diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1111-mt76-testmode-additional-supports.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1111-mt76-testmode-additional-supports.patch
index d39e83d..8ac00ff 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1111-mt76-testmode-additional-supports.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1111-mt76-testmode-additional-supports.patch
@@ -1,4 +1,4 @@
-From 9c76671cd831d28e5b270baa23c71dfc4aaf8410 Mon Sep 17 00:00:00 2001
+From c8644904cdca1f72bf43a5784ea509a15a1e65dc Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Apr 2022 15:43:19 +0800
 Subject: [PATCH] mt76: testmode: additional supports
@@ -2202,10 +2202,10 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index 4a24f6c9..690e9a7d 100644
+index 31439b39..86323f64 100644
 --- a/testmode.c
 +++ b/testmode.c
-@@ -25,28 +25,16 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
+@@ -27,28 +27,16 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
  };
  EXPORT_SYMBOL_GPL(mt76_tm_policy);
  
@@ -2240,7 +2240,7 @@
  	       q->queued < q->ndesc / 2) {
  		int ret;
  
-@@ -55,13 +43,65 @@ void mt76_testmode_tx_pending(struct mt76_phy *phy)
+@@ -57,13 +45,65 @@ void mt76_testmode_tx_pending(struct mt76_phy *phy)
  		if (ret < 0)
  			break;
  
@@ -2306,7 +2306,7 @@
  }
  
  static u32
-@@ -87,15 +127,31 @@ mt76_testmode_max_mpdu_len(struct mt76_phy *phy, u8 tx_rate_mode)
+@@ -89,15 +129,31 @@ mt76_testmode_max_mpdu_len(struct mt76_phy *phy, u8 tx_rate_mode)
  }
  
  static void
@@ -2342,7 +2342,7 @@
  {
  #define MT_TXP_MAX_LEN	4095
  	u16 fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA |
-@@ -117,7 +173,8 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+@@ -119,7 +175,8 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
  	nfrags = len / MT_TXP_MAX_LEN;
  	head_len = nfrags ? MT_TXP_MAX_LEN : len;
  
@@ -2352,9 +2352,9 @@
  		fc |= IEEE80211_STYPE_QOS_DATA;
  
  	head = alloc_skb(head_len, GFP_KERNEL);
-@@ -126,9 +183,9 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+@@ -128,9 +185,9 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
  
- 	hdr = __skb_put_zero(head, head_len);
+ 	hdr = __skb_put_zero(head, sizeof(*hdr));
  	hdr->frame_control = cpu_to_le16(fc);
 -	memcpy(hdr->addr1, td->addr[0], ETH_ALEN);
 -	memcpy(hdr->addr2, td->addr[1], ETH_ALEN);
@@ -2363,9 +2363,9 @@
 +	memcpy(hdr->addr2, addr[1], ETH_ALEN);
 +	memcpy(hdr->addr3, addr[2], ETH_ALEN);
  	skb_set_queue_mapping(head, IEEE80211_AC_BE);
- 
- 	info = IEEE80211_SKB_CB(head);
-@@ -152,7 +209,7 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+ 	get_random_bytes(__skb_put(head, head_len - sizeof(*hdr)),
+ 			 head_len - sizeof(*hdr));
+@@ -156,7 +213,7 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
  
  		frag = alloc_skb(frag_len, GFP_KERNEL);
  		if (!frag) {
@@ -2374,7 +2374,7 @@
  			dev_kfree_skb(head);
  			return -ENOMEM;
  		}
-@@ -165,15 +222,14 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+@@ -169,15 +226,14 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
  		frag_tail = &(*frag_tail)->next;
  	}
  
@@ -2394,7 +2394,7 @@
  {
  	struct mt76_testmode_data *td = &phy->test;
  	struct ieee80211_tx_info *info;
-@@ -181,7 +237,7 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
+@@ -185,7 +241,7 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
  	u8 max_nss = hweight8(phy->antenna_mask);
  	int ret;
  
@@ -2403,7 +2403,7 @@
  	if (ret)
  		return ret;
  
-@@ -191,7 +247,7 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
+@@ -195,7 +251,7 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
  	if (td->tx_antenna_mask)
  		max_nss = min_t(u8, max_nss, hweight8(td->tx_antenna_mask));
  
@@ -2412,7 +2412,7 @@
  	rate = &info->control.rates[0];
  	rate->count = 1;
  	rate->idx = td->tx_rate_idx;
-@@ -263,6 +319,25 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
+@@ -267,6 +323,25 @@ mt76_testmode_tx_init(struct mt76_phy *phy)
  out:
  	return 0;
  }
@@ -2438,7 +2438,7 @@
  
  static void
  mt76_testmode_tx_start(struct mt76_phy *phy)
-@@ -273,6 +348,14 @@ mt76_testmode_tx_start(struct mt76_phy *phy)
+@@ -277,6 +352,14 @@ mt76_testmode_tx_start(struct mt76_phy *phy)
  	td->tx_queued = 0;
  	td->tx_done = 0;
  	td->tx_pending = td->tx_count;
@@ -2453,7 +2453,7 @@
  	mt76_worker_schedule(&dev->tx_worker);
  }
  
