[rdkb][common][bsp][Refactor and sync wifi from openwrt]

[Description]
1dacd97b [MAC80211][WiFi6][Misc][Fix patch fail]
7c02334a [MAC80211][WiFi7][Misc][Fix build fail because of mt76 version upgradation]
7a073097 [MAC80211][WiFi7][misc][ensure the first MLD bss is bss[0]]
27e2304c [MAC80211][WiFi6][mt76][Refactor due to atenl change]
1e1eb98e [MAC80211][WiFi6/7][app][Add single wiphy support for atenl & iwpriv wrapper]
d4101c33 [MAC80211][WiFi7][mt76][enable lftp for wifi7 r1 cert]
55f5732f [MAC80211][WiFi7][hostapd][set ctrl_interface for all bss]

[Release-log]

Change-Id: I9cad01561c310576a9e5bdc9f1b8eec3025e51d9
diff --git a/recipes-wifi/linux-mt76/files/patches-3.x/0086-wifi-mt76-mt7996-switch-to-per-link-data-structure-o.patch b/recipes-wifi/linux-mt76/files/patches-3.x/0086-wifi-mt76-mt7996-switch-to-per-link-data-structure-o.patch
index e8d7384..7256cb2 100644
--- a/recipes-wifi/linux-mt76/files/patches-3.x/0086-wifi-mt76-mt7996-switch-to-per-link-data-structure-o.patch
+++ b/recipes-wifi/linux-mt76/files/patches-3.x/0086-wifi-mt76-mt7996-switch-to-per-link-data-structure-o.patch
@@ -1,2320 +1,2430 @@
-From 175bf6b7c7eabfb45f6618b17d19c475a1e0916e Mon Sep 17 00:00:00 2001
+From 88111ec93e8bfd47f020965dd075849bd2233e40 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Fri, 24 Nov 2023 11:31:55 +0800
+Date: Mon, 27 Nov 2023 10:43:34 +0800
 Subject: [PATCH 086/116] wifi: mt76: mt7996: switch to per-link data structure
- of vif
+ of sta
 
-Introduce struct mt7996_bss_conf, data structure for per-link BSS.
-Note that mt7996_vif now represents a legacy or MLD device.
+Introduce struct mt7996_link_sta, data structure for per-link STA.
+Note that mt7996_sta now represents a peer legacy or MLD device.
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
 Co-developed-by: Bo Jiao <Bo.Jiao@mediatek.com>
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
- mt7996/debugfs.c  |  10 +-
- mt7996/init.c     |   4 +-
- mt7996/mac.c      |  25 ++-
- mt7996/main.c     | 269 ++++++++++++++++++-----------
- mt7996/mcu.c      | 429 +++++++++++++++++++++++-----------------------
- mt7996/mt7996.h   |  72 +++++---
- mt7996/testmode.c |  17 +-
- 7 files changed, 463 insertions(+), 363 deletions(-)
+ mt7615/mcu.c      |   4 +-
+ mt76_connac_mcu.c |  18 +-
+ mt76_connac_mcu.h |   7 +-
+ mt7915/mcu.c      |   4 +-
+ mt7925/mcu.c      |   4 +-
+ mt7996/debugfs.c  |  20 ++-
+ mt7996/mac.c      | 109 ++++++------
+ mt7996/main.c     | 223 +++++++++++++++---------
+ mt7996/mcu.c      | 430 ++++++++++++++++++++++++----------------------
+ mt7996/mt7996.h   |  44 +++--
+ mt7996/testmode.c |   6 +-
+ 11 files changed, 482 insertions(+), 387 deletions(-)
 
+diff --git a/mt7615/mcu.c b/mt7615/mcu.c
+index a931066..8f4f203 100644
+--- a/mt7615/mcu.c
++++ b/mt7615/mcu.c
+@@ -862,8 +862,8 @@ mt7615_mcu_wtbl_sta_add(struct mt7615_phy *phy, struct ieee80211_vif *vif,
+ 		else
+ 			mvif->sta_added = true;
+ 	}
+-	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, sskb, vif, sta, enable,
+-				      new_entry);
++	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, sskb, vif, &sta->deflink,
++				      enable, new_entry);
+ 	if (enable && sta)
+ 		mt76_connac_mcu_sta_tlv(phy->mt76, sskb, sta, vif, 0,
+ 					MT76_STA_INFO_STATE_ASSOC);
+diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
+index 0c7b693..d83d314 100644
+--- a/mt76_connac_mcu.c
++++ b/mt76_connac_mcu.c
+@@ -371,9 +371,10 @@ EXPORT_SYMBOL_GPL(mt76_connac_mcu_bss_omac_tlv);
+ 
+ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+ 				   struct ieee80211_vif *vif,
+-				   struct ieee80211_sta *sta,
++				   struct ieee80211_link_sta *link_sta,
+ 				   bool enable, bool newly)
+ {
++	struct ieee80211_sta *sta = link_sta ? link_sta->sta : NULL;
+ 	struct sta_rec_basic *basic;
+ 	struct tlv *tlv;
+ 	int conn_type;
+@@ -431,7 +432,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+ 		break;
+ 	}
+ 
+-	memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
++	memcpy(basic->peer_addr, link_sta->addr, ETH_ALEN);
+ 	basic->qos = sta->wme;
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_basic_tlv);
+@@ -1055,7 +1056,7 @@ int mt76_connac_mcu_sta_cmd(struct mt76_phy *phy,
+ 		return PTR_ERR(skb);
+ 
+ 	if (info->sta || !info->offload_fw)
+-		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif, info->sta,
++		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif, &info->sta->deflink,
+ 					      info->enable, info->newly);
+ 	if (info->sta && info->enable)
+ 		mt76_connac_mcu_sta_tlv(phy, skb, info->sta,
+@@ -1306,7 +1307,8 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
+ EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_ba);
+ 
+ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
+-			    enum nl80211_band band, struct ieee80211_sta *sta)
++			    enum nl80211_band band,
++			    struct ieee80211_link_sta *link_sta)
+ {
+ 	struct mt76_dev *dev = phy->dev;
+ 	const struct ieee80211_sta_he_cap *he_cap;
+@@ -1317,10 +1319,10 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
+ 	if (is_connac_v1(dev))
+ 		return 0x38;
+ 
+-	if (sta) {
+-		ht_cap = &sta->deflink.ht_cap;
+-		vht_cap = &sta->deflink.vht_cap;
+-		he_cap = &sta->deflink.he_cap;
++	if (link_sta) {
++		ht_cap = &link_sta->ht_cap;
++		vht_cap = &link_sta->vht_cap;
++		he_cap = &link_sta->he_cap;
+ 	} else {
+ 		struct ieee80211_supported_band *sband;
+ 
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index c19f8e0..740b9f5 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1910,8 +1910,8 @@ int mt76_connac_mcu_set_channel_domain(struct mt76_phy *phy);
+ int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif);
+ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+ 				   struct ieee80211_vif *vif,
+-				   struct ieee80211_sta *sta, bool enable,
+-				   bool newly);
++				   struct ieee80211_link_sta *link_sta,
++				   bool enable, bool newly);
+ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+ 				      struct ieee80211_vif *vif,
+ 				      struct ieee80211_sta *sta, void *sta_wtbl,
+@@ -2019,7 +2019,8 @@ mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif);
+ const struct ieee80211_sta_eht_cap *
+ mt76_connac_get_eht_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif);
+ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
+-			    enum nl80211_band band, struct ieee80211_sta *sta);
++			    enum nl80211_band band,
++			    struct ieee80211_link_sta *link_sta);
+ u8 mt76_connac_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
+ 				enum nl80211_band band);
+ 
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 363ea0e..cb2e3b2 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -1504,7 +1504,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+ 
+ 	ra->valid = true;
+ 	ra->auto_rate = true;
+-	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
++	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, &sta->deflink);
+ 	ra->channel = chandef->chan->hw_value;
+ 	ra->bw = sta->deflink.bandwidth;
+ 	ra->phy.bw = sta->deflink.bandwidth;
+@@ -1669,7 +1669,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+ 		return PTR_ERR(skb);
+ 
+ 	/* starec basic */
+-	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, sta, enable,
++	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, &sta->deflink, enable,
+ 				      !rcu_access_pointer(dev->mt76.wcid[msta->wcid.idx]));
+ 	if (!enable)
+ 		goto out;
+diff --git a/mt7925/mcu.c b/mt7925/mcu.c
+index 652a9ac..80e1828 100644
+--- a/mt7925/mcu.c
++++ b/mt7925/mcu.c
+@@ -1626,7 +1626,7 @@ mt7925_mcu_sta_cmd(struct mt76_phy *phy,
+ 		return PTR_ERR(skb);
+ 
+ 	if (info->sta || !info->offload_fw)
+-		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif, info->sta,
++		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif, &info->sta->deflink,
+ 					      info->enable, info->newly);
+ 	if (info->sta && info->enable) {
+ 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->sta);
+@@ -2092,7 +2092,7 @@ mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
+ 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_OFDM_INDEX);
+ 
+ 	memcpy(basic_req->bssid, vif->bss_conf.bssid, ETH_ALEN);
+-	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, sta);
++	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, &sta->deflink);
+ 	basic_req->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
+ 	basic_req->dtim_period = vif->bss_conf.dtim_period;
+ 	basic_req->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 837758611..06015d686 100644
+index 06015d6..56e2192 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
-@@ -739,7 +739,7 @@ static void
+@@ -739,14 +739,15 @@ static void
  mt7996_sta_hw_queue_read(void *data, struct ieee80211_sta *sta)
  {
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
--	struct mt7996_dev *dev = msta->vif->phy->dev;
-+	struct mt7996_dev *dev = msta->vif->deflink.phy->dev;
++	struct mt7996_link_sta *mlink = &msta->deflink;
+ 	struct mt7996_dev *dev = msta->vif->deflink.phy->dev;
  	struct seq_file *s = data;
  	u8 ac;
  
+ 	for (ac = 0; ac < 4; ac++) {
+ 		u32 qlen, ctrl, val;
+-		u32 idx = msta->wcid.idx >> 5;
+-		u8 offs = msta->wcid.idx & GENMASK(4, 0);
++		u32 idx = mlink->wcid.idx >> 5;
++		u8 offs = mlink->wcid.idx & GENMASK(4, 0);
+ 
-@@ -759,7 +759,7 @@ mt7996_sta_hw_queue_read(void *data, struct ieee80211_sta *sta)
+ 		ctrl = BIT(31) | BIT(11) | (ac << 24);
+ 		val = mt76_rr(dev, MT_PLE_AC_QEMPTY(ac, idx));
+@@ -754,11 +755,11 @@ mt7996_sta_hw_queue_read(void *data, struct ieee80211_sta *sta)
+ 		if (val & BIT(offs))
+ 			continue;
+ 
+-		mt76_wr(dev, MT_FL_Q0_CTRL, ctrl | msta->wcid.idx);
++		mt76_wr(dev, MT_FL_Q0_CTRL, ctrl | mlink->wcid.idx);
+ 		qlen = mt76_get_field(dev, MT_FL_Q3_CTRL,
  				      GENMASK(11, 0));
  		seq_printf(s, "\tSTA %pM wcid %d: AC%d%d queued:%d\n",
- 			   sta->addr, msta->wcid.idx,
--			   msta->vif->mt76.wmm_idx, ac, qlen);
-+			   msta->vif->deflink.mt76.wmm_idx, ac, qlen);
+-			   sta->addr, msta->wcid.idx,
++			   sta->addr, mlink->wcid.idx,
+ 			   msta->vif->deflink.mt76.wmm_idx, ac, qlen);
  	}
  }
- 
-@@ -1023,7 +1023,7 @@ mt7996_atf_enable_set(void *data, u64 val)
- 	int ret;
- 
- 	vow->max_deficit = val ? 64 : 1;
--	ret = mt7996_mcu_set_vow_drr_ctrl(phy, NULL, VOW_DRR_CTRL_AIRTIME_DEFICIT_BOUND);
-+	ret = mt7996_mcu_set_vow_drr_ctrl(phy, NULL, NULL, VOW_DRR_CTRL_AIRTIME_DEFICIT_BOUND);
- 	if (ret)
- 		return ret;
- 
-@@ -1055,7 +1055,7 @@ mt7996_airtime_read(struct seq_file *s, void *data)
+@@ -1041,7 +1042,7 @@ mt7996_airtime_read(struct seq_file *s, void *data)
+ 	struct mt76_dev *mdev = &dev->mt76;
+ 	struct mt76_sta_stats *stats;
+ 	struct ieee80211_sta *sta;
+-	struct mt7996_sta *msta;
++	struct mt7996_link_sta *mlink;
+ 	struct mt76_wcid *wcid;
+ 	struct mt76_vif *vif;
+ 	u16 i;
+@@ -1053,9 +1054,9 @@ mt7996_airtime_read(struct seq_file *s, void *data)
+ 		if (!wcid || !wcid->sta)
+ 			continue;
  
- 		msta = container_of(wcid, struct mt7996_sta, wcid);
- 		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
--		vif = &msta->vif->mt76;
-+		vif = &msta->vif->deflink.mt76;
+-		msta = container_of(wcid, struct mt7996_sta, wcid);
+-		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
+-		vif = &msta->vif->deflink.mt76;
++		mlink = container_of(wcid, struct mt7996_link_sta, wcid);
++		sta = container_of((void *)mlink->sta, struct ieee80211_sta, drv_priv);
++		vif = &mlink->sta->vif->deflink.mt76;
  		stats = &wcid->stats;
  
  		seq_printf(s, "%pM WCID: %hu BandIdx: %hhu OmacIdx: 0x%hhx\t"
-@@ -1230,7 +1230,7 @@ static ssize_t mt7996_sta_fixed_rate_set(struct file *file,
+@@ -1230,6 +1231,7 @@ static ssize_t mt7996_sta_fixed_rate_set(struct file *file,
  #define LONG_PREAMBLE 1
  	struct ieee80211_sta *sta = file->private_data;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
--	struct mt7996_dev *dev = msta->vif->phy->dev;
-+	struct mt7996_dev *dev = msta->vif->deflink.phy->dev;
++	struct mt7996_link_sta *mlink = &msta->deflink;
+ 	struct mt7996_dev *dev = msta->vif->deflink.phy->dev;
  	struct ra_rate phy = {};
  	char buf[100];
- 	int ret;
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 6eeec3b8d..381e1292c 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -628,11 +628,11 @@ static int mt7996_vow_init(struct mt7996_phy *phy)
- 	vow->drr_quantum[6] = VOW_DRR_QUANTUM_L6;
- 	vow->drr_quantum[7] = VOW_DRR_QUANTUM_L7;
- 
--	ret = mt7996_mcu_set_vow_drr_ctrl(phy, NULL, VOW_DRR_CTRL_AIRTIME_DEFICIT_BOUND);
-+	ret = mt7996_mcu_set_vow_drr_ctrl(phy, NULL, NULL, VOW_DRR_CTRL_AIRTIME_DEFICIT_BOUND);
- 	if (ret)
- 		return ret;
- 
--	ret = mt7996_mcu_set_vow_drr_ctrl(phy, NULL, VOW_DRR_CTRL_AIRTIME_QUANTUM_ALL);
-+	ret = mt7996_mcu_set_vow_drr_ctrl(phy, NULL, NULL, VOW_DRR_CTRL_AIRTIME_QUANTUM_ALL);
- 	if (ret)
- 		return ret;
+@@ -1265,7 +1267,7 @@ static ssize_t mt7996_sta_fixed_rate_set(struct file *file,
+ 		goto out;
+ 	}
  
+-	phy.wlan_idx = cpu_to_le16(msta->wcid.idx);
++	phy.wlan_idx = cpu_to_le16(mlink->wcid.idx);
+ 	phy.gi = cpu_to_le16(gi);
+ 	phy.ltf = cpu_to_le16(ltf);
+ 	phy.ldpc = phy.ldpc ? 7 : 0;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 0879c7735..63b16f92e 100644
+index 63b16f9..3cff43d 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -897,8 +897,9 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -54,7 +54,7 @@ static const struct mt7996_dfs_radar_spec jp_radar_specs = {
+ static struct mt76_wcid *mt7996_rx_get_wcid(struct mt7996_dev *dev,
+ 					    u16 idx, bool unicast)
+ {
+-	struct mt7996_sta *sta;
++	struct mt7996_link_sta *mlink;
+ 	struct mt76_wcid *wcid;
+ 
+ 	if (idx >= ARRAY_SIZE(dev->mt76.wcid))
+@@ -67,11 +67,11 @@ static struct mt76_wcid *mt7996_rx_get_wcid(struct mt7996_dev *dev,
+ 	if (!wcid->sta)
+ 		return NULL;
+ 
+-	sta = container_of(wcid, struct mt7996_sta, wcid);
+-	if (!sta->vif)
++	mlink = container_of(wcid, struct mt7996_link_sta, wcid);
++	if (!mlink->sta->vif)
+ 		return NULL;
  
- 	if (vif) {
- 		struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+		struct mt7996_bss_conf *mconf = &mvif->deflink;
+-	return &sta->vif->sta.wcid;
++	return &mlink->wcid;
+ }
+ 
+ bool mt7996_mac_wtbl_update(struct mt7996_dev *dev, int idx, u32 mask)
+@@ -92,12 +92,11 @@ u32 mt7996_mac_wtbl_lmac_addr(struct mt7996_dev *dev, u16 wcid, u8 dw)
+ }
+ 
+ void mt7996_mac_enable_rtscts(struct mt7996_dev *dev,
+-			      struct ieee80211_vif *vif, bool enable)
++			      struct mt7996_link_sta *mlink, bool enable)
+ {
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	u32 addr;
+ 
+-	addr = mt7996_mac_wtbl_lmac_addr(dev, mvif->sta.wcid.idx, 5);
++	addr = mt7996_mac_wtbl_lmac_addr(dev, mlink->wcid.idx, 5);
+ 	if (enable)
+ 		mt76_set(dev, addr, BIT(5));
+ 	else
+@@ -349,7 +348,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
+ 	__le16 fc = 0;
+ 	int idx;
+ 	u8 hw_aggr = false;
+-	struct mt7996_sta *msta = NULL;
++	struct mt7996_link_sta *mlink = NULL;
  
--		txp->fw.bss_idx = mvif->mt76.idx;
-+		txp->fw.bss_idx = mconf->mt76.idx;
+ 	hw_aggr = status->aggr;
+ 	memset(status, 0, sizeof(*status));
+@@ -380,10 +379,10 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
+ 	status->wcid = mt7996_rx_get_wcid(dev, idx, unicast);
+ 
+ 	if (status->wcid) {
+-		msta = container_of(status->wcid, struct mt7996_sta, wcid);
++		mlink = container_of(status->wcid, struct mt7996_link_sta, wcid);
+ 		spin_lock_bh(&dev->mt76.sta_poll_lock);
+-		if (list_empty(&msta->wcid.poll_list))
+-			list_add_tail(&msta->wcid.poll_list,
++		if (list_empty(&mlink->wcid.poll_list))
++			list_add_tail(&mlink->wcid.poll_list,
+ 				      &dev->mt76.sta_poll_list);
+ 		spin_unlock_bh(&dev->mt76.sta_poll_lock);
  	}
+@@ -592,7 +591,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
+ #endif
+ 	} else {
+ 		status->flag |= RX_FLAG_8023;
+-		mt7996_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
++		mt7996_wed_check_ppe(dev, &dev->mt76.q_rx[q], mlink ? mlink->sta : NULL, skb,
+ 				     *info);
+ 	}
+ 
+@@ -942,6 +941,7 @@ static void
+ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
+ {
+ 	struct mt7996_sta *msta;
++	struct mt7996_link_sta *mlink;
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	bool is_8023 = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP;
+ 	u16 fc, tid;
+@@ -970,7 +970,8 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
+ 		return;
+ 
+ 	msta = (struct mt7996_sta *)sta->drv_priv;
+-	if (!test_and_set_bit(tid, &msta->wcid.ampdu_state))
++	mlink = rcu_dereference(msta->link[0]);
++	if (!test_and_set_bit(tid, &mlink->wcid.ampdu_state))
+ 		ieee80211_start_tx_ba_session(sta, tid, 0);
+ }
+ 
+@@ -1048,7 +1049,7 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+ 		 */
+ 		info = le32_to_cpu(*cur_info);
+ 		if (info & MT_TXFREE_INFO_PAIR) {
+-			struct mt7996_sta *msta;
++			struct mt7996_link_sta *mlink;
+ 			u16 idx;
+ 
+ 			idx = FIELD_GET(MT_TXFREE_INFO_WLAN_ID, info);
+@@ -1057,10 +1058,10 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+ 			if (!sta)
+ 				continue;
+ 
+-			msta = container_of(wcid, struct mt7996_sta, wcid);
++			mlink = container_of(wcid, struct mt7996_link_sta, wcid);
+ 			spin_lock_bh(&mdev->sta_poll_lock);
+-			if (list_empty(&msta->wcid.poll_list))
+-				list_add_tail(&msta->wcid.poll_list,
++			if (list_empty(&mlink->wcid.poll_list))
++				list_add_tail(&mlink->wcid.poll_list,
+ 					      &mdev->sta_poll_list);
+ 			spin_unlock_bh(&mdev->sta_poll_lock);
+ 			continue;
+@@ -1265,7 +1266,7 @@ out:
  
- 	txp->fw.token = cpu_to_le16(id);
-@@ -1518,12 +1519,15 @@ static void
- mt7996_update_vif_beacon(void *priv, u8 *mac, struct ieee80211_vif *vif)
+ static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
  {
- 	struct ieee80211_hw *hw = priv;
-+	struct ieee80211_bss_conf *conf = &vif->bss_conf;
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_bss_conf *mconf = &mvif->deflink;
+-	struct mt7996_sta *msta = NULL;
++	struct mt7996_link_sta *mlink;
+ 	struct mt76_wcid *wcid;
+ 	__le32 *txs_data = data;
+ 	u16 wcidx;
+@@ -1286,16 +1287,15 @@ static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
+ 	if (!wcid)
+ 		goto out;
  
- 	switch (vif->type) {
- 	case NL80211_IFTYPE_MESH_POINT:
- 	case NL80211_IFTYPE_ADHOC:
- 	case NL80211_IFTYPE_AP:
--		mt7996_mcu_add_beacon(hw, vif, vif->bss_conf.enable_beacon);
-+		mt7996_mcu_add_beacon(hw, conf, mconf, conf->enable_beacon);
- 		break;
- 	default:
- 		break;
-@@ -2237,6 +2241,8 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
- 	struct mt7996_dev *dev = container_of(work, struct mt7996_dev, rc_work);
+-	msta = container_of(wcid, struct mt7996_sta, wcid);
+-
+ 	mt7996_mac_add_txs_skb(dev, wcid, pid, txs_data);
+ 
+ 	if (!wcid->sta)
+ 		goto out;
+ 
++	mlink = container_of(wcid, struct mt7996_link_sta, wcid);
+ 	spin_lock_bh(&dev->mt76.sta_poll_lock);
+-	if (list_empty(&msta->wcid.poll_list))
+-		list_add_tail(&msta->wcid.poll_list, &dev->mt76.sta_poll_list);
++	if (list_empty(&mlink->wcid.poll_list))
++		list_add_tail(&mlink->wcid.poll_list, &dev->mt76.sta_poll_list);
+ 	spin_unlock_bh(&dev->mt76.sta_poll_lock);
+ 
+ out:
+@@ -2242,8 +2242,9 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  	struct ieee80211_sta *sta;
  	struct ieee80211_vif *vif;
-+	struct ieee80211_bss_conf *conf;
-+	struct mt7996_bss_conf *mconf;
- 	struct mt7996_sta *msta;
+ 	struct ieee80211_bss_conf *conf;
++	struct ieee80211_link_sta *link_sta;
+ 	struct mt7996_bss_conf *mconf;
+-	struct mt7996_sta *msta;
++	struct mt7996_link_sta *mlink;
  	u32 changed;
  	LIST_HEAD(list);
-@@ -2253,14 +2259,16 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+ 
+@@ -2251,24 +2252,25 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+ 	list_splice_init(&dev->sta_rc_list, &list);
  
