diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0014-mt76-mt7915-limit-minimum-twt-duration-due-to-hw-lim.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0014-mt76-mt7915-limit-minimum-twt-duration-due-to-hw-lim.patch
new file mode 100644
index 0000000..d5aafcb
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0014-mt76-mt7915-limit-minimum-twt-duration-due-to-hw-lim.patch
@@ -0,0 +1,37 @@
+From 58706d81a82726f488cda771097f5586708b47f2 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Tue, 12 Apr 2022 16:06:36 +0800
+Subject: [PATCH] mt76: mt7915: limit minimum twt duration due to hw limitation
+
+---
+ mt7915/mac.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 925f5eb9..fd897fd5 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -2698,6 +2698,7 @@ void mt7915_mac_add_twt_setup(struct ieee80211_hw *hw,
+ 			      struct ieee80211_sta *sta,
+ 			      struct ieee80211_twt_setup *twt)
+ {
++#define MT7915_MIN_TWT_DUR 64
+ 	enum ieee80211_twt_setup_cmd setup_cmd = TWT_SETUP_CMD_REJECT;
+ 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
+ 	struct ieee80211_twt_params *twt_agrt = (void *)twt->params;
+@@ -2719,6 +2720,12 @@ void mt7915_mac_add_twt_setup(struct ieee80211_hw *hw,
+ 	if (hweight8(msta->twt.flowid_mask) == ARRAY_SIZE(msta->twt.flow))
+ 		goto unlock;
+ 
++	if (twt_agrt->min_twt_dur < MT7915_MIN_TWT_DUR) {
++		setup_cmd = TWT_SETUP_CMD_DICTATE;
++		twt_agrt->min_twt_dur = MT7915_MIN_TWT_DUR;
++		goto unlock;
++	}
++
+ 	flowid = ffs(~msta->twt.flowid_mask) - 1;
+ 	le16p_replace_bits(&twt_agrt->req_type, flowid,
+ 			   IEEE80211_TWT_REQTYPE_FLOWID);
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0015-mt76-mt7915-drop-undefined-action-frame.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0015-mt76-mt7915-drop-undefined-action-frame.patch
new file mode 100644
index 0000000..f8f766e
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0015-mt76-mt7915-drop-undefined-action-frame.patch
@@ -0,0 +1,36 @@
+From 573b80a984695b338e12c6c30bb4e9f7af7e3495 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Thu, 14 Apr 2022 15:18:02 +0800
+Subject: [PATCH] mt76: mt7915: drop undefined action frame
+
+---
+ mt7915/mac.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 1e0ddc13..81c582f2 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -1303,6 +1303,8 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 			  struct mt76_tx_info *tx_info)
+ {
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx_info->skb->data;
++	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)tx_info->skb->data;
++	__le16 fc = hdr->frame_control;
+ 	struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76);
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
+ 	struct ieee80211_key_conf *key = info->control.hw_key;
+@@ -1333,6 +1335,10 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
+ 	t->skb = tx_info->skb;
+ 
++	if (ieee80211_is_action(fc) &&
++	    mgmt->u.action.category == 0xff)
++		return -1;
++
+ 	id = mt76_token_consume(mdev, &t);
+ 	if (id < 0)
+ 		return id;
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
index adf063b..b7df798 100755
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1001-mt76-mt7915-add-mtk-internal-debug-tools-for-mt76.patch
@@ -1,4 +1,4 @@
-From 0449c4e87ffdfefb52beb549d2afc924f330fc60 Mon Sep 17 00:00:00 2001
+From 03d0a859ad4ba9f270b0c5ae896e8cc89fd241f4 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Thu, 21 Apr 2022 19:42:55 +0800
 Subject: [PATCH] mt76: mt7915: add mtk internal debug tools for mt76
@@ -13,10 +13,10 @@
  mt7915/mcu.h          |    4 +
  mt7915/mt7915.h       |   41 +
  mt7915/mt7915_debug.h | 1350 +++++++++++++++++++
- mt7915/mtk_debugfs.c  | 2893 +++++++++++++++++++++++++++++++++++++++++
+ mt7915/mtk_debugfs.c  | 2921 +++++++++++++++++++++++++++++++++++++++++
  mt7915/mtk_mcu.c      |   51 +
  tools/fwlog.c         |   26 +-
- 11 files changed, 4489 insertions(+), 11 deletions(-)
+ 11 files changed, 4517 insertions(+), 11 deletions(-)
  mode change 100644 => 100755 mt7915/mcu.c
  create mode 100644 mt7915/mt7915_debug.h
  create mode 100644 mt7915/mtk_debugfs.c
@@ -54,7 +54,7 @@
  mt7915e-$(CONFIG_MT7986_WMAC) += soc.o
 \ No newline at end of file
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 77bbeeed..e8e26ac1 100644
+index b45181c1..27321528 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -8,6 +8,9 @@
@@ -67,7 +67,7 @@
  