-@@ -291,7 +374,7 @@ mt76_testmode_tx_stop(struct mt76_phy *phy)
+@@ -295,7 +378,7 @@ mt76_testmode_tx_stop(struct mt76_phy *phy)
  	wait_event_timeout(dev->tx_wait, td->tx_done == td->tx_queued,
  			   MT76_TM_TIMEOUT * HZ);
  
@@ -2462,7 +2462,7 @@
  }
  
  static inline void
-@@ -322,6 +405,8 @@ mt76_testmode_init_defaults(struct mt76_phy *phy)
+@@ -326,6 +409,8 @@ mt76_testmode_init_defaults(struct mt76_phy *phy)
  	memcpy(td->addr[0], phy->macaddr, ETH_ALEN);
  	memcpy(td->addr[1], phy->macaddr, ETH_ALEN);
  	memcpy(td->addr[2], phy->macaddr, ETH_ALEN);
@@ -2471,7 +2471,7 @@
  }
  
  static int
-@@ -331,8 +416,12 @@ __mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state)
+@@ -335,8 +420,12 @@ __mt76_testmode_set_state(struct mt76_phy *phy, enum mt76_testmode_state state)
  	struct mt76_dev *dev = phy->dev;
  	int err;
  
@@ -2485,7 +2485,7 @@
  
  	if (state == MT76_TM_STATE_TX_FRAMES) {
  		err = mt76_testmode_tx_init(phy);
-@@ -402,6 +491,44 @@ mt76_tm_get_u8(struct nlattr *attr, u8 *dest, u8 min, u8 max)
+@@ -406,6 +495,44 @@ mt76_tm_get_u8(struct nlattr *attr, u8 *dest, u8 min, u8 max)
  	return 0;
  }
  
@@ -2530,7 +2530,7 @@
  int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  		      void *data, int len)
  {
-@@ -425,6 +552,11 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -429,6 +556,11 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  	mutex_lock(&dev->mutex);
  
@@ -2542,7 +2542,7 @@
  	if (tb[MT76_TM_ATTR_RESET]) {
  		mt76_testmode_set_state(phy, MT76_TM_STATE_OFF);
  		memset(td, 0, sizeof(*td));
-@@ -452,7 +584,10 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -456,7 +588,10 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
  			   &td->tx_duty_cycle, 0, 99) ||
  	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_POWER_CONTROL],
@@ -2554,7 +2554,7 @@
  		goto out;
  
  	if (tb[MT76_TM_ATTR_TX_LENGTH]) {
-@@ -484,8 +619,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -488,8 +623,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  
  	if (tb[MT76_TM_ATTR_TX_POWER]) {
  		struct nlattr *cur;
@@ -2564,7 +2564,7 @@
  
  		nla_for_each_nested(cur, tb[MT76_TM_ATTR_TX_POWER], rem) {
  			if (nla_len(cur) != 1 ||
-@@ -505,11 +639,45 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -509,11 +643,45 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			if (nla_len(cur) != ETH_ALEN || idx >= 3)
  				goto out;
  
@@ -2611,7 +2611,7 @@
  	if (dev->test_ops->set_params) {
  		err = dev->test_ops->set_params(phy, tb, state);
  		if (err)
-@@ -574,6 +742,7 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -578,6 +746,7 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  	struct mt76_phy *phy = hw->priv;
  	struct mt76_dev *dev = phy->dev;
  	struct mt76_testmode_data *td = &phy->test;
@@ -2619,7 +2619,7 @@
  	struct nlattr *tb[NUM_MT76_TM_ATTRS] = {};
  	int err = 0;
  	void *a;
-@@ -606,6 +775,19 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -610,6 +779,19 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  		goto out;
  	}
  
@@ -2639,7 +2639,7 @@
  	mt76_testmode_init_defaults(phy);
  
  	err = -EMSGSIZE;
-@@ -618,12 +800,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -622,12 +804,8 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  		goto out;
  
  	if (nla_put_u32(msg, MT76_TM_ATTR_TX_COUNT, td->tx_count) ||
@@ -2652,7 +2652,7 @@
  	    nla_put_u8(msg, MT76_TM_ATTR_TX_RATE_STBC, td->tx_rate_stbc) ||
  	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_LTF) &&
  	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
-@@ -643,6 +821,15 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
+@@ -647,6 +825,15 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
  	     nla_put_u8(msg, MT76_TM_ATTR_FREQ_OFFSET, td->freq_offset)))
  		goto out;
  