- 		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
- 		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
-+		conf = &vif->bss_conf;
-+		mconf = &msta->vif->deflink;
+ 	while (!list_empty(&list)) {
+-		msta = list_first_entry(&list, struct mt7996_sta, rc_list);
+-		list_del_init(&msta->rc_list);
+-		changed = msta->changed;
+-		msta->changed = 0;
++		mlink = list_first_entry(&list, struct mt7996_link_sta, rc_list);
++		list_del_init(&mlink->rc_list);
++		changed = mlink->changed;
++		mlink->changed = 0;
+ 		spin_unlock_bh(&dev->mt76.sta_poll_lock);
+ 
+-		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
+-		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
++		sta = container_of((void *)mlink->sta, struct ieee80211_sta, drv_priv);
++		link_sta = &sta->deflink;
++		vif = container_of((void *)mlink->sta->vif, struct ieee80211_vif, drv_priv);
+ 		conf = &vif->bss_conf;
+-		mconf = &msta->vif->deflink;
++		mconf = &mlink->sta->vif->deflink;
  
  		if (changed & (IEEE80211_RC_SUPP_RATES_CHANGED |
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
--			mt7996_mcu_add_rate_ctrl(dev, vif, sta, true);
-+			mt7996_mcu_add_rate_ctrl(dev, conf, mconf, sta, true);
+-			mt7996_mcu_add_rate_ctrl(dev, conf, mconf, sta, true);
++			mt7996_mcu_add_rate_ctrl(dev, conf, mconf, link_sta, mlink, true);
  
  		if (changed & IEEE80211_RC_SMPS_CHANGED)
--			mt7996_mcu_set_fixed_field(dev, vif, sta, NULL,
-+			mt7996_mcu_set_fixed_field(dev, mconf, sta, NULL,
+-			mt7996_mcu_set_fixed_field(dev, mconf, sta, NULL,
++			mt7996_mcu_set_fixed_field(dev, mconf, link_sta, mlink, NULL,
  						   RATE_PARAM_MMPS_UPDATE);
  
  		spin_lock_bh(&dev->mt76.sta_poll_lock);
-@@ -2643,7 +2651,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+@@ -2561,7 +2563,7 @@ static int mt7996_mac_check_twt_req(struct ieee80211_twt_setup *twt)
+ }
+ 
+ static bool
+-mt7996_mac_twt_param_equal(struct mt7996_sta *msta,
++mt7996_mac_twt_param_equal(struct mt7996_link_sta *mlink,
+ 			   struct ieee80211_twt_params *twt_agrt)
+ {
+ 	u16 type = le16_to_cpu(twt_agrt->req_type);
+@@ -2572,10 +2574,10 @@ mt7996_mac_twt_param_equal(struct mt7996_sta *msta,
+ 	for (i = 0; i < MT7996_MAX_STA_TWT_AGRT; i++) {
+ 		struct mt7996_twt_flow *f;
+ 
+-		if (!(msta->twt.flowid_mask & BIT(i)))
++		if (!(mlink->twt.flowid_mask & BIT(i)))
+ 			continue;
+ 
+-		f = &msta->twt.flow[i];
++		f = &mlink->twt.flow[i];
+ 		if (f->duration == twt_agrt->min_twt_dur &&
+ 		    f->mantissa == twt_agrt->mantissa &&
+ 		    f->exp == exp &&
+@@ -2594,6 +2596,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+ {
+ 	enum ieee80211_twt_setup_cmd setup_cmd = TWT_SETUP_CMD_REJECT;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_link_sta *mlink;
+ 	struct ieee80211_twt_params *twt_agrt = (void *)twt->params;
+ 	u16 req_type = le16_to_cpu(twt_agrt->req_type);
+ 	enum ieee80211_twt_setup_cmd sta_setup_cmd;
+@@ -2605,11 +2608,12 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+ 		goto out;
+ 
+ 	mutex_lock(&dev->mt76.mutex);
++	mlink = mlink_dereference_protected(msta, 0);
+ 
+ 	if (dev->twt.n_agrt == MT7996_MAX_TWT_AGRT)
+ 		goto unlock;
+ 
+-	if (hweight8(msta->twt.flowid_mask) == ARRAY_SIZE(msta->twt.flow))
++	if (hweight8(mlink->twt.flowid_mask) == ARRAY_SIZE(mlink->twt.flow))
+ 		goto unlock;
+ 
+ 	if (twt_agrt->min_twt_dur < MT7996_MIN_TWT_DUR) {
+@@ -2618,10 +2622,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+ 		goto unlock;
+ 	}
+ 
+-	if (mt7996_mac_twt_param_equal(msta, twt_agrt))
++	if (mt7996_mac_twt_param_equal(mlink, twt_agrt))
+ 		goto unlock;
+ 
+-	flowid = ffs(~msta->twt.flowid_mask) - 1;
++	flowid = ffs(~mlink->twt.flowid_mask) - 1;
+ 	twt_agrt->req_type &= ~cpu_to_le16(IEEE80211_TWT_REQTYPE_FLOWID);
+ 	twt_agrt->req_type |= le16_encode_bits(flowid,
+ 					       IEEE80211_TWT_REQTYPE_FLOWID);
+@@ -2630,10 +2634,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+ 	exp = FIELD_GET(IEEE80211_TWT_REQTYPE_WAKE_INT_EXP, req_type);
+ 	sta_setup_cmd = FIELD_GET(IEEE80211_TWT_REQTYPE_SETUP_CMD, req_type);
+ 
+-	flow = &msta->twt.flow[flowid];
++	flow = &mlink->twt.flow[flowid];
+ 	memset(flow, 0, sizeof(*flow));
+ 	INIT_LIST_HEAD(&flow->list);
+-	flow->wcid = msta->wcid.idx;
++	flow->wcid = mlink->wcid.idx;
+ 	flow->table_id = table_id;
+ 	flow->id = flowid;
+ 	flow->duration = twt_agrt->min_twt_dur;
+@@ -2651,7 +2655,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  
  		flow->sched = true;
  		flow->start_tsf = mt7996_mac_twt_sched_list_add(dev, flow);
--		curr_tsf = __mt7996_get_tsf(hw, msta->vif);
-+		curr_tsf = __mt7996_get_tsf(hw, &msta->vif->deflink);
+-		curr_tsf = __mt7996_get_tsf(hw, &msta->vif->deflink);
++		curr_tsf = __mt7996_get_tsf(hw, &mlink->sta->vif->deflink);
  		div_u64_rem(curr_tsf - flow->start_tsf, interval, &rem);
  		flow_tsf = curr_tsf + interval - rem;
  		twt_agrt->twt = cpu_to_le64(flow_tsf);
-@@ -2652,7 +2660,8 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+@@ -2660,13 +2664,13 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  	}
  	flow->tsf = le64_to_cpu(twt_agrt->twt);
  
--	if (mt7996_mcu_twt_agrt_update(dev, msta->vif, flow, MCU_TWT_AGRT_ADD))
-+	if (mt7996_mcu_twt_agrt_update(dev, &msta->vif->deflink, flow,
-+				       MCU_TWT_AGRT_ADD))
+-	if (mt7996_mcu_twt_agrt_update(dev, &msta->vif->deflink, flow,
++	if (mt7996_mcu_twt_agrt_update(dev, &mlink->sta->vif->deflink, flow,
+ 				       MCU_TWT_AGRT_ADD))
  		goto unlock;
  
  	setup_cmd = TWT_SETUP_CMD_ACCEPT;
-@@ -2674,6 +2683,7 @@ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
- 				  u8 flowid)
+ 	dev->twt.table_mask |= BIT(table_id);
+-	msta->twt.flowid_mask |= BIT(flowid);
++	mlink->twt.flowid_mask |= BIT(flowid);
+ 	dev->twt.n_agrt++;
+ 
+ unlock:
+@@ -2679,26 +2683,25 @@ out:
+ }
+ 
+ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
+-				  struct mt7996_sta *msta,
+-				  u8 flowid)
++				  struct mt7996_link_sta *mlink, u8 flowid)
  {
  	struct mt7996_twt_flow *flow;
-+	struct mt7996_bss_conf *mconf = mconf_dereference_protected(msta->vif, 0);
+-	struct mt7996_bss_conf *mconf = mconf_dereference_protected(msta->vif, 0);
++	struct mt7996_bss_conf *mconf = mconf_dereference_protected(mlink->sta->vif, 0);
  
  	lockdep_assert_held(&dev->mt76.mutex);
  
+-	if (flowid >= ARRAY_SIZE(msta->twt.flow))
++	if (flowid >= ARRAY_SIZE(mlink->twt.flow))
+ 		return;
+ 
-@@ -2684,8 +2694,7 @@ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
+-	if (!(msta->twt.flowid_mask & BIT(flowid)))
++	if (!(mlink->twt.flowid_mask & BIT(flowid)))
  		return;
  
- 	flow = &msta->twt.flow[flowid];
--	if (mt7996_mcu_twt_agrt_update(dev, msta->vif, flow,
--				       MCU_TWT_AGRT_DELETE))
-+	if (mt7996_mcu_twt_agrt_update(dev, mconf, flow, MCU_TWT_AGRT_DELETE))
+-	flow = &msta->twt.flow[flowid];
++	flow = &mlink->twt.flow[flowid];
+ 	if (mt7996_mcu_twt_agrt_update(dev, mconf, flow, MCU_TWT_AGRT_DELETE))
  		return;
  
  	list_del_init(&flow->list);
-diff --git a/mt7996/main.c b/mt7996/main.c
-index c330dd479..9f61082f5 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -205,29 +205,30 @@ static int get_omac_idx(enum nl80211_iftype type, u64 mask)
- 	return -1;
+-	msta->twt.flowid_mask &= ~BIT(flowid);
++	mlink->twt.flowid_mask &= ~BIT(flowid);
+ 	dev->twt.table_mask &= ~BIT(flow->table_id);
+ 	dev->twt.n_agrt--;
  }
+@@ -2711,7 +2714,7 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
+ 	struct cfg80211_scan_request *req = phy->scan_req;
+ 	struct ieee80211_vif *vif = phy->scan_vif;
+ 	struct mt7996_vif *mvif;
+-	struct mt76_wcid *wcid;
++	struct mt7996_link_sta *mlink;
+ 	struct ieee80211_tx_info *info;
+ 	struct sk_buff *skb;
  
--static void mt7996_init_bitrate_mask(struct ieee80211_vif *vif)
-+static void mt7996_init_bitrate_mask(struct mt7996_bss_conf *mconf)
- {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	int i;
+@@ -2719,7 +2722,6 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
+ 		return;
  
--	for (i = 0; i < ARRAY_SIZE(mvif->bitrate_mask.control); i++) {
--		mvif->bitrate_mask.control[i].gi = NL80211_TXRATE_DEFAULT_GI;
--		mvif->bitrate_mask.control[i].he_gi = 0xff;
--		mvif->bitrate_mask.control[i].he_ltf = 0xff;
--		mvif->bitrate_mask.control[i].legacy = GENMASK(31, 0);
--		memset(mvif->bitrate_mask.control[i].ht_mcs, 0xff,
--		       sizeof(mvif->bitrate_mask.control[i].ht_mcs));
--		memset(mvif->bitrate_mask.control[i].vht_mcs, 0xff,
--		       sizeof(mvif->bitrate_mask.control[i].vht_mcs));
--		memset(mvif->bitrate_mask.control[i].he_mcs, 0xff,
--		       sizeof(mvif->bitrate_mask.control[i].he_mcs));
-+	for (i = 0; i < ARRAY_SIZE(mconf->bitrate_mask.control); i++) {
-+		mconf->bitrate_mask.control[i].gi = NL80211_TXRATE_DEFAULT_GI;
-+		mconf->bitrate_mask.control[i].he_gi = 0xff;
-+		mconf->bitrate_mask.control[i].he_ltf = 0xff;
-+		mconf->bitrate_mask.control[i].legacy = GENMASK(31, 0);
-+		memset(mconf->bitrate_mask.control[i].ht_mcs, 0xff,
-+		       sizeof(mconf->bitrate_mask.control[i].ht_mcs));
-+		memset(mconf->bitrate_mask.control[i].vht_mcs, 0xff,
-+		       sizeof(mconf->bitrate_mask.control[i].vht_mcs));
-+		memset(mconf->bitrate_mask.control[i].he_mcs, 0xff,
-+		       sizeof(mconf->bitrate_mask.control[i].he_mcs));
+ 	mvif = (struct mt7996_vif *)vif->drv_priv;
+-	wcid = &mvif->sta.wcid;
+ 
+ 	skb = ieee80211_probereq_get(hw, vif->addr,
+ 				     ssid->ssid, ssid->ssid_len, req->ie_len);
+@@ -2752,7 +2754,8 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
  	}
- }
  
- static int mt7996_add_interface(struct ieee80211_hw *hw,
- 				struct ieee80211_vif *vif)
- {
-+	struct ieee80211_bss_conf *conf = &vif->bss_conf;
+ 	local_bh_disable();
+-	mt76_tx(phy->mt76, NULL, wcid, skb);
++	mlink = rcu_dereference(mvif->sta.link[0]);
++	mt76_tx(phy->mt76, NULL, &mlink->wcid, skb);
+ 	local_bh_enable();
+ 
+ 	rcu_read_unlock();
+diff --git a/mt7996/main.c b/mt7996/main.c
+index bc4863d..4e5ba58 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -229,6 +229,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
+ 	struct ieee80211_bss_conf *conf = &vif->bss_conf;
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_bss_conf *mconf = &mvif->deflink;
+ 	struct mt7996_bss_conf *mconf = &mvif->deflink;
++	struct mt7996_link_sta *mlink = &mvif->sta.deflink;
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  	struct mt76_txq *mtxq;
-@@ -240,8 +241,8 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
- 	    is_zero_ether_addr(vif->addr))
- 		phy->monitor_vif = vif;
- 
--	mvif->mt76.idx = __ffs64(~dev->mt76.vif_mask);
--	if (mvif->mt76.idx >= mt7996_max_interface_num(dev)) {
-+	mconf->mt76.idx = __ffs64(~dev->mt76.vif_mask);
-+	if (mconf->mt76.idx >= mt7996_max_interface_num(dev)) {
- 		ret = -ENOSPC;
- 		goto out;
- 	}
-@@ -251,19 +252,21 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
- 		ret = -ENOSPC;
- 		goto out;
- 	}
--	mvif->mt76.omac_idx = idx;
--	mvif->phy = phy;
--	mvif->mt76.band_idx = band_idx;
--	mvif->mt76.wmm_idx = vif->type != NL80211_IFTYPE_AP;
--
--	ret = mt7996_mcu_add_dev_info(phy, vif, true);
-+	mconf->mt76.omac_idx = idx;
-+	mconf->vif = mvif;
-+	mconf->phy = phy;
-+	mconf->mt76.band_idx = band_idx;
-+	mconf->mt76.wmm_idx = vif->type != NL80211_IFTYPE_AP;
-+	mvif->dev = dev;
-+
-+	ret = mt7996_mcu_add_dev_info(phy, conf, mconf, true);
- 	if (ret)
- 		goto out;
- 
--	dev->mt76.vif_mask |= BIT_ULL(mvif->mt76.idx);
--	phy->omac_mask |= BIT_ULL(mvif->mt76.omac_idx);
-+	dev->mt76.vif_mask |= BIT_ULL(mconf->mt76.idx);
-+	phy->omac_mask |= BIT_ULL(mconf->mt76.omac_idx);
- 
--	idx = MT7996_WTBL_RESERVED - mvif->mt76.idx;
-+	idx = MT7996_WTBL_RESERVED - mconf->mt76.idx;
+@@ -268,14 +269,15 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
  
- 	INIT_LIST_HEAD(&mvif->sta.rc_list);
- 	INIT_LIST_HEAD(&mvif->sta.wcid.poll_list);
-@@ -283,24 +286,25 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
- 	}
+ 	idx = MT7996_WTBL_RESERVED - mconf->mt76.idx;
  
- 	if (vif->type != NL80211_IFTYPE_AP &&
--	    (!mvif->mt76.omac_idx || mvif->mt76.omac_idx > 3))
-+	    (!mconf->mt76.omac_idx || mconf->mt76.omac_idx > 3))
- 		vif->offload_flags = 0;
- 	vif->offload_flags |= IEEE80211_OFFLOAD_ENCAP_4ADDR;
+-	INIT_LIST_HEAD(&mvif->sta.rc_list);
+-	INIT_LIST_HEAD(&mvif->sta.wcid.poll_list);
+-	mvif->sta.wcid.idx = idx;
+-	mvif->sta.wcid.phy_idx = band_idx;
+-	mvif->sta.wcid.hw_key_idx = -1;
+-	mvif->sta.wcid.tx_info |= MT_WCID_TX_INFO_SET;
+-	mvif->sta.vif = mvif;
+-	mt76_wcid_init(&mvif->sta.wcid);
++	INIT_LIST_HEAD(&mlink->rc_list);
++	INIT_LIST_HEAD(&mlink->wcid.poll_list);
++	mlink->wcid.idx = idx;
++	mlink->wcid.phy_idx = band_idx;
++	mlink->wcid.hw_key_idx = -1;
++	mlink->wcid.tx_info |= MT_WCID_TX_INFO_SET;
++	mlink->sta = &mvif->sta;
++	mlink->sta->vif = mvif;
++	mt76_wcid_init(&mlink->wcid);
  
- 	if (phy->mt76->chandef.chan->band != NL80211_BAND_2GHZ)
--		mvif->mt76.basic_rates_idx = MT7996_BASIC_RATES_TBL + 4;
-+		mconf->mt76.basic_rates_idx = MT7996_BASIC_RATES_TBL + 4;
- 	else
--		mvif->mt76.basic_rates_idx = MT7996_BASIC_RATES_TBL;
-+		mconf->mt76.basic_rates_idx = MT7996_BASIC_RATES_TBL;
+ 	mt7996_mac_wtbl_update(dev, idx,
+ 			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
+@@ -297,14 +299,15 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
  
--	mt7996_init_bitrate_mask(vif);
-+	mt7996_init_bitrate_mask(mconf);
+ 	mt7996_init_bitrate_mask(mconf);
  
--	mt7996_mcu_add_bss_info(phy, vif, true);
-+	mt7996_mcu_add_bss_info(phy, conf, mconf, true);
+-	mt7996_mcu_add_bss_info(phy, conf, mconf, true);
++	mt7996_mcu_add_bss_info(phy, conf, mconf, mlink, true);
  	/* defer the first STA_REC of BMC entry to BSS_CHANGED_BSSID for STA
  	 * interface, since firmware only records BSSID when the entry is new
  	 */
  	if (vif->type != NL80211_IFTYPE_STATION)
--		mt7996_mcu_add_sta(dev, vif, NULL, true, true);
-+		mt7996_mcu_add_sta(dev, conf, mconf, NULL, true, true);
- 	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
-+	rcu_assign_pointer(mvif->link[0], mconf);
+-		mt7996_mcu_add_sta(dev, conf, mconf, NULL, true, true);
+-	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
++		mt7996_mcu_add_sta(dev, conf, mconf, NULL, mlink, true, true);
++	rcu_assign_pointer(dev->mt76.wcid[idx], &mlink->wcid);
+ 	rcu_assign_pointer(mvif->link[0], mconf);
++	rcu_assign_pointer(mvif->sta.link[0], mlink);
  
  out:
  	mutex_unlock(&dev->mt76.mutex);
-@@ -311,7 +315,9 @@ out:
- static void mt7996_remove_interface(struct ieee80211_hw *hw,
- 				    struct ieee80211_vif *vif)
- {
-+	struct ieee80211_bss_conf *conf;
+@@ -318,10 +321,10 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+ 	struct ieee80211_bss_conf *conf;
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_bss_conf *mconf;
- 	struct mt7996_sta *msta = &mvif->sta;
+ 	struct mt7996_bss_conf *mconf;
+-	struct mt7996_sta *msta = &mvif->sta;
++	struct mt7996_link_sta *mlink = &mvif->sta.deflink;
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
-@@ -319,24 +325,22 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+-	int idx = msta->wcid.idx;
++	int idx = mlink->wcid.idx;
  
  	cancel_delayed_work_sync(&phy->scan_work);
  
--	mt7996_mcu_add_sta(dev, vif, NULL, false, false);
--	mt7996_mcu_add_bss_info(phy, vif, false);
-+	mutex_lock(&dev->mt76.mutex);
-+
-+	conf = link_conf_dereference_protected(vif, 0);
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	mt7996_mcu_add_sta(dev, conf, mconf, NULL, false, false);
-+	mt7996_mcu_add_bss_info(phy, conf, mconf, false);
+@@ -329,8 +332,8 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+ 
+ 	conf = link_conf_dereference_protected(vif, 0);
+ 	mconf = mconf_dereference_protected(mvif, 0);
+-	mt7996_mcu_add_sta(dev, conf, mconf, NULL, false, false);
+-	mt7996_mcu_add_bss_info(phy, conf, mconf, false);
++	mt7996_mcu_add_sta(dev, conf, mconf, NULL, mlink, false, false);
++	mt7996_mcu_add_bss_info(phy, conf, mconf, mlink, false);
  
  	if (vif == phy->monitor_vif)
  		phy->monitor_vif = NULL;
- 
--	mt7996_mcu_add_dev_info(phy, vif, false);
-+	mt7996_mcu_add_dev_info(phy, conf, mconf, false);
- 
- 	rcu_assign_pointer(dev->mt76.wcid[idx], NULL);
- 
--	mutex_lock(&dev->mt76.mutex);
--
--	if (test_bit(MT76_SCANNING, &phy->mt76->state))
--		mt7996_scan_complete(phy, true);
--
--	dev->mt76.vif_mask &= ~BIT_ULL(mvif->mt76.idx);
--	phy->omac_mask &= ~BIT_ULL(mvif->mt76.omac_idx);
--	mutex_unlock(&dev->mt76.mutex);
-+	dev->mt76.vif_mask &= ~BIT_ULL(mconf->mt76.idx);
-+	phy->omac_mask &= ~BIT_ULL(mconf->mt76.omac_idx);
+@@ -343,12 +346,13 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+ 	phy->omac_mask &= ~BIT_ULL(mconf->mt76.omac_idx);
  
  	spin_lock_bh(&dev->mt76.sta_poll_lock);
- 	if (!list_empty(&msta->wcid.poll_list))
-@@ -344,6 +348,9 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+-	if (!list_empty(&msta->wcid.poll_list))
+-		list_del_init(&msta->wcid.poll_list);
++	if (!list_empty(&mlink->wcid.poll_list))
++		list_del_init(&mlink->wcid.poll_list);
  	spin_unlock_bh(&dev->mt76.sta_poll_lock);
  
- 	mt76_wcid_cleanup(&dev->mt76, &msta->wcid);
-+	rcu_assign_pointer(mvif->link[0], NULL);
-+
-+	mutex_unlock(&dev->mt76.mutex);
- }
+-	mt76_wcid_cleanup(&dev->mt76, &msta->wcid);
++	mt76_wcid_cleanup(&dev->mt76, &mlink->wcid);
+ 	rcu_assign_pointer(mvif->link[0], NULL);
++	rcu_assign_pointer(mvif->sta.link[0], NULL);
  