  /** global debugfs **/
  
-@@ -370,6 +373,9 @@ mt7915_fw_debug_wm_set(void *data, u64 val)
+@@ -448,6 +451,9 @@ mt7915_fw_debug_wm_set(void *data, u64 val)
  	int ret;
  
  	dev->fw_debug_wm = val ? MCU_FW_LOG_TO_HOST : 0;
@@ -77,7 +77,7 @@
  
  	if (dev->fw_debug_bin)
  		val = 16;
-@@ -394,6 +400,9 @@ mt7915_fw_debug_wm_set(void *data, u64 val)
+@@ -472,6 +478,9 @@ mt7915_fw_debug_wm_set(void *data, u64 val)
  		if (ret)
  			return ret;
  	}
@@ -87,7 +87,7 @@
  
  	/* WM CPU info record control */
  	mt76_clear(dev, MT_CPU_UTIL_CTRL, BIT(0));
-@@ -401,6 +410,12 @@ mt7915_fw_debug_wm_set(void *data, u64 val)
+@@ -479,6 +488,12 @@ mt7915_fw_debug_wm_set(void *data, u64 val)
  	mt76_wr(dev, MT_MCU_WM_CIRQ_IRQ_MASK_CLR_ADDR, BIT(5));
  	mt76_wr(dev, MT_MCU_WM_CIRQ_IRQ_SOFT_ADDR, BIT(5));
  
@@ -100,7 +100,7 @@
  	return 0;
  }
  
-@@ -409,7 +424,11 @@ mt7915_fw_debug_wm_get(void *data, u64 *val)
+@@ -487,7 +502,11 @@ mt7915_fw_debug_wm_get(void *data, u64 *val)
  {
  	struct mt7915_dev *dev = data;
  
@@ -113,7 +113,7 @@
  
  	return 0;
  }
-@@ -489,6 +508,16 @@ mt7915_fw_debug_bin_set(void *data, u64 val)
+@@ -567,6 +586,16 @@ mt7915_fw_debug_bin_set(void *data, u64 val)
  
  	relay_reset(dev->relay_fwlog);
  
@@ -130,7 +130,7 @@
  	return mt7915_fw_debug_wm_set(dev, dev->fw_debug_wm);
  }
  
-@@ -942,6 +971,11 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
+@@ -1020,6 +1049,11 @@ int mt7915_init_debugfs(struct mt7915_phy *phy)
  	if (!ext_phy)
  		dev->debugfs_dir = dir;
  
@@ -142,7 +142,7 @@
  	return 0;
  }
  
-@@ -982,17 +1016,53 @@ void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int
+@@ -1060,17 +1094,53 @@ void mt7915_debugfs_rx_fw_monitor(struct mt7915_dev *dev, const void *data, int
  		.msg_type = cpu_to_le16(PKT_TYPE_RX_FW_MONITOR),
  	};
  
@@ -197,7 +197,7 @@
  
  	if (dev->relay_fwlog)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index de5f3f10..ce760cdb 100644
+index 25a6adfc..6d8b749e 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -596,6 +596,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
@@ -222,7 +222,7 @@
  	if (hdr_trans && ieee80211_has_morefrags(fc)) {
  		if (mt7915_reverse_frag0_hdr_trans(skb, hdr_gap))
  			return -EINVAL;
-@@ -1352,6 +1360,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1346,6 +1354,12 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	tx_info->buf[1].skip_unmap = true;
  	tx_info->nbuf = MT_CT_DMA_BUF_NUM;
  
@@ -238,7 +238,7 @@
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
 old mode 100644
 new mode 100755
-index c215bc9e..bce14f4b
+index 20f32f7f..c325c4b6
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -298,6 +298,10 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -252,7 +252,7 @@
  	if (wait_seq)
  		*wait_seq = seq;
  
-@@ -3660,6 +3664,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
+@@ -3657,6 +3661,43 @@ int mt7915_mcu_twt_agrt_update(struct mt7915_dev *dev,
  				 &req, sizeof(req), true);
  }
  
