[Feature][Modem]1.merge MTK P2 patch 2.RF:bias modification of frequency band

Change-Id: I846de8f085e50c1b9557ad8c5d0b2cc088b18d86
diff --git a/mcu/interface/driver/peripheral/dcl_uart.h b/mcu/interface/driver/peripheral/dcl_uart.h
index 6ac8877..35bcb78 100755
--- a/mcu/interface/driver/peripheral/dcl_uart.h
+++ b/mcu/interface/driver/peripheral/dcl_uart.h
@@ -52,6 +52,11 @@
  * removed!
  * removed!
  * removed!
+ * removed!
+ *
+ * removed!
+ * removed!
+ * removed!
  *
  * removed!
  * removed!
@@ -465,7 +470,8 @@
 	    uart_port_mipc_ap12_ccci,\
 	    uart_port_mipc_ap13_ccci,\
 	    uart_port_mipc_ap14_ccci,\
-        uart_port_ccci_end = uart_port_mipc_ap14_ccci,\
+		uart_port_mbim_sap_ccci,\
+        uart_port_ccci_end = uart_port_mbim_sap_ccci,\
 		start_of_virtual_port,\
 		end_of_virtual_port = (VIRTUAL_PORT_NUM + start_of_virtual_port),\
 		/*uart_port_dcc,*/\
diff --git a/mcu/interface/l1/nl1/external/5g/nl1_ue_capability.h b/mcu/interface/l1/nl1/external/5g/nl1_ue_capability.h
index 4bca30c..bd81894 100755
--- a/mcu/interface/l1/nl1/external/5g/nl1_ue_capability.h
+++ b/mcu/interface/l1/nl1/external/5g/nl1_ue_capability.h
@@ -67,7 +67,7 @@
 #define NL1_CAP_MAX_NUM_NAICS_CAP_ENTRIES                 (1)  // 8 in spec
 #define NL1_CAP_MAX_NUM_OF_NR_BAND                        (25)//1024 in spec
 #define NL1_CAP_MAX_NUM_SIMULTANEOUS_BANDS                (6)//32 in spec
-#define NL1_CAP_MAX_NUM_FEATURE_SETS_PER_BAND             (32)//128 in spec
+#define NL1_CAP_MAX_NUM_FEATURE_SETS_PER_BAND             (80)//128 in spec
 #define NL1_CAP_MAX_NUM_CARRIERS_IN_BW_CLASS_DL           (2)//32 in spec
 #define NL1_CAP_MAX_NUM_CARRIERS_IN_BW_CLASS_UL           (2)//32 in spec
 #define NL1_CAP_MAX_NUM_OF_CODE_BOOKS                     (1)//32 in spec
diff --git a/mcu/interface/middleware/hif/ccci_tty_if.h b/mcu/interface/middleware/hif/ccci_tty_if.h
index 97797f0..61bebf7 100755
--- a/mcu/interface/middleware/hif/ccci_tty_if.h
+++ b/mcu/interface/middleware/hif/ccci_tty_if.h
@@ -53,6 +53,11 @@
  * ==========================================================================
  * $Log$
  *
+ * 09 23 2022 adel.liao
+ * [MOLY00946230] [Cogin][CPE][MBIM] CPE support MBIM
+ * 	
+ * 	add MBIM SAP channel.
+ *
  * 01 25 2021 adel.liao
  * [MOLY00607924] [Nokia][ODU][Module Startup blocking] mipc_init spend 30s
  * 	
@@ -192,7 +197,8 @@
 	CCCI_TTY_DEV_MIPC_AP12	   = 53, //  <ccci ch> CCCI_MIPC_AP12_CHANNEL
 	CCCI_TTY_DEV_MIPC_AP13	   = 54, //  <ccci ch> CCCI_MIPC_AP13_CHANNEL
 	CCCI_TTY_DEV_MIPC_AP14	   = 55, //  <ccci ch> CCCI_MIPC_AP14_CHANNEL
-    CCCI_TTY_DEV_CNT           = 56
+	CCCI_TTY_DEV_MBIM_SAP0     = 56, //  <ccci ch> CCCI_MIBM_CHANNEL
+    CCCI_TTY_DEV_CNT           = 57
 }cccitty_device_id;
 
 #endif //#ifndef _CCCI_TTY_IF_H
diff --git a/mcu/interface/protocol/general/l5_structs.h b/mcu/interface/protocol/general/l5_structs.h
index 63ee5c0..cd6847e 100755
--- a/mcu/interface/protocol/general/l5_structs.h
+++ b/mcu/interface/protocol/general/l5_structs.h
@@ -50,7 +50,7 @@
 #define L5_L5IO_MBCI_MAX_PENDING_NUM (16)
 #define L5_L5IO_MBCI_MAX_CONTROL_TRANSFER (4096)
 #define L5_L5IO_MBCI_SUPPORT_VERSION (0x0100)
-#define L5_L5IO_MBCI_SUPPORT_EXT_VERSION (0x0300)
+#define L5_L5IO_MBCI_SUPPORT_EXT_VERSION (0x0400)
 
 #define L5SEQ_ID_URC (0xffffffff)
 /**********L5IO<->L5U***************/
diff --git a/mcu/interface/protocol/general/mrs_as_inter_core_enum.h b/mcu/interface/protocol/general/mrs_as_inter_core_enum.h
index f274fa8..f1f9619 100755
--- a/mcu/interface/protocol/general/mrs_as_inter_core_enum.h
+++ b/mcu/interface/protocol/general/mrs_as_inter_core_enum.h
@@ -136,5 +136,11 @@
     MRS_CH_LOCK_STATE_NRAS_LOCK
 } MRS_CH_LOCK_STATE;
 
+typedef enum
+{
+    MRS_CH_LOCK_SCENARIO_DEFAULT,
+    MRS_CH_LOCK_SCENARIO_USER
+} MRS_CH_LOCK_SCENARIO;
 #endif /* __CHANNEL_LOCK__ */
+
 #endif /* __MRS_AS_INTER_CORE_ENUM_H__ */
diff --git a/mcu/interface/protocol/general/perf_api.h b/mcu/interface/protocol/general/perf_api.h
index f445723..fc4504d 100755
--- a/mcu/interface/protocol/general/perf_api.h
+++ b/mcu/interface/protocol/general/perf_api.h
@@ -60,6 +60,7 @@
     RECOVERY_TYPE_NR_RRC_REESTABLISH,
     RECOVERY_TYPE_NR_SCG_FAILURE_INFO,
     RECOVERY_TYPE_NR_RRC_REDIRECT_FAIL, // RRC ask ERM to notify scenario when redirection fail, and notify NRRC when scenario happened
+    RECOVERY_TYPE_NR_NW_REJECT_WITH_LONG_WAIT_TIME
 } protocol_exception_recovery_type_enum;
 
 typedef enum
diff --git a/mcu/interface/protocol/general/ps_public_enum.h b/mcu/interface/protocol/general/ps_public_enum.h
index 555fe57..e4e4706 100755
--- a/mcu/interface/protocol/general/ps_public_enum.h
+++ b/mcu/interface/protocol/general/ps_public_enum.h
@@ -115,6 +115,9 @@
 #define MAX_NR_SET_STORED_NUM 10
 #define MAX_LTE_SET_STORED_NUM 10
 
+#define UE_OS_ID_LEN 16 /* According to RFC 4122, OS_ID is defined as UUID(Universally Unique IDentifier) with length 128 bits (16 bytes) */
+#define MAX_UE_OS_ID_NUM 15 /* According to 24.501 D.6.6, UE could carry maximum 15 OS ID to NW */
+
 #define VZW_5GUW_Allowed_default 0
 #define VZW_FF03H_abnormal_default 0
 
@@ -4606,8 +4609,15 @@
 typedef enum
 {
 	  GSM_CAPABILITY = 0x01,
+	  UMTS_CAPABILITY = 0x02,
 } rat_capability_enum;
 
+typedef enum
+{
+    LEAVE_LTE = 0x01,
+    LEAVE_NR  = 0x02,
+} voice_unavail_leave_rat_enum;
+
 #define VGSM_MAX_QFI_NUM        64
 
 typedef enum {
diff --git a/mcu/interface/protocol/general/ps_public_struct.h b/mcu/interface/protocol/general/ps_public_struct.h
index 6427d24..bd12fa4 100755
--- a/mcu/interface/protocol/general/ps_public_struct.h
+++ b/mcu/interface/protocol/general/ps_public_struct.h
@@ -3110,4 +3110,9 @@
     better_rat_detect_response_enum result;
 } l4c_as_better_rat_detect_ind_struct;
 
+typedef struct
+{
+    kal_uint8 os_id[UE_OS_ID_LEN];
+} os_id_info_struct;
+
 #endif /* _PS_PUBLIC_STRUCT_H_ */
diff --git a/mcu/interface/protocol/nas_multimode/upcm/upcm.h b/mcu/interface/protocol/nas_multimode/upcm/upcm.h
index fd7f078..3bb91df 100755
--- a/mcu/interface/protocol/nas_multimode/upcm/upcm.h
+++ b/mcu/interface/protocol/nas_multimode/upcm/upcm.h
@@ -54,6 +54,11 @@
  * ==========================================================================
  * $Log$
  *
+ * 11 17 2022 stun.wu
+ * [MOLY00672250] ?????? 1396774: ?????LTE to SA?Reg req????uplink data status
+ * 	
+ * 	.
+ *
  * 11 04 2021 stun.wu
  * [MOLY00678218] [Gen97][4N SQC-Lite][W2124][W2128][Internal FT][Post_MP7][Guangzhou][MT6877][Montrose][Feature_Enhance_Test]CU+CMCC_SA+SA_Temp_Data_Switch_On, SIM1 MT call failed(1/10)
  * 	
@@ -716,4 +721,17 @@
 
 kal_bool upcm_is_test_loop(kal_uint8 protocol_idx);
 
+/**
+ * @brief upcm_has_pending_rollback_ul_data
+ * Check if UPCM has pending rollback UL data queued within.
+ *
+ * @param protocol_idx
+ * @return bool
+ *   TRUE: has pending rollback UL data
+ *   FALSE: no pending rollback UL data
+ */
+#ifdef __FIVEG_NAS__
+kal_bool upcm_has_pending_rollback_ul_data(kal_uint8 protocol_idx);
+#endif
+
 #endif   /* ----- #ifndef UPCM_INC  ----- */
diff --git a/mcu/interface/sap/md/errc_msgid.h b/mcu/interface/sap/md/errc_msgid.h
index 779a144..1daecee 100755
--- a/mcu/interface/sap/md/errc_msgid.h
+++ b/mcu/interface/sap/md/errc_msgid.h
@@ -1450,6 +1450,7 @@
 MSG_ID_L4C_ERRC_SET_SIGNAL_REPORTING_CRITERIA_REQ,
 MSG_ID_L4C_ERRC_IMS_CC_CALL_PROGRESS_IND,
 MSG_ID_NAS_SV_ERRC_ANY_SEARCH_STATUS_UPDATE_REQ,
+MSG_ID_MRS_ERRC_CH_LOCK_NTF,
 MSG_ID_EXEVT_RCV_END,
 MSG_ID_INEVT_BEGIN,
 MSG_ID_ERRC_SPV_RCM_INIT_REQ,
diff --git a/mcu/interface/sap/md/l4_msgid.h b/mcu/interface/sap/md/l4_msgid.h
index 412addd..ca2000c 100755
--- a/mcu/interface/sap/md/l4_msgid.h
+++ b/mcu/interface/sap/md/l4_msgid.h
@@ -219,6 +219,7 @@
     MSG_ID_L5_L4C_SET_PREF_NSSAI_REQ,
     MSG_ID_L5_L4C_SET_PREF_NSSAI_CNF,
     MSG_ID_L5_L4C_VGMM_NW_PARAMS_IND,
+    MSG_ID_L5_L4C_OS_ID_UPDATE_REQ,
     MSG_ID_L5_L4C_MSG_END,
 #endif
     // DMF -> L4C
diff --git a/mcu/interface/sap/md/l5_msgid.h b/mcu/interface/sap/md/l5_msgid.h
index 44ffe2c..689bbd6 100755
--- a/mcu/interface/sap/md/l5_msgid.h
+++ b/mcu/interface/sap/md/l5_msgid.h
@@ -388,6 +388,8 @@
         MSG_ID_L5IO_L5UNW_GET_CURRENT_CELL_INFO_REQ,
         MSG_ID_L5IO_L5UNW_GET_CURRENT_CELL_INFO_CNF,
         MSG_ID_L5IO_L5UNW_ENWREJAC_IND,
+        MSG_ID_L5IO_L5UNW_OS_ID_UPDATE_REQ,
+        MSG_ID_L5IO_L5UNW_OS_ID_UPDATE_CNF,
     MSG_ID_L5UNW_MSG_END,
 
