR2(phy->band_idx), MT_TMAC_TCR2_SCH_DET_DIS);
+ 
+ 	/* config rx filter for testmode rx */
+ 	mt76_wr(dev, MT_WF_RFCR(phy->band_idx), 0xcf70a);
+ 	mt76_wr(dev, MT_WF_RFCR1(phy->band_idx), 0);
++
++	if (is_mt7916(&dev->mt76)) {
++		/* enable MDP Tx block mode */
++		mt76_clear(dev, MT_MDP_TOP_DBG_WDT_CTRL,
++			   MT_MDP_TOP_DBG_WDT_CTRL_TDP_DIS_BLK);
++		mt76_clear(dev, MT_MDP_TOP_DBG_CTRL,
++			   MT_MDP_TOP_DBG_CTRL_ENQ_MODE);
++	}
+ }
+ 
+ static void
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch
new file mode 100644
index 0000000..2ece0e0
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0002-mt76-testmode-rework-tx-antenna-setting.patch
@@ -0,0 +1,76 @@
+From 2b65580db9081ac1ace74aed7b06cc855162d408 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Fri, 25 Feb 2022 09:36:01 +0800
+Subject: [PATCH 2/6] mt76: testmode: rework tx antenna setting
+
+---
+ mt7915/mcu.c      | 7 +------
+ mt7915/testmode.c | 9 +--------
+ testmode.c        | 4 ++--
+ 3 files changed, 4 insertions(+), 16 deletions(-)
+
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 2aba342c..549281a4 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -2822,14 +2822,9 @@ int mt7915_mcu_set_chan_info(struct mt7915_phy *phy, int cmd)
+ 
+ #ifdef CONFIG_NL80211_TESTMODE
+ 	if (phy->mt76->test.tx_antenna_mask &&
+-	    (phy->mt76->test.state == MT76_TM_STATE_TX_FRAMES ||
+-	     phy->mt76->test.state == MT76_TM_STATE_RX_FRAMES ||
+-	     phy->mt76->test.state == MT76_TM_STATE_TX_CONT)) {
++	    mt76_testmode_enabled(phy->mt76)) {
+ 		req.tx_streams_num = fls(phy->mt76->test.tx_antenna_mask);
+ 		req.rx_streams = phy->mt76->test.tx_antenna_mask;
+-
+-		if (phy != &dev->phy)
+-			req.rx_streams >>= dev->chainshift;
+ 	}
+ #endif
+ 
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index 8d7ec9e8..d6f71436 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -473,11 +473,7 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ 		if (td->tx_spe_idx) {
+ 			phy->test.spe_idx = td->tx_spe_idx;
+ 		} else {
+-			u8 tx_ant = td->tx_antenna_mask;
+-
+-			if (phy != &dev->phy)
+-				tx_ant >>= dev->chainshift;
+-			phy->test.spe_idx = spe_idx_map[tx_ant];
++			phy->test.spe_idx = spe_idx_map[td->tx_antenna_mask];
+ 		}
+ 	}
+ 
+@@ -728,9 +724,6 @@ mt7915_tm_set_params(struct mt76_phy *mphy, struct nlattr **tb,
+ 	    td->state == MT76_TM_STATE_OFF)
+ 		return 0;
+ 
+-	if (td->tx_antenna_mask & ~mphy->chainmask)
+-		return -EINVAL;
+-
+ 	for (i = 0; i < ARRAY_SIZE(tm_change_map); i++) {
+ 		if (tb[tm_change_map[i]])
+ 			changed |= BIT(i);
+diff --git a/testmode.c b/testmode.c
+index 382b4563..7cd00794 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -446,8 +446,8 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_LDPC], &td->tx_rate_ldpc, 0, 1) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_STBC], &td->tx_rate_stbc, 0, 1) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_LTF], &td->tx_ltf, 0, 2) ||
+-	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA],
+-			   &td->tx_antenna_mask, 0, 0xff) ||
++	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA], &td->tx_antenna_mask,
++			   1, phy->antenna_mask) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_SPE_IDX], &td->tx_spe_idx, 0, 27) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
+ 			   &td->tx_duty_cycle, 0, 99) ||
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch
new file mode 100644
index 0000000..822aaad
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0003-mt76-mt7915-rework-rx-testmode-stats.patch
@@ -0,0 +1,305 @@
+From 0b8c7d725830b5873c648777ab7813fff9d5951f Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Mon, 3 Jan 2022 17:09:53 +0800
+Subject: [PATCH 3/6] mt76: mt7915: rework rx testmode stats
+
+---
+ mac80211.c        |  3 +-
+ mt76.h            |  5 +++
+ mt76_connac_mcu.h |  1 +
+ mt7915/mcu.h      |  1 +
+ mt7915/testmode.c | 82 ++++++++++++++++++++++++++++++++++++++---------
+ mt7915/testmode.h | 28 ++++++++++++++++
+ testmode.c        |  3 ++
+ testmode.h        |  3 ++
+ 8 files changed, 109 insertions(+), 17 deletions(-)
+
+diff --git a/mac80211.c b/mac80211.c
+index 5b53d008..5a4ac5de 100644
+--- a/mac80211.c
++++ b/mac80211.c
+@@ -737,7 +737,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
+ 	}
+ 
+ #ifdef CONFIG_NL80211_TESTMODE
+-	if (phy->test.state == MT76_TM_STATE_RX_FRAMES) {
++	if (!(phy->test.flag & MT_TM_FW_RX_COUNT) &&
++	    phy->test.state == MT76_TM_STATE_RX_FRAMES) {
+ 		phy->test.rx_stats.packets[q]++;
+ 		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
+ 			phy->test.rx_stats.fcs_error[q]++;
+diff --git a/mt76.h b/mt76.h
+index 81078be3..d5f8650f 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -583,6 +583,8 @@ struct mt76_testmode_ops {
+ 	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
+ };
+ 
++#define MT_TM_FW_RX_COUNT	BIT(0)
++
+ struct mt76_testmode_data {
+ 	enum mt76_testmode_state state;
+ 
+@@ -614,6 +616,8 @@ struct mt76_testmode_data {
+ 
+ 	u8 addr[3][ETH_ALEN];
+ 
++	u8 flag;
++
+ 	u32 tx_pending;
+ 	u32 tx_queued;
+ 	u16 tx_queued_limit;
+@@ -621,6 +625,7 @@ struct mt76_testmode_data {
+ 	struct {
+ 		u64 packets[__MT_RXQ_MAX];
+ 		u64 fcs_error[__MT_RXQ_MAX];
++		u64 len_mismatch;
+ 	} rx_stats;
+ };
+ 
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index c3c93338..54419864 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -980,6 +980,7 @@ enum {
+ 	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
+ 	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
+ 	MCU_EXT_CMD_MURU_CTRL = 0x9f,
++	MCU_EXT_CMD_RX_STAT = 0xa4,
+ 	MCU_EXT_CMD_SET_SPR = 0xa8,
+ 	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
+ 	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 960072a4..52368dc3 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -28,6 +28,7 @@ struct mt7915_mcu_txd {
+ enum {
+ 	MCU_ATE_SET_TRX = 0x1,
+ 	MCU_ATE_SET_FREQ_OFFSET = 0xa,
++	MCU_ATE_SET_PHY_COUNT = 0x11,
+ 	MCU_ATE_SET_SLOT_TIME = 0x13,
+ 	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
+ };
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index d6f71436..e8bf616c 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -133,6 +133,21 @@ mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
+ 				 sizeof(req), false);
+ }
+ 
++static int
++mt7915_tm_set_phy_count(struct mt7915_phy *phy, u8 control)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct mt7915_tm_cmd req = {
++		.testmode_en = 1,
++		.param_idx = MCU_ATE_SET_PHY_COUNT,
++		.param.cfg.enable = control,
++		.param.cfg.band = phy != &dev->phy,
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
++				 sizeof(req), false);
++}
++
+ static int
+ mt7915_tm_set_slot_time(struct mt7915_phy *phy, u8 slot_time, u8 sifs)
+ {
+@@ -438,6 +453,8 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+ 	mt7915_mcu_add_bss_info(phy, phy->monitor_vif, en);
+ 	mt7915_mcu_add_sta(dev, phy->monitor_vif, NULL, en);
+ 
++	phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
++
+ 	if (!en)
+ 		mt7915_tm_set_tam_arb(phy, en, 0);
+ }
+@@ -503,18 +520,63 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ 	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
+ }
+ 
++static int
++mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
++{
++#define CMD_RX_STAT_BAND	0x3
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7915_tm_rx_stat_band *rs_band;
++	struct mt7915_dev *dev = phy->dev;
++	struct sk_buff *skb;
++	struct {
++		u8 format_id;
++		u8 band;
++		u8 _rsv[2];
++	} __packed req = {
++		.format_id = CMD_RX_STAT_BAND,
++		.band = phy != &dev->phy,
++	};
++	int ret;
++
++	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(RX_STAT),
++					&req, sizeof(req), true, &skb);
++	if (ret)
++		return ret;
++
++	rs_band = (struct mt7915_tm_rx_stat_band *)skb->data;
++	/* pr_info("mdrdy_cnt = %d\n", le32_to_cpu(rs_band->mdrdy_cnt)); */
++	/* pr_info("fcs_err = %d\n", le16_to_cpu(rs_band->fcs_err)); */
++	/* pr_info("len_mismatch = %d\n", le16_to_cpu(rs_band->len_mismatch)); */
++	/* pr_info("fcs_ok = %d\n", le16_to_cpu(rs_band->fcs_succ)); */
++
++	if (!clear) {
++		enum mt76_rxq_id q = req.band ? MT_RXQ_EXT : MT_RXQ_MAIN;
++
++		td->rx_stats.packets[q] += le32_to_cpu(rs_band->mdrdy_cnt);
++		td->rx_stats.fcs_error[q] += le16_to_cpu(rs_band->fcs_err);
++		td->rx_stats.len_mismatch += le16_to_cpu(rs_band->len_mismatch);
++	}
++
++	dev_kfree_skb(skb);
++
++	return 0;
++}
++
+ static void
+ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+ {
+ 	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
+ 
+ 	if (en) {
+-		struct mt7915_dev *dev = phy->dev;
+-
+ 		mt7915_tm_update_channel(phy);
+ 
+ 		/* read-clear */
+-		mt76_rr(dev, MT_MIB_SDR3(phy != &dev->phy));
++		mt7915_tm_get_rx_stats(phy, true);
++
++		/* clear fw count */
++		mt7915_tm_set_phy_count(phy, 0);
++		mt7915_tm_set_phy_count(phy, 1);
++
+ 		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
+ 	}
+ }
+@@ -738,12 +800,8 @@ static int
+ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+ {
+ 	struct mt7915_phy *phy = mphy->priv;
+-	struct mt7915_dev *dev = phy->dev;
+-	enum mt76_rxq_id q;
+ 	void *rx, *rssi;
+-	u16 fcs_err;
+ 	int i;
+-	u32 cnt;
+ 
+ 	rx = nla_nest_start(msg, MT76_TM_STATS_ATTR_LAST_RX);
+ 	if (!rx)
+@@ -787,15 +845,7 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+ 
+ 	nla_nest_end(msg, rx);
+ 
+-	cnt = mt76_rr(dev, MT_MIB_SDR3(phy->band_idx));
+-	fcs_err = is_mt7915(&dev->mt76) ? FIELD_GET(MT_MIB_SDR3_FCS_ERR_MASK, cnt) :
+-		FIELD_GET(MT_MIB_SDR3_FCS_ERR_MASK_MT7916, cnt);
+-
+-	q = phy->band_idx ? MT_RXQ_EXT : MT_RXQ_MAIN;
+-	mphy->test.rx_stats.packets[q] += fcs_err;
+-	mphy->test.rx_stats.fcs_error[q] += fcs_err;
+-
+-	return 0;
++	return mt7915_tm_get_rx_stats(phy, false);
+ }
+ 
+ const struct mt76_testmode_ops mt7915_testmode_ops = {
+diff --git a/mt7915/testmode.h b/mt7915/testmode.h
+index 5573ac30..a1c54c89 100644
+--- a/mt7915/testmode.h
++++ b/mt7915/testmode.h
+@@ -33,6 +33,12 @@ struct mt7915_tm_clean_txq {
+ 	u8 rsv;
+ };
+ 
++struct mt7915_tm_cfg {
++	u8 enable;
++	u8 band;
++	u8 _rsv[2];
++};
++
+ struct mt7915_tm_cmd {
+ 	u8 testmode_en;
+ 	u8 param_idx;
+@@ -43,6 +49,7 @@ struct mt7915_tm_cmd {
+ 		struct mt7915_tm_freq_offset freq;
+ 		struct mt7915_tm_slot_time slot;
+ 		struct mt7915_tm_clean_txq clean;
++		struct mt7915_tm_cfg cfg;
+ 		u8 test[72];
+ 	} param;
+ } __packed;
+@@ -102,4 +109,25 @@ enum {
+ 	TAM_ARB_OP_MODE_FORCE_SU = 5,
+ };
+ 
++struct mt7915_tm_rx_stat_band {
++	u8 category;
++
++	/* mac */
++	__le16 fcs_err;
++	__le16 len_mismatch;
++	__le16 fcs_succ;
++	__le32 mdrdy_cnt;
++	/* phy */
++	__le16 fcs_err_cck;
++	__le16 fcs_err_ofdm;
++	__le16 pd_cck;
++	__le16 pd_ofdm;
++	__le16 sig_err_cck;
++	__le16 sfd_err_cck;
++	__le16 sig_err_ofdm;
++	__le16 tag_err_ofdm;
++	__le16 mdrdy_cnt_cck;
++	__le16 mdrdy_cnt_ofdm;
++};
++
+ #endif
+diff --git a/testmode.c b/testmode.c
+index 7cd00794..e6d1f702 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -559,6 +559,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
+ 	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_PACKETS, rx_packets,
+ 			      MT76_TM_STATS_ATTR_PAD) ||
+ 	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_FCS_ERROR, rx_fcs_error,
++			      MT76_TM_STATS_ATTR_PAD) ||
++	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_LEN_MISMATCH,
++			      td->rx_stats.len_mismatch,
+ 			      MT76_TM_STATS_ATTR_PAD))
+ 		return -EMSGSIZE;
+ 
+diff --git a/testmode.h b/testmode.h
+index 5e2792d8..89613266 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -101,6 +101,8 @@ enum mt76_testmode_attr {
+  * @MT76_TM_STATS_ATTR_RX_FCS_ERROR: number of rx packets with FCS error (u64)
+  * @MT76_TM_STATS_ATTR_LAST_RX: information about the last received packet
+  *	see &enum mt76_testmode_rx_attr
++ * @MT76_TM_STATS_ATTR_RX_LEN_MISMATCH: number of rx packets with length
++ *	mismatch error (u64)
+  */
+ enum mt76_testmode_stats_attr {
+ 	MT76_TM_STATS_ATTR_UNSPEC,
+@@ -113,6 +115,7 @@ enum mt76_testmode_stats_attr {
+ 	MT76_TM_STATS_ATTR_RX_PACKETS,
+ 	MT76_TM_STATS_ATTR_RX_FCS_ERROR,
+ 	MT76_TM_STATS_ATTR_LAST_RX,
++	MT76_TM_STATS_ATTR_RX_LEN_MISMATCH,
+ 
+ 	/* keep last */
+ 	NUM_MT76_TM_STATS_ATTRS,
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0004-mt76-mt7915-fix-tx-descriptor.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0004-mt76-mt7915-fix-tx-descriptor.patch
new file mode 100644
index 0000000..c84c60e
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0004-mt76-mt7915-fix-tx-descriptor.patch
@@ -0,0 +1,24 @@
+From d0a61bbe57616c1a87a3bb4676f141ed54110add Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Wed, 19 Jan 2022 15:51:01 +0800
+Subject: [PATCH 4/6] mt76: mt7915: fix tx descriptor
+
+---
+ mt7915/mac.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 47d5a993..887292da 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -1001,6 +1001,7 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+ 	if (td->tx_rate_ldpc || (bw > 0 && mode >= MT_PHY_TYPE_HE_SU))
+ 		val |= MT_TXD6_LDPC;
+ 
++	txwi[1] &= ~cpu_to_le32(MT_TXD1_VTA);
+ 	txwi[3] &= ~cpu_to_le32(MT_TXD3_SN_VALID);
+ 	txwi[6] |= cpu_to_le32(val);
+ 	txwi[7] |= cpu_to_le32(FIELD_PREP(MT_TXD7_SPE_IDX,
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0007-mt76-mt7915-update-mt7986-CR-for-different-adie-vers.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0007-mt76-mt7915-update-mt7986-CR-for-different-adie-vers.patch
new file mode 100644
index 0000000..d5c72aa
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0007-mt76-mt7915-update-mt7986-CR-for-different-adie-vers.patch
@@ -0,0 +1,68 @@
+From 87efddcc9bb605802fdabe8bf3408a106bf5b997 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Tue, 15 Mar 2022 14:21:13 +0800
+Subject: [PATCH] mt76: mt7915: update mt7986 CR for different adie version
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt7915/regs.h |  1 +
+ mt7915/soc.c  | 24 +++++++++++++++++++++---
+ 2 files changed, 22 insertions(+), 3 deletions(-)
+
+diff --git a/mt7915/regs.h b/mt7915/regs.h
+index e5f93c40..a69ba562 100644
+--- a/mt7915/regs.h
++++ b/mt7915/regs.h
+@@ -794,6 +794,7 @@ enum offs_rev {
+ 
+ /* ADIE */
+ #define MT_ADIE_CHIP_ID			0x02c
++#define MT_ADIE_VERSION_MASK		GENMASK(15, 0)
+ #define MT_ADIE_CHIP_ID_MASK		GENMASK(31, 16)
+ #define MT_ADIE_IDX0			GENMASK(15, 0)
+ #define MT_ADIE_IDX1			GENMASK(31, 16)
+diff --git a/mt7915/soc.c b/mt7915/soc.c
+index 04df47fd..e1892368 100644
+--- a/mt7915/soc.c
++++ b/mt7915/soc.c
+@@ -468,16 +468,34 @@ static int mt7986_wmac_adie_xtal_trim_7976(struct mt7915_dev *dev, u8 adie)
+ static int mt7986_wmac_adie_patch_7976(struct mt7915_dev *dev, u8 adie)
+ {
+ 	int ret;
++	u32 id, version;
+ 
+-	ret = mt76_wmac_spi_write(dev, adie, MT_ADIE_RG_TOP_THADC, 0x4a563b00);
++
++	ret = mt76_wmac_spi_read(dev, adie, MT_ADIE_CHIP_ID, &id);
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = mt76_wmac_spi_write(dev, adie, MT_ADIE_RG_XO_01, 0x1d59080f);
++	version = FIELD_GET(MT_ADIE_VERSION_MASK, id);
++
++	ret = mt76_wmac_spi_write(dev, adie, MT_ADIE_RG_TOP_THADC, 0x4a563b00);
+ 	if (ret)
+ 		return ret;
+ 
+-	return mt76_wmac_spi_write(dev, adie, MT_ADIE_RG_XO_03, 0x34c00fe0);
++	if (version == 0x8a00 || version == 0x8a10 || version == 0x8b00) {
++		ret = mt76_wmac_spi_write(dev, adie, MT_ADIE_RG_XO_01, 0x1d59080f);
++		if (ret)
++			return ret;
++
++		mt76_wmac_spi_write(dev, adie, MT_ADIE_RG_XO_03, 0x34c00fe0);
++	} else {
++		ret = mt76_wmac_spi_write(dev, adie, MT_ADIE_RG_XO_01, 0x1959c80f);
++		if (ret)
++			return ret;
++
++		mt76_wmac_spi_write(dev, adie, MT_ADIE_RG_XO_03, 0x34d00fe0);
++	}
++
++	return ret;
+ }
+ 
+ static int
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0008-mt76-mt7915-disable-mt7986-rx-hdr-trans-short.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0008-mt76-mt7915-disable-mt7986-rx-hdr-trans-short.patch
new file mode 100644
index 0000000..ba8919b
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0008-mt76-mt7915-disable-mt7986-rx-hdr-trans-short.patch
@@ -0,0 +1,58 @@
+From 00e4fb5cf4d22681b379cdb92e0750cf74b367e7 Mon Sep 17 00:00:00 2001
+From: "lian.chen" <lian.chen@mediatek.com>
+Date: Wed, 16 Mar 2022 15:14:05 +0800
+Subject: [PATCH] mt76: mt7915: disable mt7986 RX_HDR_TRANS_SHORT
+
+Signed-off-by: lian.chen <lian.chen@mediatek.com>
+---
+ mt7915/init.c | 3 +++
+ mt7915/mac.c  | 4 ----
+ mt7915/regs.h | 3 +++
+ 3 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/mt7915/init.c b/mt7915/init.c
+index f57a3d18..223a4f77 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -451,6 +451,9 @@ static void mt7915_mac_init(struct mt7915_dev *dev)
+ 
+ 	mt76_rmw_field(dev, MT_MDP_DCR1, MT_MDP_DCR1_MAX_RX_LEN, rx_len);
+ 
++	/* disable RX_TRANS_SHORT */
++	mt76_clear(dev, MT_MDP_DCR2, MT_MDP_DCR2_RX_TRANS_SHORT);
++
+ 	/* enable hardware de-agg */
+ 	mt76_set(dev, MT_MDP_DCR0, MT_MDP_DCR0_DAMSDU_EN);
+ 
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index fe718102..eedd901f 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -835,10 +835,6 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
+ 	if (!status->wcid || !ieee80211_is_data_qos(fc))
+ 		return 0;
+ 
+-	/* drop no data frame */
+-	if (fc & cpu_to_le16(IEEE80211_STYPE_NULLFUNC))
+-		return -EINVAL;
+-
+ 	status->aggr = unicast &&
+ 		       !ieee80211_is_qos_nullfunc(fc);
+ 	status->qos_ctl = qos_ctl;
+diff --git a/mt7915/regs.h b/mt7915/regs.h
+index e7d83458..6ddfa48f 100644
+--- a/mt7915/regs.h
++++ b/mt7915/regs.h
+@@ -159,6 +159,9 @@ enum offs_rev {
+ #define MT_MDP_DCR1			MT_MDP(0x004)
+ #define MT_MDP_DCR1_MAX_RX_LEN		GENMASK(15, 3)
+ 
++#define MT_MDP_DCR2			MT_MDP(0x0e8)
++#define MT_MDP_DCR2_RX_TRANS_SHORT		BIT(2)
++
+ #define MT_MDP_BNRCFR0(_band)		MT_MDP(__OFFS(MDP_BNRCFR0) + \
+ 					       ((_band) << 8))
+ #define MT_MDP_RCFR0_MCU_RX_MGMT	GENMASK(5, 4)
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0009-mt76-mt7915-fix-table_mask-to-u16.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0009-mt76-mt7915-fix-table_mask-to-u16.patch
new file mode 100644
index 0000000..e9184f3
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0009-mt76-mt7915-fix-table_mask-to-u16.patch
@@ -0,0 +1,28 @@
+From 053df93aaa079c2942eadf52fb33f76dfffa2f05 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Tue, 22 Mar 2022 15:49:04 +0800
+Subject: [PATCH] mt76: mt7915: fix table_mask to u16
+
+mt7915 can support 16 twt stations so modify table_mask to u16.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ mt7915/mt7915.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 6efa0a2e..4b6eda95 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -319,7 +319,7 @@ struct mt7915_dev {
+ 	void *cal;
+ 
+ 	struct {
+-		u8 table_mask;
++		u16 table_mask;
+ 		u8 n_agrt;
+ 	} twt;
+ 
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0010-mt76-mt7915-fix-using-null-pointer-when-wfsys-on.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0010-mt76-mt7915-fix-using-null-pointer-when-wfsys-on.patch
new file mode 100644
index 0000000..d4e6f1b
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0010-mt76-mt7915-fix-using-null-pointer-when-wfsys-on.patch
@@ -0,0 +1,42 @@
+From 1edfc160ec62c99aa3e72d4d1019614bf17f1cc4 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Mon, 28 Mar 2022 11:37:21 +0800
+Subject: [PATCH] mt76: mt7915: fix using null pointer when wfsys on
+
+---
+ mt7915/soc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/mt7915/soc.c b/mt7915/soc.c
+index bf0603f9..36a13099 100644
+--- a/mt7915/soc.c
++++ b/mt7915/soc.c
+@@ -1145,7 +1145,7 @@ static int mt7986_wmac_init(struct mt7915_dev *dev)
+ 	if (IS_ERR(dev->rstc))
+ 		return PTR_ERR(dev->rstc);
+ 
+-	return mt7986_wmac_enable(dev);
++	return 0;
+ }
+ 
+ static int mt7986_wmac_probe(struct platform_device *pdev)
+@@ -1178,13 +1178,13 @@ static int mt7986_wmac_probe(struct platform_device *pdev)
+ 	if (ret)
+ 		goto free_device;
+ 
+-	mt7915_wfsys_reset(dev);
+-	mt76_wr(dev, MT_INT_MASK_CSR, 0);
+-
+ 	ret = mt7986_wmac_init(dev);
+ 	if (ret)
+ 		goto free_irq;
+ 
++	mt7915_wfsys_reset(dev);
++	mt76_wr(dev, MT_INT_MASK_CSR, 0);
++
+ 	ret = mt7915_register_device(dev);
+ 	if (ret)
+ 		goto free_irq;
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
new file mode 100644
index 0000000..e615e9c
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -0,0 +1,4770 @@
+From 3dd7344c6aa1124982d81d98defea6263899673b Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Thu, 17 Feb 2022 00:17:39 +0800
+Subject: [PATCH] mt76: mt7915: add mtk internal debug tools for mt76
+
+---
+ .../wireless/mediatek/mt76/mt76_connac_mcu.h  |    6 +
+ .../wireless/mediatek/mt76/mt7915/Makefile    |    2 +-
+ .../wireless/mediatek/mt76/mt7915/debugfs.c   |   72 +-
+ .../net/wireless/mediatek/mt76/mt7915/mac.c   |   14 +
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c   |   41 +
+ .../net/wireless/mediatek/mt76/mt7915/mcu.h   |    4 +
+ .../wireless/mediatek/mt76/mt7915/mt7915.h    |   41 +
+ .../mediatek/mt76/mt7915/mt7915_debug.h       | 1350 ++++++++
+ .../mediatek/mt76/mt7915/mtk_debugfs.c        | 2893 +++++++++++++++++
+ .../wireless/mediatek/mt76/mt7915/mtk_mcu.c   |   51 +
+ .../net/wireless/mediatek/mt76/tools/fwlog.c  |   26 +-
+ 11 files changed, 4489 insertions(+), 11 deletions(-)
+ create mode 100644 drivers/net/wireless/mediatek/mt76/mt7915/mt7915_debug.h
+ create mode 100644 drivers/net/wireless/mediatek/mt76/mt7915/mtk_debugfs.c
+ create mode 100644 drivers/net/wireless/mediatek/mt76/mt7915/mtk_mcu.c
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 54419864..494c5c71 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -968,6 +968,12 @@ enum {
+ 	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
+ 	MCU_EXT_CMD_RXDCOC_CAL = 0x59,
+ 	MCU_EXT_CMD_GET_MIB_INFO = 0x5a,
++#ifdef MTK_DEBUG
++	MCU_EXT_CMD_RED_ENABLE = 0x68,
++	MCU_EXT_CMD_RED_SHOW_STA = 0x69,
++	MCU_EXT_CMD_RED_TARGET_DELAY = 0x6A,
++	MCU_EXT_CMD_RED_TX_RPT = 0x6B,
++#endif
+ 	MCU_EXT_CMD_TXDPD_CAL = 0x60,
+ 	MCU_EXT_CMD_CAL_CACHE = 0x67,
+ 	MCU_EXT_CMD_SET_RADAR_TH = 0x7c,
+diff --git a/mt7915/Makefile b/mt7915/Makefile
+index b794ceb7..a3474e2f 100644
+--- a/mt7915/Makefile
++++ b/mt7915/Makefile
+@@ -3,7 +3,7 @@
+ obj-$(CONFIG_MT7915E) += mt7915e.o
+ 
+ mt7915e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
+-	     debugfs.o mmio.o
++	     debugfs.o mmio.o mtk_debugfs.o mtk_mcu.o
+ 
+ mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
+ mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
+\ No newline at end of file
+diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
+index 4e1ecaec..6df148c5 100644
+--- a/mt7915/debugfs.c
++++ b/mt7915/debugfs.c
+@@ -8,6 +8,9 @@
+ #include "mac.h"
+ 
+ #define FW_BIN_LOG_MAGIC	0x44e98caf
++#ifdef MTK_DEBUG
++#define FW_BIN_LOG_MAGIC_V2	0x44d9c99a
++#endif
+ 
+ /** global debugfs **/
+ 
+@@ -370,6 +373,9 @@ mt7915_fw_debug_wm_set(void *data, u64 val)
+ 	int ret;
+ 
+ 	dev->fw_debug_wm = val ? MCU_FW_LOG_TO_HOST : 0;
++#ifdef MTK_DEBUG
++	dev->fw_debug_wm = val;
++#endif
+ 
+ 	if (dev->fw_debug_bin)
+ 		val = 16;
+@@ -394,6 +400,9 @@ mt7915_fw_debug_wm_set(void *data, u64 val)
+ 		if (ret)
+ 			return ret;
+ 	}
++#ifdef MTK_DEBUG
++	mt7915_mcu_fw_dbg_ctrl(dev, 68, !!val);
++#endif
+ 
+ 	/* WM CPU info record control */
+ 	mt76_clear(dev, MT_CPU_UTIL_CTRL, BIT(0));
+@@ -401,6 +410,12 @@ mt7915_fw_debug_wm_set(void *data, u64 val)
+ 	mt76_wr(dev, MT_MCU_WM_CIRQ_IRQ_MASK_CLR_ADDR, BIT(5));
+ 	mt76_wr(dev, MT_MCU_WM_CIRQ_IRQ_SOFT_ADDR, BIT(5));
+ 
++#ifdef MTK_DEBUG
++	if (dev->fw_debug_bin & BIT(3))
++		/* use bit 7 to indicate v2 magic number */
++		dev->fw_debug_wm |= BIT(7);
++#endif
++
+ 	return 0;
+ }
+ 
+@@ -409,7 +424,11 @@ mt7915_fw_debug_wm_get(void *data, u64 *val)
+ {
+ 	struct mt7915_dev *dev = data;
+ 
+-	*val = dev->fw_debug_wm;
++#ifdef MTK_DEBUG
++	*val = dev->fw_debug_wm & ~BIT(7);
++#else
++	val = dev->fw_debug_wm;
++#endif
+ 
+ 	return 0;
+ }
+@@ -489,6 +508,16 @@ mt7915_fw_debug_bin_set(void *data, u64 val)
+ 
+ 	relay_reset(dev->relay_fwlog);
+ 
++#ifdef MTK_DEBUG
++	dev->dbg.dump_mcu_pkt = val & BIT(4) ? true : false;
++	dev->dbg.dump_txd = val & BIT(5) ? true : false;
++	dev->dbg.dump_tx_pkt = val & BIT(6) ? true : false;
++	dev->dbg.dump_rx_pkt = val & BIT(7) ? true : false;
++	dev->dbg.dump_rx_raw = val & BIT(8) ? true : false;
++	if (!(val & GENMASK(3, 0)))
++		return 0;
++#endif
++
+ 	return mt7915_fw_debug_wm_set(dev, dev->fw_debug_wm);
+ }
+ 
+@@ -910,6 +939,11 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+ 	if (!ext_phy)
+ 		dev->debugfs_dir = dir;
+ 
++#ifdef MTK_DEBUG
++	debugfs_create_u16("wlan_idx", 0600, dir, &dev->wlan_idx);
++	mt7915_mtk_init_debugfs(phy, dir);
++#endif
++
+ 	return 0;
+ }
+ 
+@@ -950,17 +984,53 @@ void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int
+ 		.msg_type = cpu_to_le16(PKT_TYPE_RX_FW_MONITOR),
+ 	};
+ 
++#ifdef MTK_DEBUG
++	struct {
++		__le32 magic;
++		u8 version;
++		u8 _rsv;
++		__le16 serial_id;
++		__le32 timestamp;
++		__le16 msg_type;
++		__le16 len;
++	} hdr2 = {
++		.version = 0x1,
++		.magic = cpu_to_le32(FW_BIN_LOG_MAGIC_V2),
++		.msg_type = PKT_TYPE_RX_FW_MONITOR,
++	};
++#endif
++
+ 	if (!dev->relay_fwlog)
+ 		return;
+ 
++#ifdef MTK_DEBUG
++	/* old magic num */
++	if (!(dev->fw_debug_wm & BIT(7))) {
++		hdr.timestamp = mt76_rr(dev, MT_LPON_FRCR(0));
++		hdr.len = *(__le16 *)data;
++		mt7915_debugfs_write_fwlog(dev, &hdr, sizeof(hdr), data, len);
++	} else {
++		hdr2.serial_id = dev->dbg.fwlog_seq++;
++		hdr2.timestamp = mt76_rr(dev, MT_LPON_FRCR(0));
++		hdr2.len = *(__le16 *)data;
++		mt7915_debugfs_write_fwlog(dev, &hdr2, sizeof(hdr2), data, len);
++	}
++#else
+ 	hdr.timestamp = cpu_to_le32(mt76_rr(dev, MT_LPON_FRCR(0)));
+ 	hdr.len = *(__le16 *)data;
+ 	mt7915_debugfs_write_fwlog(dev, &hdr, sizeof(hdr), data, len);
++#endif
+ }
+ 
+ bool mt7915_debugfs_rx_log(struct mt7915_dev *dev, const void *data, int len)
+ {
++#ifdef MTK_DEBUG
++	if (get_unaligned_le32(data) != FW_BIN_LOG_MAGIC &&
++	    get_unaligned_le32(data) != FW_BIN_LOG_MAGIC_V2 &&
++	    get_unaligned_le32(data) != PKT_BIN_DEBUG_MAGIC)
++#else
+ 	if (get_unaligned_le32(data) != FW_BIN_LOG_MAGIC)
++#endif
+ 		return false;
+ 
+ 	if (dev->relay_fwlog)
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 887292da..6f4cc947 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -595,6 +595,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
+ 	__le16 fc = 0;
+ 	int idx;
+ 
++#ifdef MTK_DEBUG
++	if (dev->dbg.dump_rx_raw)
++		mt7915_packet_log_to_host(dev, skb->data, skb->len, PKT_BIN_DEBUG_RX_RAW, 0);
++#endif
+ 	memset(status, 0, sizeof(*status));
+ 
+ 	if ((rxd1 & MT_RXD1_NORMAL_BAND_IDX) && !phy->band_idx) {
+@@ -778,6 +782,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
+ 	}
+ 
+ 	hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
++#ifdef MTK_DEBUG
++	if (dev->dbg.dump_rx_pkt)
++		mt7915_packet_log_to_host(dev, skb->data, skb->len, PKT_BIN_DEBUG_RX, hdr_gap);
++#endif
+ 	if (hdr_trans && ieee80211_has_morefrags(fc)) {
+ 		if (mt7915_reverse_frag0_hdr_trans(skb, hdr_gap))
+ 			return -EINVAL;
+@@ -1343,6 +1351,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	tx_info->buf[1].skip_unmap = true;
+ 	tx_info->nbuf = MT_CT_DMA_BUF_NUM;
+ 
++#ifdef MTK_DEBUG
++	if (dev->dbg.dump_txd)
++		mt7915_packet_log_to_host(dev, txwi, MT_TXD_SIZE, PKT_BIN_DEBUG_TXD, 0);
++	if (dev->dbg.dump_tx_pkt)
++		mt7915_packet_log_to_host(dev, t->skb->data, t->skb->len, PKT_BIN_DEBUG_TX, 0);
++#endif
+ 	return 0;
+ }
+ 
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 549281a4..15a6fe5a 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -298,6 +298,10 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+ 		mcu_txd->s2d_index = MCU_S2D_H2N;
+ 
+ exit:
++#ifdef MTK_DEBUG
++	if (dev->dbg.dump_mcu_pkt)
++		mt7915_packet_log_to_host(dev, skb->data, skb->len, PKT_BIN_DEBUG_MCU, 0);
++#endif
+ 	if (wait_seq)
+ 		*wait_seq = seq;
+ 
+@@ -3613,3 +3617,40 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+ 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TWT_AGRT_UPDATE),
+ 				 &req, sizeof(req), true);
+ }
++
++#ifdef MTK_DEBUG
++int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
++{
++	struct {
++		__le32 args[3];
++	} req = {
++		.args = {
++			cpu_to_le32(a1),
++			cpu_to_le32(a2),
++			cpu_to_le32(a3),
++		},
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), wait_resp);
++}
++
++int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled)
++{
++#define RED_DISABLE		0
++#define RED_BY_HOST_ENABLE	1
++#define RED_BY_WA_ENABLE	2
++	int ret;
++	u32 red_type = enabled > 0 ? RED_BY_WA_ENABLE : RED_DISABLE;
++	__le32 req = cpu_to_le32(red_type);
++
++	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(RED_ENABLE), &req,
++				 sizeof(req), false);
++	if (ret < 0)
++		return ret;
++
++	mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
++			  MCU_WA_PARAM_RED, enabled, 0, true);
++
++	return 0;
++}
++#endif
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 52368dc3..94e0a81b 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -296,6 +296,10 @@ enum {
+ 	MCU_WA_PARAM_PDMA_RX = 0x04,
+ 	MCU_WA_PARAM_CPU_UTIL = 0x0b,
+ 	MCU_WA_PARAM_RED = 0x0e,
++#ifdef MTK_DEBUG
++	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
++	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
++#endif
+ };
+ 
+ enum mcu_mmps_mode {
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 6efa0a2e..8bcd861f 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -9,6 +9,7 @@
+ #include "../mt76_connac.h"
+ #include "regs.h"
+ 
++#define MTK_DEBUG 1
+ #define MT7915_MAX_INTERFACES		19
+ #define MT7915_MAX_WMM_SETS		4
+ #define MT7915_WTBL_SIZE		288
+@@ -326,6 +327,27 @@ struct mt7915_dev {
+ 	struct reset_control *rstc;
+ 	void __iomem *dcm;
+ 	void __iomem *sku;
++
++#ifdef MTK_DEBUG
++	u16 wlan_idx;
++	struct {
++		u32 fixed_rate;
++		u32 l1debugfs_reg;
++		u32 l2debugfs_reg;
++		u32 mac_reg;
++		u32 fw_dbg_module;
++		u8 fw_dbg_lv;
++		u32 bcn_total_cnt[2];
++		u16 fwlog_seq;
++		bool dump_mcu_pkt;
++		bool dump_txd;
++		bool dump_tx_pkt;
++		bool dump_rx_pkt;
++		bool dump_rx_raw;
++		u32 token_idx;
++	} dbg;
++	const struct mt7915_dbg_reg_desc *dbg_reg;
++#endif
+ };
+ 
+ enum {
+@@ -593,4 +615,23 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			    struct ieee80211_sta *sta, struct dentry *dir);
+ #endif
+ 
++#ifdef MTK_DEBUG
++int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
++int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
++int mt7915_mcu_set_red(struct mt7915_dev *dev, bool enabled);
++void mt7915_dump_tmac_info(u8 *tmac_info);
++int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level);
++void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len);
++
++#define PKT_BIN_DEBUG_MAGIC	0xc8763123
++enum {
++	PKT_BIN_DEBUG_MCU,
++	PKT_BIN_DEBUG_TXD,
++	PKT_BIN_DEBUG_TX,
++	PKT_BIN_DEBUG_RX,
++	PKT_BIN_DEBUG_RX_RAW,
++};
++
++#endif
++
+ #endif
+diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
+new file mode 100644
+index 00000000..59c057e0
+--- /dev/null
++++ b/mt7915/mt7915_debug.h
+@@ -0,0 +1,1350 @@
++#ifndef __MT7915_DEBUG_H
++#define __MT7915_DEBUG_H
++
++#ifdef MTK_DEBUG
++
++#define DBG_INVALID_BASE		0xffffffff
++#define DBG_INVALID_OFFSET		0x0
++
++struct __dbg_map {
++	u32 phys;
++	u32 maps;
++	u32 size;
++};
++
++struct __dbg_reg {
++	u32 base;
++	u32 offs;
++};
++
++struct __dbg_mask {
++	u32 end;
++	u32 start;
++};
++
++enum dbg_base_rev {
++	MT_DBG_WFDMA0_BASE,
++	MT_DBG_WFDMA1_BASE,
++	MT_DBG_WFDMA0_PCIE1_BASE,
++	MT_DBG_WFDMA1_PCIE1_BASE,
++	MT_DBG_WFDMA_EXT_CSR_BASE,
++	MT_DBG_SWDEF_BASE,
++	__MT_DBG_BASE_REV_MAX,
++};
++
++enum dbg_reg_rev {
++	DBG_INT_SOURCE_CSR,
++	DBG_INT_MASK_CSR,
++	DBG_INT1_SOURCE_CSR,
++	DBG_INT1_MASK_CSR,
++	DBG_TX_RING_BASE,
++	DBG_RX_EVENT_RING_BASE,
++	DBG_RX_STS_RING_BASE,
++	DBG_RX_DATA_RING_BASE,
++	DBG_DMA_ICSC_FR0,
++	DBG_DMA_ICSC_FR1,
++	DBG_TMAC_ICSCR0,
++	DBG_RMAC_RXICSRPT,
++	DBG_MIB_M0SDR0,
++	DBG_MIB_M0SDR3,
++	DBG_MIB_M0SDR4,
++	DBG_MIB_M0SDR5,
++	DBG_MIB_M0SDR7,
++	DBG_MIB_M0SDR8,
++	DBG_MIB_M0SDR9,
++	DBG_MIB_M0SDR10,
++	DBG_MIB_M0SDR11,
++	DBG_MIB_M0SDR12,
++	DBG_MIB_M0SDR14,
++	DBG_MIB_M0SDR15,
++	DBG_MIB_M0SDR16,
++	DBG_MIB_M0SDR17,
++	DBG_MIB_M0SDR18,
++	DBG_MIB_M0SDR19,
++	DBG_MIB_M0SDR20,
++	DBG_MIB_M0SDR21,
++	DBG_MIB_M0SDR22,
++	DBG_MIB_M0SDR23,
++	DBG_MIB_M0DR0,
++	DBG_MIB_M0DR1,
++	DBG_MIB_MUBF,
++	DBG_MIB_M0DR6,
++	DBG_MIB_M0DR7,
++	DBG_MIB_M0DR8,
++	DBG_MIB_M0DR9,
++	DBG_MIB_M0DR10,
++	DBG_MIB_M0DR11,
++	DBG_MIB_M0DR12,
++	DBG_WTBLON_WDUCR,
++	DBG_UWTBL_WDUCR,
++	DBG_PLE_DRR_TABLE_CTRL,
++	DBG_PLE_DRR_TABLE_RDATA,
++	DBG_PLE_PBUF_CTRL,
++	DBG_PLE_QUEUE_EMPTY,
++	DBG_PLE_FREEPG_CNT,
++	DBG_PLE_FREEPG_HEAD_TAIL,
++	DBG_PLE_PG_HIF_GROUP,
++	DBG_PLE_HIF_PG_INFO,
++	DBG_PLE_PG_HIF_TXCMD_GROUP,
++	DBG_PLE_HIF_TXCMD_PG_INFO,
++	DBG_PLE_PG_CPU_GROUP,
++	DBG_PLE_CPU_PG_INFO,
++	DBG_PLE_FL_QUE_CTRL,
++	DBG_PLE_NATIVE_TXCMD_Q_EMPTY,
++	DBG_PLE_TXCMD_Q_EMPTY,
++	DBG_PLE_AC_QEMPTY,
++	DBG_PLE_AC_OFFSET,
++	DBG_PLE_STATION_PAUSE,
++	DBG_PLE_DIS_STA_MAP,
++	DBG_PSE_PBUF_CTRL,
++	DBG_PSE_FREEPG_CNT,
++	DBG_PSE_FREEPG_HEAD_TAIL,
++	DBG_PSE_HIF0_PG_INFO,
++	DBG_PSE_PG_HIF1_GROUP,
++	DBG_PSE_HIF1_PG_INFO,
++	DBG_PSE_PG_CPU_GROUP,
++	DBG_PSE_CPU_PG_INFO,
++	DBG_PSE_PG_PLE_GROUP,
++	DBG_PSE_PLE_PG_INFO,
++	DBG_PSE_PG_LMAC0_GROUP,
++	DBG_PSE_LMAC0_PG_INFO,
++	DBG_PSE_PG_LMAC1_GROUP,
++	DBG_PSE_LMAC1_PG_INFO,
++	DBG_PSE_PG_LMAC2_GROUP,
++	DBG_PSE_LMAC2_PG_INFO,
++	DBG_PSE_PG_LMAC3_GROUP,
++	DBG_PSE_LMAC3_PG_INFO,
++	DBG_PSE_PG_MDP_GROUP,
++	DBG_PSE_MDP_PG_INFO,
++	DBG_PSE_PG_PLE1_GROUP,
++	DBG_PSE_PLE1_PG_INFO,
++	DBG_AGG_AALCR0,
++	DBG_AGG_AALCR1,
++	DBG_AGG_AALCR2,
++	DBG_AGG_AALCR3,
++	DBG_AGG_AALCR4,
++	DBG_AGG_B0BRR0,
++	DBG_AGG_B1BRR0,
++	DBG_AGG_B2BRR0,
++	DBG_AGG_B3BRR0,
++	DBG_AGG_AWSCR0,
++	DBG_AGG_PCR0,
++	DBG_AGG_TTCR0,
++	DBG_MIB_M0ARNG0,
++	DBG_MIB_M0DR2,
++	DBG_MIB_M0DR13,
++	__MT_DBG_REG_REV_MAX,
++};
++
++enum dbg_mask_rev {
++	DBG_MIB_M0SDR10_RX_MDRDY_COUNT,
++	DBG_MIB_M0SDR14_AMPDU,
++	DBG_MIB_M0SDR15_AMPDU_ACKED,
++	DBG_MIB_RX_FCS_ERROR_COUNT,
++	__MT_DBG_MASK_REV_MAX,
++};
++
++enum dbg_bit_rev {
++	__MT_DBG_BIT_REV_MAX,
++};
++
++static const u32 mt7915_dbg_base[] = {
++	[MT_DBG_WFDMA0_BASE]		= 0xd4000,
++	[MT_DBG_WFDMA1_BASE]		= 0xd5000,
++	[MT_DBG_WFDMA0_PCIE1_BASE]	= 0xd8000,
++	[MT_DBG_WFDMA1_PCIE1_BASE]	= 0xd9000,
++	[MT_DBG_WFDMA_EXT_CSR_BASE]	= 0xd7000,
++	[MT_DBG_SWDEF_BASE]		= 0x41f200,
++};
++
++static const u32 mt7916_dbg_base[] = {
++	[MT_DBG_WFDMA0_BASE]		= 0xd4000,
++	[MT_DBG_WFDMA1_BASE]		= 0xd5000,
++	[MT_DBG_WFDMA0_PCIE1_BASE]	= 0xd8000,
++	[MT_DBG_WFDMA1_PCIE1_BASE]	= 0xd9000,
++	[MT_DBG_WFDMA_EXT_CSR_BASE]	= 0xd7000,
++	[MT_DBG_SWDEF_BASE]		= 0x411400,
++};
++
++static const u32 mt7986_dbg_base[] = {
++	[MT_DBG_WFDMA0_BASE]		= 0x24000,
++	[MT_DBG_WFDMA1_BASE]		= 0x25000,
++	[MT_DBG_WFDMA0_PCIE1_BASE]	= 0x28000,
++	[MT_DBG_WFDMA1_PCIE1_BASE]	= 0x29000,
++	[MT_DBG_WFDMA_EXT_CSR_BASE]	= 0x27000,
++	[MT_DBG_SWDEF_BASE]		= 0x411400,
++};
++
++/* mt7915 regs with different base and offset */
++static const struct __dbg_reg mt7915_dbg_reg[] = {
++	[DBG_INT_SOURCE_CSR]		= { MT_DBG_WFDMA_EXT_CSR_BASE, 0x10 },
++	[DBG_INT_MASK_CSR]		= { MT_DBG_WFDMA_EXT_CSR_BASE, 0x14 },
++	[DBG_INT1_SOURCE_CSR]		= { MT_DBG_WFDMA_EXT_CSR_BASE, 0x88 },
++	[DBG_INT1_MASK_CSR]		= { MT_DBG_WFDMA_EXT_CSR_BASE, 0x8c },
++	[DBG_TX_RING_BASE]		= { MT_DBG_WFDMA1_BASE, 0x400 },
++	[DBG_RX_EVENT_RING_BASE]	= { MT_DBG_WFDMA1_BASE, 0x500 },
++	[DBG_RX_STS_RING_BASE]		= { MT_DBG_WFDMA1_BASE, 0x510 },
++	[DBG_RX_DATA_RING_BASE]		= { MT_DBG_WFDMA0_BASE, 0x500 },
++	[DBG_DMA_ICSC_FR0]		= { DBG_INVALID_BASE, 0x0f0 },
++	[DBG_DMA_ICSC_FR1]		= { DBG_INVALID_BASE, 0x0f4 },
++	[DBG_TMAC_ICSCR0]		= { DBG_INVALID_BASE, 0x200 },
++	[DBG_RMAC_RXICSRPT]		= { DBG_INVALID_BASE, 0x618},
++	[DBG_MIB_M0SDR0]		= { DBG_INVALID_BASE, 0x010},
++	[DBG_MIB_M0SDR3]		= { DBG_INVALID_BASE, 0x014},
++	[DBG_MIB_M0SDR4]		= { DBG_INVALID_BASE, 0x018},
++	[DBG_MIB_M0SDR5]		= { DBG_INVALID_BASE, 0x01c},
++	[DBG_MIB_M0SDR7]		= { DBG_INVALID_BASE, 0x024},
++	[DBG_MIB_M0SDR8]		= { DBG_INVALID_BASE, 0x028},
++	[DBG_MIB_M0SDR9]		= { DBG_INVALID_BASE, 0x02C},
++	[DBG_MIB_M0SDR10]		= { DBG_INVALID_BASE, 0x030},
++	[DBG_MIB_M0SDR11]		= { DBG_INVALID_BASE, 0x034},
++	[DBG_MIB_M0SDR12]		= { DBG_INVALID_BASE, 0x038},
++	[DBG_MIB_M0SDR14]		= { DBG_INVALID_BASE, 0x040},
++	[DBG_MIB_M0SDR15]		= { DBG_INVALID_BASE, 0x044},
++	[DBG_MIB_M0SDR16]		= { DBG_INVALID_BASE, 0x048},
++	[DBG_MIB_M0SDR17]		= { DBG_INVALID_BASE, 0x04c},
++	[DBG_MIB_M0SDR18]		= { DBG_INVALID_BASE, 0x050},
++	[DBG_MIB_M0SDR19]		= { DBG_INVALID_BASE, 0x054},
++	[DBG_MIB_M0SDR20]		= { DBG_INVALID_BASE, 0x058},
++	[DBG_MIB_M0SDR21]		= { DBG_INVALID_BASE, 0x05c},
++	[DBG_MIB_M0SDR22]		= { DBG_INVALID_BASE, 0x060},
++	[DBG_MIB_M0SDR23]		= { DBG_INVALID_BASE, 0x064},
++	[DBG_MIB_M0DR0]			= { DBG_INVALID_BASE, 0x0a0},
++	[DBG_MIB_M0DR1]			= { DBG_INVALID_BASE, 0x0a4},
++	[DBG_MIB_MUBF]			= { DBG_INVALID_BASE, 0x090},
++	[DBG_MIB_M0DR6]			= { DBG_INVALID_BASE, 0x0b8},
++	[DBG_MIB_M0DR7]			= { DBG_INVALID_BASE, 0x0bc},
++	[DBG_MIB_M0DR8]			= { DBG_INVALID_BASE, 0x0c0},
++	[DBG_MIB_M0DR9]			= { DBG_INVALID_BASE, 0x0c4},
++	[DBG_MIB_M0DR10]		= { DBG_INVALID_BASE, 0x0c8},
++	[DBG_MIB_M0DR11]		= { DBG_INVALID_BASE, 0x0cc},
++	[DBG_MIB_M0DR12]		= { DBG_INVALID_BASE, 0x160},
++	[DBG_WTBLON_WDUCR]		= { DBG_INVALID_BASE, 0x0},
++	[DBG_UWTBL_WDUCR]		= { DBG_INVALID_BASE, 0x0},
++	[DBG_PLE_DRR_TABLE_CTRL]	= { DBG_INVALID_BASE, 0x388},
++	[DBG_PLE_DRR_TABLE_RDATA]	= { DBG_INVALID_BASE, 0x350},
++	[DBG_PLE_PBUF_CTRL]		= { DBG_INVALID_BASE, 0x014},
++	[DBG_PLE_QUEUE_EMPTY]		= { DBG_INVALID_BASE, 0x0b0},
++	[DBG_PLE_FREEPG_CNT]		= { DBG_INVALID_BASE, 0x100},
++	[DBG_PLE_FREEPG_HEAD_TAIL]	= { DBG_INVALID_BASE, 0x104},
++	[DBG_PLE_PG_HIF_GROUP]		= { DBG_INVALID_BASE, 0x110},
++	[DBG_PLE_HIF_PG_INFO]		= { DBG_INVALID_BASE, 0x114},
++	[DBG_PLE_PG_HIF_TXCMD_GROUP]	= { DBG_INVALID_BASE, 0x120},
++	[DBG_PLE_HIF_TXCMD_PG_INFO]	= { DBG_INVALID_BASE, 0x124},
++	[DBG_PLE_PG_CPU_GROUP]		= { DBG_INVALID_BASE, 0x150},
++	[DBG_PLE_CPU_PG_INFO]		= { DBG_INVALID_BASE, 0x154},
++	[DBG_PLE_FL_QUE_CTRL]		= { DBG_INVALID_BASE, 0x1b0},
++	[DBG_PLE_NATIVE_TXCMD_Q_EMPTY]	= { DBG_INVALID_BASE, 0x22c},
++	[DBG_PLE_TXCMD_Q_EMPTY]		= { DBG_INVALID_BASE, 0x230},
++	[DBG_PLE_AC_QEMPTY]		= { DBG_INVALID_BASE, 0x500},
++	[DBG_PLE_AC_OFFSET]		= { DBG_INVALID_BASE, 0x040},
++	[DBG_PLE_STATION_PAUSE]		= { DBG_INVALID_BASE, 0x400},
++	[DBG_PLE_DIS_STA_MAP]		= { DBG_INVALID_BASE, 0x440},
++	[DBG_PSE_PBUF_CTRL]		= { DBG_INVALID_BASE, 0x004},
++	[DBG_PSE_FREEPG_CNT]		= { DBG_INVALID_BASE, 0x100},
++	[DBG_PSE_FREEPG_HEAD_TAIL]	= { DBG_INVALID_BASE, 0x104},
++	[DBG_PSE_HIF0_PG_INFO]		= { DBG_INVALID_BASE, 0x114},
++	[DBG_PSE_PG_HIF1_GROUP]		= { DBG_INVALID_BASE, 0x118},
++	[DBG_PSE_HIF1_PG_INFO]		= { DBG_INVALID_BASE, 0x11c},
++	[DBG_PSE_PG_CPU_GROUP]		= { DBG_INVALID_BASE, 0x150},
++	[DBG_PSE_CPU_PG_INFO]		= { DBG_INVALID_BASE, 0x154},
++	[DBG_PSE_PG_PLE_GROUP]		= { DBG_INVALID_BASE, 0x160},
++	[DBG_PSE_PLE_PG_INFO]		= { DBG_INVALID_BASE, 0x164},
++	[DBG_PSE_PG_LMAC0_GROUP]	= { DBG_INVALID_BASE, 0x170},
++	[DBG_PSE_LMAC0_PG_INFO]		= { DBG_INVALID_BASE, 0x174},
++	[DBG_PSE_PG_LMAC1_GROUP]	= { DBG_INVALID_BASE, 0x178},
++	[DBG_PSE_LMAC1_PG_INFO]		= { DBG_INVALID_BASE, 0x17c},
++	[DBG_PSE_PG_LMAC2_GROUP]	= { DBG_INVALID_BASE, 0x180},
++	[DBG_PSE_LMAC2_PG_INFO]		= { DBG_INVALID_BASE, 0x184},
++	[DBG_PSE_PG_LMAC3_GROUP]	= { DBG_INVALID_BASE, 0x188},
++	[DBG_PSE_LMAC3_PG_INFO]		= { DBG_INVALID_BASE, 0x18c},
++	[DBG_PSE_PG_MDP_GROUP]		= { DBG_INVALID_BASE, 0x198},
++	[DBG_PSE_MDP_PG_INFO]		= { DBG_INVALID_BASE, 0x19c},
++	[DBG_PSE_PG_PLE1_GROUP]		= { DBG_INVALID_BASE, 0x168},
++	[DBG_PSE_PLE1_PG_INFO]		= { DBG_INVALID_BASE, 0x16c},
++	[DBG_AGG_AALCR0]		= { DBG_INVALID_BASE, 0x048},
++	[DBG_AGG_AALCR1]		= { DBG_INVALID_BASE, 0x04c},
++	[DBG_AGG_AALCR2]		= { DBG_INVALID_BASE, 0x050},
++	[DBG_AGG_AALCR3]		= { DBG_INVALID_BASE, 0x054},
++	[DBG_AGG_AALCR4]		= { DBG_INVALID_BASE, 0x058},
++	[DBG_AGG_B0BRR0]		= { DBG_INVALID_BASE, 0x100},
++	[DBG_AGG_B1BRR0]		= { DBG_INVALID_BASE, 0x104},
++	[DBG_AGG_B2BRR0]		= { DBG_INVALID_BASE, 0x108},
++	[DBG_AGG_B3BRR0]		= { DBG_INVALID_BASE, 0x10c},
++	[DBG_AGG_AWSCR0]		= { DBG_INVALID_BASE, 0x030},
++	[DBG_AGG_PCR0]			= { DBG_INVALID_BASE, 0x040},
++	[DBG_AGG_TTCR0]			= { DBG_INVALID_BASE, 0x04c},
++	[DBG_MIB_M0ARNG0]		= { DBG_INVALID_BASE, 0x4b8},
++	[DBG_MIB_M0DR2]			= { DBG_INVALID_BASE, 0x0a8},
++	[DBG_MIB_M0DR13]		= { DBG_INVALID_BASE, 0x164},
++};
++
++/* mt7986/mt7916 regs with different base and offset */
++static const struct __dbg_reg mt7916_dbg_reg[] = {
++	[DBG_INT_SOURCE_CSR]		= { MT_DBG_WFDMA0_BASE, 0x200 },
++	[DBG_INT_MASK_CSR]		= { MT_DBG_WFDMA0_BASE, 0x204 },
++	[DBG_INT1_SOURCE_CSR]		= { MT_DBG_WFDMA0_PCIE1_BASE, 0x200 },
++	[DBG_INT1_MASK_CSR]		= { MT_DBG_WFDMA0_PCIE1_BASE, 0x204 },
++	[DBG_TX_RING_BASE]		= { MT_DBG_WFDMA0_BASE, 0x400 },
++	[DBG_RX_EVENT_RING_BASE]	= { MT_DBG_WFDMA0_BASE, 0x500 },
++	[DBG_RX_STS_RING_BASE]		= { MT_DBG_WFDMA0_BASE, 0x520 },
++	[DBG_RX_DATA_RING_BASE]		= { MT_DBG_WFDMA0_BASE, 0x540 },
++	[DBG_DMA_ICSC_FR0]		= { DBG_INVALID_BASE, 0x05c },
++	[DBG_DMA_ICSC_FR1]		= { DBG_INVALID_BASE, 0x060 },
++	[DBG_TMAC_ICSCR0]		= { DBG_INVALID_BASE, 0x120 },
++	[DBG_RMAC_RXICSRPT]		= { DBG_INVALID_BASE, 0xd0 },
++	[DBG_MIB_M0SDR0]		= { DBG_INVALID_BASE, 0x7d8},
++	[DBG_MIB_M0SDR3]		= { DBG_INVALID_BASE, 0x698},
++	[DBG_MIB_M0SDR4]		= { DBG_INVALID_BASE, 0x788},
++	[DBG_MIB_M0SDR5]		= { DBG_INVALID_BASE, 0x780},
++	[DBG_MIB_M0SDR7]		= { DBG_INVALID_BASE, 0x5a8},
++	[DBG_MIB_M0SDR8]		= { DBG_INVALID_BASE, 0x78c},
++	[DBG_MIB_M0SDR9]		= { DBG_INVALID_BASE, 0x024},
++	[DBG_MIB_M0SDR10]		= { DBG_INVALID_BASE, 0x76c},
++	[DBG_MIB_M0SDR11]		= { DBG_INVALID_BASE, 0x790},
++	[DBG_MIB_M0SDR12]		= { DBG_INVALID_BASE, 0x558},
++	[DBG_MIB_M0SDR14]		= { DBG_INVALID_BASE, 0x564},
++	[DBG_MIB_M0SDR15]		= { DBG_INVALID_BASE, 0x564},
++	[DBG_MIB_M0SDR16]		= { DBG_INVALID_BASE, 0x7fc},
++	[DBG_MIB_M0SDR17]		= { DBG_INVALID_BASE, 0x800},
++	[DBG_MIB_M0SDR18]		= { DBG_INVALID_BASE, 0x030},
++	[DBG_MIB_M0SDR19]		= { DBG_INVALID_BASE, 0x5ac},
++	[DBG_MIB_M0SDR20]		= { DBG_INVALID_BASE, 0x5b0},
++	[DBG_MIB_M0SDR21]		= { DBG_INVALID_BASE, 0x5b4},
++	[DBG_MIB_M0SDR22]		= { DBG_INVALID_BASE, 0x770},
++	[DBG_MIB_M0SDR23]		= { DBG_INVALID_BASE, 0x774},
++	[DBG_MIB_M0DR0]			= { DBG_INVALID_BASE, 0x594},
++	[DBG_MIB_M0DR1]			= { DBG_INVALID_BASE, 0x598},
++	[DBG_MIB_MUBF]			= { DBG_INVALID_BASE, 0x7ac},
++	[DBG_MIB_M0DR6]			= { DBG_INVALID_BASE, 0x658},
++	[DBG_MIB_M0DR7]			= { DBG_INVALID_BASE, 0x65c},
++	[DBG_MIB_M0DR8]			= { DBG_INVALID_BASE, 0x56c},
++	[DBG_MIB_M0DR9]			= { DBG_INVALID_BASE, 0x570},
++	[DBG_MIB_M0DR10]		= { DBG_INVALID_BASE, 0x578},
++	[DBG_MIB_M0DR11]		= { DBG_INVALID_BASE, 0x574},
++	[DBG_MIB_M0DR12]		= { DBG_INVALID_BASE, 0x654},
++	[DBG_WTBLON_WDUCR]		= { DBG_INVALID_BASE, 0x200},
++	[DBG_UWTBL_WDUCR]		= { DBG_INVALID_BASE, 0x094},
++	[DBG_PLE_DRR_TABLE_CTRL]	= { DBG_INVALID_BASE, 0x490},
++	[DBG_PLE_DRR_TABLE_RDATA]	= { DBG_INVALID_BASE, 0x470},
++	[DBG_PLE_PBUF_CTRL]		= { DBG_INVALID_BASE, 0x004},
++	[DBG_PLE_QUEUE_EMPTY]		= { DBG_INVALID_BASE, 0x360},
++	[DBG_PLE_FREEPG_CNT]		= { DBG_INVALID_BASE, 0x380},
++	[DBG_PLE_FREEPG_HEAD_TAIL]	= { DBG_INVALID_BASE, 0x384},
++	[DBG_PLE_PG_HIF_GROUP]		= { DBG_INVALID_BASE, 0x00c},
++	[DBG_PLE_HIF_PG_INFO]		= { DBG_INVALID_BASE, 0x388},
++	[DBG_PLE_PG_HIF_TXCMD_GROUP]	= { DBG_INVALID_BASE, 0x014},
++	[DBG_PLE_HIF_TXCMD_PG_INFO]	= { DBG_INVALID_BASE, 0x390},
++	[DBG_PLE_PG_CPU_GROUP]		= { DBG_INVALID_BASE, 0x018},
++	[DBG_PLE_CPU_PG_INFO]		= { DBG_INVALID_BASE, 0x394},
++	[DBG_PLE_FL_QUE_CTRL]		= { DBG_INVALID_BASE, 0x3e0},
++	[DBG_PLE_NATIVE_TXCMD_Q_EMPTY]	= { DBG_INVALID_BASE, 0x370},
++	[DBG_PLE_TXCMD_Q_EMPTY]		= { DBG_INVALID_BASE, 0x374},
++	[DBG_PLE_AC_QEMPTY]		= { DBG_INVALID_BASE, 0x600},
++	[DBG_PLE_AC_OFFSET]		= { DBG_INVALID_BASE, 0x080},
++	[DBG_PLE_STATION_PAUSE]		= { DBG_INVALID_BASE, 0x100},
++	[DBG_PLE_DIS_STA_MAP] 		= { DBG_INVALID_BASE, 0x180},
++	[DBG_PSE_PBUF_CTRL]		= { DBG_INVALID_BASE, 0x004},
++	[DBG_PSE_FREEPG_CNT]		= { DBG_INVALID_BASE, 0x380},
++	[DBG_PSE_FREEPG_HEAD_TAIL]	= { DBG_INVALID_BASE, 0x384},
++	[DBG_PSE_HIF0_PG_INFO]		= { DBG_INVALID_BASE, 0x150},
++	[DBG_PSE_PG_HIF1_GROUP]		= { DBG_INVALID_BASE, 0x154},
++	[DBG_PSE_HIF1_PG_INFO]		= { DBG_INVALID_BASE, 0x160},
++	[DBG_PSE_PG_CPU_GROUP]		= { DBG_INVALID_BASE, 0x118},
++	[DBG_PSE_CPU_PG_INFO]		= { DBG_INVALID_BASE, 0x158},
++	[DBG_PSE_PG_PLE_GROUP]		= { DBG_INVALID_BASE, 0x11c},
++	[DBG_PSE_PLE_PG_INFO]		= { DBG_INVALID_BASE, 0x15c},
++	[DBG_PSE_PG_LMAC0_GROUP]	= { DBG_INVALID_BASE, 0x124},
++	[DBG_PSE_LMAC0_PG_INFO]		= { DBG_INVALID_BASE, 0x164},
++	[DBG_PSE_PG_LMAC1_GROUP]	= { DBG_INVALID_BASE, 0x128},
++	[DBG_PSE_LMAC1_PG_INFO]		= { DBG_INVALID_BASE, 0x168},
++	[DBG_PSE_PG_LMAC2_GROUP]	= { DBG_INVALID_BASE, 0x12c},
++	[DBG_PSE_LMAC2_PG_INFO]		= { DBG_INVALID_BASE, 0x16c},
++	[DBG_PSE_PG_LMAC3_GROUP]	= { DBG_INVALID_BASE, 0x130},
++	[DBG_PSE_LMAC3_PG_INFO]		= { DBG_INVALID_BASE, 0x17c},
++	[DBG_PSE_PG_MDP_GROUP]		= { DBG_INVALID_BASE, 0x134},
++	[DBG_PSE_MDP_PG_INFO]		= { DBG_INVALID_BASE, 0x174},
++	[DBG_PSE_PG_PLE1_GROUP]		= { DBG_INVALID_BASE, 0x120},
++	[DBG_PSE_PLE1_PG_INFO]		= { DBG_INVALID_BASE, 0x160},
++	[DBG_AGG_AALCR0]		= { DBG_INVALID_BASE, 0x028},
++	[DBG_AGG_AALCR1]		= { DBG_INVALID_BASE, 0x144},
++	[DBG_AGG_AALCR2]		= { DBG_INVALID_BASE, 0x14c},
++	[DBG_AGG_AALCR3]		= { DBG_INVALID_BASE, 0x154},
++	[DBG_AGG_AALCR4]		= { DBG_INVALID_BASE, 0x02c},
++	[DBG_AGG_B0BRR0]		= { DBG_INVALID_BASE, 0x08c},
++	[DBG_AGG_B1BRR0]		= { DBG_INVALID_BASE, 0x148},
++	[DBG_AGG_B2BRR0]		= { DBG_INVALID_BASE, 0x150},
++	[DBG_AGG_B3BRR0]		= { DBG_INVALID_BASE, 0x158},
++	[DBG_AGG_AWSCR0]		= { DBG_INVALID_BASE, 0x05c},
++	[DBG_AGG_PCR0]			= { DBG_INVALID_BASE,	0x06c},
++	[DBG_AGG_TTCR0]			= { DBG_INVALID_BASE, 0x07c},
++	[DBG_MIB_M0ARNG0]		= { DBG_INVALID_BASE, 0x0b0},
++	[DBG_MIB_M0DR2]			= { DBG_INVALID_BASE, 0x7dc},
++	[DBG_MIB_M0DR13]		= { DBG_INVALID_BASE, 0x7ec},
++};
++
++static const struct __dbg_mask mt7915_dbg_mask[] = {
++	[DBG_MIB_M0SDR10_RX_MDRDY_COUNT]= {25, 0},
++	[DBG_MIB_M0SDR14_AMPDU]		= {23, 0},
++	[DBG_MIB_M0SDR15_AMPDU_ACKED]	= {23, 0},
++	[DBG_MIB_RX_FCS_ERROR_COUNT]	= {15, 0},
++};
++
++static const struct __dbg_mask mt7916_dbg_mask[] = {
++	[DBG_MIB_M0SDR10_RX_MDRDY_COUNT]= {31, 0},
++	[DBG_MIB_M0SDR14_AMPDU]		= {31, 0},
++	[DBG_MIB_M0SDR15_AMPDU_ACKED]	= {31, 0},
++	[DBG_MIB_RX_FCS_ERROR_COUNT]	= {31, 16},
++};
++
++/* used to differentiate between generations */
++struct mt7915_dbg_reg_desc {
++	const u32 id;
++	const u32 *base_rev;
++	const struct __dbg_reg *reg_rev;
++	const struct __dbg_mask *mask_rev;
++};
++
++static const struct mt7915_dbg_reg_desc dbg_reg_s[] = {
++	{ 0x7915,
++	  mt7915_dbg_base,
++	  mt7915_dbg_reg,
++	  mt7915_dbg_mask
++	},
++	{ 0x7906,
++	  mt7916_dbg_base,
++	  mt7916_dbg_reg,
++	  mt7916_dbg_mask
++	},
++	{ 0x7986,
++	  mt7986_dbg_base,
++	  mt7916_dbg_reg,
++	  mt7916_dbg_mask
++	},
++};
++
++struct bin_debug_hdr {
++	__le32 magic_num;
++	__le16 serial_id;
++	__le16 msg_type;
++	__le16 len;
++	__le16 des_len;	/* descriptor len for rxd */
++} __packed;
++
++#define __DBG_REG_MAP(_dev, id, ofs)	((_dev)->dbg_reg->base_rev[(id)] + (ofs))
++#define __DBG_REG_BASE(_dev, id)	((_dev)->dbg_reg->reg_rev[(id)].base)
++#define __DBG_REG_OFFS(_dev, id)	((_dev)->dbg_reg->reg_rev[(id)].offs)
++
++#define __DBG_MASK(_dev, id)		GENMASK((_dev)->dbg_reg->mask_rev[(id)].end,	\
++						(_dev)->dbg_reg->mask_rev[(id)].start)
++#define __DBG_REG(_dev, id)		__DBG_REG_MAP((_dev), __DBG_REG_BASE((_dev), (id)),	\
++						__DBG_REG_OFFS((_dev), (id)))
++
++#define __DBG_FIELD_GET(id, _reg)	(((_reg) & __DBG_MASK(dev, (id))) >>	\
++						dev->dbg_reg->mask_rev[(id)].start)
++#define __DBG_FIELD_PREP(id, _reg)	(((_reg) << dev->dbg_reg->mask_rev[(id)].start) &	\
++						__DBG_MASK(dev, (id)))
++
++
++#define MT_DBG_TX_RING_BASE			__DBG_REG(dev, DBG_TX_RING_BASE)
++#define MT_DBG_RX_EVENT_RING_BASE		__DBG_REG(dev, DBG_RX_EVENT_RING_BASE)
++#define MT_DBG_RX_STS_RING_BASE			__DBG_REG(dev, DBG_RX_STS_RING_BASE)
++#define MT_DBG_RX_DATA_RING_BASE		__DBG_REG(dev, DBG_RX_DATA_RING_BASE)
++
++#define MT_DBG_TX_RING_CTRL(n)			(MT_DBG_TX_RING_BASE + (0x10 * (n)))