@@ -297,7 +297,7 @@
  {
  	struct {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index df7aefca..c36cf511 100644
+index 5cbc3ecf..3f303885 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -296,6 +296,10 @@ enum {
@@ -377,7 +377,7 @@
  #endif
 diff --git a/mt7915/mt7915_debug.h b/mt7915/mt7915_debug.h
 new file mode 100644
-index 00000000..ca4b6078
+index 00000000..58ba2cdf
 --- /dev/null
 +++ b/mt7915/mt7915_debug.h
 @@ -0,0 +1,1350 @@
@@ -722,7 +722,7 @@
 +	[DBG_PLE_CPU_PG_INFO]		= { DBG_INVALID_BASE, 0x394},
 +	[DBG_PLE_FL_QUE_CTRL]		= { DBG_INVALID_BASE, 0x3e0},
 +	[DBG_PLE_NATIVE_TXCMD_Q_EMPTY]	= { DBG_INVALID_BASE, 0x370},
-+	[DBG_PLE_TXCMD_Q_EMPTY]		= { DBG_INVALID_BASE, 0x374},
++	[DBG_PLE_TXCMD_Q_EMPTY]		= { DBG_INVALID_BASE, 0x36c},
 +	[DBG_PLE_AC_QEMPTY]		= { DBG_INVALID_BASE, 0x600},
 +	[DBG_PLE_AC_OFFSET]		= { DBG_INVALID_BASE, 0x080},
 +	[DBG_PLE_STATION_PAUSE]		= { DBG_INVALID_BASE, 0x100},
@@ -1733,10 +1733,10 @@
 +#endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
 new file mode 100644
-index 00000000..246eb129
+index 00000000..ccaaea78
 --- /dev/null
 +++ b/mt7915/mtk_debugfs.c
-@@ -0,0 +1,2893 @@
+@@ -0,0 +1,2921 @@
 +#include<linux/inet.h>
 +#include "mt7915.h"
 +#include "mt7915_debug.h"
@@ -1968,6 +1968,23 @@
 +#define LWTBL_LEN_IN_DW 32
 +#define UWTBL_LEN_IN_DW 8
 +#define ONE_KEY_ENTRY_LEN_IN_DW 8
++static int mt7915_sta_info(struct seq_file *s, void *data)
++{
++	struct mt7915_dev *dev = dev_get_drvdata(s->private);
++	u8 lwtbl[LWTBL_LEN_IN_DW*4] = {0};
++	u16 i = 0;
++
++	for (i=0; i < mt7915_wtbl_size(dev); i++) {
++		mt7915_wtbl_read_raw(dev, i, WTBL_TYPE_LMAC, 0,
++					LWTBL_LEN_IN_DW, lwtbl);
++		if (lwtbl[4] || lwtbl[5] || lwtbl[6] || lwtbl[7] || lwtbl[0] || lwtbl[1])
++			seq_printf(s, "wcid:%d\tAddr: %02x:%02x:%02x:%02x:%02x:%02x\n",
++					i, lwtbl[4], lwtbl[5], lwtbl[6], lwtbl[7], lwtbl[0], lwtbl[1]);
++	}
++
++	return 0;
++}
++
 +static int mt7915_wtbl_read(struct seq_file *s, void *data)
 +{
 +	struct mt7915_dev *dev = dev_get_drvdata(s->private);
@@ -2893,7 +2910,7 @@
 +	return 0;
 +}
 +
-+#define CR_NUM_OF_AC 9
++#define CR_NUM_OF_AC 17
 +
 +typedef enum _ENUM_UMAC_PORT_T {
 +	ENUM_UMAC_HIF_PORT_0         = 0,
@@ -3023,16 +3040,15 @@
 +	u32 ac_num = 9, all_ac_num;
 +
 +	/* TDO: ac_num = 16 for mt7986 */
-+	/* if (!is_mt7915(&dev->mt76))
-+		ac_num = 16;
-+	*/
++	if (!is_mt7915(&dev->mt76))
++		ac_num = 17;
 +
 +	all_ac_num = ac_num * 4;
 +
 +	for (j = 0; j < all_ac_num; j++) { /* show AC Q info */
 +		for (i = 0; i < 32; i++) {
 +			if (((ple_stat[j + 1] & (0x1 << i)) >> i) == 0) {
-+				u32 hfid, tfid, pktcnt, ac_num = j / ac_num, ctrl = 0;
++				u32 hfid, tfid, pktcnt, ac_n = j / ac_num, ctrl = 0;
 +				u32 sta_num = i + (j % ac_num) * 32, fl_que_ctrl[3] = {0};
 +				//struct wifi_dev *wdev = wdev_search_by_wcid(pAd, sta_num);
 +				u32 wmmidx = 0;
@@ -3044,16 +3060,16 @@
 +				sta = wcid_to_sta(wcid);