- static void ___mt7996_set_channel(struct mt7996_phy *phy,
-@@ -441,6 +448,8 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ 	mutex_unlock(&dev->mt76.mutex);
+ }
+@@ -447,10 +451,10 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_sta *msta = sta ? (struct mt7996_sta *)sta->drv_priv :
  				  &mvif->sta;
- 	struct mt76_wcid *wcid = &msta->wcid;
-+	struct mt7996_bss_conf *mconf;
-+	struct ieee80211_bss_conf *conf;
- 	u8 *wcid_keyidx = &wcid->hw_key_idx;
+-	struct mt76_wcid *wcid = &msta->wcid;
+ 	struct mt7996_bss_conf *mconf;
++	struct mt7996_link_sta *mlink;
+ 	struct ieee80211_bss_conf *conf;
+-	u8 *wcid_keyidx = &wcid->hw_key_idx;
++	u8 *wcid_keyidx;
  	int idx = key->keyidx;
  	int err = 0;
-@@ -482,9 +491,11 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
  
- 	mutex_lock(&dev->mt76.mutex);
+@@ -464,6 +468,12 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ 	    !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
+ 		return -EOPNOTSUPP;
  
--	if (cmd == SET_KEY && !sta && !mvif->mt76.cipher) {
--		mvif->mt76.cipher = mt76_connac_mcu_get_cipher(key->cipher);
--		mt7996_mcu_add_bss_info(phy, vif, true);
++	mutex_lock(&dev->mt76.mutex);
 +	conf = link_conf_dereference_protected(vif, 0);
 +	mconf = mconf_dereference_protected(mvif, 0);
-+	if (cmd == SET_KEY && !sta && !mconf->mt76.cipher) {
-+		mconf->mt76.cipher = mt76_connac_mcu_get_cipher(key->cipher);
-+		mt7996_mcu_add_bss_info(phy, conf, mconf, true);
++	mlink = mlink_dereference_protected(msta, 0);
++	wcid_keyidx = &mlink->wcid.hw_key_idx;
++
+ 	/* fall back to sw encryption for unsupported ciphers */
+ 	switch (key->cipher) {
+ 	case WLAN_CIPHER_SUITE_TKIP:
+@@ -486,16 +496,13 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ 	case WLAN_CIPHER_SUITE_WEP40:
+ 	case WLAN_CIPHER_SUITE_WEP104:
+ 	default:
++		mutex_unlock(&dev->mt76.mutex);
+ 		return -EOPNOTSUPP;
+ 	}
+ 
+-	mutex_lock(&dev->mt76.mutex);
+-
+-	conf = link_conf_dereference_protected(vif, 0);
+-	mconf = mconf_dereference_protected(mvif, 0);
+ 	if (cmd == SET_KEY && !sta && !mconf->mt76.cipher) {
+ 		mconf->mt76.cipher = mt76_connac_mcu_get_cipher(key->cipher);
+-		mt7996_mcu_add_bss_info(phy, conf, mconf, true);
++		mt7996_mcu_add_bss_info(phy, conf, mconf, mlink, true);
  	}
  
  	if (cmd == SET_KEY) {
-@@ -498,9 +509,9 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
- 	mt76_wcid_key_setup(&dev->mt76, wcid, key);
+@@ -506,14 +513,14 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ 		goto out;
+ 	}
+ 
+-	mt76_wcid_key_setup(&dev->mt76, wcid, key);
++	mt76_wcid_key_setup(&dev->mt76, &mlink->wcid, key);
  
  	if (key->keyidx == 6 || key->keyidx == 7)
--		err = mt7996_mcu_bcn_prot_enable(dev, vif, key);
-+		err = mt7996_mcu_bcn_prot_enable(dev, conf, mconf, key);
+-		err = mt7996_mcu_bcn_prot_enable(dev, conf, mconf, key);
++		err = mt7996_mcu_bcn_prot_enable(dev, conf, mconf, mlink, key);
  	else
--		err = mt7996_mcu_add_key(&dev->mt76, vif, key,
-+		err = mt7996_mcu_add_key(&dev->mt76, mconf, key,
+ 		err = mt7996_mcu_add_key(&dev->mt76, mconf, key,
  					 MCU_WMWA_UNI_CMD(STA_REC_UPDATE),
- 					 &msta->wcid, cmd);
+-					 &msta->wcid, cmd);
++					 &mlink->wcid, cmd);
  out:
-@@ -547,7 +558,9 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	       unsigned int link_id, u16 queue,
- 	       const struct ieee80211_tx_queue_params *params)
- {
-+	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_bss_conf *mconf;
- 	const u8 mq_to_aci[] = {
- 		[IEEE80211_AC_VO] = 3,
- 		[IEEE80211_AC_VI] = 2,
-@@ -555,10 +568,15 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 		[IEEE80211_AC_BK] = 1,
- 	};
- 
-+	mutex_lock(&dev->mt76.mutex);
-+	mconf = mconf_dereference_protected(mvif, 0);
-+
- 	/* firmware uses access class index */
--	mvif->queue_params[mq_to_aci[queue]] = *params;
-+	mconf->queue_params[mq_to_aci[queue]] = *params;
- 	/* no need to update right away, we'll get BSS_CHANGED_QOS */
- 
-+	mutex_unlock(&dev->mt76.mutex);
-+
- 	return 0;
- }
- 
-@@ -619,22 +637,20 @@ static void mt7996_configure_filter(struct ieee80211_hw *hw,
- }
- 
- static void
--mt7996_update_bss_color(struct ieee80211_hw *hw,
--			struct ieee80211_vif *vif,
-+mt7996_update_bss_color(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-+			struct mt7996_bss_conf *mconf,
- 			struct cfg80211_he_bss_color *bss_color)
- {
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 
- 	switch (vif->type) {
- 	case NL80211_IFTYPE_AP: {
--		struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--
--		if (mvif->mt76.omac_idx > HW_BSSID_MAX)
-+		if (mconf->mt76.omac_idx > HW_BSSID_MAX)
- 			return;
- 		fallthrough;
- 	}
- 	case NL80211_IFTYPE_STATION:
--		mt7996_mcu_update_bss_color(dev, vif, bss_color);
-+		mt7996_mcu_update_bss_color(dev, mconf, bss_color);
- 		break;
- 	default:
- 		break;
-@@ -642,16 +658,15 @@ mt7996_update_bss_color(struct ieee80211_hw *hw,
- }
- 
- static u8
--mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
--		       bool beacon, bool mcast)
-+mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_bss_conf *conf,
-+		       struct mt7996_bss_conf *mconf, bool beacon, bool mcast)
- {
--	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
--	struct mt76_phy *mphy = hw->priv;
-+	struct mt76_phy *mphy = mconf->phy->mt76;
- 	u16 rate;
- 	u8 i, idx;
- 
--	rate = mt76_connac2_mac_tx_rate_val(mphy, vif, beacon, mcast);
-+	rate = mt76_connac2_mac_tx_rate_val(mphy, conf->vif, beacon, mcast);
- 
- 	if (beacon) {
- 		struct mt7996_phy *phy = mphy->priv;
-@@ -672,23 +687,22 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 		if ((mt76_rates[i].hw_value & GENMASK(7, 0)) == idx)
- 			return MT7996_BASIC_RATES_TBL + 2 * i;
- 
--	return mvif->basic_rates_idx;
-+	return mconf->mt76.basic_rates_idx;
- }
- 
- static void
--mt7996_update_mu_group(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
--		       struct ieee80211_bss_conf *info)
-+mt7996_update_mu_group(struct ieee80211_hw *hw, struct ieee80211_bss_conf *conf,
-+		       struct mt7996_bss_conf *mconf)
- {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
--	u8 band = mvif->mt76.band_idx;
-+	u8 band = mconf->mt76.band_idx;
- 	u32 *mu;
- 
--	mu = (u32 *)info->mu_group.membership;
-+	mu = (u32 *)conf->mu_group.membership;
- 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_VLD0(band), mu[0]);
- 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_VLD1(band), mu[1]);
+ 	mutex_unlock(&dev->mt76.mutex);
  
--	mu = (u32 *)info->mu_group.position;
-+	mu = (u32 *)conf->mu_group.position;
- 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_POS0(band), mu[0]);
- 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_POS1(band), mu[1]);
- 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_POS2(band), mu[2]);
-@@ -700,20 +714,22 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
- 				    struct ieee80211_bss_conf *info,
- 				    u64 changed)
+@@ -716,25 +723,27 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
  {
--	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_bss_conf *mconf;
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_bss_conf *mconf;
++	struct mt7996_link_sta *mlink;
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  
  	mutex_lock(&dev->mt76.mutex);
  
-+	mconf = mconf_dereference_protected(mvif, 0);
+ 	mconf = mconf_dereference_protected(mvif, 0);
++	mlink = mlink_dereference_protected(&mvif->sta, 0);
  	/* station mode uses BSSID to map the wlan entry to a peer,
  	 * and then peer references bss_info_rfch to set bandwidth cap.
  	 */
  	if ((changed & BSS_CHANGED_BSSID && !is_zero_ether_addr(info->bssid)) ||
  	    (changed & BSS_CHANGED_ASSOC && vif->cfg.assoc) ||
  	    (changed & BSS_CHANGED_BEACON_ENABLED && info->enable_beacon)) {
--		mt7996_mcu_add_bss_info(phy, vif, true);
--		mt7996_mcu_add_sta(dev, vif, NULL, true,
-+		mt7996_mcu_add_bss_info(phy, info, mconf, true);
-+		mt7996_mcu_add_sta(dev, info, mconf, NULL, true,
+-		mt7996_mcu_add_bss_info(phy, info, mconf, true);
+-		mt7996_mcu_add_sta(dev, info, mconf, NULL, true,
++		mt7996_mcu_add_bss_info(phy, info, mconf, mlink, true);
++		mt7996_mcu_add_sta(dev, info, mconf, NULL, mlink, true,
  				   !!(changed & BSS_CHANGED_BSSID));
  	}
  
-@@ -725,42 +741,42 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+ 	if (changed & BSS_CHANGED_ERP_CTS_PROT)
+-		mt7996_mac_enable_rtscts(dev, vif, info->use_cts_prot);
++		mt7996_mac_enable_rtscts(dev, mlink, info->use_cts_prot);
  
- 		if (slottime != phy->slottime) {
- 			phy->slottime = slottime;
--			mt7996_mcu_set_timing(phy, vif);
-+			mt7996_mcu_set_timing(phy, mconf);
- 		}
- 	}
+ 	if (changed & BSS_CHANGED_ERP_SLOT) {
+ 		int slottime = info->use_short_slot ? 9 : 20;
+@@ -805,6 +814,7 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_bss_conf *mconf = mconf_dereference_protected(mvif, 0);
++	struct mt7996_link_sta *mlink = &msta->deflink;
+ 	u8 band_idx = mconf->phy->mt76->band_idx;
+ 	int idx;
  
- 	if (changed & BSS_CHANGED_MCAST_RATE)
--		mvif->mcast_rates_idx =
--			mt7996_get_rates_table(hw, vif, false, true);
-+		mconf->mt76.mcast_rates_idx =
-+			mt7996_get_rates_table(hw, info, mconf, false, true);
+@@ -816,13 +826,16 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 	if (idx < 0)
+ 		return -ENOSPC;
  
- 	if (changed & BSS_CHANGED_BASIC_RATES)
--		mvif->basic_rates_idx =
--			mt7996_get_rates_table(hw, vif, false, false);
-+		mconf->mt76.basic_rates_idx =
-+			mt7996_get_rates_table(hw, info, mconf, false, false);
+-	INIT_LIST_HEAD(&msta->rc_list);
+-	INIT_LIST_HEAD(&msta->wcid.poll_list);
++	INIT_LIST_HEAD(&mlink->rc_list);
++	INIT_LIST_HEAD(&mlink->wcid.poll_list);
+ 	msta->vif = mvif;
+-	msta->wcid.sta = 1;
+-	msta->wcid.idx = idx;
+-	msta->wcid.phy_idx = band_idx;
+-	msta->wcid.tx_info |= MT_WCID_TX_INFO_SET;
++	mlink->wcid.sta = 1;
++	mlink->wcid.idx = idx;
++	mlink->wcid.phy_idx = band_idx;
++	mlink->wcid.tx_info |= MT_WCID_TX_INFO_SET;
++	mlink->sta = msta;
++
++	rcu_assign_pointer(msta->link[0], mlink);
  
- 	/* ensure that enable txcmd_mode after bss_info */
- 	if (changed & (BSS_CHANGED_QOS | BSS_CHANGED_BEACON_ENABLED))
--		mt7996_mcu_set_tx(dev, vif);
-+		mt7996_mcu_set_tx(dev, mconf);
+ #ifdef CONFIG_MTK_VENDOR
+ 	mt7996_vendor_amnt_sta_remove(mconf->phy, sta);
+@@ -855,19 +868,25 @@ void mt7996_mac_sta_assoc(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 	struct mt7996_bss_conf *mconf;
++	struct mt7996_link_sta *mlink;
+ 	struct ieee80211_bss_conf *conf;
++	struct ieee80211_link_sta *link_sta;
  
- 	if (changed & BSS_CHANGED_HE_OBSS_PD)
--		mt7996_mcu_add_obss_spr(phy, vif, &info->he_obss_pd);
-+		mt7996_mcu_add_obss_spr(phy, mconf, &info->he_obss_pd);
+ 	mutex_lock(&dev->mt76.mutex);
  
- 	if (changed & BSS_CHANGED_HE_BSS_COLOR)
--		mt7996_update_bss_color(hw, vif, &info->he_bss_color);
-+		mt7996_update_bss_color(hw, vif, mconf, &info->he_bss_color);
+-	mt7996_mac_wtbl_update(dev, msta->wcid.idx,
+-			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
+-
+ 	conf = link_conf_dereference_protected(vif, 0);
+ 	mconf = mconf_dereference_protected(mvif, 0);
+-	mt7996_mcu_add_sta(dev, conf, mconf, sta, true, true);
+-	mt7996_mcu_add_rate_ctrl(dev, conf, mconf, sta, false);
++	link_sta = link_sta_dereference_protected(sta, 0);
++	mlink = mlink_dereference_protected(msta, 0);
  
- 	if (changed & (BSS_CHANGED_BEACON |
- 		       BSS_CHANGED_BEACON_ENABLED)) {
--		mvif->beacon_rates_idx =
--			mt7996_get_rates_table(hw, vif, true, false);
-+		mconf->mt76.beacon_rates_idx =
-+			mt7996_get_rates_table(hw, info, mconf, true, false);
+-	ewma_avg_signal_init(&msta->avg_ack_signal);
++	mt7996_mac_wtbl_update(dev, mlink->wcid.idx,
++			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
++
++	mt7996_mcu_add_sta(dev, conf, mconf, link_sta, mlink, true, true);
++	mt7996_mcu_add_rate_ctrl(dev, conf, mconf, link_sta, mlink, false);
++	mlink->wcid.tx_info |= MT_WCID_TX_INFO_SET;
++
++	ewma_avg_signal_init(&mlink->avg_ack_signal);
  
--		mt7996_mcu_add_beacon(hw, vif, info->enable_beacon);
-+		mt7996_mcu_add_beacon(hw, info, mconf, info->enable_beacon);
- 	}
+ 	mutex_unlock(&dev->mt76.mutex);
+ }
+@@ -879,25 +898,31 @@ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 	struct mt7996_bss_conf *mconf;
++	struct mt7996_link_sta *mlink;
+ 	struct ieee80211_bss_conf *conf;
++	struct ieee80211_link_sta *link_sta;
+ 	int i;
  
- 	if (changed & (BSS_CHANGED_UNSOL_BCAST_PROBE_RESP |
- 		       BSS_CHANGED_FILS_DISCOVERY))
--		mt7996_mcu_beacon_inband_discov(dev, vif, changed);
-+		mt7996_mcu_beacon_inband_discov(dev, info, mconf, changed);
+ 	conf = link_conf_dereference_protected(vif, 0);
+ 	mconf = mconf_dereference_protected(mvif, 0);
+-	mt7996_mcu_add_sta(dev, conf, mconf, sta, false, false);
++	link_sta = link_sta_dereference_protected(sta, 0);
++	mlink = mlink_dereference_protected(msta, 0);
++	mt7996_mcu_add_sta(dev, conf, mconf, link_sta, mlink, false, false);
  
- 	if (changed & BSS_CHANGED_MU_GROUPS)
--		mt7996_update_mu_group(hw, vif, info);
-+		mt7996_update_mu_group(hw, info, mconf);
+-	mt7996_mac_wtbl_update(dev, msta->wcid.idx,
++	mt7996_mac_wtbl_update(dev, mlink->wcid.idx,
+ 			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
  
- 	mutex_unlock(&dev->mt76.mutex);
- }
-@@ -771,9 +787,14 @@ mt7996_channel_switch_beacon(struct ieee80211_hw *hw,
- 			     struct cfg80211_chan_def *chandef)
- {
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_bss_conf *mconf;
-+	struct ieee80211_bss_conf *conf;
+-	for (i = 0; i < ARRAY_SIZE(msta->twt.flow); i++)
+-		mt7996_mac_twt_teardown_flow(dev, msta, i);
++	for (i = 0; i < ARRAY_SIZE(mlink->twt.flow); i++)
++		mt7996_mac_twt_teardown_flow(dev, mlink, i);
  
- 	mutex_lock(&dev->mt76.mutex);
--	mt7996_mcu_add_beacon(hw, vif, true);
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	conf = link_conf_dereference_protected(vif, 0);
-+	mt7996_mcu_add_beacon(hw, conf, mconf, true);
- 	mutex_unlock(&dev->mt76.mutex);
+ 	spin_lock_bh(&mdev->sta_poll_lock);
+-	if (!list_empty(&msta->wcid.poll_list))
+-		list_del_init(&msta->wcid.poll_list);
+-	if (!list_empty(&msta->rc_list))
+-		list_del_init(&msta->rc_list);
++	if (!list_empty(&mlink->wcid.poll_list))
++		list_del_init(&mlink->wcid.poll_list);
++	if (!list_empty(&mlink->rc_list))
++		list_del_init(&mlink->rc_list);
+ 	spin_unlock_bh(&mdev->sta_poll_lock);
++
++	rcu_assign_pointer(msta->link[0], NULL);
  }
  
-@@ -783,7 +804,8 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	u8 band_idx = mvif->phy->mt76->band_idx;
-+	struct mt7996_bss_conf *mconf = mconf_dereference_protected(mvif, 0);
-+	u8 band_idx = mconf->phy->mt76->band_idx;
- 	int idx;
+ static void mt7996_tx(struct ieee80211_hw *hw,
+@@ -909,19 +934,22 @@ static void mt7996_tx(struct ieee80211_hw *hw,
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	struct ieee80211_vif *vif = info->control.vif;
+ 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
++	struct mt7996_link_sta *mlink;
  
- #ifdef CONFIG_MTK_VENDOR
-@@ -803,7 +825,7 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 	msta->wcid.tx_info |= MT_WCID_TX_INFO_SET;
+ 	if (control->sta) {
+-		struct mt7996_sta *sta;
++		struct mt7996_sta *msta;
  
- #ifdef CONFIG_MTK_VENDOR
--	mt7996_vendor_amnt_sta_remove(mvif->phy, sta);
-+	mt7996_vendor_amnt_sta_remove(mconf->phy, sta);
- #endif
+-		sta = (struct mt7996_sta *)control->sta->drv_priv;
+-		wcid = &sta->wcid;
++		msta = (struct mt7996_sta *)control->sta->drv_priv;
++		mlink = rcu_dereference(msta->link[0]);
++		wcid = &mlink->wcid;
+ 	}
  
- #ifdef CONFIG_MTK_VENDOR
-@@ -830,15 +852,20 @@ void mt7996_mac_sta_assoc(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 			  struct ieee80211_sta *sta)
- {
- 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_bss_conf *mconf;
-+	struct ieee80211_bss_conf *conf;
+ 	if (vif && !control->sta) {
+ 		struct mt7996_vif *mvif;
  
- 	mutex_lock(&dev->mt76.mutex);
- 
- 	mt7996_mac_wtbl_update(dev, msta->wcid.idx,
- 			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
- 
--	mt7996_mcu_add_sta(dev, vif, sta, true, true);
--	mt7996_mcu_add_rate_ctrl(dev, vif, sta, false);
-+	conf = link_conf_dereference_protected(vif, 0);
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	mt7996_mcu_add_sta(dev, conf, mconf, sta, true, true);
-+	mt7996_mcu_add_rate_ctrl(dev, conf, mconf, sta, false);
+ 		mvif = (struct mt7996_vif *)vif->drv_priv;
+-		wcid = &mvif->sta.wcid;
++		mlink = rcu_dereference(mvif->sta.link[0]);
++		wcid = &mlink->wcid;
+ 	}
  
- 	ewma_avg_signal_init(&msta->avg_ack_signal);
+ 	mt76_tx(mphy, control->sta, wcid, skb);
+@@ -948,6 +976,7 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	struct ieee80211_sta *sta = params->sta;
+ 	struct ieee80211_txq *txq = sta->txq[params->tid];
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_link_sta *mlink;
+ 	u16 tid = params->tid;
+ 	u16 ssn = params->ssn;
+ 	struct mt76_txq *mtxq;
+@@ -959,14 +988,15 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	mtxq = (struct mt76_txq *)txq->drv_priv;
  
-@@ -849,10 +876,15 @@ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 			   struct ieee80211_sta *sta)
+ 	mutex_lock(&dev->mt76.mutex);
++	mlink = mlink_dereference_protected(msta, 0);
+ 	switch (action) {
+ 	case IEEE80211_AMPDU_RX_START:
+-		mt76_rx_aggr_start(&dev->mt76, &msta->wcid, tid, ssn,
++		mt76_rx_aggr_start(&dev->mt76, &mlink->wcid, tid, ssn,
+ 				   params->buf_size);
+ 		ret = mt7996_mcu_add_rx_ba(dev, params, true);
+ 		break;
+ 	case IEEE80211_AMPDU_RX_STOP:
+-		mt76_rx_aggr_stop(&dev->mt76, &msta->wcid, tid);
++		mt76_rx_aggr_stop(&dev->mt76, &mlink->wcid, tid);
+ 		ret = mt7996_mcu_add_rx_ba(dev, params, false);
+ 		break;
+ 	case IEEE80211_AMPDU_TX_OPERATIONAL:
+@@ -977,16 +1007,16 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
+ 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
+ 		mtxq->aggr = false;
+-		clear_bit(tid, &msta->wcid.ampdu_state);
++		clear_bit(tid, &mlink->wcid.ampdu_state);
+ 		ret = mt7996_mcu_add_tx_ba(dev, params, false);
+ 		break;
+ 	case IEEE80211_AMPDU_TX_START:
+-		set_bit(tid, &msta->wcid.ampdu_state);
++		set_bit(tid, &mlink->wcid.ampdu_state);
+ 		ret = IEEE80211_AMPDU_TX_START_IMMEDIATE;
+ 		break;
+ 	case IEEE80211_AMPDU_TX_STOP_CONT:
+ 		mtxq->aggr = false;
+-		clear_bit(tid, &msta->wcid.ampdu_state);
++		clear_bit(tid, &mlink->wcid.ampdu_state);
+ 		ret = mt7996_mcu_add_tx_ba(dev, params, false);
+ 		ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+ 		break;
+@@ -1165,10 +1195,19 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
+ 				  struct ieee80211_sta *sta,
+ 				  struct station_info *sinfo)
  {
- 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct mt7996_dev *dev = mt7996_hw_dev(hw);
+ 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_bss_conf *mconf;
-+	struct ieee80211_bss_conf *conf;
- 	int i;
+-	struct rate_info *txrate = &msta->wcid.rate;
++	struct mt7996_link_sta *mlink;
++	struct rate_info *txrate;
  