++#define MT_DBG_RX_DATA_RING_CTRL(n)		(MT_DBG_RX_DATA_RING_BASE + (0x10 * (n)))
++#define MT_DBG_RX_EVENT_RING_CTRL(n)		(MT_DBG_RX_EVENT_RING_BASE + (0x10 * (n)))
++
++/* WFDMA COMMON */
++#define MT_DBG_INT_SOURCE_CSR			__DBG_REG(dev, DBG_INT_SOURCE_CSR)
++#define MT_DBG_INT_MASK_CSR			__DBG_REG(dev, DBG_INT_MASK_CSR)
++#define MT_DBG_INT1_SOURCE_CSR			__DBG_REG(dev, DBG_INT1_SOURCE_CSR)
++#define MT_DBG_INT1_MASK_CSR			__DBG_REG(dev, DBG_INT1_MASK_CSR)
++
++/* WFDMA0 */
++#define MT_DBG_WFDMA0(_ofs)			__DBG_REG_MAP(dev, MT_DBG_WFDMA0_BASE, (_ofs))
++
++#define MT_DBG_WFDMA0_INT_SOURCE_CSR		MT_DBG_WFDMA0(0x200)
++#define MT_DBG_WFDMA0_INT_MASK_CSR		MT_DBG_WFDMA0(0x204)
++
++#define MT_DBG_WFDMA0_GLO_CFG			MT_DBG_WFDMA0(0x208)
++#define MT_DBG_WFDMA0_GLO_CFG_TX_DMA_EN		BIT(0)
++#define MT_DBG_WFDMA0_GLO_CFG_RX_DMA_EN		BIT(2)
++#define MT_DBG_WFDMA0_GLO_CFG_TX_BUSY_MASK	BIT(1)
++#define MT_DBG_WFDMA0_GLO_CFG_RX_BUSY_MASK	BIT(3)
++
++
++/* WFDMA1 */
++#define MT_DBG_WFDMA1(_ofs)			__DBG_REG_MAP(dev, MT_DBG_WFDMA1_BASE, (_ofs))
++#define MT_DBG_WFDMA1_INT_SOURCE_CSR		MT_DBG_WFDMA1(0x200)
++#define MT_DBG_WFDMA1_INT_MASK_CSR		MT_DBG_WFDMA1(0x204)
++
++#define MT_DBG_WFDMA1_GLO_CFG			MT_DBG_WFDMA1(0x208)
++
++#define MT_DBG_WFDMA1_GLO_CFG_TX_DMA_EN		BIT(0)
++#define MT_DBG_WFDMA1_GLO_CFG_RX_DMA_EN		BIT(2)
++#define MT_DBG_WFDMA1_GLO_CFG_TX_BUSY_MASK	BIT(1)
++#define MT_DBG_WFDMA1_GLO_CFG_RX_BUSY_MASK	BIT(3)
++
++/* WFDMA0 PCIE1 */
++#define MT_DBG_WFDMA0_PCIE1(_ofs)		__DBG_REG_MAP(dev, MT_DBG_WFDMA0_PCIE1_BASE, (_ofs))
++
++#define MT_DBG_WFDMA0_PCIE1_INT_SOURCE_CSR	MT_DBG_WFDMA0_PCIE1(0x200)
++#define MT_DBG_WFDMA0_PCIE1_INT_MASK_CSR	MT_DBG_WFDMA0_PCIE1(0x204)
++#define MT_DBG_WFDMA0_PCIE1_GLO_CFG		MT_DBG_WFDMA0_PCIE1(0x208)
++#define MT_DBG_WFDMA0_PCIE1_RX1_CTRL0		MT_DBG_WFDMA1_PCIE1(0x510)
++
++#define MT_DBG_WFDMA0_PCIE1_GLO_CFG_TX_DMA_EN		BIT(0)
++#define MT_DBG_WFDMA0_PCIE1_GLO_CFG_TX_BUSY_MASK	BIT(1)
++#define MT_DBG_WFDMA0_PCIE1_GLO_CFG_RX_DMA_EN		BIT(2)
++#define MT_DBG_WFDMA0_PCIE1_GLO_CFG_RX_BUSY_MASK	BIT(3)
++
++/* WFDMA1 PCIE1 */
++#define MT_DBG_WFDMA1_PCIE1(_ofs)		__DBG_REG_MAP(dev, MT_DBG_WFDMA1_PCIE1_BASE, (_ofs))
++#define MT_DBG_WFDMA1_PCIE1_INT_SOURCE_CSR	MT_DBG_WFDMA1_PCIE1(0x200)
++#define MT_DBG_WFDMA1_PCIE1_INT_MASK_CSR	MT_DBG_WFDMA1_PCIE1(0x204)
++#define MT_DBG_WFDMA1_PCIE1_GLO_CFG		MT_DBG_WFDMA1_PCIE1(0x208)
++#define MT_DBG_WFDMA1_PCIE1_TX19_CTRL0		MT_DBG_WFDMA1_PCIE1(0x330)
++#define MT_DBG_WFDMA1_PCIE1_RX2_CTRL0		MT_DBG_WFDMA1_PCIE1(0x520)
++
++#define MT_DBG_WFDMA1_PCIE1_GLO_CFG_TX_DMA_EN		BIT(0)
++#define MT_DBG_WFDMA1_PCIE1_GLO_CFG_TX_BUSY_MASK	BIT(1)
++#define MT_DBG_WFDMA1_PCIE1_GLO_CFG_RX_DMA_EN		BIT(2)
++#define MT_DBG_WFDMA1_PCIE1_GLO_CFG_RX_BUSY_MASK	BIT(3)
++
++#define MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_RX_DMA_EN_MASK	BIT(2)
++#define MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_TX_DMA_EN_MASK	BIT(0)
++#define MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_RX_DMA_BUSY_MASK	BIT(3)
++#define MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_TX_DMA_BUSY_MASK	BIT(1)
++
++
++/* WF DMA TOP: band 0(0x820E7000),band 1(0x820F7000) */
++#define MT_DBG_WF_DMA_BASE(_band)		((_band) ? 0x820F7000 : 0x820E7000)
++#define MT_DBG_WF_DMA(_band, ofs)		(MT_WF_DMA_BASE(_band) + (ofs))
++
++#define MT_DBG_DMA_DCR0(_band)			MT_DBG_WF_DMA((_band), 0x000)
++#define MT_DBG_DMA_DCR0_MAX_RX_LEN		GENMASK(15, 3)
++#define MT_DBG_DMA_DCR0_RXD_G5_EN		BIT(23)
++
++#define MT_DBG_DMA_ICSC_FR0(_band)		MT_DBG_WF_DMA((_band), __DBG_REG_OFFS(dev, DBG_DMA_ICSC_FR0))
++#define MT_DBG_DMA_ICSC_FR0_RXBF_EN		BIT(25)
++#define MT_DBG_DMA_ICSC_FR0_EN			BIT(24)
++#define MT_DBG_DMA_ICSC_FR0_TOUT_MASK		GENMASK(23, 16)
++#define MT_DBG_DMA_ICSC_FR0_PID_MASK		GENMASK(9, 8)
++#define MT_DBG_DMA_ICSC_FR0_QID_MASK		GENMASK(6, 0)
++
++#define MT_DBG_DMA_ICSC_FR1(_band)		MT_DBG_WF_DMA((_band), __DBG_REG_OFFS(dev, DBG_DMA_ICSC_FR1))
++#define MT_DBG_DMA_ICSC_FR1_AGG_SIZE_MASK	GENMASK(26, 16)
++#define MT_DBG_DMA_ICSC_FR1_MAX_FRAME_SIZE_MASK	GENMASK(10, 0)
++
++/* TMAC: band 0(0x820e4000), band 1(0x820f4000) */
++#define MT_DBG_WF_TMAC_BASE(_band)		((_band) ? 0x820f4000 : 0x820e4000)
++#define MT_DBG_WF_TMAC(_band, ofs)		(MT_DBG_WF_TMAC_BASE(_band) + (ofs))
++
++#define MT_DBG_TMAC_ICSCR0(_band)		MT_DBG_WF_TMAC((_band), __DBG_REG_OFFS(dev, DBG_TMAC_ICSCR0))
++#define MT_DBG_TMAC_ICSCR0_ICSRPT_EN        	BIT(0)
++
++/* RMAC: band 0(0x820E5000), band 1(0x820f5000) */
++#define MT_DBG_WF_RMAC_BASE(_band)		((_band) ? 0x820f5000 : 0x820E5000)
++#define MT_DBG_WF_RMAC(_band, ofs)		(MT_DBG_WF_RMAC_BASE(_band) + (ofs))
++
++#define MT_DBG_RMAC_RXICSRPT(_band)		MT_DBG_WF_RMAC((_band), __DBG_REG_OFFS(dev, DBG_RMAC_RXICSRPT))
++#define MT_DBG_RMAC_RXICSRPT_ICSRPT_EN		BIT(0)
++
++/* MIB: band 0(0x820ed000), band 1(0x820fd000) */
++#define MT_DBG_MIB_BASE(_band)			((_band) ? 0x820fd000 : 0x820ed000)
++#define MT_DBG_MIB(_band, ofs)			(MT_DBG_MIB_BASE(_band) + (ofs))
++
++
++#define MT_DBG_MIB_M0SCR0(_band)		MT_DBG_MIB((_band), 0x00)
++#define MT_DBG_MIB_M0PBSCR(_band)		MT_DBG_MIB((_band), 0x04)
++
++#define MT_DBG_MIB_M0SDR0(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR0))
++#define MT_DBG_MIB_M0SDR3(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR3))
++#define MT_DBG_MIB_RX_FCS_ERROR_COUNT_MASK	__DBG_MASK(dev, DBG_MIB_RX_FCS_ERROR_COUNT)
++#define MT_DBG_MIB_M0SDR4(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR4))
++#define MT_DBG_MIB_M0SDR5(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR5))
++#define MT_DBG_MIB_M0SDR6(_band)		MT_DBG_MIB((_band), 0x20)
++#define MT_DBG_MIB_M0SDR7(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR7))
++#define MT_DBG_MIB_M0SDR8(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR8))
++#define MT_DBG_MIB_M0SDR9(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR9))
++#define MT_DBG_MIB_M0SDR10(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR10))
++#define MT_DBG_MIB_M0SDR10_RX_MDRDY_COUNT_MASK	__DBG_MASK(dev, DBG_MIB_M0SDR10_RX_MDRDY_COUNT)
++#define MT_DBG_MIB_M0SDR11(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR11))
++
++#define MT_DBG_MIB_M0SDR12(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR12))
++
++#define MT_DBG_MIB_M0SDR14(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR14))
++#define MT_DBG_MIB_M0SDR14_AMPDU_MASK		__DBG_MASK(dev, DBG_MIB_M0SDR14_AMPDU)
++#define MT_DBG_MIB_M0SDR15(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR15))
++#define MT_DBG_MIB_M0SDR15_AMPDU_ACKED_MASK	__DBG_MASK(dev, DBG_MIB_M0SDR15_AMPDU_ACKED)
++#define MT_DBG_MIB_M0SDR16(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR16))
++#define MT_DBG_MIB_M0SDR17(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR17))
++#define MT_DBG_MIB_M0SDR18(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR18))
++#define MT_DBG_MIB_M0SDR19(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR19))
++#define MT_DBG_MIB_M0SDR20(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR20))
++#define MT_DBG_MIB_M0SDR21(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR21))
++#define MT_DBG_MIB_M0SDR22(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR22))
++#define MT_DBG_MIB_M0SDR23(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0SDR23))
++#define MT_DBG_MIB_M0DR0(_band)			MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR0))
++#define MT_DBG_MIB_M0DR1(_band)			MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR1))
++
++#define MT_DBG_MIB_MUBF(_band)			MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_MUBF))
++#define MT_DBG_MIB_M0DR6(_band)			MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR6))
++#define MT_DBG_MIB_M0DR7(_band)			MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR7))
++#define MT_DBG_MIB_M0DR8(_band)			MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR8))
++#define MT_DBG_MIB_M0DR9(_band)			MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR9))
++#define MT_DBG_MIB_M0DR10(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR10))
++#define MT_DBG_MIB_M0DR11(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR11))
++ #define MT_DBG_MIB_M0DR12(_band)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR12))
++
++/* WTBLON TOP: 0x820D4000/pcie(0x34000) rbus(0x434000) */
++#define MT_DBG_WTBLON_TOP_BASE			0x820D4000
++#define MT_DBG_WTBLON_TOP(ofs)			(MT_WTBLON_TOP_BASE + (ofs))
++#define MT_DBG_WTBLON_TOP_WDUCR			MT_DBG_WTBLON_TOP(__DBG_REG_OFFS(dev, DBG_WTBLON_WDUCR))
++#define MT_DBG_WTBLON_TOP_WDUCR_GROUP		GENMASK(2, 0)
++
++#define WF_WTBLON_TOP_B0BTCRn_ADDR		(MT_DBG_WTBLON_TOP_BASE + 0x1000) // 5000
++#define WF_WTBLON_TOP_B0BTBCRn_ADDR		(MT_DBG_WTBLON_TOP_BASE + 0x1010) // 5010
++#define WF_WTBLON_TOP_B0BRCRn_ADDR		(MT_DBG_WTBLON_TOP_BASE + 0x1020) // 5020
++#define WF_WTBLON_TOP_B0BRBCRn_ADDR		(MT_DBG_WTBLON_TOP_BASE + 0x1030) // 5030
++#define WF_WTBLON_TOP_B0BTDCRn_ADDR		(MT_DBG_WTBLON_TOP_BASE + 0x1040) // 5040
++#define WF_WTBLON_TOP_B0BRDCRn_ADDR		(MT_DBG_WTBLON_TOP_BASE + 0x1050) // 5050
++#define WF_WTBLON_TOP_B0MBTCRn_ADDR		(MT_DBG_WTBLON_TOP_BASE + 0x1100) // 5100
++#define WF_WTBLON_TOP_B0MBTBCRn_ADDR		(MT_DBG_WTBLON_TOP_BASE + 0x1140) // 5140
++#define WF_WTBLON_TOP_B0MBRCRn_ADDR		(MT_DBG_WTBLON_TOP_BASE + 0x1180) // 5180
++#define WF_WTBLON_TOP_B0MBRBCRn_ADDR 		(MT_DBG_WTBLON_TOP_BASE + 0x11C0) // 51C0
++
++#define WF_WTBLON_TOP_B1BTCRn_ADDR		(MT_DBG_WTBLON_TOP_BASE + 0x1800) // 5800
++
++/* WTBLON TOP: 0x820C4000/pcie(0xa8000) rbus(0x4a8000) */
++#define MT_DBG_UWTBL_TOP_BASE			0x820C4000
++#define MT_DBG_UWTBL_TOP(ofs)			(MT_DBG_UWTBL_TOP_BASE + (ofs))
++
++#define MT_DBG_UWTBL_TOP_WDUCR			MT_DBG_WTBLON_TOP(__DBG_REG_OFFS(dev, DBG_UWTBL_WDUCR))
++
++#define MT_UWTBL_TOP_WDUCR_TARGET		BIT(31)
++#define MT_UWTBL_TOP_WDUCR_GROUP		GENMASK(3, 0)
++
++
++/* WTBL : 0x820D8000/pcie(0x38000) rbus(0x438000) */
++#define MT_DBG_WTBL_BASE			0x820D8000
++
++/* PLE related CRs. */
++#define MT_DBG_PLE_BASE				0x820C0000
++#define MT_DBG_PLE(ofs)				(MT_DBG_PLE_BASE + (ofs))
++
++#define MT_DBG_PLE_DRR_TAB_CTRL			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_DRR_TABLE_CTRL))
++#define MT_DBG_PLE_DRR_TAB_RD_OFS		__DBG_REG_OFFS(dev, DBG_PLE_DRR_TABLE_RDATA)
++
++#define MT_DBG_PLE_DRR_TABLE_RDATA0		MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0x0)
++#define MT_DBG_PLE_DRR_TABLE_RDATA1		MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0x4)
++#define MT_DBG_PLE_DRR_TABLE_RDATA2		MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0x8)
++#define MT_DBG_PLE_DRR_TABLE_RDATA3		MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0xc)
++#define MT_DBG_PLE_DRR_TABLE_RDATA4		MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0x10)
++#define MT_DBG_PLE_DRR_TABLE_RDATA5		MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0x14)
++#define MT_DBG_PLE_DRR_TABLE_RDATA6		MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS + 0x18)
++#define MT_DBG_PLE_DRR_TABLE_RDATA7		MT_DBG_PLE(MT_DBG_PLE_DRR_TAB_RD_OFS+ 0x1c)
++
++#define MT_DBG_PLE_PBUF_CTRL_ADDR		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_PBUF_CTRL))
++#define MT_DBG_PLE_QUEUE_EMPTY			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_QUEUE_EMPTY))
++#define MT_DBG_PLE_FREEPG_CNT			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_FREEPG_CNT))
++#define MT_DBG_PLE_FREEPG_HEAD_TAIL		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_FREEPG_HEAD_TAIL))
++#define MT_DBG_PLE_PG_HIF_GROUP			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_PG_HIF_GROUP))
++#define MT_DBG_PLE_HIF_PG_INFO			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_HIF_PG_INFO))
++#define MT_DBG_PLE_PG_HIF_TXCMD_GROUP		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_PG_HIF_TXCMD_GROUP))
++#define MT_DBG_PLE_HIF_TXCMD_PG_INFO		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_HIF_TXCMD_PG_INFO))
++#define MT_DBG_PLE_PG_CPU_GROUP			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_PG_CPU_GROUP))
++#define MT_DBG_PLE_CPU_PG_INFO			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_CPU_PG_INFO))
++#define PLE_FL_QUE_CTRL_OFFSET			__DBG_REG_OFFS(dev, DBG_PLE_FL_QUE_CTRL)
++#define MT_DBG_PLE_FL_QUE_CTRL0			MT_DBG_PLE(PLE_FL_QUE_CTRL_OFFSET + 0x0)
++#define MT_DBG_PLE_FL_QUE_CTRL1			MT_DBG_PLE(PLE_FL_QUE_CTRL_OFFSET + 0x4)
++#define MT_DBG_PLE_FL_QUE_CTRL2			MT_DBG_PLE(PLE_FL_QUE_CTRL_OFFSET + 0x8)
++#define MT_DBG_PLE_FL_QUE_CTRL3			MT_DBG_PLE(PLE_FL_QUE_CTRL_OFFSET + 0xc)
++#define MT_DBG_PLE_NATIVE_TXCMD_Q_EMPTY		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_NATIVE_TXCMD_Q_EMPTY))
++#define MT_DBG_PLE_TXCMD_Q_EMPTY		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_TXCMD_Q_EMPTY))
++
++#define MT_DBG_PLE_PBUF_CTRL_PAGE_SIZE_MASK		BIT(31)
++#define MT_DBG_PLE_PBUF_CTRL_OFFSET_MASK 		GENMASK(25, 17)
++#define MT_DBG_PLE_PBUF_CTRL_TOTAL_PAGE_NUM_MASK	GENMASK(11, 0)
++
++#define MT_DBG_PLE_FREEPG_CNT_FREEPG_CNT_MASK		GENMASK(11, 0)
++#define MT_DBG_PLE_FREEPG_CNT_FFA_CNT_MASK		GENMASK(27, 16)
++#define MT_DBG_PLE_FREEPG_HEAD_TAIL_FREEPG_TAIL_MASK	GENMASK(27, 16)
++#define MT_DBG_PLE_FREEPG_HEAD_TAIL_FREEPG_HEAD_MASK	GENMASK(11, 0)
++#define MT_DBG_PLE_PG_HIF_GROUP_HIF_MAX_QUOTA_MASK	GENMASK(27, 16)
++#define MT_DBG_PLE_PG_HIF_GROUP_HIF_MIN_QUOTA_MASK	GENMASK(11, 0)
++
++#define MT_DBG_PLE_HIF_PG_INFO_HIF_SRC_CNT_MASK		GENMASK(27, 16)
++#define MT_DBG_PLE_HIF_PG_INFO_HIF_RSV_CNT_MASK		GENMASK(11, 0)
++
++#define MT_DBG_PLE_PG_HIF_TXCMD_GROUP_HIF_TXCMD_MAX_QUOTA_MASK	GENMASK(27, 16)
++#define MT_DBG_PLE_PG_HIF_TXCMD_GROUP_HIF_TXCMD_MIN_QUOTA_MASK	GENMASK(11, 0)
++
++#define MT_DBG_PLE_HIF_TXCMD_PG_INFO_HIF_TXCMD_SRC_CNT_MASK	GENMASK(27, 16)
++#define MT_DBG_PLE_HIF_TXCMD_PG_INFO_HIF_TXCMD_RSV_CNT_MASK	GENMASK(11, 0)
++
++#define MT_DBG_PLE_TXCMD_PG_INFO_HIF_TXCMD_SRC_CNT_MASK GENMASK(27, 16)
++#define MT_DBG_PLE_TXCMD_PG_INFO_HIF_TXCMD_RSV_CNT_MASK	GENMASK(11, 0)
++
++#define MT_DBG_PLE_PG_CPU_GROUP_CPU_MAX_QUOTA_MASK	GENMASK(27, 16)
++#define MT_DBG_PLE_PG_CPU_GROUP_CPU_MIN_QUOTA_MASK 	GENMASK(11, 0)
++
++#define MT_DBG_PLE_CPU_PG_INFO_CPU_SRC_CNT_MASK		GENMASK(27, 16)
++#define MT_DBG_PLE_CPU_PG_INFO_CPU_RSV_CNT_MASK 	GENMASK(11, 0)
++
++#define MT_DBG_PLE_Q_EMPTY_ALL_AC_EMPTY_MASK		BIT(24)
++#define MT_DBG_PLE_FL_QUE_CTRL0_EXECUTE_MASK		BIT(31)
++#define MT_DBG_PLE_FL_QUE_CTRL0_Q_BUF_QID_MASK 		GENMASK(30, 24)
++
++#define MT_PLE_FL_QUE_CTRL0_Q_BUF_QID_SHFT		24
++#define MT_PLE_FL_QUE_CTRL0_Q_BUF_PID_SHFT             	10
++
++#define MT_DBG_PLE_FL_QUE_CTRL2_Q_TAIL_FID_MASK		GENMASK(27, 16)
++#define MT_DBG_PLE_FL_QUE_CTRL2_Q_HEAD_FID_MASK		GENMASK(11, 0)
++#define MT_DBG_PLE_FL_QUE_CTRL3_Q_PKT_NUM_MASK		GENMASK(11, 0)
++
++#define MT_DBG_PLE_STATION_PAUSE(n)		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_STATION_PAUSE) + ((n) << 2))
++#define MT_DBG_PLE_DIS_STA_MAP(n)		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_DIS_STA_MAP) + ((n) << 2))
++#define MT_DBG_PLE_AC_QEMPTY(ac, n)		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PLE_AC_QEMPTY) +	\
++							   __DBG_REG_OFFS(dev, DBG_PLE_AC_OFFSET) * (ac) + ((n) << 2))
++
++#define MT_DBG_PLE_AMSDU_PACK_MSDU_CNT(n)	MT_DBG_PLE(0x10e0 + ((n) << 2))
++
++/* pseinfo related CRs. */
++#define MT_DBG_PSE_BASE				0x820C8000
++#define MT_DBG_PSE(ofs)				(MT_DBG_PSE_BASE + (ofs))
++
++#define MT_DBG_PSE_PBUF_CTRL			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_PBUF_CTRL))
++#define MT_DBG_PSE_QUEUE_EMPTY			MT_DBG_PLE(0x0b0)
++#define MT_DBG_PSE_FREEPG_CNT			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_FREEPG_CNT))
++#define MT_DBG_PSE_FREEPG_HEAD_TAIL		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_FREEPG_HEAD_TAIL))
++#define MT_DBG_PSE_PG_HIF0_GROUP		MT_DBG_PLE(0x110)
++#define MT_DBG_PSE_HIF0_PG_INFO			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_HIF0_PG_INFO))
++#define MT_DBG_PSE_PG_HIF1_GROUP		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_PG_HIF1_GROUP))
++#define MT_DBG_PSE_HIF1_PG_INFO			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_HIF1_PG_INFO))
++#define MT_DBG_PSE_PG_CPU_GROUP			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_PG_CPU_GROUP))
++#define MT_DBG_PSE_CPU_PG_INFO			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_CPU_PG_INFO))
++#define MT_DBG_PSE_PG_LMAC0_GROUP		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_PG_LMAC0_GROUP))
++#define MT_DBG_PSE_LMAC0_PG_INFO		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_LMAC0_PG_INFO))
++#define MT_DBG_PSE_PG_LMAC1_GROUP		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_PG_LMAC1_GROUP))
++#define MT_DBG_PSE_LMAC1_PG_INFO		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_LMAC1_PG_INFO))
++#define MT_DBG_PSE_PG_LMAC2_GROUP		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_PG_LMAC2_GROUP))
++#define MT_DBG_PSE_LMAC2_PG_INFO		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_LMAC2_PG_INFO))
++#define MT_DBG_PSE_PG_PLE_GROUP			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_PG_PLE_GROUP))
++#define MT_DBG_PSE_PLE_PG_INFO			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_PLE_PG_INFO))
++#define MT_DBG_PSE_PG_LMAC3_GROUP		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_PG_LMAC3_GROUP))
++#define MT_DBG_PSE_LMAC3_PG_INFO		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_LMAC3_PG_INFO))
++#define MT_DBG_PSE_PG_MDP_GROUP			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_PG_MDP_GROUP))
++#define MT_DBG_PSE_MDP_PG_INFO			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_MDP_PG_INFO))
++#define MT_DBG_PSE_PG_PLE1_GROUP		MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_PG_PLE1_GROUP))
++#define MT_DBG_PSE_PLE1_PG_INFO			MT_DBG_PLE(__DBG_REG_OFFS(dev, DBG_PSE_PLE1_PG_INFO))
++
++#define MT_DBG_PSE_PBUF_CTRL_PAGE_SIZE_CFG_MASK		BIT(31)
++#define MT_DBG_PSE_PBUF_CTRL_PBUF_OFFSET_MASK		GENMASK(25, 17)
++#define MT_DBG_PSE_PBUF_CTRL_TOTAL_PAGE_NUM_MASK	GENMASK(11, 0)
++#define MT_DBG_PSE_QUEUE_EMPTY_RLS_Q_EMTPY_MASK		BIT(31)
++#define MT_DBG_PSE_QUEUE_EMPTY_MDP_RXIOC_QUEUE_EMPTY_MASK	BIT(23)
++#define MT_DBG_PSE_QUEUE_EMPTY_MDP_TXIOC_QUEUE_EMPTY_MASK 	BIT(22)
++#define MT_DBG_PSE_QUEUE_EMPTY_SFD_PARK_QUEUE_EMPTY_MASK 	BIT(21)
++#define MT_DBG_PSE_QUEUE_EMPTY_SEC_RX_QUEUE_EMPTY_SHFT   	BIT(20)
++#define MT_DBG_PSE_QUEUE_EMPTY_SEC_TX_QUEUE_EMPTY_MASK 	BIT(19)
++#define MT_DBG_PSE_QUEUE_EMPTY_MDP_RX_QUEUE_EMPTY_MASK	BIT(18)
++#define MT_DBG_PSE_QUEUE_EMPTY_MDP_TX_QUEUE_EMPTY_MASK  BIT(17)
++#define MT_DBG_PSE_QUEUE_EMPTY_LMAC_TX_QUEUE_EMPTY_MASK BIT(16)
++#define MT_DBG_PSE_QUEUE_EMPTY_HIF_5_EMPTY_MASK		BIT(13)
++#define MT_DBG_PSE_QUEUE_EMPTY_HIF_4_EMPTY_MASK	   	BIT(12)
++#define MT_DBG_PSE_QUEUE_EMPTY_HIF_3_EMPTY_MASK		BIT(11)
++#define MT_DBG_PSE_QUEUE_EMPTY_HIF_2_EMPTY_MASK	   	BIT(10)
++#define MT_DBG_PSE_QUEUE_EMPTY_HIF_1_EMPTY_MASK		BIT(9)
++#define MT_DBG_PSE_QUEUE_EMPTY_HIF_0_EMPTY_MASK	   	BIT(8)
++#define MT_DBG_PSE_QUEUE_EMPTY_CPU_Q3_EMPTY_MASK	BIT(3)
++#define MT_DBG_PSE_QUEUE_EMPTY_CPU_Q2_EMPTY_MASK	BIT(2)
++#define MT_DBG_PSE_QUEUE_EMPTY_CPU_Q1_EMPTY_MASK	BIT(1)
++#define MT_DBG_PSE_QUEUE_EMPTY_CPU_Q0_EMPTY_MASK	BIT(0)
++#define MT_DBG_PSE_FREEPG_CNT_FFA_CNT_MASK		GENMASK(27, 16)
++#define MT_DBG_PSE_FREEPG_CNT_FREEPG_CNT_MASK	   	GENMASK(11, 0)
++#define MT_DBG_PSE_FREEPG_HEAD_TAIL_FREEPG_TAIL_MASK	GENMASK(27, 16)
++#define MT_DBG_PSE_FREEPG_HEAD_TAIL_FREEPG_HEAD_MASK	GENMASK(11, 0)
++#define MT_DBG_PSE_PG_HIF0_GROUP_HIF0_MAX_QUOTA_MASK 	GENMASK(27, 16)
++#define MT_DBG_PSE_PG_HIF0_GROUP_HIF0_MIN_QUOTA_MASK 	GENMASK(11, 0)
++#define MT_DBG_PSE_PG_HIF0_GROUP_HIF0_MAX_QUOTA_MASK	GENMASK(27, 16)
++#define MT_DBG_PSE_PG_HIF0_GROUP_HIF0_MIN_QUOTA_MASK	GENMASK(11, 0)
++#define MT_DBG_PSE_HIF0_PG_INFO_HIF0_SRC_CNT_MASK 	GENMASK(27, 16)
++#define MT_DBG_PSE_HIF0_PG_INFO_HIF0_RSV_CNT_MASK 	GENMASK(11, 0)
++#define MT_DBG_PSE_PG_HIF1_GROUP_HIF1_MAX_QUOTA_MASK 	GENMASK(27, 16)
++#define MT_DBG_PSE_PG_HIF1_GROUP_HIF1_MIN_QUOTA_MASK 	GENMASK(11, 0)
++#define MT_DBG_PSE_HIF1_PG_INFO_HIF1_SRC_CNT_MASK   	GENMASK(27, 16)
++#define MT_DBG_PSE_HIF1_PG_INFO_HIF1_RSV_CNT_MASK 	GENMASK(11, 0)
++#define MT_DBG_PSE_CPU_PG_INFO_CPU_SRC_CNT_MASK    	GENMASK(27, 16)
++#define MT_DBG_PSE_CPU_PG_INFO_CPU_RSV_CNT_MASK		GENMASK(11, 0)
++#define MT_DBG_PSE_PG_PLE_GROUP_PLE_MAX_QUOTA_MASK    	GENMASK(27, 16)
++#define MT_DBG_PSE_PG_PLE_GROUP_PLE_MIN_QUOTA_MASK 	GENMASK(11, 0)
++#define MT_DBG_PSE_PG_CPU_GROUP_CPU_MAX_QUOTA_MASK	GENMASK(27, 16)
++#define MT_DBG_PSE_PG_CPU_GROUP_CPU_MIN_QUOTA_MASK	GENMASK(11, 0)
++#define MT_DBG_PSE_PLE_PG_INFO_PLE_SRC_CNT_MASK    	GENMASK(27, 16)
++#define MT_DBG_PSE_PLE_PG_INFO_PLE_RSV_CNT_MASK		GENMASK(11, 0)
++#define MT_DBG_PSE_PG_LMAC0_GROUP_LMAC0_MAX_QUOTA_MASK	GENMASK(27, 16)
++#define MT_DBG_PSE_PG_LMAC0_GROUP_LMAC0_MIN_QUOTA_MASK	GENMASK(11, 0)
++#define MT_DBG_PSE_LMAC0_PG_INFO_LMAC0_SRC_CNT_MASK   	GENMASK(27, 16)
++#define MT_DBG_PSE_LMAC0_PG_INFO_LMAC0_RSV_CNT_MASK   	GENMASK(11, 0)
++#define MT_DBG_PSE_PG_LMAC1_GROUP_LMAC1_MAX_QUOTA_MASK	GENMASK(27, 16)
++#define MT_DBG_TOP_PG_LMAC1_GROUP_LMAC1_MIN_QUOTA_MASK 	GENMASK(11, 0)
++#define MT_DBG_PSE_LMAC1_PG_INFO_LMAC1_SRC_CNT_MASK	GENMASK(27, 16)
++#define MT_DBG_PSE_LMAC1_PG_INFO_LMAC1_RSV_CNT_MASK	GENMASK(11, 0)
++#define MT_DBG_PSE_PG_LMAC2_GROUP_LMAC2_MAX_QUOTA_MASK	GENMASK(27, 16)
++#define MT_DBG_PSE_PG_LMAC2_GROUP_LMAC2_MIN_QUOTA_MASK	GENMASK(11, 0)
++#define MT_DBG_PSE_LMAC2_PG_INFO_LMAC2_SRC_CNT_MASK	GENMASK(27, 16)
++#define MT_DBG_PSE_LMAC2_PG_INFO_LMAC2_RSV_CNT_MASK	GENMASK(11, 0)
++#define MT_DBG_PSE_PG_LMAC3_GROUP_LMAC3_MAX_QUOTA_MASK	GENMASK(27, 16)
++#define MT_DBG_TOP_PG_LMAC3_GROUP_LMAC3_MIN_QUOTA_MASK	GENMASK(11, 0)
++#define MT_DBG_PSE_LMAC3_PG_INFO_LMAC3_SRC_CNT_MASK	GENMASK(27, 16)
++#define MT_DBG_PSE_LMAC3_PG_INFO_LMAC3_RSV_CNT_MASK	GENMASK(11, 0)
++#define MT_DBG_PSE_PG_LMAC3_GROUP_LMAC3_MAX_QUOTA_MASK	GENMASK(27, 16)
++#define MT_DBG_TOP_PG_LMAC3_GROUP_LMAC3_MIN_QUOTA_MASK	GENMASK(11, 0)
++#define MT_DBG_PSE_PG_MDP_GROUP_MDP_MAX_QUOTA_MASK	GENMASK(27, 16)
++#define MT_DBG_PSE_PG_MDP_GROUP_MDP_MIN_QUOTA_MASK	GENMASK(11, 0)
++#define MT_DBG_PSE_MDP_PG_INFO_MDP_SRC_CNT_MASK		GENMASK(27, 16)
++#define MT_DBG_PSE_MDP_PG_INFO_MDP_RSV_CNT_MASK		GENMASK(11, 0)
++
++#define MT_DBG_PSE_FL_QUE_CTRL_0_ADDR			MT_DBG_PLE(0x1b0)
++#define MT_DBG_PSE_FL_QUE_CTRL_0_EXECUTE_MASK	   	BIT(31)
++#define MT_DBG_PSE_FL_QUE_CTRL_0_Q_BUF_QID_SHFT         24
++#define MT_DBG_PSE_FL_QUE_CTRL_0_Q_BUF_PID_SHFT         10
++#define MT_DBG_PSE_FL_QUE_CTRL_0_Q_BUF_WLANID_MASK    	GENMASK(9, 0)
++
++#define MT_DBG_PSE_FL_QUE_CTRL_2_ADDR			MT_DBG_PLE(0x1b8)
++#define MT_DBG_PSE_FL_QUE_CTRL_2_QUEUE_TAIL_FID_MASK    GENMASK(27, 16)
++#define MT_DBG_PSE_FL_QUE_CTRL_2_QUEUE_HEAD_FID_MASK    GENMASK(11, 0)
++
++#define MT_DBG_PSE_FL_QUE_CTRL_3_ADDR			MT_DBG_PLE(0x1bc)
++#define MT_DBG_PSE_FL_QUE_CTRL_3_QUEUE_PKT_NUM_MASK    	GENMASK(11, 0)
++
++
++/* AGG */
++#define MT_DBG_AGG_BASE(_band)			((_band) ? 0x820f2000 : 0x820e2000)
++#define MT_DBG_AGG(_band, ofs)			(MT_DBG_AGG_BASE(_band) + (ofs))
++
++#define MT_DBG_AGG_AALCR0(_band)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_AALCR0))
++#define MT_DBG_AGG_AALCR1(_band)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_AALCR1))
++#define MT_DBG_AGG_AALCR2(_band)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_AALCR2))
++#define MT_DBG_AGG_AALCR3(_band)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_AALCR3))
++#define MT_DBG_AGG_AALCR4(_band)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_AALCR4))
++#define MT_DBG_AGG_B0BRR0(_band)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_B0BRR0))
++#define MT_DBG_AGG_B1BRR0(_band)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_B1BRR0))
++#define MT_DBG_AGG_B2BRR0(_band)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_B2BRR0))
++#define MT_DBG_AGG_B3BRR0(_band)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_B3BRR0))
++#define MT_DBG_AGG_AWSCR(_band, n)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_AWSCR0) + ((n) << 2))
++#define MT_DBG_AGG_PCR(_band, n)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_PCR0) + ((n) << 2))
++#define MT_DBG_AGG_TTCR(_band, n)		MT_DBG_AGG((_band), __DBG_REG_OFFS(dev, DBG_AGG_TTCR0) + ((n) << 2))
++#define MT_DBG_MIB_M0ARNG(_band, n)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0ARNG0) + ((n) << 2))
++#define MT_DBG_MIB_M0DR2(_band, n)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR2) + ((n) << 2))
++#define MT_DBG_MIB_M0DR13(_band, n)		MT_DBG_MIB((_band), __DBG_REG_OFFS(dev, DBG_MIB_M0DR13) + ((n) << 2))
++
++#define MT_DBG_AGG_AALCR_ACx3_AGG_LIMIT_MASK   	GENMASK(31, 24)
++#define MT_DBG_AGG_AALCR_ACx2_AGG_LIMIT_MASK  	GENMASK(23, 16)
++#define MT_DBG_AGG_AALCR_ACx1_AGG_LIMIT_MASK  	GENMASK(15, 8)
++#define MT_DBG_AGG_AALCR_ACx0_AGG_LIMIT_MASK  	GENMASK(7, 0)
++#define MT_DBG_AGG_AALCR4_ALTX0_AGG_LIMIT_MASK  GENMASK(7, 0)
++
++#define MT_DBG_AGG_AWSCR0_WINSIZE3_MASK	   	GENMASK(31, 24)
++#define MT_DBG_AGG_AWSCR0_WINSIZE2_MASK   	GENMASK(23, 16)
++#define MT_DBG_AGG_AWSCR0_WINSIZE1_MASK  	GENMASK(15, 8)
++#define MT_DBG_AGG_AWSCR0_WINSIZE0_MASK  	GENMASK(7, 0)
++
++#define MT_DBG_AGG_AWSCR1_WINSIZE7_MASK	   	GENMASK(31, 24)
++#define MT_DBG_AGG_AWSCR1_WINSIZE6_MASK   	GENMASK(23, 16)
++#define MT_DBG_AGG_AWSCR1_WINSIZE5_MASK  	GENMASK(15, 8)
++#define MT_DBG_AGG_AWSCR1_WINSIZE4_MASK  	GENMASK(7, 0)
++
++#define MT_DBG_AGG_AWSCR2_WINSIZEB_MASK	   	GENMASK(31, 24)
++#define MT_DBG_AGG_AWSCR2_WINSIZEA_MASK   	GENMASK(23, 16)
++#define MT_DBG_AGG_AWSCR2_WINSIZE9_MASK  	GENMASK(15, 8)
++#define MT_DBG_AGG_AWSCR2_WINSIZE8_MASK  	GENMASK(7, 0)
++
++#define MT_DBG_AGG_AWSCR3_WINSIZEE_MASK  	GENMASK(23, 16)
++#define MT_DBG_AGG_AWSCR3_WINSIZED_MASK  	GENMASK(15, 8)
++#define MT_DBG_AGG_AWSCR3_WINSIZEC_MASK  	GENMASK(7, 0)
++
++#define MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL3_MASK	GENMASK(31, 24)
++#define MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL2_MASK   GENMASK(23, 16)
++#define MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL1_MASK  	GENMASK(15, 8)
++#define MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL0_MASK  	GENMASK(7, 0)
++
++#define MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL7_MASK	GENMASK(31, 24)
++#define MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL6_MASK	GENMASK(23, 16)
++#define MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL5_MASK  	GENMASK(15, 8)
++#define MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL4_MASK  	GENMASK(7, 0)
++
++#define MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL11_MASK	GENMASK(31, 24)
++#define MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL10_MASK	GENMASK(23, 16)
++#define MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL9_MASK  	GENMASK(15, 8)
++#define MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL8_MASK  	GENMASK(7, 0)
++
++#define MT_DBG_MIB_M0ARNG3_AGG_RANG_SEL14_MASK	GENMASK(23, 16)
++#define MT_DBG_MIB_M0ARNG3_AGG_RANG_SEL13_MASK  GENMASK(15, 8)
++#define MT_DBG_MIB_M0ARNG3_AGG_RANG_SEL12_MASK	GENMASK(7, 0)
++
++#define MT_DBG_MIB_M0DR2_TRX_AGG_RANGE1_CNT_MASK	GENMASK(31, 16)
++#define MT_DBG_MIB_M0DR2_TRX_AGG_RANGE0_CNT_MASK	GENMASK(15, 0)
++#define MT_DBG_MIB_M0DR3_TRX_AGG_RANGE3_CNT_MASK  	GENMASK(31, 16)
++#define MT_DBG_MIB_M0DR3_TRX_AGG_RANGE2_CNT_MASK  	GENMASK(15, 0)
++#define MT_DBG_MIB_M0DR4_TRX_AGG_RANGE5_CNT_MASK  	GENMASK(31, 16)
++#define MT_DBG_MIB_M0DR4_TRX_AGG_RANGE4_CNT_MASK  	GENMASK(15, 0)
++#define MT_DBG_MIB_M0DR5_TRX_AGG_RANGE7_CNT_MASK  	GENMASK(31, 16)
++#define MT_DBG_MIB_M0DR5_TRX_AGG_RANGE6_CNT_MASK  	GENMASK(15, 0)
++#define MT_DBG_MIB_M0DR13_TRX_AGG_RANGE9_CNT_MASK  	GENMASK(31, 16)
++#define MT_DBG_MIB_M0DR13_TRX_AGG_RANGE8_CNT_MASK  	GENMASK(15, 0)
++#define MT_DBG_MIB_M0DR14_TRX_AGG_RANGE11_CNT_MASK  	GENMASK(31, 16)
++#define MT_DBG_MIB_M0DR14_TRX_AGG_RANGE10_CNT_MASK  	GENMASK(15, 0)
++#define MT_DBG_MIB_M0DR15_TRX_AGG_RANGE13_CNT_MASK  	GENMASK(31, 16)
++#define MT_DBG_MIB_M0DR15_TRX_AGG_RANGE12_CNT_MASK  	GENMASK(15, 0)
++#define MT_DBG_MIB_M0DR16_TRX_AGG_RANGE15_CNT_MASK  	GENMASK(31, 16)
++#define MT_DBG_MIB_M0DR16_TRX_AGG_RANGE14_CNT_MASK  	GENMASK(15, 0)
++
++/* mt7915 host DMA*/
++#define MT_DBG_INT_DMA1_R0_DONE			BIT(0)
++#define MT_DBG_INT_DMA1_R1_DONE			BIT(1)
++#define MT_DBG_INT_DMA1_R2_DONE			BIT(2)
++
++#define MT_DBG_INT_DMA1_T16_DONE		BIT(26)
++#define MT_DBG_INT_DMA1_T17_DONE		BIT(27)
++#define MT_DBG_INT_DMA1_T18_DONE		BIT(30)
++#define MT_DBG_INT_DMA1_T19_DONE		BIT(31)
++#define MT_DBG_INT_DMA1_T20_DONE		BIT(15)
++
++#define MT_DBG_EXT_WRAP_INT_DMA0_R0_DONE	BIT(16)
++#define MT_DBG_EXT_WRAP_INT_DMA0_R1_DONE	BIT(17)
++
++/* mt7986 host DMA */
++#define MT_DBG_INT_DMA0_R0_DONE			BIT(0)
++#define MT_DBG_INT_DMA0_R1_DONE			BIT(1)
++#define MT_DBG_INT_DMA0_R2_DONE			BIT(2)
++#define MT_DBG_INT_DMA0_R3_DONE			BIT(3)
++#define MT_DBG_INT_DMA0_R4_DONE			BIT(22)
++#define MT_DBG_INT_DMA0_R5_DONE			BIT(23)
++
++#define MT_DBG_INT_DMA0_T16_DONE		BIT(26)
++#define MT_DBG_INT_DMA0_T17_DONE		BIT(27)
++#define MT_DBG_INT_DMA0_T18_DONE		BIT(30)
++#define MT_DBG_INT_DMA0_T19_DONE		BIT(31)
++#define MT_DBG_INT_DMA0_T20_DONE		BIT(25)
++
++/* MCU DMA */
++#define WF_WFDMA_MCU_DMA0_BASE					0x54000000
++#define WF_WFDMA_MCU_DMA0_HOST_INT_STA_ADDR			(WF_WFDMA_MCU_DMA0_BASE + 0x200) // 0200
++#define WF_WFDMA_MCU_DMA0_HOST_INT_ENA_ADDR			(WF_WFDMA_MCU_DMA0_BASE + 0X204) // 0204
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR			(WF_WFDMA_MCU_DMA0_BASE + 0x208) // 0208
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK	0x00000008	// RX_DMA_BUSY[3]
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT	3
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_MASK		0x00000004	// RX_DMA_EN[2]
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_SHFT		2
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK	0x00000002	// TX_DMA_BUSY[1]
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT	1
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_MASK		0x00000001	// TX_DMA_EN[0]
++#define WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_SHFT	0
++
++#define WF_WFDMA_MCU_DMA1_BASE					0x55000000
++#define WF_WFDMA_MCU_DMA1_HOST_INT_STA_ADDR			(WF_WFDMA_MCU_DMA1_BASE + 0x200) // 0200
++#define WF_WFDMA_MCU_DMA1_HOST_INT_ENA_ADDR			(WF_WFDMA_MCU_DMA1_BASE + 0X204) // 0204
++#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_ADDR			(WF_WFDMA_MCU_DMA1_BASE + 0x208) // 0208
++#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK	0x00000008	// RX_DMA_BUSY[3]
++#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT	3
++#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_EN_MASK		0x00000004	// RX_DMA_EN[2]
++#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_EN_SHFT		2
++#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK	0x00000002	// TX_DMA_BUSY[1]
++#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT	1
++#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_EN_MASK		0x00000001	// TX_DMA_EN[0]
++#define WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_EN_SHFT		0
++#define WF_WFDMA_MCU_DMA1_WPDMA_TX_RING0_CTRL0_ADDR		(WF_WFDMA_MCU_DMA1_BASE + 0x300) // 0300
++#define WF_WFDMA_MCU_DMA1_WPDMA_TX_RING1_CTRL0_ADDR		(WF_WFDMA_MCU_DMA1_BASE + 0x310) // 0310
++#define WF_WFDMA_MCU_DMA1_WPDMA_TX_RING2_CTRL0_ADDR		(WF_WFDMA_MCU_DMA1_BASE + 0x320) // 0320
++#define WF_WFDMA_MCU_DMA1_WPDMA_RX_RING0_CTRL0_ADDR		(WF_WFDMA_MCU_DMA1_BASE + 0x500) // 0500
++#define WF_WFDMA_MCU_DMA1_WPDMA_RX_RING1_CTRL0_ADDR		(WF_WFDMA_MCU_DMA1_BASE + 0x510) // 0510
++#define WF_WFDMA_MCU_DMA1_WPDMA_RX_RING2_CTRL0_ADDR		(WF_WFDMA_MCU_DMA1_BASE + 0x520) // 0520
++#define WF_WFDMA_MCU_DMA1_WPDMA_RX_RING3_CTRL0_ADDR		(WF_WFDMA_MCU_DMA1_BASE + 0x530) // 0530
++#define WF_WFDMA_MCU_DMA1_WPDMA_RX_RING4_CTRL0_ADDR		(WF_WFDMA_MCU_DMA1_BASE + 0x540) // 0540
++
++#define WF_WFDMA_MCU_DMA1_PCIE1_BASE				0x59000000
++#define WF_WFDMA_MCU_DMA1_PCIE1_HOST_INT_STA_ADDR		(WF_WFDMA_MCU_DMA1_PCIE1_BASE + 0x200) // 0200
++#define WF_WFDMA_MCU_DMA1_PCIE1_HOST_INT_ENA_ADDR		(WF_WFDMA_MCU_DMA1_PCIE1_BASE + 0X204) // 0204
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_ADDR		(WF_WFDMA_MCU_DMA1_PCIE1_BASE + 0x208) // 0208
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK	0x00000008	// RX_DMA_BUSY[3]
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT	3
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_EN_MASK	0x00000004	// RX_DMA_EN[2]
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_EN_SHFT	2
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK	0x00000002	// TX_DMA_BUSY[1]
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT	1
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_EN_MASK	0x00000001	// TX_DMA_EN[0]
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_EN_SHFT	0
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_TX_RING2_CTRL0_ADDR	(WF_WFDMA_MCU_DMA1_PCIE1_BASE + 0x320) // 0320
++#define WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_RX_RING3_CTRL0_ADDR	(WF_WFDMA_MCU_DMA1_PCIE1_BASE + 0x530) // 0530
++
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING0_CTRL0_ADDR		(WF_WFDMA_MCU_DMA0_BASE + 0x300) // 0300
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING1_CTRL0_ADDR		(WF_WFDMA_MCU_DMA0_BASE + 0x310) // 0310
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING2_CTRL0_ADDR		(WF_WFDMA_MCU_DMA0_BASE + 0x320) // 0320
++/* mt7986 add */
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING3_CTRL0_ADDR     	(WF_WFDMA_MCU_DMA0_BASE + 0x330) // 0330
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING4_CTRL0_ADDR     	(WF_WFDMA_MCU_DMA0_BASE + 0x340) // 0340
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING5_CTRL0_ADDR     	(WF_WFDMA_MCU_DMA0_BASE + 0x350) // 0350
++#define WF_WFDMA_MCU_DMA0_WPDMA_TX_RING6_CTRL0_ADDR     	(WF_WFDMA_MCU_DMA0_BASE + 0x360) // 0360
++
++
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING0_CTRL0_ADDR		(WF_WFDMA_MCU_DMA0_BASE + 0x500) // 0500
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING1_CTRL0_ADDR		(WF_WFDMA_MCU_DMA0_BASE + 0x510) // 0510
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING2_CTRL0_ADDR		(WF_WFDMA_MCU_DMA0_BASE + 0x520) // 0520
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING3_CTRL0_ADDR		(WF_WFDMA_MCU_DMA0_BASE + 0x530) // 0530
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING4_CTRL0_ADDR		(WF_WFDMA_MCU_DMA0_BASE + 0x540) // 0540
++
++/* mt7986 add */
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING5_CTRL0_ADDR     	(WF_WFDMA_MCU_DMA0_BASE + 0x550) // 0550
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING6_CTRL0_ADDR     	(WF_WFDMA_MCU_DMA0_BASE + 0x560) // 0560
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING7_CTRL0_ADDR     	(WF_WFDMA_MCU_DMA0_BASE + 0x570) // 0570
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING8_CTRL0_ADDR     	(WF_WFDMA_MCU_DMA0_BASE + 0x580) // 0580
++#define WF_WFDMA_MCU_DMA0_WPDMA_RX_RING9_CTRL0_ADDR     	(WF_WFDMA_MCU_DMA0_BASE + 0x590) // 0590
++
++/* MEM DMA */
++#define WF_WFDMA_MEM_DMA_BASE					0x58000000
++#define WF_WFDMA_MEM_DMA_HOST_INT_STA_ADDR			(WF_WFDMA_MEM_DMA_BASE + 0x200) // 0200
++#define WF_WFDMA_MEM_DMA_HOST_INT_ENA_ADDR			(WF_WFDMA_MEM_DMA_BASE + 0X204) // 0204
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_ADDR			(WF_WFDMA_MEM_DMA_BASE + 0x208) // 0208
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK		0x00000008	// RX_DMA_BUSY[3]
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT		3
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_MASK		0x00000004	// RX_DMA_EN[2]
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_SHFT		2
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK		0x00000002	// TX_DMA_BUSY[1]
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT		1
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_MASK		0x00000001	// TX_DMA_EN[0]
++#define WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_SHFT		0
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING0_CTRL0_ADDR		(WF_WFDMA_MEM_DMA_BASE + 0x300) // 0300
++#define WF_WFDMA_MEM_DMA_WPDMA_TX_RING1_CTRL0_ADDR		(WF_WFDMA_MEM_DMA_BASE + 0x310) // 0310
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING0_CTRL0_ADDR		(WF_WFDMA_MEM_DMA_BASE + 0x500) // 0500
++#define WF_WFDMA_MEM_DMA_WPDMA_RX_RING1_CTRL0_ADDR		(WF_WFDMA_MEM_DMA_BASE + 0x510) // 0510
++
++enum resource_attr {
++	HIF_TX_DATA,
++	HIF_TX_CMD,
++	HIF_TX_CMD_WM, /* direct path to WMCPU, only exist for WFDMA arch with 2 CPU */
++	HIF_TX_FWDL,
++	HIF_RX_DATA,
++	HIF_RX_EVENT,
++	RING_ATTR_NUM
++};
++
++struct hif_pci_tx_ring_desc {
++	u32 hw_int_mask;
++	u16 ring_size;
++	enum resource_attr ring_attr;
++	u8 band_idx;
++	char *const ring_info;
++};
++
++struct hif_pci_rx_ring_desc {
++	u32 hw_desc_base;
++	u32 hw_int_mask;
++	u16 ring_size;
++	enum resource_attr ring_attr;
++	u16 max_rx_process_cnt;
++	u16 max_sw_read_idx_inc;
++	char *const ring_info;
++};
++
++const struct hif_pci_tx_ring_desc mt7915_tx_ring_layout[] = {
++	{
++	 .hw_int_mask = MT_DBG_INT_DMA1_T16_DONE,
++	 .ring_size = 128,
++	 .ring_attr = HIF_TX_FWDL,
++	 .ring_info = "FWDL"
++	},
++	{
++	 .hw_int_mask = MT_DBG_INT_DMA1_T17_DONE,
++	 .ring_size = 256,
++	 .ring_attr = HIF_TX_CMD_WM,
++	 .ring_info = "cmd to WM"
++	},
++	{
++	 .hw_int_mask = MT_DBG_INT_DMA1_T18_DONE,
++	 .ring_size = 2048,
++	 .ring_attr = HIF_TX_DATA,
++	 .ring_info = "band0 TXD"
++	},
++	{
++	 .hw_int_mask = MT_DBG_INT_DMA1_T19_DONE,
++	 .ring_size = 2048,
++	 .ring_attr = HIF_TX_DATA,
++	 .ring_info = "band1 TXD"
++	},
++	{
++	 .hw_int_mask = MT_DBG_INT_DMA1_T20_DONE,
++	 .ring_size = 256,
++	 .ring_attr = HIF_TX_CMD,
++	 .ring_info = "cmd to WA"
++	}
++};
++
++const struct hif_pci_rx_ring_desc mt7915_rx_ring_layout[] = {
++	{
++	 .hw_int_mask = MT_DBG_EXT_WRAP_INT_DMA0_R0_DONE,
++	 .ring_size = 1536,
++	 .ring_attr = HIF_RX_DATA,
++	 .ring_info = "band0 RX data"
++	},
++	{
++	 .hw_int_mask = MT_DBG_EXT_WRAP_INT_DMA0_R1_DONE,
++	 .ring_size = 1536,
++	 .ring_attr = HIF_RX_DATA,
++	 .ring_info = "band1 RX data"
++	},
++	{
++	 .hw_int_mask = MT_DBG_INT_DMA1_R0_DONE,
++	 .ring_size = 512,
++	 .ring_attr = HIF_RX_EVENT,
++	 .ring_info = "event from WM"
++	},
++	{
++	 .hw_int_mask = MT_DBG_INT_DMA1_R1_DONE,
++	 .ring_size = 1024,
++	 .ring_attr = HIF_RX_EVENT,
++	 .ring_info = "event from WA band0"
++	},
++	{
++	 .hw_int_mask = MT_DBG_INT_DMA1_R2_DONE,
++	 .ring_size = 512,
++	 .ring_attr = HIF_RX_EVENT,
++	 .ring_info = "event from WA band1"
++	}
++};
++
++const struct hif_pci_tx_ring_desc mt7986_tx_ring_layout[] = {
++	{
++	 .hw_int_mask = MT_DBG_INT_DMA0_T16_DONE,
++	 .ring_size = 128,
++	 .ring_attr = HIF_TX_FWDL,
++	 .ring_info = "FWDL"
++	},
++	{
++	 .hw_int_mask = MT_DBG_INT_DMA0_T17_DONE,
++	 .ring_size = 256,
++	 .ring_attr = HIF_TX_CMD_WM,
++	 .ring_info = "cmd to WM"
++	},
++	{
++	 .hw_int_mask = MT_DBG_INT_DMA0_T18_DONE,
++	 .ring_size = 2048,
++	 .ring_attr = HIF_TX_DATA,
++	 .ring_info = "band0 TXD"
++	},
++	{
++	 .hw_int_mask = MT_DBG_INT_DMA0_T19_DONE,
++	 .ring_size = 2048,
++	 .ring_attr = HIF_TX_DATA,
++	 .ring_info = "band1 TXD"
++	},
++	{
++	 .hw_int_mask = MT_DBG_INT_DMA0_T20_DONE,
++	 .ring_size = 256,
++	 .ring_attr = HIF_TX_CMD,
++	 .ring_info = "cmd to WA"
++	}
++};
++
++const struct hif_pci_rx_ring_desc mt7986_rx_ring_layout[] = {
++	{
++	 .hw_int_mask = MT_DBG_INT_DMA0_R4_DONE,
++	 .ring_size = 1536,
++	 .ring_attr = HIF_RX_DATA,
++	 .ring_info = "band0 RX data"
++	},
++	{
++	 .hw_int_mask = MT_DBG_INT_DMA0_R5_DONE,
++	 .ring_size = 1536,
++	 .ring_attr = HIF_RX_DATA,
++	 .ring_info = "band1 RX data"
++	},
++	{
++	 .hw_int_mask = MT_DBG_INT_DMA0_R0_DONE,
++	 .ring_size = 512,
++	 .ring_attr = HIF_RX_EVENT,
++	 .ring_info = "event from WM"
++	},
++	{
++	 .hw_int_mask = MT_DBG_INT_DMA0_R1_DONE,
++	 .ring_size = 512,
++	 .ring_attr = HIF_RX_EVENT,
++	 .ring_info = "event from WA"
++	},
++	{
++	 .hw_int_mask = MT_DBG_INT_DMA0_R2_DONE,
++	 .ring_size = 1024,
++	 .ring_attr = HIF_RX_EVENT,
++	 .ring_info = "STS WA band0"
++	},
++	{
++	 .hw_int_mask = MT_DBG_INT_DMA0_R3_DONE,
++	 .ring_size = 512,
++	 .ring_attr = HIF_RX_EVENT,
++	 .ring_info = "STS WA band1"
++	},
++};
++
++/* mibinfo related CRs. */
++#define BN0_WF_MIB_TOP_BASE                                    0x820ed000
++#define BN1_WF_MIB_TOP_BASE                                    0x820fd000
++
++#define BN0_WF_MIB_TOP_BTOCR_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x400) // D400
++#define BN0_WF_MIB_TOP_BTBCR_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x428) // D428
++#define BN0_WF_MIB_TOP_BTDCR_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x4F0) // D4F0
++
++#define BN0_WF_MIB_TOP_BSDR0_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x688) // D688
++#define BN0_WF_MIB_TOP_BSDR1_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x690) // D690
++
++#define BN0_WF_MIB_TOP_BSDR2_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x518) // D518
++#define BN0_WF_MIB_TOP_BSDR3_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x520) // D520
++#define BN0_WF_MIB_TOP_BSDR4_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x528) // D528
++#define BN0_WF_MIB_TOP_BSDR5_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x530) // D530
++#define BN0_WF_MIB_TOP_BSDR6_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x538) // D538
++
++#define BN0_WF_MIB_TOP_BROCR_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x5B8) // D5B8
++#define BN0_WF_MIB_TOP_BRBCR_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x5E0) // D5E0
++#define BN0_WF_MIB_TOP_BRDCR_ADDR                              (BN0_WF_MIB_TOP_BASE + 0x630) // D630
++
++#define BN0_WF_MIB_TOP_M0SDR0_BEACONTXCOUNT_MASK               0x0000FFFF // BEACONTXCOUNT[15..0]
++
++#define BN0_WF_MIB_TOP_M0SDR4_RX_FIFO_FULL_COUNT_MASK          0x0000FFFF // RX_FIFO_FULL_COUNT[15..0]
++
++#define BN0_WF_MIB_TOP_M0SDR5_RX_MPDU_COUNT_MASK               0xFFFFFFFF // RX_MPDU_COUNT[31..0]
++
++#define BN0_WF_MIB_TOP_M0SDR6_CHANNEL_IDLE_COUNT_MASK          0x0000FFFF // CHANNEL_IDLE_COUNT[15..0]
++
++#define BN1_WF_MIB_TOP_BTOCR_ADDR                              (BN1_WF_MIB_TOP_BASE + 0x400) // D400
++
++#define BN0_WF_MIB_TOP_M0SDR7_VEC_MISS_COUNT_MASK              0x0000FFFF // VEC_MISS_COUNT[15..0]
++#define BN0_WF_MIB_TOP_M0SDR8_DELIMITER_FAIL_COUNT_MASK        0x0000FFFF // DELIMITER_FAIL_COUNT[15..0]
++#define BN0_WF_MIB_TOP_M0SDR9_CCA_NAV_TX_TIME_MASK             0x00FFFFFF // CCA_NAV_TX_TIME[23..0]
++
++#define BN0_WF_MIB_TOP_M0SDR11_RX_LEN_MISMATCH_MASK            0x0000FFFF // RX_LEN_MISMATCH[15..0]
++
++#define BN0_WF_MIB_TOP_M0SDR16_P_CCA_TIME_MASK                 0x00FFFFFF // P_CCA_TIME[23..0]
++#define BN0_WF_MIB_TOP_M0SDR17_S_CCA_TIME_MASK                 0x00FFFFFF // S_CCA_TIME[23..0]
++#define BN0_WF_MIB_TOP_M0SDR18_P_ED_TIME_MASK                  0x00FFFFFF // P_ED_TIME[23..0]
++#define BN0_WF_MIB_TOP_M0SDR19_CCK_MDRDY_TIME_MASK             0x00FFFFFF // CCK_MDRDY_TIME[23..0]
++#define BN0_WF_MIB_TOP_M0SDR20_OFDM_LG_MIXED_VHT_MDRDY_TIME_MASK 0x00FFFFFF  // OFDM_LG_MIXED_VHT_MDRDY_TIME[23..0]
++#define BN0_WF_MIB_TOP_M0SDR21_OFDM_GREEN_MDRDY_TIME_MASK      0x00FFFFFF // OFDM_GREEN_MDRDY_TIME[23..0]
++
++#define BN0_WF_MIB_TOP_M0SDR22_ADDR                            (BN0_WF_MIB_TOP_BASE + 0x60) // D060
++#define BN0_WF_MIB_TOP_M0SDR23_ADDR                            (BN0_WF_MIB_TOP_BASE + 0x64) // D064
++
++#define BN0_WF_MIB_TOP_M0SDR34_MUBF_TX_COUNT_MASK              0x0000FFFF                // MUBF_TX_COUNT[15..0]
++
++#define BN0_WF_MIB_TOP_M0DR0_TX_40MHZ_CNT_MASK                 0xFFFF0000                // TX_40MHZ_CNT[31..16]
++#define BN0_WF_MIB_TOP_M0DR0_TX_40MHZ_CNT_SHFT                 16
++#define BN0_WF_MIB_TOP_M0DR0_TX_20MHZ_CNT_MASK                 0x0000FFFF                // TX_20MHZ_CNT[15..0]
++#define BN0_WF_MIB_TOP_M0DR0_TX_20MHZ_CNT_SHFT                 0
++
++#define BN0_WF_MIB_TOP_M0DR1_TX_160MHZ_CNT_MASK                0xFFFF0000                // TX_160MHZ_CNT[31..16]
++#define BN0_WF_MIB_TOP_M0DR1_TX_160MHZ_CNT_SHFT                16
++#define BN0_WF_MIB_TOP_M0DR1_TX_80MHZ_CNT_MASK                 0x0000FFFF                // TX_80MHZ_CNT[15..0]
++#define BN0_WF_MIB_TOP_M0DR1_TX_80MHZ_CNT_SHFT                 0
++
++#define BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG2_CNT_MASK            0xFFFF0000                // TX_DDLMT_RNG2_CNT[31..16]
++#define BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG2_CNT_SHFT            16
++#define BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG1_CNT_MASK            0x0000FFFF                // TX_DDLMT_RNG1_CNT[15..0]
++#define BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG1_CNT_SHFT            0
++
++#define BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG4_CNT_MASK            0xFFFF0000                // TX_DDLMT_RNG4_CNT[31..16]
++#define BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG4_CNT_SHFT            16
++#define BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG3_CNT_MASK            0x0000FFFF                // TX_DDLMT_RNG3_CNT[15..0]
++#define BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG3_CNT_SHFT            0
++
++#define BN0_WF_MIB_TOP_M0DR10_MU_FAIL_PPDU_CNT_MASK            0x0000FFFF                // MU_FAIL_PPDU_CNT[15..0]
++
++#define BN0_WF_MIB_TOP_M0B0SDR0_ADDR                           (BN0_WF_MIB_TOP_BASE + 0x100) // D100
++#define BN0_WF_MIB_TOP_M0B0SDR0_RTSRETRYCOUNT_MASK             0xFFFF0000                // RTSRETRYCOUNT[31..16]
++#define BN0_WF_MIB_TOP_M0B0SDR0_RTSRETRYCOUNT_SHFT             16
++#define BN0_WF_MIB_TOP_M0B0SDR0_RTSTXCOUNT_MASK                0x0000FFFF                // RTSTXCOUNT[15..0]
++#define BN0_WF_MIB_TOP_M0B0SDR0_RTSTXCOUNT_SHFT                0
++#define BN0_WF_MIB_TOP_M0B0SDR1_ADDR                           (BN0_WF_MIB_TOP_BASE + 0x104) // D104
++#define BN0_WF_MIB_TOP_M0B0SDR1_ACKFAILCOUNT_MASK              0xFFFF0000                // ACKFAILCOUNT[31..16]
++#define BN0_WF_MIB_TOP_M0B0SDR1_ACKFAILCOUNT_SHFT              16
++#define BN0_WF_MIB_TOP_M0B0SDR1_BAMISSCOUNT_MASK               0x0000FFFF                // BAMISSCOUNT[15..0]
++#define BN0_WF_MIB_TOP_M0B0SDR1_BAMISSCOUNT_SHFT               0
++#define BN0_WF_MIB_TOP_M0B0SDR2_ADDR                           (BN0_WF_MIB_TOP_BASE + 0x108) // D108
++#define BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRY2COUNT_MASK          0xFFFF0000                // FRAMERETRY2COUNT[31..16]
++#define BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRY2COUNT_SHFT          16
++#define BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRYCOUNT_MASK           0x0000FFFF                // FRAMERETRYCOUNT[15..0]
++#define BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRYCOUNT_SHFT           0
++#define BN0_WF_MIB_TOP_M0B0SDR3_ADDR                           (BN0_WF_MIB_TOP_BASE + 0x10C) // D10C
++#define BN0_WF_MIB_TOP_M0B0SDR3_FRAMERETRY3COUNT_MASK          0x0000FFFF                // FRAMERETRY3COUNT[15..0]
++#define BN0_WF_MIB_TOP_M0B0SDR3_FRAMERETRY3COUNT_SHFT          0
++#define BN0_WF_MIB_TOP_M0DR12_TX_DDLMT_RNG0_CNT_MASK           0x0000FFFF                // TX_DDLMT_RNG0_CNT[15..0]
++
++
++#define BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2np1_MASK              0xFFFF0000                // TX_OK_COUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2np1_SHFT              16
++#define BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2n_MASK                0x0000FFFF                // TX_OK_COUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2n_SHFT                0
++
++#define BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2np1_MASK            0xFFFF0000                // TX_DATA_COUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2np1_SHFT            16
++#define BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2n_MASK              0x0000FFFF                // TX_DATA_COUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2n_SHFT              0
++
++#define BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2np1_MASK              0xFFFF0000                // RX_OK_COUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2np1_SHFT              16
++#define BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2n_MASK                0x0000FFFF                // RX_OK_COUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2n_SHFT                0
++
