diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3001-mt76-mt7915-wed-add-wed-tx-support.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3001-mt76-mt7915-wed-add-wed-tx-support.patch
index f26cd8e..3ec16f5 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3001-mt76-mt7915-wed-add-wed-tx-support.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3001-mt76-mt7915-wed-add-wed-tx-support.patch
@@ -1,7 +1,7 @@
-From 8e8c3896353c975491cf322737c50606fb2d3611 Mon Sep 17 00:00:00 2001
+From 2d217a2c6ffc6069b76956213a60e055e55d59df Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 10:38:53 +0800
-Subject: [PATCH 3001/3013] mt76: mt7915: wed: add wed tx support
+Subject: [PATCH 3001/3014] mt76: mt7915: wed: add wed tx support
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -12,7 +12,7 @@
  4 files changed, 13 insertions(+), 8 deletions(-)
 
 diff --git a/mt76_connac.h b/mt76_connac.h
-index 8ba883b..f70987d 100644
+index 8ba883b0..f70987dd 100644
 --- a/mt76_connac.h
 +++ b/mt76_connac.h
 @@ -116,6 +116,7 @@ struct mt76_connac_sta_key_conf {
@@ -24,7 +24,7 @@
  struct mt76_connac_fw_txp {
  	__le16 flags;
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index a0df785..0984357 100644
+index a0df7853..0984357a 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -891,9 +891,9 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
@@ -65,7 +65,7 @@
  
  static void
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 09cf35c..2dd78ca 100644
+index 09cf35c1..2dd78ca2 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -1533,14 +1533,14 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
@@ -86,7 +86,7 @@
  
  	ctx->dev = NULL;
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index c1b421d..04411e7 100644
+index c1b421d1..04411e77 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -11,7 +11,7 @@
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch
index f31b3ea..5a6cc6c 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3002-mt76-mt7915-wed-add-wds-support-when-wed-is-enabled.patch
@@ -1,7 +1,7 @@
-From 149dee94c0b88125fca16175d51719d64e8b913d Mon Sep 17 00:00:00 2001
+From 87fc706b27c4947f51ea0ed1045c841c54af2700 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 13 Dec 2022 17:51:26 +0800
-Subject: [PATCH 3002/3013] mt76: mt7915: wed: add wds support when wed is
+Subject: [PATCH 3002/3014] mt76: mt7915: wed: add wds support when wed is
  enabled
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
@@ -15,7 +15,7 @@
  6 files changed, 81 insertions(+), 8 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index c81ece0..cba11f6 100644
+index c81ece06..cba11f6c 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -60,6 +60,12 @@ enum mt76_wed_type {
@@ -32,7 +32,7 @@
  	u32 (*rr)(struct mt76_dev *dev, u32 offset);
  	void (*wr)(struct mt76_dev *dev, u32 offset, u32 val);
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 2dd78ca..eef4c3b 100644
+index 2dd78ca2..eef4c3b4 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -696,8 +696,15 @@ int mt7915_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
@@ -81,7 +81,7 @@
  	ctx->dev = NULL;
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index d380811..f494d9f 100644
+index d3808116..f494d9f6 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2364,8 +2364,17 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
@@ -105,7 +105,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index b33e671..f2f88cc 100644
+index b33e671d..f2f88cc4 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -284,6 +284,7 @@ enum {
@@ -117,7 +117,7 @@
  	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
  	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
 diff --git a/util.c b/util.c
-index 5819644..5cd5ede 100644
+index 58196442..5cd5ede0 100644
 --- a/util.c
 +++ b/util.c
 @@ -42,9 +42,14 @@ bool __mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val,
@@ -185,7 +185,7 @@
  int mt76_get_min_avg_rssi(struct mt76_dev *dev, bool ext_phy)
  {
 diff --git a/util.h b/util.h
-index 260965d..99b7263 100644
+index 260965dd..99b7263c 100644
 --- a/util.h
 +++ b/util.h
 @@ -27,7 +27,12 @@ enum {
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
index cb9011e..8c33c0f 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
@@ -1,70 +1,121 @@
-From 24574e010e78c82cca6c0aa7c9eef48cebbf3e2e Mon Sep 17 00:00:00 2001
+From 0f7a824cab3692fe35f73f6d11e788619e02193f Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Fri, 25 Nov 2022 12:05:06 +0800
-Subject: [PATCH 3003/3013] mt76: connac: wed: add wed rx copy skb
+Date: Thu, 5 Jan 2023 16:43:57 +0800
+Subject: [PATCH 3003/3014] mt76: connac: wed: add wed rx copy skb
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
- dma.c | 23 ++++++++++++++++++-----
- 1 file changed, 18 insertions(+), 5 deletions(-)
+ dma.c | 51 ++++++++++++++++++++++++++++++++++++++++-----------
+ 1 file changed, 40 insertions(+), 11 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index dc8d888..53c7528 100644
+index f977b7f5..1082d6f1 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -386,9 +386,12 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -207,11 +207,11 @@ mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q)
+ 
+ static int
+ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+-		    struct mt76_queue_buf *buf, void *data)
++		    struct mt76_queue_buf *buf, void *data,
++		    struct mt76_txwi_cache *txwi)
+ {
+ 	struct mt76_desc *desc = &q->desc[q->head];
+ 	struct mt76_queue_entry *entry = &q->entry[q->head];
+-	struct mt76_txwi_cache *txwi = NULL;
+ 	u32 buf1 = 0, ctrl;
+ 	int idx = q->head;
+ 	int rx_token;
+@@ -220,9 +220,11 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+ 
+ 	if ((q->flags & MT_QFLAG_WED) &&
+ 	    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
+-		txwi = mt76_get_rxwi(dev);
+-		if (!txwi)
+-			return -ENOMEM;
++		if(!txwi) {
++			txwi = mt76_get_rxwi(dev);
++			if (!txwi)
++				return -ENOMEM;
++		}
+ 
+ 		rx_token = mt76_rx_token_consume(dev, data, txwi, buf->addr);
+ 		if (rx_token < 0) {
+@@ -406,6 +408,7 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ 		u32 token = FIELD_GET(MT_DMA_CTL_TOKEN,
+ 				      le32_to_cpu(desc->buf1));
+ 		struct mt76_txwi_cache *t = mt76_rx_token_release(dev, token);
++		struct mt76_queue_buf qbuf;
+ 
+ 		if (!t)
+ 			return NULL;
+@@ -414,11 +417,33 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  				 SKB_WITH_OVERHEAD(q->buf_size),
  				 DMA_FROM_DEVICE);
  