--	mt7996_mcu_add_sta(dev, vif, sta, false, false);
-+	conf = link_conf_dereference_protected(vif, 0);
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	mt7996_mcu_add_sta(dev, conf, mconf, sta, false, false);
++	/* TODO: support per-link rate report */
++	mutex_lock(&dev->mt76.mutex);
++	mlink = mlink_dereference_protected(msta, 0);
++	if (!mlink)
++		goto out;
++
++	txrate = &mlink->wcid.rate;
+ 	if (txrate->legacy || txrate->flags) {
+ 		if (txrate->legacy) {
+ 			sinfo->txrate.legacy = txrate->legacy;
+@@ -1187,44 +1226,52 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
+ 	sinfo->txrate.flags = txrate->flags;
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
  
- 	mt7996_mac_wtbl_update(dev, msta->wcid.idx,
- 			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
-@@ -984,7 +1016,7 @@ mt7996_get_stats(struct ieee80211_hw *hw,
- 	return 0;
- }
+-	sinfo->tx_failed = msta->wcid.stats.tx_failed;
++	sinfo->tx_failed = mlink->wcid.stats.tx_failed;
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
  
--u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif)
-+u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_bss_conf *mconf)
- {
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
-@@ -996,8 +1028,8 @@ u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif)
+-	sinfo->tx_retries = msta->wcid.stats.tx_retries;
++	sinfo->tx_retries = mlink->wcid.stats.tx_retries;
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
  
- 	lockdep_assert_held(&dev->mt76.mutex);
- 
--	n = mvif->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
--					       : mvif->mt76.omac_idx;
-+	n = mconf->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
-+					       : mconf->mt76.omac_idx;
- 	/* TSF software read */
- 	mt76_rmw(dev, MT_LPON_TCR(phy->mt76->band_idx, n), MT_LPON_TCR_SW_MODE,
- 		 MT_LPON_TCR_SW_READ);
-@@ -1012,10 +1044,12 @@ mt7996_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
- {
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
-+	struct mt7996_bss_conf *mconf;
- 	u64 ret;
+-	sinfo->ack_signal = (s8)msta->ack_signal;
++	sinfo->ack_signal = (s8)mlink->ack_signal;
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL);
  
- 	mutex_lock(&dev->mt76.mutex);
--	ret = __mt7996_get_tsf(hw, mvif);
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	ret = __mt7996_get_tsf(hw, mconf);
- 	mutex_unlock(&dev->mt76.mutex);
+-	sinfo->avg_ack_signal = -(s8)ewma_avg_signal_read(&msta->avg_ack_signal);
++	sinfo->avg_ack_signal = -(s8)ewma_avg_signal_read(&mlink->avg_ack_signal);
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL_AVG);
  
- 	return ret;
-@@ -1028,6 +1062,7 @@ mt7996_set_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
-+	struct mt7996_bss_conf *mconf;
- 	union {
- 		u64 t64;
- 		u32 t32[2];
-@@ -1036,8 +1071,9 @@ mt7996_set_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	if (mtk_wed_device_active(&phy->dev->mt76.mmio.wed)) {
+-		sinfo->tx_bytes = msta->wcid.stats.tx_bytes;
++		sinfo->tx_bytes = mlink->wcid.stats.tx_bytes;
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES64);
  
- 	mutex_lock(&dev->mt76.mutex);
+-		sinfo->rx_bytes = msta->wcid.stats.rx_bytes;
++		sinfo->rx_bytes = mlink->wcid.stats.rx_bytes;
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES64);
  
--	n = mvif->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
--					       : mvif->mt76.omac_idx;
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	n = mconf->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
-+					       : mconf->mt76.omac_idx;
- 	mt76_wr(dev, MT_LPON_UTTR0(phy->mt76->band_idx), tsf.t32[0]);
- 	mt76_wr(dev, MT_LPON_UTTR1(phy->mt76->band_idx), tsf.t32[1]);
- 	/* TSF software overwrite */
-@@ -1054,6 +1090,7 @@ mt7996_offset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
-+	struct mt7996_bss_conf *mconf;
- 	union {
- 		u64 t64;
- 		u32 t32[2];
-@@ -1062,8 +1099,9 @@ mt7996_offset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+-		sinfo->tx_packets = msta->wcid.stats.tx_packets;
++		sinfo->tx_packets = mlink->wcid.stats.tx_packets;
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
  
- 	mutex_lock(&dev->mt76.mutex);
+-		sinfo->rx_packets = msta->wcid.stats.rx_packets;
++		sinfo->rx_packets = mlink->wcid.stats.rx_packets;
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
+ 	}
++out:
++	mutex_unlock(&dev->mt76.mutex);
+ }
  
--	n = mvif->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
--					       : mvif->mt76.omac_idx;
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	n = mconf->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
-+					       : mconf->mt76.omac_idx;
- 	mt76_wr(dev, MT_LPON_UTTR0(phy->mt76->band_idx), tsf.t32[0]);
- 	mt76_wr(dev, MT_LPON_UTTR1(phy->mt76->band_idx), tsf.t32[1]);
- 	/* TSF software adjust*/
-@@ -1179,7 +1217,7 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
  static void mt7996_sta_rc_work(void *data, struct ieee80211_sta *sta)
  {
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
--	struct mt7996_dev *dev = msta->vif->phy->dev;
-+	struct mt7996_dev *dev = msta->vif->dev;
++	struct mt7996_link_sta *mlink;
+ 	struct mt7996_dev *dev = msta->vif->dev;
  	u32 *changed = data;
  
++	rcu_read_lock();
++	mlink = rcu_dereference(msta->link[0]);
++
  	spin_lock_bh(&dev->mt76.sta_poll_lock);
-@@ -1215,9 +1253,13 @@ mt7996_set_bitrate_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
- 	struct mt7996_dev *dev = phy->dev;
-+	struct mt7996_bss_conf *mconf;
- 	u32 changed = IEEE80211_RC_SUPP_RATES_CHANGED;
+-	msta->changed |= *changed;
+-	if (list_empty(&msta->rc_list))
+-		list_add_tail(&msta->rc_list, &dev->sta_rc_list);
++	mlink->changed |= *changed;
++	if (list_empty(&mlink->rc_list))
++		list_add_tail(&mlink->rc_list, &dev->sta_rc_list);
+ 	spin_unlock_bh(&dev->mt76.sta_poll_lock);
++
++	rcu_read_unlock();
+ }
  
--	mvif->bitrate_mask = *mask;
-+	mutex_lock(&dev->mt76.mutex);
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	mconf->bitrate_mask = *mask;
-+	mutex_unlock(&dev->mt76.mutex);
+ static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
+@@ -1238,7 +1285,7 @@ static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
  
- 	/* if multiple rates across different preambles are given we can
- 	 * reconfigure this info with all peers using sta_rec command with
-@@ -1239,14 +1281,20 @@ static void mt7996_sta_set_4addr(struct ieee80211_hw *hw,
- 				 bool enabled)
- {
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	if (!msta->vif) {
+ 		dev_warn(dev->mt76.dev, "Un-initialized STA %pM wcid %d in rc_work\n",
+-			 sta->addr, msta->wcid.idx);
++			 sta->addr, msta->deflink.wcid.idx);
+ 		return;
+ 	}
+ 
+@@ -1284,16 +1331,18 @@ static void mt7996_sta_set_4addr(struct ieee80211_hw *hw,
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_bss_conf *mconf;
-+
-+	mutex_lock(&dev->mt76.mutex);
-+	mconf = mconf_dereference_protected(mvif, 0);
+ 	struct mt7996_bss_conf *mconf;
++	struct mt7996_link_sta *mlink;
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+ 	mconf = mconf_dereference_protected(mvif, 0);
++	mlink = mlink_dereference_protected(msta, 0);
  
  	if (enabled)
- 		set_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
+-		set_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
++		set_bit(MT_WCID_FLAG_4ADDR, &mlink->wcid.flags);
  	else
- 		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
+-		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
++		clear_bit(MT_WCID_FLAG_4ADDR, &mlink->wcid.flags);
  
--	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, sta);
-+	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, sta);
-+	mutex_unlock(&dev->mt76.mutex);
+-	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, sta);
++	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, mlink);
+ 	mutex_unlock(&dev->mt76.mutex);
  }
  
- static void mt7996_sta_set_decap_offload(struct ieee80211_hw *hw,
-@@ -1255,14 +1303,20 @@ static void mt7996_sta_set_decap_offload(struct ieee80211_hw *hw,
- 					 bool enabled)
- {
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+@@ -1306,16 +1355,18 @@ static void mt7996_sta_set_decap_offload(struct ieee80211_hw *hw,
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_bss_conf *mconf;
-+
-+	mutex_lock(&dev->mt76.mutex);
-+	mconf = mconf_dereference_protected(mvif, 0);
+ 	struct mt7996_bss_conf *mconf;
++	struct mt7996_link_sta *mlink;
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+ 	mconf = mconf_dereference_protected(mvif, 0);
++	mlink = mlink_dereference_protected(msta, 0);
  
  	if (enabled)
- 		set_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
+-		set_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
++		set_bit(MT_WCID_FLAG_HDR_TRANS, &mlink->wcid.flags);
  	else
- 		clear_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
+-		clear_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
++		clear_bit(MT_WCID_FLAG_HDR_TRANS, &mlink->wcid.flags);
  
--	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, sta);
-+	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, sta);
-+	mutex_unlock(&dev->mt76.mutex);
+-	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, sta);
++	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, mlink);
+ 	mutex_unlock(&dev->mt76.mutex);
  }
  
- static const char mt7996_gstrings_stats[][ETH_GSTRING_LEN] = {
-@@ -1395,7 +1449,7 @@ static void mt7996_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
+@@ -1448,11 +1499,12 @@ static void mt7996_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
+ {
  	struct mt76_ethtool_worker_info *wi = wi_data;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_link_sta *mlink = &msta->deflink;
  
--	if (msta->vif->mt76.idx != wi->idx)
-+	if (msta->vif->deflink.mt76.idx != wi->idx)
+ 	if (msta->vif->deflink.mt76.idx != wi->idx)
  		return;
  
- 	mt76_ethtool_worker(wi, &msta->wcid.stats, true);
-@@ -1409,15 +1463,17 @@ void mt7996_get_et_stats(struct ieee80211_hw *hw,
+-	mt76_ethtool_worker(wi, &msta->wcid.stats, true);
++	mt76_ethtool_worker(wi, &mlink->wcid.stats, true);
+ }
+ 
+ static
+@@ -1555,10 +1607,12 @@ mt7996_twt_teardown_request(struct ieee80211_hw *hw,
+ 			    u8 flowid)
+ {
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_link_sta *mlink;
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_bss_conf *mconf;
- 	struct mt76_mib_stats *mib = &phy->mib;
- 	struct mt76_ethtool_worker_info wi = {
- 		.data = data,
--		.idx = mvif->mt76.idx,
- 	};
- 	/* See mt7996_ampdu_stat_read_phy, etc */
- 	int i, ei = 0;
  
  	mutex_lock(&dev->mt76.mutex);
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	wi.idx = mconf->mt76.idx,
- 
- 	mt7996_mac_update_stats(phy);
+-	mt7996_mac_twt_teardown_flow(dev, msta, flowid);
++	mlink = mlink_dereference_protected(msta, 0);
++	mt7996_mac_twt_teardown_flow(dev, mlink, flowid);
+ 	mutex_unlock(&dev->mt76.mutex);
+ }
  
-@@ -1623,6 +1679,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
- 			     struct net_device_path *path)
- {
+@@ -1681,6 +1735,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_bss_conf *mconf = &mvif->deflink;
+ 	struct mt7996_bss_conf *mconf = &mvif->deflink;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_link_sta *mlink = &msta->deflink;
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
-@@ -1652,7 +1709,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+ 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
+@@ -1703,7 +1758,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+ 	if (!mtk_wed_device_active(wed))
+ 		return -ENODEV;
+ 
+-	if (msta->wcid.idx > MT7996_WTBL_STA)
++	if (mlink->wcid.idx > MT7996_WTBL_STA)
+ 		return -EIO;
+ 
  	path->type = DEV_PATH_MTK_WDMA;
- 	path->dev = ctx->dev;
+@@ -1711,11 +1766,11 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
--	path->mtk_wdma.bss = mvif->mt76.idx;
-+	path->mtk_wdma.bss = mconf->mt76.idx;
+ 	path->mtk_wdma.bss = mconf->mt76.idx;
  	path->mtk_wdma.queue = 0;
- 	path->mtk_wdma.wcid = msta->wcid.idx;
- 
-@@ -1784,6 +1841,7 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	struct mt7996_chanctx *ctx = mt7996_chanctx_get(conf);
- 	struct mt7996_phy *phy = ctx->phy;
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_bss_conf *mconf;
- 
- 	wiphy_info(hw->wiphy, "Assign VIF (addr: %pM, type: %d, link_id: %d) to channel context: %d MHz\n",
- 		    vif->addr, vif->type, link_conf->link_id,
-@@ -1791,7 +1849,8 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 
- 	mutex_lock(&phy->dev->mt76.mutex);
- 
--	mvif->chanctx = ctx;
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	mconf->chanctx = ctx;
- 	ctx->nbss_assigned++;
- 
- 	mutex_unlock(&phy->dev->mt76.mutex);
-@@ -1807,6 +1866,7 @@ mt7996_unassign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	struct mt7996_chanctx *ctx = mt7996_chanctx_get(conf);
- 	struct mt7996_phy *phy = ctx->phy;
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_bss_conf *mconf;
- 
- 	wiphy_info(hw->wiphy, "Remove VIF (addr: %pM, type: %d, link_id: %d) from channel context: %d MHz\n",
- 		   vif->addr, vif->type, link_conf->link_id,
-@@ -1818,7 +1878,8 @@ mt7996_unassign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	if (test_bit(MT76_SCANNING, &phy->mt76->state))
- 		mt7996_scan_complete(phy, true);
+-	path->mtk_wdma.wcid = msta->wcid.idx;
++	path->mtk_wdma.wcid = mlink->wcid.idx;
  
--	mvif->chanctx = NULL;
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	mconf->chanctx = NULL;
- 	ctx->nbss_assigned--;
+ 	if (ieee80211_hw_check(hw, SUPPORTS_AMSDU_IN_AMPDU) &&
+ 	    mtk_wed_is_amsdu_supported(wed))
+-		path->mtk_wdma.amsdu = msta->wcid.amsdu;
++		path->mtk_wdma.amsdu = mlink->wcid.amsdu;
+ 	else
+ 		path->mtk_wdma.amsdu = 0;
  
- 	mutex_unlock(&phy->dev->mt76.mutex);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 85077108e..11700f90f 100644
+index ebd3192..cab4a0a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -117,12 +117,12 @@ mt7996_mcu_get_sta_nss(u16 mcs_map)
+@@ -117,13 +117,13 @@ mt7996_mcu_get_sta_nss(u16 mcs_map)
  }
  
  static void
--mt7996_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
--			  u16 mcs_map)
-+mt7996_mcu_set_sta_he_mcs(struct ieee80211_sta *sta,
-+			  struct mt7996_bss_conf *mconf,
-+			  __le16 *he_mcs, u16 mcs_map)
+-mt7996_mcu_set_sta_he_mcs(struct ieee80211_sta *sta,
++mt7996_mcu_set_sta_he_mcs(struct ieee80211_link_sta *link_sta,
+ 			  struct mt7996_bss_conf *mconf,
+ 			  __le16 *he_mcs, u16 mcs_map)
  {
--	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
--	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
--	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
-+	enum nl80211_band band = mconf->phy->mt76->chandef.chan->band;
-+	const u16 *mask = mconf->bitrate_mask.control[band].he_mcs;
- 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
+ 	enum nl80211_band band = mconf->phy->mt76->chandef.chan->band;
+ 	const u16 *mask = mconf->bitrate_mask.control[band].he_mcs;
+-	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
++	int nss, max_nss = link_sta->rx_nss > 3 ? 4 : link_sta->rx_nss;
  
  	for (nss = 0; nss < max_nss; nss++) {
-@@ -922,8 +922,7 @@ mt7996_mcu_add_uni_tlv(struct sk_buff *skb, u16 tag, u16 len)
+ 		int mcs;
+@@ -166,11 +166,11 @@ mt7996_mcu_set_sta_he_mcs(struct ieee80211_sta *sta,
  }
  
  static void
--mt7996_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
--			struct mt7996_phy *phy)
-+mt7996_mcu_bss_rfch_tlv(struct sk_buff *skb, struct mt7996_phy *phy)
+-mt7996_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
+-			   const u16 *mask)
++mt7996_mcu_set_sta_vht_mcs(struct ieee80211_link_sta *link_sta,
++			   __le16 *vht_mcs, const u16 *mask)
  {
- 	static const u8 rlm_ch_band[] = {
- 		[NL80211_BAND_2GHZ] = 1,
-@@ -953,8 +952,7 @@ mt7996_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+-	u16 mcs, mcs_map = le16_to_cpu(sta->deflink.vht_cap.vht_mcs.rx_mcs_map);
+-	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
++	u16 mcs, mcs_map = le16_to_cpu(link_sta->vht_cap.vht_mcs.rx_mcs_map);
++	int nss, max_nss = link_sta->rx_nss > 3 ? 4 : link_sta->rx_nss;
+ 
+ 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
+ 		switch (mcs_map & 0x3) {
+@@ -192,13 +192,13 @@ mt7996_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
  }
  
  static void
--mt7996_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
--		      struct mt7996_phy *phy)
-+mt7996_mcu_bss_ra_tlv(struct sk_buff *skb)
+-mt7996_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
++mt7996_mcu_set_sta_ht_mcs(struct ieee80211_link_sta *link_sta, u8 *ht_mcs,
+ 			  const u8 *mask)
  {
- 	struct bss_ra_tlv *ra;
- 	struct tlv *tlv;
-@@ -966,7 +964,7 @@ mt7996_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+-	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
++	int nss, max_nss = link_sta->rx_nss > 3 ? 4 : link_sta->rx_nss;
+ 
+ 	for (nss = 0; nss < max_nss; nss++)
+-		ht_mcs[nss] = sta->deflink.ht_cap.mcs.rx_mask[nss] & mask[nss];
++		ht_mcs[nss] = link_sta->ht_cap.mcs.rx_mask[nss] & mask[nss];
  }
  
- static void
--mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
-+mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
- 		      struct mt7996_phy *phy)
+ static int
+@@ -531,14 +531,14 @@ static inline void __mt7996_stat_to_netdev(struct mt76_phy *mphy,
+ 					   u32 tx_bytes, u32 rx_bytes,
+ 					   u32 tx_packets, u32 rx_packets)
  {
- #define DEFAULT_HE_PE_DURATION		4
-@@ -975,16 +973,16 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
- 	struct bss_info_uni_he *he;
- 	struct tlv *tlv;
+-	struct mt7996_sta *msta;
++	struct mt7996_link_sta *mlink;
+ 	struct ieee80211_vif *vif;
+ 	struct wireless_dev *wdev;
  
--	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
-+	cap = mt76_connac_get_he_phy_cap(phy->mt76, conf->vif);
+ 	if (wiphy_ext_feature_isset(mphy->hw->wiphy,
+ 				    NL80211_EXT_FEATURE_STAS_COUNT)) {
+-		msta = container_of(wcid, struct mt7996_sta, wcid);
+-		vif = container_of((void *)msta->vif, struct ieee80211_vif,
++		mlink = container_of(wcid, struct mt7996_link_sta, wcid);
++		vif = container_of((void *)mlink->sta->vif, struct ieee80211_vif,
+ 				   drv_priv);
+ 		wdev = ieee80211_vif_to_wdev(vif);
  
- 	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
+@@ -1236,10 +1236,10 @@ __mt7996_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
  
- 	he = (struct bss_info_uni_he *)tlv;
--	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
-+	he->he_pe_duration = conf->htc_trig_based_pkt_ext;
- 	if (!he->he_pe_duration)
- 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
+ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
+ 			    struct ieee80211_bss_conf *conf,
+-			    struct mt7996_bss_conf *mconf, int enable)
++			    struct mt7996_bss_conf *mconf,
++			    struct mt7996_link_sta *mlink, int enable)
+ {
+ 	struct ieee80211_vif *vif = conf->vif;
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_dev *dev = phy->dev;
+ 	struct sk_buff *skb;
  
--	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
-+	he->he_rts_thres = cpu_to_le16(conf->frame_time_rts_th);
- 	if (!he->he_rts_thres)
- 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
+@@ -1255,7 +1255,7 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
  
-@@ -994,13 +992,13 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
- }
+ 	/* bss_basic must be first */
+ 	mt7996_mcu_bss_basic_tlv(skb, conf, mconf, NULL, phy->mt76,
+-				 mvif->sta.wcid.idx, enable);
++				 mlink->wcid.idx, enable);
+ 	mt7996_mcu_bss_sec_tlv(skb, mconf);
  
- static void
--mt7996_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
-+mt7996_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
- 			  struct mt7996_phy *phy, int enable)
+ 	if (vif->type == NL80211_IFTYPE_MONITOR)
+@@ -1335,9 +1335,10 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  {
- 	struct bss_info_uni_mbssid *mbssid;
- 	struct tlv *tlv;
- 
--	if (!vif->bss_conf.bssid_indicator && enable)
-+	if (!conf->bssid_indicator && enable)
- 		return;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)params->sta->drv_priv;
+ 	struct mt7996_bss_conf *mconf = mconf_dereference_protected(msta->vif, 0);
++	struct mt7996_link_sta *mlink = mlink_dereference_protected(msta, 0);
  
- 	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_11V_MBSSID, sizeof(*mbssid));
-@@ -1008,23 +1006,21 @@ mt7996_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
- 	mbssid = (struct bss_info_uni_mbssid *)tlv;
+ 	if (enable && !params->amsdu)
+-		msta->wcid.amsdu = false;
++		mlink->wcid.amsdu = false;
  
- 	if (enable) {
--		mbssid->max_indicator = vif->bss_conf.bssid_indicator;
--		mbssid->mbss_idx = vif->bss_conf.bssid_index;
-+		mbssid->max_indicator = conf->bssid_indicator;
-+		mbssid->mbss_idx = conf->bssid_index;
- 		mbssid->tx_bss_omac_idx = 0;
- 	}
+ 	return mt7996_mcu_sta_ba(dev, &mconf->mt76, params, enable, true);
  }
- 
+@@ -1355,15 +1356,15 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
  static void
--mt7996_mcu_bss_bmc_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
-+mt7996_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7996_bss_conf *mconf,
- 		       struct mt7996_phy *phy)
+ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
+ 		      struct mt7996_bss_conf *mconf,
+-		      struct ieee80211_sta *sta)
++		      struct ieee80211_link_sta *link_sta)
  {
--	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
- 	struct bss_rate_tlv *bmc;
- 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
- 	enum nl80211_band band = chandef->chan->band;
+-	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
++	struct ieee80211_he_cap_elem *elem = &link_sta->he_cap.he_cap_elem;
+ 	struct ieee80211_he_mcs_nss_supp mcs_map;
+ 	struct sta_rec_he_v2 *he;
  	struct tlv *tlv;
--	u8 idx = mvif->mcast_rates_idx ?
--		 mvif->mcast_rates_idx : mvif->basic_rates_idx;
-+	u8 idx = mconf->mt76.mcast_rates_idx ?: mconf->mt76.basic_rates_idx;
+ 	int i = 0;
  