++#define BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2np1_MASK            0xFFFF0000                // RX_DATA_COUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2np1_SHFT            16
++#define BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2n_MASK              0x0000FFFF                // RX_DATA_COUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2n_SHFT              0
++
++#define BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2np1_MASK               0xFFFF0000                // RTSTXCOUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2np1_SHFT               16
++#define BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2n_MASK                 0x0000FFFF                // RTSTXCOUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2n_SHFT                 0
++
++#define BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2np1_MASK            0xFFFF0000                // RTSRETRYCOUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2np1_SHFT            16
++#define BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2n_MASK              0x0000FFFF                // RTSRETRYCOUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2n_SHFT              0
++
++#define BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2np1_MASK              0xFFFF0000                // BAMISSCOUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2np1_SHFT              16
++#define BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2n_MASK                0x0000FFFF                // BAMISSCOUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2n_SHFT                0
++
++#define BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2np1_MASK             0xFFFF0000                // ACKFAILCOUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2np1_SHFT             16
++#define BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2n_MASK               0x0000FFFF                // ACKFAILCOUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2n_SHFT               0
++
++#define BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2np1_MASK          0xFFFF0000                // FRAMERETRYCOUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2np1_SHFT          16
++#define BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2n_MASK            0x0000FFFF                // FRAMERETRYCOUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2n_SHFT            0
++
++#define BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2np1_MASK         0xFFFF0000                // FRAMERETRY2COUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2np1_SHFT         16
++#define BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2n_MASK           0x0000FFFF                // FRAMERETRY2COUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2n_SHFT           0
++
++#define BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2np1_MASK         0xFFFF0000                // FRAMERETRY3COUNT2np1[31..16]
++#define BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2np1_SHFT         16
++#define BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2n_MASK           0x0000FFFF                // FRAMERETRY3COUNT2n[15..0]
++#define BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2n_SHFT           0
++/* TXD */
++
++#define MT_TXD1_ETYP			BIT(15)
++#define MT_TXD1_VLAN			BIT(14)
++#define MT_TXD1_RMVL			BIT(13)
++#define MT_TXD1_AMS			BIT(13)
++#define MT_TXD1_EOSP			BIT(12)
++#define MT_TXD1_MRD			BIT(11)
++
++#define MT_TXD7_CTXD			BIT(26)
++#define MT_TXD7_CTXD_CNT		GENMASK(25, 23)
++#define MT_TXD7_TAT			GENMASK(9, 0)
++
++#endif
++#endif
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+new file mode 100644
+index 00000000..246eb129
+--- /dev/null
++++ b/mt7915/mtk_debugfs.c
+@@ -0,0 +1,2893 @@
++#include<linux/inet.h>
++#include "mt7915.h"
++#include "mt7915_debug.h"
++#include "mac.h"
++#include "mcu.h"
++
++#ifdef MTK_DEBUG
++#define LWTBL_IDX2BASE_ID		GENMASK(14, 8)
++#define LWTBL_IDX2BASE_DW		GENMASK(7, 2)
++#define LWTBL_IDX2BASE(_id, _dw)	(MT_DBG_WTBL_BASE | \
++					FIELD_PREP(LWTBL_IDX2BASE_ID, _id) | \
++					FIELD_PREP(LWTBL_IDX2BASE_DW, _dw))
++
++#define UWTBL_IDX2BASE_ID		GENMASK(12, 6)
++#define UWTBL_IDX2BASE_DW		GENMASK(5, 2)
++#define UWTBL_IDX2BASE(_id, _dw)	(MT_DBG_UWTBL_TOP_BASE | 0x2000 | \
++					FIELD_PREP(UWTBL_IDX2BASE_ID, _id) | \
++					FIELD_PREP(UWTBL_IDX2BASE_DW, _dw))
++
++#define KEYTBL_IDX2BASE_KEY		GENMASK(12, 6)
++#define KEYTBL_IDX2BASE_DW		GENMASK(5, 2)
++#define KEYTBL_IDX2BASE(_key, _dw)	(MT_DBG_UWTBL_TOP_BASE | 0x2000 | \
++					FIELD_PREP(KEYTBL_IDX2BASE_KEY, _key) | \
++					FIELD_PREP(KEYTBL_IDX2BASE_DW, _dw))
++
++enum mt7915_wtbl_type {
++	WTBL_TYPE_LMAC,		/* WTBL in LMAC */
++	WTBL_TYPE_UMAC,		/* WTBL in UMAC */
++	WTBL_TYPE_KEY,		/* Key Table */
++	MAX_NUM_WTBL_TYPE
++};
++
++static int mt7915_wtbl_read_raw(struct mt7915_dev *dev, u16 idx,
++			        enum mt7915_wtbl_type type, u16 start_dw,
++			        u16 len, void *buf)
++{
++	u32 *dest_cpy = (u32 *)buf;
++	u32 size_dw = len;
++	u32 src = 0;
++
++	if (!buf)
++		return 0xFF;
++
++	if (type == WTBL_TYPE_LMAC) {
++		mt76_wr(dev, MT_DBG_WTBLON_TOP_WDUCR,
++			FIELD_PREP(MT_DBG_WTBLON_TOP_WDUCR_GROUP, (idx >> 7)));
++		src = LWTBL_IDX2BASE(idx, start_dw);
++	} else if (type == WTBL_TYPE_UMAC) {
++		mt76_wr(dev,  MT_DBG_UWTBL_TOP_WDUCR,
++			FIELD_PREP(MT_UWTBL_TOP_WDUCR_GROUP, (idx >> 7)));
++		src = UWTBL_IDX2BASE(idx, start_dw);
++	} else if (type == WTBL_TYPE_KEY) {
++		mt76_wr(dev,  MT_DBG_UWTBL_TOP_WDUCR,
++			MT_UWTBL_TOP_WDUCR_TARGET |
++			FIELD_PREP(MT_UWTBL_TOP_WDUCR_GROUP, (idx >> 7)));
++		src = KEYTBL_IDX2BASE(idx, start_dw);
++	}
++
++	while (size_dw--) {
++		*dest_cpy++ = mt76_rr(dev, src);
++		src += 4;
++	};
++
++	return 0;
++}
++
++static int mt7915_wtbl_write_raw(struct mt7915_dev *dev, u16 idx,
++			         enum mt7915_wtbl_type type, u16 start_dw,
++			         u32 val)
++{
++	u32 addr = 0;
++
++	if (type == WTBL_TYPE_LMAC) {
++		mt76_wr(dev, MT_DBG_WTBLON_TOP_WDUCR,
++			FIELD_PREP(MT_WTBLON_TOP_WDUCR_GROUP, (idx >> 7)));
++		addr = LWTBL_IDX2BASE(idx, start_dw);
++	} else if (type == WTBL_TYPE_UMAC) {
++		mt76_wr(dev, MT_DBG_UWTBL_TOP_WDUCR,
++			FIELD_PREP(MT_UWTBL_TOP_WDUCR_GROUP, (idx >> 7)));
++		addr = UWTBL_IDX2BASE(idx, start_dw);
++	} else if (type == WTBL_TYPE_KEY) {
++		mt76_wr(dev, MT_DBG_UWTBL_TOP_WDUCR,
++			MT_UWTBL_TOP_WDUCR_TARGET |
++			FIELD_PREP(MT_UWTBL_TOP_WDUCR_GROUP, (idx >> 7)));
++		addr = KEYTBL_IDX2BASE(idx, start_dw);
++	}
++
++	mt76_wr(dev, addr, val);
++
++	return 0;
++}
++
++void mt7915_packet_log_to_host(struct mt7915_dev *dev, const void *data, int len, int type, int des_len)
++{
++	struct bin_debug_hdr *hdr;
++	char *buf;
++
++	if (len > 1500 - sizeof(*hdr))
++		len = 1500 - sizeof(*hdr);
++
++	buf = kzalloc(sizeof(*hdr) + len, GFP_KERNEL);
++	if (!buf)
++		return;
++
++	hdr = (struct bin_debug_hdr *)buf;
++	hdr->magic_num = cpu_to_le32(PKT_BIN_DEBUG_MAGIC);
++	hdr->serial_id = cpu_to_le16(dev->dbg.fwlog_seq++);
++	hdr->msg_type = cpu_to_le16(type);
++	hdr->len = cpu_to_le16(len);
++	hdr->des_len = cpu_to_le16(des_len);
++
++	memcpy(buf + sizeof(*hdr), data, len);
++
++	mt7915_debugfs_rx_log(dev, buf, sizeof(*hdr) + len);
++}
++
++static int
++mt7915_fw_debug_module_set(void *data, u64 module)
++{
++	struct mt7915_dev *dev = data;
++
++	dev->dbg.fw_dbg_module = module;
++	return 0;
++}
++
++static int
++mt7915_fw_debug_module_get(void *data, u64 *module)
++{
++	struct mt7915_dev *dev = data;
++
++	*module = dev->dbg.fw_dbg_module;
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_module, mt7915_fw_debug_module_get,
++			 mt7915_fw_debug_module_set, "%lld\n");
++
++static int
++mt7915_fw_debug_level_set(void *data, u64 level)
++{
++	struct mt7915_dev *dev = data;
++
++	dev->dbg.fw_dbg_lv = level;
++	mt7915_mcu_fw_dbg_ctrl(dev, dev->dbg.fw_dbg_module, dev->dbg.fw_dbg_lv);
++	return 0;
++}
++
++static int
++mt7915_fw_debug_level_get(void *data, u64 *level)
++{
++	struct mt7915_dev *dev = data;
++
++	*level = dev->dbg.fw_dbg_lv;
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_level, mt7915_fw_debug_level_get,
++			 mt7915_fw_debug_level_set, "%lld\n");
++
++#define MAX_TX_MODE 12
++static char *HW_TX_MODE_STR[] = {"CCK", "OFDM", "HT-Mix", "HT-GF", "VHT",
++				 "N/A", "N/A", "N/A", "HE_SU", "HE_EXT_SU",
++				 "HE_TRIG", "HE_MU", "N/A"};
++static char *HW_TX_RATE_CCK_STR[] = {"1M", "2Mlong", "5.5Mlong", "11Mlong",
++				     "N/A", "2Mshort", "5.5Mshort", "11Mshort",
++				     "N/A"};
++static char *HW_TX_RATE_OFDM_STR[] = {"6M", "9M", "12M", "18M", "24M", "36M",
++				      "48M", "54M", "N/A"};
++static char *fcap_str[] =  {"20MHz", "20/40MHz", "20/40/80MHz",
++			    "20/40/80/160/80+80MHz"};
++
++static char *hw_rate_ofdm_str(u16 ofdm_idx)
++{
++	switch (ofdm_idx) {
++	case 11: /* 6M */
++		return HW_TX_RATE_OFDM_STR[0];
++
++	case 15: /* 9M */
++		return HW_TX_RATE_OFDM_STR[1];
++
++	case 10: /* 12M */
++		return HW_TX_RATE_OFDM_STR[2];
++
++	case 14: /* 18M */
++		return HW_TX_RATE_OFDM_STR[3];
++
++	case 9: /* 24M */
++		return HW_TX_RATE_OFDM_STR[4];
++
++	case 13: /* 36M */
++		return HW_TX_RATE_OFDM_STR[5];
++
++	case 8: /* 48M */
++		return HW_TX_RATE_OFDM_STR[6];
++
++	case 12: /* 54M */
++		return HW_TX_RATE_OFDM_STR[7];
++
++	default:
++		return HW_TX_RATE_OFDM_STR[8];
++	}
++}
++
++static char *hw_rate_str(u8 mode, u16 rate_idx)
++{
++	if (mode == 0)
++		return rate_idx < 8 ? HW_TX_RATE_CCK_STR[rate_idx] : HW_TX_RATE_CCK_STR[8];
++	else if (mode == 1)
++		return hw_rate_ofdm_str(rate_idx);
++	else
++		return "MCS";
++}
++
++static void parse_rate(struct seq_file *s, u16 rate_idx, u16 txrate)
++{
++	u16 txmode, mcs, nss, stbc;
++
++	txmode = FIELD_GET(GENMASK(9, 6), txrate);
++	mcs = FIELD_GET(GENMASK(5, 0), txrate);
++	nss = FIELD_GET(GENMASK(12, 10), txrate);
++	stbc = FIELD_GET(BIT(13), txrate);
++
++	seq_printf(s, "\tRate%d(0x%x):TxMode=%d(%s), TxRate=%d(%s), Nsts=%d, STBC=%d\n",
++			rate_idx + 1, txrate,
++			txmode, (txmode < MAX_TX_MODE ? HW_TX_MODE_STR[txmode] : HW_TX_MODE_STR[MAX_TX_MODE]),
++			mcs, hw_rate_str(txmode, mcs), nss, stbc);
++}
++
++#define LWTBL_LEN_IN_DW 32
++#define UWTBL_LEN_IN_DW 8
++#define ONE_KEY_ENTRY_LEN_IN_DW 8
++static int mt7915_wtbl_read(struct seq_file *s, void *data)
++{
++	struct mt7915_dev *dev = dev_get_drvdata(s->private);
++	u8 lwtbl[LWTBL_LEN_IN_DW*4] = {0};
++	int x;
++	u32 *addr = 0;
++	u32 dw_value = 0;
++
++	mt7915_wtbl_read_raw(dev, dev->wlan_idx, WTBL_TYPE_LMAC, 0,
++				 LWTBL_LEN_IN_DW, lwtbl);
++	seq_printf(s, "Dump WTBL info of WLAN_IDX:%d\n", dev->wlan_idx);
++	seq_printf(s, "LMAC WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
++				MT_DBG_WTBLON_TOP_WDUCR,
++				mt76_rr(dev, MT_DBG_WTBLON_TOP_WDUCR),
++				LWTBL_IDX2BASE(dev->wlan_idx, 0));
++	for (x = 0; x < LWTBL_LEN_IN_DW; x++) {
++		seq_printf(s, "DW%02d: %02x %02x %02x %02x\n",
++					x,
++					lwtbl[x * 4 + 3],
++					lwtbl[x * 4 + 2],
++					lwtbl[x * 4 + 1],
++					lwtbl[x * 4]);
++	}
++
++	seq_printf(s, "\n\tAddr: %02x:%02x:%02x:%02x:%02x:%02x(D0[B0~15], D1[B0~31])\n",
++			  lwtbl[4], lwtbl[5], lwtbl[6], lwtbl[7], lwtbl[0], lwtbl[1]);
++
++	// DW0, DW1
++	seq_printf(s, "LWTBL DW 0/1\n\t");
++	addr = (u32 *)&(lwtbl[0]);
++	dw_value = *addr;
++	seq_printf(s, "MUAR_IDX:%lu/ ",	FIELD_GET(GENMASK(21, 16),	dw_value));
++	seq_printf(s, "RCA1:%ld/ ",	FIELD_GET(BIT(22),		dw_value));
++	seq_printf(s, "KID:%lu/ ",	FIELD_GET(GENMASK(24, 23),	dw_value));
++	seq_printf(s, "RCID:%ld/ ",	FIELD_GET(BIT(25),		dw_value));
++	seq_printf(s, "FROM_DS:%ld\n\t",	FIELD_GET(BIT(26),		dw_value));
++	seq_printf(s, "TO_DS:%ld/ ",	FIELD_GET(BIT(27),		dw_value));
++	seq_printf(s, "RV:%ld/ ",	FIELD_GET(BIT(28),		dw_value));
++	seq_printf(s, "RCA2:%ld/ ",	FIELD_GET(BIT(29),		dw_value));
++	seq_printf(s, "WPI_FLAG:%ld\n",	FIELD_GET(BIT(30),		dw_value));
++
++	// DW2
++	seq_printf(s, "LWTBL DW 2\n\t");
++	addr = (u32 *)&(lwtbl[2*4]);
++	dw_value = *addr;
++	seq_printf(s, "AID12:%lu/ ",	FIELD_GET(GENMASK(11, 0),	dw_value));
++	seq_printf(s, "SU:%ld/ ",	FIELD_GET(BIT(12),		dw_value));
++	seq_printf(s, "SPP_EN:%ld/ ",	FIELD_GET(BIT(13),		dw_value));
++	seq_printf(s, "WPI_EVEN:%ld\n\t",FIELD_GET(BIT(14),		dw_value));
++	seq_printf(s, "CIPHER:%lu/ ",	FIELD_GET(GENMASK(20, 16),	dw_value));
++	seq_printf(s, "CIPHER_IGTK:%lu/ ",FIELD_GET(GENMASK(22, 21),	dw_value));
++	seq_printf(s, "AAD_OM:%ld\n\t",	FIELD_GET(BIT(15),		dw_value));
++	seq_printf(s, "SW:%ld/ ",	FIELD_GET(BIT(24),		dw_value));
++	seq_printf(s, "UL:%ld/ ",	FIELD_GET(BIT(25),		dw_value));
++	seq_printf(s, "TX_POWER_SAVE:%ld\n\t", FIELD_GET(BIT(26),	dw_value));
++	seq_printf(s, "QOS:%ld/ ",	FIELD_GET(BIT(27),		dw_value));
++	seq_printf(s, "HT:%ld/ ",	FIELD_GET(BIT(28),		dw_value));
++	seq_printf(s, "VHT:%ld/ ",	FIELD_GET(BIT(29),		dw_value));
++	seq_printf(s, "HE:%ld/ ",	FIELD_GET(BIT(30),		dw_value));
++	seq_printf(s, "MESH:%ld\n",	FIELD_GET(BIT(31),		dw_value));
++
++	// DW3
++	seq_printf(s, "LWTBL DW 3\n\t");
++	addr = (u32 *)&(lwtbl[3*4]);
++	dw_value = *addr;
++	seq_printf(s, "WMM_Q:%lu/ ",	FIELD_GET(GENMASK(1, 0),	dw_value));
++	seq_printf(s, "RXD_DUP_MODE:%lu\n\t", FIELD_GET(GENMASK(3, 2),	dw_value));
++	seq_printf(s, "VLAN2ETH:%ld/ ",	FIELD_GET(BIT(4),		dw_value));
++	seq_printf(s, "BEAM_CHG:%ld/ ",	FIELD_GET(BIT(5),		dw_value));
++	seq_printf(s, "DIS_BA256:%ld\n\t", FIELD_GET(BIT(6),		dw_value));
++	seq_printf(s, "PFMU_IDX:%lu/ ",	FIELD_GET(GENMASK(15, 8),	dw_value));
++	seq_printf(s, "ULPF_IDX:%lu\n\t", FIELD_GET(GENMASK(23, 16),	dw_value));
++	seq_printf(s, "RIBF:%ld/ ",	FIELD_GET(BIT(24),		dw_value));
++	seq_printf(s, "ULPF:%ld\n\t",	FIELD_GET(BIT(25),		dw_value));
++	seq_printf(s, "IGN_FBK:%ld/ ",	FIELD_GET(BIT(26),		dw_value));
++	seq_printf(s, "TBF:%ld/ ",	FIELD_GET(BIT(29),		dw_value));
++	seq_printf(s, "TBF_VHT:%ld/ ",	FIELD_GET(BIT(30),		dw_value));
++	seq_printf(s, "TBF_HE:%ld\n",	FIELD_GET(BIT(31),		dw_value));
++
++	// DW4
++	seq_printf(s, "LWTBL DW 4\n\t");
++	addr = (u32 *)&(lwtbl[4*4]);
++	dw_value = *addr;
++	seq_printf(s, "ANT_ID_STS0:%lu/ ", FIELD_GET(GENMASK(2, 0),	dw_value));
++	seq_printf(s, "STS1:%lu/ ",	FIELD_GET(GENMASK(5, 3),	dw_value));
++	seq_printf(s, "STS2:%lu/ ",	FIELD_GET(GENMASK(8, 6),	dw_value));
++	seq_printf(s, "STS3:%lu\n\t",	FIELD_GET(GENMASK(11, 9),	dw_value));
++	seq_printf(s, "ANT_ID_STS4:%lu/ ", FIELD_GET(GENMASK(14, 12),	dw_value));
++	seq_printf(s, "STS5:%lu/ ",	FIELD_GET(GENMASK(17, 15),	dw_value));
++	seq_printf(s, "STS6:%ld/ ",	FIELD_GET(GENMASK(20, 18),	dw_value));
++	seq_printf(s, "STS7:%lu\n\t",	FIELD_GET(GENMASK(23, 21),	dw_value));
++	seq_printf(s, "CASCAD:%ld/ ",	FIELD_GET(BIT(24),		dw_value));
++	seq_printf(s, "LDPC_HT:%ld/ ",	FIELD_GET(BIT(25),		dw_value));
++	seq_printf(s, "LDPC_VHT:%ld/ ", FIELD_GET(BIT(26),		dw_value));
++	seq_printf(s, "LDPC_HE:%ld\n\t", FIELD_GET(BIT(27),		dw_value));
++	seq_printf(s, "DIS_RHTR:%ld/ ",	FIELD_GET(BIT(28),		dw_value));
++	seq_printf(s, "ALL_ACK:%ld/ ",	FIELD_GET(BIT(29),		dw_value));
++	seq_printf(s, "DROP:%ld/ ",	FIELD_GET(BIT(30),		dw_value));
++	seq_printf(s, "ACK_EN:%ld\n",	FIELD_GET(BIT(31),		dw_value));
++
++	// DW5
++	seq_printf(s, "LWTBL DW 5\n\t");
++	addr = (u32 *)&(lwtbl[5*4]);
++	dw_value = *addr;
++	seq_printf(s, "AF:%lu/ ",	FIELD_GET(GENMASK(2, 0),	dw_value));
++	seq_printf(s, "AF_HE:%lu/ ",	FIELD_GET(GENMASK(4, 3),	dw_value));
++	seq_printf(s, "RTS:%ld/ ",	FIELD_GET(BIT(5),		dw_value));
++	seq_printf(s, "SMPS:%ld/ ",	FIELD_GET(BIT(6),		dw_value));
++	seq_printf(s, "DYN_BW:%ld\n\t",	FIELD_GET(BIT(7),		dw_value));
++	seq_printf(s, "MMSS:%lu/ ",	FIELD_GET(GENMASK(10, 8),	dw_value));
++	seq_printf(s, "USR:%ld/ ",	FIELD_GET(BIT(11),		dw_value));
++	seq_printf(s, "SR_RATE:%lu/ ",	FIELD_GET(GENMASK(14, 12),	dw_value));
++	seq_printf(s, "SR_ABORT:%ld\n\t", FIELD_GET(BIT(15),		dw_value));
++	seq_printf(s, "TX_POWER_OFFSET:%lu/ ", FIELD_GET(GENMASK(21, 16), dw_value));
++	seq_printf(s, "WTBL_MPDU_SIZE:%lu\n\t", FIELD_GET(GENMASK(23, 22), dw_value));
++	seq_printf(s, "PE:%lu/ ",	FIELD_GET(GENMASK(25, 24),	dw_value));
++	seq_printf(s, "DOPPL:%ld/ ",	FIELD_GET(BIT(26),		dw_value));
++	seq_printf(s, "TXOP_PS_CAP:%ld/ ", FIELD_GET(BIT(27),		dw_value));
++	seq_printf(s, "DONOT_UPDATE_I_PSM:%ld\n\t", FIELD_GET(BIT(28),	dw_value));
++	seq_printf(s, "I_PSM:%ld/ ",	FIELD_GET(BIT(29),		dw_value));
++	seq_printf(s, "PSM:%ld/ ",	FIELD_GET(BIT(30),		dw_value));
++	seq_printf(s, "SKIP_TX:%ld\n",	FIELD_GET(BIT(31),		dw_value));
++
++	// DW6
++	seq_printf(s, "LWTBL DW 6\n\t");
++	seq_printf(s, "TID 0/1/2/3/4/5/6/7 BA_WIN_SIZE:");
++	addr = (u32 *)&(lwtbl[6*4]);
++	dw_value = *addr;
++	seq_printf(s, "%lu/ ",	FIELD_GET(GENMASK(3, 0),	dw_value));
++	seq_printf(s, "%lu/ ",	FIELD_GET(GENMASK(7, 4),	dw_value));
++	seq_printf(s, "%lu/ ",	FIELD_GET(GENMASK(11, 8),	dw_value));
++	seq_printf(s, "%lu/ ",	FIELD_GET(GENMASK(15, 12),	dw_value));
++	seq_printf(s, "%lu/ ",	FIELD_GET(GENMASK(19, 16),	dw_value));
++	seq_printf(s, "%lu/ ",	FIELD_GET(GENMASK(23, 20),	dw_value));
++	seq_printf(s, "%lu/ ",	FIELD_GET(GENMASK(27, 24),	dw_value));
++	seq_printf(s, "%lu\n",	FIELD_GET(GENMASK(31, 28),	dw_value));
++
++	// DW7
++	seq_printf(s, "LWTBL DW 7\n\t");
++	addr = (u32 *)&(lwtbl[7*4]);
++	dw_value = *addr;
++	seq_printf(s, "CBRN:%lu/ ",	FIELD_GET(GENMASK(2, 0),	dw_value));
++	seq_printf(s, "DBNSS_EN:%ld/ ",	FIELD_GET(BIT(3),		dw_value));
++	seq_printf(s, "BAF_EN:%ld/ ",	FIELD_GET(BIT(4),		dw_value));
++	seq_printf(s, "RDGBA:%ld\n\t",	FIELD_GET(BIT(5),		dw_value));
++	seq_printf(s, "RDG:%ld/ ",	FIELD_GET(BIT(6),		dw_value));
++	seq_printf(s, "SPE_IDX:%lu/ ",	FIELD_GET(GENMASK(11, 7),	dw_value));
++	seq_printf(s, "G2:%ld/ ",	FIELD_GET(BIT(12),		dw_value));
++	seq_printf(s, "G4:%ld/ ",	FIELD_GET(BIT(13),		dw_value));
++	seq_printf(s, "G8:%ld/ ",	FIELD_GET(BIT(14),		dw_value));
++	seq_printf(s, "G16:%ld\n\t",	FIELD_GET(BIT(15),		dw_value));
++	seq_printf(s, "G2_LTF:%lu/ ", 	FIELD_GET(GENMASK(17, 16),	dw_value));
++	seq_printf(s, "G4_LTF:%lu/ ",	FIELD_GET(GENMASK(19, 18),	dw_value));
++	seq_printf(s, "G8_LTF:%lu/ ",	FIELD_GET(GENMASK(21, 20),	dw_value));
++	seq_printf(s, "G16_LTF:%lu\n\t", FIELD_GET(GENMASK(23, 22),	dw_value));
++	seq_printf(s, "G2_HE:%lu/ ", 	FIELD_GET(GENMASK(25, 24),	dw_value));
++	seq_printf(s, "G4_HE:%lu/ ",	FIELD_GET(GENMASK(27, 27),	dw_value));
++	seq_printf(s, "G8_HE:%lu/ ",	FIELD_GET(GENMASK(29, 28),	dw_value));
++	seq_printf(s, "G16_HE:%lu\n",	FIELD_GET(GENMASK(31, 30),	dw_value));
++
++	// DW8
++	seq_printf(s, "LWTBL DW 8\n\t");
++	addr = (u32 *)&(lwtbl[8*4]);
++	dw_value = *addr;
++	seq_printf(s, "FAIL_CNT_AC0:%lu/ ", FIELD_GET(GENMASK(4, 0),	dw_value));
++	seq_printf(s, "AC1:%lu/ ",	FIELD_GET(GENMASK(9, 5),	dw_value));
++	seq_printf(s, "AC2:%lu/ ",	FIELD_GET(GENMASK(14, 10),	dw_value));
++	seq_printf(s, "AC3:%lu\n\t",	FIELD_GET(GENMASK(19, 15),	dw_value));
++	seq_printf(s, "PARTIAL_AID:%lu/ ", FIELD_GET(GENMASK(28, 20),	dw_value));
++	seq_printf(s, "CHK_PER:%lu\n",	FIELD_GET(BIT(31),		dw_value));
++
++	// DW9
++	seq_printf(s, "LWTBL DW 9\n\t");
++	addr = (u32 *)&(lwtbl[9*4]);
++	dw_value = *addr;
++	seq_printf(s, "RX_AVG_MPDU:%lu/ ",	FIELD_GET(GENMASK(13, 0), dw_value));
++	seq_printf(s, "PRITX_SW_MODE:%ld/ ",	FIELD_GET(BIT(16),	dw_value));
++	seq_printf(s, "PRITX_PLR:%ld\n\t",	FIELD_GET(BIT(17),	dw_value));
++	seq_printf(s, "PRITX_DCM:%ld/ ",	FIELD_GET(BIT(18),	dw_value));
++	seq_printf(s, "PRITX_ER160:%ld/ ",	FIELD_GET(BIT(19),	dw_value));
++	seq_printf(s, "PRITX_ERSU:%lu\n\t",	FIELD_GET(BIT(20),	dw_value));
++	seq_printf(s, "MPDU_FAIL_CNT:%lu/ ",	FIELD_GET(GENMASK(25, 23), dw_value));
++	seq_printf(s, "MPDU_OK_CNT:%lu/ ",	FIELD_GET(GENMASK(28, 26), dw_value));
++	seq_printf(s, "RATE_IDX:%lu\n\t",	FIELD_GET(GENMASK(31, 29), dw_value));
++	seq_printf(s, "FCAP:%s\n", fcap_str[FIELD_GET(GENMASK(22, 21), dw_value)]);
++
++	// DW10
++	seq_printf(s, "LWTBL DW 10\n");
++	addr = (u32 *)&(lwtbl[10*4]);
++	dw_value = *addr;
++	parse_rate(s, 0, FIELD_GET(GENMASK(13, 0), dw_value));
++	parse_rate(s, 1, FIELD_GET(GENMASK(29, 16), dw_value));
++	// DW11
++	seq_printf(s, "LWTBL DW 11\n");
++	addr = (u32 *)&(lwtbl[11*4]);
++	dw_value = *addr;
++	parse_rate(s, 2, FIELD_GET(GENMASK(13, 0), dw_value));
++	parse_rate(s, 3, FIELD_GET(GENMASK(29, 16), dw_value));
++	// DW12
++	seq_printf(s, "LWTBL DW 12\n");
++	addr = (u32 *)&(lwtbl[12*4]);
++	dw_value = *addr;
++	parse_rate(s, 4, FIELD_GET(GENMASK(13, 0), dw_value));
++	parse_rate(s, 5, FIELD_GET(GENMASK(29, 16), dw_value));
++	// DW13
++	seq_printf(s, "LWTBL DW 13\n");
++	addr = (u32 *)&(lwtbl[13*4]);
++	dw_value = *addr;
++	parse_rate(s, 6, FIELD_GET(GENMASK(13, 0), dw_value));
++	parse_rate(s, 7, FIELD_GET(GENMASK(29, 16), dw_value));
++
++	//DW28
++	seq_printf(s, "LWTBL DW 28\n\t");
++	addr = (u32 *)&(lwtbl[28*4]);
++	dw_value = *addr;
++	seq_printf(s, "OM_INFO:%lu/ ",	FIELD_GET(GENMASK(11, 0), dw_value));
++	seq_printf(s, "OM_RXD_DUP_MODE:%u\n\t",	!!(dw_value & BIT(12)) );
++
++	//DW29
++	seq_printf(s, "LWTBL DW 29\n");
++	addr = (u32 *)&(lwtbl[29*4]);
++	dw_value = *addr;
++	seq_printf(s, "USER_RSSI:%lu/ ",	FIELD_GET(GENMASK(8, 0), dw_value));
++	seq_printf(s, "USER_SNR:%lu/ ", FIELD_GET(GENMASK(14, 9), dw_value));
++	seq_printf(s, "RAPID_REACTION_RATE:%lu/ ",	FIELD_GET(GENMASK(26, 16), dw_value));
++	seq_printf(s, "HT_AMSDU(Read Only):%u/ ",	!!(dw_value & BIT(30)) );
++	seq_printf(s, "AMSDU_CROSS_LG(Read Only):%u\n\t ", !!(dw_value & BIT(31)));
++
++	//DW30
++	seq_printf(s, "LWTBL DW 30\n\t");
++	addr = (u32 *)&(lwtbl[30*4]);
++	dw_value = *addr;
++	seq_printf(s, "RCPI 0:%lu/ ",	FIELD_GET(GENMASK(7, 0), dw_value));
++	seq_printf(s, "RCPI 1:%lu/ ",	FIELD_GET(GENMASK(15, 8), dw_value));
++	seq_printf(s, "RCPI 2:%lu/ ",	FIELD_GET(GENMASK(23, 16), dw_value));
++	seq_printf(s, "RCPI 3:%lu\n\t", FIELD_GET(GENMASK(31, 24), dw_value));
++
++	//DW31
++	seq_printf(s, "LWTBL DW 31\n\t");
++	addr = (u32 *)&(lwtbl[31*4]);
++	dw_value = *addr;
++	seq_printf(s, "RCPI 4:%lu/ ",	FIELD_GET(GENMASK(7, 0), dw_value));
++	seq_printf(s, "RCPI 5:%lu/ ",	FIELD_GET(GENMASK(15, 8), dw_value));
++	seq_printf(s, "RCPI 6:%lu/ ",	FIELD_GET(GENMASK(23, 16), dw_value));
++	seq_printf(s, "RCPI 7:%lu\n\t", FIELD_GET(GENMASK(31, 24), dw_value));
++
++	return 0;
++}
++
++static int mt7915_uwtbl_read(struct seq_file *s, void *data)
++{
++	struct mt7915_dev *dev = dev_get_drvdata(s->private);
++	u8 uwtbl[UWTBL_LEN_IN_DW * 4] = {0};
++	u8 keytbl[ONE_KEY_ENTRY_LEN_IN_DW*4] = {0};
++	int x;
++	u32 *addr = 0;
++	u32 dw_value = 0;
++	u32 amsdu_len = 0;
++	u32 u2SN = 0;
++	u16 keyloc0, keyloc1;
++
++	mt7915_wtbl_read_raw(dev, dev->wlan_idx, WTBL_TYPE_UMAC, 0,
++				 UWTBL_LEN_IN_DW, uwtbl);
++	seq_printf(s, "Dump WTBL info of WLAN_IDX:%d\n", dev->wlan_idx);
++	seq_printf(s, "UMAC WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
++		   MT_DBG_WTBLON_TOP_WDUCR,
++		   mt76_rr(dev, MT_DBG_WTBLON_TOP_WDUCR),
++		   UWTBL_IDX2BASE(dev->wlan_idx, 0));
++	for (x = 0; x < UWTBL_LEN_IN_DW; x++) {
++		seq_printf(s, "DW%02d: %02x %02x %02x %02x\n",
++			   x,
++			   uwtbl[x * 4 + 3],
++			   uwtbl[x * 4 + 2],
++			   uwtbl[x * 4 + 1],
++			   uwtbl[x * 4]);
++	}
++
++	/* UMAC WTBL DW 0 */
++	seq_printf(s, "\nUWTBL PN\n\t");
++	addr = (u32 *)&(uwtbl[0]);
++	dw_value = *addr;
++	seq_printf(s, "PN0:%lu/ ", FIELD_GET(GENMASK(7, 0), dw_value));
++	seq_printf(s, "PN1:%lu/ ", FIELD_GET(GENMASK(15, 8), dw_value));
++	seq_printf(s, "PN2:%lu\n\t", FIELD_GET(GENMASK(23, 16), dw_value));
++	seq_printf(s, "PN3:%lu/ ", FIELD_GET(GENMASK(31, 24), dw_value));
++
++	addr = (u32 *)&(uwtbl[1 * 4]);
++	dw_value = *addr;
++	seq_printf(s, "PN4:%lu/ ", FIELD_GET(GENMASK(7, 0), dw_value));
++	seq_printf(s, "PN5:%lu\n", FIELD_GET(GENMASK(15, 8), dw_value));
++
++	/* UMAC WTBL DW SN part */
++	seq_printf(s, "\nUWTBL SN\n");
++	addr = (u32 *)&(uwtbl[2 * 4]);
++	dw_value = *addr;
++	seq_printf(s, "TID0_AC0_SN:%lu\n", FIELD_GET(GENMASK(11, 0), dw_value));
++	seq_printf(s, "TID1_AC1_SN:%lu\n", FIELD_GET(GENMASK(23, 12), dw_value));
++
++	u2SN = FIELD_GET(GENMASK(31, 24), dw_value);
++	addr = (u32 *)&(uwtbl[3 * 4]);
++	dw_value = *addr;
++	u2SN |= FIELD_GET(GENMASK(3, 0), dw_value);
++	seq_printf(s, "TID2_AC2_SN:%u\n", u2SN);
++	seq_printf(s, "TID3_AC3_SN:%lu\n", FIELD_GET(GENMASK(15, 4), dw_value));
++	seq_printf(s, "TID4_SN:%lu\n", FIELD_GET(GENMASK(27, 16), dw_value));
++
++	u2SN = FIELD_GET(GENMASK(31, 28), dw_value);
++	addr = (u32 *)&(uwtbl[4 * 4]);
++	dw_value = *addr;
++	u2SN |= FIELD_GET(GENMASK(7, 0), dw_value);
++	seq_printf(s, "TID5_SN:%u\n", u2SN);
++	seq_printf(s, "TID6_SN:%lu\n", FIELD_GET(GENMASK(19, 8), dw_value));
++	seq_printf(s, "TID7_SN:%lu\n", FIELD_GET(GENMASK(31, 20), dw_value));
++
++	addr = (u32 *)&(uwtbl[1 * 4]);
++	dw_value = *addr;
++	seq_printf(s, "COM_SN:%lu\n", FIELD_GET(GENMASK(27, 16), dw_value));
++
++	/* UMAC WTBL DW 0 */
++	seq_printf(s, "\nUWTBL others\n");
++
++	addr = (u32 *)&(uwtbl[5 * 4]);
++	dw_value = *addr;
++	keyloc0 = FIELD_GET(GENMASK(10, 0), dw_value);
++	keyloc1 = FIELD_GET(GENMASK(26, 16), dw_value);
++	seq_printf(s, "\tKey Loc 1/2:%lu/%lu\n",
++		   FIELD_GET(GENMASK(10, 0), dw_value),
++		   FIELD_GET(GENMASK(26, 16), dw_value));
++	seq_printf(s, "\tUWTBL_QOS:%lu\n", FIELD_GET(BIT(27), dw_value));
++	seq_printf(s, "\tUWTBL_HT_VHT_HE:%lu\n", FIELD_GET(BIT(28), dw_value));
++
++	addr = (u32 *)&(uwtbl[6*4]);
++	dw_value = *addr;
++	seq_printf(s, "\tHW AMSDU Enable:%lu\n", FIELD_GET(BIT(9), dw_value));
++
++	amsdu_len = FIELD_GET(GENMASK(5, 0), dw_value);
++	if (amsdu_len == 0)
++		seq_printf(s, "\tHW AMSDU Len:invalid (WTBL value=0x%x)\n", amsdu_len);
++	else if (amsdu_len == 1)
++		seq_printf(s, "\tHW AMSDU Len:%d~%d (WTBL value=0x%x)\n",
++			   1,
++			   255,
++			   amsdu_len);
++	else
++		seq_printf(s, "\tHW AMSDU Len:%d~%d (WTBL value=0x%x)\n",
++			   256 * (amsdu_len - 1),
++			   256 * (amsdu_len - 1) + 255,
++			   amsdu_len
++			   );
++	seq_printf(s, "\tHW AMSDU Num:%lu (WTBL value=0x%lx)\n",
++		   FIELD_GET(GENMASK(8, 6), dw_value) + 1,
++		   FIELD_GET(GENMASK(8, 6), dw_value));
++
++	/* Parse KEY link */
++	seq_printf(s, "\n\tkeyloc0:%d\n", keyloc0);
++	if(keyloc0 != GENMASK(10, 0)) {
++		mt7915_wtbl_read_raw(dev, keyloc0, WTBL_TYPE_KEY,
++					 0, ONE_KEY_ENTRY_LEN_IN_DW, keytbl);
++		seq_printf(s, "KEY WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
++			   MT_DBG_WTBLON_TOP_WDUCR,
++			   mt76_rr(dev, MT_DBG_WTBLON_TOP_WDUCR),
++			   KEYTBL_IDX2BASE(keyloc0, 0));
++
++		for (x = 0; x < ONE_KEY_ENTRY_LEN_IN_DW; x++) {
++			seq_printf(s, "DW%02d: %02x %02x %02x %02x\n",
++				   x,
++				   keytbl[x * 4 + 3],
++				   keytbl[x * 4 + 2],
++				   keytbl[x * 4 + 1],
++				   keytbl[x * 4]);
++		}
++	}
++
++	seq_printf(s, "\n\tkeyloc1:%d\n", keyloc1);
++	if(keyloc1 != GENMASK(26, 16)) {
++		mt7915_wtbl_read_raw(dev, keyloc1, WTBL_TYPE_KEY,
++					 0, ONE_KEY_ENTRY_LEN_IN_DW, keytbl);
++		seq_printf(s, "KEY WTBL Addr: group:0x%x=0x%x addr: 0x%lx\n",
++			   MT_DBG_WTBLON_TOP_WDUCR,
++			   mt76_rr(dev, MT_DBG_WTBLON_TOP_WDUCR),
++			   KEYTBL_IDX2BASE(keyloc1, 0));
++
++		for (x = 0; x < ONE_KEY_ENTRY_LEN_IN_DW; x++) {
++			seq_printf(s, "DW%02d: %02x %02x %02x %02x\n",
++				   x,
++				   keytbl[x * 4 + 3],
++				   keytbl[x * 4 + 2],
++				   keytbl[x * 4 + 1],
++				   keytbl[x * 4]);
++		}
++	}
++	return 0;
++}
++
++static void
++dump_dma_tx_ring_info(struct seq_file *s, struct mt7915_dev *dev,  char *str, u32 ring_base)
++{
++	u32 base, cnt, cidx, didx, queue_cnt;
++
++	base= mt76_rr(dev, ring_base);
++	cnt = mt76_rr(dev, ring_base + 4);
++	cidx = mt76_rr(dev, ring_base + 8);
++	didx = mt76_rr(dev, ring_base + 12);
++	queue_cnt = (cidx >= didx) ? (cidx - didx) : (cidx - didx + cnt);
++
++	seq_printf(s, "%20s %10x %10x %10x %10x %10x\n", str, base, cnt, cidx, didx, queue_cnt);
++}
++
++static void
++dump_dma_rx_ring_info(struct seq_file *s, struct mt7915_dev *dev,  char *str, u32 ring_base)
++{
++	u32 base, cnt, cidx, didx, queue_cnt;
++
++	base= mt76_rr(dev, ring_base);
++	cnt = mt76_rr(dev, ring_base + 4);
++	cidx = mt76_rr(dev, ring_base + 8);
++	didx = mt76_rr(dev, ring_base + 12);
++	queue_cnt = (didx > cidx) ? (didx - cidx - 1) : (didx - cidx + cnt - 1);
++
++	seq_printf(s, "%20s %10x %10x %10x %10x %10x\n", str, base, cnt, cidx, didx, queue_cnt);
++}
++
++static void
++mt7915_show_host_dma_info(struct seq_file *s, struct mt7915_dev *dev)
++{
++	u32 sys_ctrl[10] = {};
++
++	/* HOST DMA */
++	sys_ctrl[0] = mt76_rr(dev, MT_DBG_INT_SOURCE_CSR);
++	sys_ctrl[1] = mt76_rr(dev, MT_DBG_INT_MASK_CSR);
++	sys_ctrl[2] = mt76_rr(dev, MT_DBG_WFDMA0_INT_SOURCE_CSR);
++	sys_ctrl[3] = mt76_rr(dev, MT_DBG_WFDMA0_INT_MASK_CSR);
++	sys_ctrl[4] = mt76_rr(dev, MT_DBG_WFDMA1_INT_SOURCE_CSR);
++	sys_ctrl[5] = mt76_rr(dev, MT_DBG_WFDMA1_INT_MASK_CSR);
++	sys_ctrl[6] = mt76_rr(dev, MT_DBG_WFDMA0_GLO_CFG);
++	sys_ctrl[7] = mt76_rr(dev, MT_DBG_WFDMA1_GLO_CFG);
++	seq_printf(s, "HOST_DMA Configuration\n");
++	seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
++			"DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
++	seq_printf(s, "%10s %10x %10x\n",
++			"Merge", sys_ctrl[0], sys_ctrl[1]);
++	seq_printf(s, "%10s %10x %10x %10x %4lx/%5lx %4lx/%5lx\n",
++			"DMA0", sys_ctrl[2], sys_ctrl[3], sys_ctrl[6],
++			FIELD_GET(MT_DBG_WFDMA0_GLO_CFG_TX_DMA_EN, sys_ctrl[6]),
++			FIELD_GET(MT_DBG_WFDMA0_GLO_CFG_RX_DMA_EN, sys_ctrl[6]),
++			FIELD_GET(MT_DBG_WFDMA0_GLO_CFG_TX_BUSY_MASK, sys_ctrl[6]),
++			FIELD_GET(MT_DBG_WFDMA0_GLO_CFG_RX_BUSY_MASK, sys_ctrl[6]));
++
++	seq_printf(s, "%10s %10x %10x %10x %4lx/%5lx %4lx/%5lx\n",
++			"DMA1", sys_ctrl[4], sys_ctrl[5], sys_ctrl[7],
++			FIELD_GET(MT_DBG_WFDMA1_GLO_CFG_TX_DMA_EN, sys_ctrl[7]),
++			FIELD_GET(MT_DBG_WFDMA1_GLO_CFG_RX_DMA_EN, sys_ctrl[7]),
++			FIELD_GET(MT_DBG_WFDMA1_GLO_CFG_TX_BUSY_MASK, sys_ctrl[7]),
++			FIELD_GET(MT_DBG_WFDMA1_GLO_CFG_RX_BUSY_MASK, sys_ctrl[7]));
++
++	sys_ctrl[0] = mt76_rr(dev, MT_DBG_INT1_SOURCE_CSR);
++	sys_ctrl[1] = mt76_rr(dev, MT_DBG_INT1_MASK_CSR);
++	sys_ctrl[2] = mt76_rr(dev, MT_DBG_WFDMA0_PCIE1_INT_SOURCE_CSR);
++	sys_ctrl[3] = mt76_rr(dev, MT_DBG_WFDMA0_PCIE1_INT_MASK_CSR);
++	sys_ctrl[4] = mt76_rr(dev, MT_DBG_WFDMA1_PCIE1_INT_SOURCE_CSR);
++	sys_ctrl[5] = mt76_rr(dev, MT_DBG_WFDMA1_PCIE1_INT_MASK_CSR);
++	sys_ctrl[6] = mt76_rr(dev, MT_DBG_WFDMA0_PCIE1_GLO_CFG);
++	sys_ctrl[7] = mt76_rr(dev, MT_DBG_WFDMA1_PCIE1_GLO_CFG);
++	seq_printf(s, "%10s %10x %10x\n",
++		      "MergeP1", sys_ctrl[0], sys_ctrl[1]);
++	seq_printf(s, "%10s %10x %10x %10x %4lx/%5lx %4lx/%5lx\n",
++		      "DMA0P1", sys_ctrl[2], sys_ctrl[3], sys_ctrl[6],
++		      FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_TX_DMA_EN, sys_ctrl[6]),
++		      FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_RX_DMA_EN, sys_ctrl[6]),
++		      FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_TX_BUSY_MASK, sys_ctrl[6]),
++		      FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_RX_BUSY_MASK, sys_ctrl[6]));
++	seq_printf(s, "%10s %10x %10x %10x %4lx/%5lx %4lx/%5lx\n",
++		      "DMA1P1", sys_ctrl[4], sys_ctrl[5], sys_ctrl[7],
++		      FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_TX_DMA_EN, sys_ctrl[7]),
++		      FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_RX_DMA_EN, sys_ctrl[7]),
++		      FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_TX_BUSY_MASK, sys_ctrl[7]),
++		      FIELD_GET(MT_DBG_WFDMA0_PCIE1_GLO_CFG_RX_BUSY_MASK, sys_ctrl[7]));
++
++	seq_printf(s, "HOST_DMA0 Ring Configuration\n");
++	seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
++		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++	dump_dma_rx_ring_info(s, dev, "R0:Data0(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(0));
++	dump_dma_rx_ring_info(s, dev, "R1:Data1(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(1));
++
++	seq_printf(s, "HOST_DMA0 PCIe 1 Ring Configuration\n");
++	seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
++		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++	dump_dma_rx_ring_info(s, dev, "R1:Data1(MAC2H)", MT_DBG_WFDMA0_PCIE1_RX1_CTRL0);
++
++	seq_printf(s, "HOST_DMA1 Ring Configuration\n");
++	seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
++		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++	dump_dma_tx_ring_info(s, dev, "T16:FWDL", MT_DBG_TX_RING_CTRL(0));
++	dump_dma_tx_ring_info(s, dev, "T17:Cmd(H2WM)", MT_DBG_TX_RING_CTRL(1));
++	dump_dma_tx_ring_info(s, dev, "T18:TXD0(H2WA)", MT_DBG_TX_RING_CTRL(2));
++	dump_dma_tx_ring_info(s, dev, "T19:TXD1(H2WA)", MT_DBG_TX_RING_CTRL(3));
++	dump_dma_tx_ring_info(s, dev, "T20:Cmd(H2WA)", MT_DBG_TX_RING_CTRL(4));
++	dump_dma_rx_ring_info(s, dev, "R0:Event(WM2H)", MT_DBG_RX_EVENT_RING_CTRL(0));
++	dump_dma_rx_ring_info(s, dev, "R1:Event0(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(1));
++	dump_dma_rx_ring_info(s, dev, "R2:Event1(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(2));
++
++	seq_printf(s, "HOST_DMA1 PCIe 1 Ring Configuration\n");
++	seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
++		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++	dump_dma_tx_ring_info(s, dev, "T19:TXD1(H2WA)", MT_DBG_WFDMA1_PCIE1_TX19_CTRL0);
++	dump_dma_rx_ring_info(s, dev, "R2:Event1(WA2H)", MT_DBG_WFDMA1_PCIE1_RX2_CTRL0);
++}
++
++static void
++mt7915_show_mcu_dma_info(struct seq_file *s, struct mt7915_dev *dev)
++{
++	u32 sys_ctrl[9] = {};
++
++	/* MCU DMA information */
++	sys_ctrl[0] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR);
++	sys_ctrl[1] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_HOST_INT_STA_ADDR);
++	sys_ctrl[2] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_HOST_INT_ENA_ADDR);
++
++	sys_ctrl[3] = mt76_rr(dev, WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_ADDR);
++	sys_ctrl[4] = mt76_rr(dev, WF_WFDMA_MCU_DMA1_HOST_INT_STA_ADDR);
++	sys_ctrl[5] = mt76_rr(dev, WF_WFDMA_MCU_DMA1_HOST_INT_ENA_ADDR);
++	sys_ctrl[6] = mt76_rr(dev, WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_ADDR);
++	sys_ctrl[7] = mt76_rr(dev, WF_WFDMA_MCU_DMA1_PCIE1_HOST_INT_STA_ADDR);
++	sys_ctrl[8] = mt76_rr(dev, WF_WFDMA_MCU_DMA1_PCIE1_HOST_INT_ENA_ADDR);
++
++	seq_printf(s, "MCU_DMA Configuration\n");
++	seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
++		      "DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
++	seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
++		      "DMA0", sys_ctrl[1], sys_ctrl[2], sys_ctrl[0],
++		      (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
++		      (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
++		      (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
++		      (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
++
++	seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
++		      "DMA1", sys_ctrl[4], sys_ctrl[5], sys_ctrl[3],
++		      (sys_ctrl[3] & WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
++		      (sys_ctrl[3] & WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
++		      (sys_ctrl[3] & WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
++		      (sys_ctrl[3] & WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA1_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
++	seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
++		      "DMA1P1", sys_ctrl[7], sys_ctrl[8], sys_ctrl[6],
++		      (sys_ctrl[6] & WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
++		      (sys_ctrl[6] & WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
++		      (sys_ctrl[6] & WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
++		      (sys_ctrl[6] & WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
++
++	seq_printf(s, "MCU_DMA0 Ring Configuration\n");
++	seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
++		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++	dump_dma_tx_ring_info(s, dev, "T0:TXD(WM2MAC)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING0_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T1:TXCMD(WM2MAC)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING1_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T2:TXD(WA2MAC)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING2_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R0:Data(MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING0_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R1:TxDone(MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING1_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R2:SPL(MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING2_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R3:TxDone(MAC2WA)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING3_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R4:TXS(MAC2WA)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING4_CTRL0_ADDR);
++
++	seq_printf(s, "MCU_DMA1 Ring Configuration\n");
++	seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
++		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++	dump_dma_tx_ring_info(s, dev, "T0:Event(WM2H)", WF_WFDMA_MCU_DMA1_WPDMA_TX_RING0_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T1:Event0(WA2H)", WF_WFDMA_MCU_DMA1_WPDMA_TX_RING1_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T2:Event1(WA2H)", WF_WFDMA_MCU_DMA1_WPDMA_TX_RING2_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R0:FWDL", WF_WFDMA_MCU_DMA1_WPDMA_RX_RING0_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R1:Cmd(H2WM)", WF_WFDMA_MCU_DMA1_WPDMA_RX_RING1_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R2:TXD0(H2WA)", WF_WFDMA_MCU_DMA1_WPDMA_RX_RING2_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R3:TXD1(H2WA)", WF_WFDMA_MCU_DMA1_WPDMA_RX_RING3_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R4:Cmd(H2WA)", WF_WFDMA_MCU_DMA1_WPDMA_RX_RING4_CTRL0_ADDR);
++
++	seq_printf(s, "MCU_DMA1 PCIe 1 Ring Configuration\n");
++	seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
++		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++	dump_dma_tx_ring_info(s, dev, "T2:Event1(WA2H)", WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_TX_RING2_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R3:TXD1(H2WA)", WF_WFDMA_MCU_DMA1_PCIE1_WPDMA_RX_RING3_CTRL0_ADDR);
++}
++
++static void
++mt7986_show_host_dma_info(struct seq_file *s, struct mt7915_dev *dev)
++{
++	u32 sys_ctrl[5] = {};
++
++	/* HOST DMA */
++	sys_ctrl[0] = mt76_rr(dev, MT_DBG_INT_SOURCE_CSR);
++	sys_ctrl[1] = mt76_rr(dev, MT_DBG_INT_MASK_CSR);
++	sys_ctrl[2] = mt76_rr(dev, MT_DBG_WFDMA0_INT_SOURCE_CSR);
++	sys_ctrl[3] = mt76_rr(dev, MT_DBG_WFDMA0_INT_MASK_CSR);
++	sys_ctrl[4] = mt76_rr(dev, MT_DBG_WFDMA0_GLO_CFG);
++
++	seq_printf(s, "HOST_DMA Configuration\n");
++	seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
++			"DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
++	seq_printf(s, "%10s %10x %10x\n",
++			"Merge", sys_ctrl[0], sys_ctrl[1]);
++	seq_printf(s, "%10s %10x %10x %10x %4lx/%5lx %4lx/%5lx\n",
++			"DMA0", sys_ctrl[2], sys_ctrl[3], sys_ctrl[4],
++			FIELD_GET(MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_TX_DMA_EN_MASK, sys_ctrl[4]),
++			FIELD_GET(MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_RX_DMA_EN_MASK, sys_ctrl[4]),
++			FIELD_GET(MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_TX_DMA_BUSY_MASK, sys_ctrl[4]),
++			FIELD_GET(MT_DBG_WFDMA_HOST_DMA0_GLO_CFG_RX_DMA_BUSY_MASK, sys_ctrl[4]));
++
++
++	seq_printf(s, "HOST_DMA0 Ring Configuration\n");
++	seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
++		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++	dump_dma_tx_ring_info(s, dev, "T16:FWDL", MT_DBG_TX_RING_CTRL(0));
++	dump_dma_tx_ring_info(s, dev, "T17:Cmd(H2WM)",	MT_DBG_TX_RING_CTRL(1));
++	dump_dma_tx_ring_info(s, dev, "T18:TXD0(H2WA)",  MT_DBG_TX_RING_CTRL(2));
++	dump_dma_tx_ring_info(s, dev, "T19:TXD1(H2WA)",  MT_DBG_TX_RING_CTRL(3));
++	dump_dma_tx_ring_info(s, dev, "T20:Cmd(H2WA)",	MT_DBG_TX_RING_CTRL(4));
++	dump_dma_rx_ring_info(s, dev, "R0:Event(WM2H)", MT_DBG_RX_DATA_RING_CTRL(0));
++	dump_dma_rx_ring_info(s, dev, "R1:Event(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(1));
++	dump_dma_rx_ring_info(s, dev, "R2:TxDone(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(2));
++	dump_dma_rx_ring_info(s, dev, "R3:TxDone1(WA2H)", MT_DBG_RX_EVENT_RING_CTRL(3));
++	dump_dma_rx_ring_info(s, dev, "R4:Data0(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(0));
++	dump_dma_rx_ring_info(s, dev, "R5:Data1(MAC2H)", MT_DBG_RX_DATA_RING_CTRL(1));
++}
++
++static void
++mt7986_show_mcu_dma_info(struct seq_file *s, struct mt7915_dev *dev)
++{
++	u32 sys_ctrl[3] = {};
++
++	/* MCU DMA information */
++	sys_ctrl[0] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_ADDR);
++	sys_ctrl[1] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_HOST_INT_STA_ADDR);
++	sys_ctrl[2] = mt76_rr(dev, WF_WFDMA_MCU_DMA0_HOST_INT_ENA_ADDR);
++
++	seq_printf(s, "MCU_DMA Configuration\n");
++	seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
++		      "DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
++	seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
++		      "DMA0", sys_ctrl[1], sys_ctrl[2], sys_ctrl[0],
++		      (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
++		      (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
++		      (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
++		      (sys_ctrl[0] & WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK) >> WF_WFDMA_MCU_DMA0_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
++
++	seq_printf(s, "MCU_DMA0 Ring Configuration\n");
++	seq_printf(s, "%22s %10s %10s %10s %10s %10s\n",
++		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++	dump_dma_tx_ring_info(s, dev, "T0:Event (WM2H)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING0_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T1:Event (WA2H)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING1_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T2:TxDone (WA2H)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING2_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T3:TxDone1 (WA2H)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING3_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T4:TXD (WM2MAC)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING4_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T5:TXCMD (WM2MAC)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING5_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T6:TXD (WA2MAC)", WF_WFDMA_MCU_DMA0_WPDMA_TX_RING6_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R0:FWDL", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING0_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R1:Cmd (H2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING1_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R2:TXD (H2WA)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING2_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R3:TXD1 (H2WA)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING3_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R4:Cmd (H2WA)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING4_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R5:Data (MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING5_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R6:TxDone/STS (MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING6_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R7:RPT (MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING7_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R8:TxDone/STS (MAC2WA)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING8_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R9:Data1 (MAC2WM)", WF_WFDMA_MCU_DMA0_WPDMA_RX_RING9_CTRL0_ADDR);
++
++}
++
++static void
++mt7915_show_dma_info(struct seq_file *s, struct mt7915_dev *dev)
++{
++	u32 sys_ctrl[10] = {};
++
++	if(is_mt7915(&dev->mt76)) {
++		mt7915_show_host_dma_info(s, dev);
++		mt7915_show_mcu_dma_info(s, dev);
++	} else {
++		mt7986_show_host_dma_info(s, dev);
++		mt7986_show_mcu_dma_info(s, dev);
++	}
++
++	/* MEM DMA information */
++	sys_ctrl[0] = mt76_rr(dev, WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_ADDR);
++	sys_ctrl[1] = mt76_rr(dev, WF_WFDMA_MEM_DMA_HOST_INT_STA_ADDR);
++	sys_ctrl[2] = mt76_rr(dev, WF_WFDMA_MEM_DMA_HOST_INT_ENA_ADDR);
++
++	seq_printf(s, "MEM_DMA Configuration\n");
++	seq_printf(s, "%10s %10s %10s %10s %10s %10s\n",
++		      "DMA", "IntCSR", "IntMask", "Glocfg", "Tx/RxEn", "Tx/RxBusy");
++	seq_printf(s, "%10s %10x %10x %10x %4x/%5x %4x/%5x\n",
++		      "MEM", sys_ctrl[1], sys_ctrl[2], sys_ctrl[0],
++		      (sys_ctrl[0] & WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_MASK) >> WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_EN_SHFT,
++		      (sys_ctrl[0] & WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_MASK) >> WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_EN_SHFT,
++		      (sys_ctrl[0] & WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_MASK) >> WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_TX_DMA_BUSY_SHFT,
++		      (sys_ctrl[0] & WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_MASK) >> WF_WFDMA_MEM_DMA_WPDMA_GLO_CFG_RX_DMA_BUSY_SHFT);
++
++	seq_printf(s, "MEM_DMA Ring Configuration\n");
++	seq_printf(s, "%20s %10s %10s %10s %10s %10s\n",
++		      "Name", "Base", "Cnt", "CIDX", "DIDX", "QCnt");
++	dump_dma_tx_ring_info(s, dev, "T0:CmdEvent(WM2WA)", WF_WFDMA_MEM_DMA_WPDMA_TX_RING0_CTRL0_ADDR);
++	dump_dma_tx_ring_info(s, dev, "T1:CmdEvent(WA2WM)", WF_WFDMA_MEM_DMA_WPDMA_TX_RING1_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R0:CmdEvent(WM2WA)", WF_WFDMA_MEM_DMA_WPDMA_RX_RING0_CTRL0_ADDR);
++	dump_dma_rx_ring_info(s, dev, "R1:CmdEvent(WA2WM)", WF_WFDMA_MEM_DMA_WPDMA_RX_RING1_CTRL0_ADDR);
++}
++
++static int mt7915_trinfo_read(struct seq_file *s, void *data)
++{
++	struct mt7915_dev *dev = dev_get_drvdata(s->private);
++	const struct hif_pci_tx_ring_desc *tx_ring_layout;
++	const struct hif_pci_rx_ring_desc *rx_ring_layout;
++	u32 tx_ring_num, rx_ring_num;
++	u32 tbase[5], tcnt[5];
++	u32 tcidx[5], tdidx[5];
++	u32 rbase[6], rcnt[6];
++	u32 rcidx[6], rdidx[6];
++	int idx;
++
++	if(is_mt7915(&dev->mt76)) {
++		tx_ring_layout = &mt7915_tx_ring_layout[0];
++		rx_ring_layout = &mt7915_rx_ring_layout[0];
++		tx_ring_num = ARRAY_SIZE(mt7915_tx_ring_layout);
++		rx_ring_num = ARRAY_SIZE(mt7915_rx_ring_layout);
++	} else {
++		tx_ring_layout = &mt7986_tx_ring_layout[0];
++		rx_ring_layout = &mt7986_rx_ring_layout[0];
++		tx_ring_num = ARRAY_SIZE(mt7986_tx_ring_layout);
++		rx_ring_num = ARRAY_SIZE(mt7986_rx_ring_layout);
++	}
++
++	for (idx = 0; idx < tx_ring_num; idx++) {
++		tbase[idx] = mt76_rr(dev, MT_DBG_TX_RING_CTRL(idx));
++		tcnt[idx]  = mt76_rr(dev, MT_DBG_TX_RING_CTRL(idx) + 0x04);
++		tcidx[idx] = mt76_rr(dev, MT_DBG_TX_RING_CTRL(idx) + 0x08);
++		tdidx[idx] = mt76_rr(dev, MT_DBG_TX_RING_CTRL(idx) + 0x0c);
++	}
++
++	for (idx = 0; idx < rx_ring_num; idx++) {
++		if (idx < 2) {
++			rbase[idx] = mt76_rr(dev, MT_DBG_RX_DATA_RING_CTRL(idx));
++			rcnt[idx]  = mt76_rr(dev, MT_DBG_RX_DATA_RING_CTRL(idx) + 0x04);
++			rcidx[idx] = mt76_rr(dev, MT_DBG_RX_DATA_RING_CTRL(idx) + 0x08);
++			rdidx[idx] = mt76_rr(dev, MT_DBG_RX_DATA_RING_CTRL(idx) + 0x0c);
++		} else {
++			rbase[idx] = mt76_rr(dev, MT_DBG_RX_EVENT_RING_CTRL(idx - 2));
++			rcnt[idx]  = mt76_rr(dev, MT_DBG_RX_EVENT_RING_CTRL(idx - 2) + 0x04);
++			rcidx[idx] = mt76_rr(dev, MT_DBG_RX_EVENT_RING_CTRL(idx - 2) + 0x08);
++			rdidx[idx] = mt76_rr(dev, MT_DBG_RX_EVENT_RING_CTRL(idx - 2) + 0x0c);
++		}
++	}
++
++	seq_printf(s, "=================================================\n");
++	seq_printf(s, "TxRing Configuration\n");
++	seq_printf(s, "%4s %10s %8s %1s %6s %6s %6s %6s\n",
++		      "Idx", "Attr", "Reg", "Base", "Cnt", "CIDX", "DIDX",
++		      "QCnt");
++	for (idx = 0; idx < tx_ring_num; idx++) {
++		u32 queue_cnt;
++
++		queue_cnt = (tcidx[idx] >= tdidx[idx]) ?
++			    (tcidx[idx] - tdidx[idx]) :
++			    (tcidx[idx] - tdidx[idx] + tcnt[idx]);
++		seq_printf(s, "%4d %8s %8x %10x %6x %6x %6x %6x\n",
++			   idx, tx_ring_layout[idx].ring_info,
++			   MT_DBG_TX_RING_CTRL(idx), tbase[idx],
++			   tcnt[idx], tcidx[idx], tdidx[idx], queue_cnt);
++	}
++
++	seq_printf(s, "RxRing Configuration\n");
++	seq_printf(s, "%4s %10s %8s %10s %6s %6s %6s %6s\n",
++		      "Idx", "Attr", "Reg", "Base", "Cnt", "CIDX", "DIDX",
++		      "QCnt");
++
++	for (idx = 0; idx < rx_ring_num; idx++) {
++		u32 queue_cnt;
++
++		queue_cnt = (rdidx[idx] > rcidx[idx]) ?