 +				if (!sta) {
 +					printk("ERROR!! no found STA wcid=%d\n", sta_num);
-+					return 0;
++					continue;
 +				}
 +				msta = container_of(wcid, struct mt7915_sta, wcid);
 +				wmmidx = msta->vif->mt76.wmm_idx;
 +
-+				seq_printf(s, "\tSTA%d AC%d: ", sta_num, ac_num);
++				seq_printf(s, "\tSTA%d AC%d: ", sta_num, ac_n);
 +
 +				fl_que_ctrl[0] |= MT_DBG_PLE_FL_QUE_CTRL0_EXECUTE_MASK;
 +				fl_que_ctrl[0] |= (ENUM_UMAC_LMAC_PORT_2 << MT_PLE_FL_QUE_CTRL0_Q_BUF_PID_SHFT);
-+				fl_que_ctrl[0] |= (ac_num << MT_PLE_FL_QUE_CTRL0_Q_BUF_QID_SHFT);
++				fl_que_ctrl[0] |= (ac_n << MT_PLE_FL_QUE_CTRL0_Q_BUF_QID_SHFT);
 +				fl_que_ctrl[0] |= sta_num;
 +				mt76_wr(dev, MT_DBG_PLE_FL_QUE_CTRL0, fl_que_ctrl[0]);
 +				fl_que_ctrl[1] = mt76_rr(dev, MT_DBG_PLE_FL_QUE_CTRL2);
@@ -3090,7 +3106,7 @@
 +	int i;
 +
 +	seq_printf(s, "Nonempty TXCMD Q info:\n");
-+	for (i = 0; i < 31; i++) {
++	for (i = 0; i < 32; i++) {
 +		if (((ple_txcmd_stat & (0x1 << i)) >> i) == 0) {
 +			u32 hfid, tfid, pktcnt, fl_que_ctrl[3] = {0};
 +
@@ -3123,10 +3139,9 @@
 +	u32 ac , index;
 +
 +	/* TDO: cr_num = 16 for mt7986 */
-+	/*
 +	if(!is_mt7915(&dev->mt76))
-+		cr_num = 16;
-+	*/
++		cr_num = 17;
++
 +	all_cr_num =  cr_num * 4;
 +
 +	ple_stat[0] = mt76_rr(dev, MT_DBG_PLE_QUEUE_EMPTY);
@@ -3143,8 +3158,13 @@
 +static void chip_get_dis_sta_map(struct mt7915_dev *dev, u32 *dis_sta_map)
 +{
 +	int i;
++	u32 ac_num = 9;
 +
-+	for(i = 0; i < CR_NUM_OF_AC; i++) {
++	/* TDO: ac_num = 16 for mt7986 */
++	if (!is_mt7915(&dev->mt76))
++		ac_num = 17;
++
++	for(i = 0; i < ac_num; i++) {
 +		dis_sta_map[i] = mt76_rr(dev, MT_DBG_PLE_DIS_STA_MAP(i));
 +	}
 +}
@@ -3152,8 +3172,13 @@
 +static void chip_get_sta_pause(struct mt7915_dev *dev, u32 *sta_pause)
 +{
 +	int i;
++	u32 ac_num = 9;
++
++	/* TDO: ac_num = 16 for mt7986 */
++	if (!is_mt7915(&dev->mt76))
++		ac_num = 17;
 +
-+	for(i = 0; i < CR_NUM_OF_AC; i++) {
++	for(i = 0; i < ac_num; i++) {
 +		sta_pause[i] = mt76_rr(dev, MT_DBG_PLE_STATION_PAUSE(i));
 +	}
 +}
@@ -3162,7 +3187,7 @@
 +{
 +	struct mt7915_dev *dev = dev_get_drvdata(s->private);
 +	u32 ple_buf_ctrl, pg_sz, pg_num;
-+	u32 ple_stat[65] = {0}, pg_flow_ctrl[8] = {0};
++	u32 ple_stat[70] = {0}, pg_flow_ctrl[8] = {0};
 +	u32 ple_native_txcmd_stat;
 +	u32 ple_txcmd_stat;
 +	u32 sta_pause[CR_NUM_OF_AC] = {0}, dis_sta_map[CR_NUM_OF_AC] = {0};
@@ -3172,9 +3197,8 @@
 +	u32 ac_num = 9, all_ac_num;
 +
 +	/* TDO: ac_num = 16 for mt7986 */
-+	/* if (!is_mt7915(&dev->mt76))
-+		ac_num = 16;
-+	*/
++	if (!is_mt7915(&dev->mt76))
++		ac_num = 17;
 +
 +	all_ac_num = ac_num * 4;
 +
@@ -3240,15 +3264,17 @@
 +	seq_printf(s, "\tHIF_TXCMD group page status(0x%x): 0x%08x\n",
 +	              MT_DBG_PLE_HIF_TXCMD_PG_INFO, pg_flow_ctrl[7]);
 +	cpu_min_q = FIELD_GET(MT_DBG_PLE_PG_HIF_TXCMD_GROUP_HIF_TXCMD_MIN_QUOTA_MASK, pg_flow_ctrl[6]);
-+	cpu_max_q = FIELD_GET(MT_DBG_PLE_PG_HIF_TXCMD_GROUP_HIF_TXCMD_MIN_QUOTA_MASK, pg_flow_ctrl[6]);