- 	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_RATE, sizeof(*bmc));
- 
-@@ -1048,9 +1044,9 @@ mt7996_mcu_bss_txcmd_tlv(struct sk_buff *skb, bool en)
- }
+-	if (!sta->deflink.he_cap.has_he)
++	if (!link_sta->he_cap.has_he)
+ 		return;
  
- static void
--mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
-+mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
-+		       struct mt7996_bss_conf *mconf)
- {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct bss_mld_tlv *mld;
- 	struct tlv *tlv;
+ 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_V2, sizeof(*he));
+@@ -1380,21 +1381,21 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
+ 		u8p_replace_bits(&he->he_phy_cap[1], conf->he_ldpc,
+ 				 IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD);
  
-@@ -1058,33 +1054,30 @@ mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
+-	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
+-	switch (sta->deflink.bandwidth) {
++	mcs_map = link_sta->he_cap.he_mcs_nss_supp;
++	switch (link_sta->bandwidth) {
+ 	case IEEE80211_STA_RX_BW_160:
+ 		if (elem->phy_cap_info[0] &
+ 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
+-			mt7996_mcu_set_sta_he_mcs(sta, mconf,
++			mt7996_mcu_set_sta_he_mcs(link_sta, mconf,
+ 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
+ 						  le16_to_cpu(mcs_map.rx_mcs_80p80));
  
- 	mld = (struct bss_mld_tlv *)tlv;
- 	mld->group_mld_id = 0xff;
--	mld->own_mld_id = mvif->mt76.idx;
-+	mld->own_mld_id = mconf->mt76.idx;
- 	mld->remap_idx = 0xff;
+-		mt7996_mcu_set_sta_he_mcs(sta, mconf,
++		mt7996_mcu_set_sta_he_mcs(link_sta, mconf,
+ 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
+ 					  le16_to_cpu(mcs_map.rx_mcs_160));
+ 		fallthrough;
+ 	default:
+-		mt7996_mcu_set_sta_he_mcs(sta, mconf,
++		mt7996_mcu_set_sta_he_mcs(link_sta, mconf,
+ 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
+ 					  le16_to_cpu(mcs_map.rx_mcs_80));
+ 		break;
+@@ -1404,24 +1405,25 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
  }
  
  static void
--mt7996_mcu_bss_sec_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
-+mt7996_mcu_bss_sec_tlv(struct sk_buff *skb, struct mt7996_bss_conf *mconf)
+-mt7996_mcu_sta_he_6g_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
++mt7996_mcu_sta_he_6g_tlv(struct sk_buff *skb,
++			 struct ieee80211_link_sta *link_sta)
  {
--	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
- 	struct bss_sec_tlv *sec;
+ 	struct sta_rec_he_6g_capa *he_6g;
  	struct tlv *tlv;
  
- 	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_SEC, sizeof(*sec));
- 
- 	sec = (struct bss_sec_tlv *)tlv;
--	sec->cipher = mvif->cipher;
-+	sec->cipher = mconf->mt76.cipher;
- }
- 
- static int
--mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_vif *vif,
--		       bool bssid, bool enable)
-+mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
-+		       struct mt7996_bss_conf *mconf, bool bssid, bool enable)
- {
- #define UNI_MUAR_ENTRY 2
- 	struct mt7996_dev *dev = phy->dev;
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
--	const u8 *addr = vif->addr;
--
-+	u32 idx = mconf->mt76.omac_idx - REPEATER_BSSID_START;
-+	const u8 *addr = bssid ? conf->bssid : conf->vif->addr;
- 	struct {
- 		struct {
- 			u8 band;
-@@ -1109,9 +1102,6 @@ mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_vif *vif,
- 		.entry_add = true,
- 	};
+-	if (!sta->deflink.he_6ghz_capa.capa)
++	if (!link_sta->he_6ghz_capa.capa)
+ 		return;
  
--	if (bssid)
--		addr = vif->bss_conf.bssid;
--
- 	if (enable)
- 		memcpy(req.addr, addr, ETH_ALEN);
+ 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G, sizeof(*he_6g));
  
-@@ -1120,10 +1110,8 @@ mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+ 	he_6g = (struct sta_rec_he_6g_capa *)tlv;
+-	he_6g->capa = sta->deflink.he_6ghz_capa.capa;
++	he_6g->capa = link_sta->he_6ghz_capa.capa;
  }
  
  static void
--mt7996_mcu_bss_ifs_timing_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
-+mt7996_mcu_bss_ifs_timing_tlv(struct sk_buff *skb, struct mt7996_phy *phy)
+-mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
++mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
  {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct mt7996_phy *phy = mvif->phy;
- 	struct bss_ifs_time_tlv *ifs_time;
+-	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_sta *msta = (struct mt7996_sta *)link_sta->sta->drv_priv;
+ 	struct ieee80211_vif *vif = container_of((void *)msta->vif,
+ 						 struct ieee80211_vif, drv_priv);
+ 	struct ieee80211_eht_mcs_nss_supp *mcs_map;
+@@ -1429,11 +1431,11 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+ 	struct sta_rec_eht *eht;
  	struct tlv *tlv;
- 	bool is_2ghz = phy->mt76->chandef.chan->band == NL80211_BAND_2GHZ;
-@@ -1149,12 +1137,13 @@ mt7996_mcu_bss_ifs_timing_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
  
- static int
- mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
--			 struct ieee80211_vif *vif,
-+			 struct ieee80211_bss_conf *conf,
-+			 struct mt7996_bss_conf *mconf,
- 			 struct ieee80211_sta *sta,
- 			 struct mt76_phy *phy, u16 wlan_idx,
- 			 bool enable)
- {
--	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
-+	struct ieee80211_vif *vif = conf->vif;
- 	struct cfg80211_chan_def *chandef = &phy->chandef;
- 	struct mt76_connac_bss_basic_tlv *bss;
- 	u32 type = CONNECTION_INFRA_AP;
-@@ -1171,8 +1160,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
- 		if (enable) {
- 			rcu_read_lock();
- 			if (!sta)
--				sta = ieee80211_find_sta(vif,
--							 vif->bss_conf.bssid);
-+				sta = ieee80211_find_sta(vif, conf->bssid);
- 			/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
- 			if (sta) {
- 				struct mt76_wcid *wcid;
-@@ -1195,18 +1183,17 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
- 	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*bss));
+-	if (!sta->deflink.eht_cap.has_eht)
++	if (!link_sta->eht_cap.has_eht)
+ 		return;
  
- 	bss = (struct mt76_connac_bss_basic_tlv *)tlv;
--	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
--	bss->dtim_period = vif->bss_conf.dtim_period;
- 	bss->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
- 	bss->sta_idx = cpu_to_le16(sta_wlan_idx);
- 	bss->conn_type = cpu_to_le32(type);
--	bss->omac_idx = mvif->omac_idx;
--	bss->band_idx = mvif->band_idx;
--	bss->wmm_idx = mvif->wmm_idx;
-+	bss->omac_idx = mconf->mt76.omac_idx;
-+	bss->band_idx = mconf->mt76.band_idx;
-+	bss->wmm_idx = mconf->mt76.wmm_idx;
- 	bss->conn_state = !enable;
- 	bss->active = enable;
+-	mcs_map = &sta->deflink.eht_cap.eht_mcs_nss_supp;
+-	elem = &sta->deflink.eht_cap.eht_cap_elem;
++	mcs_map = &link_sta->eht_cap.eht_mcs_nss_supp;
++	elem = &link_sta->eht_cap.eht_cap_elem;
  
--	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
-+	idx = mconf->mt76.omac_idx > EXT_BSSID_START ? HW_BSSID_0 :
-+						       mconf->mt76.omac_idx;
- 	bss->hw_bss_idx = idx;
+ 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT, sizeof(*eht));
  
- 	if (vif->type == NL80211_IFTYPE_MONITOR) {
-@@ -1219,9 +1206,9 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
- 		return 0;
- 	}
+@@ -1444,7 +1446,7 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+ 	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
  
--	memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
--	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
--	bss->dtim_period = vif->bss_conf.dtim_period;
-+	memcpy(bss->bssid, conf->bssid, ETH_ALEN);
-+	bss->bcn_interval = cpu_to_le16(conf->beacon_int);
-+	bss->dtim_period = conf->dtim_period;
- 	bss->phymode = mt76_connac_get_phy_mode(phy, vif,
- 						chandef->chan->band, NULL);
- 	bss->phymode_ext = mt76_connac_get_phy_mode_ext(phy, vif,
-@@ -1248,63 +1235,64 @@ __mt7996_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
+ 	if (vif->type != NL80211_IFTYPE_STATION &&
+-	    (sta->deflink.he_cap.he_cap_elem.phy_cap_info[0] &
++	    (link_sta->he_cap.he_cap_elem.phy_cap_info[0] &
+ 	     (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G |
+ 	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
+ 	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
+@@ -1460,44 +1462,44 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  }
  
- int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
--			    struct ieee80211_vif *vif, int enable)
-+			    struct ieee80211_bss_conf *conf,
-+			    struct mt7996_bss_conf *mconf, int enable)
+ static void
+-mt7996_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
++mt7996_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
  {
-+	struct ieee80211_vif *vif = conf->vif;
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_dev *dev = phy->dev;
- 	struct sk_buff *skb;
- 
--	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START) {
--		mt7996_mcu_muar_config(phy, vif, false, enable);
--		mt7996_mcu_muar_config(phy, vif, true, enable);
-+	if (mconf->mt76.omac_idx >= REPEATER_BSSID_START) {
-+		mt7996_mcu_muar_config(phy, conf, mconf, false, enable);
-+		mt7996_mcu_muar_config(phy, conf, mconf, true, enable);
- 	}
- 
--	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76,
-+	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
- 					 MT7996_BSS_UPDATE_MAX_SIZE);
- 	if (IS_ERR(skb))
- 		return PTR_ERR(skb);
- 
- 	/* bss_basic must be first */
--	mt7996_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
-+	mt7996_mcu_bss_basic_tlv(skb, conf, mconf, NULL, phy->mt76,
- 				 mvif->sta.wcid.idx, enable);
--	mt7996_mcu_bss_sec_tlv(skb, vif);
-+	mt7996_mcu_bss_sec_tlv(skb, mconf);
- 
- 	if (vif->type == NL80211_IFTYPE_MONITOR)
- 		goto out;
- 
- 	if (enable) {
--		mt7996_mcu_bss_rfch_tlv(skb, vif, phy);
--		mt7996_mcu_bss_bmc_tlv(skb, vif, phy);
--		mt7996_mcu_bss_ra_tlv(skb, vif, phy);
-+		mt7996_mcu_bss_rfch_tlv(skb, phy);
-+		mt7996_mcu_bss_bmc_tlv(skb, mconf, phy);
-+		mt7996_mcu_bss_ra_tlv(skb);
- 		mt7996_mcu_bss_txcmd_tlv(skb, true);
--		mt7996_mcu_bss_ifs_timing_tlv(skb, vif);
-+		mt7996_mcu_bss_ifs_timing_tlv(skb, phy);
- 
--		if (vif->bss_conf.he_support)
--			mt7996_mcu_bss_he_tlv(skb, vif, phy);
-+		if (conf->he_support)
-+			mt7996_mcu_bss_he_tlv(skb, conf, phy);
+ 	struct sta_rec_ht_uni *ht;
+ 	struct tlv *tlv;
  
- 		/* this tag is necessary no matter if the vif is MLD */
--		mt7996_mcu_bss_mld_tlv(skb, vif);
-+		mt7996_mcu_bss_mld_tlv(skb, vif, mconf);
- 	}
+-	if (!sta->deflink.ht_cap.ht_supported)
++	if (!link_sta->ht_cap.ht_supported)
+ 		return;
  
--	mt7996_mcu_bss_mbssid_tlv(skb, vif, phy, enable);
-+	mt7996_mcu_bss_mbssid_tlv(skb, conf, phy, enable);
+ 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
  
- out:
- 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
- 				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
+ 	ht = (struct sta_rec_ht_uni *)tlv;
+-	ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
+-	ht->ampdu_param = u8_encode_bits(sta->deflink.ht_cap.ampdu_factor,
++	ht->ht_cap = cpu_to_le16(link_sta->ht_cap.cap);
++	ht->ampdu_param = u8_encode_bits(link_sta->ht_cap.ampdu_factor,
+ 					 IEEE80211_HT_AMPDU_PARM_FACTOR) |
+-			  u8_encode_bits(sta->deflink.ht_cap.ampdu_density,
++			  u8_encode_bits(link_sta->ht_cap.ampdu_density,
+ 					 IEEE80211_HT_AMPDU_PARM_DENSITY);
  }
  
--int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif)
-+int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct mt7996_bss_conf *mconf)
- {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_dev *dev = phy->dev;
- 	struct sk_buff *skb;
- 
--	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76,
-+	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
- 					 MT7996_BSS_UPDATE_MAX_SIZE);
- 	if (IS_ERR(skb))
- 		return PTR_ERR(skb);
- 
--	mt7996_mcu_bss_ifs_timing_tlv(skb, vif);
-+	mt7996_mcu_bss_ifs_timing_tlv(skb, phy);
- 
- 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
- 				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
-@@ -1346,12 +1334,12 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
- 			 bool enable)
+ static void
+-mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
++mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
  {
- 	struct mt7996_sta *msta = (struct mt7996_sta *)params->sta->drv_priv;
--	struct mt7996_vif *mvif = msta->vif;
-+	struct mt7996_bss_conf *mconf = mconf_dereference_protected(msta->vif, 0);
- 
- 	if (enable && !params->amsdu)
- 		msta->wcid.amsdu = false;
+ 	struct sta_rec_vht *vht;
+ 	struct tlv *tlv;
+ #ifdef CONFIG_MTK_VENDOR
+-	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_sta *msta = (struct mt7996_sta *)link_sta->sta->drv_priv;
+ 	struct mt7996_phy *phy = (struct mt7996_phy *)msta->vif->deflink.phy;
+ #endif
  
--	return mt7996_mcu_sta_ba(dev, &mvif->mt76, params, enable, true);
-+	return mt7996_mcu_sta_ba(dev, &mconf->mt76, params, enable, true);
- }
+ 	/* For 6G band, this tlv is necessary to let hw work normally */
+-	if (!sta->deflink.he_6ghz_capa.capa && !sta->deflink.vht_cap.vht_supported)
++	if (!link_sta->he_6ghz_capa.capa && !link_sta->vht_cap.vht_supported)
+ 		return;
  
- int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
-@@ -1359,13 +1347,14 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
- 			 bool enable)
- {
- 	struct mt7996_sta *msta = (struct mt7996_sta *)params->sta->drv_priv;
--	struct mt7996_vif *mvif = msta->vif;
-+	struct mt7996_bss_conf *mconf = mconf_dereference_protected(msta->vif, 0);
+ 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
  
--	return mt7996_mcu_sta_ba(dev, &mvif->mt76, params, enable, false);
-+	return mt7996_mcu_sta_ba(dev, &mconf->mt76, params, enable, false);
- }
+ 	vht = (struct sta_rec_vht *)tlv;
+-	vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
+-	vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
+-	vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
++	vht->vht_cap = cpu_to_le32(link_sta->vht_cap.cap);
++	vht->vht_rx_mcs_map = link_sta->vht_cap.vht_mcs.rx_mcs_map;
++	vht->vht_tx_mcs_map = link_sta->vht_cap.vht_mcs.tx_mcs_map;
+ #ifdef CONFIG_MTK_VENDOR
+ 	vht->rts_bw_sig = phy->rts_bw_sig;
+ #endif
+@@ -1505,9 +1507,10 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  
  static void
--mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
-+mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
-+		      struct mt7996_bss_conf *mconf,
- 		      struct ieee80211_sta *sta)
+ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+-			 struct ieee80211_vif *vif, struct ieee80211_sta *sta)
++			 struct ieee80211_vif *vif,
++			 struct ieee80211_link_sta *link_sta,
++			 struct mt7996_link_sta *mlink)
  {
- 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
-@@ -1386,9 +1375,9 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
- 		he->he_phy_cap[i] = elem->phy_cap_info[i];
- 	}
- 
--	if (vif->type == NL80211_IFTYPE_AP &&
-+	if (conf->vif->type == NL80211_IFTYPE_AP &&
- 	    (elem->phy_cap_info[1] & IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
--		u8p_replace_bits(&he->he_phy_cap[1], vif->bss_conf.he_ldpc,
-+		u8p_replace_bits(&he->he_phy_cap[1], conf->he_ldpc,
- 				 IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD);
+-	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 	struct sta_rec_amsdu *amsdu;
+ 	struct tlv *tlv;
  
- 	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
-@@ -1396,16 +1385,16 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
- 	case IEEE80211_STA_RX_BW_160:
- 		if (elem->phy_cap_info[0] &
- 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
--			mt7996_mcu_set_sta_he_mcs(sta,
-+			mt7996_mcu_set_sta_he_mcs(sta, mconf,
- 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
- 						  le16_to_cpu(mcs_map.rx_mcs_80p80));
+@@ -1516,16 +1519,16 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 	    vif->type != NL80211_IFTYPE_AP)
+ 		return;
  
--		mt7996_mcu_set_sta_he_mcs(sta,
-+		mt7996_mcu_set_sta_he_mcs(sta, mconf,
- 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
- 					  le16_to_cpu(mcs_map.rx_mcs_160));
- 		fallthrough;
- 	default:
--		mt7996_mcu_set_sta_he_mcs(sta,
-+		mt7996_mcu_set_sta_he_mcs(sta, mconf,
- 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
- 					  le16_to_cpu(mcs_map.rx_mcs_80));
- 		break;
-@@ -1496,7 +1485,7 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
- 	struct tlv *tlv;
- #ifdef CONFIG_MTK_VENDOR
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
--	struct mt7996_phy *phy = (struct mt7996_phy *)msta->vif->phy;
-+	struct mt7996_phy *phy = (struct mt7996_phy *)msta->vif->deflink.phy;
- #endif
+-	if (!sta->deflink.agg.max_amsdu_len)
++	if (!link_sta->agg.max_amsdu_len)
+ 		return;
  
- 	/* For 6G band, this tlv is necessary to let hw work normally */
-@@ -1553,25 +1542,26 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
+ 	amsdu = (struct sta_rec_amsdu *)tlv;
+ 	amsdu->max_amsdu_num = 8;
+ 	amsdu->amsdu_en = true;
+-	msta->wcid.amsdu = true;
++	mlink->wcid.amsdu = true;
  
- static void
+-	switch (sta->deflink.agg.max_amsdu_len) {
++	switch (link_sta->agg.max_amsdu_len) {
+ 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
+ 		amsdu->max_mpdu_size =
+ 			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
+@@ -1544,10 +1547,10 @@ static void
  mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
--			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
-+			struct ieee80211_bss_conf *conf,
-+			struct mt7996_bss_conf *mconf,
-+			struct ieee80211_sta *sta)
+ 			struct ieee80211_bss_conf *conf,
+ 			struct mt7996_bss_conf *mconf,
+-			struct ieee80211_sta *sta)
++			struct ieee80211_link_sta *link_sta)
  {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct mt7996_phy *phy = mvif->phy;
-+	struct mt7996_phy *phy = mconf->phy;
- 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
+ 	struct mt7996_phy *phy = mconf->phy;
+-	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
++	struct ieee80211_he_cap_elem *elem = &link_sta->he_cap.he_cap_elem;
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
  
--	if (vif->type != NL80211_IFTYPE_STATION &&
--	    vif->type != NL80211_IFTYPE_AP)
-+	if (conf->vif->type != NL80211_IFTYPE_STATION &&
-+	    conf->vif->type != NL80211_IFTYPE_AP)
- 		return;
+@@ -1567,11 +1570,11 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 	muru->cfg.ofdma_dl_en = !!(phy->muru_onoff & OFDMA_DL);
+ 	muru->cfg.ofdma_ul_en = !!(phy->muru_onoff & OFDMA_UL);
  
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
+-	if (sta->deflink.vht_cap.vht_supported)
++	if (link_sta->vht_cap.vht_supported)
+ 		muru->mimo_dl.vht_mu_bfee =
+-			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
++			!!(link_sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
  
- 	muru = (struct sta_rec_muru *)tlv;
--	muru->cfg.mimo_dl_en = (vif->bss_conf.eht_mu_beamformer ||
--				vif->bss_conf.he_mu_beamformer ||
--				vif->bss_conf.vht_mu_beamformer ||
--				vif->bss_conf.vht_mu_beamformee) &&
-+	muru->cfg.mimo_dl_en = (conf->eht_mu_beamformer ||
-+				conf->he_mu_beamformer ||
-+				conf->vht_mu_beamformer ||
-+				conf->vht_mu_beamformee) &&
- 			       !!(phy->muru_onoff & MUMIMO_DL);
- 	muru->cfg.mimo_ul_en = !!(phy->muru_onoff & MUMIMO_UL);
- 	muru->cfg.ofdma_dl_en = !!(phy->muru_onoff & OFDMA_DL);
-@@ -1612,13 +1602,14 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- }
+-	if (!sta->deflink.he_cap.has_he)
++	if (!link_sta->he_cap.has_he)
+ 		return;
  
+ 	muru->mimo_dl.partial_bw_dl_mimo =
+@@ -1604,7 +1607,7 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  static inline bool
--mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
-+mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
-+			struct mt7996_bss_conf *mconf,
- 			struct ieee80211_sta *sta, bool bfee)
+ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
+ 			struct mt7996_bss_conf *mconf,
+-			struct ieee80211_sta *sta, bool bfee)
++			struct ieee80211_link_sta *link_sta, bool bfee)
  {
  	int sts = hweight16(phy->mt76->chainmask);
  
--	if (vif->type != NL80211_IFTYPE_STATION &&
--	    vif->type != NL80211_IFTYPE_AP)
-+	if (conf->vif->type != NL80211_IFTYPE_STATION &&
-+	    conf->vif->type != NL80211_IFTYPE_AP)
+@@ -1615,8 +1618,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
+ 	if (!bfee && sts < 2)
  		return false;
  
- 	if (!bfee && sts < 2)
-@@ -1629,10 +1620,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+-	if (sta->deflink.eht_cap.has_eht) {
+-		struct ieee80211_sta_eht_cap *pc = &sta->deflink.eht_cap;
++	if (link_sta->eht_cap.has_eht) {
++		struct ieee80211_sta_eht_cap *pc = &link_sta->eht_cap;
  		struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
  
  		if (bfee)
--			return vif->bss_conf.eht_su_beamformee &&
-+			return conf->eht_su_beamformee &&
- 			       EHT_PHY(CAP0_SU_BEAMFORMEE, pe->phy_cap_info[0]);
- 		else
--			return vif->bss_conf.eht_su_beamformer &&
-+			return conf->eht_su_beamformer &&
+@@ -1627,8 +1630,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
  			       EHT_PHY(CAP0_SU_BEAMFORMER, pe->phy_cap_info[0]);
  	}
  