++			    (rdidx[idx] - rcidx[idx] - 1) :
++			    (rdidx[idx] - rcidx[idx] + rcnt[idx] - 1);
++		seq_printf(s, "%4d %8s %8x %10x %6x %6x %6x %6x\n",
++			   idx, rx_ring_layout[idx].ring_info,
++			   (idx < 2) ? MT_DBG_RX_DATA_RING_CTRL(idx): MT_DBG_RX_EVENT_RING_CTRL(idx - 2),
++			   rbase[idx], rcnt[idx], rcidx[idx], rdidx[idx], queue_cnt);
++	}
++
++	mt7915_show_dma_info(s, dev);
++	return 0;
++}
++
++static int mt7915_drr_info(struct seq_file *s, void *data)
++{
++#define DL_AC_START	0x00
++#define DL_AC_END	0x0F
++#define UL_AC_START	0x10
++#define UL_AC_END	0x1F
++
++	struct mt7915_dev *dev = dev_get_drvdata(s->private);
++	u32 drr_sta_status[16];
++	u32 drr_ctrl_def_val = 0x80220000, drr_ctrl_val = 0;
++	bool is_show = false;
++	int idx, sta_line = 0, sta_no = 0, max_sta_line = (mt7915_wtbl_size(dev) + 31) / 32;
++	seq_printf(s, "DRR Table STA Info:\n");
++
++	for (idx = DL_AC_START; idx <= DL_AC_END; idx++) {
++		is_show = true;
++		drr_ctrl_val = (drr_ctrl_def_val | idx);
++		mt76_wr(dev, MT_DBG_PLE_DRR_TAB_CTRL, drr_ctrl_val);
++		drr_sta_status[0] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA0);
++		drr_sta_status[1] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA1);
++		drr_sta_status[2] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA2);
++		drr_sta_status[3] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA3);
++		drr_sta_status[4] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA4);
++		drr_sta_status[5] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA5);
++		drr_sta_status[6] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA6);
++		drr_sta_status[7] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA7);
++
++		if (is_mt7915(&dev->mt76) && max_sta_line > 8) {
++			drr_ctrl_val = (drr_ctrl_def_val | idx | 1 << 10);
++			mt76_wr(dev, MT_DBG_PLE_DRR_TAB_CTRL, drr_ctrl_val);
++			drr_sta_status[8] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA0);
++			drr_sta_status[9] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA1);
++			drr_sta_status[10] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA2);
++			drr_sta_status[11] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA3);
++			drr_sta_status[12] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA4);
++			drr_sta_status[13] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA5);
++			drr_sta_status[14] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA6);
++			drr_sta_status[15] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA7);
++		}
++		if (!is_mt7915(&dev->mt76))
++			max_sta_line = 8;
++
++		for (sta_line = 0; sta_line < max_sta_line; sta_line++) {
++			if (drr_sta_status[sta_line] > 0) {
++				for (sta_no = 0; sta_no < 32; sta_no++) {
++					if (((drr_sta_status[sta_line] & (0x1 << sta_no)) >> sta_no)) {
++						if (is_show) {
++							seq_printf(s, "\n DL AC%02d Queue Non-Empty STA:\n", idx);
++							is_show = false;
++						}
++						seq_printf(s, "%d ", sta_no + (sta_line * 32));
++					}
++				}
++			}
++		}
++	}
++
++	for (idx = UL_AC_START; idx <= UL_AC_END; idx++) {
++		is_show = true;
++		drr_ctrl_val = (drr_ctrl_def_val | idx);
++		mt76_wr(dev, MT_DBG_PLE_DRR_TAB_CTRL, drr_ctrl_val);
++		drr_sta_status[0] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA0);
++		drr_sta_status[1] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA1);
++		drr_sta_status[2] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA2);
++		drr_sta_status[3] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA3);
++		drr_sta_status[4] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA4);
++		drr_sta_status[5] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA5);
++		drr_sta_status[6] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA6);
++		drr_sta_status[7] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA7);
++
++		if (is_mt7915(&dev->mt76) && max_sta_line > 8) {
++			drr_ctrl_val = (drr_ctrl_def_val | idx | 1 << 10);
++			mt76_wr(dev, MT_DBG_PLE_DRR_TAB_CTRL, drr_ctrl_val);
++			drr_sta_status[8] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA0);
++			drr_sta_status[9] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA1);
++			drr_sta_status[10] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA2);
++			drr_sta_status[11] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA3);
++			drr_sta_status[12] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA4);
++			drr_sta_status[13] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA5);
++			drr_sta_status[14] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA6);
++			drr_sta_status[15] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA7);
++		}
++
++		if (!is_mt7915(&dev->mt76))
++			max_sta_line = 8;
++
++		for (sta_line = 0; sta_line < max_sta_line; sta_line++) {
++			if (drr_sta_status[sta_line] > 0) {
++				for (sta_no = 0; sta_no < 32; sta_no++) {
++					if (((drr_sta_status[sta_line] & (0x1 << sta_no)) >> sta_no)) {
++						if (is_show) {
++							seq_printf(s, "\n UL AC%02d Queue Non-Empty STA:\n", idx);
++							is_show = false;
++						}
++						seq_printf(s, "%d ", sta_no + (sta_line * 32));
++					}
++				}
++			}
++		}
++	}
++
++	for (idx = DL_AC_START; idx <= DL_AC_END; idx++) {
++		drr_ctrl_def_val = 0x80420000;
++		drr_ctrl_val = (drr_ctrl_def_val | idx);
++		mt76_wr(dev, MT_DBG_PLE_DRR_TAB_CTRL, drr_ctrl_val);
++		drr_sta_status[0] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA0);
++		drr_sta_status[1] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA1);
++		drr_sta_status[2] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA2);
++		drr_sta_status[3] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA3);
++		drr_sta_status[4] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA4);
++		drr_sta_status[5] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA5);
++		drr_sta_status[6] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA6);
++		drr_sta_status[7] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA7);
++
++		if (is_mt7915(&dev->mt76) && max_sta_line > 8) {
++			drr_ctrl_val = (drr_ctrl_def_val | idx | 1<<10);
++			mt76_wr(dev, MT_DBG_PLE_DRR_TAB_CTRL, drr_ctrl_val);
++			drr_sta_status[8] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA0);
++			drr_sta_status[9] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA1);
++			drr_sta_status[10] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA2);
++			drr_sta_status[11] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA3);
++			drr_sta_status[12] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA4);
++			drr_sta_status[13] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA5);
++			drr_sta_status[14] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA6);
++			drr_sta_status[15] = mt76_rr(dev, MT_DBG_PLE_DRR_TABLE_RDATA7);
++		}
++
++		seq_printf(s, "\nBSSGrp[%d]:\n", idx);
++		if (!is_mt7915(&dev->mt76))
++			max_sta_line = 8;
++
++		for (sta_line = 0; sta_line < max_sta_line; sta_line++) {
++			seq_printf(s, "0x%08x ", drr_sta_status[sta_line]);
++
++			if ((sta_line % 4) == 3)
++				seq_printf(s, "\n");
++		}
++	}
++
++	return 0;
++}
++
++#define CR_NUM_OF_AC 9
++
++typedef enum _ENUM_UMAC_PORT_T {
++	ENUM_UMAC_HIF_PORT_0         = 0,
++	ENUM_UMAC_CPU_PORT_1         = 1,
++	ENUM_UMAC_LMAC_PORT_2        = 2,
++	ENUM_PLE_CTRL_PSE_PORT_3     = 3,
++	ENUM_UMAC_PSE_PLE_PORT_TOTAL_NUM = 4
++} ENUM_UMAC_PORT_T, *P_ENUM_UMAC_PORT_T;
++
++/* N9 MCU QUEUE LIST */
++typedef enum _ENUM_UMAC_CPU_P_QUEUE_T {
++	ENUM_UMAC_CTX_Q_0 = 0,
++	ENUM_UMAC_CTX_Q_1 = 1,
++	ENUM_UMAC_CTX_Q_2 = 2,
++	ENUM_UMAC_CTX_Q_3 = 3,
++	ENUM_UMAC_CRX     = 0,
++	ENUM_UMAC_CIF_QUEUE_TOTAL_NUM = 4
++} ENUM_UMAC_CPU_P_QUEUE_T, *P_ENUM_UMAC_CPU_P_QUEUE_T;
++
++/* LMAC PLE TX QUEUE LIST */
++typedef enum _ENUM_UMAC_LMAC_PLE_TX_P_QUEUE_T {
++	ENUM_UMAC_LMAC_PLE_TX_Q_00           = 0x00,
++	ENUM_UMAC_LMAC_PLE_TX_Q_01           = 0x01,
++	ENUM_UMAC_LMAC_PLE_TX_Q_02           = 0x02,
++	ENUM_UMAC_LMAC_PLE_TX_Q_03           = 0x03,
++
++	ENUM_UMAC_LMAC_PLE_TX_Q_10           = 0x04,
++	ENUM_UMAC_LMAC_PLE_TX_Q_11           = 0x05,
++	ENUM_UMAC_LMAC_PLE_TX_Q_12           = 0x06,
++	ENUM_UMAC_LMAC_PLE_TX_Q_13           = 0x07,
++
++	ENUM_UMAC_LMAC_PLE_TX_Q_20           = 0x08,
++	ENUM_UMAC_LMAC_PLE_TX_Q_21           = 0x09,
++	ENUM_UMAC_LMAC_PLE_TX_Q_22           = 0x0a,
++	ENUM_UMAC_LMAC_PLE_TX_Q_23           = 0x0b,
++
++	ENUM_UMAC_LMAC_PLE_TX_Q_30           = 0x0c,
++	ENUM_UMAC_LMAC_PLE_TX_Q_31           = 0x0d,
++	ENUM_UMAC_LMAC_PLE_TX_Q_32           = 0x0e,
++	ENUM_UMAC_LMAC_PLE_TX_Q_33           = 0x0f,
++
++	ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_0      = 0x10,
++	ENUM_UMAC_LMAC_PLE_TX_Q_BMC_0       = 0x11,
++	ENUM_UMAC_LMAC_PLE_TX_Q_BNC_0       = 0x12,
++	ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_0      = 0x13,
++
++	ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_1      = 0x14,
++	ENUM_UMAC_LMAC_PLE_TX_Q_BMC_1       = 0x15,
++	ENUM_UMAC_LMAC_PLE_TX_Q_BNC_1       = 0x16,
++	ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_1      = 0x17,
++	ENUM_UMAC_LMAC_PLE_TX_Q_NAF         = 0x18,
++	ENUM_UMAC_LMAC_PLE_TX_Q_NBCN        = 0x19,
++	ENUM_UMAC_LMAC_PLE_TX_Q_RELEASE     = 0x1f, /* DE suggests not to use 0x1f, it's only for hw free queue */
++	ENUM_UMAC_LMAC_QUEUE_TOTAL_NUM      = 24,
++
++} ENUM_UMAC_LMAC_TX_P_QUEUE_T, *P_ENUM_UMAC_LMAC_TX_P_QUEUE_T;
++
++typedef struct _EMPTY_QUEUE_INFO_T {
++	char *QueueName;
++	u32 Portid;
++	u32 Queueid;
++} EMPTY_QUEUE_INFO_T, *P_EMPTY_QUEUE_INFO_T;
++
++static EMPTY_QUEUE_INFO_T ple_queue_empty_info[] = {
++	{"CPU Q0",  ENUM_UMAC_CPU_PORT_1,     ENUM_UMAC_CTX_Q_0},
++	{"CPU Q1",  ENUM_UMAC_CPU_PORT_1,     ENUM_UMAC_CTX_Q_1},
++	{"CPU Q2",  ENUM_UMAC_CPU_PORT_1,     ENUM_UMAC_CTX_Q_2},
++	{"CPU Q3",  ENUM_UMAC_CPU_PORT_1,     ENUM_UMAC_CTX_Q_3},
++	{NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, /* 4~7 not defined */
++	{"ALTX Q0", ENUM_UMAC_LMAC_PORT_2,    ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_0}, /* Q16 */
++	{"BMC Q0",  ENUM_UMAC_LMAC_PORT_2,    ENUM_UMAC_LMAC_PLE_TX_Q_BMC_0},
++	{"BCN Q0",  ENUM_UMAC_LMAC_PORT_2,    ENUM_UMAC_LMAC_PLE_TX_Q_BNC_0},
++	{"PSMP Q0", ENUM_UMAC_LMAC_PORT_2,    ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_0},
++	{"ALTX Q1", ENUM_UMAC_LMAC_PORT_2,    ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_1},
++	{"BMC Q1",  ENUM_UMAC_LMAC_PORT_2,    ENUM_UMAC_LMAC_PLE_TX_Q_BMC_1},
++	{"BCN Q1",  ENUM_UMAC_LMAC_PORT_2,    ENUM_UMAC_LMAC_PLE_TX_Q_BNC_1},
++	{"PSMP Q1", ENUM_UMAC_LMAC_PORT_2,    ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_1},
++	{"NAF Q",   ENUM_UMAC_LMAC_PORT_2,    ENUM_UMAC_LMAC_PLE_TX_Q_NAF},
++	{"NBCN Q",  ENUM_UMAC_LMAC_PORT_2,    ENUM_UMAC_LMAC_PLE_TX_Q_NBCN},
++	{NULL, 0, 0}, {NULL, 0, 0}, /* 18, 19 not defined */
++	{"FIXFID Q", ENUM_UMAC_LMAC_PORT_2, 0x1a},
++	{NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0},
++	{NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, /* 21~29 not defined */
++	{"RLS Q",   ENUM_PLE_CTRL_PSE_PORT_3, 0x7e},
++	{"RLS2 Q",  ENUM_PLE_CTRL_PSE_PORT_3, 0x7f}
++};
++
++static EMPTY_QUEUE_INFO_T ple_txcmd_queue_empty_info[] = {
++	{"AC00Q", ENUM_UMAC_LMAC_PORT_2, 0x40},
++	{"AC01Q", ENUM_UMAC_LMAC_PORT_2, 0x41},
++	{"AC02Q", ENUM_UMAC_LMAC_PORT_2, 0x42},
++	{"AC03Q", ENUM_UMAC_LMAC_PORT_2, 0x43},
++	{"AC10Q", ENUM_UMAC_LMAC_PORT_2, 0x44},
++	{"AC11Q", ENUM_UMAC_LMAC_PORT_2, 0x45},
++	{"AC12Q", ENUM_UMAC_LMAC_PORT_2, 0x46},
++	{"AC13Q", ENUM_UMAC_LMAC_PORT_2, 0x47},
++	{"AC20Q", ENUM_UMAC_LMAC_PORT_2, 0x48},
++	{"AC21Q", ENUM_UMAC_LMAC_PORT_2, 0x49},
++	{"AC22Q", ENUM_UMAC_LMAC_PORT_2, 0x4a},
++	{"AC23Q", ENUM_UMAC_LMAC_PORT_2, 0x4b},
++	{"AC30Q", ENUM_UMAC_LMAC_PORT_2, 0x4c},
++	{"AC31Q", ENUM_UMAC_LMAC_PORT_2, 0x4d},
++	{"AC32Q", ENUM_UMAC_LMAC_PORT_2, 0x4e},
++	{"AC33Q", ENUM_UMAC_LMAC_PORT_2, 0x4f},
++	{"ALTX Q0", ENUM_UMAC_LMAC_PORT_2, 0x50},
++	{"TF Q0", ENUM_UMAC_LMAC_PORT_2, 0x51},
++	{"TWT TSF-TF Q0", ENUM_UMAC_LMAC_PORT_2, 0x52},
++	{"TWT DL Q0", ENUM_UMAC_LMAC_PORT_2, 0x53},
++	{"TWT UL Q0", ENUM_UMAC_LMAC_PORT_2, 0x54},
++	{"ALTX Q1", ENUM_UMAC_LMAC_PORT_2, 0x55},
++	{"TF Q1", ENUM_UMAC_LMAC_PORT_2, 0x56},
++	{"TWT TSF-TF Q1", ENUM_UMAC_LMAC_PORT_2, 0x57},
++	{"TWT DL Q1", ENUM_UMAC_LMAC_PORT_2, 0x58},
++	{"TWT UL Q1", ENUM_UMAC_LMAC_PORT_2, 0x59},
++	{NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0},
++};
++
++
++
++static char* sta_ctrl_reg[] = {"ENABLE", "DISABLE", "PAUSE"};
++static u32 chip_show_sta_acq_info(struct seq_file *s, struct mt7915_dev *dev, u32 *ple_stat,
++				  u32 *sta_pause, u32 *dis_sta_map,
++				  u32 dumptxd)
++{
++	int i, j;
++	u32 total_nonempty_cnt = 0;
++	u32 ac_num = 9, all_ac_num;
++
++	/* TDO: ac_num = 16 for mt7986 */
++	/* if (!is_mt7915(&dev->mt76))
++		ac_num = 16;
++	*/
++
++	all_ac_num = ac_num * 4;
++
++	for (j = 0; j < all_ac_num; j++) { /* show AC Q info */
++		for (i = 0; i < 32; i++) {
++			if (((ple_stat[j + 1] & (0x1 << i)) >> i) == 0) {
++				u32 hfid, tfid, pktcnt, ac_num = j / ac_num, ctrl = 0;
++				u32 sta_num = i + (j % ac_num) * 32, fl_que_ctrl[3] = {0};
++				//struct wifi_dev *wdev = wdev_search_by_wcid(pAd, sta_num);
++				u32 wmmidx = 0;
++				struct mt7915_sta *msta;
++				struct mt76_wcid *wcid;
++				struct ieee80211_sta *sta = NULL;
++
++				wcid = rcu_dereference(dev->mt76.wcid[sta_num]);
++				sta = wcid_to_sta(wcid);
++				if (!sta) {
++					printk("ERROR!! no found STA wcid=%d\n", sta_num);
++					return 0;
++				}
++				msta = container_of(wcid, struct mt7915_sta, wcid);
++				wmmidx = msta->vif->mt76.wmm_idx;
++
++				seq_printf(s, "\tSTA%d AC%d: ", sta_num, ac_num);
++
++				fl_que_ctrl[0] |= MT_DBG_PLE_FL_QUE_CTRL0_EXECUTE_MASK;
++				fl_que_ctrl[0] |= (ENUM_UMAC_LMAC_PORT_2 << MT_PLE_FL_QUE_CTRL0_Q_BUF_PID_SHFT);
++				fl_que_ctrl[0] |= (ac_num << MT_PLE_FL_QUE_CTRL0_Q_BUF_QID_SHFT);
++				fl_que_ctrl[0] |= sta_num;
++				mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL0, fl_que_ctrl[0]);
++				fl_que_ctrl[1] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL2);
++				fl_que_ctrl[2] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL3);
++				hfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_HEAD_FID_MASK, fl_que_ctrl[1]);
++				tfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_TAIL_FID_MASK, fl_que_ctrl[1]);
++				pktcnt = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL3_Q_PKT_NUM_MASK, fl_que_ctrl[2]);
++				seq_printf(s, "tail/head fid = 0x%03x/0x%03x, pkt cnt = 0x%03x",
++						  tfid, hfid, pktcnt);
++
++				if (((sta_pause[j % 6] & 0x1 << i) >> i) == 1)
++					ctrl = 2;
++
++				if (((dis_sta_map[j % 6] & 0x1 << i) >> i) == 1)
++					ctrl = 1;
++
++				seq_printf(s, " ctrl = %s", sta_ctrl_reg[ctrl]);
++				seq_printf(s, " (wmmidx=%d)\n", wmmidx);
++
++				total_nonempty_cnt++;
++
++				// TODO
++				//if (pktcnt > 0 && dumptxd > 0)
++				//	ShowTXDInfo(pAd, hfid);
++			}
++		}
++	}
++
++	return total_nonempty_cnt;
++}
++
++static void chip_show_txcmdq_info(struct seq_file *s, struct mt7915_dev *dev, u32 ple_txcmd_stat)
++{
++	int i;
++
++	seq_printf(s, "Nonempty TXCMD Q info:\n");
++	for (i = 0; i < 31; i++) {
++		if (((ple_txcmd_stat & (0x1 << i)) >> i) == 0) {
++			u32 hfid, tfid, pktcnt, fl_que_ctrl[3] = {0};
++
++			if (ple_txcmd_queue_empty_info[i].QueueName != NULL) {
++				seq_printf(s, "\t%s: ", ple_txcmd_queue_empty_info[i].QueueName);
++				fl_que_ctrl[0] |= MT_DBG_PLE_FL_QUE_CTRL0_EXECUTE_MASK;
++				fl_que_ctrl[0] |= (ple_txcmd_queue_empty_info[i].Portid <<
++							MT_PLE_FL_QUE_CTRL0_Q_BUF_PID_SHFT);
++				fl_que_ctrl[0] |= (ple_txcmd_queue_empty_info[i].Queueid <<
++							MT_PLE_FL_QUE_CTRL0_Q_BUF_QID_SHFT);
++			} else
++				continue;
++
++			mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL0, fl_que_ctrl[0]);
++			fl_que_ctrl[1] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL2);
++			fl_que_ctrl[2] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL3);
++			hfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_HEAD_FID_MASK, fl_que_ctrl[1]);
++			tfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_TAIL_FID_MASK, fl_que_ctrl[1]);
++			pktcnt = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL3_Q_PKT_NUM_MASK, fl_que_ctrl[2]);
++			seq_printf(s, "tail/head fid = 0x%03x/0x%03x, pkt cnt = 0x%03x\n",
++					  tfid, hfid, pktcnt);
++		}
++	}
++}
++
++static void chip_get_ple_acq_stat(struct mt7915_dev *dev, u32 *ple_stat)
++{
++	int i;
++	int cr_num = 9, all_cr_num;
++	u32 ac , index;
++
++	/* TDO: cr_num = 16 for mt7986 */
++	/*
++	if(!is_mt7915(&dev->mt76))
++		cr_num = 16;
++	*/
++	all_cr_num =  cr_num * 4;
++
++	ple_stat[0] = mt76_rr(dev, MT_DBG_PLE_QUEUE_EMPTY);
++
++	for(i = 0; i < all_cr_num; i++) {
++		ac = i / cr_num;
++		index = i % cr_num;
++		ple_stat[i + 1] =
++			mt76_rr(dev, MT_DBG_PLE_AC_QEMPTY(ac, index));
++
++	}
++}
++
++static void chip_get_dis_sta_map(struct mt7915_dev *dev, u32 *dis_sta_map)
++{
++	int i;
++
++	for(i = 0; i < CR_NUM_OF_AC; i++) {
++		dis_sta_map[i] = mt76_rr(dev, MT_DBG_PLE_DIS_STA_MAP(i));
++	}
++}
++
++static void chip_get_sta_pause(struct mt7915_dev *dev, u32 *sta_pause)
++{
++	int i;
++
++	for(i = 0; i < CR_NUM_OF_AC; i++) {
++		sta_pause[i] = mt76_rr(dev, MT_DBG_PLE_STATION_PAUSE(i));
++	}
++}
++
++static int mt7915_pleinfo_read(struct seq_file *s, void *data)
++{
++	struct mt7915_dev *dev = dev_get_drvdata(s->private);
++	u32 ple_buf_ctrl, pg_sz, pg_num;
++	u32 ple_stat[65] = {0}, pg_flow_ctrl[8] = {0};
++	u32 ple_native_txcmd_stat;
++	u32 ple_txcmd_stat;
++	u32 sta_pause[CR_NUM_OF_AC] = {0}, dis_sta_map[CR_NUM_OF_AC] = {0};
++	u32 fpg_cnt, ffa_cnt, fpg_head, fpg_tail, hif_max_q, hif_min_q;
++	u32 rpg_hif, upg_hif, cpu_max_q, cpu_min_q, rpg_cpu, upg_cpu;
++	int i, j;
++	u32 ac_num = 9, all_ac_num;
++
++	/* TDO: ac_num = 16 for mt7986 */
++	/* if (!is_mt7915(&dev->mt76))
++		ac_num = 16;
++	*/
++
++	all_ac_num = ac_num * 4;
++
++	ple_buf_ctrl = mt76_rr(dev, MT_DBG_PLE_PBUF_CTRL_ADDR);
++	chip_get_ple_acq_stat(dev, ple_stat);
++	ple_txcmd_stat = mt76_rr(dev, MT_DBG_PLE_TXCMD_Q_EMPTY);
++	ple_native_txcmd_stat = mt76_rr(dev, MT_DBG_PLE_NATIVE_TXCMD_Q_EMPTY);
++	pg_flow_ctrl[0] = mt76_rr(dev, MT_DBG_PLE_FREEPG_CNT);
++	pg_flow_ctrl[1] = mt76_rr(dev, MT_DBG_PLE_FREEPG_HEAD_TAIL);
++	pg_flow_ctrl[2] = mt76_rr(dev, MT_DBG_PLE_PG_HIF_GROUP);
++	pg_flow_ctrl[3] = mt76_rr(dev, MT_DBG_PLE_HIF_PG_INFO);
++	pg_flow_ctrl[4] = mt76_rr(dev, MT_DBG_PLE_PG_CPU_GROUP);
++	pg_flow_ctrl[5] = mt76_rr(dev, MT_DBG_PLE_CPU_PG_INFO);
++	pg_flow_ctrl[6] = mt76_rr(dev, MT_DBG_PLE_PG_HIF_TXCMD_GROUP);
++	pg_flow_ctrl[7] = mt76_rr(dev, MT_DBG_PLE_HIF_TXCMD_PG_INFO);
++	chip_get_dis_sta_map(dev, dis_sta_map);
++	chip_get_sta_pause(dev, sta_pause);
++
++	seq_printf(s, "PLE Configuration Info:\n");
++	seq_printf(s, "\tPacket Buffer Control(0x%x): 0x%08x\n",
++		      MT_DBG_PLE_PBUF_CTRL_ADDR, ple_buf_ctrl);
++
++	pg_sz = FIELD_GET(MT_DBG_PLE_PBUF_CTRL_PAGE_SIZE_MASK, ple_buf_ctrl);
++	seq_printf(s, "\t\tPage Size=%d(%d bytes per page)\n",
++		       pg_sz, (pg_sz == 1 ? 128 : 64));
++	seq_printf(s, "\t\tPage Offset=%ld(in unit of 2KB)\n",
++		        FIELD_GET(MT_DBG_PLE_PBUF_CTRL_OFFSET_MASK, ple_buf_ctrl));
++
++	pg_num = FIELD_GET(MT_DBG_PLE_PBUF_CTRL_TOTAL_PAGE_NUM_MASK, ple_buf_ctrl);
++	seq_printf(s, "\t\tTotal Page=%d pages\n", pg_num);
++
++	/* Page Flow Control */
++	seq_printf(s, "PLE Page Flow Control:\n");
++	seq_printf(s, "\tFree page counter(0x%x): 0x%08x\n",
++		      MT_DBG_PLE_FREEPG_CNT, pg_flow_ctrl[0]);
++	fpg_cnt = FIELD_GET(MT_DBG_PLE_FREEPG_CNT_FREEPG_CNT_MASK, pg_flow_ctrl[0]);
++
++	seq_printf(s, "\t\tThe toal page number of free=0x%03x\n", fpg_cnt);
++	ffa_cnt = FIELD_GET(MT_DBG_PLE_FREEPG_CNT_FFA_CNT_MASK, pg_flow_ctrl[0]);
++
++	seq_printf(s, "\t\tThe free page numbers of free for all=0x%03x\n", ffa_cnt);
++	seq_printf(s, "\tFree page head and tail(0x%x): 0x%08x\n",
++	              MT_DBG_PLE_FREEPG_HEAD_TAIL, pg_flow_ctrl[1]);
++
++	fpg_head = FIELD_GET(MT_DBG_PLE_FREEPG_HEAD_TAIL_FREEPG_HEAD_MASK, pg_flow_ctrl[1]);
++	fpg_tail = FIELD_GET(MT_DBG_PLE_FREEPG_HEAD_TAIL_FREEPG_TAIL_MASK, pg_flow_ctrl[1]);
++	seq_printf(s, "\t\tThe tail/head page of free page list=0x%03x/0x%03x\n", fpg_tail, fpg_head);
++	seq_printf(s, "\tReserved page counter of HIF group(0x%x): 0x%08x\n",
++	              MT_DBG_PLE_PG_HIF_GROUP, pg_flow_ctrl[2]);
++	seq_printf(s, "\tHIF group page status(0x%x): 0x%08x\n",
++	              MT_DBG_PLE_HIF_PG_INFO, pg_flow_ctrl[3]);
++
++	hif_min_q = FIELD_GET(MT_DBG_PLE_PG_HIF_GROUP_HIF_MIN_QUOTA_MASK, pg_flow_ctrl[2]);
++	hif_max_q = FIELD_GET(MT_DBG_PLE_PG_HIF_GROUP_HIF_MAX_QUOTA_MASK, pg_flow_ctrl[2]);
++	seq_printf(s, "\t\tThe max/min quota pages of HIF group=0x%03x/0x%03x\n", hif_max_q, hif_min_q);
++
++	rpg_hif = FIELD_GET(MT_DBG_PLE_HIF_PG_INFO_HIF_RSV_CNT_MASK, pg_flow_ctrl[3]);
++	upg_hif = FIELD_GET(MT_DBG_PLE_HIF_PG_INFO_HIF_SRC_CNT_MASK, pg_flow_ctrl[3]);
++	seq_printf(s, "\t\tThe used/reserved pages of HIF group=0x%03x/0x%03x\n", upg_hif, rpg_hif);
++
++	seq_printf(s, "\tReserved page counter of HIF_TXCMD group(0x%x): 0x%08x\n",
++		      MT_DBG_PLE_PG_HIF_TXCMD_GROUP, pg_flow_ctrl[6]);
++	seq_printf(s, "\tHIF_TXCMD group page status(0x%x): 0x%08x\n",
++	              MT_DBG_PLE_HIF_TXCMD_PG_INFO, pg_flow_ctrl[7]);
++	cpu_min_q = FIELD_GET(MT_DBG_PLE_PG_HIF_TXCMD_GROUP_HIF_TXCMD_MIN_QUOTA_MASK, pg_flow_ctrl[6]);
++	cpu_max_q = FIELD_GET(MT_DBG_PLE_PG_HIF_TXCMD_GROUP_HIF_TXCMD_MIN_QUOTA_MASK, pg_flow_ctrl[6]);
++	seq_printf(s, "\t\tThe max/min quota pages of HIF_TXCMD group=0x%03x/0x%03x\n", cpu_max_q, cpu_min_q);
++
++	rpg_cpu = FIELD_GET(MT_DBG_PLE_TXCMD_PG_INFO_HIF_TXCMD_RSV_CNT_MASK, pg_flow_ctrl[7]);
++	upg_cpu = FIELD_GET(MT_DBG_PLE_TXCMD_PG_INFO_HIF_TXCMD_SRC_CNT_MASK, pg_flow_ctrl[7]);
++	seq_printf(s, "\t\tThe used/reserved pages of HIF_TXCMD group=0x%03x/0x%03x\n", upg_cpu, rpg_cpu);
++
++	seq_printf(s, "\tReserved page counter of CPU group(0x820c0150): 0x%08x\n", pg_flow_ctrl[4]);
++	seq_printf(s, "\tCPU group page status(0x820c0154): 0x%08x\n", pg_flow_ctrl[5]);
++	cpu_min_q = FIELD_GET(MT_DBG_PLE_PG_CPU_GROUP_CPU_MIN_QUOTA_MASK, pg_flow_ctrl[4]);
++	cpu_max_q = FIELD_GET(MT_DBG_PLE_PG_CPU_GROUP_CPU_MAX_QUOTA_MASK, pg_flow_ctrl[4]);
++	seq_printf(s, "\t\tThe max/min quota pages of CPU group=0x%03x/0x%03x\n", cpu_max_q, cpu_min_q);
++
++	rpg_cpu = FIELD_GET(MT_DBG_PLE_CPU_PG_INFO_CPU_RSV_CNT_MASK, pg_flow_ctrl[5]);
++	upg_cpu = FIELD_GET(MT_DBG_PLE_CPU_PG_INFO_CPU_SRC_CNT_MASK, pg_flow_ctrl[5]);
++	seq_printf(s, "\t\tThe used/reserved pages of CPU group=0x%03x/0x%03x\n", upg_cpu, rpg_cpu);
++
++	if ((ple_stat[0] & MT_DBG_PLE_Q_EMPTY_ALL_AC_EMPTY_MASK) == 0) {
++		for (j = 0; j < all_ac_num; j++) {
++			if (j % ac_num == 0) {
++				seq_printf(s, "\n\tNonempty AC%d Q of STA#: ", j / ac_num);
++			}
++
++			for (i = 0; i < all_ac_num; i++) {
++				if (((ple_stat[j + 1] & (0x1 << i)) >> i) == 0) {
++					seq_printf(s, "%d ", i + (j % ac_num) * 32);
++				}
++			}
++		}
++
++		seq_printf(s, "\n");
++	}
++
++	seq_printf(s, "non-native/native txcmd queue empty = %d/%d\n", ple_txcmd_stat, ple_native_txcmd_stat);
++
++	seq_printf(s, "Nonempty Q info:\n");
++
++	for (i = 0; i < all_ac_num; i++) {
++		if (((ple_stat[0] & (0x1 << i)) >> i) == 0) {
++			u32 hfid, tfid, pktcnt, fl_que_ctrl[3] = {0};
++
++			if (ple_queue_empty_info[i].QueueName != NULL) {
++				seq_printf(s, "\t%s: ", ple_queue_empty_info[i].QueueName);
++				fl_que_ctrl[0] |= MT_DBG_PLE_FL_QUE_CTRL0_EXECUTE_MASK;
++				fl_que_ctrl[0] |= (ple_queue_empty_info[i].Portid << MT_PLE_FL_QUE_CTRL0_Q_BUF_PID_SHFT);
++				fl_que_ctrl[0] |= (ple_queue_empty_info[i].Queueid << MT_PLE_FL_QUE_CTRL0_Q_BUF_QID_SHFT);
++			} else
++				continue;
++
++			if (ple_queue_empty_info[i].Queueid >= ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_0 &&
++				ple_queue_empty_info[i].Queueid <= ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_0)
++				/* band0 set TGID 0, bit31 = 0 */
++				mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL1, 0x0);
++			else if (ple_queue_empty_info[i].Queueid >= ENUM_UMAC_LMAC_PLE_TX_Q_ALTX_1 &&
++				ple_queue_empty_info[i].Queueid <= ENUM_UMAC_LMAC_PLE_TX_Q_PSMP_1)
++				/* band1 set TGID 1, bit31 = 1 */
++				mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL1, 0x80000000);
++
++			mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL0, fl_que_ctrl[0]);
++			fl_que_ctrl[1] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL2);
++			fl_que_ctrl[2] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL3);
++			hfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_HEAD_FID_MASK, fl_que_ctrl[1]);
++			tfid = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL2_Q_TAIL_FID_MASK, fl_que_ctrl[1]);
++			pktcnt = FIELD_GET(MT_DBG_PLE_FL_QUE_CTRL3_Q_PKT_NUM_MASK, fl_que_ctrl[2]);
++			seq_printf(s, "tail/head fid = 0x%03x/0x%03x, pkt cnt = 0x%03x\n",
++				      tfid, hfid, pktcnt);
++
++			/* TODO */
++			//if (pktcnt > 0 && dumptxd > 0)
++			//	ShowTXDInfo(pAd, hfid);
++		}
++	}
++
++	chip_show_sta_acq_info(s, dev, ple_stat, sta_pause, dis_sta_map, 0/*dumptxd*/);
++	chip_show_txcmdq_info(s, dev, ple_native_txcmd_stat);
++
++	return 0;
++}
++
++typedef enum _ENUM_UMAC_PLE_CTRL_P3_QUEUE_T {
++	ENUM_UMAC_PLE_CTRL_P3_Q_0X1E            = 0x1e,
++	ENUM_UMAC_PLE_CTRL_P3_Q_0X1F            = 0x1f,
++	ENUM_UMAC_PLE_CTRL_P3_TOTAL_NUM         = 2
++} ENUM_UMAC_PLE_CTRL_P3_QUEUE_T, *P_ENUM_UMAC_PLE_CTRL_P3_QUEUE_T;
++
++static EMPTY_QUEUE_INFO_T pse_queue_empty_info[] = {
++	{"CPU Q0",  ENUM_UMAC_CPU_PORT_1,     ENUM_UMAC_CTX_Q_0},
++	{"CPU Q1",  ENUM_UMAC_CPU_PORT_1,     ENUM_UMAC_CTX_Q_1},
++	{"CPU Q2",  ENUM_UMAC_CPU_PORT_1,     ENUM_UMAC_CTX_Q_2},
++	{"CPU Q3",  ENUM_UMAC_CPU_PORT_1,     ENUM_UMAC_CTX_Q_3},
++	{NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, /* 4~7 not defined */
++	{"HIF Q0", ENUM_UMAC_HIF_PORT_0,    0}, /* Q8 */
++	{"HIF Q1", ENUM_UMAC_HIF_PORT_0,    1},
++	{"HIF Q2", ENUM_UMAC_HIF_PORT_0,    2},
++	{"HIF Q3", ENUM_UMAC_HIF_PORT_0,    3},
++	{"HIF Q4", ENUM_UMAC_HIF_PORT_0,    4},
++	{"HIF Q5", ENUM_UMAC_HIF_PORT_0,    5},
++	{NULL, 0, 0}, {NULL, 0, 0},  /* 14~15 not defined */
++	{"LMAC Q",  ENUM_UMAC_LMAC_PORT_2,    0},
++	{"MDP TX Q", ENUM_UMAC_LMAC_PORT_2, 1},
++	{"MDP RX Q", ENUM_UMAC_LMAC_PORT_2, 2},
++	{"SEC TX Q", ENUM_UMAC_LMAC_PORT_2, 3},
++	{"SEC RX Q", ENUM_UMAC_LMAC_PORT_2, 4},
++	{"SFD_PARK Q", ENUM_UMAC_LMAC_PORT_2, 5},
++	{"MDP_TXIOC Q", ENUM_UMAC_LMAC_PORT_2, 6},
++	{"MDP_RXIOC Q", ENUM_UMAC_LMAC_PORT_2, 7},
++	{NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, {NULL, 0, 0}, /* 24~30 not defined */
++	{"RLS Q",  ENUM_PLE_CTRL_PSE_PORT_3, ENUM_UMAC_PLE_CTRL_P3_Q_0X1F}
++};
++
++static int mt7915_pseinfo_read(struct seq_file *s, void *data)
++{
++	struct mt7915_dev *dev = dev_get_drvdata(s->private);
++	u32 pse_buf_ctrl, pg_sz, pg_num;
++	u32 pse_stat, pg_flow_ctrl[22] = {0};
++	u32 fpg_cnt, ffa_cnt, fpg_head, fpg_tail;
++	u32 max_q, min_q, rsv_pg, used_pg;
++	int i;
++
++	pse_buf_ctrl     = mt76_rr(dev, MT_DBG_PSE_PBUF_CTRL);
++	pse_stat         = mt76_rr(dev, MT_DBG_PSE_QUEUE_EMPTY);
++	pg_flow_ctrl[0]  = mt76_rr(dev, MT_DBG_PSE_FREEPG_CNT);
++	pg_flow_ctrl[1]  = mt76_rr(dev, MT_DBG_PSE_FREEPG_HEAD_TAIL);
++	pg_flow_ctrl[2]  = mt76_rr(dev, MT_DBG_PSE_PG_HIF0_GROUP);
++	pg_flow_ctrl[3]  = mt76_rr(dev, MT_DBG_PSE_HIF0_PG_INFO);
++	pg_flow_ctrl[4]  = mt76_rr(dev, MT_DBG_PSE_PG_HIF1_GROUP);
++	pg_flow_ctrl[5]  = mt76_rr(dev, MT_DBG_PSE_HIF1_PG_INFO);
++	pg_flow_ctrl[6]  = mt76_rr(dev, MT_DBG_PSE_PG_CPU_GROUP);
++	pg_flow_ctrl[7]  = mt76_rr(dev, MT_DBG_PSE_CPU_PG_INFO);
++	pg_flow_ctrl[8]  = mt76_rr(dev, MT_DBG_PSE_PG_LMAC0_GROUP);
++	pg_flow_ctrl[9]  = mt76_rr(dev, MT_DBG_PSE_LMAC0_PG_INFO);
++	pg_flow_ctrl[10] = mt76_rr(dev, MT_DBG_PSE_PG_LMAC1_GROUP);
++	pg_flow_ctrl[11] = mt76_rr(dev, MT_DBG_PSE_LMAC1_PG_INFO);
++	pg_flow_ctrl[12] = mt76_rr(dev, MT_DBG_PSE_PG_LMAC2_GROUP);
++	pg_flow_ctrl[13] = mt76_rr(dev, MT_DBG_PSE_LMAC2_PG_INFO);
++	pg_flow_ctrl[14] = mt76_rr(dev, MT_DBG_PSE_PG_PLE_GROUP);
++	pg_flow_ctrl[15] = mt76_rr(dev, MT_DBG_PSE_PLE_PG_INFO);
++	pg_flow_ctrl[16] = mt76_rr(dev, MT_DBG_PSE_PG_LMAC3_GROUP);
++	pg_flow_ctrl[17] = mt76_rr(dev, MT_DBG_PSE_LMAC3_PG_INFO);
++	pg_flow_ctrl[18] = mt76_rr(dev, MT_DBG_PSE_PG_MDP_GROUP);
++	pg_flow_ctrl[19] = mt76_rr(dev, MT_DBG_PSE_MDP_PG_INFO);
++	pg_flow_ctrl[20] = mt76_rr(dev, MT_DBG_PSE_PG_PLE1_GROUP);
++	pg_flow_ctrl[21] = mt76_rr(dev,MT_DBG_PSE_PLE1_PG_INFO);
++
++	/* Configuration Info */
++	seq_printf(s, "PSE Configuration Info:\n");
++	seq_printf(s, "\tPacket Buffer Control(0x82068014): 0x%08x\n", pse_buf_ctrl);
++	pg_sz = FIELD_GET(MT_DBG_PSE_PBUF_CTRL_PAGE_SIZE_CFG_MASK, pse_buf_ctrl);
++
++	seq_printf(s, "\t\tPage Size=%d(%d bytes per page)\n", pg_sz, (pg_sz == 1 ? 256 : 128));
++	seq_printf(s, "\t\tPage Offset=%ld(in unit of 64KB)\n",
++			 FIELD_GET(MT_DBG_PSE_PBUF_CTRL_PBUF_OFFSET_MASK, pse_buf_ctrl));
++	pg_num = FIELD_GET(MT_DBG_PSE_PBUF_CTRL_TOTAL_PAGE_NUM_MASK, pse_buf_ctrl);
++
++	seq_printf(s, "\t\tTotal page numbers=%d pages\n", pg_num);
++
++	/* Page Flow Control */
++	seq_printf(s, "PSE Page Flow Control:\n");
++	seq_printf(s, "\tFree page counter(0x82068100): 0x%08x\n", pg_flow_ctrl[0]);
++	fpg_cnt = FIELD_GET(MT_DBG_PSE_FREEPG_CNT_FREEPG_CNT_MASK, pg_flow_ctrl[0]);
++	seq_printf(s, "\t\tThe toal page number of free=0x%03x\n", fpg_cnt);
++
++	ffa_cnt =  FIELD_GET(MT_DBG_PSE_FREEPG_CNT_FFA_CNT_MASK, pg_flow_ctrl[0]);
++	seq_printf(s, "\t\tThe free page numbers of free for all=0x%03x\n", ffa_cnt);
++
++	seq_printf(s, "\tFree page head and tail(0x82068104): 0x%08x\n", pg_flow_ctrl[1]);
++	fpg_head =  FIELD_GET(MT_DBG_PSE_FREEPG_HEAD_TAIL_FREEPG_HEAD_MASK, pg_flow_ctrl[1]);
++
++	fpg_tail = FIELD_GET(MT_DBG_PSE_FREEPG_HEAD_TAIL_FREEPG_TAIL_MASK, pg_flow_ctrl[1]);
++	seq_printf(s, "\t\tThe tail/head page of free page list=0x%03x/0x%03x\n", fpg_tail, fpg_head);
++	seq_printf(s, "\tReserved page counter of HIF0 group(0x82068110): 0x%08x\n", pg_flow_ctrl[2]);
++	seq_printf(s, "\tHIF0 group page status(0x82068114): 0x%08x\n", pg_flow_ctrl[3]);
++	min_q = FIELD_GET(MT_DBG_PSE_PG_HIF0_GROUP_HIF0_MIN_QUOTA_MASK, pg_flow_ctrl[2]);
++	max_q =  FIELD_GET(MT_DBG_PSE_PG_HIF0_GROUP_HIF0_MAX_QUOTA_MASK, pg_flow_ctrl[2]);
++	seq_printf(s, "\t\tThe max/min quota pages of HIF0 group=0x%03x/0x%03x\n", max_q, min_q);
++	rsv_pg = FIELD_GET(MT_DBG_PSE_HIF0_PG_INFO_HIF0_RSV_CNT_MASK, pg_flow_ctrl[3]);;
++	used_pg = FIELD_GET(MT_DBG_PSE_HIF0_PG_INFO_HIF0_SRC_CNT_MASK, pg_flow_ctrl[3]);
++	seq_printf(s, "\t\tThe used/reserved pages of HIF0 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
++	seq_printf(s, "\tReserved page counter of HIF1 group(0x82068118): 0x%08x\n", pg_flow_ctrl[4]);
++	seq_printf(s, "\tHIF1 group page status(0x8206811c): 0x%08x\n", pg_flow_ctrl[5]);
++	min_q = FIELD_GET(MT_DBG_PSE_PG_HIF1_GROUP_HIF1_MIN_QUOTA_MASK, pg_flow_ctrl[4]);
++	max_q = FIELD_GET(MT_DBG_PSE_PG_HIF1_GROUP_HIF1_MAX_QUOTA_MASK, pg_flow_ctrl[4]);
++	seq_printf(s, "\t\tThe max/min quota pages of HIF1 group=0x%03x/0x%03x\n", max_q, min_q);
++	rsv_pg = FIELD_GET(MT_DBG_PSE_HIF1_PG_INFO_HIF1_RSV_CNT_MASK, pg_flow_ctrl[5]);
++	used_pg = FIELD_GET(MT_DBG_PSE_HIF1_PG_INFO_HIF1_SRC_CNT_MASK, pg_flow_ctrl[5]);
++
++	seq_printf(s, "\t\tThe used/reserved pages of HIF1 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
++	seq_printf(s, "\tReserved page counter of CPU group(0x82068150): 0x%08x\n", pg_flow_ctrl[6]);
++	seq_printf(s, "\tCPU group page status(0x82068154): 0x%08x\n", pg_flow_ctrl[7]);
++	min_q = FIELD_GET(MT_DBG_PSE_PG_CPU_GROUP_CPU_MIN_QUOTA_MASK, pg_flow_ctrl[6]);
++	max_q = FIELD_GET(MT_DBG_PSE_PG_CPU_GROUP_CPU_MAX_QUOTA_MASK, pg_flow_ctrl[6]);
++	seq_printf(s, "\t\tThe max/min quota pages of CPU group=0x%03x/0x%03x\n", max_q, min_q);
++	rsv_pg = FIELD_GET(MT_DBG_PSE_CPU_PG_INFO_CPU_RSV_CNT_MASK, pg_flow_ctrl[7]);
++	used_pg = FIELD_GET(MT_DBG_PSE_CPU_PG_INFO_CPU_SRC_CNT_MASK, pg_flow_ctrl[7]);
++	seq_printf(s, "\t\tThe used/reserved pages of CPU group=0x%03x/0x%03x\n", used_pg, rsv_pg);
++	seq_printf(s, "\tReserved page counter of LMAC0 group(0x82068170): 0x%08x\n", pg_flow_ctrl[8]);
++	seq_printf(s, "\tLMAC0 group page status(0x82068174): 0x%08x\n", pg_flow_ctrl[9]);
++	min_q = FIELD_GET(MT_DBG_PSE_PG_LMAC0_GROUP_LMAC0_MIN_QUOTA_MASK, pg_flow_ctrl[8]);
++	max_q = FIELD_GET(MT_DBG_PSE_PG_LMAC0_GROUP_LMAC0_MAX_QUOTA_MASK, pg_flow_ctrl[8]);
++	seq_printf(s, "\t\tThe max/min quota pages of LMAC0 group=0x%03x/0x%03x\n", max_q, min_q);
++	rsv_pg = FIELD_GET(MT_DBG_PSE_LMAC0_PG_INFO_LMAC0_RSV_CNT_MASK, pg_flow_ctrl[9]);
++	used_pg = FIELD_GET(MT_DBG_PSE_LMAC0_PG_INFO_LMAC0_SRC_CNT_MASK, pg_flow_ctrl[9]);
++	seq_printf(s, "\t\tThe used/reserved pages of LMAC0 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
++	seq_printf(s, "\tReserved page counter of LMAC1 group(0x82068178): 0x%08x\n", pg_flow_ctrl[10]);
++	seq_printf(s, "\tLMAC1 group page status(0x8206817c): 0x%08x\n", pg_flow_ctrl[11]);
++	min_q = FIELD_GET(MT_DBG_TOP_PG_LMAC1_GROUP_LMAC1_MIN_QUOTA_MASK, pg_flow_ctrl[10]);
++	max_q = FIELD_GET(MT_DBG_PSE_PG_LMAC1_GROUP_LMAC1_MAX_QUOTA_MASK, pg_flow_ctrl[10]);
++	seq_printf(s, "\t\tThe max/min quota pages of LMAC1 group=0x%03x/0x%03x\n", max_q, min_q);
++	rsv_pg = FIELD_GET(MT_DBG_PSE_LMAC1_PG_INFO_LMAC1_RSV_CNT_MASK, pg_flow_ctrl[11]);
++	used_pg = FIELD_GET(MT_DBG_PSE_LMAC1_PG_INFO_LMAC1_SRC_CNT_MASK, pg_flow_ctrl[11]);
++	seq_printf(s, "\t\tThe used/reserved pages of LMAC1 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
++	seq_printf(s, "\tReserved page counter of LMAC2 group(0x82068180): 0x%08x\n", pg_flow_ctrl[11]);
++	seq_printf(s, "\tLMAC2 group page status(0x82068184): 0x%08x\n", pg_flow_ctrl[12]);
++	min_q = FIELD_GET(MT_DBG_PSE_PG_LMAC2_GROUP_LMAC2_MIN_QUOTA_MASK, pg_flow_ctrl[12]);
++	max_q = FIELD_GET(MT_DBG_PSE_PG_LMAC2_GROUP_LMAC2_MAX_QUOTA_MASK, pg_flow_ctrl[12]);
++	seq_printf(s, "\t\tThe max/min quota pages of LMAC2 group=0x%03x/0x%03x\n", max_q, min_q);
++	rsv_pg = FIELD_GET(MT_DBG_PSE_LMAC2_PG_INFO_LMAC2_RSV_CNT_MASK, pg_flow_ctrl[13]);
++	used_pg = FIELD_GET(MT_DBG_PSE_LMAC2_PG_INFO_LMAC2_SRC_CNT_MASK, pg_flow_ctrl[13]);
++	seq_printf(s, "\t\tThe used/reserved pages of LMAC2 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
++
++	seq_printf(s, "\tReserved page counter of LMAC3 group(0x82068188): 0x%08x\n", pg_flow_ctrl[16]);
++	seq_printf(s, "\tLMAC3 group page status(0x8206818c): 0x%08x\n", pg_flow_ctrl[17]);
++	min_q = FIELD_GET(MT_DBG_TOP_PG_LMAC3_GROUP_LMAC3_MIN_QUOTA_MASK, pg_flow_ctrl[16]);
++	max_q = FIELD_GET(MT_DBG_PSE_PG_LMAC3_GROUP_LMAC3_MAX_QUOTA_MASK, pg_flow_ctrl[16]);
++	seq_printf(s, "\t\tThe max/min quota pages of LMAC3 group=0x%03x/0x%03x\n", max_q, min_q);
++	rsv_pg = FIELD_GET(MT_DBG_PSE_LMAC3_PG_INFO_LMAC3_RSV_CNT_MASK, pg_flow_ctrl[17]);
++	used_pg = FIELD_GET(MT_DBG_PSE_LMAC3_PG_INFO_LMAC3_SRC_CNT_MASK, pg_flow_ctrl[17]);
++	seq_printf(s, "\t\tThe used/reserved pages of LMAC3 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
++
++	seq_printf(s, "\tReserved page counter of PLE group(0x82068160): 0x%08x\n", pg_flow_ctrl[14]);
++	seq_printf(s, "\tPLE group page status(0x82068164): 0x%08x\n", pg_flow_ctrl[15]);
++	min_q = FIELD_GET(MT_DBG_PSE_PG_PLE_GROUP_PLE_MIN_QUOTA_MASK, pg_flow_ctrl[14]);
++	max_q = FIELD_GET(MT_DBG_PSE_PG_PLE_GROUP_PLE_MAX_QUOTA_MASK, pg_flow_ctrl[14]);
++	seq_printf(s, "\t\tThe max/min quota pages of PLE group=0x%03x/0x%03x\n", max_q, min_q);
++	rsv_pg = FIELD_GET(MT_DBG_PSE_PLE_PG_INFO_PLE_RSV_CNT_MASK, pg_flow_ctrl[15]);
++	used_pg = FIELD_GET(MT_DBG_PSE_PLE_PG_INFO_PLE_SRC_CNT_MASK, pg_flow_ctrl[15]);
++	seq_printf(s, "\t\tThe used/reserved pages of PLE group=0x%03x/0x%03x\n", used_pg, rsv_pg);
++
++	seq_printf(s, "\tReserved page counter of PLE1 group(0x82068168): 0x%08x\n", pg_flow_ctrl[14]);
++	seq_printf(s, "\tPLE1 group page status(0x8206816c): 0x%08x\n", pg_flow_ctrl[15]);
++	min_q = FIELD_GET(MT_DBG_PSE_PG_PLE_GROUP_PLE_MIN_QUOTA_MASK, pg_flow_ctrl[20]);
++	max_q = FIELD_GET(MT_DBG_PSE_PG_PLE_GROUP_PLE_MAX_QUOTA_MASK, pg_flow_ctrl[20]);
++	seq_printf(s, "\t\tThe max/min quota pages of PLE1 group=0x%03x/0x%03x\n", max_q, min_q);
++	rsv_pg = FIELD_GET(MT_DBG_PSE_PLE_PG_INFO_PLE_RSV_CNT_MASK, pg_flow_ctrl[21]);
++	used_pg = FIELD_GET(MT_DBG_PSE_PLE_PG_INFO_PLE_SRC_CNT_MASK, pg_flow_ctrl[21]);
++	seq_printf(s, "\t\tThe used/reserved pages of PLE1 group=0x%03x/0x%03x\n", used_pg, rsv_pg);
++
++	seq_printf(s, "\tReserved page counter of MDP group(0x82068198): 0x%08x\n", pg_flow_ctrl[18]);
++	seq_printf(s, "\tMDP group page status(0x8206819c): 0x%08x\n", pg_flow_ctrl[19]);
++	min_q = FIELD_GET(MT_DBG_PSE_PG_MDP_GROUP_MDP_MIN_QUOTA_MASK, pg_flow_ctrl[18]);
++	max_q = FIELD_GET(MT_DBG_PSE_PG_MDP_GROUP_MDP_MAX_QUOTA_MASK, pg_flow_ctrl[18]);
++	seq_printf(s, "\t\tThe max/min quota pages of MDP group=0x%03x/0x%03x\n", max_q, min_q);
++	rsv_pg = FIELD_GET(MT_DBG_PSE_MDP_PG_INFO_MDP_RSV_CNT_MASK, pg_flow_ctrl[19]);
++	used_pg = FIELD_GET(MT_DBG_PSE_MDP_PG_INFO_MDP_SRC_CNT_MASK, pg_flow_ctrl[19]);
++	seq_printf(s, "\t\tThe used/reserved pages of MDP group=0x%03x/0x%03x\n", used_pg, rsv_pg);
++
++	/* Queue Empty Status */
++	seq_printf(s, "PSE Queue Empty Status:\n");
++	seq_printf(s, "\tQUEUE_EMPTY(0x820680b0): 0x%08x\n", pse_stat);
++	seq_printf(s, "\t\tCPU Q0/1/2/3 empty=%ld/%ld/%ld/%ld\n",
++			 FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_CPU_Q0_EMPTY_MASK, pse_stat),
++			 FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_CPU_Q1_EMPTY_MASK, pse_stat),
++			 FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_CPU_Q2_EMPTY_MASK, pse_stat),
++			 FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_CPU_Q3_EMPTY_MASK, pse_stat));
++
++	seq_printf(s, "\t\tHIF Q0/1/2/3/4/5 empty=%ld/%ld/%ld/%ld/%ld/%ld\n",
++			 FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_HIF_0_EMPTY_MASK, pse_stat),
++			 FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_HIF_1_EMPTY_MASK, pse_stat),
++			 FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_HIF_2_EMPTY_MASK, pse_stat),
++			 FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_HIF_3_EMPTY_MASK, pse_stat),
++			 FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_HIF_4_EMPTY_MASK, pse_stat),
++			 FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_HIF_5_EMPTY_MASK, pse_stat));
++
++	seq_printf(s, "\t\tLMAC TX Q empty=%ld\n",
++			FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_LMAC_TX_QUEUE_EMPTY_MASK, pse_stat));
++	seq_printf(s, "\t\tMDP TX Q/RX Q empty=%ld/%ld\n",
++			FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_MDP_TX_QUEUE_EMPTY_MASK, pse_stat),
++			FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_MDP_RX_QUEUE_EMPTY_MASK, pse_stat));
++	seq_printf(s, "\t\tSEC TX Q/RX Q empty=%ld/%ld\n",
++			FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_SEC_TX_QUEUE_EMPTY_MASK, pse_stat),
++			FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_SEC_RX_QUEUE_EMPTY_SHFT, pse_stat));
++	seq_printf(s, "\t\tSFD PARK Q empty=%ld\n",
++			FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_SFD_PARK_QUEUE_EMPTY_MASK, pse_stat));
++	seq_printf(s, "\t\tMDP TXIOC Q/RXIOC Q empty=%ld/%ld\n",
++			FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_MDP_TXIOC_QUEUE_EMPTY_MASK, pse_stat),
++			FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_MDP_RXIOC_QUEUE_EMPTY_MASK, pse_stat));
++	seq_printf(s, "\t\tRLS Q empty=%ld\n",
++		FIELD_GET(MT_DBG_PSE_QUEUE_EMPTY_RLS_Q_EMTPY_MASK, pse_stat));
++	seq_printf(s, "Nonempty Q info:\n");
++
++	for (i = 0; i < 31; i++) {
++		if (((pse_stat & (0x1 << i)) >> i) == 0) {
++			u32 hfid, tfid, pktcnt, fl_que_ctrl[3] = {0};
++
++			if (pse_queue_empty_info[i].QueueName != NULL) {
++				seq_printf(s, "\t%s: ", pse_queue_empty_info[i].QueueName);
++				fl_que_ctrl[0] |= MT_DBG_PSE_FL_QUE_CTRL_0_EXECUTE_MASK;
++				fl_que_ctrl[0] |= (pse_queue_empty_info[i].Portid << MT_DBG_PSE_FL_QUE_CTRL_0_Q_BUF_PID_SHFT);
++				fl_que_ctrl[0] |= (pse_queue_empty_info[i].Queueid << MT_DBG_PSE_FL_QUE_CTRL_0_Q_BUF_QID_SHFT);
++			} else
++				continue;
++
++			fl_que_ctrl[0] |= (0x1 << 31);
++
++			mt76_wr(dev,  MT_DBG_PSE_FL_QUE_CTRL_0_ADDR, fl_que_ctrl[0]);
++			fl_que_ctrl[1] = mt76_rr(dev, MT_DBG_PSE_FL_QUE_CTRL_2_ADDR);
++			fl_que_ctrl[2] = mt76_rr(dev, MT_DBG_PSE_FL_QUE_CTRL_3_ADDR);
++
++			hfid = FIELD_GET(MT_DBG_PSE_FL_QUE_CTRL_2_QUEUE_HEAD_FID_MASK, fl_que_ctrl[1]);
++			tfid = FIELD_GET(MT_DBG_PSE_FL_QUE_CTRL_2_QUEUE_TAIL_FID_MASK, fl_que_ctrl[1]);
++			pktcnt = FIELD_GET(MT_DBG_PSE_FL_QUE_CTRL_3_QUEUE_PKT_NUM_MASK, fl_que_ctrl[2]);
++			seq_printf(s, "tail/head fid = 0x%03x/0x%03x, pkt cnt = 0x%03x\n",
++					  tfid, hfid, pktcnt);
++		}
++	}
++
++	return 0;
++}
++
++static int mt7915_mibinfo_read_per_band(struct seq_file *s, int band_idx)
++{
++#define BSS_NUM	4
++	struct mt7915_dev *dev = dev_get_drvdata(s->private);
++	u32 mac_val0, mac_val, mac_val1, idx, band_offset = 0;
++	u32 msdr6, msdr7, msdr8, msdr9, msdr10, msdr16, msdr17, msdr18, msdr19, msdr20, msdr21;
++	u32 mbxsdr[BSS_NUM][7];
++	u32 mbtcr[16], mbtbcr[16], mbrcr[16], mbrbcr[16];
++	u32 btcr[BSS_NUM], btbcr[BSS_NUM], brcr[BSS_NUM], brbcr[BSS_NUM], btdcr[BSS_NUM], brdcr[BSS_NUM];
++	u32 mu_cnt[5];
++	u32 ampdu_cnt[3];
++	unsigned long per;
++
++	seq_printf(s, "Band %d MIB Status\n", band_idx);
++	seq_printf(s, "===============================\n");
++	mac_val = mt76_rr(dev, MT_DBG_MIB_M0SCR0(band_idx));
++	seq_printf(s, "MIB Status Control=0x%x\n", mac_val);
++	if (is_mt7915(&dev->mt76)) {
++		mac_val = mt76_rr(dev, MT_DBG_MIB_M0PBSCR(band_idx));
++		seq_printf(s, "MIB Per-BSS Status Control=0x%x\n", mac_val);
++	}
++
++	msdr6 = mt76_rr(dev, MT_DBG_MIB_M0SDR6(band_idx));
++	msdr7 = mt76_rr(dev, MT_DBG_MIB_M0SDR7(band_idx));
++	msdr8 = mt76_rr(dev, MT_DBG_MIB_M0SDR8(band_idx));
++	msdr9 = mt76_rr(dev, MT_DBG_MIB_M0SDR9(band_idx));
++	msdr10 = mt76_rr(dev, MT_DBG_MIB_M0SDR10(band_idx));
++	msdr16 = mt76_rr(dev, MT_DBG_MIB_M0SDR16(band_idx));
++	msdr17 = mt76_rr(dev, MT_DBG_MIB_M0SDR17(band_idx));
++	msdr18 = mt76_rr(dev, MT_DBG_MIB_M0SDR18(band_idx));
++	msdr19 = mt76_rr(dev, MT_DBG_MIB_M0SDR19(band_idx));
++	msdr20 = mt76_rr(dev, MT_DBG_MIB_M0SDR20(band_idx));
++	msdr21 = mt76_rr(dev, MT_DBG_MIB_M0SDR21(band_idx));
++	ampdu_cnt[0] = mt76_rr(dev, MT_DBG_MIB_M0SDR12(band_idx));
++	ampdu_cnt[1] = mt76_rr(dev, MT_DBG_MIB_M0SDR14(band_idx));
++	ampdu_cnt[2] = mt76_rr(dev, MT_DBG_MIB_M0SDR15(band_idx));
++	ampdu_cnt[1] &= MT_DBG_MIB_M0SDR14_AMPDU_MASK;
++	ampdu_cnt[2] &= MT_DBG_MIB_M0SDR15_AMPDU_ACKED_MASK;
++
++	seq_printf(s, "===Phy/Timing Related Counters===\n");
++	seq_printf(s, "\tChannelIdleCnt=0x%x\n", msdr6 & BN0_WF_MIB_TOP_M0SDR6_CHANNEL_IDLE_COUNT_MASK);
++	seq_printf(s, "\tCCA_NAV_Tx_Time=0x%x\n", msdr9 & BN0_WF_MIB_TOP_M0SDR9_CCA_NAV_TX_TIME_MASK);
++	seq_printf(s, "\tRx_MDRDY_CNT=0x%lx\n", msdr10 & MT_DBG_MIB_M0SDR10_RX_MDRDY_COUNT_MASK);
++	seq_printf(s, "\tCCK_MDRDY_TIME=0x%x, OFDM_MDRDY_TIME=0x%x, OFDM_GREEN_MDRDY_TIME=0x%x\n",
++			 msdr19 & BN0_WF_MIB_TOP_M0SDR19_CCK_MDRDY_TIME_MASK,
++			 msdr20 & BN0_WF_MIB_TOP_M0SDR20_OFDM_LG_MIXED_VHT_MDRDY_TIME_MASK,
++			 msdr21 & BN0_WF_MIB_TOP_M0SDR21_OFDM_GREEN_MDRDY_TIME_MASK);
++	seq_printf(s, "\tPrim CCA Time=0x%x\n", msdr16 & BN0_WF_MIB_TOP_M0SDR16_P_CCA_TIME_MASK);
++	seq_printf(s, "\tSec CCA Time=0x%x\n", msdr17 & BN0_WF_MIB_TOP_M0SDR17_S_CCA_TIME_MASK);
++	seq_printf(s, "\tPrim ED Time=0x%x\n", msdr18 & BN0_WF_MIB_TOP_M0SDR18_P_ED_TIME_MASK);
++
++	seq_printf(s, "===Tx Related Counters(Generic)===\n");
++	mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR0(band_idx));
++	dev->dbg.bcn_total_cnt[band_idx] += (mac_val & BN0_WF_MIB_TOP_M0SDR0_BEACONTXCOUNT_MASK);
++	seq_printf(s, "\tBeaconTxCnt=0x%x\n",dev->dbg.bcn_total_cnt[band_idx]);
++	dev->dbg.bcn_total_cnt[band_idx] = 0;
++	mac_val = mt76_rr(dev, MT_DBG_MIB_M0DR0(band_idx));
++	seq_printf(s, "\tTx 20MHz Cnt=0x%x\n", mac_val & BN0_WF_MIB_TOP_M0DR0_TX_20MHZ_CNT_MASK);
++	seq_printf(s, "\tTx 40MHz Cnt=0x%x\n", (mac_val & BN0_WF_MIB_TOP_M0DR0_TX_40MHZ_CNT_MASK) >> BN0_WF_MIB_TOP_M0DR0_TX_40MHZ_CNT_SHFT);
++	mac_val = mt76_rr(dev, MT_DBG_MIB_M0DR1(band_idx));
++	seq_printf(s, "\tTx 80MHz Cnt=0x%x\n", mac_val & BN0_WF_MIB_TOP_M0DR1_TX_80MHZ_CNT_MASK);
++	seq_printf(s, "\tTx 160MHz Cnt=0x%x\n", (mac_val & BN0_WF_MIB_TOP_M0DR1_TX_160MHZ_CNT_MASK) >> BN0_WF_MIB_TOP_M0DR1_TX_160MHZ_CNT_SHFT);
++	seq_printf(s, "\tAMPDU Cnt=0x%x\n", ampdu_cnt[0]);
++	seq_printf(s, "\tAMPDU MPDU Cnt=0x%x\n", ampdu_cnt[1]);
++	seq_printf(s, "\tAMPDU MPDU Ack Cnt=0x%x\n", ampdu_cnt[2]);
++	per = (ampdu_cnt[2] == 0 ? 0 : 1000 * (ampdu_cnt[1] - ampdu_cnt[2]) / ampdu_cnt[1]);
++	seq_printf(s, "\tAMPDU MPDU PER=%ld.%1ld%%\n", per / 10, per % 10);
++
++	seq_printf(s, "===MU Related Counters===\n");
++	mu_cnt[0] = mt76_rr(dev, MT_DBG_MIB_MUBF(band_idx));
++	mu_cnt[1] = mt76_rr(dev, MT_DBG_MIB_M0DR8(band_idx));
++	mu_cnt[2] = mt76_rr(dev, MT_DBG_MIB_M0DR9(band_idx));
++	mu_cnt[3] = mt76_rr(dev, MT_DBG_MIB_M0DR10(band_idx));
++	mu_cnt[4] = mt76_rr(dev, MT_DBG_MIB_M0DR11(band_idx));
++	seq_printf(s, "\tMUBF_TX_COUNT=0x%x\n", mu_cnt[0] & BN0_WF_MIB_TOP_M0SDR34_MUBF_TX_COUNT_MASK);
++	seq_printf(s, "\tMU_TX_MPDU_COUNT(Ok+Fail)=0x%x\n", mu_cnt[1]);
++	seq_printf(s, "\tMU_TX_OK_MPDU_COUNT=0x%x\n", mu_cnt[2]);
++	seq_printf(s, "\tMU_TO_SU_PPDU_COUNT=0x%x\n", mu_cnt[3] & BN0_WF_MIB_TOP_M0DR10_MU_FAIL_PPDU_CNT_MASK);
++	seq_printf(s, "\tSU_TX_OK_MPDU_COUNT=0x%x\n", mu_cnt[4]);
++
++	seq_printf(s, "===Rx Related Counters(Generic)===\n");
++	seq_printf(s, "\tVector Mismacth Cnt=0x%x\n", msdr7 & BN0_WF_MIB_TOP_M0SDR7_VEC_MISS_COUNT_MASK);
++	seq_printf(s, "\tDelimiter Fail Cnt=0x%x\n", msdr8 & BN0_WF_MIB_TOP_M0SDR8_DELIMITER_FAIL_COUNT_MASK);
++
++	mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR3(band_idx));
++	seq_printf(s, "\tRxFCSErrCnt=0x%lx\n", __DBG_FIELD_GET(DBG_MIB_RX_FCS_ERROR_COUNT, mac_val));
++	mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR4(band_idx));
++	seq_printf(s, "\tRxFifoFullCnt=0x%x\n", (mac_val & BN0_WF_MIB_TOP_M0SDR4_RX_FIFO_FULL_COUNT_MASK));
++	mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR11(band_idx));
++	seq_printf(s, "\tRxLenMismatch=0x%x\n", (mac_val & BN0_WF_MIB_TOP_M0SDR11_RX_LEN_MISMATCH_MASK));
++	mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR5(band_idx));
++	seq_printf(s, "\tRxMPDUCnt=0x%x\n", (mac_val & BN0_WF_MIB_TOP_M0SDR5_RX_MPDU_COUNT_MASK));
++	mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR22(band_idx));
++	seq_printf(s, "\tRx AMPDU Cnt=0x%x\n", mac_val);
++	/* TODO: shiang-MT7615, is MIB_M0SDR23 used for Rx total byte count for all or just AMPDU only??? */
++	mac_val = mt76_rr(dev, MT_DBG_MIB_M0SDR23(band_idx));
++	seq_printf(s, "\tRx Total ByteCnt=0x%x\n", mac_val);
++
++	if (is_mt7915(&dev->mt76)) {
++		band_offset = WF_WTBLON_TOP_B1BTCRn_ADDR - WF_WTBLON_TOP_B0BTCRn_ADDR;//check
++		seq_printf(s, "===Per-BSS Related Tx/Rx Counters===\n");
++		seq_printf(s, "BSS Idx   TxCnt/DataCnt  TxByteCnt  RxCnt/DataCnt  RxByteCnt\n");
++
++		for (idx = 0; idx < BSS_NUM; idx++) {
++			btcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0BTCRn_ADDR + band_offset + idx * 4);
++			btbcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0BTBCRn_ADDR + band_offset + idx * 4);
++			brcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0BRCRn_ADDR + band_offset + idx * 4);
++			brbcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0BRBCRn_ADDR + band_offset + idx * 4);
++			btdcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0BTDCRn_ADDR + band_offset + idx * 4);
++			brdcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0BRDCRn_ADDR + band_offset + idx * 4);
++		}
++
++		for (idx = 0; idx < BSS_NUM; idx++) {
++			seq_printf(s, "%d\t 0x%x/0x%x\t 0x%x \t 0x%x/0x%x \t 0x%x\n",
++				      idx, btcr[idx], btdcr[idx], btbcr[idx],
++				      brcr[idx], brdcr[idx], brbcr[idx]);
++		}
++
++		band_offset = (BN1_WF_MIB_TOP_BASE - BN0_WF_MIB_TOP_BASE) * band_idx;
++		seq_printf(s, "===Per-MBSS Related MIB Counters===\n");
++		seq_printf(s, "BSS Idx   RTSTx/RetryCnt  BAMissCnt  AckFailCnt  FrmRetry1/2/3Cnt\n");
++
++		for (idx = 0; idx < BSS_NUM; idx++) {
++			mbxsdr[idx][0] = mt76_rr(dev, BN0_WF_MIB_TOP_M0B0SDR0_ADDR + band_offset + idx * 0x10);
++			mbxsdr[idx][1] = mt76_rr(dev, BN0_WF_MIB_TOP_M0B0SDR1_ADDR + band_offset + idx * 0x10);
++			mbxsdr[idx][2] = mt76_rr(dev, BN0_WF_MIB_TOP_M0B0SDR2_ADDR + band_offset + idx * 0x10);
++			mbxsdr[idx][3] = mt76_rr(dev, BN0_WF_MIB_TOP_M0B0SDR3_ADDR + band_offset + idx * 0x10);
++		}
++
++		for (idx = 0; idx < BSS_NUM; idx++) {
++			seq_printf(s, "%d:\t0x%08x/0x%08x  0x%08x \t 0x%08x \t  0x%08x/0x%08x/0x%08x\n",
++				      idx, (mbxsdr[idx][0] & BN0_WF_MIB_TOP_M0B0SDR0_RTSTXCOUNT_MASK),
++				      (mbxsdr[idx][0] & BN0_WF_MIB_TOP_M0B0SDR0_RTSRETRYCOUNT_MASK) >> BN0_WF_MIB_TOP_M0B0SDR0_RTSRETRYCOUNT_SHFT,
++				      (mbxsdr[idx][1] & BN0_WF_MIB_TOP_M0B0SDR1_BAMISSCOUNT_MASK),
++				      (mbxsdr[idx][1] & BN0_WF_MIB_TOP_M0B0SDR1_ACKFAILCOUNT_MASK) >> BN0_WF_MIB_TOP_M0B0SDR1_ACKFAILCOUNT_SHFT,
++				      (mbxsdr[idx][2] & BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRYCOUNT_MASK),
++				      (mbxsdr[idx][2] & BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRY2COUNT_MASK) >> BN0_WF_MIB_TOP_M0B0SDR2_FRAMERETRY2COUNT_SHFT,
++				      (mbxsdr[idx][3] & BN0_WF_MIB_TOP_M0B0SDR3_FRAMERETRY3COUNT_MASK));
++		}
++
++		band_offset = WF_WTBLON_TOP_B1BTCRn_ADDR - WF_WTBLON_TOP_B0BTCRn_ADDR;
++		seq_printf(s, "===Per-MBSS Related Tx/Rx Counters===\n");
++		seq_printf(s, "MBSSIdx   TxCnt  TxByteCnt  RxCnt  RxByteCnt\n");
++
++		for (idx = 0; idx < 16; idx++) {
++			mbtcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0MBTCRn_ADDR + band_offset + idx * 4);
++			mbtbcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0MBTBCRn_ADDR + band_offset + idx * 4);
++			mbrcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0MBRCRn_ADDR + band_offset + idx * 4);
++			mbrbcr[idx] = mt76_rr(dev, WF_WTBLON_TOP_B0MBRBCRn_ADDR + band_offset + idx * 4);
++		}
++
++		for (idx = 0; idx < 16; idx++) {
++			seq_printf(s, "%d\t 0x%08x\t 0x%08x \t 0x%08x \t 0x%08x\n",
++						idx, mbtcr[idx], mbtbcr[idx], mbrcr[idx], mbrbcr[idx]);
++		}
++		return 0;
++	} else {
++		u32 btocr[BSS_NUM], mbtocr[16],mbrocr[16], brocr[BSS_NUM];
++		u8 bss_nums = BSS_NUM;
++
++		band_offset = (BN1_WF_MIB_TOP_BTOCR_ADDR - BN0_WF_MIB_TOP_BTOCR_ADDR) * band_idx;
++		seq_printf(s, "===Per-BSS Related Tx/Rx Counters===\n");
++		seq_printf(s, "BSS Idx   TxCnt/DataCnt  TxByteCnt  RxCnt/DataCnt  RxByteCnt\n");
++
++		for (idx = 0; idx < BSS_NUM; idx++) {
++			btocr[idx] = mt76_rr(dev, (BN0_WF_MIB_TOP_BTOCR_ADDR + band_offset + (idx >> 1) * 4));
++			btdcr[idx] = mt76_rr(dev, (BN0_WF_MIB_TOP_BTDCR_ADDR + band_offset + (idx >> 1) * 4));
++			btbcr[idx] = mt76_rr(dev, (BN0_WF_MIB_TOP_BTBCR_ADDR + band_offset + (idx * 4)));
++			brocr[idx] = mt76_rr(dev, (BN0_WF_MIB_TOP_BROCR_ADDR + band_offset + (idx >> 1) * 4));
++			brdcr[idx] = mt76_rr(dev, (BN0_WF_MIB_TOP_BRDCR_ADDR + band_offset + (idx >> 1) * 4));
++			brbcr[idx] = mt76_rr(dev, (BN0_WF_MIB_TOP_BRBCR_ADDR + band_offset + (idx * 4)));
++
++			if ((idx % 2) == 0) {
++				btocr[idx] = ((btocr[idx] & BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2n_MASK) >> BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2n_SHFT);
++				btdcr[idx] = ((btdcr[idx] & BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2n_MASK) >> BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2n_SHFT);
++				brocr[idx] = ((brocr[idx] & BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2n_MASK) >> BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2n_SHFT);
++				brdcr[idx] = ((brdcr[idx] & BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2n_MASK) >> BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2n_SHFT);
++			} else {
++				btocr[idx] = ((btocr[idx] & BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2np1_SHFT);
++				btdcr[idx] = ((btdcr[idx] & BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BTDCR_TX_DATA_COUNT2np1_SHFT);
++				brocr[idx] = ((brocr[idx] & BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2np1_SHFT);
++				brdcr[idx] = ((brdcr[idx] & BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BRDCR_RX_DATA_COUNT2np1_SHFT);
++			}
++		}
++
++		for (idx = 0; idx < BSS_NUM; idx++) {
++			seq_printf(s, "%d\t 0x%x/0x%x\t 0x%x \t 0x%x/0x%x \t 0x%x\n",
++							idx, btocr[idx], btdcr[idx], btbcr[idx], brocr[idx], brdcr[idx], brbcr[idx]);
++		}
++
++		band_offset = (BN1_WF_MIB_TOP_BASE - BN0_WF_MIB_TOP_BASE) * band_idx;
++		seq_printf(s, "===Per-MBSS Related MIB Counters===\n");
++		seq_printf(s, "BSS Idx   RTSTx/RetryCnt  BAMissCnt  AckFailCnt  FrmRetry1/2/3Cnt\n");
++
++		for (idx = 0; idx < BSS_NUM; idx++) {
++			mbxsdr[idx][0] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR0_ADDR + band_offset + ((idx >> 1) * 4));
++			mbxsdr[idx][1] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR1_ADDR + band_offset + ((idx >> 1) * 4));
++			mbxsdr[idx][2] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR2_ADDR + band_offset + ((idx >> 1) * 4));
++			mbxsdr[idx][3] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR3_ADDR + band_offset + ((idx >> 1) * 4));
++			mbxsdr[idx][4] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR4_ADDR + band_offset + ((idx >> 1) * 4));
++			mbxsdr[idx][5] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR5_ADDR + band_offset + ((idx >> 1) * 4));
++			mbxsdr[idx][6] = mt76_rr(dev, BN0_WF_MIB_TOP_BSDR6_ADDR + band_offset + ((idx >> 1) * 4));
++
++			if ((idx % 2) == 0) {
++				mbxsdr[idx][0] = ((mbxsdr[idx][0] & BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2n_SHFT);
++				mbxsdr[idx][1] = ((mbxsdr[idx][1] & BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2n_SHFT);
++				mbxsdr[idx][2] = ((mbxsdr[idx][2] & BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2n_SHFT);
++				mbxsdr[idx][3] = ((mbxsdr[idx][3] & BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2n_SHFT);
++				mbxsdr[idx][4] = ((mbxsdr[idx][4] & BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2n_SHFT);
++				mbxsdr[idx][5] = ((mbxsdr[idx][5] & BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2n_SHFT);
++				mbxsdr[idx][6] = ((mbxsdr[idx][6] & BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2n_MASK) >> BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2n_SHFT);
++			} else {
++				mbxsdr[idx][0] = ((mbxsdr[idx][0] & BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR0_RTSTXCOUNT2np1_SHFT);
++				mbxsdr[idx][1] = ((mbxsdr[idx][1] & BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR1_RTSRETRYCOUNT2np1_SHFT);
++				mbxsdr[idx][2] = ((mbxsdr[idx][2] & BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR2_BAMISSCOUNT2np1_SHFT);
++				mbxsdr[idx][3] = ((mbxsdr[idx][3] & BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR3_ACKFAILCOUNT2np1_SHFT);
++				mbxsdr[idx][4] = ((mbxsdr[idx][4] & BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR4_FRAMERETRYCOUNT2np1_SHFT);
++				mbxsdr[idx][5] = ((mbxsdr[idx][5] & BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR5_FRAMERETRY2COUNT2np1_SHFT);
++				mbxsdr[idx][6] = ((mbxsdr[idx][6] & BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BSDR6_FRAMERETRY3COUNT2np1_SHFT);
++			}
++		}
++
++		for (idx = 0; idx < BSS_NUM; idx++) {
++			seq_printf(s, "%d:\t0x%x/0x%x  0x%x \t 0x%x \t  0x%x/0x%x/0x%x\n",
++				      idx,
++				      mbxsdr[idx][0], mbxsdr[idx][1], mbxsdr[idx][2], mbxsdr[idx][3],
++				      mbxsdr[idx][4], mbxsdr[idx][5], mbxsdr[idx][6]);
++		}
++
++		band_offset = (BN1_WF_MIB_TOP_BTOCR_ADDR - BN0_WF_MIB_TOP_BTOCR_ADDR) * band_idx;
++		seq_printf(s, "===Per-MBSS Related Tx/Rx Counters===\n");
++		seq_printf(s, "MBSSIdx   TxCnt  TxByteCnt  RxCnt  RxByteCnt\n");
++
++		for (idx = 0; idx < 16; idx++) {
++			mbtocr[idx] = mt76_rr(dev, BN0_WF_MIB_TOP_BTOCR_ADDR + band_offset + (((bss_nums >> 1) * 4) + ((idx >> 1) * 4)));
++			mbtbcr[idx] = mt76_rr(dev, BN0_WF_MIB_TOP_BTBCR_ADDR + band_offset + (((bss_nums >> 1) * 4) + (idx * 4)));
++			mbrocr[idx] = mt76_rr(dev, BN0_WF_MIB_TOP_BROCR_ADDR + band_offset + (((bss_nums >> 1) * 4) + ((idx >> 1) * 4)));
++			mbrbcr[idx] = mt76_rr(dev, BN0_WF_MIB_TOP_BRBCR_ADDR + band_offset + (((bss_nums >> 1) * 4) + (idx * 4)));
++
++			if ((idx % 2) == 0) {
++				mbtocr[idx] = ((mbtocr[idx] & BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2n_MASK) >> BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2n_SHFT);
++				mbrocr[idx] = ((mbrocr[idx] & BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2n_MASK) >> BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2n_SHFT);
++			} else {
++				mbtocr[idx] = ((mbtocr[idx] & BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BTOCR_TX_OK_COUNT2np1_SHFT);
++				mbrocr[idx] = ((mbrocr[idx] & BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2np1_MASK) >> BN0_WF_MIB_TOP_BROCR_RX_OK_COUNT2np1_SHFT);
++			}
++		}
++
++		for (idx = 0; idx < 16; idx++) {
++			seq_printf(s, "%d\t 0x%08x\t 0x%08x \t 0x%08x \t 0x%08x\n",
++						idx, mbtocr[idx], mbtbcr[idx], mbrocr[idx], mbrbcr[idx]);
++		}
++	}
++
++	seq_printf(s, "===Dummy delimiter insertion result===\n");
++	mac_val0 = mt76_rr(dev, MT_DBG_MIB_M0DR11(band_idx));
++	mac_val = mt76_rr(dev, MT_DBG_MIB_M0DR6(band_idx));
++	mac_val1 = mt76_rr(dev, MT_DBG_MIB_M0DR7(band_idx));
++	seq_printf(s, "Range0 = %d\t Range1 = %d\t Range2 = %d\t Range3 = %d\t Range4 = %d\n",
++				(mac_val0 & BN0_WF_MIB_TOP_M0DR12_TX_DDLMT_RNG0_CNT_MASK),
++				(mac_val & BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG1_CNT_MASK),
++				(mac_val & BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG2_CNT_MASK) >> BN0_WF_MIB_TOP_M0DR6_TX_DDLMT_RNG2_CNT_SHFT,
++				(mac_val1 & BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG3_CNT_MASK),
++				(mac_val1 & BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG4_CNT_MASK) >> BN0_WF_MIB_TOP_M0DR7_TX_DDLMT_RNG4_CNT_SHFT);
++
++	return 0;
++}
++
++static int mt7915_mibinfo_band0(struct seq_file *s, void *data)
++{
++	mt7915_mibinfo_read_per_band(s, 0);
++	return 0;
++}
++
++static int mt7915_mibinfo_band1(struct seq_file *s, void *data)
++{
++	mt7915_mibinfo_read_per_band(s, 1);
++	return 0;
++}
++
++static int mt7915_token_read(struct seq_file *s, void *data)
++{
++	struct mt7915_dev *dev = dev_get_drvdata(s->private);
++	int id, count = 0;
++	struct mt76_txwi_cache *txwi;
++
++	seq_printf(s, "Cut through token:\n");
++	spin_lock_bh(&dev->mt76.token_lock);
++	idr_for_each_entry(&dev->mt76.token, txwi, id) {
++		seq_printf(s, "%4d ", id);
++		count++;
++		if (count % 8 == 0)
++			seq_printf(s, "\n");
++	}
++	spin_unlock_bh(&dev->mt76.token_lock);
++	seq_printf(s, "\n");
++
++	return 0;
++}
++
++struct txd_l {
++	u32 txd_0;
++	u32 txd_1;
++	u32 txd_2;
++	u32 txd_3;
++	u32 txd_4;
++	u32 txd_5;
++	u32 txd_6;
++	u32 txd_7;
++} __packed;
++
++char *pkt_ft_str[] = {"cut_through", "store_forward", "cmd", "PDA_FW_Download"};
++char *hdr_fmt_str[] = {
++	"Non-80211-Frame",
++	"Command-Frame",
++	"Normal-80211-Frame",
++	"enhanced-80211-Frame",
++};
++/* TMAC_TXD_1.hdr_format */
++#define TMI_HDR_FT_NON_80211	0x0
++#define TMI_HDR_FT_CMD		0x1
++#define TMI_HDR_FT_NOR_80211	0x2
++#define TMI_HDR_FT_ENH_80211	0x3
++
++void mt7915_dump_tmac_info(u8 *tmac_info)
++{
++	struct txd_l *txd = (struct txd_l *)tmac_info;
++
++	printk("txd raw data: size=%d\n", MT_TXD_SIZE);
++	print_hex_dump(KERN_ERR , "", DUMP_PREFIX_OFFSET, 16, 1, tmac_info, MT_TXD_SIZE, false);
++
++	printk("TMAC_TXD Fields:\n");
++	printk("\tTMAC_TXD_0:\n");
++
++	/* DW0 */
++	/* TX Byte Count [15:0]  */
++	printk("\t\tTxByteCnt = %ld\n", FIELD_GET(MT_TXD0_TX_BYTES, txd->txd_0));
++
++	/* PKT_FT: Packet Format [24:23] */
++	printk("\t\tpkt_ft = %ld(%s)\n",
++			FIELD_GET(MT_TXD0_PKT_FMT, txd->txd_0),
++			pkt_ft_str[FIELD_GET(MT_TXD0_PKT_FMT, txd->txd_0)]);
++
++	/* Q_IDX [31:25]  */
++	printk("\t\tQueID =0x%lx\n", FIELD_GET(MT_TXD0_Q_IDX, txd->txd_0));
++
++	printk("\tTMAC_TXD_1:\n");
++
++	/* DW1 */
++	/* WLAN Indec [9:0] */
++	printk("\t\tWlan Index = %ld\n", FIELD_GET(MT_TXD1_WLAN_IDX, txd->txd_1));
++
++	/* VTA [10] */
++	printk("\t\tVTA = %d\n", ((txd->txd_1 & MT_TXD1_VTA) ? 1 : 0));
++
++	/* HF: Header Format [17:16] */
++	printk("\t\tHdrFmt = %ld(%s)\n",
++			FIELD_GET(MT_TXD1_HDR_FORMAT, txd->txd_1),
++			FIELD_GET(MT_TXD1_HDR_FORMAT, txd->txd_1) < 4 ?
