diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch
index 87c34b2..84e8b97 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0001-mtk-Revert-wifi-mt76-mt7996-fill-txd-by-host-driver.patch
@@ -1,4 +1,4 @@
-From 4b6925449bf9160932961c506fb8f06db29a5e77 Mon Sep 17 00:00:00 2001
+From 803b79d47849d9f35f797f86efc63d57758a1dbd Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 19 Sep 2023 11:21:23 +0800
 Subject: [PATCH 001/116] mtk: Revert "wifi: mt76: mt7996: fill txd by host
@@ -10,7 +10,7 @@
  1 file changed, 9 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index bc7111a71..3afdd7eb9 100644
+index bc7111a..3afdd7e 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -938,8 +938,11 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -41,5 +41,5 @@
  	if (!key)
  		txp->fw.flags |= cpu_to_le16(MT_CT_INFO_NONE_CIPHER_FRAME);
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0002-bp-sync-upstream-changes.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0002-bp-sync-upstream-changes.patch
index 0937b99..cc34f3c 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0002-bp-sync-upstream-changes.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0002-bp-sync-upstream-changes.patch
@@ -1,4 +1,4 @@
-From aff8d4c7a0312f94429e93edc21b0e6b04899e12 Mon Sep 17 00:00:00 2001
+From 33b7b4702d0666eb4e1535ea99bcf1f4316c2ab2 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Mar 2024 12:14:20 +0800
 Subject: [PATCH 002/116] bp: sync upstream changes
@@ -12,10 +12,10 @@
  4 files changed, 6 insertions(+), 6 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index e7b763bab..64307b967 100644
+index 4871355..e4675bf 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1613,8 +1613,8 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
+@@ -1614,8 +1614,8 @@ EXPORT_SYMBOL_GPL(mt76_get_sar_power);
  static void
  __mt76_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
  {
@@ -26,7 +26,7 @@
  }
  
  void mt76_csa_finish(struct mt76_dev *dev)
-@@ -1638,7 +1638,7 @@ __mt76_csa_check(void *priv, u8 *mac, struct ieee80211_vif *vif)
+@@ -1639,7 +1639,7 @@ __mt76_csa_check(void *priv, u8 *mac, struct ieee80211_vif *vif)
  	if (!vif->bss_conf.csa_active)
  		return;
  
@@ -36,7 +36,7 @@
  
  void mt76_csa_check(struct mt76_dev *dev)
 diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index ae34d019e..c807bd8d9 100644
+index ae34d01..c807bd8 100644
 --- a/mt7615/mcu.c
 +++ b/mt7615/mcu.c
 @@ -353,7 +353,7 @@ static void
@@ -49,7 +49,7 @@
  
  static void
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index fe54a2f40..24daa0835 100644
+index 29e9d66..fc194e0 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -228,7 +228,7 @@ mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
@@ -62,7 +62,7 @@
  
  static void
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index aa4478fdf..4f8e656b2 100644
+index 4588696..4bd74e1 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -341,7 +341,7 @@ mt7996_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
@@ -75,5 +75,5 @@
  
  static void
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0003-mtk-wifi-mt76-mt7996-let-upper-layer-handle-MGMT-fra.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0003-mtk-wifi-mt76-mt7996-let-upper-layer-handle-MGMT-fra.patch
deleted file mode 100644
index 77eb801..0000000
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0003-mtk-wifi-mt76-mt7996-let-upper-layer-handle-MGMT-fra.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From a764efbef07c65a3b712dc1c5d619c3f22bd6433 Mon Sep 17 00:00:00 2001
-From: Michael-CY Lee <michael-cy.lee@mediatek.com>
-Date: Mon, 18 Mar 2024 17:06:58 +0800
-Subject: [PATCH 003/116] mtk: wifi: mt76: mt7996: let upper layer handle MGMT
- frame protection
-
-The firmware support for management frame protection has limitations:
-- do not support cipher BIP-GMAC-128 and BIP-GMAC-256
-- support cipher BIP-CMAC-128 and BIP-CMAC-256, except action frame with
-  action type 'not robust'.
-
-Therefore, to simplify the logic, do not set the IGTK to firmware and
-let the encryption of management frames be handled by upper layer.
-
-Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- mt7996/main.c | 9 +++++----
- 1 file changed, 5 insertions(+), 4 deletions(-)
-
-diff --git a/mt7996/main.c b/mt7996/main.c
-index 16115c279..a65a1efca 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -352,10 +352,6 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
- 
- 	/* fall back to sw encryption for unsupported ciphers */
- 	switch (key->cipher) {
--	case WLAN_CIPHER_SUITE_AES_CMAC:
--		wcid_keyidx = &wcid->hw_key_idx2;
--		key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIE;
--		break;
- 	case WLAN_CIPHER_SUITE_TKIP:
- 	case WLAN_CIPHER_SUITE_CCMP:
- 	case WLAN_CIPHER_SUITE_CCMP_256:
-@@ -363,6 +359,11 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
- 	case WLAN_CIPHER_SUITE_GCMP_256:
- 	case WLAN_CIPHER_SUITE_SMS4:
- 		break;
-+	case WLAN_CIPHER_SUITE_AES_CMAC:
-+		wcid_keyidx = &wcid->hw_key_idx2;
-+		key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIE;
-+		fallthrough;
-+	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
- 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
- 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
- 		if (key->keyidx == 6 || key->keyidx == 7)
--- 
-2.39.2
-
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0004-wifi-mt76-mt7996-use-hweight16-to-get-correct-tx_ant.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0003-wifi-mt76-mt7996-use-hweight16-to-get-correct-tx_ant.patch
similarity index 81%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0004-wifi-mt76-mt7996-use-hweight16-to-get-correct-tx_ant.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0003-wifi-mt76-mt7996-use-hweight16-to-get-correct-tx_ant.patch
index b333c68..e1fdf6b 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0004-wifi-mt76-mt7996-use-hweight16-to-get-correct-tx_ant.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0003-wifi-mt76-mt7996-use-hweight16-to-get-correct-tx_ant.patch
@@ -1,7 +1,7 @@
-From b403f206062aee515c6d0fcabf327a87c7a04fbc Mon Sep 17 00:00:00 2001
+From e9039f548952da4aa2f91d125da157974d0c0fa7 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 10 Apr 2024 14:05:12 +0800
-Subject: [PATCH 004/116] wifi: mt76: mt7996: use hweight16 to get correct
+Subject: [PATCH 003/116] wifi: mt76: mt7996: use hweight16 to get correct
  tx_ant
 
 The chainmask is u16 so using hweight8 cannot get correct tx_ant.
@@ -16,7 +16,7 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 4f8e656b2..e426d0737 100644
+index 4bd74e1..239b64a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -1653,7 +1653,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
@@ -27,7 +27,7 @@
 +	int tx_ant = hweight16(phy->mt76->chainmask) - 1;
  	struct sta_rec_bf *bf;
  	struct tlv *tlv;
- 	const u8 matrix[4][4] = {
+ 	static const u8 matrix[4][4] = {
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0005-mtk-wifi-mt76-mt7996-fix-MBSS.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0004-mtk-wifi-mt76-mt7996-fix-MBSS.patch
similarity index 86%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0005-mtk-wifi-mt76-mt7996-fix-MBSS.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0004-mtk-wifi-mt76-mt7996-fix-MBSS.patch
index 331153f..9684e8b 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0005-mtk-wifi-mt76-mt7996-fix-MBSS.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0004-mtk-wifi-mt76-mt7996-fix-MBSS.patch
@@ -1,7 +1,7 @@
-From eb0640a1313c7f6a3fd579d2e0ad4209808440db Mon Sep 17 00:00:00 2001
+From 3fc5e746e7fb33b2d2206f5fd3c5e9cd65b302f3 Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Thu, 18 Apr 2024 14:19:21 +0800
-Subject: [PATCH 005/116] mtk: wifi: mt76: mt7996: fix MBSS
+Subject: [PATCH 004/116] mtk: wifi: mt76: mt7996: fix MBSS
 
 Refactor 11v mbss unicmd flow
 case1(disable->enable) : when we enable 11v MBSS, we have to add 11v mbss tlv(UNI_BSS_INFO_11V_MBSSID)
@@ -14,7 +14,7 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index e426d0737..f23801901 100644
+index 239b64a..ceff487 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -822,7 +822,7 @@ mt7996_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
@@ -27,5 +27,5 @@
  
  	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_11V_MBSSID, sizeof(*mbssid));
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0006-wifi-mt76-mt7996-fix-HE-and-EHT-phy-cap.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0005-wifi-mt76-mt7996-fix-HE-and-EHT-phy-cap.patch
similarity index 96%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0006-wifi-mt76-mt7996-fix-HE-and-EHT-phy-cap.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0005-wifi-mt76-mt7996-fix-HE-and-EHT-phy-cap.patch
index b5dd0e5..371bdf0 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0006-wifi-mt76-mt7996-fix-HE-and-EHT-phy-cap.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0005-wifi-mt76-mt7996-fix-HE-and-EHT-phy-cap.patch
@@ -1,7 +1,7 @@
-From a6f5e8e1df21f5d65fcef533b96b9d26680d5bc3 Mon Sep 17 00:00:00 2001
+From 0a8c7ea3be6987390e2567a63659fec93aa3269c Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 12 Mar 2024 09:07:52 +0800
-Subject: [PATCH 006/116] wifi: mt76: mt7996: fix HE and EHT phy cap
+Subject: [PATCH 005/116] wifi: mt76: mt7996: fix HE and EHT phy cap
 
 This commit fix he and eht phy capabailties ie. For HE phy cap, fix
 correct beamform capabilities for station vif. For EHT phy cap, remove
@@ -10,13 +10,12 @@
 Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi7 (802.11be) devices")
 Fixes: 348533eb968d ("wifi: mt76: mt7996: add EHT capability init")
 Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
-
 ---
  mt7996/init.c | 65 ++++++++++++++++++++++++++++++++++-----------------
  1 file changed, 43 insertions(+), 22 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 9aa97e4a7..c264d5043 100644
+index 9aa97e4..c264d50 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -1010,8 +1010,6 @@ mt7996_set_stream_he_txbf_caps(struct mt7996_phy *phy,
@@ -142,5 +141,5 @@
  
  static void
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0007-mtk-wifi-mt76-mt7996-adjust-Beamformee-SS-capability.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0006-mtk-wifi-mt76-mt7996-adjust-Beamformee-SS-capability.patch
similarity index 93%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0007-mtk-wifi-mt76-mt7996-adjust-Beamformee-SS-capability.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0006-mtk-wifi-mt76-mt7996-adjust-Beamformee-SS-capability.patch
index b8fdf57..9b56c52 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0007-mtk-wifi-mt76-mt7996-adjust-Beamformee-SS-capability.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0006-mtk-wifi-mt76-mt7996-adjust-Beamformee-SS-capability.patch
@@ -1,7 +1,7 @@
-From 4dde35f480e8bdf961911d07a49c5443cc0c8e6a Mon Sep 17 00:00:00 2001
+From 346eb89054af1f40dcceec43d128d8775081fd9a Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 27 Feb 2024 14:50:20 +0800
-Subject: [PATCH 007/116] mtk: wifi: mt76: mt7996: adjust Beamformee SS
+Subject: [PATCH 006/116] mtk: wifi: mt76: mt7996: adjust Beamformee SS
  capability
 
 This commit includes two changes to adjust beamformee ss capability.
@@ -15,7 +15,7 @@
  1 file changed, 17 insertions(+), 6 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index c264d5043..ab9445cc3 100644
+index c264d50..ab9445c 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -940,8 +940,12 @@ void mt7996_set_stream_vht_txbf_caps(struct mt7996_phy *phy)
@@ -63,5 +63,5 @@
  		u8_encode_bits(u8_get_bits(val, BIT(0)),
  			       IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK);
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0008-wifi-mt76-mt7992-adjust-beamform-mcu-cmd-configurati.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0007-wifi-mt76-mt7992-adjust-beamform-mcu-cmd-configurati.patch
similarity index 83%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0008-wifi-mt76-mt7992-adjust-beamform-mcu-cmd-configurati.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0007-wifi-mt76-mt7992-adjust-beamform-mcu-cmd-configurati.patch
index c516ea3..6608130 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0008-wifi-mt76-mt7992-adjust-beamform-mcu-cmd-configurati.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0007-wifi-mt76-mt7992-adjust-beamform-mcu-cmd-configurati.patch
@@ -1,7 +1,7 @@
-From 43f21d17de82755344f60fe7a026bc3566a89dfb Mon Sep 17 00:00:00 2001
+From e4f7c4696b0701162b5bef4bf699b13313f9c9f5 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 18 Mar 2024 11:13:56 +0800
-Subject: [PATCH 008/116] wifi: mt76: mt7992: adjust beamform mcu cmd
+Subject: [PATCH 007/116] wifi: mt76: mt7992: adjust beamform mcu cmd
  configuration for mt7992
 
 Adjust the correct beamform mcu cmd configuration for mt7992 chipsets.
@@ -12,7 +12,7 @@
  1 file changed, 3 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index f23801901..7928571e0 100644
+index ceff487..0e5ddf6 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -3920,8 +3920,9 @@ int mt7996_mcu_set_txbf(struct mt7996_dev *dev, u8 action)
@@ -28,5 +28,5 @@
  	}
  	default:
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0009-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0008-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch
similarity index 91%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0009-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0008-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch
index 90c2dd0..8a29fda 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0009-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0008-mtk-wifi-mt76-mt7996-add-preamble-puncture-support-f.patch
@@ -1,7 +1,7 @@
-From e820e86fa2d0b0e0de3c86feb1e0cb4c2ab6e5a2 Mon Sep 17 00:00:00 2001
+From f8092ef14eb9b03588ea29ac1b5a3a023f34c705 Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Thu, 18 Apr 2024 11:16:24 +0800
-Subject: [PATCH 009/116] mtk: wifi: mt76: mt7996: add preamble puncture
+Subject: [PATCH 008/116] mtk: wifi: mt76: mt7996: add preamble puncture
  support for mt7996
 
 Add support configure preamble puncture feature through mcu commands.
@@ -19,10 +19,10 @@
  6 files changed, 61 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 67be14d2a..70def0a3b 100644
+index 915eb3a..1e187a8 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1271,6 +1271,7 @@ enum {
+@@ -1273,6 +1273,7 @@ enum {
  	MCU_UNI_CMD_CHANNEL_SWITCH = 0x34,
  	MCU_UNI_CMD_THERMAL = 0x35,
  	MCU_UNI_CMD_VOW = 0x37,
@@ -31,7 +31,7 @@
  	MCU_UNI_CMD_RRO = 0x57,
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index ab9445cc3..afe8a0a1a 100644
+index ab9445c..afe8a0a 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -387,6 +387,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -43,7 +43,7 @@
  	if (!mdev->dev->of_node ||
  	    !of_property_read_bool(mdev->dev->of_node,
 diff --git a/mt7996/main.c b/mt7996/main.c
-index a65a1efca..2e72fd8ed 100644
+index 40ccfdc..1791335 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -411,6 +411,11 @@ static int mt7996_config(struct ieee80211_hw *hw, u32 changed)
@@ -59,7 +59,7 @@
  		ret = mt7996_set_channel(phy);
  		if (ret)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 7928571e0..36f72d586 100644
+index 0e5ddf6..1f99b2d 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -4550,3 +4550,43 @@ int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode)
@@ -107,7 +107,7 @@
 +				 &req, sizeof(req), false);
 +}
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index a9ba63d14..2052555fe 100644
+index a9ba63d..2052555 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -923,6 +923,16 @@ enum {
@@ -128,7 +128,7 @@
  #define MT7996_PATCH_SCRAMBLE_KEY	GENMASK(15, 8)
  #define MT7996_PATCH_AES_KEY		GENMASK(7, 0)
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 177cfff31..58fa6b458 100644
+index 177cfff..58fa6b4 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -237,6 +237,9 @@ struct mt7996_phy {
@@ -150,5 +150,5 @@
  void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  			    struct ieee80211_sta *sta, struct dentry *dir);
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0010-mtk-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0009-mtk-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv.patch
similarity index 83%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0010-mtk-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0009-mtk-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv.patch
index d46ffbb..93ab989 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0010-mtk-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0009-mtk-wifi-mt76-mt7996-add-driver-support-for-wpa3-ocv.patch
@@ -1,7 +1,7 @@
-From 2a8a93b5c49cb56c5eace22690c7e1544d4e80b1 Mon Sep 17 00:00:00 2001
+From f0e002bc52cfc5fe8d32fe647baef94920d212d6 Mon Sep 17 00:00:00 2001
 From: mtk23510 <rudra.shahi@mediatek.com>
 Date: Fri, 24 Mar 2023 19:18:53 +0800
-Subject: [PATCH 010/116] mtk: wifi: mt76: mt7996: add driver support for wpa3
+Subject: [PATCH 009/116] mtk: wifi: mt76: mt7996: add driver support for wpa3
  ocv and bp mt76
 
 Signed-off-by: mtk23510 <rudra.shahi@mediatek.com>
@@ -10,7 +10,7 @@
  1 file changed, 2 insertions(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index afe8a0a1a..ab2e17ec4 100644
+index afe8a0a..ab2e17e 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -389,6 +389,8 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -23,5 +23,5 @@
  	    !of_property_read_bool(mdev->dev->of_node,
  				   "mediatek,disable-radar-background"))
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0011-mtk-wifi-mt76-mt7996-enable-ser-query.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0010-mtk-wifi-mt76-mt7996-enable-ser-query.patch
similarity index 78%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0011-mtk-wifi-mt76-mt7996-enable-ser-query.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0010-mtk-wifi-mt76-mt7996-enable-ser-query.patch
index b1ae890..1ac9d59 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0011-mtk-wifi-mt76-mt7996-enable-ser-query.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0010-mtk-wifi-mt76-mt7996-enable-ser-query.patch
@@ -1,7 +1,7 @@
-From 87fdddbf88629d4c0bf6dc966107fb70df157a5a Mon Sep 17 00:00:00 2001
+From 55c395dcb6ab95671cc0830e31b71c3aa8fa91c5 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 30 Oct 2023 20:19:41 +0800
-Subject: [PATCH 011/116] mtk: wifi: mt76: mt7996: enable ser query
+Subject: [PATCH 010/116] mtk: wifi: mt76: mt7996: enable ser query
 
 Do not return -EINVAL when action is UNI_CMD_SER_QUERY for user
 to dump SER information from FW.
@@ -12,7 +12,7 @@
  1 file changed, 2 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 36f72d586..10637226c 100644
+index 1f99b2d..9ed8638 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -3865,6 +3865,8 @@ int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 val, u8 band)
@@ -25,5 +25,5 @@
  		req.set.mask = cpu_to_le32(val);
  		break;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0012-mtk-wifi-mt76-mt7996-set-key-flag-IEEE80211_KEY_FLAG.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0011-mtk-wifi-mt76-mt7996-set-key-flag-IEEE80211_KEY_FLAG.patch
similarity index 88%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0012-mtk-wifi-mt76-mt7996-set-key-flag-IEEE80211_KEY_FLAG.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0011-mtk-wifi-mt76-mt7996-set-key-flag-IEEE80211_KEY_FLAG.patch
index c116951..ca8e083 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0012-mtk-wifi-mt76-mt7996-set-key-flag-IEEE80211_KEY_FLAG.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0011-mtk-wifi-mt76-mt7996-set-key-flag-IEEE80211_KEY_FLAG.patch
@@ -1,7 +1,7 @@
-From d33a316c3d868e7ee5b34eac5c8cd0d624b37dc3 Mon Sep 17 00:00:00 2001
+From df056f10532395d83a9bdb199ff609817840dfab Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Thu, 18 Apr 2024 17:21:22 +0800
-Subject: [PATCH 012/116] mtk: wifi: mt76: mt7996: set key flag
+Subject: [PATCH 011/116] mtk: wifi: mt76: mt7996: set key flag
  'IEEE80211_KEY_FLAG_GENERATE_MMIE' for other ciphers
 
 When beacon protection is enabled, FW checks MMIE tag & length in the
@@ -15,7 +15,7 @@
  1 file changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 2e72fd8ed..8b8037f54 100644
+index 1791335..dc8014e 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -360,14 +360,14 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
@@ -38,5 +38,5 @@
  	case WLAN_CIPHER_SUITE_WEP40:
  	case WLAN_CIPHER_SUITE_WEP104:
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0013-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0012-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
similarity index 83%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0013-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0012-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
index 4ae6237..3f105a8 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0013-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0012-mtk-wifi-mt76-mt7996-Fix-TGax-HE-4.51.1_24G-fail.patch
@@ -1,7 +1,7 @@
-From d0bb7153ee8c546e2dc582a77b49c2d7f0f8c7c0 Mon Sep 17 00:00:00 2001
+From 6992fbb2128d9df358760e654a7797b3f89efcb9 Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Fri, 17 Nov 2023 11:01:04 +0800
-Subject: [PATCH 013/116] mtk: wifi: mt76: mt7996: Fix TGax HE-4.51.1_24G fail
+Subject: [PATCH 012/116] mtk: wifi: mt76: mt7996: Fix TGax HE-4.51.1_24G fail
 
 According to sta capability to decide to enable/disable wed pao when create ppe entry.
 without this patch, TGax HE-4.51.1_24G will test fail
@@ -12,7 +12,7 @@
  1 file changed, 6 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 8b8037f54..f553704ce 100644
+index dc8014e..0e8abe7 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1463,7 +1463,12 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
@@ -30,5 +30,5 @@
  
  	return 0;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0014-mtk-wifi-mt76-mt7996-add-support-for-different-varia.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0013-mtk-wifi-mt76-mt7996-add-support-for-different-varia.patch
similarity index 96%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0014-mtk-wifi-mt76-mt7996-add-support-for-different-varia.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0013-mtk-wifi-mt76-mt7996-add-support-for-different-varia.patch
index 13233e0..4f690df 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0014-mtk-wifi-mt76-mt7996-add-support-for-different-varia.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0013-mtk-wifi-mt76-mt7996-add-support-for-different-varia.patch
@@ -1,7 +1,7 @@
-From a4eb2ef1c0960faae461ab4585f4572eda428ed2 Mon Sep 17 00:00:00 2001
+From f269d62b33ba484c31db69d71b9ebcac8e2fc094 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 20 Jul 2023 17:27:22 +0800
-Subject: [PATCH 014/116] mtk: wifi: mt76: mt7996: add support for different
+Subject: [PATCH 013/116] mtk: wifi: mt76: mt7996: add support for different
  variants
 
 Add fem type (2i5i, 2i5e, 2e5e, ...)
@@ -35,7 +35,7 @@
  6 files changed, 155 insertions(+), 6 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 4a8237118..3260d1fef 100644
+index 4a82371..3260d1f 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -9,14 +9,33 @@
@@ -109,7 +109,7 @@
  	if (ret < 0) {
  		if (ret != -EINVAL)
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 412d6e2f8..72c38ad3b 100644
+index 412d6e2..72c38ad 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -29,6 +29,7 @@ enum mt7996_eeprom_field {
@@ -121,7 +121,7 @@
  #define MT_EE_WIFI_CONF1_TX_PATH_BAND0		GENMASK(5, 3)
  #define MT_EE_WIFI_CONF2_TX_PATH_BAND1		GENMASK(2, 0)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index ab2e17ec4..d58335a37 100644
+index ab2e17e..d58335a 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -885,6 +885,65 @@ out:
@@ -202,7 +202,7 @@
  	if (ret)
  		return ret;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 10637226c..9e94e03d8 100644
+index 9ed8638..fb6ee7c 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -14,7 +14,12 @@
@@ -220,7 +220,7 @@
  	case 0x7990:						\
  	default:						\
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 58fa6b458..b7197dcb7 100644
+index 58fa6b4..b7197dc 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -39,8 +39,24 @@
@@ -303,7 +303,7 @@
  int mt7996_run(struct ieee80211_hw *hw);
  int mt7996_mcu_init(struct mt7996_dev *dev);
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 47b429d8b..cf12c5e02 100644
+index 47b429d..cf12c5e 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -662,6 +662,13 @@ enum offs_rev {
@@ -321,5 +321,5 @@
  #define MT_HW_REV				0x70010204
  #define MT_HW_REV1				0x8a00
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0015-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0014-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch
similarity index 86%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0015-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0014-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch
index ecb5d29..6bcf893 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0015-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0014-mtk-wifi-mt76-mt7996-ACS-channel-time-too-long-on-du.patch
@@ -1,7 +1,7 @@
-From 615fa2bf42b12776d01445f009f766d3c35dabf7 Mon Sep 17 00:00:00 2001
+From d2d45d00e7644e62f366203a17924f0e2025853a Mon Sep 17 00:00:00 2001
 From: "fancy.liu" <fancy.liu@mediatek.com>
 Date: Tue, 14 Nov 2023 10:13:24 +0800
-Subject: [PATCH 015/116] mtk: wifi: mt76: mt7996: ACS channel time too long on
+Subject: [PATCH 014/116] mtk: wifi: mt76: mt7996: ACS channel time too long on
  duty channel
 
 Step and issue:
@@ -43,10 +43,10 @@
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 64307b967..993e155b9 100644
+index e4675bf..d291caa 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -927,6 +927,7 @@ void mt76_set_channel(struct mt76_phy *phy)
+@@ -928,6 +928,7 @@ void mt76_set_channel(struct mt76_phy *phy)
  	struct cfg80211_chan_def *chandef = &hw->conf.chandef;
  	bool offchannel = hw->conf.flags & IEEE80211_CONF_OFFCHANNEL;
  	int timeout = HZ / 5;
@@ -54,7 +54,7 @@
  
  	wait_event_timeout(dev->tx_wait, !mt76_has_tx_pending(phy), timeout);
  	mt76_update_survey(phy);
-@@ -941,7 +942,7 @@ void mt76_set_channel(struct mt76_phy *phy)
+@@ -942,7 +943,7 @@ void mt76_set_channel(struct mt76_phy *phy)
  	if (!offchannel)
  		phy->main_chan = chandef->chan;
  
@@ -64,5 +64,5 @@
  }
  EXPORT_SYMBOL_GPL(mt76_set_channel);
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0016-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0015-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch
similarity index 87%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0016-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0015-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch
index 1d9046b..a029391 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0016-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0015-mtk-wifi-mt76-mt7996-Fixed-null-pointer-dereference-.patch
@@ -1,7 +1,7 @@
-From 8cb027bb01c80130b08a9a6a5b4a0fe49a42995e Mon Sep 17 00:00:00 2001
+From c8d653d2b80ec1d58e9efd947196ee9d0fbf871b Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Thu, 26 Oct 2023 10:08:10 +0800
-Subject: [PATCH 016/116] mtk: wifi: mt76: mt7996: Fixed null pointer
+Subject: [PATCH 015/116] mtk: wifi: mt76: mt7996: Fixed null pointer
  dereference issue
 
 Without this patch, when the station is still in Authentication stage and
@@ -17,7 +17,7 @@
  1 file changed, 7 insertions(+)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index f553704ce..4fc1dd9a9 100644
+index 0e8abe7..e66c607 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1079,9 +1079,16 @@ static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
@@ -38,5 +38,5 @@
  	ieee80211_queue_work(hw, &dev->rc_work);
  }
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0017-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0016-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch
similarity index 83%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0017-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0016-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch
index 732937a..ebca1e8 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0017-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0016-mtk-wifi-mt76-add-sanity-check-to-prevent-kernel-cra.patch
@@ -1,7 +1,7 @@
-From 49a1a916113cf23ad38ef6e3f3cfd0279f7abea4 Mon Sep 17 00:00:00 2001
+From cfac6751faf2d57e1d02c44984f220b770ac6cf3 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 30 Oct 2023 11:06:19 +0800
-Subject: [PATCH 017/116] mtk: wifi: mt76: add sanity check to prevent kernel
+Subject: [PATCH 016/116] mtk: wifi: mt76: add sanity check to prevent kernel
  crash
 
 wcid may not be initialized when mac80211 calls mt76.tx and it would lead to
@@ -13,7 +13,7 @@
  1 file changed, 8 insertions(+)
 
 diff --git a/tx.c b/tx.c
-index 5cf6edee4..ab42f69b8 100644
+index 5cf6ede..ab42f69 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -345,6 +345,14 @@ mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
@@ -32,5 +32,5 @@
  	__skb_queue_tail(&wcid->tx_pending, skb);
  	spin_unlock_bh(&wcid->tx_pending.lock);
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0018-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0017-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch
similarity index 98%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0018-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0017-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch
index feecebe..7ab6d8f 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0018-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0017-mtk-wifi-mt76-mt7996-add-firmware-WA-s-coredump.patch
@@ -1,7 +1,7 @@
-From 88fd1708523b4d5a2f8c821f6aa768b2f2a6a033 Mon Sep 17 00:00:00 2001
+From 06ea431d801676bc203ee274503cdb876abcf73c Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Fri, 19 May 2023 14:16:50 +0800
-Subject: [PATCH 018/116] mtk: wifi: mt76: mt7996: add firmware WA's coredump.
+Subject: [PATCH 017/116] mtk: wifi: mt76: mt7996: add firmware WA's coredump.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
@@ -14,7 +14,7 @@
  6 files changed, 182 insertions(+), 83 deletions(-)
 
 diff --git a/mt7996/coredump.c b/mt7996/coredump.c
-index ccab0d7b9..60b88085c 100644
+index ccab0d7..60b8808 100644
 --- a/mt7996/coredump.c
 +++ b/mt7996/coredump.c
 @@ -7,11 +7,11 @@
@@ -335,7 +335,7 @@
  }
  
 diff --git a/mt7996/coredump.h b/mt7996/coredump.h
-index af2ba219b..01ed3731c 100644
+index af2ba21..01ed373 100644
 --- a/mt7996/coredump.h
 +++ b/mt7996/coredump.h
 @@ -6,10 +6,13 @@
@@ -428,7 +428,7 @@
  	return NULL;
  }
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 3afdd7eb9..d88bbfb24 100644
+index 3afdd7e..d88bbfb 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -1998,28 +1998,25 @@ void mt7996_mac_reset_work(struct work_struct *work)
@@ -506,7 +506,7 @@
  }
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 9e94e03d8..0656b4a51 100644
+index fb6ee7c..f4bbb78 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -2704,6 +2704,8 @@ static int mt7996_load_patch(struct mt7996_dev *dev)
@@ -529,7 +529,7 @@
  		 fw_type, hdr->fw_ver, hdr->build_date);
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index b7197dcb7..e12ad318d 100644
+index b7197dc..e12ad31 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -84,6 +84,8 @@
@@ -563,7 +563,7 @@
  	struct list_head sta_rc_list;
  	struct list_head twt_list;
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index cf12c5e02..4c20a67d7 100644
+index cf12c5e..4c20a67 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -597,7 +597,8 @@ enum offs_rev {
@@ -593,5 +593,5 @@
  
  /* CONN AFE CTL CON */
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0019-mtk-wifi-mt76-mt7996-for-build-pass.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0018-mtk-wifi-mt76-mt7996-for-build-pass.patch
similarity index 87%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0019-mtk-wifi-mt76-mt7996-for-build-pass.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0018-mtk-wifi-mt76-mt7996-for-build-pass.patch
index 101893a..001f887 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0019-mtk-wifi-mt76-mt7996-for-build-pass.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0018-mtk-wifi-mt76-mt7996-for-build-pass.patch
@@ -1,7 +1,7 @@
-From db4bbc138ecda8790cc3e6b0d513278ff900a4cc Mon Sep 17 00:00:00 2001
+From e3182cb0870f1d702a01deecdf62493832ab4fd9 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 3 Nov 2022 00:27:17 +0800
-Subject: [PATCH 019/116] mtk: wifi: mt76: mt7996: for build pass
+Subject: [PATCH 018/116] mtk: wifi: mt76: mt7996: for build pass
 
 ---
  debugfs.c         | 3 +++
@@ -16,7 +16,7 @@
  9 files changed, 12 insertions(+), 3 deletions(-)
 
 diff --git a/debugfs.c b/debugfs.c
-index c4649ba04..ac5207e5e 100644
+index c4649ba..ac5207e 100644
 --- a/debugfs.c
 +++ b/debugfs.c
 @@ -33,8 +33,11 @@ mt76_napi_threaded_set(void *data, u64 val)
@@ -32,7 +32,7 @@
  	return 0;
  }
 diff --git a/dma.c b/dma.c
-index f4f88c444..560446395 100644
+index f4f88c4..5604463 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -883,7 +883,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
@@ -45,7 +45,7 @@
  			goto free_frag;
  
 diff --git a/mcu.c b/mcu.c
-index a8cafa39a..fa4b05441 100644
+index a8cafa3..fa4b054 100644
 --- a/mcu.c
 +++ b/mcu.c
 @@ -4,6 +4,7 @@
@@ -57,7 +57,7 @@
  struct sk_buff *
  __mt76_mcu_msg_alloc(struct mt76_dev *dev, const void *data,
 diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index c807bd8d9..a9310660b 100644
+index c807bd8..a931066 100644
 --- a/mt7615/mcu.c
 +++ b/mt7615/mcu.c
 @@ -10,6 +10,7 @@
@@ -69,7 +69,7 @@
  static bool prefer_offload_fw = true;
  module_param(prefer_offload_fw, bool, 0644);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index b35acf86e..1e34e0ae3 100644
+index b35acf8..1e34e0a 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -4,6 +4,7 @@
@@ -81,7 +81,7 @@
  int mt76_connac_mcu_start_firmware(struct mt76_dev *dev, u32 addr, u32 option)
  {
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 24daa0835..2d017396c 100644
+index fc194e0..363ea0e 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -6,6 +6,7 @@
@@ -93,7 +93,7 @@
  #define fw_name(_dev, name, ...)	({			\
  	char *_fw;						\
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index 73e633d0d..759a58e8e 100644
+index 73e633d..759a58e 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
 @@ -641,8 +641,8 @@ int mt7996_dma_init(struct mt7996_dev *dev)
@@ -108,7 +108,7 @@
  
  	mt7996_dma_enable(dev, false);
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 3260d1fef..121a3c958 100644
+index 3260d1f..121a3c9 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -138,6 +138,7 @@ static int mt7996_eeprom_parse_efuse_hw_cap(struct mt7996_dev *dev)
@@ -120,7 +120,7 @@
  		dev->has_eht = !(cap & MODE_HE_ONLY);
  		dev->wtbl_size_group = u32_get_bits(cap, WTBL_SIZE_GROUP);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 0656b4a51..57cfa1494 100644
+index f4bbb78..90332fe 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -5,6 +5,7 @@
@@ -132,5 +132,5 @@
  #include "mcu.h"
  #include "mac.h"
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0020-mtk-wifi-mt76-mt7996-add-debug-tool.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0019-mtk-wifi-mt76-mt7996-add-debug-tool.patch
similarity index 99%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0020-mtk-wifi-mt76-mt7996-add-debug-tool.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0019-mtk-wifi-mt76-mt7996-add-debug-tool.patch
index 90bd7b1..e6aae93 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0020-mtk-wifi-mt76-mt7996-add-debug-tool.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0019-mtk-wifi-mt76-mt7996-add-debug-tool.patch
@@ -1,7 +1,7 @@
-From 6b19a7a6cfa1095afbf622419d085c54e11d05b3 Mon Sep 17 00:00:00 2001
+From fe15bfb3335bcbdf95fed1563646d84154607b42 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 24 Mar 2023 14:02:32 +0800
-Subject: [PATCH 020/116] mtk: wifi: mt76: mt7996: add debug tool
+Subject: [PATCH 019/116] mtk: wifi: mt76: mt7996: add debug tool
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 
@@ -83,7 +83,7 @@
  create mode 100644 mt7996/mtk_mcu.h
 
 diff --git a/mt76.h b/mt76.h
-index 2cbea731e..599787db2 100644
+index 7f3ec40..b421a98 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -399,6 +399,8 @@ struct mt76_txwi_cache {
@@ -96,7 +96,7 @@
  
  struct mt76_rx_tid {
 diff --git a/mt7996/Makefile b/mt7996/Makefile
-index 07c8b555c..a056b40e0 100644
+index 07c8b55..a056b40 100644
 --- a/mt7996/Makefile
 +++ b/mt7996/Makefile
 @@ -1,4 +1,6 @@
@@ -113,7 +113,7 @@
 +
 +mt7996e-y += mtk_debugfs.o mtk_mcu.o
 diff --git a/mt7996/coredump.c b/mt7996/coredump.c
-index 60b88085c..a7f91b56d 100644
+index 60b8808..a7f91b5 100644
 --- a/mt7996/coredump.c
 +++ b/mt7996/coredump.c
 @@ -195,7 +195,7 @@ mt7996_coredump_fw_stack(struct mt7996_dev *dev, u8 type, struct mt7996_coredump
@@ -162,7 +162,7 @@
  		dev_warn(dev->mt76.dev, "no crash dump data found\n");
  		return -ENODATA;
 diff --git a/mt7996/coredump.h b/mt7996/coredump.h
-index 01ed3731c..93cd84a03 100644
+index 01ed373..93cd84a 100644
 --- a/mt7996/coredump.h
 +++ b/mt7996/coredump.h
 @@ -75,6 +75,7 @@ struct mt7996_mem_region {
@@ -187,7 +187,7 @@
  mt7996_crash_data *mt7996_coredump_new(struct mt7996_dev *dev, u8 type)
  {
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 62c03d088..344c759c0 100644
+index 62c03d0..344c759 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -295,11 +295,39 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
@@ -398,7 +398,7 @@
  	hdr.timestamp = cpu_to_le32(mt76_rr(dev, MT_LPON_FRCR(0)));
  	hdr.len = *(__le16 *)data;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index d88bbfb24..1f53d2303 100644
+index d88bbfb..1f53d23 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -936,6 +936,9 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -412,7 +412,7 @@
  	pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb);
  	memset(txwi_ptr, 0, MT_TXD_SIZE);
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index e12ad318d..696e16fa1 100644
+index e12ad31..696e16f 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -362,6 +362,7 @@ struct mt7996_dev {
@@ -451,7 +451,7 @@
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mtk_debug.h b/mt7996/mtk_debug.h
 new file mode 100644
-index 000000000..27d8f1cb2
+index 0000000..27d8f1c
 --- /dev/null
 +++ b/mt7996/mtk_debug.h
 @@ -0,0 +1,2286 @@
@@ -2743,7 +2743,7 @@
 +#endif
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
 new file mode 100644
-index 000000000..8baf27c76
+index 0000000..d79e00c
 --- /dev/null
 +++ b/mt7996/mtk_debugfs.c
 @@ -0,0 +1,2507 @@
@@ -3095,7 +3095,7 @@
 +		[MT7996_FEM_MIX] = "mixed FEM",
 +	};
 +
-+	seq_printf(s, "Version: 4.3.24.3\n");
++	seq_printf(s, "Version: 4.3.24.5\n");
 +
 +	if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
 +		return 0;
@@ -5256,7 +5256,7 @@
 +#endif
 diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
 new file mode 100644
-index 000000000..c16b25ab5
+index 0000000..c16b25a
 --- /dev/null
 +++ b/mt7996/mtk_mcu.c
 @@ -0,0 +1,39 @@
@@ -5301,7 +5301,7 @@
 +#endif
 diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
 new file mode 100644
-index 000000000..7f4d4e029
+index 0000000..7f4d4e0
 --- /dev/null
 +++ b/mt7996/mtk_mcu.h
 @@ -0,0 +1,19 @@
@@ -5325,7 +5325,7 @@
 +
 +#endif
 diff --git a/tools/fwlog.c b/tools/fwlog.c
-index e5d4a1051..3c6a61d71 100644
+index e5d4a10..3c6a61d 100644
 --- a/tools/fwlog.c
 +++ b/tools/fwlog.c
 @@ -26,7 +26,7 @@ static const char *debugfs_path(const char *phyname, const char *file)
@@ -5409,5 +5409,5 @@
  	return ret;
  }
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0021-mtk-wifi-mt76-mt7996-add-check-for-hostapd-config-he.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0020-mtk-wifi-mt76-mt7996-add-check-for-hostapd-config-he.patch
similarity index 92%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0021-mtk-wifi-mt76-mt7996-add-check-for-hostapd-config-he.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0020-mtk-wifi-mt76-mt7996-add-check-for-hostapd-config-he.patch
index 7b80a5d..f02a3eb 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0021-mtk-wifi-mt76-mt7996-add-check-for-hostapd-config-he.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0020-mtk-wifi-mt76-mt7996-add-check-for-hostapd-config-he.patch
@@ -1,7 +1,7 @@
-From 8acf6c19fc99fc2183e62fd04b1c7b7c6ae82d3a Mon Sep 17 00:00:00 2001
+From 4974096ee9b3e3a6083da610ce13dde3b82608c9 Mon Sep 17 00:00:00 2001
 From: "Allen.Ye" <allen.ye@mediatek.com>
 Date: Thu, 8 Jun 2023 17:32:33 +0800
-Subject: [PATCH 021/116] mtk: wifi: mt76: mt7996: add check for hostapd config
+Subject: [PATCH 020/116] mtk: wifi: mt76: mt7996: add check for hostapd config
  he_ldpc
 
 Add check for hostapd config he_ldpc.
@@ -15,7 +15,7 @@
  1 file changed, 9 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 57cfa1494..bad370839 100644
+index 90332fe..6c565c9 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -1188,7 +1188,8 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
@@ -59,5 +59,5 @@
  		mt7996_mcu_sta_he_6g_tlv(skb, sta);
  		/* starec eht */
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0022-mtk-wifi-mt76-testmode-add-basic-testmode-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0021-mtk-wifi-mt76-testmode-add-basic-testmode-support.patch
similarity index 98%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0022-mtk-wifi-mt76-testmode-add-basic-testmode-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0021-mtk-wifi-mt76-testmode-add-basic-testmode-support.patch
index 21a18ea..19ea968 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0022-mtk-wifi-mt76-testmode-add-basic-testmode-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0021-mtk-wifi-mt76-testmode-add-basic-testmode-support.patch
@@ -1,7 +1,7 @@
-From 02ec22e1dac31435e5d5defea0b50778061da97e Mon Sep 17 00:00:00 2001
+From 501b857b081c10d3400c8b4374db346b238d3f72 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 28 Dec 2022 22:24:25 +0800
-Subject: [PATCH 022/116] mtk: wifi: mt76: testmode: add basic testmode support
+Subject: [PATCH 021/116] mtk: wifi: mt76: testmode: add basic testmode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 
@@ -45,7 +45,7 @@
  create mode 100644 mt7996/testmode.h
 
 diff --git a/eeprom.c b/eeprom.c
-index 0bc66cc19..a0047d791 100644
+index 0bc66cc..a0047d7 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -94,8 +94,10 @@ int mt76_get_of_data_from_mtd(struct mt76_dev *dev, void *eep, int offset, int l
@@ -62,10 +62,10 @@
  
  out_put_node:
 diff --git a/mac80211.c b/mac80211.c
-index 993e155b9..b285407a8 100644
+index d291caa..9a1eb47 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -845,7 +845,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
+@@ -846,7 +846,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
  	}
  
  #ifdef CONFIG_NL80211_TESTMODE
@@ -76,7 +76,7 @@
  		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
  			phy->test.rx_stats.fcs_error[q]++;
 diff --git a/mt76.h b/mt76.h
-index 599787db2..58e8e726c 100644
+index b421a98..57b75fa 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -700,14 +700,21 @@ struct mt76_testmode_ops {
@@ -160,10 +160,10 @@
  {
  #ifdef CONFIG_NL80211_TESTMODE
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 70def0a3b..718552baf 100644
+index 1e187a8..0b9c6c5 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1267,12 +1267,14 @@ enum {
+@@ -1269,12 +1269,14 @@ enum {
  	MCU_UNI_CMD_EFUSE_CTRL = 0x2d,
  	MCU_UNI_CMD_RA = 0x2f,
  	MCU_UNI_CMD_MURU = 0x31,
@@ -179,7 +179,7 @@
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
  	MCU_UNI_CMD_PER_STA_INFO = 0x6d,
 diff --git a/mt7996/Makefile b/mt7996/Makefile
-index a056b40e0..7bb17f440 100644
+index a056b40..7bb17f4 100644
 --- a/mt7996/Makefile
 +++ b/mt7996/Makefile
 @@ -8,5 +8,6 @@ mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \
@@ -190,7 +190,7 @@
  
  mt7996e-y += mtk_debugfs.o mtk_mcu.o
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 121a3c958..f9b9ca25d 100644
+index 121a3c9..f9b9ca2 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -6,6 +6,11 @@
@@ -269,7 +269,7 @@
  		}
  	}
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 72c38ad3b..de3ff4e27 100644
+index 72c38ad..de3ff4e 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -14,6 +14,7 @@ enum mt7996_eeprom_field {
@@ -281,7 +281,7 @@
  	MT_EE_RATE_DELTA_2G =	0x1400,
  	MT_EE_RATE_DELTA_5G =	0x147d,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index d58335a37..440e26d58 100644
+index d58335a..440e26d 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -969,6 +969,10 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
@@ -307,7 +307,7 @@
  				   ARRAY_SIZE(mt76_rates));
  	if (ret)
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 1f53d2303..603f6c0d7 100644
+index 1f53d23..603f6c0 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -685,7 +685,8 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
@@ -321,7 +321,7 @@
  
  	if (!status->wcid || !ieee80211_is_data_qos(fc) || hw_aggr)
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 4fc1dd9a9..48cc87e07 100644
+index e66c607..50c7f07 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -23,6 +23,18 @@ static bool mt7996_dev_running(struct mt7996_dev *dev)
@@ -387,7 +387,7 @@
  	.sta_add_debugfs = mt7996_sta_add_debugfs,
  #endif
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index bad370839..f09281430 100644
+index 6c565c9..2bca86a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -2865,8 +2865,12 @@ static int mt7996_load_ram(struct mt7996_dev *dev)
@@ -483,7 +483,7 @@
 +				 &req, sizeof(req), false);
 +}
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 2052555fe..d5ac2b38e 100644
+index 2052555..d5ac2b3 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -157,6 +157,16 @@ struct mt7996_mcu_eeprom {
@@ -536,7 +536,7 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 696e16fa1..0c6a4b96b 100644
+index 696e16f..0c6a4b9 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -32,25 +32,30 @@
@@ -644,7 +644,7 @@
  {
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
 new file mode 100644
-index 000000000..98eebceed
+index 0000000..98eebce
 --- /dev/null
 +++ b/mt7996/testmode.c
 @@ -0,0 +1,740 @@
@@ -1390,7 +1390,7 @@
 +};
 diff --git a/mt7996/testmode.h b/mt7996/testmode.h
 new file mode 100644
-index 000000000..319ef257a
+index 0000000..319ef25
 --- /dev/null
 +++ b/mt7996/testmode.h
 @@ -0,0 +1,299 @@
@@ -1694,7 +1694,7 @@
 +
 +#endif
 diff --git a/testmode.c b/testmode.c
-index ca4feccf3..44f3a5bfc 100644
+index ca4fecc..44f3a5b 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -2,11 +2,13 @@
@@ -1961,7 +1961,7 @@
  
  	if (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_POWER)) {
 diff --git a/testmode.h b/testmode.h
-index 5e2792d81..96872e8cd 100644
+index 5e2792d..96872e8 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -5,7 +5,8 @@
@@ -2151,7 +2151,7 @@
  
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
-index e3f690896..055f90f3c 100644
+index e3f6908..055f90f 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -10,6 +10,7 @@ static const char * const testmode_state[] = {
@@ -2366,5 +2366,5 @@
  
  const struct tm_field msg_field = {
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0023-mtk-wifi-mt76-testmode-add-testmode-pre-calibration-.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0022-mtk-wifi-mt76-testmode-add-testmode-pre-calibration-.patch
similarity index 97%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0023-mtk-wifi-mt76-testmode-add-testmode-pre-calibration-.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0022-mtk-wifi-mt76-testmode-add-testmode-pre-calibration-.patch
index 4c519cf..27a6593 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0023-mtk-wifi-mt76-testmode-add-testmode-pre-calibration-.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0022-mtk-wifi-mt76-testmode-add-testmode-pre-calibration-.patch
@@ -1,7 +1,7 @@
-From d0914a4cc7a181e2a2c8c1295a99f2812525e31c Mon Sep 17 00:00:00 2001
+From 19f055d29f67eb3ace29ccb6400a6bd59da8af7e Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 31 Mar 2023 11:27:24 +0800
-Subject: [PATCH 023/116] mtk: wifi: mt76: testmode: add testmode
+Subject: [PATCH 022/116] mtk: wifi: mt76: testmode: add testmode
  pre-calibration support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -21,7 +21,7 @@
  12 files changed, 632 insertions(+), 23 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index b285407a8..1127ef7b5 100644
+index 9a1eb47..e2ff011 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -6,27 +6,6 @@
@@ -53,7 +53,7 @@
  	CHAN2G(1, 2412),
  	CHAN2G(2, 2417),
 diff --git a/mt76.h b/mt76.h
-index 58e8e726c..97a691991 100644
+index 57b75fa..c591f67 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -23,6 +23,27 @@
@@ -93,10 +93,10 @@
  
  #define MT_TM_FW_RX_COUNT	BIT(0)
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 718552baf..f5ea719e4 100644
+index 0b9c6c5..1919325 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1042,8 +1042,10 @@ enum {
+@@ -1043,8 +1043,10 @@ enum {
  	MCU_UNI_EVENT_RDD_REPORT = 0x11,
  	MCU_UNI_EVENT_ROC = 0x27,
  	MCU_UNI_EVENT_TX_DONE = 0x2d,
@@ -108,7 +108,7 @@
  	MCU_UNI_EVENT_PER_STA_INFO = 0x6d,
  	MCU_UNI_EVENT_ALL_STA_INFO = 0x6e,
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index f9b9ca25d..62c1ad489 100644
+index f9b9ca2..62c1ad4 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -12,6 +12,42 @@ static bool testmode_enable;
@@ -192,7 +192,7 @@
  mt7996_eeprom_load_default(struct mt7996_dev *dev)
  {
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index de3ff4e27..849b8bcab 100644
+index de3ff4e..849b8bc 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -14,6 +14,7 @@ enum mt7996_eeprom_field {
@@ -257,7 +257,7 @@
  #define MT_EE_WIFI_CONF2_TX_PATH_BAND1		GENMASK(2, 0)
  #define MT_EE_WIFI_CONF2_TX_PATH_BAND2		GENMASK(5, 3)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index f09281430..82528f7b2 100644
+index 2bca86a..1d4f421 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -715,6 +715,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
@@ -273,7 +273,7 @@
  		break;
  	}
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 0c6a4b96b..121c4a1a7 100644
+index 0c6a4b9..121c4a1 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -390,6 +390,9 @@ struct mt7996_dev {
@@ -305,7 +305,7 @@
  static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
  {
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 98eebceed..a756ee10d 100644
+index 98eebce..a756ee1 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
 @@ -7,6 +7,8 @@
@@ -772,7 +772,7 @@
 +	.dump_precal = mt7996_tm_dump_precal,
  };
 diff --git a/mt7996/testmode.h b/mt7996/testmode.h
-index 319ef257a..9bfb86f28 100644
+index 319ef25..9bfb86f 100644
 --- a/mt7996/testmode.h
 +++ b/mt7996/testmode.h
 @@ -34,6 +34,12 @@ enum bw_mapping_method {
@@ -834,7 +834,7 @@
  	RF_OPER_NORMAL,
  	RF_OPER_RF_TEST,
 diff --git a/testmode.c b/testmode.c
-index 44f3a5bfc..cd8cb6553 100644
+index 44f3a5b..cd8cb65 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -674,6 +674,18 @@ int mt76_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *msg,
@@ -857,7 +857,7 @@
  		err = -EINVAL;
  
 diff --git a/testmode.h b/testmode.h
-index 96872e8cd..d6601cdcf 100644
+index 96872e8..d6601cd 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -220,6 +220,14 @@ enum mt76_testmode_state {
@@ -876,7 +876,7 @@
  
  	/* keep last */
 diff --git a/tools/fields.c b/tools/fields.c
-index 055f90f3c..b01227638 100644
+index 055f90f..b012276 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -11,6 +11,14 @@ static const char * const testmode_state[] = {
@@ -895,5 +895,5 @@
  
  static const char * const testmode_tx_mode[] = {
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0024-mtk-wifi-mt76-mt7996-add-normal-mode-pre-calibration.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0023-mtk-wifi-mt76-mt7996-add-normal-mode-pre-calibration.patch
similarity index 95%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0024-mtk-wifi-mt76-mt7996-add-normal-mode-pre-calibration.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0023-mtk-wifi-mt76-mt7996-add-normal-mode-pre-calibration.patch
index 740ee4a..7c11685 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0024-mtk-wifi-mt76-mt7996-add-normal-mode-pre-calibration.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0023-mtk-wifi-mt76-mt7996-add-normal-mode-pre-calibration.patch
@@ -1,7 +1,7 @@
-From 9b77eae5dca30ef64dea0b2a48c05b22a6a8bc25 Mon Sep 17 00:00:00 2001
+From 51626ab22252946790a178fd0751bd7616fc2d99 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 1 Mar 2023 12:12:51 +0800
-Subject: [PATCH 024/116] mtk: wifi: mt76: mt7996: add normal mode
+Subject: [PATCH 023/116] mtk: wifi: mt76: mt7996: add normal mode
  pre-calibration support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -16,10 +16,10 @@
  7 files changed, 188 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f5ea719e4..c785edb80 100644
+index 1919325..8202ebb 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1277,6 +1277,7 @@ enum {
+@@ -1279,6 +1279,7 @@ enum {
  	MCU_UNI_CMD_PP = 0x38,
  	MCU_UNI_CMD_FIXED_RATE_TABLE = 0x40,
  	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
@@ -28,7 +28,7 @@
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
  	MCU_UNI_CMD_PER_STA_INFO = 0x6d,
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 62c1ad489..4afa2a295 100644
+index 62c1ad4..4afa2a2 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -356,6 +356,10 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
@@ -43,7 +43,7 @@
  	if (ret < 0)
  		return ret;
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 849b8bcab..58179c0c5 100644
+index 849b8bc..58179c0 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -25,6 +25,8 @@ enum mt7996_eeprom_field {
@@ -56,7 +56,7 @@
  
  #define MT_EE_WIFI_CONF0_TX_PATH		GENMASK(2, 0)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 440e26d58..201daf110 100644
+index 440e26d..201daf1 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -985,6 +985,12 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
@@ -73,7 +73,7 @@
  	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7996_WTBL_STA);
  	if (idx)
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 48cc87e07..479940095 100644
+index 50c7f07..89d5a17 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -317,6 +317,12 @@ int mt7996_set_channel(struct mt7996_phy *phy)
@@ -90,7 +90,7 @@
  		mt7996_tm_update_channel(phy);
  		goto out;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 82528f7b2..a006b0e34 100644
+index 1d4f421..f02d33c 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -3631,6 +3631,172 @@ int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num)
@@ -267,7 +267,7 @@
  {
  #define NIC_CAP	3
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 121c4a1a7..5e2d8bef0 100644
+index 121c4a1..5e2d8be 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -598,6 +598,9 @@ void mt7996_mcu_exit(struct mt7996_dev *dev);
@@ -281,5 +281,5 @@
  void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb);
  #endif
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0025-mtk-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-d.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0024-mtk-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-d.patch
similarity index 94%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0025-mtk-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-d.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0024-mtk-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-d.patch
index 8e37799..d318959 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0025-mtk-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-d.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0024-mtk-wifi-mt76-mt7996-enable-SCS-feature-for-mt7996-d.patch
@@ -1,7 +1,7 @@
-From d5f1a204501372080b078364e41762992e81eec6 Mon Sep 17 00:00:00 2001
+From db1c305572e6eba5df01d52472e027cb9ef745c6 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 8 May 2023 09:03:50 +0800
-Subject: [PATCH 025/116] mtk: wifi: mt76: mt7996: enable SCS feature for
+Subject: [PATCH 024/116] mtk: wifi: mt76: mt7996: enable SCS feature for
  mt7996 driver
 
 Enable Smart Carrier Sense algorithn by default to improve performance
@@ -20,10 +20,10 @@
  8 files changed, 148 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index c785edb80..d8830dc25 100644
+index 8202ebb..49c5ba3 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1262,6 +1262,7 @@ enum {
+@@ -1264,6 +1264,7 @@ enum {
  	MCU_UNI_CMD_GET_STAT_INFO = 0x23,
  	MCU_UNI_CMD_SNIFFER = 0x24,
  	MCU_UNI_CMD_SR = 0x25,
@@ -32,7 +32,7 @@
  	MCU_UNI_CMD_SET_DBDC_PARMS = 0x28,
  	MCU_UNI_CMD_TXPOWER = 0x2b,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 201daf110..6a394c364 100644
+index 201daf1..6a394c3 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -1415,6 +1415,7 @@ int mt7996_register_device(struct mt7996_dev *dev)
@@ -44,7 +44,7 @@
  	INIT_LIST_HEAD(&dev->twt_list);
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 603f6c0d7..c9f45abef 100644
+index 603f6c0..c9f45ab 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -1795,6 +1795,7 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
@@ -64,7 +64,7 @@
  
  void mt7996_mac_reset_work(struct work_struct *work)
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 479940095..57865f1de 100644
+index 89d5a17..eb213f8 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -81,11 +81,17 @@ int mt7996_run(struct ieee80211_hw *hw)
@@ -94,7 +94,7 @@
  	mutex_lock(&dev->mt76.mutex);
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index a006b0e34..2650dc6ff 100644
+index f02d33c..16a01b1 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -4813,3 +4813,108 @@ int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 da
@@ -207,7 +207,7 @@
 +				 &req, sizeof(req), false);
 +}
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index d5ac2b38e..5953b25e8 100644
+index d5ac2b3..5953b25 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -966,6 +966,12 @@ enum pp_mode {
@@ -224,7 +224,7 @@
  #define MT7996_PATCH_SCRAMBLE_KEY	GENMASK(15, 8)
  #define MT7996_PATCH_AES_KEY		GENMASK(7, 0)
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 5e2d8bef0..186af3c1d 100644
+index 5e2d8be..186af3c 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -234,6 +234,16 @@ struct mt7996_hif {
@@ -271,7 +271,7 @@
  static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
  {
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 8baf27c76..9b4d5f68c 100644
+index d79e00c..24b331e 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2430,6 +2430,16 @@ static int mt7996_token_read(struct seq_file *s, void *data)
@@ -300,5 +300,5 @@
  	return 0;
  }
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0026-mtk-wifi-mt76-mt7996-add-txpower-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0025-mtk-wifi-mt76-mt7996-add-txpower-support.patch
similarity index 98%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0026-mtk-wifi-mt76-mt7996-add-txpower-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0025-mtk-wifi-mt76-mt7996-add-txpower-support.patch
index 22228e5..eb2c6e8 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0026-mtk-wifi-mt76-mt7996-add-txpower-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0025-mtk-wifi-mt76-mt7996-add-txpower-support.patch
@@ -1,7 +1,7 @@
-From c3e9680c5a1387067019b361390df5a150eb232b Mon Sep 17 00:00:00 2001
+From 186a919f2ff018e53c1e1bc9e015b409525e7273 Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Fri, 24 Mar 2023 23:35:30 +0800
-Subject: [PATCH 026/116] mtk: wifi: mt76: mt7996: add txpower support
+Subject: [PATCH 025/116] mtk: wifi: mt76: mt7996: add txpower support
 
 Add single sku and default enable sku.
 
@@ -35,7 +35,7 @@
  14 files changed, 724 insertions(+), 27 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index a0047d791..11efe2937 100644
+index a0047d7..11efe29 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -305,9 +305,10 @@ mt76_apply_array_limit(s8 *pwr, size_t pwr_len, const __be32 *data,
@@ -140,7 +140,7 @@
  	return max_power;
  }
 diff --git a/mt76.h b/mt76.h
-index 97a691991..20fdd050a 100644
+index c591f67..c372e78 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -1059,6 +1059,14 @@ struct mt76_power_limits {
@@ -167,7 +167,7 @@
  
  static inline bool mt76_queue_is_wed_tx_free(struct mt76_queue *q)
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 1e34e0ae3..0c7b69352 100644
+index 1e34e0a..0c7b693 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -2150,7 +2150,7 @@ mt76_connac_mcu_rate_txpower_band(struct mt76_phy *phy,
@@ -180,7 +180,7 @@
  			tx_power_tlv.last_msg = ch_list[idx] == last_ch;
  			sku_tlbv.channel = ch_list[idx];
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 4afa2a295..6ac992a81 100644
+index 4afa2a2..6ac992a 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -408,3 +408,37 @@ s8 mt7996_eeprom_get_power_delta(struct mt7996_dev *dev, int band)
@@ -222,7 +222,7 @@
 +	[SKU_EHT3x996_484] = 16,
 +};
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 58179c0c5..b19ff068e 100644
+index 58179c0..b19ff06 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -125,4 +125,46 @@ mt7996_get_channel_group_6g(int channel)
@@ -273,7 +273,7 @@
 +
  #endif
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 6a394c364..f1d681787 100644
+index 6a394c3..f1d6817 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -295,7 +295,12 @@ static void __mt7996_init_txpower(struct mt7996_phy *phy,
@@ -311,7 +311,7 @@
  	}
  }
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 57865f1de..52870fa72 100644
+index eb213f8..46e3e5a 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -85,6 +85,21 @@ int mt7996_run(struct ieee80211_hw *hw)
@@ -337,7 +337,7 @@
  
  	ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 2650dc6ff..1330ff397 100644
+index 16a01b1..ffd3536 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -4665,9 +4665,31 @@ int mt7996_mcu_wed_rro_reset_sessions(struct mt7996_dev *dev, u16 id)
@@ -436,7 +436,7 @@
  				     MCU_WM_UNI_CMD(TXPOWER), true);
  }
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 5953b25e8..5a60ccc55 100644
+index 5953b25..5a60ccc 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -911,6 +911,7 @@ struct tx_power_ctrl {
@@ -456,7 +456,7 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 186af3c1d..6ab45cc7e 100644
+index 186af3c..6ab45cc 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -296,6 +296,9 @@ struct mt7996_phy {
@@ -478,7 +478,7 @@
  void mt7996_mcu_scs_sta_poll(struct work_struct *work);
  
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 9b4d5f68c..48209668c 100644
+index 24b331e..74aabf0 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2440,6 +2440,364 @@ mt7996_scs_enable_set(void *data, u64 val)
@@ -858,7 +858,7 @@
  	debugfs_create_devm_seqfile(dev->mt76.dev, "wtbl_info", dir,
  				    mt7996_wtbl_read);
 diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
-index c16b25ab5..e56ddd8ff 100644
+index c16b25a..e56ddd8 100644
 --- a/mt7996/mtk_mcu.c
 +++ b/mt7996/mtk_mcu.c
 @@ -12,8 +12,31 @@
@@ -894,7 +894,7 @@
  int mt7996_mcu_muru_dbg_info(struct mt7996_dev *dev, u16 item, u8 val)
  {
 diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
-index 7f4d4e029..c30418cae 100644
+index 7f4d4e0..c30418c 100644
 --- a/mt7996/mtk_mcu.h
 +++ b/mt7996/mtk_mcu.h
 @@ -14,6 +14,98 @@ enum {
@@ -997,7 +997,7 @@
  
  #endif
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 4c20a67d7..8ec1dc1c6 100644
+index 4c20a67..8ec1dc1 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -693,24 +693,29 @@ enum offs_rev {
@@ -1042,5 +1042,5 @@
  #define MT_WF_PHYRX_CSD_BAND_RXTD12_IRPI_SW_CLR		BIT(29)
  
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0027-mtk-wifi-mt76-mt7996-add-binfile-mode-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0026-mtk-wifi-mt76-mt7996-add-binfile-mode-support.patch
similarity index 96%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0027-mtk-wifi-mt76-mt7996-add-binfile-mode-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0026-mtk-wifi-mt76-mt7996-add-binfile-mode-support.patch
index 2afa335..00b9fc6 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0027-mtk-wifi-mt76-mt7996-add-binfile-mode-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0026-mtk-wifi-mt76-mt7996-add-binfile-mode-support.patch
@@ -1,7 +1,7 @@
-From 83c7e6d692657d514891430ad530df1337b90799 Mon Sep 17 00:00:00 2001
+From 5e960ddb3cd014c0fe80526215319ffd3c497054 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 31 Mar 2023 11:36:34 +0800
-Subject: [PATCH 027/116] mtk: wifi: mt76: mt7996: add binfile mode support
+Subject: [PATCH 026/116] mtk: wifi: mt76: mt7996: add binfile mode support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 
@@ -25,7 +25,7 @@
  7 files changed, 179 insertions(+), 6 deletions(-)
 
 diff --git a/eeprom.c b/eeprom.c
-index 11efe2937..3da94926e 100644
+index 11efe29..3da9492 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -161,6 +161,31 @@ static int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int len)
@@ -61,7 +61,7 @@
  mt76_eeprom_override(struct mt76_phy *phy)
  {
 diff --git a/mt76.h b/mt76.h
-index 20fdd050a..0b6d8b84e 100644
+index c372e78..dbd8ab9 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -954,6 +954,8 @@ struct mt76_dev {
@@ -82,7 +82,7 @@
  struct mt76_queue *
  mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 6ac992a81..fe8b25352 100644
+index 6ac992a..fe8b253 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -82,10 +82,17 @@ static int mt7996_check_eeprom(struct mt7996_dev *dev)
@@ -243,7 +243,7 @@
  		if (ret)
  			return ret;
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index b19ff068e..8f0f87b6b 100644
+index b19ff06..8f0f87b 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -102,6 +102,13 @@ enum mt7996_eeprom_band {
@@ -261,7 +261,7 @@
  mt7996_get_channel_group_5g(int channel)
  {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 6ab45cc7e..9d6e85c1d 100644
+index 6ab45cc..9d6e85c 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -62,6 +62,7 @@
@@ -290,7 +290,7 @@
  int mt7996_eeprom_check_fw_mode(struct mt7996_dev *dev);
  int mt7996_eeprom_parse_hw_cap(struct mt7996_dev *dev, struct mt7996_phy *phy);
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 48209668c..3ecce1329 100644
+index 74aabf0..2499f12 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2798,6 +2798,44 @@ static const struct file_operations mt7996_txpower_path_fops = {
@@ -349,7 +349,7 @@
  				    mt7996_wtbl_read);
  
 diff --git a/testmode.h b/testmode.h
-index d6601cdcf..5d677f8c1 100644
+index d6601cd..5d677f8 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -16,7 +16,7 @@
@@ -362,5 +362,5 @@
   * @MT76_TM_ATTR_BAND_IDX: band idx of the chip (u8)
   *
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0028-mtk-wifi-mt76-testmode-add-testmode-ZWDFS-verificati.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0027-mtk-wifi-mt76-testmode-add-testmode-ZWDFS-verificati.patch
similarity index 97%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0028-mtk-wifi-mt76-testmode-add-testmode-ZWDFS-verificati.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0027-mtk-wifi-mt76-testmode-add-testmode-ZWDFS-verificati.patch
index c01db67..5ccf77e 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0028-mtk-wifi-mt76-testmode-add-testmode-ZWDFS-verificati.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0027-mtk-wifi-mt76-testmode-add-testmode-ZWDFS-verificati.patch
@@ -1,7 +1,7 @@
-From 6e64a8af10129018ea1ff7ccd4803d5b0c7ff7ad Mon Sep 17 00:00:00 2001
+From 2ef29df1bbd84d7b35b6830025323cead3681e85 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 22 Mar 2023 11:19:52 +0800
-Subject: [PATCH 028/116] mtk: wifi: mt76: testmode: add testmode ZWDFS
+Subject: [PATCH 027/116] mtk: wifi: mt76: testmode: add testmode ZWDFS
  verification support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -15,7 +15,7 @@
  6 files changed, 326 insertions(+), 12 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 0b6d8b84e..4a3e6bf40 100644
+index dbd8ab9..43e4585 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -783,6 +783,14 @@ struct mt76_testmode_data {
@@ -34,7 +34,7 @@
  
  struct mt76_vif {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 9d6e85c1d..7d6ec8ba4 100644
+index 9d6e85c..7d6ec8b 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -289,6 +289,7 @@ struct mt7996_phy {
@@ -46,7 +46,7 @@
  	bool has_aux_rx;
  
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index a756ee10d..836211f98 100644
+index a756ee1..836211f 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
 @@ -17,6 +17,12 @@ enum {
@@ -336,7 +336,7 @@
  
  static int
 diff --git a/mt7996/testmode.h b/mt7996/testmode.h
-index 9bfb86f28..78662b2ed 100644
+index 9bfb86f..78662b2 100644
 --- a/mt7996/testmode.h
 +++ b/mt7996/testmode.h
 @@ -27,9 +27,15 @@ enum {
@@ -399,7 +399,7 @@
 +
  #endif
 diff --git a/testmode.c b/testmode.c
-index cd8cb6553..69147f866 100644
+index cd8cb65..69147f8 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -27,6 +27,13 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -453,7 +453,7 @@
  	     nla_put_u8(msg, MT76_TM_ATTR_TX_LTF, td->tx_ltf)) ||
  	    (mt76_testmode_param_present(td, MT76_TM_ATTR_TX_ANTENNA) &&
 diff --git a/tools/fields.c b/tools/fields.c
-index b01227638..77696ce7b 100644
+index b012276..77696ce 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -35,6 +35,15 @@ static const char * const testmode_tx_mode[] = {
@@ -486,5 +486,5 @@
  	FIELD_NESTED_RO(STATS, stats, "",
  			.print_extra = print_extra_stats),
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0029-mtk-wifi-mt76-mt7996-support-eagle-ZWDFS-on-iFEM.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0028-mtk-wifi-mt76-mt7996-support-eagle-ZWDFS-on-iFEM.patch
similarity index 94%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0029-mtk-wifi-mt76-mt7996-support-eagle-ZWDFS-on-iFEM.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0028-mtk-wifi-mt76-mt7996-support-eagle-ZWDFS-on-iFEM.patch
index 818e125..3cbb987 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0029-mtk-wifi-mt76-mt7996-support-eagle-ZWDFS-on-iFEM.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0028-mtk-wifi-mt76-mt7996-support-eagle-ZWDFS-on-iFEM.patch
@@ -1,7 +1,7 @@
-From 72f979ee7ce94f3f28b6fc761a1aadb37ab2d63a Mon Sep 17 00:00:00 2001
+From 1be3480176150329dd571219f69ccd8efa312daa Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 5 Jul 2023 10:00:17 +0800
-Subject: [PATCH 029/116] mtk: wifi: mt76: mt7996: support eagle ZWDFS on iFEM
+Subject: [PATCH 028/116] mtk: wifi: mt76: mt7996: support eagle ZWDFS on iFEM
 
 Fix the case that control channel is not first chan during first
 interface setup.
@@ -15,7 +15,7 @@
  3 files changed, 67 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 52870fa72..1a1f0242c 100644
+index 46e3e5a..61396a8 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1444,6 +1444,61 @@ mt7996_twt_teardown_request(struct ieee80211_hw *hw,
@@ -117,7 +117,7 @@
  		goto out;
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 1330ff397..f375a5aba 100644
+index ffd3536..a3b66f1 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -372,12 +372,14 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
@@ -138,7 +138,7 @@
  }
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 7d6ec8ba4..fd93db2fc 100644
+index 7d6ec8b..fd93db2 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -399,6 +399,7 @@ struct mt7996_dev {
@@ -150,5 +150,5 @@
  	bool ibf;
  	u8 fw_debug_wm;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0030-mtk-wifi-mt76-mt7996-refactor-eeprom-loading-flow-fo.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0029-mtk-wifi-mt76-mt7996-refactor-eeprom-loading-flow-fo.patch
similarity index 97%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0030-mtk-wifi-mt76-mt7996-refactor-eeprom-loading-flow-fo.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0029-mtk-wifi-mt76-mt7996-refactor-eeprom-loading-flow-fo.patch
index b0ec37f..786d7e6 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0030-mtk-wifi-mt76-mt7996-refactor-eeprom-loading-flow-fo.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0029-mtk-wifi-mt76-mt7996-refactor-eeprom-loading-flow-fo.patch
@@ -1,7 +1,7 @@
-From fcdb091e77f60c86abd005508edc7beb6dd33154 Mon Sep 17 00:00:00 2001
+From 1ed0aea054ae9fcd011f81333888d15cba7fc19f Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 11 Mar 2024 10:43:03 +0800
-Subject: [PATCH 030/116] mtk: wifi: mt76: mt7996: refactor eeprom loading flow
+Subject: [PATCH 029/116] mtk: wifi: mt76: mt7996: refactor eeprom loading flow
  for sku checking
 
 Add eeprom sku checking mechanism to avoid using the
@@ -42,7 +42,7 @@
  5 files changed, 150 insertions(+), 112 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index fe8b25352..f97d76cc4 100644
+index fe8b253..f97d76c 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -50,54 +50,84 @@ const u32 dpd_6g_bw320_ch_num = ARRAY_SIZE(dpd_6g_ch_list_bw320);
@@ -364,7 +364,7 @@
  	ret = mt7996_eeprom_load_precal(dev);
  	if (ret)
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 8f0f87b6b..03a4fd07d 100644
+index 8f0f87b..03a4fd0 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -132,6 +132,38 @@ mt7996_get_channel_group_6g(int channel)
@@ -407,7 +407,7 @@
  	SKU_CCK,
  	SKU_OFDM,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index f375a5aba..15751a54b 100644
+index a3b66f1..446fe1f 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -3507,7 +3507,7 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
@@ -443,7 +443,7 @@
  {
  	struct mt7996_mcu_eeprom_info req = {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index fd93db2fc..b2a938162 100644
+index fd93db2..b2a9381 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -54,15 +54,14 @@
@@ -464,7 +464,7 @@
  #define MT7996_EEPROM_BLOCK_SIZE	16
  #define MT7996_TOKEN_SIZE		16384
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 3ecce1329..50b2df1ec 100644
+index 2499f12..2a9f213 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2827,7 +2827,7 @@ static int mt7996_show_eeprom_mode(struct seq_file *s, void *data)
@@ -477,5 +477,5 @@
  	default:
  		break;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0031-mtk-wifi-mt76-mt7996-add-vendor-commands-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0030-mtk-wifi-mt76-mt7996-add-vendor-commands-support.patch
similarity index 98%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0031-mtk-wifi-mt76-mt7996-add-vendor-commands-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0030-mtk-wifi-mt76-mt7996-add-vendor-commands-support.patch
index ade9a1e..c5c7739 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0031-mtk-wifi-mt76-mt7996-add-vendor-commands-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0030-mtk-wifi-mt76-mt7996-add-vendor-commands-support.patch
@@ -1,7 +1,7 @@
-From 0e813e3d82da805835d53d1af182bd2d700aaafa Mon Sep 17 00:00:00 2001
+From 952ed39c596363be421fab82fc8dc9043a6d6b01 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 13 Dec 2022 15:17:43 +0800
-Subject: [PATCH 031/116] mtk: wifi: mt76: mt7996: add vendor commands support
+Subject: [PATCH 030/116] mtk: wifi: mt76: mt7996: add vendor commands support
 
 mtk: wifi: mt76: fix muru_onoff as all enabled by default
 
@@ -57,10 +57,10 @@
  create mode 100644 mt7996/vendor.h
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index d8830dc25..2a6091939 100644
+index 49c5ba3..750bb93 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1252,6 +1252,7 @@ enum {
+@@ -1254,6 +1254,7 @@ enum {
  	MCU_UNI_CMD_REG_ACCESS = 0x0d,
  	MCU_UNI_CMD_CHIP_CONFIG = 0x0e,
  	MCU_UNI_CMD_POWER_CTRL = 0x0f,
@@ -68,7 +68,7 @@
  	MCU_UNI_CMD_RX_HDR_TRANS = 0x12,
  	MCU_UNI_CMD_SER = 0x13,
  	MCU_UNI_CMD_TWT = 0x14,
-@@ -1284,6 +1285,7 @@ enum {
+@@ -1286,6 +1287,7 @@ enum {
  	MCU_UNI_CMD_PER_STA_INFO = 0x6d,
  	MCU_UNI_CMD_ALL_STA_INFO = 0x6e,
  	MCU_UNI_CMD_ASSERT_DUMP = 0x6f,
@@ -77,7 +77,7 @@
  
  enum {
 diff --git a/mt7996/Makefile b/mt7996/Makefile
-index 7bb17f440..6643c7a38 100644
+index 7bb17f4..6643c7a 100644
 --- a/mt7996/Makefile
 +++ b/mt7996/Makefile
 @@ -1,11 +1,12 @@
@@ -95,7 +95,7 @@
  mt7996e-$(CONFIG_DEV_COREDUMP) += coredump.o
  mt7996e-$(CONFIG_NL80211_TESTMODE) += testmode.o
 diff --git a/mt7996/init.c b/mt7996/init.c
-index f1d681787..5cc2e6fbf 100644
+index f1d6817..5cc2e6f 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -378,6 +378,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -129,7 +129,7 @@
  				   ARRAY_SIZE(mt76_rates));
  	if (ret)
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index c9f45abef..d55e5a761 100644
+index c9f45ab..d55e5a7 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -679,6 +679,10 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
@@ -144,7 +144,7 @@
  		status->flag |= RX_FLAG_8023;
  		mt7996_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 1a1f0242c..6d1f61cd0 100644
+index 61396a8..003bf3f 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -760,6 +760,10 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -159,7 +159,7 @@
  	if (ret)
  		return ret;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 15751a54b..91c2dab1a 100644
+index 446fe1f..ae0c11a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -1378,6 +1378,8 @@ static void
@@ -218,7 +218,7 @@
 +}
 +#endif
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 5a60ccc55..2e845e920 100644
+index 5a60ccc..2e845e9 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -754,8 +754,20 @@ enum {
@@ -252,7 +252,7 @@
  };
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index b2a938162..402327d92 100644
+index b2a9381..402327d 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -258,6 +258,34 @@ struct mt7996_wed_rro_session_id {
@@ -337,7 +337,7 @@
  int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir);
  int mt7996_mcu_muru_dbg_info(struct mt7996_dev *dev, u16 item, u8 val);
 diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
-index e56ddd8ff..5c54d02c4 100644
+index e56ddd8..5c54d02 100644
 --- a/mt7996/mtk_mcu.c
 +++ b/mt7996/mtk_mcu.c
 @@ -59,4 +59,91 @@ int mt7996_mcu_muru_dbg_info(struct mt7996_dev *dev, u16 item, u8 val)
@@ -433,7 +433,7 @@
 +
  #endif
 diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
-index c30418cae..36a58ad63 100644
+index c30418c..36a58ad 100644
 --- a/mt7996/mtk_mcu.h
 +++ b/mt7996/mtk_mcu.h
 @@ -106,6 +106,21 @@ enum txpower_event {
@@ -460,7 +460,7 @@
  #endif
 diff --git a/mt7996/vendor.c b/mt7996/vendor.c
 new file mode 100644
-index 000000000..0d6fa7792
+index 0000000..0d6fa77
 --- /dev/null
 +++ b/mt7996/vendor.c
 @@ -0,0 +1,805 @@
@@ -1271,7 +1271,7 @@
 +}
 diff --git a/mt7996/vendor.h b/mt7996/vendor.h
 new file mode 100644
-index 000000000..8aaa18eec
+index 0000000..8aaa18e
 --- /dev/null
 +++ b/mt7996/vendor.h
 @@ -0,0 +1,153 @@
@@ -1429,5 +1429,5 @@
 +
 +#endif
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0032-mtk-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0031-mtk-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch
similarity index 95%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0032-mtk-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0031-mtk-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch
index 87e3e08..0adbbdc 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0032-mtk-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0031-mtk-wifi-mt76-mt7996-add-debugfs-for-fw-coredump.patch
@@ -1,7 +1,7 @@
-From 0b8743892c4e39e7ba7f2c248ee8929f6c599e76 Mon Sep 17 00:00:00 2001
+From 2b301b7df0e6aeb725683bbee25027787488b147 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Fri, 19 May 2023 14:56:07 +0800
-Subject: [PATCH 032/116] mtk: wifi: mt76: mt7996: add debugfs for fw coredump.
+Subject: [PATCH 031/116] mtk: wifi: mt76: mt7996: add debugfs for fw coredump.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
@@ -12,7 +12,7 @@
  4 files changed, 56 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 344c759c0..3074202bb 100644
+index 344c759..3074202 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -84,6 +84,8 @@ mt7996_sys_recovery_set(struct file *file, const char __user *user_buf,
@@ -64,7 +64,7 @@
  	desc += scnprintf(buff + desc, bufsz - desc,
  			  "\nlet's dump firmware SER statistics...\n");
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index d55e5a761..1c1b3eb51 100644
+index d55e5a7..1c1b3eb 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -2080,15 +2080,36 @@ void mt7996_mac_dump_work(struct work_struct *work)
@@ -116,7 +116,7 @@
  	}
  
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 2e845e920..cb7260fb3 100644
+index 2e845e9..cb7260f 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -958,7 +958,11 @@ enum {
@@ -132,7 +132,7 @@
  	UNI_CMD_SER_ENABLE = 1,
  	UNI_CMD_SER_SET,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 402327d92..623b782c9 100644
+index 402327d..623b782 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -138,6 +138,14 @@ enum mt7996_ram_type {
@@ -167,5 +167,5 @@
  int mt7996_mcu_init(struct mt7996_dev *dev);
  int mt7996_mcu_init_firmware(struct mt7996_dev *dev);
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0033-mtk-wifi-mt76-mt7996-Add-mt7992-coredump-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0032-mtk-wifi-mt76-mt7996-Add-mt7992-coredump-support.patch
similarity index 94%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0033-mtk-wifi-mt76-mt7996-Add-mt7992-coredump-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0032-mtk-wifi-mt76-mt7996-Add-mt7992-coredump-support.patch
index 3a286e2..20f82a0 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0033-mtk-wifi-mt76-mt7996-Add-mt7992-coredump-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0032-mtk-wifi-mt76-mt7996-Add-mt7992-coredump-support.patch
@@ -1,7 +1,7 @@
-From 7582fc5bf2165b744eb41631f3892969ca6b510c Mon Sep 17 00:00:00 2001
+From 2df50005330ec03e1316a25e0cb3b6ece5915d13 Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Mon, 25 Dec 2023 15:17:49 +0800
-Subject: [PATCH 033/116] mtk: wifi: mt76: mt7996: Add mt7992 coredump support
+Subject: [PATCH 032/116] mtk: wifi: mt76: mt7996: Add mt7992 coredump support
 
 1. Add mt7992 coredump support
 2. fixed if new ic have not support coredump, it may cause crash when remove module
@@ -13,7 +13,7 @@
  2 files changed, 67 insertions(+), 14 deletions(-)
 
 diff --git a/mt7996/coredump.c b/mt7996/coredump.c
-index a7f91b56d..d09bcd4bd 100644
+index a7f91b5..d09bcd4 100644
 --- a/mt7996/coredump.c
 +++ b/mt7996/coredump.c
 @@ -67,6 +67,44 @@ static const struct mt7996_mem_region mt7996_wa_mem_regions[] = {
@@ -146,7 +146,7 @@
  }
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 623b782c9..97425a025 100644
+index 623b782..97425a0 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -229,6 +229,7 @@ struct mt7996_vif {
@@ -158,5 +158,5 @@
  	u8 *memdump_buf;
  	size_t memdump_buf_len;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0034-mtk-wifi-mt76-mt7996-add-support-for-runtime-set-in-.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0033-mtk-wifi-mt76-mt7996-add-support-for-runtime-set-in-.patch
similarity index 89%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0034-mtk-wifi-mt76-mt7996-add-support-for-runtime-set-in-.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0033-mtk-wifi-mt76-mt7996-add-support-for-runtime-set-in-.patch
index 8688630..94ad572 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0034-mtk-wifi-mt76-mt7996-add-support-for-runtime-set-in-.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0033-mtk-wifi-mt76-mt7996-add-support-for-runtime-set-in-.patch
@@ -1,7 +1,7 @@
-From 4982c35a7957ef3a6b9ec0985544a4245b5d5f14 Mon Sep 17 00:00:00 2001
+From 6fd185872dc77c7ca2f13237937269bb8f2af706 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 6 Jun 2023 16:57:10 +0800
-Subject: [PATCH 034/116] mtk: wifi: mt76: mt7996: add support for runtime set
+Subject: [PATCH 033/116] mtk: wifi: mt76: mt7996: add support for runtime set
  in-band discovery
 
 with this patch, AP can runtime set inband discovery via hostapd_cli
@@ -17,7 +17,7 @@
  1 file changed, 2 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 91c2dab1a..94c5da5e8 100644
+index ae0c11a..51c771b 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -2609,8 +2609,7 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
@@ -40,5 +40,5 @@
  
  	buf = (u8 *)tlv + sizeof(*discov);
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0035-mtk-wifi-mt76-mt7996-add-support-spatial-reuse-debug.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0034-mtk-wifi-mt76-mt7996-add-support-spatial-reuse-debug.patch
similarity index 96%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0035-mtk-wifi-mt76-mt7996-add-support-spatial-reuse-debug.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0034-mtk-wifi-mt76-mt7996-add-support-spatial-reuse-debug.patch
index 4a925be..9c80261 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0035-mtk-wifi-mt76-mt7996-add-support-spatial-reuse-debug.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0034-mtk-wifi-mt76-mt7996-add-support-spatial-reuse-debug.patch
@@ -1,7 +1,7 @@
-From e4af7a0b0c39e05e0bded3de7b63831cd9b5dd97 Mon Sep 17 00:00:00 2001
+From 5e5d779286a2c289480469f3b6d1b93479a4762c Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 10 Jul 2023 11:47:29 +0800
-Subject: [PATCH 035/116] mtk: wifi: mt76: mt7996: add support spatial reuse
+Subject: [PATCH 034/116] mtk: wifi: mt76: mt7996: add support spatial reuse
  debug commands
 