         /*MSG_ID_L5IO->L5USIM*/
@@ -480,6 +482,9 @@
         MSG_ID_L5USMS_SCBM_IND,
         MSG_ID_L5USMS_DOMAIN_REQ,
         MSG_ID_L5USMS_DOMAIN_CNF,
+        MSG_ID_L5USMS_DUP_NEW_SMS_IND,
+        MSG_ID_L5USMS_CBM_CFG_REQ,
+        MSG_ID_L5USMS_CBM_CFG_CNF,
         /* L5USMS -> L5USMS */
         MSG_ID_L5USMS_HANDLE_NEXT_NTF,
         MSG_ID_L5USMS_EIND_URC,
@@ -667,13 +672,16 @@
 
     MSG_ID_L5U_L5UIMS_IND_BEGIN,
         MSG_ID_L5U_L5UIMS_CIREGU_IND,
+        MSG_ID_L5U_L5UIMS_EIREG_IND,
         MSG_ID_L5U_L5UIMS_EWFC_IND,
         MSG_ID_L5U_L5UIMS_EIMSREGURI_IND,
         MSG_ID_L5U_L5UIMS_EIMSREGRESP_IND,
+        MSG_ID_L5UIMS_PDN_IND,
     MSG_ID_L5U_L5UIMS_IND_END,
 
     MSG_ID_L5UIMS_IND_BEGIN,
         MSG_ID_L5UIMS_CIREGU_IND,
+        MSG_ID_L5UIMS_EIREG_IND,
         MSG_ID_L5UIMS_EWFC_IND,
         MSG_ID_L5UIMS_EIMSREGURI_IND,
         MSG_ID_L5UIMS_EIMSREGRESP_IND,
@@ -683,12 +691,14 @@
         /* IO->IMS */
         MSG_ID_L5UIMS_GET_STATE_REQ,
 	    MSG_ID_L5UIMS_SET_EIMSCFG_REQ,
+	    MSG_ID_L5UIMS_GET_PDN_REQ,
     MSG_ID_L5IO_L5UIMS_REQ_MSG_END,
 
     MSG_ID_L5IO_L5UIMS_CNF_MSG_BEGIN,
         /* IMS->IO */
         MSG_ID_L5UIMS_GET_STATE_CNF,
 		MSG_ID_L5UIMS_SET_EIMSCFG_CNF,
+		MSG_ID_L5UIMS_GET_PDN_CNF,
     MSG_ID_L5IO_L5UIMS_CNF_MSG_END,
 
     /* L5USIM IND */
diff --git a/mcu/interface/sap/md/mrs_msgid.h b/mcu/interface/sap/md/mrs_msgid.h
index 1958a1e..7bcf069 100755
--- a/mcu/interface/sap/md/mrs_msgid.h
+++ b/mcu/interface/sap/md/mrs_msgid.h
@@ -203,8 +203,9 @@
 MSG_ID_MRS_L4C_CAPABILITY_UPDATE_IND,
 MSG_ID_MRS_DUMP_VG_ROAMING_CONFIG_IND,
 MSG_ID_MRS_DUMP_RAT_CAPABILITY_CONFIG_IND,
+MSG_ID_MRS_DUMP_VOICE_UNAVAIL_LEAVE_RAT_CONFIG_IND,
 
-MSG_ID_MRS_CODE_END = MSG_ID_MRS_DUMP_RAT_CAPABILITY_CONFIG_IND,
+MSG_ID_MRS_CODE_END = MSG_ID_MRS_DUMP_VOICE_UNAVAIL_LEAVE_RAT_CONFIG_IND,
 
 
 MODULE_MSG_END( MSG_ID_MRS_CODE_TAIL )
diff --git a/mcu/interface/sap/md/mtf_msgid.h b/mcu/interface/sap/md/mtf_msgid.h
index 43ee4b8..b57c1fc 100755
--- a/mcu/interface/sap/md/mtf_msgid.h
+++ b/mcu/interface/sap/md/mtf_msgid.h
@@ -54,6 +54,16 @@
  *===========================================================
  * $Log$
  *
+ * 11 08 2022 gavin.zhang
+ * [MOLY00716695] ?21041??SA??????????????????q-RxLevMin/q-QualMin???????????.
+ * 	
+ * 	.
+ *
+ * 10 25 2022 gavin.zhang
+ * [MOLY00733110] 1546071?21041??network??SA????????????SINR?????????OSS????????
+ * 	
+ * 	.
+ *
  * 08 25 2022 bingking.li
  * [MOLY00800186] DUT selects back to serving selll after SA to SA redirect failure and it causes very bad user experience on subway
  * 	
@@ -110,10 +120,14 @@
 MSG_ID_L4C_MT_SCREEN_STATE_IND,
 MSG_ID_MT_DMF_L4C_CUSTOM_CONFIG_CNF,
 
+MSG_ID_NRRC_MT_DMF_QRXLEVMIN_ADJ_IND,
+MSG_ID_NL1MOB_MT_DMF_QRXLEVMIN_ADJ_IND,
 
 MSG_ID_NL1MOB_MT_DMF_CUSTOM_ENH_IND,
 MSG_ID_NL1MOB_MT_DMF_POSTPONE_A2_FOR_B1B2_IND,
 
+MSG_ID_NL1MOB_MT_DMF_POOR_SINR_OOS_IND,
+
 MODULE_MSG_END( MSG_ID_MTF_CODE_TAIL )
 
 
diff --git a/mcu/interface/sap/md/nl1_msgid.h b/mcu/interface/sap/md/nl1_msgid.h
index 2014069..881a783 100755
--- a/mcu/interface/sap/md/nl1_msgid.h
+++ b/mcu/interface/sap/md/nl1_msgid.h
@@ -114,6 +114,7 @@
 MSG_ID_NRRC_NL1_SA_SILENCE_CTRL_REQ,
 MSG_ID_NRRC_NL1_GEMINI_SHARE_REQ,
 MSG_ID_NRRC_NL1_MOB_NVRAM_PARA_UPDATE_REQ,
+MSG_ID_NRRC_NL1_IRAT_FROM_NR_INFO_REQ,
 MSG_ID_NL1_NRRC_DVFS_CONTROL_MSG,
 MSG_ID_NRRC_NL1_HST_ENHANCE_CONFIG_REQ,
 
diff --git a/mcu/interface/sap/md/nrrc_msgid.h b/mcu/interface/sap/md/nrrc_msgid.h
index d59615a..07b7aba 100755
--- a/mcu/interface/sap/md/nrrc_msgid.h
+++ b/mcu/interface/sap/md/nrrc_msgid.h
@@ -731,6 +731,8 @@
     MSG_ID_NRRC_SEARCH_DUMP_CONTEXT_IND,
     MSG_ID_NRRC_SEARCH_DUMP_CARRIER_CONTROL_INFO_IND,
 
+	MSG_ID_MRS_NRRC_CH_LOCK_NTF,
+
 MSG_ID_NRRC_MSG_ID_END,
 MODULE_MSG_END( MSG_ID_NRRC_CODE_TAIL )
 
diff --git a/mcu/interface/sap/md/ps_public_l4_msgid.h b/mcu/interface/sap/md/ps_public_l4_msgid.h
index 3e82c7e..705f3b6 100755
--- a/mcu/interface/sap/md/ps_public_l4_msgid.h
+++ b/mcu/interface/sap/md/ps_public_l4_msgid.h
@@ -143,6 +143,7 @@
     MSG_ID_L4C_AS_BETTER_RAT_DETECT_REQ,
     MSG_ID_L4C_AS_BETTER_RAT_DETECT_CNF,
     MSG_ID_L4C_AS_BETTER_RAT_DETECT_IND,
+	MSG_ID_PHB_DHL_DUMP_CONTEXT_IND,
     MSG_ID_L4_PUBLIC_CODE_END,
 MODULE_MSG_END( MSG_ID_L4_PUBLIC_CODE_TAIL )
 
diff --git a/mcu/interface/sap/md/upds_msgid.h b/mcu/interface/sap/md/upds_msgid.h
index f50efeb..3bc6f4d 100755
--- a/mcu/interface/sap/md/upds_msgid.h
+++ b/mcu/interface/sap/md/upds_msgid.h
@@ -56,6 +56,9 @@
     MSG_ID_URSP_UPDS_UE_POLICY_IND,
     MSG_ID_URSP_UPDS_GET_UE_POLICY_INFO_IND,
 
+    /* MSGs from L4C */
+    MSG_ID_L4C_UPDS_OS_ID_UPDATE_REQ,
+
     MSG_ID_UPDS_END,
 
 MODULE_MSG_END( MSG_ID_UPDS_CODE_TAIL )
diff --git a/mcu/interface/sap/md_sap.h b/mcu/interface/sap/md_sap.h
index 43d8b32..5617c67 100755
--- a/mcu/interface/sap/md_sap.h
+++ b/mcu/interface/sap/md_sap.h
@@ -322,8 +322,8 @@
     NMAC_NL1_SAP,
     NMAC_NL1_SLIM_SAP,
     EL1_NL1_SAP,
-    EL1MPC_NL1_SAP,  // __EL1_LPP_INTER_RAT_RSTD_SUPPORT_- 
-    NL1_EL1MPC_SAP,  // __EL1_LPP_INTER_RAT_RSTD_SUPPORT_ 
+    EL1MPC_NL1_SAP,  // __EL1_LPP_INTER_RAT_RSTD_SUPPORT_-
+    NL1_EL1MPC_SAP,  // __EL1_LPP_INTER_RAT_RSTD_SUPPORT_
     NL1_MMRF_XL1TST_SAP,
     NL1_NL1_SAP,
     NL1_NL1ICD_SAP,
@@ -1081,8 +1081,8 @@
     D2_SAP,
 
     /* D2PM */
-    ME_D2PM_SAP, 
-    D2PM_D2APN_SAP, 
+    ME_D2PM_SAP,
+    D2PM_D2APN_SAP,
     D2PM_D2RM_SAP,
     D2PM_DDM_SAP,
 
@@ -1090,12 +1090,12 @@
     D2APN_D2CUST_SAP,
 
     /* URSP */
-    D2APN_URSP_SAP, 
-    D2PM_URSP_SAP, 
-    D2RM_URSP_SAP, 
-    DDM_URSP_SAP, 
-    URSP_UPDS_SAP, 
-    URSP_VGMM_SAP, 
+    D2APN_URSP_SAP,
+    D2PM_URSP_SAP,
+    D2RM_URSP_SAP,
+    DDM_URSP_SAP,
+    URSP_UPDS_SAP,
+    URSP_VGMM_SAP,
 
     /* D2SSC */
     D2SSC_D2_SAP,
@@ -1335,7 +1335,7 @@
     VGSM_RATDM_SAP,
     ESM_VGSM_SAP,
     L4C_VGSM_SAP,
-    
+
     DHL_MRS_SAP,
     DHL_GMSS_SAP,
 
@@ -1349,6 +1349,7 @@
     /* UPDS SAP */
     URSP_SAP,
     UPDS_VGMM_SAP,
+    L4C_UPDS_SAP,
 
     /* D2AT */
     D2AT_D2RM_SAP,
@@ -1491,7 +1492,7 @@
 
     /* N3CF */
     N3CF_L4C_SAP,
-    
+
     /* N3SAM */
     N3SAM_N3SAM_SAP,
     N3EPC_N3SAM_SAP,
@@ -1507,7 +1508,7 @@
     N3EPC_N3ANS_SAP,
     N3ANS_SIMMNGR_SAP,
     N3ANS_L4BNW_SAP,
-    
+
     /* N3SYS */
     N3SYS_SAP,
 
@@ -1522,21 +1523,21 @@
     IMCSMS_EVAL_SAP,
     SMS_IMCSMS_SAP,
 	DHL_SMS_SAP,
-	
+
     ERRC_MT_SAP,
     IMS_UA_USER_SENSITIVE_SAP,
-	
+
 	XCAP_IMC_SAP,
 	SASE_IMC_SAP,
     SMU_CVAL_SAP,
     L4BPWR_MT_SAP,
 