++			hdr_fmt_str[FIELD_GET(MT_TXD1_HDR_FORMAT, txd->txd_1)] : "N/A");
++
++	switch (FIELD_GET(MT_TXD1_HDR_FORMAT, txd->txd_1)) {
++	case TMI_HDR_FT_NON_80211:
++		/* MRD [11], EOSP [12], RMVL [13], VLAN [14], ETYPE [15] */
++		printk("\t\t\tMRD = %d, EOSP = %d,\
++				RMVL = %d, VLAN = %d, ETYP = %d\n",
++				(txd->txd_1 & MT_TXD1_MRD) ? 1 : 0,
++				(txd->txd_1 & MT_TXD1_EOSP) ? 1 : 0,
++				(txd->txd_1 & MT_TXD1_RMVL) ? 1 : 0,
++				(txd->txd_1 & MT_TXD1_VLAN) ? 1 : 0,
++				(txd->txd_1 & MT_TXD1_ETYP) ? 1 : 0);
++		break;
++	case TMI_HDR_FT_NOR_80211:
++		/* HEADER_LENGTH [15:11] */
++		printk("\t\t\tHeader Len = %ld(WORD)\n", FIELD_GET(MT_TXD1_HDR_INFO, txd->txd_1));
++		break;
++
++	case TMI_HDR_FT_ENH_80211:
++		/* EOSP [12], AMS [13]  */
++		printk("\t\t\tEOSP = %d, AMS = %d\n",
++				(txd->txd_1 & MT_TXD1_EOSP) ? 1 : 0,
++				(txd->txd_1 & MT_TXD1_AMS) ? 1 : 0);
++		break;
++	}
++
++	/* Header Padding [19:18] */
++	printk("\t\tHdrPad = %ld\n", FIELD_GET(MT_TXD1_HDR_PAD, txd->txd_1));
++
++	/* TID [22:20] */
++	printk("\t\tTID = %ld\n", FIELD_GET(MT_TXD1_TID, txd->txd_1));
++
++
++	/* UtxB/AMSDU_C/AMSDU [23] */
++	printk("\t\tamsdu = %d\n", ((txd->txd_1 & MT_TXD1_AMSDU) ? 1 : 0));
++
++	/* OM [29:24] */
++	printk("\t\town_mac = %ld\n", FIELD_GET(MT_TXD1_OWN_MAC, txd->txd_1));
++
++
++	/* TGID [30] */
++	printk("\t\tTGID = %d\n", ((txd->txd_1 & MT_TXD1_TGID) ? 1 : 0));
++
++
++	/* FT [31] */
++	printk("\t\tTxDFormatType = %d\n", (txd->txd_1 & MT_TXD1_LONG_FORMAT) ? 1 : 0);
++
++	printk("\tTMAC_TXD_2:\n");
++	/* DW2 */
++	/* Subtype [3:0] */
++	printk("\t\tsub_type = %ld\n", FIELD_GET(MT_TXD2_SUB_TYPE, txd->txd_2));
++
++	/* Type[5:4] */
++	printk("\t\tfrm_type = %ld\n", FIELD_GET(MT_TXD2_FRAME_TYPE, txd->txd_2));
++
++	/* NDP [6] */
++	printk("\t\tNDP = %d\n", ((txd->txd_2 & MT_TXD2_NDP) ? 1 : 0));
++
++	/* NDPA [7] */
++	printk("\t\tNDPA = %d\n", ((txd->txd_2 & MT_TXD2_NDPA) ? 1 : 0));
++
++	/* SD [8] */
++	printk("\t\tSounding = %d\n", ((txd->txd_2 & MT_TXD2_SOUNDING) ? 1 : 0));
++
++	/* RTS [9] */
++	printk("\t\tRTS = %d\n", ((txd->txd_2 & MT_TXD2_RTS) ? 1 : 0));
++
++	/* BM [10] */
++	printk("\t\tbc_mc_pkt = %d\n", ((txd->txd_2 & MT_TXD2_MULTICAST) ? 1 : 0));
++
++	/* B [11]  */
++	printk("\t\tBIP = %d\n", ((txd->txd_2 & MT_TXD2_BIP) ? 1 : 0));
++
++	/* DU [12] */
++	printk("\t\tDuration = %d\n", ((txd->txd_2 & MT_TXD2_DURATION) ? 1 : 0));
++
++	/* HE [13] */
++	printk("\t\tHE(HTC Exist) = %d\n", ((txd->txd_2 & MT_TXD2_HTC_VLD) ? 1 : 0));
++
++	/* FRAG [15:14] */
++	printk("\t\tFRAG = %ld\n", FIELD_GET(MT_TXD2_FRAG, txd->txd_2));
++
++
++	/* Remaining Life Time [23:16]*/
++	printk("\t\tReamingLife/MaxTx time = %ld (unit: 64TU)\n",
++		FIELD_GET(MT_TXD2_MAX_TX_TIME, txd->txd_2));
++
++	/* Power Offset [29:24] */
++	printk("\t\tpwr_offset = %ld\n", FIELD_GET(MT_TXD2_POWER_OFFSET, txd->txd_2));
++
++	/* FRM [30] */
++	printk("\t\tfix rate mode = %d\n", (txd->txd_2 & MT_TXD2_FIXED_RATE) ? 1 : 0);
++
++	/* FR[31] */
++	printk("\t\tfix rate = %d\n", (txd->txd_2 & MT_TXD2_FIX_RATE) ? 1 : 0);
++
++
++	printk("\tTMAC_TXD_3:\n");
++
++	/* DW3 */
++	/* NA [0] */
++	printk("\t\tNoAck = %d\n", (txd->txd_3 & MT_TXD3_NO_ACK) ? 1 : 0);
++
++	/* PF [1] */
++	printk("\t\tPF = %d\n", (txd->txd_3 & MT_TXD3_PROTECT_FRAME) ? 1 : 0);
++
++	/* EMRD [2] */
++	printk("\t\tEMRD = %d\n", (txd->txd_3 & MT_TXD3_EMRD) ? 1 : 0);
++
++	/* EEOSP [3] */
++	printk("\t\tEEOSP = %d\n", (txd->txd_3 & MT_TXD3_EEOSP) ? 1 : 0);
++
++	/* DAS [4] */
++	printk("\t\tda_select = %d\n", (txd->txd_3 & MT_TXD3_DAS) ? 1 : 0);
++
++	/* TM [5] */
++	printk("\t\ttm = %d\n", (txd->txd_3 & MT_TXD3_TIMING_MEASURE) ? 1 : 0);
++
++	/* TX Count [10:6] */
++	printk("\t\ttx_cnt = %ld\n", FIELD_GET(MT_TXD3_TX_COUNT, txd->txd_3));
++
++	/* Remaining TX Count [15:11] */
++	printk("\t\tremain_tx_cnt = %ld\n", FIELD_GET(MT_TXD3_REM_TX_COUNT, txd->txd_3));
++
++	/* SN [27:16] */
++	printk("\t\tsn = %ld\n", FIELD_GET(MT_TXD3_SEQ, txd->txd_3));
++
++	/* BA_DIS [28] */
++	printk("\t\tba dis = %d\n", (txd->txd_3 & MT_TXD3_BA_DISABLE) ? 1 : 0);
++
++	/* Power Management [29] */
++	printk("\t\tpwr_mgmt = 0x%x\n", (txd->txd_3 & MT_TXD3_SW_POWER_MGMT) ? 1 : 0);
++
++	/* PN_VLD [30] */
++	printk("\t\tpn_vld = %d\n", (txd->txd_3 & MT_TXD3_PN_VALID) ? 1 : 0);
++
++	/* SN_VLD [31] */
++	printk("\t\tsn_vld = %d\n", (txd->txd_3 & MT_TXD3_SN_VALID) ? 1 : 0);
++
++
++	/* DW4 */
++	printk("\tTMAC_TXD_4:\n");
++
++	/* PN_LOW [31:0] */
++	printk("\t\tpn_low = 0x%lx\n", FIELD_GET(MT_TXD4_PN_LOW, txd->txd_4));
++
++
++	/* DW5 */
++	printk("\tTMAC_TXD_5:\n");
++
++	/* PID [7:0] */
++	printk("\t\tpid = %ld\n", FIELD_GET(MT_TXD5_PID, txd->txd_5));
++
++	/* TXSFM [8] */
++	printk("\t\ttx_status_fmt = %d\n", (txd->txd_5 & MT_TXD5_TX_STATUS_FMT) ? 1 : 0);
++
++	/* TXS2M [9] */
++	printk("\t\ttx_status_2_mcu = %d\n", (txd->txd_5 & MT_TXD5_TX_STATUS_MCU) ? 1 : 0);
++
++	/* TXS2H [10] */
++	printk("\t\ttx_status_2_host = %d\n", (txd->txd_5 & MT_TXD5_TX_STATUS_HOST) ? 1 : 0);
++
++	/* ADD_BA [14] */
++	printk("\t\tADD_BA = %d\n", (txd->txd_5 & MT_TXD5_ADD_BA) ? 1 : 0);
++
++	/* MD [15] */
++	printk("\t\tMD = %d\n", (txd->txd_5 & MT_TXD5_MD) ? 1 : 0);
++
++	/* PN_HIGH [31:16]  */
++	printk("\t\tpn_high = 0x%lx\n", FIELD_GET(MT_TXD5_PN_HIGH, txd->txd_5));
++
++	/* DW6 */
++	printk("\tTMAC_TXD_6:\n");
++
++	if (txd->txd_2 & MT_TXD2_FIX_RATE) {
++		/* Fixed BandWidth mode [2:0] */
++		printk("\t\tbw = %ld\n", FIELD_GET(MT_TXD6_BW, txd->txd_6));
++
++		/* DYN_BW [3] */
++		printk("\t\tdyn_bw = %d\n", (txd->txd_6 & MT_TXD6_DYN_BW) ? 1 : 0);
++
++		/* ANT_ID [7:4] */
++		printk("\t\tant_id = %ld\n", FIELD_GET(MT_TXD6_ANT_ID, txd->txd_6));
++
++		/* SPE_IDX_SEL [10] */
++		printk("\t\tspe_idx_sel = %d\n", (txd->txd_6 & MT_TXD6_SPE_ID_IDX) ? 1 : 0);
++
++		/* LDPC [11] */
++		printk("\t\tldpc = %d\n", (txd->txd_6 & MT_TXD6_LDPC) ? 1 : 0);
++
++		/* HELTF Type[13:12] */
++		printk("\t\tHELTF Type = %ld\n", FIELD_GET(MT_TXD6_HELTF, txd->txd_6));
++
++		/* GI Type [15:14] */
++		printk("\t\tGI = %ld\n", FIELD_GET(MT_TXD6_SGI, txd->txd_6));
++
++		/* Rate to be Fixed [29:16] */
++		printk("\t\ttx_rate = 0x%lx\n", FIELD_GET(MT_TXD6_TX_RATE, txd->txd_6));
++	}
++
++	/* TXEBF [30] */
++	printk("\t\ttxebf = %d\n", (txd->txd_6 & MT_TXD6_TX_EBF)  ? 1 : 0);
++
++	/* TXIBF [31] */
++	printk("\t\ttxibf = %d\n", (txd->txd_6 & MT_TXD6_TX_IBF) ? 1 : 0);
++
++	/* DW7 */
++	printk("\tTMAC_TXD_7:\n");
++
++	if ((txd->txd_1 & MT_TXD1_VTA) == 0) {
++		/* SW Tx Time [9:0] */
++		printk("\t\tsw_tx_time = %ld\n", FIELD_GET(MT_TXD7_TX_TIME, txd->txd_7));
++	} else {
++		/* TXD Arrival Time [9:0] */
++		printk("\t\tat = %ld\n", FIELD_GET(MT_TXD7_TAT, txd->txd_7));
++	}
++
++	/* HW_AMSDU_CAP [10] */
++	printk("\t\thw amsdu cap = %d\n",(txd->txd_7 & MT_TXD7_HW_AMSDU) ? 1 : 0);
++
++	/* SPE_IDX [15:11] */
++	if (txd->txd_2 & MT_TXD2_FIX_RATE) {
++		printk("\t\tspe_idx = 0x%lx\n", FIELD_GET(MT_TXD7_SPE_IDX, txd->txd_7));
++	}
++
++	/* PSE_FID [27:16] */
++	printk("\t\tpse_fid = 0x%lx\n", FIELD_GET(MT_TXD7_PSE_FID, txd->txd_7));
++
++	/* Subtype [19:16] */
++	printk("\t\tpp_sub_type=%ld\n", FIELD_GET(MT_TXD7_SUB_TYPE, txd->txd_7));
++
++	/* Type [21:20] */
++	printk("\t\tpp_type=%ld\n", FIELD_GET(MT_TXD7_TYPE, txd->txd_7));
++
++	/* CTXD_CNT [25:23] */
++	printk("\t\tctxd cnt=0x%lx\n", FIELD_GET(MT_TXD7_CTXD_CNT, txd->txd_7));
++
++	/* CTXD [26] */
++	printk("\t\tctxd = %d\n", (txd->txd_7 & MT_TXD7_CTXD) ? 1 : 0);
++
++	/* I [28]  */
++	printk("\t\ti = %d\n", (txd->txd_7 & MT_TXD7_IP_SUM) ? 1 : 0);
++
++	/* UT [29] */
++	printk("\t\tUT = %d\n", (txd->txd_7 & MT_TXD7_UDP_TCP_SUM) ? 1 : 0);
++
++	/* TXDLEN [31:30] */
++	printk("\t\t txd len= %ld\n", FIELD_GET(MT_TXD7_TXD_LEN, txd->txd_7));
++}
++
++
++static int mt7915_token_txd_read(struct seq_file *s, void *data)
++{
++	struct mt7915_dev *dev = dev_get_drvdata(s->private);
++	struct mt76_txwi_cache *t;
++	u8* txwi;
++
++	seq_printf(s, "\n");
++	spin_lock_bh(&dev->mt76.token_lock);
++
++	t = idr_find(&dev->mt76.token, dev->dbg.token_idx);
++
++	spin_unlock_bh(&dev->mt76.token_lock);
++	if (t != NULL) {
++		struct mt76_dev *mdev = &dev->mt76;
++		txwi = ((u8*)(t)) - (mdev->drv->txwi_size);
++		mt7915_dump_tmac_info((u8*) txwi);
++		seq_printf(s, "\n");
++		printk("[SKB]\n");
++		print_hex_dump(KERN_ERR , "", DUMP_PREFIX_OFFSET, 16, 1, (u8 *)t->skb->data, t->skb->len, false);
++		seq_printf(s, "\n");
++	}
++	return 0;
++}
++
++static int mt7915_amsduinfo_read(struct seq_file *s, void *data)
++{
++	struct mt7915_dev *dev = dev_get_drvdata(s->private);
++	u32 ple_stat[8] = {0}, total_amsdu = 0;
++	u8 i;
++
++	for (i = 0; i < 8; i++)
++		ple_stat[i] = mt76_rr(dev, MT_DBG_PLE_AMSDU_PACK_MSDU_CNT(i));
++
++	seq_printf(s, "TXD counter status of MSDU:\n");
++
++	for (i = 0; i < 8; i++)
++		total_amsdu += ple_stat[i];
++
++	for (i = 0; i < 8; i++) {
++		seq_printf(s, "AMSDU pack count of %d MSDU in TXD: 0x%x ", i + 1, ple_stat[i]);
++		if (total_amsdu != 0)
++			seq_printf(s, "(%d%%)\n", ple_stat[i] * 100 / total_amsdu);
++		else
++			seq_printf(s, "\n");
++	}
++
++	return 0;
++
++}
++
++static int mt7915_agginfo_read_per_band(struct seq_file *s, int band_idx)
++{
++	struct mt7915_dev *dev = dev_get_drvdata(s->private);
++	u32 value, idx, agg_rang_sel[15], ampdu_cnt[11], total_ampdu = 0;
++
++	seq_printf(s, "Band %d AGG Status\n", band_idx);
++	seq_printf(s, "===============================\n");
++	value = mt76_rr(dev, MT_DBG_AGG_AALCR0(band_idx));
++	seq_printf(s, "AC00 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx0_AGG_LIMIT_MASK, value));
++	seq_printf(s, "AC01 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx1_AGG_LIMIT_MASK, value));
++	seq_printf(s, "AC02 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx2_AGG_LIMIT_MASK, value));
++	seq_printf(s, "AC03 Agg limit = %ld\n", FIELD_GET(MT_DBG_AGG_AALCR_ACx3_AGG_LIMIT_MASK, value));
++
++	value = mt76_rr(dev, MT_DBG_AGG_AALCR1(band_idx));
++	seq_printf(s, "AC10 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx0_AGG_LIMIT_MASK, value));
++	seq_printf(s, "AC11 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx1_AGG_LIMIT_MASK, value));
++	seq_printf(s, "AC12 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx2_AGG_LIMIT_MASK, value));
++	seq_printf(s, "AC13 Agg limit = %ld\n", FIELD_GET(MT_DBG_AGG_AALCR_ACx3_AGG_LIMIT_MASK, value));
++
++	value = mt76_rr(dev, MT_DBG_AGG_AALCR2(band_idx));
++	seq_printf(s, "AC20 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx0_AGG_LIMIT_MASK, value));
++	seq_printf(s, "AC21 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx1_AGG_LIMIT_MASK, value));
++	seq_printf(s, "AC22 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx2_AGG_LIMIT_MASK, value));
++	seq_printf(s, "AC23 Agg limit = %ld\n", FIELD_GET(MT_DBG_AGG_AALCR_ACx3_AGG_LIMIT_MASK, value));
++
++	value = mt76_rr(dev, MT_DBG_AGG_AALCR3(band_idx));
++	seq_printf(s, "AC30 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx0_AGG_LIMIT_MASK, value));
++	seq_printf(s, "AC31 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx1_AGG_LIMIT_MASK, value));
++	seq_printf(s, "AC32 Agg limit = %ld\t", FIELD_GET(MT_DBG_AGG_AALCR_ACx2_AGG_LIMIT_MASK, value));
++	seq_printf(s, "AC33 Agg limit = %ld\n", FIELD_GET(MT_DBG_AGG_AALCR_ACx3_AGG_LIMIT_MASK, value));
++
++	value = mt76_rr(dev, MT_DBG_AGG_AALCR4(band_idx));
++	seq_printf(s, "ALTX Agg limit = %ld\n", FIELD_GET(MT_DBG_AGG_AALCR4_ALTX0_AGG_LIMIT_MASK, value));
++
++	value = mt76_rr(dev, MT_DBG_AGG_AWSCR(band_idx, 0));
++	seq_printf(s, "Winsize0 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR0_WINSIZE0_MASK, value));
++	seq_printf(s, "Winsize1 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR0_WINSIZE1_MASK, value));
++	seq_printf(s, "Winsize2 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR0_WINSIZE2_MASK, value));
++	seq_printf(s, "Winsize3 limit = %ld\n", FIELD_GET(MT_DBG_AGG_AWSCR0_WINSIZE3_MASK, value));
++
++	value = mt76_rr(dev, MT_DBG_AGG_AWSCR(band_idx, 1));
++	seq_printf(s, "Winsize4 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR1_WINSIZE4_MASK, value));
++	seq_printf(s, "Winsize5 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR1_WINSIZE5_MASK, value));
++	seq_printf(s, "Winsize6 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR1_WINSIZE6_MASK, value));
++	seq_printf(s, "Winsize7 limit = %ld\n", FIELD_GET(MT_DBG_AGG_AWSCR1_WINSIZE7_MASK, value));
++
++	value = mt76_rr(dev, MT_DBG_AGG_AWSCR(band_idx, 2));
++	seq_printf(s, "Winsize8 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR2_WINSIZE8_MASK, value));
++	seq_printf(s, "Winsize9 limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR2_WINSIZE9_MASK, value));
++	seq_printf(s, "WinsizeA limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR2_WINSIZEA_MASK, value));
++	seq_printf(s, "WinsizeB limit = %ld\n", FIELD_GET(MT_DBG_AGG_AWSCR2_WINSIZEB_MASK, value));
++
++
++	value = mt76_rr(dev, MT_DBG_AGG_AWSCR(band_idx, 3));
++	seq_printf(s, "WinsizeC limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR3_WINSIZEC_MASK, value));
++	seq_printf(s, "WinsizeD limit = %ld\t", FIELD_GET(MT_DBG_AGG_AWSCR3_WINSIZED_MASK, value));
++	seq_printf(s, "WinsizeE limit = %ld\n", FIELD_GET(MT_DBG_AGG_AWSCR3_WINSIZEE_MASK, value));
++
++	seq_printf(s, "===AMPDU Related Counters===\n");
++
++	value = mt76_rr(dev, MT_DBG_MIB_M0ARNG(band_idx, 0));
++	agg_rang_sel[0] = FIELD_GET(MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL0_MASK, value);
++	agg_rang_sel[1] = FIELD_GET(MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL1_MASK, value);
++	agg_rang_sel[2] = FIELD_GET(MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL2_MASK, value);
++	agg_rang_sel[3] = FIELD_GET(MT_DBG_MIB_M0ARNG0_AGG_RANG_SEL3_MASK, value);
++
++	value = mt76_rr(dev, MT_DBG_MIB_M0ARNG(band_idx, 1));
++	agg_rang_sel[4] = FIELD_GET(MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL4_MASK, value);
++	agg_rang_sel[5] = FIELD_GET(MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL5_MASK, value);
++	agg_rang_sel[6] = FIELD_GET(MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL6_MASK, value);
++	agg_rang_sel[7] = FIELD_GET(MT_DBG_MIB_M0ARNG1_AGG_RANG_SEL7_MASK, value);
++
++	value = mt76_rr(dev, MT_DBG_MIB_M0ARNG(band_idx, 2));
++	agg_rang_sel[8] = FIELD_GET(MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL8_MASK, value);
++	agg_rang_sel[9] = FIELD_GET(MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL9_MASK, value);
++	agg_rang_sel[10] = FIELD_GET(MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL10_MASK, value);
++	agg_rang_sel[11] = FIELD_GET(MT_DBG_MIB_M0ARNG2_AGG_RANG_SEL11_MASK, value);
++
++	value = mt76_rr(dev, MT_DBG_MIB_M0ARNG(band_idx, 3));
++	agg_rang_sel[12] = FIELD_GET(MT_DBG_MIB_M0ARNG3_AGG_RANG_SEL12_MASK, value);
++	agg_rang_sel[13] = FIELD_GET(MT_DBG_MIB_M0ARNG3_AGG_RANG_SEL13_MASK, value);
++	agg_rang_sel[14] = FIELD_GET(MT_DBG_MIB_M0ARNG3_AGG_RANG_SEL14_MASK, value);
++
++	/* Need to add 1 after read from AGG_RANG_SEL CR */
++	for (idx = 0; idx < 15; idx++)
++		agg_rang_sel[idx]++;
++
++	ampdu_cnt[3] = mt76_rr(dev, MT_DBG_MIB_M0DR2(band_idx, 0));
++	ampdu_cnt[4] = mt76_rr(dev, MT_DBG_MIB_M0DR2(band_idx, 1));
++	ampdu_cnt[5] = mt76_rr(dev, MT_DBG_MIB_M0DR2(band_idx, 2));
++	ampdu_cnt[6] = mt76_rr(dev, MT_DBG_MIB_M0DR2(band_idx, 3));
++	ampdu_cnt[7] = mt76_rr(dev, MT_DBG_MIB_M0DR13(band_idx, 0));
++	ampdu_cnt[8] = mt76_rr(dev, MT_DBG_MIB_M0DR13(band_idx, 1));
++	ampdu_cnt[9] = mt76_rr(dev, MT_DBG_MIB_M0DR13(band_idx, 2));
++	ampdu_cnt[10] = mt76_rr(dev, MT_DBG_MIB_M0DR13(band_idx, 3));
++
++	seq_printf(s, "\tTx Agg Range: \t%d \t%d~%d \t%d~%d \t%d~%d \t%d~%d \t%d~%d \t%d~%d \t%d~%d\n",
++			 agg_rang_sel[0],
++			 agg_rang_sel[0] + 1, agg_rang_sel[1],
++			 agg_rang_sel[1] + 1, agg_rang_sel[2],
++			 agg_rang_sel[2] + 1, agg_rang_sel[3],
++			 agg_rang_sel[3] + 1, agg_rang_sel[4],
++			 agg_rang_sel[4] + 1, agg_rang_sel[5],
++			 agg_rang_sel[5] + 1, agg_rang_sel[6],
++			 agg_rang_sel[6] + 1, agg_rang_sel[7]);
++
++#define BIT_0_to_15_MASK 0x0000FFFF
++#define BIT_15_to_31_MASK 0xFFFF0000
++#define SHFIT_16_BIT 16
++
++	for (idx = 3; idx < 11; idx++)
++		total_ampdu = total_ampdu + (ampdu_cnt[idx] & BIT_0_to_15_MASK) + ((ampdu_cnt[idx] & BIT_15_to_31_MASK) >> SHFIT_16_BIT);
++
++	seq_printf(s, "\t\t\t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx\n",
++			 (ampdu_cnt[3]) & MT_DBG_MIB_M0DR2_TRX_AGG_RANGE0_CNT_MASK,
++			 FIELD_GET(MT_DBG_MIB_M0DR2_TRX_AGG_RANGE1_CNT_MASK, ampdu_cnt[3]),
++			 (ampdu_cnt[4]) & MT_DBG_MIB_M0DR3_TRX_AGG_RANGE2_CNT_MASK,
++			 FIELD_GET(MT_DBG_MIB_M0DR3_TRX_AGG_RANGE3_CNT_MASK, ampdu_cnt[4]),
++			 (ampdu_cnt[5]) & MT_DBG_MIB_M0DR4_TRX_AGG_RANGE4_CNT_MASK,
++			 FIELD_GET(MT_DBG_MIB_M0DR4_TRX_AGG_RANGE5_CNT_MASK, ampdu_cnt[5]),
++			 (ampdu_cnt[6]) & MT_DBG_MIB_M0DR5_TRX_AGG_RANGE6_CNT_MASK,
++			 FIELD_GET(MT_DBG_MIB_M0DR5_TRX_AGG_RANGE7_CNT_MASK, ampdu_cnt[6]));
++
++	if (total_ampdu != 0) {
++		seq_printf(s, "\t\t\t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%)\n",
++				((ampdu_cnt[3]) & MT_DBG_MIB_M0DR2_TRX_AGG_RANGE0_CNT_MASK) * 100 / total_ampdu,
++				FIELD_GET(MT_DBG_MIB_M0DR2_TRX_AGG_RANGE1_CNT_MASK, ampdu_cnt[3]) * 100 / total_ampdu,
++				((ampdu_cnt[4]) & MT_DBG_MIB_M0DR3_TRX_AGG_RANGE2_CNT_MASK) * 100 / total_ampdu,
++				FIELD_GET(MT_DBG_MIB_M0DR3_TRX_AGG_RANGE3_CNT_MASK, ampdu_cnt[4]) * 100 / total_ampdu,
++				((ampdu_cnt[5]) & MT_DBG_MIB_M0DR4_TRX_AGG_RANGE4_CNT_MASK) * 100 / total_ampdu,
++				FIELD_GET(MT_DBG_MIB_M0DR4_TRX_AGG_RANGE5_CNT_MASK, ampdu_cnt[5]) * 100 / total_ampdu,
++				((ampdu_cnt[6]) & MT_DBG_MIB_M0DR5_TRX_AGG_RANGE6_CNT_MASK) * 100 / total_ampdu,
++				 FIELD_GET(MT_DBG_MIB_M0DR5_TRX_AGG_RANGE7_CNT_MASK, ampdu_cnt[6]) * 100 / total_ampdu);
++		}
++
++		seq_printf(s, "\t\t\t%d~%d\t%d~%d\t%d~%d\t%d~%d\t%d~%d\t%d~%d\t%d~%d\t%d~256\n",
++			 agg_rang_sel[7] + 1, agg_rang_sel[8],
++			 agg_rang_sel[8] + 1, agg_rang_sel[9],
++			 agg_rang_sel[9] + 1, agg_rang_sel[10],
++			 agg_rang_sel[10] + 1, agg_rang_sel[11],
++			 agg_rang_sel[11] + 1, agg_rang_sel[12],
++			 agg_rang_sel[12] + 1, agg_rang_sel[13],
++			 agg_rang_sel[13] + 1, agg_rang_sel[14],
++			 agg_rang_sel[14] + 1);
++
++		seq_printf(s, "\t\t\t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx \t0x%lx\n",
++			(ampdu_cnt[7]) & MT_DBG_MIB_M0DR13_TRX_AGG_RANGE8_CNT_MASK,
++			FIELD_GET(MT_DBG_MIB_M0DR13_TRX_AGG_RANGE9_CNT_MASK, ampdu_cnt[7]),
++			(ampdu_cnt[8]) & MT_DBG_MIB_M0DR14_TRX_AGG_RANGE10_CNT_MASK,
++			FIELD_GET(MT_DBG_MIB_M0DR14_TRX_AGG_RANGE11_CNT_MASK, ampdu_cnt[8]),
++			(ampdu_cnt[9]) & MT_DBG_MIB_M0DR15_TRX_AGG_RANGE12_CNT_MASK,
++			FIELD_GET(MT_DBG_MIB_M0DR15_TRX_AGG_RANGE13_CNT_MASK, ampdu_cnt[9]),
++			(ampdu_cnt[10]) & MT_DBG_MIB_M0DR16_TRX_AGG_RANGE14_CNT_MASK,
++			FIELD_GET(MT_DBG_MIB_M0DR16_TRX_AGG_RANGE15_CNT_MASK, ampdu_cnt[10]));
++
++	if (total_ampdu != 0) {
++		seq_printf(s, "\t\t\t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%) \t(%ld%%)\n",
++		       ((ampdu_cnt[7]) & MT_DBG_MIB_M0DR2_TRX_AGG_RANGE0_CNT_MASK) * 100 / total_ampdu,
++			FIELD_GET(MT_DBG_MIB_M0DR2_TRX_AGG_RANGE1_CNT_MASK, ampdu_cnt[7]) * 100 / total_ampdu,
++			((ampdu_cnt[8]) & MT_DBG_MIB_M0DR3_TRX_AGG_RANGE2_CNT_MASK) * 100 / total_ampdu,
++			FIELD_GET(MT_DBG_MIB_M0DR3_TRX_AGG_RANGE3_CNT_MASK, ampdu_cnt[8]) * 100 / total_ampdu,
++			((ampdu_cnt[9]) & MT_DBG_MIB_M0DR4_TRX_AGG_RANGE4_CNT_MASK) * 100 / total_ampdu,
++			FIELD_GET(MT_DBG_MIB_M0DR4_TRX_AGG_RANGE5_CNT_MASK, ampdu_cnt[9]) * 100 / total_ampdu,
++			((ampdu_cnt[10]) & MT_DBG_MIB_M0DR5_TRX_AGG_RANGE6_CNT_MASK) * 100 / total_ampdu,
++			FIELD_GET(MT_DBG_MIB_M0DR5_TRX_AGG_RANGE7_CNT_MASK, ampdu_cnt[10]) * 100 / total_ampdu);
++	}
++
++	return 0;
++}
++
++static int mt7915_agginfo_read_band0(struct seq_file *s, void *data)
++{
++	mt7915_agginfo_read_per_band(s, 0);
++	return 0;
++}
++
++static int mt7915_agginfo_read_band1(struct seq_file *s, void *data)
++{
++	mt7915_agginfo_read_per_band(s, 1);
++	return 0;
++}
++
++/*usage: <en> <num> <len>
++	en: BIT(16) 0: sw amsdu  1: hw amsdu
++	num: GENMASK(15, 8) range 1-8
++	len: GENMASK(7, 0) unit: 256 bytes */
++static int mt7915_sta_tx_amsdu_set(void *data, u64 tx_amsdu)
++{
++/* UWTBL DW 6 */
++#define WTBL_AMSDU_LEN_MASK              GENMASK(5, 0)
++#define WTBL_AMSDU_NUM_MASK              GENMASK(8, 6)
++#define WTBL_AMSDU_EN_MASK               BIT(9)
++#define UWTBL_HW_AMSDU_DW                 6
++
++	struct mt7915_dev *dev = data;
++	u32 len = FIELD_GET(GENMASK(7, 0), tx_amsdu);
++	u32 num = FIELD_GET(GENMASK(15, 8), tx_amsdu);
++	u32 uwtbl;
++
++	mt7915_wtbl_read_raw(dev, dev->wlan_idx, WTBL_TYPE_UMAC,
++			UWTBL_HW_AMSDU_DW, 1, &uwtbl);
++
++	if (len) {
++		uwtbl &= ~WTBL_AMSDU_LEN_MASK;
++		uwtbl |= FIELD_PREP(WTBL_AMSDU_LEN_MASK, len);
++	}
++
++	uwtbl &= ~WTBL_AMSDU_NUM_MASK;
++	uwtbl |= FIELD_PREP(WTBL_AMSDU_NUM_MASK, num);
++
++	if (tx_amsdu & BIT(16))
++		uwtbl |= WTBL_AMSDU_EN_MASK;
++
++	mt7915_wtbl_write_raw(dev, dev->wlan_idx, WTBL_TYPE_UMAC,
++			UWTBL_HW_AMSDU_DW, uwtbl);
++
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_tx_amsdu, NULL,
++			 mt7915_sta_tx_amsdu_set, "%llx\n");
++
++static int mt7915_red_enable_set(void *data, u64 en)
++{
++	struct mt7915_dev *dev = data;
++
++	return mt7915_mcu_set_red(dev, en);
++}
++DEFINE_DEBUGFS_ATTRIBUTE(fops_red_en, NULL,
++			 mt7915_red_enable_set, "%llx\n");
++
++static int mt7915_red_show_sta_set(void *data, u64 wlan_idx)
++{
++	struct mt7915_dev *dev = data;
++
++	mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
++			  MCU_WA_PARAM_RED_SHOW_STA,
++			  wlan_idx, 0, true);
++
++	return 0;
++}
++DEFINE_DEBUGFS_ATTRIBUTE(fops_red_show_sta, NULL,
++			 mt7915_red_show_sta_set, "%llx\n");
++
++static int mt7915_red_target_dly_set(void *data, u64 delay)
++{
++	struct mt7915_dev *dev = data;
++
++	if (delay > 0 && delay <= 32767)
++		mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET),
++				  MCU_WA_PARAM_RED_TARGET_DELAY,
++				  delay, 0, true);
++
++	return 0;
++}
++DEFINE_DEBUGFS_ATTRIBUTE(fops_red_target_dly, NULL,
++			 mt7915_red_target_dly_set, "%llx\n");
++
++static int
++mt7915_txpower_level_set(void *data, u64 val)
++{
++	struct mt7915_dev *dev = data;
++	struct mt7915_phy *ext_phy = mt7915_ext_phy(dev);
++	mt7915_mcu_set_txpower_level(&dev->phy, val);
++	if (ext_phy)
++		mt7915_mcu_set_txpower_level(ext_phy, val);
++
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_txpower_level, NULL,
++			 mt7915_txpower_level_set, "%lld\n");
++
++/* usage: echo 0x[arg3][arg2][arg1] > fw_wa_set */
++static int
++mt7915_wa_set(void *data, u64 val)
++{
++	struct mt7915_dev *dev = data;
++	u32 arg1, arg2, arg3;
++
++	arg1 = FIELD_GET(GENMASK_ULL(7, 0), val);
++	arg2 = FIELD_GET(GENMASK_ULL(15, 8), val);
++	arg3 = FIELD_GET(GENMASK_ULL(23, 16), val);
++
++	mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET), arg1, arg2, arg3, false);
++
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_set, NULL, mt7915_wa_set,
++			 "0x%llx\n");
++/* usage: echo 0x[arg3][arg2][arg1] > fw_wa_query */
++static int
++mt7915_wa_query(void *data, u64 val)
++{
++	struct mt7915_dev *dev = data;
++	u32 arg1, arg2, arg3;
++
++	arg1 = FIELD_GET(GENMASK_ULL(7, 0), val);
++	arg2 = FIELD_GET(GENMASK_ULL(15, 8), val);
++	arg3 = FIELD_GET(GENMASK_ULL(23, 16), val);
++
++	mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(QUERY), arg1, arg2, arg3, false);
++
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_query, NULL, mt7915_wa_query,
++					 "0x%llx\n");
++/* set wa debug level
++     usage:
++	echo 0x[arg] > fw_wa_debug
++	bit0 : DEBUG_WIFI_TX
++	bit1 : DEBUG_CMD_EVENT
++	bit2 : DEBUG_RED
++	bit3 : DEBUG_WARN
++	bit4 : DEBUG_WIFI_RX
++	bit5 : DEBUG_TIME_STAMP
++	bit6 : DEBUG_TX_FREE_DONE_EVENT
++	bit12 : DEBUG_WIFI_TXD */
++static int
++mt7915_wa_debug(void *data, u64 val)
++{
++	struct mt7915_dev *dev = data;
++	u32 arg;
++
++	arg = FIELD_GET(GENMASK_ULL(15, 0), val);
++
++	mt7915_dbg_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(DEBUG), arg, 0, 0, false);
++
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_wa_debug, NULL, mt7915_wa_debug,
++			 "0x%llx\n");
++
++int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
++{
++	struct mt7915_dev *dev = phy->dev;
++	u32 device_id = (dev->mt76.rev) >> 16;
++	int i = 0;
++
++	for (i = 0; i < ARRAY_SIZE(dbg_reg_s); i++) {
++		if (device_id == dbg_reg_s[i].id) {
++			dev->dbg_reg = &dbg_reg_s[i];
++			break;
++		}
++	}
++
++	mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
++
++	debugfs_create_file("fw_debug_module", 0600, dir, dev,
++			    &fops_fw_debug_module);
++	debugfs_create_file("fw_debug_level", 0600, dir, dev,
++			    &fops_fw_debug_level);
++
++	debugfs_create_devm_seqfile(dev->mt76.dev, "wtbl_info", dir,
++				    mt7915_wtbl_read);
++	debugfs_create_devm_seqfile(dev->mt76.dev, "uwtbl_info", dir,
++				    mt7915_uwtbl_read);
++
++	debugfs_create_devm_seqfile(dev->mt76.dev, "tr_info", dir,
++				    mt7915_trinfo_read);
++
++	debugfs_create_devm_seqfile(dev->mt76.dev, "drr_info", dir,
++				    mt7915_drr_info);
++
++	debugfs_create_devm_seqfile(dev->mt76.dev, "ple_info", dir,
++				    mt7915_pleinfo_read);
++
++	debugfs_create_devm_seqfile(dev->mt76.dev, "pse_info", dir,
++				    mt7915_pseinfo_read);
++
++	debugfs_create_devm_seqfile(dev->mt76.dev, "mib_info0", dir,
++				    mt7915_mibinfo_band0);
++	debugfs_create_devm_seqfile(dev->mt76.dev, "mib_info1", dir,
++				    mt7915_mibinfo_band1);
++
++	debugfs_create_u32("token_idx", 0600, dir, &dev->dbg.token_idx);
++	debugfs_create_devm_seqfile(dev->mt76.dev, "token", dir,
++				    mt7915_token_read);
++	debugfs_create_devm_seqfile(dev->mt76.dev, "token_txd", dir,
++				    mt7915_token_txd_read);
++
++	debugfs_create_devm_seqfile(dev->mt76.dev, "amsdu_info", dir,
++				    mt7915_amsduinfo_read);
++
++	debugfs_create_devm_seqfile(dev->mt76.dev, "agg_info0", dir,
++				    mt7915_agginfo_read_band0);
++	debugfs_create_devm_seqfile(dev->mt76.dev, "agg_info1", dir,
++				    mt7915_agginfo_read_band1);
++
++	debugfs_create_file("tx_amsdu", 0600, dir, dev, &fops_tx_amsdu);
++
++	debugfs_create_file("fw_wa_query", 0600, dir, dev, &fops_wa_query);
++	debugfs_create_file("fw_wa_set", 0600, dir, dev, &fops_wa_set);
++	debugfs_create_file("fw_wa_debug", 0600, dir, dev, &fops_wa_debug);
++
++	debugfs_create_file("red_en", 0600, dir, dev,
++			    &fops_red_en);
++	debugfs_create_file("red_show_sta", 0600, dir, dev,
++			    &fops_red_show_sta);
++	debugfs_create_file("red_target_dly", 0600, dir, dev,
++			    &fops_red_target_dly);
++
++	debugfs_create_file("txpower_level", 0400, dir, dev,
++			    &fops_txpower_level);
++
++	return 0;
++}
++#endif
+diff --git a/mt7915/mtk_mcu.c b/mt7915/mtk_mcu.c
+new file mode 100644
+index 00000000..145fe785
+--- /dev/null
++++ b/mt7915/mtk_mcu.c
+@@ -0,0 +1,51 @@
++#include <linux/firmware.h>
++#include <linux/fs.h>
++#include<linux/inet.h>
++#include "mt7915.h"
++#include "mcu.h"
++#include "mac.h"
++
++int mt7915_mcu_set_txpower_level(struct mt7915_phy *phy, u8 drop_level)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct mt7915_sku_val {
++		u8 format_id;
++		u8 val;
++		u8 band;
++		u8 _rsv;
++	} __packed req = {
++		.format_id = 1,
++		.band = phy->band_idx,
++		.val = !!drop_level,
++	};
++	int ret;
++
++	ret = mt76_mcu_send_msg(&dev->mt76,
++				MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
++				sizeof(req), true);
++	if (ret)
++		return ret;
++
++	req.format_id = 2;
++	if ((drop_level > 90 && drop_level < 100) || !drop_level)
++		req.val = 0;
++	else if (drop_level > 60 && drop_level <= 90)
++		/* reduce Pwr for 1 dB. */
++		req.val = 2;
++	else if (drop_level > 30 && drop_level <= 60)
++		/* reduce Pwr for 3 dB. */
++		req.val = 6;
++	else if (drop_level > 15 && drop_level <= 30)
++		/* reduce Pwr for 6 dB. */
++		req.val = 12;
++	else if (drop_level > 9 && drop_level <= 15)
++		/* reduce Pwr for 9 dB. */
++		req.val = 18;
++	else if (drop_level > 0 && drop_level <= 9)
++		/* reduce Pwr for 12 dB. */
++		req.val = 24;
++
++	return mt76_mcu_send_msg(&dev->mt76,
++				 MCU_EXT_CMD(TX_POWER_FEATURE_CTRL), &req,
++				 sizeof(req), true);
++}
+diff --git a/tools/fwlog.c b/tools/fwlog.c
+index e5d4a105..58a976a9 100644
+--- a/tools/fwlog.c
++++ b/tools/fwlog.c
+@@ -26,7 +26,7 @@ static const char *debugfs_path(const char *phyname, const char *file)
+ 	return path;
+ }
+ 
+-static int mt76_set_fwlog_en(const char *phyname, bool en)
++static int mt76_set_fwlog_en(const char *phyname, bool en, char *val)
+ {
+ 	FILE *f = fopen(debugfs_path(phyname, "fw_debug_bin"), "w");
+ 
+@@ -35,7 +35,13 @@ static int mt76_set_fwlog_en(const char *phyname, bool en)
+ 		return 1;
+ 	}
+ 
+-	fprintf(f, "7");
++	if (en && val)
++		fprintf(f, "%s", val);
++	else if (en)
++		fprintf(f, "7");
++	else
++		fprintf(f, "0");
++
+ 	fclose(f);
+ 
+ 	return 0;
+@@ -76,6 +82,7 @@ static void handle_signal(int sig)
+ 
+ int mt76_fwlog(const char *phyname, int argc, char **argv)
+ {
++#define BUF_SIZE 1504
+ 	struct sockaddr_in local = {
+ 		.sin_family = AF_INET,
+ 		.sin_addr.s_addr = INADDR_ANY,
+@@ -84,9 +91,9 @@ int mt76_fwlog(const char *phyname, int argc, char **argv)
+ 		.sin_family = AF_INET,
+ 		.sin_port = htons(55688),
+ 	};
+-	char buf[1504];
++	char *buf = calloc(BUF_SIZE, sizeof(char));
+ 	int ret = 0;
+-	int yes = 1;
++	/* int yes = 1; */
+ 	int s, fd;
+ 
+ 	if (argc < 1) {
+@@ -105,13 +112,13 @@ int mt76_fwlog(const char *phyname, int argc, char **argv)
+ 		return 1;
+ 	}
+ 
+-	setsockopt(s, SOL_SOCKET, SO_BROADCAST, &yes, sizeof(yes));
++	/* setsockopt(s, SOL_SOCKET, SO_BROADCAST, &yes, sizeof(yes)); */
+ 	if (bind(s, (struct sockaddr *)&local, sizeof(local)) < 0) {
+ 		perror("bind");
+ 		return 1;
+ 	}
+ 
+-	if (mt76_set_fwlog_en(phyname, true))
++	if (mt76_set_fwlog_en(phyname, true, argv[1]))
+ 		return 1;
+ 
+ 	fd = open(debugfs_path(phyname, "fwlog_data"), O_RDONLY);
+@@ -145,8 +152,8 @@ int mt76_fwlog(const char *phyname, int argc, char **argv)
+ 		if (!r)
+ 			continue;
+ 
+-		if (len > sizeof(buf)) {
+-			fprintf(stderr, "Length error: %d > %d\n", len, (int)sizeof(buf));
++		if (len > BUF_SIZE) {
++			fprintf(stderr, "Length error: %d > %d\n", len, BUF_SIZE);
+ 			ret = 1;
+ 			break;
+ 		}
+@@ -171,7 +178,8 @@ int mt76_fwlog(const char *phyname, int argc, char **argv)
+ 	close(fd);
+ 
+ out:
+-	mt76_set_fwlog_en(phyname, false);
++	mt76_set_fwlog_en(phyname, false, NULL);
++	free(buf);
+ 
+ 	return ret;
+ }
+-- 
+2.25.1
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1002-mt76-mt7915-csi-implement-csi-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
new file mode 100644
index 0000000..9286d3c
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1002-mt76-mt7915-csi-implement-csi-support.patch
@@ -0,0 +1,919 @@
+From 317b05bb3db50a63ef5e8497a9dc9c59e5830d9b Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Mon, 28 Mar 2022 09:12:54 +0800
+Subject: [PATCH] mt76: mt7915: csi: implement csi support
+
+---
+ mt76_connac_mcu.h |   2 +
+ mt7915/Makefile   |   4 +-
+ mt7915/init.c     |  39 ++++
+ mt7915/mcu.c      | 111 ++++++++++++
+ mt7915/mcu.h      |  76 ++++++++
+ mt7915/mt7915.h   |  20 ++
+ mt7915/vendor.c   | 452 ++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/vendor.h   |  60 ++++++
+ 8 files changed, 762 insertions(+), 2 deletions(-)
+ create mode 100644 mt7915/vendor.c
+ create mode 100644 mt7915/vendor.h
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 494c5c71..6f84a0fc 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -820,6 +820,7 @@ enum {
+ 	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
+ 	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
+ 	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
++	MCU_EXT_EVENT_CSI_REPORT = 0xc2,
+ };
+ 
+ enum {
+@@ -991,6 +992,7 @@ enum {
+ 	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
+ 	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
+ 	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
++	MCU_EXT_CMD_CSI_CTRL = 0xc2,
+ };
+ 
+ enum {
+diff --git a/mt7915/Makefile b/mt7915/Makefile
+index a3474e2f..e272c826 100644
+--- a/mt7915/Makefile
++++ b/mt7915/Makefile
+@@ -1,9 +1,9 @@
+ # SPDX-License-Identifier: ISC
+-
++EXTRA_CFLAGS += -DCONFIG_MTK_VENDOR
+ obj-$(CONFIG_MT7915E) += mt7915e.o
+ 
+ mt7915e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
+-	     debugfs.o mmio.o mtk_debugfs.o mtk_mcu.o
++	     debugfs.o mmio.o mtk_debugfs.o mtk_mcu.o vendor.o
+ 
+ mt7915e-$(CONFIG_NL80211_TESTMODE) += testmode.o
+ mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
+\ No newline at end of file
+diff --git a/mt7915/init.c b/mt7915/init.c
+index 02eb0612..dbcdf147 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -539,6 +539,12 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
+ 	/* init wiphy according to mphy and phy */
+ 	mt7915_init_wiphy(mphy->hw);
+ 
++#ifdef CONFIG_MTK_VENDOR
++	INIT_LIST_HEAD(&phy->csi.csi_list);
++	spin_lock_init(&phy->csi.csi_lock);
++	mt7915_vendor_register(phy);
++#endif
++
+ 	ret = mt76_register_phy(mphy, true, mt76_rates,
+ 				ARRAY_SIZE(mt76_rates));
+ 	if (ret)
+@@ -1027,6 +1033,25 @@ void mt7915_set_stream_he_caps(struct mt7915_phy *phy)
+ 	}
+ }
+ 
++#ifdef CONFIG_MTK_VENDOR
++static int mt7915_unregister_features(struct mt7915_phy *phy)
++{
++	struct csi_data *c, *tmp_c;
++
++	spin_lock_bh(&phy->csi.csi_lock);
++	phy->csi.enable = 0;
++
++	list_for_each_entry_safe(c, tmp_c, &phy->csi.csi_list, node) {
++		list_del(&c->node);
++		kfree(c);
++	}
++	spin_unlock_bh(&phy->csi.csi_lock);
++
++
++	return 0;
++}
++#endif
++
+ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
+ {
+ 	struct mt7915_phy *phy = mt7915_ext_phy(dev);
+@@ -1035,6 +1060,10 @@ static void mt7915_unregister_ext_phy(struct mt7915_dev *dev)
+ 	if (!phy)
+ 		return;
+ 
++#ifdef CONFIG_MTK_VENDOR
++	mt7915_unregister_features(phy);
++#endif
++
+ 	mt7915_unregister_thermal(phy);
+ 	mt76_unregister_phy(mphy);
+ 	ieee80211_free_hw(mphy->hw);
+@@ -1047,6 +1076,10 @@ static void mt7915_stop_hardware(struct mt7915_dev *dev)
+ 	mt7915_dma_cleanup(dev);
+ 	tasklet_disable(&dev->irq_tasklet);
+ 
++#ifdef CONFIG_MTK_VENDOR
++	mt7915_unregister_features(&dev->phy);
++#endif
++
+ 	if (is_mt7986(&dev->mt76))
+ 		mt7986_wmac_disable(dev);
+ }
+@@ -1087,6 +1120,12 @@ int mt7915_register_device(struct mt7915_dev *dev)
+ 	dev->mt76.test_ops = &mt7915_testmode_ops;
+ #endif
+ 
++#ifdef CONFIG_MTK_VENDOR
++	INIT_LIST_HEAD(&dev->phy.csi.csi_list);
++	spin_lock_init(&dev->phy.csi.csi_lock);
++	mt7915_vendor_register(&dev->phy);
++#endif
++
+ 	/* init led callbacks */
+ 	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
+ 		dev->mt76.led_cdev.brightness_set = mt7915_led_set_brightness;
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 9a7941fa..26831327 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -89,6 +89,10 @@ struct mt7915_fw_region {
+ #define HE_PHY(p, c)			u8_get_bits(c, IEEE80211_HE_PHY_##p)
+ #define HE_MAC(m, c)			u8_get_bits(c, IEEE80211_HE_MAC_##m)
+ 
++#ifdef CONFIG_MTK_VENDOR
++static int mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb);
++#endif
++
+ static u8
+ mt7915_mcu_get_sta_nss(u16 mcs_map)
+ {
+@@ -453,6 +457,11 @@ mt7915_mcu_rx_ext_event(struct mt7915_dev *dev, struct sk_buff *skb)
+ 	case MCU_EXT_EVENT_FW_LOG_2_HOST:
+ 		mt7915_mcu_rx_log_message(dev, skb);
+ 		break;
++#ifdef CONFIG_MTK_VENDOR
++	case MCU_EXT_EVENT_CSI_REPORT:
++		mt7915_mcu_report_csi(dev, skb);
++		break;
++#endif
+ 	case MCU_EXT_EVENT_BCC_NOTIFY:
+ 		mt7915_mcu_rx_bcc_notify(dev, skb);
+ 		break;
+@@ -3677,6 +3686,108 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+ 				 &req, sizeof(req), true);
+ }
+ 
++#ifdef CONFIG_MTK_VENDOR
++int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
++			u8 cfg, u8 v1, u32 v2, u8 *mac_addr)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct mt7915_mcu_csi req = {
++		.band = phy != &dev->phy,
++		.mode = mode,
++		.cfg = cfg,
++		.v1 = v1,
++		.v2 = cpu_to_le32(v2),
++	};
++
++	if (is_valid_ether_addr(mac_addr))
++		ether_addr_copy(req.mac_addr, mac_addr);
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(CSI_CTRL), &req,
++				 sizeof(req), false);
++}
++
++static int
++mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
++{
++	struct mt7915_mcu_rxd *rxd = (struct mt7915_mcu_rxd *)skb->data;
++	struct mt7915_phy *phy = &dev->phy;
++	struct mt7915_mcu_csi_report *cr;
++	struct csi_data *csi;
++	int len, i;
++
++	skb_pull(skb, sizeof(struct mt7915_mcu_rxd));
++
++	len = le16_to_cpu(rxd->len) - sizeof(struct mt7915_mcu_rxd) + 24;
++	if (len < sizeof(*cr))
++		return -EINVAL;
++
++	cr = (struct mt7915_mcu_csi_report *)skb->data;
++
++	if (phy->csi.interval &&
++	    le32_to_cpu(cr->ts) < phy->csi.last_record + phy->csi.interval)
++		return 0;
++
++	csi = kzalloc(sizeof(*csi), GFP_KERNEL);
++	if (!csi)
++		return -ENOMEM;
++
++#define SET_CSI_DATA(_field)	csi->_field = le32_to_cpu(cr->_field)
++	SET_CSI_DATA(ch_bw);
++	SET_CSI_DATA(rssi);
++	SET_CSI_DATA(snr);
++	SET_CSI_DATA(data_num);
++	SET_CSI_DATA(data_bw);
++	SET_CSI_DATA(pri_ch_idx);
++	SET_CSI_DATA(info);
++	SET_CSI_DATA(rx_mode);
++	SET_CSI_DATA(h_idx);
++	SET_CSI_DATA(ts);
++
++	SET_CSI_DATA(band);
++	if (csi->band && !phy->band_idx)
++		phy = mt7915_ext_phy(dev);
++#undef SET_CSI_DATA
++
++	for (i = 0; i < csi->data_num; i++) {
++		csi->data_i[i] = le16_to_cpu(cr->data_i[i]);
++		csi->data_q[i] = le16_to_cpu(cr->data_q[i]);
++	}
++
++	memcpy(csi->ta, cr->ta, ETH_ALEN);
++	csi->tx_idx = le32_get_bits(cr->trx_idx, GENMASK(31, 16));
++	csi->rx_idx = le32_get_bits(cr->trx_idx, GENMASK(15, 0));
++
++	INIT_LIST_HEAD(&csi->node);
++	spin_lock_bh(&phy->csi.csi_lock);
++
++	if (!phy->csi.enable) {
++		kfree(csi);
++		spin_unlock_bh(&phy->csi.csi_lock);
++		return 0;
++	}
++
++	list_add_tail(&csi->node, &phy->csi.csi_list);
++	phy->csi.count++;
++
++	if (phy->csi.count > CSI_MAX_BUF_NUM) {
++		struct csi_data *old;
++
++		old = list_first_entry(&phy->csi.csi_list,
++				       struct csi_data, node);
++
++		list_del(&old->node);
++		kfree(old);
++		phy->csi.count--;
++	}
++
++	if (csi->h_idx & BIT(15)) /* last chain */
++		phy->csi.last_record = csi->ts;
++	spin_unlock_bh(&phy->csi.csi_lock);
++
++	return 0;
++}
++#endif
++
+ #ifdef MTK_DEBUG
+ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp)
+ {
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 94e0a81b..007282d4 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -493,4 +493,80 @@ enum {
+ 					 sizeof(struct bss_info_bcn_mbss) + \
+ 					 sizeof(struct bss_info_bcn_cont))
+ 
++#ifdef CONFIG_MTK_VENDOR
++struct mt7915_mcu_csi {
++	u8 band;
++	u8 mode;
++	u8 cfg;
++	u8 v1;
++	__le32 v2;
++	u8 mac_addr[ETH_ALEN];
++	u8 _rsv[34];
++} __packed;
++
++struct csi_tlv {
++	__le32 tag;
++	__le32 len;
++} __packed;
++
++#define CSI_MAX_COUNT	256
++#define CSI_MAX_BUF_NUM	3000
++
++struct mt7915_mcu_csi_report {
++	struct csi_tlv _t0;
++	__le32 ver;
++	struct csi_tlv _t1;
++	__le32 ch_bw;
++	struct csi_tlv _t2;
++	__le32 rssi;
++	struct csi_tlv _t3;
++	__le32 snr;
++	struct csi_tlv _t4;
++	__le32 band;
++	struct csi_tlv _t5;
++	__le32 data_num;
++	struct csi_tlv _t6;
++	__le16 data_i[CSI_MAX_COUNT];
++	struct csi_tlv _t7;
++	__le16 data_q[CSI_MAX_COUNT];
++	struct csi_tlv _t8;
++	__le32 data_bw;
++	struct csi_tlv _t9;
++	__le32 pri_ch_idx;
++	struct csi_tlv _t10;
++	u8 ta[8];
++	struct csi_tlv _t11;
++	__le32 info;
++	struct csi_tlv _t12;
++	__le32 rx_mode;
++	struct csi_tlv _t17;
++	__le32 h_idx;
++	struct csi_tlv _t18;
++	__le32 trx_idx;
++	struct csi_tlv _t19;
++	__le32 ts;
++} __packed;
++
++struct csi_data {
++	u8 ch_bw;
++	u16 data_num;
++	s16 data_i[CSI_MAX_COUNT];
++	s16 data_q[CSI_MAX_COUNT];
++	u8 band;
++	s8 rssi;
++	u8 snr;
++	u32 ts;
++	u8 data_bw;
++	u8 pri_ch_idx;
++	u8 ta[ETH_ALEN];
++	u32 info;
++	u8 rx_mode;
++	u32 h_idx;
++	u16 tx_idx;
++	u16 rx_idx;
++
++	struct list_head node;
++};
++#endif
++
+ #endif
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index e0ec262a..908c47c8 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -267,6 +267,20 @@ struct mt7915_phy {
+ 		u8 spe_idx;
+ 	} test;
+ #endif
++
++#ifdef CONFIG_MTK_VENDOR
++	struct {
++		struct list_head csi_list;
++		spinlock_t csi_lock;
++		u32 count;
++		bool mask;
++		bool reorder;
++		bool enable;
++
++		u32 interval;
++		u32 last_record;
++	} csi;
++#endif
+ };
+ 
+ struct mt7915_dev {
+@@ -615,6 +629,12 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			    struct ieee80211_sta *sta, struct dentry *dir);
+ #endif
+ 
++#ifdef CONFIG_MTK_VENDOR
++void mt7915_vendor_register(struct mt7915_phy *phy);
++int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
++			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
++#endif
++
+ #ifdef MTK_DEBUG
+ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir);
+ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3, bool wait_resp);
+diff --git a/mt7915/vendor.c b/mt7915/vendor.c
+new file mode 100644
+index 00000000..98fd9c2d
+--- /dev/null
++++ b/mt7915/vendor.c
+@@ -0,0 +1,452 @@
++// SPDX-License-Identifier: ISC
++/*
++ * Copyright (C) 2020, MediaTek Inc. All rights reserved.