 This commit adds the following debug commands in debugfs:
@@ -15,7 +15,6 @@
 
 To learn more details of these commands, please check:
 https://wiki.mediatek.inc/display/APKB/mt76+Phy+feature+debug+Cheetsheet#mt76PhyfeaturedebugCheetsheet-SpatialReuse
-
 ---
  mt76_connac_mcu.h    |   1 +
  mt7996/main.c        |   6 +++
@@ -27,10 +26,10 @@
  7 files changed, 270 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 2a6091939..864a802d7 100644
+index 750bb93..7f2daf7 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1040,6 +1040,7 @@ enum {
+@@ -1041,6 +1041,7 @@ enum {
  	MCU_UNI_EVENT_BSS_BEACON_LOSS = 0x0c,
  	MCU_UNI_EVENT_SCAN_DONE = 0x0e,
  	MCU_UNI_EVENT_RDD_REPORT = 0x11,
@@ -39,7 +38,7 @@
  	MCU_UNI_EVENT_TX_DONE = 0x2d,
  	MCU_UNI_EVENT_BF = 0x33,
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 6d1f61cd0..f8ac51707 100644
+index 003bf3f..92b2834 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -6,6 +6,9 @@
@@ -63,7 +62,7 @@
  						dev->dbg.sku_disable ? 0 : phy->sku_limit_en);
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 94c5da5e8..0be5a880f 100644
+index 51c771b..7318842 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -717,6 +717,14 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
@@ -82,7 +81,7 @@
  	case MCU_UNI_EVENT_TESTMODE_CTRL:
  		mt7996_tm_rf_test_event(dev, skb);
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 97425a025..c06aae960 100644
+index 97425a0..c06aae9 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -357,6 +357,10 @@ struct mt7996_phy {
@@ -106,7 +105,7 @@
  
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 50b2df1ec..9dc6ea778 100644
+index 2a9f213..3eb55a3 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2836,6 +2836,83 @@ static int mt7996_show_eeprom_mode(struct seq_file *s, void *data)
@@ -206,7 +205,7 @@
  }
  
 diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
-index 5c54d02c4..dbdf8d809 100644
+index 5c54d02..dbdf8d8 100644
 --- a/mt7996/mtk_mcu.c
 +++ b/mt7996/mtk_mcu.c
 @@ -146,4 +146,115 @@ int mt7996_mcu_edcca_threshold_ctrl(struct mt7996_phy *phy, u8 *value, bool set)
@@ -326,7 +325,7 @@
 +}
  #endif
 diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
-index 36a58ad63..098e63aef 100644
+index 36a58ad..098e63a 100644
 --- a/mt7996/mtk_mcu.h
 +++ b/mt7996/mtk_mcu.h
 @@ -121,6 +121,62 @@ enum {
@@ -393,5 +392,5 @@
  
  #endif
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0036-mtk-wifi-mt76-mt7996-Establish-BA-in-VO-queue.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0035-mtk-wifi-mt76-mt7996-Establish-BA-in-VO-queue.patch
similarity index 74%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0036-mtk-wifi-mt76-mt7996-Establish-BA-in-VO-queue.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0035-mtk-wifi-mt76-mt7996-Establish-BA-in-VO-queue.patch
index 5ea0ac5..1103857 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0036-mtk-wifi-mt76-mt7996-Establish-BA-in-VO-queue.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0035-mtk-wifi-mt76-mt7996-Establish-BA-in-VO-queue.patch
@@ -1,14 +1,14 @@
-From 6888c8da2d1620dcd3a85834b07faef4a90c64b2 Mon Sep 17 00:00:00 2001
+From e6c2efee109792cf81fa79a0b0bf56fdbc1f4787 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Tue, 1 Aug 2023 16:02:28 +0800
-Subject: [PATCH 036/116] mtk: wifi: mt76: mt7996: Establish BA in VO queue
+Subject: [PATCH 035/116] mtk: wifi: mt76: mt7996: Establish BA in VO queue
 
 ---
  mt7996/mac.c | 2 --
  1 file changed, 2 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 1c1b3eb51..4e52aa1bf 100644
+index 1c1b3eb..4e52aa1 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -1032,8 +1032,6 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
@@ -21,5 +21,5 @@
  	if (is_8023) {
  		fc = IEEE80211_FTYPE_DATA |
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0037-mtk-wifi-mt76-mt7996-report-tx-and-rx-byte-to-tpt_le.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0036-mtk-wifi-mt76-mt7996-report-tx-and-rx-byte-to-tpt_le.patch
similarity index 88%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0037-mtk-wifi-mt76-mt7996-report-tx-and-rx-byte-to-tpt_le.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0036-mtk-wifi-mt76-mt7996-report-tx-and-rx-byte-to-tpt_le.patch
index e762d07..e58ed5b 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0037-mtk-wifi-mt76-mt7996-report-tx-and-rx-byte-to-tpt_le.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0036-mtk-wifi-mt76-mt7996-report-tx-and-rx-byte-to-tpt_le.patch
@@ -1,7 +1,7 @@
-From 7bf50fae60cf0682279a316814c17c58425322c5 Mon Sep 17 00:00:00 2001
+From fdad308b7db267d46e7dc1e22f251797c9cbd79e Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Sat, 12 Aug 2023 04:17:22 +0800
-Subject: [PATCH 037/116] mtk: wifi: mt76: mt7996: report tx and rx byte to
+Subject: [PATCH 036/116] mtk: wifi: mt76: mt7996: report tx and rx byte to
  tpt_led
 
 ---
@@ -9,7 +9,7 @@
  1 file changed, 11 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 0be5a880f..d951c733e 100644
+index 7318842..2b9dedb 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -525,6 +525,8 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
@@ -43,5 +43,5 @@
  			break;
  		case UNI_ALL_STA_TXRX_MSDU_COUNT:
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0038-mtk-wifi-mt76-mt7996-support-dup-wtbl.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0037-mtk-wifi-mt76-mt7996-support-dup-wtbl.patch
similarity index 88%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0038-mtk-wifi-mt76-mt7996-support-dup-wtbl.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0037-mtk-wifi-mt76-mt7996-support-dup-wtbl.patch
index 23f01e1..77e8fb5 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0038-mtk-wifi-mt76-mt7996-support-dup-wtbl.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0037-mtk-wifi-mt76-mt7996-support-dup-wtbl.patch
@@ -1,7 +1,7 @@
-From 389b458b00f2369eeb43eb8a237836b7404b6657 Mon Sep 17 00:00:00 2001
+From a0f3047d8ba9040f39a14a202b7369efe223dd9e Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 21 Sep 2023 00:52:46 +0800
-Subject: [PATCH 038/116] mtk: wifi: mt76: mt7996: support dup wtbl
+Subject: [PATCH 037/116] mtk: wifi: mt76: mt7996: support dup wtbl
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
@@ -11,7 +11,7 @@
  3 files changed, 25 insertions(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 5cc2e6fbf..d4b0a72eb 100644
+index 5cc2e6f..d4b0a72 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -686,6 +686,7 @@ static void mt7996_init_work(struct work_struct *work)
@@ -23,7 +23,7 @@
  
  void mt7996_wfsys_reset(struct mt7996_dev *dev)
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index c06aae960..dbc4aa634 100644
+index c06aae9..dbc4aa6 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -813,6 +813,7 @@ int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir);
@@ -35,7 +35,7 @@
  
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
-index dbdf8d809..ea4e5bf28 100644
+index dbdf8d8..ea4e5bf 100644
 --- a/mt7996/mtk_mcu.c
 +++ b/mt7996/mtk_mcu.c
 @@ -257,4 +257,27 @@ void mt7996_mcu_rx_sr_event(struct mt7996_dev *dev, struct sk_buff *skb)
@@ -67,5 +67,5 @@
 +}
  #endif
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0039-mtk-wifi-mt76-try-more-times-when-send-message-timeo.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0038-mtk-wifi-mt76-try-more-times-when-send-message-timeo.patch
similarity index 95%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0039-mtk-wifi-mt76-try-more-times-when-send-message-timeo.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0038-mtk-wifi-mt76-try-more-times-when-send-message-timeo.patch
index 13e486c..937ae0c 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0039-mtk-wifi-mt76-try-more-times-when-send-message-timeo.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0038-mtk-wifi-mt76-try-more-times-when-send-message-timeo.patch
@@ -1,7 +1,7 @@
-From 39e2b93d2071ec41a6e85523df19f5269e9550a3 Mon Sep 17 00:00:00 2001
+From 3cc26e708dbef9b1eb0b5466a073a9c5c8a613b9 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Nov 2023 11:10:10 +0800
-Subject: [PATCH 039/116] mtk: wifi: mt76: try more times when send message
+Subject: [PATCH 038/116] mtk: wifi: mt76: try more times when send message
  timeout.
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
@@ -12,7 +12,7 @@
  3 files changed, 62 insertions(+), 47 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 560446395..66c000ef0 100644
+index 5604463..66c000e 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -504,9 +504,12 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
@@ -39,7 +39,7 @@
  
  static int
 diff --git a/mcu.c b/mcu.c
-index fa4b05441..2926f7150 100644
+index fa4b054..2926f71 100644
 --- a/mcu.c
 +++ b/mcu.c
 @@ -4,6 +4,7 @@
@@ -131,7 +131,7 @@
  
  	return ret;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 4e52aa1bf..56827c9b3 100644
+index 4e52aa1..56827c9 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -1784,13 +1784,24 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
@@ -208,5 +208,5 @@
  		 wiphy_name(dev->mt76.hw->wiphy));
  }
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0040-mtk-wifi-mt76-mt7996-add-SER-overlap-handle.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0039-mtk-wifi-mt76-mt7996-add-SER-overlap-handle.patch
similarity index 91%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0040-mtk-wifi-mt76-mt7996-add-SER-overlap-handle.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0039-mtk-wifi-mt76-mt7996-add-SER-overlap-handle.patch
index b6ec672..ab691e1 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0040-mtk-wifi-mt76-mt7996-add-SER-overlap-handle.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0039-mtk-wifi-mt76-mt7996-add-SER-overlap-handle.patch
@@ -1,7 +1,7 @@
-From 6c5c10622f2dcba5a72b60df9954060ebdde7fe4 Mon Sep 17 00:00:00 2001
+From 5759eb68a8453f211699bb09d74a39dd9e8d4c02 Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Tue, 21 Nov 2023 09:55:46 +0800
-Subject: [PATCH 040/116] mtk: wifi: mt76: mt7996: add SER overlap handle
+Subject: [PATCH 039/116] mtk: wifi: mt76: mt7996: add SER overlap handle
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
@@ -12,7 +12,7 @@
  4 files changed, 23 insertions(+), 1 deletion(-)
 
 diff --git a/mcu.c b/mcu.c
-index 2926f7150..a7afa2d7c 100644
+index 2926f71..a7afa2d 100644
 --- a/mcu.c
 +++ b/mcu.c
 @@ -94,7 +94,8 @@ int mt76_mcu_skb_send_and_get_msg(struct mt76_dev *dev, struct sk_buff *skb,
@@ -26,7 +26,7 @@
  
  		ret = dev->mcu_ops->mcu_skb_send_msg(dev, skb_tmp, cmd, &seq);
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 56827c9b3..9b5b9951e 100644
+index 56827c9..9b5b995 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -1885,6 +1885,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
@@ -69,7 +69,7 @@
  	wake_up(&dev->reset_wait);
  }
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index d951c733e..fcc2512f3 100644
+index 2b9dedb..ce26cfb 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -246,6 +246,14 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -88,7 +88,7 @@
  
  	seq = ++dev->mt76.mcu.msg_seq & 0xf;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index dbc4aa634..d40f8bf43 100644
+index dbc4aa6..d40f8bf 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -397,6 +397,8 @@ struct mt7996_dev {
@@ -101,5 +101,5 @@
  		u32 wm_reset_count;
  		bool hw_full_reset:1;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0041-mtk-wifi-mt76-mt7996-kite-default-1-pcie-setting.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0040-mtk-wifi-mt76-mt7996-kite-default-1-pcie-setting.patch
similarity index 88%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0041-mtk-wifi-mt76-mt7996-kite-default-1-pcie-setting.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0040-mtk-wifi-mt76-mt7996-kite-default-1-pcie-setting.patch
index 8e1d41b..2bb7510 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0041-mtk-wifi-mt76-mt7996-kite-default-1-pcie-setting.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0040-mtk-wifi-mt76-mt7996-kite-default-1-pcie-setting.patch
@@ -1,7 +1,7 @@
-From f2660cb8f6840bd545b093b9dee22c8f06ccb499 Mon Sep 17 00:00:00 2001
+From 9d16189b29de2e3c2fb0daf7fe5238f489b26818 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 13 Jul 2023 16:36:36 +0800
-Subject: [PATCH 041/116] mtk: wifi: mt76: mt7996: kite default 1-pcie setting
+Subject: [PATCH 040/116] mtk: wifi: mt76: mt7996: kite default 1-pcie setting
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -9,7 +9,7 @@
  1 file changed, 11 insertions(+)
 
 diff --git a/mt7996/pci.c b/mt7996/pci.c
-index 040561813..05830c01c 100644
+index 0405618..05830c0 100644
 --- a/mt7996/pci.c
 +++ b/mt7996/pci.c
 @@ -11,6 +11,9 @@
@@ -52,5 +52,5 @@
  	if (ret)
  		return ret;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0042-mtk-wifi-mt76-mt7996-add-debugfs-knob-for-rx_counter.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0041-mtk-wifi-mt76-mt7996-add-debugfs-knob-for-rx_counter.patch
similarity index 93%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0042-mtk-wifi-mt76-mt7996-add-debugfs-knob-for-rx_counter.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0041-mtk-wifi-mt76-mt7996-add-debugfs-knob-for-rx_counter.patch
index 59b7901..6b2abc6 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0042-mtk-wifi-mt76-mt7996-add-debugfs-knob-for-rx_counter.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0041-mtk-wifi-mt76-mt7996-add-debugfs-knob-for-rx_counter.patch
@@ -1,7 +1,7 @@
-From c8059abc389412d9031292c2795b2db52c78ddc5 Mon Sep 17 00:00:00 2001
+From 9e924043388155d6e27199f90755a282d4b13126 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 28 Apr 2023 10:39:58 +0800
-Subject: [PATCH 042/116] mtk: wifi: mt76: mt7996: add debugfs knob for
+Subject: [PATCH 041/116] mtk: wifi: mt76: mt7996: add debugfs knob for
  rx_counters
 
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
@@ -14,7 +14,7 @@
  5 files changed, 94 insertions(+), 5 deletions(-)
 
 diff --git a/agg-rx.c b/agg-rx.c
-index 07c386c7b..37588ac20 100644
+index 07c386c..37588ac 100644
 --- a/agg-rx.c
 +++ b/agg-rx.c
 @@ -33,10 +33,13 @@ mt76_rx_aggr_release_frames(struct mt76_rx_tid *tid,
@@ -72,10 +72,10 @@
  	spin_lock_init(&tid->lock);
  
 diff --git a/mac80211.c b/mac80211.c
-index 1127ef7b5..0590aaf2e 100644
+index e2ff011..93e5c50 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -783,6 +783,7 @@ static void mt76_rx_release_amsdu(struct mt76_phy *phy, enum mt76_rxq_id q)
+@@ -784,6 +784,7 @@ static void mt76_rx_release_amsdu(struct mt76_phy *phy, enum mt76_rxq_id q)
  		}
  
  		if (ether_addr_equal(skb->data + offset, rfc1042_header)) {
@@ -83,7 +83,7 @@
  			dev_kfree_skb(skb);
  			return;
  		}
-@@ -1099,10 +1100,16 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -1100,10 +1101,16 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
  
  	*sta = wcid_to_sta(mstat.wcid);
  	*hw = mt76_phy_hw(dev, mstat.phy_idx);
@@ -101,7 +101,7 @@
  {
  	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
  	struct mt76_wcid *wcid = status->wcid;
-@@ -1149,7 +1156,11 @@ skip_hdr_check:
+@@ -1150,7 +1157,11 @@ skip_hdr_check:
  	ret = memcmp(status->iv, wcid->rx_key_pn[security_idx],
  		     sizeof(status->iv));
  	if (ret <= 0) {
@@ -113,7 +113,7 @@
  		return;
  	}
  
-@@ -1330,7 +1341,7 @@ void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
+@@ -1331,7 +1342,7 @@ void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  	while ((skb = __skb_dequeue(frames)) != NULL) {
  		struct sk_buff *nskb = skb_shinfo(skb)->frag_list;
  
@@ -122,7 +122,7 @@
  		skb_shinfo(skb)->frag_list = NULL;
  		mt76_rx_convert(dev, skb, &hw, &sta);
  		ieee80211_rx_list(hw, sta, skb, &list);
-@@ -1353,6 +1364,7 @@ void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
+@@ -1354,6 +1365,7 @@ void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
  	}
  
  	list_for_each_entry_safe(skb, tmp, &list, list) {
@@ -131,7 +131,7 @@
  		napi_gro_receive(napi, skb);
  	}
 diff --git a/mt76.h b/mt76.h
-index 4a3e6bf40..631f82fd5 100644
+index 43e4585..0cc6e53 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -428,6 +428,7 @@ struct mt76_rx_tid {
@@ -171,7 +171,7 @@
  
  /* per-phy stats.  */
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 9b5b9951e..18616fd29 100644
+index 9b5b995..18616fd 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -469,8 +469,10 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
@@ -227,7 +227,7 @@
  		break;
  	}
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 9dc6ea778..321e43f83 100644
+index 3eb55a3..af7d3a1 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2913,6 +2913,46 @@ mt7996_sr_scene_cond_show(struct seq_file *file, void *data)
@@ -287,5 +287,5 @@
  	debugfs_create_file("txpower_info", 0600, dir, phy, &mt7996_txpower_info_fops);
  	debugfs_create_file("txpower_sku", 0600, dir, phy, &mt7996_txpower_sku_fops);
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0043-mtk-wifi-mt76-mt7996-support-BF-MIMO-debug-commands.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0042-mtk-wifi-mt76-mt7996-support-BF-MIMO-debug-commands.patch
similarity index 98%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0043-mtk-wifi-mt76-mt7996-support-BF-MIMO-debug-commands.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0042-mtk-wifi-mt76-mt7996-support-BF-MIMO-debug-commands.patch
index d24cacb..55a47be 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0043-mtk-wifi-mt76-mt7996-support-BF-MIMO-debug-commands.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0042-mtk-wifi-mt76-mt7996-support-BF-MIMO-debug-commands.patch
@@ -1,7 +1,7 @@
-From a824fd4250a195e3010d24daa58e01cff4f45c46 Mon Sep 17 00:00:00 2001
+From 8ffdd68c3265dbb716322ccfb0a8c0e230616335 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 3 Jan 2023 09:42:07 +0800
-Subject: [PATCH 043/116] mtk: wifi: mt76: mt7996: support BF/MIMO debug
+Subject: [PATCH 042/116] mtk: wifi: mt76: mt7996: support BF/MIMO debug
  commands
 
 This commit includes the following commands:
@@ -33,7 +33,7 @@
  6 files changed, 1100 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index fcc2512f3..4be5ca4bf 100644
+index ce26cfb..d39a73f 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -744,6 +744,11 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
@@ -49,7 +49,7 @@
  	default:
  		break;
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index cb7260fb3..29bd7a55b 100644
+index cb7260f..29bd7a5 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -770,8 +770,12 @@ enum {
@@ -66,7 +66,7 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index d40f8bf43..4602b4e7a 100644
+index d40f8bf..4602b4e 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -816,6 +816,11 @@ int mt7996_mcu_muru_dbg_info(struct mt7996_dev *dev, u16 item, u8 val);
@@ -82,7 +82,7 @@
  
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 321e43f83..36db55479 100644
+index af7d3a1..0851d65 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2953,6 +2953,117 @@ static int mt7996_rx_counters(struct seq_file *s, void *data)
@@ -220,7 +220,7 @@
  }
  
 diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
-index ea4e5bf28..6b2cdad6f 100644
+index ea4e5bf..6b2cdad 100644
 --- a/mt7996/mtk_mcu.c
 +++ b/mt7996/mtk_mcu.c
 @@ -280,4 +280,628 @@ int mt7996_mcu_set_dup_wtbl(struct mt7996_dev *dev)
@@ -853,7 +853,7 @@
 +
  #endif
 diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
-index 098e63aef..27d6a05b8 100644
+index 098e63a..27d6a05 100644
 --- a/mt7996/mtk_mcu.h
 +++ b/mt7996/mtk_mcu.h
 @@ -119,6 +119,348 @@ enum {
@@ -1206,5 +1206,5 @@
  
  enum {
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0044-mtk-wifi-mt76-mt7996-add-build-the-following-MURU-mc.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0043-mtk-wifi-mt76-mt7996-add-build-the-following-MURU-mc.patch
similarity index 94%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0044-mtk-wifi-mt76-mt7996-add-build-the-following-MURU-mc.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0043-mtk-wifi-mt76-mt7996-add-build-the-following-MURU-mc.patch
index 0c42ddf..4064983 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0044-mtk-wifi-mt76-mt7996-add-build-the-following-MURU-mc.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0043-mtk-wifi-mt76-mt7996-add-build-the-following-MURU-mc.patch
@@ -1,13 +1,12 @@
-From 8531498a7a6b120e4861772b19f4f9a9a63a2484 Mon Sep 17 00:00:00 2001
+From 786203d2878c468d179ec324c9d91b331e09e16a Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Tue, 13 Jun 2023 14:49:02 +0800
-Subject: [PATCH 044/116] mtk: wifi: mt76: mt7996: add build the following MURU
+Subject: [PATCH 043/116] mtk: wifi: mt76: mt7996: add build the following MURU
  mcu command tlvs
 
 It includes the following tlvs:
 1. MURU tlv id 0x10, 0x33, 0xC8, 0xC9, 0xCA, 0xCC, 0xCD
 2. BF tlv id 0x1c
-
 ---
  mt7996/mcu.h         |  1 +
  mt7996/mt7996.h      |  3 ++
@@ -17,7 +16,7 @@
  5 files changed, 108 insertions(+)
 
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 29bd7a55b..848c85dae 100644
+index 29bd7a5..848c85d 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -776,6 +776,7 @@ enum {
@@ -29,7 +28,7 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 4602b4e7a..205a3c7b7 100644
+index 4602b4e..205a3c7 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -821,6 +821,9 @@ void mt7996_mcu_rx_bf_event(struct mt7996_dev *dev, struct sk_buff *skb);
@@ -43,7 +42,7 @@
  
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 36db55479..e337ae4f7 100644
+index 0851d65..b7fef1b 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -3064,6 +3064,16 @@ static const struct file_operations fops_muru_fixed_group_rate = {
@@ -73,7 +72,7 @@
  }
  
 diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
-index 6b2cdad6f..686506234 100644
+index 6b2cdad..6865062 100644
 --- a/mt7996/mtk_mcu.c
 +++ b/mt7996/mtk_mcu.c
 @@ -904,4 +904,82 @@ error:
@@ -160,7 +159,7 @@
 +
  #endif
 diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
-index 27d6a05b8..d9686ebb5 100644
+index 27d6a05..d9686eb 100644
 --- a/mt7996/mtk_mcu.h
 +++ b/mt7996/mtk_mcu.h
 @@ -119,6 +119,20 @@ enum {
@@ -185,5 +184,5 @@
  struct bf_pfmu_tag {
  	__le16 tag;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0045-mtk-wifi-mt76-mt7996-add-cert-patch.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0044-mtk-wifi-mt76-mt7996-add-cert-patch.patch
similarity index 98%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0045-mtk-wifi-mt76-mt7996-add-cert-patch.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0044-mtk-wifi-mt76-mt7996-add-cert-patch.patch
index eafe7db..cdb3a91 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0045-mtk-wifi-mt76-mt7996-add-cert-patch.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0044-mtk-wifi-mt76-mt7996-add-cert-patch.patch
@@ -1,7 +1,7 @@
-From 5316ac1eaa6a54cf11d0f7b66d074b6e101b5837 Mon Sep 17 00:00:00 2001
+From c9230b110a7c2db2d8863499d7a1d72b9fc74cad Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Mon, 14 Aug 2023 13:36:58 +0800
-Subject: [PATCH 045/116] mtk: wifi: mt76: mt7996: add cert patch
+Subject: [PATCH 044/116] mtk: wifi: mt76: mt7996: add cert patch
 
 This patch includes TGac and TGax
 
@@ -23,7 +23,7 @@
  9 files changed, 778 insertions(+), 7 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 18616fd29..70f0c56cc 100644
+index 18616fd..70f0c56 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -10,6 +10,7 @@
@@ -50,7 +50,7 @@
  {
  	struct mt7996_dev *dev = container_of(work, struct mt7996_dev, rc_work);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index f8ac51707..2f1dd0fb7 100644
+index 92b2834..8e67616 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -613,6 +613,7 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -113,7 +113,7 @@
  
  void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 4be5ca4bf..b1296ce25 100644
+index d39a73f..423d918 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -1352,6 +1352,10 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
@@ -185,7 +185,7 @@
  		if (val < 0 || val > 15) {
  			printk("Wrong value! The value is between 0-15.\n");
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 848c85dae..806163806 100644
+index 848c85d..8061638 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -755,6 +755,8 @@ enum {
@@ -221,7 +221,7 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 205a3c7b7..30ceb0018 100644
+index 205a3c7..30ceb00 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -354,6 +354,7 @@ struct mt7996_phy {
@@ -273,7 +273,7 @@
  
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
-index 686506234..b67d366d4 100644
+index 6865062..b67d366 100644
 --- a/mt7996/mtk_mcu.c
 +++ b/mt7996/mtk_mcu.c
 @@ -982,4 +982,209 @@ int mt7996_mcu_set_bypass_smthint(struct mt7996_phy *phy, u8 val)
@@ -487,7 +487,7 @@
 +
  #endif
 diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
-index d9686ebb5..7a4140b57 100644
+index d9686eb..7a4140b 100644
 --- a/mt7996/mtk_mcu.h
 +++ b/mt7996/mtk_mcu.h
 @@ -122,14 +122,15 @@ enum {
@@ -692,7 +692,7 @@
  
  #endif
 diff --git a/mt7996/vendor.c b/mt7996/vendor.c
-index 0d6fa7792..7ab64471f 100644
+index 0d6fa77..7ab6447 100644
 --- a/mt7996/vendor.c
 +++ b/mt7996/vendor.c
 @@ -10,10 +10,31 @@
@@ -992,7 +992,7 @@
  }
 +#endif
 diff --git a/mt7996/vendor.h b/mt7996/vendor.h
-index 8aaa18eec..2ee1339a5 100644
+index 8aaa18e..2ee1339 100644
 --- a/mt7996/vendor.h
 +++ b/mt7996/vendor.h
 @@ -3,8 +3,12 @@
@@ -1090,5 +1090,5 @@
 +
 +#endif
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0046-mtk-wifi-mt76-testmode-add-testmode-bf-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0045-mtk-wifi-mt76-testmode-add-testmode-bf-support.patch
similarity index 98%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0046-mtk-wifi-mt76-testmode-add-testmode-bf-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0045-mtk-wifi-mt76-testmode-add-testmode-bf-support.patch
index 120ee1e..fc0ff2e 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0046-mtk-wifi-mt76-testmode-add-testmode-bf-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0045-mtk-wifi-mt76-testmode-add-testmode-bf-support.patch
@@ -1,7 +1,7 @@
-From a0d5c65378876c6fbbc83b602e297d791640a7c3 Mon Sep 17 00:00:00 2001
+From 822d3687ba4c131b1850a06116ee39e5ebc3767c Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 6 Apr 2023 16:40:28 +0800
-Subject: [PATCH 046/116] mtk: wifi: mt76: testmode: add testmode bf support
+Subject: [PATCH 045/116] mtk: wifi: mt76: testmode: add testmode bf support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 
@@ -44,7 +44,7 @@
  14 files changed, 1576 insertions(+), 59 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 631f82fd5..11cbb2d28 100644
+index 0cc6e53..8b17dfb 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -757,6 +757,11 @@ struct mt76_testmode_data {
@@ -60,7 +60,7 @@
  	bool ebf;
  
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 864a802d7..885e5883e 100644
+index 7f2daf7..61a14a8 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -488,7 +488,8 @@ struct sta_rec_bf {
@@ -73,7 +73,7 @@
  } __packed;
  
  struct sta_rec_bfee {
-@@ -1279,6 +1280,7 @@ enum {
+@@ -1281,6 +1282,7 @@ enum {
  	MCU_UNI_CMD_VOW = 0x37,
  	MCU_UNI_CMD_PP = 0x38,
  	MCU_UNI_CMD_FIXED_RATE_TABLE = 0x40,
@@ -82,7 +82,7 @@
  	MCU_UNI_CMD_PRECAL_RESULT = 0x47,
  	MCU_UNI_CMD_RRO = 0x57,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index b1296ce25..8f3e5ebfd 100644
+index 423d918..18d8f4d 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -1073,7 +1073,12 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
@@ -108,7 +108,7 @@
  	struct sk_buff *skb;
  	struct tlv *tlv;
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 806163806..663128176 100644
+index 8061638..6631281 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -685,6 +685,22 @@ struct bf_sounding_on {
@@ -179,7 +179,7 @@
  	CMD_BAND_NONE,
  	CMD_BAND_24G,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 30ceb0018..84fbd0fb0 100644
+index 30ceb00..84fbd0f 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -486,6 +486,14 @@ struct mt7996_dev {
@@ -220,7 +220,7 @@
 +
  #endif
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index e337ae4f7..c7713e8b2 100644
+index b7fef1b..c1b665f 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -2958,7 +2958,7 @@ mt7996_starec_bf_read_set(void *data, u64 wlan_idx)
@@ -251,7 +251,7 @@
  DEFINE_DEBUGFS_ATTRIBUTE(fops_bf_pfmu_tag_read, NULL,
  			 mt7996_bf_pfmu_tag_read_set, "%lld\n");
 diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
-index b67d366d4..a9a7db15a 100644
+index b67d366..a9a7db1 100644
 --- a/mt7996/mtk_mcu.c
 +++ b/mt7996/mtk_mcu.c
 @@ -295,7 +295,7 @@ __mt7996_mcu_add_uni_tlv(struct sk_buff *skb, u16 tag, u16 len)
@@ -441,7 +441,7 @@
  		dev_info(dev->mt76.dev, "%s: unknown bf event tag %d\n",
  			 __func__, event->tag);
 diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
-index 7a4140b57..58d61c517 100644
+index 7a4140b..58d61c5 100644
 --- a/mt7996/mtk_mcu.h
 +++ b/mt7996/mtk_mcu.h
 @@ -189,6 +189,165 @@ struct bf_txsnd_info {
@@ -907,7 +907,7 @@
  	__le16 wlan_idx0;
  	__le16 wlan_idx1;
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 8ec1dc1c6..263737c52 100644
+index 8ec1dc1..263737c 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -326,6 +326,9 @@ enum offs_rev {
@@ -921,7 +921,7 @@
  #define MT_WF_RMAC_BASE(_band)			__BASE(WF_RMAC_BASE, (_band))
  #define MT_WF_RMAC(_band, ofs)			(MT_WF_RMAC_BASE(_band) + (ofs))
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 836211f98..5cec1eef6 100644
+index 836211f..5cec1ee 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
 @@ -23,6 +23,7 @@ enum {
@@ -1814,7 +1814,7 @@
  
  static int
 diff --git a/mt7996/testmode.h b/mt7996/testmode.h
-index 78662b2ed..f97ccb267 100644
+index 78662b2..f97ccb2 100644
 --- a/mt7996/testmode.h
 +++ b/mt7996/testmode.h
 @@ -27,6 +27,17 @@ enum {
@@ -1857,7 +1857,7 @@
  	__le32 func_data;
  	u8 band_idx;
 diff --git a/testmode.c b/testmode.c
-index 69147f866..b9f710970 100644
+index 69147f8..b9f7109 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -462,6 +462,44 @@ out:
@@ -1937,7 +1937,7 @@
  		err = dev->test_ops->set_params(phy, tb, state);
  		if (err)
 diff --git a/testmode.h b/testmode.h
-index 5d677f8c1..bda7624ad 100644
+index 5d677f8..bda7624 100644
 --- a/testmode.h
 +++ b/testmode.h
 @@ -286,6 +286,59 @@ enum mt76_testmode_eeprom_action {
@@ -2001,7 +2001,7 @@
  
  #endif
 diff --git a/tools/fields.c b/tools/fields.c
-index 77696ce7b..f793d1a51 100644
+index 77696ce..f793d1a 100644
 --- a/tools/fields.c
 +++ b/tools/fields.c
 @@ -44,6 +44,30 @@ static const char * const testmode_offchan_bw[] = {
@@ -2063,5 +2063,5 @@
  	FIELD(u8, OFF_CH_SCAN_CENTER_CH, "offchan_center_ch"),
  	FIELD_ENUM(OFF_CH_SCAN_BW, "offchan_bw", testmode_offchan_bw),
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0047-mtk-wifi-mt76-mt7996-add-zwdfs-cert-mode.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0046-mtk-wifi-mt76-mt7996-add-zwdfs-cert-mode.patch
similarity index 95%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0047-mtk-wifi-mt76-mt7996-add-zwdfs-cert-mode.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0046-mtk-wifi-mt76-mt7996-add-zwdfs-cert-mode.patch
index ff7ffa4..9088f6e 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0047-mtk-wifi-mt76-mt7996-add-zwdfs-cert-mode.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0046-mtk-wifi-mt76-mt7996-add-zwdfs-cert-mode.patch
@@ -1,7 +1,7 @@
-From 2ad633b14de62c86fbc40d1ab2a1d3417a10d2b7 Mon Sep 17 00:00:00 2001
+From f0bff585456e12c9b5e5b0e5cc33bf920d8cb6d0 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 22 Sep 2023 12:33:06 +0800
-Subject: [PATCH 047/116] mtk: wifi: mt76: mt7996: add zwdfs cert mode
+Subject: [PATCH 046/116] mtk: wifi: mt76: mt7996: add zwdfs cert mode
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -13,7 +13,7 @@
  5 files changed, 100 insertions(+), 12 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 8f3e5ebfd..8756a5df8 100644
+index 18d8f4d..d46c5ae 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -4496,18 +4496,7 @@ int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable)
@@ -75,7 +75,7 @@
  				     struct ieee80211_vif *vif,
  				     struct ieee80211_sta *sta)
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 663128176..f5e91a898 100644
+index 6631281..f5e91a8 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -119,6 +119,20 @@ struct mt7996_mcu_rdd_report {
@@ -100,7 +100,7 @@
  	u8 _rsv[4];
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 84fbd0fb0..7f7a6223b 100644
+index 84fbd0f..7f7a622 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -523,8 +523,11 @@ enum mt7996_rdd_cmd {
@@ -125,7 +125,7 @@
  				     struct cfg80211_chan_def *chandef);
  int mt7996_mcu_set_fixed_rate_table(struct mt7996_phy *phy, u8 table_idx,
 diff --git a/mt7996/vendor.c b/mt7996/vendor.c
-index 7ab64471f..ba00ef359 100644
+index 7ab6447..ba00ef3 100644
 --- a/mt7996/vendor.c
 +++ b/mt7996/vendor.c
 @@ -108,6 +108,11 @@ rfeature_ctrl_policy[NUM_MTK_VENDOR_ATTRS_RFEATURE_CTRL] = {
@@ -187,7 +187,7 @@
  
  void mt7996_vendor_register(struct mt7996_phy *phy)
 diff --git a/mt7996/vendor.h b/mt7996/vendor.h
-index 2ee1339a5..7c812f914 100644
+index 2ee1339..7c812f9 100644
 --- a/mt7996/vendor.h
 +++ b/mt7996/vendor.h
 @@ -14,6 +14,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -217,5 +217,5 @@
  	BW_SIGNALING_DISABLE,
  	BW_SIGNALING_STATIC,
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0048-mtk-wifi-mt76-testmode-add-channel-68-96.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0047-mtk-wifi-mt76-testmode-add-channel-68-96.patch
similarity index 96%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0048-mtk-wifi-mt76-testmode-add-channel-68-96.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0047-mtk-wifi-mt76-testmode-add-channel-68-96.patch
index fc82555..309f186 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0048-mtk-wifi-mt76-testmode-add-channel-68-96.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0047-mtk-wifi-mt76-testmode-add-channel-68-96.patch
@@ -1,7 +1,7 @@
-From 097d8d847d49f831848e990e60091d10bd9c59a5 Mon Sep 17 00:00:00 2001
+From 2904eb321441ee487d4438fdc46efe3d8032e74f Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 11 Sep 2023 14:43:07 +0800
-Subject: [PATCH 048/116] mtk: wifi: mt76: testmode: add channel 68 & 96
+Subject: [PATCH 047/116] mtk: wifi: mt76: testmode: add channel 68 & 96
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 
@@ -24,7 +24,7 @@
  6 files changed, 82 insertions(+), 9 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 0590aaf2e..8091a60e0 100644
+index 93e5c50..de0a398 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -34,6 +34,15 @@ static const struct ieee80211_channel mt76_channels_5ghz[] = {
@@ -44,7 +44,7 @@
  	CHAN5G(104, 5520),
  	CHAN5G(108, 5540),
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index f97d76cc4..acf5bc179 100644
+index f97d76c..acf5bc1 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -18,6 +18,17 @@ const struct ieee80211_channel dpd_2g_ch_list_bw20[] = {
@@ -125,7 +125,7 @@
  {
  	struct mt76_dev *mdev = &dev->mt76;
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 03a4fd07d..9a15b4462 100644
+index 03a4fd0..9a15b44 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -67,6 +67,8 @@ enum mt7996_eeprom_field {
@@ -138,7 +138,7 @@
  extern const u32 dpd_5g_bw160_ch_num;
  extern const struct ieee80211_channel dpd_6g_ch_list_bw160[];
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 8756a5df8..97bf2969e 100644
+index d46c5ae..6f08161 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -3766,7 +3766,8 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
@@ -173,7 +173,7 @@
  
  	for (i = 0; i < per_chan_size / MT_EE_CAL_UNIT; i++) {
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 5cec1eef6..95d3bde03 100644
+index 5cec1ee..95d3bde 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
 @@ -531,6 +531,11 @@ mt7996_tm_dpd_prek_send_req(struct mt7996_phy *phy, struct mt7996_tm_req *req,
@@ -227,7 +227,7 @@
  
  	return first_control + offset;
 diff --git a/mt7996/testmode.h b/mt7996/testmode.h
-index f97ccb267..ba1767aed 100644
+index f97ccb2..ba1767a 100644
 --- a/mt7996/testmode.h
 +++ b/mt7996/testmode.h
 @@ -38,9 +38,9 @@ enum {
@@ -244,5 +244,5 @@
  enum bw_mapping_method {
  	BW_MAP_NL_TO_FW,
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0049-mtk-wifi-mt76-testmode-add-kite-testmode-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0048-mtk-wifi-mt76-testmode-add-kite-testmode-support.patch
similarity index 98%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0049-mtk-wifi-mt76-testmode-add-kite-testmode-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0048-mtk-wifi-mt76-testmode-add-kite-testmode-support.patch
index f18fd7d..ef91f55 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0049-mtk-wifi-mt76-testmode-add-kite-testmode-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0048-mtk-wifi-mt76-testmode-add-kite-testmode-support.patch
@@ -1,7 +1,7 @@
-From 70f6d9e12225fb10db626a41cd0cd81439f2c814 Mon Sep 17 00:00:00 2001
+From 85865dc300bbe3bc8ef98907a145e8a9875858af Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Thu, 12 Oct 2023 16:17:33 +0800
-Subject: [PATCH 049/116] mtk: wifi: mt76: testmode: add kite testmode support
+Subject: [PATCH 048/116] mtk: wifi: mt76: testmode: add kite testmode support
 
 Add Kite testmode support
 1. avoid entering connac 2 testmode flow in kite
@@ -18,7 +18,7 @@
  6 files changed, 198 insertions(+), 120 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index acf5bc179..215d81e31 100644
+index acf5bc1..215d81e 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -29,12 +29,39 @@ const struct ieee80211_channel dpd_5g_skip_ch_list[] = {
@@ -112,7 +112,7 @@
  mt7996_eeprom_load_bin(struct mt7996_dev *dev)
  {
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index 9a15b4462..fa9c31e7a 100644
+index 9a15b44..fa9c31e 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -45,36 +45,69 @@ enum mt7996_eeprom_field {
@@ -210,7 +210,7 @@
  #define RF_DPD_FLAT_CAL				BIT(28)
  #define RF_PRE_CAL				BIT(29)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 97bf2969e..3e92a2742 100644
+index 6f08161..528bce8 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -3735,13 +3735,11 @@ int mt7996_mcu_apply_tx_dpd(struct mt7996_phy *phy)
@@ -317,7 +317,7 @@
  	cal += MT_EE_CAL_GROUP_SIZE + base_offset + idx * per_chan_size;
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 7f7a6223b..0ebeb2403 100644
+index 7f7a622..0ebeb24 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -194,6 +194,19 @@ struct mt7996_twt_flow {
@@ -360,7 +360,7 @@
  void mt7996_dma_reset(struct mt7996_dev *dev, bool force);
  void mt7996_dma_prefetch(struct mt7996_dev *dev);
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 95d3bde03..9fa4edcd6 100644
+index 95d3bde..9fa4edc 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
 @@ -434,7 +434,7 @@ mt7996_tm_set_tx_cont(struct mt7996_phy *phy, bool en)
@@ -550,7 +550,7 @@
  	cal_idx = le32_to_cpu(data->cal_idx);
  	cal_type = le32_to_cpu(data->cal_type);
 diff --git a/testmode.c b/testmode.c
-index b9f710970..2dd184e48 100644
+index b9f7109..2dd184e 100644
 --- a/testmode.c
 +++ b/testmode.c
 @@ -37,6 +37,11 @@ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
@@ -593,5 +593,5 @@
  		return;
  	}
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0050-mtk-wifi-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0049-mtk-wifi-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for.patch
similarity index 88%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0050-mtk-wifi-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0049-mtk-wifi-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for.patch
index 152574e..5145ced 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0050-mtk-wifi-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0049-mtk-wifi-mt76-mt7996-assign-DEAUTH-to-ALTX-queue-for.patch
@@ -1,7 +1,7 @@
-From 77ec17101af8185206e06bc70fce00fd9b1d178f Mon Sep 17 00:00:00 2001
+From 6eb483091a4f12b40d201fb2a896a0499ea41100 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Tue, 14 Nov 2023 11:27:06 +0800
-Subject: [PATCH 050/116] mtk: wifi: mt76: mt7996: assign DEAUTH to ALTX queue
+Subject: [PATCH 049/116] mtk: wifi: mt76: mt7996: assign DEAUTH to ALTX queue
  for CERT
 
 Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
@@ -10,7 +10,7 @@
  1 file changed, 10 insertions(+)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 70f0c56cc..727d1fb80 100644
+index 70f0c56..727d1fb 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -753,6 +753,8 @@ static void
@@ -38,5 +38,5 @@
  	    mgmt->u.action.category == WLAN_CATEGORY_BACK &&
  	    mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ)
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0051-mtk-wifi-mt76-mt7996-add-no_beacon-vendor-command-fo.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0050-mtk-wifi-mt76-mt7996-add-no_beacon-vendor-command-fo.patch
similarity index 94%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0051-mtk-wifi-mt76-mt7996-add-no_beacon-vendor-command-fo.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0050-mtk-wifi-mt76-mt7996-add-no_beacon-vendor-command-fo.patch
index d7cc7f3..bc472fd 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0051-mtk-wifi-mt76-mt7996-add-no_beacon-vendor-command-fo.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0050-mtk-wifi-mt76-mt7996-add-no_beacon-vendor-command-fo.patch
@@ -1,7 +1,7 @@
-From 0eb032654d67a0afcd486a730270bc7e069e1f99 Mon Sep 17 00:00:00 2001
+From 2fadd891ed50fdb0ba643748abec7d576ff65945 Mon Sep 17 00:00:00 2001
 From: MeiChia Chiu <meichia.chiu@mediatek.com>
 Date: Wed, 22 Nov 2023 22:42:09 +0800
-Subject: [PATCH 051/116] mtk: wifi: mt76: mt7996: add no_beacon vendor command
+Subject: [PATCH 050/116] mtk: wifi: mt76: mt7996: add no_beacon vendor command
  for cert
 
 Add the vendor command to disable/enable beacon
@@ -21,7 +21,7 @@
  4 files changed, 65 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 3e92a2742..2b12d5c12 100644
+index 528bce8..b5c6638 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -5100,4 +5100,15 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
@@ -41,7 +41,7 @@
 +}
  #endif
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 0ebeb2403..1bba5450f 100644
+index 0ebeb24..1bba545 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -835,6 +835,7 @@ void mt7996_set_wireless_amsdu(struct ieee80211_hw *hw, u8 en);
@@ -53,7 +53,7 @@
  
  int mt7996_mcu_edcca_enable(struct mt7996_phy *phy, bool enable);
 diff --git a/mt7996/vendor.c b/mt7996/vendor.c
-index ba00ef359..31688c373 100644
+index ba00ef3..31688c3 100644
 --- a/mt7996/vendor.c
 +++ b/mt7996/vendor.c
 @@ -113,6 +113,11 @@ background_radar_ctrl_policy[NUM_MTK_VENDOR_ATTRS_BACKGROUND_RADAR_CTRL] = {
@@ -119,7 +119,7 @@
  
  void mt7996_vendor_register(struct mt7996_phy *phy)
 diff --git a/mt7996/vendor.h b/mt7996/vendor.h
-index 7c812f914..0d1ef3228 100644
+index 7c812f9..0d1ef32 100644
 --- a/mt7996/vendor.h
 +++ b/mt7996/vendor.h
 @@ -16,6 +16,7 @@ enum mtk_nl80211_vendor_subcmds {
@@ -149,5 +149,5 @@
  
  #endif
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0052-mtk-wifi-mt76-mt7996-add-adie-efuse-merge-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0051-mtk-wifi-mt76-mt7996-add-adie-efuse-merge-support.patch
similarity index 96%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0052-mtk-wifi-mt76-mt7996-add-adie-efuse-merge-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0051-mtk-wifi-mt76-mt7996-add-adie-efuse-merge-support.patch
index f9ea292..4403909 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0052-mtk-wifi-mt76-mt7996-add-adie-efuse-merge-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0051-mtk-wifi-mt76-mt7996-add-adie-efuse-merge-support.patch
@@ -1,7 +1,7 @@
-From f33f7b6e8e9f4b8af0b9c7d4de2726556c45c566 Mon Sep 17 00:00:00 2001
+From 571a367ee2ab7e447b7126bb05f778ec4ffdb3d0 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 24 Nov 2023 09:49:08 +0800
-Subject: [PATCH 052/116] mtk: wifi: mt76: mt7996: add adie efuse merge support
+Subject: [PATCH 051/116] mtk: wifi: mt76: mt7996: add adie efuse merge support
 
 Merge adie-dependent parameters in efuse into eeprom after FT.
 Note that Eagle BE14000 is not considered yet.
@@ -16,7 +16,7 @@
  4 files changed, 195 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 3074202bb..f3a520bef 100644
+index 3074202..f3a520b 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -894,6 +894,46 @@ DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_muru_disable,
@@ -75,7 +75,7 @@
  	if (phy->mt76->cap.has_5ghz) {
  		debugfs_create_u32("dfs_hw_pattern", 0400, dir,
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 215d81e31..3cdd58529 100644
+index 215d81e..3cdd585 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -496,6 +496,146 @@ static int mt7996_eeprom_load_precal(struct mt7996_dev *dev)
@@ -237,7 +237,7 @@
  	if (ret < 0)
  		return ret;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 2b12d5c12..6053242cd 100644
+index b5c6638..1a904e4 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -3606,7 +3606,7 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf)
@@ -265,7 +265,7 @@
  
  int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num)
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 9fa4edcd6..784a8bea4 100644
+index 9fa4edc..784a8be 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
 @@ -2116,8 +2116,12 @@ mt7996_tm_write_back_to_efuse(struct mt7996_dev *dev)
@@ -284,5 +284,5 @@
  		if (!memcmp(req.data, read_buf, MT76_TM_EEPROM_BLOCK_SIZE))
  			continue;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0053-mtk-wifi-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0052-mtk-wifi-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch
similarity index 94%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0053-mtk-wifi-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0052-mtk-wifi-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch
index 755a238..1ab4d7d 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0053-mtk-wifi-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0052-mtk-wifi-mt7996-add-Eagle-2adie-TBTC-BE14000-support.patch
@@ -1,7 +1,7 @@
-From bc31813e3f470888713d7072e2563cc1562c27a8 Mon Sep 17 00:00:00 2001
+From eafc607f276a54844224670c0fff6b92ebe5af09 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 5 Dec 2023 16:48:33 +0800
-Subject: [PATCH 053/116] mtk: wifi: mt7996: add Eagle 2adie TBTC (BE14000)
+Subject: [PATCH 052/116] mtk: wifi: mt7996: add Eagle 2adie TBTC (BE14000)
  support
 
 Add fwdl/default eeprom load support for Eagle 2 adie TBTC
@@ -22,7 +22,7 @@
  6 files changed, 38 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 3cdd58529..5eb862914 100644
+index 3cdd585..5eb8629 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -158,6 +158,8 @@ const char *mt7996_eeprom_name(struct mt7996_dev *dev)
@@ -62,7 +62,7 @@
  			eep_offs[1] = eep_offs_list[ADIE_7977];
  		}
 diff --git a/mt7996/eeprom.h b/mt7996/eeprom.h
-index fa9c31e7a..43c9783c0 100644
+index fa9c31e..43c9783 100644
 --- a/mt7996/eeprom.h
 +++ b/mt7996/eeprom.h
 @@ -70,6 +70,18 @@ static const u32 mt7996_prek_rev[] = {
@@ -85,7 +85,7 @@
  static const u32 mt7992_prek_rev[] = {
  	[GROUP_SIZE_2G] =			4 * MT_EE_CAL_UNIT,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index d4b0a72eb..cb0032290 100644
+index d4b0a72..cb00322 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -916,6 +916,12 @@ int mt7996_get_chip_sku(struct mt7996_dev *dev)
@@ -102,7 +102,7 @@
  		if (adie_comb <= 1)
  			dev->chip_sku = MT7996_SKU_444;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 6053242cd..e70932760 100644
+index 1a904e4..686cdda 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -23,6 +23,11 @@
@@ -118,7 +118,7 @@
  		_fw = MT7996_##name;				\
  		break;						\
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 1bba5450f..72865c8ef 100644
+index 1bba545..72865c8 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -35,6 +35,12 @@
@@ -151,7 +151,7 @@
  
  enum mt7992_sku_type {
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 263737c52..91159c635 100644
+index 263737c..91159c6 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -666,6 +666,7 @@ enum offs_rev {
@@ -163,5 +163,5 @@
  #define MT_PAD_GPIO_ADIE_NUM_7992		BIT(15)
  
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0054-mtk-wifi-mt76-mt7996-add-background-radar-hw-cap-che.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0053-mtk-wifi-mt76-mt7996-add-background-radar-hw-cap-che.patch
similarity index 90%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0054-mtk-wifi-mt76-mt7996-add-background-radar-hw-cap-che.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0053-mtk-wifi-mt76-mt7996-add-background-radar-hw-cap-che.patch
index 1e3131d..12d06e6 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0054-mtk-wifi-mt76-mt7996-add-background-radar-hw-cap-che.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0053-mtk-wifi-mt76-mt7996-add-background-radar-hw-cap-che.patch
@@ -1,7 +1,7 @@
-From c7587ccb5403436628fa4568c4f1aadeb322cb81 Mon Sep 17 00:00:00 2001
+From 189d4baa960d2202e518c3e15c9959524cafc3d0 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 22 Dec 2023 17:27:10 +0800
-Subject: [PATCH 054/116] mtk: wifi: mt76: mt7996: add background radar hw cap
+Subject: [PATCH 053/116] mtk: wifi: mt76: mt7996: add background radar hw cap
  check
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
@@ -12,7 +12,7 @@
  3 files changed, 29 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index f3a520bef..6c5fbc78c 100644
+index f3a520b..6c5fbc7 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -262,6 +262,11 @@ mt7996_rdd_monitor(struct seq_file *s, void *data)
@@ -28,7 +28,7 @@
  		ret = -EINVAL;
  		goto out;
 diff --git a/mt7996/init.c b/mt7996/init.c
-index cb0032290..6430bfa46 100644
+index cb00322..6430bfa 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -404,9 +404,10 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -46,7 +46,7 @@
  				      NL80211_EXT_FEATURE_RADAR_BACKGROUND);
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 72865c8ef..c73701df1 100644
+index 72865c8..c73701d 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -605,6 +605,26 @@ mt7996_band_valid(struct mt7996_dev *dev, u8 band)
@@ -77,5 +77,5 @@
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0055-mtk-wifi-mt76-mt7996-add-fallback-in-case-of-missing.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0054-mtk-wifi-mt76-mt7996-add-fallback-in-case-of-missing.patch
similarity index 91%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0055-mtk-wifi-mt76-mt7996-add-fallback-in-case-of-missing.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0054-mtk-wifi-mt76-mt7996-add-fallback-in-case-of-missing.patch
index 1f6fbdf..35eafe9 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0055-mtk-wifi-mt76-mt7996-add-fallback-in-case-of-missing.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0054-mtk-wifi-mt76-mt7996-add-fallback-in-case-of-missing.patch
@@ -1,7 +1,7 @@
-From 2f7296b87ad9175b6761aa3db3d88a8f67d45fe7 Mon Sep 17 00:00:00 2001
+From 60ed10d23382fef314766291e997d422ef9d9fd5 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 19 Mar 2024 17:33:49 +0800
-Subject: [PATCH 055/116] mtk: wifi: mt76: mt7996: add fallback in case of
+Subject: [PATCH 054/116] mtk: wifi: mt76: mt7996: add fallback in case of
  missing precal data
 
 Align Wi-Fi 6 upstream changes
@@ -15,7 +15,7 @@
  3 files changed, 23 insertions(+), 11 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 5eb862914..9987bdab2 100644
+index 5eb8629..9987bda 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -487,17 +487,31 @@ static int mt7996_eeprom_load_precal(struct mt7996_dev *dev)
@@ -68,7 +68,7 @@
  	ret = mt7996_apply_cal_free_data(dev);
  	if (ret)
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 6430bfa46..c10f6675d 100644
+index 6430bfa..c10f667 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -1010,7 +1010,7 @@ static int mt7996_init_hardware(struct mt7996_dev *dev)
@@ -81,7 +81,7 @@
  		if (ret)
  			return ret;
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 2f1dd0fb7..aef08a882 100644
+index 8e67616..c7cc66e 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -345,7 +345,7 @@ int mt7996_set_channel(struct mt7996_phy *phy)
@@ -94,5 +94,5 @@
  		if (ret)
  			goto out;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0056-mtk-wifi-mt76-mt7996-add-kite-part-number-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0055-mtk-wifi-mt76-mt7996-add-kite-part-number-support.patch
similarity index 94%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0056-mtk-wifi-mt76-mt7996-add-kite-part-number-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0055-mtk-wifi-mt76-mt7996-add-kite-part-number-support.patch
index 1e7ba92..4a4a5f0 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0056-mtk-wifi-mt76-mt7996-add-kite-part-number-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0055-mtk-wifi-mt76-mt7996-add-kite-part-number-support.patch
@@ -1,7 +1,7 @@
-From 8353ce159acb7a91db3d9df1591b1d0882b11063 Mon Sep 17 00:00:00 2001
+From 1b54509046b166213c2e9611d6d4db9d8b42e493 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Wed, 27 Mar 2024 17:50:16 +0800
-Subject: [PATCH 056/116] mtk: wifi: mt76: mt7996: add kite part number support
+Subject: [PATCH 055/116] mtk: wifi: mt76: mt7996: add kite part number support
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -9,7 +9,7 @@
  1 file changed, 23 insertions(+), 12 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 9987bdab2..51455d877 100644
+index 9987bda..51455d8 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -316,26 +316,39 @@ out:
@@ -88,5 +88,5 @@
  }
  
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0057-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0056-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
similarity index 97%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0057-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0056-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
index 81dd482..b8213cd 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0057-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0056-mtk-wifi-mt76-revert-page_poll-for-kernel-5.4.patch
@@ -1,10 +1,9 @@
-From 7883011e4646c3c69b1f181d3a7de98e811c68fb Mon Sep 17 00:00:00 2001
+From f4f100bea5c4e42cfd7f815555be0a6efc79aaba Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Feb 2023 19:49:22 +0800
-Subject: [PATCH 057/116] mtk: wifi: mt76: revert page_poll for kernel 5.4
+Subject: [PATCH 056/116] mtk: wifi: mt76: revert page_poll for kernel 5.4
 
 This reverts commit e8c10835cf062c577ddf426913788c39d30b4bd7.
-
 ---
  dma.c         | 75 ++++++++++++++++++++++++++-------------------------
  mac80211.c    | 56 --------------------------------------
@@ -15,7 +14,7 @@
  6 files changed, 104 insertions(+), 168 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 66c000ef0..33a84f5fa 100644
+index 66c000e..33a84f5 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -178,7 +178,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
@@ -204,10 +203,10 @@
  
  	if (mtk_wed_device_active(&dev->mmio.wed))
 diff --git a/mac80211.c b/mac80211.c
-index 8091a60e0..f7b9ba6a0 100644
+index de0a398..a050d0a 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -565,47 +565,6 @@ void mt76_unregister_phy(struct mt76_phy *phy)
+@@ -566,47 +566,6 @@ void mt76_unregister_phy(struct mt76_phy *phy)
  }
  EXPORT_SYMBOL_GPL(mt76_unregister_phy);
  
@@ -255,7 +254,7 @@
  struct mt76_dev *
  mt76_alloc_device(struct device *pdev, unsigned int size,
  		  const struct ieee80211_ops *ops,
-@@ -1818,21 +1777,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
+@@ -1819,21 +1778,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
  }
  EXPORT_SYMBOL_GPL(mt76_ethtool_worker);
  
@@ -278,7 +277,7 @@
  {
  	struct ieee80211_hw *hw = phy->hw;
 diff --git a/mt76.h b/mt76.h
-index 11cbb2d28..e21c6537f 100644
+index 8b17dfb..fd6eab5 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -251,7 +251,7 @@ struct mt76_queue {
@@ -325,7 +324,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7915/main.c b/mt7915/main.c
-index b16a63366..ad91fc3c8 100644
+index b16a633..ad91fc3 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -1402,22 +1402,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
@@ -383,7 +382,7 @@
  
  static void
 diff --git a/usb.c b/usb.c
-index dc690d1cd..058f2d124 100644
+index dc690d1..058f2d1 100644
 --- a/usb.c
 +++ b/usb.c
 @@ -319,27 +319,29 @@ mt76u_set_endpoints(struct usb_interface *intf,
@@ -517,7 +516,7 @@
  
  static void mt76u_free_rx(struct mt76_dev *dev)
 diff --git a/wed.c b/wed.c
-index f89e45375..8eca4d818 100644
+index f89e453..8eca4d8 100644
 --- a/wed.c
 +++ b/wed.c
 @@ -9,8 +9,12 @@
@@ -614,5 +613,5 @@
  
  	return -ENOMEM;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0058-mtk-wifi-mt76-rework-wed-rx-flow.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0057-mtk-wifi-mt76-rework-wed-rx-flow.patch
similarity index 96%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0058-mtk-wifi-mt76-rework-wed-rx-flow.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0057-mtk-wifi-mt76-rework-wed-rx-flow.patch
index a2bfd4f..b8f0a0d 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0058-mtk-wifi-mt76-rework-wed-rx-flow.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0057-mtk-wifi-mt76-rework-wed-rx-flow.patch
@@ -1,7 +1,7 @@
-From ce4b2f430de33a73028d24acac09c0db3ce335e6 Mon Sep 17 00:00:00 2001
+From 9874e44657b18d1c2c225506ce9f7a985fd9b94a Mon Sep 17 00:00:00 2001
 From: Bo Jiao <Bo.Jiao@mediatek.com>
 Date: Mon, 6 Feb 2023 13:37:23 +0800
-Subject: [PATCH 058/116] mtk: wifi: mt76: rework wed rx flow
+Subject: [PATCH 057/116] mtk: wifi: mt76: rework wed rx flow
 
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 ---
@@ -15,7 +15,7 @@
  7 files changed, 144 insertions(+), 85 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 33a84f5fa..c54187bd6 100644
+index 33a84f5..c54187b 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -64,17 +64,17 @@ mt76_alloc_txwi(struct mt76_dev *dev)
@@ -259,10 +259,10 @@
  					 DMA_FROM_DEVICE);
  			skb_free_frag(buf);
 diff --git a/mac80211.c b/mac80211.c
-index f7b9ba6a0..c7b222837 100644
+index a050d0a..3c2c2af 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -595,7 +595,6 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
+@@ -596,7 +596,6 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
  	spin_lock_init(&dev->lock);
  	spin_lock_init(&dev->cc_lock);
  	spin_lock_init(&dev->status_lock);
@@ -270,7 +270,7 @@
  	mutex_init(&dev->mutex);
  	init_waitqueue_head(&dev->tx_wait);
  
-@@ -628,6 +627,7 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
+@@ -629,6 +628,7 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
  	INIT_LIST_HEAD(&dev->txwi_cache);
  	INIT_LIST_HEAD(&dev->rxwi_cache);
  	dev->token_size = dev->drv->token_size;
@@ -279,7 +279,7 @@
  	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
  		skb_queue_head_init(&dev->rx_skb[i]);
 diff --git a/mt76.h b/mt76.h
-index e21c6537f..aecd0a7cd 100644
+index fd6eab5..2ad5a3f 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -205,6 +205,7 @@ struct mt76_queue_entry {
@@ -352,7 +352,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 6004d64f5..5938bd9f2 100644
+index 6004d64..5938bd9 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -714,7 +714,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
@@ -373,7 +373,7 @@
  		.tx_complete_skb = mt76_connac_tx_complete_skb,
  		.rx_skb = mt7915_queue_rx_skb,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index a30d08eb0..f1e2c93a4 100644
+index a30d08e..f1e2c93 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -62,6 +62,7 @@
@@ -385,7 +385,7 @@
  #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
  #define MT7915_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
 diff --git a/tx.c b/tx.c
-index ab42f69b8..46dae6e0a 100644
+index ab42f69..46dae6e 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -851,16 +851,16 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
@@ -430,7 +430,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_rx_token_release);
 diff --git a/wed.c b/wed.c
-index 8eca4d818..0a0b5c05c 100644
+index 8eca4d8..0a0b5c0 100644
 --- a/wed.c
 +++ b/wed.c
 @@ -9,28 +9,45 @@
@@ -537,5 +537,5 @@
  		}
  
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0059-mtk-wifi-mt76-wed-change-wed-token-init-size-to-adap.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0058-mtk-wifi-mt76-wed-change-wed-token-init-size-to-adap.patch
similarity index 83%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0059-mtk-wifi-mt76-wed-change-wed-token-init-size-to-adap.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0058-mtk-wifi-mt76-wed-change-wed-token-init-size-to-adap.patch
index 9634bc9..86ecb66 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0059-mtk-wifi-mt76-wed-change-wed-token-init-size-to-adap.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0058-mtk-wifi-mt76-wed-change-wed-token-init-size-to-adap.patch
@@ -1,7 +1,7 @@
-From d4491420eea3a761e14335aa8bd57eb1b9deee51 Mon Sep 17 00:00:00 2001
+From e5bfc7a288ec62f00e1bb7da03646268ba1b67d2 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Wed, 19 Apr 2023 17:13:41 +0800
-Subject: [PATCH 059/116] mtk: wifi: mt76: wed: change wed token init size to
+Subject: [PATCH 058/116] mtk: wifi: mt76: wed: change wed token init size to
  adapt wed3.0
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
@@ -10,7 +10,7 @@
  1 file changed, 7 insertions(+), 3 deletions(-)
 
 diff --git a/tx.c b/tx.c
-index 46dae6e0a..e2795067c 100644
+index 46dae6e..e279506 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -827,12 +827,16 @@ EXPORT_SYMBOL_GPL(__mt76_set_tx_blocked);
@@ -34,5 +34,5 @@
  
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0060-mtk-wifi-mt76-add-random-early-drop-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0059-mtk-wifi-mt76-add-random-early-drop-support.patch
similarity index 95%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0060-mtk-wifi-mt76-add-random-early-drop-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0059-mtk-wifi-mt76-add-random-early-drop-support.patch
index ace759b..342f2ce 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0060-mtk-wifi-mt76-add-random-early-drop-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0059-mtk-wifi-mt76-add-random-early-drop-support.patch
@@ -1,7 +1,7 @@
-From 6441b05d35d5b721fa16f6d529a1ca3be225ca26 Mon Sep 17 00:00:00 2001
+From 4b0b49bb26433a9d8a62cd37c66fbba548d9aee7 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Wed, 19 Apr 2023 18:32:41 +0800
-Subject: [PATCH 060/116] mtk: wifi: mt76: add random early drop support
+Subject: [PATCH 059/116] mtk: wifi: mt76: add random early drop support
 
 ---
  mt7996/debugfs.c     |  1 +
@@ -15,7 +15,7 @@
  8 files changed, 167 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 6c5fbc78c..8d639372e 100644
+index 6c5fbc7..8d63937 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -634,6 +634,7 @@ mt7996_tx_stats_show(struct seq_file *file, void *data)
@@ -27,7 +27,7 @@
  	mt7996_txbf_stat_read_phy(phy, file);
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 727d1fb80..78e35aa6b 100644
+index 727d1fb..78e35aa 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -1176,6 +1176,13 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
@@ -45,7 +45,7 @@
  		}
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index e70932760..3205f0f72 100644
+index 686cdda..f745139 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -3147,8 +3147,8 @@ int mt7996_mcu_init_firmware(struct mt7996_dev *dev)
@@ -144,7 +144,7 @@
  {
  	struct {
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index f5e91a898..ca78cd506 100644
+index f5e91a8..ca78cd5 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -346,8 +346,9 @@ enum {
@@ -167,7 +167,7 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index c73701df1..453d22462 100644
+index c73701d..453d224 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -354,6 +354,7 @@ struct mt7996_phy {
@@ -201,7 +201,7 @@
 -
  #endif
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index c7713e8b2..28b920e11 100644
+index c1b665f..ff84d6f 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -3074,6 +3074,27 @@ static int mt7996_muru_prot_thr_set(void *data, u64 val)
@@ -242,7 +242,7 @@
  	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
  	debugfs_create_file("scs_enable", 0200, dir, phy, &fops_scs_enable);
 diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
-index a9a7db15a..aed32e982 100644
+index a9a7db1..aed32e9 100644
 --- a/mt7996/mtk_mcu.c
 +++ b/mt7996/mtk_mcu.c
 @@ -1316,4 +1316,30 @@ void mt7996_mcu_set_cert(struct mt7996_phy *phy, u8 type)
@@ -277,7 +277,7 @@
 +
  #endif
 diff --git a/mt7996/mtk_mcu.h b/mt7996/mtk_mcu.h
-index 58d61c517..2cffc8937 100644
+index 58d61c5..2cffc89 100644
 --- a/mt7996/mtk_mcu.h
 +++ b/mt7996/mtk_mcu.h
 @@ -1138,6 +1138,30 @@ enum muru_vendor_ctrl {
@@ -312,5 +312,5 @@
  
  #endif
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0061-mtk-wifi-mt76-mt7996-reset-addr_elem-when-delete-ba.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0060-mtk-wifi-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
similarity index 89%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0061-mtk-wifi-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0060-mtk-wifi-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
index 8bd6c0e..96dff48 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0061-mtk-wifi-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0060-mtk-wifi-mt76-mt7996-reset-addr_elem-when-delete-ba.patch
@@ -1,7 +1,7 @@
-From 86ac4d3c181a20f2cf093d2502d8a6e4f1054a3d Mon Sep 17 00:00:00 2001
+From 7328175da3d5b1a42c26d1f7fd34fe6c278d22ca Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 18 May 2023 15:01:47 +0800
-Subject: [PATCH 061/116] mtk: wifi: mt76: mt7996: reset addr_elem when delete
+Subject: [PATCH 060/116] mtk: wifi: mt76: mt7996: reset addr_elem when delete
  ba
 
 The old addr element info may be used when the signature is not equel to
@@ -20,7 +20,7 @@
  2 files changed, 47 insertions(+)
 
 diff --git a/mt76.h b/mt76.h
-index aecd0a7cd..b3a5f9c12 100644
+index 2ad5a3f..37ef803 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -444,6 +444,7 @@ struct mt76_rx_tid {
@@ -32,7 +32,7 @@
  	u8 started:1, stopped:1, timer_pending:1;
  
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index ca78cd506..3c4ff7a5c 100644
+index ca78cd5..3c4ff7a 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -298,6 +298,52 @@ struct mt7996_mcu_thermal_notify {
@@ -89,5 +89,5 @@
  	UNI_MIB_OBSS_AIRTIME = 26,
  	UNI_MIB_NON_WIFI_TIME = 27,
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0062-mtk-wifi-mt76-wed-change-pcie0-R5-to-pcie1-to-get-6G.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0061-mtk-wifi-mt76-wed-change-pcie0-R5-to-pcie1-to-get-6G.patch
similarity index 90%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0062-mtk-wifi-mt76-wed-change-pcie0-R5-to-pcie1-to-get-6G.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0061-mtk-wifi-mt76-wed-change-pcie0-R5-to-pcie1-to-get-6G.patch
index 520353f..f70c00d 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0062-mtk-wifi-mt76-wed-change-pcie0-R5-to-pcie1-to-get-6G.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0061-mtk-wifi-mt76-wed-change-pcie0-R5-to-pcie1-to-get-6G.patch
@@ -1,7 +1,7 @@
-From d5ccc55676b9a010e69111f73ecea5d2305c17f5 Mon Sep 17 00:00:00 2001
+From 51653708b92be73f1bd4a79ca11eaa3cb181ee4b Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Fri, 6 Oct 2023 14:01:41 +0800
-Subject: [PATCH 062/116] mtk: wifi: mt76: wed: change pcie0 R5 to pcie1 to get
+Subject: [PATCH 061/116] mtk: wifi: mt76: wed: change pcie0 R5 to pcie1 to get
  6G ICS
 
 ---
@@ -11,7 +11,7 @@
  3 files changed, 10 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index 759a58e8e..5d85e9ea2 100644
+index 759a58e..5d85e9e 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
 @@ -538,6 +538,10 @@ int mt7996_dma_init(struct mt7996_dev *dev)
@@ -26,7 +26,7 @@
  				       MT_RXQ_ID(MT_RXQ_BAND2),
  				       MT7996_RX_RING_SIZE,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index c10f6675d..de5122f7d 100644
+index c10f667..de5122f 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -649,10 +649,8 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
@@ -43,7 +43,7 @@
  
  	return 0;
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 8fe56ed96..a082ccae8 100644
+index 8fe56ed..a082cca 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -527,12 +527,15 @@ static void mt7996_irq_tasklet(struct tasklet_struct *t)
@@ -64,5 +64,5 @@
  		mt76_wr(dev, MT_INT_MASK_CSR, 0);
  		if (dev->hif2)
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0063-mtk-wifi-mt76-add-SER-support-for-wed3.0.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0062-mtk-wifi-mt76-add-SER-support-for-wed3.0.patch
similarity index 80%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0063-mtk-wifi-mt76-add-SER-support-for-wed3.0.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0062-mtk-wifi-mt76-add-SER-support-for-wed3.0.patch
index aa28894..9653eac 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0063-mtk-wifi-mt76-add-SER-support-for-wed3.0.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0062-mtk-wifi-mt76-add-SER-support-for-wed3.0.patch
@@ -1,7 +1,7 @@
-From 8697ea1b612b2c57459b12b2fdd812d6dd31dd18 Mon Sep 17 00:00:00 2001
+From a666507a58b47e007ea1396d35941598a398cdc9 Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Tue, 23 May 2023 12:06:29 +0800
-Subject: [PATCH 063/116] mtk: wifi: mt76: add SER support for wed3.0
+Subject: [PATCH 062/116] mtk: wifi: mt76: add SER support for wed3.0
 
 ---
  dma.c         | 5 +++--
@@ -9,7 +9,7 @@
  2 files changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index c54187bd6..e5be891cb 100644
+index c54187b..e5be891 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -834,8 +834,9 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
@@ -25,7 +25,7 @@
  		mt76_dma_rx_fill(dev, q, false);
  	}
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index a082ccae8..d29579ff5 100644
+index a082cca..d29579f 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -297,6 +297,7 @@ out:
@@ -37,5 +37,5 @@
  
  int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0064-mtk-wifi-mt76-mt7915-wed-find-rx-token-by-physical-a.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0063-mtk-wifi-mt76-mt7915-wed-find-rx-token-by-physical-a.patch
similarity index 90%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0064-mtk-wifi-mt76-mt7915-wed-find-rx-token-by-physical-a.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0063-mtk-wifi-mt76-mt7915-wed-find-rx-token-by-physical-a.patch
index bdad93c..e40c8a0 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0064-mtk-wifi-mt76-mt7915-wed-find-rx-token-by-physical-a.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0063-mtk-wifi-mt76-mt7915-wed-find-rx-token-by-physical-a.patch
@@ -1,7 +1,7 @@
-From d810c1768039fafabea801f2c4a5fc517e8cd68d Mon Sep 17 00:00:00 2001
+From e9774619c3b0871df9bfcb87fb4f268e8799e0c3 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Wed, 19 Jul 2023 10:55:09 +0800
-Subject: [PATCH 064/116] mtk: wifi: mt76: mt7915: wed: find rx token by
+Subject: [PATCH 063/116] mtk: wifi: mt76: mt7915: wed: find rx token by
  physical address
 
 The token id in RxDMAD may be incorrect when it is not the last frame due to
@@ -14,7 +14,7 @@
  1 file changed, 25 insertions(+), 2 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index e5be891cb..1021b3e5d 100644
+index e5be891..1021b3e 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -446,9 +446,32 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
@@ -61,5 +61,5 @@
  
  		if (q->rx_head)
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0065-mtk-wifi-mt76-mt7996-add-dma-mask-limitation.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0064-mtk-wifi-mt76-mt7996-add-dma-mask-limitation.patch
similarity index 87%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0065-mtk-wifi-mt76-mt7996-add-dma-mask-limitation.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0064-mtk-wifi-mt76-mt7996-add-dma-mask-limitation.patch
index b48ad31..ae66519 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0065-mtk-wifi-mt76-mt7996-add-dma-mask-limitation.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0064-mtk-wifi-mt76-mt7996-add-dma-mask-limitation.patch
@@ -1,7 +1,7 @@
-From 4bf3625251b6086c3b57cbef75aa3ef6f3706fe3 Mon Sep 17 00:00:00 2001
+From 947f66954b1b232255697954131532b4f005e7cd Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 20 Jul 2023 10:25:50 +0800
-Subject: [PATCH 065/116] mtk: wifi: mt76: mt7996: add dma mask limitation
+Subject: [PATCH 064/116] mtk: wifi: mt76: mt7996: add dma mask limitation
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
 ---
@@ -10,7 +10,7 @@
  2 files changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 1021b3e5d..da21f6410 100644
+index 1021b3e..da21f64 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -488,7 +488,7 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
@@ -32,7 +32,7 @@
  			break;
  
 diff --git a/wed.c b/wed.c
-index 0a0b5c05c..1c6d53c84 100644
+index 0a0b5c0..1c6d53c 100644
 --- a/wed.c
 +++ b/wed.c
 @@ -65,14 +65,14 @@ u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
@@ -53,5 +53,5 @@
  			mt76_put_rxwi(dev, r);
  			goto unmap;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0066-mtk-wifi-mt76-mt7996-add-per-bss-statistic-info.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0065-mtk-wifi-mt76-mt7996-add-per-bss-statistic-info.patch
similarity index 94%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0066-mtk-wifi-mt76-mt7996-add-per-bss-statistic-info.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0065-mtk-wifi-mt76-mt7996-add-per-bss-statistic-info.patch
index 4089488..48ed97c 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0066-mtk-wifi-mt76-mt7996-add-per-bss-statistic-info.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0065-mtk-wifi-mt76-mt7996-add-per-bss-statistic-info.patch
@@ -1,7 +1,7 @@
-From 313d5480374cccb0d7414913223021cb7f4171d3 Mon Sep 17 00:00:00 2001
+From d86765207c6919af7c0448841f723159b0c1dcab Mon Sep 17 00:00:00 2001
 From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
 Date: Fri, 18 Aug 2023 10:17:08 +0800
-Subject: [PATCH 066/116] mtk: wifi: mt76: mt7996: add per bss statistic info
+Subject: [PATCH 065/116] mtk: wifi: mt76: mt7996: add per bss statistic info
 
 Whenever WED is enabled, unicast traffic might run through HW path.
 As a result, we need to count them using WM event.
@@ -22,7 +22,7 @@
  3 files changed, 37 insertions(+), 5 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index de5122f7d..8b7c27873 100644
+index de5122f..8b7c278 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -401,6 +401,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -34,7 +34,7 @@
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION);
  	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_PROTECTION);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index aef08a882..f97898f5f 100644
+index c7cc66e..801e480 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -265,6 +265,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
@@ -46,7 +46,7 @@
  
  	mt7996_mac_wtbl_update(dev, idx,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 3205f0f72..568e4d45a 100644
+index f745139..a238fdd 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -524,6 +524,27 @@ mt7996_mcu_update_tx_gi(struct rate_info *rate, struct all_sta_trx_rate *mcu_rat
@@ -118,5 +118,5 @@
  		default:
  			break;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0067-mtk-wifi-mt76-mt7996-do-not-report-netdev-stats-on-m.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0066-mtk-wifi-mt76-mt7996-do-not-report-netdev-stats-on-m.patch
similarity index 86%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0067-mtk-wifi-mt76-mt7996-do-not-report-netdev-stats-on-m.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0066-mtk-wifi-mt76-mt7996-do-not-report-netdev-stats-on-m.patch
index fabd025..d86ca2c 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0067-mtk-wifi-mt76-mt7996-do-not-report-netdev-stats-on-m.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0066-mtk-wifi-mt76-mt7996-do-not-report-netdev-stats-on-m.patch
@@ -1,7 +1,7 @@
-From db3c26b1e067aca67455a0246c390dc0271496f3 Mon Sep 17 00:00:00 2001
+From 947b71bb7b65824acf8dbaa984ead4ce638f4005 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 26 Oct 2023 17:27:43 +0800
-Subject: [PATCH 067/116] mtk: wifi: mt76: mt7996: do not report netdev stats
+Subject: [PATCH 066/116] mtk: wifi: mt76: mt7996: do not report netdev stats
  on monitor vif
 
 This fixes the following NULL pointer crash when enabling monitor mode:
@@ -19,7 +19,7 @@
  1 file changed, 3 insertions(+)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 568e4d45a..337bcf559 100644
+index a238fdd..b886644 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -540,6 +540,9 @@ static inline void __mt7996_stat_to_netdev(struct mt76_phy *mphy,
@@ -33,5 +33,5 @@
  		dev_sw_netstats_rx_add(wdev->netdev, rx_packets, rx_bytes);
  	}
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0068-mtk-wifi-mt76-mt7996-add-support-for-HW-ATF.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0067-mtk-wifi-mt76-mt7996-add-support-for-HW-ATF.patch
similarity index 98%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0068-mtk-wifi-mt76-mt7996-add-support-for-HW-ATF.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0067-mtk-wifi-mt76-mt7996-add-support-for-HW-ATF.patch
index ed8a05a..dc84c18 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0068-mtk-wifi-mt76-mt7996-add-support-for-HW-ATF.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0067-mtk-wifi-mt76-mt7996-add-support-for-HW-ATF.patch
@@ -1,7 +1,7 @@
-From 58bd9403132eee4438f9e0b67415d772af324585 Mon Sep 17 00:00:00 2001
+From f5372277983af2dd7cc3416563de0ad06ff6211c Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Mon, 11 Sep 2023 16:35:15 +0800
-Subject: [PATCH 068/116] mtk: wifi: mt76: mt7996: add support for HW-ATF
+Subject: [PATCH 067/116] mtk: wifi: mt76: mt7996: add support for HW-ATF
 
 ---
  mt7996/debugfs.c |  90 ++++++++++++++++
@@ -13,7 +13,7 @@
  6 files changed, 475 insertions(+), 26 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 8d639372e..f8ba573f2 100644
+index 8d63937..f8ba573 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -940,6 +940,91 @@ static const struct file_operations mt7996_efuse_ops = {
@@ -121,7 +121,7 @@
  	if (phy->mt76->cap.has_5ghz) {
  		debugfs_create_u32("dfs_hw_pattern", 0400, dir,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 8b7c27873..c382ded01 100644
+index 8b7c278..c382ded 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -573,6 +573,37 @@ int mt7996_txbf_init(struct mt7996_dev *dev)
@@ -189,7 +189,7 @@
  	if (ret)
  		goto error;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 78e35aa6b..be56abe16 100644
+index 78e35aa..be56abe 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -103,6 +103,7 @@ static void mt7996_mac_sta_poll(struct mt7996_dev *dev)
@@ -220,7 +220,7 @@
  
  		/* get signal strength of resp frames (CTS/BA/ACK) */
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 337bcf559..cde4e0014 100644
+index b886644..ef30d8e 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -2225,34 +2225,37 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
@@ -514,7 +514,7 @@
  void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
  {
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 3c4ff7a5c..700330ab5 100644
+index 3c4ff7a..700330a 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -965,6 +965,7 @@ enum {
@@ -526,7 +526,7 @@
  	UNI_VOW_RX_AT_AIRTIME_CLR_EN = 0x0e,
  	UNI_VOW_RED_ENABLE = 0x18,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 453d22462..c95c12b45 100644
+index 453d224..c95c12b 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -114,6 +114,12 @@
@@ -671,5 +671,5 @@
  u32 mt7996_mac_wtbl_lmac_addr(struct mt7996_dev *dev, u16 wcid, u8 dw);
  bool mt7996_mac_wtbl_update(struct mt7996_dev *dev, int idx, u32 mask);
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0069-mtk-wifi-mt76-mt7996-wed-add-SER0.5-support-w-wed3.0.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0068-mtk-wifi-mt76-mt7996-wed-add-SER0.5-support-w-wed3.0.patch
similarity index 96%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0069-mtk-wifi-mt76-mt7996-wed-add-SER0.5-support-w-wed3.0.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0068-mtk-wifi-mt76-mt7996-wed-add-SER0.5-support-w-wed3.0.patch
index 06890c2..8865ef4 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0069-mtk-wifi-mt76-mt7996-wed-add-SER0.5-support-w-wed3.0.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0068-mtk-wifi-mt76-mt7996-wed-add-SER0.5-support-w-wed3.0.patch
@@ -1,7 +1,7 @@
-From 2285ea8b0ee712928f6980240c0103fcd2a96033 Mon Sep 17 00:00:00 2001
+From 21fac5083443173762f0bda68768acde71e7153e Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Thu, 12 Oct 2023 10:04:54 +0800
-Subject: [PATCH 069/116] mtk: wifi: mt76: mt7996: wed: add SER0.5 support w/
+Subject: [PATCH 068/116] mtk: wifi: mt76: mt7996: wed: add SER0.5 support w/
  wed3.0
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
@@ -18,7 +18,7 @@
  9 files changed, 146 insertions(+), 64 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index da21f6410..e23b744b8 100644
+index da21f64..e23b744 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -218,9 +218,9 @@ void __mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q,
@@ -53,7 +53,7 @@
  	return 0;
  }
 diff --git a/dma.h b/dma.h
-index 1de5a2b20..3a8c2e558 100644
+index 1de5a2b..3a8c2e5 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -83,12 +83,12 @@ int mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
@@ -72,7 +72,7 @@
  		mt76_wed_dma_setup(dev, q, true);
  }
 diff --git a/mt76.h b/mt76.h
-index b3a5f9c12..e9fc37d99 100644
+index 37ef803..9f1f7fc 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -301,7 +301,7 @@ struct mt76_queue_ops {
@@ -111,7 +111,7 @@
  }
  
 diff --git a/mt792x_dma.c b/mt792x_dma.c
-index 5cc2d59b7..c224bcc8a 100644
+index 5cc2d59..c224bcc 100644
 --- a/mt792x_dma.c
 +++ b/mt792x_dma.c
 @@ -181,13 +181,13 @@ mt792x_dma_reset(struct mt792x_dev *dev, bool force)
@@ -132,7 +132,7 @@
  	mt76_tx_status_check(&dev->mt76, true);
  