 	CC_GAS_SAP,
-	
+
 	MT_USER_SENSITIVE_SAP,
-	
+
     SBP_CSS_SAP,
-    
+
     /* SASE to ERRC */
     SASE_ERRC_SAP,
     /* SASE to NRRC */
@@ -1555,7 +1556,7 @@
 	ATP_SASE_SAP,
 	SASE_SAP,
 	IMSM_MSPM_SAP,
-	
+
     /*OSTD SAP*/
     OSTD_SAP,
 
@@ -1570,7 +1571,7 @@
 
 #ifdef __IPC_ADAPTER__
 /* IPC Adapter */
-    IPCA_ATP_SAP, 
+    IPCA_ATP_SAP,
     IPCA_PWR_SAP,
     IPCA_SMS_SAP,
     IPCA_SAT_SAP,
@@ -1590,7 +1591,7 @@
     IPCA_EM_SAP,
     IPCA_FACTORY_SAP,
     IPCA_IMS_SAP,
-    IPCA_CFG_SAP,    
+    IPCA_CFG_SAP,
     IPCA_NW_GPRS_SAP,
     IPCA_GPRS_ROUTINE_SAP,
     IPCA_LEISIM_SAP,
@@ -1605,15 +1606,15 @@
     L4BSIM_IPCA_SRLTE_SAP,
 
     DHL_IPCA_SMU_SAP,
-    IPCA_SBP_SAP,    
+    IPCA_SBP_SAP,
     IPCA_UPCM_SAP,
     IPCA_DOMESTIC_SAP,
     IPCA_SMU_SIM_SAP,
-    
+
 #endif
     D2AT_IPCA_GPRS_SAP,
 
-    /* L5*/    
+    /* L5*/
     L5IO_SAP,
     L5IO_L5U_SAP,
     L5IO_USWITCH_SAP,
@@ -1641,7 +1642,7 @@
     L5U_SAP,
 
     L5UNW_L4BNW_SAP,
-    L5USS_L5USS_SAP,	
+    L5USS_L5USS_SAP,
 	L5IO_L5USYS_SAP,
 	L5UPDN_D2CM_SAP,
     L5UPDN_D2_SAP,
@@ -1651,7 +1652,9 @@
     L5UNW_L4C_SAP,
 	L5URF_L4C_SAP,
     NL1_MT_SAP,
+    NRRC_MT_SAP,
     DHL_VDM_SAP,
+    DHL_PHB_SAP,
 
     L5IO_SLT_SAP,
     L5USIM_L5USWITCH_SAP,
diff --git a/mcu/interface/service/hif/ccci_config_channel_id.h b/mcu/interface/service/hif/ccci_config_channel_id.h
index c0cb651..0ee73a2 100755
--- a/mcu/interface/service/hif/ccci_config_channel_id.h
+++ b/mcu/interface/service/hif/ccci_config_channel_id.h
@@ -53,6 +53,11 @@
  * ==========================================================================
  * $Log$
  *
+ * 09 23 2022 adel.liao
+ * [MOLY00946230] [Cogin][CPE][MBIM] CPE support MBIM
+ * 	
+ * 	add MBIM SAP channel.
+ *
  * 01 25 2021 adel.liao
  * [MOLY00607924] [Nokia][ODU][Module Startup blocking] mipc_init spend 30s
  * 	
@@ -399,6 +404,11 @@
 	CCCI_MIPC_AP13_CHANNEL_RX, //=[255] 0x00ff
 	CCCI_MIPC_AP14_CHANNEL_TX, //=[256] 0x0100
 	CCCI_MIPC_AP14_CHANNEL_RX, //=[257] 0x0101
+	CCCI_RESERVE258_CHANNEL_TX,//[258]0X102
+	CCCI_RESERVE259_CHANNEL_RX,//[259]0X103
+	CCCI_MBIM_CHANNEL_TX,//[260]0X104
+	CCCI_MBIM_CHANNEL_RX,//[261]0X105
+
 
     #if defined(__CCCI_UT__) //keep this UT port at the end of table
     CCCI_NCCCI_TEST_CHANNEL_TX, CCCI_NCCCI_TEST_CHANNEL = CCCI_NCCCI_TEST_CHANNEL_TX,
diff --git a/mcu/interface/service/mtf/mtf_struct.h b/mcu/interface/service/mtf/mtf_struct.h
index 382dbef..d46b604 100755
--- a/mcu/interface/service/mtf/mtf_struct.h
+++ b/mcu/interface/service/mtf/mtf_struct.h
@@ -58,6 +58,16 @@
  *
  * removed!
  * removed!
+ * removed!
+ * removed!
+ *
+ * removed!
+ * removed!
+ * removed!
+ * removed!
+ *
+ * removed!
+ * removed!
  *
  * removed!
  * removed!
@@ -100,6 +110,7 @@
 #include "global_type.h"
 #include "mcd_l3_inc_struct.h"
 #include "sim_exported_enum.h"
+#define NRRC_PLMN_ID_LIST_LEN_MAX 12
 
 typedef enum {
     NL1MOB_MT_CUSTOM_ENH_TYPE_A3A4A5_IGNORE = 0,
@@ -169,6 +180,26 @@
 }errc_mt_dmf_custom_bar_ind_struct;
 
 typedef struct{
+    LOCAL_PARA_HDR
+    kal_uint8      plmn_id_num;
+    plmn_id_struct plmn_id[NRRC_PLMN_ID_LIST_LEN_MAX];
+    kal_uint16     dl_frequency_band;
+    kal_uint32     ssb_arfcn;
+    kal_int16      rsrp;  // unit: QdBm
+    kal_int16      rsrq;  // unit: QdB
+    kal_int16      sinr;  // unit: QdB
+    kal_int16      q_rxlev_min;
+    kal_int8       q_qual_min;
+    kal_int16      s_rxlev;
+    kal_uint8      adj_method;
+    kal_int16      rsrq_th;
+    kal_int16      qrxlevmin_good;
+    kal_int16      qrxlevmin_bad;
+}nrrc_mt_dmf_qrxlevmin_adj_ind_struct;
+
+typedef nrrc_mt_dmf_qrxlevmin_adj_ind_struct nl1mob_mt_dmf_qrxlevmin_adj_ind_struct;
+
+typedef struct{
     kal_uint32 xarfcn;
     kal_uint32 pci;
     kal_int16  rsrp;  //unit: qdBm
@@ -188,6 +219,17 @@
     LOCAL_PARA_HDR
 }nl1mob_mt_dmf_postpone_a2_for_b1b2_ind_struct;
 
+typedef struct{
+    LOCAL_PARA_HDR
+    plmn_id_struct plmn_id;
+    kal_uint16     dl_frequency_band;
+    kal_uint32     ssb_arfcn;
+    kal_int16      rsrp;  // unit: QdBm
+    kal_int16      rsrq;  // unit: QdB
+    kal_int16      sinr;  // unit: QdB
+}nl1mob_mt_dmf_poor_sinr_oos_ind_struct;
+
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/mcu/interface/service/nvram/csg_nvram_def.h b/mcu/interface/service/nvram/csg_nvram_def.h
index 66448f9..246c4d8 100755
--- a/mcu/interface/service/nvram/csg_nvram_def.h
+++ b/mcu/interface/service/nvram/csg_nvram_def.h
@@ -59,6 +59,9 @@
  *
  * removed!
  * removed!
+ *
+ * removed!
+ * removed!
  * removed!
  * removed!
  * removed!
@@ -95,15 +98,17 @@
 
 // VERNO
 #if (defined(__3G_CSG_SUPPORT__) || defined(__LTE_RAT__))
-#define NVRAM_EF_UE_CSG_LIST_LID_VERNO                       "001"
-#define NVRAM_EF_UE_CSG_LIST_LID_HASH                        0x4D0D10AA
+#define NVRAM_EF_UE_CSG_LIST_LID_VERNO                       "002"
+#define NVRAM_EF_UE_CSG_LIST_LID_HASH                        0x2B76AE90
 #endif
 
 #if (defined(__3G_CSG_SUPPORT__) || defined(__LTE_RAT__))
 
 // Size and Total 
+#define NVRAM_EF_UE_CSG_SIZE                                   (sizeof(nvram_ef_ue_csg_list_struct))
 #define NVRAM_EF_UE_CSG_LIST_SIZE                              2500
 #define NVRAM_EF_UE_CSG_LIST_TOTAL                             (1 * NVRAM_DUAL_RECORD)
+#define NVRAM_EF_UE_CSG_IMSI_MAX_LEN                           15
 #endif
 
 #ifdef __cplusplus
diff --git a/mcu/interface/service/nvram/csg_nvram_editor.h b/mcu/interface/service/nvram/csg_nvram_editor.h
index 97b1394..07dbaeb 100755
--- a/mcu/interface/service/nvram/csg_nvram_editor.h
+++ b/mcu/interface/service/nvram/csg_nvram_editor.h
@@ -59,6 +59,9 @@
  *
  * removed!
  * removed!
+ *
+ * removed!
+ * removed!
  * removed!
  * removed!
  *
@@ -81,7 +84,9 @@
 // Data Structure of Each LID
 typedef  struct
 {
-    kal_uint8 data[NVRAM_EF_UE_CSG_LIST_SIZE];
+	kal_uint8    imsi_length;
+    kal_uint8    imsi[NVRAM_EF_UE_CSG_IMSI_MAX_LEN];
+    kal_uint8    data[NVRAM_EF_UE_CSG_LIST_SIZE];
 } nvram_ef_ue_csg_list_struct;
 
 #endif
@@ -101,9 +106,9 @@
 *********************************************************************************************/
 LID_BIT VER_LID(NVRAM_EF_UE_CSG_LIST_LID) nvram_ef_ue_csg_list_struct * NVRAM_EF_UE_CSG_LIST_TOTAL
 {
-    data: "csg white list[2500]"
-    {
-    };  
+    imsi_length:"IMSI length[1]"{};
+    imsi:"IMSI to which this CSG list belongs to[15]"{};  
+    data:"UE based CSG allowed list[2500]"{};  
 };
 #endif
 END_NVRAM_DATA
diff --git a/mcu/interface/service/nvram/mrs_nvram_def.h b/mcu/interface/service/nvram/mrs_nvram_def.h
index d60327f..cde8c0b 100755
--- a/mcu/interface/service/nvram/mrs_nvram_def.h
+++ b/mcu/interface/service/nvram/mrs_nvram_def.h
@@ -217,6 +217,7 @@
     NVRAM_EF_MRS_CUSTOM_SEARCH_ORDER_TABLE_LID = NVRAM_LID_GRP_MRS(18),
     NVRAM_EF_MRS_RAT_CAPABILITY_CONFIG_LID  = NVRAM_LID_GRP_MRS(21),
     NVRAM_EF_MRS_NR_PARTIAL_BAND_TABLE_LID  = NVRAM_LID_GRP_MRS(22),
+	NVRAM_EF_MRS_VOICE_UNAVAIL_LEAVE_RAT_CONFIG_LID  = NVRAM_LID_GRP_MRS(23),
     NVRAM_EF_MRS_LAST_LID                   = NVRAM_LID_GRP_MRS(63)
 } nvram_lid_mrs_enum;
 
@@ -256,6 +257,11 @@
 #define NVRAM_EF_MRS_RAT_CAPABILITY_CONFIG_LID_VERNO   "000"
 #define NVRAM_EF_MRS_RAT_CAPABILITY_CONFIG_LID_HASH    0x682739BF
 
+#define NVRAM_EF_MRS_VOICE_UNAVAIL_LEAVE_RAT_CONFIG_SIZE        (sizeof(nvram_ef_mrs_voice_unavail_leave_rat_config_struct))
+#define NVRAM_EF_MRS_VOICE_UNAVAIL_LEAVE_RAT_CONFIG_TOTAL       (1)
+#define NVRAM_EF_MRS_VOICE_UNAVAIL_LEAVE_RAT_CONFIG_LID_VERNO   "000"
+#define NVRAM_EF_MRS_VOICE_UNAVAIL_LEAVE_RAT_CONFIG_LID_HASH    0xBF8E072E
+
 #define NVRAM_EF_MRS_NR_BAND_DISABLE_LIST_SIZE        (sizeof(nvram_ef_nr_custom_band_disable_list_struct))
 #define NVRAM_EF_MRS_NR_BAND_DISABLE_LIST_TOTAL       (1 * NVRAM_DUAL_RECORD)
 #define NVRAM_EF_MRS_NR_BAND_DISABLE_LIST_LID_VERNO   "007"
diff --git a/mcu/interface/service/nvram/mrs_nvram_editor.h b/mcu/interface/service/nvram/mrs_nvram_editor.h
index 5a68f6a..10353f5 100755
--- a/mcu/interface/service/nvram/mrs_nvram_editor.h
+++ b/mcu/interface/service/nvram/mrs_nvram_editor.h
@@ -207,6 +207,8 @@
 