++	cpu_max_q = FIELD_GET(MT_DBG_PLE_PG_HIF_TXCMD_GROUP_HIF_TXCMD_MAX_QUOTA_MASK, pg_flow_ctrl[6]);
 +	seq_printf(s, "\t\tThe max/min quota pages of HIF_TXCMD group=0x%03x/0x%03x\n", cpu_max_q, cpu_min_q);
 +
 +	rpg_cpu = FIELD_GET(MT_DBG_PLE_TXCMD_PG_INFO_HIF_TXCMD_RSV_CNT_MASK, pg_flow_ctrl[7]);
 +	upg_cpu = FIELD_GET(MT_DBG_PLE_TXCMD_PG_INFO_HIF_TXCMD_SRC_CNT_MASK, pg_flow_ctrl[7]);
 +	seq_printf(s, "\t\tThe used/reserved pages of HIF_TXCMD group=0x%03x/0x%03x\n", upg_cpu, rpg_cpu);
 +
-+	seq_printf(s, "\tReserved page counter of CPU group(0x820c0150): 0x%08x\n", pg_flow_ctrl[4]);
-+	seq_printf(s, "\tCPU group page status(0x820c0154): 0x%08x\n", pg_flow_ctrl[5]);
++	seq_printf(s, "\tReserved page counter of CPU group(0x%x): 0x%08x\n",
++			MT_DBG_PLE_PG_CPU_GROUP, pg_flow_ctrl[4]);
++	seq_printf(s, "\tCPU group page status(0x%x): 0x%08x\n",
++			MT_DBG_PLE_CPU_PG_INFO, pg_flow_ctrl[5]);
 +	cpu_min_q = FIELD_GET(MT_DBG_PLE_PG_CPU_GROUP_CPU_MIN_QUOTA_MASK, pg_flow_ctrl[4]);
 +	cpu_max_q = FIELD_GET(MT_DBG_PLE_PG_CPU_GROUP_CPU_MAX_QUOTA_MASK, pg_flow_ctrl[4]);
 +	seq_printf(s, "\t\tThe max/min quota pages of CPU group=0x%03x/0x%03x\n", cpu_max_q, cpu_min_q);
@@ -3263,7 +3289,7 @@
 +				seq_printf(s, "\n\tNonempty AC%d Q of STA#: ", j / ac_num);
 +			}
 +
-+			for (i = 0; i < all_ac_num; i++) {
++			for (i = 0; i < 32; i++) {
 +				if (((ple_stat[j + 1] & (0x1 << i)) >> i) == 0) {
 +					seq_printf(s, "%d ", i + (j % ac_num) * 32);
 +				}
@@ -3277,7 +3303,7 @@
 +
 +	seq_printf(s, "Nonempty Q info:\n");
 +
-+	for (i = 0; i < all_ac_num; i++) {
++	for (i = 0; i < 32; i++) {
 +		if (((ple_stat[0] & (0x1 << i)) >> i) == 0) {
 +			u32 hfid, tfid, pktcnt, fl_que_ctrl[3] = {0};
 +
@@ -4575,6 +4601,8 @@
 +	debugfs_create_file("fw_debug_level", 0600, dir, dev,
 +			    &fops_fw_debug_level);
 +
++	debugfs_create_devm_seqfile(dev->mt76.dev, "sta_info", dir,
++				    mt7915_sta_info);
 +	debugfs_create_devm_seqfile(dev->mt76.dev, "wtbl_info", dir,
 +				    mt7915_wtbl_read);
 +	debugfs_create_devm_seqfile(dev->mt76.dev, "uwtbl_info", dir,
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
index d72aab5..31bdbf4 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1004-mt76-mt7915-add-support-for-muru_onoff-via-debugfs.patch
@@ -1,4 +1,4 @@
-From cdccb674bc75292020be6894dcea162e585dc5ce Mon Sep 17 00:00:00 2001
+From 6820d00b2fd86c760e281ea6e3e114cf2779cb12 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 28 Mar 2022 09:19:29 +0800
 Subject: [PATCH] mt76: mt7915: add support for muru_onoff via debugfs
@@ -12,7 +12,7 @@
  5 files changed, 49 insertions(+), 4 deletions(-)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index dbcdf147..c58f045f 100644
+index ad2a9c9f..3eaf7916 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -574,6 +574,7 @@ static void mt7915_init_work(struct work_struct *work)
@@ -24,7 +24,7 @@
  