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index 5d85e9ea2..d9e1b17ff 100644
+index 5d85e9e..d9e1b17 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
 @@ -711,21 +711,31 @@ void mt7996_dma_reset(struct mt7996_dev *dev, bool force)
@@ -173,7 +173,7 @@
  	mt7996_dma_enable(dev, !force);
  }
 diff --git a/mt7996/init.c b/mt7996/init.c
-index c382ded01..ff629e8d8 100644
+index c382ded..ff629e8 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -735,11 +735,91 @@ void mt7996_wfsys_reset(struct mt7996_dev *dev)
@@ -323,7 +323,7 @@
  #else
  	return 0;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index be56abe16..2ad9f4889 100644
+index be56abe..2ad9f48 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -1764,6 +1764,31 @@ mt7996_mac_restart(struct mt7996_dev *dev)
@@ -359,7 +359,7 @@
  	ret = mt7996_mcu_set_eeprom(dev);
  	if (ret)
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index c95c12b45..4090fadfa 100644
+index c95c12b..4090fad 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -718,6 +718,7 @@ extern const struct mt76_testmode_ops mt7996_testmode_ops;
@@ -371,7 +371,7 @@
  u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif);
  int mt7996_register_device(struct mt7996_dev *dev);
 diff --git a/wed.c b/wed.c
-index 1c6d53c84..61a6badf2 100644
+index 1c6d53c..61a6bad 100644
 --- a/wed.c
 +++ b/wed.c
 @@ -155,7 +155,7 @@ int mt76_wed_dma_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
@@ -393,5 +393,5 @@
  		mtk_wed_device_ind_rx_ring_setup(q->wed, q->regs);
  		break;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0070-mtk-wifi-mt76-mt7996-support-backaward-compatiable.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0069-mtk-wifi-mt76-mt7996-support-backaward-compatiable.patch
similarity index 94%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0070-mtk-wifi-mt76-mt7996-support-backaward-compatiable.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0069-mtk-wifi-mt76-mt7996-support-backaward-compatiable.patch
index 1bf962b..8890a59 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0070-mtk-wifi-mt76-mt7996-support-backaward-compatiable.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0069-mtk-wifi-mt76-mt7996-support-backaward-compatiable.patch
@@ -1,7 +1,7 @@
-From d31f86b70ab12fba91854fe3f4188448638f967d Mon Sep 17 00:00:00 2001
+From 099ff0e39f8f83d3d6395db232da68448392b67b Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Fri, 6 Oct 2023 20:59:42 +0800
-Subject: [PATCH 070/116] mtk: wifi: mt76: mt7996: support backaward
+Subject: [PATCH 069/116] mtk: wifi: mt76: mt7996: support backaward
  compatiable
 
 revert upstream wed trigger mode to polling mode
@@ -27,7 +27,7 @@
  7 files changed, 24 insertions(+), 17 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index e9fc37d99..4009e3c61 100644
+index 9f1f7fc..677f68f 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -53,6 +53,8 @@
@@ -40,7 +40,7 @@
  #define MT_QFLAG_WED_TYPE	GENMASK(4, 2)
  #define MT_QFLAG_WED		BIT(5)
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 2ad9f4889..8396e6def 100644
+index 2ad9f48..8396e6d 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -1777,7 +1777,7 @@ mt7996_mac_restart(struct mt7996_dev *dev)
@@ -61,7 +61,7 @@
  		mt7996_irq_disable(dev, 0);
  	}
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index cde4e0014..1a45c31b3 100644
+index ef30d8e..6366cf0 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -3254,7 +3254,7 @@ static int mt7996_mcu_wa_red_config(struct mt7996_dev *dev)
@@ -74,7 +74,7 @@
  	return mt76_mcu_send_msg(&dev->mt76, MCU_WA_PARAM_CMD(SET),
  				 &req, sizeof(req), false);
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index d29579ff5..1c2cea2ec 100644
+index d29579f..1c2cea2 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -14,7 +14,7 @@
@@ -125,7 +125,7 @@
  #else
  	return 0;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 4090fadfa..7011f6659 100644
+index 4090fad..7011f66 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -73,6 +73,7 @@
@@ -137,7 +137,7 @@
  #define MT7996_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
  #define MT7996_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
 diff --git a/mt7996/pci.c b/mt7996/pci.c
-index 05830c01c..4e957771f 100644
+index 05830c0..4e95777 100644
 --- a/mt7996/pci.c
 +++ b/mt7996/pci.c
 @@ -171,7 +171,7 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
@@ -182,7 +182,7 @@
  		if (mtk_wed_device_active(&dev->mt76.mmio.wed_hif2))
  			mtk_wed_device_detach(&dev->mt76.mmio.wed_hif2);
 diff --git a/wed.c b/wed.c
-index 61a6badf2..634c95cf9 100644
+index 61a6bad..634c95c 100644
 --- a/wed.c
 +++ b/wed.c
 @@ -120,7 +120,7 @@ int mt76_wed_offload_enable(struct mtk_wed_device *wed)
@@ -204,5 +204,5 @@
  }
  EXPORT_SYMBOL_GPL(mt76_wed_offload_disable);
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0071-mtk-wifi-mt76-mt7996-wed-add-wed-support-for-mt7992.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0070-mtk-wifi-mt76-mt7996-wed-add-wed-support-for-mt7992.patch
similarity index 97%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0071-mtk-wifi-mt76-mt7996-wed-add-wed-support-for-mt7992.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0070-mtk-wifi-mt76-mt7996-wed-add-wed-support-for-mt7992.patch
index 3454663..2e43a51 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0071-mtk-wifi-mt76-mt7996-wed-add-wed-support-for-mt7992.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0070-mtk-wifi-mt76-mt7996-wed-add-wed-support-for-mt7992.patch
@@ -1,7 +1,7 @@
-From 6764f5f9c24ad031431c80834e293b0d2ec12db5 Mon Sep 17 00:00:00 2001
+From 048688dc31d7f531fc9d99d0e20820189ede9c53 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Fri, 8 Sep 2023 11:57:39 +0800
-Subject: [PATCH 071/116] mtk: wifi: mt76: mt7996: wed: add wed support for
+Subject: [PATCH 070/116] mtk: wifi: mt76: mt7996: wed: add wed support for
  mt7992
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
@@ -20,7 +20,7 @@
  7 files changed, 142 insertions(+), 48 deletions(-)
 
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index d9e1b17ff..d62dc8ba9 100644
+index d9e1b17..d62dc8b 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
 @@ -77,18 +77,23 @@ static void mt7996_dma_config(struct mt7996_dev *dev)
@@ -168,7 +168,7 @@
  		if (mt7996_band_valid(dev, MT_BAND2)) {
  			/* rx rro data queue for band2 */
 diff --git a/mt7996/init.c b/mt7996/init.c
-index ff629e8d8..e29cebeb9 100644
+index ff629e8..e29cebe 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -813,6 +813,7 @@ void mt7996_rro_hw_init(struct mt7996_dev *dev)
@@ -198,7 +198,7 @@
  				  MT7996_RRO_WINDOW_MAX_LEN * sizeof(*addr),
  				  &dev->wed_rro.session.phy_addr,
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 8396e6def..b4703804b 100644
+index 8396e6d..b470380 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -2007,6 +2007,10 @@ void mt7996_mac_reset_work(struct work_struct *work)
@@ -213,7 +213,7 @@
  					    true);
  
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 1c2cea2ec..3f0692c79 100644
+index 1c2cea2..3f0692c 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -313,7 +313,8 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
@@ -305,7 +305,7 @@
  		dev->mt76.rx_token_size = MT7996_TOKEN_SIZE + wed->wlan.rx_npkt;
  	}
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 7011f6659..929a077b9 100644
+index 7011f66..929a077 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -121,6 +121,10 @@
@@ -340,7 +340,7 @@
  		struct work_struct work;
  		struct list_head poll_list;
 diff --git a/mt7996/pci.c b/mt7996/pci.c
-index 4e957771f..f0d3f199c 100644
+index 4e95777..f0d3f19 100644
 --- a/mt7996/pci.c
 +++ b/mt7996/pci.c
 @@ -107,7 +107,7 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
@@ -376,7 +376,7 @@
  			goto free_wed_or_irq_vector;
  
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index 91159c635..e6427a351 100644
+index 91159c6..e6427a3 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -77,6 +77,8 @@ enum offs_rev {
@@ -428,5 +428,5 @@
  #define MT_INT_RX_DONE_RRO_IND			BIT(11)
  #define MT_INT_RX_DONE_MSDU_PG_BAND0		BIT(18)
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0072-mtk-wifi-mt76-mt7992-wed-add-2pcie-one-wed-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0071-mtk-wifi-mt76-mt7992-wed-add-2pcie-one-wed-support.patch
similarity index 96%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0072-mtk-wifi-mt76-mt7992-wed-add-2pcie-one-wed-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0071-mtk-wifi-mt76-mt7992-wed-add-2pcie-one-wed-support.patch
index 3cb13db..cb745f1 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0072-mtk-wifi-mt76-mt7992-wed-add-2pcie-one-wed-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0071-mtk-wifi-mt76-mt7992-wed-add-2pcie-one-wed-support.patch
@@ -1,7 +1,7 @@
-From 435235e314311be77ae5746d1fed1f5a89f0e947 Mon Sep 17 00:00:00 2001
+From 2342f41c5f878f7d419d20a46daa3b025c024b08 Mon Sep 17 00:00:00 2001
 From: "sujuan.chen" <sujuan.chen@mediatek.com>
 Date: Wed, 13 Sep 2023 17:35:43 +0800
-Subject: [PATCH 072/116] mtk: wifi: mt76: mt7992: wed: add 2pcie one wed
+Subject: [PATCH 071/116] mtk: wifi: mt76: mt7992: wed: add 2pcie one wed
  support
 
 Signed-off-by: sujuan.chen <sujuan.chen@mediatek.com>
@@ -14,7 +14,7 @@
  5 files changed, 39 insertions(+), 13 deletions(-)
 
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index d62dc8ba9..c23b0d651 100644
+index d62dc8b..c23b0d6 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
 @@ -355,6 +355,13 @@ static void mt7996_dma_enable(struct mt7996_dev *dev, bool reset)
@@ -55,7 +55,7 @@
  			dev->mt76.q_rx[MT_RXQ_TXFREE_BAND0].wed = wed;
  
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 3f0692c79..91567a04b 100644
+index 3f0692c..91567a0 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -375,10 +375,10 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
@@ -84,7 +84,7 @@
  			mt76_wr(dev, MT_INT_MASK_CSR, mdev->mmio.irqmask);
  			mt76_wr(dev, MT_INT1_MASK_CSR, mdev->mmio.irqmask);
 diff --git a/mt7996/mtk_debug.h b/mt7996/mtk_debug.h
-index 27d8f1cb2..da2a60723 100644
+index 27d8f1c..da2a607 100644
 --- a/mt7996/mtk_debug.h
 +++ b/mt7996/mtk_debug.h
 @@ -561,6 +561,11 @@ struct queue_desc {
@@ -100,7 +100,7 @@
  //#define WF_WFDMA_MCU_DMA0_BASE                                 0x02000
  #define WF_WFDMA_MCU_DMA0_BASE                                 0x54000000
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 28b920e11..27ad9432f 100644
+index ff84d6f..70ff761 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -559,14 +559,22 @@ mt7996_show_dma_info(struct seq_file *s, struct mt7996_dev *dev)
@@ -153,7 +153,7 @@
  
  	/* MCU DMA information */
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index e6427a351..cbd71706c 100644
+index e6427a3..cbd7170 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -411,6 +411,7 @@ enum offs_rev {
@@ -173,5 +173,5 @@
  
  #define MT_WFDMA_EXT_CSR_HIF_MISC		MT_WFDMA_EXT_CSR(0x44)
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0073-mtk-wifi-mt76-mt7996-Remove-wed-rro-ring-add-napi-at.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0072-mtk-wifi-mt76-mt7996-Remove-wed-rro-ring-add-napi-at.patch
similarity index 83%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0073-mtk-wifi-mt76-mt7996-Remove-wed-rro-ring-add-napi-at.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0072-mtk-wifi-mt76-mt7996-Remove-wed-rro-ring-add-napi-at.patch
index 2827342..759ac00 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0073-mtk-wifi-mt76-mt7996-Remove-wed-rro-ring-add-napi-at.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0072-mtk-wifi-mt76-mt7996-Remove-wed-rro-ring-add-napi-at.patch
@@ -1,7 +1,7 @@
-From 4bc413bf6205f65522cc18e00c64773d70faefdf Mon Sep 17 00:00:00 2001
+From 6701c4d78ed81ac7d04b73c213f38f2d3ba1a735 Mon Sep 17 00:00:00 2001
 From: mtk27745 <rex.lu@mediatek.com>
 Date: Mon, 6 Nov 2023 10:16:34 +0800
-Subject: [PATCH 073/116] mtk: wifi: mt76: mt7996: Remove wed rro ring add napi
+Subject: [PATCH 072/116] mtk: wifi: mt76: mt7996: Remove wed rro ring add napi
  at init state
 
 without this patch. rro ring will add napi at initial state. once rro ring add napi, it will have chance to be used by host driver. if host driver accessed the ring data, it will cause some issue.
@@ -12,7 +12,7 @@
  1 file changed, 4 insertions(+)
 
 diff --git a/dma.c b/dma.c
-index e23b744b8..38701c71e 100644
+index e23b744..38701c7 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -1017,6 +1017,10 @@ mt76_dma_init(struct mt76_dev *dev,
@@ -27,5 +27,5 @@
  		mt76_dma_rx_fill(dev, &dev->q_rx[i], false);
  		napi_enable(&dev->napi[i]);
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0074-mtk-wifi-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0073-mtk-wifi-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch
similarity index 83%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0074-mtk-wifi-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0073-mtk-wifi-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch
index ab2490f..4e46bfe 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0074-mtk-wifi-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0073-mtk-wifi-mt76-mt7996-Remove-wed_stop-during-L1-SER.patch
@@ -1,7 +1,7 @@
-From 2287fce6adb7e62918bf06792acb13f1eac3f1f9 Mon Sep 17 00:00:00 2001
+From 86d498b85d7e85f5c75b83a39a17f744357481b7 Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Wed, 29 Nov 2023 13:56:52 +0800
-Subject: [PATCH 074/116] mtk: wifi: mt76: mt7996: Remove wed_stop during L1
+Subject: [PATCH 073/116] mtk: wifi: mt76: mt7996: Remove wed_stop during L1
  SER
 
 Align logan L1 SER flow. During L1 SER, didn't need to close wed interrupt.
@@ -12,7 +12,7 @@
  1 file changed, 6 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index b4703804b..0805251e8 100644
+index b470380..0805251 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -1950,12 +1950,6 @@ void mt7996_mac_reset_work(struct work_struct *work)
@@ -29,5 +29,5 @@
  	if (phy2)
  		ieee80211_stop_queues(phy2->mt76->hw);
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0075-mtk-wifi-mt76-mt7996-Refactor-rro-del-ba-command-for.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0074-mtk-wifi-mt76-mt7996-Refactor-rro-del-ba-command-for.patch
similarity index 89%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0075-mtk-wifi-mt76-mt7996-Refactor-rro-del-ba-command-for.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0074-mtk-wifi-mt76-mt7996-Refactor-rro-del-ba-command-for.patch
index 817d12c..481382a 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0075-mtk-wifi-mt76-mt7996-Refactor-rro-del-ba-command-for.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0074-mtk-wifi-mt76-mt7996-Refactor-rro-del-ba-command-for.patch
@@ -1,7 +1,7 @@
-From 5fd50b8df6409278d15377d1a6b58381e677c080 Mon Sep 17 00:00:00 2001
+From 319c0c7f599ca9835577ccfd91aff59af02b1999 Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Wed, 29 Nov 2023 15:51:04 +0800
-Subject: [PATCH 075/116] mtk: wifi: mt76: mt7996: Refactor rro del ba command
+Subject: [PATCH 074/116] mtk: wifi: mt76: mt7996: Refactor rro del ba command
  format
 
 1. remove unused struct
@@ -13,7 +13,7 @@
  1 file changed, 3 insertions(+), 47 deletions(-)
 
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 700330ab5..a58f52d0c 100644
+index 700330a..a58f52d 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -273,7 +273,9 @@ struct mt7996_mcu_wed_rro_ba_delete_event {
@@ -81,5 +81,5 @@
  	UNI_MIB_OBSS_AIRTIME = 26,
  	UNI_MIB_NON_WIFI_TIME = 27,
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0076-mtk-wifi-mt76-mt7996-get-airtime-and-RSSI-via-MCU-co.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0075-mtk-wifi-mt76-mt7996-get-airtime-and-RSSI-via-MCU-co.patch
similarity index 97%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0076-mtk-wifi-mt76-mt7996-get-airtime-and-RSSI-via-MCU-co.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0075-mtk-wifi-mt76-mt7996-get-airtime-and-RSSI-via-MCU-co.patch
index b395ff5..a553070 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0076-mtk-wifi-mt76-mt7996-get-airtime-and-RSSI-via-MCU-co.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0075-mtk-wifi-mt76-mt7996-get-airtime-and-RSSI-via-MCU-co.patch
@@ -1,7 +1,7 @@
-From 226977cba476d426936788b86986dbf5b8e71920 Mon Sep 17 00:00:00 2001
+From a08f12c4e90f1c849c3e8dc0db60fe294b63f3fe Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Fri, 17 Nov 2023 18:08:06 +0800
-Subject: [PATCH 076/116] mtk: wifi: mt76: mt7996: get airtime and RSSI via MCU
+Subject: [PATCH 075/116] mtk: wifi: mt76: mt7996: get airtime and RSSI via MCU
  commands
 
 Direct access to WTBL for airtime and RSSI may cause synchronization issue with FW.
@@ -23,7 +23,7 @@
  9 files changed, 361 insertions(+), 143 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index 4009e3c61..c3c35841f 100644
+index 677f68f..28defd4 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -332,11 +332,15 @@ struct mt76_sta_stats {
@@ -66,10 +66,10 @@
  mtxq_to_txq(struct mt76_txq *mtxq)
  {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 885e5883e..45fef88b9 100644
+index 61a14a8..f389470 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1369,11 +1369,23 @@ enum {
+@@ -1372,11 +1372,23 @@ enum {
  	UNI_OFFLOAD_OFFLOAD_BMC_RPY_DETECT,
  };
  
@@ -95,7 +95,7 @@
  	UNI_ALL_STA_GI_MODE,
  	UNI_ALL_STA_TXRX_MSDU_COUNT,
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index f8ba573f2..e26de48c6 100644
+index f8ba573..e26de48 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -992,12 +992,11 @@ mt7996_airtime_read(struct seq_file *s, void *data)
@@ -137,7 +137,7 @@
  	rcu_read_unlock();
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 0805251e8..782594cd7 100644
+index 0805251..782594c 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -12,8 +12,6 @@
@@ -326,7 +326,7 @@
  	ieee80211_queue_delayed_work(mphy->hw, &mphy->mac_work,
  				     MT7996_WATCHDOG_TIME);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 1a45c31b3..2bee4a59c 100644
+index 6366cf0..b02303b 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -563,7 +563,8 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
@@ -550,7 +550,7 @@
  }
  
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index a58f52d0c..e64812c6d 100644
+index a58f52d..e64812c 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -199,6 +199,31 @@ struct mt7996_mcu_mib {
@@ -606,7 +606,7 @@
  } __packed;
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 929a077b9..a0cc8f37d 100644
+index 929a077..a0cc8f3 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -125,6 +125,8 @@
@@ -678,7 +678,7 @@
  int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id, u8 data);
  int mt7996_mcu_get_tx_power_info(struct mt7996_phy *phy, u8 category, void *event);
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 27ad9432f..5fb6078c1 100644
+index 70ff761..dab5b23 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -3106,6 +3106,69 @@ mt7996_vow_drr_dbg(void *data, u64 val)
@@ -767,7 +767,7 @@
  }
  
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index cbd71706c..a001d9fd6 100644
+index cbd7170..a001d9f 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -122,6 +122,8 @@ enum offs_rev {
@@ -780,5 +780,5 @@
  #define MT_PLE_BASE				0x820c0000
  #define MT_PLE(ofs)				(MT_PLE_BASE + (ofs))
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0077-mtk-wifi-mt76-mt7996-add-support-for-WMM-PBC-configu.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0076-mtk-wifi-mt76-mt7996-add-support-for-WMM-PBC-configu.patch
similarity index 94%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0077-mtk-wifi-mt76-mt7996-add-support-for-WMM-PBC-configu.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0076-mtk-wifi-mt76-mt7996-add-support-for-WMM-PBC-configu.patch
index 7d6125e..c3b13e6 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0077-mtk-wifi-mt76-mt7996-add-support-for-WMM-PBC-configu.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0076-mtk-wifi-mt76-mt7996-add-support-for-WMM-PBC-configu.patch
@@ -1,7 +1,7 @@
-From e6455a415fefb896c325db624d03725a56eaa3f5 Mon Sep 17 00:00:00 2001
+From b524ec9e1239ff6edd8ffadf8ce9fe03c2621f64 Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Thu, 4 Jan 2024 09:47:00 +0800
-Subject: [PATCH 077/116] mtk: wifi: mt76: mt7996: add support for WMM PBC
+Subject: [PATCH 076/116] mtk: wifi: mt76: mt7996: add support for WMM PBC
  configuration
 
 Query per-AC-queue packet statistics from WA, and determine if multi-AC transmission is ongoing.
@@ -18,10 +18,10 @@
  6 files changed, 105 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 45fef88b9..12fdc6e12 100644
+index f389470..92f0bd7 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1026,6 +1026,7 @@ enum {
+@@ -1027,6 +1027,7 @@ enum {
  	MCU_EXT_EVENT_ASSERT_DUMP = 0x23,
  	MCU_EXT_EVENT_RDD_REPORT = 0x3a,
  	MCU_EXT_EVENT_CSA_NOTIFY = 0x4f,
@@ -29,7 +29,7 @@
  	MCU_EXT_EVENT_WA_TX_STAT = 0x74,
  	MCU_EXT_EVENT_BCC_NOTIFY = 0x75,
  	MCU_EXT_EVENT_MURU_CTRL = 0x9f,
-@@ -1224,6 +1225,7 @@ enum {
+@@ -1226,6 +1227,7 @@ enum {
  	MCU_EXT_CMD_TXDPD_CAL = 0x60,
  	MCU_EXT_CMD_CAL_CACHE = 0x67,
  	MCU_EXT_CMD_RED_ENABLE = 0x68,
@@ -38,7 +38,7 @@
  	MCU_EXT_CMD_SET_RADAR_TH = 0x7c,
  	MCU_EXT_CMD_SET_RDD_PATTERN = 0x7d,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index e29cebeb9..f4111460c 100644
+index e29cebe..f411146 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -1536,6 +1536,8 @@ int mt7996_register_device(struct mt7996_dev *dev)
@@ -51,7 +51,7 @@
  	if (ret)
  		return ret;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 782594cd7..e3758ff13 100644
+index 782594c..e3758ff 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -2298,6 +2298,10 @@ void mt7996_mac_work(struct work_struct *work)
@@ -66,7 +66,7 @@
  			           test_bit(MT76_STATE_RUNNING, &mdev->phys[i]->state))
  				break;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 2bee4a59c..6fb9f81f0 100644
+index b02303b..82ed9e8 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -669,6 +669,82 @@ mt7996_mcu_rx_thermal_notify(struct mt7996_dev *dev, struct sk_buff *skb)
@@ -162,7 +162,7 @@
  		break;
  	}
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index e64812c6d..d24874a4b 100644
+index e64812c..d24874a 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -375,10 +375,25 @@ enum {
@@ -192,7 +192,7 @@
  	MCU_WA_PARAM_RED_CONFIG = 0x40,
  };
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index a0cc8f37d..19965393e 100644
+index a0cc8f3..1996539 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -606,6 +606,9 @@ struct mt7996_dev {
@@ -214,5 +214,5 @@
  static inline u8 mt7996_max_interface_num(struct mt7996_dev *dev)
  {
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0078-mtk-wifi-mt76-mt7996-eagle-support-extra-option_type.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0077-mtk-wifi-mt76-mt7996-eagle-support-extra-option_type.patch
similarity index 96%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0078-mtk-wifi-mt76-mt7996-eagle-support-extra-option_type.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0077-mtk-wifi-mt76-mt7996-eagle-support-extra-option_type.patch
index e0cae7d..658e5f7 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0078-mtk-wifi-mt76-mt7996-eagle-support-extra-option_type.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0077-mtk-wifi-mt76-mt7996-eagle-support-extra-option_type.patch
@@ -1,7 +1,7 @@
-From 2d0f8b5d4e08fb55a6e9ea3f05faab7afbfd65a1 Mon Sep 17 00:00:00 2001
+From 0749ce8ea6a89c47f1e5b1a85ad5dfcd8fc4dc02 Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Thu, 1 Feb 2024 10:32:42 +0800
-Subject: [PATCH 078/116] mtk: wifi: mt76: mt7996: eagle support extra
+Subject: [PATCH 077/116] mtk: wifi: mt76: mt7996: eagle support extra
  option_type
 
 1. eagle + mt7988d option_type 2 support
@@ -23,7 +23,7 @@
  6 files changed, 123 insertions(+), 22 deletions(-)
 
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index c23b0d651..3dc0e8a1d 100644
+index c23b0d6..3dc0e8a 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
 @@ -12,12 +12,20 @@ int mt7996_init_tx_queues(struct mt7996_phy *phy, int idx, int n_desc,
@@ -111,7 +111,7 @@
  		mt76_wr(dev, MT_WFDMA0_PAUSE_RX_Q_45_TH + hif1_ofs, 0xc000c);
  		mt76_wr(dev, MT_WFDMA0_PAUSE_RX_Q_67_TH + hif1_ofs, 0x10008);
 diff --git a/mt7996/init.c b/mt7996/init.c
-index f4111460c..1e7cd5235 100644
+index f411146..1e7cd52 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -511,7 +511,7 @@ static void mt7996_mac_init_basic_rates(struct mt7996_dev *dev)
@@ -216,7 +216,7 @@
  	mt76_wr(dev, MT_INT_SOURCE_CSR, ~0);
  	if (is_mt7992(&dev->mt76)) {
 diff --git a/mt7996/main.c b/mt7996/main.c
-index f97898f5f..445f86221 100644
+index 801e480..1894588 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1606,8 +1606,19 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
@@ -242,7 +242,7 @@
  	if (!mtk_wed_device_active(wed))
  		return -ENODEV;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 19965393e..3f1f9b362 100644
+index 1996539..3f1f9b3 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -8,6 +8,7 @@
@@ -272,7 +272,7 @@
  	u8 fw_debug_wm;
  	u8 fw_debug_wa;
 diff --git a/mt7996/pci.c b/mt7996/pci.c
-index f0d3f199c..24d69d4dc 100644
+index f0d3f19..24d69d4 100644
 --- a/mt7996/pci.c
 +++ b/mt7996/pci.c
 @@ -5,7 +5,6 @@
@@ -292,7 +292,7 @@
  	list_add(&hif->list, &hif_list);
  	spin_unlock_bh(&hif_lock);
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index a001d9fd6..a0e4b3e11 100644
+index a001d9f..a0e4b3e 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -435,6 +435,7 @@ enum offs_rev {
@@ -322,5 +322,5 @@
  #define MT_PCIE_RECOG_ID_MASK			GENMASK(30, 0)
  #define MT_PCIE_RECOG_ID_SEM			BIT(31)
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0079-mtk-wifi-mt76-mt7996-support-enable-disable-thermal-.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0078-mtk-wifi-mt76-mt7996-support-enable-disable-thermal-.patch
similarity index 92%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0079-mtk-wifi-mt76-mt7996-support-enable-disable-thermal-.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0078-mtk-wifi-mt76-mt7996-support-enable-disable-thermal-.patch
index 56ae4e8..90ce5bf 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0079-mtk-wifi-mt76-mt7996-support-enable-disable-thermal-.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0078-mtk-wifi-mt76-mt7996-support-enable-disable-thermal-.patch
@@ -1,7 +1,7 @@
-From d3513854d4eaa55fabcef09ed6841ee817b00851 Mon Sep 17 00:00:00 2001
+From 4ced99d2b25f8804f194317675f3a7cce0f493b2 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 27 Jul 2023 19:35:32 +0800
-Subject: [PATCH 079/116] mtk: wifi: mt76: mt7996: support enable/disable
+Subject: [PATCH 078/116] mtk: wifi: mt76: mt7996: support enable/disable
  thermal protection mechanism
 
 This commit adds a new debugfs thermal_enable to enable/disable thermal
@@ -24,7 +24,7 @@
  3 files changed, 47 insertions(+)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 445f86221..f7ea49f18 100644
+index 1894588..775d81e 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -91,6 +91,7 @@ int mt7996_run(struct ieee80211_hw *hw)
@@ -36,7 +36,7 @@
  	ret = mt7996_mcu_set_tx_power_ctrl(phy, UNI_TXPOWER_SKU_POWER_LIMIT_CTRL,
  						dev->dbg.sku_disable ? 0 : phy->sku_limit_en);
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 3f1f9b362..3069e9070 100644
+index 3f1f9b3..3069e90 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -488,6 +488,7 @@ struct mt7996_phy {
@@ -48,7 +48,7 @@
  };
  
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index 5fb6078c1..ee72c0e51 100644
+index dab5b23..de21a95 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -3169,6 +3169,49 @@ mt7996_show_rro_mib(struct seq_file *s, void *data)
@@ -111,5 +111,5 @@
  }
  
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0080-mtk-wifi-mt76-mt7996-support-thermal-recal-debug-com.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0079-mtk-wifi-mt76-mt7996-support-thermal-recal-debug-com.patch
similarity index 91%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0080-mtk-wifi-mt76-mt7996-support-thermal-recal-debug-com.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0079-mtk-wifi-mt76-mt7996-support-thermal-recal-debug-com.patch
index 15694fa..bf9ce92 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0080-mtk-wifi-mt76-mt7996-support-thermal-recal-debug-com.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0079-mtk-wifi-mt76-mt7996-support-thermal-recal-debug-com.patch
@@ -1,7 +1,7 @@
-From 5c0d266ff3446fe53d2fa9203e930350607ab7dc Mon Sep 17 00:00:00 2001
+From 5a95bf563b00a4d60292580619c8bc041697b548 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Thu, 4 Jan 2024 19:53:37 +0800
-Subject: [PATCH 080/116] mtk: wifi: mt76: mt7996: support thermal recal debug
+Subject: [PATCH 079/116] mtk: wifi: mt76: mt7996: support thermal recal debug
  command
 
 Add support thermal recal debug command.
@@ -23,10 +23,10 @@
  4 files changed, 40 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 12fdc6e12..151183d08 100644
+index 92f0bd7..c19f8e0 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1285,6 +1285,7 @@ enum {
+@@ -1287,6 +1287,7 @@ enum {
  	MCU_UNI_CMD_TESTMODE_TRX_PARAM = 0x42,
  	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
  	MCU_UNI_CMD_PRECAL_RESULT = 0x47,
@@ -35,7 +35,7 @@
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
  	MCU_UNI_CMD_PER_STA_INFO = 0x6d,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 3069e9070..69bcf78f5 100644
+index 3069e90..69bcf78 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -1032,6 +1032,7 @@ void mt7996_mcu_set_cert(struct mt7996_phy *phy, u8 type);
@@ -47,7 +47,7 @@
  
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index ee72c0e51..ddb4a7ca2 100644
+index de21a95..c787551 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -3212,6 +3212,22 @@ out:
@@ -82,7 +82,7 @@
  	return 0;
  }
 diff --git a/mt7996/mtk_mcu.c b/mt7996/mtk_mcu.c
-index aed32e982..aa44b4710 100644
+index aed32e9..aa44b47 100644
 --- a/mt7996/mtk_mcu.c
 +++ b/mt7996/mtk_mcu.c
 @@ -1342,4 +1342,25 @@ int mt7996_mcu_set_vow_drr_dbg(struct mt7996_dev *dev, u32 val)
@@ -112,5 +112,5 @@
 +}
  #endif
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0081-mtk-wifi-mt76-mt7996-add-kite-two-pcie-with-two-wed-.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0080-mtk-wifi-mt76-mt7996-add-kite-two-pcie-with-two-wed-.patch
similarity index 96%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0081-mtk-wifi-mt76-mt7996-add-kite-two-pcie-with-two-wed-.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0080-mtk-wifi-mt76-mt7996-add-kite-two-pcie-with-two-wed-.patch
index 463df1f..7cf05e6 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0081-mtk-wifi-mt76-mt7996-add-kite-two-pcie-with-two-wed-.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0080-mtk-wifi-mt76-mt7996-add-kite-two-pcie-with-two-wed-.patch
@@ -1,7 +1,7 @@
-From 3945c5fb09e36f31863f019dc12d242aa4e3644c Mon Sep 17 00:00:00 2001
+From f56bd70e5c9b889582244a4f22a510de9b19bc74 Mon Sep 17 00:00:00 2001
 From: Rex Lu <rex.lu@mediatek.com>
 Date: Tue, 19 Mar 2024 13:16:12 +0800
-Subject: [PATCH 081/116] mtk: wifi: mt76: mt7996: add kite two pcie with two
+Subject: [PATCH 080/116] mtk: wifi: mt76: mt7996: add kite two pcie with two
  wed support
 
 Signed-off-by: Rex Lu <rex.lu@mediatek.com>
@@ -15,7 +15,7 @@
  6 files changed, 101 insertions(+), 47 deletions(-)
 
 diff --git a/mt7996/dma.c b/mt7996/dma.c
-index 3dc0e8a1d..a2490fa77 100644
+index 3dc0e8a..a2490fa 100644
 --- a/mt7996/dma.c
 +++ b/mt7996/dma.c
 @@ -108,8 +108,8 @@ static void mt7996_dma_config(struct mt7996_dev *dev)
@@ -131,7 +131,7 @@
  				       MT_RXQ_ID(MT_RXQ_BAND1_WA),
  				       MT7996_RX_MCU_RING_SIZE,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 1e7cd5235..768979ef7 100644
+index 1e7cd52..768979e 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -525,39 +525,46 @@ void mt7996_mac_init(struct mt7996_dev *dev)
@@ -222,7 +222,7 @@
  				wed = &dev->mt76.mmio.wed_hif2;
  			}
 diff --git a/mt7996/main.c b/mt7996/main.c
-index f7ea49f18..2fe9bf28f 100644
+index 775d81e..c9e8108 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1607,7 +1607,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
@@ -245,7 +245,7 @@
  			break;
  		}
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 91567a04b..6028182e1 100644
+index 91567a0..6028182 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -336,10 +336,16 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
@@ -287,7 +287,7 @@
  
  	if (mtk_wed_device_active(wed)) {
 diff --git a/mt7996/pci.c b/mt7996/pci.c
-index 24d69d4dc..382b6a898 100644
+index 24d69d4..382b6a8 100644
 --- a/mt7996/pci.c
 +++ b/mt7996/pci.c
 @@ -110,7 +110,7 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
@@ -310,7 +310,7 @@
  		if (ret < 0)
  			goto free_wed_or_irq_vector;
 diff --git a/mt7996/regs.h b/mt7996/regs.h
-index a0e4b3e11..e18935172 100644
+index a0e4b3e..e189351 100644
 --- a/mt7996/regs.h
 +++ b/mt7996/regs.h
 @@ -525,6 +525,7 @@ enum offs_rev {
@@ -322,5 +322,5 @@
  #define MT_INT_RX_TXFREE_EXT			BIT(26)
  #define MT_INT_MCU_CMD				BIT(29)
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0082-mtk-wifi-mt76-mt7992-add-support-to-enable-index-FW-.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0081-mtk-wifi-mt76-mt7992-add-support-to-enable-index-FW-.patch
similarity index 97%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0082-mtk-wifi-mt76-mt7992-add-support-to-enable-index-FW-.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0081-mtk-wifi-mt76-mt7992-add-support-to-enable-index-FW-.patch
index 0ff551c..0748f93 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0082-mtk-wifi-mt76-mt7992-add-support-to-enable-index-FW-.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0081-mtk-wifi-mt76-mt7992-add-support-to-enable-index-FW-.patch
@@ -1,7 +1,7 @@
-From a5d6a71a81b1bd7daadd810a601615a293beea80 Mon Sep 17 00:00:00 2001
+From 4b13a975d69ad2c954791dbdfbcb3c7c7a5bf63f Mon Sep 17 00:00:00 2001
 From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
 Date: Thu, 11 Jan 2024 08:55:13 +0800
-Subject: [PATCH 082/116] mtk: wifi: mt76: mt7992: add support to enable index
+Subject: [PATCH 081/116] mtk: wifi: mt76: mt7992: add support to enable index
  FW log for ConsysPlanet
 
 Add support to enable and record index FW log, which is the input for ConsysPlanet, via mt76-test command.
@@ -38,7 +38,7 @@
  8 files changed, 295 insertions(+), 69 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index e26de48c6..837758611 100644
+index e26de48..8377586 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -430,8 +430,8 @@ create_buf_file_cb(const char *filename, struct dentry *parent, umode_t mode,
@@ -168,7 +168,7 @@
  	return true;
  }
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index e3758ff13..8c444423b 100644
+index e3758ff..8c44442 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -2279,11 +2279,9 @@ void mt7996_mac_work(struct work_struct *work)
@@ -198,7 +198,7 @@
  			           test_bit(MT76_STATE_RUNNING, &mdev->phys[i]->state))
  				break;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 6fb9f81f0..3a376c9ac 100644
+index 82ed9e8..e38a507 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -400,6 +400,7 @@ static void
@@ -257,7 +257,7 @@
  {
  	struct {
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index d24874a4b..814072e3a 100644
+index d24874a..814072e 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -357,7 +357,8 @@ enum {
@@ -279,7 +279,7 @@
  
  enum {
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 69bcf78f5..d03d3d94c 100644
+index 69bcf78..d03d3d9 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -591,9 +591,11 @@ struct mt7996_dev {
@@ -303,7 +303,7 @@
  void mt7996_mcu_rx_event(struct mt7996_dev *dev, struct sk_buff *skb);
  void mt7996_mcu_exit(struct mt7996_dev *dev);
 diff --git a/tools/fwlog.c b/tools/fwlog.c
-index 3c6a61d71..0e2de2dc2 100644
+index 3c6a61d..0e2de2d 100644
 --- a/tools/fwlog.c
 +++ b/tools/fwlog.c
 @@ -29,10 +29,9 @@ static const char *debugfs_path(const char *phyname, const char *file)
@@ -591,7 +591,7 @@
  	return ret;
  }
 diff --git a/tools/main.c b/tools/main.c
-index 699a9eea6..e9e255679 100644
+index 699a9ee..e9e2556 100644
 --- a/tools/main.c
 +++ b/tools/main.c
 @@ -198,6 +198,8 @@ int main(int argc, char **argv)
@@ -604,7 +604,7 @@
  		usage();
  
 diff --git a/tools/mt76-test.h b/tools/mt76-test.h
-index d2fafa862..b9d508c5c 100644
+index d2fafa8..b9d508c 100644
 --- a/tools/mt76-test.h
 +++ b/tools/mt76-test.h
 @@ -22,6 +22,8 @@
@@ -624,5 +624,5 @@
  
  #endif
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0083-wifi-mt76-mt7996-implement-and-switch-to-hw-scan-cal.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0082-wifi-mt76-mt7996-implement-and-switch-to-hw-scan-cal.patch
similarity index 96%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0083-wifi-mt76-mt7996-implement-and-switch-to-hw-scan-cal.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0082-wifi-mt76-mt7996-implement-and-switch-to-hw-scan-cal.patch
index ffec2d1..c76593a 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0083-wifi-mt76-mt7996-implement-and-switch-to-hw-scan-cal.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0082-wifi-mt76-mt7996-implement-and-switch-to-hw-scan-cal.patch
@@ -1,7 +1,7 @@
-From afcc6594ef97e51bdbb707b7e9aeb8dfb7202ef1 Mon Sep 17 00:00:00 2001
+From 8a1c29f6a9b99d2f3d699fe6100704349406fc4b Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 3 Nov 2023 21:44:45 +0800
-Subject: [PATCH 083/116] wifi: mt76: mt7996: implement and switch to hw scan
+Subject: [PATCH 082/116] wifi: mt76: mt7996: implement and switch to hw scan
  callbacks
 
 To support MLO, hw_scan callbacks are mandatory. However, the
@@ -29,10 +29,10 @@
  7 files changed, 248 insertions(+), 12 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index c7b222837..4fad03dd9 100644
+index 3c2c2af..0ad3f25 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -820,7 +820,7 @@ bool mt76_has_tx_pending(struct mt76_phy *phy)
+@@ -821,7 +821,7 @@ bool mt76_has_tx_pending(struct mt76_phy *phy)
  }
  EXPORT_SYMBOL_GPL(mt76_has_tx_pending);
  
@@ -41,7 +41,7 @@
  mt76_channel_state(struct mt76_phy *phy, struct ieee80211_channel *c)
  {
  	struct mt76_sband *msband;
-@@ -836,6 +836,7 @@ mt76_channel_state(struct mt76_phy *phy, struct ieee80211_channel *c)
+@@ -837,6 +837,7 @@ mt76_channel_state(struct mt76_phy *phy, struct ieee80211_channel *c)
  	idx = c - &msband->sband.channels[0];
  	return &msband->chan[idx];
  }
@@ -50,7 +50,7 @@
  void mt76_update_survey_active_time(struct mt76_phy *phy, ktime_t time)
  {
 diff --git a/mt76.h b/mt76.h
-index c3c35841f..0abb8ebf5 100644
+index 28defd4..8ca7907 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -1477,6 +1477,8 @@ void mt76_release_buffered_frames(struct ieee80211_hw *hw,
@@ -63,7 +63,7 @@
  void mt76_update_survey(struct mt76_phy *phy);
  void mt76_update_survey_active_time(struct mt76_phy *phy, ktime_t time);
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 768979ef7..952356823 100644
+index 768979e..9523568 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -457,6 +457,9 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -93,7 +93,7 @@
  	INIT_LIST_HEAD(&dev->sta_rc_list);
  	INIT_LIST_HEAD(&dev->twt_list);
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 8c444423b..4e9dd2c1f 100644
+index 8c44442..4e9dd2c 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -2693,3 +2693,144 @@ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
@@ -242,7 +242,7 @@
 +	ieee80211_queue_delayed_work(hw, &phy->scan_work, duration);
 +}
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 2fe9bf28f..c8f1b1097 100644
+index c9e8108..5c1735e 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -312,6 +312,8 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
@@ -397,7 +397,7 @@
  	.get_txpower = mt76_get_txpower,
  	.channel_switch_beacon = mt7996_channel_switch_beacon,
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 3a376c9ac..99cca0dc7 100644
+index e38a507..9f2d125 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -3775,7 +3775,8 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
@@ -411,7 +411,7 @@
  	else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
  					  NL80211_IFTYPE_AP))
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index d03d3d94c..fbf1e835b 100644
+index d03d3d9..fbf1e83 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -458,6 +458,13 @@ struct mt7996_phy {
@@ -447,5 +447,5 @@
  int mt7996_dfs_init_radar_detector(struct mt7996_phy *phy);
  void mt7996_set_stream_he_eht_caps(struct mt7996_phy *phy);
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0084-wifi-mt76-mt7996-implement-and-switch-to-chanctx-cal.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0083-wifi-mt76-mt7996-implement-and-switch-to-chanctx-cal.patch
similarity index 97%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0084-wifi-mt76-mt7996-implement-and-switch-to-chanctx-cal.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0083-wifi-mt76-mt7996-implement-and-switch-to-chanctx-cal.patch
index a413885..0e99f39 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0084-wifi-mt76-mt7996-implement-and-switch-to-chanctx-cal.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0083-wifi-mt76-mt7996-implement-and-switch-to-chanctx-cal.patch
@@ -1,7 +1,7 @@
-From fa5c84eb945cb472d98172876d176bff4a082d67 Mon Sep 17 00:00:00 2001
+From d225140776409dcf5b526034682768803e551dbb Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 6 Nov 2023 16:17:11 +0800
-Subject: [PATCH 084/116] wifi: mt76: mt7996: implement and switch to chanctx
+Subject: [PATCH 083/116] wifi: mt76: mt7996: implement and switch to chanctx
  callbacks
 
 To support MLO, chanctx callbacks are mandatory, since one VIF (MLD) could
@@ -20,7 +20,7 @@
  5 files changed, 211 insertions(+), 18 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 952356823..6eeec3b8d 100644
+index 9523568..6eeec3b 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -382,6 +382,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
@@ -81,7 +81,7 @@
  	if (ret)
  		return ret;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 4e9dd2c1f..0879c7735 100644
+index 4e9dd2c..0879c77 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -2785,7 +2785,10 @@ void mt7996_scan_work(struct work_struct *work)
@@ -109,7 +109,7 @@
  		ieee80211_queue_delayed_work(hw, &phy->scan_work, HZ / 10);
  
 diff --git a/mt7996/main.c b/mt7996/main.c
-index c8f1b1097..dd4f3a711 100644
+index 5c1735e..dff0f1f 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -76,6 +76,11 @@ int mt7996_run(struct ieee80211_hw *hw)
@@ -317,7 +317,7 @@
 +	.switch_vif_chanctx = mt7996_switch_vif_chanctx,
  };
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 99cca0dc7..85077108e 100644
+index 9f2d125..5319cc3 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -5309,7 +5309,7 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap)
@@ -330,7 +330,7 @@
  		return 0;
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index fbf1e835b..84aafb404 100644
+index fbf1e83..84aafb4 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -332,6 +332,8 @@ struct mt7996_vif {
@@ -379,5 +379,5 @@
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0085-wifi-mt76-mt7996-use-.sta_state-to-replace-.sta_add-.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0084-wifi-mt76-mt7996-use-.sta_state-to-replace-.sta_add-.patch
similarity index 95%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0085-wifi-mt76-mt7996-use-.sta_state-to-replace-.sta_add-.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0084-wifi-mt76-mt7996-use-.sta_state-to-replace-.sta_add-.patch
index 6d221cf..cc84e17 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0085-wifi-mt76-mt7996-use-.sta_state-to-replace-.sta_add-.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0084-wifi-mt76-mt7996-use-.sta_state-to-replace-.sta_add-.patch
@@ -1,7 +1,7 @@
-From 3e111fa2be564cc27c213471242f6b6b920e253c Mon Sep 17 00:00:00 2001
+From 21ea1ffbe885bbaba0266f0b835cf58574cecc5f Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 8 Nov 2023 18:52:26 +0800
-Subject: [PATCH 085/116] wifi: mt76: mt7996: use .sta_state to replace
+Subject: [PATCH 084/116] wifi: mt76: mt7996: use .sta_state to replace
  .sta_add and .sta_remove
 