 #define NVRAM_MAX_MRS_RAT_CAPABILITY_CONFIG_NUM 300
 
+#define NVRAM_MAX_MRS_VOICE_UNAVAIL_LEAVE_RAT_CONFIG_NUM 300
+
 #define NVRAM_MAX_MRS_DISABLE_VG_ROAMING_ENTRY_NUM 300
 
 #define NVRAM_NR_BAND_DISABLE_POSITIVE_PLMN_NUM_MAX 30
@@ -398,6 +400,7 @@
 
 typedef enum {
     NVRAM_GSM_CAPABILITY = 0x01,
+	NVRAM_UMTS_CAPABILITY = 0x02,
 } nvram_rat_capability_enum;
 
 typedef struct {
@@ -416,6 +419,37 @@
 } nvram_ef_mrs_rat_capability_config_struct;
 
 typedef enum {
+    APPLY_SCOPE_GENERAL,
+    APPLY_SCOPE_ROAMING,
+    APPLY_SCOPE_HOME,
+} nvram_ef_apply_scope_enum;
+
+typedef enum {
+    NVRAM_LEAVE_LTE = 0x01,
+    NVRAM_LEAVE_NR  = 0x02,
+} nvram_voice_unavail_leave_rat_enum;
+
+typedef enum {
+    NO_NEED_LEAVE,
+    NEED_LEAVE,
+} nvram_voice_unavail_leave_status_enum;
+
+typedef struct {
+    nvram_plmn_id_struct hplmn;                              /* Home PLMN derived from IMSI */
+    nvram_plmn_id_struct splmn;                              /* Serving PLMN */
+    nvram_voice_unavail_leave_rat_enum leave_rat;            /* Only support leave LTE/NR currently */
+    nvram_voice_unavail_leave_status_enum leave_status;      /* Need leave or no need leave */
+    nvram_ef_apply_scope_enum scope;                         /* Rule applied scope */
+    kal_uint8 num_of_exception;                              /* Number of exception rules */
+} nvram_ef_mrs_voice_unavail_leave_rat_struct;
+
+typedef struct {
+    kal_bool is_valid;
+    kal_uint32 num_of_entry;
+    nvram_ef_mrs_voice_unavail_leave_rat_struct voice_unavail_leave_rat_config_list[NVRAM_MAX_MRS_VOICE_UNAVAIL_LEAVE_RAT_CONFIG_NUM];
+} nvram_ef_mrs_voice_unavail_leave_rat_config_struct;
+
+typedef enum {
     NV_MRS_SEARCH_PRIORITY_ENUM_ENDC,
     NV_MRS_SEARCH_PRIORITY_ENUM_SIGNAL_LEVEL,
     NV_MRS_SEARCH_PRIORITY_ENUM_LARGE_BW,
@@ -913,6 +947,30 @@
                         partial_band_table[*].partial_band_info.freq_range_info.range_list[*].ul_phy_freq_max:"[MCF]UL max frequency (MHz)" {};
      };
 
+/********************************************************************************************
+* LID_NAME
+*      NVRAM_EF_MRS_VOICE_UNAVAIL_LEAVE_RAT_CONFIG_LID
+* DESCRIPTION
+*      This LID is used to store voice unavail leave rat configuration
+* INFOMATION
+*      Can OTA Reset: Yes
+*      Update Scenario: This LID need to be manual updated.
+*********************************************************************************************/
+LID_BIT VER_LID(NVRAM_EF_MRS_VOICE_UNAVAIL_LEAVE_RAT_CONFIG_LID)
+nvram_ef_mrs_voice_unavail_leave_rat_config_struct * NVRAM_EF_MRS_VOICE_UNAVAIL_LEAVE_RAT_CONFIG_TOTAL
+     {
+        is_valid:"[MCF,RUNTIME]Validity of voice unavail leave rat config table" {};
+
+        num_of_entry:"[MCF,RUNTIME]Number of valid entries" {};
+        voice_unavail_leave_rat_config_list:"[MCF,RUNTIME]Rules for leave/not leave rat when voice unavailable for specific SIM/network" {};
+        voice_unavail_leave_rat_config_list[*].hplmn: "PLMN ID of Home PLMN" {};
+        voice_unavail_leave_rat_config_list[*].splmn: "PLMN ID of Serving PLMN" {};
+        voice_unavail_leave_rat_config_list[*].leave_rat: "enum of rat to leave" {};
+        voice_unavail_leave_rat_config_list[*].leave_status: "need leave or no need leave" {};
+        voice_unavail_leave_rat_config_list[*].scope: "rule applied scope" {};
+        voice_unavail_leave_rat_config_list[*].num_of_exception: "number of exception rules" {};
+    };
+
 END_NVRAM_DATA
 #endif	/* GEN FOR PC */
 
diff --git a/mcu/interface/service/nvram/nrrc_nvram_def.h b/mcu/interface/service/nvram/nrrc_nvram_def.h
index 686fcb6..c75dc61 100755
--- a/mcu/interface/service/nvram/nrrc_nvram_def.h
+++ b/mcu/interface/service/nvram/nrrc_nvram_def.h
@@ -74,6 +74,21 @@
  *
  * removed!
  * removed!
+ * removed!
+ * removed!
+ *
+ * removed!
+ * removed!
+ * removed!
+ * removed!
+ *
+ * removed!
+ * removed!
+ * removed!
+ * removed!
+ *
+ * removed!
+ * removed!
  *
  * removed!
  * removed!
@@ -291,8 +306,8 @@
 #define NVRAM_NRRC_SEARCH_MAX_LEARNED_INFO_NUM     50
 #define NVRAM_NRRC_SEARCH_MAX_MOST_RECENT_MCC_NUM  6
 
-#define NVRAM_EF_NRRC_COMMON_CONFIG_LID_VERNO "036"
-#define NVRAM_EF_NRRC_COMMON_CONFIG_LID_HASH  0x639CC9B9
+#define NVRAM_EF_NRRC_COMMON_CONFIG_LID_VERNO "035"
+#define NVRAM_EF_NRRC_COMMON_CONFIG_LID_HASH  0xED98C676
 