  void mt7915_wfsys_reset(struct mt7915_dev *dev)
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 26831327..95825062 100644
+index c7694819..cbcd3bd4 100755
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -944,6 +944,7 @@ mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
@@ -55,10 +55,10 @@
  	if (sta->vht_cap.vht_supported)
  		muru->mimo_dl.vht_mu_bfee =
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index 007282d4..a5e5afae 100644
+index f166eaea..ccb1c9d0 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
-@@ -569,4 +569,10 @@ struct csi_data {
+@@ -573,4 +573,10 @@ struct csi_data {
  };
  #endif
  
@@ -70,7 +70,7 @@
 +
  #endif
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 9960785e..ec844dbe 100644
+index 1b37cef7..e6b87239 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -390,6 +390,7 @@ struct mt7915_dev {
@@ -82,10 +82,10 @@
  	const struct mt7915_dbg_reg_desc *dbg_reg;
  #endif
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index 246eb129..6c48f115 100644
+index ccaaea78..d2dbae45 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
-@@ -2454,6 +2454,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
+@@ -2480,6 +2480,38 @@ static int mt7915_token_txd_read(struct seq_file *s, void *data)
  	return 0;
  }
  
@@ -124,7 +124,7 @@
  static int mt7915_amsduinfo_read(struct seq_file *s, void *data)
  {
  	struct mt7915_dev *dev = dev_get_drvdata(s->private);
-@@ -2831,6 +2863,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+@@ -2857,6 +2889,7 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
  
  	mt7915_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, 0);
  
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-drop-packetes-when-TWT-stations-use-more.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-drop-packets-when-TWT-stations-use-more-.patch
old mode 100755
new mode 100644
similarity index 73%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-drop-packetes-when-TWT-stations-use-more.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-drop-packets-when-TWT-stations-use-more-.patch
index 9de9b75..743f41b
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-drop-packetes-when-TWT-stations-use-more.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1114-mt76-mt7915-drop-packets-when-TWT-stations-use-more-.patch
@@ -1,8 +1,8 @@
-From fa3b5a740661e91e59b68ffab139cc1e32a0cd6e Mon Sep 17 00:00:00 2001
-From: Bo Jiao <Bo.Jiao@mediatek.com>
-Date: Mon, 9 May 2022 13:37:09 +0800
-Subject: [PATCH 08/10] mt76: mt7915: drop packetes when TWT stations use more
- token then 128
+From c83d3e3692a758084e4d78fad127043d8789d263 Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Mon, 9 May 2022 16:36:38 +0800
+Subject: [PATCH] mt76: mt7915: drop packets when TWT stations use more tokens
+ than 128
 
 ---
  mt7915/mac.c    | 21 ++++++++++++++++++---
@@ -10,10 +10,10 @@
  2 files changed, 20 insertions(+), 3 deletions(-)
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index db35eb14..2ee49b82 100644
+index c73e767b..588c0d58 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1306,6 +1306,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1292,6 +1292,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
  	struct ieee80211_key_conf *key = info->control.hw_key;
  	struct ieee80211_vif *vif = info->control.vif;
@@ -21,7 +21,7 @@
  	struct mt76_txwi_cache *t;
  	struct mt7915_txp *txp;
  	int id, i, nbuf = tx_info->nbuf - 1;
-@@ -1319,8 +1320,6 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1305,8 +1306,6 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  		wcid = &dev->mt76.global_wcid;
  
  	if (sta) {
@@ -30,9 +30,9 @@
  		msta = (struct mt7915_sta *)sta->drv_priv;
  
  		if (time_after(jiffies, msta->jiffies + HZ / 4)) {
-@@ -1336,10 +1335,22 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
- 	    mgmt->u.action.category == 0xff)
- 		return -1;
+@@ -1318,10 +1317,22 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
+ 	t->skb = tx_info->skb;
  