 MAC80211 mostly uses MLD address through TX path, and leaves the header
@@ -21,7 +21,7 @@
  3 files changed, 24 insertions(+), 32 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index dd4f3a711..c330dd479 100644
+index dff0f1f..9eb4c5b 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -784,7 +784,7 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -117,7 +117,7 @@
  	.sta_rc_update = mt7996_sta_rc_update,
  	.set_key = mt7996_set_key,
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 6028182e1..6abbcb68e 100644
+index 6028182..6abbcb6 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -655,6 +655,7 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
@@ -129,7 +129,7 @@
  		.update_survey = mt7996_update_channel,
  	};
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 84aafb404..2b266d18b 100644
+index 84aafb4..2b266d1 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -966,6 +966,8 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
@@ -142,5 +142,5 @@
  			   struct ieee80211_sta *sta);
  void mt7996_mac_work(struct work_struct *work);
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0085-wifi-mt76-mt7996-switch-to-per-link-data-structure-o.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0085-wifi-mt76-mt7996-switch-to-per-link-data-structure-o.patch
new file mode 100644
index 0000000..f035710
--- /dev/null
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0085-wifi-mt76-mt7996-switch-to-per-link-data-structure-o.patch
@@ -0,0 +1,2320 @@
+From a8c22741f0614f90922e3dcac3a94666e29e4682 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Fri, 24 Nov 2023 11:31:55 +0800
+Subject: [PATCH 085/116] wifi: mt76: mt7996: switch to per-link data structure
+ of vif
+
+Introduce struct mt7996_bss_conf, data structure for per-link BSS.
+Note that mt7996_vif now represents a legacy or MLD device.
+This is a preliminary patch to add MLO support for mt7996 chipsets.
+
+Co-developed-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ mt7996/debugfs.c  |  10 +-
+ mt7996/init.c     |   4 +-
+ mt7996/mac.c      |  25 ++-
+ mt7996/main.c     | 269 ++++++++++++++++++-----------
+ mt7996/mcu.c      | 429 +++++++++++++++++++++++-----------------------
+ mt7996/mt7996.h   |  72 +++++---
+ mt7996/testmode.c |  17 +-
+ 7 files changed, 463 insertions(+), 363 deletions(-)
+
+diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
+index 8377586..06015d6 100644
+--- a/mt7996/debugfs.c
++++ b/mt7996/debugfs.c
+@@ -739,7 +739,7 @@ static void
+ mt7996_sta_hw_queue_read(void *data, struct ieee80211_sta *sta)
+ {
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+-	struct mt7996_dev *dev = msta->vif->phy->dev;
++	struct mt7996_dev *dev = msta->vif->deflink.phy->dev;
+ 	struct seq_file *s = data;
+ 	u8 ac;
+ 
+@@ -759,7 +759,7 @@ mt7996_sta_hw_queue_read(void *data, struct ieee80211_sta *sta)
+ 				      GENMASK(11, 0));
+ 		seq_printf(s, "\tSTA %pM wcid %d: AC%d%d queued:%d\n",
+ 			   sta->addr, msta->wcid.idx,
+-			   msta->vif->mt76.wmm_idx, ac, qlen);
++			   msta->vif->deflink.mt76.wmm_idx, ac, qlen);
+ 	}
+ }
+ 
+@@ -1023,7 +1023,7 @@ mt7996_atf_enable_set(void *data, u64 val)
+ 	int ret;
+ 
+ 	vow->max_deficit = val ? 64 : 1;
+-	ret = mt7996_mcu_set_vow_drr_ctrl(phy, NULL, VOW_DRR_CTRL_AIRTIME_DEFICIT_BOUND);
++	ret = mt7996_mcu_set_vow_drr_ctrl(phy, NULL, NULL, VOW_DRR_CTRL_AIRTIME_DEFICIT_BOUND);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -1055,7 +1055,7 @@ mt7996_airtime_read(struct seq_file *s, void *data)
+ 
+ 		msta = container_of(wcid, struct mt7996_sta, wcid);
+ 		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
+-		vif = &msta->vif->mt76;
++		vif = &msta->vif->deflink.mt76;
+ 		stats = &wcid->stats;
+ 
+ 		seq_printf(s, "%pM WCID: %hu BandIdx: %hhu OmacIdx: 0x%hhx\t"
+@@ -1230,7 +1230,7 @@ static ssize_t mt7996_sta_fixed_rate_set(struct file *file,
+ #define LONG_PREAMBLE 1
+ 	struct ieee80211_sta *sta = file->private_data;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+-	struct mt7996_dev *dev = msta->vif->phy->dev;
++	struct mt7996_dev *dev = msta->vif->deflink.phy->dev;
+ 	struct ra_rate phy = {};
+ 	char buf[100];
+ 	int ret;
+diff --git a/mt7996/init.c b/mt7996/init.c
+index 6eeec3b..381e129 100644
+--- a/mt7996/init.c
++++ b/mt7996/init.c
+@@ -628,11 +628,11 @@ static int mt7996_vow_init(struct mt7996_phy *phy)
+ 	vow->drr_quantum[6] = VOW_DRR_QUANTUM_L6;
+ 	vow->drr_quantum[7] = VOW_DRR_QUANTUM_L7;
+ 
+-	ret = mt7996_mcu_set_vow_drr_ctrl(phy, NULL, VOW_DRR_CTRL_AIRTIME_DEFICIT_BOUND);
++	ret = mt7996_mcu_set_vow_drr_ctrl(phy, NULL, NULL, VOW_DRR_CTRL_AIRTIME_DEFICIT_BOUND);
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = mt7996_mcu_set_vow_drr_ctrl(phy, NULL, VOW_DRR_CTRL_AIRTIME_QUANTUM_ALL);
++	ret = mt7996_mcu_set_vow_drr_ctrl(phy, NULL, NULL, VOW_DRR_CTRL_AIRTIME_QUANTUM_ALL);
+ 	if (ret)
+ 		return ret;
+ 
+diff --git a/mt7996/mac.c b/mt7996/mac.c
+index 0879c77..63b16f9 100644
+--- a/mt7996/mac.c
++++ b/mt7996/mac.c
+@@ -897,8 +897,9 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 
+ 	if (vif) {
+ 		struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++		struct mt7996_bss_conf *mconf = &mvif->deflink;
+ 
+-		txp->fw.bss_idx = mvif->mt76.idx;
++		txp->fw.bss_idx = mconf->mt76.idx;
+ 	}
+ 
+ 	txp->fw.token = cpu_to_le16(id);
+@@ -1518,12 +1519,15 @@ static void
+ mt7996_update_vif_beacon(void *priv, u8 *mac, struct ieee80211_vif *vif)
+ {
+ 	struct ieee80211_hw *hw = priv;
++	struct ieee80211_bss_conf *conf = &vif->bss_conf;
++	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct mt7996_bss_conf *mconf = &mvif->deflink;
+ 
+ 	switch (vif->type) {
+ 	case NL80211_IFTYPE_MESH_POINT:
+ 	case NL80211_IFTYPE_ADHOC:
+ 	case NL80211_IFTYPE_AP:
+-		mt7996_mcu_add_beacon(hw, vif, vif->bss_conf.enable_beacon);
++		mt7996_mcu_add_beacon(hw, conf, mconf, conf->enable_beacon);
+ 		break;
+ 	default:
+ 		break;
+@@ -2237,6 +2241,8 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+ 	struct mt7996_dev *dev = container_of(work, struct mt7996_dev, rc_work);
+ 	struct ieee80211_sta *sta;
+ 	struct ieee80211_vif *vif;
++	struct ieee80211_bss_conf *conf;
++	struct mt7996_bss_conf *mconf;
+ 	struct mt7996_sta *msta;
+ 	u32 changed;
+ 	LIST_HEAD(list);
+@@ -2253,14 +2259,16 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+ 
+ 		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
+ 		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
++		conf = &vif->bss_conf;
++		mconf = &msta->vif->deflink;
+ 
+ 		if (changed & (IEEE80211_RC_SUPP_RATES_CHANGED |
+ 			       IEEE80211_RC_NSS_CHANGED |
+ 			       IEEE80211_RC_BW_CHANGED))
+-			mt7996_mcu_add_rate_ctrl(dev, vif, sta, true);
++			mt7996_mcu_add_rate_ctrl(dev, conf, mconf, sta, true);
+ 
+ 		if (changed & IEEE80211_RC_SMPS_CHANGED)
+-			mt7996_mcu_set_fixed_field(dev, vif, sta, NULL,
++			mt7996_mcu_set_fixed_field(dev, mconf, sta, NULL,
+ 						   RATE_PARAM_MMPS_UPDATE);
+ 
+ 		spin_lock_bh(&dev->mt76.sta_poll_lock);
+@@ -2643,7 +2651,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+ 
+ 		flow->sched = true;
+ 		flow->start_tsf = mt7996_mac_twt_sched_list_add(dev, flow);
+-		curr_tsf = __mt7996_get_tsf(hw, msta->vif);
++		curr_tsf = __mt7996_get_tsf(hw, &msta->vif->deflink);
+ 		div_u64_rem(curr_tsf - flow->start_tsf, interval, &rem);
+ 		flow_tsf = curr_tsf + interval - rem;
+ 		twt_agrt->twt = cpu_to_le64(flow_tsf);
+@@ -2652,7 +2660,8 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+ 	}
+ 	flow->tsf = le64_to_cpu(twt_agrt->twt);
+ 
+-	if (mt7996_mcu_twt_agrt_update(dev, msta->vif, flow, MCU_TWT_AGRT_ADD))
++	if (mt7996_mcu_twt_agrt_update(dev, &msta->vif->deflink, flow,
++				       MCU_TWT_AGRT_ADD))
+ 		goto unlock;
+ 
+ 	setup_cmd = TWT_SETUP_CMD_ACCEPT;
+@@ -2674,6 +2683,7 @@ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
+ 				  u8 flowid)
+ {
+ 	struct mt7996_twt_flow *flow;
++	struct mt7996_bss_conf *mconf = mconf_dereference_protected(msta->vif, 0);
+ 
+ 	lockdep_assert_held(&dev->mt76.mutex);
+ 
+@@ -2684,8 +2694,7 @@ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
+ 		return;
+ 
+ 	flow = &msta->twt.flow[flowid];
+-	if (mt7996_mcu_twt_agrt_update(dev, msta->vif, flow,
+-				       MCU_TWT_AGRT_DELETE))
++	if (mt7996_mcu_twt_agrt_update(dev, mconf, flow, MCU_TWT_AGRT_DELETE))
+ 		return;
+ 
+ 	list_del_init(&flow->list);
+diff --git a/mt7996/main.c b/mt7996/main.c
+index 9eb4c5b..bc4863d 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -205,29 +205,30 @@ static int get_omac_idx(enum nl80211_iftype type, u64 mask)
+ 	return -1;
+ }
+ 
+-static void mt7996_init_bitrate_mask(struct ieee80211_vif *vif)
++static void mt7996_init_bitrate_mask(struct mt7996_bss_conf *mconf)
+ {
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	int i;
+ 
+-	for (i = 0; i < ARRAY_SIZE(mvif->bitrate_mask.control); i++) {
+-		mvif->bitrate_mask.control[i].gi = NL80211_TXRATE_DEFAULT_GI;
+-		mvif->bitrate_mask.control[i].he_gi = 0xff;
+-		mvif->bitrate_mask.control[i].he_ltf = 0xff;
+-		mvif->bitrate_mask.control[i].legacy = GENMASK(31, 0);
+-		memset(mvif->bitrate_mask.control[i].ht_mcs, 0xff,
+-		       sizeof(mvif->bitrate_mask.control[i].ht_mcs));
+-		memset(mvif->bitrate_mask.control[i].vht_mcs, 0xff,
+-		       sizeof(mvif->bitrate_mask.control[i].vht_mcs));
+-		memset(mvif->bitrate_mask.control[i].he_mcs, 0xff,
+-		       sizeof(mvif->bitrate_mask.control[i].he_mcs));
++	for (i = 0; i < ARRAY_SIZE(mconf->bitrate_mask.control); i++) {
++		mconf->bitrate_mask.control[i].gi = NL80211_TXRATE_DEFAULT_GI;
++		mconf->bitrate_mask.control[i].he_gi = 0xff;
++		mconf->bitrate_mask.control[i].he_ltf = 0xff;
++		mconf->bitrate_mask.control[i].legacy = GENMASK(31, 0);
++		memset(mconf->bitrate_mask.control[i].ht_mcs, 0xff,
++		       sizeof(mconf->bitrate_mask.control[i].ht_mcs));
++		memset(mconf->bitrate_mask.control[i].vht_mcs, 0xff,
++		       sizeof(mconf->bitrate_mask.control[i].vht_mcs));
++		memset(mconf->bitrate_mask.control[i].he_mcs, 0xff,
++		       sizeof(mconf->bitrate_mask.control[i].he_mcs));
+ 	}
+ }
+ 
+ static int mt7996_add_interface(struct ieee80211_hw *hw,
+ 				struct ieee80211_vif *vif)
+ {
++	struct ieee80211_bss_conf *conf = &vif->bss_conf;
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct mt7996_bss_conf *mconf = &mvif->deflink;
+ 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
+ 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
+ 	struct mt76_txq *mtxq;
+@@ -240,8 +241,8 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
+ 	    is_zero_ether_addr(vif->addr))
+ 		phy->monitor_vif = vif;
+ 
+-	mvif->mt76.idx = __ffs64(~dev->mt76.vif_mask);
+-	if (mvif->mt76.idx >= mt7996_max_interface_num(dev)) {
++	mconf->mt76.idx = __ffs64(~dev->mt76.vif_mask);
++	if (mconf->mt76.idx >= mt7996_max_interface_num(dev)) {
+ 		ret = -ENOSPC;
+ 		goto out;
+ 	}
+@@ -251,19 +252,21 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
+ 		ret = -ENOSPC;
+ 		goto out;
+ 	}
+-	mvif->mt76.omac_idx = idx;
+-	mvif->phy = phy;
+-	mvif->mt76.band_idx = band_idx;
+-	mvif->mt76.wmm_idx = vif->type != NL80211_IFTYPE_AP;
+-
+-	ret = mt7996_mcu_add_dev_info(phy, vif, true);
++	mconf->mt76.omac_idx = idx;
++	mconf->vif = mvif;
++	mconf->phy = phy;
++	mconf->mt76.band_idx = band_idx;
++	mconf->mt76.wmm_idx = vif->type != NL80211_IFTYPE_AP;
++	mvif->dev = dev;
++
++	ret = mt7996_mcu_add_dev_info(phy, conf, mconf, true);
+ 	if (ret)
+ 		goto out;
+ 
+-	dev->mt76.vif_mask |= BIT_ULL(mvif->mt76.idx);
+-	phy->omac_mask |= BIT_ULL(mvif->mt76.omac_idx);
++	dev->mt76.vif_mask |= BIT_ULL(mconf->mt76.idx);
++	phy->omac_mask |= BIT_ULL(mconf->mt76.omac_idx);
+ 
+-	idx = MT7996_WTBL_RESERVED - mvif->mt76.idx;
++	idx = MT7996_WTBL_RESERVED - mconf->mt76.idx;
+ 
+ 	INIT_LIST_HEAD(&mvif->sta.rc_list);
+ 	INIT_LIST_HEAD(&mvif->sta.wcid.poll_list);
+@@ -283,24 +286,25 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
+ 	}
+ 
+ 	if (vif->type != NL80211_IFTYPE_AP &&
+-	    (!mvif->mt76.omac_idx || mvif->mt76.omac_idx > 3))
++	    (!mconf->mt76.omac_idx || mconf->mt76.omac_idx > 3))
+ 		vif->offload_flags = 0;
+ 	vif->offload_flags |= IEEE80211_OFFLOAD_ENCAP_4ADDR;
+ 
+ 	if (phy->mt76->chandef.chan->band != NL80211_BAND_2GHZ)
+-		mvif->mt76.basic_rates_idx = MT7996_BASIC_RATES_TBL + 4;
++		mconf->mt76.basic_rates_idx = MT7996_BASIC_RATES_TBL + 4;
+ 	else
+-		mvif->mt76.basic_rates_idx = MT7996_BASIC_RATES_TBL;
++		mconf->mt76.basic_rates_idx = MT7996_BASIC_RATES_TBL;
+ 
+-	mt7996_init_bitrate_mask(vif);
++	mt7996_init_bitrate_mask(mconf);
+ 
+-	mt7996_mcu_add_bss_info(phy, vif, true);
++	mt7996_mcu_add_bss_info(phy, conf, mconf, true);
+ 	/* defer the first STA_REC of BMC entry to BSS_CHANGED_BSSID for STA
+ 	 * interface, since firmware only records BSSID when the entry is new
+ 	 */
+ 	if (vif->type != NL80211_IFTYPE_STATION)
+-		mt7996_mcu_add_sta(dev, vif, NULL, true, true);
++		mt7996_mcu_add_sta(dev, conf, mconf, NULL, true, true);
+ 	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
++	rcu_assign_pointer(mvif->link[0], mconf);
+ 
+ out:
+ 	mutex_unlock(&dev->mt76.mutex);
+@@ -311,7 +315,9 @@ out:
+ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+ 				    struct ieee80211_vif *vif)
+ {
++	struct ieee80211_bss_conf *conf;
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct mt7996_bss_conf *mconf;
+ 	struct mt7996_sta *msta = &mvif->sta;
+ 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
+ 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
+@@ -319,24 +325,22 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+ 
+ 	cancel_delayed_work_sync(&phy->scan_work);
+ 
+-	mt7996_mcu_add_sta(dev, vif, NULL, false, false);
+-	mt7996_mcu_add_bss_info(phy, vif, false);
++	mutex_lock(&dev->mt76.mutex);
++
++	conf = link_conf_dereference_protected(vif, 0);
++	mconf = mconf_dereference_protected(mvif, 0);
++	mt7996_mcu_add_sta(dev, conf, mconf, NULL, false, false);
++	mt7996_mcu_add_bss_info(phy, conf, mconf, false);
+ 
+ 	if (vif == phy->monitor_vif)
+ 		phy->monitor_vif = NULL;
+ 
+-	mt7996_mcu_add_dev_info(phy, vif, false);
++	mt7996_mcu_add_dev_info(phy, conf, mconf, false);
+ 
+ 	rcu_assign_pointer(dev->mt76.wcid[idx], NULL);
+ 
+-	mutex_lock(&dev->mt76.mutex);
+-
+-	if (test_bit(MT76_SCANNING, &phy->mt76->state))
+-		mt7996_scan_complete(phy, true);
+-
+-	dev->mt76.vif_mask &= ~BIT_ULL(mvif->mt76.idx);
+-	phy->omac_mask &= ~BIT_ULL(mvif->mt76.omac_idx);
+-	mutex_unlock(&dev->mt76.mutex);
++	dev->mt76.vif_mask &= ~BIT_ULL(mconf->mt76.idx);
++	phy->omac_mask &= ~BIT_ULL(mconf->mt76.omac_idx);
+ 
+ 	spin_lock_bh(&dev->mt76.sta_poll_lock);
+ 	if (!list_empty(&msta->wcid.poll_list))
+@@ -344,6 +348,9 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+ 	spin_unlock_bh(&dev->mt76.sta_poll_lock);
+ 
+ 	mt76_wcid_cleanup(&dev->mt76, &msta->wcid);
++	rcu_assign_pointer(mvif->link[0], NULL);
++
++	mutex_unlock(&dev->mt76.mutex);
+ }
+ 
+ static void ___mt7996_set_channel(struct mt7996_phy *phy,
+@@ -441,6 +448,8 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ 	struct mt7996_sta *msta = sta ? (struct mt7996_sta *)sta->drv_priv :
+ 				  &mvif->sta;
+ 	struct mt76_wcid *wcid = &msta->wcid;
++	struct mt7996_bss_conf *mconf;
++	struct ieee80211_bss_conf *conf;
+ 	u8 *wcid_keyidx = &wcid->hw_key_idx;
+ 	int idx = key->keyidx;
+ 	int err = 0;
+@@ -482,9 +491,11 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+ 
+-	if (cmd == SET_KEY && !sta && !mvif->mt76.cipher) {
+-		mvif->mt76.cipher = mt76_connac_mcu_get_cipher(key->cipher);
+-		mt7996_mcu_add_bss_info(phy, vif, true);
++	conf = link_conf_dereference_protected(vif, 0);
++	mconf = mconf_dereference_protected(mvif, 0);
++	if (cmd == SET_KEY && !sta && !mconf->mt76.cipher) {
++		mconf->mt76.cipher = mt76_connac_mcu_get_cipher(key->cipher);
++		mt7996_mcu_add_bss_info(phy, conf, mconf, true);
+ 	}
+ 
+ 	if (cmd == SET_KEY) {
+@@ -498,9 +509,9 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ 	mt76_wcid_key_setup(&dev->mt76, wcid, key);
+ 
+ 	if (key->keyidx == 6 || key->keyidx == 7)
+-		err = mt7996_mcu_bcn_prot_enable(dev, vif, key);
++		err = mt7996_mcu_bcn_prot_enable(dev, conf, mconf, key);
+ 	else
+-		err = mt7996_mcu_add_key(&dev->mt76, vif, key,
++		err = mt7996_mcu_add_key(&dev->mt76, mconf, key,
+ 					 MCU_WMWA_UNI_CMD(STA_REC_UPDATE),
+ 					 &msta->wcid, cmd);
+ out:
+@@ -547,7 +558,9 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	       unsigned int link_id, u16 queue,
+ 	       const struct ieee80211_tx_queue_params *params)
+ {
++	struct mt7996_dev *dev = mt7996_hw_dev(hw);
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct mt7996_bss_conf *mconf;
+ 	static const u8 mq_to_aci[] = {
+ 		[IEEE80211_AC_VO] = 3,
+ 		[IEEE80211_AC_VI] = 2,
+@@ -555,10 +568,15 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		[IEEE80211_AC_BK] = 1,
+ 	};
+ 
++	mutex_lock(&dev->mt76.mutex);
++	mconf = mconf_dereference_protected(mvif, 0);
++
+ 	/* firmware uses access class index */
+-	mvif->queue_params[mq_to_aci[queue]] = *params;
++	mconf->queue_params[mq_to_aci[queue]] = *params;
+ 	/* no need to update right away, we'll get BSS_CHANGED_QOS */
+ 
++	mutex_unlock(&dev->mt76.mutex);
++
+ 	return 0;
+ }
+ 
+@@ -619,22 +637,20 @@ static void mt7996_configure_filter(struct ieee80211_hw *hw,
+ }
+ 
+ static void
+-mt7996_update_bss_color(struct ieee80211_hw *hw,
+-			struct ieee80211_vif *vif,
++mt7996_update_bss_color(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
++			struct mt7996_bss_conf *mconf,
+ 			struct cfg80211_he_bss_color *bss_color)
+ {
+ 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
+ 
+ 	switch (vif->type) {
+ 	case NL80211_IFTYPE_AP: {
+-		struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+-
+-		if (mvif->mt76.omac_idx > HW_BSSID_MAX)
++		if (mconf->mt76.omac_idx > HW_BSSID_MAX)
+ 			return;
+ 		fallthrough;
+ 	}
+ 	case NL80211_IFTYPE_STATION:
+-		mt7996_mcu_update_bss_color(dev, vif, bss_color);
++		mt7996_mcu_update_bss_color(dev, mconf, bss_color);
+ 		break;
+ 	default:
+ 		break;
+@@ -642,16 +658,15 @@ mt7996_update_bss_color(struct ieee80211_hw *hw,
+ }
+ 
+ static u8
+-mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+-		       bool beacon, bool mcast)
++mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_bss_conf *conf,
++		       struct mt7996_bss_conf *mconf, bool beacon, bool mcast)
+ {
+-	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
+ 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
+-	struct mt76_phy *mphy = hw->priv;
++	struct mt76_phy *mphy = mconf->phy->mt76;
+ 	u16 rate;
+ 	u8 i, idx;
+ 
+-	rate = mt76_connac2_mac_tx_rate_val(mphy, vif, beacon, mcast);
++	rate = mt76_connac2_mac_tx_rate_val(mphy, conf->vif, beacon, mcast);
+ 
+ 	if (beacon) {
+ 		struct mt7996_phy *phy = mphy->priv;
+@@ -672,23 +687,22 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		if ((mt76_rates[i].hw_value & GENMASK(7, 0)) == idx)
+ 			return MT7996_BASIC_RATES_TBL + 2 * i;
+ 
+-	return mvif->basic_rates_idx;
++	return mconf->mt76.basic_rates_idx;
+ }
+ 
+ static void
+-mt7996_update_mu_group(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+-		       struct ieee80211_bss_conf *info)
++mt7996_update_mu_group(struct ieee80211_hw *hw, struct ieee80211_bss_conf *conf,
++		       struct mt7996_bss_conf *mconf)
+ {
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
+-	u8 band = mvif->mt76.band_idx;
++	u8 band = mconf->mt76.band_idx;
+ 	u32 *mu;
+ 
+-	mu = (u32 *)info->mu_group.membership;
++	mu = (u32 *)conf->mu_group.membership;
+ 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_VLD0(band), mu[0]);
+ 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_VLD1(band), mu[1]);
+ 
+-	mu = (u32 *)info->mu_group.position;
++	mu = (u32 *)conf->mu_group.position;
+ 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_POS0(band), mu[0]);
+ 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_POS1(band), mu[1]);
+ 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_POS2(band), mu[2]);
+@@ -700,20 +714,22 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+ 				    struct ieee80211_bss_conf *info,
+ 				    u64 changed)
+ {
+-	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
++	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct mt7996_bss_conf *mconf;
+ 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
+ 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+ 
++	mconf = mconf_dereference_protected(mvif, 0);
+ 	/* station mode uses BSSID to map the wlan entry to a peer,
+ 	 * and then peer references bss_info_rfch to set bandwidth cap.
+ 	 */
+ 	if ((changed & BSS_CHANGED_BSSID && !is_zero_ether_addr(info->bssid)) ||
+ 	    (changed & BSS_CHANGED_ASSOC && vif->cfg.assoc) ||
+ 	    (changed & BSS_CHANGED_BEACON_ENABLED && info->enable_beacon)) {
+-		mt7996_mcu_add_bss_info(phy, vif, true);
+-		mt7996_mcu_add_sta(dev, vif, NULL, true,
++		mt7996_mcu_add_bss_info(phy, info, mconf, true);
++		mt7996_mcu_add_sta(dev, info, mconf, NULL, true,
+ 				   !!(changed & BSS_CHANGED_BSSID));
+ 	}
+ 
+@@ -725,42 +741,42 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+ 
+ 		if (slottime != phy->slottime) {
+ 			phy->slottime = slottime;
+-			mt7996_mcu_set_timing(phy, vif);
++			mt7996_mcu_set_timing(phy, mconf);
+ 		}
+ 	}
+ 
+ 	if (changed & BSS_CHANGED_MCAST_RATE)
+-		mvif->mcast_rates_idx =
+-			mt7996_get_rates_table(hw, vif, false, true);
++		mconf->mt76.mcast_rates_idx =
++			mt7996_get_rates_table(hw, info, mconf, false, true);
+ 
+ 	if (changed & BSS_CHANGED_BASIC_RATES)
+-		mvif->basic_rates_idx =
+-			mt7996_get_rates_table(hw, vif, false, false);
++		mconf->mt76.basic_rates_idx =
++			mt7996_get_rates_table(hw, info, mconf, false, false);
+ 
+ 	/* ensure that enable txcmd_mode after bss_info */
+ 	if (changed & (BSS_CHANGED_QOS | BSS_CHANGED_BEACON_ENABLED))
+-		mt7996_mcu_set_tx(dev, vif);
++		mt7996_mcu_set_tx(dev, mconf);
+ 
+ 	if (changed & BSS_CHANGED_HE_OBSS_PD)
+-		mt7996_mcu_add_obss_spr(phy, vif, &info->he_obss_pd);
++		mt7996_mcu_add_obss_spr(phy, mconf, &info->he_obss_pd);
+ 
+ 	if (changed & BSS_CHANGED_HE_BSS_COLOR)
+-		mt7996_update_bss_color(hw, vif, &info->he_bss_color);
++		mt7996_update_bss_color(hw, vif, mconf, &info->he_bss_color);
+ 
+ 	if (changed & (BSS_CHANGED_BEACON |
+ 		       BSS_CHANGED_BEACON_ENABLED)) {
+-		mvif->beacon_rates_idx =
+-			mt7996_get_rates_table(hw, vif, true, false);
++		mconf->mt76.beacon_rates_idx =
++			mt7996_get_rates_table(hw, info, mconf, true, false);
+ 
+-		mt7996_mcu_add_beacon(hw, vif, info->enable_beacon);
++		mt7996_mcu_add_beacon(hw, info, mconf, info->enable_beacon);
+ 	}
+ 
+ 	if (changed & (BSS_CHANGED_UNSOL_BCAST_PROBE_RESP |
+ 		       BSS_CHANGED_FILS_DISCOVERY))
+-		mt7996_mcu_beacon_inband_discov(dev, vif, changed);
++		mt7996_mcu_beacon_inband_discov(dev, info, mconf, changed);
+ 
+ 	if (changed & BSS_CHANGED_MU_GROUPS)
+-		mt7996_update_mu_group(hw, vif, info);
++		mt7996_update_mu_group(hw, info, mconf);
+ 
+ 	mutex_unlock(&dev->mt76.mutex);
+ }
+@@ -771,9 +787,14 @@ mt7996_channel_switch_beacon(struct ieee80211_hw *hw,
+ 			     struct cfg80211_chan_def *chandef)
+ {
+ 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
++	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct mt7996_bss_conf *mconf;
++	struct ieee80211_bss_conf *conf;
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+-	mt7996_mcu_add_beacon(hw, vif, true);
++	mconf = mconf_dereference_protected(mvif, 0);
++	conf = link_conf_dereference_protected(vif, 0);
++	mt7996_mcu_add_beacon(hw, conf, mconf, true);
+ 	mutex_unlock(&dev->mt76.mutex);
+ }
+ 
+@@ -783,7 +804,8 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+-	u8 band_idx = mvif->phy->mt76->band_idx;
++	struct mt7996_bss_conf *mconf = mconf_dereference_protected(mvif, 0);
++	u8 band_idx = mconf->phy->mt76->band_idx;
+ 	int idx;
+ 
+ #ifdef CONFIG_MTK_VENDOR
+@@ -803,7 +825,7 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 	msta->wcid.tx_info |= MT_WCID_TX_INFO_SET;
+ 
+ #ifdef CONFIG_MTK_VENDOR
+-	mt7996_vendor_amnt_sta_remove(mvif->phy, sta);
++	mt7996_vendor_amnt_sta_remove(mconf->phy, sta);
+ #endif
+ 
+ #ifdef CONFIG_MTK_VENDOR
+@@ -830,15 +852,20 @@ void mt7996_mac_sta_assoc(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 			  struct ieee80211_sta *sta)
+ {
+ 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
++	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_bss_conf *mconf;
++	struct ieee80211_bss_conf *conf;
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+ 
+ 	mt7996_mac_wtbl_update(dev, msta->wcid.idx,
+ 			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
+ 
+-	mt7996_mcu_add_sta(dev, vif, sta, true, true);
+-	mt7996_mcu_add_rate_ctrl(dev, vif, sta, false);
++	conf = link_conf_dereference_protected(vif, 0);
++	mconf = mconf_dereference_protected(mvif, 0);
++	mt7996_mcu_add_sta(dev, conf, mconf, sta, true, true);
++	mt7996_mcu_add_rate_ctrl(dev, conf, mconf, sta, false);
+ 
+ 	ewma_avg_signal_init(&msta->avg_ack_signal);
+ 
+@@ -849,10 +876,15 @@ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 			   struct ieee80211_sta *sta)
+ {
+ 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
++	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_bss_conf *mconf;
++	struct ieee80211_bss_conf *conf;
+ 	int i;
+ 
+-	mt7996_mcu_add_sta(dev, vif, sta, false, false);
++	conf = link_conf_dereference_protected(vif, 0);
++	mconf = mconf_dereference_protected(mvif, 0);
++	mt7996_mcu_add_sta(dev, conf, mconf, sta, false, false);
+ 
+ 	mt7996_mac_wtbl_update(dev, msta->wcid.idx,
+ 			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
+@@ -984,7 +1016,7 @@ mt7996_get_stats(struct ieee80211_hw *hw,
+ 	return 0;
+ }
+ 
+-u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif)
++u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_bss_conf *mconf)
+ {
+ 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
+ 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
+@@ -996,8 +1028,8 @@ u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif)
+ 
+ 	lockdep_assert_held(&dev->mt76.mutex);
+ 
+-	n = mvif->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
+-					       : mvif->mt76.omac_idx;
++	n = mconf->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
++					       : mconf->mt76.omac_idx;
+ 	/* TSF software read */
+ 	mt76_rmw(dev, MT_LPON_TCR(phy->mt76->band_idx, n), MT_LPON_TCR_SW_MODE,
+ 		 MT_LPON_TCR_SW_READ);
+@@ -1012,10 +1044,12 @@ mt7996_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+ {
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
++	struct mt7996_bss_conf *mconf;
+ 	u64 ret;
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+-	ret = __mt7996_get_tsf(hw, mvif);
++	mconf = mconf_dereference_protected(mvif, 0);
++	ret = __mt7996_get_tsf(hw, mconf);
+ 	mutex_unlock(&dev->mt76.mutex);
+ 
+ 	return ret;
+@@ -1028,6 +1062,7 @@ mt7996_set_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
+ 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
++	struct mt7996_bss_conf *mconf;
+ 	union {
+ 		u64 t64;
+ 		u32 t32[2];
+@@ -1036,8 +1071,9 @@ mt7996_set_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+ 
+-	n = mvif->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
+-					       : mvif->mt76.omac_idx;
++	mconf = mconf_dereference_protected(mvif, 0);
++	n = mconf->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
++					       : mconf->mt76.omac_idx;
+ 	mt76_wr(dev, MT_LPON_UTTR0(phy->mt76->band_idx), tsf.t32[0]);
+ 	mt76_wr(dev, MT_LPON_UTTR1(phy->mt76->band_idx), tsf.t32[1]);
+ 	/* TSF software overwrite */
+@@ -1054,6 +1090,7 @@ mt7996_offset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
+ 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
++	struct mt7996_bss_conf *mconf;
+ 	union {
+ 		u64 t64;
+ 		u32 t32[2];
+@@ -1062,8 +1099,9 @@ mt7996_offset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+ 
+-	n = mvif->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
+-					       : mvif->mt76.omac_idx;
++	mconf = mconf_dereference_protected(mvif, 0);
++	n = mconf->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
++					       : mconf->mt76.omac_idx;
+ 	mt76_wr(dev, MT_LPON_UTTR0(phy->mt76->band_idx), tsf.t32[0]);
+ 	mt76_wr(dev, MT_LPON_UTTR1(phy->mt76->band_idx), tsf.t32[1]);
+ 	/* TSF software adjust*/
+@@ -1179,7 +1217,7 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
+ static void mt7996_sta_rc_work(void *data, struct ieee80211_sta *sta)
+ {
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+-	struct mt7996_dev *dev = msta->vif->phy->dev;
++	struct mt7996_dev *dev = msta->vif->dev;
+ 	u32 *changed = data;
+ 
+ 	spin_lock_bh(&dev->mt76.sta_poll_lock);
+@@ -1215,9 +1253,13 @@ mt7996_set_bitrate_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
+ 	struct mt7996_dev *dev = phy->dev;
++	struct mt7996_bss_conf *mconf;
+ 	u32 changed = IEEE80211_RC_SUPP_RATES_CHANGED;
+ 
+-	mvif->bitrate_mask = *mask;
++	mutex_lock(&dev->mt76.mutex);
++	mconf = mconf_dereference_protected(mvif, 0);
++	mconf->bitrate_mask = *mask;
++	mutex_unlock(&dev->mt76.mutex);
+ 
+ 	/* if multiple rates across different preambles are given we can
+ 	 * reconfigure this info with all peers using sta_rec command with
+@@ -1239,14 +1281,20 @@ static void mt7996_sta_set_4addr(struct ieee80211_hw *hw,
+ 				 bool enabled)
+ {
+ 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
++	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_bss_conf *mconf;
++
++	mutex_lock(&dev->mt76.mutex);
++	mconf = mconf_dereference_protected(mvif, 0);
+ 
+ 	if (enabled)
+ 		set_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
+ 	else
+ 		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
+ 
+-	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, sta);
++	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, sta);
++	mutex_unlock(&dev->mt76.mutex);
+ }
+ 
+ static void mt7996_sta_set_decap_offload(struct ieee80211_hw *hw,
+@@ -1255,14 +1303,20 @@ static void mt7996_sta_set_decap_offload(struct ieee80211_hw *hw,
+ 					 bool enabled)
+ {
+ 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
++	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_bss_conf *mconf;
++
++	mutex_lock(&dev->mt76.mutex);
++	mconf = mconf_dereference_protected(mvif, 0);
+ 
+ 	if (enabled)
+ 		set_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
+ 	else
+ 		clear_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
+ 
+-	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, sta);
++	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, sta);
++	mutex_unlock(&dev->mt76.mutex);
+ }
+ 
+ static const char mt7996_gstrings_stats[][ETH_GSTRING_LEN] = {
+@@ -1395,7 +1449,7 @@ static void mt7996_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
+ 	struct mt76_ethtool_worker_info *wi = wi_data;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 
+-	if (msta->vif->mt76.idx != wi->idx)
++	if (msta->vif->deflink.mt76.idx != wi->idx)
+ 		return;
+ 
+ 	mt76_ethtool_worker(wi, &msta->wcid.stats, true);
+@@ -1409,15 +1463,17 @@ void mt7996_get_et_stats(struct ieee80211_hw *hw,
+ 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
+ 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct mt7996_bss_conf *mconf;
+ 	struct mt76_mib_stats *mib = &phy->mib;
+ 	struct mt76_ethtool_worker_info wi = {
+ 		.data = data,
+-		.idx = mvif->mt76.idx,
+ 	};
+ 	/* See mt7996_ampdu_stat_read_phy, etc */
+ 	int i, ei = 0;
+ 
+ 	mutex_lock(&dev->mt76.mutex);
++	mconf = mconf_dereference_protected(mvif, 0);
++	wi.idx = mconf->mt76.idx,
+ 
+ 	mt7996_mac_update_stats(phy);
+ 
+@@ -1623,6 +1679,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+ 			     struct net_device_path *path)
+ {
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct mt7996_bss_conf *mconf = &mvif->deflink;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
+ 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
+@@ -1652,7 +1709,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+ 	path->type = DEV_PATH_MTK_WDMA;
+ 	path->dev = ctx->dev;
+ 	path->mtk_wdma.wdma_idx = wed->wdma_idx;
+-	path->mtk_wdma.bss = mvif->mt76.idx;
++	path->mtk_wdma.bss = mconf->mt76.idx;
+ 	path->mtk_wdma.queue = 0;
+ 	path->mtk_wdma.wcid = msta->wcid.idx;
+ 
+@@ -1784,6 +1841,7 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	struct mt7996_chanctx *ctx = mt7996_chanctx_get(conf);
+ 	struct mt7996_phy *phy = ctx->phy;
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct mt7996_bss_conf *mconf;
+ 
+ 	wiphy_info(hw->wiphy, "Assign VIF (addr: %pM, type: %d, link_id: %d) to channel context: %d MHz\n",
+ 		    vif->addr, vif->type, link_conf->link_id,
+@@ -1791,7 +1849,8 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 
+ 	mutex_lock(&phy->dev->mt76.mutex);
+ 
+-	mvif->chanctx = ctx;
++	mconf = mconf_dereference_protected(mvif, 0);
++	mconf->chanctx = ctx;
+ 	ctx->nbss_assigned++;
+ 
+ 	mutex_unlock(&phy->dev->mt76.mutex);
+@@ -1807,6 +1866,7 @@ mt7996_unassign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	struct mt7996_chanctx *ctx = mt7996_chanctx_get(conf);
+ 	struct mt7996_phy *phy = ctx->phy;
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct mt7996_bss_conf *mconf;
+ 
+ 	wiphy_info(hw->wiphy, "Remove VIF (addr: %pM, type: %d, link_id: %d) from channel context: %d MHz\n",
+ 		   vif->addr, vif->type, link_conf->link_id,
+@@ -1818,7 +1878,8 @@ mt7996_unassign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	if (test_bit(MT76_SCANNING, &phy->mt76->state))
+ 		mt7996_scan_complete(phy, true);
+ 
+-	mvif->chanctx = NULL;
++	mconf = mconf_dereference_protected(mvif, 0);
++	mconf->chanctx = NULL;
+ 	ctx->nbss_assigned--;
+ 
+ 	mutex_unlock(&phy->dev->mt76.mutex);
+diff --git a/mt7996/mcu.c b/mt7996/mcu.c
+index 5319cc3..ebd3192 100644
+--- a/mt7996/mcu.c
++++ b/mt7996/mcu.c
+@@ -117,12 +117,12 @@ mt7996_mcu_get_sta_nss(u16 mcs_map)
+ }
+ 
+ static void
+-mt7996_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
+-			  u16 mcs_map)
++mt7996_mcu_set_sta_he_mcs(struct ieee80211_sta *sta,
++			  struct mt7996_bss_conf *mconf,
++			  __le16 *he_mcs, u16 mcs_map)
+ {
+-	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+-	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
+-	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
++	enum nl80211_band band = mconf->phy->mt76->chandef.chan->band;
++	const u16 *mask = mconf->bitrate_mask.control[band].he_mcs;
+ 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
+ 
+ 	for (nss = 0; nss < max_nss; nss++) {
+@@ -922,8 +922,7 @@ mt7996_mcu_add_uni_tlv(struct sk_buff *skb, u16 tag, u16 len)
+ }
+ 
+ static void
+-mt7996_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+-			struct mt7996_phy *phy)
++mt7996_mcu_bss_rfch_tlv(struct sk_buff *skb, struct mt7996_phy *phy)
+ {
+ 	static const u8 rlm_ch_band[] = {
+ 		[NL80211_BAND_2GHZ] = 1,
+@@ -953,8 +952,7 @@ mt7996_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+ }
+ 
+ static void
+-mt7996_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+-		      struct mt7996_phy *phy)
++mt7996_mcu_bss_ra_tlv(struct sk_buff *skb)
+ {
+ 	struct bss_ra_tlv *ra;
+ 	struct tlv *tlv;
+@@ -966,7 +964,7 @@ mt7996_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+ }
+ 
+ static void
+-mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
++mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
+ 		      struct mt7996_phy *phy)
+ {
+ #define DEFAULT_HE_PE_DURATION		4
+@@ -975,16 +973,16 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+ 	struct bss_info_uni_he *he;
+ 	struct tlv *tlv;
+ 
+-	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
++	cap = mt76_connac_get_he_phy_cap(phy->mt76, conf->vif);
+ 
+ 	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
+ 
+ 	he = (struct bss_info_uni_he *)tlv;
+-	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
++	he->he_pe_duration = conf->htc_trig_based_pkt_ext;
+ 	if (!he->he_pe_duration)
+ 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
+ 
+-	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
++	he->he_rts_thres = cpu_to_le16(conf->frame_time_rts_th);
+ 	if (!he->he_rts_thres)
+ 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
+ 
+@@ -994,13 +992,13 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+ }
+ 
+ static void
+-mt7996_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
++mt7996_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
+ 			  struct mt7996_phy *phy, int enable)
+ {
+ 	struct bss_info_uni_mbssid *mbssid;
+ 	struct tlv *tlv;
+ 
+-	if (!vif->bss_conf.bssid_indicator && enable)
++	if (!conf->bssid_indicator && enable)
+ 		return;
+ 
+ 	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_11V_MBSSID, sizeof(*mbssid));
+@@ -1008,23 +1006,21 @@ mt7996_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+ 	mbssid = (struct bss_info_uni_mbssid *)tlv;
+ 
+ 	if (enable) {
+-		mbssid->max_indicator = vif->bss_conf.bssid_indicator;
+-		mbssid->mbss_idx = vif->bss_conf.bssid_index;
++		mbssid->max_indicator = conf->bssid_indicator;
++		mbssid->mbss_idx = conf->bssid_index;
+ 		mbssid->tx_bss_omac_idx = 0;
+ 	}
+ }
+ 
+ static void
+-mt7996_mcu_bss_bmc_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
++mt7996_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7996_bss_conf *mconf,
+ 		       struct mt7996_phy *phy)
+ {
+-	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
+ 	struct bss_rate_tlv *bmc;
+ 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
+ 	enum nl80211_band band = chandef->chan->band;
+ 	struct tlv *tlv;
+-	u8 idx = mvif->mcast_rates_idx ?
+-		 mvif->mcast_rates_idx : mvif->basic_rates_idx;
++	u8 idx = mconf->mt76.mcast_rates_idx ?: mconf->mt76.basic_rates_idx;
+ 
+ 	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_RATE, sizeof(*bmc));
+ 
+@@ -1048,9 +1044,9 @@ mt7996_mcu_bss_txcmd_tlv(struct sk_buff *skb, bool en)
+ }
+ 
+ static void
+-mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
++mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
++		       struct mt7996_bss_conf *mconf)
+ {
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct bss_mld_tlv *mld;
+ 	struct tlv *tlv;
+ 
+@@ -1058,33 +1054,30 @@ mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
+ 
+ 	mld = (struct bss_mld_tlv *)tlv;
+ 	mld->group_mld_id = 0xff;
+-	mld->own_mld_id = mvif->mt76.idx;
++	mld->own_mld_id = mconf->mt76.idx;
+ 	mld->remap_idx = 0xff;
+ }
+ 
+ static void
+-mt7996_mcu_bss_sec_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
++mt7996_mcu_bss_sec_tlv(struct sk_buff *skb, struct mt7996_bss_conf *mconf)
+ {
+-	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
+ 	struct bss_sec_tlv *sec;
+ 	struct tlv *tlv;
+ 
+ 	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_SEC, sizeof(*sec));
+ 
+ 	sec = (struct bss_sec_tlv *)tlv;
+-	sec->cipher = mvif->cipher;
++	sec->cipher = mconf->mt76.cipher;
+ }
+ 
+ static int
+-mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+-		       bool bssid, bool enable)
++mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
++		       struct mt7996_bss_conf *mconf, bool bssid, bool enable)
+ {
+ #define UNI_MUAR_ENTRY 2
+ 	struct mt7996_dev *dev = phy->dev;
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+-	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
+-	const u8 *addr = vif->addr;
+-
++	u32 idx = mconf->mt76.omac_idx - REPEATER_BSSID_START;
++	const u8 *addr = bssid ? conf->bssid : conf->vif->addr;
+ 	struct {
+ 		struct {
+ 			u8 band;
+@@ -1109,9 +1102,6 @@ mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+ 		.entry_add = true,
+ 	};
+ 
+-	if (bssid)
+-		addr = vif->bss_conf.bssid;
+-
+ 	if (enable)
+ 		memcpy(req.addr, addr, ETH_ALEN);
+ 
+@@ -1120,10 +1110,8 @@ mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+ }
+ 
+ static void
+-mt7996_mcu_bss_ifs_timing_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
++mt7996_mcu_bss_ifs_timing_tlv(struct sk_buff *skb, struct mt7996_phy *phy)
+ {
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+-	struct mt7996_phy *phy = mvif->phy;
+ 	struct bss_ifs_time_tlv *ifs_time;
+ 	struct tlv *tlv;
+ 	bool is_2ghz = phy->mt76->chandef.chan->band == NL80211_BAND_2GHZ;
+@@ -1149,12 +1137,13 @@ mt7996_mcu_bss_ifs_timing_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
+ 
+ static int
+ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+-			 struct ieee80211_vif *vif,
++			 struct ieee80211_bss_conf *conf,
++			 struct mt7996_bss_conf *mconf,
+ 			 struct ieee80211_sta *sta,
+ 			 struct mt76_phy *phy, u16 wlan_idx,
+ 			 bool enable)
+ {
+-	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
++	struct ieee80211_vif *vif = conf->vif;
+ 	struct cfg80211_chan_def *chandef = &phy->chandef;
+ 	struct mt76_connac_bss_basic_tlv *bss;
+ 	u32 type = CONNECTION_INFRA_AP;
+@@ -1171,8 +1160,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+ 		if (enable) {
+ 			rcu_read_lock();
+ 			if (!sta)
+-				sta = ieee80211_find_sta(vif,
+-							 vif->bss_conf.bssid);
++				sta = ieee80211_find_sta(vif, conf->bssid);
+ 			/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
+ 			if (sta) {
+ 				struct mt76_wcid *wcid;
+@@ -1195,18 +1183,17 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+ 	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*bss));
+ 
+ 	bss = (struct mt76_connac_bss_basic_tlv *)tlv;
+-	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
+-	bss->dtim_period = vif->bss_conf.dtim_period;
+ 	bss->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
+ 	bss->sta_idx = cpu_to_le16(sta_wlan_idx);
+ 	bss->conn_type = cpu_to_le32(type);
+-	bss->omac_idx = mvif->omac_idx;
+-	bss->band_idx = mvif->band_idx;
+-	bss->wmm_idx = mvif->wmm_idx;
++	bss->omac_idx = mconf->mt76.omac_idx;
++	bss->band_idx = mconf->mt76.band_idx;
++	bss->wmm_idx = mconf->mt76.wmm_idx;
+ 	bss->conn_state = !enable;
+ 	bss->active = enable;
+ 
+-	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
++	idx = mconf->mt76.omac_idx > EXT_BSSID_START ? HW_BSSID_0 :
++						       mconf->mt76.omac_idx;
+ 	bss->hw_bss_idx = idx;
+ 
+ 	if (vif->type == NL80211_IFTYPE_MONITOR) {
+@@ -1219,9 +1206,9 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
+ 		return 0;
+ 	}
+ 
+-	memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
+-	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
+-	bss->dtim_period = vif->bss_conf.dtim_period;
++	memcpy(bss->bssid, conf->bssid, ETH_ALEN);
++	bss->bcn_interval = cpu_to_le16(conf->beacon_int);
++	bss->dtim_period = conf->dtim_period;
+ 	bss->phymode = mt76_connac_get_phy_mode(phy, vif,
+ 						chandef->chan->band, NULL);
+ 	bss->phymode_ext = mt76_connac_get_phy_mode_ext(phy, vif,
+@@ -1248,63 +1235,64 @@ __mt7996_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
+ }
+ 
+ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
+-			    struct ieee80211_vif *vif, int enable)
++			    struct ieee80211_bss_conf *conf,
++			    struct mt7996_bss_conf *mconf, int enable)
+ {
++	struct ieee80211_vif *vif = conf->vif;
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_dev *dev = phy->dev;
+ 	struct sk_buff *skb;
+ 
+-	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START) {
+-		mt7996_mcu_muar_config(phy, vif, false, enable);
+-		mt7996_mcu_muar_config(phy, vif, true, enable);
++	if (mconf->mt76.omac_idx >= REPEATER_BSSID_START) {
++		mt7996_mcu_muar_config(phy, conf, mconf, false, enable);
++		mt7996_mcu_muar_config(phy, conf, mconf, true, enable);
+ 	}
+ 
+-	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76,
++	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
+ 					 MT7996_BSS_UPDATE_MAX_SIZE);
+ 	if (IS_ERR(skb))
+ 		return PTR_ERR(skb);
+ 
+ 	/* bss_basic must be first */
+-	mt7996_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
++	mt7996_mcu_bss_basic_tlv(skb, conf, mconf, NULL, phy->mt76,
+ 				 mvif->sta.wcid.idx, enable);
+-	mt7996_mcu_bss_sec_tlv(skb, vif);
++	mt7996_mcu_bss_sec_tlv(skb, mconf);
+ 
+ 	if (vif->type == NL80211_IFTYPE_MONITOR)
+ 		goto out;
+ 
+ 	if (enable) {
+-		mt7996_mcu_bss_rfch_tlv(skb, vif, phy);
+-		mt7996_mcu_bss_bmc_tlv(skb, vif, phy);
+-		mt7996_mcu_bss_ra_tlv(skb, vif, phy);
++		mt7996_mcu_bss_rfch_tlv(skb, phy);
++		mt7996_mcu_bss_bmc_tlv(skb, mconf, phy);
++		mt7996_mcu_bss_ra_tlv(skb);
+ 		mt7996_mcu_bss_txcmd_tlv(skb, true);
+-		mt7996_mcu_bss_ifs_timing_tlv(skb, vif);
++		mt7996_mcu_bss_ifs_timing_tlv(skb, phy);
+ 
+-		if (vif->bss_conf.he_support)
+-			mt7996_mcu_bss_he_tlv(skb, vif, phy);
++		if (conf->he_support)
++			mt7996_mcu_bss_he_tlv(skb, conf, phy);
+ 
+ 		/* this tag is necessary no matter if the vif is MLD */
+-		mt7996_mcu_bss_mld_tlv(skb, vif);
++		mt7996_mcu_bss_mld_tlv(skb, vif, mconf);
+ 	}
+ 
+-	mt7996_mcu_bss_mbssid_tlv(skb, vif, phy, enable);
++	mt7996_mcu_bss_mbssid_tlv(skb, conf, phy, enable);
+ 
+ out:
+ 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
+ 				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
+ }
+ 
+-int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif)
++int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct mt7996_bss_conf *mconf)
+ {
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_dev *dev = phy->dev;
+ 	struct sk_buff *skb;
+ 
+-	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76,
++	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
+ 					 MT7996_BSS_UPDATE_MAX_SIZE);
+ 	if (IS_ERR(skb))
+ 		return PTR_ERR(skb);
+ 
+-	mt7996_mcu_bss_ifs_timing_tlv(skb, vif);
++	mt7996_mcu_bss_ifs_timing_tlv(skb, phy);
+ 
+ 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
+ 				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
+@@ -1346,12 +1334,12 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
+ 			 bool enable)
+ {
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)params->sta->drv_priv;
+-	struct mt7996_vif *mvif = msta->vif;
++	struct mt7996_bss_conf *mconf = mconf_dereference_protected(msta->vif, 0);
+ 
+ 	if (enable && !params->amsdu)
+ 		msta->wcid.amsdu = false;
+ 
+-	return mt7996_mcu_sta_ba(dev, &mvif->mt76, params, enable, true);
++	return mt7996_mcu_sta_ba(dev, &mconf->mt76, params, enable, true);
+ }
+ 
+ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
+@@ -1359,13 +1347,14 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
+ 			 bool enable)
+ {
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)params->sta->drv_priv;
+-	struct mt7996_vif *mvif = msta->vif;
++	struct mt7996_bss_conf *mconf = mconf_dereference_protected(msta->vif, 0);
+ 
+-	return mt7996_mcu_sta_ba(dev, &mvif->mt76, params, enable, false);
++	return mt7996_mcu_sta_ba(dev, &mconf->mt76, params, enable, false);
+ }
+ 
+ static void
+-mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
++mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
++		      struct mt7996_bss_conf *mconf,
+ 		      struct ieee80211_sta *sta)
+ {
+ 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
+@@ -1386,9 +1375,9 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+ 		he->he_phy_cap[i] = elem->phy_cap_info[i];
+ 	}
+ 
+-	if (vif->type == NL80211_IFTYPE_AP &&
++	if (conf->vif->type == NL80211_IFTYPE_AP &&
+ 	    (elem->phy_cap_info[1] & IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
+-		u8p_replace_bits(&he->he_phy_cap[1], vif->bss_conf.he_ldpc,
++		u8p_replace_bits(&he->he_phy_cap[1], conf->he_ldpc,
+ 				 IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD);
+ 
+ 	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
+@@ -1396,16 +1385,16 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+ 	case IEEE80211_STA_RX_BW_160:
+ 		if (elem->phy_cap_info[0] &
+ 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
+-			mt7996_mcu_set_sta_he_mcs(sta,
++			mt7996_mcu_set_sta_he_mcs(sta, mconf,
+ 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
+ 						  le16_to_cpu(mcs_map.rx_mcs_80p80));
+ 
+-		mt7996_mcu_set_sta_he_mcs(sta,
++		mt7996_mcu_set_sta_he_mcs(sta, mconf,
+ 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
+ 					  le16_to_cpu(mcs_map.rx_mcs_160));
+ 		fallthrough;
+ 	default:
+-		mt7996_mcu_set_sta_he_mcs(sta,
++		mt7996_mcu_set_sta_he_mcs(sta, mconf,
+ 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
+ 					  le16_to_cpu(mcs_map.rx_mcs_80));
+ 		break;
+@@ -1496,7 +1485,7 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+ 	struct tlv *tlv;
+ #ifdef CONFIG_MTK_VENDOR
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+-	struct mt7996_phy *phy = (struct mt7996_phy *)msta->vif->phy;
++	struct mt7996_phy *phy = (struct mt7996_phy *)msta->vif->deflink.phy;
+ #endif
+ 
+ 	/* For 6G band, this tlv is necessary to let hw work normally */
+@@ -1553,25 +1542,26 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 
+ static void
+ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+-			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
++			struct ieee80211_bss_conf *conf,
++			struct mt7996_bss_conf *mconf,
++			struct ieee80211_sta *sta)
+ {
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+-	struct mt7996_phy *phy = mvif->phy;
++	struct mt7996_phy *phy = mconf->phy;
+ 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
+ 	struct sta_rec_muru *muru;
+ 	struct tlv *tlv;
+ 
+-	if (vif->type != NL80211_IFTYPE_STATION &&
+-	    vif->type != NL80211_IFTYPE_AP)
++	if (conf->vif->type != NL80211_IFTYPE_STATION &&
++	    conf->vif->type != NL80211_IFTYPE_AP)
+ 		return;
+ 
+ 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
+ 
+ 	muru = (struct sta_rec_muru *)tlv;
+-	muru->cfg.mimo_dl_en = (vif->bss_conf.eht_mu_beamformer ||
+-				vif->bss_conf.he_mu_beamformer ||
+-				vif->bss_conf.vht_mu_beamformer ||
+-				vif->bss_conf.vht_mu_beamformee) &&
++	muru->cfg.mimo_dl_en = (conf->eht_mu_beamformer ||
++				conf->he_mu_beamformer ||
++				conf->vht_mu_beamformer ||
++				conf->vht_mu_beamformee) &&
+ 			       !!(phy->muru_onoff & MUMIMO_DL);
+ 	muru->cfg.mimo_ul_en = !!(phy->muru_onoff & MUMIMO_UL);
+ 	muru->cfg.ofdma_dl_en = !!(phy->muru_onoff & OFDMA_DL);
+@@ -1612,13 +1602,14 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ }
+ 
+ static inline bool
+-mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
++mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
++			struct mt7996_bss_conf *mconf,
+ 			struct ieee80211_sta *sta, bool bfee)
+ {
+ 	int sts = hweight16(phy->mt76->chainmask);
+ 
+-	if (vif->type != NL80211_IFTYPE_STATION &&
+-	    vif->type != NL80211_IFTYPE_AP)
++	if (conf->vif->type != NL80211_IFTYPE_STATION &&
++	    conf->vif->type != NL80211_IFTYPE_AP)
+ 		return false;
+ 
+ 	if (!bfee && sts < 2)
+@@ -1629,10 +1620,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+ 		struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
+ 
+ 		if (bfee)
+-			return vif->bss_conf.eht_su_beamformee &&
++			return conf->eht_su_beamformee &&
+ 			       EHT_PHY(CAP0_SU_BEAMFORMEE, pe->phy_cap_info[0]);
+ 		else
+-			return vif->bss_conf.eht_su_beamformer &&
++			return conf->eht_su_beamformer &&
+ 			       EHT_PHY(CAP0_SU_BEAMFORMER, pe->phy_cap_info[0]);
+ 	}
+ 
+@@ -1640,10 +1631,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+ 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
+ 
+ 		if (bfee)
+-			return vif->bss_conf.he_su_beamformee &&
++			return conf->he_su_beamformee &&
+ 			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
+ 		else
+-			return vif->bss_conf.he_su_beamformer &&
++			return conf->he_su_beamformer &&
+ 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
+ 	}
+ 
+@@ -1651,10 +1642,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+ 		u32 cap = sta->deflink.vht_cap.cap;
+ 
+ 		if (bfee)
+-			return vif->bss_conf.vht_su_beamformee &&
++			return conf->vht_su_beamformee &&
+ 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
+ 		else
+-			return vif->bss_conf.vht_su_beamformer &&
++			return conf->vht_su_beamformer &&
+ 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
+ 	}
+ 
+@@ -1850,10 +1841,10 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+ 
+ static void
+ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+-			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
++			struct ieee80211_bss_conf *conf, struct mt7996_bss_conf *mconf,
++			struct ieee80211_sta *sta)
+ {
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+-	struct mt7996_phy *phy = mvif->phy;
++	struct mt7996_phy *phy = mconf->phy;
+ 	int tx_ant = hweight16(phy->mt76->chainmask) - 1;
+ 	struct sta_rec_bf *bf;
+ 	struct tlv *tlv;
+@@ -1868,7 +1859,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
+ 		return;
+ 
+-	ebf = mt7996_is_ebf_supported(phy, vif, sta, false);
++	ebf = mt7996_is_ebf_supported(phy, conf, mconf, sta, false);
+ 	if (!ebf && !dev->ibf)
+ 		return;
+ 
+@@ -1880,9 +1871,9 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 	 * ht: iBF only, since mac80211 lacks of eBF support
+ 	 */
+ 	if (sta->deflink.eht_cap.has_eht && ebf)
+-		mt7996_mcu_sta_bfer_eht(sta, vif, phy, bf);
++		mt7996_mcu_sta_bfer_eht(sta, conf->vif, phy, bf);
+ 	else if (sta->deflink.he_cap.has_he && ebf)
+-		mt7996_mcu_sta_bfer_he(sta, vif, phy, bf);
++		mt7996_mcu_sta_bfer_he(sta, conf->vif, phy, bf);
+ 	else if (sta->deflink.vht_cap.vht_supported)
+ 		mt7996_mcu_sta_bfer_vht(sta, phy, bf, ebf);
+ 	else if (sta->deflink.ht_cap.ht_supported)
+@@ -1921,10 +1912,10 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 
+ static void
+ mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+-			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
++			struct ieee80211_bss_conf *conf,
++			struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta)
+ {
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+-	struct mt7996_phy *phy = mvif->phy;
++	struct mt7996_phy *phy = mconf->phy;
+ 	int tx_ant = hweight8(phy->mt76->antenna_mask) - 1;
+ 	struct sta_rec_bfee *bfee;
+ 	struct tlv *tlv;
+@@ -1933,7 +1924,7 @@ mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
+ 		return;
+ 
+-	if (!mt7996_is_ebf_supported(phy, vif, sta, true))
++	if (!mt7996_is_ebf_supported(phy, conf, mconf, sta, true))
+ 		return;
+ 
+ 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
+@@ -2055,17 +2046,17 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
+ 				     MCU_WM_UNI_CMD(RA), true);
+ }
+ 
+-int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif,
++int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
++			       struct mt7996_bss_conf *mconf,
+ 			       struct ieee80211_sta *sta, void *data, u32 field)
+ {
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 	struct sta_phy_uni *phy = data;
+ 	struct sta_rec_ra_fixed_uni *ra;
+ 	struct sk_buff *skb;
+ 	struct tlv *tlv;
+ 
+-	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
++	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
+ 					      &msta->wcid,
+ 					      MT7996_STA_UPDATE_MAX_SIZE);
+ 	if (IS_ERR(skb))
+@@ -2097,12 +2088,13 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif
+ }
+ 
+ static int
+-mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif,
++mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
++			       struct ieee80211_bss_conf *conf,
++			       struct mt7996_bss_conf *mconf,
+ 			       struct ieee80211_sta *sta)
+ {
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+-	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
+-	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
++	struct cfg80211_chan_def *chandef = &mconf->phy->mt76->chandef;
++	struct cfg80211_bitrate_mask *mask = &mconf->bitrate_mask;
+ 	enum nl80211_band band = chandef->chan->band;
+ 	struct sta_phy_uni phy = {};
+ 	int ret, nrates = 0;
+@@ -2144,7 +2136,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
+ 
+ 	/* fixed single rate */
+ 	if (nrates == 1) {
+-		ret = mt7996_mcu_set_fixed_field(dev, vif, sta, &phy,
++		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
+ 						 RATE_PARAM_FIXED_MCS);
+ 		if (ret)
+ 			return ret;
+@@ -2166,7 +2158,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
+ 		else
+ 			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
+ 
+-		ret = mt7996_mcu_set_fixed_field(dev, vif, sta, &phy,
++		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
+ 						 RATE_PARAM_FIXED_GI);
+ 		if (ret)
+ 			return ret;
+@@ -2174,7 +2166,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
+ 
+ 	/* fixed HE_LTF */
+ 	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
+-		ret = mt7996_mcu_set_fixed_field(dev, vif, sta, &phy,
++		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
+ 						 RATE_PARAM_FIXED_HE_LTF);
+ 		if (ret)
+ 			return ret;
+@@ -2185,13 +2177,14 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
+ 
+ static void
+ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+-			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
++			     struct ieee80211_bss_conf *conf,
++			     struct mt7996_bss_conf *mconf,
++			     struct ieee80211_sta *sta)
+ {
+ #define INIT_RCPI 180
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+-	struct mt76_phy *mphy = mvif->phy->mt76;
++	struct mt76_phy *mphy = mconf->phy->mt76;
+ 	struct cfg80211_chan_def *chandef = &mphy->chandef;
+-	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
++	struct cfg80211_bitrate_mask *mask = &mconf->bitrate_mask;
+ 	enum nl80211_band band = chandef->chan->band;
+ 	struct sta_rec_ra_uni *ra;
+ 	struct tlv *tlv;
+@@ -2203,7 +2196,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+ 
+ 	ra->valid = true;
+ 	ra->auto_rate = true;
+-	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
++	ra->phy_mode = mt76_connac_get_phy_mode(mphy, conf->vif, band, sta);
+ 	ra->channel = chandef->chan->hw_value;
+ 	ra->bw = (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_320) ?
+ 		 CMD_CBW_320MHZ : sta->deflink.bandwidth;
+@@ -2242,7 +2235,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+ 			cap |= STA_CAP_TX_STBC;
+ 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
+ 			cap |= STA_CAP_RX_STBC;
+-		if (vif->bss_conf.ht_ldpc &&
++		if (conf->ht_ldpc &&
+ 		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
+ 			cap |= STA_CAP_LDPC;
+ 
+@@ -2268,7 +2261,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+ 			cap |= STA_CAP_VHT_TX_STBC;
+ 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
+ 			cap |= STA_CAP_VHT_RX_STBC;
+-		if (vif->bss_conf.vht_ldpc &&
++		if (conf->vht_ldpc &&
+ 		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
+ 			cap |= STA_CAP_VHT_LDPC;
+ 
+@@ -2289,15 +2282,16 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+ 	memset(ra->rx_rcpi, INIT_RCPI, sizeof(ra->rx_rcpi));
+ }
+ 
+-int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
++int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
++			     struct ieee80211_bss_conf *conf,
++			     struct mt7996_bss_conf *mconf,
+ 			     struct ieee80211_sta *sta, bool changed)
+ {
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 	struct sk_buff *skb;
+ 	int ret;
+ 
+-	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
++	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
+ 					      &msta->wcid,
+ 					      MT7996_STA_UPDATE_MAX_SIZE);
+ 	if (IS_ERR(skb))
+@@ -2308,26 +2302,27 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ 	 * update sta_rec_he here.
+ 	 */
+ 	if (changed)
+-		mt7996_mcu_sta_he_tlv(skb, vif, sta);
++		mt7996_mcu_sta_he_tlv(skb, conf, mconf, sta);
+ 
+ 	/* sta_rec_ra accommodates BW, NSS and only MCS range format
+ 	 * i.e 0-{7,8,9} for VHT.
+ 	 */
+-	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
++	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, conf, mconf, sta);
+ 
+ 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
+ 				    MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
+ 	if (ret)
+ 		return ret;
+ 
+-	return mt7996_mcu_add_rate_ctrl_fixed(dev, vif, sta);
++	return mt7996_mcu_add_rate_ctrl_fixed(dev, conf, mconf, sta);
+ }
+ 
+ static int
+-mt7996_mcu_sta_init_vow(struct mt7996_phy *phy, struct mt7996_sta *msta)
++mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf, struct mt7996_sta *msta)
+ {
++	struct mt7996_phy *phy = mconf->phy;
+ 	struct mt7996_vow_sta_ctrl *vow = &msta->vow;
+-	u8 omac_idx = msta->vif->mt76.omac_idx;
++	u8 omac_idx = mconf->mt76.omac_idx;
+ 	int ret;
+ 
+ 	/* Assignment of STA BSS group index aligns FW.
+@@ -2344,20 +2339,22 @@ mt7996_mcu_sta_init_vow(struct mt7996_phy *phy, struct mt7996_sta *msta)
+ 	vow->drr_quantum[IEEE80211_AC_BE] = VOW_DRR_QUANTUM_IDX2;
+ 	vow->drr_quantum[IEEE80211_AC_BK] = VOW_DRR_QUANTUM_IDX2;
+ 
+-	ret = mt7996_mcu_set_vow_drr_ctrl(phy, msta, VOW_DRR_CTRL_STA_BSS_GROUP);
++	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_BSS_GROUP);
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = mt7996_mcu_set_vow_drr_ctrl(phy, msta, VOW_DRR_CTRL_STA_PAUSE);
++	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_PAUSE);
+ 	if (ret)
+ 		return ret;
+ 
+-	return mt7996_mcu_set_vow_drr_ctrl(phy, msta, VOW_DRR_CTRL_STA_ALL);
++	return mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_ALL);
+ }
+ 
+-int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+-		       struct ieee80211_sta *sta, bool enable, bool newly)
++int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
++		       struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta,
++		       bool enable, bool newly)
+ {
++	struct ieee80211_vif *vif = conf->vif;
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_sta *msta;
+ 	struct sk_buff *skb;
+@@ -2365,7 +2362,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ 
+ 	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mvif->sta;
+ 
+-	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
++	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
+ 					      &msta->wcid,
+ 					      MT7996_STA_UPDATE_MAX_SIZE);
+ 	if (IS_ERR(skb))
+@@ -2387,7 +2384,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ 		/* starec hdrt mode */
+ 		mt7996_mcu_sta_hdrt_tlv(dev, skb);
+ 		/* starec bfer */
+-		mt7996_mcu_sta_bfer_tlv(dev, skb, vif, sta);
++		mt7996_mcu_sta_bfer_tlv(dev, skb, conf, mconf, sta);
+ 		/* starec ht */
+ 		mt7996_mcu_sta_ht_tlv(skb, sta);
+ 		/* starec vht */
+@@ -2397,18 +2394,18 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ 		/* starec amsdu */
+ 		mt7996_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
+ 		/* starec he */
+-		mt7996_mcu_sta_he_tlv(skb, vif, sta);
++		mt7996_mcu_sta_he_tlv(skb, conf, mconf, sta);
+ 		/* starec he 6g*/
+ 		mt7996_mcu_sta_he_6g_tlv(skb, sta);
+ 		/* starec eht */
+ 		mt7996_mcu_sta_eht_tlv(skb, sta);
+ 		/* starec muru */
+-		mt7996_mcu_sta_muru_tlv(dev, skb, vif, sta);
++		mt7996_mcu_sta_muru_tlv(dev, skb, conf, mconf, sta);
+ 		/* starec bfee */
+-		mt7996_mcu_sta_bfee_tlv(dev, skb, vif, sta);
++		mt7996_mcu_sta_bfee_tlv(dev, skb, conf, mconf, sta);
+ 	}
+ 
+-	ret = mt7996_mcu_sta_init_vow(mvif->phy, msta);
++	ret = mt7996_mcu_sta_init_vow(mconf, msta);
+ 	if (ret) {
+ 		dev_kfree_skb(skb);
+ 		return ret;
+@@ -2463,16 +2460,15 @@ mt7996_mcu_sta_key_tlv(struct mt76_wcid *wcid,
+ 	return 0;
+ }
+ 
+-int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
++int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
+ 		       struct ieee80211_key_conf *key, int mcu_cmd,
+ 		       struct mt76_wcid *wcid, enum set_key_cmd cmd)
+ {
+-	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
+ 	struct sk_buff *skb;
+ 	int ret;
+ 
+-	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid,
+-					      MT7996_STA_UPDATE_MAX_SIZE);
++	skb = __mt76_connac_mcu_alloc_sta_req(dev, (struct mt76_vif *)mconf,
++					      wcid, MT7996_STA_UPDATE_MAX_SIZE);
+ 	if (IS_ERR(skb))
+ 		return PTR_ERR(skb);
+ 
+@@ -2483,17 +2479,18 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
+ 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
+ }
+ 
+-static int mt7996_mcu_get_pn(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+-			     u8 *pn)
++static int mt7996_mcu_get_pn(struct mt7996_dev *dev,
++			     struct ieee80211_bss_conf *conf,
++			     struct mt7996_bss_conf *mconf, u8 *pn)
+ {
+ #define TSC_TYPE_BIGTK_PN 2
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct mt7996_vif *mvif = (struct mt7996_vif *)conf->vif->drv_priv;
+ 	struct sta_rec_pn_info *pn_info;
+ 	struct sk_buff *skb, *rskb;
+ 	struct tlv *tlv;
+ 	int ret;
+ 
+-	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, &mvif->sta.wcid);
++	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76, &mvif->sta.wcid);
+ 	if (IS_ERR(skb))
+ 		return PTR_ERR(skb);
+ 
+@@ -2517,10 +2514,11 @@ static int mt7996_mcu_get_pn(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ 	return 0;
+ }
+ 
+-int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif,
++int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
++			       struct ieee80211_bss_conf *conf,
++			       struct mt7996_bss_conf *mconf,
+ 			       struct ieee80211_key_conf *key)
+ {
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_mcu_bcn_prot_tlv *bcn_prot;
+ 	struct sk_buff *skb;
+ 	struct tlv *tlv;
+@@ -2529,7 +2527,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
+ 		  sizeof(struct mt7996_mcu_bcn_prot_tlv);
+ 	int ret;
+ 
+-	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76, len);
++	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76, len);
+ 	if (IS_ERR(skb))
+ 		return PTR_ERR(skb);
+ 
+@@ -2537,7 +2535,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
+ 
+ 	bcn_prot = (struct mt7996_mcu_bcn_prot_tlv *)tlv;
+ 
+-	ret = mt7996_mcu_get_pn(dev, vif, pn);
++	ret = mt7996_mcu_get_pn(dev, conf, mconf, pn);
+ 	if (ret) {
+ 		dev_kfree_skb(skb);
+ 		return ret;
+@@ -2570,10 +2568,10 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
+ 				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
+ }
+ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
+-			    struct ieee80211_vif *vif, bool enable)
++			    struct ieee80211_bss_conf *conf,
++			    struct mt7996_bss_conf *mconf, bool enable)
+ {
+ 	struct mt7996_dev *dev = phy->dev;
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct {
+ 		struct req_hdr {
+ 			u8 omac_idx;
+@@ -2589,8 +2587,8 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
+ 		} __packed tlv;
+ 	} data = {
+ 		.hdr = {
+-			.omac_idx = mvif->mt76.omac_idx,
+-			.band_idx = mvif->mt76.band_idx,
++			.omac_idx = mconf->mt76.omac_idx,
++			.band_idx = mconf->mt76.band_idx,
+ 		},
+ 		.tlv = {
+ 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
+@@ -2599,16 +2597,16 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
+ 		},
+ 	};
+ 
+-	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
+-		return mt7996_mcu_muar_config(phy, vif, false, enable);
++	if (mconf->mt76.omac_idx >= REPEATER_BSSID_START)
++		return mt7996_mcu_muar_config(phy, conf, mconf, false, enable);
+ 
+-	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
++	memcpy(data.tlv.omac_addr, conf->addr, ETH_ALEN);
+ 	return mt76_mcu_send_msg(&dev->mt76, MCU_WMWA_UNI_CMD(DEV_INFO_UPDATE),
+ 				 &data, sizeof(data), true);
+ }
+ 
+ static void
+-mt7996_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
++mt7996_mcu_beacon_cntdwn(struct ieee80211_bss_conf *conf, struct sk_buff *rskb,
+ 			 struct sk_buff *skb,
+ 			 struct ieee80211_mutable_offsets *offs)
+ {
+@@ -2619,7 +2617,7 @@ mt7996_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
+ 	if (!offs->cntdwn_counter_offs[0])
+ 		return;
+ 
+-	tag = vif->bss_conf.csa_active ? UNI_BSS_INFO_BCN_CSA : UNI_BSS_INFO_BCN_BCC;
++	tag = conf->csa_active ? UNI_BSS_INFO_BCN_CSA : UNI_BSS_INFO_BCN_BCC;
+ 
+ 	tlv = mt7996_mcu_add_uni_tlv(rskb, tag, sizeof(*info));
+ 
+@@ -2629,14 +2627,15 @@ mt7996_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
+ 
+ static void
+ mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
+-		       struct ieee80211_vif *vif, struct bss_bcn_content_tlv *bcn,
++		       struct ieee80211_bss_conf *conf,
++		       struct bss_bcn_content_tlv *bcn,
+ 		       struct ieee80211_mutable_offsets *offs)
+ {
+ 	struct bss_bcn_mbss_tlv *mbss;
+ 	const struct element *elem;
+ 	struct tlv *tlv;
+ 
+-	if (!vif->bss_conf.bssid_indicator)
++	if (!conf->bssid_indicator)
+ 		return;
+ 
+ 	tlv = mt7996_mcu_add_uni_tlv(rskb, UNI_BSS_INFO_BCN_MBSSID, sizeof(*mbss));
+@@ -2681,7 +2680,7 @@ mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
+ }
+ 
+ static void
+-mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
++mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+ 		       struct sk_buff *rskb, struct sk_buff *skb,
+ 		       struct bss_bcn_content_tlv *bcn,
+ 		       struct ieee80211_mutable_offsets *offs)
+@@ -2695,9 +2694,9 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ 	if (offs->cntdwn_counter_offs[0]) {
+ 		u16 offset = offs->cntdwn_counter_offs[0];
+ 
+-		if (vif->bss_conf.csa_active)
++		if (conf->csa_active)
+ 			bcn->csa_ie_pos = cpu_to_le16(offset - 4);
+-		if (vif->bss_conf.color_change_active)
++		if (conf->color_change_active)
+ 			bcn->bcc_ie_pos = cpu_to_le16(offset - 3);
+ 	}
+ 
+@@ -2709,11 +2708,11 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ }
+ 
+ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+-			  struct ieee80211_vif *vif, int en)
++			  struct ieee80211_bss_conf *conf,
++			  struct mt7996_bss_conf *mconf, int en)
+ {
+ 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
+ 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct ieee80211_mutable_offsets offs;
+ 	struct ieee80211_tx_info *info;
+ 	struct sk_buff *skb, *rskb;
+@@ -2721,15 +2720,15 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+ 	struct bss_bcn_content_tlv *bcn;
+ 	int len;
+ 
+-	if (vif->bss_conf.nontransmitted)
++	if (conf->nontransmitted)
+ 		return 0;
+ 
+-	rskb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76,
++	rskb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
+ 					  MT7996_MAX_BSS_OFFLOAD_SIZE);
+ 	if (IS_ERR(rskb))
+ 		return PTR_ERR(rskb);
+ 
+-	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
++	skb = ieee80211_beacon_get_template(hw, conf->vif, &offs, 0);
+ 	if (!skb) {
+ 		dev_kfree_skb(rskb);
+ 		return -EINVAL;
+@@ -2752,9 +2751,9 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
+ 	if (!en)
+ 		goto out;
+ 
+-	mt7996_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
+-	mt7996_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
+-	mt7996_mcu_beacon_cntdwn(vif, rskb, skb, &offs);
++	mt7996_mcu_beacon_cont(dev, conf, rskb, skb, bcn, &offs);
++	mt7996_mcu_beacon_mbss(rskb, skb, conf, bcn, &offs);
++	mt7996_mcu_beacon_cntdwn(conf, rskb, skb, &offs);
+ out:
+ 	dev_kfree_skb(skb);
+ 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
+@@ -2762,14 +2761,15 @@ out:
+ }
+ 
+ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+-				    struct ieee80211_vif *vif, u32 changed)
++				    struct ieee80211_bss_conf *conf,
++				    struct mt7996_bss_conf *mconf, u32 changed)
+ {
+ #define OFFLOAD_TX_MODE_SU	BIT(0)
+ #define OFFLOAD_TX_MODE_MU	BIT(1)
+ 	struct ieee80211_hw *hw = mt76_hw(dev);
++	struct ieee80211_vif *vif = conf->vif;
+ 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+-	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
++	struct cfg80211_chan_def *chandef = &mconf->phy->mt76->chandef;
+ 	enum nl80211_band band = chandef->chan->band;
+ 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
+ 	struct bss_inband_discovery_tlv *discov;
+@@ -2779,20 +2779,20 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+ 	u8 *buf, interval;
+ 	int len;
+ 
+-	if (vif->bss_conf.nontransmitted)
++	if (conf->nontransmitted)
+ 		return 0;
+ 
+-	rskb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76,
++	rskb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
+ 					  MT7996_MAX_BSS_OFFLOAD_SIZE);
+ 	if (IS_ERR(rskb))
+ 		return PTR_ERR(rskb);
+ 
+ 	if (changed & BSS_CHANGED_FILS_DISCOVERY) {
+-		interval = vif->bss_conf.fils_discovery.max_interval;
++		interval = conf->fils_discovery.max_interval;
+ 		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
+ 	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
+-		   vif->bss_conf.unsol_bcast_probe_resp_interval) {
+-		interval = vif->bss_conf.unsol_bcast_probe_resp_interval;
++		   conf->unsol_bcast_probe_resp_interval) {
++		interval = conf->unsol_bcast_probe_resp_interval;
+ 		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
+ 	}
+ 
+@@ -3456,7 +3456,7 @@ int mt7996_mcu_set_hdr_trans(struct mt7996_dev *dev, bool hdr_trans)
+ 				     MCU_WM_UNI_CMD(RX_HDR_TRANS), true);
+ }
+ 
+-int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
++int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct mt7996_bss_conf *mconf)
+ {
+ #define MCU_EDCA_AC_PARAM	0
+ #define WMM_AIFS_SET		BIT(0)
+@@ -3465,12 +3465,11 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
+ #define WMM_TXOP_SET		BIT(3)
+ #define WMM_PARAM_SET		(WMM_AIFS_SET | WMM_CW_MIN_SET | \
+ 				 WMM_CW_MAX_SET | WMM_TXOP_SET)
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct {
+ 		u8 bss_idx;
+ 		u8 __rsv[3];
+ 	} __packed hdr = {
+-		.bss_idx = mvif->mt76.idx,
++		.bss_idx = mconf->mt76.idx,
+ 	};
+ 	struct sk_buff *skb;
+ 	int len = sizeof(hdr) + IEEE80211_NUM_ACS * sizeof(struct edca);
+@@ -3483,7 +3482,7 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
+ 	skb_put_data(skb, &hdr, sizeof(hdr));
+ 
+ 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+-		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
++		struct ieee80211_tx_queue_params *q = &mconf->queue_params[ac];
+ 		struct edca *e;
+ 		struct tlv *tlv;
+ 
+@@ -4496,12 +4495,12 @@ mt7996_mcu_set_obss_spr_pd(struct mt7996_phy *phy,
+ }
+ 
+ static int
+-mt7996_mcu_set_obss_spr_siga(struct mt7996_phy *phy, struct ieee80211_vif *vif,
++mt7996_mcu_set_obss_spr_siga(struct mt7996_phy *phy,
++			     struct mt7996_bss_conf *mconf,
+ 			     struct ieee80211_he_obss_pd *he_obss_pd)
+ {
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_dev *dev = phy->dev;
+-	u8 omac = mvif->mt76.omac_idx;
++	u8 omac = mconf->mt76.omac_idx;
+ 	struct {
+ 		u8 band_idx;
+ 		u8 __rsv[3];
+@@ -4573,7 +4572,8 @@ mt7996_mcu_set_obss_spr_bitmap(struct mt7996_phy *phy,
+ 				 sizeof(req), true);
+ }
+ 
+-int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
++int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy,
++			    struct mt7996_bss_conf *mconf,
+ 			    struct ieee80211_he_obss_pd *he_obss_pd)
+ {
+ 	int ret;
+@@ -4607,7 +4607,7 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+ 		return ret;
+ 
+ 	/* Set SR prohibit */
+-	ret = mt7996_mcu_set_obss_spr_siga(phy, vif, he_obss_pd);
++	ret = mt7996_mcu_set_obss_spr_siga(phy, mconf, he_obss_pd);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -4615,16 +4615,16 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+ 	return mt7996_mcu_set_obss_spr_bitmap(phy, he_obss_pd);
+ }
+ 
+-int mt7996_mcu_update_bss_color(struct mt7996_dev *dev, struct ieee80211_vif *vif,
++int mt7996_mcu_update_bss_color(struct mt7996_dev *dev,
++				struct mt7996_bss_conf *mconf,
+ 				struct cfg80211_he_bss_color *he_bss_color)
+ {
+ 	int len = sizeof(struct bss_req_hdr) + sizeof(struct bss_color_tlv);
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct bss_color_tlv *bss_color;
+ 	struct sk_buff *skb;
+ 	struct tlv *tlv;
+ 
+-	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76, len);
++	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76, len);
+ 	if (IS_ERR(skb))
+ 		return PTR_ERR(skb);
+ 
+@@ -4643,7 +4643,7 @@ int mt7996_mcu_update_bss_color(struct mt7996_dev *dev, struct ieee80211_vif *vi
+ #define TWT_AGRT_PROTECT	BIT(2)
+ 
+ int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
+-			       struct mt7996_vif *mvif,
++			       struct mt7996_bss_conf *mconf,
+ 			       struct mt7996_twt_flow *flow,
+ 			       int cmd)
+ {
+@@ -4674,12 +4674,12 @@ int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
+ 		.len = cpu_to_le16(sizeof(req) - 4),
+ 		.tbl_idx = flow->table_id,
+ 		.cmd = cmd,
+-		.own_mac_idx = mvif->mt76.omac_idx,
++		.own_mac_idx = mconf->mt76.omac_idx,
+ 		.flowid = flow->id,
+ 		.peer_id = cpu_to_le16(flow->wcid),
+ 		.duration = flow->duration,
+-		.bss = mvif->mt76.idx,
+-		.bss_idx = mvif->mt76.idx,
++		.bss = mconf->mt76.idx,
++		.bss_idx = mconf->mt76.idx,
+ 		.start_tsf = cpu_to_le64(flow->tsf),
+ 		.mantissa = flow->mantissa,
+ 		.exponent = flow->exp,
+@@ -4810,15 +4810,15 @@ int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev, bool disable
+ 
+ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
+ 				     struct ieee80211_vif *vif,
++				     struct mt7996_bss_conf *mconf,
+ 				     struct ieee80211_sta *sta)
+ {
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_sta *msta;
+ 	struct sk_buff *skb;
+ 
+-	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mvif->sta;
++	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mconf->vif->sta;
+ 
+-	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
++	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
+ 					      &msta->wcid,
+ 					      MT7996_STA_UPDATE_MAX_SIZE);
+ 	if (IS_ERR(skb))
+@@ -5462,8 +5462,9 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
+ 				 &req, sizeof(req), false);
+ }
+ 
+-int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy, struct mt7996_sta *msta,
+-	                        enum vow_drr_ctrl_id id)
++int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
++				struct mt7996_bss_conf *mconf,
++				struct mt7996_sta *msta, enum vow_drr_ctrl_id id)
+ {
+ 	struct mt7996_vow_sta_ctrl *vow = msta ? &msta->vow : NULL;
+ 	u32 val = 0;
+@@ -5489,9 +5490,9 @@ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy, struct mt7996_sta *msta,
+ 		.len = cpu_to_le16(sizeof(req) - 4),
+ 		.wlan_idx = cpu_to_le16(msta ? msta->wcid.idx : 0),
+ 		.band_idx = phy->mt76->band_idx,
+-		.wmm_idx = msta ? msta->vif->mt76.wmm_idx : 0,
++		.wmm_idx = msta ? mconf->mt76.wmm_idx : 0,
+ 		.ctrl_id = cpu_to_le32(id),
+-		.omac_idx = msta ? msta->vif->mt76.omac_idx : 0
++		.omac_idx = msta ? mconf->mt76.omac_idx : 0
+ 	};
+ 
+ 	switch (id) {
+@@ -5679,7 +5680,7 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+ {
+ 	u8 mode, val;
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+-	struct mt7996_phy *phy =  mvif->phy;
++	struct mt7996_phy *phy =  mvif->deflink.phy;
+ 
+ 	mode = FIELD_GET(RATE_CFG_MODE, *((u32 *)data));
+ 	val = FIELD_GET(RATE_CFG_VAL, *((u32 *)data));
+@@ -5710,11 +5711,11 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+ void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
+ {
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+-	struct ieee80211_hw *hw = mvif->phy->mt76->hw;
++	struct ieee80211_hw *hw = mvif->deflink.phy->mt76->hw;
+ 	u8 val = *((u8 *)data);
+ 
+ 	vif->bss_conf.enable_beacon = val;
+ 
+-	mt7996_mcu_add_beacon(hw, vif, val);
++	mt7996_mcu_add_beacon(hw, &vif->bss_conf, &mvif->deflink, val);
+ }
+ #endif
+diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
+index 2b266d1..6b03ee1 100644
+--- a/mt7996/mt7996.h
++++ b/mt7996/mt7996.h
+@@ -324,18 +324,25 @@ struct mt7996_sta {
+ 	struct mt7996_vow_sta_ctrl vow;
+ };
+ 
+-struct mt7996_vif {
++struct mt7996_bss_conf {
+ 	struct mt76_vif mt76; /* must be first */
+ 
+-	struct mt7996_sta sta;
++	struct mt7996_vif *vif;
+ 	struct mt7996_phy *phy;
+-
+ 	struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS];
+ 	struct cfg80211_bitrate_mask bitrate_mask;
+ 
+ 	struct mt7996_chanctx *chanctx;
+ };
+ 
++struct mt7996_vif {
++	struct mt7996_bss_conf deflink;
++	struct mt7996_bss_conf __rcu *link[IEEE80211_MLD_MAX_NUM_LINKS];
++
++	struct mt7996_sta sta;
++	struct mt7996_dev *dev;
++};
++
+ /* crash-dump */
+ struct mt7996_crash_data {
+ 	guid_t guid;
+@@ -769,6 +776,13 @@ mt7996_chanctx_get(struct ieee80211_chanctx_conf *ctx)
+ 	return (struct mt7996_chanctx *)&ctx->drv_priv;
+ }
+ 
++static inline struct mt7996_bss_conf *
++mconf_dereference_protected(struct mt7996_vif *mvif, u8 link_id)
++{
++	return rcu_dereference_protected(mvif->link[link_id],
++					 lockdep_is_held(&mvif->dev->mt76.mutex));
++}
++
+ extern const struct ieee80211_ops mt7996_ops;
+ extern struct pci_driver mt7996_pci_driver;
+ extern struct pci_driver mt7996_hif_driver;
+@@ -779,7 +793,7 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
+ void mt7996_wfsys_reset(struct mt7996_dev *dev);
+ void mt7996_rro_hw_init(struct mt7996_dev *dev);
+ irqreturn_t mt7996_irq_handler(int irq, void *dev_instance);
+-u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif);
++u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_bss_conf *mconf);
+ int mt7996_register_device(struct mt7996_dev *dev);
+ void mt7996_unregister_device(struct mt7996_dev *dev);
+ const char *mt7996_eeprom_name(struct mt7996_dev *dev);
+@@ -805,37 +819,47 @@ int mt7996_run(struct ieee80211_hw *hw);
+ int mt7996_mcu_init(struct mt7996_dev *dev);
+ int mt7996_mcu_init_firmware(struct mt7996_dev *dev);
+ int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
+-			       struct mt7996_vif *mvif,
++			       struct mt7996_bss_conf *mconf,
+ 			       struct mt7996_twt_flow *flow,
+ 			       int cmd);
+ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
+-			    struct ieee80211_vif *vif, bool enable);
++			    struct ieee80211_bss_conf *conf,
++			    struct mt7996_bss_conf *mconf, bool enable);
+ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
+-			    struct ieee80211_vif *vif, int enable);
+-int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+-		       struct ieee80211_sta *sta, bool enable, bool newly);
++			    struct ieee80211_bss_conf *conf,
++			    struct mt7996_bss_conf *mconf, int enable);
++int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
++		       struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta,
++		       bool enable, bool newly);
+ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
+ 			 struct ieee80211_ampdu_params *params,
+ 			 bool add);
+ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
+ 			 struct ieee80211_ampdu_params *params,
+ 			 bool add);
+-int mt7996_mcu_update_bss_color(struct mt7996_dev *dev, struct ieee80211_vif *vif,
++int mt7996_mcu_update_bss_color(struct mt7996_dev *dev,
++				struct mt7996_bss_conf *mconf,
+ 				struct cfg80211_he_bss_color *he_bss_color);
+-int mt7996_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+-			  int enable);
++int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
++			  struct ieee80211_bss_conf *conf,
++			  struct mt7996_bss_conf *mconf, int en);
+ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
+-				    struct ieee80211_vif *vif, u32 changed);
+-int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
++				    struct ieee80211_bss_conf *conf,
++				    struct mt7996_bss_conf *mconf, u32 changed);
++int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy,
++			    struct mt7996_bss_conf *mconf,
+ 			    struct ieee80211_he_obss_pd *he_obss_pd);
+-int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
++int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
++			     struct ieee80211_bss_conf *conf,
++			     struct mt7996_bss_conf *mconf,
+ 			     struct ieee80211_sta *sta, bool changed);
+ int mt7996_set_channel(struct mt7996_phy *phy, struct cfg80211_chan_def *chandef);
+ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag);
+-int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif);
++int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct mt7996_bss_conf *mconf);
+ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
+ 				   void *data, u16 version);
+-int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif,
++int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
++			       struct mt7996_bss_conf *mconf,
+ 			       struct ieee80211_sta *sta, void *data, u32 field);
+ int mt7996_mcu_set_eeprom(struct mt7996_dev *dev);
+ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf);
+@@ -850,7 +874,7 @@ int mt7996_mcu_set_radar_th(struct mt7996_dev *dev, int index,
+ 			    const struct mt7996_dfs_pattern *pattern);
+ int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable);
+ int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val);
+-int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif);
++int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct mt7996_bss_conf *mconf);
+ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch);
+ int mt7996_mcu_get_temperature(struct mt7996_phy *phy);
+ int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state);
+@@ -890,8 +914,9 @@ void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb);
+ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable);
+ void mt7996_mcu_scs_sta_poll(struct work_struct *work);
+ int mt7996_mcu_set_band_confg(struct mt7996_phy *phy, u16 option, bool enable);
+-int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy, struct mt7996_sta *msta,
+-	                        enum vow_drr_ctrl_id id);
++int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
++				struct mt7996_bss_conf *mconf,
++				struct mt7996_sta *msta, enum vow_drr_ctrl_id id);
+ int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy);
+ void mt7996_mcu_wmm_pbc_work(struct work_struct *work);
+ 
+@@ -1000,13 +1025,16 @@ void mt7996_update_channel(struct mt76_phy *mphy);
+ int mt7996_init_debugfs(struct mt7996_phy *phy);
+ void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int len);
+ bool mt7996_debugfs_rx_log(struct mt7996_dev *dev, const void *data, int len);
+-int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
++int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
+ 		       struct ieee80211_key_conf *key, int mcu_cmd,
+ 		       struct mt76_wcid *wcid, enum set_key_cmd cmd);
+-int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif,
++int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
++			       struct ieee80211_bss_conf *conf,
++			       struct mt7996_bss_conf *mconf,
+ 			       struct ieee80211_key_conf *key);
+ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
+ 				     struct ieee80211_vif *vif,
++				     struct mt7996_bss_conf *mconf,
+ 				     struct ieee80211_sta *sta);
+ int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode);
+ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
+diff --git a/mt7996/testmode.c b/mt7996/testmode.c
+index 784a8be..bf55b43 100644
+--- a/mt7996/testmode.c
++++ b/mt7996/testmode.c
+@@ -223,6 +223,7 @@ static void
+ mt7996_tm_init(struct mt7996_phy *phy, bool en)
+ {
+ 	struct mt7996_dev *dev = phy->dev;
++	struct mt7996_vif *mvif = (struct mt7996_vif *)phy->monitor_vif->drv_priv;
+ 	u8 rf_test_mode = en ? RF_OPER_RF_TEST : RF_OPER_NORMAL;
+ 
+ 	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
+@@ -234,8 +235,8 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
+ 
+ 	mt7996_tm_rf_switch_mode(dev, rf_test_mode);
+ 
+-	mt7996_mcu_add_bss_info(phy, phy->monitor_vif, en);
+-	mt7996_mcu_add_sta(dev, phy->monitor_vif, NULL, en, false);
++	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, en);
++	mt7996_mcu_add_sta(dev, &phy->monitor_vif->bss_conf, &mvif->deflink, NULL, en, false);
+ 
+ 	mt7996_tm_set(dev, SET_ID(BAND_IDX), phy->mt76->band_idx);
+ 
+@@ -1179,13 +1180,13 @@ mt7996_tm_txbf_init(struct mt7996_phy *phy, u16 *val)
+ 	mt7996_tm_set_mac_addr(dev, td->addr[2], SET_ID(BSSID));
+ 
+ 	/* bss idx & omac idx should be set to band idx for ibf cal */
+-	mvif->mt76.idx = band_idx;
+-	dev->mt76.vif_mask |= BIT_ULL(mvif->mt76.idx);
+-	mvif->mt76.omac_idx = band_idx;
+-	phy->omac_mask |= BIT_ULL(mvif->mt76.omac_idx);
++	mvif->deflink.mt76.idx = band_idx;
++	dev->mt76.vif_mask |= BIT_ULL(mvif->deflink.mt76.idx);
++	mvif->deflink.mt76.omac_idx = band_idx;
++	phy->omac_mask |= BIT_ULL(mvif->deflink.mt76.omac_idx);
+ 
+-	mt7996_mcu_add_dev_info(phy, phy->monitor_vif, true);
+-	mt7996_mcu_add_bss_info(phy, phy->monitor_vif, true);
++	mt7996_mcu_add_dev_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, true);
++	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, true);
+ 
+ 	if (td->ibf) {
+ 		if (td->is_txbf_dut) {
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0086-wifi-mt76-mt7996-switch-to-per-link-data-structure-o.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0086-wifi-mt76-mt7996-switch-to-per-link-data-structure-o.patch
index e8d7384..7256cb2 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0086-wifi-mt76-mt7996-switch-to-per-link-data-structure-o.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0086-wifi-mt76-mt7996-switch-to-per-link-data-structure-o.patch
@@ -1,2320 +1,2430 @@
-From 175bf6b7c7eabfb45f6618b17d19c475a1e0916e Mon Sep 17 00:00:00 2001
+From 88111ec93e8bfd47f020965dd075849bd2233e40 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Fri, 24 Nov 2023 11:31:55 +0800
+Date: Mon, 27 Nov 2023 10:43:34 +0800
 Subject: [PATCH 086/116] wifi: mt76: mt7996: switch to per-link data structure
- of vif
+ of sta
 
-Introduce struct mt7996_bss_conf, data structure for per-link BSS.
-Note that mt7996_vif now represents a legacy or MLD device.
+Introduce struct mt7996_link_sta, data structure for per-link STA.
+Note that mt7996_sta now represents a peer legacy or MLD device.
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
 Co-developed-by: Bo Jiao <Bo.Jiao@mediatek.com>
 Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
- mt7996/debugfs.c  |  10 +-
- mt7996/init.c     |   4 +-
- mt7996/mac.c      |  25 ++-
- mt7996/main.c     | 269 ++++++++++++++++++-----------
- mt7996/mcu.c      | 429 +++++++++++++++++++++++-----------------------
- mt7996/mt7996.h   |  72 +++++---
- mt7996/testmode.c |  17 +-
- 7 files changed, 463 insertions(+), 363 deletions(-)
+ mt7615/mcu.c      |   4 +-
+ mt76_connac_mcu.c |  18 +-
+ mt76_connac_mcu.h |   7 +-
+ mt7915/mcu.c      |   4 +-
+ mt7925/mcu.c      |   4 +-
+ mt7996/debugfs.c  |  20 ++-
+ mt7996/mac.c      | 109 ++++++------
+ mt7996/main.c     | 223 +++++++++++++++---------
+ mt7996/mcu.c      | 430 ++++++++++++++++++++++++----------------------
+ mt7996/mt7996.h   |  44 +++--
+ mt7996/testmode.c |   6 +-
+ 11 files changed, 482 insertions(+), 387 deletions(-)
 
+diff --git a/mt7615/mcu.c b/mt7615/mcu.c
+index a931066..8f4f203 100644
+--- a/mt7615/mcu.c
++++ b/mt7615/mcu.c
+@@ -862,8 +862,8 @@ mt7615_mcu_wtbl_sta_add(struct mt7615_phy *phy, struct ieee80211_vif *vif,
+ 		else
+ 			mvif->sta_added = true;
+ 	}
+-	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, sskb, vif, sta, enable,
+-				      new_entry);
++	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, sskb, vif, &sta->deflink,
++				      enable, new_entry);
+ 	if (enable && sta)
+ 		mt76_connac_mcu_sta_tlv(phy->mt76, sskb, sta, vif, 0,
+ 					MT76_STA_INFO_STATE_ASSOC);
+diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
+index 0c7b693..d83d314 100644
+--- a/mt76_connac_mcu.c
++++ b/mt76_connac_mcu.c
+@@ -371,9 +371,10 @@ EXPORT_SYMBOL_GPL(mt76_connac_mcu_bss_omac_tlv);
+ 
+ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+ 				   struct ieee80211_vif *vif,
+-				   struct ieee80211_sta *sta,
++				   struct ieee80211_link_sta *link_sta,
+ 				   bool enable, bool newly)
+ {
++	struct ieee80211_sta *sta = link_sta ? link_sta->sta : NULL;
+ 	struct sta_rec_basic *basic;
+ 	struct tlv *tlv;
+ 	int conn_type;
+@@ -431,7 +432,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+ 		break;
+ 	}
+ 
+-	memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
++	memcpy(basic->peer_addr, link_sta->addr, ETH_ALEN);
+ 	basic->qos = sta->wme;
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_basic_tlv);
+@@ -1055,7 +1056,7 @@ int mt76_connac_mcu_sta_cmd(struct mt76_phy *phy,
+ 		return PTR_ERR(skb);
+ 
+ 	if (info->sta || !info->offload_fw)
+-		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif, info->sta,
++		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif, &info->sta->deflink,
+ 					      info->enable, info->newly);
+ 	if (info->sta && info->enable)
+ 		mt76_connac_mcu_sta_tlv(phy, skb, info->sta,
+@@ -1306,7 +1307,8 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
+ EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_ba);
+ 
+ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
+-			    enum nl80211_band band, struct ieee80211_sta *sta)
++			    enum nl80211_band band,
++			    struct ieee80211_link_sta *link_sta)
+ {
+ 	struct mt76_dev *dev = phy->dev;
+ 	const struct ieee80211_sta_he_cap *he_cap;
+@@ -1317,10 +1319,10 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
+ 	if (is_connac_v1(dev))
+ 		return 0x38;
+ 
+-	if (sta) {
+-		ht_cap = &sta->deflink.ht_cap;
+-		vht_cap = &sta->deflink.vht_cap;
+-		he_cap = &sta->deflink.he_cap;
++	if (link_sta) {
++		ht_cap = &link_sta->ht_cap;
++		vht_cap = &link_sta->vht_cap;
++		he_cap = &link_sta->he_cap;
+ 	} else {
+ 		struct ieee80211_supported_band *sband;
+ 
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index c19f8e0..740b9f5 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1910,8 +1910,8 @@ int mt76_connac_mcu_set_channel_domain(struct mt76_phy *phy);
+ int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif);
+ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+ 				   struct ieee80211_vif *vif,
+-				   struct ieee80211_sta *sta, bool enable,
+-				   bool newly);
++				   struct ieee80211_link_sta *link_sta,
++				   bool enable, bool newly);
+ void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
+ 				      struct ieee80211_vif *vif,
+ 				      struct ieee80211_sta *sta, void *sta_wtbl,
+@@ -2019,7 +2019,8 @@ mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif);
+ const struct ieee80211_sta_eht_cap *
+ mt76_connac_get_eht_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif);
+ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
+-			    enum nl80211_band band, struct ieee80211_sta *sta);
++			    enum nl80211_band band,
++			    struct ieee80211_link_sta *link_sta);
+ u8 mt76_connac_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
+ 				enum nl80211_band band);
+ 
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 363ea0e..cb2e3b2 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -1504,7 +1504,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
+ 
+ 	ra->valid = true;
+ 	ra->auto_rate = true;
+-	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
++	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, &sta->deflink);
+ 	ra->channel = chandef->chan->hw_value;
+ 	ra->bw = sta->deflink.bandwidth;
+ 	ra->phy.bw = sta->deflink.bandwidth;
+@@ -1669,7 +1669,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+ 		return PTR_ERR(skb);
+ 
+ 	/* starec basic */
+-	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, sta, enable,
++	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, &sta->deflink, enable,
+ 				      !rcu_access_pointer(dev->mt76.wcid[msta->wcid.idx]));
+ 	if (!enable)
+ 		goto out;
+diff --git a/mt7925/mcu.c b/mt7925/mcu.c
+index 652a9ac..80e1828 100644
+--- a/mt7925/mcu.c
++++ b/mt7925/mcu.c
+@@ -1626,7 +1626,7 @@ mt7925_mcu_sta_cmd(struct mt76_phy *phy,
+ 		return PTR_ERR(skb);
+ 
+ 	if (info->sta || !info->offload_fw)
+-		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif, info->sta,
++		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif, &info->sta->deflink,
+ 					      info->enable, info->newly);
+ 	if (info->sta && info->enable) {
+ 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->sta);
+@@ -2092,7 +2092,7 @@ mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
+ 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_OFDM_INDEX);
+ 
+ 	memcpy(basic_req->bssid, vif->bss_conf.bssid, ETH_ALEN);
+-	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, sta);
++	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, &sta->deflink);
+ 	basic_req->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
+ 	basic_req->dtim_period = vif->bss_conf.dtim_period;
+ 	basic_req->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 837758611..06015d686 100644
+index 06015d6..56e2192 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
-@@ -739,7 +739,7 @@ static void
+@@ -739,14 +739,15 @@ static void
  mt7996_sta_hw_queue_read(void *data, struct ieee80211_sta *sta)
  {
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
--	struct mt7996_dev *dev = msta->vif->phy->dev;
-+	struct mt7996_dev *dev = msta->vif->deflink.phy->dev;
++	struct mt7996_link_sta *mlink = &msta->deflink;
+ 	struct mt7996_dev *dev = msta->vif->deflink.phy->dev;
  	struct seq_file *s = data;
  	u8 ac;
  
+ 	for (ac = 0; ac < 4; ac++) {
+ 		u32 qlen, ctrl, val;
+-		u32 idx = msta->wcid.idx >> 5;
+-		u8 offs = msta->wcid.idx & GENMASK(4, 0);
++		u32 idx = mlink->wcid.idx >> 5;
++		u8 offs = mlink->wcid.idx & GENMASK(4, 0);
+ 
-@@ -759,7 +759,7 @@ mt7996_sta_hw_queue_read(void *data, struct ieee80211_sta *sta)
+ 		ctrl = BIT(31) | BIT(11) | (ac << 24);
+ 		val = mt76_rr(dev, MT_PLE_AC_QEMPTY(ac, idx));
+@@ -754,11 +755,11 @@ mt7996_sta_hw_queue_read(void *data, struct ieee80211_sta *sta)
+ 		if (val & BIT(offs))
+ 			continue;
+ 
+-		mt76_wr(dev, MT_FL_Q0_CTRL, ctrl | msta->wcid.idx);
++		mt76_wr(dev, MT_FL_Q0_CTRL, ctrl | mlink->wcid.idx);
+ 		qlen = mt76_get_field(dev, MT_FL_Q3_CTRL,
  				      GENMASK(11, 0));
  		seq_printf(s, "\tSTA %pM wcid %d: AC%d%d queued:%d\n",
- 			   sta->addr, msta->wcid.idx,
--			   msta->vif->mt76.wmm_idx, ac, qlen);
-+			   msta->vif->deflink.mt76.wmm_idx, ac, qlen);
+-			   sta->addr, msta->wcid.idx,
++			   sta->addr, mlink->wcid.idx,
+ 			   msta->vif->deflink.mt76.wmm_idx, ac, qlen);
  	}
  }
- 
-@@ -1023,7 +1023,7 @@ mt7996_atf_enable_set(void *data, u64 val)
- 	int ret;
- 
- 	vow->max_deficit = val ? 64 : 1;
--	ret = mt7996_mcu_set_vow_drr_ctrl(phy, NULL, VOW_DRR_CTRL_AIRTIME_DEFICIT_BOUND);
-+	ret = mt7996_mcu_set_vow_drr_ctrl(phy, NULL, NULL, VOW_DRR_CTRL_AIRTIME_DEFICIT_BOUND);
- 	if (ret)
- 		return ret;
- 
-@@ -1055,7 +1055,7 @@ mt7996_airtime_read(struct seq_file *s, void *data)
+@@ -1041,7 +1042,7 @@ mt7996_airtime_read(struct seq_file *s, void *data)
+ 	struct mt76_dev *mdev = &dev->mt76;
+ 	struct mt76_sta_stats *stats;
+ 	struct ieee80211_sta *sta;
+-	struct mt7996_sta *msta;
++	struct mt7996_link_sta *mlink;
+ 	struct mt76_wcid *wcid;
+ 	struct mt76_vif *vif;
+ 	u16 i;
+@@ -1053,9 +1054,9 @@ mt7996_airtime_read(struct seq_file *s, void *data)
+ 		if (!wcid || !wcid->sta)
+ 			continue;
  
- 		msta = container_of(wcid, struct mt7996_sta, wcid);
- 		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
--		vif = &msta->vif->mt76;
-+		vif = &msta->vif->deflink.mt76;
+-		msta = container_of(wcid, struct mt7996_sta, wcid);
+-		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
+-		vif = &msta->vif->deflink.mt76;
++		mlink = container_of(wcid, struct mt7996_link_sta, wcid);
++		sta = container_of((void *)mlink->sta, struct ieee80211_sta, drv_priv);
++		vif = &mlink->sta->vif->deflink.mt76;
  		stats = &wcid->stats;
  
  		seq_printf(s, "%pM WCID: %hu BandIdx: %hhu OmacIdx: 0x%hhx\t"
-@@ -1230,7 +1230,7 @@ static ssize_t mt7996_sta_fixed_rate_set(struct file *file,
+@@ -1230,6 +1231,7 @@ static ssize_t mt7996_sta_fixed_rate_set(struct file *file,
  #define LONG_PREAMBLE 1
  	struct ieee80211_sta *sta = file->private_data;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
--	struct mt7996_dev *dev = msta->vif->phy->dev;
-+	struct mt7996_dev *dev = msta->vif->deflink.phy->dev;
++	struct mt7996_link_sta *mlink = &msta->deflink;
+ 	struct mt7996_dev *dev = msta->vif->deflink.phy->dev;
  	struct ra_rate phy = {};
  	char buf[100];
- 	int ret;
-diff --git a/mt7996/init.c b/mt7996/init.c
-index 6eeec3b8d..381e1292c 100644
---- a/mt7996/init.c
-+++ b/mt7996/init.c
-@@ -628,11 +628,11 @@ static int mt7996_vow_init(struct mt7996_phy *phy)
- 	vow->drr_quantum[6] = VOW_DRR_QUANTUM_L6;
- 	vow->drr_quantum[7] = VOW_DRR_QUANTUM_L7;
- 
--	ret = mt7996_mcu_set_vow_drr_ctrl(phy, NULL, VOW_DRR_CTRL_AIRTIME_DEFICIT_BOUND);
-+	ret = mt7996_mcu_set_vow_drr_ctrl(phy, NULL, NULL, VOW_DRR_CTRL_AIRTIME_DEFICIT_BOUND);
- 	if (ret)
- 		return ret;
- 
--	ret = mt7996_mcu_set_vow_drr_ctrl(phy, NULL, VOW_DRR_CTRL_AIRTIME_QUANTUM_ALL);
-+	ret = mt7996_mcu_set_vow_drr_ctrl(phy, NULL, NULL, VOW_DRR_CTRL_AIRTIME_QUANTUM_ALL);
- 	if (ret)
- 		return ret;
+@@ -1265,7 +1267,7 @@ static ssize_t mt7996_sta_fixed_rate_set(struct file *file,
+ 		goto out;
+ 	}
  
+-	phy.wlan_idx = cpu_to_le16(msta->wcid.idx);
++	phy.wlan_idx = cpu_to_le16(mlink->wcid.idx);
+ 	phy.gi = cpu_to_le16(gi);
+ 	phy.ltf = cpu_to_le16(ltf);
+ 	phy.ldpc = phy.ldpc ? 7 : 0;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 0879c7735..63b16f92e 100644
+index 63b16f9..3cff43d 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
-@@ -897,8 +897,9 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -54,7 +54,7 @@ static const struct mt7996_dfs_radar_spec jp_radar_specs = {
+ static struct mt76_wcid *mt7996_rx_get_wcid(struct mt7996_dev *dev,
+ 					    u16 idx, bool unicast)
+ {
+-	struct mt7996_sta *sta;
++	struct mt7996_link_sta *mlink;
+ 	struct mt76_wcid *wcid;
+ 
+ 	if (idx >= ARRAY_SIZE(dev->mt76.wcid))
+@@ -67,11 +67,11 @@ static struct mt76_wcid *mt7996_rx_get_wcid(struct mt7996_dev *dev,
+ 	if (!wcid->sta)
+ 		return NULL;
+ 
+-	sta = container_of(wcid, struct mt7996_sta, wcid);
+-	if (!sta->vif)
++	mlink = container_of(wcid, struct mt7996_link_sta, wcid);
++	if (!mlink->sta->vif)
+ 		return NULL;
  
- 	if (vif) {
- 		struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+		struct mt7996_bss_conf *mconf = &mvif->deflink;
+-	return &sta->vif->sta.wcid;
++	return &mlink->wcid;
+ }
+ 
+ bool mt7996_mac_wtbl_update(struct mt7996_dev *dev, int idx, u32 mask)
+@@ -92,12 +92,11 @@ u32 mt7996_mac_wtbl_lmac_addr(struct mt7996_dev *dev, u16 wcid, u8 dw)
+ }
+ 
+ void mt7996_mac_enable_rtscts(struct mt7996_dev *dev,
+-			      struct ieee80211_vif *vif, bool enable)
++			      struct mt7996_link_sta *mlink, bool enable)
+ {
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	u32 addr;
+ 
+-	addr = mt7996_mac_wtbl_lmac_addr(dev, mvif->sta.wcid.idx, 5);
++	addr = mt7996_mac_wtbl_lmac_addr(dev, mlink->wcid.idx, 5);
+ 	if (enable)
+ 		mt76_set(dev, addr, BIT(5));
+ 	else
+@@ -349,7 +348,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
+ 	__le16 fc = 0;
+ 	int idx;
+ 	u8 hw_aggr = false;
+-	struct mt7996_sta *msta = NULL;
++	struct mt7996_link_sta *mlink = NULL;
  
--		txp->fw.bss_idx = mvif->mt76.idx;
-+		txp->fw.bss_idx = mconf->mt76.idx;
+ 	hw_aggr = status->aggr;
+ 	memset(status, 0, sizeof(*status));
+@@ -380,10 +379,10 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
+ 	status->wcid = mt7996_rx_get_wcid(dev, idx, unicast);
+ 
+ 	if (status->wcid) {
+-		msta = container_of(status->wcid, struct mt7996_sta, wcid);
++		mlink = container_of(status->wcid, struct mt7996_link_sta, wcid);
+ 		spin_lock_bh(&dev->mt76.sta_poll_lock);
+-		if (list_empty(&msta->wcid.poll_list))
+-			list_add_tail(&msta->wcid.poll_list,
++		if (list_empty(&mlink->wcid.poll_list))
++			list_add_tail(&mlink->wcid.poll_list,
+ 				      &dev->mt76.sta_poll_list);
+ 		spin_unlock_bh(&dev->mt76.sta_poll_lock);
  	}
+@@ -592,7 +591,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
+ #endif
+ 	} else {
+ 		status->flag |= RX_FLAG_8023;
+-		mt7996_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
++		mt7996_wed_check_ppe(dev, &dev->mt76.q_rx[q], mlink ? mlink->sta : NULL, skb,
+ 				     *info);
+ 	}
+ 
+@@ -942,6 +941,7 @@ static void
+ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
+ {
+ 	struct mt7996_sta *msta;
++	struct mt7996_link_sta *mlink;
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	bool is_8023 = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP;
+ 	u16 fc, tid;
+@@ -970,7 +970,8 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
+ 		return;
+ 
+ 	msta = (struct mt7996_sta *)sta->drv_priv;
+-	if (!test_and_set_bit(tid, &msta->wcid.ampdu_state))
++	mlink = rcu_dereference(msta->link[0]);
++	if (!test_and_set_bit(tid, &mlink->wcid.ampdu_state))
+ 		ieee80211_start_tx_ba_session(sta, tid, 0);
+ }
+ 
+@@ -1048,7 +1049,7 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+ 		 */
+ 		info = le32_to_cpu(*cur_info);
+ 		if (info & MT_TXFREE_INFO_PAIR) {
+-			struct mt7996_sta *msta;
++			struct mt7996_link_sta *mlink;
+ 			u16 idx;
+ 
+ 			idx = FIELD_GET(MT_TXFREE_INFO_WLAN_ID, info);
+@@ -1057,10 +1058,10 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+ 			if (!sta)
+ 				continue;
+ 
+-			msta = container_of(wcid, struct mt7996_sta, wcid);
++			mlink = container_of(wcid, struct mt7996_link_sta, wcid);
+ 			spin_lock_bh(&mdev->sta_poll_lock);
+-			if (list_empty(&msta->wcid.poll_list))
+-				list_add_tail(&msta->wcid.poll_list,
++			if (list_empty(&mlink->wcid.poll_list))
++				list_add_tail(&mlink->wcid.poll_list,
+ 					      &mdev->sta_poll_list);
+ 			spin_unlock_bh(&mdev->sta_poll_lock);
+ 			continue;
+@@ -1265,7 +1266,7 @@ out:
  
- 	txp->fw.token = cpu_to_le16(id);
-@@ -1518,12 +1519,15 @@ static void
- mt7996_update_vif_beacon(void *priv, u8 *mac, struct ieee80211_vif *vif)
+ static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
  {
- 	struct ieee80211_hw *hw = priv;
-+	struct ieee80211_bss_conf *conf = &vif->bss_conf;
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_bss_conf *mconf = &mvif->deflink;
+-	struct mt7996_sta *msta = NULL;
++	struct mt7996_link_sta *mlink;
+ 	struct mt76_wcid *wcid;
+ 	__le32 *txs_data = data;
+ 	u16 wcidx;
+@@ -1286,16 +1287,15 @@ static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
+ 	if (!wcid)
+ 		goto out;
  
- 	switch (vif->type) {
- 	case NL80211_IFTYPE_MESH_POINT:
- 	case NL80211_IFTYPE_ADHOC:
- 	case NL80211_IFTYPE_AP:
--		mt7996_mcu_add_beacon(hw, vif, vif->bss_conf.enable_beacon);
-+		mt7996_mcu_add_beacon(hw, conf, mconf, conf->enable_beacon);
- 		break;
- 	default:
- 		break;
-@@ -2237,6 +2241,8 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
- 	struct mt7996_dev *dev = container_of(work, struct mt7996_dev, rc_work);
+-	msta = container_of(wcid, struct mt7996_sta, wcid);
+-
+ 	mt7996_mac_add_txs_skb(dev, wcid, pid, txs_data);
+ 
+ 	if (!wcid->sta)
+ 		goto out;
+ 
++	mlink = container_of(wcid, struct mt7996_link_sta, wcid);
+ 	spin_lock_bh(&dev->mt76.sta_poll_lock);
+-	if (list_empty(&msta->wcid.poll_list))
+-		list_add_tail(&msta->wcid.poll_list, &dev->mt76.sta_poll_list);
++	if (list_empty(&mlink->wcid.poll_list))
++		list_add_tail(&mlink->wcid.poll_list, &dev->mt76.sta_poll_list);
+ 	spin_unlock_bh(&dev->mt76.sta_poll_lock);
+ 
+ out:
+@@ -2242,8 +2242,9 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
  	struct ieee80211_sta *sta;
  	struct ieee80211_vif *vif;
-+	struct ieee80211_bss_conf *conf;
-+	struct mt7996_bss_conf *mconf;
- 	struct mt7996_sta *msta;
+ 	struct ieee80211_bss_conf *conf;
++	struct ieee80211_link_sta *link_sta;
+ 	struct mt7996_bss_conf *mconf;
+-	struct mt7996_sta *msta;
++	struct mt7996_link_sta *mlink;
  	u32 changed;
  	LIST_HEAD(list);
-@@ -2253,14 +2259,16 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+ 
+@@ -2251,24 +2252,25 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
+ 	list_splice_init(&dev->sta_rc_list, &list);
  
- 		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
- 		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
-+		conf = &vif->bss_conf;
-+		mconf = &msta->vif->deflink;
+ 	while (!list_empty(&list)) {
+-		msta = list_first_entry(&list, struct mt7996_sta, rc_list);
+-		list_del_init(&msta->rc_list);
+-		changed = msta->changed;
+-		msta->changed = 0;
++		mlink = list_first_entry(&list, struct mt7996_link_sta, rc_list);
++		list_del_init(&mlink->rc_list);
++		changed = mlink->changed;
++		mlink->changed = 0;
+ 		spin_unlock_bh(&dev->mt76.sta_poll_lock);
+ 
+-		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
+-		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
++		sta = container_of((void *)mlink->sta, struct ieee80211_sta, drv_priv);
++		link_sta = &sta->deflink;
++		vif = container_of((void *)mlink->sta->vif, struct ieee80211_vif, drv_priv);
+ 		conf = &vif->bss_conf;
+-		mconf = &msta->vif->deflink;
++		mconf = &mlink->sta->vif->deflink;
  
  		if (changed & (IEEE80211_RC_SUPP_RATES_CHANGED |
  			       IEEE80211_RC_NSS_CHANGED |
  			       IEEE80211_RC_BW_CHANGED))
--			mt7996_mcu_add_rate_ctrl(dev, vif, sta, true);
-+			mt7996_mcu_add_rate_ctrl(dev, conf, mconf, sta, true);
+-			mt7996_mcu_add_rate_ctrl(dev, conf, mconf, sta, true);
++			mt7996_mcu_add_rate_ctrl(dev, conf, mconf, link_sta, mlink, true);
  
  		if (changed & IEEE80211_RC_SMPS_CHANGED)
--			mt7996_mcu_set_fixed_field(dev, vif, sta, NULL,
-+			mt7996_mcu_set_fixed_field(dev, mconf, sta, NULL,
+-			mt7996_mcu_set_fixed_field(dev, mconf, sta, NULL,
++			mt7996_mcu_set_fixed_field(dev, mconf, link_sta, mlink, NULL,
  						   RATE_PARAM_MMPS_UPDATE);
  
  		spin_lock_bh(&dev->mt76.sta_poll_lock);
-@@ -2643,7 +2651,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+@@ -2561,7 +2563,7 @@ static int mt7996_mac_check_twt_req(struct ieee80211_twt_setup *twt)
+ }
+ 
+ static bool
+-mt7996_mac_twt_param_equal(struct mt7996_sta *msta,
++mt7996_mac_twt_param_equal(struct mt7996_link_sta *mlink,
+ 			   struct ieee80211_twt_params *twt_agrt)
+ {
+ 	u16 type = le16_to_cpu(twt_agrt->req_type);
+@@ -2572,10 +2574,10 @@ mt7996_mac_twt_param_equal(struct mt7996_sta *msta,
+ 	for (i = 0; i < MT7996_MAX_STA_TWT_AGRT; i++) {
+ 		struct mt7996_twt_flow *f;
+ 
+-		if (!(msta->twt.flowid_mask & BIT(i)))
++		if (!(mlink->twt.flowid_mask & BIT(i)))
+ 			continue;
+ 
+-		f = &msta->twt.flow[i];
++		f = &mlink->twt.flow[i];
+ 		if (f->duration == twt_agrt->min_twt_dur &&
+ 		    f->mantissa == twt_agrt->mantissa &&
+ 		    f->exp == exp &&
+@@ -2594,6 +2596,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+ {
+ 	enum ieee80211_twt_setup_cmd setup_cmd = TWT_SETUP_CMD_REJECT;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_link_sta *mlink;
+ 	struct ieee80211_twt_params *twt_agrt = (void *)twt->params;
+ 	u16 req_type = le16_to_cpu(twt_agrt->req_type);
+ 	enum ieee80211_twt_setup_cmd sta_setup_cmd;
+@@ -2605,11 +2608,12 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+ 		goto out;
+ 
+ 	mutex_lock(&dev->mt76.mutex);
++	mlink = mlink_dereference_protected(msta, 0);
+ 
+ 	if (dev->twt.n_agrt == MT7996_MAX_TWT_AGRT)
+ 		goto unlock;
+ 
+-	if (hweight8(msta->twt.flowid_mask) == ARRAY_SIZE(msta->twt.flow))
++	if (hweight8(mlink->twt.flowid_mask) == ARRAY_SIZE(mlink->twt.flow))
+ 		goto unlock;
+ 
+ 	if (twt_agrt->min_twt_dur < MT7996_MIN_TWT_DUR) {
+@@ -2618,10 +2622,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+ 		goto unlock;
+ 	}
+ 
+-	if (mt7996_mac_twt_param_equal(msta, twt_agrt))
++	if (mt7996_mac_twt_param_equal(mlink, twt_agrt))
+ 		goto unlock;
+ 
+-	flowid = ffs(~msta->twt.flowid_mask) - 1;
++	flowid = ffs(~mlink->twt.flowid_mask) - 1;
+ 	twt_agrt->req_type &= ~cpu_to_le16(IEEE80211_TWT_REQTYPE_FLOWID);
+ 	twt_agrt->req_type |= le16_encode_bits(flowid,
+ 					       IEEE80211_TWT_REQTYPE_FLOWID);
+@@ -2630,10 +2634,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+ 	exp = FIELD_GET(IEEE80211_TWT_REQTYPE_WAKE_INT_EXP, req_type);
+ 	sta_setup_cmd = FIELD_GET(IEEE80211_TWT_REQTYPE_SETUP_CMD, req_type);
+ 
+-	flow = &msta->twt.flow[flowid];
++	flow = &mlink->twt.flow[flowid];
+ 	memset(flow, 0, sizeof(*flow));
+ 	INIT_LIST_HEAD(&flow->list);
+-	flow->wcid = msta->wcid.idx;
++	flow->wcid = mlink->wcid.idx;
+ 	flow->table_id = table_id;
+ 	flow->id = flowid;
+ 	flow->duration = twt_agrt->min_twt_dur;
+@@ -2651,7 +2655,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  
  		flow->sched = true;
  		flow->start_tsf = mt7996_mac_twt_sched_list_add(dev, flow);
--		curr_tsf = __mt7996_get_tsf(hw, msta->vif);
-+		curr_tsf = __mt7996_get_tsf(hw, &msta->vif->deflink);
+-		curr_tsf = __mt7996_get_tsf(hw, &msta->vif->deflink);
++		curr_tsf = __mt7996_get_tsf(hw, &mlink->sta->vif->deflink);
  		div_u64_rem(curr_tsf - flow->start_tsf, interval, &rem);
  		flow_tsf = curr_tsf + interval - rem;
  		twt_agrt->twt = cpu_to_le64(flow_tsf);
-@@ -2652,7 +2660,8 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+@@ -2660,13 +2664,13 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
  	}
  	flow->tsf = le64_to_cpu(twt_agrt->twt);
  