 #define NVRAM_EF_NRRC_COMMON_CONFIG_SIZE      (sizeof(nvram_ef_nrrc_common_config_struct))
 #define NVRAM_EF_NRRC_COMMON_CONFIG_TOTAL     (1 * NVRAM_DUAL_RECORD)
diff --git a/mcu/interface/service/nvram/nrrc_nvram_editor.h b/mcu/interface/service/nvram/nrrc_nvram_editor.h
index bb5ba08..a4d99d3 100755
--- a/mcu/interface/service/nvram/nrrc_nvram_editor.h
+++ b/mcu/interface/service/nvram/nrrc_nvram_editor.h
@@ -65,6 +65,27 @@
  * removed!
  * removed!
  * removed!
+ *
+ * removed!
+ *
+ * removed!
+ * removed!
+ * removed!
+ * removed!
+ *
+ * removed!
+ * removed!
+ * removed!
+ * removed!
+ *
+ * removed!
+ * removed!
+ * removed!
+ * removed!
+ *
+ * removed!
+ * removed!
+ * removed!
  * removed!
  *
  * removed!
@@ -580,6 +601,14 @@
                     meas_mob_performance.lte_B1_B2_force_th.nbr_rsrp_th: "neighbor cell rsrp threshold, unit: qdBm, range: -640~-120, disable: 0x8000."{};
                     meas_mob_performance.lte_B1_B2_force_th.nbr_rsrq_th: "neighbor cell rsrq threshold, unit: qdB , range: -180~80, disable: 0x8000."{};
                     meas_mob_performance.lte_B1_B2_force_th.nbr_sinr_th: "neighbor cell sinr threshold, unit: qdB , range: -100~160, disable: 0x8000."{};
+                meas_mob_performance.lte_B1_B2_force_th_vonr: "srv<srv_th && nbr>nbr_th force LTE B1 report."{};
+                    meas_mob_performance.lte_B1_B2_force_th_vonr.ctrl_bmp: "0x01: disable on high speed, 0x02: enable srv_th, 0x04: enable nbr_th, 0x08: disable on test SIM, 0x40: B1 enable, 0x80: B2 enable"{};
+                    meas_mob_performance.lte_B1_B2_force_th_vonr.srv_rsrp_th: "serving cell rsrp threshold, unit: qdBm, range: -640~-120, disable: 0x8000."{};
+                    meas_mob_performance.lte_B1_B2_force_th_vonr.srv_rsrq_th: "serving cell rsrq threshold, unit: qdB , range: -180~80, disable: 0x8000."{};
+                    meas_mob_performance.lte_B1_B2_force_th_vonr.srv_sinr_th: "serving cell sinr threshold, unit: qdB , range: -100~160, disable: 0x8000."{};
+                    meas_mob_performance.lte_B1_B2_force_th_vonr.nbr_rsrp_th: "neighbor cell rsrp threshold, unit: qdBm, range: -640~-120, disable: 0x8000."{};
+                    meas_mob_performance.lte_B1_B2_force_th_vonr.nbr_rsrq_th: "neighbor cell rsrq threshold, unit: qdB , range: -180~80, disable: 0x8000."{};
+                    meas_mob_performance.lte_B1_B2_force_th_vonr.nbr_sinr_th: "neighbor cell sinr threshold, unit: qdB , range: -100~160, disable: 0x8000."{};
                 meas_mob_performance.lte_B1_B2_force_th_serv_per_band_list: "Serving threshold per band list for lte_B1_B2_force_th. One of srv_rsrp_th/srv_rsrq_th/srv_sinr_th in lte_B1_B2_force_th must be valid. Unspecified band will use value in lte_B1_B2_force_th"{};
                     meas_mob_performance.lte_B1_B2_force_th_serv_per_band_list.per_band_threshold: "Threshold for specific band"{};
                         meas_mob_performance.lte_B1_B2_force_th_serv_per_band_list.per_band_threshold.band: "NR band, range: 1~65535, disable: 0x0000"{};
@@ -608,6 +637,11 @@
                     meas_mob_performance.ping_pong_parameter.ping_pong_cell_bar_time: "ping-pong cell bar time(300s), range: 60~600, disable: 0x8000."{};
                     meas_mob_performance.ping_pong_parameter.ping_pong_cell_monitor_period: "ping-pong cell monitor period(20s), range: 10~30 , disable: 0x8000."{};
                     meas_mob_performance.ping_pong_parameter.ping_pong_hit_count_threshold: "ping-pong hit count threshold, range: 2~5 , disable: 0x80."{};
+                meas_mob_performance.irat_ping_pong_parameter: "Parameters for nr irat ping-pong bar enhancement."{};
+                    meas_mob_performance.irat_ping_pong_parameter.ctrl_bmp: "0x01: enable nr irat pingpong_bar, 0x02: disable on test SIM"{};
+                    meas_mob_performance.irat_ping_pong_parameter.ping_pong_cell_bar_time: "ping-pong cell bar time(300s), range: 60~600, disable: 0x8000."{};
+                    meas_mob_performance.irat_ping_pong_parameter.ping_pong_cell_monitor_period: "ping-pong cell monitor period(60s), range: 30~180 , disable: 0x8000."{};
+                    meas_mob_performance.irat_ping_pong_parameter.ping_pong_hit_count_threshold: "ping-pong hit count threshold, range: 2~5 , disable: 0x80."{};
                 meas_mob_performance.a2_adjust_th: "srv>srv_th, adjust a2 thresh as MAX(ori, good_a2_rsrp_th). srv<=srv_th, adjust a2 thresh as MAX(ori, bad_a2_rsrq_th)"{};
                     meas_mob_performance.a2_adjust_th.ctrl_bmp: "0x01: disable on high speed, 0x02: enable good_a2_rsrp_th, 0x04: enable bad_a2_rsrp_th, 0x08: disable on test SIM"{};
                     meas_mob_performance.a2_adjust_th.srv_rsrp_th: "serving cell rsrp threshold, unit: qdBm, range: -640~-120, disable: 0x8000."{};
@@ -615,6 +649,13 @@
                     meas_mob_performance.a2_adjust_th.srv_sinr_th: "serving cell sinr threshold, unit: qdB , range: -100~160, disable: 0x8000."{};
                     meas_mob_performance.a2_adjust_th.good_a2_rsrp_th: "good_a2_rsrp_th, unit: qdBm, range: -640~-120, disable: 0x8000."{};
                     meas_mob_performance.a2_adjust_th.bad_a2_rsrp_th: "bad_a2_rsrp_th, unit: qdBm, range: -640~-120, disable: 0x8000."{};
+                meas_mob_performance.a2_adjust_th_vonr: "srv>srv_th, adjust a2 thresh as MAX(ori, good_a2_rsrp_th). srv<=srv_th, adjust a2 thresh as MAX(ori, bad_a2_rsrq_th)"{};
+                    meas_mob_performance.a2_adjust_th_vonr.ctrl_bmp: "0x01: disable on high speed, 0x02: enable good_a2_rsrp_th, 0x04: enable bad_a2_rsrp_th, 0x08: disable on test SIM"{};
+                    meas_mob_performance.a2_adjust_th_vonr.srv_rsrp_th: "serving cell rsrp threshold, unit: qdBm, range: -640~-120, disable: 0x8000."{};
+                    meas_mob_performance.a2_adjust_th_vonr.srv_rsrq_th: "serving cell rsrq threshold, unit: qdB , range: -180~80, disable: 0x8000."{};
+                    meas_mob_performance.a2_adjust_th_vonr.srv_sinr_th: "serving cell sinr threshold, unit: qdB , range: -100~160, disable: 0x8000."{};
+                    meas_mob_performance.a2_adjust_th_vonr.good_a2_rsrp_th: "good_a2_rsrp_th, unit: qdBm, range: -640~-120, disable: 0x8000."{};
+                    meas_mob_performance.a2_adjust_th_vonr.bad_a2_rsrp_th: "bad_a2_rsrp_th, unit: qdBm, range: -640~-120, disable: 0x8000."{};
                 meas_mob_performance.a2_adjust_th_per_band_list: "Per band list for a2_adjust_th. One of srv_rsrp_th/srv_rsrq_th/srv_sinr_th in a2_adjust_th must be valid. Unspecified band will use value in a2_adjust_th"{};
                     meas_mob_performance.a2_adjust_th_per_band_list.per_band_threshold: "Threshold for specific band"{};
                         meas_mob_performance.a2_adjust_th_per_band_list.per_band_threshold.band: "NR band, range: 1~65535, disable: 0x0000"{};
@@ -636,12 +677,18 @@
                     meas_mob_performance.A3A4A5_prefer_cell.rsrp_th_for_ignore_rpt: "neighbor cell rsrp threshold, unit: qdBm, range: -640~-120, disable: 0x8000."{};
                     meas_mob_performance.A3A4A5_prefer_cell.rsrq_th_for_ignore_rpt: "neighbor cell rsrq threshold, unit: qdB , range: -180~80, disable: 0x8000."{};
                     meas_mob_performance.A3A4A5_prefer_cell.sinr_th_for_ignore_rpt: "neighbor cell sinr threshold, unit: qdB , range: -100~160, disable: 0x8000."{};
-                    meas_mob_performance.postpone_a2_for_b1b2: "srv>srv_th, postpone a2 if b1b2 configured for timer_postpone_b1b2"{};
+                meas_mob_performance.postpone_a2_for_b1b2: "srv>srv_th, postpone a2 if b1b2 configured for timer_postpone_b1b2"{};
                     meas_mob_performance.postpone_a2_for_b1b2.ctrl_bmp: "0x01: disable on high speed, 0x02: enable lower_a2_rsrp_th, 0x04: enable lower_a2_rsrq_th, 0x08: disable on test SIM"{};
                     meas_mob_performance.postpone_a2_for_b1b2.timer_postpone_a2: "to postpone a2 for how long in ms if B1 or B2 configured"{};
                     meas_mob_performance.postpone_a2_for_b1b2.srv_rsrp_th: "serving cell rsrp threshold, unit: qdBm, range: -640~-120, disable: 0x8000."{};
                     meas_mob_performance.postpone_a2_for_b1b2.srv_rsrq_th: "serving cell rsrq threshold, unit: qdB , range: -180~80, disable: 0x8000."{};
                     meas_mob_performance.postpone_a2_for_b1b2.srv_sinr_th: "serving cell sinr threshold, unit: qdB , range: -100~160, disable: 0x8000."{};
+                meas_mob_performance.nr_lte_prefer_rat_rsrp_th: "Customized nr lte prefer rat rsrp threshold config."{};
+                    meas_mob_performance.nr_lte_prefer_rat_rsrp_th.ctrl_bmp: "0x01: enable nr lte prefer rat rsrp threshold, 0x02: disable on test SIM"{};
+                    meas_mob_performance.nr_lte_prefer_rat_rsrp_th.nr_good_rsrp_th: "nr serving cell rsrp good threshold, unit: qdBm, range: -640~-120, disable: 0x8000."{};
+                    meas_mob_performance.nr_lte_prefer_rat_rsrp_th.nr_bad_rsrp_th: "nr serving cell rsrp bad threshold, unit: qdBm, range: -640~-120, disable: 0x8000."{};
+                    meas_mob_performance.nr_lte_prefer_rat_rsrp_th.lte_rsrp_th: "lte candidate cell rsrp good threshold, unit: qdBm, range: -640~-120, disable: 0x8000."{};
+                meas_mob_performance.game_nbr_bad_rsrp_th:  "set the rsrp lower bound of gaming neighbor cell, unit: qdBm, range: -640~-120, disable: 0x8000."{};
             scg_bar_info: "[MCF] Configuration for SCG bar info."{};
                 scg_bar_info.scg_bar_th: "Number of SCG failures more than the scg_bar_th, scg cell will be barred."{};
                 scg_bar_info.scg_bar_time: "SCG cell bar timer."{};
@@ -662,20 +709,26 @@
                 nrrc_erm_param_info.short_monitor_duration: "abnormal monitor duration in sec"{};
                 nrrc_erm_param_info.bar_time:"bar time when abnormal threshold match"{};
                 nrrc_erm_param_info.long_monitor_duration:"monitor duration to fully alleviate"{};
+                nrrc_erm_param_info.nw_reject_with_long_wait_time_counter :"Counter for NW reject with a long wait time"{};
+                nrrc_erm_param_info.nw_reject_with_long_wait_time_monitoring_time :"Monitoring time for NW reject with a long wait time"{};
+                nrrc_erm_param_info.nw_reject_with_long_wait_time_bar_time :"Bar time for NW reject with a long wait time"{};
+                nrrc_erm_param_info.nw_reject_with_long_wait_time_threshold :"Threshold for NW reject with a long wait time"{};
             nrrc_idle_param:"[MCF] Configuration for idle mode behavior parameters."{};
                 nrrc_idle_param.nr_tacless_bar_cell_timer:"Bar timer when 4G5 redirection to NR TACLESS cell."{};
                 nrrc_idle_param.nrrc_idle_custom_redir_param_info: "parameters for handling redirection failed in subway scenario"{};
                     nrrc_idle_param.nrrc_idle_custom_redir_param_info.offset_penalty: "offset penalty value when intra-NR redirection failed in subway scenario"{};
                     nrrc_idle_param.nrrc_idle_custom_redir_param_info.offset_time: "offset penalty time when intra-NR redirection failed in subway scenario"{};
             nrrc_si_param:"[MCF] Configuration for SIB reception behaviour parameters."{};
-                nrrc_si_param.q_rx_lv_min.is_valid:"[MCF] validity of custom NR_Q_RxLevMin"{};
-                nrrc_si_param.q_rx_lv_min.custom_val:"[MCF] custom value of custom NR_Q_RxLevMin"{};
-                nrrc_si_param.q_rx_lv_min.threshold_high:"[MCF] threshold high of custom NR_Q_RxLevMin"{};
-                nrrc_si_param.q_rx_lv_min.threshold_low:"[MCF] threshold low of custom NR_Q_RxLevMin"{};
-                nrrc_si_param.q_qual_lv_min.is_valid:"[MCF] validity of custom NR_Q_QualMin"{};
-                nrrc_si_param.q_qual_lv_min.custom_val:"[MCF] custom value of custom NR_Q_QualMin"{};
-                nrrc_si_param.q_qual_lv_min.threshold_high:"[MCF] threshold high custom NR_Q_QualMin"{};
-                nrrc_si_param.q_qual_lv_min.threshold_low:"[MCF] threshold low of custom NR_Q_QualMin"{};
+                nrrc_si_param.q_rx_lv_min:"[MCF] customized NR_Q_RxLevMin"{};
+                    nrrc_si_param.q_rx_lv_min.is_valid:"[MCF] validity of customized NR_Q_RxLevMin"{};
+                    nrrc_si_param.q_rx_lv_min.custom_val:"[MCF] custom value of customized NR_Q_RxLevMin"{};
+                    nrrc_si_param.q_rx_lv_min.threshold_high:"[MCF] threshold high of customized NR_Q_RxLevMin"{};
+                    nrrc_si_param.q_rx_lv_min.threshold_low:"[MCF] threshold low of customized NR_Q_RxLevMin"{};
+                nrrc_si_param.q_qual_lv_min:"[MCF] customized NR_Q_QualMin"{};
+                    nrrc_si_param.q_qual_lv_min.is_valid:"[MCF] validity of customized NR_Q_QualMin"{};
+                    nrrc_si_param.q_qual_lv_min.custom_val:"[MCF] custom value of customized NR_Q_QualMin"{};
+                    nrrc_si_param.q_qual_lv_min.threshold_high:"[MCF] threshold high customized NR_Q_QualMin"{};
+                    nrrc_si_param.q_qual_lv_min.threshold_low:"[MCF] threshold low of customized NR_Q_QualMin"{};
             hst_cell_param:"[MCF] Configuration for cell power threshold."{};
                 hst_cell_param.rsrp_threshold:"[MCF] custom value of rsrp threshold for hst enhance"{};
                 hst_cell_param.rsrq_threshold:"[MCF] custom value of rsrq threshold for hst enhance"{};
@@ -1121,6 +1174,10 @@
     kal_uint32       short_monitor_duration;
     kal_uint32       bar_time;
     kal_uint32       long_monitor_duration;
+    kal_uint8        nw_reject_with_long_wait_time_counter;
+    kal_uint8        nw_reject_with_long_wait_time_monitoring_time;
+    kal_uint32       nw_reject_with_long_wait_time_bar_time;
+    kal_uint8        nw_reject_with_long_wait_time_threshold;
 } nvram_nrrc_abnormal_control_params_struct;
 
 typedef struct {
diff --git a/mcu/interface/service/sbp/sbp_feature.def b/mcu/interface/service/sbp/sbp_feature.def
index 7ad155f..e7d0714 100755
--- a/mcu/interface/service/sbp/sbp_feature.def
+++ b/mcu/interface/service/sbp/sbp_feature.def
@@ -69,7 +69,8 @@
 		<RECORD Date="2022-06-24" Author="ot901114">Add SBP_GMSS_TRIGGER_INCREMENTAL_MPSR</RECORD>
 		<RECORD Date="2022-05-16" Author="OT901109">Add SBP_NWSEL_CLEAR_RPLMN_FOR_POWER_ON_SEARCH</RECORD>
 		<RECORD Date="2022-05-16" Author="OT901109">Add SBP_NWSEL_CLEAR_RPLMN_FOR_HOME_COUNTRY_POWER_ON_SEARCH</RECORD>
-	</HISTORY>
+        <RECORD Date="2022-08-16" Author="mtk15164">Add SBP_NAS_SV_RAT_CAP_CONTROL_BY_MRS_CONFIG</RECORD>
+    </HISTORY>
 </SBP_DOC_INFO>
 ******* SBP Doc End ********/
 
@@ -22698,7 +22699,7 @@
 #endif
 
 /****** SBP Document BEGIN ************************************************************************
-<SBP title="SBP_KOR_SKT_NULL_MSISDN_REG - Blocking the registration for Korea SKT telecom requirement ">
+<SBP title="SBP_KOR_NULL_MSISDN_REG - Blocking the registration for Korea operator requirement ">
     <DESCRIPTION>
         <PARAG>If inserted USIM card has NULL MSISDN with registration mode, UE will not try to attach request to network. </PARAG>
     </DESCRIPTION>
@@ -22708,13 +22709,13 @@
         <VALUE value="1">Enabled</VALUE>
     </CONFIG>
     <DEFAULT>0</DEFAULT>
-    <OP>SKT</OP>
+    <OP>OP115 and OP116</OP>
     <DEPENDENCY>N/A</DEPENDENCY>
     <NOTE>None</NOTE>
     <AUTHOR>mtk06648</AUTHOR>
 </SBP>
 ******* SBP Document END **************************************************************************/
-SBP_FEATURE_DEF(SBP_KOR_SKT_NULL_MSISDN_REG, SBP_ATTR_NONE, "Do Not try to attach network if USIM has NULL MSISDN for SKT", "Disabled", "Enabled", 0)
+SBP_FEATURE_DEF(SBP_KOR_NULL_MSISDN_REG, SBP_ATTR_NONE, "Do Not try to attach network if USIM has NULL MSISDN for Korea operator requirement", "Disabled", "Enabled", 0)
 