 +	spin_lock_bh(&mdev->token_lock);
 +	if (msta && msta->twt.flowid_mask && msta->token_count > 128) {
@@ -53,15 +53,15 @@
  	pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb);
  	mt7915_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, pid, key,
  			      false);
-@@ -1531,6 +1542,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1513,6 +1524,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  	struct mt76_dev *mdev = &dev->mt76;
  	struct mt76_txwi_cache *txwi;
  	struct ieee80211_sta *sta = NULL;
-+	struct mt7915_sta *msta;
++	struct mt7915_sta *msta = NULL;
  	LIST_HEAD(free_list);
  	void *end = data + len;
  	bool v3, wake = false;
-@@ -1554,7 +1566,6 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1536,7 +1548,6 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  		 * 1'b0: msdu_id with the same 'wcid pair' as above.
  		 */
  		if (info & MT_TX_FREE_PAIR) {
@@ -69,7 +69,7 @@
  			struct mt76_wcid *wcid;
  			u16 idx;
  
-@@ -1590,6 +1601,10 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1569,6 +1580,10 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  			txwi = mt76_token_release(mdev, msdu, &wake);
  			if (!txwi)
  				continue;
@@ -81,7 +81,7 @@
  			mt7915_txwi_free(dev, txwi, sta, &free_list);
  		}
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index bc7f746f..56f6ba6c 100644
+index cd54f087..b78b1a9a 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -136,6 +136,8 @@ struct mt7915_sta {
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3000-mt76-remove-WED-support-patch-for-build-err.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3000-mt76-remove-WED-support-patch-for-build-err.patch
index c681770..26fd886 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3000-mt76-remove-WED-support-patch-for-build-err.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3000-mt76-remove-WED-support-patch-for-build-err.patch
@@ -1,7 +1,7 @@
-From 705b565717a1e6e74369ad56b17e147e60d5a821 Mon Sep 17 00:00:00 2001
+From 1100bd66f9de10e2091d6640d8d9952d12891a42 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 12 Apr 2022 15:58:28 +0800
-Subject: [PATCH 1116/1116] mt76:remove WED support patch for build err
+Subject: [PATCH] mt76:remove WED support patch for build err
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -442,7 +442,7 @@
  		return ret;
  
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index c2d655cd..66a312a9 100644
+index 9e3d14db..4358e9bf 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -8,16 +8,9 @@
@@ -527,10 +527,10 @@
  		return ret;
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 1935acff..8d1552fc 100644
+index 588c0d58..f3049639 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -1391,29 +1391,6 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -1380,29 +1380,6 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	return 0;
  }
  
@@ -560,7 +560,7 @@
  static void
  mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
  {
-@@ -1447,7 +1424,7 @@ mt7915_txp_skb_unmap(struct mt76_dev *dev, struct mt76_txwi_cache *t)
+@@ -1436,7 +1413,7 @@ mt7915_txp_skb_unmap(struct mt76_dev *dev, struct mt76_txwi_cache *t)
  
  	txp = mt7915_txwi_to_txp(dev, t);
  	for (i = 0; i < txp->nbuf; i++)
@@ -569,7 +569,7 @@
  				 le16_to_cpu(txp->len[i]), DMA_TO_DEVICE);
  }
  
-@@ -1456,7 +1433,6 @@ mt7915_txwi_free(struct mt7915_dev *dev, struct mt76_txwi_cache *t,
+@@ -1445,7 +1422,6 @@ mt7915_txwi_free(struct mt7915_dev *dev, struct mt76_txwi_cache *t,
  		 struct ieee80211_sta *sta, struct list_head *free_list)
  {
  	struct mt76_dev *mdev = &dev->mt76;
@@ -577,7 +577,7 @@
  	struct mt76_wcid *wcid;
  	__le32 *txwi;
  	u16 wcid_idx;
-@@ -1469,24 +1445,13 @@ mt7915_txwi_free(struct mt7915_dev *dev, struct mt76_txwi_cache *t,
+@@ -1458,24 +1434,13 @@ mt7915_txwi_free(struct mt7915_dev *dev, struct mt76_txwi_cache *t,
  	if (sta) {
  		wcid = (struct mt76_wcid *)sta->drv_priv;
  		wcid_idx = wcid->idx;
@@ -605,7 +605,7 @@
  	__mt76_tx_complete_skb(mdev, wcid_idx, t->skb, free_list);
  
  out:
-@@ -1494,56 +1459,30 @@ out:
+@@ -1483,56 +1448,30 @@ out:
  	mt76_put_txwi(mdev, t);
  }
  
@@ -651,7 +651,7 @@
 +	struct mt76_phy *mphy_ext = mdev->phy2;
  	struct mt76_txwi_cache *txwi;
  	struct ieee80211_sta *sta = NULL;
- 	struct mt7915_sta *msta;
+ 	struct mt7915_sta *msta = NULL;
  	LIST_HEAD(free_list);
 +	struct sk_buff *skb, *tmp;
  	void *end = data + len;
@@ -671,7 +671,7 @@
  
  	total = le16_get_bits(free->ctrl, MT_TX_FREE_MSDU_CNT);
  	v3 = (FIELD_GET(MT_TX_FREE_VER, txd) == 0x4);
-@@ -1603,38 +1542,17 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -1589,38 +1528,17 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  		}
  	}
  