--	if (mt7996_mcu_twt_agrt_update(dev, msta->vif, flow, MCU_TWT_AGRT_ADD))
-+	if (mt7996_mcu_twt_agrt_update(dev, &msta->vif->deflink, flow,
-+				       MCU_TWT_AGRT_ADD))
+-	if (mt7996_mcu_twt_agrt_update(dev, &msta->vif->deflink, flow,
++	if (mt7996_mcu_twt_agrt_update(dev, &mlink->sta->vif->deflink, flow,
+ 				       MCU_TWT_AGRT_ADD))
  		goto unlock;
  
  	setup_cmd = TWT_SETUP_CMD_ACCEPT;
-@@ -2674,6 +2683,7 @@ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
- 				  u8 flowid)
+ 	dev->twt.table_mask |= BIT(table_id);
+-	msta->twt.flowid_mask |= BIT(flowid);
++	mlink->twt.flowid_mask |= BIT(flowid);
+ 	dev->twt.n_agrt++;
+ 
+ unlock:
+@@ -2679,26 +2683,25 @@ out:
+ }
+ 
+ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
+-				  struct mt7996_sta *msta,
+-				  u8 flowid)
++				  struct mt7996_link_sta *mlink, u8 flowid)
  {
  	struct mt7996_twt_flow *flow;
-+	struct mt7996_bss_conf *mconf = mconf_dereference_protected(msta->vif, 0);
+-	struct mt7996_bss_conf *mconf = mconf_dereference_protected(msta->vif, 0);
++	struct mt7996_bss_conf *mconf = mconf_dereference_protected(mlink->sta->vif, 0);
  
  	lockdep_assert_held(&dev->mt76.mutex);
  
+-	if (flowid >= ARRAY_SIZE(msta->twt.flow))
++	if (flowid >= ARRAY_SIZE(mlink->twt.flow))
+ 		return;
+ 
-@@ -2684,8 +2694,7 @@ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
+-	if (!(msta->twt.flowid_mask & BIT(flowid)))
++	if (!(mlink->twt.flowid_mask & BIT(flowid)))
  		return;
  
- 	flow = &msta->twt.flow[flowid];
--	if (mt7996_mcu_twt_agrt_update(dev, msta->vif, flow,
--				       MCU_TWT_AGRT_DELETE))
-+	if (mt7996_mcu_twt_agrt_update(dev, mconf, flow, MCU_TWT_AGRT_DELETE))
+-	flow = &msta->twt.flow[flowid];
++	flow = &mlink->twt.flow[flowid];
+ 	if (mt7996_mcu_twt_agrt_update(dev, mconf, flow, MCU_TWT_AGRT_DELETE))
  		return;
  
  	list_del_init(&flow->list);
-diff --git a/mt7996/main.c b/mt7996/main.c
-index c330dd479..9f61082f5 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -205,29 +205,30 @@ static int get_omac_idx(enum nl80211_iftype type, u64 mask)
- 	return -1;
+-	msta->twt.flowid_mask &= ~BIT(flowid);
++	mlink->twt.flowid_mask &= ~BIT(flowid);
+ 	dev->twt.table_mask &= ~BIT(flow->table_id);
+ 	dev->twt.n_agrt--;
  }
+@@ -2711,7 +2714,7 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
+ 	struct cfg80211_scan_request *req = phy->scan_req;
+ 	struct ieee80211_vif *vif = phy->scan_vif;
+ 	struct mt7996_vif *mvif;
+-	struct mt76_wcid *wcid;
++	struct mt7996_link_sta *mlink;
+ 	struct ieee80211_tx_info *info;
+ 	struct sk_buff *skb;
  
--static void mt7996_init_bitrate_mask(struct ieee80211_vif *vif)
-+static void mt7996_init_bitrate_mask(struct mt7996_bss_conf *mconf)
- {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	int i;
+@@ -2719,7 +2722,6 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
+ 		return;
  
--	for (i = 0; i < ARRAY_SIZE(mvif->bitrate_mask.control); i++) {
--		mvif->bitrate_mask.control[i].gi = NL80211_TXRATE_DEFAULT_GI;
--		mvif->bitrate_mask.control[i].he_gi = 0xff;
--		mvif->bitrate_mask.control[i].he_ltf = 0xff;
--		mvif->bitrate_mask.control[i].legacy = GENMASK(31, 0);
--		memset(mvif->bitrate_mask.control[i].ht_mcs, 0xff,
--		       sizeof(mvif->bitrate_mask.control[i].ht_mcs));
--		memset(mvif->bitrate_mask.control[i].vht_mcs, 0xff,
--		       sizeof(mvif->bitrate_mask.control[i].vht_mcs));
--		memset(mvif->bitrate_mask.control[i].he_mcs, 0xff,
--		       sizeof(mvif->bitrate_mask.control[i].he_mcs));
-+	for (i = 0; i < ARRAY_SIZE(mconf->bitrate_mask.control); i++) {
-+		mconf->bitrate_mask.control[i].gi = NL80211_TXRATE_DEFAULT_GI;
-+		mconf->bitrate_mask.control[i].he_gi = 0xff;
-+		mconf->bitrate_mask.control[i].he_ltf = 0xff;
-+		mconf->bitrate_mask.control[i].legacy = GENMASK(31, 0);
-+		memset(mconf->bitrate_mask.control[i].ht_mcs, 0xff,
-+		       sizeof(mconf->bitrate_mask.control[i].ht_mcs));
-+		memset(mconf->bitrate_mask.control[i].vht_mcs, 0xff,
-+		       sizeof(mconf->bitrate_mask.control[i].vht_mcs));
-+		memset(mconf->bitrate_mask.control[i].he_mcs, 0xff,
-+		       sizeof(mconf->bitrate_mask.control[i].he_mcs));
+ 	mvif = (struct mt7996_vif *)vif->drv_priv;
+-	wcid = &mvif->sta.wcid;
+ 
+ 	skb = ieee80211_probereq_get(hw, vif->addr,
+ 				     ssid->ssid, ssid->ssid_len, req->ie_len);
+@@ -2752,7 +2754,8 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
  	}
- }
  
- static int mt7996_add_interface(struct ieee80211_hw *hw,
- 				struct ieee80211_vif *vif)
- {
-+	struct ieee80211_bss_conf *conf = &vif->bss_conf;
+ 	local_bh_disable();
+-	mt76_tx(phy->mt76, NULL, wcid, skb);
++	mlink = rcu_dereference(mvif->sta.link[0]);
++	mt76_tx(phy->mt76, NULL, &mlink->wcid, skb);
+ 	local_bh_enable();
+ 
+ 	rcu_read_unlock();
+diff --git a/mt7996/main.c b/mt7996/main.c
+index bc4863d..4e5ba58 100644
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -229,6 +229,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
+ 	struct ieee80211_bss_conf *conf = &vif->bss_conf;
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_bss_conf *mconf = &mvif->deflink;
+ 	struct mt7996_bss_conf *mconf = &mvif->deflink;
++	struct mt7996_link_sta *mlink = &mvif->sta.deflink;
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  	struct mt76_txq *mtxq;
-@@ -240,8 +241,8 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
- 	    is_zero_ether_addr(vif->addr))
- 		phy->monitor_vif = vif;
- 
--	mvif->mt76.idx = __ffs64(~dev->mt76.vif_mask);
--	if (mvif->mt76.idx >= mt7996_max_interface_num(dev)) {
-+	mconf->mt76.idx = __ffs64(~dev->mt76.vif_mask);
-+	if (mconf->mt76.idx >= mt7996_max_interface_num(dev)) {
- 		ret = -ENOSPC;
- 		goto out;
- 	}
-@@ -251,19 +252,21 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
- 		ret = -ENOSPC;
- 		goto out;
- 	}
--	mvif->mt76.omac_idx = idx;
--	mvif->phy = phy;
--	mvif->mt76.band_idx = band_idx;
--	mvif->mt76.wmm_idx = vif->type != NL80211_IFTYPE_AP;
--
--	ret = mt7996_mcu_add_dev_info(phy, vif, true);
-+	mconf->mt76.omac_idx = idx;
-+	mconf->vif = mvif;
-+	mconf->phy = phy;
-+	mconf->mt76.band_idx = band_idx;
-+	mconf->mt76.wmm_idx = vif->type != NL80211_IFTYPE_AP;
-+	mvif->dev = dev;
-+
-+	ret = mt7996_mcu_add_dev_info(phy, conf, mconf, true);
- 	if (ret)
- 		goto out;
- 
--	dev->mt76.vif_mask |= BIT_ULL(mvif->mt76.idx);
--	phy->omac_mask |= BIT_ULL(mvif->mt76.omac_idx);
-+	dev->mt76.vif_mask |= BIT_ULL(mconf->mt76.idx);
-+	phy->omac_mask |= BIT_ULL(mconf->mt76.omac_idx);
- 
--	idx = MT7996_WTBL_RESERVED - mvif->mt76.idx;
-+	idx = MT7996_WTBL_RESERVED - mconf->mt76.idx;
+@@ -268,14 +269,15 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
  
- 	INIT_LIST_HEAD(&mvif->sta.rc_list);
- 	INIT_LIST_HEAD(&mvif->sta.wcid.poll_list);
-@@ -283,24 +286,25 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
- 	}
+ 	idx = MT7996_WTBL_RESERVED - mconf->mt76.idx;
  
- 	if (vif->type != NL80211_IFTYPE_AP &&
--	    (!mvif->mt76.omac_idx || mvif->mt76.omac_idx > 3))
-+	    (!mconf->mt76.omac_idx || mconf->mt76.omac_idx > 3))
- 		vif->offload_flags = 0;
- 	vif->offload_flags |= IEEE80211_OFFLOAD_ENCAP_4ADDR;
+-	INIT_LIST_HEAD(&mvif->sta.rc_list);
+-	INIT_LIST_HEAD(&mvif->sta.wcid.poll_list);
+-	mvif->sta.wcid.idx = idx;
+-	mvif->sta.wcid.phy_idx = band_idx;
+-	mvif->sta.wcid.hw_key_idx = -1;
+-	mvif->sta.wcid.tx_info |= MT_WCID_TX_INFO_SET;
+-	mvif->sta.vif = mvif;
+-	mt76_wcid_init(&mvif->sta.wcid);
++	INIT_LIST_HEAD(&mlink->rc_list);
++	INIT_LIST_HEAD(&mlink->wcid.poll_list);
++	mlink->wcid.idx = idx;
++	mlink->wcid.phy_idx = band_idx;
++	mlink->wcid.hw_key_idx = -1;
++	mlink->wcid.tx_info |= MT_WCID_TX_INFO_SET;
++	mlink->sta = &mvif->sta;
++	mlink->sta->vif = mvif;
++	mt76_wcid_init(&mlink->wcid);
  
- 	if (phy->mt76->chandef.chan->band != NL80211_BAND_2GHZ)
--		mvif->mt76.basic_rates_idx = MT7996_BASIC_RATES_TBL + 4;
-+		mconf->mt76.basic_rates_idx = MT7996_BASIC_RATES_TBL + 4;
- 	else
--		mvif->mt76.basic_rates_idx = MT7996_BASIC_RATES_TBL;
-+		mconf->mt76.basic_rates_idx = MT7996_BASIC_RATES_TBL;
+ 	mt7996_mac_wtbl_update(dev, idx,
+ 			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
+@@ -297,14 +299,15 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
  
--	mt7996_init_bitrate_mask(vif);
-+	mt7996_init_bitrate_mask(mconf);
+ 	mt7996_init_bitrate_mask(mconf);
  
--	mt7996_mcu_add_bss_info(phy, vif, true);
-+	mt7996_mcu_add_bss_info(phy, conf, mconf, true);
+-	mt7996_mcu_add_bss_info(phy, conf, mconf, true);
++	mt7996_mcu_add_bss_info(phy, conf, mconf, mlink, true);
  	/* defer the first STA_REC of BMC entry to BSS_CHANGED_BSSID for STA
  	 * interface, since firmware only records BSSID when the entry is new
  	 */
  	if (vif->type != NL80211_IFTYPE_STATION)
--		mt7996_mcu_add_sta(dev, vif, NULL, true, true);
-+		mt7996_mcu_add_sta(dev, conf, mconf, NULL, true, true);
- 	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
-+	rcu_assign_pointer(mvif->link[0], mconf);
+-		mt7996_mcu_add_sta(dev, conf, mconf, NULL, true, true);
+-	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
++		mt7996_mcu_add_sta(dev, conf, mconf, NULL, mlink, true, true);
++	rcu_assign_pointer(dev->mt76.wcid[idx], &mlink->wcid);
+ 	rcu_assign_pointer(mvif->link[0], mconf);
++	rcu_assign_pointer(mvif->sta.link[0], mlink);
  
  out:
  	mutex_unlock(&dev->mt76.mutex);
-@@ -311,7 +315,9 @@ out:
- static void mt7996_remove_interface(struct ieee80211_hw *hw,
- 				    struct ieee80211_vif *vif)
- {
-+	struct ieee80211_bss_conf *conf;
+@@ -318,10 +321,10 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+ 	struct ieee80211_bss_conf *conf;
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_bss_conf *mconf;
- 	struct mt7996_sta *msta = &mvif->sta;
+ 	struct mt7996_bss_conf *mconf;
+-	struct mt7996_sta *msta = &mvif->sta;
++	struct mt7996_link_sta *mlink = &mvif->sta.deflink;
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
-@@ -319,24 +325,22 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+-	int idx = msta->wcid.idx;
++	int idx = mlink->wcid.idx;
  
  	cancel_delayed_work_sync(&phy->scan_work);
  
--	mt7996_mcu_add_sta(dev, vif, NULL, false, false);
--	mt7996_mcu_add_bss_info(phy, vif, false);
-+	mutex_lock(&dev->mt76.mutex);
-+
-+	conf = link_conf_dereference_protected(vif, 0);
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	mt7996_mcu_add_sta(dev, conf, mconf, NULL, false, false);
-+	mt7996_mcu_add_bss_info(phy, conf, mconf, false);
+@@ -329,8 +332,8 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+ 
+ 	conf = link_conf_dereference_protected(vif, 0);
+ 	mconf = mconf_dereference_protected(mvif, 0);
+-	mt7996_mcu_add_sta(dev, conf, mconf, NULL, false, false);
+-	mt7996_mcu_add_bss_info(phy, conf, mconf, false);
++	mt7996_mcu_add_sta(dev, conf, mconf, NULL, mlink, false, false);
++	mt7996_mcu_add_bss_info(phy, conf, mconf, mlink, false);
  
  	if (vif == phy->monitor_vif)
  		phy->monitor_vif = NULL;
- 
--	mt7996_mcu_add_dev_info(phy, vif, false);
-+	mt7996_mcu_add_dev_info(phy, conf, mconf, false);
- 
- 	rcu_assign_pointer(dev->mt76.wcid[idx], NULL);
- 
--	mutex_lock(&dev->mt76.mutex);
--
--	if (test_bit(MT76_SCANNING, &phy->mt76->state))
--		mt7996_scan_complete(phy, true);
--
--	dev->mt76.vif_mask &= ~BIT_ULL(mvif->mt76.idx);
--	phy->omac_mask &= ~BIT_ULL(mvif->mt76.omac_idx);
--	mutex_unlock(&dev->mt76.mutex);
-+	dev->mt76.vif_mask &= ~BIT_ULL(mconf->mt76.idx);
-+	phy->omac_mask &= ~BIT_ULL(mconf->mt76.omac_idx);
+@@ -343,12 +346,13 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+ 	phy->omac_mask &= ~BIT_ULL(mconf->mt76.omac_idx);
  
  	spin_lock_bh(&dev->mt76.sta_poll_lock);
- 	if (!list_empty(&msta->wcid.poll_list))
-@@ -344,6 +348,9 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
+-	if (!list_empty(&msta->wcid.poll_list))
+-		list_del_init(&msta->wcid.poll_list);
++	if (!list_empty(&mlink->wcid.poll_list))
++		list_del_init(&mlink->wcid.poll_list);
  	spin_unlock_bh(&dev->mt76.sta_poll_lock);
  
- 	mt76_wcid_cleanup(&dev->mt76, &msta->wcid);
-+	rcu_assign_pointer(mvif->link[0], NULL);
-+
-+	mutex_unlock(&dev->mt76.mutex);
- }
+-	mt76_wcid_cleanup(&dev->mt76, &msta->wcid);
++	mt76_wcid_cleanup(&dev->mt76, &mlink->wcid);
+ 	rcu_assign_pointer(mvif->link[0], NULL);
++	rcu_assign_pointer(mvif->sta.link[0], NULL);
  
- static void ___mt7996_set_channel(struct mt7996_phy *phy,
-@@ -441,6 +448,8 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ 	mutex_unlock(&dev->mt76.mutex);
+ }
+@@ -447,10 +451,10 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_sta *msta = sta ? (struct mt7996_sta *)sta->drv_priv :
  				  &mvif->sta;
- 	struct mt76_wcid *wcid = &msta->wcid;
-+	struct mt7996_bss_conf *mconf;
-+	struct ieee80211_bss_conf *conf;
- 	u8 *wcid_keyidx = &wcid->hw_key_idx;
+-	struct mt76_wcid *wcid = &msta->wcid;
+ 	struct mt7996_bss_conf *mconf;
++	struct mt7996_link_sta *mlink;
+ 	struct ieee80211_bss_conf *conf;
+-	u8 *wcid_keyidx = &wcid->hw_key_idx;
++	u8 *wcid_keyidx;
  	int idx = key->keyidx;
  	int err = 0;
-@@ -482,9 +491,11 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
  
- 	mutex_lock(&dev->mt76.mutex);
+@@ -464,6 +468,12 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ 	    !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
+ 		return -EOPNOTSUPP;
  
--	if (cmd == SET_KEY && !sta && !mvif->mt76.cipher) {
--		mvif->mt76.cipher = mt76_connac_mcu_get_cipher(key->cipher);
--		mt7996_mcu_add_bss_info(phy, vif, true);
++	mutex_lock(&dev->mt76.mutex);
 +	conf = link_conf_dereference_protected(vif, 0);
 +	mconf = mconf_dereference_protected(mvif, 0);
-+	if (cmd == SET_KEY && !sta && !mconf->mt76.cipher) {
-+		mconf->mt76.cipher = mt76_connac_mcu_get_cipher(key->cipher);
-+		mt7996_mcu_add_bss_info(phy, conf, mconf, true);
++	mlink = mlink_dereference_protected(msta, 0);
++	wcid_keyidx = &mlink->wcid.hw_key_idx;
++
+ 	/* fall back to sw encryption for unsupported ciphers */
+ 	switch (key->cipher) {
+ 	case WLAN_CIPHER_SUITE_TKIP:
+@@ -486,16 +496,13 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ 	case WLAN_CIPHER_SUITE_WEP40:
+ 	case WLAN_CIPHER_SUITE_WEP104:
+ 	default:
++		mutex_unlock(&dev->mt76.mutex);
+ 		return -EOPNOTSUPP;
+ 	}
+ 
+-	mutex_lock(&dev->mt76.mutex);
+-
+-	conf = link_conf_dereference_protected(vif, 0);
+-	mconf = mconf_dereference_protected(mvif, 0);
+ 	if (cmd == SET_KEY && !sta && !mconf->mt76.cipher) {
+ 		mconf->mt76.cipher = mt76_connac_mcu_get_cipher(key->cipher);
+-		mt7996_mcu_add_bss_info(phy, conf, mconf, true);
++		mt7996_mcu_add_bss_info(phy, conf, mconf, mlink, true);
  	}
  
  	if (cmd == SET_KEY) {
-@@ -498,9 +509,9 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
- 	mt76_wcid_key_setup(&dev->mt76, wcid, key);
+@@ -506,14 +513,14 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ 		goto out;
+ 	}
+ 
+-	mt76_wcid_key_setup(&dev->mt76, wcid, key);
++	mt76_wcid_key_setup(&dev->mt76, &mlink->wcid, key);
  
  	if (key->keyidx == 6 || key->keyidx == 7)
--		err = mt7996_mcu_bcn_prot_enable(dev, vif, key);
-+		err = mt7996_mcu_bcn_prot_enable(dev, conf, mconf, key);
+-		err = mt7996_mcu_bcn_prot_enable(dev, conf, mconf, key);
++		err = mt7996_mcu_bcn_prot_enable(dev, conf, mconf, mlink, key);
  	else
--		err = mt7996_mcu_add_key(&dev->mt76, vif, key,
-+		err = mt7996_mcu_add_key(&dev->mt76, mconf, key,
+ 		err = mt7996_mcu_add_key(&dev->mt76, mconf, key,
  					 MCU_WMWA_UNI_CMD(STA_REC_UPDATE),
- 					 &msta->wcid, cmd);
+-					 &msta->wcid, cmd);
++					 &mlink->wcid, cmd);
  out:
-@@ -547,7 +558,9 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	       unsigned int link_id, u16 queue,
- 	       const struct ieee80211_tx_queue_params *params)
- {
-+	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_bss_conf *mconf;
- 	const u8 mq_to_aci[] = {
- 		[IEEE80211_AC_VO] = 3,
- 		[IEEE80211_AC_VI] = 2,
-@@ -555,10 +568,15 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 		[IEEE80211_AC_BK] = 1,
- 	};
- 
-+	mutex_lock(&dev->mt76.mutex);
-+	mconf = mconf_dereference_protected(mvif, 0);
-+
- 	/* firmware uses access class index */
--	mvif->queue_params[mq_to_aci[queue]] = *params;
-+	mconf->queue_params[mq_to_aci[queue]] = *params;
- 	/* no need to update right away, we'll get BSS_CHANGED_QOS */
- 
-+	mutex_unlock(&dev->mt76.mutex);
-+
- 	return 0;
- }
- 
-@@ -619,22 +637,20 @@ static void mt7996_configure_filter(struct ieee80211_hw *hw,
- }
- 
- static void
--mt7996_update_bss_color(struct ieee80211_hw *hw,
--			struct ieee80211_vif *vif,
-+mt7996_update_bss_color(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-+			struct mt7996_bss_conf *mconf,
- 			struct cfg80211_he_bss_color *bss_color)
- {
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 
- 	switch (vif->type) {
- 	case NL80211_IFTYPE_AP: {
--		struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--
--		if (mvif->mt76.omac_idx > HW_BSSID_MAX)
-+		if (mconf->mt76.omac_idx > HW_BSSID_MAX)
- 			return;
- 		fallthrough;
- 	}
- 	case NL80211_IFTYPE_STATION:
--		mt7996_mcu_update_bss_color(dev, vif, bss_color);
-+		mt7996_mcu_update_bss_color(dev, mconf, bss_color);
- 		break;
- 	default:
- 		break;
-@@ -642,16 +658,15 @@ mt7996_update_bss_color(struct ieee80211_hw *hw,
- }
- 
- static u8
--mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
--		       bool beacon, bool mcast)
-+mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_bss_conf *conf,
-+		       struct mt7996_bss_conf *mconf, bool beacon, bool mcast)
- {
--	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
--	struct mt76_phy *mphy = hw->priv;
-+	struct mt76_phy *mphy = mconf->phy->mt76;
- 	u16 rate;
- 	u8 i, idx;
- 
--	rate = mt76_connac2_mac_tx_rate_val(mphy, vif, beacon, mcast);
-+	rate = mt76_connac2_mac_tx_rate_val(mphy, conf->vif, beacon, mcast);
- 
- 	if (beacon) {
- 		struct mt7996_phy *phy = mphy->priv;
-@@ -672,23 +687,22 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 		if ((mt76_rates[i].hw_value & GENMASK(7, 0)) == idx)
- 			return MT7996_BASIC_RATES_TBL + 2 * i;
- 
--	return mvif->basic_rates_idx;
-+	return mconf->mt76.basic_rates_idx;
- }
- 
- static void
--mt7996_update_mu_group(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
--		       struct ieee80211_bss_conf *info)
-+mt7996_update_mu_group(struct ieee80211_hw *hw, struct ieee80211_bss_conf *conf,
-+		       struct mt7996_bss_conf *mconf)
- {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
--	u8 band = mvif->mt76.band_idx;
-+	u8 band = mconf->mt76.band_idx;
- 	u32 *mu;
- 
--	mu = (u32 *)info->mu_group.membership;
-+	mu = (u32 *)conf->mu_group.membership;
- 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_VLD0(band), mu[0]);
- 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_VLD1(band), mu[1]);
+ 	mutex_unlock(&dev->mt76.mutex);
  
--	mu = (u32 *)info->mu_group.position;
-+	mu = (u32 *)conf->mu_group.position;
- 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_POS0(band), mu[0]);
- 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_POS1(band), mu[1]);
- 	mt76_wr(dev, MT_WF_PHYRX_BAND_GID_TAB_POS2(band), mu[2]);
-@@ -700,20 +714,22 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
- 				    struct ieee80211_bss_conf *info,
- 				    u64 changed)
+@@ -716,25 +723,27 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
  {
--	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_bss_conf *mconf;
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_bss_conf *mconf;
++	struct mt7996_link_sta *mlink;
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  
  	mutex_lock(&dev->mt76.mutex);
  
-+	mconf = mconf_dereference_protected(mvif, 0);
+ 	mconf = mconf_dereference_protected(mvif, 0);
++	mlink = mlink_dereference_protected(&mvif->sta, 0);
  	/* station mode uses BSSID to map the wlan entry to a peer,
  	 * and then peer references bss_info_rfch to set bandwidth cap.
  	 */
  	if ((changed & BSS_CHANGED_BSSID && !is_zero_ether_addr(info->bssid)) ||
  	    (changed & BSS_CHANGED_ASSOC && vif->cfg.assoc) ||
  	    (changed & BSS_CHANGED_BEACON_ENABLED && info->enable_beacon)) {
--		mt7996_mcu_add_bss_info(phy, vif, true);
--		mt7996_mcu_add_sta(dev, vif, NULL, true,
-+		mt7996_mcu_add_bss_info(phy, info, mconf, true);
-+		mt7996_mcu_add_sta(dev, info, mconf, NULL, true,
+-		mt7996_mcu_add_bss_info(phy, info, mconf, true);
+-		mt7996_mcu_add_sta(dev, info, mconf, NULL, true,
++		mt7996_mcu_add_bss_info(phy, info, mconf, mlink, true);
++		mt7996_mcu_add_sta(dev, info, mconf, NULL, mlink, true,
  				   !!(changed & BSS_CHANGED_BSSID));
  	}
  
-@@ -725,42 +741,42 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
+ 	if (changed & BSS_CHANGED_ERP_CTS_PROT)
+-		mt7996_mac_enable_rtscts(dev, vif, info->use_cts_prot);
++		mt7996_mac_enable_rtscts(dev, mlink, info->use_cts_prot);
  
- 		if (slottime != phy->slottime) {
- 			phy->slottime = slottime;
--			mt7996_mcu_set_timing(phy, vif);
-+			mt7996_mcu_set_timing(phy, mconf);
- 		}
- 	}
+ 	if (changed & BSS_CHANGED_ERP_SLOT) {
+ 		int slottime = info->use_short_slot ? 9 : 20;
+@@ -805,6 +814,7 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_bss_conf *mconf = mconf_dereference_protected(mvif, 0);
++	struct mt7996_link_sta *mlink = &msta->deflink;
+ 	u8 band_idx = mconf->phy->mt76->band_idx;
+ 	int idx;
  
- 	if (changed & BSS_CHANGED_MCAST_RATE)
--		mvif->mcast_rates_idx =
--			mt7996_get_rates_table(hw, vif, false, true);
-+		mconf->mt76.mcast_rates_idx =
-+			mt7996_get_rates_table(hw, info, mconf, false, true);
+@@ -816,13 +826,16 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 	if (idx < 0)
+ 		return -ENOSPC;
  
- 	if (changed & BSS_CHANGED_BASIC_RATES)
--		mvif->basic_rates_idx =
--			mt7996_get_rates_table(hw, vif, false, false);
-+		mconf->mt76.basic_rates_idx =
-+			mt7996_get_rates_table(hw, info, mconf, false, false);
+-	INIT_LIST_HEAD(&msta->rc_list);
+-	INIT_LIST_HEAD(&msta->wcid.poll_list);
++	INIT_LIST_HEAD(&mlink->rc_list);
++	INIT_LIST_HEAD(&mlink->wcid.poll_list);
+ 	msta->vif = mvif;
+-	msta->wcid.sta = 1;
+-	msta->wcid.idx = idx;
+-	msta->wcid.phy_idx = band_idx;
+-	msta->wcid.tx_info |= MT_WCID_TX_INFO_SET;
++	mlink->wcid.sta = 1;
++	mlink->wcid.idx = idx;
++	mlink->wcid.phy_idx = band_idx;
++	mlink->wcid.tx_info |= MT_WCID_TX_INFO_SET;
++	mlink->sta = msta;
++
++	rcu_assign_pointer(msta->link[0], mlink);
  
- 	/* ensure that enable txcmd_mode after bss_info */
- 	if (changed & (BSS_CHANGED_QOS | BSS_CHANGED_BEACON_ENABLED))
--		mt7996_mcu_set_tx(dev, vif);
-+		mt7996_mcu_set_tx(dev, mconf);
+ #ifdef CONFIG_MTK_VENDOR
+ 	mt7996_vendor_amnt_sta_remove(mconf->phy, sta);
+@@ -855,19 +868,25 @@ void mt7996_mac_sta_assoc(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 	struct mt7996_bss_conf *mconf;
++	struct mt7996_link_sta *mlink;
+ 	struct ieee80211_bss_conf *conf;
++	struct ieee80211_link_sta *link_sta;
  
- 	if (changed & BSS_CHANGED_HE_OBSS_PD)
--		mt7996_mcu_add_obss_spr(phy, vif, &info->he_obss_pd);
-+		mt7996_mcu_add_obss_spr(phy, mconf, &info->he_obss_pd);
+ 	mutex_lock(&dev->mt76.mutex);
  
- 	if (changed & BSS_CHANGED_HE_BSS_COLOR)
--		mt7996_update_bss_color(hw, vif, &info->he_bss_color);
-+		mt7996_update_bss_color(hw, vif, mconf, &info->he_bss_color);
+-	mt7996_mac_wtbl_update(dev, msta->wcid.idx,
+-			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
+-
+ 	conf = link_conf_dereference_protected(vif, 0);
+ 	mconf = mconf_dereference_protected(mvif, 0);
+-	mt7996_mcu_add_sta(dev, conf, mconf, sta, true, true);
+-	mt7996_mcu_add_rate_ctrl(dev, conf, mconf, sta, false);
++	link_sta = link_sta_dereference_protected(sta, 0);
++	mlink = mlink_dereference_protected(msta, 0);
  
- 	if (changed & (BSS_CHANGED_BEACON |
- 		       BSS_CHANGED_BEACON_ENABLED)) {
--		mvif->beacon_rates_idx =
--			mt7996_get_rates_table(hw, vif, true, false);
-+		mconf->mt76.beacon_rates_idx =
-+			mt7996_get_rates_table(hw, info, mconf, true, false);
+-	ewma_avg_signal_init(&msta->avg_ack_signal);
++	mt7996_mac_wtbl_update(dev, mlink->wcid.idx,
++			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
++
++	mt7996_mcu_add_sta(dev, conf, mconf, link_sta, mlink, true, true);
++	mt7996_mcu_add_rate_ctrl(dev, conf, mconf, link_sta, mlink, false);
++	mlink->wcid.tx_info |= MT_WCID_TX_INFO_SET;
++
++	ewma_avg_signal_init(&mlink->avg_ack_signal);
  
--		mt7996_mcu_add_beacon(hw, vif, info->enable_beacon);
-+		mt7996_mcu_add_beacon(hw, info, mconf, info->enable_beacon);
- 	}
+ 	mutex_unlock(&dev->mt76.mutex);
+ }
+@@ -879,25 +898,31 @@ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 	struct mt7996_bss_conf *mconf;
++	struct mt7996_link_sta *mlink;
+ 	struct ieee80211_bss_conf *conf;
++	struct ieee80211_link_sta *link_sta;
+ 	int i;
  
- 	if (changed & (BSS_CHANGED_UNSOL_BCAST_PROBE_RESP |
- 		       BSS_CHANGED_FILS_DISCOVERY))
--		mt7996_mcu_beacon_inband_discov(dev, vif, changed);
-+		mt7996_mcu_beacon_inband_discov(dev, info, mconf, changed);
+ 	conf = link_conf_dereference_protected(vif, 0);
+ 	mconf = mconf_dereference_protected(mvif, 0);
+-	mt7996_mcu_add_sta(dev, conf, mconf, sta, false, false);
++	link_sta = link_sta_dereference_protected(sta, 0);
++	mlink = mlink_dereference_protected(msta, 0);
++	mt7996_mcu_add_sta(dev, conf, mconf, link_sta, mlink, false, false);
  
- 	if (changed & BSS_CHANGED_MU_GROUPS)
--		mt7996_update_mu_group(hw, vif, info);
-+		mt7996_update_mu_group(hw, info, mconf);
+-	mt7996_mac_wtbl_update(dev, msta->wcid.idx,
++	mt7996_mac_wtbl_update(dev, mlink->wcid.idx,
+ 			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
  
- 	mutex_unlock(&dev->mt76.mutex);
- }
-@@ -771,9 +787,14 @@ mt7996_channel_switch_beacon(struct ieee80211_hw *hw,
- 			     struct cfg80211_chan_def *chandef)
- {
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_bss_conf *mconf;
-+	struct ieee80211_bss_conf *conf;
+-	for (i = 0; i < ARRAY_SIZE(msta->twt.flow); i++)
+-		mt7996_mac_twt_teardown_flow(dev, msta, i);
++	for (i = 0; i < ARRAY_SIZE(mlink->twt.flow); i++)
++		mt7996_mac_twt_teardown_flow(dev, mlink, i);
  
- 	mutex_lock(&dev->mt76.mutex);
--	mt7996_mcu_add_beacon(hw, vif, true);
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	conf = link_conf_dereference_protected(vif, 0);
-+	mt7996_mcu_add_beacon(hw, conf, mconf, true);
- 	mutex_unlock(&dev->mt76.mutex);
+ 	spin_lock_bh(&mdev->sta_poll_lock);
+-	if (!list_empty(&msta->wcid.poll_list))
+-		list_del_init(&msta->wcid.poll_list);
+-	if (!list_empty(&msta->rc_list))
+-		list_del_init(&msta->rc_list);
++	if (!list_empty(&mlink->wcid.poll_list))
++		list_del_init(&mlink->wcid.poll_list);
++	if (!list_empty(&mlink->rc_list))
++		list_del_init(&mlink->rc_list);
+ 	spin_unlock_bh(&mdev->sta_poll_lock);
++
++	rcu_assign_pointer(msta->link[0], NULL);
  }
  
-@@ -783,7 +804,8 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	u8 band_idx = mvif->phy->mt76->band_idx;
-+	struct mt7996_bss_conf *mconf = mconf_dereference_protected(mvif, 0);
-+	u8 band_idx = mconf->phy->mt76->band_idx;
- 	int idx;
+ static void mt7996_tx(struct ieee80211_hw *hw,
+@@ -909,19 +934,22 @@ static void mt7996_tx(struct ieee80211_hw *hw,
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	struct ieee80211_vif *vif = info->control.vif;
+ 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
++	struct mt7996_link_sta *mlink;
  
- #ifdef CONFIG_MTK_VENDOR
-@@ -803,7 +825,7 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 	msta->wcid.tx_info |= MT_WCID_TX_INFO_SET;
+ 	if (control->sta) {
+-		struct mt7996_sta *sta;
++		struct mt7996_sta *msta;
  
- #ifdef CONFIG_MTK_VENDOR
--	mt7996_vendor_amnt_sta_remove(mvif->phy, sta);
-+	mt7996_vendor_amnt_sta_remove(mconf->phy, sta);
- #endif
+-		sta = (struct mt7996_sta *)control->sta->drv_priv;
+-		wcid = &sta->wcid;
++		msta = (struct mt7996_sta *)control->sta->drv_priv;
++		mlink = rcu_dereference(msta->link[0]);
++		wcid = &mlink->wcid;
+ 	}
  
- #ifdef CONFIG_MTK_VENDOR
-@@ -830,15 +852,20 @@ void mt7996_mac_sta_assoc(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 			  struct ieee80211_sta *sta)
- {
- 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_bss_conf *mconf;
-+	struct ieee80211_bss_conf *conf;
+ 	if (vif && !control->sta) {
+ 		struct mt7996_vif *mvif;
  
- 	mutex_lock(&dev->mt76.mutex);
- 
- 	mt7996_mac_wtbl_update(dev, msta->wcid.idx,
- 			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
- 
--	mt7996_mcu_add_sta(dev, vif, sta, true, true);
--	mt7996_mcu_add_rate_ctrl(dev, vif, sta, false);
-+	conf = link_conf_dereference_protected(vif, 0);
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	mt7996_mcu_add_sta(dev, conf, mconf, sta, true, true);
-+	mt7996_mcu_add_rate_ctrl(dev, conf, mconf, sta, false);
+ 		mvif = (struct mt7996_vif *)vif->drv_priv;
+-		wcid = &mvif->sta.wcid;
++		mlink = rcu_dereference(mvif->sta.link[0]);
++		wcid = &mlink->wcid;
+ 	}
  
- 	ewma_avg_signal_init(&msta->avg_ack_signal);
+ 	mt76_tx(mphy, control->sta, wcid, skb);
+@@ -948,6 +976,7 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	struct ieee80211_sta *sta = params->sta;
+ 	struct ieee80211_txq *txq = sta->txq[params->tid];
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_link_sta *mlink;
+ 	u16 tid = params->tid;
+ 	u16 ssn = params->ssn;
+ 	struct mt76_txq *mtxq;
+@@ -959,14 +988,15 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	mtxq = (struct mt76_txq *)txq->drv_priv;
  
-@@ -849,10 +876,15 @@ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 			   struct ieee80211_sta *sta)
+ 	mutex_lock(&dev->mt76.mutex);
++	mlink = mlink_dereference_protected(msta, 0);
+ 	switch (action) {
+ 	case IEEE80211_AMPDU_RX_START:
+-		mt76_rx_aggr_start(&dev->mt76, &msta->wcid, tid, ssn,
++		mt76_rx_aggr_start(&dev->mt76, &mlink->wcid, tid, ssn,
+ 				   params->buf_size);
+ 		ret = mt7996_mcu_add_rx_ba(dev, params, true);
+ 		break;
+ 	case IEEE80211_AMPDU_RX_STOP:
+-		mt76_rx_aggr_stop(&dev->mt76, &msta->wcid, tid);
++		mt76_rx_aggr_stop(&dev->mt76, &mlink->wcid, tid);
+ 		ret = mt7996_mcu_add_rx_ba(dev, params, false);
+ 		break;
+ 	case IEEE80211_AMPDU_TX_OPERATIONAL:
+@@ -977,16 +1007,16 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
+ 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
+ 		mtxq->aggr = false;
+-		clear_bit(tid, &msta->wcid.ampdu_state);
++		clear_bit(tid, &mlink->wcid.ampdu_state);
+ 		ret = mt7996_mcu_add_tx_ba(dev, params, false);
+ 		break;
+ 	case IEEE80211_AMPDU_TX_START:
+-		set_bit(tid, &msta->wcid.ampdu_state);
++		set_bit(tid, &mlink->wcid.ampdu_state);
+ 		ret = IEEE80211_AMPDU_TX_START_IMMEDIATE;
+ 		break;
+ 	case IEEE80211_AMPDU_TX_STOP_CONT:
+ 		mtxq->aggr = false;
+-		clear_bit(tid, &msta->wcid.ampdu_state);
++		clear_bit(tid, &mlink->wcid.ampdu_state);
+ 		ret = mt7996_mcu_add_tx_ba(dev, params, false);
+ 		ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+ 		break;
+@@ -1165,10 +1195,19 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
+ 				  struct ieee80211_sta *sta,
+ 				  struct station_info *sinfo)
  {
- 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++	struct mt7996_dev *dev = mt7996_hw_dev(hw);
+ 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_bss_conf *mconf;
-+	struct ieee80211_bss_conf *conf;
- 	int i;
+-	struct rate_info *txrate = &msta->wcid.rate;
++	struct mt7996_link_sta *mlink;
++	struct rate_info *txrate;
  
--	mt7996_mcu_add_sta(dev, vif, sta, false, false);
-+	conf = link_conf_dereference_protected(vif, 0);
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	mt7996_mcu_add_sta(dev, conf, mconf, sta, false, false);
++	/* TODO: support per-link rate report */
++	mutex_lock(&dev->mt76.mutex);
++	mlink = mlink_dereference_protected(msta, 0);
++	if (!mlink)
++		goto out;
++
++	txrate = &mlink->wcid.rate;
+ 	if (txrate->legacy || txrate->flags) {
+ 		if (txrate->legacy) {
+ 			sinfo->txrate.legacy = txrate->legacy;
+@@ -1187,44 +1226,52 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
+ 	sinfo->txrate.flags = txrate->flags;
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
  
- 	mt7996_mac_wtbl_update(dev, msta->wcid.idx,
- 			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
-@@ -984,7 +1016,7 @@ mt7996_get_stats(struct ieee80211_hw *hw,
- 	return 0;
- }
+-	sinfo->tx_failed = msta->wcid.stats.tx_failed;
++	sinfo->tx_failed = mlink->wcid.stats.tx_failed;
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
  
--u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif)
-+u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_bss_conf *mconf)
- {
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
-@@ -996,8 +1028,8 @@ u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif)
+-	sinfo->tx_retries = msta->wcid.stats.tx_retries;
++	sinfo->tx_retries = mlink->wcid.stats.tx_retries;
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
  
- 	lockdep_assert_held(&dev->mt76.mutex);
- 
--	n = mvif->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
--					       : mvif->mt76.omac_idx;
-+	n = mconf->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
-+					       : mconf->mt76.omac_idx;
- 	/* TSF software read */
- 	mt76_rmw(dev, MT_LPON_TCR(phy->mt76->band_idx, n), MT_LPON_TCR_SW_MODE,
- 		 MT_LPON_TCR_SW_READ);
-@@ -1012,10 +1044,12 @@ mt7996_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
- {
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
-+	struct mt7996_bss_conf *mconf;
- 	u64 ret;
+-	sinfo->ack_signal = (s8)msta->ack_signal;
++	sinfo->ack_signal = (s8)mlink->ack_signal;
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL);
  
- 	mutex_lock(&dev->mt76.mutex);
--	ret = __mt7996_get_tsf(hw, mvif);
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	ret = __mt7996_get_tsf(hw, mconf);
- 	mutex_unlock(&dev->mt76.mutex);
+-	sinfo->avg_ack_signal = -(s8)ewma_avg_signal_read(&msta->avg_ack_signal);
++	sinfo->avg_ack_signal = -(s8)ewma_avg_signal_read(&mlink->avg_ack_signal);
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL_AVG);
  
- 	return ret;
-@@ -1028,6 +1062,7 @@ mt7996_set_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
-+	struct mt7996_bss_conf *mconf;
- 	union {
- 		u64 t64;
- 		u32 t32[2];
-@@ -1036,8 +1071,9 @@ mt7996_set_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	if (mtk_wed_device_active(&phy->dev->mt76.mmio.wed)) {
+-		sinfo->tx_bytes = msta->wcid.stats.tx_bytes;
++		sinfo->tx_bytes = mlink->wcid.stats.tx_bytes;
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES64);
  
- 	mutex_lock(&dev->mt76.mutex);
+-		sinfo->rx_bytes = msta->wcid.stats.rx_bytes;
++		sinfo->rx_bytes = mlink->wcid.stats.rx_bytes;
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES64);
  
--	n = mvif->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
--					       : mvif->mt76.omac_idx;
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	n = mconf->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
-+					       : mconf->mt76.omac_idx;
- 	mt76_wr(dev, MT_LPON_UTTR0(phy->mt76->band_idx), tsf.t32[0]);
- 	mt76_wr(dev, MT_LPON_UTTR1(phy->mt76->band_idx), tsf.t32[1]);
- 	/* TSF software overwrite */
-@@ -1054,6 +1090,7 @@ mt7996_offset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
-+	struct mt7996_bss_conf *mconf;
- 	union {
- 		u64 t64;
- 		u32 t32[2];
-@@ -1062,8 +1099,9 @@ mt7996_offset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+-		sinfo->tx_packets = msta->wcid.stats.tx_packets;
++		sinfo->tx_packets = mlink->wcid.stats.tx_packets;
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
  
- 	mutex_lock(&dev->mt76.mutex);
+-		sinfo->rx_packets = msta->wcid.stats.rx_packets;
++		sinfo->rx_packets = mlink->wcid.stats.rx_packets;
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
+ 	}
++out:
++	mutex_unlock(&dev->mt76.mutex);
+ }
  
--	n = mvif->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
--					       : mvif->mt76.omac_idx;
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	n = mconf->mt76.omac_idx > HW_BSSID_MAX ? HW_BSSID_0
-+					       : mconf->mt76.omac_idx;
- 	mt76_wr(dev, MT_LPON_UTTR0(phy->mt76->band_idx), tsf.t32[0]);
- 	mt76_wr(dev, MT_LPON_UTTR1(phy->mt76->band_idx), tsf.t32[1]);
- 	/* TSF software adjust*/
-@@ -1179,7 +1217,7 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
  static void mt7996_sta_rc_work(void *data, struct ieee80211_sta *sta)
  {
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
--	struct mt7996_dev *dev = msta->vif->phy->dev;
-+	struct mt7996_dev *dev = msta->vif->dev;
++	struct mt7996_link_sta *mlink;
+ 	struct mt7996_dev *dev = msta->vif->dev;
  	u32 *changed = data;
  
++	rcu_read_lock();
++	mlink = rcu_dereference(msta->link[0]);
++
  	spin_lock_bh(&dev->mt76.sta_poll_lock);
-@@ -1215,9 +1253,13 @@ mt7996_set_bitrate_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
- 	struct mt7996_dev *dev = phy->dev;
-+	struct mt7996_bss_conf *mconf;
- 	u32 changed = IEEE80211_RC_SUPP_RATES_CHANGED;
+-	msta->changed |= *changed;
+-	if (list_empty(&msta->rc_list))
+-		list_add_tail(&msta->rc_list, &dev->sta_rc_list);
++	mlink->changed |= *changed;
++	if (list_empty(&mlink->rc_list))
++		list_add_tail(&mlink->rc_list, &dev->sta_rc_list);
+ 	spin_unlock_bh(&dev->mt76.sta_poll_lock);
++
++	rcu_read_unlock();
+ }
  
--	mvif->bitrate_mask = *mask;
-+	mutex_lock(&dev->mt76.mutex);
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	mconf->bitrate_mask = *mask;
-+	mutex_unlock(&dev->mt76.mutex);
+ static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
+@@ -1238,7 +1285,7 @@ static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
  
- 	/* if multiple rates across different preambles are given we can
- 	 * reconfigure this info with all peers using sta_rec command with
-@@ -1239,14 +1281,20 @@ static void mt7996_sta_set_4addr(struct ieee80211_hw *hw,
- 				 bool enabled)
- {
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	if (!msta->vif) {
+ 		dev_warn(dev->mt76.dev, "Un-initialized STA %pM wcid %d in rc_work\n",
+-			 sta->addr, msta->wcid.idx);
++			 sta->addr, msta->deflink.wcid.idx);
+ 		return;
+ 	}
+ 
+@@ -1284,16 +1331,18 @@ static void mt7996_sta_set_4addr(struct ieee80211_hw *hw,
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_bss_conf *mconf;
-+
-+	mutex_lock(&dev->mt76.mutex);
-+	mconf = mconf_dereference_protected(mvif, 0);
+ 	struct mt7996_bss_conf *mconf;
++	struct mt7996_link_sta *mlink;
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+ 	mconf = mconf_dereference_protected(mvif, 0);
++	mlink = mlink_dereference_protected(msta, 0);
  
  	if (enabled)
- 		set_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
+-		set_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
++		set_bit(MT_WCID_FLAG_4ADDR, &mlink->wcid.flags);
  	else
- 		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
+-		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
++		clear_bit(MT_WCID_FLAG_4ADDR, &mlink->wcid.flags);
  
--	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, sta);
-+	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, sta);
-+	mutex_unlock(&dev->mt76.mutex);
+-	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, sta);
++	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, mlink);
+ 	mutex_unlock(&dev->mt76.mutex);
  }
  
- static void mt7996_sta_set_decap_offload(struct ieee80211_hw *hw,
-@@ -1255,14 +1303,20 @@ static void mt7996_sta_set_decap_offload(struct ieee80211_hw *hw,
- 					 bool enabled)
- {
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+@@ -1306,16 +1355,18 @@ static void mt7996_sta_set_decap_offload(struct ieee80211_hw *hw,
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_bss_conf *mconf;
-+
-+	mutex_lock(&dev->mt76.mutex);
-+	mconf = mconf_dereference_protected(mvif, 0);
+ 	struct mt7996_bss_conf *mconf;
++	struct mt7996_link_sta *mlink;
+ 
+ 	mutex_lock(&dev->mt76.mutex);
+ 	mconf = mconf_dereference_protected(mvif, 0);
++	mlink = mlink_dereference_protected(msta, 0);
  
  	if (enabled)
- 		set_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
+-		set_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
++		set_bit(MT_WCID_FLAG_HDR_TRANS, &mlink->wcid.flags);
  	else
- 		clear_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
+-		clear_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
++		clear_bit(MT_WCID_FLAG_HDR_TRANS, &mlink->wcid.flags);
  
--	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, sta);
-+	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, sta);
-+	mutex_unlock(&dev->mt76.mutex);
+-	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, sta);
++	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, mlink);
+ 	mutex_unlock(&dev->mt76.mutex);
  }
  
- static const char mt7996_gstrings_stats[][ETH_GSTRING_LEN] = {
-@@ -1395,7 +1449,7 @@ static void mt7996_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
+@@ -1448,11 +1499,12 @@ static void mt7996_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
+ {
  	struct mt76_ethtool_worker_info *wi = wi_data;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_link_sta *mlink = &msta->deflink;
  
--	if (msta->vif->mt76.idx != wi->idx)
-+	if (msta->vif->deflink.mt76.idx != wi->idx)
+ 	if (msta->vif->deflink.mt76.idx != wi->idx)
  		return;
  
- 	mt76_ethtool_worker(wi, &msta->wcid.stats, true);
-@@ -1409,15 +1463,17 @@ void mt7996_get_et_stats(struct ieee80211_hw *hw,
+-	mt76_ethtool_worker(wi, &msta->wcid.stats, true);
++	mt76_ethtool_worker(wi, &mlink->wcid.stats, true);
+ }
+ 
+ static
+@@ -1555,10 +1607,12 @@ mt7996_twt_teardown_request(struct ieee80211_hw *hw,
+ 			    u8 flowid)
+ {
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_link_sta *mlink;
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_bss_conf *mconf;
- 	struct mt76_mib_stats *mib = &phy->mib;
- 	struct mt76_ethtool_worker_info wi = {
- 		.data = data,
--		.idx = mvif->mt76.idx,
- 	};
- 	/* See mt7996_ampdu_stat_read_phy, etc */
- 	int i, ei = 0;
  
  	mutex_lock(&dev->mt76.mutex);
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	wi.idx = mconf->mt76.idx,
- 
- 	mt7996_mac_update_stats(phy);
+-	mt7996_mac_twt_teardown_flow(dev, msta, flowid);
++	mlink = mlink_dereference_protected(msta, 0);
++	mt7996_mac_twt_teardown_flow(dev, mlink, flowid);
+ 	mutex_unlock(&dev->mt76.mutex);
+ }
  
-@@ -1623,6 +1679,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
- 			     struct net_device_path *path)
- {
+@@ -1681,6 +1735,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_bss_conf *mconf = &mvif->deflink;
+ 	struct mt7996_bss_conf *mconf = &mvif->deflink;
  	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_link_sta *mlink = &msta->deflink;
  	struct mt7996_dev *dev = mt7996_hw_dev(hw);
  	struct mt7996_phy *phy = mt7996_hw_phy(hw);
-@@ -1652,7 +1709,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+ 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
+@@ -1703,7 +1758,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
+ 	if (!mtk_wed_device_active(wed))
+ 		return -ENODEV;
+ 
+-	if (msta->wcid.idx > MT7996_WTBL_STA)
++	if (mlink->wcid.idx > MT7996_WTBL_STA)
+ 		return -EIO;
+ 
  	path->type = DEV_PATH_MTK_WDMA;
- 	path->dev = ctx->dev;
+@@ -1711,11 +1766,11 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
  	path->mtk_wdma.wdma_idx = wed->wdma_idx;
--	path->mtk_wdma.bss = mvif->mt76.idx;
-+	path->mtk_wdma.bss = mconf->mt76.idx;
+ 	path->mtk_wdma.bss = mconf->mt76.idx;
  	path->mtk_wdma.queue = 0;
- 	path->mtk_wdma.wcid = msta->wcid.idx;
- 
-@@ -1784,6 +1841,7 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	struct mt7996_chanctx *ctx = mt7996_chanctx_get(conf);
- 	struct mt7996_phy *phy = ctx->phy;
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_bss_conf *mconf;
- 
- 	wiphy_info(hw->wiphy, "Assign VIF (addr: %pM, type: %d, link_id: %d) to channel context: %d MHz\n",
- 		    vif->addr, vif->type, link_conf->link_id,
-@@ -1791,7 +1849,8 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 
- 	mutex_lock(&phy->dev->mt76.mutex);
- 
--	mvif->chanctx = ctx;
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	mconf->chanctx = ctx;
- 	ctx->nbss_assigned++;
- 
- 	mutex_unlock(&phy->dev->mt76.mutex);
-@@ -1807,6 +1866,7 @@ mt7996_unassign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	struct mt7996_chanctx *ctx = mt7996_chanctx_get(conf);
- 	struct mt7996_phy *phy = ctx->phy;
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_bss_conf *mconf;
- 
- 	wiphy_info(hw->wiphy, "Remove VIF (addr: %pM, type: %d, link_id: %d) from channel context: %d MHz\n",
- 		   vif->addr, vif->type, link_conf->link_id,
-@@ -1818,7 +1878,8 @@ mt7996_unassign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	if (test_bit(MT76_SCANNING, &phy->mt76->state))
- 		mt7996_scan_complete(phy, true);
+-	path->mtk_wdma.wcid = msta->wcid.idx;
++	path->mtk_wdma.wcid = mlink->wcid.idx;
  
--	mvif->chanctx = NULL;
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	mconf->chanctx = NULL;
- 	ctx->nbss_assigned--;
+ 	if (ieee80211_hw_check(hw, SUPPORTS_AMSDU_IN_AMPDU) &&
+ 	    mtk_wed_is_amsdu_supported(wed))
+-		path->mtk_wdma.amsdu = msta->wcid.amsdu;
++		path->mtk_wdma.amsdu = mlink->wcid.amsdu;
+ 	else
+ 		path->mtk_wdma.amsdu = 0;
  
- 	mutex_unlock(&phy->dev->mt76.mutex);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 85077108e..11700f90f 100644
+index ebd3192..cab4a0a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
-@@ -117,12 +117,12 @@ mt7996_mcu_get_sta_nss(u16 mcs_map)
+@@ -117,13 +117,13 @@ mt7996_mcu_get_sta_nss(u16 mcs_map)
  }
  
  static void
--mt7996_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
--			  u16 mcs_map)
-+mt7996_mcu_set_sta_he_mcs(struct ieee80211_sta *sta,
-+			  struct mt7996_bss_conf *mconf,
-+			  __le16 *he_mcs, u16 mcs_map)
+-mt7996_mcu_set_sta_he_mcs(struct ieee80211_sta *sta,
++mt7996_mcu_set_sta_he_mcs(struct ieee80211_link_sta *link_sta,
+ 			  struct mt7996_bss_conf *mconf,
+ 			  __le16 *he_mcs, u16 mcs_map)
  {
--	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
--	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
--	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
-+	enum nl80211_band band = mconf->phy->mt76->chandef.chan->band;
-+	const u16 *mask = mconf->bitrate_mask.control[band].he_mcs;
- 	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
+ 	enum nl80211_band band = mconf->phy->mt76->chandef.chan->band;
+ 	const u16 *mask = mconf->bitrate_mask.control[band].he_mcs;
+-	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
++	int nss, max_nss = link_sta->rx_nss > 3 ? 4 : link_sta->rx_nss;
  
  	for (nss = 0; nss < max_nss; nss++) {
-@@ -922,8 +922,7 @@ mt7996_mcu_add_uni_tlv(struct sk_buff *skb, u16 tag, u16 len)
+ 		int mcs;
+@@ -166,11 +166,11 @@ mt7996_mcu_set_sta_he_mcs(struct ieee80211_sta *sta,
  }
  
  static void
--mt7996_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
--			struct mt7996_phy *phy)
-+mt7996_mcu_bss_rfch_tlv(struct sk_buff *skb, struct mt7996_phy *phy)
+-mt7996_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
+-			   const u16 *mask)
++mt7996_mcu_set_sta_vht_mcs(struct ieee80211_link_sta *link_sta,
++			   __le16 *vht_mcs, const u16 *mask)
  {
- 	static const u8 rlm_ch_band[] = {
- 		[NL80211_BAND_2GHZ] = 1,
-@@ -953,8 +952,7 @@ mt7996_mcu_bss_rfch_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+-	u16 mcs, mcs_map = le16_to_cpu(sta->deflink.vht_cap.vht_mcs.rx_mcs_map);
+-	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
++	u16 mcs, mcs_map = le16_to_cpu(link_sta->vht_cap.vht_mcs.rx_mcs_map);
++	int nss, max_nss = link_sta->rx_nss > 3 ? 4 : link_sta->rx_nss;
+ 
+ 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
+ 		switch (mcs_map & 0x3) {
+@@ -192,13 +192,13 @@ mt7996_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
  }
  
  static void
--mt7996_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
--		      struct mt7996_phy *phy)
-+mt7996_mcu_bss_ra_tlv(struct sk_buff *skb)
+-mt7996_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
++mt7996_mcu_set_sta_ht_mcs(struct ieee80211_link_sta *link_sta, u8 *ht_mcs,
+ 			  const u8 *mask)
  {
- 	struct bss_ra_tlv *ra;
- 	struct tlv *tlv;
-@@ -966,7 +964,7 @@ mt7996_mcu_bss_ra_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+-	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
++	int nss, max_nss = link_sta->rx_nss > 3 ? 4 : link_sta->rx_nss;
+ 
+ 	for (nss = 0; nss < max_nss; nss++)
+-		ht_mcs[nss] = sta->deflink.ht_cap.mcs.rx_mask[nss] & mask[nss];
++		ht_mcs[nss] = link_sta->ht_cap.mcs.rx_mask[nss] & mask[nss];
  }
  
- static void
--mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
-+mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
- 		      struct mt7996_phy *phy)
+ static int
+@@ -531,14 +531,14 @@ static inline void __mt7996_stat_to_netdev(struct mt76_phy *mphy,
+ 					   u32 tx_bytes, u32 rx_bytes,
+ 					   u32 tx_packets, u32 rx_packets)
  {
- #define DEFAULT_HE_PE_DURATION		4
-@@ -975,16 +973,16 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
- 	struct bss_info_uni_he *he;
- 	struct tlv *tlv;
+-	struct mt7996_sta *msta;
++	struct mt7996_link_sta *mlink;
+ 	struct ieee80211_vif *vif;
+ 	struct wireless_dev *wdev;
  
--	cap = mt76_connac_get_he_phy_cap(phy->mt76, vif);
-+	cap = mt76_connac_get_he_phy_cap(phy->mt76, conf->vif);
+ 	if (wiphy_ext_feature_isset(mphy->hw->wiphy,
+ 				    NL80211_EXT_FEATURE_STAS_COUNT)) {
+-		msta = container_of(wcid, struct mt7996_sta, wcid);
+-		vif = container_of((void *)msta->vif, struct ieee80211_vif,
++		mlink = container_of(wcid, struct mt7996_link_sta, wcid);
++		vif = container_of((void *)mlink->sta->vif, struct ieee80211_vif,
+ 				   drv_priv);
+ 		wdev = ieee80211_vif_to_wdev(vif);
  
- 	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_HE_BASIC, sizeof(*he));
+@@ -1236,10 +1236,10 @@ __mt7996_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
  
- 	he = (struct bss_info_uni_he *)tlv;
--	he->he_pe_duration = vif->bss_conf.htc_trig_based_pkt_ext;
-+	he->he_pe_duration = conf->htc_trig_based_pkt_ext;
- 	if (!he->he_pe_duration)
- 		he->he_pe_duration = DEFAULT_HE_PE_DURATION;
+ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
+ 			    struct ieee80211_bss_conf *conf,
+-			    struct mt7996_bss_conf *mconf, int enable)
++			    struct mt7996_bss_conf *mconf,
++			    struct mt7996_link_sta *mlink, int enable)
+ {
+ 	struct ieee80211_vif *vif = conf->vif;
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_dev *dev = phy->dev;
+ 	struct sk_buff *skb;
  
--	he->he_rts_thres = cpu_to_le16(vif->bss_conf.frame_time_rts_th);
-+	he->he_rts_thres = cpu_to_le16(conf->frame_time_rts_th);
- 	if (!he->he_rts_thres)
- 		he->he_rts_thres = cpu_to_le16(DEFAULT_HE_DURATION_RTS_THRES);
+@@ -1255,7 +1255,7 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
  
-@@ -994,13 +992,13 @@ mt7996_mcu_bss_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
- }
+ 	/* bss_basic must be first */
+ 	mt7996_mcu_bss_basic_tlv(skb, conf, mconf, NULL, phy->mt76,
+-				 mvif->sta.wcid.idx, enable);
++				 mlink->wcid.idx, enable);
+ 	mt7996_mcu_bss_sec_tlv(skb, mconf);
  
- static void
--mt7996_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
-+mt7996_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
- 			  struct mt7996_phy *phy, int enable)
+ 	if (vif->type == NL80211_IFTYPE_MONITOR)
+@@ -1335,9 +1335,10 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  {
- 	struct bss_info_uni_mbssid *mbssid;
- 	struct tlv *tlv;
- 
--	if (!vif->bss_conf.bssid_indicator && enable)
-+	if (!conf->bssid_indicator && enable)
- 		return;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)params->sta->drv_priv;
+ 	struct mt7996_bss_conf *mconf = mconf_dereference_protected(msta->vif, 0);
++	struct mt7996_link_sta *mlink = mlink_dereference_protected(msta, 0);
  
- 	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_11V_MBSSID, sizeof(*mbssid));
-@@ -1008,23 +1006,21 @@ mt7996_mcu_bss_mbssid_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
- 	mbssid = (struct bss_info_uni_mbssid *)tlv;
+ 	if (enable && !params->amsdu)
+-		msta->wcid.amsdu = false;
++		mlink->wcid.amsdu = false;
  
- 	if (enable) {
--		mbssid->max_indicator = vif->bss_conf.bssid_indicator;
--		mbssid->mbss_idx = vif->bss_conf.bssid_index;
-+		mbssid->max_indicator = conf->bssid_indicator;
-+		mbssid->mbss_idx = conf->bssid_index;
- 		mbssid->tx_bss_omac_idx = 0;
- 	}
+ 	return mt7996_mcu_sta_ba(dev, &mconf->mt76, params, enable, true);
  }
- 
+@@ -1355,15 +1356,15 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
  static void
--mt7996_mcu_bss_bmc_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
-+mt7996_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt7996_bss_conf *mconf,
- 		       struct mt7996_phy *phy)
+ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
+ 		      struct mt7996_bss_conf *mconf,
+-		      struct ieee80211_sta *sta)
++		      struct ieee80211_link_sta *link_sta)
  {
--	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
- 	struct bss_rate_tlv *bmc;
- 	struct cfg80211_chan_def *chandef = &phy->mt76->chandef;
- 	enum nl80211_band band = chandef->chan->band;
+-	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
++	struct ieee80211_he_cap_elem *elem = &link_sta->he_cap.he_cap_elem;
+ 	struct ieee80211_he_mcs_nss_supp mcs_map;
+ 	struct sta_rec_he_v2 *he;
  	struct tlv *tlv;
--	u8 idx = mvif->mcast_rates_idx ?
--		 mvif->mcast_rates_idx : mvif->basic_rates_idx;
-+	u8 idx = mconf->mt76.mcast_rates_idx ?: mconf->mt76.basic_rates_idx;
+ 	int i = 0;
  
- 	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_RATE, sizeof(*bmc));
- 
-@@ -1048,9 +1044,9 @@ mt7996_mcu_bss_txcmd_tlv(struct sk_buff *skb, bool en)
- }
+-	if (!sta->deflink.he_cap.has_he)
++	if (!link_sta->he_cap.has_he)
+ 		return;
  
- static void
--mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
-+mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
-+		       struct mt7996_bss_conf *mconf)
- {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct bss_mld_tlv *mld;
- 	struct tlv *tlv;
+ 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_V2, sizeof(*he));
+@@ -1380,21 +1381,21 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
+ 		u8p_replace_bits(&he->he_phy_cap[1], conf->he_ldpc,
+ 				 IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD);
  
-@@ -1058,33 +1054,30 @@ mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
+-	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
+-	switch (sta->deflink.bandwidth) {
++	mcs_map = link_sta->he_cap.he_mcs_nss_supp;
++	switch (link_sta->bandwidth) {
+ 	case IEEE80211_STA_RX_BW_160:
+ 		if (elem->phy_cap_info[0] &
+ 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
+-			mt7996_mcu_set_sta_he_mcs(sta, mconf,
++			mt7996_mcu_set_sta_he_mcs(link_sta, mconf,
+ 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
+ 						  le16_to_cpu(mcs_map.rx_mcs_80p80));
  
- 	mld = (struct bss_mld_tlv *)tlv;
- 	mld->group_mld_id = 0xff;
--	mld->own_mld_id = mvif->mt76.idx;
-+	mld->own_mld_id = mconf->mt76.idx;
- 	mld->remap_idx = 0xff;
+-		mt7996_mcu_set_sta_he_mcs(sta, mconf,
++		mt7996_mcu_set_sta_he_mcs(link_sta, mconf,
+ 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
+ 					  le16_to_cpu(mcs_map.rx_mcs_160));
+ 		fallthrough;
+ 	default:
+-		mt7996_mcu_set_sta_he_mcs(sta, mconf,
++		mt7996_mcu_set_sta_he_mcs(link_sta, mconf,
+ 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
+ 					  le16_to_cpu(mcs_map.rx_mcs_80));
+ 		break;
+@@ -1404,24 +1405,25 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
  }
  
  static void
--mt7996_mcu_bss_sec_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
-+mt7996_mcu_bss_sec_tlv(struct sk_buff *skb, struct mt7996_bss_conf *mconf)
+-mt7996_mcu_sta_he_6g_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
++mt7996_mcu_sta_he_6g_tlv(struct sk_buff *skb,
++			 struct ieee80211_link_sta *link_sta)
  {
--	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
- 	struct bss_sec_tlv *sec;
+ 	struct sta_rec_he_6g_capa *he_6g;
  	struct tlv *tlv;
  
- 	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_SEC, sizeof(*sec));
- 
- 	sec = (struct bss_sec_tlv *)tlv;
--	sec->cipher = mvif->cipher;
-+	sec->cipher = mconf->mt76.cipher;
- }
- 
- static int
--mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_vif *vif,
--		       bool bssid, bool enable)
-+mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
-+		       struct mt7996_bss_conf *mconf, bool bssid, bool enable)
- {
- #define UNI_MUAR_ENTRY 2
- 	struct mt7996_dev *dev = phy->dev;
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	u32 idx = mvif->mt76.omac_idx - REPEATER_BSSID_START;
--	const u8 *addr = vif->addr;
--
-+	u32 idx = mconf->mt76.omac_idx - REPEATER_BSSID_START;
-+	const u8 *addr = bssid ? conf->bssid : conf->vif->addr;
- 	struct {
- 		struct {
- 			u8 band;
-@@ -1109,9 +1102,6 @@ mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_vif *vif,
- 		.entry_add = true,
- 	};
+-	if (!sta->deflink.he_6ghz_capa.capa)
++	if (!link_sta->he_6ghz_capa.capa)
+ 		return;
  
--	if (bssid)
--		addr = vif->bss_conf.bssid;
--
- 	if (enable)
- 		memcpy(req.addr, addr, ETH_ALEN);
+ 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G, sizeof(*he_6g));
  
-@@ -1120,10 +1110,8 @@ mt7996_mcu_muar_config(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+ 	he_6g = (struct sta_rec_he_6g_capa *)tlv;
+-	he_6g->capa = sta->deflink.he_6ghz_capa.capa;
++	he_6g->capa = link_sta->he_6ghz_capa.capa;
  }
  
  static void
--mt7996_mcu_bss_ifs_timing_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
-+mt7996_mcu_bss_ifs_timing_tlv(struct sk_buff *skb, struct mt7996_phy *phy)
+-mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
++mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
  {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct mt7996_phy *phy = mvif->phy;
- 	struct bss_ifs_time_tlv *ifs_time;
+-	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_sta *msta = (struct mt7996_sta *)link_sta->sta->drv_priv;
+ 	struct ieee80211_vif *vif = container_of((void *)msta->vif,
+ 						 struct ieee80211_vif, drv_priv);
+ 	struct ieee80211_eht_mcs_nss_supp *mcs_map;
+@@ -1429,11 +1431,11 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+ 	struct sta_rec_eht *eht;
  	struct tlv *tlv;
- 	bool is_2ghz = phy->mt76->chandef.chan->band == NL80211_BAND_2GHZ;
-@@ -1149,12 +1137,13 @@ mt7996_mcu_bss_ifs_timing_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
  
- static int
- mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
--			 struct ieee80211_vif *vif,
-+			 struct ieee80211_bss_conf *conf,
-+			 struct mt7996_bss_conf *mconf,
- 			 struct ieee80211_sta *sta,
- 			 struct mt76_phy *phy, u16 wlan_idx,
- 			 bool enable)
- {
--	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
-+	struct ieee80211_vif *vif = conf->vif;
- 	struct cfg80211_chan_def *chandef = &phy->chandef;
- 	struct mt76_connac_bss_basic_tlv *bss;
- 	u32 type = CONNECTION_INFRA_AP;
-@@ -1171,8 +1160,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
- 		if (enable) {
- 			rcu_read_lock();
- 			if (!sta)
--				sta = ieee80211_find_sta(vif,
--							 vif->bss_conf.bssid);
-+				sta = ieee80211_find_sta(vif, conf->bssid);
- 			/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
- 			if (sta) {
- 				struct mt76_wcid *wcid;
-@@ -1195,18 +1183,17 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
- 	tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*bss));
+-	if (!sta->deflink.eht_cap.has_eht)
++	if (!link_sta->eht_cap.has_eht)
+ 		return;
  
- 	bss = (struct mt76_connac_bss_basic_tlv *)tlv;
--	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
--	bss->dtim_period = vif->bss_conf.dtim_period;
- 	bss->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
- 	bss->sta_idx = cpu_to_le16(sta_wlan_idx);
- 	bss->conn_type = cpu_to_le32(type);
--	bss->omac_idx = mvif->omac_idx;
--	bss->band_idx = mvif->band_idx;
--	bss->wmm_idx = mvif->wmm_idx;
-+	bss->omac_idx = mconf->mt76.omac_idx;
-+	bss->band_idx = mconf->mt76.band_idx;
-+	bss->wmm_idx = mconf->mt76.wmm_idx;
- 	bss->conn_state = !enable;
- 	bss->active = enable;
+-	mcs_map = &sta->deflink.eht_cap.eht_mcs_nss_supp;
+-	elem = &sta->deflink.eht_cap.eht_cap_elem;
++	mcs_map = &link_sta->eht_cap.eht_mcs_nss_supp;
++	elem = &link_sta->eht_cap.eht_cap_elem;
  
--	idx = mvif->omac_idx > EXT_BSSID_START ? HW_BSSID_0 : mvif->omac_idx;
-+	idx = mconf->mt76.omac_idx > EXT_BSSID_START ? HW_BSSID_0 :
-+						       mconf->mt76.omac_idx;
- 	bss->hw_bss_idx = idx;
+ 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT, sizeof(*eht));
  
- 	if (vif->type == NL80211_IFTYPE_MONITOR) {
-@@ -1219,9 +1206,9 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
- 		return 0;
- 	}
+@@ -1444,7 +1446,7 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+ 	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
  
--	memcpy(bss->bssid, vif->bss_conf.bssid, ETH_ALEN);
--	bss->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
--	bss->dtim_period = vif->bss_conf.dtim_period;
-+	memcpy(bss->bssid, conf->bssid, ETH_ALEN);
-+	bss->bcn_interval = cpu_to_le16(conf->beacon_int);
-+	bss->dtim_period = conf->dtim_period;
- 	bss->phymode = mt76_connac_get_phy_mode(phy, vif,
- 						chandef->chan->band, NULL);
- 	bss->phymode_ext = mt76_connac_get_phy_mode_ext(phy, vif,
-@@ -1248,63 +1235,64 @@ __mt7996_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
+ 	if (vif->type != NL80211_IFTYPE_STATION &&
+-	    (sta->deflink.he_cap.he_cap_elem.phy_cap_info[0] &
++	    (link_sta->he_cap.he_cap_elem.phy_cap_info[0] &
+ 	     (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G |
+ 	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
+ 	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
+@@ -1460,44 +1462,44 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  }
  
- int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
--			    struct ieee80211_vif *vif, int enable)
-+			    struct ieee80211_bss_conf *conf,
-+			    struct mt7996_bss_conf *mconf, int enable)
+ static void
+-mt7996_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
++mt7996_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
  {
-+	struct ieee80211_vif *vif = conf->vif;
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_dev *dev = phy->dev;
- 	struct sk_buff *skb;
- 
--	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START) {
--		mt7996_mcu_muar_config(phy, vif, false, enable);
--		mt7996_mcu_muar_config(phy, vif, true, enable);
-+	if (mconf->mt76.omac_idx >= REPEATER_BSSID_START) {
-+		mt7996_mcu_muar_config(phy, conf, mconf, false, enable);
-+		mt7996_mcu_muar_config(phy, conf, mconf, true, enable);
- 	}
- 
--	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76,
-+	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
- 					 MT7996_BSS_UPDATE_MAX_SIZE);
- 	if (IS_ERR(skb))
- 		return PTR_ERR(skb);
- 
- 	/* bss_basic must be first */
--	mt7996_mcu_bss_basic_tlv(skb, vif, NULL, phy->mt76,
-+	mt7996_mcu_bss_basic_tlv(skb, conf, mconf, NULL, phy->mt76,
- 				 mvif->sta.wcid.idx, enable);
--	mt7996_mcu_bss_sec_tlv(skb, vif);
-+	mt7996_mcu_bss_sec_tlv(skb, mconf);
- 
- 	if (vif->type == NL80211_IFTYPE_MONITOR)
- 		goto out;
- 
- 	if (enable) {
--		mt7996_mcu_bss_rfch_tlv(skb, vif, phy);
--		mt7996_mcu_bss_bmc_tlv(skb, vif, phy);
--		mt7996_mcu_bss_ra_tlv(skb, vif, phy);
-+		mt7996_mcu_bss_rfch_tlv(skb, phy);
-+		mt7996_mcu_bss_bmc_tlv(skb, mconf, phy);
-+		mt7996_mcu_bss_ra_tlv(skb);
- 		mt7996_mcu_bss_txcmd_tlv(skb, true);
--		mt7996_mcu_bss_ifs_timing_tlv(skb, vif);
-+		mt7996_mcu_bss_ifs_timing_tlv(skb, phy);
- 
--		if (vif->bss_conf.he_support)
--			mt7996_mcu_bss_he_tlv(skb, vif, phy);
-+		if (conf->he_support)
-+			mt7996_mcu_bss_he_tlv(skb, conf, phy);
+ 	struct sta_rec_ht_uni *ht;
+ 	struct tlv *tlv;
  
- 		/* this tag is necessary no matter if the vif is MLD */
--		mt7996_mcu_bss_mld_tlv(skb, vif);
-+		mt7996_mcu_bss_mld_tlv(skb, vif, mconf);
- 	}
+-	if (!sta->deflink.ht_cap.ht_supported)
++	if (!link_sta->ht_cap.ht_supported)
+ 		return;
  
--	mt7996_mcu_bss_mbssid_tlv(skb, vif, phy, enable);
-+	mt7996_mcu_bss_mbssid_tlv(skb, conf, phy, enable);
+ 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
  
- out:
- 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
- 				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
+ 	ht = (struct sta_rec_ht_uni *)tlv;
+-	ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
+-	ht->ampdu_param = u8_encode_bits(sta->deflink.ht_cap.ampdu_factor,
++	ht->ht_cap = cpu_to_le16(link_sta->ht_cap.cap);
++	ht->ampdu_param = u8_encode_bits(link_sta->ht_cap.ampdu_factor,
+ 					 IEEE80211_HT_AMPDU_PARM_FACTOR) |
+-			  u8_encode_bits(sta->deflink.ht_cap.ampdu_density,
++			  u8_encode_bits(link_sta->ht_cap.ampdu_density,
+ 					 IEEE80211_HT_AMPDU_PARM_DENSITY);
  }
  
--int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif)
-+int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct mt7996_bss_conf *mconf)
- {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_dev *dev = phy->dev;
- 	struct sk_buff *skb;
- 
--	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76,
-+	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
- 					 MT7996_BSS_UPDATE_MAX_SIZE);
- 	if (IS_ERR(skb))
- 		return PTR_ERR(skb);
- 
--	mt7996_mcu_bss_ifs_timing_tlv(skb, vif);
-+	mt7996_mcu_bss_ifs_timing_tlv(skb, phy);
- 
- 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
- 				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
-@@ -1346,12 +1334,12 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
- 			 bool enable)
+ static void
+-mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
++mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
  {
- 	struct mt7996_sta *msta = (struct mt7996_sta *)params->sta->drv_priv;
--	struct mt7996_vif *mvif = msta->vif;
-+	struct mt7996_bss_conf *mconf = mconf_dereference_protected(msta->vif, 0);
- 
- 	if (enable && !params->amsdu)
- 		msta->wcid.amsdu = false;
+ 	struct sta_rec_vht *vht;
+ 	struct tlv *tlv;
+ #ifdef CONFIG_MTK_VENDOR
+-	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_sta *msta = (struct mt7996_sta *)link_sta->sta->drv_priv;
+ 	struct mt7996_phy *phy = (struct mt7996_phy *)msta->vif->deflink.phy;
+ #endif
  
--	return mt7996_mcu_sta_ba(dev, &mvif->mt76, params, enable, true);
-+	return mt7996_mcu_sta_ba(dev, &mconf->mt76, params, enable, true);
- }
+ 	/* For 6G band, this tlv is necessary to let hw work normally */
+-	if (!sta->deflink.he_6ghz_capa.capa && !sta->deflink.vht_cap.vht_supported)
++	if (!link_sta->he_6ghz_capa.capa && !link_sta->vht_cap.vht_supported)
+ 		return;
  
- int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
-@@ -1359,13 +1347,14 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
- 			 bool enable)
- {
- 	struct mt7996_sta *msta = (struct mt7996_sta *)params->sta->drv_priv;
--	struct mt7996_vif *mvif = msta->vif;
-+	struct mt7996_bss_conf *mconf = mconf_dereference_protected(msta->vif, 0);
+ 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
  
--	return mt7996_mcu_sta_ba(dev, &mvif->mt76, params, enable, false);
-+	return mt7996_mcu_sta_ba(dev, &mconf->mt76, params, enable, false);
- }
+ 	vht = (struct sta_rec_vht *)tlv;
+-	vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
+-	vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
+-	vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
++	vht->vht_cap = cpu_to_le32(link_sta->vht_cap.cap);
++	vht->vht_rx_mcs_map = link_sta->vht_cap.vht_mcs.rx_mcs_map;
++	vht->vht_tx_mcs_map = link_sta->vht_cap.vht_mcs.tx_mcs_map;
+ #ifdef CONFIG_MTK_VENDOR
+ 	vht->rts_bw_sig = phy->rts_bw_sig;
+ #endif
+@@ -1505,9 +1507,10 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
  
  static void
--mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
-+mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
-+		      struct mt7996_bss_conf *mconf,
- 		      struct ieee80211_sta *sta)
+ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+-			 struct ieee80211_vif *vif, struct ieee80211_sta *sta)
++			 struct ieee80211_vif *vif,
++			 struct ieee80211_link_sta *link_sta,
++			 struct mt7996_link_sta *mlink)
  {
- 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
-@@ -1386,9 +1375,9 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
- 		he->he_phy_cap[i] = elem->phy_cap_info[i];
- 	}
- 
--	if (vif->type == NL80211_IFTYPE_AP &&
-+	if (conf->vif->type == NL80211_IFTYPE_AP &&
- 	    (elem->phy_cap_info[1] & IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
--		u8p_replace_bits(&he->he_phy_cap[1], vif->bss_conf.he_ldpc,
-+		u8p_replace_bits(&he->he_phy_cap[1], conf->he_ldpc,
- 				 IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD);
+-	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 	struct sta_rec_amsdu *amsdu;
+ 	struct tlv *tlv;
  
- 	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
-@@ -1396,16 +1385,16 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
- 	case IEEE80211_STA_RX_BW_160:
- 		if (elem->phy_cap_info[0] &
- 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
--			mt7996_mcu_set_sta_he_mcs(sta,
-+			mt7996_mcu_set_sta_he_mcs(sta, mconf,
- 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
- 						  le16_to_cpu(mcs_map.rx_mcs_80p80));
+@@ -1516,16 +1519,16 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 	    vif->type != NL80211_IFTYPE_AP)
+ 		return;
  
--		mt7996_mcu_set_sta_he_mcs(sta,
-+		mt7996_mcu_set_sta_he_mcs(sta, mconf,
- 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
- 					  le16_to_cpu(mcs_map.rx_mcs_160));
- 		fallthrough;
- 	default:
--		mt7996_mcu_set_sta_he_mcs(sta,
-+		mt7996_mcu_set_sta_he_mcs(sta, mconf,
- 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
- 					  le16_to_cpu(mcs_map.rx_mcs_80));
- 		break;
-@@ -1496,7 +1485,7 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
- 	struct tlv *tlv;
- #ifdef CONFIG_MTK_VENDOR
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
--	struct mt7996_phy *phy = (struct mt7996_phy *)msta->vif->phy;
-+	struct mt7996_phy *phy = (struct mt7996_phy *)msta->vif->deflink.phy;
- #endif
+-	if (!sta->deflink.agg.max_amsdu_len)
++	if (!link_sta->agg.max_amsdu_len)
+ 		return;
  
- 	/* For 6G band, this tlv is necessary to let hw work normally */
-@@ -1553,25 +1542,26 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
+ 	amsdu = (struct sta_rec_amsdu *)tlv;
+ 	amsdu->max_amsdu_num = 8;
+ 	amsdu->amsdu_en = true;
+-	msta->wcid.amsdu = true;
++	mlink->wcid.amsdu = true;
  
- static void
+-	switch (sta->deflink.agg.max_amsdu_len) {
++	switch (link_sta->agg.max_amsdu_len) {
+ 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
+ 		amsdu->max_mpdu_size =
+ 			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
+@@ -1544,10 +1547,10 @@ static void
  mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
--			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
-+			struct ieee80211_bss_conf *conf,
-+			struct mt7996_bss_conf *mconf,
-+			struct ieee80211_sta *sta)
+ 			struct ieee80211_bss_conf *conf,
+ 			struct mt7996_bss_conf *mconf,
+-			struct ieee80211_sta *sta)
++			struct ieee80211_link_sta *link_sta)
  {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct mt7996_phy *phy = mvif->phy;
-+	struct mt7996_phy *phy = mconf->phy;
- 	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
+ 	struct mt7996_phy *phy = mconf->phy;
+-	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
++	struct ieee80211_he_cap_elem *elem = &link_sta->he_cap.he_cap_elem;
  	struct sta_rec_muru *muru;
  	struct tlv *tlv;
  