 
 /****** SBP Document BEGIN ************************************************************************
@@ -33251,7 +33252,7 @@
         <VALUE value="0">Not support</VALUE>
         <VALUE value="1">Support</VALUE>
     </CONFIG>
-    <DEFAULT>0</DEFAULT>
+    <DEFAULT>1</DEFAULT>
     <OP>N/A</OP>
     <DEPENDENCY>N/A</DEPENDENCY>
     <NOTE>
@@ -33261,10 +33262,10 @@
     <AUTHOR>mtk16743</AUTHOR>
 </SBP>
 ******* SBP Document END **************************************************************************/
-#if defined(__SUPPORT_LTE_SKIPPED_FALLBACK_CA__)
-    SBP_FEATURE_DEF(SBP_SUPPORT_LTE_SKIPPED_FALLBACK_CA, SBP_ATTR_NONE, "Support of skippfallback CA combinations in LTE", "Not support", "Support", 1)
-#else
+#if defined(__DISABLE_SUPPORT_LTE_SKIPPED_FALLBACK_CA__)
     SBP_FEATURE_DEF(SBP_SUPPORT_LTE_SKIPPED_FALLBACK_CA, SBP_ATTR_NONE, "Support of skippfallback CA combinations in LTE", "Not support", "Support", 0)
+#else
+    SBP_FEATURE_DEF(SBP_SUPPORT_LTE_SKIPPED_FALLBACK_CA, SBP_ATTR_NONE, "Support of skippfallback CA combinations in LTE", "Not support", "Support", 1)
 #endif
 
 /****** SBP Document BEGIN ************************************************************************
@@ -33304,7 +33305,7 @@
         <VALUE value="0">Disabled</VALUE>
         <VALUE value="1">Enabled</VALUE>
     </CONFIG>
-    <DEFAULT>0</DEFAULT>
+    <DEFAULT>1</DEFAULT>
     <OP>N/A</OP>
     <DEPENDENCY>N/A</DEPENDENCY>
     <NOTE>
@@ -33314,7 +33315,11 @@
     <AUTHOR>mtk16743</AUTHOR>
 </SBP>
 ******* SBP Document END **************************************************************************/
-SBP_FEATURE_DEF(SBP_CA_MAX_MIMO_LAYERS, SBP_ATTR_NONE, "Support of maximumCCsRetrieval in LTE", "Disabled", "Enabled", 0)
+#if defined __DISABLE_LTE_SUPPORT_MAX_CC_RETRIEVAL__
+    SBP_FEATURE_DEF(SBP_CA_MAX_MIMO_LAYERS, SBP_ATTR_NONE, "Support of maximumCCsRetrieval in LTE", "Disabled", "Enabled", 0)
+#else
+    SBP_FEATURE_DEF(SBP_CA_MAX_MIMO_LAYERS, SBP_ATTR_NONE, "Support of maximumCCsRetrieval in LTE", "Disabled", "Enabled", 1)
+#endif
 
 /****** SBP Document BEGIN ************************************************************************
 <SBP title="SBP_NR_PARTIAL_BAND_USE_NVRAM - Use NVRAM to config NR partial band under MCC">
@@ -33851,7 +33856,7 @@
 /****** SBP Document BEGIN ************************************************************************
 <SBP title="SBP_NR_CAP_DISABLE_PUSCH_LBRM - disable pusch_LBRM transmission in NR">
     <DESCRIPTION>
-       <PARAG> 
+       <PARAG>
 	   To force disable NR LBRM PUSCH transmission. The capabitliy report of pusch_LBRM in 38.306 will be affected.
        </PARAG>
     </DESCRIPTION>
@@ -33968,8 +33973,8 @@
 /****** SBP Document BEGIN ************************************************************************
 <SBP title="SBP_LBS_LPP_ALLOW_NILR_AFTER_EMC_END - LBS to allow/deny NILR session after an emergency call ends">
     <DESCRIPTION>
-        <PARAG>The UE SHALL allow NI-LR for Emergency Service Calls regardless of the location privacy settings or 
-		GPS settings on the UE. UE SHALL allow NI-LR to be supported for upto 5minutes after an emergency call ends 
+        <PARAG>The UE SHALL allow NI-LR for Emergency Service Calls regardless of the location privacy settings or
+		GPS settings on the UE. UE SHALL allow NI-LR to be supported for upto 5minutes after an emergency call ends
 		(in case of a premature or dropped call where PSAP may wish to do a locate).
         </PARAG>
     </DESCRIPTION>
@@ -33993,8 +33998,510 @@
     SBP_FEATURE_DEF(SBP_LBS_LPP_ALLOW_NILR_AFTER_EMC_END, SBP_ATTR_NONE, "The NILR session not allowed after an emergency call ends.", "Allow NILR", "Not allow NILR", 0)
 #endif
 
+/****** SBP Document BEGIN ************************************************************************
+<SBP title="SBP_SA_LTE_B1_MEAS_SKIP_SERVING_MEAS_OBJECT_CHECK - NRRC Skips MeasObj Check of Serving Frequency for LTE B1 in SA Mode during VoNR">
+    <DESCRIPTION>
+        <PARAG>
+            If this SBP is turn ON, NRRC skips measObj check of serving frequency for LTE B1 in SA Mode during VoNR
+        </PARAG>
+    </DESCRIPTION>
+    <CONFIG>
+       <VALUE value="0">Disable</VALUE>
+       <VALUE value="1">Enable</VALUE>
+    </CONFIG>
+    <CATEGORY>NRRC</CATEGORY>
+    <DEFAULT>0</DEFAULT>
+    <OP>N/A</OP>
+    <DEPENDENCY>N/A</DEPENDENCY>
+    <NOTE>None</NOTE>
+    <AUTHOR>mtk12264</AUTHOR>
+</SBP>
+******* SBP Document END **************************************************************************/
+#ifdef __SA_LTE_B1_MEAS_SKIP_SERVING_MEAS_OBJECT_CHECK__
+	SBP_FEATURE_DEF(SBP_SA_LTE_B1_MEAS_SKIP_SERVING_MEAS_OBJECT_CHECK, SBP_ATTR_NONE, "NRRC Skips MeasObj Check of Serving Frequency for LTE B1 in SA mode during VoNR", "Disabled", "Enabled", 1)
+#else
+	SBP_FEATURE_DEF(SBP_SA_LTE_B1_MEAS_SKIP_SERVING_MEAS_OBJECT_CHECK, SBP_ATTR_NONE, "NRRC Skips MeasObj Check of Serving Frequency for LTE B1 in SA mode during VoNR", "Disabled", "Enabled", 0)
+#endif
+
+/****** SBP Document BEGIN ************************************************************************
+<SBP title="SBP_DEREG_VOWIFI_WHEN_CS_CALL_ONGOING">
+    <DESCRIPTION>
+        <PARAG> When CS call is ongoing, UE should dereg VoWiFi </PARAG>
+    </DESCRIPTION>
+    <CATEGORY>IMC</CATEGORY>
+    <CONFIG>
+        <VALUE value="0">Disabled</VALUE>
+        <VALUE value="1">Enabled</VALUE>
+    </CONFIG>
+    <DEFAULT>0</DEFAULT>
+    <OP>N/A</OP>
+    <DEPENDENCY>N/A</DEPENDENCY>
+    <NOTE>None</NOTE>
+    <AUTHOR>mtk16701</AUTHOR>
+</SBP>
+******* SBP Document END **************************************************************************/
+#if defined(__SBP_DEREG_VOWIFI_WHEN_CS_CALL_ONGOING__)
+    SBP_FEATURE_DEF(SBP_DEREG_VOWIFI_WHEN_CS_CALL_ONGOING, SBP_ATTR_NONE, "Enable that UE should dereg VoWiFi when CS call is ongoing.", "Not Enabled", "Enabled", 1)
+#else
+    SBP_FEATURE_DEF(SBP_DEREG_VOWIFI_WHEN_CS_CALL_ONGOING, SBP_ATTR_NONE, "Disable that UE should dereg VoWiFi when CS call is ongoing.", "Not Enabled", "Enabled", 0)
+#endif
+
 SBP_FEATURE_DEF_END(169)
 