@@ -2914,5 +2914,5 @@
  			wake_up(&dev->tx_wait);
  
 -- 
-2.18.0
+2.32.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1116-mt76-mt7915-add-vendor-dump-phy-capa.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1116-mt76-mt7915-add-vendor-dump-phy-capa.patch
index df0838e..0ffb27a 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1116-mt76-mt7915-add-vendor-dump-phy-capa.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1116-mt76-mt7915-add-vendor-dump-phy-capa.patch
@@ -1,8 +1,31 @@
-Index: mt76-2022-06-24-b6e865e2/mt7915/vendor.c
-===================================================================
---- mt76-2022-06-24-b6e865e2.orig/mt7915/vendor.c
-+++ mt76-2022-06-24-b6e865e2/mt7915/vendor.c
-@@ -50,6 +50,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTR
+From 1dd09d7cdf80f3982017cae52013a423f84bfa52 Mon Sep 17 00:00:00 2001
+From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
+Date: Tue, 12 Jul 2022 10:04:35 -0700
+Subject: [PATCH] mt76: mt7915: add phy capability vendor command
+
+---
+ mt7915/mt7915.h |  1 +
+ mt7915/vendor.c | 52 +++++++++++++++++++++++++++++++++++++++++++++++++
+ mt7915/vendor.h | 25 ++++++++++++++++++++++++
+ 3 files changed, 78 insertions(+)
+
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 5f11b3fb..fb8bd877 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -11,6 +11,7 @@
+ 
+ #define MTK_DEBUG 1
+ #define MT7915_MAX_INTERFACES		19
++#define MT7915_MAX_BSS			16
+ #define MT7915_WTBL_SIZE		288
+ #define MT7916_WTBL_SIZE		544
+ #define MT7915_WTBL_RESERVED		(mt7915_wtbl_size(dev) - 1)
+diff --git a/mt7915/vendor.c b/mt7915/vendor.c
+index c7551848..77d71e48 100644
+--- a/mt7915/vendor.c
++++ b/mt7915/vendor.c
+@@ -50,6 +50,18 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
  	[MTK_VENDOR_ATTR_RFEATURE_CTRL_TRIG_TXBF] = { .type = NLA_U8 },
  };
  
@@ -21,7 +44,7 @@
  struct csi_null_tone {
  	u8 start;
  	u8 end;
-@@ -974,6 +986,35 @@ static int mt7915_vendor_hemu_ctrl(struc
+@@ -974,6 +986,35 @@ static int mt7915_vendor_hemu_ctrl(struct wiphy *wiphy,
  	return 0;
  }
  
@@ -57,7 +80,7 @@
  static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  	{
  		.info = {
-@@ -1031,6 +1072,17 @@ static const struct wiphy_vendor_command
+@@ -1031,6 +1072,17 @@ static const struct wiphy_vendor_command mt7915_vendor_commands[] = {
  		.doit = mt7915_vendor_hemu_ctrl,
  		.policy = hemu_ctrl_policy,
  		.maxattr = MTK_VENDOR_ATTR_HEMU_CTRL_MAX,
@@ -75,10 +98,10 @@
  	}
  };
  
-Index: mt76-2022-06-24-b6e865e2/mt7915/vendor.h
-===================================================================
---- mt76-2022-06-24-b6e865e2.orig/mt7915/vendor.h
-+++ mt76-2022-06-24-b6e865e2/mt7915/vendor.h
+diff --git a/mt7915/vendor.h b/mt7915/vendor.h
+index a8e4ebf9..719b851f 100644
+--- a/mt7915/vendor.h
++++ b/mt7915/vendor.h
 @@ -9,6 +9,7 @@ enum mtk_nl80211_vendor_subcmds {
  	MTK_NL80211_VENDOR_SUBCMD_RFEATURE_CTRL = 0xc3,
  	MTK_NL80211_VENDOR_SUBCMD_WIRELESS_CTRL = 0xc4,
@@ -116,15 +139,6 @@
 +};
 +
  #endif
-Index: mt76-2022-06-24-b6e865e2/mt7915/mt7915.h
-===================================================================
---- mt76-2022-06-24-b6e865e2.orig/mt7915/mt7915.h
-+++ mt76-2022-06-24-b6e865e2/mt7915/mt7915.h
-@@ -11,6 +11,7 @@
- 
- #define MTK_DEBUG 1
- #define MT7915_MAX_INTERFACES		19
-+#define MT7915_MAX_BSS			16
- #define MT7915_WTBL_SIZE		288
- #define MT7916_WTBL_SIZE		544
- #define MT7915_WTBL_RESERVED		(mt7915_wtbl_size(dev) - 1)
+-- 
+2.32.0
+