--	if (vif->type != NL80211_IFTYPE_STATION &&
--	    vif->type != NL80211_IFTYPE_AP)
-+	if (conf->vif->type != NL80211_IFTYPE_STATION &&
-+	    conf->vif->type != NL80211_IFTYPE_AP)
- 		return;
+@@ -1567,11 +1570,11 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 	muru->cfg.ofdma_dl_en = !!(phy->muru_onoff & OFDMA_DL);
+ 	muru->cfg.ofdma_ul_en = !!(phy->muru_onoff & OFDMA_UL);
  
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
+-	if (sta->deflink.vht_cap.vht_supported)
++	if (link_sta->vht_cap.vht_supported)
+ 		muru->mimo_dl.vht_mu_bfee =
+-			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
++			!!(link_sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
  
- 	muru = (struct sta_rec_muru *)tlv;
--	muru->cfg.mimo_dl_en = (vif->bss_conf.eht_mu_beamformer ||
--				vif->bss_conf.he_mu_beamformer ||
--				vif->bss_conf.vht_mu_beamformer ||
--				vif->bss_conf.vht_mu_beamformee) &&
-+	muru->cfg.mimo_dl_en = (conf->eht_mu_beamformer ||
-+				conf->he_mu_beamformer ||
-+				conf->vht_mu_beamformer ||
-+				conf->vht_mu_beamformee) &&
- 			       !!(phy->muru_onoff & MUMIMO_DL);
- 	muru->cfg.mimo_ul_en = !!(phy->muru_onoff & MUMIMO_UL);
- 	muru->cfg.ofdma_dl_en = !!(phy->muru_onoff & OFDMA_DL);
-@@ -1612,13 +1602,14 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- }
+-	if (!sta->deflink.he_cap.has_he)
++	if (!link_sta->he_cap.has_he)
+ 		return;
  
+ 	muru->mimo_dl.partial_bw_dl_mimo =
+@@ -1604,7 +1607,7 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  static inline bool
--mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
-+mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
-+			struct mt7996_bss_conf *mconf,
- 			struct ieee80211_sta *sta, bool bfee)
+ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
+ 			struct mt7996_bss_conf *mconf,
+-			struct ieee80211_sta *sta, bool bfee)
++			struct ieee80211_link_sta *link_sta, bool bfee)
  {
  	int sts = hweight16(phy->mt76->chainmask);
  
--	if (vif->type != NL80211_IFTYPE_STATION &&
--	    vif->type != NL80211_IFTYPE_AP)
-+	if (conf->vif->type != NL80211_IFTYPE_STATION &&
-+	    conf->vif->type != NL80211_IFTYPE_AP)
+@@ -1615,8 +1618,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
+ 	if (!bfee && sts < 2)
  		return false;
  
- 	if (!bfee && sts < 2)
-@@ -1629,10 +1620,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+-	if (sta->deflink.eht_cap.has_eht) {
+-		struct ieee80211_sta_eht_cap *pc = &sta->deflink.eht_cap;
++	if (link_sta->eht_cap.has_eht) {
++		struct ieee80211_sta_eht_cap *pc = &link_sta->eht_cap;
  		struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
  
  		if (bfee)
--			return vif->bss_conf.eht_su_beamformee &&
-+			return conf->eht_su_beamformee &&
- 			       EHT_PHY(CAP0_SU_BEAMFORMEE, pe->phy_cap_info[0]);
- 		else
--			return vif->bss_conf.eht_su_beamformer &&
-+			return conf->eht_su_beamformer &&
+@@ -1627,8 +1630,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
  			       EHT_PHY(CAP0_SU_BEAMFORMER, pe->phy_cap_info[0]);
  	}
  
+-	if (sta->deflink.he_cap.has_he) {
+-		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
++	if (link_sta->he_cap.has_he) {
++		struct ieee80211_he_cap_elem *pe = &link_sta->he_cap.he_cap_elem;
+ 
+ 		if (bfee)
+ 			return conf->he_su_beamformee &&
+@@ -1638,8 +1641,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
+ 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
+ 	}
+ 
+-	if (sta->deflink.vht_cap.vht_supported) {
+-		u32 cap = sta->deflink.vht_cap.cap;
++	if (link_sta->vht_cap.vht_supported) {
++		u32 cap = link_sta->vht_cap.cap;
+ 
+ 		if (bfee)
+ 			return conf->vht_su_beamformee &&
+@@ -1662,10 +1665,10 @@ mt7996_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
+ }
+ 
+ static void
+-mt7996_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
+-		       struct sta_rec_bf *bf)
++mt7996_mcu_sta_bfer_ht(struct ieee80211_link_sta *link_sta,
++		       struct mt7996_phy *phy, struct sta_rec_bf *bf)
+ {
+-	struct ieee80211_mcs_info *mcs = &sta->deflink.ht_cap.mcs;
++	struct ieee80211_mcs_info *mcs = &link_sta->ht_cap.mcs;
+ 	u8 n = 0;
+ 
+ 	bf->tx_mode = MT_PHY_TYPE_HT;
+@@ -1687,10 +1690,11 @@ mt7996_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
+ }
+ 
+ static void
+-mt7996_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
+-			struct sta_rec_bf *bf, bool explicit)
++mt7996_mcu_sta_bfer_vht(struct ieee80211_link_sta *link_sta,
++			struct mt7996_phy *phy, struct sta_rec_bf *bf,
++			bool explicit)
+ {
+-	struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
++	struct ieee80211_sta_vht_cap *pc = &link_sta->vht_cap;
+ 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
+ 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
+ 	u8 nss_mcs = mt7996_mcu_get_sta_nss(mcs_map);
+@@ -1711,23 +1715,24 @@ mt7996_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
+ 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
+ 		bf->ibf_ncol = bf->ncol;
+ 
-@@ -1640,10 +1631,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
- 		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
+-		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
++		if (link_sta->bandwidth == IEEE80211_STA_RX_BW_160)
+ 			bf->nrow = 1;
+ 	} else {
+ 		bf->nrow = tx_ant;
+ 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
+ 		bf->ibf_ncol = nss_mcs;
  
- 		if (bfee)
--			return vif->bss_conf.he_su_beamformee &&
-+			return conf->he_su_beamformee &&
- 			       HE_PHY(CAP3_SU_BEAMFORMER, pe->phy_cap_info[3]);
- 		else
--			return vif->bss_conf.he_su_beamformer &&
-+			return conf->he_su_beamformer &&
- 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
+-		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
++		if (link_sta->bandwidth == IEEE80211_STA_RX_BW_160)
+ 			bf->ibf_nrow = 1;
  	}
+ }
  
-@@ -1651,10 +1642,10 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_vif *vif,
- 		u32 cap = sta->deflink.vht_cap.cap;
+ static void
+-mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+-		       struct mt7996_phy *phy, struct sta_rec_bf *bf)
++mt7996_mcu_sta_bfer_he(struct ieee80211_link_sta *link_sta,
++		       struct ieee80211_vif *vif, struct mt7996_phy *phy,
++		       struct sta_rec_bf *bf)
+ {
+-	struct ieee80211_sta_he_cap *pc = &sta->deflink.he_cap;
++	struct ieee80211_sta_he_cap *pc = &link_sta->he_cap;
+ 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
+ 	const struct ieee80211_sta_he_cap *vc =
+ 		mt76_connac_get_he_phy_cap(phy->mt76, vif);
+@@ -1752,7 +1757,7 @@ mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+ 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
+ 	bf->ibf_ncol = bf->ncol;
  
- 		if (bfee)
--			return vif->bss_conf.vht_su_beamformee &&
-+			return conf->vht_su_beamformee &&
- 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
- 		else
--			return vif->bss_conf.vht_su_beamformer &&
-+			return conf->vht_su_beamformer &&
- 			       (cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
- 	}
+-	if (sta->deflink.bandwidth != IEEE80211_STA_RX_BW_160)
++	if (link_sta->bandwidth != IEEE80211_STA_RX_BW_160)
+ 		return;
+ 
+ 	/* go over for 160MHz and 80p80 */
+@@ -1784,10 +1789,11 @@ mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+ }
+ 
+ static void
+-mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+-			struct mt7996_phy *phy, struct sta_rec_bf *bf)
++mt7996_mcu_sta_bfer_eht(struct ieee80211_link_sta *link_sta,
++			struct ieee80211_vif *vif, struct mt7996_phy *phy,
++			struct sta_rec_bf *bf)
+ {
+-	struct ieee80211_sta_eht_cap *pc = &sta->deflink.eht_cap;
++	struct ieee80211_sta_eht_cap *pc = &link_sta->eht_cap;
+ 	struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
+ 	struct ieee80211_eht_mcs_nss_supp *eht_nss = &pc->eht_mcs_nss_supp;
+ 	const struct ieee80211_sta_eht_cap *vc =
+@@ -1810,10 +1816,10 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+ 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
+ 	bf->ibf_ncol = bf->ncol;
  
-@@ -1850,10 +1841,10 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
+-	if (sta->deflink.bandwidth < IEEE80211_STA_RX_BW_160)
++	if (link_sta->bandwidth < IEEE80211_STA_RX_BW_160)
+ 		return;
  
+-	switch (sta->deflink.bandwidth) {
++	switch (link_sta->bandwidth) {
+ 	case IEEE80211_STA_RX_BW_160:
+ 		snd_dim = EHT_PHY(CAP2_SOUNDING_DIM_160MHZ_MASK, ve->phy_cap_info[2]);
+ 		sts = EHT_PHY(CAP1_BEAMFORMEE_SS_160MHZ_MASK, pe->phy_cap_info[1]);
+@@ -1842,7 +1848,7 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
  static void
  mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
--			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
-+			struct ieee80211_bss_conf *conf, struct mt7996_bss_conf *mconf,
-+			struct ieee80211_sta *sta)
+ 			struct ieee80211_bss_conf *conf, struct mt7996_bss_conf *mconf,
+-			struct ieee80211_sta *sta)
++			struct ieee80211_link_sta *link_sta)
  {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct mt7996_phy *phy = mvif->phy;
-+	struct mt7996_phy *phy = mconf->phy;
+ 	struct mt7996_phy *phy = mconf->phy;
  	int tx_ant = hweight16(phy->mt76->chainmask) - 1;
- 	struct sta_rec_bf *bf;
- 	struct tlv *tlv;
-@@ -1868,7 +1859,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- 	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
+@@ -1856,10 +1862,10 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 	};
+ 	bool ebf;
+ 
+-	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
++	if (!(link_sta->ht_cap.ht_supported || link_sta->he_cap.has_he))
  		return;
  
--	ebf = mt7996_is_ebf_supported(phy, vif, sta, false);
-+	ebf = mt7996_is_ebf_supported(phy, conf, mconf, sta, false);
+-	ebf = mt7996_is_ebf_supported(phy, conf, mconf, sta, false);
++	ebf = mt7996_is_ebf_supported(phy, conf, mconf, link_sta, false);
  	if (!ebf && !dev->ibf)
  		return;
  
-@@ -1880,9 +1871,9 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+@@ -1870,23 +1876,23 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 	 * vht: support eBF and iBF
  	 * ht: iBF only, since mac80211 lacks of eBF support
  	 */
- 	if (sta->deflink.eht_cap.has_eht && ebf)
--		mt7996_mcu_sta_bfer_eht(sta, vif, phy, bf);
-+		mt7996_mcu_sta_bfer_eht(sta, conf->vif, phy, bf);
- 	else if (sta->deflink.he_cap.has_he && ebf)
--		mt7996_mcu_sta_bfer_he(sta, vif, phy, bf);
-+		mt7996_mcu_sta_bfer_he(sta, conf->vif, phy, bf);
- 	else if (sta->deflink.vht_cap.vht_supported)
- 		mt7996_mcu_sta_bfer_vht(sta, phy, bf, ebf);
- 	else if (sta->deflink.ht_cap.ht_supported)
-@@ -1921,10 +1912,10 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+-	if (sta->deflink.eht_cap.has_eht && ebf)
+-		mt7996_mcu_sta_bfer_eht(sta, conf->vif, phy, bf);
+-	else if (sta->deflink.he_cap.has_he && ebf)
+-		mt7996_mcu_sta_bfer_he(sta, conf->vif, phy, bf);
+-	else if (sta->deflink.vht_cap.vht_supported)
+-		mt7996_mcu_sta_bfer_vht(sta, phy, bf, ebf);
+-	else if (sta->deflink.ht_cap.ht_supported)
+-		mt7996_mcu_sta_bfer_ht(sta, phy, bf);
++	if (link_sta->eht_cap.has_eht && ebf)
++		mt7996_mcu_sta_bfer_eht(link_sta, conf->vif, phy, bf);
++	else if (link_sta->he_cap.has_he && ebf)
++		mt7996_mcu_sta_bfer_he(link_sta, conf->vif, phy, bf);
++	else if (link_sta->vht_cap.vht_supported)
++		mt7996_mcu_sta_bfer_vht(link_sta, phy, bf, ebf);
++	else if (link_sta->ht_cap.ht_supported)
++		mt7996_mcu_sta_bfer_ht(link_sta, phy, bf);
+ 	else
+ 		return;
  
+ 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
+-	bf->bw = sta->deflink.bandwidth;
+-	bf->ibf_dbw = sta->deflink.bandwidth;
++	bf->bw = link_sta->bandwidth;
++	bf->ibf_dbw = link_sta->bandwidth;
+ 	bf->ibf_nrow = tx_ant;
+ 
+-	if (!ebf && sta->deflink.bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
++	if (!ebf && link_sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
+ 		bf->ibf_timeout = 0x48;
+ 	else
+ 		bf->ibf_timeout = 0x18;
+@@ -1896,7 +1902,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 	else
+ 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
+ 
+-	switch (sta->deflink.bandwidth) {
++	switch (link_sta->bandwidth) {
+ 	case IEEE80211_STA_RX_BW_160:
+ 	case IEEE80211_STA_RX_BW_80:
+ 		bf->mem_total = bf->mem_20m * 2;
+@@ -1913,7 +1919,8 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  static void
  mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
--			struct ieee80211_vif *vif, struct ieee80211_sta *sta)
-+			struct ieee80211_bss_conf *conf,
-+			struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta)
+ 			struct ieee80211_bss_conf *conf,
+-			struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta)
++			struct mt7996_bss_conf *mconf,
++			struct ieee80211_link_sta *link_sta)
  {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct mt7996_phy *phy = mvif->phy;
-+	struct mt7996_phy *phy = mconf->phy;
+ 	struct mt7996_phy *phy = mconf->phy;
  	int tx_ant = hweight8(phy->mt76->antenna_mask) - 1;
- 	struct sta_rec_bfee *bfee;
+@@ -1921,22 +1928,22 @@ mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
  	struct tlv *tlv;
-@@ -1933,7 +1924,7 @@ mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- 	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
+ 	u8 nrow = 0;
+ 
+-	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
++	if (!(link_sta->vht_cap.vht_supported || link_sta->he_cap.has_he))
  		return;
  
--	if (!mt7996_is_ebf_supported(phy, vif, sta, true))
-+	if (!mt7996_is_ebf_supported(phy, conf, mconf, sta, true))
+-	if (!mt7996_is_ebf_supported(phy, conf, mconf, sta, true))
++	if (!mt7996_is_ebf_supported(phy, conf, mconf, link_sta, true))
  		return;
  
  	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
-@@ -2055,17 +2046,17 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
- 				     MCU_WM_UNI_CMD(RA), true);
- }
+ 	bfee = (struct sta_rec_bfee *)tlv;
+ 
+-	if (sta->deflink.he_cap.has_he) {
+-		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
++	if (link_sta->he_cap.has_he) {
++		struct ieee80211_he_cap_elem *pe = &link_sta->he_cap.he_cap_elem;
  
--int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
-+			       struct mt7996_bss_conf *mconf,
- 			       struct ieee80211_sta *sta, void *data, u32 field)
+ 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
+ 			      pe->phy_cap_info[5]);
+-	} else if (sta->deflink.vht_cap.vht_supported) {
+-		struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
++	} else if (link_sta->vht_cap.vht_supported) {
++		struct ieee80211_sta_vht_cap *pc = &link_sta->vht_cap;
+ 
+ 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
+ 				 pc->cap);
+@@ -1973,25 +1980,24 @@ mt7996_mcu_sta_hdrt_tlv(struct mt7996_dev *dev, struct sk_buff *skb)
+ static void
+ mt7996_mcu_sta_hdr_trans_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
+ 			     struct ieee80211_vif *vif,
+-			     struct ieee80211_sta *sta)
++			     struct mt7996_link_sta *mlink)
  {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 	struct sta_rec_hdr_trans *hdr_trans;
+-	struct mt76_wcid *wcid;
++	struct mt76_wcid *wcid = &mlink->wcid;
+ 	struct tlv *tlv;
+ 
+ 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HDR_TRANS, sizeof(*hdr_trans));
+ 	hdr_trans = (struct sta_rec_hdr_trans *)tlv;
+ 	hdr_trans->dis_rx_hdr_tran = true;
+ 
++	if (!wcid->sta)
++		return;
++
+ 	if (vif->type == NL80211_IFTYPE_STATION)
+ 		hdr_trans->to_ds = true;
+ 	else
+ 		hdr_trans->from_ds = true;
+ 
+-	if (!sta)
+-		return;
+-
+-	wcid = (struct mt76_wcid *)sta->drv_priv;
+ 	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
+ 	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
+ 		hdr_trans->to_ds = true;
+@@ -2048,16 +2054,17 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
+ 
+ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
+ 			       struct mt7996_bss_conf *mconf,
+-			       struct ieee80211_sta *sta, void *data, u32 field)
++			       struct ieee80211_link_sta *link_sta,
++			       struct mt7996_link_sta *mlink, void *data,
++			       u32 field)
+ {
+-	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
  	struct sta_phy_uni *phy = data;
  	struct sta_rec_ra_fixed_uni *ra;
  	struct sk_buff *skb;
  	struct tlv *tlv;
  
--	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
-+	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
- 					      &msta->wcid,
+ 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
+-					      &msta->wcid,
++					      &mlink->wcid,
  					      MT7996_STA_UPDATE_MAX_SIZE);
  	if (IS_ERR(skb))
-@@ -2097,12 +2088,13 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif
- }
- 
- static int
--mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
-+			       struct ieee80211_bss_conf *conf,
-+			       struct mt7996_bss_conf *mconf,
- 			       struct ieee80211_sta *sta)
+ 		return PTR_ERR(skb);
+@@ -2076,7 +2083,7 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
+ 			ra->phy = *phy;
+ 		break;
+ 	case RATE_PARAM_MMPS_UPDATE:
+-		ra->mmps_mode = mt7996_mcu_get_mmps_mode(sta->deflink.smps_mode);
++		ra->mmps_mode = mt7996_mcu_get_mmps_mode(link_sta->smps_mode);
+ 		break;
+ 	default:
+ 		break;
+@@ -2091,7 +2098,8 @@ static int
+ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
+ 			       struct ieee80211_bss_conf *conf,
+ 			       struct mt7996_bss_conf *mconf,
+-			       struct ieee80211_sta *sta)
++			       struct ieee80211_link_sta *link_sta,
++			       struct mt7996_link_sta *mlink)
  {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
--	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
-+	struct cfg80211_chan_def *chandef = &mconf->phy->mt76->chandef;
-+	struct cfg80211_bitrate_mask *mask = &mconf->bitrate_mask;
- 	enum nl80211_band band = chandef->chan->band;
- 	struct sta_phy_uni phy = {};
- 	int ret, nrates = 0;
-@@ -2144,7 +2136,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
+ 	struct cfg80211_chan_def *chandef = &mconf->phy->mt76->chandef;
+ 	struct cfg80211_bitrate_mask *mask = &mconf->bitrate_mask;
+@@ -2115,11 +2123,11 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
+ 		}								\
+ 	} while (0)
+ 
+-	if (sta->deflink.he_cap.has_he) {
++	if (link_sta->he_cap.has_he) {
+ 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
+-	} else if (sta->deflink.vht_cap.vht_supported) {
++	} else if (link_sta->vht_cap.vht_supported) {
+ 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
+-	} else if (sta->deflink.ht_cap.ht_supported) {
++	} else if (link_sta->ht_cap.ht_supported) {
+ 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
+ 	} else {
+ 		nrates = hweight32(mask->control[band].legacy);
+@@ -2136,8 +2144,8 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
  
  	/* fixed single rate */
  	if (nrates == 1) {
--		ret = mt7996_mcu_set_fixed_field(dev, vif, sta, &phy,
-+		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
- 						 RATE_PARAM_FIXED_MCS);
+-		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
+-						 RATE_PARAM_FIXED_MCS);
++		ret = mt7996_mcu_set_fixed_field(dev, mconf, link_sta, mlink,
++						 &phy, RATE_PARAM_FIXED_MCS);
  		if (ret)
  			return ret;
-@@ -2166,7 +2158,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
+ 	}
+@@ -2145,29 +2153,28 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
+ 	/* fixed GI */
+ 	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
+ 	    mask->control[band].he_gi != GENMASK(7, 0)) {
+-		struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ 		u32 addr;
+ 
+ 		/* firmware updates only TXCMD but doesn't take WTBL into
+ 		 * account, so driver should update here to reflect the
+ 		 * actual txrate hardware sends out.
+ 		 */
+-		addr = mt7996_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
+-		if (sta->deflink.he_cap.has_he)
++		addr = mt7996_mac_wtbl_lmac_addr(dev, mlink->wcid.idx, 7);
++		if (link_sta->he_cap.has_he)
+ 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
  		else
  			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
  
--		ret = mt7996_mcu_set_fixed_field(dev, vif, sta, &phy,
-+		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
- 						 RATE_PARAM_FIXED_GI);
+-		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
+-						 RATE_PARAM_FIXED_GI);
++		ret = mt7996_mcu_set_fixed_field(dev, mconf, link_sta, mlink,
++						 &phy, RATE_PARAM_FIXED_GI);
  		if (ret)
  			return ret;
-@@ -2174,7 +2166,7 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
+ 	}
  
  	/* fixed HE_LTF */
  	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
--		ret = mt7996_mcu_set_fixed_field(dev, vif, sta, &phy,
-+		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
- 						 RATE_PARAM_FIXED_HE_LTF);
+-		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
+-						 RATE_PARAM_FIXED_HE_LTF);
++		ret = mt7996_mcu_set_fixed_field(dev, mconf, link_sta, mlink,
++						 &phy, RATE_PARAM_FIXED_HE_LTF);
  		if (ret)
  			return ret;
-@@ -2185,13 +2177,14 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct ieee80211_vif *vif
- 
- static void
+ 	}
+@@ -2179,7 +2186,7 @@ static void
  mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
--			     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
-+			     struct ieee80211_bss_conf *conf,
-+			     struct mt7996_bss_conf *mconf,
-+			     struct ieee80211_sta *sta)
+ 			     struct ieee80211_bss_conf *conf,
+ 			     struct mt7996_bss_conf *mconf,
+-			     struct ieee80211_sta *sta)
++			     struct ieee80211_link_sta *link_sta)
  {
  #define INIT_RCPI 180
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct mt76_phy *mphy = mvif->phy->mt76;
-+	struct mt76_phy *mphy = mconf->phy->mt76;
- 	struct cfg80211_chan_def *chandef = &mphy->chandef;
--	struct cfg80211_bitrate_mask *mask = &mvif->bitrate_mask;
-+	struct cfg80211_bitrate_mask *mask = &mconf->bitrate_mask;
+ 	struct mt76_phy *mphy = mconf->phy->mt76;
+@@ -2188,20 +2195,20 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
  	enum nl80211_band band = chandef->chan->band;
  	struct sta_rec_ra_uni *ra;
  	struct tlv *tlv;
-@@ -2203,7 +2196,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+-	u32 supp_rate = sta->deflink.supp_rates[band];
+-	u32 cap = sta->wme ? STA_CAP_WMM : 0;
++	u32 supp_rate = link_sta->supp_rates[band];
++	u32 cap = link_sta->sta->wme ? STA_CAP_WMM : 0;
+ 
+ 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
+ 	ra = (struct sta_rec_ra_uni *)tlv;
  
  	ra->valid = true;
  	ra->auto_rate = true;
--	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
-+	ra->phy_mode = mt76_connac_get_phy_mode(mphy, conf->vif, band, sta);
+-	ra->phy_mode = mt76_connac_get_phy_mode(mphy, conf->vif, band, sta);
++	ra->phy_mode = mt76_connac_get_phy_mode(mphy, conf->vif, band, link_sta);
  	ra->channel = chandef->chan->hw_value;
- 	ra->bw = (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_320) ?
- 		 CMD_CBW_320MHZ : sta->deflink.bandwidth;
-@@ -2242,7 +2235,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+-	ra->bw = (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_320) ?
+-		 CMD_CBW_320MHZ : sta->deflink.bandwidth;
++	ra->bw = (link_sta->bandwidth == IEEE80211_STA_RX_BW_320) ?
++		 CMD_CBW_320MHZ : link_sta->bandwidth;
+ 	ra->phy.bw = ra->bw;
+-	ra->mmps_mode = mt7996_mcu_get_mmps_mode(sta->deflink.smps_mode);
++	ra->mmps_mode = mt7996_mcu_get_mmps_mode(link_sta->smps_mode);
+ 
+ 	if (supp_rate) {
+ 		supp_rate &= mask->control[band].legacy;
+@@ -2221,60 +2228,60 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+ 		}
+ 	}
+ 
+-	if (sta->deflink.ht_cap.ht_supported) {
++	if (link_sta->ht_cap.ht_supported) {
+ 		ra->supp_mode |= MODE_HT;
+-		ra->af = sta->deflink.ht_cap.ampdu_factor;
+-		ra->ht_gf = !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
++		ra->af = link_sta->ht_cap.ampdu_factor;
++		ra->ht_gf = !!(link_sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
+ 
+ 		cap |= STA_CAP_HT;
+-		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
++		if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
+ 			cap |= STA_CAP_SGI_20;
+-		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
++		if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
+ 			cap |= STA_CAP_SGI_40;
+-		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
++		if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
  			cap |= STA_CAP_TX_STBC;
- 		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
+-		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
++		if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
  			cap |= STA_CAP_RX_STBC;
--		if (vif->bss_conf.ht_ldpc &&
-+		if (conf->ht_ldpc &&
- 		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
+ 		if (conf->ht_ldpc &&
+-		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
++		    (link_sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
  			cap |= STA_CAP_LDPC;
  
+-		mt7996_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
++		mt7996_mcu_set_sta_ht_mcs(link_sta, ra->ht_mcs,
+ 					  mask->control[band].ht_mcs);
+ 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
+ 	}
+ 
-@@ -2268,7 +2261,7 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+-	if (sta->deflink.vht_cap.vht_supported) {
++	if (link_sta->vht_cap.vht_supported) {
+ 		u8 af;
+ 
+ 		ra->supp_mode |= MODE_VHT;
+ 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
+-			       sta->deflink.vht_cap.cap);
++			       link_sta->vht_cap.cap);
+ 		ra->af = max_t(u8, ra->af, af);
+ 
+ 		cap |= STA_CAP_VHT;
+-		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
++		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
+ 			cap |= STA_CAP_VHT_SGI_80;
+-		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
++		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
+ 			cap |= STA_CAP_VHT_SGI_160;
+-		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
++		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
  			cap |= STA_CAP_VHT_TX_STBC;
- 		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
+-		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
++		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
  			cap |= STA_CAP_VHT_RX_STBC;
--		if (vif->bss_conf.vht_ldpc &&
-+		if (conf->vht_ldpc &&
- 		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
+ 		if (conf->vht_ldpc &&
+-		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
++		    (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
  			cap |= STA_CAP_VHT_LDPC;
  
-@@ -2289,15 +2282,16 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
- 	memset(ra->rx_rcpi, INIT_RCPI, sizeof(ra->rx_rcpi));
- }
+-		mt7996_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
++		mt7996_mcu_set_sta_vht_mcs(link_sta, ra->supp_vht_mcs,
+ 					   mask->control[band].vht_mcs);
+ 	}
  
--int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
-+			     struct ieee80211_bss_conf *conf,
-+			     struct mt7996_bss_conf *mconf,
- 			     struct ieee80211_sta *sta, bool changed)
+-	if (sta->deflink.he_cap.has_he) {
++	if (link_sta->he_cap.has_he) {
+ 		ra->supp_mode |= MODE_HE;
+ 		cap |= STA_CAP_HE;
+ 
+-		if (sta->deflink.he_6ghz_capa.capa)
+-			ra->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
++		if (link_sta->he_6ghz_capa.capa)
++			ra->af = le16_get_bits(link_sta->he_6ghz_capa.capa,
+ 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
+ 	}
+ 	ra->sta_cap = cpu_to_le32(cap);
+@@ -2285,14 +2292,14 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
+ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+ 			     struct ieee80211_bss_conf *conf,
+ 			     struct mt7996_bss_conf *mconf,
+-			     struct ieee80211_sta *sta, bool changed)
++			     struct ieee80211_link_sta *link_sta,
++			     struct mt7996_link_sta *mlink, bool changed)
  {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+-	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
  	struct sk_buff *skb;
  	int ret;
  
--	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
-+	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
- 					      &msta->wcid,
+ 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
+-					      &msta->wcid,
++					      &mlink->wcid,
  					      MT7996_STA_UPDATE_MAX_SIZE);
  	if (IS_ERR(skb))
-@@ -2308,26 +2302,27 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ 		return PTR_ERR(skb);
+@@ -2302,26 +2309,27 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
  	 * update sta_rec_he here.
  	 */
  	if (changed)
--		mt7996_mcu_sta_he_tlv(skb, vif, sta);
-+		mt7996_mcu_sta_he_tlv(skb, conf, mconf, sta);
+-		mt7996_mcu_sta_he_tlv(skb, conf, mconf, sta);
++		mt7996_mcu_sta_he_tlv(skb, conf, mconf, link_sta);
  
  	/* sta_rec_ra accommodates BW, NSS and only MCS range format
  	 * i.e 0-{7,8,9} for VHT.
  	 */
--	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, vif, sta);
-+	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, conf, mconf, sta);
+-	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, conf, mconf, sta);
++	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, conf, mconf, link_sta);
  
  	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
  				    MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
  	if (ret)
  		return ret;
  
--	return mt7996_mcu_add_rate_ctrl_fixed(dev, vif, sta);
-+	return mt7996_mcu_add_rate_ctrl_fixed(dev, conf, mconf, sta);
+-	return mt7996_mcu_add_rate_ctrl_fixed(dev, conf, mconf, sta);
++	return mt7996_mcu_add_rate_ctrl_fixed(dev, conf, mconf, link_sta, mlink);
  }
  
  static int
--mt7996_mcu_sta_init_vow(struct mt7996_phy *phy, struct mt7996_sta *msta)
-+mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf, struct mt7996_sta *msta)
+-mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf, struct mt7996_sta *msta)
++mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf,
++			struct mt7996_link_sta *mlink)
  {
-+	struct mt7996_phy *phy = mconf->phy;
- 	struct mt7996_vow_sta_ctrl *vow = &msta->vow;
--	u8 omac_idx = msta->vif->mt76.omac_idx;
-+	u8 omac_idx = mconf->mt76.omac_idx;
+ 	struct mt7996_phy *phy = mconf->phy;
+-	struct mt7996_vow_sta_ctrl *vow = &msta->vow;
++	struct mt7996_vow_sta_ctrl *vow = &mlink->vow;
+ 	u8 omac_idx = mconf->mt76.omac_idx;
  	int ret;
  
- 	/* Assignment of STA BSS group index aligns FW.
-@@ -2344,20 +2339,22 @@ mt7996_mcu_sta_init_vow(struct mt7996_phy *phy, struct mt7996_sta *msta)
+@@ -2339,73 +2347,70 @@ mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf, struct mt7996_sta *msta)
  	vow->drr_quantum[IEEE80211_AC_BE] = VOW_DRR_QUANTUM_IDX2;
  	vow->drr_quantum[IEEE80211_AC_BK] = VOW_DRR_QUANTUM_IDX2;
  
--	ret = mt7996_mcu_set_vow_drr_ctrl(phy, msta, VOW_DRR_CTRL_STA_BSS_GROUP);
-+	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_BSS_GROUP);
+-	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_BSS_GROUP);
++	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, mlink, VOW_DRR_CTRL_STA_BSS_GROUP);
  	if (ret)
  		return ret;
  
--	ret = mt7996_mcu_set_vow_drr_ctrl(phy, msta, VOW_DRR_CTRL_STA_PAUSE);
-+	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_PAUSE);
+-	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_PAUSE);
++	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, mlink, VOW_DRR_CTRL_STA_PAUSE);
  	if (ret)
  		return ret;
  
--	return mt7996_mcu_set_vow_drr_ctrl(phy, msta, VOW_DRR_CTRL_STA_ALL);
-+	return mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_ALL);
+-	return mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_ALL);
++	return mt7996_mcu_set_vow_drr_ctrl(phy, mconf, mlink, VOW_DRR_CTRL_STA_ALL);
  }
  
--int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
--		       struct ieee80211_sta *sta, bool enable, bool newly)
-+int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
-+		       struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta,
-+		       bool enable, bool newly)
+ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+-		       struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta,
+-		       bool enable, bool newly)
++		       struct mt7996_bss_conf *mconf,
++		       struct ieee80211_link_sta *link_sta,
++		       struct mt7996_link_sta *mlink, bool enable, bool newly)
  {
-+	struct ieee80211_vif *vif = conf->vif;
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_sta *msta;
+ 	struct ieee80211_vif *vif = conf->vif;
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+-	struct mt7996_sta *msta;
  	struct sk_buff *skb;
-@@ -2365,7 +2362,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
- 
- 	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mvif->sta;
+ 	int ret;
  
--	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
-+	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
- 					      &msta->wcid,
+-	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mvif->sta;
+-
+ 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
+-					      &msta->wcid,
++					      &mlink->wcid,
  					      MT7996_STA_UPDATE_MAX_SIZE);
  	if (IS_ERR(skb))
-@@ -2387,7 +2384,7 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ 		return PTR_ERR(skb);
+ 
+ 	/* starec basic */
+-	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, sta, enable, newly);
++	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, link_sta, enable, newly);
+ 
+ 	if (!enable)
+ 		goto out;
+ 
+ 	/* starec hdr trans */
+-	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, sta);
++	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, mlink);
+ 	/* starec tx proc */
+ 	mt7996_mcu_sta_tx_proc_tlv(skb);
+ 
+ 	/* tag order is in accordance with firmware dependency. */
+-	if (sta) {
++	if (link_sta) {
  		/* starec hdrt mode */
  		mt7996_mcu_sta_hdrt_tlv(dev, skb);
  		/* starec bfer */
--		mt7996_mcu_sta_bfer_tlv(dev, skb, vif, sta);
-+		mt7996_mcu_sta_bfer_tlv(dev, skb, conf, mconf, sta);
+-		mt7996_mcu_sta_bfer_tlv(dev, skb, conf, mconf, sta);
++		mt7996_mcu_sta_bfer_tlv(dev, skb, conf, mconf, link_sta);
  		/* starec ht */
- 		mt7996_mcu_sta_ht_tlv(skb, sta);
+-		mt7996_mcu_sta_ht_tlv(skb, sta);
++		mt7996_mcu_sta_ht_tlv(skb, link_sta);
  		/* starec vht */
-@@ -2397,18 +2394,18 @@ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+-		mt7996_mcu_sta_vht_tlv(skb, sta);
++		mt7996_mcu_sta_vht_tlv(skb, link_sta);
+ 		/* starec uapsd */
+-		mt76_connac_mcu_sta_uapsd(skb, vif, sta);
++		mt76_connac_mcu_sta_uapsd(skb, vif, link_sta->sta);
  		/* starec amsdu */
- 		mt7996_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
+-		mt7996_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
++		mt7996_mcu_sta_amsdu_tlv(dev, skb, vif, link_sta, mlink);
  		/* starec he */
--		mt7996_mcu_sta_he_tlv(skb, vif, sta);
-+		mt7996_mcu_sta_he_tlv(skb, conf, mconf, sta);
+-		mt7996_mcu_sta_he_tlv(skb, conf, mconf, sta);
++		mt7996_mcu_sta_he_tlv(skb, conf, mconf, link_sta);
  		/* starec he 6g*/
- 		mt7996_mcu_sta_he_6g_tlv(skb, sta);
+-		mt7996_mcu_sta_he_6g_tlv(skb, sta);
++		mt7996_mcu_sta_he_6g_tlv(skb, link_sta);
  		/* starec eht */
- 		mt7996_mcu_sta_eht_tlv(skb, sta);
+-		mt7996_mcu_sta_eht_tlv(skb, sta);
++		mt7996_mcu_sta_eht_tlv(skb, link_sta);
  		/* starec muru */
--		mt7996_mcu_sta_muru_tlv(dev, skb, vif, sta);
-+		mt7996_mcu_sta_muru_tlv(dev, skb, conf, mconf, sta);
+-		mt7996_mcu_sta_muru_tlv(dev, skb, conf, mconf, sta);
++		mt7996_mcu_sta_muru_tlv(dev, skb, conf, mconf, link_sta);
  		/* starec bfee */
--		mt7996_mcu_sta_bfee_tlv(dev, skb, vif, sta);
-+		mt7996_mcu_sta_bfee_tlv(dev, skb, conf, mconf, sta);
+-		mt7996_mcu_sta_bfee_tlv(dev, skb, conf, mconf, sta);
++		mt7996_mcu_sta_bfee_tlv(dev, skb, conf, mconf, link_sta);
  	}
  
--	ret = mt7996_mcu_sta_init_vow(mvif->phy, msta);
-+	ret = mt7996_mcu_sta_init_vow(mconf, msta);
+-	ret = mt7996_mcu_sta_init_vow(mconf, msta);
++	ret = mt7996_mcu_sta_init_vow(mconf, mlink);
  	if (ret) {
  		dev_kfree_skb(skb);
  		return ret;
-@@ -2463,16 +2460,15 @@ mt7996_mcu_sta_key_tlv(struct mt76_wcid *wcid,
- 	return 0;
- }
- 
--int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
-+int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
- 		       struct ieee80211_key_conf *key, int mcu_cmd,
- 		       struct mt76_wcid *wcid, enum set_key_cmd cmd)
- {
--	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
- 	struct sk_buff *skb;
- 	int ret;
- 
--	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid,
--					      MT7996_STA_UPDATE_MAX_SIZE);
-+	skb = __mt76_connac_mcu_alloc_sta_req(dev, (struct mt76_vif *)mconf,
-+					      wcid, MT7996_STA_UPDATE_MAX_SIZE);
- 	if (IS_ERR(skb))
- 		return PTR_ERR(skb);
+@@ -2481,16 +2486,16 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
  
-@@ -2483,17 +2479,18 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
- 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
- }
- 
--static int mt7996_mcu_get_pn(struct mt7996_dev *dev, struct ieee80211_vif *vif,
--			     u8 *pn)
-+static int mt7996_mcu_get_pn(struct mt7996_dev *dev,
-+			     struct ieee80211_bss_conf *conf,
-+			     struct mt7996_bss_conf *mconf, u8 *pn)
+ static int mt7996_mcu_get_pn(struct mt7996_dev *dev,
+ 			     struct ieee80211_bss_conf *conf,
+-			     struct mt7996_bss_conf *mconf, u8 *pn)
++			     struct mt7996_bss_conf *mconf,
++			     struct mt7996_link_sta *mlink, u8 *pn)
  {
  #define TSC_TYPE_BIGTK_PN 2
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)conf->vif->drv_priv;
+-	struct mt7996_vif *mvif = (struct mt7996_vif *)conf->vif->drv_priv;
  	struct sta_rec_pn_info *pn_info;
  	struct sk_buff *skb, *rskb;
  	struct tlv *tlv;
  	int ret;
  
--	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76, &mvif->sta.wcid);
-+	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76, &mvif->sta.wcid);
+-	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76, &mvif->sta.wcid);
++	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76, &mlink->wcid);
  	if (IS_ERR(skb))
  		return PTR_ERR(skb);
  
-@@ -2517,10 +2514,11 @@ static int mt7996_mcu_get_pn(struct mt7996_dev *dev, struct ieee80211_vif *vif,
- 	return 0;
- }
- 
--int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
-+			       struct ieee80211_bss_conf *conf,
-+			       struct mt7996_bss_conf *mconf,
+@@ -2517,6 +2522,7 @@ static int mt7996_mcu_get_pn(struct mt7996_dev *dev,
+ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
+ 			       struct ieee80211_bss_conf *conf,
+ 			       struct mt7996_bss_conf *mconf,
++			       struct mt7996_link_sta *mlink,
  			       struct ieee80211_key_conf *key)
  {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
  	struct mt7996_mcu_bcn_prot_tlv *bcn_prot;
- 	struct sk_buff *skb;
- 	struct tlv *tlv;
-@@ -2529,7 +2527,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
- 		  sizeof(struct mt7996_mcu_bcn_prot_tlv);
- 	int ret;
- 
--	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76, len);
-+	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76, len);
- 	if (IS_ERR(skb))
- 		return PTR_ERR(skb);
- 
-@@ -2537,7 +2535,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
+@@ -2535,7 +2541,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
  
  	bcn_prot = (struct mt7996_mcu_bcn_prot_tlv *)tlv;
  
--	ret = mt7996_mcu_get_pn(dev, vif, pn);
-+	ret = mt7996_mcu_get_pn(dev, conf, mconf, pn);
+-	ret = mt7996_mcu_get_pn(dev, conf, mconf, pn);
++	ret = mt7996_mcu_get_pn(dev, conf, mconf, mlink, pn);
  	if (ret) {
  		dev_kfree_skb(skb);
  		return ret;
-@@ -2570,10 +2568,10 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif
- 				     MCU_WMWA_UNI_CMD(BSS_INFO_UPDATE), true);
- }
- int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
--			    struct ieee80211_vif *vif, bool enable)
-+			    struct ieee80211_bss_conf *conf,
-+			    struct mt7996_bss_conf *mconf, bool enable)
- {
- 	struct mt7996_dev *dev = phy->dev;
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct {
- 		struct req_hdr {
- 			u8 omac_idx;
-@@ -2589,8 +2587,8 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
- 		} __packed tlv;
- 	} data = {
- 		.hdr = {
--			.omac_idx = mvif->mt76.omac_idx,
--			.band_idx = mvif->mt76.band_idx,
-+			.omac_idx = mconf->mt76.omac_idx,
-+			.band_idx = mconf->mt76.band_idx,
- 		},
- 		.tlv = {
- 			.tag = cpu_to_le16(DEV_INFO_ACTIVE),
-@@ -2599,16 +2597,16 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
- 		},
- 	};
- 
--	if (mvif->mt76.omac_idx >= REPEATER_BSSID_START)
--		return mt7996_mcu_muar_config(phy, vif, false, enable);
-+	if (mconf->mt76.omac_idx >= REPEATER_BSSID_START)
-+		return mt7996_mcu_muar_config(phy, conf, mconf, false, enable);
- 
--	memcpy(data.tlv.omac_addr, vif->addr, ETH_ALEN);
-+	memcpy(data.tlv.omac_addr, conf->addr, ETH_ALEN);
- 	return mt76_mcu_send_msg(&dev->mt76, MCU_WMWA_UNI_CMD(DEV_INFO_UPDATE),
- 				 &data, sizeof(data), true);
- }
- 
- static void
--mt7996_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
-+mt7996_mcu_beacon_cntdwn(struct ieee80211_bss_conf *conf, struct sk_buff *rskb,
- 			 struct sk_buff *skb,
- 			 struct ieee80211_mutable_offsets *offs)
- {
-@@ -2619,7 +2617,7 @@ mt7996_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
- 	if (!offs->cntdwn_counter_offs[0])
- 		return;
- 
--	tag = vif->bss_conf.csa_active ? UNI_BSS_INFO_BCN_CSA : UNI_BSS_INFO_BCN_BCC;
-+	tag = conf->csa_active ? UNI_BSS_INFO_BCN_CSA : UNI_BSS_INFO_BCN_BCC;
- 
- 	tlv = mt7996_mcu_add_uni_tlv(rskb, tag, sizeof(*info));
- 
-@@ -2629,14 +2627,15 @@ mt7996_mcu_beacon_cntdwn(struct ieee80211_vif *vif, struct sk_buff *rskb,
- 
- static void
- mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
--		       struct ieee80211_vif *vif, struct bss_bcn_content_tlv *bcn,
-+		       struct ieee80211_bss_conf *conf,
-+		       struct bss_bcn_content_tlv *bcn,
- 		       struct ieee80211_mutable_offsets *offs)
- {
- 	struct bss_bcn_mbss_tlv *mbss;
- 	const struct element *elem;
- 	struct tlv *tlv;
- 
--	if (!vif->bss_conf.bssid_indicator)
-+	if (!conf->bssid_indicator)
- 		return;
- 
- 	tlv = mt7996_mcu_add_uni_tlv(rskb, UNI_BSS_INFO_BCN_MBSSID, sizeof(*mbss));
-@@ -2681,7 +2680,7 @@ mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
- }
- 
- static void
--mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
- 		       struct sk_buff *rskb, struct sk_buff *skb,
- 		       struct bss_bcn_content_tlv *bcn,
- 		       struct ieee80211_mutable_offsets *offs)
-@@ -2695,9 +2694,9 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
- 	if (offs->cntdwn_counter_offs[0]) {
- 		u16 offset = offs->cntdwn_counter_offs[0];
- 
--		if (vif->bss_conf.csa_active)
-+		if (conf->csa_active)
- 			bcn->csa_ie_pos = cpu_to_le16(offset - 4);
--		if (vif->bss_conf.color_change_active)
-+		if (conf->color_change_active)
- 			bcn->bcc_ie_pos = cpu_to_le16(offset - 3);
- 	}
- 
-@@ -2709,11 +2708,11 @@ mt7996_mcu_beacon_cont(struct mt7996_dev *dev, struct ieee80211_vif *vif,
- }
- 
- int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
--			  struct ieee80211_vif *vif, int en)
-+			  struct ieee80211_bss_conf *conf,
-+			  struct mt7996_bss_conf *mconf, int en)
- {
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct ieee80211_mutable_offsets offs;
- 	struct ieee80211_tx_info *info;
- 	struct sk_buff *skb, *rskb;
-@@ -2721,15 +2720,15 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
- 	struct bss_bcn_content_tlv *bcn;
- 	int len;
- 
--	if (vif->bss_conf.nontransmitted)
-+	if (conf->nontransmitted)
- 		return 0;
- 
--	rskb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76,
-+	rskb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
- 					  MT7996_MAX_BSS_OFFLOAD_SIZE);
- 	if (IS_ERR(rskb))
- 		return PTR_ERR(rskb);
- 
--	skb = ieee80211_beacon_get_template(hw, vif, &offs, 0);
-+	skb = ieee80211_beacon_get_template(hw, conf->vif, &offs, 0);
- 	if (!skb) {
- 		dev_kfree_skb(rskb);
- 		return -EINVAL;
-@@ -2752,9 +2751,9 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
- 	if (!en)
- 		goto out;
- 
--	mt7996_mcu_beacon_cont(dev, vif, rskb, skb, bcn, &offs);
--	mt7996_mcu_beacon_mbss(rskb, skb, vif, bcn, &offs);
--	mt7996_mcu_beacon_cntdwn(vif, rskb, skb, &offs);
-+	mt7996_mcu_beacon_cont(dev, conf, rskb, skb, bcn, &offs);
-+	mt7996_mcu_beacon_mbss(rskb, skb, conf, bcn, &offs);
-+	mt7996_mcu_beacon_cntdwn(conf, rskb, skb, &offs);
- out:
- 	dev_kfree_skb(skb);
- 	return mt76_mcu_skb_send_msg(&phy->dev->mt76, rskb,
-@@ -2762,14 +2761,15 @@ out:
- }
- 
- int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
--				    struct ieee80211_vif *vif, u32 changed)
-+				    struct ieee80211_bss_conf *conf,
-+				    struct mt7996_bss_conf *mconf, u32 changed)
- {
- #define OFFLOAD_TX_MODE_SU	BIT(0)
- #define OFFLOAD_TX_MODE_MU	BIT(1)
- 	struct ieee80211_hw *hw = mt76_hw(dev);
-+	struct ieee80211_vif *vif = conf->vif;
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct cfg80211_chan_def *chandef = &mvif->phy->mt76->chandef;
-+	struct cfg80211_chan_def *chandef = &mconf->phy->mt76->chandef;
- 	enum nl80211_band band = chandef->chan->band;
- 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
- 	struct bss_inband_discovery_tlv *discov;
-@@ -2779,20 +2779,20 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
- 	u8 *buf, interval;
- 	int len;
- 
--	if (vif->bss_conf.nontransmitted)
-+	if (conf->nontransmitted)
- 		return 0;
- 
--	rskb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76,
-+	rskb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76,
- 					  MT7996_MAX_BSS_OFFLOAD_SIZE);
- 	if (IS_ERR(rskb))
- 		return PTR_ERR(rskb);
- 
- 	if (changed & BSS_CHANGED_FILS_DISCOVERY) {
--		interval = vif->bss_conf.fils_discovery.max_interval;
-+		interval = conf->fils_discovery.max_interval;
- 		skb = ieee80211_get_fils_discovery_tmpl(hw, vif);
- 	} else if (changed & BSS_CHANGED_UNSOL_BCAST_PROBE_RESP &&
--		   vif->bss_conf.unsol_bcast_probe_resp_interval) {
--		interval = vif->bss_conf.unsol_bcast_probe_resp_interval;
-+		   conf->unsol_bcast_probe_resp_interval) {
-+		interval = conf->unsol_bcast_probe_resp_interval;
- 		skb = ieee80211_get_unsol_bcast_probe_resp_tmpl(hw, vif);
- 	}
- 
-@@ -3456,7 +3456,7 @@ int mt7996_mcu_set_hdr_trans(struct mt7996_dev *dev, bool hdr_trans)
- 				     MCU_WM_UNI_CMD(RX_HDR_TRANS), true);
- }
- 
--int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
-+int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct mt7996_bss_conf *mconf)
+@@ -4811,21 +4817,18 @@ int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev, bool disable
+ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
+ 				     struct ieee80211_vif *vif,
+ 				     struct mt7996_bss_conf *mconf,
+-				     struct ieee80211_sta *sta)
++				     struct mt7996_link_sta *mlink)
  {
- #define MCU_EDCA_AC_PARAM	0
- #define WMM_AIFS_SET		BIT(0)
-@@ -3465,12 +3465,11 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
- #define WMM_TXOP_SET		BIT(3)
- #define WMM_PARAM_SET		(WMM_AIFS_SET | WMM_CW_MIN_SET | \
- 				 WMM_CW_MAX_SET | WMM_TXOP_SET)
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct {
- 		u8 bss_idx;
- 		u8 __rsv[3];
- 	} __packed hdr = {
--		.bss_idx = mvif->mt76.idx,
-+		.bss_idx = mconf->mt76.idx,
- 	};
+-	struct mt7996_sta *msta;
  	struct sk_buff *skb;
- 	int len = sizeof(hdr) + IEEE80211_NUM_ACS * sizeof(struct edca);
-@@ -3483,7 +3482,7 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif)
- 	skb_put_data(skb, &hdr, sizeof(hdr));
- 
- 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
--		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
-+		struct ieee80211_tx_queue_params *q = &mconf->queue_params[ac];
- 		struct edca *e;
- 		struct tlv *tlv;
- 
-@@ -4496,12 +4495,12 @@ mt7996_mcu_set_obss_spr_pd(struct mt7996_phy *phy,
- }
- 
- static int
--mt7996_mcu_set_obss_spr_siga(struct mt7996_phy *phy, struct ieee80211_vif *vif,
-+mt7996_mcu_set_obss_spr_siga(struct mt7996_phy *phy,
-+			     struct mt7996_bss_conf *mconf,
- 			     struct ieee80211_he_obss_pd *he_obss_pd)
- {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_dev *dev = phy->dev;
--	u8 omac = mvif->mt76.omac_idx;
-+	u8 omac = mconf->mt76.omac_idx;
- 	struct {
- 		u8 band_idx;
- 		u8 __rsv[3];
-@@ -4573,7 +4572,8 @@ mt7996_mcu_set_obss_spr_bitmap(struct mt7996_phy *phy,
- 				 sizeof(req), true);
- }
- 
--int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
-+int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy,
-+			    struct mt7996_bss_conf *mconf,
- 			    struct ieee80211_he_obss_pd *he_obss_pd)
- {
- 	int ret;
-@@ -4607,7 +4607,7 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
- 		return ret;
  
- 	/* Set SR prohibit */
--	ret = mt7996_mcu_set_obss_spr_siga(phy, vif, he_obss_pd);
-+	ret = mt7996_mcu_set_obss_spr_siga(phy, mconf, he_obss_pd);
- 	if (ret)
- 		return ret;
+-	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mconf->vif->sta;
+-
+ 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
+-					      &msta->wcid,
++					      &mlink->wcid,
+ 					      MT7996_STA_UPDATE_MAX_SIZE);
+ 	if (IS_ERR(skb))
+ 		return PTR_ERR(skb);
  
-@@ -4615,16 +4615,16 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
- 	return mt7996_mcu_set_obss_spr_bitmap(phy, he_obss_pd);
+ 	/* starec hdr trans */
+-	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, sta);
++	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, mlink);
+ 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
+ 				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
  }
+@@ -5014,7 +5017,7 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
+ 	switch (tag) {
+ 	case UNI_PER_STA_RSSI:
+ 		for (i = 0; i < sta_num; ++i) {
+-			struct mt7996_sta *msta;
++			struct mt7996_link_sta *mlink;
+ 			struct mt76_phy *phy;
+ 			s8 rssi[4];
+ 			u8 *rcpi;
+@@ -5028,10 +5031,10 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
+ 				rssi[2] = to_rssi(MT_PRXV_RCPI0, rcpi[2]);
+ 				rssi[3] = to_rssi(MT_PRXV_RCPI0, rcpi[3]);
  
--int mt7996_mcu_update_bss_color(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+int mt7996_mcu_update_bss_color(struct mt7996_dev *dev,
-+				struct mt7996_bss_conf *mconf,
- 				struct cfg80211_he_bss_color *he_bss_color)
+-				msta = container_of(wcid, struct mt7996_sta, wcid);
+-				phy = msta->vif->phy->mt76;
+-				msta->ack_signal = mt76_rx_signal(phy->antenna_mask, rssi);
+-				ewma_avg_signal_add(&msta->avg_ack_signal, -msta->ack_signal);
++				mlink = container_of(wcid, struct mt7996_link_sta, wcid);
++				phy = mlink->sta->vif->deflink.phy->mt76;
++				mlink->ack_signal = mt76_rx_signal(phy->antenna_mask, rssi);
++				ewma_avg_signal_add(&mlink->avg_ack_signal, -mlink->ack_signal);
+ 			} else {
+ 				ret = -EINVAL;
+ 				dev_err(dev->dev, "Failed to update RSSI for "
+@@ -5069,7 +5072,7 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
  {
- 	int len = sizeof(struct bss_req_hdr) + sizeof(struct bss_color_tlv);
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct bss_color_tlv *bss_color;
- 	struct sk_buff *skb;
- 	struct tlv *tlv;
- 
--	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76, len);
-+	skb = __mt7996_mcu_alloc_bss_req(&dev->mt76, &mconf->mt76, len);
- 	if (IS_ERR(skb))
- 		return PTR_ERR(skb);
+ 	u16 sta_list[PER_STA_INFO_MAX_NUM];
+ 	LIST_HEAD(sta_poll_list);
+-	struct mt7996_sta *msta;
++	struct mt7996_link_sta *mlink;
+ 	int i, ret;
+ 	bool empty = false;
  
-@@ -4643,7 +4643,7 @@ int mt7996_mcu_update_bss_color(struct mt7996_dev *dev, struct ieee80211_vif *vi
- #define TWT_AGRT_PROTECT	BIT(2)
+@@ -5089,13 +5092,13 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
+ 				empty = true;
+ 				break;
+ 			}
+-			msta = list_first_entry(&sta_poll_list,
+-			                        struct mt7996_sta,
++			mlink = list_first_entry(&sta_poll_list,
++			                        struct mt7996_link_sta,
+ 			                        wcid.poll_list);
+-			list_del_init(&msta->wcid.poll_list);
++			list_del_init(&mlink->wcid.poll_list);
+ 			spin_unlock_bh(&dev->sta_poll_lock);
  
- int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
--			       struct mt7996_vif *mvif,
-+			       struct mt7996_bss_conf *mconf,
- 			       struct mt7996_twt_flow *flow,
- 			       int cmd)
- {
-@@ -4674,12 +4674,12 @@ int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
- 		.len = cpu_to_le16(sizeof(req) - 4),
- 		.tbl_idx = flow->table_id,
- 		.cmd = cmd,
--		.own_mac_idx = mvif->mt76.omac_idx,
-+		.own_mac_idx = mconf->mt76.omac_idx,
- 		.flowid = flow->id,
- 		.peer_id = cpu_to_le16(flow->wcid),
- 		.duration = flow->duration,
--		.bss = mvif->mt76.idx,
--		.bss_idx = mvif->mt76.idx,
-+		.bss = mconf->mt76.idx,
-+		.bss_idx = mconf->mt76.idx,
- 		.start_tsf = cpu_to_le64(flow->tsf),
- 		.mantissa = flow->mantissa,
- 		.exponent = flow->exp,
-@@ -4810,15 +4810,15 @@ int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev, bool disable
+-			sta_list[i] = msta->wcid.idx;
++			sta_list[i] = mlink->wcid.idx;
+ 		}
  
- int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
- 				     struct ieee80211_vif *vif,
-+				     struct mt7996_bss_conf *mconf,
- 				     struct ieee80211_sta *sta)
+ 		ret = mt7996_mcu_get_per_sta_info(dev, UNI_PER_STA_RSSI,
+@@ -5385,10 +5388,18 @@ int mt7996_mcu_set_scs_stats(struct mt7996_phy *phy)
+ void mt7996_sta_rssi_work(void *data, struct ieee80211_sta *sta)
  {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_sta *msta;
- 	struct sk_buff *skb;
- 
--	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mvif->sta;
-+	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mconf->vif->sta;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct mt7996_link_sta *mlink;
+ 	struct mt7996_phy *poll_phy = (struct mt7996_phy *) data;
  
--	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mvif->mt76,
-+	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
- 					      &msta->wcid,
- 					      MT7996_STA_UPDATE_MAX_SIZE);
- 	if (IS_ERR(skb))
-@@ -5462,8 +5462,9 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
- 				 &req, sizeof(req), false);
+-	if (poll_phy->scs_ctrl.sta_min_rssi > msta->ack_signal)
+-		poll_phy->scs_ctrl.sta_min_rssi = msta->ack_signal;
++	mutex_lock(&poll_phy->dev->mt76.mutex);
++	mlink = mlink_dereference_protected(msta, 0);
++	if (!mlink)
++		goto out;
++
++	if (poll_phy->scs_ctrl.sta_min_rssi > mlink->ack_signal)
++		poll_phy->scs_ctrl.sta_min_rssi = mlink->ack_signal;
++out:
++	mutex_unlock(&poll_phy->dev->mt76.mutex);
  }
  
+ void mt7996_mcu_scs_sta_poll(struct work_struct *work)
+@@ -5464,9 +5475,10 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
+ 
--int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy, struct mt7996_sta *msta,
--	                        enum vow_drr_ctrl_id id)
-+int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
-+				struct mt7996_bss_conf *mconf,
-+				struct mt7996_sta *msta, enum vow_drr_ctrl_id id)
+ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
+ 				struct mt7996_bss_conf *mconf,
+-				struct mt7996_sta *msta, enum vow_drr_ctrl_id id)
++				struct mt7996_link_sta *mlink,
++				enum vow_drr_ctrl_id id)
  {
- 	struct mt7996_vow_sta_ctrl *vow = msta ? &msta->vow : NULL;
+-	struct mt7996_vow_sta_ctrl *vow = msta ? &msta->vow : NULL;
++	struct mt7996_vow_sta_ctrl *vow = mlink ? &mlink->vow : NULL;
  	u32 val = 0;
-@@ -5489,9 +5490,9 @@ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy, struct mt7996_sta *msta,
+ 	struct {
+ 		u8 __rsv1[4];
+@@ -5488,11 +5500,11 @@ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
+ 	} __packed req = {
+ 		.tag = cpu_to_le16(UNI_VOW_DRR_CTRL),
  		.len = cpu_to_le16(sizeof(req) - 4),
- 		.wlan_idx = cpu_to_le16(msta ? msta->wcid.idx : 0),
+-		.wlan_idx = cpu_to_le16(msta ? msta->wcid.idx : 0),
++		.wlan_idx = cpu_to_le16(mlink ? mlink->wcid.idx : 0),
  		.band_idx = phy->mt76->band_idx,
--		.wmm_idx = msta ? msta->vif->mt76.wmm_idx : 0,
-+		.wmm_idx = msta ? mconf->mt76.wmm_idx : 0,
+-		.wmm_idx = msta ? mconf->mt76.wmm_idx : 0,
++		.wmm_idx = mlink ? mconf->mt76.wmm_idx : 0,
  		.ctrl_id = cpu_to_le32(id),
--		.omac_idx = msta ? msta->vif->mt76.omac_idx : 0
-+		.omac_idx = msta ? mconf->mt76.omac_idx : 0
+-		.omac_idx = msta ? mconf->mt76.omac_idx : 0
++		.omac_idx = mlink ? mconf->mt76.omac_idx : 0
  	};
  
  	switch (id) {
-@@ -5679,7 +5680,7 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
- {
- 	u8 mode, val;
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct mt7996_phy *phy =  mvif->phy;
-+	struct mt7996_phy *phy =  mvif->deflink.phy;
- 
- 	mode = FIELD_GET(RATE_CFG_MODE, *((u32 *)data));
- 	val = FIELD_GET(RATE_CFG_VAL, *((u32 *)data));
-@@ -5710,11 +5711,11 @@ void mt7996_set_wireless_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
- void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
- {
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct ieee80211_hw *hw = mvif->phy->mt76->hw;
-+	struct ieee80211_hw *hw = mvif->deflink.phy->mt76->hw;
- 	u8 val = *((u8 *)data);
- 
- 	vif->bss_conf.enable_beacon = val;
- 
--	mt7996_mcu_add_beacon(hw, vif, val);
-+	mt7996_mcu_add_beacon(hw, &vif->bss_conf, &mvif->deflink, val);
- }
- #endif
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 2b266d18b..6b03ee17f 100644
+index 6b03ee1..3701720 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -324,18 +324,25 @@ struct mt7996_sta {
- 	struct mt7996_vow_sta_ctrl vow;
+@@ -302,10 +302,10 @@ struct mt7996_vow_sta_ctrl {
+ 	u8 drr_quantum[IEEE80211_NUM_ACS];
  };
  
--struct mt7996_vif {
-+struct mt7996_bss_conf {
- 	struct mt76_vif mt76; /* must be first */
+-struct mt7996_sta {
++struct mt7996_link_sta {
+ 	struct mt76_wcid wcid; /* must be first */
  
--	struct mt7996_sta sta;
-+	struct mt7996_vif *vif;
- 	struct mt7996_phy *phy;
--
- 	struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS];
- 	struct cfg80211_bitrate_mask bitrate_mask;
+-	struct mt7996_vif *vif;
++	struct mt7996_sta *sta;
  
- 	struct mt7996_chanctx *chanctx;
+ 	struct list_head rc_list;
+ 
+@@ -324,6 +324,13 @@ struct mt7996_sta {
+ 	struct mt7996_vow_sta_ctrl vow;
  };
  
-+struct mt7996_vif {
-+	struct mt7996_bss_conf deflink;
-+	struct mt7996_bss_conf __rcu *link[IEEE80211_MLD_MAX_NUM_LINKS];
++struct mt7996_sta {
++	struct mt7996_link_sta deflink;
++	struct mt7996_link_sta __rcu *link[IEEE80211_MLD_MAX_NUM_LINKS];
 +
-+	struct mt7996_sta sta;
-+	struct mt7996_dev *dev;
++	struct mt7996_vif *vif;
 +};
 +
- /* crash-dump */
- struct mt7996_crash_data {
- 	guid_t guid;
-@@ -769,6 +776,13 @@ mt7996_chanctx_get(struct ieee80211_chanctx_conf *ctx)
- 	return (struct mt7996_chanctx *)&ctx->drv_priv;
+ struct mt7996_bss_conf {
+ 	struct mt76_vif mt76; /* must be first */
+ 
+@@ -783,6 +790,13 @@ mconf_dereference_protected(struct mt7996_vif *mvif, u8 link_id)
+ 					 lockdep_is_held(&mvif->dev->mt76.mutex));
  }
  
-+static inline struct mt7996_bss_conf *
-+mconf_dereference_protected(struct mt7996_vif *mvif, u8 link_id)
++static inline struct mt7996_link_sta *
++mlink_dereference_protected(struct mt7996_sta *msta, u8 link_id)
 +{
-+	return rcu_dereference_protected(mvif->link[link_id],
-+					 lockdep_is_held(&mvif->dev->mt76.mutex));
++	return rcu_dereference_protected(msta->link[link_id],
++					 lockdep_is_held(&msta->vif->dev->mt76.mutex));
 +}
 +
  extern const struct ieee80211_ops mt7996_ops;
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
-@@ -779,7 +793,7 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
- void mt7996_wfsys_reset(struct mt7996_dev *dev);
- void mt7996_rro_hw_init(struct mt7996_dev *dev);
- irqreturn_t mt7996_irq_handler(int irq, void *dev_instance);
--u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_vif *mvif);
-+u64 __mt7996_get_tsf(struct ieee80211_hw *hw, struct mt7996_bss_conf *mconf);
- int mt7996_register_device(struct mt7996_dev *dev);
- void mt7996_unregister_device(struct mt7996_dev *dev);
- const char *mt7996_eeprom_name(struct mt7996_dev *dev);
-@@ -805,37 +819,47 @@ int mt7996_run(struct ieee80211_hw *hw);
- int mt7996_mcu_init(struct mt7996_dev *dev);
- int mt7996_mcu_init_firmware(struct mt7996_dev *dev);
- int mt7996_mcu_twt_agrt_update(struct mt7996_dev *dev,
--			       struct mt7996_vif *mvif,
-+			       struct mt7996_bss_conf *mconf,
- 			       struct mt7996_twt_flow *flow,
- 			       int cmd);
- int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
--			    struct ieee80211_vif *vif, bool enable);
-+			    struct ieee80211_bss_conf *conf,
-+			    struct mt7996_bss_conf *mconf, bool enable);
+@@ -827,10 +841,12 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
+ 			    struct mt7996_bss_conf *mconf, bool enable);
  int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
--			    struct ieee80211_vif *vif, int enable);
--int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_vif *vif,
--		       struct ieee80211_sta *sta, bool enable, bool newly);
-+			    struct ieee80211_bss_conf *conf,
-+			    struct mt7996_bss_conf *mconf, int enable);
-+int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
-+		       struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta,
-+		       bool enable, bool newly);
+ 			    struct ieee80211_bss_conf *conf,
+-			    struct mt7996_bss_conf *mconf, int enable);
++			    struct mt7996_bss_conf *mconf,
++			    struct mt7996_link_sta *mlink, int enable);
+ int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
+-		       struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta,
+-		       bool enable, bool newly);
++		       struct mt7996_bss_conf *mconf,
++		       struct ieee80211_link_sta *link_sta,
++		       struct mt7996_link_sta *mlink, bool enable, bool newly);
  int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
  			 struct ieee80211_ampdu_params *params,
  			 bool add);
- int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
- 			 struct ieee80211_ampdu_params *params,
- 			 bool add);
--int mt7996_mcu_update_bss_color(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+int mt7996_mcu_update_bss_color(struct mt7996_dev *dev,
-+				struct mt7996_bss_conf *mconf,
- 				struct cfg80211_he_bss_color *he_bss_color);
--int mt7996_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
--			  int enable);
-+int mt7996_mcu_add_beacon(struct ieee80211_hw *hw,
-+			  struct ieee80211_bss_conf *conf,
-+			  struct mt7996_bss_conf *mconf, int en);
- int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
--				    struct ieee80211_vif *vif, u32 changed);
--int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy, struct ieee80211_vif *vif,
-+				    struct ieee80211_bss_conf *conf,
-+				    struct mt7996_bss_conf *mconf, u32 changed);
-+int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy,
-+			    struct mt7996_bss_conf *mconf,
- 			    struct ieee80211_he_obss_pd *he_obss_pd);
--int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
-+			     struct ieee80211_bss_conf *conf,
-+			     struct mt7996_bss_conf *mconf,
- 			     struct ieee80211_sta *sta, bool changed);
+@@ -852,7 +868,8 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy,
+ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+ 			     struct ieee80211_bss_conf *conf,
+ 			     struct mt7996_bss_conf *mconf,
+-			     struct ieee80211_sta *sta, bool changed);
++			     struct ieee80211_link_sta *link_sta,
++			     struct mt7996_link_sta *mlink, bool changed);
  int mt7996_set_channel(struct mt7996_phy *phy, struct cfg80211_chan_def *chandef);
  int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag);
--int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif);
-+int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct mt7996_bss_conf *mconf);
- int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
+ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct mt7996_bss_conf *mconf);
+@@ -860,7 +877,9 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
  				   void *data, u16 version);
--int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
-+			       struct mt7996_bss_conf *mconf,
- 			       struct ieee80211_sta *sta, void *data, u32 field);
+ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
+ 			       struct mt7996_bss_conf *mconf,
+-			       struct ieee80211_sta *sta, void *data, u32 field);
++			       struct ieee80211_link_sta *link_sta,
++			       struct mt7996_link_sta *mlink, void *data,
++			       u32 field);
  int mt7996_mcu_set_eeprom(struct mt7996_dev *dev);
  int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf);
-@@ -850,7 +874,7 @@ int mt7996_mcu_set_radar_th(struct mt7996_dev *dev, int index,
- 			    const struct mt7996_dfs_pattern *pattern);
- int mt7996_mcu_set_radio_en(struct mt7996_phy *phy, bool enable);
- int mt7996_mcu_set_rts_thresh(struct mt7996_phy *phy, u32 val);
--int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif);
-+int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct mt7996_bss_conf *mconf);
- int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch);
- int mt7996_mcu_get_temperature(struct mt7996_phy *phy);
- int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state);
-@@ -890,8 +914,9 @@ void mt7996_tm_rf_test_event(struct mt7996_dev *dev, struct sk_buff *skb);
- int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable);
- void mt7996_mcu_scs_sta_poll(struct work_struct *work);
+ int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num);
+@@ -916,7 +935,8 @@ void mt7996_mcu_scs_sta_poll(struct work_struct *work);
  int mt7996_mcu_set_band_confg(struct mt7996_phy *phy, u16 option, bool enable);
--int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy, struct mt7996_sta *msta,
--	                        enum vow_drr_ctrl_id id);
-+int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
-+				struct mt7996_bss_conf *mconf,
-+				struct mt7996_sta *msta, enum vow_drr_ctrl_id id);
+ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
+ 				struct mt7996_bss_conf *mconf,
+-				struct mt7996_sta *msta, enum vow_drr_ctrl_id id);
++				struct mt7996_link_sta *mlink,
++				enum vow_drr_ctrl_id id);
  int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy);
  void mt7996_mcu_wmm_pbc_work(struct work_struct *work);
  
-@@ -1000,13 +1025,16 @@ void mt7996_update_channel(struct mt76_phy *mphy);
- int mt7996_init_debugfs(struct mt7996_phy *phy);
- void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int len);
- bool mt7996_debugfs_rx_log(struct mt7996_dev *dev, const void *data, int len);
--int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
-+int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
- 		       struct ieee80211_key_conf *key, int mcu_cmd,
- 		       struct mt76_wcid *wcid, enum set_key_cmd cmd);
--int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev, struct ieee80211_vif *vif,
-+int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
-+			       struct ieee80211_bss_conf *conf,
-+			       struct mt7996_bss_conf *mconf,
+@@ -983,7 +1003,7 @@ void mt7996_mac_reset_counters(struct mt7996_phy *phy);
+ void mt7996_mac_cca_stats_reset(struct mt7996_phy *phy);
+ void mt7996_mac_enable_nf(struct mt7996_dev *dev, u8 band);
+ void mt7996_mac_enable_rtscts(struct mt7996_dev *dev,
+-			      struct ieee80211_vif *vif, bool enable);
++			      struct mt7996_link_sta *mlink, bool enable);
+ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+ 			   struct sk_buff *skb, struct mt76_wcid *wcid,
+ 			   struct ieee80211_key_conf *key, int pid,
+@@ -1001,8 +1021,7 @@ void mt7996_mac_dump_work(struct work_struct *work);
+ void mt7996_mac_sta_rc_work(struct work_struct *work);
+ void mt7996_mac_update_stats(struct mt7996_phy *phy);
+ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
+-				  struct mt7996_sta *msta,
+-				  u8 flowid);
++				  struct mt7996_link_sta *mlink, u8 flowid);
+ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+ 			      struct ieee80211_sta *sta,
+ 			      struct ieee80211_twt_setup *twt);
+@@ -1031,11 +1050,12 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
+ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
+ 			       struct ieee80211_bss_conf *conf,
+ 			       struct mt7996_bss_conf *mconf,
++			       struct mt7996_link_sta *mlink,
  			       struct ieee80211_key_conf *key);
  int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
  				     struct ieee80211_vif *vif,
-+				     struct mt7996_bss_conf *mconf,
- 				     struct ieee80211_sta *sta);
+ 				     struct mt7996_bss_conf *mconf,
+-				     struct ieee80211_sta *sta);
++				     struct mt7996_link_sta *mlink);
  int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode);
  int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
+ #ifdef CONFIG_MAC80211_DEBUGFS
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index 784a8bea4..bf55b4309 100644
+index bf55b43..ba17f94 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
-@@ -223,6 +223,7 @@ static void
- mt7996_tm_init(struct mt7996_phy *phy, bool en)
- {
- 	struct mt7996_dev *dev = phy->dev;
-+	struct mt7996_vif *mvif = (struct mt7996_vif *)phy->monitor_vif->drv_priv;
- 	u8 rf_test_mode = en ? RF_OPER_RF_TEST : RF_OPER_NORMAL;
- 
- 	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
-@@ -234,8 +235,8 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
+@@ -235,8 +235,8 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
  
  	mt7996_tm_rf_switch_mode(dev, rf_test_mode);
  
--	mt7996_mcu_add_bss_info(phy, phy->monitor_vif, en);
--	mt7996_mcu_add_sta(dev, phy->monitor_vif, NULL, en, false);
-+	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, en);
-+	mt7996_mcu_add_sta(dev, &phy->monitor_vif->bss_conf, &mvif->deflink, NULL, en, false);
+-	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, en);
+-	mt7996_mcu_add_sta(dev, &phy->monitor_vif->bss_conf, &mvif->deflink, NULL, en, false);
++	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, &mvif->sta.deflink, en);
++	mt7996_mcu_add_sta(dev, &phy->monitor_vif->bss_conf, &mvif->deflink, NULL, &mvif->sta.deflink, en, false);
  
  	mt7996_tm_set(dev, SET_ID(BAND_IDX), phy->mt76->band_idx);
  
-@@ -1179,13 +1180,13 @@ mt7996_tm_txbf_init(struct mt7996_phy *phy, u16 *val)
- 	mt7996_tm_set_mac_addr(dev, td->addr[2], SET_ID(BSSID));
+@@ -1186,7 +1186,7 @@ mt7996_tm_txbf_init(struct mt7996_phy *phy, u16 *val)
+ 	phy->omac_mask |= BIT_ULL(mvif->deflink.mt76.omac_idx);
  
- 	/* bss idx & omac idx should be set to band idx for ibf cal */
--	mvif->mt76.idx = band_idx;
--	dev->mt76.vif_mask |= BIT_ULL(mvif->mt76.idx);
--	mvif->mt76.omac_idx = band_idx;
--	phy->omac_mask |= BIT_ULL(mvif->mt76.omac_idx);
-+	mvif->deflink.mt76.idx = band_idx;
-+	dev->mt76.vif_mask |= BIT_ULL(mvif->deflink.mt76.idx);
-+	mvif->deflink.mt76.omac_idx = band_idx;
-+	phy->omac_mask |= BIT_ULL(mvif->deflink.mt76.omac_idx);
- 
--	mt7996_mcu_add_dev_info(phy, phy->monitor_vif, true);
--	mt7996_mcu_add_bss_info(phy, phy->monitor_vif, true);
-+	mt7996_mcu_add_dev_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, true);
-+	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, true);
+ 	mt7996_mcu_add_dev_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, true);
+-	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, true);
++	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, &mvif->sta.deflink, true);
  
  	if (td->ibf) {
  		if (td->is_txbf_dut) {
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0088-wifi-mt76-extend-wcid-and-sta-flow-for-MLO-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0087-wifi-mt76-extend-wcid-and-sta-flow-for-MLO-support.patch
similarity index 84%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0088-wifi-mt76-extend-wcid-and-sta-flow-for-MLO-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0087-wifi-mt76-extend-wcid-and-sta-flow-for-MLO-support.patch
index d52447a..c1cf6ec 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0088-wifi-mt76-extend-wcid-and-sta-flow-for-MLO-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0087-wifi-mt76-extend-wcid-and-sta-flow-for-MLO-support.patch
@@ -1,7 +1,7 @@
-From 700547976605b447defd5492837cc123c97aba50 Mon Sep 17 00:00:00 2001
+From e0f1ba7574dc2a68c51a3a1d9f926dbebfbefc55 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 29 Nov 2023 11:04:50 +0800
-Subject: [PATCH 088/116] wifi: mt76: extend wcid and sta flow for MLO support
+Subject: [PATCH 087/116] wifi: mt76: extend wcid and sta flow for MLO support
 
 Add link related info to wcid, and split sta connection flow of common
 parts for MLO supported chipsets.
@@ -16,10 +16,10 @@
  2 files changed, 17 insertions(+), 2 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 4fad03dd9..96fab2320 100644
+index 0ad3f25..4e96b39 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1066,6 +1066,10 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -1067,6 +1067,10 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
  		     sizeof(mstat.chain_signal));
  	memcpy(status->chain_signal, mstat.chain_signal,
  	       sizeof(mstat.chain_signal));
@@ -30,7 +30,7 @@
  
  	*sta = wcid_to_sta(mstat.wcid);
  	*hw = mt76_phy_hw(dev, mstat.phy_idx);
-@@ -1374,6 +1378,9 @@ mt76_sta_add(struct mt76_phy *phy, struct ieee80211_vif *vif,
+@@ -1375,6 +1379,9 @@ mt76_sta_add(struct mt76_phy *phy, struct ieee80211_vif *vif,
  	if (ret)
  		goto out;
  
@@ -40,7 +40,7 @@
  	for (i = 0; i < ARRAY_SIZE(sta->txq); i++) {
  		struct mt76_txq *mtxq;
  
-@@ -1403,12 +1410,15 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
+@@ -1404,12 +1411,15 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
  	struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;
  	int i, idx = wcid->idx;
  
@@ -58,7 +58,7 @@
  
  	mt76_wcid_mask_clear(dev->wcid_mask, idx);
 diff --git a/mt76.h b/mt76.h
-index 0abb8ebf5..b60b5161b 100644
+index 8ca7907..c3ab96a 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -381,6 +381,9 @@ struct mt76_wcid {
@@ -87,5 +87,5 @@
  }
  