+-	if (sta->deflink.he_cap.has_he) {
+-		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
++	if (link_sta->he_cap.has_he) {
++		struct ieee80211_he_cap_elem *pe = &link_sta->he_cap.he_cap_elem;
+ 
+ 		if (bfee)
+ 			return conf->he_su_beamformee &&
+@@ -1638,8 +1641,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
+ 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
+ 	}
+ 
+-	if (sta->deflink.vht_cap.vht_supported) {
+-		u32 cap = sta->deflink.vht_cap.cap;
++	if (link_sta->vht_cap.vht_supported) {
++		u32 cap = link_sta->vht_cap.cap;
+ 
+ 		if (bfee)
+ 			return conf->vht_su_beamformee &&
+@@ -1662,10 +1665,10 @@ mt7996_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
+ }
+ 
+ static void
+-mt7996_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
+-		       struct sta_rec_bf *bf)
++mt7996_mcu_sta_bfer_ht(struct ieee80211_link_sta *link_sta,
++		       struct mt7996_phy *phy, struct sta_rec_bf *bf)
+ {
+-	struct ieee80211_mcs_info *mcs = &sta->deflink.ht_cap.mcs;
++	struct ieee80211_mcs_info *mcs = &link_sta->ht_cap.mcs;
+ 	u8 n = 0;
+ 
+ 	bf->tx_mode = MT_PHY_TYPE_HT;
+@@ -1687,10 +1690,11 @@ mt7996_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
+ }
+ 
+ static void
+-mt7996_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
+-			struct sta_rec_bf *bf, bool explicit)
++mt7996_mcu_sta_bfer_vht(struct ieee80211_link_sta *link_sta,
++			struct mt7996_phy *phy, struct sta_rec_bf *bf,
++			bool explicit)
+ {
+-	struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
++	struct ieee80211_sta_vht_cap *pc = &link_sta->vht_cap;
+ 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
+ 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
+ 	u8 nss_mcs = mt7996_mcu_get_sta_nss(mcs_map);
+@@ -1711,23 +1715,24 @@ mt7996_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
+ 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
+ 		bf->ibf_ncol = bf->ncol;
+ 
-@@ -1640,10 +1631,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
- 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
+-		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
++		if (link_sta->bandwidth == IEEE80211_STA_RX_BW_160)
+ 			bf->nrow = 1;
+ 	} else {
+ 		bf->nrow = tx_ant;
+ 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
+ 		bf->ibf_ncol = nss_mcs;
  
- 		if (bfee)
--			return vif->bss_conf.he_su_beamformee &&
-+			return conf->he_su_beamformee &&
- 			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
- 		else
--			return vif->bss_conf.he_su_beamformer &&
-+			return conf->he_su_beamformer &&
- 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
+-		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
++		if (link_sta->bandwidth == IEEE80211_STA_RX_BW_160)
+ 			bf->ibf_nrow = 1;
  	}
+ }
  
-@@ -1651,10 +1642,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
- 		u32 cap = sta->deflink.vht_cap.cap;
+ static void
+-mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+-		       struct mt7996_phy *phy, struct sta_rec_bf *bf)
++mt7996_mcu_sta_bfer_he(struct ieee80211_link_sta *link_sta,
++		       struct ieee80211_vif *vif, struct mt7996_phy *phy,
++		       struct sta_rec_bf *bf)
+ {
+-	struct ieee80211_sta_he_cap *pc = &sta->deflink.he_cap;
++	struct ieee80211_sta_he_cap *pc = &link_sta->he_cap;
+ 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
+ 	const struct ieee80211_sta_he_cap *vc =
+ 		mt76_connac_get_he_phy_cap(phy->mt76, vif);
+@@ -1752,7 +1757,7 @@ mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+ 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
+ 	bf->ibf_ncol = bf->ncol;
  
- 		if (bfee)
--			return vif->bss_conf.vht_su_beamformee &&
-+			return conf->vht_su_beamformee &&
- 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
- 		else
--			return vif->bss_conf.vht_su_beamformer &&
-+			return conf->vht_su_beamformer &&
- 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
- 	}
+-	if (sta->deflink.bandwidth != IEEE80211_STA_RX_BW_160)
++	if (link_sta->bandwidth != IEEE80211_STA_RX_BW_160)
+ 		return;
+ 
+ 	/* go over for 160MHz and 80p80 */
+@@ -1784,10 +1789,11 @@ mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+ }
+ 
+ static void
+-mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+-			struct mt7996_phy *phy, struct sta_rec_bf *bf)
++mt7996_mcu_sta_bfer_eht(struct ieee80211_link_sta *link_sta,
++			struct ieee80211_vif *vif, struct mt7996_phy *phy,
++			struct sta_rec_bf *bf)
+ {
+-	struct ieee80211_sta_eht_cap *pc = &sta->deflink.eht_cap;
++	struct ieee80211_sta_eht_cap *pc = &link_sta->eht_cap;
+ 	struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
+ 	struct ieee80211_eht_mcs_nss_supp *eht_nss = &pc->eht_mcs_nss_supp;
+ 	const struct ieee80211_sta_eht_cap *vc =
+@@ -1810,10 +1816,10 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+ 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
+ 	bf->ibf_ncol = bf->ncol;
  
-@@ -1850,10 +1841,10 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+-	if (sta->deflink.bandwidth < IEEE80211_STA_RX_BW_160)
++	if (link_sta->bandwidth < IEEE80211_STA_RX_BW_160)
+ 		return;
  
+-	switch (sta->deflink.bandwidth) {
++	switch (link_sta->bandwidth) {
+ 	case IEEE80211_STA_RX_BW_160:
+ 		snd_dim = EHT_PHY(CAP2_SOUNDING_DIM_160MHZ_MASK, ve->phy_cap_info[2]);
+ 		sts = EHT_PHY(CAP1_BEAMFORMEE_SS_160MHZ_MASK, pe->phy_cap_info[1]);
+@@ -1842,7 +1848,7 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  static void
  mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
--			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
-+			struct ieee80211_bss_conf *conf, struct mt7996_bss_conf *mconf,
-+			struct ieee80211_sta *sta)
+ 			struct ieee80211_bss_conf *conf, struct mt7996_bss_conf *mconf,
+-			struct ieee80211_sta *sta)
++			struct ieee80211_link_sta *link_sta)
  {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct mt7996_phy *phy = mvif->phy;
-+	struct mt7996_phy *phy = mconf->phy;
+ 	struct mt7996_phy *phy = mconf->phy;
  	int tx_ant = hweight16(phy->mt76->chainmask) - 1;
- 	struct sta_rec_bf *bf;
- 	struct tlv *tlv;
-@@ -1868,7 +1859,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- 	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
+@@ -1856,10 +1862,10 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 	};
+ 	bool ebf;
+ 
+-	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
++	if (!(link_sta->ht_cap.ht_supported || link_sta->he_cap.has_he))
  		return;
  
--	ebf = mt7996_is_ebf_supported(phy, vif, sta, false);
-+	ebf = mt7996_is_ebf_supported(phy, conf, mconf, sta, false);
+-	ebf = mt7996_is_ebf_supported(phy, conf, mconf, sta, false);
++	ebf = mt7996_is_ebf_supported(phy, conf, mconf, link_sta, false);
  	if (!ebf && !dev->ibf)
  		return;
  
-@@ -1880,9 +1871,9 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1870,23 +1876,23 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 	 * vht: support eBF and iBF
  	 * ht: iBF only, since mac80211 lacks of eBF support
  	 */
- 	if (sta->deflink.eht_cap.has_eht && ebf)
--		mt7996_mcu_sta_bfer_eht(sta, vif, phy, bf);
-+		mt7996_mcu_sta_bfer_eht(sta, conf->vif, phy, bf);
- 	else if (sta->deflink.he_cap.has_he && ebf)
--		mt7996_mcu_sta_bfer_he(sta, vif, phy, bf);
-+		mt7996_mcu_sta_bfer_he(sta, conf->vif, phy, bf);
- 	else if (sta->deflink.vht_cap.vht_supported)
- 		mt7996_mcu_sta_bfer_vht(sta, phy, bf, ebf);
- 	else if (sta->deflink.ht_cap.ht_supported)
-@@ -1921,10 +1912,10 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+-	if (sta->deflink.eht_cap.has_eht && ebf)
+-		mt7996_mcu_sta_bfer_eht(sta, conf->vif, phy, bf);
+-	else if (sta->deflink.he_cap.has_he && ebf)
+-		mt7996_mcu_sta_bfer_he(sta, conf->vif, phy, bf);
+-	else if (sta->deflink.vht_cap.vht_supported)
+-		mt7996_mcu_sta_bfer_vht(sta, phy, bf, ebf);
+-	else if (sta->deflink.ht_cap.ht_supported)
+-		mt7996_mcu_sta_bfer_ht(sta, phy, bf);
++	if (link_sta->eht_cap.has_eht && ebf)
++		mt7996_mcu_sta_bfer_eht(link_sta, conf->vif, phy, bf);
++	else if (link_sta->he_cap.has_he && ebf)
++		mt7996_mcu_sta_bfer_he(link_sta, conf->vif, phy, bf);
++	else if (link_sta->vht_cap.vht_supported)
++		mt7996_mcu_sta_bfer_vht(link_sta, phy, bf, ebf);
++	else if (link_sta->ht_cap.ht_supported)
++		mt7996_mcu_sta_bfer_ht(link_sta, phy, bf);
+ 	else
+ 		return;
  
+ 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
+-	bf->bw = sta->deflink.bandwidth;
+-	bf->ibf_dbw = sta->deflink.bandwidth;
++	bf->bw = link_sta->bandwidth;
++	bf->ibf_dbw = link_sta->bandwidth;
+ 	bf->ibf_nrow = tx_ant;
+ 
+-	if (!ebf && sta->deflink.bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
++	if (!ebf && link_sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
+ 		bf->ibf_timeout = 0x48;
+ 	else
+ 		bf->ibf_timeout = 0x18;
+@@ -1896,7 +1902,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 	else
+ 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
+ 
+-	switch (sta->deflink.bandwidth) {
++	switch (link_sta->bandwidth) {
+ 	case IEEE80211_STA_RX_BW_160:
+ 	case IEEE80211_STA_RX_BW_80:
+ 		bf->mem_total = bf->mem_20m * 2;
+@@ -1913,7 +1919,8 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  static void
  mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
--			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
-+			struct ieee80211_bss_conf *conf,
-+			struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta)
+ 			struct ieee80211_bss_conf *conf,
+-			struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta)
++			struct mt7996_bss_conf *mconf,
++			struct ieee80211_link_sta *link_sta)
  {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct mt7996_phy *phy = mvif->phy;
-+	struct mt7996_phy *phy = mconf->phy;
+ 	struct mt7996_phy *phy = mconf->phy;
  	int tx_ant = hweight8(phy->mt76->antenna_mask) - 1;
- 	struct sta_rec_bfee *bfee;
+@@ -1921,22 +1928,22 @@ mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
-@@ -1933,7 +1924,7 @@ mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- 	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
+ 	u8 nrow = 0;
+ 
+-	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
++	if (!(link_sta->vht_cap.vht_supported || link_sta->he_cap.has_he))
  		return;
  
--	if (!mt7996_is_ebf_supported(phy, vif, sta, true))
-+	if (!mt7996_is_ebf_supported(phy, conf, mconf, sta, true))
+-	if (!mt7996_is_ebf_supported(phy, conf, mconf, sta, true))
++	if (!mt7996_is_ebf_supported(phy, conf, mconf, link_sta, true))
  		return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
-@@ -2055,17 +2046,17 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
- 				     MCU_WM_UNI_CMD(RA), true);
- }
+ 	bfee = (struct sta_rec_bfee *)tlv;
+ 
+-	if (sta->deflink.he_cap.has_he) {
+-		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
++	if (link_sta->he_cap.has_he) {
++		struct ieee80211_he_cap_elem *pe = &link_sta->he_cap.he_cap_elem;
  
--int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
-+			       struct mt7996_bss_conf *mconf,
- 			       struct ieee80211_sta *sta, void *data, u32 field)
+ 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
+ 			      pe->phy_cap_info[5]);
+-	} else if (sta->deflink.vht_cap.vht_supported) {
+-		struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
++	} else if (link_sta->vht_cap.vht_supported) {
++		struct ieee80211_sta_vht_cap *pc = &link_sta->vht_cap;
+ 
+ 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
+ 				 pc->cap);
+@@ -1973,25 +1980,24 @@ mt7996_mcu_sta_hdrt_tlv(struct mt7996_dev *dev, struct sk_buff *skb)
+ static void
+ mt7996_mcu_sta_hdr_trans_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 			     struct ieee80211_vif *vif,
+-			     struct ieee80211_sta *sta)
++			     struct mt7996_link_sta *mlink)
  {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 	struct sta_rec_hdr_trans *hdr_trans;
+-	struct mt76_wcid *wcid;
++	struct mt76_wcid *wcid = &mlink->wcid;
+ 	struct tlv *tlv;
+ 
+ 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HDR_TRANS, sizeof(*hdr_trans));
+ 	hdr_trans = (struct sta_rec_hdr_trans *)tlv;
+ 	hdr_trans->dis_rx_hdr_tran = true;
+ 
++	if (!wcid->sta)
++		return;
++
+ 	if (vif->type == NL80211_IFTYPE_STATION)
+ 		hdr_trans->to_ds = true;
+ 	else
+ 		hdr_trans->from_ds = true;
+ 
+-	if (!sta)
+-		return;
+-
+-	wcid = (struct mt76_wcid *)sta->drv_priv;
+ 	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
+ 	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
+ 		hdr_trans->to_ds = true;
+@@ -2048,16 +2054,17 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
+ 
+ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
+ 			       struct mt7996_bss_conf *mconf,
+-			       struct ieee80211_sta *sta, void *data, u32 field)
++			       struct ieee80211_link_sta *link_sta,
++			       struct mt7996_link_sta *mlink, void *data,
++			       u32 field)
+ {
+-	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
  	struct sta_phy_uni *phy = data;
  	struct sta_rec_ra_fixed_uni *ra;
  	struct sk_buff *skb;
  	struct tlv *tlv;
  
--	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
-+	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
- 					      &msta->wcid,
+ 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
+-					      &msta->wcid,
++					      &mlink->wcid,
  					      MT7996_STA_UPDATE_MAX_SIZE);
  	if (IS_ERR(skb))
-@@ -2097,12 +2088,13 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif
- }
- 
- static int
--mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
-+			       struct ieee80211_bss_conf *conf,
-+			       struct mt7996_bss_conf *mconf,
- 			       struct ieee80211_sta *sta)
+ 		return PTR_ERR(skb);
+@@ -2076,7 +2083,7 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
+ 			ra->phy = *phy;
+ 		break;
+ 	case RATE_PARAM_MMPS_UPDATE:
+-		ra->mmps_mode = mt7996_mcu_get_mmps_mode(sta->deflink.smps_mode);
++		ra->mmps_mode = mt7996_mcu_get_mmps_mode(link_sta->smps_mode);
+ 		break;
+ 	default:
+ 		break;
+@@ -2091,7 +2098,8 @@ static int
+ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
+ 			       struct ieee80211_bss_conf *conf,
+ 			       struct mt7996_bss_conf *mconf,
+-			       struct ieee80211_sta *sta)
++			       struct ieee80211_link_sta *link_sta,
++			       struct mt7996_link_sta *mlink)
  {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
--	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
-+	struct cfg80211_chan_def *chandef = &mconf->phy->mt76->chandef;
-+	struct cfg80211_bitrate_mask *mask = &mconf->bitrate_mask;
- 	enum nl80211_band band = chandef->chan->band;
- 	struct sta_phy_uni phy = {};
- 	int ret, nrates = 0;
-@@ -2144,7 +2136,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
+ 	struct cfg80211_chan_def *chandef = &mconf->phy->mt76->chandef;
+ 	struct cfg80211_bitrate_mask *mask = &mconf->bitrate_mask;
+@@ -2115,11 +2123,11 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
+ 		}								\
+ 	} while (0)
+ 
+-	if (sta->deflink.he_cap.has_he) {
++	if (link_sta->he_cap.has_he) {
+ 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
+-	} else if (sta->deflink.vht_cap.vht_supported) {
++	} else if (link_sta->vht_cap.vht_supported) {
+ 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
+-	} else if (sta->deflink.ht_cap.ht_supported) {
++	} else if (link_sta->ht_cap.ht_supported) {
+ 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
+ 	} else {
+ 		nrates = hweight32(mask->control[band].legacy);
+@@ -2136,8 +2144,8 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
  
  	/* fixed single rate */
  	if (nrates == 1) {
--		ret = mt7996_mcu_set_fixed_field(dev, vif, sta, &phy,
-+		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
- 						 RATE_PARAM_FIXED_MCS);
+-		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
+-						 RATE_PARAM_FIXED_MCS);
++		ret = mt7996_mcu_set_fixed_field(dev, mconf, link_sta, mlink,
++						 &phy, RATE_PARAM_FIXED_MCS);
  		if (ret)
  			return ret;
-@@ -2166,7 +2158,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
+ 	}
+@@ -2145,29 +2153,28 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
+ 	/* fixed GI */
+ 	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
+ 	    mask->control[band].he_gi != GENMASK(7, 0)) {
+-		struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 		u32 addr;
+ 
+ 		/* firmware updates only TXCMD but doesn't take WTBL into
+ 		 * account, so driver should update here to reflect the
+ 		 * actual txrate hardware sends out.
+ 		 */
+-		addr = mt7996_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
+-		if (sta->deflink.he_cap.has_he)
++		addr = mt7996_mac_wtbl_lmac_addr(dev, mlink->wcid.idx, 7);
++		if (link_sta->he_cap.has_he)
+ 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
  		else
  			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
  
--		ret = mt7996_mcu_set_fixed_field(dev, vif, sta, &phy,
-+		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
- 						 RATE_PARAM_FIXED_GI);
+-		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
+-						 RATE_PARAM_FIXED_GI);
++		ret = mt7996_mcu_set_fixed_field(dev, mconf, link_sta, mlink,
++						 &phy, RATE_PARAM_FIXED_GI);
  		if (ret)
  			return ret;
-@@ -2174,7 +2166,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
+ 	}
  
  	/* fixed HE_LTF */
  	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
--		ret = mt7996_mcu_set_fixed_field(dev, vif, sta, &phy,
-+		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
- 						 RATE_PARAM_FIXED_HE_LTF);
+-		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
+-						 RATE_PARAM_FIXED_HE_LTF);
++		ret = mt7996_mcu_set_fixed_field(dev, mconf, link_sta, mlink,
++						 &phy, RATE_PARAM_FIXED_HE_LTF);
  		if (ret)
  			return ret;
-@@ -2185,13 +2177,14 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
- 
- static void
+ 	}
+@@ -2179,7 +2186,7 @@ static void
  mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
--			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
-+			     struct ieee80211_bss_conf *conf,
-+			     struct mt7996_bss_conf *mconf,
-+			     struct ieee80211_sta *sta)
+ 			     struct ieee80211_bss_conf *conf,
+ 			     struct mt7996_bss_conf *mconf,
+-			     struct ieee80211_sta *sta)
++			     struct ieee80211_link_sta *link_sta)
  {
  #define INIT_RCPI 180
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct mt76_phy *mphy = mvif->phy->mt76;
-+	struct mt76_phy *mphy = mconf->phy->mt76;
- 	struct cfg80211_chan_def *chandef = &mphy->chandef;
--	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
-+	struct cfg80211_bitrate_mask *mask = &mconf->bitrate_mask;
+ 	struct mt76_phy *mphy = mconf->phy->mt76;
+@@ -2188,20 +2195,20 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  	enum nl80211_band band = chandef->chan->band;
  	struct sta_rec_ra_uni *ra;
  	struct tlv *tlv;
-@@ -2203,7 +2196,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+-	u32 supp_rate = sta->deflink.supp_rates[band];
+-	u32 cap = sta->wme ? STA_CAP_WMM : 0;
++	u32 supp_rate = link_sta->supp_rates[band];
++	u32 cap = link_sta->sta->wme ? STA_CAP_WMM : 0;
+ 
+ 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
+ 	ra = (struct sta_rec_ra_uni *)tlv;
  
  	ra->valid = true;
  	ra->auto_rate = true;
--	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
-+	ra->phy_mode = mt76_connac_get_phy_mode(mphy, conf->vif, band, sta);
+-	ra->phy_mode = mt76_connac_get_phy_mode(mphy, conf->vif, band, sta);
++	ra->phy_mode = mt76_connac_get_phy_mode(mphy, conf->vif, band, link_sta);
  	ra->channel = chandef->chan->hw_value;
- 	ra->bw = (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_320) ?
- 		 CMD_CBW_320MHZ : sta->deflink.bandwidth;
-@@ -2242,7 +2235,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+-	ra->bw = (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_320) ?
+-		 CMD_CBW_320MHZ : sta->deflink.bandwidth;
++	ra->bw = (link_sta->bandwidth == IEEE80211_STA_RX_BW_320) ?
++		 CMD_CBW_320MHZ : link_sta->bandwidth;
+ 	ra->phy.bw = ra->bw;
+-	ra->mmps_mode = mt7996_mcu_get_mmps_mode(sta->deflink.smps_mode);
++	ra->mmps_mode = mt7996_mcu_get_mmps_mode(link_sta->smps_mode);
+ 
+ 	if (supp_rate) {
+ 		supp_rate &= mask->control[band].legacy;
+@@ -2221,60 +2228,60 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+ 		}
+ 	}
+ 
+-	if (sta->deflink.ht_cap.ht_supported) {
++	if (link_sta->ht_cap.ht_supported) {
+ 		ra->supp_mode |= MODE_HT;
+-		ra->af = sta->deflink.ht_cap.ampdu_factor;
+-		ra->ht_gf = !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
++		ra->af = link_sta->ht_cap.ampdu_factor;
++		ra->ht_gf = !!(link_sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
+ 
+ 		cap |= STA_CAP_HT;
+-		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
++		if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
+ 			cap |= STA_CAP_SGI_20;
+-		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
++		if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
+ 			cap |= STA_CAP_SGI_40;
+-		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
++		if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
  			cap |= STA_CAP_TX_STBC;
- 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
+-		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
++		if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
  			cap |= STA_CAP_RX_STBC;
--		if (vif->bss_conf.ht_ldpc &&
-+		if (conf->ht_ldpc &&
- 		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
+ 		if (conf->ht_ldpc &&
+-		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
++		    (link_sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
  			cap |= STA_CAP_LDPC;
  
+-		mt7996_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
++		mt7996_mcu_set_sta_ht_mcs(link_sta, ra->ht_mcs,
+ 					  mask->control[band].ht_mcs);
+ 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
+ 	}
+ 
-@@ -2268,7 +2261,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+-	if (sta->deflink.vht_cap.vht_supported) {
++	if (link_sta->vht_cap.vht_supported) {
+ 		u8 af;
+ 
+ 		ra->supp_mode |= MODE_VHT;
+ 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
+-			       sta->deflink.vht_cap.cap);
++			       link_sta->vht_cap.cap);
+ 		ra->af = max_t(u8, ra->af, af);
+ 
+ 		cap |= STA_CAP_VHT;
+-		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
++		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
+ 			cap |= STA_CAP_VHT_SGI_80;
+-		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
++		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
+ 			cap |= STA_CAP_VHT_SGI_160;
+-		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
++		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
  			cap |= STA_CAP_VHT_TX_STBC;
- 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
+-		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
++		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
  			cap |= STA_CAP_VHT_RX_STBC;
--		if (vif->bss_conf.vht_ldpc &&
-+		if (conf->vht_ldpc &&
- 		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
+ 		if (conf->vht_ldpc &&
+-		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
++		    (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
  			cap |= STA_CAP_VHT_LDPC;
  
-@@ -2289,15 +2282,16 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
- 	memset(ra->rx_rcpi, INIT_RCPI, sizeof(ra->rx_rcpi));
- }
+-		mt7996_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
++		mt7996_mcu_set_sta_vht_mcs(link_sta, ra->supp_vht_mcs,
+ 					   mask->control[band].vht_mcs);
+ 	}
  