 -		buf = t->ptr;
+-		t->dma_addr = 0;
+-		t->ptr = NULL;
 +		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
 +		if (!buf)
 +			return NULL;
 +
 +		memcpy(buf, t->ptr, SKB_WITH_OVERHEAD(q->buf_size));
- 		t->dma_addr = 0;
--		t->ptr = NULL;
- 
- 		mt76_put_rxwi(dev, t);
- 
-@@ -568,6 +571,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 	while (q->queued < q->ndesc - 1) {
- 		struct mt76_txwi_cache *t = NULL;
- 		struct mt76_queue_buf qbuf;
-+		bool skip_alloc = false;
- 		void *buf = NULL;
- 
- 		if ((q->flags & MT_QFLAG_WED) &&
-@@ -575,11 +579,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 			t = mt76_get_rxwi(dev);
- 			if (!t)
- 				break;
++
++		t->dma_addr = dma_map_single(dev->dma_dev, t->ptr,
++					     SKB_WITH_OVERHEAD(q->buf_size),
++					     DMA_FROM_DEVICE);
++		if (unlikely(dma_mapping_error(dev->dma_dev, t->dma_addr))) {
++			skb_free_frag(t->ptr);
++			mt76_put_rxwi(dev, t);
++			return NULL;
++		}
 +
-+			if (t->ptr) {
-+				skip_alloc = true;
-+				buf = t->ptr;
-+			}
- 		}
++		qbuf.addr = t->dma_addr;
++		qbuf.len = SKB_WITH_OVERHEAD(q->buf_size);
++		qbuf.skip_unmap = false;
  
--		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
--		if (!buf)
--			break;
-+		if (!skip_alloc) {
-+			buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
-+			if (!buf)
-+				break;
+-		mt76_put_rxwi(dev, t);
++		if (mt76_dma_add_rx_buf(dev, q, &qbuf, t->ptr, t) < 0) {
++			dma_unmap_single(dev->dma_dev, t->dma_addr,
++					 SKB_WITH_OVERHEAD(q->buf_size),
++					 DMA_FROM_DEVICE);
++			skb_free_frag(t->ptr);
++			mt76_put_rxwi(dev, t);
++			return NULL;
 +		}
  
- 		addr = dma_map_single(dev->dma_dev, buf, len, DMA_FROM_DEVICE);
- 		if (unlikely(dma_mapping_error(dev->dma_dev, addr))) {
-@@ -949,5 +960,7 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+ 		if (drop) {
+ 			u32 ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
+@@ -587,6 +612,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+ 	int len = SKB_WITH_OVERHEAD(q->buf_size);
+ 	int frames = 0, offset = q->buf_offset;
+ 	dma_addr_t addr;
++	bool flags = false;
  