++ */
++
++#include <net/netlink.h>
++
++#include "mt7915.h"
++#include "mcu.h"
++#include "vendor.h"
++
++static const struct nla_policy
++csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
++	[MTK_VENDOR_ATTR_CSI_CTRL_CFG] = {.type = NLA_NESTED },
++	[MTK_VENDOR_ATTR_CSI_CTRL_CFG_MODE] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_CSI_CTRL_CFG_TYPE] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL1] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL2] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR] = { .type = NLA_NESTED },
++	[MTK_VENDOR_ATTR_CSI_CTRL_INTERVAL] = { .type = NLA_U32 },
++	[MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM] = { .type = NLA_U16 },
++	[MTK_VENDOR_ATTR_CSI_CTRL_DATA] = { .type = NLA_NESTED },
++};
++
++struct csi_null_tone {
++	u8 start;
++	u8 end;
++};
++
++struct csi_reorder{
++	u8 dest;
++	u8 start;
++	u8 end;
++};
++
++struct csi_mask {
++	struct csi_null_tone null[10];
++	u8 pilot[8];
++	struct csi_reorder ro[3];
++};
++
++static const struct csi_mask csi_mask_groups[] = {
++	/* OFDM */
++	{ .null = { { 0 }, { 27, 37 } },
++	  .ro = { {0, 0, 63} },
++	},
++	{ .null = { { 0, 69 }, { 96 }, { 123, 127 } },
++	  .ro = { { 0, 96 }, { 38, 70, 95 }, { 1, 97, 122 } },
++	},
++	{ .null = { { 0, 5 }, { 32 }, { 59, 127 } },
++	  .ro = { { 0, 32 }, { 38, 6, 31 }, { 1, 33, 58 } },
++	},
++	{ .null = { { 0, 5 }, { 32 }, { 59, 69 }, { 96 }, { 123, 127 } },
++	  .ro = { { 0, 0, 127 } },
++	},
++	{ .null = { { 0, 133 }, { 160 }, { 187, 255 } },
++	  .ro = { { 0, 160 }, { 1, 161, 186 }, { 38, 134, 159 } },
++	},
++	{ .null = { { 0, 197 }, { 224 }, { 251, 255 } },
++	  .ro = { { 0, 224 }, { 1, 225, 250 }, { 38, 198, 223 } },
++	},
++	{ .null = { { 0, 5 }, { 32 }, { 59, 255 } },
++	  .ro = { { 0, 32 }, { 1, 33, 58 }, { 38, 6, 31 } },
++	},
++	{ .null = { { 0, 69 }, { 96 }, { 123, 255 } },
++	  .ro = { { 0, 96 }, { 1, 97, 122 }, { 38, 70, 95 } },
++	},
++	{ .null = { { 0, 133 }, { 160 }, { 187, 197 }, { 224 }, { 251, 255 } },
++	  .ro = { { 0, 192 }, { 2, 198, 250 }, { 74, 134, 186 } },
++	},
++	{ .null = { { 0, 5 }, { 32 }, { 59, 69 }, { 96 }, { 123, 255 } },
++	  .ro = { { 0, 64 }, { 2, 70, 122 }, { 74, 6, 58 } },
++	},
++	{ .null = { { 0, 5 }, { 32 }, { 59, 69 }, { 96 }, { 123, 133 },
++		    { 160 }, { 187, 197 }, { 224 }, { 251, 255 } },
++	  .ro = { { 0, 0, 255 } },
++	},
++
++	/* HT/VHT */
++	{ .null = { { 0 }, { 29, 35 } },
++	  .pilot = { 7, 21, 43, 57 },
++	  .ro = { { 0, 0, 63 } },
++	},
++	{ .null = { { 0, 67 }, { 96 }, { 125, 127 } },
++	  .pilot = { 75, 89, 103, 117 },
++	  .ro = { { 0, 96 }, { 36, 68, 95 }, { 1, 97, 124 } },
++	},
++	{ .null = { { 0, 3 }, { 32 }, { 61, 127 } },
++	  .pilot = { 11, 25, 39, 53 },
++	  .ro = { { 0, 32 }, { 36, 4, 31 }, { 1, 33, 60 } },
++	},
++	{ .null = { { 0, 1 }, { 59, 69 }, { 127 } },
++	  .pilot = { 11, 25, 53, 75, 103, 117 },
++	  .ro = { { 0, 0, 127 } },
++	},
++	{ .null = { { 0, 131 }, { 160 }, { 189, 255 } },
++	  .pilot = { 139, 153, 167, 181 },
++	  .ro = { { 0, 160 }, { 1, 161, 188 }, { 36, 132, 159 } },
++	},
++	{ .null = { { 0, 195 }, { 224 }, { 253 }, { 255 } },
++	  .pilot = { 203, 217, 231, 245 },
++	  .ro = { { 0, 224 }, { 1, 225, 252 }, { 36, 196, 223 } },
++	},
++	{ .null = { { 0, 3 }, { 32 }, { 61, 255 } },
++	  .pilot = { 11, 25, 39, 53 },
++	  .ro = { { 0, 32 }, { 1, 33, 60 }, { 36, 4, 31 } },
++	},
++	{ .null = { { 0, 67 }, { 96 }, { 125, 255 } },
++	  .pilot = { 75, 89, 103, 117 },
++	  .ro = { { 0, 96 }, { 1, 97, 124 }, { 36, 68, 95 } },
++	},
++	{ .null = { { 0, 133 }, { 191, 193 }, { 251, 255 } },
++	  .pilot = { 139, 167, 181, 203, 217, 245 },
++	  .ro = { { 0, 192 }, { 2, 194, 250 }, { 70, 134, 190 } },
++	},
++	{ .null = { { 0, 5 }, { 63, 65 }, { 123, 127 } },
++	  .pilot = { 11, 39, 53, 75, 89, 117 },
++	  .ro = { { 0, 64 }, { 2, 66, 122 }, { 70, 6, 62 } },
++	},
++	{ .null = { { 0, 1 }, { 123, 133 }, { 255 } },
++	  .pilot = { 11, 39, 75, 103, 153, 181, 217, 245 },
++	  .ro = { { 0, 0, 255 } },
++	},
++
++	/* HE */
++	{ .null = { { 0 }, { 31, 33 } },
++	  .pilot = { 12, 29, 35, 52 },
++	  .ro = { { 0, 0, 63 } },
++	},
++	{ .null = { { 30, 34 }, { 96 } },
++	  .pilot = { 4, 21, 43, 60, 70, 87, 105, 122 },
++	  .ro = { { 0, 96 }, { 34, 66, 95 }, { 1, 97, 126 } },
++	},
++	{ .null = { { 32 }, { 94, 98 } },
++	  .pilot = { 6, 23, 41, 58, 68, 85, 107, 124 },
++	  .ro = { { 0, 32 }, { 34, 2, 31 }, { 1, 31, 62 } },
++	},
++	{ .null = { { 0 }, { 62, 66 } },
++	  .pilot = { 9, 26, 36, 53, 75, 92, 102, 119 },
++	  .ro = { { 0, 0, 127 } },
++	},
++	{ .null = { { 30, 34 }, { 160 } },
++	  .pilot = { 4, 21, 43, 60, 137, 154, 166, 183 },
++	  .ro = { { 0, 160 }, { 1, 161, 190 }, { 34, 130, 159 } },
++	},
++	{ .null = { { 94, 98 }, { 224 } },
++	  .pilot = { 68, 85, 107, 124, 201, 218, 230, 247 },
++	  .ro = { { 0, 224 }, { 1, 225, 254 }, { 34, 194, 223 } },
++	},
++	{ .null = { { 32 }, { 158, 162 } },
++	  .pilot = { 9, 26, 38, 55, 132, 149, 171, 188 },
++	  .ro = { { 0, 32 }, { 1, 33, 62 }, { 34, 2, 31 } },
++	},
++	{ .null = { { 96 }, { 222, 226 } },
++	  .pilot = { 73, 90, 102, 119, 196, 213, 235, 252 },
++	  .ro = { { 0, 96 }, { 1, 97, 126 }, { 34, 66, 95 } },
++	},
++	{ .null = { { 62, 66 }, { 192 } },
++	  .pilot = { 36, 53, 75, 92, 169, 186, 198, 215 },
++	  .ro = { { 0, 192 }, { 1, 193, 253 }, { 67, 131, 191 } },
++	},
++	{ .null = { { 64 }, { 190, 194 } },
++	  .pilot = { 41, 58, 70, 87, 164, 181, 203, 220 },
++	  .ro = { { 0, 64 }, { 1, 65, 125 }, { 67, 3, 63 } },
++	},
++	{ .null = { { 0 }, { 126, 130 } },
++	  .pilot = { 6, 23, 100, 117, 139, 156, 233, 250 },
++	  .ro = { { 0, 0, 255 } },
++	},
++};
++
++static inline u8 csi_group_idx(u8 mode, u8 ch_bw, u8 data_bw, u8 pri_ch_idx)
++{
++	if (ch_bw < 2 || data_bw < 1)
++		return mode * 11 + ch_bw * ch_bw + pri_ch_idx;
++	else
++		return mode * 11 + ch_bw * ch_bw + (data_bw + 1) * 2 + pri_ch_idx;
++}
++
++static int mt7915_vendor_csi_ctrl(struct wiphy *wiphy,
++				  struct wireless_dev *wdev,
++				  const void *data,
++				  int data_len)
++{
++	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++	struct mt7915_phy *phy = mt7915_hw_phy(hw);
++	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_CSI_CTRL];
++	int err;
++
++	err = nla_parse(tb, MTK_VENDOR_ATTR_CSI_CTRL_MAX, data, data_len,
++			csi_ctrl_policy, NULL);
++	if (err)
++		return err;
++
++	if (tb[MTK_VENDOR_ATTR_CSI_CTRL_CFG]) {
++		u8 mode = 0, type = 0, v1 = 0, v2 = 0;
++		u8 mac_addr[ETH_ALEN] = {};
++		struct nlattr *cur;
++		int rem;
++
++		nla_for_each_nested(cur, tb[MTK_VENDOR_ATTR_CSI_CTRL_CFG], rem) {
++			switch(nla_type(cur)) {
++			case MTK_VENDOR_ATTR_CSI_CTRL_CFG_MODE:
++				mode = nla_get_u8(cur);
++				break;
++			case MTK_VENDOR_ATTR_CSI_CTRL_CFG_TYPE:
++				type = nla_get_u8(cur);
++				break;
++			case MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL1:
++				v1 = nla_get_u8(cur);
++				break;
++			case MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL2:
++				v2 = nla_get_u8(cur);
++				break;
++			default:
++				return -EINVAL;
++			};
++		}
++
++		if (tb[MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR]) {
++			int idx = 0;
++
++			nla_for_each_nested(cur, tb[MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR], rem) {
++				mac_addr[idx++] = nla_get_u8(cur);
++			}
++		}
++
++		mt7915_mcu_set_csi(phy, mode, type, v1, v2, mac_addr);
++
++		spin_lock_bh(&phy->csi.csi_lock);
++
++		phy->csi.enable = !!mode;
++
++		if (mode == 2 && type == 5) {
++			if (v1 >= 1)
++				phy->csi.mask = 1;
++			if (v1 == 2)
++				phy->csi.reorder = 1;
++		}
++
++		/* clean up old csi stats */
++		if ((mode == 0 || mode == 2) && !list_empty(&phy->csi.csi_list)) {
++			struct csi_data *c, *tmp_c;
++
++			list_for_each_entry_safe(c, tmp_c, &phy->csi.csi_list,
++						 node) {
++				list_del(&c->node);
++				kfree(c);
++				phy->csi.count--;
++			}
++		} else if (mode == 1) {
++			phy->csi.last_record = 0;
++		}
++
++		spin_unlock_bh(&phy->csi.csi_lock);
++	}
++
++	if (tb[MTK_VENDOR_ATTR_CSI_CTRL_INTERVAL])
++		phy->csi.interval = nla_get_u32(tb[MTK_VENDOR_ATTR_CSI_CTRL_INTERVAL]);
++
++	return 0;
++}
++
++static void
++mt7915_vendor_csi_tone_mask(struct mt7915_phy *phy, struct csi_data *csi)
++{
++	static const u8 mode_map[] = {
++		[MT_PHY_TYPE_OFDM] = 0,
++		[MT_PHY_TYPE_HT] = 1,
++		[MT_PHY_TYPE_VHT] = 1,
++		[MT_PHY_TYPE_HE_SU] = 2,
++	};
++	const struct csi_mask *cmask;
++	int i;
++
++	if (csi->rx_mode == MT_PHY_TYPE_CCK || !phy->csi.mask)
++		return;
++
++	if (csi->data_bw == IEEE80211_STA_RX_BW_40)
++		csi->pri_ch_idx /= 2;
++
++	cmask = &csi_mask_groups[csi_group_idx(mode_map[csi->rx_mode],
++					       csi->ch_bw,
++					       csi->data_bw,
++					       csi->pri_ch_idx)];
++
++	for (i = 0; i < 10; i++) {
++		const struct csi_null_tone *ntone = &cmask->null[i];
++		u8 start = ntone->start;
++		u8 end = ntone->end;
++		int j;
++
++		if (!start && !end && i > 0)
++			break;
++
++		if (!end)
++			end = start;
++
++		for (j = start; j <= end; j++) {
++			csi->data_i[j] = 0;
++			csi->data_q[j] = 0;
++		}
++	}
++
++	for (i = 0; i < 8; i++) {
++		u8 pilot = cmask->pilot[i];
++
++		if (!pilot)
++			break;
++
++		csi->data_i[pilot] = 0;
++		csi->data_q[pilot] = 0;
++	}
++
++	if (!phy->csi.reorder)
++		return;
++
++	for (i = 0; i < 3; i++) {
++		const struct csi_reorder *ro = &cmask->ro[i];
++		u8 dest = ro->dest;
++		u8 start = ro->start;
++		u8 end = ro->end;
++
++		if (!dest && !start && !end)
++			break;
++
++		if (dest == start)
++			continue;
++
++		if (end) {
++			memmove(&csi->data_i[dest], &csi->data_i[start],
++				end - start + 1);
++			memmove(&csi->data_q[dest], &csi->data_q[start],
++				end - start + 1);
++		} else {
++			csi->data_i[dest] = csi->data_i[start];
++			csi->data_q[dest] = csi->data_q[start];
++		}
++	}
++}
++
++static int
++mt7915_vendor_csi_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
++			    struct sk_buff *skb, const void *data, int data_len,
++			    unsigned long *storage)
++{
++#define RESERVED_SET	BIT(31)
++	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++	struct mt7915_phy *phy = mt7915_hw_phy(hw);
++	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_CSI_CTRL];
++	int err = 0;
++
++	if (*storage & RESERVED_SET) {
++		if ((*storage & GENMASK(15, 0)) == 0)
++			return -ENOENT;
++		(*storage)--;
++	}
++
++	if (data) {
++		err = nla_parse(tb, MTK_VENDOR_ATTR_CSI_CTRL_MAX, data, data_len,
++				csi_ctrl_policy, NULL);
++		if (err)
++			return err;
++	}
++
++	if (!(*storage & RESERVED_SET) && tb[MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM]) {
++		*storage = nla_get_u16(tb[MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM]);
++		*storage |= RESERVED_SET;
++	}
++
++	spin_lock_bh(&phy->csi.csi_lock);
++
++	if (!list_empty(&phy->csi.csi_list)) {
++		struct csi_data *csi;
++		void *a, *b;
++		int i;
++
++		csi = list_first_entry(&phy->csi.csi_list, struct csi_data, node);
++
++		mt7915_vendor_csi_tone_mask(phy, csi);
++
++		a = nla_nest_start(skb, MTK_VENDOR_ATTR_CSI_CTRL_DATA);
++
++		if (nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_VER, 1) ||
++		    nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_RSSI, csi->rssi) ||
++		    nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_SNR, csi->snr) ||
++		    nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_BW, csi->data_bw) ||
++		    nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_CH_IDX, csi->pri_ch_idx) ||
++		    nla_put_u8(skb, MTK_VENDOR_ATTR_CSI_DATA_MODE, csi->rx_mode))
++			goto out;
++
++		if (nla_put_u16(skb, MTK_VENDOR_ATTR_CSI_DATA_TX_ANT, csi->tx_idx) ||
++		    nla_put_u16(skb, MTK_VENDOR_ATTR_CSI_DATA_RX_ANT, csi->rx_idx))
++			goto out;
++
++		if (nla_put_u32(skb, MTK_VENDOR_ATTR_CSI_DATA_INFO, csi->info) ||
++		    nla_put_u32(skb, MTK_VENDOR_ATTR_CSI_DATA_H_IDX, csi->h_idx) ||
++		    nla_put_u32(skb, MTK_VENDOR_ATTR_CSI_DATA_TS, csi->ts))
++			goto out;
++
++		b = nla_nest_start(skb, MTK_VENDOR_ATTR_CSI_DATA_TA);
++			for (i = 0; i < ARRAY_SIZE(csi->ta); i++)
++				if (nla_put_u8(skb, i, csi->ta[i]))
++					goto out;
++		nla_nest_end(skb, b);
++
++		b = nla_nest_start(skb, MTK_VENDOR_ATTR_CSI_DATA_I);
++			for (i = 0; i < ARRAY_SIZE(csi->data_i); i++)
++				if (nla_put_u16(skb, i, csi->data_i[i]))
++					goto out;
++		nla_nest_end(skb, b);
++
++		b = nla_nest_start(skb, MTK_VENDOR_ATTR_CSI_DATA_Q);
++			for (i = 0; i < ARRAY_SIZE(csi->data_q); i++)
++				if (nla_put_u16(skb, i, csi->data_q[i]))
++					goto out;
++		nla_nest_end(skb, b);
++
++		nla_nest_end(skb, a);
++
++		list_del(&csi->node);
++		kfree(csi);
++		phy->csi.count--;
++
++		err = phy->csi.count;
++	}
++out:
++	spin_unlock_bh(&phy->csi.csi_lock);
++
++	return err;
++}
++
++static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
++	{
++		.info = {
++			.vendor_id = MTK_NL80211_VENDOR_ID,
++			.subcmd = MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL,
++		},
++		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
++			 WIPHY_VENDOR_CMD_NEED_RUNNING,
++		.doit = mt7915_vendor_csi_ctrl,
++		.dumpit = mt7915_vendor_csi_ctrl_dump,
++		.policy = csi_ctrl_policy,
++		.maxattr = MTK_VENDOR_ATTR_CSI_CTRL_MAX,
++	}
++};
++
++void mt7915_vendor_register(struct mt7915_phy *phy)
++{
++	phy->mt76->hw->wiphy->vendor_commands = mt7915_vendor_commands;
++	phy->mt76->hw->wiphy->n_vendor_commands = ARRAY_SIZE(mt7915_vendor_commands);
++}
+diff --git a/mt7915/vendor.h b/mt7915/vendor.h
+new file mode 100644
+index 00000000..9d3db2a7
+--- /dev/null
++++ b/mt7915/vendor.h
+@@ -0,0 +1,60 @@
++#ifndef __MT7915_VENDOR_H
++#define __MT7915_VENDOR_H
++
++#define MTK_NL80211_VENDOR_ID	0x0ce7
++
++enum mtk_nl80211_vendor_subcmds {
++	MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
++};
++
++enum mtk_vendor_attr_csi_ctrl {
++	MTK_VENDOR_ATTR_CSI_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_CSI_CTRL_CFG,
++	MTK_VENDOR_ATTR_CSI_CTRL_CFG_MODE,
++	MTK_VENDOR_ATTR_CSI_CTRL_CFG_TYPE,
++	MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL1,
++	MTK_VENDOR_ATTR_CSI_CTRL_CFG_VAL2,
++	MTK_VENDOR_ATTR_CSI_CTRL_MAC_ADDR,
++	MTK_VENDOR_ATTR_CSI_CTRL_INTERVAL,
++
++	MTK_VENDOR_ATTR_CSI_CTRL_DUMP_NUM,
++
++	MTK_VENDOR_ATTR_CSI_CTRL_DATA,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_CSI_CTRL,
++	MTK_VENDOR_ATTR_CSI_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_CSI_CTRL - 1
++};
++
++enum mtk_vendor_attr_csi_data {
++	MTK_VENDOR_ATTR_CSI_DATA_UNSPEC,
++	MTK_VENDOR_ATTR_CSI_DATA_PAD,
++
++	MTK_VENDOR_ATTR_CSI_DATA_VER,
++	MTK_VENDOR_ATTR_CSI_DATA_TS,
++	MTK_VENDOR_ATTR_CSI_DATA_RSSI,
++	MTK_VENDOR_ATTR_CSI_DATA_SNR,
++	MTK_VENDOR_ATTR_CSI_DATA_BW,
++	MTK_VENDOR_ATTR_CSI_DATA_CH_IDX,
++	MTK_VENDOR_ATTR_CSI_DATA_TA,
++	MTK_VENDOR_ATTR_CSI_DATA_I,
++	MTK_VENDOR_ATTR_CSI_DATA_Q,
++	MTK_VENDOR_ATTR_CSI_DATA_INFO,
++	MTK_VENDOR_ATTR_CSI_DATA_RSVD1,
++	MTK_VENDOR_ATTR_CSI_DATA_RSVD2,
++	MTK_VENDOR_ATTR_CSI_DATA_RSVD3,
++	MTK_VENDOR_ATTR_CSI_DATA_RSVD4,
++	MTK_VENDOR_ATTR_CSI_DATA_TX_ANT,
++	MTK_VENDOR_ATTR_CSI_DATA_RX_ANT,
++	MTK_VENDOR_ATTR_CSI_DATA_MODE,
++	MTK_VENDOR_ATTR_CSI_DATA_H_IDX,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_CSI_DATA,
++	MTK_VENDOR_ATTR_CSI_DATA_MAX =
++		NUM_MTK_VENDOR_ATTRS_CSI_DATA - 1
++};
++
++#endif
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1003-mt76-mt7915-air-monitor-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1003-mt76-mt7915-air-monitor-support.patch
new file mode 100644
index 0000000..32f206c
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1003-mt76-mt7915-air-monitor-support.patch
@@ -0,0 +1,549 @@
+From 03d314ba186fa4d49e599690d5e719650d62cd90 Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Tue, 11 Jan 2022 12:03:23 +0800
+Subject: [PATCH 1003/1005] mt76: mt7915: air monitor support
+
+---
+ .../wireless/mediatek/mt76/mt76_connac_mcu.h  |   2 +
+ .../net/wireless/mediatek/mt76/mt7915/mac.c   |   4 +
+ .../net/wireless/mediatek/mt76/mt7915/main.c  |   3 +
+ .../wireless/mediatek/mt76/mt7915/mt7915.h    |  34 ++
+ .../wireless/mediatek/mt76/mt7915/vendor.c    | 359 ++++++++++++++++++
+ .../wireless/mediatek/mt76/mt7915/vendor.h    |  38 ++
+ 6 files changed, 440 insertions(+)
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 464b55f..b0f2d97 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -992,6 +992,8 @@ enum {
+ 	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
+ 	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
+ 	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
++	/* for vendor csi and air monitor */
++	MCU_EXT_CMD_SMESH_CTRL = 0xae,
+ 	MCU_EXT_CMD_CSI_CTRL = 0xc2,
+ };
+ 
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 261861a..78d2a96 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -827,6 +827,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
+ 			seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
+ 			qos_ctl = *ieee80211_get_qos_ctl(hdr);
+ 		}
++#ifdef CONFIG_MTK_VENDOR
++		if (phy->amnt_ctrl.enable)
++			mt7915_vendor_amnt_fill_rx(phy, skb);
++#endif
+ 	} else {
+ 		status->flag |= RX_FLAG_8023;
+ 	}
+diff --git a/mt7915/main.c b/mt7915/main.c
+index c3f44d8..1beadd8 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -677,6 +677,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 	if (ret)
+ 		return ret;
+ 
++#ifdef CONFIG_MTK_VENDOR
++	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
++#endif
+ 	return mt7915_mcu_add_rate_ctrl(dev, vif, sta, false);
+ }
+ 
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index df42286..6e62a46 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -222,6 +222,35 @@ struct mt7915_hif {
+ 	int irq;
+ };
+ 
++#ifdef CONFIG_MTK_VENDOR
++#define MT7915_AIR_MONITOR_MAX_ENTRY	16
++#define MT7915_AIR_MONITOR_MAX_GROUP	MT7915_AIR_MONITOR_MAX_ENTRY >> 2
++
++struct mt7915_air_monitor_group {
++	bool enable;
++	bool used[2];
++};
++
++struct mt7915_air_monitor_entry {
++	bool enable;
++
++	u8 group_idx;
++	u8 group_used_idx;
++	u8 muar_idx;
++	u8 addr[ETH_ALEN];
++	unsigned int last_seen;
++	s8 rssi[4];
++	struct ieee80211_sta *sta;
++};
++
++struct mt7915_air_monitor_ctrl {
++	u8 enable;
++
++	struct mt7915_air_monitor_group group[MT7915_AIR_MONITOR_MAX_GROUP];
++	struct mt7915_air_monitor_entry entry[MT7915_AIR_MONITOR_MAX_ENTRY];
++};
++#endif
++
+ struct mt7915_phy {
+ 	struct mt76_phy *mt76;
+ 	struct mt7915_dev *dev;
+@@ -278,6 +307,8 @@ struct mt7915_phy {
+ 		u32 interval;
+ 		u32 last_record;
+ 	} csi;
++
++	struct mt7915_air_monitor_ctrl amnt_ctrl;
+ #endif
+ };
+ 
+@@ -626,6 +657,9 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ void mt7915_vendor_register(struct mt7915_phy *phy);
+ int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
+ 			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
++void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb);
++int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
++				  struct ieee80211_sta *sta);
+ #endif
+ 
+ #ifdef MTK_DEBUG
+diff --git a/mt7915/vendor.c b/mt7915/vendor.c
+index 98fd9c2..b94d787 100644
+--- a/mt7915/vendor.c
++++ b/mt7915/vendor.c
+@@ -430,6 +430,353 @@ out:
+ 	return err;
+ }
+ 
++static const struct nla_policy
++amnt_ctrl_policy[NUM_MTK_VENDOR_ATTRS_AMNT_CTRL] = {
++	[MTK_VENDOR_ATTR_AMNT_CTRL_SET] = {.type = NLA_NESTED },
++	[MTK_VENDOR_ATTR_AMNT_CTRL_DUMP] = { .type = NLA_NESTED },
++};
++
++static const struct nla_policy
++amnt_set_policy[NUM_MTK_VENDOR_ATTRS_AMNT_SET] = {
++	[MTK_VENDOR_ATTR_AMNT_SET_INDEX] = {.type = NLA_U8 },
++	[MTK_VENDOR_ATTR_AMNT_SET_MACADDR] = { .type = NLA_NESTED },
++};
++
++static const struct nla_policy
++amnt_dump_policy[NUM_MTK_VENDOR_ATTRS_AMNT_DUMP] = {
++	[MTK_VENDOR_ATTR_AMNT_DUMP_INDEX] = {.type = NLA_U8 },
++	[MTK_VENDOR_ATTR_AMNT_DUMP_LEN] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_AMNT_DUMP_RESULT] = { .type = NLA_NESTED },
++};
++
++struct mt7915_amnt_data {
++	u8 idx;
++	u8 addr[ETH_ALEN];
++	s8 rssi[4];
++	u32 last_seen;
++};
++
++struct mt7915_smesh {
++	u8 band;
++	u8 write;
++	u8 enable;
++	bool a2;
++	bool a1;
++	bool data;
++	bool mgnt;
++	bool ctrl;
++} __packed;
++
++struct mt7915_smesh_event {
++	u8 band;
++	__le32 value;
++} __packed;
++
++static int
++mt7915_vendor_smesh_ctrl(struct mt7915_phy *phy, u8 write,
++			 u8 enable, u32 *value)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct mt7915_smesh req = {
++		.band = phy != &dev->phy,
++		.write = write,
++		.enable = enable,
++		.a2 = 1,
++		.a1 = 1,
++		.data = 1,
++	};
++	struct mt7915_smesh_event *res;
++	struct sk_buff *skb;
++	int ret = 0;
++
++	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(SMESH_CTRL),
++					&req, sizeof(req), !write, &skb);
++
++	if (ret || write)
++		return ret;
++
++	res = (struct mt7915_smesh_event *) skb->data;
++
++	if (!value)
++		return -EINVAL;
++
++	*value = res->value;
++
++	dev_kfree_skb(skb);
++
++	return 0;
++}
++
++static int
++mt7915_vendor_amnt_muar(struct mt7915_phy *phy, u8 muar_idx, u8 *addr)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		u8 mode;
++		u8 force_clear;
++		u8 clear_bitmap[8];
++		u8 entry_count;
++		u8 write;
++		u8 band;
++
++		u8 index;
++		u8 bssid;
++		u8 addr[ETH_ALEN];
++	} __packed req = {
++		.entry_count = 1,
++		.write = 1,
++		.band = phy != &dev->phy,
++		.index = muar_idx,
++	};
++
++	ether_addr_copy(req.addr, addr);
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MUAR_UPDATE), &req,
++				 sizeof(req), true);
++}
++
++static int
++mt7915_vendor_amnt_set_en(struct mt7915_phy *phy, u8 enable)
++{
++	u32 status;
++	int ret;
++
++	ret = mt7915_vendor_smesh_ctrl(phy, 0, enable, &status);
++	if (ret)
++		return ret;
++
++	status = status & 0xff;
++
++	if (status == enable)
++		return 0;
++
++	ret = mt7915_vendor_smesh_ctrl(phy, 1, enable, &status);
++	if (ret)
++		return ret;
++
++	return 0;
++}
++
++static int
++mt7915_vendor_amnt_set_addr(struct mt7915_phy *phy, u8 index, u8 *addr)
++{
++	struct mt7915_air_monitor_ctrl *amnt_ctrl = &phy->amnt_ctrl;
++	struct mt7915_air_monitor_group *group;
++	struct mt7915_air_monitor_entry *entry = &amnt_ctrl->entry[index];
++	const u8 zero_addr[ETH_ALEN] = {};
++	int enable = !ether_addr_equal(addr, zero_addr);
++	int ret, i, j;
++
++	if (enable == 1 && entry->enable == 1) {
++		ether_addr_copy(entry->addr, addr);
++	} else if (enable == 1 && entry->enable == 0){
++		for (i = 0; i < MT7915_AIR_MONITOR_MAX_GROUP; i++) {
++			group = &(amnt_ctrl->group[i]);
++			if (group->used[0] == 0)
++				j = 0;
++			else
++				j = 1;
++
++			group->enable = 1;
++			group->used[j] = 1;
++			entry->enable = 1;
++			entry->group_idx = i;
++			entry->group_used_idx = j;
++			entry->muar_idx = 32 + 2 * i + 2 * i + 2 * j;
++			ether_addr_copy(entry->addr, addr);
++			break;
++		}
++	} else {
++		group = &(amnt_ctrl->group[entry->group_idx]);
++
++		group->used[entry->group_used_idx] = 0;
++		if (group->used[0] == 0 && group->used[1] == 0)
++			group->enable = 0;
++
++		entry->enable = 0;
++		ether_addr_copy(entry->addr, addr);
++	}
++
++	amnt_ctrl->enable &= ~(1 << entry->group_idx);
++	amnt_ctrl->enable |= entry->enable << entry->group_idx;
++	ret = mt7915_vendor_amnt_muar(phy, entry->muar_idx, addr);
++	if (ret)
++		return ret;
++
++	return mt7915_vendor_amnt_set_en(phy, amnt_ctrl->enable);
++}
++
++void mt7915_vendor_amnt_fill_rx(struct mt7915_phy *phy, struct sk_buff *skb)
++{
++	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
++	struct mt7915_air_monitor_ctrl *ctrl = &phy->amnt_ctrl;
++	struct ieee80211_hdr *hdr = mt76_skb_get_hdr(skb);
++	__le16 fc = hdr->frame_control;
++	u8 addr[ETH_ALEN];
++	int i;
++
++	if (!ieee80211_has_fromds(fc))
++		ether_addr_copy(addr, hdr->addr2);
++	else if (ieee80211_has_tods(fc))
++		ether_addr_copy(addr, hdr->addr4);
++	else
++		ether_addr_copy(addr, hdr->addr3);
++
++	for (i = 0; i < MT7915_AIR_MONITOR_MAX_ENTRY; i++) {
++		struct mt7915_air_monitor_entry *entry;
++
++		if (ether_addr_equal(addr, ctrl->entry[i].addr)) {
++			entry = &ctrl->entry[i];
++			entry->rssi[0] = status->chain_signal[0];
++			entry->rssi[1] = status->chain_signal[1];
++			entry->rssi[2] = status->chain_signal[2];
++			entry->rssi[3] = status->chain_signal[3];
++			entry->last_seen = jiffies;
++		}
++	}
++
++	if (ieee80211_has_tods(fc) &&
++	    !ether_addr_equal(hdr->addr3, phy->mt76->macaddr))
++		return;
++	else if (!ether_addr_equal(hdr->addr1, phy->mt76->macaddr))
++		return;
++}
++
++int mt7915_vendor_amnt_sta_remove(struct mt7915_phy *phy,
++				  struct ieee80211_sta *sta)
++{
++	u8 zero[ETH_ALEN] = {};
++	int i;
++
++	if (!phy->amnt_ctrl.enable)
++		return 0;
++
++	for (i = 0; i < MT7915_AIR_MONITOR_MAX_ENTRY; i++)
++		if (ether_addr_equal(sta->addr, phy->amnt_ctrl.entry[i].addr))
++			return mt7915_vendor_amnt_set_addr(phy, i, zero);
++
++	return 0;
++}
++
++static int
++mt7915_vendor_amnt_ctrl(struct wiphy *wiphy, struct wireless_dev *wdev,
++			const void *data, int data_len)
++{
++	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++	struct mt7915_phy *phy = mt7915_hw_phy(hw);
++	struct nlattr *tb1[NUM_MTK_VENDOR_ATTRS_AMNT_CTRL];
++	struct nlattr *tb2[NUM_MTK_VENDOR_ATTRS_AMNT_SET];
++	struct nlattr *cur;
++	u8 index = 0, i = 0;
++	u8 mac_addr[ETH_ALEN] = {};
++	int err, rem;
++
++	err = nla_parse(tb1, MTK_VENDOR_ATTR_AMNT_CTRL_MAX, data, data_len,
++			amnt_ctrl_policy, NULL);
++	if (err)
++		return err;
++
++	if (!tb1[MTK_VENDOR_ATTR_AMNT_CTRL_SET])
++		return -EINVAL;
++
++	err = nla_parse_nested(tb2, MTK_VENDOR_ATTR_AMNT_SET_MAX,
++		tb1[MTK_VENDOR_ATTR_AMNT_CTRL_SET], amnt_set_policy, NULL);
++
++	if (!tb2[MTK_VENDOR_ATTR_AMNT_SET_INDEX] ||
++		!tb2[MTK_VENDOR_ATTR_AMNT_SET_MACADDR])
++		return -EINVAL;
++
++	index = nla_get_u8(tb2[MTK_VENDOR_ATTR_AMNT_SET_INDEX]);
++	nla_for_each_nested(cur, tb2[MTK_VENDOR_ATTR_AMNT_SET_MACADDR], rem) {
++		mac_addr[i++] = nla_get_u8(cur);
++	}
++
++	return mt7915_vendor_amnt_set_addr(phy, index, mac_addr);
++}
++
++static int
++mt7915_amnt_dump(struct mt7915_phy *phy, struct sk_buff *skb,
++		 u8 amnt_idx, int *attrtype)
++{
++	struct mt7915_air_monitor_entry *entry =
++			&phy->amnt_ctrl.entry[amnt_idx];
++	struct mt7915_amnt_data data;
++	u32 last_seen = 0;
++
++	if (entry->enable == 0)
++		return 0;
++
++	last_seen = jiffies_to_msecs(jiffies - entry->last_seen);
++
++	data.idx = amnt_idx;
++	ether_addr_copy(data.addr, entry->addr);
++	data.rssi[0] = entry->rssi[0];
++	data.rssi[1] = entry->rssi[1];
++	data.rssi[2] = entry->rssi[2];
++	data.rssi[3] = entry->rssi[3];
++	data.last_seen = last_seen;
++
++	nla_put(skb, (*attrtype)++, sizeof(struct mt7915_amnt_data), &data);
++
++	return 1;
++}
++
++static int
++mt7915_vendor_amnt_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
++			     struct sk_buff *skb, const void *data, int data_len,
++			     unsigned long *storage)
++{
++	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++	struct mt7915_phy *phy = mt7915_hw_phy(hw);
++	struct nlattr *tb1[NUM_MTK_VENDOR_ATTRS_AMNT_CTRL];
++	struct nlattr *tb2[NUM_MTK_VENDOR_ATTRS_AMNT_DUMP];
++	void *a, *b;
++	int err = 0, attrtype = 0, i, len = 0;
++	u8 amnt_idx;
++
++	if (*storage == 1)
++		return -ENOENT;
++	*storage = 1;
++
++	err = nla_parse(tb1, MTK_VENDOR_ATTR_AMNT_CTRL_MAX, data, data_len,
++			amnt_ctrl_policy, NULL);
++	if (err)
++		return err;
++
++	if (!tb1[MTK_VENDOR_ATTR_AMNT_CTRL_DUMP])
++		return -EINVAL;
++
++	err = nla_parse_nested(tb2, MTK_VENDOR_ATTR_AMNT_DUMP_MAX,
++			       tb1[MTK_VENDOR_ATTR_AMNT_CTRL_DUMP],
++			       amnt_dump_policy, NULL);
++	if (err)
++		return err;
++
++	if (!tb2[MTK_VENDOR_ATTR_AMNT_DUMP_INDEX])
++		return -EINVAL;
++
++	amnt_idx = nla_get_u8(tb2[MTK_VENDOR_ATTR_AMNT_DUMP_INDEX]);
++
++	a = nla_nest_start(skb, MTK_VENDOR_ATTR_AMNT_CTRL_DUMP);
++	b = nla_nest_start(skb, MTK_VENDOR_ATTR_AMNT_DUMP_RESULT);
++
++	if (amnt_idx != 0xff) {
++		len += mt7915_amnt_dump(phy, skb, amnt_idx, &attrtype);
++	} else {
++		for (i = 0; i < MT7915_AIR_MONITOR_MAX_ENTRY; i++) {
++			len += mt7915_amnt_dump(phy, skb, i, &attrtype);
++		}
++	}
++
++	nla_nest_end(skb, b);
++
++	nla_put_u8(skb, MTK_VENDOR_ATTR_AMNT_DUMP_LEN, len);
++
++	nla_nest_end(skb, a);
++
++	return len + 1;
++}
++
+ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ 	{
+ 		.info = {
+@@ -442,6 +789,18 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ 		.dumpit = mt7915_vendor_csi_ctrl_dump,
+ 		.policy = csi_ctrl_policy,
+ 		.maxattr = MTK_VENDOR_ATTR_CSI_CTRL_MAX,
++	},
++	{
++		.info = {
++			.vendor_id = MTK_NL80211_VENDOR_ID,
++			.subcmd = MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL,
++		},
++		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
++			 WIPHY_VENDOR_CMD_NEED_RUNNING,
++		.doit = mt7915_vendor_amnt_ctrl,
++		.dumpit = mt7915_vendor_amnt_ctrl_dump,
++		.policy = amnt_ctrl_policy,
++		.maxattr = MTK_VENDOR_ATTR_AMNT_CTRL_MAX,
+ 	}
+ };
+ 
+diff --git a/mt7915/vendor.h b/mt7915/vendor.h
+index 9d3db2a..976817f 100644
+--- a/mt7915/vendor.h
++++ b/mt7915/vendor.h
+@@ -4,6 +4,7 @@
+ #define MTK_NL80211_VENDOR_ID	0x0ce7
+ 
+ enum mtk_nl80211_vendor_subcmds {
++	MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL = 0xae,
+ 	MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
+ };
+ 
+@@ -57,4 +58,41 @@ enum mtk_vendor_attr_csi_data {
+ 		NUM_MTK_VENDOR_ATTRS_CSI_DATA - 1
+ };
+ 
++enum mtk_vendor_attr_mnt_ctrl {
++	MTK_VENDOR_ATTR_AMNT_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_AMNT_CTRL_SET,
++	MTK_VENDOR_ATTR_AMNT_CTRL_DUMP,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_AMNT_CTRL,
++	MTK_VENDOR_ATTR_AMNT_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_AMNT_CTRL - 1
++};
++
++enum mtk_vendor_attr_mnt_set {
++	MTK_VENDOR_ATTR_AMNT_SET_UNSPEC,
++
++	MTK_VENDOR_ATTR_AMNT_SET_INDEX,
++	MTK_VENDOR_ATTR_AMNT_SET_MACADDR,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_AMNT_SET,
++	MTK_VENDOR_ATTR_AMNT_SET_MAX =
++		NUM_MTK_VENDOR_ATTRS_AMNT_SET - 1
++};
++
++enum mtk_vendor_attr_mnt_dump {
++	MTK_VENDOR_ATTR_AMNT_DUMP_UNSPEC,
++
++	MTK_VENDOR_ATTR_AMNT_DUMP_INDEX,
++	MTK_VENDOR_ATTR_AMNT_DUMP_LEN,
++	MTK_VENDOR_ATTR_AMNT_DUMP_RESULT,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_AMNT_DUMP,
++	MTK_VENDOR_ATTR_AMNT_DUMP_MAX =
++		NUM_MTK_VENDOR_ATTRS_AMNT_DUMP - 1
++};
++
+ #endif
+-- 
+2.25.1
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
new file mode 100644
index 0000000..d72aab5
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -0,0 +1,137 @@
+From cdccb674bc75292020be6894dcea162e585dc5ce Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Mon, 28 Mar 2022 09:19:29 +0800
+Subject: [PATCH] mt76: mt7915: add support for muru_onoff via debugfs
+
+---
+ mt7915/init.c        |  1 +
+ mt7915/mcu.c         | 12 ++++++++----
+ mt7915/mcu.h         |  6 ++++++
+ mt7915/mt7915.h      |  1 +
+ mt7915/mtk_debugfs.c | 33 +++++++++++++++++++++++++++++++++
+ 5 files changed, 49 insertions(+), 4 deletions(-)
+
+diff --git a/mt7915/init.c b/mt7915/init.c
+index dbcdf147..c58f045f 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -574,6 +574,7 @@ static void mt7915_init_work(struct work_struct *work)
+ 	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
+ 	mt7915_init_txpower(dev, &dev->mphy.sband_6g.sband);
+ 	mt7915_txbf_init(dev);
++	dev->dbg.muru_onoff = OFDMA_DL | MUMIMO_UL | MUMIMO_DL;
+ }
+ 
+ void mt7915_wfsys_reset(struct mt7915_dev *dev)
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 26831327..95825062 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -944,6 +944,7 @@ mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+ 			struct ieee80211_vif *vif)
+ {
+ 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
++	struct mt7915_dev *dev = mvif->phy->dev;
+ 	struct ieee80211_he_cap_elem *elem = &sta->he_cap.he_cap_elem;
+ 	struct sta_rec_muru *muru;
+ 	struct tlv *tlv;
+@@ -956,11 +957,14 @@ mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+ 
+ 	muru = (struct sta_rec_muru *)tlv;
+ 
+-	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
++	muru->cfg.mimo_dl_en = (mvif->cap.he_mu_ebfer ||
+ 			       mvif->cap.vht_mu_ebfer ||
+-			       mvif->cap.vht_mu_ebfee;
+-	muru->cfg.mimo_ul_en = true;
+-	muru->cfg.ofdma_dl_en = true;
++			       mvif->cap.vht_mu_ebfee) &&
++			       !!(dev->dbg.muru_onoff & MUMIMO_DL);
++
++	muru->cfg.mimo_ul_en = !!(dev->dbg.muru_onoff & MUMIMO_UL);
++	muru->cfg.ofdma_dl_en = !!(dev->dbg.muru_onoff & OFDMA_DL);
++	muru->cfg.ofdma_ul_en = !!(dev->dbg.muru_onoff & OFDMA_UL);
+ 
+ 	if (sta->vht_cap.vht_supported)
+ 		muru->mimo_dl.vht_mu_bfee =
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 007282d4..a5e5afae 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -569,4 +569,10 @@ struct csi_data {
+ };
+ #endif
+ 
++/* MURU */
++#define OFDMA_DL			BIT(0)
++#define OFDMA_UL			BIT(1)
++#define MUMIMO_DL			BIT(2)
++#define MUMIMO_UL			BIT(3)
++
+ #endif
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 9960785e..ec844dbe 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -390,6 +390,7 @@ struct mt7915_dev {
+ 		bool dump_rx_pkt;
+ 		bool dump_rx_raw;
+ 		u32 token_idx;
++		u8 muru_onoff;
+ 	} dbg;
+ 	const struct mt7915_dbg_reg_desc *dbg_reg;
+ #endif
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+index 246eb129..6c48f115 100644
+--- a/mt7915/mtk_debugfs.c
++++ b/mt7915/mtk_debugfs.c
+@@ -2454,6 +2454,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
+ 	return 0;
+ }
+ 
++static int mt7915_muru_onoff_get(void *data, u64 *val)
++{
++	struct mt7915_dev *dev = data;
++
++	*val = dev->dbg.muru_onoff;
++
++	printk("mumimo ul:%d, mumimo dl:%d, ofdma ul:%d, ofdma dl:%d\n",
++		!!(dev->dbg.muru_onoff & MUMIMO_UL),
++		!!(dev->dbg.muru_onoff & MUMIMO_DL),
++		!!(dev->dbg.muru_onoff & OFDMA_UL),
++		!!(dev->dbg.muru_onoff & OFDMA_DL));
++
++	return 0;
++}
++
++static int mt7915_muru_onoff_set(void *data, u64 val)
++{
++	struct mt7915_dev *dev = data;
++
++	if (val > 15) {
++		printk("Wrong value! The value is between 0 ~ 15.\n");
++		goto exit;
++	}
++
++	dev->dbg.muru_onoff = val;
++exit:
++	return 0;
++}
++
++DEFINE_DEBUGFS_ATTRIBUTE(fops_muru_onoff, mt7915_muru_onoff_get,
++			mt7915_muru_onoff_set, "%llx\n");
++
+ static int mt7915_amsduinfo_read(struct seq_file *s, void *data)
+ {
+ 	struct mt7915_dev *dev = dev_get_drvdata(s->private);
+@@ -2831,6 +2863,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+ 
+ 	mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
+ 
++	debugfs_create_file("muru_onoff", 0600, dir, dev, &fops_muru_onoff);
+ 	debugfs_create_file("fw_debug_module", 0600, dir, dev,
+ 			    &fops_fw_debug_module);
+ 	debugfs_create_file("fw_debug_level", 0600, dir, dev,
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1005-mt76-certification-patches.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1005-mt76-certification-patches.patch
new file mode 100644
index 0000000..276a962
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1005-mt76-certification-patches.patch
@@ -0,0 +1,1161 @@
+From 8fa3dd1f1d9eb24436f6c2b4435c83736bf12f1b Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Fri, 21 Jan 2022 11:22:10 +0800
+Subject: [PATCH 1005/1005] mt76: certification patches
+
+Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
+---
+ .../wireless/mediatek/mt76/mt76_connac_mcu.h  |   1 +
+ .../net/wireless/mediatek/mt76/mt7915/init.c  |   7 +-
+ .../net/wireless/mediatek/mt76/mt7915/mac.c   |  23 +
+ .../net/wireless/mediatek/mt76/mt7915/main.c  |  15 +-
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c   | 463 ++++++++++++++++++
+ .../net/wireless/mediatek/mt76/mt7915/mcu.h   | 209 +++++++-
+ .../wireless/mediatek/mt76/mt7915/mt7915.h    |  13 +
+ .../mediatek/mt76/mt7915/mtk_debugfs.c        |   7 +-
+ .../wireless/mediatek/mt76/mt7915/vendor.c    | 187 +++++++
+ .../wireless/mediatek/mt76/mt7915/vendor.h    |  42 ++
+ 10 files changed, 961 insertions(+), 6 deletions(-)
+
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index b0f2d97..cb7d096 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -994,6 +994,7 @@ enum {
+ 	MCU_EXT_CMD_PHY_STAT_INFO = 0xad,
+ 	/* for vendor csi and air monitor */
+ 	MCU_EXT_CMD_SMESH_CTRL = 0xae,
++	MCU_EXT_CMD_CERT_CFG = 0xb7,
+ 	MCU_EXT_CMD_CSI_CTRL = 0xc2,
+ };
+ 
+diff --git a/mt7915/init.c b/mt7915/init.c
+index bb766ed..cd69174 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -367,12 +367,17 @@ mt7915_init_wiphy(struct ieee80211_hw *hw)
+ 	if (!phy->dev->dbdc_support)
+ 		wiphy->txq_memory_limit = 32 << 20; /* 32 MiB */
+ 
+-	if (phy->mt76->cap.has_2ghz)
++	if (phy->mt76->cap.has_2ghz) {
++		phy->mt76->sband_2g.sband.ht_cap.ampdu_density =
++			IEEE80211_HT_MPDU_DENSITY_4;
+ 		phy->mt76->sband_2g.sband.ht_cap.cap |=
+ 			IEEE80211_HT_CAP_LDPC_CODING |
+ 			IEEE80211_HT_CAP_MAX_AMSDU;
++	}
+ 
+ 	if (phy->mt76->cap.has_5ghz) {
++		phy->mt76->sband_5g.sband.ht_cap.ampdu_density =
++			IEEE80211_HT_MPDU_DENSITY_4;
+ 		phy->mt76->sband_5g.sband.ht_cap.cap |=
+ 			IEEE80211_HT_CAP_LDPC_CODING |
+ 			IEEE80211_HT_CAP_MAX_AMSDU;
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 78d2a96..fb42446 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -7,6 +7,7 @@
+ #include "../dma.h"
+ #include "mac.h"
+ #include "mcu.h"
++#include "vendor.h"
+ 
+ #define to_rssi(field, rxv)	((FIELD_GET(field, rxv) - 220) / 2)
+ 
+@@ -2317,6 +2318,21 @@ void mt7915_mac_update_stats(struct mt7915_phy *phy)
+ 	}
+ }
+ 
++#ifdef CONFIG_MTK_VENDOR
++void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta)
++{
++	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
++	struct mt7915_dev *dev = msta->vif->phy->dev;
++	u32 *changed = data;
++
++	spin_lock_bh(&dev->sta_poll_lock);
++	msta->changed |= *changed;
++	if (list_empty(&msta->rc_list))
++		list_add_tail(&msta->rc_list, &dev->sta_rc_list);
++	spin_unlock_bh(&dev->sta_poll_lock);
++}
++#endif
++
+ void mt7915_mac_sta_rc_work(struct work_struct *work)
+ {
+ 	struct mt7915_dev *dev = container_of(work, struct mt7915_dev, rc_work);
+@@ -2339,6 +2355,13 @@ void mt7915_mac_sta_rc_work(struct work_struct *work)
+ 		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
+ 		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
+ 
++#ifdef CONFIG_MTK_VENDOR
++		if (changed & CAPI_RFEATURE_CHANGED) {
++			mt7915_mcu_set_rfeature_starec(&changed, dev, vif, sta);
++			spin_lock_bh(&dev->sta_poll_lock);
++			continue;
++		}
++#endif
+ 		if (changed & (IEEE80211_RC_SUPP_RATES_CHANGED |
+ 			       IEEE80211_RC_NSS_CHANGED |
+ 			       IEEE80211_RC_BW_CHANGED))
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 1beadd8..a09cd74 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -655,6 +655,9 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
+ 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
+ 	bool ext_phy = mvif->phy != &dev->phy;
++#ifdef CONFIG_MTK_VENDOR
++	struct mt7915_phy *phy;
++#endif
+ 	int ret, idx;
+ 
+ 	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
+@@ -680,7 +683,17 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ #ifdef CONFIG_MTK_VENDOR
+ 	mt7915_vendor_amnt_sta_remove(mvif->phy, sta);
+ #endif
+-	return mt7915_mcu_add_rate_ctrl(dev, vif, sta, false);
++	ret = mt7915_mcu_add_rate_ctrl(dev, vif, sta, false);
++	if (ret)
++		return ret;
++
++#ifdef CONFIG_MTK_VENDOR
++	if (dev->dbg.muru_onoff & MUMIMO_DL_CERT) {
++		phy = mvif->mt76.band_idx ? mt7915_ext_phy(dev) : &dev->phy;
++		mt7915_mcu_set_mimo(phy, 0);
++	}
++#endif
++	return 0;
+ }
+ 
+ void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index ecc96f1..d55e9d0 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -3735,6 +3735,469 @@ mt7915_mcu_report_csi(struct mt7915_dev *dev, struct sk_buff *skb)
+ 
+ 	return 0;
+ }
++void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
++{
++	u8 mode, val;
++	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
++	struct mt7915_dev *dev =  mvif->phy->dev;
++
++	mode = FIELD_GET(RATE_CFG_MODE, *((u32 *)data));
++	val = FIELD_GET(RATE_CFG_VAL, *((u32 *)data));
++
++	switch (mode) {
++	case RATE_PARAM_FIXED_OFDMA:
++		dev->dbg.muru_onoff = val;
++		break;
++	case RATE_PARAM_FIXED_MIMO:
++		if (val == 0)
++			dev->dbg.muru_onoff = MUMIMO_DL_CERT | MUMIMO_DL;
++		break;
++	}
++}
++
++void mt7915_mcu_set_rfeature_starec(void *data, struct mt7915_dev *dev,
++		       struct ieee80211_vif *vif, struct ieee80211_sta *sta)
++{
++	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
++	struct mt7915_vif *mvif = msta->vif;
++	struct sta_rec_ra_fixed *ra;
++	struct sk_buff *skb;
++	struct tlv *tlv;
++	u8 mode, val;
++	int len = sizeof(struct sta_req_hdr) + sizeof(*ra);
++
++	mode = FIELD_GET(RATE_CFG_MODE, *((u32 *)data));
++	val = FIELD_GET(RATE_CFG_VAL, *((u32 *)data));
++
++	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, &msta->wcid, len);
++	if (IS_ERR(skb))
++		return;
++
++	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
++	ra = (struct sta_rec_ra_fixed *)tlv;
++
++	switch (mode) {
++	case RATE_PARAM_FIXED_GI:
++		ra->field = cpu_to_le32(RATE_PARAM_FIXED_GI);
++		ra->phy.sgi = val * 85;
++		break;
++	case RATE_PARAM_FIXED_HE_LTF:
++		ra->field = cpu_to_le32(RATE_PARAM_FIXED_HE_LTF);
++		ra->phy.he_ltf = val * 85;
++		break;
++	case RATE_PARAM_FIXED_MCS:
++		ra->field = cpu_to_le32(RATE_PARAM_FIXED_MCS);
++		ra->phy.mcs = val;
++		break;
++	}
++
++	mt76_mcu_skb_send_msg(&dev->mt76, skb,
++			      MCU_EXT_CMD(STA_REC_UPDATE), true);
++}
++
++int mt7915_mcu_set_mu_prot_frame_th(struct mt7915_phy *phy, u32 val)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		__le32 cmd;
++		__le32 threshold;
++	} __packed req = {
++		.cmd = cpu_to_le32(MURU_SET_PROT_FRAME_THR),
++		.threshold = val,
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
++			sizeof(req), false);
++}
++
++int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		__le32 cmd;
++		u8 override;
++	} __packed req = {
++		.cmd = cpu_to_le32(MURU_SET_CERT_MU_EDCA_OVERRIDE),
++		.override = val,
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
++			sizeof(req), false);
++}
++
++int mt7915_mcu_set_muru_cfg(struct mt7915_phy *phy, struct mt7915_muru *muru)
++{
++        struct mt7915_dev *dev = phy->dev;
++        struct {
++                __le32 cmd;
++                struct mt7915_muru muru;
++        } __packed req = {
++                .cmd = cpu_to_le32(MURU_SET_MANUAL_CFG),
++        };
++
++        memcpy(&req.muru, muru, sizeof(struct mt7915_muru));
++
++        return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
++                                 sizeof(req), false);
++}
++
++int mt7915_set_muru_cfg(struct mt7915_phy *phy, u8 action, u8 val)
++{
++	struct mt7915_muru muru;
++	struct mt7915_muru_dl *dl = &muru.dl;
++	struct mt7915_muru_ul *ul = &muru.ul;
++	struct mt7915_muru_comm *comm = &muru.comm;
++
++        memset(&muru, 0, sizeof(muru));
++
++	switch (action) {
++	case MURU_DL_USER_CNT:
++		dl->user_num = val;
++		comm->ppdu_format |= MURU_PPDU_HE_MU;
++		comm->sch_type |= MURU_OFDMA_SCH_TYPE_DL;
++		muru.cfg_comm = cpu_to_le32(MURU_COMM_SET);
++		muru.cfg_dl = cpu_to_le32(MURU_USER_CNT);
++		return mt7915_mcu_set_muru_cfg(phy, &muru);
++	case MURU_UL_USER_CNT:
++		ul->user_num = val;
++		comm->ppdu_format |= MURU_PPDU_HE_TRIG;
++		comm->sch_type |= MURU_OFDMA_SCH_TYPE_UL;
++		muru.cfg_comm = cpu_to_le32(MURU_COMM_SET);
++		muru.cfg_ul = cpu_to_le32(MURU_USER_CNT);
++		return mt7915_mcu_set_muru_cfg(phy, &muru);
++	default:
++		return 0;
++        }
++}
++
++void mt7915_mcu_set_ppdu_tx_type(struct mt7915_phy *phy, u8 ppdu_type)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		__le32 cmd;
++		u8 enable_su;
++	} __packed ppdu_type_req = {
++		.cmd = cpu_to_le32(MURU_SET_SUTX),
++	};
++
++	switch(ppdu_type) {
++	case CAPI_SU:
++		ppdu_type_req.enable_su = 1;
++		mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
++				  &ppdu_type_req, sizeof(ppdu_type_req), false);
++		mt7915_set_muru_cfg(phy, MURU_DL_USER_CNT, 0);
++		break;
++	case CAPI_MU:
++		ppdu_type_req.enable_su = 0;
++		mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
++				  &ppdu_type_req, sizeof(ppdu_type_req), false);
++		break;
++	default:
++		break;
++	}
++}
++
++void mt7915_mcu_set_nusers_ofdma(struct mt7915_phy *phy, u8 type, u8 ofdma_user_cnt)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		__le32 cmd;
++		u8 enable_su;
++	} __packed nusers_ofdma_req = {
++		.cmd = cpu_to_le32(MURU_SET_SUTX),
++		.enable_su = 0,
++	};
++
++	mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
++			  &nusers_ofdma_req, sizeof(nusers_ofdma_req), false);
++
++	mt7915_mcu_set_mu_dl_ack_policy(phy, MU_DL_ACK_POLICY_SU_BAR);
++	mt7915_mcu_set_mu_prot_frame_th(phy, 9999);
++	switch(type) {
++	case MURU_UL_USER_CNT:
++		mt7915_set_muru_cfg(phy, MURU_UL_USER_CNT, ofdma_user_cnt);
++		break;
++	case MURU_DL_USER_CNT:
++	default:
++		mt7915_set_muru_cfg(phy, MURU_DL_USER_CNT, ofdma_user_cnt);
++		break;
++	}
++}
++
++void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction)
++{
++#define MUMIMO_SET_FIXED_RATE		10
++#define MUMIMO_SET_FIXED_GRP_RATE	11
++#define MUMIMO_SET_FORCE_MU		12
++	struct mt7915_dev *dev = phy->dev;
++	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
++	struct {
++		__le32 cmd;
++		__le16 sub_cmd;
++		__le16 disable_ra;
++	} __packed fixed_rate_req = {
++		.cmd = cpu_to_le32(MURU_SET_MUMIMO_CTRL),
++		.sub_cmd = cpu_to_le16(MUMIMO_SET_FIXED_RATE),
++		.disable_ra = cpu_to_le16(1),
++	};
++	struct {
++		__le32 cmd;
++		__le32 sub_cmd;
++		struct {
++			u8 user_cnt:2;
++			u8 rsv:2;
++			u8 ns0:1;
++			u8 ns1:1;
++			u8 ns2:1;
++			u8 ns3:1;
++
++			__le16 wlan_id_user0;
++			__le16 wlan_id_user1;
++			__le16 wlan_id_user2;
++			__le16 wlan_id_user3;
++
++			u8 dl_mcs_user0:4;
++			u8 dl_mcs_user1:4;
++			u8 dl_mcs_user2:4;
++			u8 dl_mcs_user3:4;
++
++			u8 ul_mcs_user0:4;
++			u8 ul_mcs_user1:4;
++			u8 ul_mcs_user2:4;
++			u8 ul_mcs_user3:4;
++
++			u8 ru_alloc;
++			u8 cap;
++			u8 gi;
++			u8 dl_ul;
++		} grp_rate_conf;
++	} fixed_grp_rate_req = {
++		.cmd = cpu_to_le32(MURU_SET_MUMIMO_CTRL),
++		.sub_cmd = cpu_to_le32(MUMIMO_SET_FIXED_GRP_RATE),
++		.grp_rate_conf = {
++			.user_cnt = 1,
++			.ru_alloc = 134,
++			.gi = 0,
++			.cap = 1,
++			.dl_ul = 0,
++			.wlan_id_user0 = cpu_to_le16(1),
++			.dl_mcs_user0 = 2,
++			.wlan_id_user1 = cpu_to_le16(2),
++			.dl_mcs_user1 = 2,
++		},
++	};
++	struct {
++		__le32 cmd;
++		__le16 sub_cmd;
++		bool force_mu;
++	} __packed force_mu_req = {
++		.cmd = cpu_to_le32(MURU_SET_MUMIMO_CTRL),
++		.sub_cmd = cpu_to_le16(MUMIMO_SET_FORCE_MU),
++		.force_mu = true,
++	};
++
++	switch (chandef->width) {
++	case NL80211_CHAN_WIDTH_20_NOHT:
++	case NL80211_CHAN_WIDTH_20:
++		fixed_grp_rate_req.grp_rate_conf.ru_alloc = 122;
++		break;
++	case NL80211_CHAN_WIDTH_80:
++	default:
++		break;
++	}
++
++	mt7915_mcu_set_mu_dl_ack_policy(phy, MU_DL_ACK_POLICY_SU_BAR);
++
++	mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
++			&fixed_rate_req, sizeof(fixed_rate_req), false);
++	mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
++			&fixed_grp_rate_req, sizeof(fixed_grp_rate_req), false);
++	mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
++			&force_mu_req, sizeof(force_mu_req), false);
++}
++
++void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		__le32 cmd;
++		u8 enable;
++        } __packed req = {
++		.cmd = cpu_to_le32(MURU_SET_20M_DYN_ALGO),
++		.enable = enable,
++        };
++
++	mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
++			&req, sizeof(req), false);
++}
++
++void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type)
++{
++#define CFGINFO_CERT_CFG 4
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		struct basic_info{
++			u8 dbdc_idx;
++			u8 rsv[3];
++			__le32 tlv_num;
++			u8 tlv_buf[0];
++		} hdr;
++		struct cert_cfg{
++			__le16 tag;
++			__le16 length;
++			u8 cert_program;
++			u8 rsv[3];
++		} tlv;
++	} req = {
++		.hdr = {
++			.dbdc_idx = phy != &dev->phy,
++			.tlv_num = cpu_to_le32(1),
++		},
++		.tlv = {
++			.tag = cpu_to_le16(CFGINFO_CERT_CFG),
++			.length = cpu_to_le16(sizeof(struct cert_cfg)),
++			.cert_program = type, /* 1: CAPI Enable */
++		}
++	};
++
++	mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(CERT_CFG),
++			  &req, sizeof(req), false);
++}
++
++void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val)
++{
++#define BF_CMD_CFG_PHY		36
++#define BF_PHY_SMTH_INTL_BYPASS 0
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		u8 cmd_category_id;
++		u8 action;
++		u8 band_idx;
++		u8 smthintbypass;
++		u8 rsv[12];
++	} req = {
++		.cmd_category_id = BF_CMD_CFG_PHY,
++		.action = BF_PHY_SMTH_INTL_BYPASS,
++		.band_idx = phy != &dev->phy,
++		.smthintbypass = val,
++	};
++
++	mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION),
++			&req, sizeof(req), false);
++}
++
++int mt7915_mcu_set_bsrp_ctrl(struct mt7915_phy *phy, u16 interval,
++			u16 ru_alloc, u32 ppdu_dur, u8 trig_flow, u8 ext_cmd)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		__le32 cmd;
++		__le16 bsrp_interval;
++		__le16 bsrp_ru_alloc;
++		__le32 ppdu_duration;
++		u8 trigger_flow;
++		u8 ext_cmd_bsrp;
++	} __packed req = {
++		.cmd = cpu_to_le32(MURU_SET_BSRP_CTRL),
++		.bsrp_interval = cpu_to_le16(interval),
++		.bsrp_ru_alloc = cpu_to_le16(ru_alloc),
++		.ppdu_duration = cpu_to_le32(ppdu_dur),
++		.trigger_flow = trig_flow,
++		.ext_cmd_bsrp = ext_cmd,
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
++				sizeof(req), false);
++}
++
++int mt7915_mcu_set_mu_dl_ack_policy(struct mt7915_phy *phy, u8 policy_num)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		__le32 cmd;
++		u8 ack_policy;
++	} __packed req = {
++		.cmd = cpu_to_le32(MURU_SET_MU_DL_ACK_POLICY),
++		.ack_policy = policy_num,
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
++				sizeof(req), false);
++}
++
++int mt7915_mcu_set_txbf_sound_info(struct mt7915_phy *phy, u8 action,
++			u8 v1, u8 v2, u8 v3)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct {
++		u8 cmd_category_id;
++		u8 action;
++		u8 read_clear;
++		u8 vht_opt;
++		u8 he_opt;
++		u8 glo_opt;
++		__le16 wlan_idx;
++		u8 sound_interval;
++		u8 sound_stop;
++		u8 max_sound_sta;
++		u8 tx_time;
++		u8 mcs;
++		bool ldpc;
++		u8 inf;
++		u8 rsv;
++	} __packed req = {
++		.cmd_category_id = BF_CMD_TXSND_INFO,
++		.action = action,
++	};
++
++	switch (action) {
++	case BF_SND_CFG_OPT:
++		req.vht_opt = v1;
++		req.he_opt = v2;
++		req.glo_opt = v3;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(TXBF_ACTION), &req,
++				sizeof(req), false);
++}
++
++int mt7915_mcu_set_rfeature_trig_type(struct mt7915_phy *phy, u8 enable, u8 trig_type)
++{
++	struct mt7915_dev *dev = phy->dev;
++	int ret = 0;
++	struct {
++		__le32 cmd;
++		u8 trig_type;
++	} __packed req = {
++		.cmd = cpu_to_le32(MURU_SET_TRIG_TYPE),
++		.trig_type = trig_type,
++	};
++
++	if (enable) {
++		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &req,
++					 sizeof(req), false);
++		if (ret)
++			return ret;
++	}
++
++	switch (trig_type) {
++	case CAPI_BASIC:
++		return mt7915_mcu_set_bsrp_ctrl(phy, 5, 67, 0, 0, enable);
++	case CAPI_BRP:
++		return mt7915_mcu_set_txbf_sound_info(phy, BF_SND_CFG_OPT,
++				0x0, 0x0, 0x1b);
++	case CAPI_MU_BAR:
++		return mt7915_mcu_set_mu_dl_ack_policy(phy,
++				MU_DL_ACK_POLICY_MU_BAR);
++	case CAPI_BSRP:
++		return mt7915_mcu_set_bsrp_ctrl(phy, 5, 67, 4, 0, enable);
++	default:
++		return 0;
++	}
++}
+ #endif
+ 
+ #ifdef MTK_DEBUG
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index a5e5afa..c15f89b 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -431,9 +431,13 @@ enum {
+ 	RATE_PARAM_FIXED = 3,
+ 	RATE_PARAM_MMPS_UPDATE = 5,
+ 	RATE_PARAM_FIXED_HE_LTF = 7,
+-	RATE_PARAM_FIXED_MCS,
++	RATE_PARAM_FIXED_MCS = 8,
+ 	RATE_PARAM_FIXED_GI = 11,
+ 	RATE_PARAM_AUTO = 20,
++#ifdef CONFIG_MTK_VENDOR
++	RATE_PARAM_FIXED_MIMO = 30,
++	RATE_PARAM_FIXED_OFDMA = 31,
++#endif
+ };
+ 
+ #define RATE_CFG_MCS			GENMASK(3, 0)
+@@ -445,6 +449,9 @@ enum {
+ #define RATE_CFG_PHY_TYPE		GENMASK(27, 24)
+ #define RATE_CFG_HE_LTF			GENMASK(31, 28)