--int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
-+			     struct ieee80211_bss_conf *conf,
-+			     struct mt7996_bss_conf *mconf,
- 			     struct ieee80211_sta *sta, bool changed)
+-	if (sta->deflink.he_cap.has_he) {
++	if (link_sta->he_cap.has_he) {
+ 		ra->supp_mode |= MODE_HE;
+ 		cap |= STA_CAP_HE;
+ 
+-		if (sta->deflink.he_6ghz_capa.capa)
+-			ra->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
++		if (link_sta->he_6ghz_capa.capa)
++			ra->af = le16_get_bits(link_sta->he_6ghz_capa.capa,
+ 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
+ 	}
+ 	ra->sta_cap = cpu_to_le32(cap);
+@@ -2285,14 +2292,14 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+ 			     struct ieee80211_bss_conf *conf,
+ 			     struct mt7996_bss_conf *mconf,
+-			     struct ieee80211_sta *sta, bool changed)
++			     struct ieee80211_link_sta *link_sta,
++			     struct mt7996_link_sta *mlink, bool changed)
  {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+-	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
  	struct sk_buff *skb;
  	int ret;
  
--	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
-+	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
- 					      &msta->wcid,
+ 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
+-					      &msta->wcid,
++					      &mlink->wcid,
  					      MT7996_STA_UPDATE_MAX_SIZE);
  	if (IS_ERR(skb))
-@@ -2308,26 +2302,27 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ 		return PTR_ERR(skb);
+@@ -2302,26 +2309,27 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  	 * update sta_rec_he here.
  	 */
  	if (changed)
--		mt7996_mcu_sta_he_tlv(skb, vif, sta);
-+		mt7996_mcu_sta_he_tlv(skb, conf, mconf, sta);
+-		mt7996_mcu_sta_he_tlv(skb, conf, mconf, sta);
++		mt7996_mcu_sta_he_tlv(skb, conf, mconf, link_sta);
  
  	/* sta_rec_ra accommodates BW, NSS and only MCS range format
  	 * i.e 0-{7,8,9} for VHT.
  	 */
--	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
-+	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, conf, mconf, sta);
+-	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, conf, mconf, sta);
++	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, conf, mconf, link_sta);
  
  	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
  				    MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
  	if (ret)
  		return ret;
  
--	return mt7996_mcu_add_rate_ctrl_fixed(dev, vif, sta);
-+	return mt7996_mcu_add_rate_ctrl_fixed(dev, conf, mconf, sta);
+-	return mt7996_mcu_add_rate_ctrl_fixed(dev, conf, mconf, sta);
++	return mt7996_mcu_add_rate_ctrl_fixed(dev, conf, mconf, link_sta, mlink);
  }
  
  static int
--mt7996_mcu_sta_init_vow(struct mt7996_phy *phy, struct mt7996_sta *msta)
-+mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf, struct mt7996_sta *msta)
+-mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf, struct mt7996_sta *msta)
++mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf,
++			struct mt7996_link_sta *mlink)
  {
-+	struct mt7996_phy *phy = mconf->phy;
- 	struct mt7996_vow_sta_ctrl *vow = &msta->vow;
--	u8 omac_idx = msta->vif->mt76.omac_idx;
-+	u8 omac_idx = mconf->mt76.omac_idx;
+ 	struct mt7996_phy *phy = mconf->phy;
+-	struct mt7996_vow_sta_ctrl *vow = &msta->vow;
++	struct mt7996_vow_sta_ctrl *vow = &mlink->vow;
+ 	u8 omac_idx = mconf->mt76.omac_idx;
  	int ret;
  
- 	/* Assignment of STA BSS group index aligns FW.
-@@ -2344,20 +2339,22 @@ mt7996_mcu_sta_init_vow(struct mt7996_phy *phy, struct mt7996_sta *msta)
+@@ -2339,73 +2347,70 @@ mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf, struct mt7996_sta *msta)
  	vow->drr_quantum[IEEE80211_AC_BE] = VOW_DRR_QUANTUM_IDX2;
  	vow->drr_quantum[IEEE80211_AC_BK] = VOW_DRR_QUANTUM_IDX2;
  
--	ret = mt7996_mcu_set_vow_drr_ctrl(phy, msta, VOW_DRR_CTRL_STA_BSS_GROUP);
-+	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_BSS_GROUP);
+-	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_BSS_GROUP);
++	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, mlink, VOW_DRR_CTRL_STA_BSS_GROUP);
  	if (ret)
  		return ret;
  
--	ret = mt7996_mcu_set_vow_drr_ctrl(phy, msta, VOW_DRR_CTRL_STA_PAUSE);
-+	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_PAUSE);
+-	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_PAUSE);
++	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, mlink, VOW_DRR_CTRL_STA_PAUSE);
  	if (ret)
  		return ret;
  
--	return mt7996_mcu_set_vow_drr_ctrl(phy, msta, VOW_DRR_CTRL_STA_ALL);
-+	return mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_ALL);
+-	return mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_ALL);
++	return mt7996_mcu_set_vow_drr_ctrl(phy, mconf, mlink, VOW_DRR_CTRL_STA_ALL);
  }
  
--int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
--		       struct ieee80211_sta *sta, bool enable, bool newly)
-+int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
-+		       struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta,
-+		       bool enable, bool newly)
+ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+-		       struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta,
+-		       bool enable, bool newly)
++		       struct mt7996_bss_conf *mconf,
++		       struct ieee80211_link_sta *link_sta,
++		       struct mt7996_link_sta *mlink, bool enable, bool newly)
  {
-+	struct ieee80211_vif *vif = conf->vif;
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_sta *msta;
+ 	struct ieee80211_vif *vif = conf->vif;
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+-	struct mt7996_sta *msta;
  	struct sk_buff *skb;
-@@ -2365,7 +2362,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
- 
- 	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mvif->sta;
+ 	int ret;
  
--	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
-+	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
- 					      &msta->wcid,
+-	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mvif->sta;
+-
+ 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
+-					      &msta->wcid,
++					      &mlink->wcid,
  					      MT7996_STA_UPDATE_MAX_SIZE);
  	if (IS_ERR(skb))
-@@ -2387,7 +2384,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ 		return PTR_ERR(skb);
+ 
+ 	/* starec basic */
+-	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, sta, enable, newly);
++	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, link_sta, enable, newly);
+ 
+ 	if (!enable)
+ 		goto out;
+ 
+ 	/* starec hdr trans */
+-	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, sta);
++	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, mlink);
+ 	/* starec tx proc */
+ 	mt7996_mcu_sta_tx_proc_tlv(skb);
+ 
+ 	/* tag order is in accordance with firmware dependency. */
+-	if (sta) {
++	if (link_sta) {
  		/* starec hdrt mode */
  		mt7996_mcu_sta_hdrt_tlv(dev, skb);
  		/* starec bfer */
--		mt7996_mcu_sta_bfer_tlv(dev, skb, vif, sta);
-+		mt7996_mcu_sta_bfer_tlv(dev, skb, conf, mconf, sta);
+-		mt7996_mcu_sta_bfer_tlv(dev, skb, conf, mconf, sta);
++		mt7996_mcu_sta_bfer_tlv(dev, skb, conf, mconf, link_sta);
  		/* starec ht */
- 		mt7996_mcu_sta_ht_tlv(skb, sta);
+-		mt7996_mcu_sta_ht_tlv(skb, sta);
++		mt7996_mcu_sta_ht_tlv(skb, link_sta);
  		/* starec vht */
-@@ -2397,18 +2394,18 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+-		mt7996_mcu_sta_vht_tlv(skb, sta);
++		mt7996_mcu_sta_vht_tlv(skb, link_sta);
+ 		/* starec uapsd */
+-		mt76_connac_mcu_sta_uapsd(skb, vif, sta);
++		mt76_connac_mcu_sta_uapsd(skb, vif, link_sta->sta);
  		/* starec amsdu */
- 		mt7996_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
+-		mt7996_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
++		mt7996_mcu_sta_amsdu_tlv(dev, skb, vif, link_sta, mlink);
  		/* starec he */
--		mt7996_mcu_sta_he_tlv(skb, vif, sta);
-+		mt7996_mcu_sta_he_tlv(skb, conf, mconf, sta);
+-		mt7996_mcu_sta_he_tlv(skb, conf, mconf, sta);
++		mt7996_mcu_sta_he_tlv(skb, conf, mconf, link_sta);
  		/* starec he 6g*/
- 		mt7996_mcu_sta_he_6g_tlv(skb, sta);
+-		mt7996_mcu_sta_he_6g_tlv(skb, sta);
++		mt7996_mcu_sta_he_6g_tlv(skb, link_sta);
  		/* starec eht */
- 		mt7996_mcu_sta_eht_tlv(skb, sta);
+-		mt7996_mcu_sta_eht_tlv(skb, sta);
++		mt7996_mcu_sta_eht_tlv(skb, link_sta);
  		/* starec muru */
--		mt7996_mcu_sta_muru_tlv(dev, skb, vif, sta);
-+		mt7996_mcu_sta_muru_tlv(dev, skb, conf, mconf, sta);
+-		mt7996_mcu_sta_muru_tlv(dev, skb, conf, mconf, sta);
++		mt7996_mcu_sta_muru_tlv(dev, skb, conf, mconf, link_sta);
  		/* starec bfee */
--		mt7996_mcu_sta_bfee_tlv(dev, skb, vif, sta);
-+		mt7996_mcu_sta_bfee_tlv(dev, skb, conf, mconf, sta);
+-		mt7996_mcu_sta_bfee_tlv(dev, skb, conf, mconf, sta);
++		mt7996_mcu_sta_bfee_tlv(dev, skb, conf, mconf, link_sta);
  	}
  
--	ret = mt7996_mcu_sta_init_vow(mvif->phy, msta);
-+	ret = mt7996_mcu_sta_init_vow(mconf, msta);
+-	ret = mt7996_mcu_sta_init_vow(mconf, msta);
++	ret = mt7996_mcu_sta_init_vow(mconf, mlink);
  	if (ret) {
  		dev_kfree_skb(skb);
  		return ret;
-@@ -2463,16 +2460,15 @@ mt7996_mcu_sta_key_tlv(struct mt76_wcid *wcid,
- 	return 0;
- }
- 
--int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
-+int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
- 		       struct ieee80211_key_conf *key, int mcu_cmd,
- 		       struct mt76_wcid *wcid, enum set_key_cmd cmd)
- {
--	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
- 	struct sk_buff *skb;
- 	int ret;
- 
--	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid,
--					      MT7996_STA_UPDATE_MAX_SIZE);
-+	skb = __mt76_connac_mcu_alloc_sta_req(dev, (struct mt76_vif *)mconf,
-+					      wcid, MT7996_STA_UPDATE_MAX_SIZE);
- 	if (IS_ERR(skb))
- 		return PTR_ERR(skb);
+@@ -2481,16 +2486,16 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
  
-@@ -2483,17 +2479,18 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
- 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
- }
- 
--static int mt7996_mcu_get_pn(struct mt7996_dev *dev, struct ieee80211_vif *vif,
--			     u8 *pn)
-+static int mt7996_mcu_get_pn(struct mt7996_dev *dev,
-+			     struct ieee80211_bss_conf *conf,
-+			     struct mt7996_bss_conf *mconf, u8 *pn)
+ static int mt7996_mcu_get_pn(struct mt7996_dev *dev,
+ 			     struct ieee80211_bss_conf *conf,
+-			     struct mt7996_bss_conf *mconf, u8 *pn)
++			     struct mt7996_bss_conf *mconf,
++			     struct mt7996_link_sta *mlink, u8 *pn)
  {
  #define TSC_TYPE_BIGTK_PN 2
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)conf->vif->drv_priv;
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)conf->vif->drv_priv;
  	struct sta_rec_pn_info *pn_info;
  	struct sk_buff *skb, *rskb;
  	struct tlv *tlv;
  	int ret;
  
--	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, &mvif->sta.wcid);
-+	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76, &mvif->sta.wcid);
+-	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76, &mvif->sta.wcid);
++	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76, &mlink->wcid);
  	if (IS_ERR(skb))
  		return PTR_ERR(skb);
  
-@@ -2517,10 +2514,11 @@ static int mt7996_mcu_get_pn(struct mt7996_dev *dev, struct ieee80211_vif *vif,
- 	return 0;
- }
- 
--int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
-+			       struct ieee80211_bss_conf *conf,
-+			       struct mt7996_bss_conf *mconf,
+@@ -2517,6 +2522,7 @@ static int mt7996_mcu_get_pn(struct mt7996_dev *dev,
+ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
+ 			       struct ieee80211_bss_conf *conf,
+ 			       struct mt7996_bss_conf *mconf,
++			       struct mt7996_link_sta *mlink,
  			       struct ieee80211_key_conf *key)
  {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_mcu_bcn_prot_tlv *bcn_prot;
- 	struct sk_buff *skb;
- 	struct tlv *tlv;
-@@ -2529,7 +2527,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
- 		  sizeof(struct mt7996_mcu_bcn_prot_tlv);
- 	int ret;
- 
--	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76, len);
-+	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76, len);
- 	if (IS_ERR(skb))
- 		return PTR_ERR(skb);
- 
-@@ -2537,7 +2535,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
+@@ -2535,7 +2541,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
  
  	bcn_prot = (struct mt7996_mcu_bcn_prot_tlv *)tlv;
  
--	ret = mt7996_mcu_get_pn(dev, vif, pn);
-+	ret = mt7996_mcu_get_pn(dev, conf, mconf, pn);
+-	ret = mt7996_mcu_get_pn(dev, conf, mconf, pn);
++	ret = mt7996_mcu_get_pn(dev, conf, mconf, mlink, pn);
  	if (ret) {
  		dev_kfree_skb(skb);
  		return ret;
-@@ -2570,10 +2568,10 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
- 				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
- }
- int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
--			    struct ieee80211_vif *vif, bool enable)
-+			    struct ieee80211_bss_conf *conf,
-+			    struct mt7996_bss_conf *mconf, bool enable)
- {
- 	struct mt7996_dev *dev = phy->dev;
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct {
- 		struct req_hdr {
- 			u8 omac_idx;
-@@ -2589,8 +2587,8 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
- 		} __packed tlv;
- 	} data = {
- 		.hdr = {
--			.omac_idx = mvif->mt76.omac_idx,
--			.band_idx = mvif->mt76.band_idx,
-+			.omac_idx = mconf->mt76.omac_idx,
-+			.band_idx = mconf->mt76.band_idx,
- 		},
- 		.tlv = {
- 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
-@@ -2599,16 +2597,16 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
- 		},
- 	};
- 
--	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
--		return mt7996_mcu_muar_config(phy, vif, false, enable);
-+	if (mconf->mt76.omac_idx >= REPEATER_BSSID_START)
-+		return mt7996_mcu_muar_config(phy, conf, mconf, false, enable);
- 
--	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
-+	memcpy(data.tlv.omac_addr, conf->addr, ETH_ALEN);
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_WMWA_UNI_CMD(DEV_INFO_UPDATE),
- 				 &data, sizeof(data), true);
- }
- 
- static void
--mt7996_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
-+mt7996_mcu_beacon_cntdwn(struct ieee80211_bss_conf *conf, struct sk_buff *rskb,
- 			 struct sk_buff *skb,
- 			 struct ieee80211_mutable_offsets *offs)
- {
-@@ -2619,7 +2617,7 @@ mt7996_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
- 	if (!offs->cntdwn_counter_offs[0])
- 		return;
- 
--	tag = vif->bss_conf.csa_active ? UNI_BSS_INFO_BCN_CSA : UNI_BSS_INFO_BCN_BCC;
-+	tag = conf->csa_active ? UNI_BSS_INFO_BCN_CSA : UNI_BSS_INFO_BCN_BCC;
- 
- 	tlv = mt7996_mcu_add_uni_tlv(rskb, tag, sizeof(*info));
- 
-@@ -2629,14 +2627,15 @@ mt7996_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
- 
- static void
- mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
--		       struct ieee80211_vif *vif, struct bss_bcn_content_tlv *bcn,
-+		       struct ieee80211_bss_conf *conf,
-+		       struct bss_bcn_content_tlv *bcn,
- 		       struct ieee80211_mutable_offsets *offs)
- {
- 	struct bss_bcn_mbss_tlv *mbss;
- 	const struct element *elem;
- 	struct tlv *tlv;
- 
--	if (!vif->bss_conf.bssid_indicator)
-+	if (!conf->bssid_indicator)
- 		return;
- 
- 	tlv = mt7996_mcu_add_uni_tlv(rskb, UNI_BSS_INFO_BCN_MBSSID, sizeof(*mbss));
-@@ -2681,7 +2680,7 @@ mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
- }
- 
- static void
--mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
- 		       struct sk_buff *rskb, struct sk_buff *skb,
- 		       struct bss_bcn_content_tlv *bcn,
- 		       struct ieee80211_mutable_offsets *offs)
-@@ -2695,9 +2694,9 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
- 	if (offs->cntdwn_counter_offs[0]) {
- 		u16 offset = offs->cntdwn_counter_offs[0];
- 
--		if (vif->bss_conf.csa_active)
-+		if (conf->csa_active)
- 			bcn->csa_ie_pos = cpu_to_le16(offset - 4);
--		if (vif->bss_conf.color_change_active)
-+		if (conf->color_change_active)
- 			bcn->bcc_ie_pos = cpu_to_le16(offset - 3);
- 	}
- 
-@@ -2709,11 +2708,11 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
- }
- 
- int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
--			  struct ieee80211_vif *vif, int en)
-+			  struct ieee80211_bss_conf *conf,
-+			  struct mt7996_bss_conf *mconf, int en)
- {
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct ieee80211_mutable_offsets offs;
- 	struct ieee80211_tx_info *info;
- 	struct sk_buff *skb, *rskb;
-@@ -2721,15 +2720,15 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
- 	struct bss_bcn_content_tlv *bcn;
- 	int len;
- 
--	if (vif->bss_conf.nontransmitted)
-+	if (conf->nontransmitted)
- 		return 0;
- 
--	rskb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76,
-+	rskb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
- 					  MT7996_MAX_BSS_OFFLOAD_SIZE);
- 	if (IS_ERR(rskb))
- 		return PTR_ERR(rskb);
- 
--	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
-+	skb = ieee80211_beacon_get_template(hw, conf->vif, &offs, 0);
- 	if (!skb) {
- 		dev_kfree_skb(rskb);
- 		return -EINVAL;
-@@ -2752,9 +2751,9 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
- 	if (!en)
- 		goto out;
- 
--	mt7996_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
--	mt7996_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
--	mt7996_mcu_beacon_cntdwn(vif, rskb, skb, &offs);
-+	mt7996_mcu_beacon_cont(dev, conf, rskb, skb, bcn, &offs);
-+	mt7996_mcu_beacon_mbss(rskb, skb, conf, bcn, &offs);
-+	mt7996_mcu_beacon_cntdwn(conf, rskb, skb, &offs);
- out:
- 	dev_kfree_skb(skb);
- 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
-@@ -2762,14 +2761,15 @@ out:
- }
- 
- int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
--				    struct ieee80211_vif *vif, u32 changed)
-+				    struct ieee80211_bss_conf *conf,
-+				    struct mt7996_bss_conf *mconf, u32 changed)
- {
- #define OFFLOAD_TX_MODE_SU	BIT(0)
- #define OFFLOAD_TX_MODE_MU	BIT(1)
- 	struct ieee80211_hw *hw = mt76_hw(dev);
-+	struct ieee80211_vif *vif = conf->vif;
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
-+	struct cfg80211_chan_def *chandef = &mconf->phy->mt76->chandef;
- 	enum nl80211_band band = chandef->chan->band;
- 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
- 	struct bss_inband_discovery_tlv *discov;
-@@ -2779,20 +2779,20 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
- 	u8 *buf, interval;
- 	int len;
- 
--	if (vif->bss_conf.nontransmitted)
-+	if (conf->nontransmitted)
- 		return 0;
- 
--	rskb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76,
-+	rskb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
- 					  MT7996_MAX_BSS_OFFLOAD_SIZE);
- 	if (IS_ERR(rskb))
- 		return PTR_ERR(rskb);
- 
- 	if (changed & BSS_CHANGED_FILS_DISCOVERY) {
--		interval = vif->bss_conf.fils_discovery.max_interval;
-+		interval = conf->fils_discovery.max_interval;
- 		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
- 	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
--		   vif->bss_conf.unsol_bcast_probe_resp_interval) {
--		interval = vif->bss_conf.unsol_bcast_probe_resp_interval;
-+		   conf->unsol_bcast_probe_resp_interval) {
-+		interval = conf->unsol_bcast_probe_resp_interval;
- 		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
- 	}
- 
-@@ -3456,7 +3456,7 @@ int mt7996_mcu_set_hdr_trans(struct mt7996_dev *dev, bool hdr_trans)
- 				     MCU_WM_UNI_CMD(RX_HDR_TRANS), true);
- }
- 
--int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
-+int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct mt7996_bss_conf *mconf)
+@@ -4811,21 +4817,18 @@ int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev, bool disable
+ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
+ 				     struct ieee80211_vif *vif,
+ 				     struct mt7996_bss_conf *mconf,
+-				     struct ieee80211_sta *sta)
++				     struct mt7996_link_sta *mlink)
  {
- #define MCU_EDCA_AC_PARAM	0
- #define WMM_AIFS_SET		BIT(0)
-@@ -3465,12 +3465,11 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
- #define WMM_TXOP_SET		BIT(3)
- #define WMM_PARAM_SET		(WMM_AIFS_SET | WMM_CW_MIN_SET | \
- 				 WMM_CW_MAX_SET | WMM_TXOP_SET)
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct {
- 		u8 bss_idx;
- 		u8 __rsv[3];
- 	} __packed hdr = {
--		.bss_idx = mvif->mt76.idx,
-+		.bss_idx = mconf->mt76.idx,
- 	};
+-	struct mt7996_sta *msta;
  	struct sk_buff *skb;
- 	int len = sizeof(hdr) + IEEE80211_NUM_ACS * sizeof(struct edca);
-@@ -3483,7 +3482,7 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
- 	skb_put_data(skb, &hdr, sizeof(hdr));
- 
- 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
--		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
-+		struct ieee80211_tx_queue_params *q = &mconf->queue_params[ac];
- 		struct edca *e;
- 		struct tlv *tlv;
- 
-@@ -4496,12 +4495,12 @@ mt7996_mcu_set_obss_spr_pd(struct mt7996_phy *phy,
- }
- 
- static int
--mt7996_mcu_set_obss_spr_siga(struct mt7996_phy *phy, struct ieee80211_vif *vif,
-+mt7996_mcu_set_obss_spr_siga(struct mt7996_phy *phy,
-+			     struct mt7996_bss_conf *mconf,
- 			     struct ieee80211_he_obss_pd *he_obss_pd)
- {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_dev *dev = phy->dev;
--	u8 omac = mvif->mt76.omac_idx;
-+	u8 omac = mconf->mt76.omac_idx;
- 	struct {
- 		u8 band_idx;
- 		u8 __rsv[3];
-@@ -4573,7 +4572,8 @@ mt7996_mcu_set_obss_spr_bitmap(struct mt7996_phy *phy,
- 				 sizeof(req), true);
- }
- 
--int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
-+int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy,
-+			    struct mt7996_bss_conf *mconf,
- 			    struct ieee80211_he_obss_pd *he_obss_pd)
- {
- 	int ret;
-@@ -4607,7 +4607,7 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
- 		return ret;
  
