diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
index 8c33c0f..f6cca71 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
@@ -1,15 +1,15 @@
-From 0f7a824cab3692fe35f73f6d11e788619e02193f Mon Sep 17 00:00:00 2001
+From cf9c84fbe7863a9af60e00bbb18ebdc6a4f29020 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 5 Jan 2023 16:43:57 +0800
 Subject: [PATCH 3003/3014] mt76: connac: wed: add wed rx copy skb
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
- dma.c | 51 ++++++++++++++++++++++++++++++++++++++++-----------
- 1 file changed, 40 insertions(+), 11 deletions(-)
+ dma.c | 67 ++++++++++++++++++++++++++++++++++++++++++++++-------------
+ 1 file changed, 52 insertions(+), 15 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index f977b7f5..1082d6f1 100644
+index e05b7ca1..74e2169e 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -207,11 +207,11 @@ mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q)
@@ -41,53 +41,75 @@
  
  		rx_token = mt76_rx_token_consume(dev, data, txwi, buf->addr);
  		if (rx_token < 0) {
-@@ -406,6 +408,7 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
- 		u32 token = FIELD_GET(MT_DMA_CTL_TOKEN,
- 				      le32_to_cpu(desc->buf1));
- 		struct mt76_txwi_cache *t = mt76_rx_token_release(dev, token);
-+		struct mt76_queue_buf qbuf;
+@@ -386,7 +388,7 @@ mt76_dma_tx_cleanup(struct mt76_dev *dev, struct mt76_queue *q, bool flush)
  
- 		if (!t)
- 			return NULL;
-@@ -414,11 +417,33 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ static void *
+ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+-		 int *len, u32 *info, bool *more, bool *drop)
++		 int *len, u32 *info, bool *more, bool *drop, bool flush)
+ {
+ 	struct mt76_queue_entry *e = &q->entry[idx];
+ 	struct mt76_desc *desc = &q->desc[idx];
+@@ -413,12 +415,43 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ 		dma_unmap_single(dev->dma_dev, t->dma_addr,
  				 SKB_WITH_OVERHEAD(q->buf_size),
  				 DMA_FROM_DEVICE);
- 
+-
 -		buf = t->ptr;
 -		t->dma_addr = 0;
 -		t->ptr = NULL;
-+		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
-+		if (!buf)
-+			return NULL;
-+
-+		memcpy(buf, t->ptr, SKB_WITH_OVERHEAD(q->buf_size));
+-
+-		mt76_put_rxwi(dev, t);
++		if (flush) {
++			buf = t->ptr;
++			t->dma_addr = 0;
++			t->ptr = NULL;
 +
-+		t->dma_addr = dma_map_single(dev->dma_dev, t->ptr,
-+					     SKB_WITH_OVERHEAD(q->buf_size),
-+					     DMA_FROM_DEVICE);
-+		if (unlikely(dma_mapping_error(dev->dma_dev, t->dma_addr))) {
-+			skb_free_frag(t->ptr);
 +			mt76_put_rxwi(dev, t);
-+			return NULL;
-+		}
++		} else {
++			struct mt76_queue_buf qbuf;
 +
-+		qbuf.addr = t->dma_addr;
-+		qbuf.len = SKB_WITH_OVERHEAD(q->buf_size);
-+		qbuf.skip_unmap = false;
- 
--		mt76_put_rxwi(dev, t);
-+		if (mt76_dma_add_rx_buf(dev, q, &qbuf, t->ptr, t) < 0) {
-+			dma_unmap_single(dev->dma_dev, t->dma_addr,
-+					 SKB_WITH_OVERHEAD(q->buf_size),
-+					 DMA_FROM_DEVICE);
-+			skb_free_frag(t->ptr);
-+			mt76_put_rxwi(dev, t);
-+			return NULL;
++			buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
++			if (!buf)
++				return NULL;
++
++			memcpy(buf, t->ptr, SKB_WITH_OVERHEAD(q->buf_size));
++
++			t->dma_addr = dma_map_single(dev->dma_dev, t->ptr,
++						     SKB_WITH_OVERHEAD(q->buf_size),
++						     DMA_FROM_DEVICE);
++			if (unlikely(dma_mapping_error(dev->dma_dev, t->dma_addr))) {
++				skb_free_frag(t->ptr);
++				mt76_put_rxwi(dev, t);
++				return NULL;
++			}
++
++			qbuf.addr = t->dma_addr;
++			qbuf.len = SKB_WITH_OVERHEAD(q->buf_size);
++			qbuf.skip_unmap = false;
++
++			if (mt76_dma_add_rx_buf(dev, q, &qbuf, t->ptr, t) < 0) {
++				dma_unmap_single(dev->dma_dev, t->dma_addr,
++						 SKB_WITH_OVERHEAD(q->buf_size),
++						 DMA_FROM_DEVICE);
++				skb_free_frag(t->ptr);
++				mt76_put_rxwi(dev, t);
++				return NULL;
++			}
 +		}
  
  		if (drop) {
  			u32 ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
-@@ -587,6 +612,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -455,7 +488,7 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
+ 	q->tail = (q->tail + 1) % q->ndesc;
+ 	q->queued--;
+ 
+-	return mt76_dma_get_buf(dev, q, idx, len, info, more, drop);
++	return mt76_dma_get_buf(dev, q, idx, len, info, more, drop, flush);
+ }
+ 
+ static int
+@@ -587,6 +620,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  	int len = SKB_WITH_OVERHEAD(q->buf_size);
  	int frames = 0, offset = q->buf_offset;
  	dma_addr_t addr;
@@ -95,7 +117,7 @@
  
  	if (!q->ndesc)
  		return 0;
-@@ -610,7 +636,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -610,7 +644,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  		qbuf.addr = addr + offset;
  		qbuf.len = len - offset;
  		qbuf.skip_unmap = false;
@@ -104,7 +126,7 @@
  			dma_unmap_single(dev->dma_dev, addr, len,
  					 DMA_FROM_DEVICE);
  			skb_free_frag(buf);
-@@ -619,7 +645,10 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -619,7 +653,10 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  		frames++;
  	}