+ 
++#define RATE_CFG_MODE			GENMASK(15, 8)
++#define RATE_CFG_VAL			GENMASK(7, 0)
++
+ enum {
+ 	THERMAL_PROTECT_PARAMETER_CTRL,
+ 	THERMAL_PROTECT_BASIC_INFO,
+@@ -574,5 +581,205 @@ struct csi_data {
+ #define OFDMA_UL			BIT(1)
+ #define MUMIMO_DL			BIT(2)
+ #define MUMIMO_UL			BIT(3)
++#define MUMIMO_DL_CERT			BIT(4)
++
++
++#ifdef CONFIG_MTK_VENDOR
++struct mt7915_muru_comm {
++	u8 ppdu_format;
++	u8 sch_type;
++	u8 band;
++	u8 wmm_idx;
++	u8 spe_idx;
++	u8 proc_type;
++};
++
++struct mt7915_muru_dl {
++	u8 user_num;
++	u8 tx_mode;
++	u8 bw;
++	u8 gi;
++	u8 ltf;
++	/* sigB */
++	u8 mcs;
++	u8 dcm;
++	u8 cmprs;
++
++	u8 ru[8];
++	u8 c26[2];
++	u8 ack_policy;
++
++	struct {
++		__le16 wlan_idx;
++		u8 ru_alloc_seg;
++		u8 ru_idx;
++		u8 ldpc;
++		u8 nss;
++		u8 mcs;
++		u8 mu_group_idx;
++		u8 vht_groud_id;
++		u8 vht_up;
++		u8 he_start_stream;
++		u8 he_mu_spatial;
++		u8 ack_policy;
++		__le16 tx_power_alpha;
++	} usr[16];
++};
++
++struct mt7915_muru_ul {
++	u8 user_num;
++
++	/* UL TX */
++	u8 trig_type;
++	__le16 trig_cnt;
++	__le16 trig_intv;
++	u8 bw;
++	u8 gi_ltf;
++	__le16 ul_len;
++	u8 pad;
++	u8 trig_ta[ETH_ALEN];
++	u8 ru[8];
++	u8 c26[2];
++
++	struct {
++		__le16 wlan_idx;
++		u8 ru_alloc;
++		u8 ru_idx;
++		u8 ldpc;
++		u8 nss;
++		u8 mcs;
++		u8 target_rssi;
++		__le32 trig_pkt_size;
++	} usr[16];
++
++	/* HE TB RX Debug */
++	__le32 rx_hetb_nonsf_en_bitmap;
++	__le32 rx_hetb_cfg[2];
++
++	/* DL TX */
++	u8 ba_type;
++};
++
++struct mt7915_muru {
++	__le32 cfg_comm;
++	__le32 cfg_dl;
++	__le32 cfg_ul;
++
++	struct mt7915_muru_comm comm;
++	struct mt7915_muru_dl dl;
++	struct mt7915_muru_ul ul;
++};
++
++#define MURU_PPDU_HE_TRIG		BIT(2)
++#define MURU_PPDU_HE_MU                 BIT(3)
++
++#define MURU_OFDMA_SCH_TYPE_DL          BIT(0)
++#define MURU_OFDMA_SCH_TYPE_UL          BIT(1)
++
++/* Common Config */
++#define MURU_COMM_PPDU_FMT              BIT(0)
++#define MURU_COMM_SCH_TYPE              BIT(1)
++#define MURU_COMM_SET                   (MURU_COMM_PPDU_FMT | MURU_COMM_SCH_TYPE)
++
++/* DL&UL User config*/
++#define MURU_USER_CNT                   BIT(4)
++
++enum {
++	CAPI_SU,
++	CAPI_MU,
++	CAPI_ER_SU,
++	CAPI_TB,
++	CAPI_LEGACY
++};
++
++enum {
++	CAPI_BASIC,
++	CAPI_BRP,
++	CAPI_MU_BAR,
++	CAPI_MU_RTS,
++	CAPI_BSRP,
++	CAPI_GCR_MU_BAR,
++	CAPI_BQRP,
++	CAPI_NDP_FRP
++};
++
++enum {
++	MURU_SET_BSRP_CTRL = 1,
++	MURU_SET_SUTX = 16,
++	MURU_SET_MUMIMO_CTRL = 17,
++	MURU_SET_MANUAL_CFG = 100,
++	MURU_SET_MU_DL_ACK_POLICY = 200,
++	MURU_SET_TRIG_TYPE = 201,
++	MURU_SET_20M_DYN_ALGO = 202,
++	MURU_SET_PROT_FRAME_THR = 204,
++	MURU_SET_CERT_MU_EDCA_OVERRIDE = 205,
++};
++
++enum {
++	MU_DL_ACK_POLICY_MU_BAR = 3,
++	MU_DL_ACK_POLICY_TF_FOR_ACK = 4,
++	MU_DL_ACK_POLICY_SU_BAR = 5,
++};
++
++enum {
++	BF_SOUNDING_OFF = 0,
++	BF_SOUNDING_ON,
++	BF_DATA_PACKET_APPLY,
++	BF_PFMU_MEM_ALLOCATE,
++	BF_PFMU_MEM_RELEASE,
++	BF_PFMU_TAG_READ,
++	BF_PFMU_TAG_WRITE,
++	BF_PROFILE_READ,
++	BF_PROFILE_WRITE,
++	BF_PN_READ,
++	BF_PN_WRITE,
++	BF_PFMU_MEM_ALLOC_MAP_READ,
++	BF_AID_SET,
++	BF_STA_REC_READ,
++	BF_PHASE_CALIBRATION,
++	BF_IBF_PHASE_COMP,
++	BF_LNA_GAIN_CONFIG,
++	BF_PROFILE_WRITE_20M_ALL,
++	BF_APCLIENT_CLUSTER,
++	BF_AWARE_CTRL,
++	BF_HW_ENABLE_STATUS_UPDATE,
++	BF_REPT_CLONED_STA_TO_NORMAL_STA,
++	BF_GET_QD,
++	BF_BFEE_HW_CTRL,
++	BF_PFMU_SW_TAG_WRITE,
++	BF_MOD_EN_CTRL,
++	BF_DYNSND_EN_INTR,
++	BF_DYNSND_CFG_DMCS_TH,
++	BF_DYNSND_EN_PFID_INTR,
++	BF_CONFIG,
++	BF_PFMU_DATA_WRITE,
++	BF_FBRPT_DBG_INFO_READ,
++	BF_CMD_TXSND_INFO,
++	BF_CMD_PLY_INFO,
++	BF_CMD_MU_METRIC,
++	BF_CMD_TXCMD,
++	BF_CMD_CFG_PHY,
++	BF_CMD_SND_CNT,
++	BF_CMD_MAX
++};
++
++enum {
++	BF_SND_READ_INFO = 0,
++	BF_SND_CFG_OPT,
++	BF_SND_CFG_INTV,
++	BF_SND_STA_STOP,
++	BF_SND_CFG_MAX_STA,
++	BF_SND_CFG_BFRP,
++	BF_SND_CFG_INF
++};
++
++enum {
++	MURU_UPDATE = 0,
++	MURU_DL_USER_CNT,
++	MURU_UL_USER_CNT,
++	MURU_DL_INIT,
++	MURU_UL_INIT,
++};
++#endif
+ 
+ #endif
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 746e05c..a8726fe 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -655,6 +655,19 @@ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ #endif
+ 
+ #ifdef CONFIG_MTK_VENDOR
++void mt7915_capi_sta_rc_work(void *data, struct ieee80211_sta *sta);
++void mt7915_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif);
++void mt7915_mcu_set_rfeature_starec(void *data, struct mt7915_dev *dev,
++		       struct ieee80211_vif *vif, struct ieee80211_sta *sta);
++int mt7915_mcu_set_rfeature_trig_type(struct mt7915_phy *phy, u8 enable, u8 trig_type);
++int mt7915_mcu_set_mu_dl_ack_policy(struct mt7915_phy *phy, u8 policy_num);
++void mt7915_mcu_set_ppdu_tx_type(struct mt7915_phy *phy, u8 ppdu_type);
++void mt7915_mcu_set_nusers_ofdma(struct mt7915_phy *phy, u8 type, u8 ofdma_user_cnt);
++void mt7915_mcu_set_mimo(struct mt7915_phy *phy, u8 direction);
++void mt7915_mcu_set_dynalgo(struct mt7915_phy *phy, u8 enable);
++int mt7915_mcu_set_mu_edca(struct mt7915_phy *phy, u8 val);
++void mt7915_mcu_set_cert(struct mt7915_phy *phy, u8 type);
++void mt7915_mcu_set_bypass_smthint(struct mt7915_phy *phy, u8 val);
+ void mt7915_vendor_register(struct mt7915_phy *phy);
+ int mt7915_mcu_set_csi(struct mt7915_phy *phy, u8 mode,
+ 			u8 cfg, u8 v1, u32 v2, u8 *mac_addr);
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+index 4ebeeb2..63853f7 100644
+--- a/mt7915/mtk_debugfs.c
++++ b/mt7915/mtk_debugfs.c
+@@ -2436,7 +2436,8 @@ static int mt7915_muru_onoff_get(void *data, u64 *val)
+ 
+ 	*val = dev->dbg.muru_onoff;
+ 
+-	printk("mumimo ul:%d, mumimo dl:%d, ofdma ul:%d, ofdma dl:%d\n",
++	printk("cert mumimo dl:%d, mumimo ul:%d, mumimo dl:%d, ofdma ul:%d, ofdma dl:%d\n",
++		!!(dev->dbg.muru_onoff & MUMIMO_DL_CERT),
+ 		!!(dev->dbg.muru_onoff & MUMIMO_UL),
+ 		!!(dev->dbg.muru_onoff & MUMIMO_DL),
+ 		!!(dev->dbg.muru_onoff & OFDMA_UL),
+@@ -2449,8 +2450,8 @@ static int mt7915_muru_onoff_set(void *data, u64 val)
+ {
+ 	struct mt7915_dev *dev = data;
+ 
+-	if (val > 15) {
+-		printk("Wrong value! The value is between 0 ~ 15.\n");
++	if (val > 31) {
++		printk("Wrong value! The value is between 0 ~ 31.\n");
+ 		goto exit;
+ 	}
+ 
+diff --git a/mt7915/vendor.c b/mt7915/vendor.c
+index b94d787..7456c57 100644
+--- a/mt7915/vendor.c
++++ b/mt7915/vendor.c
+@@ -22,6 +22,29 @@ csi_ctrl_policy[NUM_MTK_VENDOR_ATTRS_CSI_CTRL] = {
+ 	[MTK_VENDOR_ATTR_CSI_CTRL_DATA] = { .type = NLA_NESTED },
+ };
+ 
++static const struct nla_policy
++wireless_ctrl_policy[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL] = {
++	[MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_MCS] = {.type = NLA_U8 },
++	[MTK_VENDOR_ATTR_WIRELESS_CTRL_OFDMA] = {.type = NLA_U8 },
++	[MTK_VENDOR_ATTR_WIRELESS_CTRL_PPDU_TX_TYPE] = {.type = NLA_U8 },
++	[MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA] = {.type = NLA_U8 },
++	[MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO] = {.type = NLA_U8 },
++	[MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE] = {.type = NLA_U16 },
++	[MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA] = {.type = NLA_U8 },
++	[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT] = {.type = NLA_U8 },
++};
++
++static const struct nla_policy
++rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
++	[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI] = {.type = NLA_U8 },
++	[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_LTF] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_CFG] = { .type = NLA_NESTED },
++	[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_EN] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_RFEATURE_CTRL_ACK_PLCY] = { .type = NLA_U8 },
++	[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TXBF] = { .type = NLA_U8 },
++};
++
+ struct csi_null_tone {
+ 	u8 start;
+ 	u8 end;
+@@ -777,6 +800,148 @@ mt7915_vendor_amnt_ctrl_dump(struct wiphy *wiphy, struct wireless_dev *wdev,
+ 	return len + 1;
+ }
+ 
++static int mt7915_vendor_rfeature_ctrl(struct wiphy *wiphy,
++				  struct wireless_dev *wdev,
++				  const void *data,
++				  int data_len)
++{
++	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++	struct mt7915_phy *phy = mt7915_hw_phy(hw);
++	struct mt7915_dev *dev = phy->dev;
++	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL];
++	int err;
++	u32 val;
++
++	err = nla_parse(tb, MTK_VENDOR_ATTR_RFEATURE_CTRL_MAX, data, data_len,
++			rfeature_ctrl_policy, NULL);
++	if (err)
++		return err;
++
++	val = CAPI_RFEATURE_CHANGED;
++
++	if (tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI]) {
++		val |= FIELD_PREP(RATE_CFG_MODE, RATE_PARAM_FIXED_GI)|
++			FIELD_PREP(RATE_CFG_VAL, nla_get_u8(tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI]));
++		ieee80211_iterate_stations_atomic(hw, mt7915_capi_sta_rc_work, &val);
++		ieee80211_queue_work(hw, &dev->rc_work);
++	}
++	else if (tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_LTF]) {
++		val |= FIELD_PREP(RATE_CFG_MODE, RATE_PARAM_FIXED_HE_LTF)|
++			FIELD_PREP(RATE_CFG_VAL, nla_get_u8(tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_LTF]));
++                ieee80211_iterate_stations_atomic(hw, mt7915_capi_sta_rc_work, &val);
++		ieee80211_queue_work(hw, &dev->rc_work);
++	}
++	else if (tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_CFG]) {
++		u8 enable, trig_type;
++		int rem;
++		struct nlattr *cur;
++
++		nla_for_each_nested(cur, tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_CFG], rem) {
++			switch(nla_type(cur)) {
++			case MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_EN:
++				enable = nla_get_u8(cur);
++				break;
++			case MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE:
++				trig_type = nla_get_u8(cur);
++				break;
++			default:
++				return -EINVAL;
++			};
++		}
++
++		err = mt7915_mcu_set_rfeature_trig_type(phy, enable, trig_type);
++		if (err)
++			return err;
++	}
++	else if (tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_ACK_PLCY]) {
++		u8 ack_policy;
++
++		ack_policy = nla_get_u8(tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_ACK_PLCY]);
++#define HE_TB_PPDU_ACK 4
++		switch (ack_policy) {
++		case HE_TB_PPDU_ACK:
++			return mt7915_mcu_set_mu_dl_ack_policy(phy, ack_policy);
++		default:
++			return 0;
++		}
++	}
++	else if (tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TXBF]) {
++		u8 trig_txbf;
++
++		trig_txbf = nla_get_u8(tb[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TXBF]);
++		/* CAPI only issues trig_txbf=disable */
++	}
++
++	return 0;
++}
++
++static int mt7915_vendor_wireless_ctrl(struct wiphy *wiphy,
++				  struct wireless_dev *wdev,
++				  const void *data,
++				  int data_len)
++{
++	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
++	struct mt7915_phy *phy = mt7915_hw_phy(hw);
++	struct mt7915_dev *dev = phy->dev;
++	struct nlattr *tb[NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL];
++	int err;
++	u8 val8;
++	u16 val16;
++	u32 val32;
++
++	err = nla_parse(tb, MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX, data, data_len,
++			wireless_ctrl_policy, NULL);
++	if (err)
++		return err;
++
++	val32 = CAPI_WIRELESS_CHANGED;
++
++	if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_MCS]) {
++		val32 &= ~CAPI_WIRELESS_CHANGED;
++		val32 |= CAPI_RFEATURE_CHANGED |
++			FIELD_PREP(RATE_CFG_MODE, RATE_PARAM_FIXED_MCS) |
++			FIELD_PREP(RATE_CFG_VAL, nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_MCS]));
++		ieee80211_iterate_stations_atomic(hw, mt7915_capi_sta_rc_work, &val32);
++		ieee80211_queue_work(hw, &dev->rc_work);
++	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_OFDMA]) {
++		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_OFDMA]);
++		val32 |= FIELD_PREP(RATE_CFG_MODE, RATE_PARAM_FIXED_OFDMA) |
++			 FIELD_PREP(RATE_CFG_VAL, val8);
++		ieee80211_iterate_active_interfaces_atomic(hw, IEEE80211_IFACE_ITER_RESUME_ALL,
++			mt7915_set_wireless_vif, &val32);
++		if (val8 == 3) /* DL20and80 */
++			mt7915_mcu_set_dynalgo(phy, 1); /* Enable dynamic algo */
++	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE]) {
++		val16 = nla_get_u16(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE]);
++		hw->max_tx_aggregation_subframes = val16;
++		hw->max_rx_aggregation_subframes = val16;
++	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA]) {
++		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA]);
++		mt7915_mcu_set_mu_edca(phy, val8);
++	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_PPDU_TX_TYPE]) {
++		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_PPDU_TX_TYPE]);
++		mt7915_mcu_set_ppdu_tx_type(phy, val8);
++	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA]) {
++		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA]);
++		if (FIELD_GET(OFDMA_UL, dev->dbg.muru_onoff) == 1)
++			mt7915_mcu_set_nusers_ofdma(phy, MURU_UL_USER_CNT, val8);
++		else
++			mt7915_mcu_set_nusers_ofdma(phy, MURU_DL_USER_CNT, val8);
++	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO]) {
++		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO]);
++		val32 |= FIELD_PREP(RATE_CFG_MODE, RATE_PARAM_FIXED_MIMO) |
++			 FIELD_PREP(RATE_CFG_VAL, val8);
++		ieee80211_iterate_active_interfaces_atomic(hw, IEEE80211_IFACE_ITER_RESUME_ALL,
++			mt7915_set_wireless_vif, &val32);
++	} else if (tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]) {
++		val8 = nla_get_u8(tb[MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT]);
++		mt7915_mcu_set_cert(phy, val8); /* Cert Enable for OMI */
++		mt7915_mcu_set_bypass_smthint(phy, val8); /* Cert bypass smooth interpolation */
++	}
++
++	return 0;
++}
++
+ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ 	{
+ 		.info = {
+@@ -801,6 +966,28 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
+ 		.dumpit = mt7915_vendor_amnt_ctrl_dump,
+ 		.policy = amnt_ctrl_policy,
+ 		.maxattr = MTK_VENDOR_ATTR_AMNT_CTRL_MAX,
++	},
++	{
++		.info = {
++			.vendor_id = MTK_NL80211_VENDOR_ID,
++			.subcmd = MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL,
++		},
++		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
++			WIPHY_VENDOR_CMD_NEED_RUNNING,
++		.doit = mt7915_vendor_rfeature_ctrl,
++		.policy = rfeature_ctrl_policy,
++		.maxattr = MTK_VENDOR_ATTR_RFEATURE_CTRL_MAX,
++	},
++	{
++		.info = {
++			.vendor_id = MTK_NL80211_VENDOR_ID,
++			.subcmd = MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL,
++		},
++		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV |
++			WIPHY_VENDOR_CMD_NEED_RUNNING,
++		.doit = mt7915_vendor_wireless_ctrl,
++		.policy = wireless_ctrl_policy,
++		.maxattr = MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX,
+ 	}
+ };
+ 
+diff --git a/mt7915/vendor.h b/mt7915/vendor.h
+index 976817f..1b08321 100644
+--- a/mt7915/vendor.h
++++ b/mt7915/vendor.h
+@@ -6,6 +6,48 @@
+ enum mtk_nl80211_vendor_subcmds {
+ 	MTK_NL80211_VENDOR_SUBCMD_AMNT_CTRL = 0xae,
+ 	MTK_NL80211_VENDOR_SUBCMD_CSI_CTRL = 0xc2,
++	MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
++	MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
++};
++
++enum mtk_capi_control_changed {
++	CAPI_RFEATURE_CHANGED		= BIT(16),
++	CAPI_WIRELESS_CHANGED		= BIT(17),
++};
++
++enum mtk_vendor_attr_wireless_ctrl {
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_MCS,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_OFDMA,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_PPDU_TX_TYPE,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_NUSERS_OFDMA,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_BA_BUFFER_SIZE,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_MIMO,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_CERT = 9,
++
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_MU_EDCA, /* reserve */
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL,
++	MTK_VENDOR_ATTR_WIRELESS_CTRL_MAX =
++		NUM_MTK_VENDOR_ATTRS_WIRELESS_CTRL - 1
++};
++
++enum mtk_vendor_attr_rfeature_ctrl {
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_UNSPEC,
++
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI,
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_LTF,
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_CFG,
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE_EN,
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TYPE,
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_ACK_PLCY,
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TXBF,
++
++	/* keep last */
++	NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL,
++	MTK_VENDOR_ATTR_RFEATURE_CTRL_MAX =
++	NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL - 1
+ };
+ 
+ enum mtk_vendor_attr_csi_ctrl {
+-- 
+2.25.1
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1100-mt76-testmode-support-eeprom-handle.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1100-mt76-testmode-support-eeprom-handle.patch
new file mode 100755
index 0000000..ee5b283
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1100-mt76-testmode-support-eeprom-handle.patch
@@ -0,0 +1,284 @@
+From b6c6afbe347c8cd3ab43d4cab07e840ecf5d3ad6 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Tue, 29 Jun 2021 14:30:44 +0800
+Subject: [PATCH 1100/1112] mt76: testmode: support eeprom handle
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ drivers/net/wireless/mediatek/mt76/mt76.h     |  1 +
+ .../net/wireless/mediatek/mt76/mt7915/init.c  |  2 +-
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c   |  5 +-
+ .../wireless/mediatek/mt76/mt7915/mt7915.h    |  2 +-
+ .../wireless/mediatek/mt76/mt7915/testmode.c  | 54 +++++++++++++++++++
+ drivers/net/wireless/mediatek/mt76/testmode.c | 46 +++++++++++++++-
+ drivers/net/wireless/mediatek/mt76/testmode.h | 30 +++++++++++
+ 7 files changed, 133 insertions(+), 7 deletions(-)
+
+diff --git a/mt76.h b/mt76.h
+index 58b324c..8ad7674 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -581,6 +581,7 @@ struct mt76_testmode_ops {
+ 	int (*set_params)(struct mt76_phy *phy, struct nlattr **tb,
+ 			  enum mt76_testmode_state new_state);
+ 	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
++	int (*set_eeprom)(struct mt76_phy *phy, u32 offset, u8 *val, u8 action);
+ };
+ 
+ #define MT_TM_FW_RX_COUNT	BIT(0)
+diff --git a/mt7915/init.c b/mt7915/init.c
+index cd69174..92d57f9 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -569,7 +569,7 @@ static void mt7915_init_work(struct work_struct *work)
+ 	struct mt7915_dev *dev = container_of(work, struct mt7915_dev,
+ 				 init_work);
+ 
+-	mt7915_mcu_set_eeprom(dev);
++	mt7915_mcu_set_eeprom(dev, dev->flash_mode);
+ 	mt7915_mac_init(dev);
+ 	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
+ 	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index d55e9d0..2b57459 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -289,7 +289,6 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+ 	if (mcu_txd->ext_cid) {
+ 		mcu_txd->ext_cid_ack = 1;
+ 
+-		/* do not use Q_SET for efuse */
+ 		if (cmd & __MCU_CMD_FIELD_QUERY)
+ 			mcu_txd->set_query = MCU_Q_QUERY;
+ 		else
+@@ -2913,14 +2912,14 @@ static int mt7915_mcu_set_eeprom_flash(struct mt7915_dev *dev)
+ 	return 0;
+ }
+ 
+-int mt7915_mcu_set_eeprom(struct mt7915_dev *dev)
++int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode)
+ {
+ 	struct mt7915_mcu_eeprom req = {
+ 		.buffer_mode = EE_MODE_EFUSE,
+ 		.format = EE_FORMAT_WHOLE,
+ 	};
+ 
+-	if (dev->flash_mode)
++	if (flash_mode)
+ 		return mt7915_mcu_set_eeprom_flash(dev);
+ 
+ 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_BUFFER_MODE),
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index a8726fe..274afff 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -539,7 +539,7 @@ int mt7915_mcu_set_fixed_rate_ctrl(struct mt7915_dev *dev,
+ 				   struct ieee80211_vif *vif,
+ 				   struct ieee80211_sta *sta,
+ 				   void *data, u32 field);
+-int mt7915_mcu_set_eeprom(struct mt7915_dev *dev);
++int mt7915_mcu_set_eeprom(struct mt7915_dev *dev, bool flash_mode);
+ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset);
+ int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num);
+ int mt7915_mcu_set_mac(struct mt7915_dev *dev, int band, bool enable,
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index e8bf616..2c859f6 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -848,8 +848,62 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+ 	return mt7915_tm_get_rx_stats(phy, false);
+ }
+ 
++static int
++mt7915_tm_write_back_to_efuse(struct mt7915_dev *dev)
++{
++	struct mt7915_mcu_eeprom_info req = {};
++	u8 *eeprom = dev->mt76.eeprom.data;
++	int i, ret = -EINVAL;
++
++	/* prevent from damaging chip id in efuse */
++	if (mt76_chip(&dev->mt76) != get_unaligned_le16(eeprom))
++		goto out;
++
++	for (i = 0; i < MT7915_EEPROM_SIZE; i += MT76_TM_EEPROM_BLOCK_SIZE) {
++		req.addr = cpu_to_le32(i);
++		memcpy(&req.data, eeprom + i, MT76_TM_EEPROM_BLOCK_SIZE);
++
++		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EFUSE_ACCESS),
++					&req, sizeof(req), true);
++		if (ret)
++			return ret;
++	}
++
++out:
++	return ret;
++}
++
++static int
++mt7915_tm_set_eeprom(struct mt76_phy *mphy, u32 offset, u8 *val, u8 action)
++{
++	struct mt7915_phy *phy = mphy->priv;
++	struct mt7915_dev *dev = phy->dev;
++	u8 *eeprom = dev->mt76.eeprom.data;
++	int ret = 0;
++
++	if (offset >= MT7915_EEPROM_SIZE)
++		return -EINVAL;
++
++	switch (action) {
++	case MT76_TM_EEPROM_ACTION_UPDATE_DATA:
++		memcpy(eeprom + offset, val, MT76_TM_EEPROM_BLOCK_SIZE);
++		break;
++	case MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE:
++		ret = mt7915_mcu_set_eeprom(dev, true);
++		break;
++	case MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE:
++		ret = mt7915_tm_write_back_to_efuse(dev);
++		break;
++	default:
++		break;
++	}
++
++	return ret;
++}
++
+ const struct mt76_testmode_ops mt7915_testmode_ops = {
+ 	.set_state = mt7915_tm_set_state,
+ 	.set_params = mt7915_tm_set_params,
+ 	.dump_stats = mt7915_tm_dump_stats,
++	.set_eeprom = mt7915_tm_set_eeprom,
+ };
+diff --git a/testmode.c b/testmode.c
+index e6d1f70..1fbca66 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -402,6 +402,44 @@ mt76_tm_get_u8(struct nlattr *attr, u8 *dest, u8 min, u8 max)
+ 	return 0;
+ }
+ 
++static int
++mt76_testmode_set_eeprom(struct mt76_phy *phy, struct nlattr **tb)
++{
++	struct mt76_dev *dev = phy->dev;
++	u8 action, val[MT76_TM_EEPROM_BLOCK_SIZE];
++	u32 offset = 0;
++	int err = -EINVAL;
++
++	if (!dev->test_ops->set_eeprom)
++		return -EOPNOTSUPP;
++
++	if (mt76_tm_get_u8(tb[MT76_TM_ATTR_EEPROM_ACTION], &action,
++			   0, MT76_TM_EEPROM_ACTION_MAX))
++		goto out;
++
++	if (tb[MT76_TM_ATTR_EEPROM_OFFSET]) {
++		struct nlattr *cur;
++		int rem, idx = 0;
++
++		offset = nla_get_u32(tb[MT76_TM_ATTR_EEPROM_OFFSET]);
++		if (!!(offset % MT76_TM_EEPROM_BLOCK_SIZE) ||
++		    !tb[MT76_TM_ATTR_EEPROM_VAL])
++			goto out;
++
++		nla_for_each_nested(cur, tb[MT76_TM_ATTR_EEPROM_VAL], rem) {
++			if (nla_len(cur) != 1 || idx >= ARRAY_SIZE(val))
++				goto out;
++
++			val[idx++] = nla_get_u8(cur);
++		}
++	}
++
++	err = dev->test_ops->set_eeprom(phy, offset, val, action);
++
++out:
++	return err;
++}
++
+ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		      void *data, int len)
+ {
+@@ -425,6 +463,11 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 
+ 	mutex_lock(&dev->mutex);
+ 
++	if (tb[MT76_TM_ATTR_EEPROM_ACTION]) {
++		err = mt76_testmode_set_eeprom(phy, tb);
++		goto out;
++	}
++
+ 	if (tb[MT76_TM_ATTR_RESET]) {
+ 		mt76_testmode_set_state(phy, MT76_TM_STATE_OFF);
+ 		memset(td, 0, sizeof(*td));
+@@ -484,8 +527,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 
+ 	if (tb[MT76_TM_ATTR_TX_POWER]) {
+ 		struct nlattr *cur;
+-		int idx = 0;
+-		int rem;
++		int rem, idx = 0;
+ 
+ 		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TX_POWER], rem) {
+ 			if (nla_len(cur) != 1 ||
+diff --git a/testmode.h b/testmode.h
+index 8961326..5900c76 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -6,6 +6,7 @@
+ #define __MT76_TESTMODE_H
+ 
+ #define MT76_TM_TIMEOUT	10
++#define MT76_TM_EEPROM_BLOCK_SIZE	16
+ 
+ /**
+  * enum mt76_testmode_attr - testmode attributes inside NL80211_ATTR_TESTDATA
+@@ -47,6 +48,13 @@
+  * @MT76_TM_ATTR_DRV_DATA: driver specific netlink attrs (nested)
+  *
+  * @MT76_TM_ATTR_MAC_ADDRS: array of nested MAC addresses (nested)
++ *
++ * @MT76_TM_ATTR_EEPROM_ACTION: eeprom setting actions
++ * 	(u8, see &enum mt76_testmode_eeprom_action)
++ * @MT76_TM_ATTR_EEPROM_OFFSET: offset of eeprom data block for writing (u32)
++ * @MT76_TM_ATTR_EEPROM_VAL: values for writing into a 16-byte data block
++ * 	(nested, u8 attrs)
++ *
+  */
+ enum mt76_testmode_attr {
+ 	MT76_TM_ATTR_UNSPEC,
+@@ -85,6 +93,10 @@ enum mt76_testmode_attr {
+ 
+ 	MT76_TM_ATTR_MAC_ADDRS,
+ 
++	MT76_TM_ATTR_EEPROM_ACTION,
++	MT76_TM_ATTR_EEPROM_OFFSET,
++	MT76_TM_ATTR_EEPROM_VAL,
++
+ 	/* keep last */
+ 	NUM_MT76_TM_ATTRS,
+ 	MT76_TM_ATTR_MAX = NUM_MT76_TM_ATTRS - 1,
+@@ -198,4 +210,22 @@ enum mt76_testmode_tx_mode {
+ 
+ extern const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS];
+ 
++/**
++ * enum mt76_testmode_eeprom_action - eeprom setting actions
++ *
++ * @MT76_TM_EEPROM_ACTION_UPDATE_DATA: update rf values to specific
++ * 	eeprom data block
++ * @MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE: send updated eeprom data to fw
++ * @MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE: write eeprom data back to efuse
++ */
++enum mt76_testmode_eeprom_action {
++	MT76_TM_EEPROM_ACTION_UPDATE_DATA,
++	MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE,
++	MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE,
++
++	/* keep last */
++	NUM_MT76_TM_EEPROM_ACTION,
++	MT76_TM_EEPROM_ACTION_MAX = NUM_MT76_TM_EEPROM_ACTION - 1,
++};
++
+ #endif
+-- 
+2.25.1
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1101-mt76-enable-more-5g-channels.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1101-mt76-enable-more-5g-channels.patch
new file mode 100755
index 0000000..c8f5b55
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1101-mt76-enable-more-5g-channels.patch
@@ -0,0 +1,55 @@
+From a45a4416976cd7604bf90103e24fe78150b9de6f Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Wed, 29 Sep 2021 14:03:02 +0800
+Subject: [PATCH 1101/1112] mt76: enable more 5g channels
+
+This is necessary for testmode.
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ drivers/net/wireless/mediatek/mt76/mac80211.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/mac80211.c b/mac80211.c
+index 89ca644..e473227 100644
+--- a/mac80211.c
++++ b/mac80211.c
+@@ -45,6 +45,9 @@ static const struct ieee80211_channel mt76_channels_2ghz[] = {
+ };
+ 
+ static const struct ieee80211_channel mt76_channels_5ghz[] = {
++	CHAN5G(12, 5060),
++	CHAN5G(16, 5080),
++
+ 	CHAN5G(36, 5180),
+ 	CHAN5G(40, 5200),
+ 	CHAN5G(44, 5220),
+@@ -55,6 +58,13 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
+ 	CHAN5G(60, 5300),
+ 	CHAN5G(64, 5320),
+ 
++	CHAN5G(68, 5340),
++	CHAN5G(80, 5400),
++	CHAN5G(84, 5420),
++	CHAN5G(88, 5440),
++	CHAN5G(92, 5460),
++	CHAN5G(96, 5480),
++
+ 	CHAN5G(100, 5500),
+ 	CHAN5G(104, 5520),
+ 	CHAN5G(108, 5540),
+@@ -75,6 +85,11 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
+ 	CHAN5G(165, 5825),
+ 	CHAN5G(169, 5845),
+ 	CHAN5G(173, 5865),
++
++	CHAN5G(184, 4920),
++	CHAN5G(188, 4940),
++	CHAN5G(192, 4960),
++	CHAN5G(196, 4980),
+ };
+ 
+ static const struct ieee80211_channel mt76_channels_6ghz[] = {
+-- 
+2.25.1
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1102-mt76-testmode-add-attributes-for-setting-rf-config.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1102-mt76-testmode-add-attributes-for-setting-rf-config.patch
new file mode 100755
index 0000000..6fedd3c
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1102-mt76-testmode-add-attributes-for-setting-rf-config.patch
@@ -0,0 +1,106 @@
+From fdf988d26cbea1d432e6cfb9a0ca82c160101771 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Fri, 4 Jun 2021 18:22:07 +0800
+Subject: [PATCH 1102/1112] mt76: testmode: add attributes for setting rf
+ config
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ drivers/net/wireless/mediatek/mt76/mt76.h     |  5 ++++
+ drivers/net/wireless/mediatek/mt76/testmode.c | 17 +++++++++++++-
+ drivers/net/wireless/mediatek/mt76/testmode.h | 23 +++++++++++++++++++
+ 3 files changed, 44 insertions(+), 1 deletion(-)
+
+diff --git a/mt76.h b/mt76.h
+index 8ad7674..157fd6d 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -619,6 +619,11 @@ struct mt76_testmode_data {
+ 
+ 	u8 flag;
+ 
++	struct {
++		u8 type;
++		u8 enable;
++	} cfg;
++
+ 	u32 tx_pending;
+ 	u32 tx_queued;
+ 	u16 tx_queued_limit;
+diff --git a/testmode.c b/testmode.c
+index 1fbca66..f31e124 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -547,7 +547,22 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			if (nla_len(cur) != ETH_ALEN || idx >= 3)
+ 				goto out;
+ 
+-			memcpy(td->addr[idx], nla_data(cur), ETH_ALEN);
++			memcpy(td->addr[idx++], nla_data(cur), ETH_ALEN);
++		}
++	}
++
++	if (tb[MT76_TM_ATTR_CFG]) {
++		struct nlattr *cur;
++		int rem, idx = 0;
++
++		nla_for_each_nested(cur, tb[MT76_TM_ATTR_CFG], rem) {
++			if (nla_len(cur) != 1 || idx >= 2)
++				goto out;
++
++			if (idx == 0)
++				td->cfg.type = nla_get_u8(cur);
++			else
++				td->cfg.enable = nla_get_u8(cur);
+ 			idx++;
+ 		}
+ 	}
+diff --git a/testmode.h b/testmode.h
+index 5900c76..c469ce6 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -55,6 +55,8 @@
+  * @MT76_TM_ATTR_EEPROM_VAL: values for writing into a 16-byte data block
+  * 	(nested, u8 attrs)
+  *
++ * @MT76_TM_ATTR_CFG: config testmode rf feature (nested, see &mt76_testmode_cfg)
++ *
+  */
+ enum mt76_testmode_attr {
+ 	MT76_TM_ATTR_UNSPEC,
+@@ -97,6 +99,8 @@ enum mt76_testmode_attr {
+ 	MT76_TM_ATTR_EEPROM_OFFSET,
+ 	MT76_TM_ATTR_EEPROM_VAL,
+ 
++	MT76_TM_ATTR_CFG,
++
+ 	/* keep last */
+ 	NUM_MT76_TM_ATTRS,
+ 	MT76_TM_ATTR_MAX = NUM_MT76_TM_ATTRS - 1,
+@@ -228,4 +232,23 @@ enum mt76_testmode_eeprom_action {
+ 	MT76_TM_EEPROM_ACTION_MAX = NUM_MT76_TM_EEPROM_ACTION - 1,
+ };
+ 
++/**
++ * enum mt76_testmode_cfg - packet tx phy mode
++ *
++ * @MT76_TM_EEPROM_ACTION_UPDATE_DATA: update rf values to specific
++ * 	eeprom data block
++ * @MT76_TM_EEPROM_ACTION_UPDATE_BUFFER_MODE: send updated eeprom data to fw
++ * @MT76_TM_EEPROM_ACTION_WRITE_TO_EFUSE: write eeprom data back to efuse
++ */
++enum mt76_testmode_cfg {
++	MT76_TM_CFG_TSSI,
++	MT76_TM_CFG_DPD,
++	MT76_TM_CFG_RATE_POWER_OFFSET,
++	MT76_TM_CFG_THERMAL_COMP,
++
++	/* keep last */
++	NUM_MT76_TM_CFG,
++	MT76_TM_CFG_MAX = NUM_MT76_TM_CFG - 1,
++};
++
+ #endif
+-- 
+2.25.1
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1103-mt76-mt7915-implement-config-set-in-testmode.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1103-mt76-mt7915-implement-config-set-in-testmode.patch
new file mode 100755
index 0000000..bdba37f
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1103-mt76-mt7915-implement-config-set-in-testmode.patch
@@ -0,0 +1,87 @@
+From 63de755813ec9d82c785b4d70c4f59d5fb00ca69 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Fri, 4 Jun 2021 18:25:21 +0800
+Subject: [PATCH 1103/1112] mt76: mt7915: implement config set in testmode
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ .../net/wireless/mediatek/mt76/mt7915/mcu.h   |  4 +++
+ .../wireless/mediatek/mt76/mt7915/testmode.c  | 26 +++++++++++++++++++
+ 2 files changed, 30 insertions(+)
+
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index c15f89b..4b78468 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -27,6 +27,10 @@ struct mt7915_mcu_txd {
+ 
+ enum {
+ 	MCU_ATE_SET_TRX = 0x1,
++	MCU_ATE_SET_TSSI = 0x5,
++	MCU_ATE_SET_DPD = 0x6,
++	MCU_ATE_SET_RATE_POWER_OFFSET = 0x7,
++	MCU_ATE_SET_THERMAL_COMP = 0x8,
+ 	MCU_ATE_SET_FREQ_OFFSET = 0xa,
+ 	MCU_ATE_SET_PHY_COUNT = 0x11,
+ 	MCU_ATE_SET_SLOT_TIME = 0x13,
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index 2c859f6..98431d6 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -9,6 +9,7 @@
+ enum {
+ 	TM_CHANGED_TXPOWER,
+ 	TM_CHANGED_FREQ_OFFSET,
++	TM_CHANGED_CFG,
+ 
+ 	/* must be last */
+ 	NUM_TM_CHANGED
+@@ -17,6 +18,7 @@ enum {
+ static const u8 tm_change_map[] = {
+ 	[TM_CHANGED_TXPOWER] = MT76_TM_ATTR_TX_POWER,
+ 	[TM_CHANGED_FREQ_OFFSET] = MT76_TM_ATTR_FREQ_OFFSET,
++	[TM_CHANGED_CFG] = MT76_TM_ATTR_CFG,
+ };
+ 
+ struct reg_band {
+@@ -182,6 +184,28 @@ mt7915_tm_set_tam_arb(struct mt7915_phy *phy, bool enable, bool mu)
+ 	return mt7915_mcu_set_muru_ctrl(dev, MURU_SET_ARB_OP_MODE, op_mode);
+ }
+ 
++static int
++mt7915_tm_set_cfg(struct mt7915_phy *phy)
++{
++	static const u8 cfg_cmd[] = {
++		[MT76_TM_CFG_TSSI] = MCU_ATE_SET_TSSI,
++		[MT76_TM_CFG_DPD] = MCU_ATE_SET_DPD,
++		[MT76_TM_CFG_RATE_POWER_OFFSET] = MCU_ATE_SET_RATE_POWER_OFFSET,
++		[MT76_TM_CFG_THERMAL_COMP] = MCU_ATE_SET_THERMAL_COMP,
++	};
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7915_dev *dev = phy->dev;
++	struct mt7915_tm_cmd req = {
++		.testmode_en = !(phy->mt76->test.state == MT76_TM_STATE_OFF),
++		.param_idx = cfg_cmd[td->cfg.type],
++		.param.cfg.enable = td->cfg.enable,
++		.param.cfg.band = phy != &dev->phy,
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
++				 sizeof(req), false);
++}
++
+ static int
+ mt7915_tm_set_wmm_qid(struct mt7915_dev *dev, u8 qid, u8 aifs, u8 cw_min,
+ 		      u16 cw_max, u16 txop)
+@@ -727,6 +751,8 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+ 		mt7915_tm_set_freq_offset(phy, en, en ? td->freq_offset : 0);
+ 	if (changed & BIT(TM_CHANGED_TXPOWER))
+ 		mt7915_tm_set_tx_power(phy);
++	if (changed & BIT(TM_CHANGED_CFG))
++		mt7915_tm_set_cfg(phy);
+ }
+ 
+ static int
+-- 
+2.25.1
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1104-mt76-testmode-add-attributes-to-support-off-channel-.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1104-mt76-testmode-add-attributes-to-support-off-channel-.patch
new file mode 100755
index 0000000..98b1d7b
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1104-mt76-testmode-add-attributes-to-support-off-channel-.patch
@@ -0,0 +1,92 @@
+From c11cb393f5d03ff73809510a1056f7aef1799de9 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Mon, 28 Jun 2021 10:46:14 +0800
+Subject: [PATCH 1104/1112] mt76: testmode: add attributes to support off
+ channel scan
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ drivers/net/wireless/mediatek/mt76/mt76.h     |  5 +++++
+ drivers/net/wireless/mediatek/mt76/testmode.c | 21 +++++++++++++++++++
+ drivers/net/wireless/mediatek/mt76/testmode.h | 10 +++++++++
+ 3 files changed, 36 insertions(+)
+
+diff --git a/mt76.h b/mt76.h
+index 157fd6d..ab9482c 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -624,6 +624,11 @@ struct mt76_testmode_data {
+ 		u8 enable;
+ 	} cfg;
+ 
++	u8 off_ch_scan_ch;
++	u8 off_ch_scan_center_ch;
++	u8 off_ch_scan_bw;
++	u8 off_ch_scan_path;
++
+ 	u32 tx_pending;
+ 	u32 tx_queued;
+ 	u16 tx_queued_limit;
+diff --git a/testmode.c b/testmode.c
+index f31e124..2376e00 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -567,6 +567,27 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		}
+ 	}
+ 
++	if (tb[MT76_TM_ATTR_OFF_CH_SCAN_CH]) {
++		u8 ch = nla_get_u8(tb[MT76_TM_ATTR_OFF_CH_SCAN_CH]);
++		struct ieee80211_supported_band *sband;
++
++		sband = ch > 14 ? &phy->sband_5g.sband :
++				  &phy->sband_2g.sband;
++		if (ch && (ch < sband->channels[0].hw_value ||
++			   ch > sband->channels[sband->n_channels - 1].hw_value))
++			goto out;
++
++		td->off_ch_scan_ch = ch;
++
++		if (mt76_tm_get_u8(tb[MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH],
++				   &td->off_ch_scan_center_ch, ch - 6, ch + 6) ||
++		    mt76_tm_get_u8(tb[MT76_TM_ATTR_OFF_CH_SCAN_BW],
++				   &td->off_ch_scan_bw, 0, 6) ||
++		    mt76_tm_get_u8(tb[MT76_TM_ATTR_OFF_CH_SCAN_PATH],
++				   &td->off_ch_scan_path, 1, 0xff))
++			goto out;
++	}
++
+ 	if (dev->test_ops->set_params) {
+ 		err = dev->test_ops->set_params(phy, tb, state);
+ 		if (err)
+diff --git a/testmode.h b/testmode.h
+index c469ce6..0fc0ddd 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -57,6 +57,11 @@
+  *
+  * @MT76_TM_ATTR_CFG: config testmode rf feature (nested, see &mt76_testmode_cfg)
+  *
++ * @MT76_TM_ATTR_OFF_CH_SCAN_CH: monitored channel for off channel scan (u8)
++ * @MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH: monitored channel for off channel scan (u8)
++ * @MT76_TM_ATTR_OFF_CH_SCAN_BW: monitored bw for off channel scan (u8)
++ * @MT76_TM_ATTR_OFF_CH_SCAN_PATH: monitored rx path for off channel scan (u8)
++ *
+  */
+ enum mt76_testmode_attr {
+ 	MT76_TM_ATTR_UNSPEC,
+@@ -101,6 +106,11 @@ enum mt76_testmode_attr {
+ 
+ 	MT76_TM_ATTR_CFG,
+ 
++	MT76_TM_ATTR_OFF_CH_SCAN_CH,
++	MT76_TM_ATTR_OFF_CH_SCAN_CENTER_CH,
++	MT76_TM_ATTR_OFF_CH_SCAN_BW,
++	MT76_TM_ATTR_OFF_CH_SCAN_PATH,
++
+ 	/* keep last */
+ 	NUM_MT76_TM_ATTRS,
+ 	MT76_TM_ATTR_MAX = NUM_MT76_TM_ATTRS - 1,
+-- 
+2.25.1
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1105-mt76-mt7915-add-off-channel-scan-support-in-testmode.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1105-mt76-mt7915-add-off-channel-scan-support-in-testmode.patch
new file mode 100755
index 0000000..ecad61f
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1105-mt76-mt7915-add-off-channel-scan-support-in-testmode.patch
@@ -0,0 +1,145 @@
+From 623e57c672ee85f8a4a9455888237d09df405962 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Mon, 28 Jun 2021 10:46:39 +0800
+Subject: [PATCH 1105/1112] mt76: mt7915: add off channel scan support in
+ testmode
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ .../wireless/mediatek/mt76/mt7915/testmode.c  | 72 +++++++++++++++++++
+ .../wireless/mediatek/mt76/mt7915/testmode.h  | 10 +++
+ 2 files changed, 82 insertions(+)
+
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index 98431d6..08bb700 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -10,6 +10,7 @@ enum {
+ 	TM_CHANGED_TXPOWER,
+ 	TM_CHANGED_FREQ_OFFSET,
+ 	TM_CHANGED_CFG,
++	TM_CHANGED_OFF_CH_SCAN_CH,
+ 
+ 	/* must be last */
+ 	NUM_TM_CHANGED
+@@ -19,6 +20,7 @@ static const u8 tm_change_map[] = {
+ 	[TM_CHANGED_TXPOWER] = MT76_TM_ATTR_TX_POWER,
+ 	[TM_CHANGED_FREQ_OFFSET] = MT76_TM_ATTR_FREQ_OFFSET,
+ 	[TM_CHANGED_CFG] = MT76_TM_ATTR_CFG,
++	[TM_CHANGED_OFF_CH_SCAN_CH] = MT76_TM_ATTR_OFF_CH_SCAN_CH,
+ };
+ 
+ struct reg_band {
+@@ -36,6 +38,25 @@ struct reg_band {
+ static struct reg_band reg_backup_list[TM_REG_MAX_ID];
+ 
+ 
++static u8 mt7915_tm_chan_bw(enum nl80211_chan_width width)
++{
++	static const u8 width_to_bw[] = {
++		[NL80211_CHAN_WIDTH_40] = TM_CBW_40MHZ,
++		[NL80211_CHAN_WIDTH_80] = TM_CBW_80MHZ,
++		[NL80211_CHAN_WIDTH_80P80] = TM_CBW_8080MHZ,
++		[NL80211_CHAN_WIDTH_160] = TM_CBW_160MHZ,
++		[NL80211_CHAN_WIDTH_5] = TM_CBW_5MHZ,
++		[NL80211_CHAN_WIDTH_10] = TM_CBW_10MHZ,
++		[NL80211_CHAN_WIDTH_20] = TM_CBW_20MHZ,
++		[NL80211_CHAN_WIDTH_20_NOHT] = TM_CBW_20MHZ,
++	};
++
++	if (width >= ARRAY_SIZE(width_to_bw))
++		return 0;
++
++	return width_to_bw[width];
++}
++
+ static int
+ mt7915_tm_set_tx_power(struct mt7915_phy *phy)
+ {
+@@ -206,6 +227,55 @@ mt7915_tm_set_cfg(struct mt7915_phy *phy)
+ 				 sizeof(req), false);
+ }
+ 
++static int
++mt7915_tm_set_off_channel_scan(struct mt7915_phy *phy)
++{
++#define OFF_CH_SCAN_SIMPLE_RX	2
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7915_dev *dev = phy->dev;
++	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
++	int freq1 = chandef->center_freq1;
++	struct {
++		u8 cur_pri_ch;
++		u8 cur_center_ch;
++		u8 cur_bw;
++		u8 cur_tx_path;
++		u8 cur_rx_path;
++
++		u8 scan_pri_ch;
++		u8 scan_center_ch;
++		u8 scan_bw;
++		u8 scan_tx_path;
++		u8 scan_rx_path;
++
++		u8 enable;
++		u8 band_idx;
++		u8 type;
++		u8 is_5g;
++		u8 _rsv[2];
++	} __packed req = {
++		.cur_pri_ch = chandef->chan->hw_value,
++		.cur_center_ch = ieee80211_frequency_to_channel(freq1),
++		.cur_bw = mt7915_tm_chan_bw(chandef->width),
++		.cur_tx_path = td->tx_antenna_mask,
++		.cur_rx_path = td->tx_antenna_mask,
++
++		.scan_pri_ch = td->off_ch_scan_ch,
++		.scan_center_ch = td->off_ch_scan_center_ch,
++		.scan_bw = td->off_ch_scan_bw,
++		.scan_tx_path = td->off_ch_scan_path,
++		.scan_rx_path = td->off_ch_scan_path,
++
++		.enable = !!td->off_ch_scan_ch,
++		.band_idx = phy != &dev->phy,
++		.type = OFF_CH_SCAN_SIMPLE_RX,
++		.is_5g = td->off_ch_scan_ch > 14 ? 1 : 0,
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(OFFCH_SCAN_CTRL), &req,
++				 sizeof(req), false);
++}
++
+ static int
+ mt7915_tm_set_wmm_qid(struct mt7915_dev *dev, u8 qid, u8 aifs, u8 cw_min,
+ 		      u16 cw_max, u16 txop)
+@@ -753,6 +823,8 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+ 		mt7915_tm_set_tx_power(phy);
+ 	if (changed & BIT(TM_CHANGED_CFG))
+ 		mt7915_tm_set_cfg(phy);
++	if (changed & BIT(TM_CHANGED_OFF_CH_SCAN_CH))
++		mt7915_tm_set_off_channel_scan(phy);
+ }
+ 
+ static int
+diff --git a/mt7915/testmode.h b/mt7915/testmode.h
+index a1c54c8..d22aabe 100644
+--- a/mt7915/testmode.h
++++ b/mt7915/testmode.h
+@@ -130,4 +130,14 @@ struct mt7915_tm_rx_stat_band {
+ 	__le16 mdrdy_cnt_ofdm;
+ };
+ 
++enum {
++	TM_CBW_20MHZ,
++	TM_CBW_40MHZ,
++	TM_CBW_80MHZ,
++	TM_CBW_10MHZ,
++	TM_CBW_5MHZ,
++	TM_CBW_160MHZ,
++	TM_CBW_8080MHZ,
++};
++
+ #endif
+-- 
+2.25.1
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1106-mt76-testmode-add-virtual-stations-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1106-mt76-testmode-add-virtual-stations-support.patch
new file mode 100755
index 0000000..16b0858
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1106-mt76-testmode-add-virtual-stations-support.patch
@@ -0,0 +1,224 @@
+From ced1d19944f5da249dfacc0a4ef3d5616efc4f87 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Mon, 10 May 2021 20:50:43 +0800
+Subject: [PATCH 1106/1112] mt76: testmode: add virtual stations support
+
+Introduce a virtual station struct mt76_testmode_sta for the
+preparation of HE-MU and RU setting support in testmode.
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ drivers/net/wireless/mediatek/mt76/mt76.h     | 103 +++++++++++++++---
+ drivers/net/wireless/mediatek/mt76/testmode.c |   6 +-
+ drivers/net/wireless/mediatek/mt76/testmode.h |   5 +
+ drivers/net/wireless/mediatek/mt76/tx.c       |   3 +-
+ 4 files changed, 99 insertions(+), 18 deletions(-)
+
+diff --git a/mt76.h b/mt76.h
+index ab9482c..ce4a098 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -586,6 +586,22 @@ struct mt76_testmode_ops {
+ 
+ #define MT_TM_FW_RX_COUNT	BIT(0)
+ 
++struct mt76_testmode_sta_data {
++	u16 tx_mpdu_len;
++	u8 tx_rate_idx;
++	u8 tx_rate_nss;
++	u8 tx_rate_ldpc;
++
++	u8 aid;
++	u8 ru_alloc;
++	u8 ru_idx;
++};
++
++struct mt76_testmode_sta {
++	struct sk_buff *tx_skb;
++	struct mt76_testmode_sta_data sd;
++};
++
+ struct mt76_testmode_data {
+ 	enum mt76_testmode_state state;
+ 
+@@ -593,13 +609,9 @@ struct mt76_testmode_data {
+ 	struct sk_buff *tx_skb;
+ 
+ 	u32 tx_count;
+-	u16 tx_mpdu_len;
+ 
+ 	u8 tx_rate_mode;
+-	u8 tx_rate_idx;
+-	u8 tx_rate_nss;
+ 	u8 tx_rate_sgi;
+-	u8 tx_rate_ldpc;
+ 	u8 tx_rate_stbc;
+ 	u8 tx_ltf;
+ 
+@@ -629,6 +641,22 @@ struct mt76_testmode_data {
+ 	u8 off_ch_scan_bw;
+ 	u8 off_ch_scan_path;
+ 
++	struct mt76_wcid *tm_wcid[MT76_TM_MAX_STA_NUM + 1];
++	u16 tm_sta_mask;
++	union {
++		struct mt76_testmode_sta_data sd;
++		struct {
++			u16 tx_mpdu_len;
++			u8 tx_rate_idx;
++			u8 tx_rate_nss;
++			u8 tx_rate_ldpc;
++
++			u8 aid;
++			u8 ru_alloc;
++			u8 ru_idx;
++		};
++	};
++
+ 	u32 tx_pending;
+ 	u32 tx_queued;
+ 	u16 tx_queued_limit;
+@@ -1107,22 +1135,69 @@ static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
+ #endif
+ }
+ 
++#ifdef CONFIG_NL80211_TESTMODE
++static inline bool
++mt76_testmode_has_sta(struct mt76_phy *phy)
++{
++	return phy->test.tm_sta_mask != 0;
++}
++
++static inline struct mt76_testmode_sta *
++mt76_testmode_aid_get_sta(struct mt76_phy *phy, u8 aid)
++{
++	struct mt76_wcid *wcid = phy->test.tm_wcid[aid];
++
++	if (!wcid || !aid)
++		return NULL;
++
++	return (struct mt76_testmode_sta *)((u8 *)wcid + phy->hw->sta_data_size);
++}
++
++#define mt76_testmode_for_each_sta(phy, aid, tm_sta)	\
++	for (aid = 1, tm_sta = mt76_testmode_aid_get_sta(phy, 1);	\
++	     aid <= hweight16(phy->test.tm_sta_mask);	\
++	     aid = phy->test.tm_sta_mask >> aid ?	\
++		   ffs(phy->test.tm_sta_mask >> aid) + aid :	\
++		   aid + 1,	\
++	     tm_sta = mt76_testmode_aid_get_sta(phy, aid))
++
++static inline bool
++__mt76_testmode_check_skb(struct mt76_phy *phy, struct sk_buff *skb)
++{
++	struct mt76_testmode_sta *tm_sta;
++	int i;
++
++	if (!mt76_testmode_has_sta(phy))
++		return false;
++
++	mt76_testmode_for_each_sta(phy, i, tm_sta) {
++		if (tm_sta->tx_skb == skb)
++			return true;
++	}
++
++	return false;
++}
++
+ static inline bool mt76_is_testmode_skb(struct mt76_dev *dev,
+ 					struct sk_buff *skb,
+ 					struct ieee80211_hw **hw)
+ {
+-#ifdef CONFIG_NL80211_TESTMODE
+-	if (skb == dev->phy.test.tx_skb)
+-		*hw = dev->phy.hw;
+-	else if (dev->phy2 && skb == dev->phy2->test.tx_skb)
+-		*hw = dev->phy2->hw;
+-	else
+-		return false;
+-	return true;
+-#else
++	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++	struct mt76_phy *phy = &dev->phy;
++
++	if ((info->hw_queue & MT_TX_HW_QUEUE_EXT_PHY) && dev->phy2)
++		phy = dev->phy2;
++
++	if (mt76_testmode_enabled(phy) &&
++	    (skb == phy->test.tx_skb ||
++	    __mt76_testmode_check_skb(phy, skb))) {
++		*hw = phy->hw;
++		return true;
++	}
++
+ 	return false;
+-#endif
+ }
++#endif
+ 
+ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb);
+ void mt76_tx(struct mt76_phy *dev, struct ieee80211_sta *sta,
+diff --git a/testmode.c b/testmode.c
+index 2376e00..682ca3d 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -382,7 +382,6 @@ int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state
+ 	}
+ 
+ 	return __mt76_testmode_set_state(phy, state);
+-
+ }
+ EXPORT_SYMBOL(mt76_testmode_set_state);
+ 
+@@ -495,7 +494,10 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
+ 			   &td->tx_duty_cycle, 0, 99) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_POWER_CONTROL],
+-			   &td->tx_power_control, 0, 1))
++			   &td->tx_power_control, 0, 1) ||
++	    mt76_tm_get_u8(tb[MT76_TM_ATTR_AID], &td->aid, 0, 16) ||
++	    mt76_tm_get_u8(tb[MT76_TM_ATTR_RU_ALLOC], &td->ru_alloc, 0, 0xff) ||
++	    mt76_tm_get_u8(tb[MT76_TM_ATTR_RU_IDX], &td->ru_idx, 0, 68))
+ 		goto out;
+ 
+ 	if (tb[MT76_TM_ATTR_TX_LENGTH]) {
+diff --git a/testmode.h b/testmode.h
+index 0fc0ddd..b360d7a 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -7,6 +7,7 @@
+ 
+ #define MT76_TM_TIMEOUT	10
+ #define MT76_TM_EEPROM_BLOCK_SIZE	16
++#define MT76_TM_MAX_STA_NUM	16
+ 
+ /**
+  * enum mt76_testmode_attr - testmode attributes inside NL80211_ATTR_TESTDATA
+@@ -111,6 +112,10 @@ enum mt76_testmode_attr {
+ 	MT76_TM_ATTR_OFF_CH_SCAN_BW,
+ 	MT76_TM_ATTR_OFF_CH_SCAN_PATH,
+ 
++	MT76_TM_ATTR_AID,
++	MT76_TM_ATTR_RU_ALLOC,
++	MT76_TM_ATTR_RU_IDX,
++
+ 	/* keep last */
+ 	NUM_MT76_TM_ATTRS,
+ 	MT76_TM_ATTR_MAX = NUM_MT76_TM_ATTRS - 1,
+diff --git a/tx.c b/tx.c
+index 6b8c9dc..ca5e6d9 100644
+--- a/tx.c
++++ b/tx.c
+@@ -245,8 +245,7 @@ void __mt76_tx_complete_skb(struct mt76_dev *dev, u16 wcid_idx, struct sk_buff *
+ 	if (mt76_is_testmode_skb(dev, skb, &hw)) {
+ 		struct mt76_phy *phy = hw->priv;
+ 
+-		if (skb == phy->test.tx_skb)
+-			phy->test.tx_done++;
++		phy->test.tx_done++;
+ 		if (phy->test.tx_queued == phy->test.tx_done)
+ 			wake_up(&dev->tx_wait);
+ 
+-- 
+2.25.1
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1107-mt76-testmode-support-to-dump-stats-from-different-v.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1107-mt76-testmode-support-to-dump-stats-from-different-v.patch
new file mode 100755
index 0000000..78ad215
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1107-mt76-testmode-support-to-dump-stats-from-different-v.patch
@@ -0,0 +1,94 @@
+From e5b15e6a5f8f8ee282e818172f9b1a9cb5a63942 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Mon, 17 May 2021 11:27:17 +0800
+Subject: [PATCH 1107/1112] mt76: testmode: support to dump stats from
+ different virtual stations
+
+Support to
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ drivers/net/wireless/mediatek/mt76/testmode.c | 36 ++++++++++++++++---
+ 1 file changed, 31 insertions(+), 5 deletions(-)
+
+diff --git a/testmode.c b/testmode.c
+index 682ca3d..bb15388 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -331,8 +331,11 @@ __mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state)
+ 	struct mt76_dev *dev = phy->dev;
+ 	int err;
+ 
+-	if (prev_state == MT76_TM_STATE_TX_FRAMES)
++	if (prev_state == MT76_TM_STATE_TX_FRAMES) {
++		if (phy->test.tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
++			dev->test_ops->set_state(phy, MT76_TM_STATE_IDLE);
+ 		mt76_testmode_tx_stop(phy);
++	}
+ 
+ 	if (state == MT76_TM_STATE_TX_FRAMES) {
+ 		err = mt76_testmode_tx_init(phy);
+@@ -654,6 +657,7 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ 	struct mt76_phy *phy = hw->priv;
+ 	struct mt76_dev *dev = phy->dev;
+ 	struct mt76_testmode_data *td = &phy->test;
++	struct mt76_testmode_sta_data *sd = &td->sd;
+ 	struct nlattr *tb[NUM_MT76_TM_ATTRS] = {};
+ 	int err = 0;
+ 	void *a;
+@@ -686,6 +690,23 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ 		goto out;
+ 	}
+ 
++	if (tb[MT76_TM_ATTR_AID]) {
++		struct mt76_testmode_sta *tm_sta;
++		u8 aid;
++
++		err = mt76_tm_get_u8(tb[MT76_TM_ATTR_AID], &aid, 1, 16);
++		if (err)
++			goto out;
++
++		tm_sta = mt76_testmode_aid_get_sta(phy, aid);
++		if (!tm_sta) {
++			err = -EINVAL;
++			goto out;
++		}
++
++		sd = &tm_sta->sd;
++	}
++
+ 	mt76_testmode_init_defaults(phy);
+ 
+ 	err = -EMSGSIZE;
+@@ -698,12 +719,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ 		goto out;
+ 
+ 	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
+-	    nla_put_u32(msg, MT76_TM_ATTR_TX_LENGTH, td->tx_mpdu_len) ||
+ 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_MODE, td->tx_rate_mode) ||
+-	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_NSS, td->tx_rate_nss) ||
+-	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_IDX, td->tx_rate_idx) ||
+ 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_SGI, td->tx_rate_sgi) ||
+-	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_LDPC, td->tx_rate_ldpc) ||
+ 	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_STBC, td->tx_rate_stbc) ||
+ 	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_LTF) &&
+ 	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
+@@ -723,6 +740,15 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+ 	     nla_put_u8(msg, MT76_TM_ATTR_FREQ_OFFSET, td->freq_offset)))
+ 		goto out;
+ 
++	if (nla_put_u8(msg, MT76_TM_ATTR_AID, sd->aid) ||
++	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_NSS, sd->tx_rate_nss) ||
++	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_IDX, sd->tx_rate_idx) ||
++	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_LDPC, sd->tx_rate_ldpc) ||
++	    nla_put_u8(msg, MT76_TM_ATTR_RU_ALLOC, sd->ru_alloc) ||
++	    nla_put_u8(msg, MT76_TM_ATTR_RU_IDX, sd->ru_idx) ||
++	    nla_put_u32(msg, MT76_TM_ATTR_TX_LENGTH, sd->tx_mpdu_len))
++		goto out;
++
+ 	if (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_POWER)) {
+ 		a = nla_nest_start(msg, MT76_TM_ATTR_TX_POWER);
+ 		if (!a)
+-- 
+2.25.1
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1108-mt76-testmode-rework-the-flow-of-init-tx-skb.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1108-mt76-testmode-rework-the-flow-of-init-tx-skb.patch
new file mode 100755
index 0000000..45e5af7
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1108-mt76-testmode-rework-the-flow-of-init-tx-skb.patch
@@ -0,0 +1,193 @@
+From 323105f9f7d5057ffb445948318525f81b76506c Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Tue, 11 May 2021 10:24:46 +0800
+Subject: [PATCH 1108/1112] mt76: testmode: rework the flow of init tx skb
+
+This is the preparation for supporting virtual stations in testmode.