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0087-wifi-mt76-mt7996-switch-to-per-link-data-structure-o.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0087-wifi-mt76-mt7996-switch-to-per-link-data-structure-o.patch
deleted file mode 100644
index fb5a898..0000000
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0087-wifi-mt76-mt7996-switch-to-per-link-data-structure-o.patch
+++ /dev/null
@@ -1,2430 +0,0 @@
-From c847e82ab99803a3f79be845fba1cbbf2de03bbc Mon Sep 17 00:00:00 2001
-From: Shayne Chen <shayne.chen@mediatek.com>
-Date: Mon, 27 Nov 2023 10:43:34 +0800
-Subject: [PATCH 087/116] wifi: mt76: mt7996: switch to per-link data structure
- of sta
-
-Introduce struct mt7996_link_sta, data structure for per-link STA.
-Note that mt7996_sta now represents a peer legacy or MLD device.
-This is a preliminary patch to add MLO support for mt7996 chipsets.
-
-Co-developed-by: Bo Jiao <Bo.Jiao@mediatek.com>
-Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
-Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
----
- mt7615/mcu.c      |   4 +-
- mt76_connac_mcu.c |  18 +-
- mt76_connac_mcu.h |   7 +-
- mt7915/mcu.c      |   4 +-
- mt7925/mcu.c      |   4 +-
- mt7996/debugfs.c  |  20 ++-
- mt7996/mac.c      | 109 ++++++------
- mt7996/main.c     | 223 +++++++++++++++---------
- mt7996/mcu.c      | 430 ++++++++++++++++++++++++----------------------
- mt7996/mt7996.h   |  44 +++--
- mt7996/testmode.c |   6 +-
- 11 files changed, 482 insertions(+), 387 deletions(-)
-
-diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index a9310660b..8f4f203ef 100644
---- a/mt7615/mcu.c
-+++ b/mt7615/mcu.c
-@@ -862,8 +862,8 @@ mt7615_mcu_wtbl_sta_add(struct mt7615_phy *phy, struct ieee80211_vif *vif,
- 		else
- 			mvif->sta_added = true;
- 	}
--	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, sskb, vif, sta, enable,
--				      new_entry);
-+	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, sskb, vif, &sta->deflink,
-+				      enable, new_entry);
- 	if (enable && sta)
- 		mt76_connac_mcu_sta_tlv(phy->mt76, sskb, sta, vif, 0,
- 					MT76_STA_INFO_STATE_ASSOC);
-diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 0c7b69352..d83d31441 100644
---- a/mt76_connac_mcu.c
-+++ b/mt76_connac_mcu.c
-@@ -371,9 +371,10 @@ EXPORT_SYMBOL_GPL(mt76_connac_mcu_bss_omac_tlv);
- 
- void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
- 				   struct ieee80211_vif *vif,
--				   struct ieee80211_sta *sta,
-+				   struct ieee80211_link_sta *link_sta,
- 				   bool enable, bool newly)
- {
-+	struct ieee80211_sta *sta = link_sta ? link_sta->sta : NULL;
- 	struct sta_rec_basic *basic;
- 	struct tlv *tlv;
- 	int conn_type;
-@@ -431,7 +432,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
- 		break;
- 	}
- 
--	memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
-+	memcpy(basic->peer_addr, link_sta->addr, ETH_ALEN);
- 	basic->qos = sta->wme;
- }
- EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_basic_tlv);
-@@ -1055,7 +1056,7 @@ int mt76_connac_mcu_sta_cmd(struct mt76_phy *phy,
- 		return PTR_ERR(skb);
- 
- 	if (info->sta || !info->offload_fw)
--		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif, info->sta,
-+		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif, &info->sta->deflink,
- 					      info->enable, info->newly);
- 	if (info->sta && info->enable)
- 		mt76_connac_mcu_sta_tlv(phy, skb, info->sta,
-@@ -1306,7 +1307,8 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
- EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_ba);
- 
- u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
--			    enum nl80211_band band, struct ieee80211_sta *sta)
-+			    enum nl80211_band band,
-+			    struct ieee80211_link_sta *link_sta)
- {
- 	struct mt76_dev *dev = phy->dev;
- 	const struct ieee80211_sta_he_cap *he_cap;
-@@ -1317,10 +1319,10 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
- 	if (is_connac_v1(dev))
- 		return 0x38;
- 
--	if (sta) {
--		ht_cap = &sta->deflink.ht_cap;
--		vht_cap = &sta->deflink.vht_cap;
--		he_cap = &sta->deflink.he_cap;
-+	if (link_sta) {
-+		ht_cap = &link_sta->ht_cap;
-+		vht_cap = &link_sta->vht_cap;
-+		he_cap = &link_sta->he_cap;
- 	} else {
- 		struct ieee80211_supported_band *sband;
- 
-diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 151183d08..f7da63658 100644
---- a/mt76_connac_mcu.h
-+++ b/mt76_connac_mcu.h
-@@ -1903,8 +1903,8 @@ int mt76_connac_mcu_set_channel_domain(struct mt76_phy *phy);
- int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif);
- void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
- 				   struct ieee80211_vif *vif,
--				   struct ieee80211_sta *sta, bool enable,
--				   bool newly);
-+				   struct ieee80211_link_sta *link_sta,
-+				   bool enable, bool newly);
- void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
- 				      struct ieee80211_vif *vif,
- 				      struct ieee80211_sta *sta, void *sta_wtbl,
-@@ -2012,7 +2012,8 @@ mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif);
- const struct ieee80211_sta_eht_cap *
- mt76_connac_get_eht_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif);
- u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
--			    enum nl80211_band band, struct ieee80211_sta *sta);
-+			    enum nl80211_band band,
-+			    struct ieee80211_link_sta *link_sta);
- u8 mt76_connac_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
- 				enum nl80211_band band);
- 
-diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 2d017396c..1d1b3cead 100644
---- a/mt7915/mcu.c
-+++ b/mt7915/mcu.c
-@@ -1504,7 +1504,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
- 
- 	ra->valid = true;
- 	ra->auto_rate = true;
--	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
-+	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, &sta->deflink);
- 	ra->channel = chandef->chan->hw_value;
- 	ra->bw = sta->deflink.bandwidth;
- 	ra->phy.bw = sta->deflink.bandwidth;
-@@ -1669,7 +1669,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
- 		return PTR_ERR(skb);
- 
- 	/* starec basic */
--	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, sta, enable,
-+	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, &sta->deflink, enable,
- 				      !rcu_access_pointer(dev->mt76.wcid[msta->wcid.idx]));
- 	if (!enable)
- 		goto out;
-diff --git a/mt7925/mcu.c b/mt7925/mcu.c
-index bd37cb8d7..1cb556302 100644
---- a/mt7925/mcu.c
-+++ b/mt7925/mcu.c
-@@ -1626,7 +1626,7 @@ mt7925_mcu_sta_cmd(struct mt76_phy *phy,
- 		return PTR_ERR(skb);
- 
- 	if (info->sta || !info->offload_fw)
--		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif, info->sta,
-+		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif, &info->sta->deflink,
- 					      info->enable, info->newly);
- 	if (info->sta && info->enable) {
- 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->sta);
-@@ -2092,7 +2092,7 @@ mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
- 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_OFDM_INDEX);
- 
- 	memcpy(basic_req->bssid, vif->bss_conf.bssid, ETH_ALEN);
--	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, sta);
-+	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, &sta->deflink);
- 	basic_req->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
- 	basic_req->dtim_period = vif->bss_conf.dtim_period;
- 	basic_req->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
-diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 06015d686..56e219231 100644
---- a/mt7996/debugfs.c
-+++ b/mt7996/debugfs.c
-@@ -739,14 +739,15 @@ static void
- mt7996_sta_hw_queue_read(void *data, struct ieee80211_sta *sta)
- {
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_link_sta *mlink = &msta->deflink;
- 	struct mt7996_dev *dev = msta->vif->deflink.phy->dev;
- 	struct seq_file *s = data;
- 	u8 ac;
- 
- 	for (ac = 0; ac < 4; ac++) {
- 		u32 qlen, ctrl, val;
--		u32 idx = msta->wcid.idx >> 5;
--		u8 offs = msta->wcid.idx & GENMASK(4, 0);
-+		u32 idx = mlink->wcid.idx >> 5;
-+		u8 offs = mlink->wcid.idx & GENMASK(4, 0);
- 
- 		ctrl = BIT(31) | BIT(11) | (ac << 24);
- 		val = mt76_rr(dev, MT_PLE_AC_QEMPTY(ac, idx));
-@@ -754,11 +755,11 @@ mt7996_sta_hw_queue_read(void *data, struct ieee80211_sta *sta)
- 		if (val & BIT(offs))
- 			continue;
- 
--		mt76_wr(dev, MT_FL_Q0_CTRL, ctrl | msta->wcid.idx);
-+		mt76_wr(dev, MT_FL_Q0_CTRL, ctrl | mlink->wcid.idx);
- 		qlen = mt76_get_field(dev, MT_FL_Q3_CTRL,
- 				      GENMASK(11, 0));
- 		seq_printf(s, "\tSTA %pM wcid %d: AC%d%d queued:%d\n",
--			   sta->addr, msta->wcid.idx,
-+			   sta->addr, mlink->wcid.idx,
- 			   msta->vif->deflink.mt76.wmm_idx, ac, qlen);
- 	}
- }
-@@ -1041,7 +1042,7 @@ mt7996_airtime_read(struct seq_file *s, void *data)
- 	struct mt76_dev *mdev = &dev->mt76;
- 	struct mt76_sta_stats *stats;
- 	struct ieee80211_sta *sta;
--	struct mt7996_sta *msta;
-+	struct mt7996_link_sta *mlink;
- 	struct mt76_wcid *wcid;
- 	struct mt76_vif *vif;
- 	u16 i;
-@@ -1053,9 +1054,9 @@ mt7996_airtime_read(struct seq_file *s, void *data)
- 		if (!wcid || !wcid->sta)
- 			continue;
- 
--		msta = container_of(wcid, struct mt7996_sta, wcid);
--		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
--		vif = &msta->vif->deflink.mt76;
-+		mlink = container_of(wcid, struct mt7996_link_sta, wcid);
-+		sta = container_of((void *)mlink->sta, struct ieee80211_sta, drv_priv);
-+		vif = &mlink->sta->vif->deflink.mt76;
- 		stats = &wcid->stats;
- 
- 		seq_printf(s, "%pM WCID: %hu BandIdx: %hhu OmacIdx: 0x%hhx\t"
-@@ -1230,6 +1231,7 @@ static ssize_t mt7996_sta_fixed_rate_set(struct file *file,
- #define LONG_PREAMBLE 1
- 	struct ieee80211_sta *sta = file->private_data;
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_link_sta *mlink = &msta->deflink;
- 	struct mt7996_dev *dev = msta->vif->deflink.phy->dev;
- 	struct ra_rate phy = {};
- 	char buf[100];
-@@ -1265,7 +1267,7 @@ static ssize_t mt7996_sta_fixed_rate_set(struct file *file,
- 		goto out;
- 	}
- 
--	phy.wlan_idx = cpu_to_le16(msta->wcid.idx);
-+	phy.wlan_idx = cpu_to_le16(mlink->wcid.idx);
- 	phy.gi = cpu_to_le16(gi);
- 	phy.ltf = cpu_to_le16(ltf);
- 	phy.ldpc = phy.ldpc ? 7 : 0;
-diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 63b16f92e..3cff43d6b 100644
---- a/mt7996/mac.c
-+++ b/mt7996/mac.c
-@@ -54,7 +54,7 @@ static const struct mt7996_dfs_radar_spec jp_radar_specs = {
- static struct mt76_wcid *mt7996_rx_get_wcid(struct mt7996_dev *dev,
- 					    u16 idx, bool unicast)
- {
--	struct mt7996_sta *sta;
-+	struct mt7996_link_sta *mlink;
- 	struct mt76_wcid *wcid;
- 
- 	if (idx >= ARRAY_SIZE(dev->mt76.wcid))
-@@ -67,11 +67,11 @@ static struct mt76_wcid *mt7996_rx_get_wcid(struct mt7996_dev *dev,
- 	if (!wcid->sta)
- 		return NULL;
- 
--	sta = container_of(wcid, struct mt7996_sta, wcid);
--	if (!sta->vif)
-+	mlink = container_of(wcid, struct mt7996_link_sta, wcid);
-+	if (!mlink->sta->vif)
- 		return NULL;
- 
--	return &sta->vif->sta.wcid;
-+	return &mlink->wcid;
- }
- 
- bool mt7996_mac_wtbl_update(struct mt7996_dev *dev, int idx, u32 mask)
-@@ -92,12 +92,11 @@ u32 mt7996_mac_wtbl_lmac_addr(struct mt7996_dev *dev, u16 wcid, u8 dw)
- }
- 
- void mt7996_mac_enable_rtscts(struct mt7996_dev *dev,
--			      struct ieee80211_vif *vif, bool enable)
-+			      struct mt7996_link_sta *mlink, bool enable)
- {
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	u32 addr;
- 
--	addr = mt7996_mac_wtbl_lmac_addr(dev, mvif->sta.wcid.idx, 5);
-+	addr = mt7996_mac_wtbl_lmac_addr(dev, mlink->wcid.idx, 5);
- 	if (enable)
- 		mt76_set(dev, addr, BIT(5));
- 	else
-@@ -349,7 +348,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
- 	__le16 fc = 0;
- 	int idx;
- 	u8 hw_aggr = false;
--	struct mt7996_sta *msta = NULL;
-+	struct mt7996_link_sta *mlink = NULL;
- 
- 	hw_aggr = status->aggr;
- 	memset(status, 0, sizeof(*status));
-@@ -380,10 +379,10 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
- 	status->wcid = mt7996_rx_get_wcid(dev, idx, unicast);
- 
- 	if (status->wcid) {
--		msta = container_of(status->wcid, struct mt7996_sta, wcid);
-+		mlink = container_of(status->wcid, struct mt7996_link_sta, wcid);
- 		spin_lock_bh(&dev->mt76.sta_poll_lock);
--		if (list_empty(&msta->wcid.poll_list))
--			list_add_tail(&msta->wcid.poll_list,
-+		if (list_empty(&mlink->wcid.poll_list))
-+			list_add_tail(&mlink->wcid.poll_list,
- 				      &dev->mt76.sta_poll_list);
- 		spin_unlock_bh(&dev->mt76.sta_poll_lock);
- 	}
-@@ -592,7 +591,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
- #endif
- 	} else {
- 		status->flag |= RX_FLAG_8023;
--		mt7996_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
-+		mt7996_wed_check_ppe(dev, &dev->mt76.q_rx[q], mlink ? mlink->sta : NULL, skb,
- 				     *info);
- 	}
- 
-@@ -942,6 +941,7 @@ static void
- mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
- {
- 	struct mt7996_sta *msta;
-+	struct mt7996_link_sta *mlink;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 	bool is_8023 = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP;
- 	u16 fc, tid;
-@@ -970,7 +970,8 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
- 		return;
- 
- 	msta = (struct mt7996_sta *)sta->drv_priv;
--	if (!test_and_set_bit(tid, &msta->wcid.ampdu_state))
-+	mlink = rcu_dereference(msta->link[0]);
-+	if (!test_and_set_bit(tid, &mlink->wcid.ampdu_state))
- 		ieee80211_start_tx_ba_session(sta, tid, 0);
- }
- 
-@@ -1048,7 +1049,7 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
- 		 */
- 		info = le32_to_cpu(*cur_info);
- 		if (info & MT_TXFREE_INFO_PAIR) {
--			struct mt7996_sta *msta;
-+			struct mt7996_link_sta *mlink;
- 			u16 idx;
- 
- 			idx = FIELD_GET(MT_TXFREE_INFO_WLAN_ID, info);
-@@ -1057,10 +1058,10 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
- 			if (!sta)
- 				continue;
- 
--			msta = container_of(wcid, struct mt7996_sta, wcid);
-+			mlink = container_of(wcid, struct mt7996_link_sta, wcid);
- 			spin_lock_bh(&mdev->sta_poll_lock);
--			if (list_empty(&msta->wcid.poll_list))
--				list_add_tail(&msta->wcid.poll_list,
-+			if (list_empty(&mlink->wcid.poll_list))
-+				list_add_tail(&mlink->wcid.poll_list,
- 					      &mdev->sta_poll_list);
- 			spin_unlock_bh(&mdev->sta_poll_lock);
- 			continue;
-@@ -1265,7 +1266,7 @@ out:
- 
- static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
- {
--	struct mt7996_sta *msta = NULL;
-+	struct mt7996_link_sta *mlink;
- 	struct mt76_wcid *wcid;
- 	__le32 *txs_data = data;
- 	u16 wcidx;
-@@ -1286,16 +1287,15 @@ static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
- 	if (!wcid)
- 		goto out;
- 
--	msta = container_of(wcid, struct mt7996_sta, wcid);
--
- 	mt7996_mac_add_txs_skb(dev, wcid, pid, txs_data);
- 
- 	if (!wcid->sta)
- 		goto out;
- 
-+	mlink = container_of(wcid, struct mt7996_link_sta, wcid);
- 	spin_lock_bh(&dev->mt76.sta_poll_lock);
--	if (list_empty(&msta->wcid.poll_list))
--		list_add_tail(&msta->wcid.poll_list, &dev->mt76.sta_poll_list);
-+	if (list_empty(&mlink->wcid.poll_list))
-+		list_add_tail(&mlink->wcid.poll_list, &dev->mt76.sta_poll_list);
- 	spin_unlock_bh(&dev->mt76.sta_poll_lock);
- 
- out:
-@@ -2242,8 +2242,9 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
- 	struct ieee80211_sta *sta;
- 	struct ieee80211_vif *vif;
- 	struct ieee80211_bss_conf *conf;
-+	struct ieee80211_link_sta *link_sta;
- 	struct mt7996_bss_conf *mconf;
--	struct mt7996_sta *msta;
-+	struct mt7996_link_sta *mlink;
- 	u32 changed;
- 	LIST_HEAD(list);
- 
-@@ -2251,24 +2252,25 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
- 	list_splice_init(&dev->sta_rc_list, &list);
- 
- 	while (!list_empty(&list)) {
--		msta = list_first_entry(&list, struct mt7996_sta, rc_list);
--		list_del_init(&msta->rc_list);
--		changed = msta->changed;
--		msta->changed = 0;
-+		mlink = list_first_entry(&list, struct mt7996_link_sta, rc_list);
-+		list_del_init(&mlink->rc_list);
-+		changed = mlink->changed;
-+		mlink->changed = 0;
- 		spin_unlock_bh(&dev->mt76.sta_poll_lock);
- 
--		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
--		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
-+		sta = container_of((void *)mlink->sta, struct ieee80211_sta, drv_priv);
-+		link_sta = &sta->deflink;
-+		vif = container_of((void *)mlink->sta->vif, struct ieee80211_vif, drv_priv);
- 		conf = &vif->bss_conf;
--		mconf = &msta->vif->deflink;
-+		mconf = &mlink->sta->vif->deflink;
- 
- 		if (changed & (IEEE80211_RC_SUPP_RATES_CHANGED |
- 			       IEEE80211_RC_NSS_CHANGED |
- 			       IEEE80211_RC_BW_CHANGED))
--			mt7996_mcu_add_rate_ctrl(dev, conf, mconf, sta, true);
-+			mt7996_mcu_add_rate_ctrl(dev, conf, mconf, link_sta, mlink, true);
- 
- 		if (changed & IEEE80211_RC_SMPS_CHANGED)
--			mt7996_mcu_set_fixed_field(dev, mconf, sta, NULL,
-+			mt7996_mcu_set_fixed_field(dev, mconf, link_sta, mlink, NULL,
- 						   RATE_PARAM_MMPS_UPDATE);
- 
- 		spin_lock_bh(&dev->mt76.sta_poll_lock);
-@@ -2561,7 +2563,7 @@ static int mt7996_mac_check_twt_req(struct ieee80211_twt_setup *twt)
- }
- 
- static bool
--mt7996_mac_twt_param_equal(struct mt7996_sta *msta,
-+mt7996_mac_twt_param_equal(struct mt7996_link_sta *mlink,
- 			   struct ieee80211_twt_params *twt_agrt)
- {
- 	u16 type = le16_to_cpu(twt_agrt->req_type);
-@@ -2572,10 +2574,10 @@ mt7996_mac_twt_param_equal(struct mt7996_sta *msta,
- 	for (i = 0; i < MT7996_MAX_STA_TWT_AGRT; i++) {
- 		struct mt7996_twt_flow *f;
- 
--		if (!(msta->twt.flowid_mask & BIT(i)))
-+		if (!(mlink->twt.flowid_mask & BIT(i)))
- 			continue;
- 
--		f = &msta->twt.flow[i];
-+		f = &mlink->twt.flow[i];
- 		if (f->duration == twt_agrt->min_twt_dur &&
- 		    f->mantissa == twt_agrt->mantissa &&
- 		    f->exp == exp &&
-@@ -2594,6 +2596,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
- {
- 	enum ieee80211_twt_setup_cmd setup_cmd = TWT_SETUP_CMD_REJECT;
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_link_sta *mlink;
- 	struct ieee80211_twt_params *twt_agrt = (void *)twt->params;
- 	u16 req_type = le16_to_cpu(twt_agrt->req_type);
- 	enum ieee80211_twt_setup_cmd sta_setup_cmd;
-@@ -2605,11 +2608,12 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
- 		goto out;
- 
- 	mutex_lock(&dev->mt76.mutex);
-+	mlink = mlink_dereference_protected(msta, 0);
- 
- 	if (dev->twt.n_agrt == MT7996_MAX_TWT_AGRT)
- 		goto unlock;
- 
--	if (hweight8(msta->twt.flowid_mask) == ARRAY_SIZE(msta->twt.flow))
-+	if (hweight8(mlink->twt.flowid_mask) == ARRAY_SIZE(mlink->twt.flow))
- 		goto unlock;
- 
- 	if (twt_agrt->min_twt_dur < MT7996_MIN_TWT_DUR) {
-@@ -2618,10 +2622,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
- 		goto unlock;
- 	}
- 
--	if (mt7996_mac_twt_param_equal(msta, twt_agrt))
-+	if (mt7996_mac_twt_param_equal(mlink, twt_agrt))
- 		goto unlock;
- 
--	flowid = ffs(~msta->twt.flowid_mask) - 1;
-+	flowid = ffs(~mlink->twt.flowid_mask) - 1;
- 	twt_agrt->req_type &= ~cpu_to_le16(IEEE80211_TWT_REQTYPE_FLOWID);
- 	twt_agrt->req_type |= le16_encode_bits(flowid,
- 					       IEEE80211_TWT_REQTYPE_FLOWID);
-@@ -2630,10 +2634,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
- 	exp = FIELD_GET(IEEE80211_TWT_REQTYPE_WAKE_INT_EXP, req_type);
- 	sta_setup_cmd = FIELD_GET(IEEE80211_TWT_REQTYPE_SETUP_CMD, req_type);
- 
--	flow = &msta->twt.flow[flowid];
-+	flow = &mlink->twt.flow[flowid];
- 	memset(flow, 0, sizeof(*flow));
- 	INIT_LIST_HEAD(&flow->list);
--	flow->wcid = msta->wcid.idx;
-+	flow->wcid = mlink->wcid.idx;
- 	flow->table_id = table_id;
- 	flow->id = flowid;
- 	flow->duration = twt_agrt->min_twt_dur;
-@@ -2651,7 +2655,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
- 
- 		flow->sched = true;
- 		flow->start_tsf = mt7996_mac_twt_sched_list_add(dev, flow);
--		curr_tsf = __mt7996_get_tsf(hw, &msta->vif->deflink);
-+		curr_tsf = __mt7996_get_tsf(hw, &mlink->sta->vif->deflink);
- 		div_u64_rem(curr_tsf - flow->start_tsf, interval, &rem);
- 		flow_tsf = curr_tsf + interval - rem;
- 		twt_agrt->twt = cpu_to_le64(flow_tsf);
-@@ -2660,13 +2664,13 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
- 	}
- 	flow->tsf = le64_to_cpu(twt_agrt->twt);
- 
--	if (mt7996_mcu_twt_agrt_update(dev, &msta->vif->deflink, flow,
-+	if (mt7996_mcu_twt_agrt_update(dev, &mlink->sta->vif->deflink, flow,
- 				       MCU_TWT_AGRT_ADD))
- 		goto unlock;
- 
- 	setup_cmd = TWT_SETUP_CMD_ACCEPT;
- 	dev->twt.table_mask |= BIT(table_id);
--	msta->twt.flowid_mask |= BIT(flowid);
-+	mlink->twt.flowid_mask |= BIT(flowid);
- 	dev->twt.n_agrt++;
- 
- unlock:
-@@ -2679,26 +2683,25 @@ out:
- }
- 
- void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
--				  struct mt7996_sta *msta,
--				  u8 flowid)
-+				  struct mt7996_link_sta *mlink, u8 flowid)
- {
- 	struct mt7996_twt_flow *flow;
--	struct mt7996_bss_conf *mconf = mconf_dereference_protected(msta->vif, 0);
-+	struct mt7996_bss_conf *mconf = mconf_dereference_protected(mlink->sta->vif, 0);
- 
- 	lockdep_assert_held(&dev->mt76.mutex);
- 
--	if (flowid >= ARRAY_SIZE(msta->twt.flow))
-+	if (flowid >= ARRAY_SIZE(mlink->twt.flow))
- 		return;
- 
--	if (!(msta->twt.flowid_mask & BIT(flowid)))
-+	if (!(mlink->twt.flowid_mask & BIT(flowid)))
- 		return;
- 
--	flow = &msta->twt.flow[flowid];
-+	flow = &mlink->twt.flow[flowid];
- 	if (mt7996_mcu_twt_agrt_update(dev, mconf, flow, MCU_TWT_AGRT_DELETE))
- 		return;
- 
- 	list_del_init(&flow->list);
--	msta->twt.flowid_mask &= ~BIT(flowid);
-+	mlink->twt.flowid_mask &= ~BIT(flowid);
- 	dev->twt.table_mask &= ~BIT(flow->table_id);
- 	dev->twt.n_agrt--;
- }
-@@ -2711,7 +2714,7 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
- 	struct cfg80211_scan_request *req = phy->scan_req;
- 	struct ieee80211_vif *vif = phy->scan_vif;
- 	struct mt7996_vif *mvif;
--	struct mt76_wcid *wcid;
-+	struct mt7996_link_sta *mlink;
- 	struct ieee80211_tx_info *info;
- 	struct sk_buff *skb;
- 
-@@ -2719,7 +2722,6 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
- 		return;
- 
- 	mvif = (struct mt7996_vif *)vif->drv_priv;
--	wcid = &mvif->sta.wcid;
- 
- 	skb = ieee80211_probereq_get(hw, vif->addr,
- 				     ssid->ssid, ssid->ssid_len, req->ie_len);
-@@ -2752,7 +2754,8 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
- 	}
- 
- 	local_bh_disable();
--	mt76_tx(phy->mt76, NULL, wcid, skb);
-+	mlink = rcu_dereference(mvif->sta.link[0]);
-+	mt76_tx(phy->mt76, NULL, &mlink->wcid, skb);
- 	local_bh_enable();
- 
- 	rcu_read_unlock();
-diff --git a/mt7996/main.c b/mt7996/main.c
-index 9f61082f5..4069ffb70 100644
---- a/mt7996/main.c
-+++ b/mt7996/main.c
-@@ -229,6 +229,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
- 	struct ieee80211_bss_conf *conf = &vif->bss_conf;
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_bss_conf *mconf = &mvif->deflink;
-+	struct mt7996_link_sta *mlink = &mvif->sta.deflink;
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
- 	struct mt76_txq *mtxq;
-@@ -268,14 +269,15 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
- 
- 	idx = MT7996_WTBL_RESERVED - mconf->mt76.idx;
- 
--	INIT_LIST_HEAD(&mvif->sta.rc_list);
--	INIT_LIST_HEAD(&mvif->sta.wcid.poll_list);
--	mvif->sta.wcid.idx = idx;
--	mvif->sta.wcid.phy_idx = band_idx;
--	mvif->sta.wcid.hw_key_idx = -1;
--	mvif->sta.wcid.tx_info |= MT_WCID_TX_INFO_SET;
--	mvif->sta.vif = mvif;
--	mt76_wcid_init(&mvif->sta.wcid);
-+	INIT_LIST_HEAD(&mlink->rc_list);
-+	INIT_LIST_HEAD(&mlink->wcid.poll_list);
-+	mlink->wcid.idx = idx;
-+	mlink->wcid.phy_idx = band_idx;
-+	mlink->wcid.hw_key_idx = -1;
-+	mlink->wcid.tx_info |= MT_WCID_TX_INFO_SET;
-+	mlink->sta = &mvif->sta;
-+	mlink->sta->vif = mvif;
-+	mt76_wcid_init(&mlink->wcid);
- 
- 	mt7996_mac_wtbl_update(dev, idx,
- 			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
-@@ -297,14 +299,15 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
- 
- 	mt7996_init_bitrate_mask(mconf);
- 
--	mt7996_mcu_add_bss_info(phy, conf, mconf, true);
-+	mt7996_mcu_add_bss_info(phy, conf, mconf, mlink, true);
- 	/* defer the first STA_REC of BMC entry to BSS_CHANGED_BSSID for STA
- 	 * interface, since firmware only records BSSID when the entry is new
- 	 */
- 	if (vif->type != NL80211_IFTYPE_STATION)
--		mt7996_mcu_add_sta(dev, conf, mconf, NULL, true, true);
--	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
-+		mt7996_mcu_add_sta(dev, conf, mconf, NULL, mlink, true, true);
-+	rcu_assign_pointer(dev->mt76.wcid[idx], &mlink->wcid);
- 	rcu_assign_pointer(mvif->link[0], mconf);
-+	rcu_assign_pointer(mvif->sta.link[0], mlink);
- 
- out:
- 	mutex_unlock(&dev->mt76.mutex);
-@@ -318,10 +321,10 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
- 	struct ieee80211_bss_conf *conf;
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_bss_conf *mconf;
--	struct mt7996_sta *msta = &mvif->sta;
-+	struct mt7996_link_sta *mlink = &mvif->sta.deflink;
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
--	int idx = msta->wcid.idx;
-+	int idx = mlink->wcid.idx;
- 
- 	cancel_delayed_work_sync(&phy->scan_work);
- 
-@@ -329,8 +332,8 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
- 
- 	conf = link_conf_dereference_protected(vif, 0);
- 	mconf = mconf_dereference_protected(mvif, 0);
--	mt7996_mcu_add_sta(dev, conf, mconf, NULL, false, false);
--	mt7996_mcu_add_bss_info(phy, conf, mconf, false);
-+	mt7996_mcu_add_sta(dev, conf, mconf, NULL, mlink, false, false);
-+	mt7996_mcu_add_bss_info(phy, conf, mconf, mlink, false);
- 
- 	if (vif == phy->monitor_vif)
- 		phy->monitor_vif = NULL;
-@@ -343,12 +346,13 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
- 	phy->omac_mask &= ~BIT_ULL(mconf->mt76.omac_idx);
- 
- 	spin_lock_bh(&dev->mt76.sta_poll_lock);
--	if (!list_empty(&msta->wcid.poll_list))
--		list_del_init(&msta->wcid.poll_list);
-+	if (!list_empty(&mlink->wcid.poll_list))
-+		list_del_init(&mlink->wcid.poll_list);
- 	spin_unlock_bh(&dev->mt76.sta_poll_lock);
- 
--	mt76_wcid_cleanup(&dev->mt76, &msta->wcid);
-+	mt76_wcid_cleanup(&dev->mt76, &mlink->wcid);
- 	rcu_assign_pointer(mvif->link[0], NULL);
-+	rcu_assign_pointer(mvif->sta.link[0], NULL);
- 
- 	mutex_unlock(&dev->mt76.mutex);
- }
-@@ -447,10 +451,10 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_sta *msta = sta ? (struct mt7996_sta *)sta->drv_priv :
- 				  &mvif->sta;
--	struct mt76_wcid *wcid = &msta->wcid;
- 	struct mt7996_bss_conf *mconf;
-+	struct mt7996_link_sta *mlink;
- 	struct ieee80211_bss_conf *conf;
--	u8 *wcid_keyidx = &wcid->hw_key_idx;
-+	u8 *wcid_keyidx;
- 	int idx = key->keyidx;
- 	int err = 0;
- 
-@@ -464,6 +468,12 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
- 	    !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
- 		return -EOPNOTSUPP;
- 
-+	mutex_lock(&dev->mt76.mutex);
-+	conf = link_conf_dereference_protected(vif, 0);
-+	mconf = mconf_dereference_protected(mvif, 0);
-+	mlink = mlink_dereference_protected(msta, 0);
-+	wcid_keyidx = &mlink->wcid.hw_key_idx;
-+
- 	/* fall back to sw encryption for unsupported ciphers */
- 	switch (key->cipher) {
- 	case WLAN_CIPHER_SUITE_TKIP:
-@@ -486,16 +496,13 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
- 	case WLAN_CIPHER_SUITE_WEP40:
- 	case WLAN_CIPHER_SUITE_WEP104:
- 	default:
-+		mutex_unlock(&dev->mt76.mutex);
- 		return -EOPNOTSUPP;
- 	}
- 
--	mutex_lock(&dev->mt76.mutex);
--
--	conf = link_conf_dereference_protected(vif, 0);
--	mconf = mconf_dereference_protected(mvif, 0);
- 	if (cmd == SET_KEY && !sta && !mconf->mt76.cipher) {
- 		mconf->mt76.cipher = mt76_connac_mcu_get_cipher(key->cipher);
--		mt7996_mcu_add_bss_info(phy, conf, mconf, true);
-+		mt7996_mcu_add_bss_info(phy, conf, mconf, mlink, true);
- 	}
- 
- 	if (cmd == SET_KEY) {
-@@ -506,14 +513,14 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
- 		goto out;
- 	}
- 
--	mt76_wcid_key_setup(&dev->mt76, wcid, key);
-+	mt76_wcid_key_setup(&dev->mt76, &mlink->wcid, key);
- 
- 	if (key->keyidx == 6 || key->keyidx == 7)
--		err = mt7996_mcu_bcn_prot_enable(dev, conf, mconf, key);
-+		err = mt7996_mcu_bcn_prot_enable(dev, conf, mconf, mlink, key);
- 	else
- 		err = mt7996_mcu_add_key(&dev->mt76, mconf, key,
- 					 MCU_WMWA_UNI_CMD(STA_REC_UPDATE),
--					 &msta->wcid, cmd);
-+					 &mlink->wcid, cmd);
- out:
- 	mutex_unlock(&dev->mt76.mutex);
- 
-@@ -716,25 +723,27 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
- {
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_bss_conf *mconf;
-+	struct mt7996_link_sta *mlink;
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 
- 	mutex_lock(&dev->mt76.mutex);
- 
- 	mconf = mconf_dereference_protected(mvif, 0);
-+	mlink = mlink_dereference_protected(&mvif->sta, 0);
- 	/* station mode uses BSSID to map the wlan entry to a peer,
- 	 * and then peer references bss_info_rfch to set bandwidth cap.
- 	 */
- 	if ((changed & BSS_CHANGED_BSSID && !is_zero_ether_addr(info->bssid)) ||
- 	    (changed & BSS_CHANGED_ASSOC && vif->cfg.assoc) ||
- 	    (changed & BSS_CHANGED_BEACON_ENABLED && info->enable_beacon)) {
--		mt7996_mcu_add_bss_info(phy, info, mconf, true);
--		mt7996_mcu_add_sta(dev, info, mconf, NULL, true,
-+		mt7996_mcu_add_bss_info(phy, info, mconf, mlink, true);
-+		mt7996_mcu_add_sta(dev, info, mconf, NULL, mlink, true,
- 				   !!(changed & BSS_CHANGED_BSSID));
- 	}
- 
- 	if (changed & BSS_CHANGED_ERP_CTS_PROT)
--		mt7996_mac_enable_rtscts(dev, vif, info->use_cts_prot);
-+		mt7996_mac_enable_rtscts(dev, mlink, info->use_cts_prot);
- 
- 	if (changed & BSS_CHANGED_ERP_SLOT) {
- 		int slottime = info->use_short_slot ? 9 : 20;
-@@ -805,6 +814,7 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_bss_conf *mconf = mconf_dereference_protected(mvif, 0);
-+	struct mt7996_link_sta *mlink = &msta->deflink;
- 	u8 band_idx = mconf->phy->mt76->band_idx;
- 	int idx;
- 
-@@ -816,13 +826,16 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 	if (idx < 0)
- 		return -ENOSPC;
- 
--	INIT_LIST_HEAD(&msta->rc_list);
--	INIT_LIST_HEAD(&msta->wcid.poll_list);
-+	INIT_LIST_HEAD(&mlink->rc_list);
-+	INIT_LIST_HEAD(&mlink->wcid.poll_list);
- 	msta->vif = mvif;
--	msta->wcid.sta = 1;
--	msta->wcid.idx = idx;
--	msta->wcid.phy_idx = band_idx;
--	msta->wcid.tx_info |= MT_WCID_TX_INFO_SET;
-+	mlink->wcid.sta = 1;
-+	mlink->wcid.idx = idx;
-+	mlink->wcid.phy_idx = band_idx;
-+	mlink->wcid.tx_info |= MT_WCID_TX_INFO_SET;
-+	mlink->sta = msta;
-+
-+	rcu_assign_pointer(msta->link[0], mlink);
- 
- #ifdef CONFIG_MTK_VENDOR
- 	mt7996_vendor_amnt_sta_remove(mconf->phy, sta);
-@@ -855,19 +868,25 @@ void mt7996_mac_sta_assoc(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
- 	struct mt7996_bss_conf *mconf;
-+	struct mt7996_link_sta *mlink;
- 	struct ieee80211_bss_conf *conf;
-+	struct ieee80211_link_sta *link_sta;
- 
- 	mutex_lock(&dev->mt76.mutex);
- 
--	mt7996_mac_wtbl_update(dev, msta->wcid.idx,
--			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
--
- 	conf = link_conf_dereference_protected(vif, 0);
- 	mconf = mconf_dereference_protected(mvif, 0);
--	mt7996_mcu_add_sta(dev, conf, mconf, sta, true, true);
--	mt7996_mcu_add_rate_ctrl(dev, conf, mconf, sta, false);
-+	link_sta = link_sta_dereference_protected(sta, 0);
-+	mlink = mlink_dereference_protected(msta, 0);
- 
--	ewma_avg_signal_init(&msta->avg_ack_signal);
-+	mt7996_mac_wtbl_update(dev, mlink->wcid.idx,
-+			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
-+
-+	mt7996_mcu_add_sta(dev, conf, mconf, link_sta, mlink, true, true);
-+	mt7996_mcu_add_rate_ctrl(dev, conf, mconf, link_sta, mlink, false);
-+	mlink->wcid.tx_info |= MT_WCID_TX_INFO_SET;
-+
-+	ewma_avg_signal_init(&mlink->avg_ack_signal);
- 
- 	mutex_unlock(&dev->mt76.mutex);
- }
-@@ -879,25 +898,31 @@ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
- 	struct mt7996_bss_conf *mconf;
-+	struct mt7996_link_sta *mlink;
- 	struct ieee80211_bss_conf *conf;
-+	struct ieee80211_link_sta *link_sta;
- 	int i;
- 
- 	conf = link_conf_dereference_protected(vif, 0);
- 	mconf = mconf_dereference_protected(mvif, 0);
--	mt7996_mcu_add_sta(dev, conf, mconf, sta, false, false);
-+	link_sta = link_sta_dereference_protected(sta, 0);
-+	mlink = mlink_dereference_protected(msta, 0);
-+	mt7996_mcu_add_sta(dev, conf, mconf, link_sta, mlink, false, false);
- 
--	mt7996_mac_wtbl_update(dev, msta->wcid.idx,
-+	mt7996_mac_wtbl_update(dev, mlink->wcid.idx,
- 			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
- 
--	for (i = 0; i < ARRAY_SIZE(msta->twt.flow); i++)
--		mt7996_mac_twt_teardown_flow(dev, msta, i);
-+	for (i = 0; i < ARRAY_SIZE(mlink->twt.flow); i++)
-+		mt7996_mac_twt_teardown_flow(dev, mlink, i);
- 
- 	spin_lock_bh(&mdev->sta_poll_lock);
--	if (!list_empty(&msta->wcid.poll_list))
--		list_del_init(&msta->wcid.poll_list);
--	if (!list_empty(&msta->rc_list))
--		list_del_init(&msta->rc_list);
-+	if (!list_empty(&mlink->wcid.poll_list))
-+		list_del_init(&mlink->wcid.poll_list);
-+	if (!list_empty(&mlink->rc_list))
-+		list_del_init(&mlink->rc_list);
- 	spin_unlock_bh(&mdev->sta_poll_lock);
-+
-+	rcu_assign_pointer(msta->link[0], NULL);
- }
- 
- static void mt7996_tx(struct ieee80211_hw *hw,
-@@ -909,19 +934,22 @@ static void mt7996_tx(struct ieee80211_hw *hw,
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 	struct ieee80211_vif *vif = info->control.vif;
- 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
-+	struct mt7996_link_sta *mlink;
- 
- 	if (control->sta) {
--		struct mt7996_sta *sta;
-+		struct mt7996_sta *msta;
- 
--		sta = (struct mt7996_sta *)control->sta->drv_priv;
--		wcid = &sta->wcid;
-+		msta = (struct mt7996_sta *)control->sta->drv_priv;
-+		mlink = rcu_dereference(msta->link[0]);
-+		wcid = &mlink->wcid;
- 	}
- 
- 	if (vif && !control->sta) {
- 		struct mt7996_vif *mvif;
- 
- 		mvif = (struct mt7996_vif *)vif->drv_priv;
--		wcid = &mvif->sta.wcid;
-+		mlink = rcu_dereference(mvif->sta.link[0]);
-+		wcid = &mlink->wcid;
- 	}
- 
- 	mt76_tx(mphy, control->sta, wcid, skb);
-@@ -948,6 +976,7 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	struct ieee80211_sta *sta = params->sta;
- 	struct ieee80211_txq *txq = sta->txq[params->tid];
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_link_sta *mlink;
- 	u16 tid = params->tid;
- 	u16 ssn = params->ssn;
- 	struct mt76_txq *mtxq;
-@@ -959,14 +988,15 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	mtxq = (struct mt76_txq *)txq->drv_priv;
- 
- 	mutex_lock(&dev->mt76.mutex);
-+	mlink = mlink_dereference_protected(msta, 0);
- 	switch (action) {
- 	case IEEE80211_AMPDU_RX_START:
--		mt76_rx_aggr_start(&dev->mt76, &msta->wcid, tid, ssn,
-+		mt76_rx_aggr_start(&dev->mt76, &mlink->wcid, tid, ssn,
- 				   params->buf_size);
- 		ret = mt7996_mcu_add_rx_ba(dev, params, true);
- 		break;
- 	case IEEE80211_AMPDU_RX_STOP:
--		mt76_rx_aggr_stop(&dev->mt76, &msta->wcid, tid);
-+		mt76_rx_aggr_stop(&dev->mt76, &mlink->wcid, tid);
- 		ret = mt7996_mcu_add_rx_ba(dev, params, false);
- 		break;
- 	case IEEE80211_AMPDU_TX_OPERATIONAL:
-@@ -977,16 +1007,16 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
- 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
- 		mtxq->aggr = false;
--		clear_bit(tid, &msta->wcid.ampdu_state);
-+		clear_bit(tid, &mlink->wcid.ampdu_state);
- 		ret = mt7996_mcu_add_tx_ba(dev, params, false);
- 		break;
- 	case IEEE80211_AMPDU_TX_START:
--		set_bit(tid, &msta->wcid.ampdu_state);
-+		set_bit(tid, &mlink->wcid.ampdu_state);
- 		ret = IEEE80211_AMPDU_TX_START_IMMEDIATE;
- 		break;
- 	case IEEE80211_AMPDU_TX_STOP_CONT:
- 		mtxq->aggr = false;
--		clear_bit(tid, &msta->wcid.ampdu_state);
-+		clear_bit(tid, &mlink->wcid.ampdu_state);
- 		ret = mt7996_mcu_add_tx_ba(dev, params, false);
- 		ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
- 		break;
-@@ -1165,10 +1195,19 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
- 				  struct ieee80211_sta *sta,
- 				  struct station_info *sinfo)
- {
-+	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
--	struct rate_info *txrate = &msta->wcid.rate;
-+	struct mt7996_link_sta *mlink;
-+	struct rate_info *txrate;
- 
-+	/* TODO: support per-link rate report */
-+	mutex_lock(&dev->mt76.mutex);
-+	mlink = mlink_dereference_protected(msta, 0);
-+	if (!mlink)
-+		goto out;
-+
-+	txrate = &mlink->wcid.rate;
- 	if (txrate->legacy || txrate->flags) {
- 		if (txrate->legacy) {
- 			sinfo->txrate.legacy = txrate->legacy;
-@@ -1187,44 +1226,52 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
- 	sinfo->txrate.flags = txrate->flags;
- 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
- 
--	sinfo->tx_failed = msta->wcid.stats.tx_failed;
-+	sinfo->tx_failed = mlink->wcid.stats.tx_failed;
- 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
- 
--	sinfo->tx_retries = msta->wcid.stats.tx_retries;
-+	sinfo->tx_retries = mlink->wcid.stats.tx_retries;
- 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
- 
--	sinfo->ack_signal = (s8)msta->ack_signal;
-+	sinfo->ack_signal = (s8)mlink->ack_signal;
- 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL);
- 
--	sinfo->avg_ack_signal = -(s8)ewma_avg_signal_read(&msta->avg_ack_signal);
-+	sinfo->avg_ack_signal = -(s8)ewma_avg_signal_read(&mlink->avg_ack_signal);
- 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL_AVG);
- 
- 	if (mtk_wed_device_active(&phy->dev->mt76.mmio.wed)) {
--		sinfo->tx_bytes = msta->wcid.stats.tx_bytes;
-+		sinfo->tx_bytes = mlink->wcid.stats.tx_bytes;
- 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES64);
- 
--		sinfo->rx_bytes = msta->wcid.stats.rx_bytes;
-+		sinfo->rx_bytes = mlink->wcid.stats.rx_bytes;
- 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES64);
- 
--		sinfo->tx_packets = msta->wcid.stats.tx_packets;
-+		sinfo->tx_packets = mlink->wcid.stats.tx_packets;
- 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
- 
--		sinfo->rx_packets = msta->wcid.stats.rx_packets;
-+		sinfo->rx_packets = mlink->wcid.stats.rx_packets;
- 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
- 	}
-+out:
-+	mutex_unlock(&dev->mt76.mutex);
- }
- 
- static void mt7996_sta_rc_work(void *data, struct ieee80211_sta *sta)
- {
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_link_sta *mlink;
- 	struct mt7996_dev *dev = msta->vif->dev;
- 	u32 *changed = data;
- 
-+	rcu_read_lock();
-+	mlink = rcu_dereference(msta->link[0]);
-+
- 	spin_lock_bh(&dev->mt76.sta_poll_lock);
--	msta->changed |= *changed;
--	if (list_empty(&msta->rc_list))
--		list_add_tail(&msta->rc_list, &dev->sta_rc_list);
-+	mlink->changed |= *changed;
-+	if (list_empty(&mlink->rc_list))
-+		list_add_tail(&mlink->rc_list, &dev->sta_rc_list);
- 	spin_unlock_bh(&dev->mt76.sta_poll_lock);
-+
-+	rcu_read_unlock();
- }
- 
- static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
-@@ -1238,7 +1285,7 @@ static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
- 
- 	if (!msta->vif) {
- 		dev_warn(dev->mt76.dev, "Un-initialized STA %pM wcid %d in rc_work\n",
--			 sta->addr, msta->wcid.idx);
-+			 sta->addr, msta->deflink.wcid.idx);
- 		return;
- 	}
- 
-@@ -1284,16 +1331,18 @@ static void mt7996_sta_set_4addr(struct ieee80211_hw *hw,
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
- 	struct mt7996_bss_conf *mconf;
-+	struct mt7996_link_sta *mlink;
- 
- 	mutex_lock(&dev->mt76.mutex);
- 	mconf = mconf_dereference_protected(mvif, 0);
-+	mlink = mlink_dereference_protected(msta, 0);
- 
- 	if (enabled)
--		set_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
-+		set_bit(MT_WCID_FLAG_4ADDR, &mlink->wcid.flags);
- 	else
--		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
-+		clear_bit(MT_WCID_FLAG_4ADDR, &mlink->wcid.flags);
- 
--	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, sta);
-+	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, mlink);
- 	mutex_unlock(&dev->mt76.mutex);
- }
- 
-@@ -1306,16 +1355,18 @@ static void mt7996_sta_set_decap_offload(struct ieee80211_hw *hw,
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
- 	struct mt7996_bss_conf *mconf;
-+	struct mt7996_link_sta *mlink;
- 
- 	mutex_lock(&dev->mt76.mutex);
- 	mconf = mconf_dereference_protected(mvif, 0);
-+	mlink = mlink_dereference_protected(msta, 0);
- 
- 	if (enabled)
--		set_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
-+		set_bit(MT_WCID_FLAG_HDR_TRANS, &mlink->wcid.flags);
- 	else
--		clear_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
-+		clear_bit(MT_WCID_FLAG_HDR_TRANS, &mlink->wcid.flags);
- 
--	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, sta);
-+	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, mlink);
- 	mutex_unlock(&dev->mt76.mutex);
- }
- 
-@@ -1448,11 +1499,12 @@ static void mt7996_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
- {
- 	struct mt76_ethtool_worker_info *wi = wi_data;
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_link_sta *mlink = &msta->deflink;
- 
- 	if (msta->vif->deflink.mt76.idx != wi->idx)
- 		return;
- 
--	mt76_ethtool_worker(wi, &msta->wcid.stats, true);
-+	mt76_ethtool_worker(wi, &mlink->wcid.stats, true);
- }
- 
- static
-@@ -1555,10 +1607,12 @@ mt7996_twt_teardown_request(struct ieee80211_hw *hw,
- 			    u8 flowid)
- {
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_link_sta *mlink;
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 
- 	mutex_lock(&dev->mt76.mutex);
--	mt7996_mac_twt_teardown_flow(dev, msta, flowid);
-+	mlink = mlink_dereference_protected(msta, 0);
-+	mt7996_mac_twt_teardown_flow(dev, mlink, flowid);
- 	mutex_unlock(&dev->mt76.mutex);
- }
- 
-@@ -1681,6 +1735,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
- 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_bss_conf *mconf = &mvif->deflink;
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_link_sta *mlink = &msta->deflink;
- 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
- 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
- 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
-@@ -1703,7 +1758,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
- 	if (!mtk_wed_device_active(wed))
- 		return -ENODEV;
- 
--	if (msta->wcid.idx > MT7996_WTBL_STA)
-+	if (mlink->wcid.idx > MT7996_WTBL_STA)
- 		return -EIO;
- 
- 	path->type = DEV_PATH_MTK_WDMA;
-@@ -1711,11 +1766,11 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
- 	path->mtk_wdma.wdma_idx = wed->wdma_idx;
- 	path->mtk_wdma.bss = mconf->mt76.idx;
- 	path->mtk_wdma.queue = 0;
--	path->mtk_wdma.wcid = msta->wcid.idx;
-+	path->mtk_wdma.wcid = mlink->wcid.idx;
- 
- 	if (ieee80211_hw_check(hw, SUPPORTS_AMSDU_IN_AMPDU) &&
- 	    mtk_wed_is_amsdu_supported(wed))
--		path->mtk_wdma.amsdu = msta->wcid.amsdu;
-+		path->mtk_wdma.amsdu = mlink->wcid.amsdu;
- 	else
- 		path->mtk_wdma.amsdu = 0;
- 
-diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 11700f90f..6d2b517e0 100644
---- a/mt7996/mcu.c
-+++ b/mt7996/mcu.c
-@@ -117,13 +117,13 @@ mt7996_mcu_get_sta_nss(u16 mcs_map)
- }
- 
- static void
--mt7996_mcu_set_sta_he_mcs(struct ieee80211_sta *sta,
-+mt7996_mcu_set_sta_he_mcs(struct ieee80211_link_sta *link_sta,
- 			  struct mt7996_bss_conf *mconf,
- 			  __le16 *he_mcs, u16 mcs_map)
- {
- 	enum nl80211_band band = mconf->phy->mt76->chandef.chan->band;
- 	const u16 *mask = mconf->bitrate_mask.control[band].he_mcs;
--	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
-+	int nss, max_nss = link_sta->rx_nss > 3 ? 4 : link_sta->rx_nss;
- 
- 	for (nss = 0; nss < max_nss; nss++) {
- 		int mcs;
-@@ -166,11 +166,11 @@ mt7996_mcu_set_sta_he_mcs(struct ieee80211_sta *sta,
- }
- 
- static void
--mt7996_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
--			   const u16 *mask)
-+mt7996_mcu_set_sta_vht_mcs(struct ieee80211_link_sta *link_sta,
-+			   __le16 *vht_mcs, const u16 *mask)
- {
--	u16 mcs, mcs_map = le16_to_cpu(sta->deflink.vht_cap.vht_mcs.rx_mcs_map);
--	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
-+	u16 mcs, mcs_map = le16_to_cpu(link_sta->vht_cap.vht_mcs.rx_mcs_map);
-+	int nss, max_nss = link_sta->rx_nss > 3 ? 4 : link_sta->rx_nss;
- 
- 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
- 		switch (mcs_map & 0x3) {
-@@ -192,13 +192,13 @@ mt7996_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
- }
- 
- static void
--mt7996_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
-+mt7996_mcu_set_sta_ht_mcs(struct ieee80211_link_sta *link_sta, u8 *ht_mcs,
- 			  const u8 *mask)
- {
--	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
-+	int nss, max_nss = link_sta->rx_nss > 3 ? 4 : link_sta->rx_nss;
- 
- 	for (nss = 0; nss < max_nss; nss++)
--		ht_mcs[nss] = sta->deflink.ht_cap.mcs.rx_mask[nss] & mask[nss];
-+		ht_mcs[nss] = link_sta->ht_cap.mcs.rx_mask[nss] & mask[nss];
- }
- 
- static int
-@@ -531,14 +531,14 @@ static inline void __mt7996_stat_to_netdev(struct mt76_phy *mphy,
- 					   u32 tx_bytes, u32 rx_bytes,
- 					   u32 tx_packets, u32 rx_packets)
- {
--	struct mt7996_sta *msta;
-+	struct mt7996_link_sta *mlink;
- 	struct ieee80211_vif *vif;
- 	struct wireless_dev *wdev;
- 
- 	if (wiphy_ext_feature_isset(mphy->hw->wiphy,
- 				    NL80211_EXT_FEATURE_STAS_COUNT)) {
--		msta = container_of(wcid, struct mt7996_sta, wcid);
--		vif = container_of((void *)msta->vif, struct ieee80211_vif,
-+		mlink = container_of(wcid, struct mt7996_link_sta, wcid);
-+		vif = container_of((void *)mlink->sta->vif, struct ieee80211_vif,
- 				   drv_priv);
- 		wdev = ieee80211_vif_to_wdev(vif);
- 
-@@ -1236,10 +1236,10 @@ __mt7996_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
- 
- int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
- 			    struct ieee80211_bss_conf *conf,
--			    struct mt7996_bss_conf *mconf, int enable)
-+			    struct mt7996_bss_conf *mconf,
-+			    struct mt7996_link_sta *mlink, int enable)
- {
- 	struct ieee80211_vif *vif = conf->vif;
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
- 	struct mt7996_dev *dev = phy->dev;
- 	struct sk_buff *skb;
- 
-@@ -1255,7 +1255,7 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
- 
- 	/* bss_basic must be first */
- 	mt7996_mcu_bss_basic_tlv(skb, conf, mconf, NULL, phy->mt76,
--				 mvif->sta.wcid.idx, enable);
-+				 mlink->wcid.idx, enable);
- 	mt7996_mcu_bss_sec_tlv(skb, mconf);
- 
- 	if (vif->type == NL80211_IFTYPE_MONITOR)
-@@ -1335,9 +1335,10 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
- {
- 	struct mt7996_sta *msta = (struct mt7996_sta *)params->sta->drv_priv;
- 	struct mt7996_bss_conf *mconf = mconf_dereference_protected(msta->vif, 0);
-+	struct mt7996_link_sta *mlink = mlink_dereference_protected(msta, 0);
- 
- 	if (enable && !params->amsdu)
--		msta->wcid.amsdu = false;
-+		mlink->wcid.amsdu = false;
- 
- 	return mt7996_mcu_sta_ba(dev, &mconf->mt76, params, enable, true);
- }
-@@ -1355,15 +1356,15 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
- static void
- mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
- 		      struct mt7996_bss_conf *mconf,
--		      struct ieee80211_sta *sta)
-+		      struct ieee80211_link_sta *link_sta)
- {
--	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
-+	struct ieee80211_he_cap_elem *elem = &link_sta->he_cap.he_cap_elem;
- 	struct ieee80211_he_mcs_nss_supp mcs_map;
- 	struct sta_rec_he_v2 *he;
- 	struct tlv *tlv;
- 	int i = 0;
- 
--	if (!sta->deflink.he_cap.has_he)
-+	if (!link_sta->he_cap.has_he)
- 		return;
- 
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_V2, sizeof(*he));
-@@ -1380,21 +1381,21 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
- 		u8p_replace_bits(&he->he_phy_cap[1], conf->he_ldpc,
- 				 IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD);
- 
--	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
--	switch (sta->deflink.bandwidth) {
-+	mcs_map = link_sta->he_cap.he_mcs_nss_supp;
-+	switch (link_sta->bandwidth) {
- 	case IEEE80211_STA_RX_BW_160:
- 		if (elem->phy_cap_info[0] &
- 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
--			mt7996_mcu_set_sta_he_mcs(sta, mconf,
-+			mt7996_mcu_set_sta_he_mcs(link_sta, mconf,
- 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
- 						  le16_to_cpu(mcs_map.rx_mcs_80p80));
- 
--		mt7996_mcu_set_sta_he_mcs(sta, mconf,
-+		mt7996_mcu_set_sta_he_mcs(link_sta, mconf,
- 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
- 					  le16_to_cpu(mcs_map.rx_mcs_160));
- 		fallthrough;
- 	default:
--		mt7996_mcu_set_sta_he_mcs(sta, mconf,
-+		mt7996_mcu_set_sta_he_mcs(link_sta, mconf,
- 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
- 					  le16_to_cpu(mcs_map.rx_mcs_80));
- 		break;
-@@ -1404,24 +1405,25 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
- }
- 
- static void
--mt7996_mcu_sta_he_6g_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
-+mt7996_mcu_sta_he_6g_tlv(struct sk_buff *skb,
-+			 struct ieee80211_link_sta *link_sta)
- {
- 	struct sta_rec_he_6g_capa *he_6g;
- 	struct tlv *tlv;
- 
--	if (!sta->deflink.he_6ghz_capa.capa)
-+	if (!link_sta->he_6ghz_capa.capa)
- 		return;
- 
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G, sizeof(*he_6g));
- 
- 	he_6g = (struct sta_rec_he_6g_capa *)tlv;
--	he_6g->capa = sta->deflink.he_6ghz_capa.capa;
-+	he_6g->capa = link_sta->he_6ghz_capa.capa;
- }
- 
- static void
--mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
-+mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
- {
--	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_sta *msta = (struct mt7996_sta *)link_sta->sta->drv_priv;
- 	struct ieee80211_vif *vif = container_of((void *)msta->vif,
- 						 struct ieee80211_vif, drv_priv);
- 	struct ieee80211_eht_mcs_nss_supp *mcs_map;
-@@ -1429,11 +1431,11 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
- 	struct sta_rec_eht *eht;
- 	struct tlv *tlv;
- 
--	if (!sta->deflink.eht_cap.has_eht)
-+	if (!link_sta->eht_cap.has_eht)
- 		return;
- 
--	mcs_map = &sta->deflink.eht_cap.eht_mcs_nss_supp;
--	elem = &sta->deflink.eht_cap.eht_cap_elem;
-+	mcs_map = &link_sta->eht_cap.eht_mcs_nss_supp;
-+	elem = &link_sta->eht_cap.eht_cap_elem;
- 
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT, sizeof(*eht));
- 
-@@ -1444,7 +1446,7 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
- 	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
- 
- 	if (vif->type != NL80211_IFTYPE_STATION &&
--	    (sta->deflink.he_cap.he_cap_elem.phy_cap_info[0] &
-+	    (link_sta->he_cap.he_cap_elem.phy_cap_info[0] &
- 	     (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G |
- 	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
- 	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
-@@ -1460,44 +1462,44 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
- }
- 
- static void
--mt7996_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
-+mt7996_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
- {
- 	struct sta_rec_ht_uni *ht;
- 	struct tlv *tlv;
- 
--	if (!sta->deflink.ht_cap.ht_supported)
-+	if (!link_sta->ht_cap.ht_supported)
- 		return;
- 
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
- 
- 	ht = (struct sta_rec_ht_uni *)tlv;
--	ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
--	ht->ampdu_param = u8_encode_bits(sta->deflink.ht_cap.ampdu_factor,
-+	ht->ht_cap = cpu_to_le16(link_sta->ht_cap.cap);
-+	ht->ampdu_param = u8_encode_bits(link_sta->ht_cap.ampdu_factor,
- 					 IEEE80211_HT_AMPDU_PARM_FACTOR) |
--			  u8_encode_bits(sta->deflink.ht_cap.ampdu_density,
-+			  u8_encode_bits(link_sta->ht_cap.ampdu_density,
- 					 IEEE80211_HT_AMPDU_PARM_DENSITY);
- }
- 
- static void
--mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
-+mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
- {
- 	struct sta_rec_vht *vht;
- 	struct tlv *tlv;
- #ifdef CONFIG_MTK_VENDOR
--	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_sta *msta = (struct mt7996_sta *)link_sta->sta->drv_priv;
- 	struct mt7996_phy *phy = (struct mt7996_phy *)msta->vif->deflink.phy;
- #endif
- 
- 	/* For 6G band, this tlv is necessary to let hw work normally */
--	if (!sta->deflink.he_6ghz_capa.capa && !sta->deflink.vht_cap.vht_supported)
-+	if (!link_sta->he_6ghz_capa.capa && !link_sta->vht_cap.vht_supported)
- 		return;
- 
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
- 
- 	vht = (struct sta_rec_vht *)tlv;
--	vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
--	vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
--	vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
-+	vht->vht_cap = cpu_to_le32(link_sta->vht_cap.cap);
-+	vht->vht_rx_mcs_map = link_sta->vht_cap.vht_mcs.rx_mcs_map;
-+	vht->vht_tx_mcs_map = link_sta->vht_cap.vht_mcs.tx_mcs_map;
- #ifdef CONFIG_MTK_VENDOR
- 	vht->rts_bw_sig = phy->rts_bw_sig;
- #endif
-@@ -1505,9 +1507,10 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
- 
- static void
- mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
--			 struct ieee80211_vif *vif, struct ieee80211_sta *sta)
-+			 struct ieee80211_vif *vif,
-+			 struct ieee80211_link_sta *link_sta,
-+			 struct mt7996_link_sta *mlink)
- {
--	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
- 	struct sta_rec_amsdu *amsdu;
- 	struct tlv *tlv;
- 
-@@ -1516,16 +1519,16 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- 	    vif->type != NL80211_IFTYPE_AP)
- 		return;
- 
--	if (!sta->deflink.agg.max_amsdu_len)
-+	if (!link_sta->agg.max_amsdu_len)
- 		return;
- 
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
- 	amsdu = (struct sta_rec_amsdu *)tlv;
- 	amsdu->max_amsdu_num = 8;
- 	amsdu->amsdu_en = true;
--	msta->wcid.amsdu = true;
-+	mlink->wcid.amsdu = true;
- 
--	switch (sta->deflink.agg.max_amsdu_len) {
-+	switch (link_sta->agg.max_amsdu_len) {
- 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
- 		amsdu->max_mpdu_size =
- 			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
-@@ -1544,10 +1547,10 @@ static void
- mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- 			struct ieee80211_bss_conf *conf,
- 			struct mt7996_bss_conf *mconf,
--			struct ieee80211_sta *sta)
-+			struct ieee80211_link_sta *link_sta)
- {
- 	struct mt7996_phy *phy = mconf->phy;
--	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
-+	struct ieee80211_he_cap_elem *elem = &link_sta->he_cap.he_cap_elem;
- 	struct sta_rec_muru *muru;
- 	struct tlv *tlv;
- 
-@@ -1567,11 +1570,11 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- 	muru->cfg.ofdma_dl_en = !!(phy->muru_onoff & OFDMA_DL);
- 	muru->cfg.ofdma_ul_en = !!(phy->muru_onoff & OFDMA_UL);
- 
--	if (sta->deflink.vht_cap.vht_supported)
-+	if (link_sta->vht_cap.vht_supported)
- 		muru->mimo_dl.vht_mu_bfee =
--			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
-+			!!(link_sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
- 
--	if (!sta->deflink.he_cap.has_he)
-+	if (!link_sta->he_cap.has_he)
- 		return;
- 
- 	muru->mimo_dl.partial_bw_dl_mimo =
-@@ -1604,7 +1607,7 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- static inline bool
- mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
- 			struct mt7996_bss_conf *mconf,
--			struct ieee80211_sta *sta, bool bfee)
-+			struct ieee80211_link_sta *link_sta, bool bfee)
- {
- 	int sts = hweight16(phy->mt76->chainmask);
- 
-@@ -1615,8 +1618,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
- 	if (!bfee && sts < 2)
- 		return false;
- 
--	if (sta->deflink.eht_cap.has_eht) {
--		struct ieee80211_sta_eht_cap *pc = &sta->deflink.eht_cap;
-+	if (link_sta->eht_cap.has_eht) {
-+		struct ieee80211_sta_eht_cap *pc = &link_sta->eht_cap;
- 		struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
- 
- 		if (bfee)
-@@ -1627,8 +1630,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
- 			       EHT_PHY(CAP0_SU_BEAMFORMER, pe->phy_cap_info[0]);
- 	}
- 
--	if (sta->deflink.he_cap.has_he) {
--		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
-+	if (link_sta->he_cap.has_he) {
-+		struct ieee80211_he_cap_elem *pe = &link_sta->he_cap.he_cap_elem;
- 
- 		if (bfee)
- 			return conf->he_su_beamformee &&
-@@ -1638,8 +1641,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
- 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
- 	}
- 
--	if (sta->deflink.vht_cap.vht_supported) {
--		u32 cap = sta->deflink.vht_cap.cap;
-+	if (link_sta->vht_cap.vht_supported) {
-+		u32 cap = link_sta->vht_cap.cap;
- 
- 		if (bfee)
- 			return conf->vht_su_beamformee &&
-@@ -1662,10 +1665,10 @@ mt7996_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
- }
- 
- static void
--mt7996_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
--		       struct sta_rec_bf *bf)
-+mt7996_mcu_sta_bfer_ht(struct ieee80211_link_sta *link_sta,
-+		       struct mt7996_phy *phy, struct sta_rec_bf *bf)
- {
--	struct ieee80211_mcs_info *mcs = &sta->deflink.ht_cap.mcs;
-+	struct ieee80211_mcs_info *mcs = &link_sta->ht_cap.mcs;
- 	u8 n = 0;
- 
- 	bf->tx_mode = MT_PHY_TYPE_HT;
-@@ -1687,10 +1690,11 @@ mt7996_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
- }
- 
- static void
--mt7996_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
--			struct sta_rec_bf *bf, bool explicit)
-+mt7996_mcu_sta_bfer_vht(struct ieee80211_link_sta *link_sta,
-+			struct mt7996_phy *phy, struct sta_rec_bf *bf,
-+			bool explicit)
- {
--	struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
-+	struct ieee80211_sta_vht_cap *pc = &link_sta->vht_cap;
- 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
- 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
- 	u8 nss_mcs = mt7996_mcu_get_sta_nss(mcs_map);
-@@ -1711,23 +1715,24 @@ mt7996_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
- 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
- 		bf->ibf_ncol = bf->ncol;
- 
--		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
-+		if (link_sta->bandwidth == IEEE80211_STA_RX_BW_160)
- 			bf->nrow = 1;
- 	} else {
- 		bf->nrow = tx_ant;
- 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
- 		bf->ibf_ncol = nss_mcs;
- 
--		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
-+		if (link_sta->bandwidth == IEEE80211_STA_RX_BW_160)
- 			bf->ibf_nrow = 1;
- 	}
- }
- 
- static void
--mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
--		       struct mt7996_phy *phy, struct sta_rec_bf *bf)
-+mt7996_mcu_sta_bfer_he(struct ieee80211_link_sta *link_sta,
-+		       struct ieee80211_vif *vif, struct mt7996_phy *phy,
-+		       struct sta_rec_bf *bf)
- {
--	struct ieee80211_sta_he_cap *pc = &sta->deflink.he_cap;
-+	struct ieee80211_sta_he_cap *pc = &link_sta->he_cap;
- 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
- 	const struct ieee80211_sta_he_cap *vc =
- 		mt76_connac_get_he_phy_cap(phy->mt76, vif);
-@@ -1752,7 +1757,7 @@ mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
- 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
- 	bf->ibf_ncol = bf->ncol;
- 
--	if (sta->deflink.bandwidth != IEEE80211_STA_RX_BW_160)
-+	if (link_sta->bandwidth != IEEE80211_STA_RX_BW_160)
- 		return;
- 
- 	/* go over for 160MHz and 80p80 */
-@@ -1784,10 +1789,11 @@ mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
- }
- 
- static void
--mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
--			struct mt7996_phy *phy, struct sta_rec_bf *bf)
-+mt7996_mcu_sta_bfer_eht(struct ieee80211_link_sta *link_sta,
-+			struct ieee80211_vif *vif, struct mt7996_phy *phy,
-+			struct sta_rec_bf *bf)
- {
--	struct ieee80211_sta_eht_cap *pc = &sta->deflink.eht_cap;
-+	struct ieee80211_sta_eht_cap *pc = &link_sta->eht_cap;
- 	struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
- 	struct ieee80211_eht_mcs_nss_supp *eht_nss = &pc->eht_mcs_nss_supp;
- 	const struct ieee80211_sta_eht_cap *vc =
-@@ -1810,10 +1816,10 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
- 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
- 	bf->ibf_ncol = bf->ncol;
- 
--	if (sta->deflink.bandwidth < IEEE80211_STA_RX_BW_160)
-+	if (link_sta->bandwidth < IEEE80211_STA_RX_BW_160)
- 		return;
- 
--	switch (sta->deflink.bandwidth) {
-+	switch (link_sta->bandwidth) {
- 	case IEEE80211_STA_RX_BW_160:
- 		snd_dim = EHT_PHY(CAP2_SOUNDING_DIM_160MHZ_MASK, ve->phy_cap_info[2]);
- 		sts = EHT_PHY(CAP1_BEAMFORMEE_SS_160MHZ_MASK, pe->phy_cap_info[1]);
-@@ -1842,7 +1848,7 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
- static void
- mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- 			struct ieee80211_bss_conf *conf, struct mt7996_bss_conf *mconf,
--			struct ieee80211_sta *sta)
-+			struct ieee80211_link_sta *link_sta)
- {
- 	struct mt7996_phy *phy = mconf->phy;
- 	int tx_ant = hweight16(phy->mt76->chainmask) - 1;
-@@ -1856,10 +1862,10 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- 	};
- 	bool ebf;
- 
--	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
-+	if (!(link_sta->ht_cap.ht_supported || link_sta->he_cap.has_he))
- 		return;
- 
--	ebf = mt7996_is_ebf_supported(phy, conf, mconf, sta, false);
-+	ebf = mt7996_is_ebf_supported(phy, conf, mconf, link_sta, false);
- 	if (!ebf && !dev->ibf)
- 		return;
- 
-@@ -1870,23 +1876,23 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- 	 * vht: support eBF and iBF
- 	 * ht: iBF only, since mac80211 lacks of eBF support
- 	 */
--	if (sta->deflink.eht_cap.has_eht && ebf)
--		mt7996_mcu_sta_bfer_eht(sta, conf->vif, phy, bf);
--	else if (sta->deflink.he_cap.has_he && ebf)
--		mt7996_mcu_sta_bfer_he(sta, conf->vif, phy, bf);
--	else if (sta->deflink.vht_cap.vht_supported)
--		mt7996_mcu_sta_bfer_vht(sta, phy, bf, ebf);
--	else if (sta->deflink.ht_cap.ht_supported)
--		mt7996_mcu_sta_bfer_ht(sta, phy, bf);
-+	if (link_sta->eht_cap.has_eht && ebf)
-+		mt7996_mcu_sta_bfer_eht(link_sta, conf->vif, phy, bf);
-+	else if (link_sta->he_cap.has_he && ebf)
-+		mt7996_mcu_sta_bfer_he(link_sta, conf->vif, phy, bf);
-+	else if (link_sta->vht_cap.vht_supported)
-+		mt7996_mcu_sta_bfer_vht(link_sta, phy, bf, ebf);
-+	else if (link_sta->ht_cap.ht_supported)
-+		mt7996_mcu_sta_bfer_ht(link_sta, phy, bf);
- 	else
- 		return;
- 
- 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
--	bf->bw = sta->deflink.bandwidth;
--	bf->ibf_dbw = sta->deflink.bandwidth;
-+	bf->bw = link_sta->bandwidth;
-+	bf->ibf_dbw = link_sta->bandwidth;
- 	bf->ibf_nrow = tx_ant;
- 
--	if (!ebf && sta->deflink.bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
-+	if (!ebf && link_sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
- 		bf->ibf_timeout = 0x48;
- 	else
- 		bf->ibf_timeout = 0x18;
-@@ -1896,7 +1902,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- 	else
- 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
- 
--	switch (sta->deflink.bandwidth) {
-+	switch (link_sta->bandwidth) {
- 	case IEEE80211_STA_RX_BW_160:
- 	case IEEE80211_STA_RX_BW_80:
- 		bf->mem_total = bf->mem_20m * 2;
-@@ -1913,7 +1919,8 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- static void
- mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- 			struct ieee80211_bss_conf *conf,
--			struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta)
-+			struct mt7996_bss_conf *mconf,
-+			struct ieee80211_link_sta *link_sta)
- {
- 	struct mt7996_phy *phy = mconf->phy;
- 	int tx_ant = hweight8(phy->mt76->antenna_mask) - 1;
-@@ -1921,22 +1928,22 @@ mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- 	struct tlv *tlv;
- 	u8 nrow = 0;
- 
--	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
-+	if (!(link_sta->vht_cap.vht_supported || link_sta->he_cap.has_he))
- 		return;
- 
--	if (!mt7996_is_ebf_supported(phy, conf, mconf, sta, true))
-+	if (!mt7996_is_ebf_supported(phy, conf, mconf, link_sta, true))
- 		return;
- 
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
- 	bfee = (struct sta_rec_bfee *)tlv;
- 
--	if (sta->deflink.he_cap.has_he) {
--		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
-+	if (link_sta->he_cap.has_he) {
-+		struct ieee80211_he_cap_elem *pe = &link_sta->he_cap.he_cap_elem;
- 
- 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
- 			      pe->phy_cap_info[5]);
--	} else if (sta->deflink.vht_cap.vht_supported) {
--		struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
-+	} else if (link_sta->vht_cap.vht_supported) {
-+		struct ieee80211_sta_vht_cap *pc = &link_sta->vht_cap;
- 
- 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
- 				 pc->cap);
-@@ -1973,25 +1980,24 @@ mt7996_mcu_sta_hdrt_tlv(struct mt7996_dev *dev, struct sk_buff *skb)
- static void
- mt7996_mcu_sta_hdr_trans_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
- 			     struct ieee80211_vif *vif,
--			     struct ieee80211_sta *sta)
-+			     struct mt7996_link_sta *mlink)
- {
- 	struct sta_rec_hdr_trans *hdr_trans;
--	struct mt76_wcid *wcid;
-+	struct mt76_wcid *wcid = &mlink->wcid;
- 	struct tlv *tlv;
- 
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HDR_TRANS, sizeof(*hdr_trans));
- 	hdr_trans = (struct sta_rec_hdr_trans *)tlv;
- 	hdr_trans->dis_rx_hdr_tran = true;
- 
-+	if (!wcid->sta)
-+		return;
-+
- 	if (vif->type == NL80211_IFTYPE_STATION)
- 		hdr_trans->to_ds = true;
- 	else
- 		hdr_trans->from_ds = true;
- 
--	if (!sta)
--		return;
--
--	wcid = (struct mt76_wcid *)sta->drv_priv;
- 	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
- 	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
- 		hdr_trans->to_ds = true;
-@@ -2048,16 +2054,17 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
- 
- int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
- 			       struct mt7996_bss_conf *mconf,
--			       struct ieee80211_sta *sta, void *data, u32 field)
-+			       struct ieee80211_link_sta *link_sta,
-+			       struct mt7996_link_sta *mlink, void *data,
-+			       u32 field)
- {
--	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
- 	struct sta_phy_uni *phy = data;
- 	struct sta_rec_ra_fixed_uni *ra;
- 	struct sk_buff *skb;
- 	struct tlv *tlv;
- 
- 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
--					      &msta->wcid,
-+					      &mlink->wcid,
- 					      MT7996_STA_UPDATE_MAX_SIZE);
- 	if (IS_ERR(skb))
- 		return PTR_ERR(skb);
-@@ -2076,7 +2083,7 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
- 			ra->phy = *phy;
- 		break;
- 	case RATE_PARAM_MMPS_UPDATE:
--		ra->mmps_mode = mt7996_mcu_get_mmps_mode(sta->deflink.smps_mode);
-+		ra->mmps_mode = mt7996_mcu_get_mmps_mode(link_sta->smps_mode);
- 		break;
- 	default:
- 		break;
-@@ -2091,7 +2098,8 @@ static int
- mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
- 			       struct ieee80211_bss_conf *conf,
- 			       struct mt7996_bss_conf *mconf,
--			       struct ieee80211_sta *sta)
-+			       struct ieee80211_link_sta *link_sta,
-+			       struct mt7996_link_sta *mlink)
- {
- 	struct cfg80211_chan_def *chandef = &mconf->phy->mt76->chandef;
- 	struct cfg80211_bitrate_mask *mask = &mconf->bitrate_mask;
-@@ -2115,11 +2123,11 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
- 		}								\
- 	} while (0)
- 
--	if (sta->deflink.he_cap.has_he) {
-+	if (link_sta->he_cap.has_he) {
- 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
--	} else if (sta->deflink.vht_cap.vht_supported) {
-+	} else if (link_sta->vht_cap.vht_supported) {
- 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
--	} else if (sta->deflink.ht_cap.ht_supported) {
-+	} else if (link_sta->ht_cap.ht_supported) {
- 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
- 	} else {
- 		nrates = hweight32(mask->control[band].legacy);
-@@ -2136,8 +2144,8 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
- 
- 	/* fixed single rate */
- 	if (nrates == 1) {
--		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
--						 RATE_PARAM_FIXED_MCS);
-+		ret = mt7996_mcu_set_fixed_field(dev, mconf, link_sta, mlink,
-+						 &phy, RATE_PARAM_FIXED_MCS);
- 		if (ret)
- 			return ret;
- 	}
-@@ -2145,29 +2153,28 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
- 	/* fixed GI */
- 	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
- 	    mask->control[band].he_gi != GENMASK(7, 0)) {
--		struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
- 		u32 addr;
- 
- 		/* firmware updates only TXCMD but doesn't take WTBL into
- 		 * account, so driver should update here to reflect the
- 		 * actual txrate hardware sends out.
- 		 */
--		addr = mt7996_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
--		if (sta->deflink.he_cap.has_he)
-+		addr = mt7996_mac_wtbl_lmac_addr(dev, mlink->wcid.idx, 7);
-+		if (link_sta->he_cap.has_he)
- 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
- 		else
- 			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
- 
--		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
--						 RATE_PARAM_FIXED_GI);
-+		ret = mt7996_mcu_set_fixed_field(dev, mconf, link_sta, mlink,
-+						 &phy, RATE_PARAM_FIXED_GI);
- 		if (ret)
- 			return ret;
- 	}
- 
- 	/* fixed HE_LTF */
- 	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
--		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
--						 RATE_PARAM_FIXED_HE_LTF);
-+		ret = mt7996_mcu_set_fixed_field(dev, mconf, link_sta, mlink,
-+						 &phy, RATE_PARAM_FIXED_HE_LTF);
- 		if (ret)
- 			return ret;
- 	}
-@@ -2179,7 +2186,7 @@ static void
- mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
- 			     struct ieee80211_bss_conf *conf,
- 			     struct mt7996_bss_conf *mconf,
--			     struct ieee80211_sta *sta)
-+			     struct ieee80211_link_sta *link_sta)
- {
- #define INIT_RCPI 180
- 	struct mt76_phy *mphy = mconf->phy->mt76;
-@@ -2188,20 +2195,20 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
- 	enum nl80211_band band = chandef->chan->band;
- 	struct sta_rec_ra_uni *ra;
- 	struct tlv *tlv;
--	u32 supp_rate = sta->deflink.supp_rates[band];
--	u32 cap = sta->wme ? STA_CAP_WMM : 0;
-+	u32 supp_rate = link_sta->supp_rates[band];
-+	u32 cap = link_sta->sta->wme ? STA_CAP_WMM : 0;
- 
- 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
- 	ra = (struct sta_rec_ra_uni *)tlv;
- 
- 	ra->valid = true;
- 	ra->auto_rate = true;
--	ra->phy_mode = mt76_connac_get_phy_mode(mphy, conf->vif, band, sta);
-+	ra->phy_mode = mt76_connac_get_phy_mode(mphy, conf->vif, band, link_sta);
- 	ra->channel = chandef->chan->hw_value;
--	ra->bw = (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_320) ?
--		 CMD_CBW_320MHZ : sta->deflink.bandwidth;
-+	ra->bw = (link_sta->bandwidth == IEEE80211_STA_RX_BW_320) ?
-+		 CMD_CBW_320MHZ : link_sta->bandwidth;
- 	ra->phy.bw = ra->bw;
--	ra->mmps_mode = mt7996_mcu_get_mmps_mode(sta->deflink.smps_mode);
-+	ra->mmps_mode = mt7996_mcu_get_mmps_mode(link_sta->smps_mode);
- 
- 	if (supp_rate) {
- 		supp_rate &= mask->control[band].legacy;
-@@ -2221,60 +2228,60 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
- 		}
- 	}
- 
--	if (sta->deflink.ht_cap.ht_supported) {
-+	if (link_sta->ht_cap.ht_supported) {
- 		ra->supp_mode |= MODE_HT;
--		ra->af = sta->deflink.ht_cap.ampdu_factor;
--		ra->ht_gf = !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
-+		ra->af = link_sta->ht_cap.ampdu_factor;
-+		ra->ht_gf = !!(link_sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
- 
- 		cap |= STA_CAP_HT;
--		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
-+		if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
- 			cap |= STA_CAP_SGI_20;
--		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
-+		if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
- 			cap |= STA_CAP_SGI_40;
--		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
-+		if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
- 			cap |= STA_CAP_TX_STBC;
--		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
-+		if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
- 			cap |= STA_CAP_RX_STBC;
- 		if (conf->ht_ldpc &&
--		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
-+		    (link_sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
- 			cap |= STA_CAP_LDPC;
- 
--		mt7996_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
-+		mt7996_mcu_set_sta_ht_mcs(link_sta, ra->ht_mcs,
- 					  mask->control[band].ht_mcs);
- 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
- 	}
- 
--	if (sta->deflink.vht_cap.vht_supported) {
-+	if (link_sta->vht_cap.vht_supported) {
- 		u8 af;
- 
- 		ra->supp_mode |= MODE_VHT;
- 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
--			       sta->deflink.vht_cap.cap);
-+			       link_sta->vht_cap.cap);
- 		ra->af = max_t(u8, ra->af, af);
- 
- 		cap |= STA_CAP_VHT;
--		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
-+		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
- 			cap |= STA_CAP_VHT_SGI_80;
--		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
-+		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
- 			cap |= STA_CAP_VHT_SGI_160;
--		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
-+		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
- 			cap |= STA_CAP_VHT_TX_STBC;
--		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
-+		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
- 			cap |= STA_CAP_VHT_RX_STBC;
- 		if (conf->vht_ldpc &&
--		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
-+		    (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
- 			cap |= STA_CAP_VHT_LDPC;
- 
--		mt7996_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
-+		mt7996_mcu_set_sta_vht_mcs(link_sta, ra->supp_vht_mcs,
- 					   mask->control[band].vht_mcs);
- 	}
- 
--	if (sta->deflink.he_cap.has_he) {
-+	if (link_sta->he_cap.has_he) {
- 		ra->supp_mode |= MODE_HE;
- 		cap |= STA_CAP_HE;
- 
--		if (sta->deflink.he_6ghz_capa.capa)
--			ra->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
-+		if (link_sta->he_6ghz_capa.capa)
-+			ra->af = le16_get_bits(link_sta->he_6ghz_capa.capa,
- 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
- 	}
- 	ra->sta_cap = cpu_to_le32(cap);
-@@ -2285,14 +2292,14 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
- int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
- 			     struct ieee80211_bss_conf *conf,
- 			     struct mt7996_bss_conf *mconf,
--			     struct ieee80211_sta *sta, bool changed)
-+			     struct ieee80211_link_sta *link_sta,
-+			     struct mt7996_link_sta *mlink, bool changed)
- {
--	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
- 	struct sk_buff *skb;
- 	int ret;
- 
- 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
--					      &msta->wcid,
-+					      &mlink->wcid,
- 					      MT7996_STA_UPDATE_MAX_SIZE);
- 	if (IS_ERR(skb))
- 		return PTR_ERR(skb);
-@@ -2302,26 +2309,27 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
- 	 * update sta_rec_he here.
- 	 */
- 	if (changed)
--		mt7996_mcu_sta_he_tlv(skb, conf, mconf, sta);
-+		mt7996_mcu_sta_he_tlv(skb, conf, mconf, link_sta);
- 
- 	/* sta_rec_ra accommodates BW, NSS and only MCS range format
- 	 * i.e 0-{7,8,9} for VHT.
- 	 */
--	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, conf, mconf, sta);
-+	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, conf, mconf, link_sta);
- 
- 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
- 				    MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
- 	if (ret)
- 		return ret;
- 
--	return mt7996_mcu_add_rate_ctrl_fixed(dev, conf, mconf, sta);
-+	return mt7996_mcu_add_rate_ctrl_fixed(dev, conf, mconf, link_sta, mlink);
- }
- 
- static int
--mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf, struct mt7996_sta *msta)
-+mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf,
-+			struct mt7996_link_sta *mlink)
- {
- 	struct mt7996_phy *phy = mconf->phy;
--	struct mt7996_vow_sta_ctrl *vow = &msta->vow;
-+	struct mt7996_vow_sta_ctrl *vow = &mlink->vow;
- 	u8 omac_idx = mconf->mt76.omac_idx;
- 	int ret;
- 
-@@ -2339,73 +2347,70 @@ mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf, struct mt7996_sta *msta)
- 	vow->drr_quantum[IEEE80211_AC_BE] = VOW_DRR_QUANTUM_IDX2;
- 	vow->drr_quantum[IEEE80211_AC_BK] = VOW_DRR_QUANTUM_IDX2;
- 
--	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_BSS_GROUP);
-+	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, mlink, VOW_DRR_CTRL_STA_BSS_GROUP);
- 	if (ret)
- 		return ret;
- 
--	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_PAUSE);
-+	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, mlink, VOW_DRR_CTRL_STA_PAUSE);
- 	if (ret)
- 		return ret;
- 
--	return mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_ALL);
-+	return mt7996_mcu_set_vow_drr_ctrl(phy, mconf, mlink, VOW_DRR_CTRL_STA_ALL);
- }
- 
- int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
--		       struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta,
--		       bool enable, bool newly)
-+		       struct mt7996_bss_conf *mconf,
-+		       struct ieee80211_link_sta *link_sta,
-+		       struct mt7996_link_sta *mlink, bool enable, bool newly)
- {
- 	struct ieee80211_vif *vif = conf->vif;
--	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
--	struct mt7996_sta *msta;
- 	struct sk_buff *skb;
- 	int ret;
- 
--	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mvif->sta;
--
- 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
--					      &msta->wcid,
-+					      &mlink->wcid,
- 					      MT7996_STA_UPDATE_MAX_SIZE);
- 	if (IS_ERR(skb))
- 		return PTR_ERR(skb);
- 
- 	/* starec basic */
--	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, sta, enable, newly);
-+	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, link_sta, enable, newly);
- 
- 	if (!enable)
- 		goto out;
- 
- 	/* starec hdr trans */
--	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, sta);
-+	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, mlink);
- 	/* starec tx proc */
- 	mt7996_mcu_sta_tx_proc_tlv(skb);
- 
- 	/* tag order is in accordance with firmware dependency. */
--	if (sta) {
-+	if (link_sta) {
- 		/* starec hdrt mode */
- 		mt7996_mcu_sta_hdrt_tlv(dev, skb);
- 		/* starec bfer */
--		mt7996_mcu_sta_bfer_tlv(dev, skb, conf, mconf, sta);
-+		mt7996_mcu_sta_bfer_tlv(dev, skb, conf, mconf, link_sta);
- 		/* starec ht */
--		mt7996_mcu_sta_ht_tlv(skb, sta);
-+		mt7996_mcu_sta_ht_tlv(skb, link_sta);
- 		/* starec vht */
--		mt7996_mcu_sta_vht_tlv(skb, sta);
-+		mt7996_mcu_sta_vht_tlv(skb, link_sta);
- 		/* starec uapsd */
--		mt76_connac_mcu_sta_uapsd(skb, vif, sta);
-+		mt76_connac_mcu_sta_uapsd(skb, vif, link_sta->sta);
- 		/* starec amsdu */
--		mt7996_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
-+		mt7996_mcu_sta_amsdu_tlv(dev, skb, vif, link_sta, mlink);
- 		/* starec he */
--		mt7996_mcu_sta_he_tlv(skb, conf, mconf, sta);
-+		mt7996_mcu_sta_he_tlv(skb, conf, mconf, link_sta);
- 		/* starec he 6g*/
--		mt7996_mcu_sta_he_6g_tlv(skb, sta);
-+		mt7996_mcu_sta_he_6g_tlv(skb, link_sta);
- 		/* starec eht */
--		mt7996_mcu_sta_eht_tlv(skb, sta);
-+		mt7996_mcu_sta_eht_tlv(skb, link_sta);
- 		/* starec muru */
--		mt7996_mcu_sta_muru_tlv(dev, skb, conf, mconf, sta);
-+		mt7996_mcu_sta_muru_tlv(dev, skb, conf, mconf, link_sta);
- 		/* starec bfee */
--		mt7996_mcu_sta_bfee_tlv(dev, skb, conf, mconf, sta);
-+		mt7996_mcu_sta_bfee_tlv(dev, skb, conf, mconf, link_sta);
- 	}
- 
--	ret = mt7996_mcu_sta_init_vow(mconf, msta);
-+	ret = mt7996_mcu_sta_init_vow(mconf, mlink);
- 	if (ret) {
- 		dev_kfree_skb(skb);
- 		return ret;
-@@ -2481,16 +2486,16 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
- 
- static int mt7996_mcu_get_pn(struct mt7996_dev *dev,
- 			     struct ieee80211_bss_conf *conf,
--			     struct mt7996_bss_conf *mconf, u8 *pn)
-+			     struct mt7996_bss_conf *mconf,
-+			     struct mt7996_link_sta *mlink, u8 *pn)
- {
- #define TSC_TYPE_BIGTK_PN 2
--	struct mt7996_vif *mvif = (struct mt7996_vif *)conf->vif->drv_priv;
- 	struct sta_rec_pn_info *pn_info;
- 	struct sk_buff *skb, *rskb;
- 	struct tlv *tlv;
- 	int ret;
- 
--	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76, &mvif->sta.wcid);
-+	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76, &mlink->wcid);
- 	if (IS_ERR(skb))
- 		return PTR_ERR(skb);
- 
-@@ -2517,6 +2522,7 @@ static int mt7996_mcu_get_pn(struct mt7996_dev *dev,
- int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
- 			       struct ieee80211_bss_conf *conf,
- 			       struct mt7996_bss_conf *mconf,
-+			       struct mt7996_link_sta *mlink,
- 			       struct ieee80211_key_conf *key)
- {
- 	struct mt7996_mcu_bcn_prot_tlv *bcn_prot;
-@@ -2535,7 +2541,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
- 
- 	bcn_prot = (struct mt7996_mcu_bcn_prot_tlv *)tlv;
- 
--	ret = mt7996_mcu_get_pn(dev, conf, mconf, pn);
-+	ret = mt7996_mcu_get_pn(dev, conf, mconf, mlink, pn);
- 	if (ret) {
- 		dev_kfree_skb(skb);
- 		return ret;
-@@ -4811,21 +4817,18 @@ int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev, bool disable
- int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
- 				     struct ieee80211_vif *vif,
- 				     struct mt7996_bss_conf *mconf,
--				     struct ieee80211_sta *sta)
-+				     struct mt7996_link_sta *mlink)
- {
--	struct mt7996_sta *msta;
- 	struct sk_buff *skb;
- 
--	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mconf->vif->sta;
--
- 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
--					      &msta->wcid,
-+					      &mlink->wcid,
- 					      MT7996_STA_UPDATE_MAX_SIZE);
- 	if (IS_ERR(skb))
- 		return PTR_ERR(skb);
- 
- 	/* starec hdr trans */
--	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, sta);
-+	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, mlink);
- 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
- 				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
- }
-@@ -5014,7 +5017,7 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
- 	switch (tag) {
- 	case UNI_PER_STA_RSSI:
- 		for (i = 0; i < sta_num; ++i) {
--			struct mt7996_sta *msta;
-+			struct mt7996_link_sta *mlink;
- 			struct mt76_phy *phy;
- 			s8 rssi[4];
- 			u8 *rcpi;
-@@ -5028,10 +5031,10 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
- 				rssi[2] = to_rssi(MT_PRXV_RCPI0, rcpi[2]);
- 				rssi[3] = to_rssi(MT_PRXV_RCPI0, rcpi[3]);
- 
--				msta = container_of(wcid, struct mt7996_sta, wcid);
--				phy = msta->vif->phy->mt76;
--				msta->ack_signal = mt76_rx_signal(phy->antenna_mask, rssi);
--				ewma_avg_signal_add(&msta->avg_ack_signal, -msta->ack_signal);
-+				mlink = container_of(wcid, struct mt7996_link_sta, wcid);
-+				phy = mlink->sta->vif->deflink.phy->mt76;
-+				mlink->ack_signal = mt76_rx_signal(phy->antenna_mask, rssi);
-+				ewma_avg_signal_add(&mlink->avg_ack_signal, -mlink->ack_signal);
- 			} else {
- 				ret = -EINVAL;
- 				dev_err(dev->dev, "Failed to update RSSI for "
-@@ -5069,7 +5072,7 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
- {
- 	u16 sta_list[PER_STA_INFO_MAX_NUM];
- 	LIST_HEAD(sta_poll_list);
--	struct mt7996_sta *msta;
-+	struct mt7996_link_sta *mlink;
- 	int i, ret;
- 	bool empty = false;
- 
-@@ -5089,13 +5092,13 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
- 				empty = true;
- 				break;
- 			}
--			msta = list_first_entry(&sta_poll_list,
--			                        struct mt7996_sta,
-+			mlink = list_first_entry(&sta_poll_list,
-+			                        struct mt7996_link_sta,
- 			                        wcid.poll_list);
--			list_del_init(&msta->wcid.poll_list);
-+			list_del_init(&mlink->wcid.poll_list);
- 			spin_unlock_bh(&dev->sta_poll_lock);
- 
--			sta_list[i] = msta->wcid.idx;
-+			sta_list[i] = mlink->wcid.idx;
- 		}
- 
- 		ret = mt7996_mcu_get_per_sta_info(dev, UNI_PER_STA_RSSI,
-@@ -5385,10 +5388,18 @@ int mt7996_mcu_set_scs_stats(struct mt7996_phy *phy)
- void mt7996_sta_rssi_work(void *data, struct ieee80211_sta *sta)
- {
- 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-+	struct mt7996_link_sta *mlink;
- 	struct mt7996_phy *poll_phy = (struct mt7996_phy *) data;
- 
--	if (poll_phy->scs_ctrl.sta_min_rssi > msta->ack_signal)
--		poll_phy->scs_ctrl.sta_min_rssi = msta->ack_signal;
-+	mutex_lock(&poll_phy->dev->mt76.mutex);
-+	mlink = mlink_dereference_protected(msta, 0);
-+	if (!mlink)
-+		goto out;
-+
-+	if (poll_phy->scs_ctrl.sta_min_rssi > mlink->ack_signal)
-+		poll_phy->scs_ctrl.sta_min_rssi = mlink->ack_signal;
-+out:
-+	mutex_unlock(&poll_phy->dev->mt76.mutex);
- }
- 
- void mt7996_mcu_scs_sta_poll(struct work_struct *work)
-@@ -5464,9 +5475,10 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
- 
- int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
- 				struct mt7996_bss_conf *mconf,
--				struct mt7996_sta *msta, enum vow_drr_ctrl_id id)
-+				struct mt7996_link_sta *mlink,
-+				enum vow_drr_ctrl_id id)
- {
--	struct mt7996_vow_sta_ctrl *vow = msta ? &msta->vow : NULL;
-+	struct mt7996_vow_sta_ctrl *vow = mlink ? &mlink->vow : NULL;
- 	u32 val = 0;
- 	struct {
- 		u8 __rsv1[4];
-@@ -5488,11 +5500,11 @@ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
- 	} __packed req = {
- 		.tag = cpu_to_le16(UNI_VOW_DRR_CTRL),
- 		.len = cpu_to_le16(sizeof(req) - 4),
--		.wlan_idx = cpu_to_le16(msta ? msta->wcid.idx : 0),
-+		.wlan_idx = cpu_to_le16(mlink ? mlink->wcid.idx : 0),
- 		.band_idx = phy->mt76->band_idx,
--		.wmm_idx = msta ? mconf->mt76.wmm_idx : 0,
-+		.wmm_idx = mlink ? mconf->mt76.wmm_idx : 0,
- 		.ctrl_id = cpu_to_le32(id),
--		.omac_idx = msta ? mconf->mt76.omac_idx : 0
-+		.omac_idx = mlink ? mconf->mt76.omac_idx : 0
- 	};
- 
- 	switch (id) {
-diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 6b03ee17f..370172037 100644
---- a/mt7996/mt7996.h
-+++ b/mt7996/mt7996.h
-@@ -302,10 +302,10 @@ struct mt7996_vow_sta_ctrl {
- 	u8 drr_quantum[IEEE80211_NUM_ACS];
- };
- 
--struct mt7996_sta {
-+struct mt7996_link_sta {
- 	struct mt76_wcid wcid; /* must be first */
- 
--	struct mt7996_vif *vif;
-+	struct mt7996_sta *sta;
- 
- 	struct list_head rc_list;
- 
-@@ -324,6 +324,13 @@ struct mt7996_sta {
- 	struct mt7996_vow_sta_ctrl vow;
- };
- 
-+struct mt7996_sta {
-+	struct mt7996_link_sta deflink;
-+	struct mt7996_link_sta __rcu *link[IEEE80211_MLD_MAX_NUM_LINKS];
-+
-+	struct mt7996_vif *vif;
-+};
-+
- struct mt7996_bss_conf {
- 	struct mt76_vif mt76; /* must be first */
- 
-@@ -783,6 +790,13 @@ mconf_dereference_protected(struct mt7996_vif *mvif, u8 link_id)
- 					 lockdep_is_held(&mvif->dev->mt76.mutex));
- }
- 
-+static inline struct mt7996_link_sta *
-+mlink_dereference_protected(struct mt7996_sta *msta, u8 link_id)
-+{
-+	return rcu_dereference_protected(msta->link[link_id],
-+					 lockdep_is_held(&msta->vif->dev->mt76.mutex));
-+}
-+
- extern const struct ieee80211_ops mt7996_ops;
- extern struct pci_driver mt7996_pci_driver;
- extern struct pci_driver mt7996_hif_driver;
-@@ -827,10 +841,12 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
- 			    struct mt7996_bss_conf *mconf, bool enable);
- int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
- 			    struct ieee80211_bss_conf *conf,
--			    struct mt7996_bss_conf *mconf, int enable);
-+			    struct mt7996_bss_conf *mconf,
-+			    struct mt7996_link_sta *mlink, int enable);
- int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
--		       struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta,
--		       bool enable, bool newly);
-+		       struct mt7996_bss_conf *mconf,
-+		       struct ieee80211_link_sta *link_sta,
-+		       struct mt7996_link_sta *mlink, bool enable, bool newly);
- int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
- 			 struct ieee80211_ampdu_params *params,
- 			 bool add);
-@@ -852,7 +868,8 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy,
- int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
- 			     struct ieee80211_bss_conf *conf,
- 			     struct mt7996_bss_conf *mconf,
--			     struct ieee80211_sta *sta, bool changed);
-+			     struct ieee80211_link_sta *link_sta,
-+			     struct mt7996_link_sta *mlink, bool changed);
- int mt7996_set_channel(struct mt7996_phy *phy, struct cfg80211_chan_def *chandef);
- int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag);
- int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct mt7996_bss_conf *mconf);
-@@ -860,7 +877,9 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
- 				   void *data, u16 version);
- int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
- 			       struct mt7996_bss_conf *mconf,
--			       struct ieee80211_sta *sta, void *data, u32 field);
-+			       struct ieee80211_link_sta *link_sta,
-+			       struct mt7996_link_sta *mlink, void *data,
-+			       u32 field);
- int mt7996_mcu_set_eeprom(struct mt7996_dev *dev);
- int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf);
- int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num);
-@@ -916,7 +935,8 @@ void mt7996_mcu_scs_sta_poll(struct work_struct *work);
- int mt7996_mcu_set_band_confg(struct mt7996_phy *phy, u16 option, bool enable);
- int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
- 				struct mt7996_bss_conf *mconf,
--				struct mt7996_sta *msta, enum vow_drr_ctrl_id id);
-+				struct mt7996_link_sta *mlink,
-+				enum vow_drr_ctrl_id id);
- int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy);
- void mt7996_mcu_wmm_pbc_work(struct work_struct *work);
- 
-@@ -983,7 +1003,7 @@ void mt7996_mac_reset_counters(struct mt7996_phy *phy);
- void mt7996_mac_cca_stats_reset(struct mt7996_phy *phy);
- void mt7996_mac_enable_nf(struct mt7996_dev *dev, u8 band);
- void mt7996_mac_enable_rtscts(struct mt7996_dev *dev,
--			      struct ieee80211_vif *vif, bool enable);
-+			      struct mt7996_link_sta *mlink, bool enable);
- void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
- 			   struct sk_buff *skb, struct mt76_wcid *wcid,
- 			   struct ieee80211_key_conf *key, int pid,
-@@ -1001,8 +1021,7 @@ void mt7996_mac_dump_work(struct work_struct *work);
- void mt7996_mac_sta_rc_work(struct work_struct *work);
- void mt7996_mac_update_stats(struct mt7996_phy *phy);
- void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
--				  struct mt7996_sta *msta,
--				  u8 flowid);
-+				  struct mt7996_link_sta *mlink, u8 flowid);
- void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
- 			      struct ieee80211_sta *sta,
- 			      struct ieee80211_twt_setup *twt);
-@@ -1031,11 +1050,12 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
- int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
- 			       struct ieee80211_bss_conf *conf,
- 			       struct mt7996_bss_conf *mconf,
-+			       struct mt7996_link_sta *mlink,
- 			       struct ieee80211_key_conf *key);
- int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
- 				     struct ieee80211_vif *vif,
- 				     struct mt7996_bss_conf *mconf,
--				     struct ieee80211_sta *sta);
-+				     struct mt7996_link_sta *mlink);
- int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode);
- int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
- #ifdef CONFIG_MAC80211_DEBUGFS
-diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index bf55b4309..ba17f947b 100644
---- a/mt7996/testmode.c
-+++ b/mt7996/testmode.c
-@@ -235,8 +235,8 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
- 
- 	mt7996_tm_rf_switch_mode(dev, rf_test_mode);
- 
--	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, en);
--	mt7996_mcu_add_sta(dev, &phy->monitor_vif->bss_conf, &mvif->deflink, NULL, en, false);
-+	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, &mvif->sta.deflink, en);
-+	mt7996_mcu_add_sta(dev, &phy->monitor_vif->bss_conf, &mvif->deflink, NULL, &mvif->sta.deflink, en, false);
- 
- 	mt7996_tm_set(dev, SET_ID(BAND_IDX), phy->mt76->band_idx);
- 
-@@ -1186,7 +1186,7 @@ mt7996_tm_txbf_init(struct mt7996_phy *phy, u16 *val)
- 	phy->omac_mask |= BIT_ULL(mvif->deflink.mt76.omac_idx);
- 
- 	mt7996_mcu_add_dev_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, true);
--	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, true);
-+	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, &mvif->sta.deflink, true);
- 
- 	if (td->ibf) {
- 		if (td->is_txbf_dut) {
--- 
-2.39.2
-
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0089-wifi-mt76-mt7996-enable-MLO-capability.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0088-wifi-mt76-mt7996-enable-MLO-capability.patch
similarity index 94%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0089-wifi-mt76-mt7996-enable-MLO-capability.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0088-wifi-mt76-mt7996-enable-MLO-capability.patch
index 479e720..9fbb44a 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0089-wifi-mt76-mt7996-enable-MLO-capability.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0088-wifi-mt76-mt7996-enable-MLO-capability.patch
@@ -1,7 +1,7 @@
-From c7aef97eb798ee5c8e779e5d0514cbe68b41f6a3 Mon Sep 17 00:00:00 2001
+From ebe94f1d3aa73deefe0057ae93974a06b55db1ce Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 30 Nov 2023 16:31:17 +0800
-Subject: [PATCH 089/116] wifi: mt76: mt7996: enable MLO capability
+Subject: [PATCH 088/116] wifi: mt76: mt7996: enable MLO capability
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
@@ -12,7 +12,7 @@
  2 files changed, 44 insertions(+), 2 deletions(-)
 