+/* 171st byte*/
+SBP_FEATURE_DEF_BEGIN(170)
+
+/****** SBP Document BEGIN ************************************************************************
+<SBP title="SBP_ERRC_A3_HO_ENH_TRIGGER_EARLY_REEST - Trigger Early Re-establishment if N/W not responding for 10 consecutive A3 MR  ">
+    <DESCRIPTION>
+        <PARAG>
+        If the n/w is not responding for consecutive 10 A3 MR and serving cell has low RSRQ and SINR ,then trigger early re-establisment to avoid T-put loss.
+        </PARAG>
+    </DESCRIPTION>
+    <CATEGORY>ERRC</CATEGORY>
+    <CONFIG>
+        <VALUE value="0">Disable. </VALUE>
+        <VALUE value="1">Enable. </VALUE>
+    </CONFIG>
+    <DEFAULT>0</DEFAULT>
+    <OP></OP>
+    <DEPENDENCY>if compile option __SBP_ERRC_A3_HO_ENH_TRIGGER_EARLY_REEST__ is defined, the SBP is enabled</DEPENDENCY>
+    <NOTE>
+        IS_VIOLATE_STANDARD=Y
+        VIOLATED_STANDARD= 3GPP TS 36.331
+    </NOTE>
+    <AUTHOR>ot903712</AUTHOR>
+</SBP>
+******* SBP Document END **************************************************************************/
+#ifdef __SBP_ERRC_A3_HO_ENH_TRIGGER_EARLY_REEST__
+    SBP_FEATURE_DEF(SBP_ERRC_A3_HO_ENH_TRIGGER_EARLY_REEST, SBP_ATTR_NONE, "Trigger Early Re-establishment if N/W not responding for 10 consecutive A3 MR.", "Disabled", "Enabled", 1)
+#else
+    SBP_FEATURE_DEF(SBP_ERRC_A3_HO_ENH_TRIGGER_EARLY_REEST, SBP_ATTR_NONE, "Trigger Early Re-establishment if N/W not responding for 10 consecutive A3 MR.", "Disabled", "Enabled", 0)
+#endif
+
+/****** SBP Document BEGIN ************************************************************************
+<SBP title="SBP_ENABLE_PINGPONG_BAR_NR_IRAT - Enable NR IRAT ping-pong-bar enhancement ">
+    <DESCRIPTION>
+        <PARAG>
+            Enable NR IRAT ping-pong-bar enhancement.
+        </PARAG>
+    </DESCRIPTION>
+    <CATEGORY>NR</CATEGORY>
+    <CONFIG>
+        <VALUE value="0">Not Enabled</VALUE>
+        <VALUE value="1">Enabled</VALUE>
+    </CONFIG>
+    <DEFAULT>0</DEFAULT>
+    <OP>N/A</OP>
+    <DEPENDENCY>if compile option __ENABLE_PINGPONG_BAR_NR_IRAT__ is defined, the SBP is enabled</DEPENDENCY>
+    <NOTE>N/A</NOTE>
+    <AUTHOR>mtk02689</AUTHOR>
+</SBP>
+******* SBP Document END **************************************************************************/
+#if defined(__ENABLE_PINGPONG_BAR_NR_IRAT__)
+    SBP_FEATURE_DEF(SBP_ENABLE_PINGPONG_BAR_NR_IRAT, SBP_ATTR_NONE, "Enable NR IRAT ping-pong-bar enhancement", "Not Enabled", "Enabled", 1)
+#else
+    SBP_FEATURE_DEF(SBP_ENABLE_PINGPONG_BAR_NR_IRAT, SBP_ATTR_NONE, "Enable NR IRAT ping-pong-bar enhancement", "Not Enabled", "Enabled", 0)
+#endif
+
+/****** SBP Document BEGIN ************************************************************************
+<SBP title="SBP_NR_BAR_CELL_NW_REJECT_WITH_LONG_WAIT_TIME">
+    <DESCRIPTION>
+        <PARAG>
+            When this SBP is turned on, NR serving cell is set as barred,
+            if RRC connection establishment is rejected constantly
+            by the NW with a long wait time.
+        </PARAG>
+    </DESCRIPTION>
+    <CATEGORY>NR</CATEGORY>
+    <CONFIG>
+        <VALUE value="0">Disabled</VALUE>
+        <VALUE value="1">Enabled</VALUE>
+    </CONFIG>
+    <DEFAULT>0</DEFAULT>
+    <OP>N/A</OP>
+    <DEPENDENCY>N/A</DEPENDENCY>
+    <NOTE>N/A</NOTE>
+    <AUTHOR>mtk11329</AUTHOR>
+</SBP>
+******* SBP Document END **************************************************************************/
+SBP_FEATURE_DEF(SBP_NR_BAR_CELL_NW_REJECT_WITH_LONG_WAIT_TIME, SBP_ATTR_NONE, "Set NR serving cell as barred, if RRC conn. est. is rejected by NW with a long wait time.", "Disabled", "Enabled", 0)
+
+/****** SBP Document BEGIN ************************************************************************
+<SBP title="MULTIPLE_APN_REQUIREMENT - Multiple APNs for each protocol type.">
+    <DESCRIPTION>
+        <PARAG>
+            MOLY00379474: PDP_type of IA PDN conflicts with User APN setting, TC3 acquires us to activate another type of PDN.
+            ALPS05666551: TMO test needs to reject PDN reuse due to protocol type conflict.
+        </PARAG>
+    </DESCRIPTION>
+    <CATEGORY>EAS</CATEGORY>
+    <CONFIG>
+        <VALUE value="0">Disable. </VALUE>
+        <VALUE value="1">Enable. </VALUE>
+    </CONFIG>
+    <DEFAULT>0</DEFAULT>
+    <OP>N/A</OP>
+    <DEPENDENCY>N/A</DEPENDENCY>
+    <NOTE>None</NOTE>
+    <AUTHOR>mtk13643</AUTHOR>
+</SBP>
+******* SBP Document END **************************************************************************/
+#ifdef __MULTIPLE_APN_REQUIREMENT__
+    SBP_FEATURE_DEF(SBP_MULTIPLE_APN_REQUIREMENT, SBP_ATTR_NONE, "Multiple APN feature is enable.", "Disabled", "Enabled", 1)
+#else
+    SBP_FEATURE_DEF(SBP_MULTIPLE_APN_REQUIREMENT, SBP_ATTR_NONE, "Multiple APN feature is disable.", "Disabled", "Enabled", 0)
+#endif
+
+/****** SBP Document BEGIN ************************************************************************
+<SBP title="SBP_VGMM_BYPASS_SR_BLOCK_IN_CONNECTED">
+    <DESCRIPTION>
+        <PARAG>
+        Seldomly in RJIO, NW would not response SR, because NW does not receive PDU RELEASE COMPLETE yet.
+        When this SBP is on, if UE is in connected, VGMM will send VGSM PDU RELEASE COMPLETE to NW evenif the other SR is ongoing.
+        This SBP is only used in RJIO.
+        </PARAG>
+    </DESCRIPTION>
+    <CATEGORY>NAS</CATEGORY>
+    <CONFIG>
+        <VALUE value="0">Disable </VALUE>
+        <VALUE value="1">Enable </VALUE>
+    </CONFIG>
+    <DEFAULT>0</DEFAULT>
+    <OP>N/A</OP>
+    <DEPENDENCY>N/A</DEPENDENCY>
+    <NOTE>None</NOTE>
+    <AUTHOR>mtk16210</AUTHOR>
+</SBP>
+******* SBP Document END **************************************************************************/
+#ifdef __SBP_VGMM_BYPASS_SR_BLOCK_IN_CONNECTED__
+    SBP_FEATURE_DEF(SBP_VGMM_BYPASS_SR_BLOCK_IN_CONNECTED, SBP_ATTR_NONE, "Enable VGMM bypss SR block in connected", "Disabled", "Enabled", 1)
+#else
+    SBP_FEATURE_DEF(SBP_VGMM_BYPASS_SR_BLOCK_IN_CONNECTED, SBP_ATTR_NONE, "Enable VGMM bypss SR block in connected", "Disabled", "Enabled", 0)
+#endif
+
+/****** SBP Document BEGIN ************************************************************************
+<SBP title="SBP_L5SMS_CBM_ALL_CLOSE_DEFAULT">
+    <DESCRIPTION>
+        <PARAG> make all 3gpp CBM close in low layer defaultly. Low layer would not receive the CBM and not notify L5(not to HOST). make this as 1 could save resource
+        </PARAG>
+    </DESCRIPTION>
+    <CATEGORY>NAS</CATEGORY>
+    <CONFIG>
+        <VALUE value="0">Disable. </VALUE>
+        <VALUE value="1">Enable. </VALUE>
+    </CONFIG>
+    <DEFAULT>Disable</DEFAULT>
+    <OP>N/A</OP>
+    <DEPENDENCY>N/A</DEPENDENCY>
+    <NOTE>None</NOTE>
+    <AUTHOR>mtk14954</AUTHOR>
+</SBP>
+******* SBP Document END **************************************************************************/
+SBP_FEATURE_DEF(SBP_L5SMS_CBM_ALL_CLOSE_DEFAULT, SBP_ATTR_NONE, "make all 3gpp CBM close in low layer defaultly", "DISABLE", "ENABLE", 0)
+
+/****** SBP Document BEGIN ************************************************************************
+<SBP title="SBP_DISABLE_SIB12_FOR_CMAS_DISABLE - Disable SIB12 reception when CMAS is disabled from Higher layers">
+    <DESCRIPTION>
+        <PARAG>
+        If this SBP is turn ON, UE doesn't  receive SIB12 when CMAS is disabled from Higher layers.
+        </PARAG>
+    </DESCRIPTION>
+    <CATEGORY>EAS</CATEGORY>
+    <CONFIG>
+        <VALUE value="0">Disable. UE receive SIB12 when CMAS is disabled from Higher layers. </VALUE>
+        <VALUE value="1">Enable. UE doesn't  receive SIB12 when CMAS is disabled from Higher layers. </VALUE>
+    </CONFIG>
+    <DEFAULT>0</DEFAULT>
+    <OP>N/A</OP>
+    <DEPENDENCY>
+    </DEPENDENCY>
+    <NOTE>
+    </NOTE>
+    <AUTHOR>mtk25376</AUTHOR>
+</SBP>
+******* SBP Document END **************************************************************************/
+#ifdef __DISABLE_SIB12_FOR_CMAS_DISABLE__
+SBP_FEATURE_DEF(SBP_DISABLE_SIB12_FOR_CMAS_DISABLE, SBP_ATTR_NONE, "Disable SIB12 reception when CMAS is disabled from Higher layers", "Disable", "Enable", 1)
+#else
+SBP_FEATURE_DEF(SBP_DISABLE_SIB12_FOR_CMAS_DISABLE, SBP_ATTR_NONE, "Disable SIB12 reception when CMAS is disabled from Higher layers", "Disable", "Enable", 0)
+#endif
+
+/****** SBP Document BEGIN ************************************************************************
+<SBP title="SBP_NR_TO_LTE_B1B2_CUSTOM_CELL_THRESH_FOR_VONR - additional pcell/ncell custom threshold check for B1/B2 report when under VoNR ongoing ">
+    <DESCRIPTION>
+        <PARAG>
+            Enable/Disable additional pcell/ncell custom threshold check for B1/B2 report when under VoNR ongoing.
+        </PARAG>
+    </DESCRIPTION>
+    <CATEGORY>NR</CATEGORY>
+    <CONFIG>
+        <VALUE value="0">Not Enabled</VALUE>
+        <VALUE value="1">Enabled</VALUE>
+    </CONFIG>
+    <DEFAULT>0</DEFAULT>
+    <OP>N/A</OP>
+    <DEPENDENCY>if compile option __ENABLE_NR_TO_LTE_B1B2_CUSTOM_CELL_THRESH_FOR_VONR__ is defined, the SBP is enabled</DEPENDENCY>
+    <NOTE>N/A</NOTE>
+    <AUTHOR>mtk12473</AUTHOR>
+</SBP>
+******* SBP Document END **************************************************************************/
+#if defined(__ENABLE_NR_TO_LTE_B1B2_CUSTOM_CELL_THRESH_FOR_VONR__)
+    SBP_FEATURE_DEF(SBP_NR_TO_LTE_B1B2_CUSTOM_CELL_THRESH_FOR_VONR, SBP_ATTR_NONE, "additional pcell/ncell custom threshold check for B1/B2 report when under VoNR ongoing", "Not Enabled", "Enabled", 1)
+#else
+    SBP_FEATURE_DEF(SBP_NR_TO_LTE_B1B2_CUSTOM_CELL_THRESH_FOR_VONR, SBP_ATTR_NONE, "additional pcell/ncell custom threshold check for B1/B2 report when under VoNR ongoing", "Not Enabled", "Enabled", 0)
+#endif
+
+SBP_FEATURE_DEF_END(170)
+
+/* 172st byte*/
+SBP_FEATURE_DEF_BEGIN(171)
+
+/****** SBP Document BEGIN ************************************************************************
+<SBP title="SBP_NR_CUSTOM_A2_THRESH_ADJUST_FOR_VONR - additional pcell custom thresh and a2 threshold for A2 report when under VoNR ongoing ">
+    <DESCRIPTION>
+        <PARAG>
+            Enable/Disable additional pcell custom thresh and a2 threshold for A2 report when under VoNR ongoing.
+        </PARAG>
+    </DESCRIPTION>
+    <CATEGORY>NR</CATEGORY>
+    <CONFIG>
+        <VALUE value="0">Not Enabled</VALUE>
+        <VALUE value="1">Enabled</VALUE>
+    </CONFIG>
+    <DEFAULT>0</DEFAULT>
+    <OP>N/A</OP>
+    <DEPENDENCY>if compile option __ENABLE_NR_CUSTOM_A2_THRESH_ADJUST_FOR_VONR__ is defined, the SBP is enabled</DEPENDENCY>
+    <NOTE>N/A</NOTE>
+    <AUTHOR>mtk12473</AUTHOR>
+</SBP>
+******* SBP Document END **************************************************************************/
+#if defined(__ENABLE_NR_CUSTOM_A2_THRESH_ADJUST_FOR_VONR__)