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ drivers/net/wireless/mediatek/mt76/mt76.h     |  3 +-
+ .../wireless/mediatek/mt76/mt7915/testmode.c  |  2 +-
+ drivers/net/wireless/mediatek/mt76/testmode.c | 73 +++++++++++++++----
+ 3 files changed, 61 insertions(+), 17 deletions(-)
+
+diff --git a/mt76.h b/mt76.h
+index ce4a098..b5f1367 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -1289,7 +1289,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
+ 		       struct netlink_callback *cb, void *data, int len);
+ int mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state);
+-int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len);
++int mt76_testmode_init_skb(struct mt76_phy *phy, u32 len, u8 aid, struct sk_buff **skb);
+ 
+ static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
+ {
+@@ -1303,7 +1303,6 @@ static inline void mt76_testmode_reset(struct mt76_phy *phy, bool disable)
+ #endif
+ }
+ 
+-
+ /* internal */
+ static inline struct ieee80211_hw *
+ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index 08bb700..054829e 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -431,7 +431,7 @@ mt7915_tm_set_tx_len(struct mt7915_phy *phy, u32 tx_time)
+ 	bitrate = cfg80211_calculate_bitrate(&rate);
+ 	tx_len = bitrate * tx_time / 10 / 8;
+ 
+-	ret = mt76_testmode_alloc_skb(phy->mt76, tx_len);
++	ret = mt76_testmode_init_skb(phy->mt76, tx_len, 0, &td->tx_skb);
+ 	if (ret)
+ 		return ret;
+ 
+diff --git a/testmode.c b/testmode.c
+index bb15388..0f93338 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -87,15 +87,34 @@ mt76_testmode_max_mpdu_len(struct mt76_phy *phy, u8 tx_rate_mode)
+ }
+ 
+ static void
+-mt76_testmode_free_skb(struct mt76_phy *phy)
++mt76_testmode_free_skb(struct sk_buff **tx_skb)
++{
++	dev_kfree_skb(*tx_skb);
++	*tx_skb = NULL;
++}
++
++static void
++mt76_testmode_free_skb_all(struct mt76_phy *phy)
+ {
+ 	struct mt76_testmode_data *td = &phy->test;
+ 
+-	dev_kfree_skb(td->tx_skb);
+-	td->tx_skb = NULL;
++	if (mt76_testmode_has_sta(phy)) {
++		struct mt76_testmode_sta *tm_sta;
++		int i;
++
++		mt76_testmode_for_each_sta(phy, i, tm_sta) {
++			mt76_testmode_free_skb(&tm_sta->tx_skb);
++		}
++
++		return;
++	}
++
++	mt76_testmode_free_skb(&td->tx_skb);
+ }
+ 
+-int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
++static int
++mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len,
++			struct sk_buff **tx_skb, u8 *da)
+ {
+ #define MT_TXP_MAX_LEN	4095
+ 	u16 fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA |
+@@ -128,7 +147,9 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+ 	hdr->frame_control = cpu_to_le16(fc);
+ 	memcpy(hdr->addr1, td->addr[0], ETH_ALEN);
+ 	memcpy(hdr->addr2, td->addr[1], ETH_ALEN);
+-	memcpy(hdr->addr3, td->addr[2], ETH_ALEN);
++	/* memcpy(hdr->addr3, td->addr[2], ETH_ALEN); */
++	memcpy(hdr->addr3, da, ETH_ALEN);
++
+ 	skb_set_queue_mapping(head, IEEE80211_AC_BE);
+ 
+ 	info = IEEE80211_SKB_CB(head);
+@@ -152,7 +173,7 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+ 
+ 		frag = alloc_skb(frag_len, GFP_KERNEL);
+ 		if (!frag) {
+-			mt76_testmode_free_skb(phy);
++			mt76_testmode_free_skb(tx_skb);
+ 			dev_kfree_skb(head);
+ 			return -ENOMEM;
+ 		}
+@@ -165,23 +186,25 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+ 		frag_tail = &(*frag_tail)->next;
+ 	}
+ 
+-	mt76_testmode_free_skb(phy);
+-	td->tx_skb = head;
++	mt76_testmode_free_skb(tx_skb);
++	*tx_skb = head;
+ 
+ 	return 0;
+ }
+-EXPORT_SYMBOL(mt76_testmode_alloc_skb);
+ 
+-static int
+-mt76_testmode_tx_init(struct mt76_phy *phy)
++int mt76_testmode_init_skb(struct mt76_phy *phy, u32 len, u8 aid,
++			   struct sk_buff **tx_skb)
+ {
+ 	struct mt76_testmode_data *td = &phy->test;
+ 	struct ieee80211_tx_info *info;
+ 	struct ieee80211_tx_rate *rate;
+ 	u8 max_nss = hweight8(phy->antenna_mask);
++	u8 da[ETH_ALEN];
+ 	int ret;
+ 
+-	ret = mt76_testmode_alloc_skb(phy, td->tx_mpdu_len);
++	ether_addr_copy(da, phy->macaddr);
++	da[0] += aid * 4;
++	ret = mt76_testmode_alloc_skb(phy, len, tx_skb, da);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -191,7 +214,7 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
+ 	if (td->tx_antenna_mask)
+ 		max_nss = min_t(u8, max_nss, hweight8(td->tx_antenna_mask));
+ 
+-	info = IEEE80211_SKB_CB(td->tx_skb);
++	info = IEEE80211_SKB_CB(*tx_skb);
+ 	rate = &info->control.rates[0];
+ 	rate->count = 1;
+ 	rate->idx = td->tx_rate_idx;
+@@ -263,6 +286,28 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
+ out:
+ 	return 0;
+ }
++EXPORT_SYMBOL(mt76_testmode_init_skb);
++
++static int
++mt76_testmode_tx_init(struct mt76_phy *phy)
++{
++	struct mt76_testmode_data *td = &phy->test;
++	struct mt76_testmode_sta *tm_sta;
++	int ret, i;
++
++	if (!mt76_testmode_has_sta(phy))
++		return mt76_testmode_init_skb(phy, td->tx_mpdu_len,
++					      0, &td->tx_skb);
++
++	mt76_testmode_for_each_sta(phy, i, tm_sta) {
++		ret = mt76_testmode_init_skb(phy, tm_sta->sd.tx_mpdu_len,
++					     tm_sta->sd.aid, &tm_sta->tx_skb);
++		if (ret)
++			return ret;
++	}
++
++	return 0;
++}
+ 
+ static void
+ mt76_testmode_tx_start(struct mt76_phy *phy)
+@@ -291,7 +336,7 @@ mt76_testmode_tx_stop(struct mt76_phy *phy)
+ 	wait_event_timeout(dev->tx_wait, td->tx_done == td->tx_queued,
+ 			   MT76_TM_TIMEOUT * HZ);
+ 
+-	mt76_testmode_free_skb(phy);
++	mt76_testmode_free_skb_all(phy);
+ }
+ 
+ static inline void
+-- 
+2.25.1
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1109-mt76-testmode-add-support-to-queue-skb-of-multiple-s.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1109-mt76-testmode-add-support-to-queue-skb-of-multiple-s.patch
new file mode 100755
index 0000000..e92177a
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1109-mt76-testmode-add-support-to-queue-skb-of-multiple-s.patch
@@ -0,0 +1,144 @@
+From 19e0036562d574c6ffe6a47790dbfa953b35050c Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Tue, 11 May 2021 15:17:31 +0800
+Subject: [PATCH 1109/1112] mt76: testmode: add support to queue skb of
+ multiple stations
+
+Rework queue skb flow to support sending packet for multiple virtual
+stations.
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ drivers/net/wireless/mediatek/mt76/mt76.h     |  1 +
+ drivers/net/wireless/mediatek/mt76/testmode.c | 70 ++++++++++++++++---
+ 2 files changed, 63 insertions(+), 8 deletions(-)
+
+diff --git a/mt76.h b/mt76.h
+index b5f1367..4b502c6 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -642,6 +642,7 @@ struct mt76_testmode_data {
+ 	u8 off_ch_scan_path;
+ 
+ 	struct mt76_wcid *tm_wcid[MT76_TM_MAX_STA_NUM + 1];
++	u8 cur_aid;
+ 	u16 tm_sta_mask;
+ 	union {
+ 		struct mt76_testmode_sta_data sd;
+diff --git a/testmode.c b/testmode.c
+index 0f93338..9da490c 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -25,18 +25,18 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
+ };
+ EXPORT_SYMBOL_GPL(mt76_tm_policy);
+ 
+-void mt76_testmode_tx_pending(struct mt76_phy *phy)
++static u16
++mt76_testmode_queue_tx(struct mt76_phy *phy, struct mt76_wcid *wcid,
++		       struct sk_buff *skb, u32 limit)
+ {
+ 	struct mt76_testmode_data *td = &phy->test;
+ 	struct mt76_dev *dev = phy->dev;
+-	struct mt76_wcid *wcid = &dev->global_wcid;
+-	struct sk_buff *skb = td->tx_skb;
+ 	struct mt76_queue *q;
+-	u16 tx_queued_limit;
++	u16 tx_queued_limit, count = 0;
+ 	int qid;
+ 
+-	if (!skb || !td->tx_pending)
+-		return;
++	if (!skb)
++		return 0;
+ 
+ 	qid = skb_get_queue_mapping(skb);
+ 	q = phy->q_tx[qid];
+@@ -45,7 +45,7 @@ void mt76_testmode_tx_pending(struct mt76_phy *phy)
+ 
+ 	spin_lock_bh(&q->lock);
+ 
+-	while (td->tx_pending > 0 &&
++	while (count < limit &&
+ 	       td->tx_queued - td->tx_done < tx_queued_limit &&
+ 	       q->queued < q->ndesc / 2) {
+ 		int ret;
+@@ -55,13 +55,56 @@ void mt76_testmode_tx_pending(struct mt76_phy *phy)
+ 		if (ret < 0)
+ 			break;
+ 
+-		td->tx_pending--;
+ 		td->tx_queued++;
++		count++;
+ 	}
+ 
+ 	dev->queue_ops->kick(dev, q);
+ 
+ 	spin_unlock_bh(&q->lock);
++
++	return count;
++}
++
++void mt76_testmode_tx_pending(struct mt76_phy *phy)
++{
++	struct mt76_testmode_data *td = &phy->test;
++	u16 count;
++
++	if (!td->tx_pending)
++		return;
++
++	if (!mt76_testmode_has_sta(phy)) {
++		count = mt76_testmode_queue_tx(phy, &phy->dev->global_wcid,
++					       td->tx_skb, td->tx_pending);
++		td->tx_pending -= count;
++
++		return;
++	}
++
++	while (true) {
++		struct mt76_testmode_sta *tm_sta;
++		struct mt76_wcid *wcid;
++		u32 limit, per_sta_cnt = 1;
++
++		if (td->tx_rate_mode != MT76_TM_TX_MODE_HE_MU)
++			per_sta_cnt = td->tx_count / hweight16(phy->test.tm_sta_mask);
++
++		limit = td->tx_pending % per_sta_cnt;
++		if (limit == 0)
++			limit = per_sta_cnt;
++
++		tm_sta = mt76_testmode_aid_get_sta(phy, td->cur_aid);
++		wcid = td->tm_wcid[td->cur_aid];
++		count = mt76_testmode_queue_tx(phy, wcid, tm_sta->tx_skb, limit);
++
++		td->tx_pending -= count;
++
++		if (td->tx_pending && (td->tx_pending % per_sta_cnt == 0))
++			td->cur_aid = ffs(td->tm_sta_mask >> td->cur_aid) + td->cur_aid;
++		else
++			break;
++	}
+ }
+ 
+ static u32
+@@ -318,6 +361,17 @@ mt76_testmode_tx_start(struct mt76_phy *phy)
+ 	td->tx_queued = 0;
+ 	td->tx_done = 0;
+ 	td->tx_pending = td->tx_count;
++
++	if (mt76_testmode_has_sta(phy)) {
++		td->cur_aid = ffs(td->tm_sta_mask);
++
++		/* The actual tx count of MU packets will be pass to FW
++		 * by a mcu command in testmode.
++		 */
++		if (td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU)
++			td->tx_pending = hweight16(phy->test.tm_sta_mask);
++	}
++
+ 	mt76_worker_schedule(&dev->tx_worker);
+ }
+ 
+-- 
+2.25.1
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1110-mt76-mt7915-implement-aid-support-in-testmode.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1110-mt76-mt7915-implement-aid-support-in-testmode.patch
new file mode 100755
index 0000000..90b53ea
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1110-mt76-mt7915-implement-aid-support-in-testmode.patch
@@ -0,0 +1,420 @@
+From 8027e94f1564089d719a6fb0eab7d29bb2981bf0 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Tue, 11 May 2021 16:24:09 +0800
+Subject: [PATCH 1110/1112] mt76: mt7915: implement aid support in testmode
+
+Add support for virtual stations in mt7915 testmode.
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ .../wireless/mediatek/mt76/mt76_connac_mcu.c  |   5 +
+ .../net/wireless/mediatek/mt76/mt7915/mac.c   |  25 +-
+ .../wireless/mediatek/mt76/mt7915/testmode.c  | 231 +++++++++++++++---
+ 3 files changed, 216 insertions(+), 45 deletions(-)
+
+diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
+index eac096c..a361ab6 100644
+--- a/mt76_connac_mcu.c
++++ b/mt76_connac_mcu.c
+@@ -389,6 +389,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct sk_buff *skb,
+ 	switch (vif->type) {
+ 	case NL80211_IFTYPE_MESH_POINT:
+ 	case NL80211_IFTYPE_AP:
++	case NL80211_IFTYPE_MONITOR:
+ 		if (vif->p2p)
+ 			conn_type = CONNECTION_P2P_GC;
+ 		else
+@@ -577,6 +578,10 @@ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev,
+ 					     wtbl_tlv, sta_wtbl);
+ 	spe = (struct wtbl_spe *)tlv;
+ 	spe->spe_idx = 24;
++
++	/* check */
++	if (vif->type == NL80211_IFTYPE_MONITOR)
++		rx->rca1 = 0;
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac_mcu_wtbl_generic_tlv);
+ 
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index fb42446..2ad4cb1 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -906,16 +906,28 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+ {
+ #ifdef CONFIG_NL80211_TESTMODE
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt76_testmode_sta_data *sd = &td->sd;
+ 	const struct ieee80211_rate *r;
+-	u8 bw, mode, nss = td->tx_rate_nss;
+-	u8 rate_idx = td->tx_rate_idx;
++	u8 bw, mode, nss, rate_idx;
+ 	u16 rateval = 0;
+ 	u32 val;
+ 	bool cck = false;
+ 	int band;
+ 
+-	if (skb != phy->mt76->test.tx_skb)
+-		return;
++	if (mt76_testmode_has_sta(phy->mt76)) {
++		struct mt76_testmode_sta *tm_sta;
++		int i;
++
++		mt76_testmode_for_each_sta(phy->mt76, i, tm_sta) {
++			if (tm_sta->tx_skb == skb) {
++				sd = &tm_sta->sd;
++				break;
++			}
++		}
++	}
++
++	nss = sd->tx_rate_nss;
++	rate_idx = sd->tx_rate_idx;
+ 
+ 	switch (td->tx_rate_mode) {
+ 	case MT76_TM_TX_MODE_HT:
+@@ -1005,7 +1017,7 @@ mt7915_mac_write_txwi_tm(struct mt7915_phy *phy, __le32 *txwi,
+ 	if (mode >= MT_PHY_TYPE_HE_SU)
+ 		val |= FIELD_PREP(MT_TXD6_HELTF, td->tx_ltf);
+ 
+-	if (td->tx_rate_ldpc || (bw > 0 && mode >= MT_PHY_TYPE_HE_SU))
++	if (sd->tx_rate_ldpc || (bw > 0 && mode >= MT_PHY_TYPE_HE_SU))
+ 		val |= MT_TXD6_LDPC;
+ 
+ 	txwi[1] &= ~cpu_to_le32(MT_TXD1_VTA);
+@@ -1474,6 +1486,9 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+ 				continue;
+ 
+ 			msta = container_of(wcid, struct mt7915_sta, wcid);
++			if (mt76_testmode_enabled(msta->vif->phy->mt76))
++				continue;
++
+ 			spin_lock_bh(&dev->sta_poll_lock);
+ 			if (list_empty(&msta->poll_list))
+ 				list_add_tail(&msta->poll_list, &dev->sta_poll_list);
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index 054829e..29c173d 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -11,6 +11,7 @@ enum {
+ 	TM_CHANGED_FREQ_OFFSET,
+ 	TM_CHANGED_CFG,
+ 	TM_CHANGED_OFF_CH_SCAN_CH,
++	TM_CHANGED_AID,
+ 
+ 	/* must be last */
+ 	NUM_TM_CHANGED
+@@ -21,6 +22,7 @@ static const u8 tm_change_map[] = {
+ 	[TM_CHANGED_FREQ_OFFSET] = MT76_TM_ATTR_FREQ_OFFSET,
+ 	[TM_CHANGED_CFG] = MT76_TM_ATTR_CFG,
+ 	[TM_CHANGED_OFF_CH_SCAN_CH] = MT76_TM_ATTR_OFF_CH_SCAN_CH,
++	[TM_CHANGED_AID] = MT76_TM_ATTR_AID,
+ };
+ 
+ struct reg_band {
+@@ -142,18 +144,33 @@ mt7915_tm_set_trx(struct mt7915_phy *phy, int type, bool en)
+ }
+ 
+ static int
+-mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
++mt7915_tm_clean_hwq(struct mt7915_phy *phy)
+ {
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct mt7915_tm_cmd req = {
+ 		.testmode_en = 1,
+ 		.param_idx = MCU_ATE_CLEAN_TXQUEUE,
+-		.param.clean.wcid = wcid,
+ 		.param.clean.band = phy != &dev->phy,
+ 	};
++	struct mt76_testmode_sta *tm_sta;
++	int ret, i;
+ 
+-	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
+-				 sizeof(req), false);
++	if (!mt76_testmode_has_sta(phy->mt76)) {
++		req.param.clean.wcid = dev->mt76.global_wcid.idx;
++
++		return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL),
++					 &req, sizeof(req), false);
++	}
++
++	mt76_testmode_for_each_sta(phy->mt76, i, tm_sta) {
++		req.param.clean.wcid = phy->mt76->test.tm_wcid[i]->idx;
++		ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL),
++					&req, sizeof(req), false);
++		if (ret)
++			return ret;
++	}
++
++	return 0;
+ }
+ 
+ static int
+@@ -530,27 +547,109 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+ 	}
+ }
+ 
++static int
++mt7915_tm_sta_add(struct mt7915_phy *phy, u8 aid,
++		  struct mt76_testmode_sta_data *sd)
++{
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt76_testmode_sta *tm_sta;
++
++	if (!aid)
++		return 0;
++
++	if (!td->tm_wcid[aid]) {
++		struct ieee80211_vif *vif = phy->monitor_vif;
++		struct ieee80211_sband_iftype_data *data;
++		struct ieee80211_supported_band *sband;
++		struct ieee80211_sta *sta;
++		struct mt7915_sta *msta;
++		int ret;
++
++		sta = kzalloc(sizeof(*sta) + phy->mt76->hw->sta_data_size +
++			      sizeof(*tm_sta), GFP_KERNEL);
++		if (!sta)
++			return -ENOMEM;
++
++		if (phy->mt76->chandef.chan->band == NL80211_BAND_5GHZ) {
++			sband = &phy->mt76->sband_5g.sband;
++			data = phy->iftype[NL80211_BAND_5GHZ];
++		} else {
++			sband = &phy->mt76->sband_2g.sband;
++			data = phy->iftype[NL80211_BAND_2GHZ];
++		}
++
++		ether_addr_copy(sta->addr, phy->mt76->macaddr);
++		sta->addr[0] += aid * 4;
++		memcpy(&sta->ht_cap, &sband->ht_cap, sizeof(sta->ht_cap));
++		memcpy(&sta->vht_cap, &sband->vht_cap, sizeof(sta->vht_cap));
++		memcpy(&sta->he_cap, &data[NL80211_IFTYPE_STATION].he_cap,
++		       sizeof(sta->he_cap));
++		sta->aid = aid;
++		sta->wme = 1;
++
++		ret = mt7915_mac_sta_add(&phy->dev->mt76, vif, sta);
++		if (ret) {
++			kfree(sta);
++			return ret;
++		}
++
++		msta = (struct mt7915_sta *)sta->drv_priv;
++		td->tm_wcid[aid] = &msta->wcid;
++		td->tm_sta_mask |= BIT(aid - 1);
++	}
++
++	tm_sta = mt76_testmode_aid_get_sta(phy->mt76, aid);
++	memcpy(&tm_sta->sd, sd, sizeof(tm_sta->sd));
++
++	return 0;
++}
++
+ static void
+-mt7915_tm_init(struct mt7915_phy *phy, bool en)
++mt7915_tm_sta_remove(struct mt7915_phy *phy, u8 aid)
+ {
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt76_wcid *wcid = td->tm_wcid[aid];
+ 	struct mt7915_dev *dev = phy->dev;
++	struct ieee80211_sta *sta = wcid_to_sta(wcid);
+ 
+-	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
++	mt7915_mac_sta_remove(&dev->mt76, phy->monitor_vif, sta);
++	mt76_wcid_mask_clear(dev->mt76.wcid_mask, wcid->idx);
++
++	kfree(sta);
++	td->tm_wcid[aid] = NULL;
++	td->tm_sta_mask &= ~BIT(aid - 1);
++}
++
++static void
++mt7915_tm_sta_remove_all(struct mt7915_phy *phy)
++{
++	int i;
++
++	if (!mt76_testmode_has_sta(phy->mt76))
+ 		return;
+ 
+-	mt7915_mcu_set_sku_en(phy, !en);
++	for (i = 1; i < ARRAY_SIZE(phy->mt76->test.tm_wcid); i++) {
++		if (phy->mt76->test.tm_wcid[i])
++			mt7915_tm_sta_remove(phy, i);
++	}
++}
+ 
+-	mt7915_tm_mode_ctrl(dev, en);
+-	mt7915_tm_reg_backup_restore(phy);
+-	mt7915_tm_set_trx(phy, TM_MAC_TXRX, !en);
++static int
++mt7915_tm_set_sta(struct mt7915_phy *phy)
++{
++	struct mt76_testmode_data *td = &phy->mt76->test;
+ 
+-	mt7915_mcu_add_bss_info(phy, phy->monitor_vif, en);
+-	mt7915_mcu_add_sta(dev, phy->monitor_vif, NULL, en);
++	if (!td->aid) {
++		mt7915_tm_sta_remove_all(phy);
++		return 0;
++	}
+ 
+-	phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
++	if (td->tx_count == 0) {
++		mt7915_tm_sta_remove(phy, td->aid);
++		return 0;
++	}
+ 
+-	if (!en)
+-		mt7915_tm_set_tam_arb(phy, en, 0);
++	return mt7915_tm_sta_add(phy, td->aid, &td->sd);
+ }
+ 
+ static void
+@@ -563,22 +662,48 @@ mt7915_tm_update_channel(struct mt7915_phy *phy)
+ 	mt7915_mcu_set_chan_info(phy, MCU_EXT_CMD(SET_RX_PATH));
+ }
+ 
++static bool
++mt7915_tm_check_skb(struct mt7915_phy *phy)
++{
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct ieee80211_tx_info *info;
++
++	if (!mt76_testmode_has_sta(phy->mt76)) {
++		if (!td->tx_skb)
++			return false;
++
++		info = IEEE80211_SKB_CB(td->tx_skb);
++		info->control.vif = phy->monitor_vif;
++	} else {
++		struct mt76_testmode_sta *tm_sta;
++		int i;
++
++		mt76_testmode_for_each_sta(phy->mt76, i, tm_sta) {
++			if (!tm_sta->tx_skb)
++				return false;
++
++			info = IEEE80211_SKB_CB(tm_sta->tx_skb);
++			info->control.vif = phy->monitor_vif;
++		}
++	}
++
++	return true;
++}
++
+ static void
+ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ {
+ 	static const u8 spe_idx_map[] = {0, 0, 1, 0, 3, 2, 4, 0,
+ 					 9, 8, 6, 10, 16, 12, 18, 0};
+ 	struct mt76_testmode_data *td = &phy->mt76->test;
+-	struct mt7915_dev *dev = phy->dev;
+-	struct ieee80211_tx_info *info;
+-	u8 duty_cycle = td->tx_duty_cycle;
+-	u32 tx_time = td->tx_time;
+-	u32 ipg = td->tx_ipg;
+ 
+ 	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
+-	mt7915_tm_clean_hwq(phy, dev->mt76.global_wcid.idx);
++	mt7915_tm_set_trx(phy, TM_MAC_TX, false);
+ 
+ 	if (en) {
++		u32 tx_time = td->tx_time, ipg = td->tx_ipg;
++		u8 duty_cycle = td->tx_duty_cycle;
++
+ 		mt7915_tm_update_channel(phy);
+ 
+ 		if (td->tx_spe_idx) {
+@@ -586,30 +711,29 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ 		} else {
+ 			phy->test.spe_idx = spe_idx_map[td->tx_antenna_mask];
+ 		}
+-	}
+ 
+-	mt7915_tm_set_tam_arb(phy, en,
+-			      td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU);
+-
+-	/* if all three params are set, duty_cycle will be ignored */
+-	if (duty_cycle && tx_time && !ipg) {
+-		ipg = tx_time * 100 / duty_cycle - tx_time;
+-	} else if (duty_cycle && !tx_time && ipg) {
+-		if (duty_cycle < 100)
+-			tx_time = duty_cycle * ipg / (100 - duty_cycle);
+-	}
++		/* if all three params are set, duty_cycle will be ignored */
++		if (duty_cycle && tx_time && !ipg) {
++			ipg = tx_time * 100 / duty_cycle - tx_time;
++		} else if (duty_cycle && !tx_time && ipg) {
++			if (duty_cycle < 100)
++				tx_time = duty_cycle * ipg / (100 - duty_cycle);
++		}
+ 
+-	mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode);
+-	mt7915_tm_set_tx_len(phy, tx_time);
++		mt7915_tm_set_ipg_params(phy, ipg, td->tx_rate_mode);
++		mt7915_tm_set_tx_len(phy, tx_time);
+ 
+-	if (ipg)
+-		td->tx_queued_limit = MT76_TM_TIMEOUT * 1000000 / ipg / 2;
++		if (ipg)
++			td->tx_queued_limit = MT76_TM_TIMEOUT * 1000000 / ipg / 2;
+ 
+-	if (!en || !td->tx_skb)
+-		return;
++		if (!mt7915_tm_check_skb(phy))
++			return;
++	} else {
++		mt7915_tm_clean_hwq(phy);
++	}
+ 
+-	info = IEEE80211_SKB_CB(td->tx_skb);
+-	info->control.vif = phy->monitor_vif;
++	mt7915_tm_set_tam_arb(phy, en,
++			      td->tx_rate_mode == MT76_TM_TX_MODE_HE_MU);
+ 
+ 	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
+ }
+@@ -811,6 +935,31 @@ out:
+ 				 sizeof(req), true);
+ }
+ 
++static void
++mt7915_tm_init(struct mt7915_phy *phy, bool en)
++{
++	struct mt7915_dev *dev = phy->dev;
++
++	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
++		return;
++
++	mt7915_mcu_set_sku_en(phy, !en);
++
++	mt7915_tm_mode_ctrl(dev, en);
++	mt7915_tm_reg_backup_restore(phy);
++	mt7915_tm_set_trx(phy, TM_MAC_TXRX, !en);
++
++	mt7915_mcu_add_bss_info(phy, phy->monitor_vif, en);
++	mt7915_mcu_add_sta(dev, phy->monitor_vif, NULL, en);
++
++	phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
++
++	if (!en) {
++		mt7915_tm_set_tam_arb(phy, en, 0);
++		mt7915_tm_sta_remove_all(phy);
++	}
++}
++
+ static void
+ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+ {
+@@ -825,6 +974,8 @@ mt7915_tm_update_params(struct mt7915_phy *phy, u32 changed)
+ 		mt7915_tm_set_cfg(phy);
+ 	if (changed & BIT(TM_CHANGED_OFF_CH_SCAN_CH))
+ 		mt7915_tm_set_off_channel_scan(phy);
++	if (changed & BIT(TM_CHANGED_AID))
++		mt7915_tm_set_sta(phy);
+ }
+ 
+ static int
+-- 
+2.25.1
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1111-mt76-tool-add-more-commands.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1111-mt76-tool-add-more-commands.patch
new file mode 100755
index 0000000..630a68c
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1111-mt76-tool-add-more-commands.patch
@@ -0,0 +1,134 @@
+From ce9be27dcc763b3a9b399dfe8f62ee1c0fed9734 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Fri, 4 Feb 2022 21:35:14 +0800
+Subject: [PATCH 1111/1112] mt76: tool: add more commands
+
+---
+ .../net/wireless/mediatek/mt76/tools/fields.c | 76 +++++++++++++++++++
+ 1 file changed, 76 insertions(+)
+
+diff --git a/tools/fields.c b/tools/fields.c
+index e3f6908..036406c 100644
+--- a/tools/fields.c
++++ b/tools/fields.c
+@@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
+ 	[MT76_TM_STATE_IDLE] = "idle",
+ 	[MT76_TM_STATE_TX_FRAMES] = "tx_frames",
+ 	[MT76_TM_STATE_RX_FRAMES] = "rx_frames",
++	[MT76_TM_STATE_TX_CONT] = "tx_cont",
+ };
+ 
+ static const char * const testmode_tx_mode[] = {
+@@ -201,6 +202,63 @@ static void print_extra_stats(const struct tm_field *field, struct nlattr **tb)
+ 	printf("%srx_per=%.02f%%\n", prefix, 100 * failed / total);
+ }
+ 
++static bool parse_mac(const struct tm_field *field, int idx,
++		      struct nl_msg *msg, const char *val)
++{
++#define ETH_ALEN	6
++	bool ret = true;
++	char *str, *cur, *ap;
++	void *a;
++
++	ap = str = strdup(val);
++
++	a = nla_nest_start(msg, idx);
++
++	idx = 0;
++	while ((cur = strsep(&ap, ",")) != NULL) {
++		unsigned char addr[ETH_ALEN];
++		char *val, *tmp = cur;
++		int i = 0;
++
++		while ((val = strsep(&tmp, ":")) != NULL) {
++			if (i >= ETH_ALEN)
++				break;
++
++			addr[i++] = strtoul(val, NULL, 16);
++		}
++
++		nla_put(msg, idx, ETH_ALEN, addr);
++
++		idx++;
++	}
++
++	nla_nest_end(msg, a);
++
++	free(str);
++
++	return ret;
++}
++
++static void print_mac(const struct tm_field *field, struct nlattr *attr)
++{
++#define MAC2STR(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5]
++#define MACSTR "%02x:%02x:%02x:%02x:%02x:%02x"
++	unsigned char addr[3][6];
++	struct nlattr *cur;
++	int idx = 0;
++	int rem;
++
++	nla_for_each_nested(cur, attr, rem) {
++		if (nla_len(cur) != 6)
++			continue;
++		memcpy(addr[idx++], nla_data(cur), 6);
++	}
++
++	printf("" MACSTR "," MACSTR "," MACSTR "",
++	       MAC2STR(addr[0]), MAC2STR(addr[1]), MAC2STR(addr[2]));
++
++	return;
++}
+ 
+ #define FIELD_GENERIC(_field, _name, ...)	\
+ 	[FIELD_NAME(_field)] = {			\
+@@ -250,6 +308,13 @@ static void print_extra_stats(const struct tm_field *field, struct nlattr **tb)
+ 		 ##__VA_ARGS__				\
+ 	)
+ 
++#define FIELD_MAC(_field, _name)			\
++	[FIELD_NAME(_field)] = {			\
++		.name = _name,				\
++		.parse = parse_mac,			\
++		.print = print_mac			\
++	}
++
+ #define FIELD_NAME(_field) MT76_TM_RX_ATTR_##_field
+ static const struct tm_field rx_fields[NUM_MT76_TM_RX_ATTRS] = {
+ 	FIELD_RO(s32, FREQ_OFFSET, "freq_offset"),
+@@ -300,10 +365,16 @@ static const struct tm_field testdata_fields[NUM_MT76_TM_ATTRS] = {
+ 	FIELD(u8, TX_RATE_LDPC, "tx_rate_ldpc"),
+ 	FIELD(u8, TX_RATE_STBC, "tx_rate_stbc"),
+ 	FIELD(u8, TX_LTF, "tx_ltf"),
++	FIELD(u8, TX_DUTY_CYCLE, "tx_duty_cycle"),
++	FIELD(u32, TX_IPG, "tx_ipg"),
++	FIELD(u32, TX_TIME, "tx_time"),
+ 	FIELD(u8, TX_POWER_CONTROL, "tx_power_control"),
+ 	FIELD_ARRAY(u8, TX_POWER, "tx_power"),
+ 	FIELD(u8, TX_ANTENNA, "tx_antenna"),
++	FIELD(u8, TX_SPE_IDX, "tx_spe_idx"),
+ 	FIELD(u32, FREQ_OFFSET, "freq_offset"),
++	FIELD(u8, AID, "aid"),
++	FIELD_MAC(MAC_ADDRS, "mac_addrs"),
+ 	FIELD_NESTED_RO(STATS, stats, "",
+ 			.print_extra = print_extra_stats),
+ };
+@@ -322,9 +393,14 @@ static struct nla_policy testdata_policy[NUM_MT76_TM_ATTRS] = {
+ 	[MT76_TM_ATTR_TX_RATE_LDPC] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_TX_RATE_STBC] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_TX_LTF] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_TX_DUTY_CYCLE] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_TX_IPG] = { .type = NLA_U32 },
++	[MT76_TM_ATTR_TX_TIME] = { .type = NLA_U32 },
+ 	[MT76_TM_ATTR_TX_POWER_CONTROL] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_TX_ANTENNA] = { .type = NLA_U8 },
++	[MT76_TM_ATTR_TX_SPE_IDX] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_FREQ_OFFSET] = { .type = NLA_U32 },
++	[MT76_TM_ATTR_AID] = { .type = NLA_U8 },
+ 	[MT76_TM_ATTR_STATS] = { .type = NLA_NESTED },
+ };
+ 
+-- 
+2.25.1
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/2001-mt76-mt7915-add-L0.5-SER-for-mt7986.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/2001-mt76-mt7915-add-L0.5-SER-for-mt7986.patch
new file mode 100644
index 0000000..0b0e0f0
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/2001-mt76-mt7915-add-L0.5-SER-for-mt7986.patch
@@ -0,0 +1,929 @@
+From dd9c922fc167858afc7ac23dd180cc45821a3501 Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Mon, 28 Mar 2022 09:28:30 +0800
+Subject: [PATCH] mt76: mt7915: add L0.5 SER for mt7986
+
+---
+ mt7915/debugfs.c | 168 +++++++++++++++++++++++++++++++++-
+ mt7915/dma.c     |  49 ++++++++++
+ mt7915/init.c    |   8 +-
+ mt7915/mac.c     | 231 ++++++++++++++++++++++++++++++++++++++++++++++-
+ mt7915/main.c    |  16 +++-
+ mt7915/mcu.c     |  52 ++++++++---
+ mt7915/mmio.c    |  12 ++-
+ mt7915/mt7915.h  |  27 ++++++
+ mt7915/regs.h    |  37 +++++++-
+ 9 files changed, 572 insertions(+), 28 deletions(-)
+
+diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
+index 6df148c5..57754105 100644
+--- a/mt7915/debugfs.c
++++ b/mt7915/debugfs.c
+@@ -47,7 +47,8 @@ mt7915_implicit_txbf_get(void *data, u64 *val)
+ DEFINE_DEBUGFS_ATTRIBUTE(fops_implicit_txbf, mt7915_implicit_txbf_get,
+ 			 mt7915_implicit_txbf_set, "%lld\n");
+ 
+-/* test knob of system layer 1/2 error recovery */
++/* test knob of system layer 0.5/1/2 error recovery */
++/*
+ static int mt7915_ser_trigger_set(void *data, u64 val)
+ {
+ 	enum {
+@@ -74,9 +75,172 @@ static int mt7915_ser_trigger_set(void *data, u64 val)
+ 	return ret;
+ }
+ 
++*/
++static int mt7915_ser_trigger_set(void *data, u64 val)
++{
++#define SER_SET		GENMASK(3, 0)
++#define SER_BAND	GENMASK(7, 4)
++#define SER_ACTION	GENMASK(11, 8)
++	enum {
++		SER_ACTION_SET = 1,
++		SER_ACTION_SET_MASK = 2,
++		SER_ACTION_TRIGGER = 3,
++	};
++
++	struct mt7915_dev *dev = data;
++	u8 ser_action, ser_band, ser_set, set_val;
++
++	ser_action = FIELD_GET(SER_ACTION, val);
++	ser_set = set_val = FIELD_GET(SER_SET, val);
++	ser_band = (ser_action == SER_ACTION_TRIGGER) ?
++		   FIELD_GET(SER_BAND, val) : 0;
++
++	if (ser_band > 1)
++		return -1;
++
++	switch (ser_action) {
++	case SER_ACTION_SET:
++		/*
++		 * 0x100: disable system error recovery function.
++		 * 0x101: enable system error recovery function.
++		 */
++		ser_set = !!set_val;
++		break;
++	case SER_ACTION_SET_MASK:
++		/*
++		 * 0x200: enable system error tracking.
++		 * 0x201: enable system error L1 recover.
++		 * 0x202: enable system error L2 recover.
++		 * 0x203: enable system error L3 rx abort.
++		 * 0x204: enable system error L3 tx abort.
++		 * 0x205: enable system error L3 tx disable.
++		 * 0x206: enable system error L3 bf recover.
++		 * 0x207: enable system error all recover.
++		 */
++		ser_set = set_val > 7 ? 0x7f : BIT(set_val);
++		break;
++	case SER_ACTION_TRIGGER:
++		/*
++		 * 0x300: trigger L0 recover.
++		 * 0x301/0x311: trigger L1 recover for band0/band1.
++		 * 0x302/0x312: trigger L2 recover for band0/band1.
++		 * 0x303/0x313: trigger L3 rx abort for band0/band1.
++		 * 0x304/0x314: trigger L3 tx abort for band0/band1.
++		 * 0x305/0x315: trigger L3 tx disable for band0/band1.
++		 * 0x306/0x316: trigger L3 bf recover for band0/band1.
++		 */
++		if (0x300 == val || 0x310 == val) {
++			mt7915_reset(dev, SER_TYPE_FULL_RESET);
++			return 0;
++		}
++
++		if (ser_set > 6)
++			return -1;
++		break;
++	default:
++		return -1;
++	}
++
++	return mt7915_mcu_set_ser(dev, ser_action, ser_set, ser_band);
++}
++
+ DEFINE_DEBUGFS_ATTRIBUTE(fops_ser_trigger, NULL,
+ 			 mt7915_ser_trigger_set, "%lld\n");
+ 
++static int
++mt7915_ser_stats_show(struct seq_file *s, void *data)
++{
++#define	SER_ACTION_QUERY	0
++	struct mt7915_dev *dev = dev_get_drvdata(s->private);
++	int ret = 0;
++
++	/* get more info from firmware */
++	ret = mt7915_mcu_set_ser(dev, SER_ACTION_QUERY, 0, 0);
++	msleep(100);
++
++	seq_printf(s, "::E  R , SER_STATUS        = 0x%08X\n",
++		   MT_SWDEF_SER_STATUS);
++	seq_printf(s, "::E  R , SER_PLE_ERR       = 0x%08X\n",
++		   MT_SWDEF_PLE_STATUS);
++	seq_printf(s, "::E  R , SER_PLE_ERR_1     = 0x%08X\n",
++		   MT_SWDEF_PLE1_STATUS);
++	seq_printf(s, "::E  R , SER_PLE_ERR_AMSDU = 0x%08X\n",
++		   MT_SWDEF_PLE_AMSDU_STATUS);
++	seq_printf(s, "::E  R , SER_PSE_ERR       = 0x%08X\n",
++		   MT_SWDEF_PSE_STATUS);
++	seq_printf(s, "::E  R , SER_PSE_ERR_1     = 0x%08X\n",
++		   MT_SWDEF_PSE1_STATUS);
++	seq_printf(s, "::E  R , SER_LMAC_WISR6_B0 = 0x%08X\n",
++		   MT_SWDEF_LAMC_WISR6_BN0_STATUS);
++	seq_printf(s, "::E  R , SER_LMAC_WISR6_B1 = 0x%08X\n",
++		   MT_SWDEF_LAMC_WISR6_BN1_STATUS);
++	seq_printf(s, "::E  R , SER_LMAC_WISR7_B0 = 0x%08X\n",
++		   MT_SWDEF_LAMC_WISR7_BN0_STATUS);
++	seq_printf(s, "::E  R , SER_LMAC_WISR7_B1 = 0x%08X\n",
++		   MT_SWDEF_LAMC_WISR7_BN1_STATUS);
++
++	seq_printf(s, "\nWF RESET STATUS: WM %d, WA %d, WO %d\n",
++		   dev->ser.wf_reset_wm_count,
++		   dev->ser.wf_reset_wa_count,
++		   dev->ser.wf_reset_wo_count);
++
++	return ret;
++}
++
++
++int mt7915_fw_exception_chk(struct mt7915_dev *dev)
++{
++	u32 reg_val;
++
++	reg_val = mt76_rr(dev, MT_EXCEPTION_ADDR);
++
++	if (is_mt7915(&dev->mt76))
++		reg_val >>= 8;
++
++	return !!(reg_val & 0xff);
++}
++
++void mt7915_fw_heart_beat_chk(struct mt7915_dev *dev)
++{
++#define WM_TIMEOUT_COUNT_CHECK 5
++#define WM_HANG_COUNT_CHECK 9
++	u32 cnt, cidx, didx, queue;
++	u32 idx, i;
++	static struct {
++		u32 cidx;
++		u32 didx;
++	} dma_rec[5];
++
++	if (dev->ser.hw_full_reset)
++		return;
++
++	if (dev->ser.cmd_fail_cnt >= WM_TIMEOUT_COUNT_CHECK) {
++
++		cnt = mt76_rr(dev, WF_WFDMA_MEM_DMA_RX_RING_CTL + 4);
++		cidx = mt76_rr(dev, WF_WFDMA_MEM_DMA_RX_RING_CTL + 8);
++		didx = mt76_rr(dev, WF_WFDMA_MEM_DMA_RX_RING_CTL + 12);
++		queue = (didx > cidx) ?
++			(didx - cidx - 1) : (didx - cidx + cnt - 1);
++
++		idx = (dev->ser.cmd_fail_cnt - WM_TIMEOUT_COUNT_CHECK) % 5;
++		dma_rec[idx].cidx = cidx;
++		dma_rec[idx].cidx = didx;
++
++		if (((cnt - 1) == queue) &&
++		    (dev->ser.cmd_fail_cnt >= WM_HANG_COUNT_CHECK)) {
++
++			for (i = 0; i < 5; i++) {
++				if ((dma_rec[i].cidx != cidx) ||
++				    (dma_rec[i].didx != didx))
++					return;
++			}
++
++			mt7915_reset(dev, SER_TYPE_FULL_RESET);
++			dev->ser.cmd_fail_cnt = 0;
++		}
++	}
++}
++
+ static int
+ mt7915_radar_trigger(void *data, u64 val)
+ {
+@@ -927,6 +1091,8 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+ 	debugfs_create_devm_seqfile(dev->mt76.dev, "twt_stats", dir,
+ 				    mt7915_twt_stats);
+ 	debugfs_create_file("ser_trigger", 0200, dir, dev, &fops_ser_trigger);
++	debugfs_create_devm_seqfile(dev->mt76.dev, "ser_show", dir,
++				    mt7915_ser_stats_show);
+ 	if (!dev->dbdc_support || phy->band_idx) {
+ 		debugfs_create_u32("dfs_hw_pattern", 0400, dir,
+ 				   &dev->hw_pattern);
+diff --git a/mt7915/dma.c b/mt7915/dma.c
+index 66a312a9..60b4368a 100644
+--- a/mt7915/dma.c
++++ b/mt7915/dma.c
+@@ -453,6 +453,55 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
+ 	return 0;
+ }
+ 
++
++int mt7915_dma_reset(struct mt7915_dev *dev, bool force)
++{
++	struct mt76_phy *mphy_ext = dev->mt76.phy2;
++	int i;
++
++	/* clean up hw queues */
++	for (i = 0; i < ARRAY_SIZE(dev->mt76.phy.q_tx); i++) {
++		mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[i], true);
++		if (mphy_ext)
++			mt76_queue_tx_cleanup(dev, mphy_ext->q_tx[i], true);
++	}
++
++	for (i = 0; i < ARRAY_SIZE(dev->mt76.q_mcu); i++)
++		mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[i], true);
++
++	for (i = 0; i < __MT_RXQ_MAX; i++)
++		mt76_queue_rx_cleanup(dev, &dev->mt76.q_rx[i]);
++
++	/* reset wfsys */
++	if (force)
++		mt7915_wfsys_reset(dev);
++
++	/* disable wfdma */
++	mt7915_dma_disable(dev, force);
++
++	/* reset hw queues */
++	for (i = 0; i < __MT_TXQ_MAX; i++) {
++		mt76_queue_reset(dev, dev->mphy.q_tx[i]);
++		if (mphy_ext)
++			mt76_queue_reset(dev, mphy_ext->q_tx[i]);
++	}
++
++	for (i = 0; i < __MT_MCUQ_MAX; i++)
++		mt76_queue_reset(dev, dev->mt76.q_mcu[i]);
++
++	for (i = 0; i < __MT_RXQ_MAX; i++)
++		mt76_queue_reset(dev, &dev->mt76.q_rx[i]);
++
++	mt76_tx_status_check(&dev->mt76, true);
++
++	mt7915_dma_enable(dev);
++
++	for (i = 0; i < __MT_RXQ_MAX; i++)
++		mt76_queue_rx_reset(dev, i);
++
++	return 0;
++}
++
+ void mt7915_dma_cleanup(struct mt7915_dev *dev)
+ {
+ 	mt7915_dma_disable(dev, true);
+diff --git a/mt7915/init.c b/mt7915/init.c
+index 4d462c3a..03bcb40e 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -262,7 +262,7 @@ static void mt7915_led_set_brightness(struct led_classdev *led_cdev,
+ 		mt7915_led_set_config(led_cdev, 0xff, 0);
+ }
+ 
+-static void
++void
+ mt7915_init_txpower(struct mt7915_dev *dev,
+ 		    struct ieee80211_supported_band *sband)
+ {
+@@ -446,7 +446,7 @@ mt7915_mac_init_band(struct mt7915_dev *dev, u8 band)
+ 	mt76_clear(dev, MT_DMA_DCR0(band), MT_DMA_DCR0_RXD_G5_EN);
+ }
+ 
+-static void mt7915_mac_init(struct mt7915_dev *dev)
++void mt7915_mac_init(struct mt7915_dev *dev)
+ {
+ 	int i;
+ 	u32 rx_len = is_mt7915(&dev->mt76) ? 0x400 : 0x680;
+@@ -476,7 +476,7 @@ static void mt7915_mac_init(struct mt7915_dev *dev)
+ 	}
+ }
+ 
+-static int mt7915_txbf_init(struct mt7915_dev *dev)
++int mt7915_txbf_init(struct mt7915_dev *dev)
+ {
+ 	int ret;
+ 
+@@ -1157,6 +1157,8 @@ int mt7915_register_device(struct mt7915_dev *dev)
+ 
+ 	mt7915_init_debugfs(&dev->phy);
+ 
++	dev->ser.hw_init_done = true;
++
+ 	return 0;
+ 
+ unreg_thermal:
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index d8578d12..aa312b75 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -3,6 +3,7 @@
+ 
+ #include <linux/etherdevice.h>
+ #include <linux/timekeeping.h>
++#include <linux/pci.h>
+ #include "mt7915.h"
+ #include "../dma.h"
+ #include "mac.h"
+@@ -1970,9 +1971,9 @@ mt7915_update_beacons(struct mt7915_dev *dev)
+ 		IEEE80211_IFACE_ITER_RESUME_ALL,
+ 		mt7915_update_vif_beacon, dev->mt76.phy2->hw);
+ }
+-
++#if 0
+ static void
+-mt7915_dma_reset(struct mt7915_dev *dev)
++mt7915_dma_reset(struct mt7915_dev *dev, bool force)
+ {
+ 	struct mt76_phy *mphy_ext = dev->mt76.phy2;
+ 	u32 hif1_ofs = MT_WFDMA0_PCIE1(0) - MT_WFDMA0(0);
+@@ -2037,6 +2038,7 @@ mt7915_dma_reset(struct mt7915_dev *dev)
+ 				 MT_WFDMA1_GLO_CFG_OMIT_RX_INFO);
+ 	}
+ }
++#endif
+ 
+ void mt7915_tx_token_put(struct mt7915_dev *dev)
+ {
+@@ -2052,6 +2054,172 @@ void mt7915_tx_token_put(struct mt7915_dev *dev)
+ 	idr_destroy(&dev->mt76.token);
+ }
+ 
++static int
++mt7915_mac_reset(struct mt7915_dev *dev)
++{
++	struct mt7915_phy *phy2;
++	struct mt76_phy *ext_phy;
++	struct mt76_dev *mdev = &dev->mt76;
++	int i, ret;
++	u32 irq_mask;
++
++	ext_phy = dev->mt76.phy2;
++	phy2 = ext_phy ? ext_phy->priv : NULL;
++
++	/* irq disable */
++	mt76_wr(dev, MT_INT_MASK_CSR, 0x0);
++	mt76_wr(dev, MT_INT_SOURCE_CSR, ~0);
++	if (dev->hif2) {
++		mt76_wr(dev, MT_INT1_MASK_CSR, 0x0);
++		mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0);
++	}
++	if (dev_is_pci(mdev->dev)) {
++		mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0x0);
++		if (dev->hif2)
++			mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0x0);
++	}
++
++	set_bit(MT76_RESET, &dev->mphy.state);
++	wake_up(&dev->mt76.mcu.wait);
++	if (ext_phy)
++		set_bit(MT76_RESET, &ext_phy->state);
++
++	/* lock/unlock all queues to ensure that no tx is pending */
++	mt76_txq_schedule_all(&dev->mphy);
++	if (ext_phy)
++		mt76_txq_schedule_all(ext_phy);
++
++	/* disable all tx/rx napi */
++	mt76_worker_disable(&dev->mt76.tx_worker);
++	mt76_for_each_q_rx(mdev, i) {
++		if (mdev->q_rx[i].ndesc)
++			napi_disable(&dev->mt76.napi[i]);
++	}
++	napi_disable(&dev->mt76.tx_napi);
++
++	/* token reinit */
++	mt7915_tx_token_put(dev);
++	idr_init(&dev->mt76.token);
++
++	mt7915_dma_reset(dev, true);
++	mt76_for_each_q_rx(mdev, i) {
++		if (mdev->q_rx[i].ndesc) {
++			napi_enable(&dev->mt76.napi[i]);
++			napi_schedule(&dev->mt76.napi[i]);
++		}
++	}
++	clear_bit(MT76_MCU_RESET, &dev->mphy.state);
++	clear_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state);
++
++	mt76_wr(dev, MT_INT_MASK_CSR, dev->mt76.mmio.irqmask);
++	mt76_wr(dev, MT_INT_SOURCE_CSR, ~0);
++	if (dev->hif2) {
++		mt76_wr(dev, MT_INT1_MASK_CSR, irq_mask);
++		mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0);
++	}
++	if (dev_is_pci(mdev->dev)) {
++		mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0xff);
++		if (dev->hif2)
++			mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0xff);
++	}
++
++	/* load firmware */
++	ret = mt7915_run_firmware(dev);
++	if (ret)
++		goto out;
++
++	/* set the necessary init items */
++	ret = mt7915_mcu_set_eeprom(dev, dev->flash_mode);
++	if (ret)
++		goto out;
++
++	mt7915_mac_init(dev);
++	mt7915_init_txpower(dev, &dev->mphy.sband_2g.sband);
++	mt7915_init_txpower(dev, &dev->mphy.sband_5g.sband);
++	ret = mt7915_txbf_init(dev);
++
++out:
++	/* reset done */
++	clear_bit(MT76_RESET, &dev->mphy.state);
++	if (phy2)
++		clear_bit(MT76_RESET, &phy2->mt76->state);
++
++	napi_enable(&dev->mt76.tx_napi);
++	napi_schedule(&dev->mt76.tx_napi);
++	mt76_worker_enable(&dev->mt76.tx_worker);
++
++	return ret;
++}
++
++static void
++mt7915_mac_full_reset(struct mt7915_dev *dev)
++{
++	struct mt7915_phy *phy2;
++	struct mt76_phy *ext_phy;
++	int i;
++	struct cfg80211_scan_info info = {
++		.aborted = true,
++	};
++
++	ext_phy = dev->mt76.phy2;
++	phy2 = ext_phy ? ext_phy->priv : NULL;
++
++	dev->ser.hw_full_reset = true;
++	if (READ_ONCE(dev->reset_state) & MT_MCU_CMD_WA_WDT)
++		dev->ser.wf_reset_wa_count++;
++	else
++		dev->ser.wf_reset_wm_count++;
++
++	wake_up(&dev->mt76.mcu.wait);
++	ieee80211_stop_queues(mt76_hw(dev));
++	if (ext_phy)
++		ieee80211_stop_queues(ext_phy->hw);
++
++	cancel_delayed_work_sync(&dev->mphy.mac_work);
++	if (ext_phy)
++		cancel_delayed_work_sync(&ext_phy->mac_work);
++
++	mutex_lock(&dev->mt76.mutex);
++	for (i = 0; i < 10; i++) {
++		if (!mt7915_mac_reset(dev))
++			break;
++	}
++	mutex_unlock(&dev->mt76.mutex);
++
++	if (i == 10)
++		dev_err(dev->mt76.dev, "chip full reset failed\n");
++
++	if (test_and_clear_bit(MT76_HW_SCANNING, &dev->mphy.state))
++		ieee80211_scan_completed(dev->mphy.hw, &info);
++
++	if (test_and_clear_bit(MT76_HW_SCANNING, &ext_phy->state))
++		ieee80211_scan_completed(ext_phy->hw, &info);
++
++	ieee80211_wake_queues(mt76_hw(dev));
++	if (ext_phy)
++		ieee80211_wake_queues(ext_phy->hw);
++
++	if (test_bit(MT76_STATE_RUNNING, &dev->mphy.state))
++		__mt7915_start(dev->mphy.hw);
++
++	if (ext_phy &&
++	    test_bit(MT76_STATE_RUNNING, &ext_phy->state))
++		__mt7915_start(ext_phy->hw);
++
++	dev->ser.hw_full_reset = false;
++
++	ieee80211_restart_hw(mt76_hw(dev));
++	if (ext_phy)
++		ieee80211_restart_hw(ext_phy->hw);
++
++	ieee80211_queue_delayed_work(mt76_hw(dev), &dev->mphy.mac_work,
++				     MT7915_WATCHDOG_TIME);
++	if (ext_phy)
++		ieee80211_queue_delayed_work(ext_phy->hw,
++					     &ext_phy->mac_work,
++					     MT7915_WATCHDOG_TIME);
++}
++
+ /* system error recovery */
+ void mt7915_mac_reset_work(struct work_struct *work)
+ {
+@@ -2063,6 +2231,25 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ 	ext_phy = dev->mt76.phy2;
+ 	phy2 = ext_phy ? ext_phy->priv : NULL;
+ 
++	/* chip full reset */
++	if (dev->ser.reset_type == SER_TYPE_FULL_RESET) {
++		u32 val;
++
++		/* disable wa/wm watchdog interuppt */
++		val = mt76_rr(dev, MT_WFDMA0_MCU_HOST_INT_ENA);
++		val &= ~(MT_MCU_CMD_WA_WDT | MT_MCU_CMD_WM_WDT);
++		mt76_set(dev, MT_WFDMA0_MCU_HOST_INT_ENA, val);
++
++		mt7915_mac_full_reset(dev);
++
++		/* enable the mcu irq*/
++		mt7915_irq_enable(dev, MT_INT_MCU_CMD);
++		mt7915_irq_disable(dev, 0);
++		return;
++	}
++
++	/* chip partial reset */
++	dev->ser.reset_type = SER_TYPE_NONE;
+ 	if (!(READ_ONCE(dev->reset_state) & MT_MCU_CMD_STOP_DMA))
+ 		return;
+ 
+@@ -2089,7 +2276,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ 	mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_STOPPED);
+ 
+ 	if (mt7915_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) {
+-		mt7915_dma_reset(dev);
++		mt7915_dma_reset(dev, false);
+ 
+ 		mt7915_tx_token_put(dev);
+ 		idr_init(&dev->mt76.token);
+@@ -2140,6 +2327,44 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ 					     MT7915_WATCHDOG_TIME);
+ }
+ 
++
++void mt7915_reset(struct mt7915_dev *dev, u8 type)
++{
++	struct mt76_phy *ext_phy = dev->mt76.phy2;
++
++	if (!dev->ser.hw_init_done)
++		return;
++
++	if (dev->ser.hw_full_reset)
++		return;
++
++	dev_err(dev->mt76.dev, "SER: reset_state(0x%08X) type(0x%08X)\n",
++		READ_ONCE(dev->reset_state), type);
++
++	/* WM/WA exception: do full recovery */
++	if ((READ_ONCE(dev->reset_state) & MT_MCU_CMD_WDT_MASK) ||
++	    type == SER_TYPE_FULL_RESET) {
++
++		if (!is_mt7986(&dev->mt76))
++			return;
++
++		dev->ser.reset_type = SER_TYPE_FULL_RESET;
++		set_bit(MT76_MCU_RESET, &dev->mphy.state);
++		if (ext_phy)
++			set_bit(MT76_MCU_RESET, &ext_phy->state);
++
++		ieee80211_queue_work(mt76_hw(dev), &dev->reset_work);
++		return;
++	}
++
++	/* do partial recovery */
++	mt7915_irq_enable(dev, MT_INT_MCU_CMD);
++	mt7915_irq_disable(dev, 0);
++	dev->ser.reset_type = SER_TYPE_PARTIAL_RESET;
++	ieee80211_queue_work(mt76_hw(dev), &dev->reset_work);
++	wake_up(&dev->reset_wait);
++}
++
+ void mt7915_mac_update_stats(struct mt7915_phy *phy)
+ {
+ 	struct mt7915_dev *dev = phy->dev;
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 0816398a..9de5f152 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -20,7 +20,7 @@ static bool mt7915_dev_running(struct mt7915_dev *dev)
+ 	return phy && test_bit(MT76_STATE_RUNNING, &phy->mt76->state);
+ }
+ 
+-static int mt7915_start(struct ieee80211_hw *hw)
++int __mt7915_start(struct ieee80211_hw *hw)
+ {
+ 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
+ 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
+@@ -29,8 +29,6 @@ static int mt7915_start(struct ieee80211_hw *hw)
+ 
+ 	flush_work(&dev->init_work);
+ 
+-	mutex_lock(&dev->mt76.mutex);
+-
+ 	running = mt7915_dev_running(dev);
+ 
+ 	if (!running) {
+@@ -95,6 +93,18 @@ out:
+ 	return ret;
+ }
+ 
++static int mt7915_start(struct ieee80211_hw *hw)
++{
++	struct mt7915_dev *dev = mt7915_hw_dev(hw);
++	int ret;
++
++	mutex_lock(&dev->mt76.mutex);
++	ret = __mt7915_start(hw);
++	mutex_unlock(&dev->mt76.mutex);
++
++	return ret;
++}
++
+ static void mt7915_stop(struct ieee80211_hw *hw)
+ {
+ 	struct mt7915_dev *dev = mt7915_hw_dev(hw);
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 987e5f3f..e7c0ab1d 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -212,14 +212,31 @@ mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
+ 			  struct sk_buff *skb, int seq)
+ {
+ 	struct mt7915_mcu_rxd *rxd;
++	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
+ 	int ret = 0;
+ 
+ 	if (!skb) {
+ 		dev_err(mdev->dev, "Message %08x (seq %d) timeout\n",
+ 			cmd, seq);
++
++		dev->ser.cmd_fail_cnt++;
++
++		if (dev->ser.cmd_fail_cnt < 5) {
++			int exp_type = mt7915_fw_exception_chk(dev);
++
++			dev_err(mdev->dev, "Fw is status(%d)\n", exp_type);
++			if (exp_type) {
++				dev->ser.reset_type = SER_TYPE_FULL_RESET;
++				mt7915_reset(dev, SER_TYPE_FULL_RESET);
++			}
++		}
++		mt7915_fw_heart_beat_chk(dev);
++
+ 		return -ETIMEDOUT;
+ 	}
+ 
++	dev->ser.cmd_fail_cnt = 0;
++
+ 	rxd = (struct mt7915_mcu_rxd *)skb->data;
+ 	if (seq != rxd->seq)
+ 		return -EAGAIN;
+@@ -243,11 +260,17 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+ {
+ 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
+ 	struct mt7915_mcu_txd *mcu_txd;
++	//struct mt76_phy *ext_phy = mdev->phy2;
+ 	enum mt76_mcuq_id qid;
+ 	__le32 *txd;
+ 	u32 val;
+ 	u8 seq;
+ 
++	if (test_bit(MT76_MCU_RESET, &mdev->phy.state)) {
++		dev_err(mdev->dev, "%s assert\n", __func__);
++		return -EBUSY;
++	}
++
+ 	/* TODO: make dynamic based on msg type */
+ 	mdev->mcu.timeout = 20 * HZ;
+ 
+@@ -2472,25 +2495,14 @@ mt7915_mcu_init_rx_airtime(struct mt7915_dev *dev)
+ 				 sizeof(req), true);
+ }
+ 
+-int mt7915_mcu_init(struct mt7915_dev *dev)
++int mt7915_run_firmware(struct mt7915_dev *dev)
+ {
+-	static const struct mt76_mcu_ops mt7915_mcu_ops = {
+-		.headroom = sizeof(struct mt7915_mcu_txd),
+-		.mcu_skb_send_msg = mt7915_mcu_send_message,
+-		.mcu_parse_response = mt7915_mcu_parse_response,
+-		.mcu_restart = mt76_connac_mcu_restart,
+-	};
+ 	int ret;
+ 
+-	dev->mt76.mcu_ops = &mt7915_mcu_ops;
+-
+ 	/* force firmware operation mode into normal state,
+ 	 * which should be set before firmware download stage.
+ 	 */
+-	if (is_mt7915(&dev->mt76))
+-		mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
+-	else
+-		mt76_wr(dev, MT_SWDEF_MODE_MT7916, MT_SWDEF_NORMAL_MODE);
++	mt76_wr(dev, MT_SWDEF_MODE, MT_SWDEF_NORMAL_MODE);
+ 
+ 	ret = mt7915_driver_own(dev, 0);
+ 	if (ret)
+@@ -2532,6 +2544,20 @@ int mt7915_mcu_init(struct mt7915_dev *dev)
+ 				 MCU_WA_PARAM_RED, 0, 0);
+ }
+ 
++int mt7915_mcu_init(struct mt7915_dev *dev)
++{
++	static const struct mt76_mcu_ops mt7915_mcu_ops = {
++		.headroom = sizeof(struct mt7915_mcu_txd),
++		.mcu_skb_send_msg = mt7915_mcu_send_message,
++		.mcu_parse_response = mt7915_mcu_parse_response,
++		.mcu_restart = mt76_connac_mcu_restart,
++	};
++
++	dev->mt76.mcu_ops = &mt7915_mcu_ops;
++
++	return mt7915_run_firmware(dev);
++}
++
+ void mt7915_mcu_exit(struct mt7915_dev *dev)
+ {
+ 	__mt76_mcu_restart(&dev->mt76);
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 2466907e..561ac650 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -22,6 +22,8 @@ static const u32 mt7915_reg[] = {
+ 	[WFDMA_EXT_CSR_ADDR]	= 0xd7000,
+ 	[CBTOP1_PHY_END]	= 0x77ffffff,
+ 	[INFRA_MCU_ADDR_END]	= 0x7c3fffff,
++	[EXCEPTION_BASE_ADDR]	= 0x219848,
++	[SWDEF_BASE_ADDR]	= 0x41f200,
+ };
+ 
+ static const u32 mt7916_reg[] = {
+@@ -36,6 +38,8 @@ static const u32 mt7916_reg[] = {
+ 	[WFDMA_EXT_CSR_ADDR]	= 0xd7000,
+ 	[CBTOP1_PHY_END]	= 0x7fffffff,
+ 	[INFRA_MCU_ADDR_END]	= 0x7c085fff,
++	[EXCEPTION_BASE_ADDR]	= 0x022050BC,
++	[SWDEF_BASE_ADDR]	= 0x411400,
+ };
+ 
+ static const u32 mt7986_reg[] = {
+@@ -50,6 +54,8 @@ static const u32 mt7986_reg[] = {
+ 	[WFDMA_EXT_CSR_ADDR]	= 0x27000,
+ 	[CBTOP1_PHY_END]	= 0x7fffffff,
+ 	[INFRA_MCU_ADDR_END]	= 0x7c085fff,
++	[EXCEPTION_BASE_ADDR]	= 0x02204FFC,
++	[SWDEF_BASE_ADDR]	= 0x411400,
+ };
+ 
+ static const u32 mt7915_offs[] = {
+@@ -601,10 +607,10 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
+ 		u32 val = mt76_rr(dev, MT_MCU_CMD);
+ 
+ 		mt76_wr(dev, MT_MCU_CMD, val);
+-		if (val & MT_MCU_CMD_ERROR_MASK) {
++		mt7915_irq_disable(dev, MT_INT_MCU_CMD);
++		if (val & MT_MCU_CMD_ALL_ERROR_MASK) {
+ 			dev->reset_state = val;
+-			ieee80211_queue_work(mt76_hw(dev), &dev->reset_work);
+-			wake_up(&dev->reset_wait);
++			mt7915_reset(dev, SER_TYPE_UNKNOWN);
+ 		}
+ 	}
+ }
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index b4d3981e..87557da8 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -343,6 +343,15 @@ struct mt7915_dev {
+ 	struct work_struct reset_work;
+ 	wait_queue_head_t reset_wait;
+ 	u32 reset_state;
++	struct {
++		bool hw_full_reset:1;
++		bool hw_init_done:1;
++		u32 reset_type;
++		u32 cmd_fail_cnt;
++		u32 wf_reset_wm_count;
++		u32 wf_reset_wa_count;
++		u32 wf_reset_wo_count;
++	}ser;
+ 
+ 	struct list_head sta_rc_list;
+ 	struct list_head sta_poll_list;
+@@ -439,6 +448,13 @@ enum mt7915_rdd_cmd {
+ 	RDD_IRQ_OFF,
+ };
+ 
++enum {
++	SER_TYPE_NONE,
++	SER_TYPE_PARTIAL_RESET,
++	SER_TYPE_FULL_RESET,
++	SER_TYPE_UNKNOWN,
++};
++
+ static inline struct mt7915_phy *
+ mt7915_hw_phy(struct ieee80211_hw *hw)
+ {
+@@ -656,6 +672,17 @@ int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy, void *ms);
+ int mt7915_init_debugfs(struct mt7915_phy *phy);
+ void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int len);
+ bool mt7915_debugfs_rx_log(struct mt7915_dev *dev, const void *data, int len);
++int mt7915_fw_exception_chk(struct mt7915_dev *dev);
++void mt7915_fw_heart_beat_chk(struct mt7915_dev *dev);
++void mt7915_wfsys_reset(struct mt7915_dev *dev);
++void mt7915_reset(struct mt7915_dev *dev, u8 type);
++int mt7915_dma_reset(struct mt7915_dev *dev, bool force);
++int __mt7915_start(struct ieee80211_hw *hw);
++void mt7915_init_txpower(struct mt7915_dev *dev,
++		    struct ieee80211_supported_band *sband);
++int mt7915_txbf_init(struct mt7915_dev *dev);
++void mt7915_mac_init(struct mt7915_dev *dev);
++int mt7915_run_firmware(struct mt7915_dev *dev);
+ #ifdef CONFIG_MAC80211_DEBUGFS
+ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 			    struct ieee80211_sta *sta, struct dentry *dir);
+diff --git a/mt7915/regs.h b/mt7915/regs.h
+index 6ddfa48f..27f682fe 100644
+--- a/mt7915/regs.h
++++ b/mt7915/regs.h
+@@ -30,6 +30,8 @@ enum reg_rev {
+ 	WFDMA_EXT_CSR_ADDR,
+ 	CBTOP1_PHY_END,
+ 	INFRA_MCU_ADDR_END,
++	EXCEPTION_BASE_ADDR,
++	SWDEF_BASE_ADDR,
+ 	__MT_REG_MAX,
+ };
+ 
+@@ -111,6 +113,11 @@ enum offs_rev {
+ #define __REG(id)			(dev->reg.reg_rev[(id)])
+ #define __OFFS(id)			(dev->reg.offs_rev[(id)])
+ 
++/* MEM WFDMA */
++#define WF_WFDMA_MEM_DMA		0x58000000
++
++#define WF_WFDMA_MEM_DMA_RX_RING_CTL	(WF_WFDMA_MEM_DMA + (0x510))
++
+ /* MCU WFDMA0 */
+ #define MT_MCU_WFDMA0_BASE		0x2000
+ #define MT_MCU_WFDMA0(ofs)		(MT_MCU_WFDMA0_BASE + (ofs))
+@@ -555,6 +562,10 @@ enum offs_rev {
+ #define MT_WFDMA0_PRI_DLY_INT_CFG1	MT_WFDMA0(0x2f4)
+ #define MT_WFDMA0_PRI_DLY_INT_CFG2	MT_WFDMA0(0x2f8)
+ 
++#define MT_WFDMA0_MCU_HOST_INT_ENA	MT_WFDMA0(0x1f4)
++#define MT_WFDMA0_MT_WA_WDT_INT		BIT(31)
++#define MT_WFDMA0_MT_WM_WDT_INT		BIT(30)
++
+ /* WFDMA1 */
+ #define MT_WFDMA1_BASE			0xd5000
+ #define MT_WFDMA1(ofs)			(MT_WFDMA1_BASE + (ofs))
+@@ -687,6 +698,12 @@ enum offs_rev {
+ #define MT_MCU_CMD_NORMAL_STATE		BIT(5)
+ #define MT_MCU_CMD_ERROR_MASK		GENMASK(5, 1)
+ 
++#define MT_MCU_CMD_WA_WDT		BIT(31)
++#define MT_MCU_CMD_WM_WDT		BIT(30)
++#define MT_MCU_CMD_WDT_MASK		GENMASK(31, 30)
++#define MT_MCU_CMD_ALL_ERROR_MASK	(MT_MCU_CMD_ERROR_MASK |	\
++					 MT_MCU_CMD_WDT_MASK)
++
+ /* TOP RGU */
+ #define MT_TOP_RGU_BASE			0x18000000
+ #define MT_TOP_PWR_CTRL			(MT_TOP_RGU_BASE + (0x0))
+@@ -929,12 +946,25 @@ enum offs_rev {
+ #define MT_ADIE_TYPE_MASK		BIT(1)
+ 
+ /* FW MODE SYNC */
+-#define MT_SWDEF_MODE			0x41f23c
+-#define MT_SWDEF_MODE_MT7916		0x41143c
++#define MT_SWDEF_BASE			__REG(SWDEF_BASE_ADDR)
++
++#define MT_SWDEF(ofs)			(MT_SWDEF_BASE + (ofs))
++#define MT_SWDEF_MODE			MT_SWDEF(0x3c)
+ #define MT_SWDEF_NORMAL_MODE		0
+ #define MT_SWDEF_ICAP_MODE		1
+ #define MT_SWDEF_SPECTRUM_MODE		2
+ 
++#define MT_SWDEF_SER_STATUS		MT_SWDEF(0x040)
++#define MT_SWDEF_PLE_STATUS		MT_SWDEF(0x044)
++#define MT_SWDEF_PLE1_STATUS		MT_SWDEF(0x048)
++#define MT_SWDEF_PLE_AMSDU_STATUS	MT_SWDEF(0x04C)
++#define MT_SWDEF_PSE_STATUS		MT_SWDEF(0x050)
++#define MT_SWDEF_PSE1_STATUS		MT_SWDEF(0x054)
++#define MT_SWDEF_LAMC_WISR6_BN0_STATUS	MT_SWDEF(0x058)
++#define MT_SWDEF_LAMC_WISR6_BN1_STATUS	MT_SWDEF(0x05C)
++#define MT_SWDEF_LAMC_WISR7_BN0_STATUS	MT_SWDEF(0x060)
++#define MT_SWDEF_LAMC_WISR7_BN1_STATUS	MT_SWDEF(0x064)
++
+ #define MT_DIC_CMD_REG_BASE		0x41f000
+ #define MT_DIC_CMD_REG(ofs)		(MT_DIC_CMD_REG_BASE + (ofs))
+ #define MT_DIC_CMD_REG_CMD		MT_DIC_CMD_REG(0x10)
+@@ -1016,6 +1046,9 @@ enum offs_rev {
+ 
+ #define MT_MCU_BUS_REMAP		MT_MCU_BUS(0x120)
+ 
++/* MISC */
++#define MT_EXCEPTION_ADDR		__REG(EXCEPTION_BASE_ADDR)
++
+ /* TOP CFG */
+ #define MT_TOP_CFG_BASE			0x184b0000
+ #define MT_TOP_CFG(ofs)			(MT_TOP_CFG_BASE + (ofs))
+-- 
+2.18.0
+