- 	/* Set SR prohibit */
--	ret = mt7996_mcu_set_obss_spr_siga(phy, vif, he_obss_pd);
-+	ret = mt7996_mcu_set_obss_spr_siga(phy, mconf, he_obss_pd);
- 	if (ret)
- 		return ret;
+-	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mconf->vif->sta;
+-
+ 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
+-					      &msta->wcid,
++					      &mlink->wcid,
+ 					      MT7996_STA_UPDATE_MAX_SIZE);
+ 	if (IS_ERR(skb))
+ 		return PTR_ERR(skb);
  
-@@ -4615,16 +4615,16 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
- 	return mt7996_mcu_set_obss_spr_bitmap(phy, he_obss_pd);
+ 	/* starec hdr trans */
+-	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, sta);
++	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, mlink);
+ 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
+ 				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
  }
+@@ -5014,7 +5017,7 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
+ 	switch (tag) {
+ 	case UNI_PER_STA_RSSI:
+ 		for (i = 0; i < sta_num; ++i) {
+-			struct mt7996_sta *msta;
++			struct mt7996_link_sta *mlink;
+ 			struct mt76_phy *phy;
+ 			s8 rssi[4];
+ 			u8 *rcpi;
+@@ -5028,10 +5031,10 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
+ 				rssi[2] = to_rssi(MT_PRXV_RCPI0, rcpi[2]);
+ 				rssi[3] = to_rssi(MT_PRXV_RCPI0, rcpi[3]);
  
--int mt7996_mcu_update_bss_color(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+int mt7996_mcu_update_bss_color(struct mt7996_dev *dev,
-+				struct mt7996_bss_conf *mconf,
- 				struct cfg80211_he_bss_color *he_bss_color)
+-				msta = container_of(wcid, struct mt7996_sta, wcid);
+-				phy = msta->vif->phy->mt76;
+-				msta->ack_signal = mt76_rx_signal(phy->antenna_mask, rssi);
+-				ewma_avg_signal_add(&msta->avg_ack_signal, -msta->ack_signal);
++				mlink = container_of(wcid, struct mt7996_link_sta, wcid);
++				phy = mlink->sta->vif->deflink.phy->mt76;
++				mlink->ack_signal = mt76_rx_signal(phy->antenna_mask, rssi);
++				ewma_avg_signal_add(&mlink->avg_ack_signal, -mlink->ack_signal);
+ 			} else {
+ 				ret = -EINVAL;
+ 				dev_err(dev->dev, "Failed to update RSSI for "
+@@ -5069,7 +5072,7 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
  {
- 	int len = sizeof(struct bss_req_hdr) + sizeof(struct bss_color_tlv);
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct bss_color_tlv *bss_color;
- 	struct sk_buff *skb;
- 	struct tlv *tlv;
- 
--	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76, len);
-+	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76, len);
- 	if (IS_ERR(skb))
- 		return PTR_ERR(skb);
+ 	u16 sta_list[PER_STA_INFO_MAX_NUM];
+ 	LIST_HEAD(sta_poll_list);
+-	struct mt7996_sta *msta;
++	struct mt7996_link_sta *mlink;
+ 	int i, ret;
+ 	bool empty = false;
  
-@@ -4643,7 +4643,7 @@ int mt7996_mcu_update_bss_color(struct mt7996_dev *dev, struct ieee80211_vif *vi
- #define TWT_AGRT_PROTECT	BIT(2)
+@@ -5089,13 +5092,13 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
+ 				empty = true;
+ 				break;
+ 			}
+-			msta = list_first_entry(&sta_poll_list,
+-			                        struct mt7996_sta,
++			mlink = list_first_entry(&sta_poll_list,
++			                        struct mt7996_link_sta,
+ 			                        wcid.poll_list);
+-			list_del_init(&msta->wcid.poll_list);
++			list_del_init(&mlink->wcid.poll_list);
+ 			spin_unlock_bh(&dev->sta_poll_lock);
  
- int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
--			       struct mt7996_vif *mvif,
-+			       struct mt7996_bss_conf *mconf,
- 			       struct mt7996_twt_flow *flow,
- 			       int cmd)
- {
-@@ -4674,12 +4674,12 @@ int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
- 		.len = cpu_to_le16(sizeof(req) - 4),
- 		.tbl_idx = flow->table_id,
- 		.cmd = cmd,
--		.own_mac_idx = mvif->mt76.omac_idx,
-+		.own_mac_idx = mconf->mt76.omac_idx,
- 		.flowid = flow->id,
- 		.peer_id = cpu_to_le16(flow->wcid),
- 		.duration = flow->duration,
--		.bss = mvif->mt76.idx,
--		.bss_idx = mvif->mt76.idx,
-+		.bss = mconf->mt76.idx,
-+		.bss_idx = mconf->mt76.idx,
- 		.start_tsf = cpu_to_le64(flow->tsf),
- 		.mantissa = flow->mantissa,
- 		.exponent = flow->exp,
-@@ -4810,15 +4810,15 @@ int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev, bool disable
+-			sta_list[i] = msta->wcid.idx;
++			sta_list[i] = mlink->wcid.idx;
+ 		}
  
- int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
- 				     struct ieee80211_vif *vif,
-+				     struct mt7996_bss_conf *mconf,
- 				     struct ieee80211_sta *sta)
+ 		ret = mt7996_mcu_get_per_sta_info(dev, UNI_PER_STA_RSSI,
+@@ -5385,10 +5388,18 @@ int mt7996_mcu_set_scs_stats(struct mt7996_phy *phy)
+ void mt7996_sta_rssi_work(void *data, struct ieee80211_sta *sta)
  {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_sta *msta;
- 	struct sk_buff *skb;
- 
--	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mvif->sta;
-+	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mconf->vif->sta;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_link_sta *mlink;
+ 	struct mt7996_phy *poll_phy = (struct mt7996_phy *) data;
  
--	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
-+	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
- 					      &msta->wcid,
- 					      MT7996_STA_UPDATE_MAX_SIZE);
- 	if (IS_ERR(skb))
-@@ -5462,8 +5462,9 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
- 				 &req, sizeof(req), false);
+-	if (poll_phy->scs_ctrl.sta_min_rssi > msta->ack_signal)
+-		poll_phy->scs_ctrl.sta_min_rssi = msta->ack_signal;
++	mutex_lock(&poll_phy->dev->mt76.mutex);
++	mlink = mlink_dereference_protected(msta, 0);
++	if (!mlink)
++		goto out;
++
++	if (poll_phy->scs_ctrl.sta_min_rssi > mlink->ack_signal)
++		poll_phy->scs_ctrl.sta_min_rssi = mlink->ack_signal;
++out:
++	mutex_unlock(&poll_phy->dev->mt76.mutex);
  }
  
+ void mt7996_mcu_scs_sta_poll(struct work_struct *work)
+@@ -5464,9 +5475,10 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
+ 
--int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy, struct mt7996_sta *msta,
--	                        enum vow_drr_ctrl_id id)
-+int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
-+				struct mt7996_bss_conf *mconf,
-+				struct mt7996_sta *msta, enum vow_drr_ctrl_id id)
+ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
+ 				struct mt7996_bss_conf *mconf,
+-				struct mt7996_sta *msta, enum vow_drr_ctrl_id id)
++				struct mt7996_link_sta *mlink,
++				enum vow_drr_ctrl_id id)
  {
- 	struct mt7996_vow_sta_ctrl *vow = msta ? &msta->vow : NULL;
+-	struct mt7996_vow_sta_ctrl *vow = msta ? &msta->vow : NULL;
++	struct mt7996_vow_sta_ctrl *vow = mlink ? &mlink->vow : NULL;
  	u32 val = 0;
-@@ -5489,9 +5490,9 @@ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy, struct mt7996_sta *msta,
+ 	struct {
+ 		u8 __rsv1[4];
+@@ -5488,11 +5500,11 @@ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
+ 	} __packed req = {
+ 		.tag = cpu_to_le16(UNI_VOW_DRR_CTRL),
  		.len = cpu_to_le16(sizeof(req) - 4),
- 		.wlan_idx = cpu_to_le16(msta ? msta->wcid.idx : 0),
+-		.wlan_idx = cpu_to_le16(msta ? msta->wcid.idx : 0),
++		.wlan_idx = cpu_to_le16(mlink ? mlink->wcid.idx : 0),
  		.band_idx = phy->mt76->band_idx,
--		.wmm_idx = msta ? msta->vif->mt76.wmm_idx : 0,
-+		.wmm_idx = msta ? mconf->mt76.wmm_idx : 0,
+-		.wmm_idx = msta ? mconf->mt76.wmm_idx : 0,
++		.wmm_idx = mlink ? mconf->mt76.wmm_idx : 0,
  		.ctrl_id = cpu_to_le32(id),
--		.omac_idx = msta ? msta->vif->mt76.omac_idx : 0
-+		.omac_idx = msta ? mconf->mt76.omac_idx : 0
+-		.omac_idx = msta ? mconf->mt76.omac_idx : 0
++		.omac_idx = mlink ? mconf->mt76.omac_idx : 0
  	};
  
  	switch (id) {
-@@ -5679,7 +5680,7 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
- {
- 	u8 mode, val;
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct mt7996_phy *phy =  mvif->phy;
-+	struct mt7996_phy *phy =  mvif->deflink.phy;
- 
- 	mode = FIELD_GET(RATE_CFG_MODE, *((u32 *)data));
- 	val = FIELD_GET(RATE_CFG_VAL, *((u32 *)data));
-@@ -5710,11 +5711,11 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
- void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
- {
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct ieee80211_hw *hw = mvif->phy->mt76->hw;
-+	struct ieee80211_hw *hw = mvif->deflink.phy->mt76->hw;
- 	u8 val = *((u8 *)data);
- 
- 	vif->bss_conf.enable_beacon = val;
- 
--	mt7996_mcu_add_beacon(hw, vif, val);
-+	mt7996_mcu_add_beacon(hw, &vif->bss_conf, &mvif->deflink, val);
- }
- #endif
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 2b266d18b..6b03ee17f 100644
+index 6b03ee1..3701720 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -324,18 +324,25 @@ struct mt7996_sta {
- 	struct mt7996_vow_sta_ctrl vow;
+@@ -302,10 +302,10 @@ struct mt7996_vow_sta_ctrl {
+ 	u8 drr_quantum[IEEE80211_NUM_ACS];
  };
  
--struct mt7996_vif {
-+struct mt7996_bss_conf {
- 	struct mt76_vif mt76; /* must be first */
+-struct mt7996_sta {
++struct mt7996_link_sta {
+ 	struct mt76_wcid wcid; /* must be first */
  
--	struct mt7996_sta sta;
-+	struct mt7996_vif *vif;
- 	struct mt7996_phy *phy;
--
- 	struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS];
- 	struct cfg80211_bitrate_mask bitrate_mask;
+-	struct mt7996_vif *vif;
++	struct mt7996_sta *sta;
  
- 	struct mt7996_chanctx *chanctx;
+ 	struct list_head rc_list;
+ 
+@@ -324,6 +324,13 @@ struct mt7996_sta {
+ 	struct mt7996_vow_sta_ctrl vow;
  };
  
-+struct mt7996_vif {
-+	struct mt7996_bss_conf deflink;
-+	struct mt7996_bss_conf __rcu *link[IEEE80211_MLD_MAX_NUM_LINKS];
++struct mt7996_sta {
++	struct mt7996_link_sta deflink;
++	struct mt7996_link_sta __rcu *link[IEEE80211_MLD_MAX_NUM_LINKS];
 +
-+	struct mt7996_sta sta;
-+	struct mt7996_dev *dev;
++	struct mt7996_vif *vif;
 +};
 +
- /* crash-dump */
- struct mt7996_crash_data {
- 	guid_t guid;
-@@ -769,6 +776,13 @@ mt7996_chanctx_get(struct ieee80211_chanctx_conf *ctx)
- 	return (struct mt7996_chanctx *)&ctx->drv_priv;
+ struct mt7996_bss_conf {
+ 	struct mt76_vif mt76; /* must be first */
+ 
+@@ -783,6 +790,13 @@ mconf_dereference_protected(struct mt7996_vif *mvif, u8 link_id)
+ 					 lockdep_is_held(&mvif->dev->mt76.mutex));
  }
  
-+static inline struct mt7996_bss_conf *
-+mconf_dereference_protected(struct mt7996_vif *mvif, u8 link_id)
++static inline struct mt7996_link_sta *
++mlink_dereference_protected(struct mt7996_sta *msta, u8 link_id)
 +{
-+	return rcu_dereference_protected(mvif->link[link_id],
-+					 lockdep_is_held(&mvif->dev->mt76.mutex));
++	return rcu_dereference_protected(msta->link[link_id],
++					 lockdep_is_held(&msta->vif->dev->mt76.mutex));
 +}
 +
  extern const struct ieee80211_ops mt7996_ops;
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
-@@ -779,7 +793,7 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
- void mt7996_wfsys_reset(struct mt7996_dev *dev);
- void mt7996_rro_hw_init(struct mt7996_dev *dev);
- irqreturn_t mt7996_irq_handler(int irq, void *dev_instance);
--u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif);
-+u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_bss_conf *mconf);
- int mt7996_register_device(struct mt7996_dev *dev);
- void mt7996_unregister_device(struct mt7996_dev *dev);
- const char *mt7996_eeprom_name(struct mt7996_dev *dev);
-@@ -805,37 +819,47 @@ int mt7996_run(struct ieee80211_hw *hw);
- int mt7996_mcu_init(struct mt7996_dev *dev);
- int mt7996_mcu_init_firmware(struct mt7996_dev *dev);
- int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
--			       struct mt7996_vif *mvif,
-+			       struct mt7996_bss_conf *mconf,
- 			       struct mt7996_twt_flow *flow,
- 			       int cmd);
- int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
--			    struct ieee80211_vif *vif, bool enable);
-+			    struct ieee80211_bss_conf *conf,
-+			    struct mt7996_bss_conf *mconf, bool enable);
+@@ -827,10 +841,12 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
+ 			    struct mt7996_bss_conf *mconf, bool enable);
  int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
--			    struct ieee80211_vif *vif, int enable);
--int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
--		       struct ieee80211_sta *sta, bool enable, bool newly);
-+			    struct ieee80211_bss_conf *conf,
-+			    struct mt7996_bss_conf *mconf, int enable);
-+int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
-+		       struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta,
-+		       bool enable, bool newly);
+ 			    struct ieee80211_bss_conf *conf,
+-			    struct mt7996_bss_conf *mconf, int enable);
++			    struct mt7996_bss_conf *mconf,
++			    struct mt7996_link_sta *mlink, int enable);
+ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+-		       struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta,
+-		       bool enable, bool newly);
++		       struct mt7996_bss_conf *mconf,
++		       struct ieee80211_link_sta *link_sta,
++		       struct mt7996_link_sta *mlink, bool enable, bool newly);
  int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  			 struct ieee80211_ampdu_params *params,
  			 bool add);
- int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
- 			 struct ieee80211_ampdu_params *params,
- 			 bool add);
--int mt7996_mcu_update_bss_color(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+int mt7996_mcu_update_bss_color(struct mt7996_dev *dev,
-+				struct mt7996_bss_conf *mconf,
- 				struct cfg80211_he_bss_color *he_bss_color);
--int mt7996_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
--			  int enable);
-+int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
-+			  struct ieee80211_bss_conf *conf,
-+			  struct mt7996_bss_conf *mconf, int en);
- int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
--				    struct ieee80211_vif *vif, u32 changed);
--int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
-+				    struct ieee80211_bss_conf *conf,
-+				    struct mt7996_bss_conf *mconf, u32 changed);
-+int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy,
-+			    struct mt7996_bss_conf *mconf,
- 			    struct ieee80211_he_obss_pd *he_obss_pd);
--int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
-+			     struct ieee80211_bss_conf *conf,
-+			     struct mt7996_bss_conf *mconf,
- 			     struct ieee80211_sta *sta, bool changed);
+@@ -852,7 +868,8 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy,
+ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+ 			     struct ieee80211_bss_conf *conf,
+ 			     struct mt7996_bss_conf *mconf,
+-			     struct ieee80211_sta *sta, bool changed);
++			     struct ieee80211_link_sta *link_sta,
++			     struct mt7996_link_sta *mlink, bool changed);
  int mt7996_set_channel(struct mt7996_phy *phy, struct cfg80211_chan_def *chandef);
  int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag);
--int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif);
-+int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct mt7996_bss_conf *mconf);
- int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
+ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct mt7996_bss_conf *mconf);
+@@ -860,7 +877,9 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
  				   void *data, u16 version);
--int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
-+			       struct mt7996_bss_conf *mconf,
- 			       struct ieee80211_sta *sta, void *data, u32 field);
+ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
+ 			       struct mt7996_bss_conf *mconf,
+-			       struct ieee80211_sta *sta, void *data, u32 field);
++			       struct ieee80211_link_sta *link_sta,
++			       struct mt7996_link_sta *mlink, void *data,
++			       u32 field);
  int mt7996_mcu_set_eeprom(struct mt7996_dev *dev);
  int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf);
-@@ -850,7 +874,7 @@ int mt7996_mcu_set_radar_th(struct mt7996_dev *dev, int index,
- 			    const struct mt7996_dfs_pattern *pattern);
- int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable);
- int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val);
--int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif);
-+int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct mt7996_bss_conf *mconf);
- int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch);
- int mt7996_mcu_get_temperature(struct mt7996_phy *phy);
- int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state);
-@@ -890,8 +914,9 @@ void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb);
- int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable);
- void mt7996_mcu_scs_sta_poll(struct work_struct *work);
+ int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num);
+@@ -916,7 +935,8 @@ void mt7996_mcu_scs_sta_poll(struct work_struct *work);
  int mt7996_mcu_set_band_confg(struct mt7996_phy *phy, u16 option, bool enable);
--int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy, struct mt7996_sta *msta,
--	                        enum vow_drr_ctrl_id id);
-+int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
-+				struct mt7996_bss_conf *mconf,
-+				struct mt7996_sta *msta, enum vow_drr_ctrl_id id);
+ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
+ 				struct mt7996_bss_conf *mconf,
+-				struct mt7996_sta *msta, enum vow_drr_ctrl_id id);
++				struct mt7996_link_sta *mlink,
++				enum vow_drr_ctrl_id id);
  int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy);
  void mt7996_mcu_wmm_pbc_work(struct work_struct *work);
  
-@@ -1000,13 +1025,16 @@ void mt7996_update_channel(struct mt76_phy *mphy);
- int mt7996_init_debugfs(struct mt7996_phy *phy);
- void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int len);
- bool mt7996_debugfs_rx_log(struct mt7996_dev *dev, const void *data, int len);
--int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
-+int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
- 		       struct ieee80211_key_conf *key, int mcu_cmd,
- 		       struct mt76_wcid *wcid, enum set_key_cmd cmd);
--int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
-+			       struct ieee80211_bss_conf *conf,
-+			       struct mt7996_bss_conf *mconf,
+@@ -983,7 +1003,7 @@ void mt7996_mac_reset_counters(struct mt7996_phy *phy);
+ void mt7996_mac_cca_stats_reset(struct mt7996_phy *phy);
+ void mt7996_mac_enable_nf(struct mt7996_dev *dev, u8 band);
+ void mt7996_mac_enable_rtscts(struct mt7996_dev *dev,
+-			      struct ieee80211_vif *vif, bool enable);
++			      struct mt7996_link_sta *mlink, bool enable);
+ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+ 			   struct sk_buff *skb, struct mt76_wcid *wcid,
+ 			   struct ieee80211_key_conf *key, int pid,
+@@ -1001,8 +1021,7 @@ void mt7996_mac_dump_work(struct work_struct *work);
+ void mt7996_mac_sta_rc_work(struct work_struct *work);
+ void mt7996_mac_update_stats(struct mt7996_phy *phy);
+ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
+-				  struct mt7996_sta *msta,
+-				  u8 flowid);
++				  struct mt7996_link_sta *mlink, u8 flowid);
+ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+ 			      struct ieee80211_sta *sta,
+ 			      struct ieee80211_twt_setup *twt);
+@@ -1031,11 +1050,12 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
+ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
+ 			       struct ieee80211_bss_conf *conf,
+ 			       struct mt7996_bss_conf *mconf,
++			       struct mt7996_link_sta *mlink,
  			       struct ieee80211_key_conf *key);
  int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
  				     struct ieee80211_vif *vif,
-+				     struct mt7996_bss_conf *mconf,
- 				     struct ieee80211_sta *sta);
+ 				     struct mt7996_bss_conf *mconf,
+-				     struct ieee80211_sta *sta);
++				     struct mt7996_link_sta *mlink);
  int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode);
  int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
+ #ifdef CONFIG_MAC80211_DEBUGFS
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 784a8bea4..bf55b4309 100644
+index bf55b43..ba17f94 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -223,6 +223,7 @@ static void
- mt7996_tm_init(struct mt7996_phy *phy, bool en)
- {
- 	struct mt7996_dev *dev = phy->dev;
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)phy->monitor_vif->drv_priv;
- 	u8 rf_test_mode = en ? RF_OPER_RF_TEST : RF_OPER_NORMAL;
- 
- 	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
-@@ -234,8 +235,8 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
+@@ -235,8 +235,8 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
  
  	mt7996_tm_rf_switch_mode(dev, rf_test_mode);
  
--	mt7996_mcu_add_bss_info(phy, phy->monitor_vif, en);
--	mt7996_mcu_add_sta(dev, phy->monitor_vif, NULL, en, false);
-+	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, en);
-+	mt7996_mcu_add_sta(dev, &phy->monitor_vif->bss_conf, &mvif->deflink, NULL, en, false);
+-	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, en);
+-	mt7996_mcu_add_sta(dev, &phy->monitor_vif->bss_conf, &mvif->deflink, NULL, en, false);
++	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, &mvif->sta.deflink, en);
++	mt7996_mcu_add_sta(dev, &phy->monitor_vif->bss_conf, &mvif->deflink, NULL, &mvif->sta.deflink, en, false);
  
  	mt7996_tm_set(dev, SET_ID(BAND_IDX), phy->mt76->band_idx);
  
-@@ -1179,13 +1180,13 @@ mt7996_tm_txbf_init(struct mt7996_phy *phy, u16 *val)
- 	mt7996_tm_set_mac_addr(dev, td->addr[2], SET_ID(BSSID));
+@@ -1186,7 +1186,7 @@ mt7996_tm_txbf_init(struct mt7996_phy *phy, u16 *val)
+ 	phy->omac_mask |= BIT_ULL(mvif->deflink.mt76.omac_idx);
  
- 	/* bss idx & omac idx should be set to band idx for ibf cal */
--	mvif->mt76.idx = band_idx;
--	dev->mt76.vif_mask |= BIT_ULL(mvif->mt76.idx);
--	mvif->mt76.omac_idx = band_idx;
--	phy->omac_mask |= BIT_ULL(mvif->mt76.omac_idx);
-+	mvif->deflink.mt76.idx = band_idx;
-+	dev->mt76.vif_mask |= BIT_ULL(mvif->deflink.mt76.idx);
-+	mvif->deflink.mt76.omac_idx = band_idx;
-+	phy->omac_mask |= BIT_ULL(mvif->deflink.mt76.omac_idx);
- 
--	mt7996_mcu_add_dev_info(phy, phy->monitor_vif, true);
--	mt7996_mcu_add_bss_info(phy, phy->monitor_vif, true);
-+	mt7996_mcu_add_dev_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, true);
-+	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, true);
+ 	mt7996_mcu_add_dev_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, true);
+-	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, true);
++	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, &mvif->sta.deflink, true);
  
  	if (td->ibf) {
  		if (td->is_txbf_dut) {
 -- 
-2.39.2
+2.18.0