@@ -717,7 +717,7 @@
  }
  
  static bool
-@@ -1814,9 +1732,6 @@ bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len)
+@@ -1800,9 +1718,6 @@ bool mt7915_rx_check(struct mt76_dev *mdev, void *data, int len)
  	case PKT_TYPE_TXRX_NOTIFY:
  		mt7915_mac_tx_free(dev, data, len);
  		return false;
@@ -727,7 +727,7 @@
  	case PKT_TYPE_TXS:
  		for (rxd += 2; rxd + 8 <= end; rxd += 8)
  		    mt7915_mac_add_txs(dev, rxd);
-@@ -1844,10 +1759,6 @@ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+@@ -1830,10 +1745,6 @@ void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
  		mt7915_mac_tx_free(dev, skb->data, skb->len);
  		napi_consume_skb(skb, 1);
  		break;
@@ -759,10 +759,10 @@
  #define MT_TX_FREE_LATENCY		GENMASK(12, 0)
  /* 0: success, others: dropped */
 diff --git a/mt7915/main.c b/mt7915/main.c
-index f50dbbb5..660f3482 100644
+index 87f4c5ab..ffc2ed0d 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
-@@ -1393,39 +1393,6 @@ out:
+@@ -1405,39 +1405,6 @@ out:
  	return ret;
  }
  
@@ -802,7 +802,7 @@
  const struct ieee80211_ops mt7915_ops = {
  	.tx = mt7915_tx,
  	.start = mt7915_start,
-@@ -1473,7 +1440,4 @@ const struct ieee80211_ops mt7915_ops = {
+@@ -1485,7 +1452,4 @@ const struct ieee80211_ops mt7915_ops = {
  	.sta_add_debugfs = mt7915_sta_add_debugfs,
  #endif
  	.set_radar_background = mt7915_set_radar_background,
@@ -811,10 +811,10 @@
 -#endif
  };
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 10450bd7..e464a16b 100755
+index d547cf6f..562f3346 100755
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2512,9 +2512,6 @@ int mt7915_mcu_init(struct mt7915_dev *dev)
+@@ -2575,9 +2575,6 @@ int mt7915_run_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -825,10 +825,10 @@
  	if (ret)
  		return ret;
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 2d733d32..99119cdc 100644
+index b3de3a7a..3768c1a6 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
-@@ -552,21 +552,15 @@ static void mt7915_rx_poll_complete(struct mt76_dev *mdev,
+@@ -555,21 +555,15 @@ static void mt7915_rx_poll_complete(struct mt76_dev *mdev,
  static void mt7915_irq_tasklet(struct tasklet_struct *t)
  {
  	struct mt7915_dev *dev = from_tasklet(dev, t, irq_tasklet);
@@ -856,7 +856,7 @@
  
  	if (dev->hif2) {
  		intr1 = mt76_rr(dev, MT_INT1_SOURCE_CSR);
-@@ -621,15 +615,10 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
+@@ -623,15 +617,10 @@ static void mt7915_irq_tasklet(struct tasklet_struct *t)
  irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
  {
  	struct mt7915_dev *dev = dev_instance;
@@ -876,10 +876,10 @@
  	if (!test_bit(MT76_STATE_INITIALIZED, &dev->mphy.state))
  		return IRQ_NONE;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 0feccb17..d185e364 100644
+index b78b1a9a..fca0bfcb 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
-@@ -502,8 +502,6 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
+@@ -517,8 +517,6 @@ struct mt7915_dev *mt7915_mmio_probe(struct device *pdev,
  void mt7915_wfsys_reset(struct mt7915_dev *dev);
  irqreturn_t mt7915_irq_handler(int irq, void *dev_instance);
  u64 __mt7915_get_tsf(struct ieee80211_hw *hw, struct mt7915_vif *mvif);
@@ -1027,10 +1027,10 @@
  	mt76_free_device(&dev->mt76);
  
 diff --git a/mt7915/regs.h b/mt7915/regs.h
-index ee212c99..078ab334 100644
+index 99834310..02d097fa 100644
 --- a/mt7915/regs.h
 +++ b/mt7915/regs.h
-@@ -581,31 +581,18 @@ enum offs_rev {
+@@ -591,31 +591,18 @@ enum offs_rev {
  
  /* WFDMA CSR */
  #define MT_WFDMA_EXT_CSR_BASE		__REG(WFDMA_EXT_CSR_ADDR)