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 51455d877..0393e93bf 100644
+index 51455d8..0393e93 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -387,6 +387,12 @@ static int mt7996_eeprom_parse_band_config(struct mt7996_phy *phy)
@@ -29,7 +29,7 @@
  }
  
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 381e1292c..c6eb6a5c2 100644
+index 381e129..c6eb6a5 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -34,16 +34,45 @@ static const struct ieee80211_iface_combination if_comb[] = {
@@ -104,5 +104,5 @@
  
  static void
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0090-wifi-mt76-mt7996-support-multi-link-vif-links-and-ML.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0089-wifi-mt76-mt7996-support-multi-link-vif-links-and-ML.patch
similarity index 98%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0090-wifi-mt76-mt7996-support-multi-link-vif-links-and-ML.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0089-wifi-mt76-mt7996-support-multi-link-vif-links-and-ML.patch
index d6b68ca..c4d110d 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0090-wifi-mt76-mt7996-support-multi-link-vif-links-and-ML.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0089-wifi-mt76-mt7996-support-multi-link-vif-links-and-ML.patch
@@ -1,7 +1,7 @@
-From 4cc16942c3f1ec92f9a25802341f456d92dd5cc4 Mon Sep 17 00:00:00 2001
+From 9b5284be6784cf32222425a9cbbd9622db38aafd Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 23 Nov 2023 18:22:11 +0800
-Subject: [PATCH 090/116] wifi: mt76: mt7996: support multi-link vif links and
+Subject: [PATCH 089/116] wifi: mt76: mt7996: support multi-link vif links and
  MLO bss callbacks
 
 Rework add/remove interface functions to add/remove bss_conf functions,
@@ -18,7 +18,7 @@
  3 files changed, 270 insertions(+), 66 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 4069ffb70..38aae12be 100644
+index 4e5ba58..9fbb86c 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -205,6 +205,38 @@ static int get_omac_idx(enum nl80211_iftype type, u64 mask)
@@ -492,7 +492,7 @@
 +	.change_vif_links = mt7996_change_vif_links,
  };
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 6d2b517e0..0eccc112d 100644
+index cab4a0a..2a17299 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -1047,15 +1047,23 @@ static void
@@ -552,7 +552,7 @@
  
  	if (vif->type == NL80211_IFTYPE_MONITOR)
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 370172037..ed8c82e8c 100644
+index 3701720..ed8c82e 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -340,6 +340,9 @@ struct mt7996_bss_conf {
@@ -586,5 +586,5 @@
  	struct work_struct init_work;
  	struct work_struct rc_work;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0091-wifi-mt76-mt7996-support-multi-link-sta-links-and-ML.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0090-wifi-mt76-mt7996-support-multi-link-sta-links-and-ML.patch
similarity index 98%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0091-wifi-mt76-mt7996-support-multi-link-sta-links-and-ML.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0090-wifi-mt76-mt7996-support-multi-link-sta-links-and-ML.patch
index c1eda8b..b4ea4c0 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0091-wifi-mt76-mt7996-support-multi-link-sta-links-and-ML.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0090-wifi-mt76-mt7996-support-multi-link-sta-links-and-ML.patch
@@ -1,7 +1,7 @@
-From 9bff2b264652d23bf0dc056f1e76120951c8d833 Mon Sep 17 00:00:00 2001
+From 707513db7b37788147180eda7215eb23561d579f Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 29 Nov 2023 10:12:39 +0800
-Subject: [PATCH 091/116] wifi: mt76: mt7996: support multi-link sta links and
+Subject: [PATCH 090/116] wifi: mt76: mt7996: support multi-link sta links and
  MLO sta callbacks
 
 Rework add_sta functions to add_link_sta functions, and support
@@ -20,7 +20,7 @@
  5 files changed, 398 insertions(+), 66 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index f7da63658..d45765beb 100644
+index 740b9f5..728ffb3 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -814,7 +814,9 @@ enum {
@@ -34,7 +34,7 @@
  	STA_REC_KEY_V3 = 0x27,
  	STA_REC_HDRT = 0x28,
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 38aae12be..b193e638e 100644
+index 9fbb86c..37e065f 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -928,42 +928,234 @@ mt7996_channel_switch_beacon(struct ieee80211_hw *hw,
@@ -400,7 +400,7 @@
 +	.change_sta_links = mt7996_change_sta_links,
  };
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 0eccc112d..ed854b473 100644
+index 2a17299..16352d1 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -2425,6 +2425,123 @@ out:
@@ -528,7 +528,7 @@
  mt7996_mcu_sta_key_tlv(struct mt76_wcid *wcid,
  		       struct sk_buff *skb,
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 814072e3a..ee36cf5ed 100644
+index 814072e..ee36cf5 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -698,6 +698,35 @@ struct sta_rec_hdr_trans {
@@ -568,7 +568,7 @@
  	__le16 tag;
  	__le16 len;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index ed8c82e8c..913aff173 100644
+index ed8c82e..913aff1 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -329,6 +329,8 @@ struct mt7996_sta {
@@ -600,5 +600,5 @@
  int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag);
  int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct mt7996_bss_conf *mconf);
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0092-wifi-mt76-mt7996-introduce-mt7996_band_phy-for-ch-ba.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0091-wifi-mt76-mt7996-introduce-mt7996_band_phy-for-ch-ba.patch
similarity index 97%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0092-wifi-mt76-mt7996-introduce-mt7996_band_phy-for-ch-ba.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0091-wifi-mt76-mt7996-introduce-mt7996_band_phy-for-ch-ba.patch
index 8e8cfb9..45d16d3 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0092-wifi-mt76-mt7996-introduce-mt7996_band_phy-for-ch-ba.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0091-wifi-mt76-mt7996-introduce-mt7996_band_phy-for-ch-ba.patch
@@ -1,7 +1,7 @@
-From 04384a0b4762de5741c6220aba3b0500e260d8a2 Mon Sep 17 00:00:00 2001
+From 5aa4150e28fdef37bedc7231913a17c260b7aef0 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 1 Dec 2023 16:01:53 +0800
-Subject: [PATCH 092/116] wifi: mt76: mt7996: introduce mt7996_band_phy() for
+Subject: [PATCH 091/116] wifi: mt76: mt7996: introduce mt7996_band_phy() for
  ch band and phy mapping
 
 For MLO devices, one ieee80211_hw can be mapped to several bands, and
@@ -16,7 +16,7 @@
  2 files changed, 112 insertions(+), 59 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index b193e638e..435815e9a 100644
+index 37e065f..e443761 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -41,9 +41,8 @@ static void mt7996_testmode_disable_all(struct mt7996_dev *dev)
@@ -234,7 +234,7 @@
  	int ret;
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 913aff173..4c090badf 100644
+index 913aff1..4c090ba 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -788,6 +788,28 @@ mt7996_get_background_radar_cap(struct mt7996_dev *dev)
@@ -267,5 +267,5 @@
  mt7996_chanctx_get(struct ieee80211_chanctx_conf *ctx)
  {
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0093-wifi-mt76-mt7996-rework-ieee80211_ops-callbacks-for-.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0092-wifi-mt76-mt7996-rework-ieee80211_ops-callbacks-for-.patch
similarity index 98%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0093-wifi-mt76-mt7996-rework-ieee80211_ops-callbacks-for-.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0092-wifi-mt76-mt7996-rework-ieee80211_ops-callbacks-for-.patch
index 9c04e89..13bff79 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0093-wifi-mt76-mt7996-rework-ieee80211_ops-callbacks-for-.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0092-wifi-mt76-mt7996-rework-ieee80211_ops-callbacks-for-.patch
@@ -1,7 +1,7 @@
-From 29127cd132bbeca563f105bb43fb6e5855cc3572 Mon Sep 17 00:00:00 2001
+From 31581304bf759bc9d85325c233731aaa5667d311 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 1 Dec 2023 17:26:43 +0800
-Subject: [PATCH 093/116] wifi: mt76: mt7996: rework ieee80211_ops callbacks
+Subject: [PATCH 092/116] wifi: mt76: mt7996: rework ieee80211_ops callbacks
  for link consideration
 
 Extend ieee80211 callback functions to support multi-link operation.
@@ -15,7 +15,7 @@
  1 file changed, 204 insertions(+), 109 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 435815e9a..3bd97d4aa 100644
+index e443761..f5658d4 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -568,7 +568,6 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
@@ -497,5 +497,5 @@
  	.set_key = mt7996_set_key,
  	.ampdu_action = mt7996_ampdu_action,
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0094-wifi-mt76-mt7996-rework-TXD-for-multi-link-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0093-wifi-mt76-mt7996-rework-TXD-for-multi-link-support.patch
similarity index 96%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0094-wifi-mt76-mt7996-rework-TXD-for-multi-link-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0093-wifi-mt76-mt7996-rework-TXD-for-multi-link-support.patch
index 0519b1b..6509b04 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0094-wifi-mt76-mt7996-rework-TXD-for-multi-link-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0093-wifi-mt76-mt7996-rework-TXD-for-multi-link-support.patch
@@ -1,7 +1,7 @@
-From dba16ea5f62b21ec911c67a7ca1539004c5e5f3b Mon Sep 17 00:00:00 2001
+From 59f38b9ffa5320f9d80c0752d8ffc15dcf0114c5 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 4 Dec 2023 11:25:54 +0800
-Subject: [PATCH 094/116] wifi: mt76: mt7996: rework TXD for multi-link support
+Subject: [PATCH 093/116] wifi: mt76: mt7996: rework TXD for multi-link support
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
@@ -14,7 +14,7 @@
  2 files changed, 73 insertions(+), 24 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 3cff43d6b..0fa3266cc 100644
+index 3cff43d..0fa3266 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -621,9 +621,8 @@ mt7996_mac_write_txwi_8023(struct mt7996_dev *dev, __le32 *txwi,
@@ -179,7 +179,7 @@
  	txp->fw.rept_wds_wcid = cpu_to_le16(sta ? wcid->idx : 0xfff);
  
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 4c090badf..21a95c146 100644
+index 4c090ba..21a95c1 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -830,6 +830,15 @@ mlink_dereference_protected(struct mt7996_sta *msta, u8 link_id)
@@ -199,5 +199,5 @@
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0095-wifi-mt76-mt7996-rework-TXS-for-multi-link-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0094-wifi-mt76-mt7996-rework-TXS-for-multi-link-support.patch
similarity index 93%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0095-wifi-mt76-mt7996-rework-TXS-for-multi-link-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0094-wifi-mt76-mt7996-rework-TXS-for-multi-link-support.patch
index 6edeabe..8e6acb1 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0095-wifi-mt76-mt7996-rework-TXS-for-multi-link-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0094-wifi-mt76-mt7996-rework-TXS-for-multi-link-support.patch
@@ -1,7 +1,7 @@
-From 1f35388fa6214a36e5f7a4770c248a187a543019 Mon Sep 17 00:00:00 2001
+From 13cf1c4b8027b2747c067d1bdd2f927f8c266b31 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 4 Dec 2023 11:57:38 +0800
-Subject: [PATCH 095/116] wifi: mt76: mt7996: rework TXS for multi-link support
+Subject: [PATCH 094/116] wifi: mt76: mt7996: rework TXS for multi-link support
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
@@ -15,7 +15,7 @@
  3 files changed, 34 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 0fa3266cc..65431c7d7 100644
+index 0fa3266..65431c7 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -1192,7 +1192,7 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
@@ -58,7 +58,7 @@
  	if (list_empty(&mlink->wcid.poll_list))
  		list_add_tail(&mlink->wcid.poll_list, &dev->mt76.sta_poll_list);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 3bd97d4aa..aceb77ab2 100644
+index f5658d4..a94955c 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -2317,6 +2317,7 @@ mt7996_assign_vif_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -70,7 +70,7 @@
  	if (mt7996_hw_phy(hw) == phy)
  		mvif->master_link_id = link_id;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 21a95c146..c6ca00f1a 100644
+index 21a95c1..c6ca00f 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -357,6 +357,8 @@ struct mt7996_vif {
@@ -116,5 +116,5 @@
  extern struct pci_driver mt7996_pci_driver;
  extern struct pci_driver mt7996_hif_driver;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0096-wifi-mt76-mt7996-rework-RXD-for-multi-link-support.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0095-wifi-mt76-mt7996-rework-RXD-for-multi-link-support.patch
similarity index 91%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0096-wifi-mt76-mt7996-rework-RXD-for-multi-link-support.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0095-wifi-mt76-mt7996-rework-RXD-for-multi-link-support.patch
index 426b18b..3d24613 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0096-wifi-mt76-mt7996-rework-RXD-for-multi-link-support.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0095-wifi-mt76-mt7996-rework-RXD-for-multi-link-support.patch
@@ -1,7 +1,7 @@
-From b332b97c6eadd80d210eafc4cd089163c910bf95 Mon Sep 17 00:00:00 2001
+From eeabbc93450223a64bfbb812c2dd938219e58bc2 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 4 Dec 2023 14:50:47 +0800
-Subject: [PATCH 096/116] wifi: mt76: mt7996: rework RXD for multi-link support
+Subject: [PATCH 095/116] wifi: mt76: mt7996: rework RXD for multi-link support
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
 
@@ -13,7 +13,7 @@
  1 file changed, 2 insertions(+), 25 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 65431c7d7..a32b416c4 100644
+index 65431c7..a32b416 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -51,29 +51,6 @@ static const struct mt7996_dfs_radar_spec jp_radar_specs = {
@@ -60,5 +60,5 @@
  		if (list_empty(&mlink->wcid.poll_list))
  			list_add_tail(&mlink->wcid.poll_list,
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0097-wifi-mt76-mt7996-rework-mac-functions-for-multi-link.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0096-wifi-mt76-mt7996-rework-mac-functions-for-multi-link.patch
similarity index 97%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0097-wifi-mt76-mt7996-rework-mac-functions-for-multi-link.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0096-wifi-mt76-mt7996-rework-mac-functions-for-multi-link.patch
index 73838c5..fcb59e6 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0097-wifi-mt76-mt7996-rework-mac-functions-for-multi-link.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0096-wifi-mt76-mt7996-rework-mac-functions-for-multi-link.patch
@@ -1,7 +1,7 @@
-From 15d70608c54b7e8823589850714f396b76e39783 Mon Sep 17 00:00:00 2001
+From 0bd2c0dd6b87178561f38f27cd0be5009b56d43c Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 4 Dec 2023 18:31:02 +0800
-Subject: [PATCH 097/116] wifi: mt76: mt7996: rework mac functions for
+Subject: [PATCH 096/116] wifi: mt76: mt7996: rework mac functions for
  multi-link support
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
@@ -14,7 +14,7 @@
  1 file changed, 65 insertions(+), 26 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index a32b416c4..31b916695 100644
+index a32b416..31b9166 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -85,10 +85,11 @@ static int mt7996_reverse_frag0_hdr_trans(struct sk_buff *skb, u16 hdr_gap)
@@ -245,5 +245,5 @@
  
  void mt7996_mac_work(struct work_struct *work)
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0098-wifi-mt76-connac-rework-mcu-functions-for-multi-link.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0097-wifi-mt76-connac-rework-mcu-functions-for-multi-link.patch
similarity index 95%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0098-wifi-mt76-connac-rework-mcu-functions-for-multi-link.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0097-wifi-mt76-connac-rework-mcu-functions-for-multi-link.patch
index 78653d9..c4caeb7 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0098-wifi-mt76-connac-rework-mcu-functions-for-multi-link.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0097-wifi-mt76-connac-rework-mcu-functions-for-multi-link.patch
@@ -1,7 +1,7 @@
-From 8b128999c458c20f3ad09d8a0dde31e38f23e38b Mon Sep 17 00:00:00 2001
+From c83a1297e94b7b05b1acb8245347ed6443f8b50e Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 7 Dec 2023 15:39:03 +0800
-Subject: [PATCH 098/116] wifi: mt76: connac: rework mcu functions for
+Subject: [PATCH 097/116] wifi: mt76: connac: rework mcu functions for
  multi-link support
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
@@ -17,7 +17,7 @@
  6 files changed, 63 insertions(+), 30 deletions(-)
 
 diff --git a/mt7615/mcu.c b/mt7615/mcu.c
-index 8f4f203ef..e72dd654c 100644
+index 8f4f203..e72dd65 100644
 --- a/mt7615/mcu.c
 +++ b/mt7615/mcu.c
 @@ -862,8 +862,8 @@ mt7615_mcu_wtbl_sta_add(struct mt7615_phy *phy, struct ieee80211_vif *vif,
@@ -32,7 +32,7 @@
  		mt76_connac_mcu_sta_tlv(phy->mt76, sskb, sta, vif, 0,
  					MT76_STA_INFO_STATE_ASSOC);
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index d83d31441..9ea74719a 100644
+index d83d314..9ea7471 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -370,10 +370,11 @@ void mt76_connac_mcu_bss_omac_tlv(struct sk_buff *skb,
@@ -72,10 +72,10 @@
  	if (info->sta && info->enable)
  		mt76_connac_mcu_sta_tlv(phy, skb, info->sta,
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index d45765beb..7f1562b8e 100644
+index 728ffb3..b93b5e0 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1904,7 +1904,7 @@ mt76_connac_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
+@@ -1911,7 +1911,7 @@ mt76_connac_mcu_add_tlv(struct sk_buff *skb, int tag, int len)
  int mt76_connac_mcu_set_channel_domain(struct mt76_phy *phy);
  int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif);
  void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
@@ -85,7 +85,7 @@
  				   bool enable, bool newly);
  void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 1d1b3cead..366f2bba2 100644
+index cb2e3b2..d2294e5 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -1669,7 +1669,8 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
@@ -99,7 +99,7 @@
  	if (!enable)
  		goto out;
 diff --git a/mt7925/mcu.c b/mt7925/mcu.c
-index 1cb556302..e9cf442b8 100644
+index 80e1828..a814b2a 100644
 --- a/mt7925/mcu.c
 +++ b/mt7925/mcu.c
 @@ -1626,7 +1626,8 @@ mt7925_mcu_sta_cmd(struct mt76_phy *phy,
@@ -113,7 +113,7 @@
  	if (info->sta && info->enable) {
  		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->sta);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index ed854b473..4bdb1fcbc 100644
+index 16352d1..7f31dd9 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -1169,10 +1169,12 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
@@ -255,5 +255,5 @@
  				ewma_avg_signal_add(&mlink->avg_ack_signal, -mlink->ack_signal);
  			} else {
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0099-wifi-mt76-connac-rework-connac-helpers.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0098-wifi-mt76-connac-rework-connac-helpers.patch
similarity index 93%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0099-wifi-mt76-connac-rework-connac-helpers.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0098-wifi-mt76-connac-rework-connac-helpers.patch
index 78704e7..02d240f 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0099-wifi-mt76-connac-rework-connac-helpers.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0098-wifi-mt76-connac-rework-connac-helpers.patch
@@ -1,7 +1,7 @@
-From 458a75e252d6d8a7969108695b8b9c7cceb079e3 Mon Sep 17 00:00:00 2001
+From 056ff64bf4b942ff77e1b5931cdabd236f9d0f83 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 11 Dec 2023 18:45:00 +0800
-Subject: [PATCH 099/116] wifi: mt76: connac: rework connac helpers
+Subject: [PATCH 098/116] wifi: mt76: connac: rework connac helpers
 
 Rework connac helpers related to rate and phymode.
 This is a preliminary patch to add MLO support for mt7996 chipsets.
@@ -20,7 +20,7 @@
  7 files changed, 16 insertions(+), 17 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 91987bdf2..0025add80 100644
+index 445d0f0..f7766a9 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -427,7 +427,7 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
@@ -33,7 +33,7 @@
  bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
  			       __le32 *txs_data);
 diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index b841bf628..c1e9ba0fc 100644
+index b841bf6..c1e9ba0 100644
 --- a/mt76_connac_mac.c
 +++ b/mt76_connac_mac.c
 @@ -291,12 +291,11 @@ EXPORT_SYMBOL_GPL(mt76_connac_init_tx_queues);
@@ -93,7 +93,7 @@
  		u32 val = MT_TXD6_FIXED_BW;
  
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 9ea74719a..71f3d301c 100644
+index 9ea7471..71f3d30 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -1361,7 +1361,7 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
@@ -118,10 +118,10 @@
  
  	switch (band) {
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 7f1562b8e..41e26b8a4 100644
+index b93b5e0..4d0fd4b 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -2016,7 +2016,7 @@ mt76_connac_get_eht_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif);
+@@ -2023,7 +2023,7 @@ mt76_connac_get_eht_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif);
  u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
  			    enum nl80211_band band,
  			    struct ieee80211_link_sta *link_sta);
@@ -131,7 +131,7 @@
  
  int mt76_connac_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
 diff --git a/mt7925/main.c b/mt7925/main.c
-index 1f07ec5a2..6d7ec7708 100644
+index 1f07ec5..6d7ec77 100644
 --- a/mt7925/main.c
 +++ b/mt7925/main.c
 @@ -675,7 +675,7 @@ mt7925_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -144,7 +144,7 @@
  
  	if (beacon && ht) {
 diff --git a/mt7996/main.c b/mt7996/main.c
-index aceb77ab2..bf3ae65e4 100644
+index a94955c..0245b6b 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -804,7 +804,7 @@ mt7996_get_rates_table(struct ieee80211_hw *hw, struct ieee80211_bss_conf *conf,
@@ -157,7 +157,7 @@
  	if (beacon) {
  		struct mt7996_phy *phy = mphy->priv;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 4bdb1fcbc..35e0578b5 100644
+index 7f31dd9..f3d162a 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -1219,7 +1219,7 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
@@ -170,5 +170,5 @@
  
  	return 0;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0100-wifi-mt76-mt7996-handle-mapping-for-hw-and-phy.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0099-wifi-mt76-mt7996-handle-mapping-for-hw-and-phy.patch
similarity index 93%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0100-wifi-mt76-mt7996-handle-mapping-for-hw-and-phy.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0099-wifi-mt76-mt7996-handle-mapping-for-hw-and-phy.patch
index 6351831..e1391b5 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0100-wifi-mt76-mt7996-handle-mapping-for-hw-and-phy.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0099-wifi-mt76-mt7996-handle-mapping-for-hw-and-phy.patch
@@ -1,7 +1,7 @@
-From 5cbd493fec6ab4c947bde92425b7af7754112e15 Mon Sep 17 00:00:00 2001
+From b359a84d5cb94c2856285a0d82422a6b232f7f70 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 5 Dec 2023 13:56:51 +0800
-Subject: [PATCH 100/116] wifi: mt76: mt7996: handle mapping for hw and phy
+Subject: [PATCH 099/116] wifi: mt76: mt7996: handle mapping for hw and phy
 
 We've used mt7996_band_phy() to do mapping from ieee80211_hw to mt7996_phy,
 and this patch is a temporal workaround for opposite direction.
@@ -16,10 +16,10 @@
  4 files changed, 55 insertions(+), 14 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 96fab2320..175f19169 100644
+index 4e96b39..de2c00d 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -823,9 +823,13 @@ EXPORT_SYMBOL_GPL(mt76_has_tx_pending);
+@@ -824,9 +824,13 @@ EXPORT_SYMBOL_GPL(mt76_has_tx_pending);
  struct mt76_channel_state *
  mt76_channel_state(struct mt76_phy *phy, struct ieee80211_channel *c)
  {
@@ -33,7 +33,7 @@
  	if (c->band == NL80211_BAND_2GHZ)
  		msband = &phy->sband_2g;
  	else if (c->band == NL80211_BAND_6GHZ)
-@@ -834,6 +838,11 @@ mt76_channel_state(struct mt76_phy *phy, struct ieee80211_channel *c)
+@@ -835,6 +839,11 @@ mt76_channel_state(struct mt76_phy *phy, struct ieee80211_channel *c)
  		msband = &phy->sband_5g;
  
  	idx = c - &msband->sband.channels[0];
@@ -45,7 +45,7 @@
  	return &msband->chan[idx];
  }
  EXPORT_SYMBOL_GPL(mt76_channel_state);
-@@ -1072,7 +1081,7 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -1073,7 +1082,7 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
  	}
  
  	*sta = wcid_to_sta(mstat.wcid);
@@ -55,7 +55,7 @@
  	if ((mstat.flag & RX_FLAG_8023) || ieee80211_is_data_qos(hdr->frame_control)) {
  		struct mt76_phy *phy = mt76_dev_phy(dev, mstat.phy_idx);
 diff --git a/mt76.h b/mt76.h
-index b60b5161b..3f9a0b8aa 100644
+index c3ab96a..ebfd379 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -831,6 +831,7 @@ struct mt76_vif {
@@ -83,7 +83,7 @@
  mt76_get_txwi_ptr(struct mt76_dev *dev, struct mt76_txwi_cache *t)
  {
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 31b916695..cd25ea616 100644
+index 31b9166..cd25ea6 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -2383,7 +2383,10 @@ void mt7996_mac_work(struct work_struct *work)
@@ -108,7 +108,7 @@
  				      NULL)) {
  		rcu_read_unlock();
 diff --git a/mt7996/main.c b/mt7996/main.c
-index bf3ae65e4..8b463b17d 100644
+index 0245b6b..34ff96d 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -173,6 +173,7 @@ static void mt7996_stop(struct ieee80211_hw *hw)
@@ -214,5 +214,5 @@
  		mutex_unlock(&phy->dev->mt76.mutex);
  		return -ENOSPC;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0101-wifi-mt76-mt7996-handle-mapping-for-hw-and-vif.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0100-wifi-mt76-mt7996-handle-mapping-for-hw-and-vif.patch
similarity index 93%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0101-wifi-mt76-mt7996-handle-mapping-for-hw-and-vif.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0100-wifi-mt76-mt7996-handle-mapping-for-hw-and-vif.patch
index d32cbf5..6fa4af2 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0101-wifi-mt76-mt7996-handle-mapping-for-hw-and-vif.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0100-wifi-mt76-mt7996-handle-mapping-for-hw-and-vif.patch
@@ -1,7 +1,7 @@
-From 239433584a6782a9b99d105698dbd4841b18cf9a Mon Sep 17 00:00:00 2001
+From 556174db2cbb957fdc977ecfcef3b20a3dcd670b Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 8 Dec 2023 18:08:13 +0800
-Subject: [PATCH 101/116] wifi: mt76: mt7996: handle mapping for hw and vif
+Subject: [PATCH 100/116] wifi: mt76: mt7996: handle mapping for hw and vif
 
 We have several temporal workarounds for ieee80211_hw and mt76_phy
 mappings. For legacy MBSS cases, we also need a method to do the
@@ -24,7 +24,7 @@
  9 files changed, 46 insertions(+), 9 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 38701c71e..3f1fb6c2a 100644
+index 38701c7..3f1fb6c 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -685,7 +685,7 @@ free:
@@ -37,10 +37,10 @@
  	ieee80211_tx_status_ext(hw, &status);
  	spin_unlock_bh(&dev->rx_lock);
 diff --git a/mac80211.c b/mac80211.c
-index 175f19169..dad659ecb 100644
+index de2c00d..1dec143 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1519,7 +1519,7 @@ void mt76_wcid_cleanup(struct mt76_dev *dev, struct mt76_wcid *wcid)
+@@ -1520,7 +1520,7 @@ void mt76_wcid_cleanup(struct mt76_dev *dev, struct mt76_wcid *wcid)
  	spin_unlock_bh(&phy->tx_lock);
  
  	while ((skb = __skb_dequeue(&list)) != NULL) {
@@ -50,7 +50,7 @@
  	}
  }
 diff --git a/mt76.h b/mt76.h
-index 3f9a0b8aa..64ea323d8 100644
+index ebfd379..1d57e21 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -556,6 +556,9 @@ struct mt76_driver_ops {
@@ -88,7 +88,7 @@
  }
  
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index cd25ea616..6ca3e06e2 100644
+index cd25ea6..6ca3e06 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -2846,13 +2846,23 @@ static void mt7996_scan_check_sta(void *data, struct ieee80211_sta *sta)
@@ -133,7 +133,7 @@
 +	}
 +}
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 8b463b17d..8bf520120 100644
+index 34ff96d..ddfde58 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -444,6 +444,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
@@ -145,7 +145,7 @@
  
  	ret = mt7996_add_bss_conf(phy, vif, &vif->bss_conf);
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 35e0578b5..399e0ffd4 100644
+index f3d162a..2a09ed1 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -2947,11 +2947,11 @@ int mt7996_mcu_beacon_inband_discov(struct mt7996_dev *dev,
@@ -163,7 +163,7 @@
  
  	if (!skb) {
 diff --git a/mt7996/mmio.c b/mt7996/mmio.c
-index 6abbcb68e..6bebdd81b 100644
+index 6abbcb6..6bebdd8 100644
 --- a/mt7996/mmio.c
 +++ b/mt7996/mmio.c
 @@ -658,6 +658,7 @@ struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,
@@ -175,7 +175,7 @@
  	struct mt7996_dev *dev;
  	struct mt76_dev *mdev;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index c6ca00f1a..dc0a31d44 100644
+index c6ca00f..dc0a31d 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -353,6 +353,7 @@ struct mt7996_vif {
@@ -196,7 +196,7 @@
  void mt7996_coredump(struct mt7996_dev *dev, u8 state);
  int mt7996_run(struct ieee80211_hw *hw);
 diff --git a/tx.c b/tx.c
-index e2795067c..6580833e9 100644
+index e279506..6580833 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -76,7 +76,7 @@ mt76_tx_status_unlock(struct mt76_dev *dev, struct sk_buff_head *list)
@@ -218,5 +218,5 @@
  		if (status.sta && (wcid->rate.flags || wcid->rate.legacy)) {
  			rs.rate_idx = wcid->rate;
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0102-wifi-mt76-mt7996-rework-scanning-parts-for-MLD-STA-s.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0101-wifi-mt76-mt7996-rework-scanning-parts-for-MLD-STA-s.patch
similarity index 95%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0102-wifi-mt76-mt7996-rework-scanning-parts-for-MLD-STA-s.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0101-wifi-mt76-mt7996-rework-scanning-parts-for-MLD-STA-s.patch
index 4aba3ff..c79b078 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0102-wifi-mt76-mt7996-rework-scanning-parts-for-MLD-STA-s.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0101-wifi-mt76-mt7996-rework-scanning-parts-for-MLD-STA-s.patch
@@ -1,7 +1,7 @@
-From f60e775a0f4ca3389d4777b1b2200a5be06cab92 Mon Sep 17 00:00:00 2001
+From 1cad504914e594c629dd2b5a5b67ff58afd307e6 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 13 Dec 2023 16:58:31 +0800
-Subject: [PATCH 102/116] wifi: mt76: mt7996: rework scanning parts for MLD STA
+Subject: [PATCH 101/116] wifi: mt76: mt7996: rework scanning parts for MLD STA
  support
 
 During the first scanning, the STA VIF is still a legacy interface,
@@ -16,7 +16,7 @@
  2 files changed, 42 insertions(+), 9 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 6ca3e06e2..d6d1c0798 100644
+index 6ca3e06..d6d1c07 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -2770,23 +2770,40 @@ static void
@@ -100,7 +100,7 @@
  	phy->scan_req = NULL;
  	phy->scan_vif = NULL;
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 8bf520120..66972080f 100644
+index ddfde58..ef08563 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -2191,6 +2191,8 @@ mt7996_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -149,5 +149,5 @@
  	}
  }
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0103-wifi-mt76-mt7996-implement-mld-address-translation.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0102-wifi-mt76-mt7996-implement-mld-address-translation.patch
similarity index 94%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0103-wifi-mt76-mt7996-implement-mld-address-translation.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0102-wifi-mt76-mt7996-implement-mld-address-translation.patch
index 13c3519..d4e5cae 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0103-wifi-mt76-mt7996-implement-mld-address-translation.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0102-wifi-mt76-mt7996-implement-mld-address-translation.patch
@@ -1,7 +1,7 @@
-From 3ef17fdd49c8ded3d8aad5fea83fc1ffbf8972a0 Mon Sep 17 00:00:00 2001
+From fe38a0bccd1cf3ddb1736d79048b6ae9b17b94d0 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 7 Dec 2023 16:31:56 +0800
-Subject: [PATCH 103/116] wifi: mt76: mt7996: implement mld address translation
+Subject: [PATCH 102/116] wifi: mt76: mt7996: implement mld address translation
 
 Do the MLD to link address translation for EAPOL and management frames
 in driver.
@@ -18,7 +18,7 @@
  2 files changed, 66 insertions(+), 3 deletions(-)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index d6d1c0798..3141fe4e4 100644
+index d6d1c07..3141fe4 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -895,6 +895,26 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -49,7 +49,7 @@
  	for (i = 0; i < nbuf; i++) {
  		u16 len;
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 66972080f..97431ae34 100644
+index ef08563..61c4d2d 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1308,14 +1308,56 @@ static void mt7996_tx(struct ieee80211_hw *hw,
@@ -121,5 +121,5 @@
  }
  
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0104-wifi-mt76-mt7996-use-BSS_CHANGED_TXPOWER-for-txpower.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0103-wifi-mt76-mt7996-use-BSS_CHANGED_TXPOWER-for-txpower.patch
similarity index 93%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0104-wifi-mt76-mt7996-use-BSS_CHANGED_TXPOWER-for-txpower.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0103-wifi-mt76-mt7996-use-BSS_CHANGED_TXPOWER-for-txpower.patch
index 97f1b55..ab0aacb 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0104-wifi-mt76-mt7996-use-BSS_CHANGED_TXPOWER-for-txpower.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0103-wifi-mt76-mt7996-use-BSS_CHANGED_TXPOWER-for-txpower.patch
@@ -1,7 +1,7 @@
-From 463f4e447fe5f513e0b0f49b44152d359897c4c3 Mon Sep 17 00:00:00 2001
+From dd18695ef0e8a86e7ab7560ef2c07faf2ef381d7 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Tue, 27 Feb 2024 18:07:11 +0800
-Subject: [PATCH 104/116] wifi: mt76: mt7996: use BSS_CHANGED_TXPOWER for
+Subject: [PATCH 103/116] wifi: mt76: mt7996: use BSS_CHANGED_TXPOWER for
  txpower setting
 
 This is a preliminary patch to add MLO support for mt7996 chipsets.
@@ -15,7 +15,7 @@
  4 files changed, 9 insertions(+), 13 deletions(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 97431ae34..a38d77390 100644
+index 61c4d2d..2d0dc16 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -661,14 +661,6 @@ static int mt7996_config(struct ieee80211_hw *hw, u32 changed)
@@ -52,7 +52,7 @@
  	mutex_unlock(&dev->mt76.mutex);
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 399e0ffd4..39e353ab2 100644
+index 2a09ed1..025a00c 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -5325,7 +5325,8 @@ mt7996_update_max_txpower_cur(struct mt7996_phy *phy, int tx_power)
@@ -75,7 +75,7 @@
  	if (phy->sku_limit_en) {
  		txpower_limit = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index dc0a31d44..39aa3ee5b 100644
+index dc0a31d..39aa3ee 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -976,7 +976,8 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch);
@@ -89,7 +89,7 @@
  		       u8 rx_sel, u8 val);
  int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev,
 diff --git a/mt7996/testmode.c b/mt7996/testmode.c
-index ba17f947b..0565ebc94 100644
+index ba17f94..0565ebc 100644
 --- a/mt7996/testmode.c
 +++ b/mt7996/testmode.c
 @@ -1830,7 +1830,7 @@ mt7996_tm_update_params(struct mt7996_phy *phy, u32 changed)
@@ -102,5 +102,5 @@
  	if (changed & BIT(TM_CHANGED_TX_LENGTH)) {
  		mt7996_tm_set(dev, SET_ID(TX_LEN), td->tx_mpdu_len);
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0105-wifi-mt76-mt7996-temp-support-for-single-wiphy.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0104-wifi-mt76-mt7996-temp-support-for-single-wiphy.patch
similarity index 96%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0105-wifi-mt76-mt7996-temp-support-for-single-wiphy.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0104-wifi-mt76-mt7996-temp-support-for-single-wiphy.patch
index 841aaba..9f92af3 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0105-wifi-mt76-mt7996-temp-support-for-single-wiphy.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0104-wifi-mt76-mt7996-temp-support-for-single-wiphy.patch
@@ -1,7 +1,7 @@
-From 155e1bd8b7933deef463abc30f7d375761b93055 Mon Sep 17 00:00:00 2001
+From b8584db9dd73a4686872e75f5919184e4cb109d0 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Thu, 28 Mar 2024 18:50:04 +0800
-Subject: [PATCH 105/116] wifi: mt76: mt7996: temp support for single wiphy
+Subject: [PATCH 104/116] wifi: mt76: mt7996: temp support for single wiphy
 
 Add temporal single wiphy for simultaneously supporting MLD and legacy
 interfaces.
@@ -18,10 +18,10 @@
  7 files changed, 81 insertions(+), 77 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index dad659ecb..20ab1db4d 100644
+index 1dec143..8b9f3fd 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -823,13 +823,9 @@ EXPORT_SYMBOL_GPL(mt76_has_tx_pending);
+@@ -824,13 +824,9 @@ EXPORT_SYMBOL_GPL(mt76_has_tx_pending);
  struct mt76_channel_state *
  mt76_channel_state(struct mt76_phy *phy, struct ieee80211_channel *c)
  {
@@ -35,7 +35,7 @@
  	if (c->band == NL80211_BAND_2GHZ)
  		msband = &phy->sband_2g;
  	else if (c->band == NL80211_BAND_6GHZ)
-@@ -838,11 +834,6 @@ begin:
+@@ -839,11 +835,6 @@ begin:
  		msband = &phy->sband_5g;
  
  	idx = c - &msband->sband.channels[0];
@@ -47,7 +47,7 @@
  	return &msband->chan[idx];
  }
  EXPORT_SYMBOL_GPL(mt76_channel_state);
-@@ -1081,7 +1072,7 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
+@@ -1082,7 +1073,7 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
  	}
  
  	*sta = wcid_to_sta(mstat.wcid);
@@ -57,7 +57,7 @@
  	if ((mstat.flag & RX_FLAG_8023) || ieee80211_is_data_qos(hdr->frame_control)) {
  		struct mt76_phy *phy = mt76_dev_phy(dev, mstat.phy_idx);
 diff --git a/mt76.h b/mt76.h
-index 64ea323d8..b77a2f76b 100644
+index 1d57e21..0452e5d 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -833,8 +833,8 @@ struct mt76_vif {
@@ -87,7 +87,7 @@
  mt76_get_txwi_ptr(struct mt76_dev *dev, struct mt76_txwi_cache *t)
  {
 diff --git a/mt7996/eeprom.c b/mt7996/eeprom.c
-index 0393e93bf..51455d877 100644
+index 0393e93..51455d8 100644
 --- a/mt7996/eeprom.c
 +++ b/mt7996/eeprom.c
 @@ -387,12 +387,6 @@ static int mt7996_eeprom_parse_band_config(struct mt7996_phy *phy)
@@ -104,7 +104,7 @@
  }
  
 diff --git a/mt7996/init.c b/mt7996/init.c
-index c6eb6a5c2..f374119f6 100644
+index c6eb6a5..f374119 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -18,13 +18,13 @@ static const struct ieee80211_iface_limit if_limits[] = {
@@ -181,7 +181,7 @@
  	mt7996_mcu_exit(dev);
  	mt7996_tx_token_put(dev);
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 3141fe4e4..e6db1765f 100644
+index 3141fe4..e6db176 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -2403,10 +2403,7 @@ void mt7996_mac_work(struct work_struct *work)
@@ -197,7 +197,7 @@
  }
  
 diff --git a/mt7996/main.c b/mt7996/main.c
-index a38d77390..b9cc5a2e5 100644
+index 2d0dc16..b0ac649 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -140,6 +140,10 @@ static int mt7996_start(struct ieee80211_hw *hw)
@@ -400,7 +400,7 @@
  		mutex_unlock(&phy->dev->mt76.mutex);
  		return -ENOSPC;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 39aa3ee5b..0444ae58e 100644
+index 39aa3ee..0444ae5 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -794,21 +794,19 @@ mt7996_get_background_radar_cap(struct mt7996_dev *dev)
@@ -432,5 +432,5 @@
  	return phy->priv;
  }
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0106-wifi-mt76-mt7996-implement-ieee80211_ops-for-link-de.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0105-wifi-mt76-mt7996-implement-ieee80211_ops-for-link-de.patch
similarity index 95%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0106-wifi-mt76-mt7996-implement-ieee80211_ops-for-link-de.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0105-wifi-mt76-mt7996-implement-ieee80211_ops-for-link-de.patch
index 53a5557..708a27e 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0106-wifi-mt76-mt7996-implement-ieee80211_ops-for-link-de.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0105-wifi-mt76-mt7996-implement-ieee80211_ops-for-link-de.patch
@@ -1,7 +1,7 @@
-From d17884fc654153615c5d6f6ac4192eed3ec34525 Mon Sep 17 00:00:00 2001
+From 79961bfcb2ebe3368d6d1ddf8b09cbf370c855a8 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Fri, 29 Dec 2023 18:37:41 +0800
-Subject: [PATCH 106/116] wifi: mt76: mt7996: implement ieee80211_ops for link
+Subject: [PATCH 105/116] wifi: mt76: mt7996: implement ieee80211_ops for link
  debugfs
 
 Add .link_sta_add_debugfs and .link_add_debugfs.
@@ -16,7 +16,7 @@
  5 files changed, 78 insertions(+), 4 deletions(-)
 
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 56e219231..26927eda9 100644
+index 56e2192..26927ed 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -1307,4 +1307,69 @@ void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -90,7 +90,7 @@
 +}
  #endif
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index e6db1765f..5967b6aeb 100644
+index e6db176..5967b6a 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -2379,10 +2379,10 @@ void mt7996_mac_work(struct work_struct *work)
@@ -107,7 +107,7 @@
  				if (mt7996_mcu_wa_cmd(phy->dev, MCU_WA_PARAM_CMD(QUERY), MCU_WA_PARAM_BSS_ACQ_PKT_CNT,
  				                      BSS_ACQ_PKT_CNT_BSS_BITMAP_ALL | BSS_ACQ_PKT_CNT_READ_CLR, 0))
 diff --git a/mt7996/main.c b/mt7996/main.c
-index b9cc5a2e5..64797f177 100644
+index b0ac649..3e70d86 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -2602,6 +2602,8 @@ const struct ieee80211_ops mt7996_ops = {
@@ -120,7 +120,7 @@
  	.set_radar_background = mt7996_set_radar_background,
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 39e353ab2..24489ac27 100644
+index 025a00c..1387a52 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -616,8 +616,10 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
@@ -137,7 +137,7 @@
  		case UNI_ALL_STA_TXRX_AIRTIME:
  			wlan_idx = le16_to_cpu(res->airtime[i].wlan_idx);
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 0444ae58e..dc3cacc3a 100644
+index 0444ae5..dc3cacc 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -1138,6 +1138,11 @@ int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
@@ -153,5 +153,5 @@
  int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
  			 bool hif2, int *irq);
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0107-mtk-wifi-mt76-mt7996-support-multi-link-channel-swit.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0106-mtk-wifi-mt76-mt7996-support-multi-link-channel-swit.patch
similarity index 93%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0107-mtk-wifi-mt76-mt7996-support-multi-link-channel-swit.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0106-mtk-wifi-mt76-mt7996-support-multi-link-channel-swit.patch
index c7e57c9..c57d3c8 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0107-mtk-wifi-mt76-mt7996-support-multi-link-channel-swit.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0106-mtk-wifi-mt76-mt7996-support-multi-link-channel-swit.patch
@@ -1,7 +1,7 @@
-From 7ece9b1ea9a8960f2ff94ac84754ddddf645b3a1 Mon Sep 17 00:00:00 2001
+From 4969672ddd07d512af13af7622a8c941ddc21d53 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Fri, 19 Jan 2024 14:04:03 +0800
-Subject: [PATCH 107/116] mtk: wifi: mt76: mt7996: support multi-link channel
+Subject: [PATCH 106/116] mtk: wifi: mt76: mt7996: support multi-link channel
  switch
 
 mtk: wifi: mt76: mt7996: remove the limitation of radar detect width for mlo
@@ -35,10 +35,10 @@
  5 files changed, 22 insertions(+), 9 deletions(-)
 
 diff --git a/mac80211.c b/mac80211.c
-index 20ab1db4d..6512dee61 100644
+index 8b9f3fd..c2b82fb 100644
 --- a/mac80211.c
 +++ b/mac80211.c
-@@ -1797,7 +1797,7 @@ enum mt76_dfs_state mt76_phy_dfs_state(struct mt76_phy *phy)
+@@ -1798,7 +1798,7 @@ enum mt76_dfs_state mt76_phy_dfs_state(struct mt76_phy *phy)
  	    test_bit(MT76_SCANNING, &phy->state))
  		return MT_DFS_STATE_DISABLED;
  
@@ -48,7 +48,7 @@
  		    (phy->chandef.chan->flags & IEEE80211_CHAN_RADAR))
  			return MT_DFS_STATE_ACTIVE;
 diff --git a/mt76.h b/mt76.h
-index b77a2f76b..7919d9c99 100644
+index 0452e5d..d88d552 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -849,6 +849,7 @@ struct mt76_phy {
@@ -60,7 +60,7 @@
  
  	u32 aggr_stats[32];
 diff --git a/mt7996/init.c b/mt7996/init.c
-index f374119f6..0dee6596f 100644
+index f374119..0dee659 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -36,13 +36,11 @@ static const struct ieee80211_iface_combination if_comb[] = {
@@ -78,7 +78,7 @@
  };
  
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 64797f177..05efec469 100644
+index 3e70d86..8e44da7 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -2133,7 +2133,7 @@ static int
@@ -131,7 +131,7 @@
  	new_ctx->chandef = vifs->new_ctx->def;
  	new_ctx->phy = phy;
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 24489ac27..dc719ecbe 100644
+index 1387a52..e18a553 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -357,10 +357,18 @@ int mt7996_mcu_wa_cmd(struct mt7996_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
@@ -165,5 +165,5 @@
  		case UNI_EVENT_IE_COUNTDOWN_BCC:
  			ieee80211_iterate_active_interfaces_atomic(mphy->hw,
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0108-mtk-mt76-mt7996-hw_scan-ACS-channel-time-too-long-on.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0107-mtk-mt76-mt7996-hw_scan-ACS-channel-time-too-long-on.patch
similarity index 87%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0108-mtk-mt76-mt7996-hw_scan-ACS-channel-time-too-long-on.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0107-mtk-mt76-mt7996-hw_scan-ACS-channel-time-too-long-on.patch
index 79732e8..54f4647 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0108-mtk-mt76-mt7996-hw_scan-ACS-channel-time-too-long-on.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0107-mtk-mt76-mt7996-hw_scan-ACS-channel-time-too-long-on.patch
@@ -1,7 +1,7 @@
-From 469ce653f972aa5b6cf213418cfdcecffe0af924 Mon Sep 17 00:00:00 2001
+From 919a124e164b3c1ba5fe4fde2ad48e0ef3961d17 Mon Sep 17 00:00:00 2001
 From: Michael-CY Lee <michael-cy.lee@mediatek.com>
 Date: Thu, 22 Feb 2024 11:09:10 +0800
-Subject: [PATCH 108/116] mtk: mt76: mt7996: hw_scan: ACS channel time too long
+Subject: [PATCH 107/116] mtk: mt76: mt7996: hw_scan: ACS channel time too long
  on duty channel
 
 This problem happens in SW scan and was already fixed.
@@ -15,7 +15,7 @@
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 05efec469..6943b28ba 100644
+index 8e44da7..233bf2a 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -497,6 +497,7 @@ static void ___mt7996_set_channel(struct mt7996_phy *phy,
@@ -36,5 +36,5 @@
  }
  
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0109-wifi-mt76-mt7996-add-beacon-monitoring-in-driver-for.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0108-wifi-mt76-mt7996-add-beacon-monitoring-in-driver-for.patch
similarity index 96%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0109-wifi-mt76-mt7996-add-beacon-monitoring-in-driver-for.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0108-wifi-mt76-mt7996-add-beacon-monitoring-in-driver-for.patch
index 8b41539..cf2d487 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0109-wifi-mt76-mt7996-add-beacon-monitoring-in-driver-for.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0108-wifi-mt76-mt7996-add-beacon-monitoring-in-driver-for.patch
@@ -1,7 +1,7 @@
-From 184ecc9c9c16bbc9b93a69c994194d8bf1e41e72 Mon Sep 17 00:00:00 2001
+From e7f7d5d9d5d110e7550ee2cf6fb1e6bcf6455976 Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Tue, 20 Feb 2024 10:08:01 +0800
-Subject: [PATCH 109/116] wifi: mt76: mt7996: add beacon monitoring in driver
+Subject: [PATCH 108/116] wifi: mt76: mt7996: add beacon monitoring in driver
  for mlo
 
 Add beacon monitoring in driver since mac80211 does not
@@ -16,7 +16,7 @@
  3 files changed, 113 insertions(+)
 
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 5967b6aeb..2a45fc03d 100644
+index 5967b6a..2a45fc0 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -565,6 +565,21 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
@@ -90,7 +90,7 @@
  		   struct ieee80211_hw **hw)
  {
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 6943b28ba..e37f0c013 100644
+index 233bf2a..d1f2c25 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -450,6 +450,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
@@ -165,7 +165,7 @@
  	.remove_chanctx = mt7996_remove_chanctx,
  	.change_chanctx = mt7996_change_chanctx,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index dc3cacc3a..0412d7375 100644
+index dc3cacc..0412d73 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -128,6 +128,8 @@
@@ -197,5 +197,5 @@
  int mt7996_dfs_init_radar_detector(struct mt7996_phy *phy);
  void mt7996_set_stream_he_eht_caps(struct mt7996_phy *phy);
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0110-mtk-wifi-mt76-mt7996-support-band_idx-option-for-set.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0109-mtk-wifi-mt76-mt7996-support-band_idx-option-for-set.patch
similarity index 94%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0110-mtk-wifi-mt76-mt7996-support-band_idx-option-for-set.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0109-mtk-wifi-mt76-mt7996-support-band_idx-option-for-set.patch
index af1295a..18dc66b 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0110-mtk-wifi-mt76-mt7996-support-band_idx-option-for-set.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0109-mtk-wifi-mt76-mt7996-support-band_idx-option-for-set.patch
@@ -1,7 +1,7 @@
-From e9b712d9fa71f982a52ee20eb86929d8938ec7ca Mon Sep 17 00:00:00 2001
+From ef9c473ce6e0e65c915225af9d8400dbebb7ae67 Mon Sep 17 00:00:00 2001
 From: Howard Hsu <howard-yh.hsu@mediatek.com>
 Date: Mon, 4 Mar 2024 16:21:16 +0800
-Subject: [PATCH 110/116] mtk: wifi: mt76: mt7996: support band_idx option for
+Subject: [PATCH 109/116] mtk: wifi: mt76: mt7996: support band_idx option for
  set_mu/get_mu vendor command
 
 The vendor command set_mu and get_mu should be executed with band_idx.
@@ -16,7 +16,7 @@
  4 files changed, 56 insertions(+), 12 deletions(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index dc719ecbe..cd49f7058 100644
+index e18a553..a71d92f 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -5853,12 +5853,23 @@ int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy)
@@ -66,7 +66,7 @@
  
  void mt7996_set_beacon_vif(void *data, u8 *mac, struct ieee80211_vif *vif)
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index ee36cf5ed..3d5a0c3c2 100644
+index ee36cf5..3d5a0c3 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -888,6 +888,7 @@ enum {
@@ -78,7 +78,7 @@
  #define RATE_CFG_VAL	GENMASK(7, 0)
  
 diff --git a/mt7996/vendor.c b/mt7996/vendor.c
-index 31688c373..64ef5515c 100644
+index 31688c3..64ef551 100644
 --- a/mt7996/vendor.c
 +++ b/mt7996/vendor.c
 @@ -16,6 +16,7 @@ mu_ctrl_policy[NUM_MTK_VENDOR_ATTRS_MU_CTRL] = {
@@ -162,7 +162,7 @@
  
  void mt7996_set_wireless_rts_sigta(struct ieee80211_hw *hw, u8 value) {
 diff --git a/mt7996/vendor.h b/mt7996/vendor.h
-index 0d1ef3228..323467756 100644
+index 0d1ef32..3234677 100644
 --- a/mt7996/vendor.h
 +++ b/mt7996/vendor.h
 @@ -68,6 +68,7 @@ enum mtk_vendor_attr_mu_ctrl {
@@ -174,5 +174,5 @@
  	/* keep last */
  	NUM_MTK_VENDOR_ATTRS_MU_CTRL,
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0111-mtk-wifi-mt76-mt7996-tmp-disable-VOW.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0110-mtk-wifi-mt76-mt7996-tmp-disable-VOW.patch
similarity index 90%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0111-mtk-wifi-mt76-mt7996-tmp-disable-VOW.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0110-mtk-wifi-mt76-mt7996-tmp-disable-VOW.patch
index e8dd3e2..7d6fb6f 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0111-mtk-wifi-mt76-mt7996-tmp-disable-VOW.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0110-mtk-wifi-mt76-mt7996-tmp-disable-VOW.patch
@@ -1,7 +1,7 @@
-From bc25ea014bff5720ae8b2276dab96b7cc317635b Mon Sep 17 00:00:00 2001
+From 2611bc7e80596500702dd3eef9d34014d00869b3 Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Wed, 20 Mar 2024 22:56:44 +0800
-Subject: [PATCH 111/116] mtk: wifi: mt76: mt7996: tmp disable VOW
+Subject: [PATCH 110/116] mtk: wifi: mt76: mt7996: tmp disable VOW
 
 FW will return failed when legacy 5G station connects after legacy 2G
 station, need to check.
@@ -12,7 +12,7 @@
  1 file changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index cd49f7058..1fd844c27 100644
+index a71d92f..895ec3e 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -2369,6 +2369,7 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
@@ -55,5 +55,5 @@
  	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
  				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0112-mtk-wifi-mt76-mt7996-enable-ampdu-limit-to-avoid-BA-.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0111-mtk-wifi-mt76-mt7996-enable-ampdu-limit-to-avoid-BA-.patch
similarity index 95%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0112-mtk-wifi-mt76-mt7996-enable-ampdu-limit-to-avoid-BA-.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0111-mtk-wifi-mt76-mt7996-enable-ampdu-limit-to-avoid-BA-.patch
index f3dae49..4c4f50d 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0112-mtk-wifi-mt76-mt7996-enable-ampdu-limit-to-avoid-BA-.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0111-mtk-wifi-mt76-mt7996-enable-ampdu-limit-to-avoid-BA-.patch
@@ -1,7 +1,7 @@
-From d707638e405334b74dd27428876edb8c7703eafd Mon Sep 17 00:00:00 2001
+From 20695a924111dee64fb9fa5d8c4996f2333b4aee Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 1 Apr 2024 17:00:21 +0800
-Subject: [PATCH 112/116] mtk: wifi: mt76: mt7996: enable ampdu limit to avoid
+Subject: [PATCH 111/116] mtk: wifi: mt76: mt7996: enable ampdu limit to avoid
  BA bound issue
 
 [Description]
@@ -33,7 +33,7 @@
  3 files changed, 95 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 41e26b8a4..b592890ca 100644
+index 4d0fd4b..1c8e503 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -821,6 +821,7 @@ enum {
@@ -45,7 +45,7 @@
  };
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index 1fd844c27..db6aa24ed 100644
+index 895ec3e..3f51c28 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -1344,6 +1344,85 @@ mt7996_mcu_sta_ba(struct mt7996_dev *dev, struct mt76_vif *mvif,
@@ -156,7 +156,7 @@
  
  	return 0;
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index 3d5a0c3c2..a1ac18f72 100644
+index 3d5a0c3..a1ac18f 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -579,6 +579,13 @@ struct sta_rec_ba_uni {
@@ -182,5 +182,5 @@
  
  #define MT7996_MAX_BEACON_SIZE		1338
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0113-wifi-mt76-mt7996-Fix-get_txpower-wrong-result-in-sin.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0112-wifi-mt76-mt7996-Fix-get_txpower-wrong-result-in-sin.patch
similarity index 91%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0113-wifi-mt76-mt7996-Fix-get_txpower-wrong-result-in-sin.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0112-wifi-mt76-mt7996-Fix-get_txpower-wrong-result-in-sin.patch
index 37fb204..5471917 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0113-wifi-mt76-mt7996-Fix-get_txpower-wrong-result-in-sin.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0112-wifi-mt76-mt7996-Fix-get_txpower-wrong-result-in-sin.patch
@@ -1,20 +1,19 @@
-From 4449a5a89e46ab7ce56ca6313fda11c6767dde8d Mon Sep 17 00:00:00 2001
+From e993c3e5aecb0d86609ebda85608bf84547b7ca7 Mon Sep 17 00:00:00 2001
 From: Allen Ye <allen.ye@mediatek.com>
 Date: Mon, 8 Apr 2024 16:56:09 +0800
-Subject: [PATCH 113/116] wifi: mt76: mt7996: Fix get_txpower wrong result in
+Subject: [PATCH 112/116] wifi: mt76: mt7996: Fix get_txpower wrong result in
  single wiphy and legacy mode
 
 Fix get_txpower wrong result in single wiphy and legacy mode.
 ieee80211_hw is get from wiphy0, so we need to get correct phy from vif.
 
 Temporarily use link 0 bss due to mac80211 didn't pass link id here.
-
 ---
  mt7996/main.c | 28 +++++++++++++++++++++++++++-
  1 file changed, 27 insertions(+), 1 deletion(-)
 
 diff --git a/mt7996/main.c b/mt7996/main.c
-index e37f0c013..7abee0c57 100644
+index d1f2c25..dcb0b07 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -975,6 +975,32 @@ out:
@@ -60,5 +59,5 @@
  	.get_stats = mt7996_get_stats,
  	.get_et_sset_count = mt7996_get_et_sset_count,
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0114-mtk-wifi-mt76-mt7996-add-beacon_int_min_gcd-to-suppo.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0113-mtk-wifi-mt76-mt7996-add-beacon_int_min_gcd-to-suppo.patch
similarity index 84%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0114-mtk-wifi-mt76-mt7996-add-beacon_int_min_gcd-to-suppo.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0113-mtk-wifi-mt76-mt7996-add-beacon_int_min_gcd-to-suppo.patch
index 212f934..273a130 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0114-mtk-wifi-mt76-mt7996-add-beacon_int_min_gcd-to-suppo.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0113-mtk-wifi-mt76-mt7996-add-beacon_int_min_gcd-to-suppo.patch
@@ -1,7 +1,7 @@
-From 8da22299c32a6f07912f8d4333b2c5a904d03a0a Mon Sep 17 00:00:00 2001
+From fde0acbc9ad0c869da1a075c408946ba1e7b91d1 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 19 Apr 2024 11:01:21 +0800
-Subject: [PATCH 114/116] mtk: wifi: mt76: mt7996: add beacon_int_min_gcd to
+Subject: [PATCH 113/116] mtk: wifi: mt76: mt7996: add beacon_int_min_gcd to
  support different beacon interval
 
 When beacon_int_min_gcd is zero, all beacon intervals for different
@@ -18,7 +18,7 @@
  1 file changed, 1 insertion(+)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 0dee6596f..3af9d02fe 100644
+index 0dee659..3af9d02 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -41,6 +41,7 @@ static const struct ieee80211_iface_combination if_comb[] = {
@@ -30,5 +30,5 @@
  };
  
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0115-mtk-wifi-mt76-mt7996-Add-connac3-csi-feature.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0114-mtk-wifi-mt76-mt7996-Add-connac3-csi-feature.patch
similarity index 98%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0115-mtk-wifi-mt76-mt7996-Add-connac3-csi-feature.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0114-mtk-wifi-mt76-mt7996-Add-connac3-csi-feature.patch
index 66f1d19..15ec86c 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0115-mtk-wifi-mt76-mt7996-Add-connac3-csi-feature.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0114-mtk-wifi-mt76-mt7996-Add-connac3-csi-feature.patch
@@ -1,7 +1,7 @@
-From 4e663529b04108914d4d684a50ab4c3accb9f232 Mon Sep 17 00:00:00 2001
+From e8ef34a080c0c243559a63d029376436ddf11ac8 Mon Sep 17 00:00:00 2001
 From: mtk20656 <chank.chen@mediatek.com>
 Date: Sat, 20 Jan 2024 12:03:24 +0800
-Subject: [PATCH 115/116] mtk: wifi: mt76: mt7996: Add connac3 csi feature.
+Subject: [PATCH 114/116] mtk: wifi: mt76: mt7996: Add connac3 csi feature.
 
 1. format align to wifi6.
 2. add bw320 support.
@@ -20,10 +20,10 @@
  8 files changed, 910 insertions(+)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index b592890ca..680c08ed7 100644
+index 1c8e503..daaf87f 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1052,6 +1052,7 @@ enum {
+@@ -1053,6 +1053,7 @@ enum {
  	MCU_UNI_EVENT_THERMAL = 0x35,
  	MCU_UNI_EVENT_NIC_CAPAB = 0x43,
  	MCU_UNI_EVENT_TESTMODE_CTRL = 0x46,
@@ -31,7 +31,7 @@
  	MCU_UNI_EVENT_WED_RRO = 0x57,
  	MCU_UNI_EVENT_PER_STA_INFO = 0x6d,
  	MCU_UNI_EVENT_ALL_STA_INFO = 0x6e,
-@@ -1288,6 +1289,7 @@ enum {
+@@ -1290,6 +1291,7 @@ enum {
  	MCU_UNI_CMD_TESTMODE_TRX_PARAM = 0x42,
  	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
  	MCU_UNI_CMD_PRECAL_RESULT = 0x47,
@@ -40,7 +40,7 @@
  	MCU_UNI_CMD_RRO = 0x57,
  	MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 3af9d02fe..ff72aabed 100644
+index 3af9d02..ff72aab 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -806,6 +806,24 @@ error:
@@ -80,7 +80,7 @@
  
  	mphy = phy->dev->mt76.phys[band];
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 7abee0c57..8dca88ac2 100644
+index dcb0b07..35f2495 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -1292,6 +1292,9 @@ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -94,7 +94,7 @@
  }
  
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index db6aa24ed..d8e3181b1 100644
+index 3f51c28..6c9ec31 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -653,6 +653,263 @@ mt7996_mcu_rx_all_sta_info_event(struct mt7996_dev *dev, struct sk_buff *skb)
@@ -582,7 +582,7 @@
 +}
  #endif
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index a1ac18f72..dc93fab25 100644
+index a1ac18f..dc93fab 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -1159,4 +1159,109 @@ struct fixed_rate_table_ctrl {
@@ -696,7 +696,7 @@
 +
  #endif
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 0412d7375..0d537fb9b 100644
+index 0412d73..0d537fb 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -438,6 +438,47 @@ struct mt7996_air_monitor_ctrl {
@@ -776,7 +776,7 @@
  
  int mt7996_mcu_edcca_enable(struct mt7996_phy *phy, bool enable);
 diff --git a/mt7996/vendor.c b/mt7996/vendor.c
-index 64ef5515c..07c0c367f 100644
+index 64ef551..07c0c36 100644
 --- a/mt7996/vendor.c
 +++ b/mt7996/vendor.c
 @@ -119,6 +119,18 @@ beacon_ctrl_policy[NUM_MTK_VENDOR_ATTRS_BEACON_CTRL] = {
@@ -1017,7 +1017,7 @@
  }
  #endif
 diff --git a/mt7996/vendor.h b/mt7996/vendor.h
-index 323467756..abe3fdeab 100644
+index 3234677..abe3fde 100644
 --- a/mt7996/vendor.h
 +++ b/mt7996/vendor.h
 @@ -7,6 +7,7 @@
@@ -1085,5 +1085,5 @@
  
  #endif
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0116-mtk-wifi-mt76-mt7996-add-more-debug-info-for-MLO.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0115-mtk-wifi-mt76-mt7996-add-more-debug-info-for-MLO.patch
similarity index 99%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0116-mtk-wifi-mt76-mt7996-add-more-debug-info-for-MLO.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0115-mtk-wifi-mt76-mt7996-add-more-debug-info-for-MLO.patch
index 5cc3522..fad0b87 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0116-mtk-wifi-mt76-mt7996-add-more-debug-info-for-MLO.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0115-mtk-wifi-mt76-mt7996-add-more-debug-info-for-MLO.patch
@@ -1,7 +1,7 @@
-From 42e52bb5cc78f560047d602325a38709eed0d0ca Mon Sep 17 00:00:00 2001
+From 9f8261c0ffa9a1bbe4f810ce39c70c1f8954c60d Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 22 Apr 2024 11:06:48 +0800
-Subject: [PATCH 116/116] mtk: wifi: mt76: mt7996: add more debug info for MLO
+Subject: [PATCH 115/116] mtk: wifi: mt76: mt7996: add more debug info for MLO
 
 ---
  mt76_connac_mcu.c    |    1 +
@@ -17,7 +17,7 @@
  10 files changed, 1847 insertions(+), 9 deletions(-)
 
 diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 71f3d301c..a4924c4e4 100644
+index 71f3d30..a4924c4 100644
 --- a/mt76_connac_mcu.c
 +++ b/mt76_connac_mcu.c
 @@ -433,6 +433,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
@@ -29,10 +29,10 @@
  }
  EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_basic_tlv);
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 680c08ed7..6fde64bac 100644
+index daaf87f..27bff39 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
-@@ -1285,6 +1285,7 @@ enum {
+@@ -1287,6 +1287,7 @@ enum {
  	MCU_UNI_CMD_THERMAL = 0x35,
  	MCU_UNI_CMD_VOW = 0x37,
  	MCU_UNI_CMD_PP = 0x38,
@@ -41,7 +41,7 @@
  	MCU_UNI_CMD_TESTMODE_TRX_PARAM = 0x42,
  	MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
 diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
-index 26927eda9..77349c263 100644
+index 26927ed..77349c2 100644
 --- a/mt7996/debugfs.c
 +++ b/mt7996/debugfs.c
 @@ -314,15 +314,17 @@ mt7996_fw_debug_wm_set(void *data, u64 val)
@@ -123,7 +123,7 @@
  	if (is_fwlog) {
  		if (dev->relay_fwlog)
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index 2a45fc03d..a8cf24c3c 100644
+index 2a45fc0..a8cf24c 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -331,6 +331,10 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
@@ -163,7 +163,7 @@
  }
  
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 8dca88ac2..74b874758 100644
+index 35f2495..2cc0c32 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -431,6 +431,9 @@ static int mt7996_add_bss_conf(struct mt7996_phy *phy,
@@ -230,7 +230,7 @@
  
  	if (rem)
 diff --git a/mt7996/mcu.c b/mt7996/mcu.c
-index d8e3181b1..38305d810 100644
+index 6c9ec31..fa17f73 100644
 --- a/mt7996/mcu.c
 +++ b/mt7996/mcu.c
 @@ -333,6 +333,10 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
@@ -300,7 +300,7 @@
  				 &data, sizeof(data), true);
  }
 diff --git a/mt7996/mcu.h b/mt7996/mcu.h
-index dc93fab25..84d961d11 100644
+index dc93fab..84d961d 100644
 --- a/mt7996/mcu.h
 +++ b/mt7996/mcu.h
 @@ -1035,6 +1035,14 @@ enum {
@@ -319,7 +319,7 @@
  	UNI_CMD_SR_ENABLE = 0x1,
  	UNI_CMD_SR_ENABLE_SD,
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 0d537fb9b..de7cf1ecc 100644
+index 0d537fb..de7cf1e 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
 @@ -730,6 +730,13 @@ struct mt7996_dev {
@@ -364,7 +364,7 @@
  
  #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 diff --git a/mt7996/mtk_debug.h b/mt7996/mtk_debug.h
-index da2a60723..829902398 100644
+index da2a607..8299023 100644
 --- a/mt7996/mtk_debug.h
 +++ b/mt7996/mtk_debug.h
 @@ -2288,4 +2288,664 @@ enum cipher_suit {
@@ -1033,7 +1033,7 @@
 +
  #endif
 diff --git a/mt7996/mtk_debugfs.c b/mt7996/mtk_debugfs.c
-index ddb4a7ca2..d20c40a5f 100644
+index c787551..6640448 100644
 --- a/mt7996/mtk_debugfs.c
 +++ b/mt7996/mtk_debugfs.c
 @@ -3228,6 +3228,1072 @@ mt7996_thermal_recal_set(void *data, u64 val)
@@ -2136,5 +2136,5 @@
  	return 0;
  }
 -- 
-2.39.2
+2.18.0
 
diff --git a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0117-mtk-wifi-mt76-mt7996-remain-multiple-wiphy-model-for.patch b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0116-mtk-wifi-mt76-mt7996-remain-multiple-wiphy-model-for.patch
similarity index 91%
rename from autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0117-mtk-wifi-mt76-mt7996-remain-multiple-wiphy-model-for.patch
rename to autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0116-mtk-wifi-mt76-mt7996-remain-multiple-wiphy-model-for.patch
index 8eb928e..351cb74 100644
--- a/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0117-mtk-wifi-mt76-mt7996-remain-multiple-wiphy-model-for.patch
+++ b/autobuild_mac80211_release/mt7988_mt7996_mac80211_mlo/package/kernel/mt76/patches/0116-mtk-wifi-mt76-mt7996-remain-multiple-wiphy-model-for.patch
@@ -1,8 +1,8 @@
-From ac266f21b594867461f3354940b84d218992a42f Mon Sep 17 00:00:00 2001
+From 81a4701e1fb249ce062c5d17e6c670265ef0f05e Mon Sep 17 00:00:00 2001
 From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 Date: Mon, 22 Apr 2024 16:49:48 +0800
-Subject: [PATCH] mtk: wifi: mt76: mt7996: remain multiple wiphy model for
- testmode
+Subject: [PATCH 116/116] mtk: wifi: mt76: mt7996: remain multiple wiphy model
+ for testmode
 
 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
 ---
@@ -12,7 +12,7 @@
  3 files changed, 22 insertions(+), 14 deletions(-)
 
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 047d2b78..3baf40d1 100644
+index ff72aab..58944c6 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -794,9 +794,11 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
@@ -43,7 +43,7 @@
  #ifdef CONFIG_MTK_VENDOR
  	mt7996_unregister_csi(phy);
 diff --git a/mt7996/main.c b/mt7996/main.c
-index 74b87475..ea230921 100644
+index 2cc0c32..9738e76 100644
 --- a/mt7996/main.c
 +++ b/mt7996/main.c
 @@ -140,8 +140,8 @@ static int mt7996_start(struct ieee80211_hw *hw)
@@ -82,10 +82,10 @@
  	mvif->dev = dev;
  	mvif->hw = hw;
 diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
-index 9a9eb75b..5555c11c 100644
+index de7cf1e..45f8af1 100644
 --- a/mt7996/mt7996.h
 +++ b/mt7996/mt7996.h
-@@ -868,16 +868,15 @@ mt7996_get_background_radar_cap(struct mt7996_dev *dev)
+@@ -860,16 +860,15 @@ mt7996_get_background_radar_cap(struct mt7996_dev *dev)
  static inline struct mt7996_phy *
  mt7996_band_phy(struct ieee80211_hw *hw, enum nl80211_band band)
  {