+    SBP_FEATURE_DEF(SBP_NR_CUSTOM_A2_THRESH_ADJUST_FOR_VONR, SBP_ATTR_NONE, "additional pcell custom thresh and a2 threshold for A2 report when under VoNR ongoing", "Not Enabled", "Enabled", 1)
+#else
+    SBP_FEATURE_DEF(SBP_NR_CUSTOM_A2_THRESH_ADJUST_FOR_VONR, SBP_ATTR_NONE, "additional pcell custom thresh and a2 threshold for A2 report when under VoNR ongoing", "Not Enabled", "Enabled", 0)
+#endif
+
+/****** SBP Document BEGIN ************************************************************************
+<SBP title="SBP_OP12_ONSITE_LTE_UICC">
+    <DESCRIPTION>
+        <PARAG>
+            If the ICCID begins with 89999480, the device consider the UICC to be an "On Site LTE UICC".
+            The device shall not only comply with all existing LTE device requirements defined OP12 Wireless,
+            but also follow the data-centric and/or IMS-less requirements.
+        </PARAG>
+    </DESCRIPTION>
+    <CONFIG>
+       <VALUE value="0">Disable to check if this SIM is OP12 onsite UICC</VALUE>
+       <VALUE value="1">Enable to check if this SIM is OP12 onsite UICC</VALUE>
+    </CONFIG>
+    <CATEGORY>L4</CATEGORY>
+    <DEFAULT>0</DEFAULT>
+    <OP>OP12</OP>
+    <DEPENDENCY>N/A</DEPENDENCY>
+    <NOTE>IS_VIOLATE_STANDARD=N</NOTE>
+    <AUTHOR>mtk22699</AUTHOR>
+</SBP>
+******* SBP Document END **************************************************************************/
+#if defined(__SBP_ENABLE_OP12_ONSITE_LTE_UICC__)
+    SBP_FEATURE_DEF(SBP_OP12_ONSITE_LTE_UICC, SBP_ATTR_NONE, "this SIM is OP12 onsite UICC", "Disabled", "Enabled", 1)
+#else
+    SBP_FEATURE_DEF(SBP_OP12_ONSITE_LTE_UICC, SBP_ATTR_NONE, "this SIM is OP12 onsite UICC", "Disabled", "Enabled", 0)
+#endif
+
+/****** SBP Document BEGIN ************************************************************************
+<SBP title="SBP_L5_SIM_REPORT_REQUESTED_PIN_TYPE_WHEN_BLOCKED">
+    <DESCRIPTION>
+        <PARAG>
+            when verify pin fail max times and blocked:
+            1.If sbp on, reported pin type is the same as in the request and remaining_attempts is 0.
+            2.If sbp off, reported pin type is the puk corresponding to the pin type in the request and remaining_attempts is puk remaining times.
+        </PARAG>
+    </DESCRIPTION>
+    <CONFIG>
+       <VALUE value="0">report pin type puk and puk remain_attemps</VALUE>
+       <VALUE value="1">report pin type pin and pin remain_attemps 0</VALUE>
+    </CONFIG>
+    <CATEGORY>MIPC</CATEGORY>
+    <DEFAULT>0</DEFAULT>
+    <OP>N/A</OP>
+    <DEPENDENCY>
+        This SBP can be controlled by compile option __L5_SIM_REPORT_REQUESTED_PIN_TYPE_WHEN_BLOCKED__
+    </DEPENDENCY>
+    <NOTE>
+        None
+        IS_VIOLATE_STANDARD=N
+    </NOTE>
+    <AUTHOR>mtk21075</AUTHOR>
+</SBP>
+******* SBP Document END **************************************************************************/
+#ifdef __L5_SIM_REPORT_REQUESTED_PIN_TYPE_WHEN_BLOCKED__
+    SBP_FEATURE_DEF(SBP_L5_SIM_REPORT_REQUESTED_PIN_TYPE_WHEN_BLOCKED, SBP_ATTR_NONE, "report pin type is the same as in the request and remaining_attempts is 0 when verify pin fail max times and blocked", "Disabled", "Enabled", 1)
+#else
+    SBP_FEATURE_DEF(SBP_L5_SIM_REPORT_REQUESTED_PIN_TYPE_WHEN_BLOCKED, SBP_ATTR_NONE, "report pin type is the same as in the request and remaining_attempts is 0 when verify pin fail max times and blocked", "Disabled", "Enabled", 0)
+#endif
+
+/****** SBP Document BEGIN ************************************************************************
+<SBP title="SBP_L5_SIM_REPORT_SIM_STATUS_IND_WHEN_VERIFY_FAIL_TO_BLOCKED">
+    <DESCRIPTION>
+        <PARAG>
+            1.If sbp on, modem will send sim status ind to AP when verify pin failed max times and changed to PUK
+            2.If sbp off, modem will not send sim status ind to AP when verify pin failed max times and changed to PUK
+        </PARAG>
+    </DESCRIPTION>
+    <CONFIG>
+       <VALUE value="0">off</VALUE>
+       <VALUE value="1">on</VALUE>
+    </CONFIG>
+    <CATEGORY>MIPC</CATEGORY>
+    <DEFAULT>0</DEFAULT>
+    <OP>N/A</OP>
+    <DEPENDENCY>
+        This SBP can be controlled by compile option __L5_SIM_REPORT_SIM_STATUS_IND_WHEN_VERIFY_FAIL_TO_BLOCKED__
+    </DEPENDENCY>
+    <NOTE>
+        None
+        IS_VIOLATE_STANDARD=N
+    </NOTE>
+    <AUTHOR>mtk21075</AUTHOR>
+</SBP>
+******* SBP Document END **************************************************************************/
+#ifdef __L5_SIM_REPORT_SIM_STATUS_IND_WHEN_VERIFY_FAIL_TO_BLOCKED__
+    SBP_FEATURE_DEF(SBP_L5_SIM_REPORT_SIM_STATUS_IND_WHEN_VERIFY_FAIL_TO_BLOCKED, SBP_ATTR_NONE, "when verify fail to block and send ind", "Disabled", "Enabled", 1)
+#else
+    SBP_FEATURE_DEF(SBP_L5_SIM_REPORT_SIM_STATUS_IND_WHEN_VERIFY_FAIL_TO_BLOCKED, SBP_ATTR_NONE, "when verify fail to block and send ind", "Disabled", "Enabled", 0)
+#endif
+
+/****** SBP Document BEGIN *****************************************************************************
+<SBP title="SBP_TPC_ETM_TRIGGER_EARLIER_FOR_MT6308H">
+    <DESCRIPTION>
+        <PARAG>
+            1. This feaure is to resolve MT6308H's HW limition issue.
+            2. When UL power difference is large between different channnels, there is an undershoot issue for MT6308H, TPC would trigger ETM bias earlier than normal scenario.
+        </PARAG>
+    </DESCRIPTION>
+    <CATEGORY>RF</CATEGORY>
+    <CONFIG>
+        <VALUE value="0">Disable</VALUE>
+        <VALUE value="1">Enable</VALUE>
+    </CONFIG>
+    <DEFAULT>0</DEFAULT>
+    <OP>Verizon</OP>
+    <DEPENDENCY>N/A</DEPENDENCY>
+    <NOTE>
+     N/A
+    </NOTE>
+    <AUTHOR>mtk11568</AUTHOR>
+</SBP>
+******* SBP Document END **************************************************************************/
+  SBP_FEATURE_DEF(SBP_TPC_ETM_TRIGGER_EARLIER_FOR_MT6308H, SBP_ATTR_NONE, "Enable TPC trigger ETM Bias earlier", "Disable", "Enable", 1)
+
+/****** SBP Document BEGIN ************************************************************************
+<SBP title="SBP_4G5_MRU_PREFER_UL_DATA_STATUS">
+    <DESCRIPTION>
+        <PARAG>
+            Wait TFTPF matching result before IRAT MRU start. So uplink_data_status may set correctly in registration request.
+        </PARAG>
+    </DESCRIPTION>
+    <CONFIG>
+       <VALUE value="0">Disable</VALUE>
+       <VALUE value="1">Enable</VALUE>
+    </CONFIG>
+    <CATEGORY>NAS</CATEGORY>
+    <DEFAULT>0</DEFAULT>
+    <OP>N/A</OP>
+    <DEPENDENCY>N/A</DEPENDENCY>
+    <NOTE>N/A</NOTE>
+    <AUTHOR>mtk13167</AUTHOR>
+</SBP>
+******* SBP Document END **************************************************************************/
+#ifdef __SBP_4G5_MRU_PREFER_UL_DATA_STATUS__
+    SBP_FEATURE_DEF(SBP_4G5_MRU_PREFER_UL_DATA_STATUS, SBP_ATTR_NONE, "prefer uplink data status in 4G5 HO MRU", "Disabled", "Enabled", 1)
+#else
+    SBP_FEATURE_DEF(SBP_4G5_MRU_PREFER_UL_DATA_STATUS, SBP_ATTR_NONE, "prefer uplink data status in 4G5 HO MRU", "Disabled", "Enabled", 0)
+#endif
+
+/****** SBP Document BEGIN ************************************************************************
+<SBP title="SBP_ENABLE_PHB_DUMP_LOGGING - Logging of PHB dump data.">
+    <DESCRIPTION>
+        <PARAG> 
+        If this SBP is enabled, then the PHB dump data logging will be enabled.
+        If this SBP is disabled, then the PHB dump data logging will be disabled.
+        </PARAG>
+    </DESCRIPTION>
+    <CATEGORY>L4</CATEGORY>
+    <CONFIG>
+        <VALUE value="0">Disable. </VALUE>
+        <VALUE value="1">Enable. </VALUE>
+    </CONFIG>
+    <DEFAULT>Disable</DEFAULT>
+    <OP>N/A</OP>
+    <DEPENDENCY>N/A</DEPENDENCY>
+    <NOTE>None</NOTE>
+    <AUTHOR>mtk15332</AUTHOR>
+</SBP>
+******* SBP Document END **************************************************************************/
+#if defined(__ENABLE_PHB_DUMP_LOGGING__)
+    SBP_FEATURE_DEF(SBP_ENABLE_PHB_DUMP_LOGGING, SBP_ATTR_NONE, "Enables the logging of PHB dump data", "Disabled", "Enabled", 1)
+#else
+    SBP_FEATURE_DEF(SBP_ENABLE_PHB_DUMP_LOGGING, SBP_ATTR_NONE, "Disables the logging of PHB dump data", "Disabled", "Enabled", 0)
+#endif
+
+/****** SBP Document BEGIN ************************************************************************
+<SBP title="SBP_SDAP_AS_REFLECTIVE_QOS_SUPPORT - UE supports SDAP AS Reflective QoS (AS RQoS)">
+    <DESCRIPTION>
+        <PARAG>
+            Under NR SA, configuration for NRRC capability SDAP as-ReflectiveQoS.
+            When this SBP is enabled, UE supports SDAP AS Reflective QoS (AS RQoS).
+            Please refer to TS 37.324 for detail.
+        </PARAG>
+    </DESCRIPTION>
+    <CATEGORY>AS</CATEGORY>
+    <CONFIG>
+        <VALUE value="0">Not supported: UE does not support SDAP AS Reflective QoS</VALUE>
+        <VALUE value="1">Supported: UE supports SDAP AS Reflective QoS</VALUE>
+    </CONFIG>
+    <DEFAULT>1</DEFAULT>
+    <OP>N/A</OP>
+    <DEPENDENCY>N/A</DEPENDENCY>
+    <NOTE>N/A</NOTE>
+    <AUTHOR>mtk16615</AUTHOR>
+</SBP>
+******* SBP Document END **************************************************************************/
+    SBP_FEATURE_DEF(SBP_SDAP_AS_REFLECTIVE_QOS_SUPPORT, SBP_ATTR_NONE, "UE supports SDAP AS Reflective QoS", "Not supported", "Supported", 1)
+
+SBP_FEATURE_DEF_END(171)
+
+/* 173rd byte*/
+SBP_FEATURE_DEF_BEGIN(172)
+
+/****** SBP Document BEGIN ************************************************************************
+<SBP title="SBP_NAS_SV_RAT_CAP_CONTROL_BY_MRS_CONFIG - To disable RAT capability according to mrs rat cap config ">
+    <DESCRIPTION>
+        <PARAG> To disable RAT capability according to mrs rat cap config. </PARAG>
+    </DESCRIPTION>
+    <CATEGORY>NAS</CATEGORY>
+    <CONFIG>
+        <VALUE value="0">Not Enabled</VALUE>
+        <VALUE value="1">Enabled</VALUE>
+    </CONFIG>
+    <DEFAULT>1</DEFAULT>
+    <OP>N/A</OP>
+    <DEPENDENCY>N/A</DEPENDENCY>
+    <NOTE>
+    IS_VIOLATE_STANDARD=N
+    </NOTE>
+    <AUTHOR>mtk14832</AUTHOR>
+</SBP>
+******* SBP Document END **************************************************************************/
+#ifdef _DISABLE_NAS_SV_RAT_CAP_CONTROL_BY_MRS_CONFIG_
+   SBP_FEATURE_DEF(SBP_NAS_SV_RAT_CAP_CONTROL_BY_MRS_CONFIG, SBP_ATTR_NONE, "disable the feature.",  "Not Enabled", "Enabled", 0)
+#else
+   SBP_FEATURE_DEF(SBP_NAS_SV_RAT_CAP_CONTROL_BY_MRS_CONFIG, SBP_ATTR_NONE, "enable the feature.",  "Not Enabled", "Enabled", 1)
+#endif
+
+SBP_FEATURE_DEF_END(172)
+
 #undef SBP_FEATURE_DEF_BEGIN
 #undef SBP_FEATURE_DEF
 #undef SBP_FEATURE_DEF_END
diff --git a/mcu/interface/service/sbp/sbp_public_utility.h b/mcu/interface/service/sbp/sbp_public_utility.h
index cf10b33..bbc0b7b 100755
--- a/mcu/interface/service/sbp/sbp_public_utility.h
+++ b/mcu/interface/service/sbp/sbp_public_utility.h
@@ -535,6 +535,7 @@
     SBP_ID_ALIV = 359,
     SBP_ID_CTEXCEL = 360,
     SBP_ID_BMOBILE = 362,
+	SBP_ID_CBN = 388,
 	SBP_ID_LICT = 398,
 
     /* Lab testing SBP ID */