- 	if (mtk_wed_device_active(&dev->mmio.wed))
- 		mtk_wed_device_detach(&dev->mmio.wed);
+ 	if (!q->ndesc)
+ 		return 0;
+@@ -610,7 +636,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+ 		qbuf.addr = addr + offset;
+ 		qbuf.len = len - offset;
+ 		qbuf.skip_unmap = false;
+-		if (mt76_dma_add_rx_buf(dev, q, &qbuf, buf) < 0) {
++		if (mt76_dma_add_rx_buf(dev, q, &qbuf, buf, NULL) < 0) {
+ 			dma_unmap_single(dev->dma_dev, addr, len,
+ 					 DMA_FROM_DEVICE);
+ 			skb_free_frag(buf);
+@@ -619,7 +645,10 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+ 		frames++;
+ 	}
+ 
+-	if (frames)
++	flags = (q->flags & MT_QFLAG_WED) &&
++		FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX;
 +
-+	mt76_free_pending_rxwi(dev);
- }
- EXPORT_SYMBOL_GPL(mt76_dma_cleanup);
++	if (frames || flags)
+ 		mt76_dma_kick_queue(dev, q);
+ 
+ 	spin_unlock_bh(&q->lock);
 -- 
 2.18.0
 
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
index ce833f6..be492fc 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3004-mt76-mt7915-wed-add-fill-receive-path-to-report-wed-.patch
@@ -1,7 +1,7 @@
-From 0aeb9b3feebcb664e84146cacdf3bd3eb3b04855 Mon Sep 17 00:00:00 2001
+From b750e9f13c700e0b9f60c1d29b0493a539fd8c2f Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 19 May 2022 13:44:42 +0800
-Subject: [PATCH 3004/3013] mt76: mt7915: wed: add fill receive path to report
+Subject: [PATCH 3004/3014] mt76: mt7915: wed: add fill receive path to report
  wed idx
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
@@ -10,7 +10,7 @@
  1 file changed, 19 insertions(+)
 
 diff --git a/mt7915/main.c b/mt7915/main.c
-index eef4c3b..7dd3973 100644
+index eef4c3b4..7dd3973f 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -1565,6 +1565,24 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
index 9dad25a..28db7a8 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
@@ -1,7 +1,7 @@
-From e5e65159cea489e2d8154cbfdc84d7d3d829ed63 Mon Sep 17 00:00:00 2001
+From f8d9b46c86122218ee1c60d813cf371b25401780 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:07:46 +0800
-Subject: [PATCH 3005/3013] mt76: mt7915: wed: add ser support when wed on
+Subject: [PATCH 3005/3014] mt76: mt7915: wed: add ser support when wed on
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
@@ -15,7 +15,7 @@
  7 files changed, 76 insertions(+), 14 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 53c7528..35beec7 100644
+index 1082d6f1..5163a8e9 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -165,7 +165,7 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
@@ -35,7 +35,7 @@
  
  static void
  mt76_dma_sync_idx(struct mt76_dev *dev, struct mt76_queue *q)
-@@ -618,14 +619,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -656,14 +657,18 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  	return frames;
  }
  
@@ -57,7 +57,7 @@
  	if (!mtk_wed_device_active(wed))
  		q->flags &= ~MT_QFLAG_WED;
  
-@@ -637,7 +642,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -675,7 +680,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
  
  	switch (type) {
  	case MT76_WED_Q_TX:
@@ -66,7 +66,7 @@
  		if (!ret)
  			q->wed_regs = wed->tx_ring[ring].reg_base;
  		break;
-@@ -653,7 +658,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -691,7 +696,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
  			q->wed_regs = wed->txfree_ring.reg_base;
  		break;
  	case MT76_WED_Q_RX:
@@ -75,7 +75,7 @@
  		if (!ret)
  			q->wed_regs = wed->rx_ring[ring].reg_base;
  		break;
-@@ -666,6 +671,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -704,6 +709,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
  	return 0;
  #endif
  }
@@ -83,7 +83,7 @@
  
  static int
  mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
-@@ -692,7 +698,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -730,7 +736,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  	if (!q->entry)
  		return -ENOMEM;
  
@@ -92,7 +92,7 @@
  	if (ret)
  		return ret;
  
-@@ -743,8 +749,13 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+@@ -781,8 +787,13 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
  		q->desc[i].ctrl = cpu_to_le32(MT_DMA_CTL_DMA_DONE);
  
  	mt76_dma_rx_cleanup(dev, q);
@@ -109,7 +109,7 @@
  	if (!q->rx_head)
  		return;
 diff --git a/dma.h b/dma.h
-index 53c6ce2..4b9bc7f 100644
+index 53c6ce25..4b9bc7f4 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -56,5 +56,6 @@ enum mt76_mcu_evt_type {
@@ -120,7 +120,7 @@
  
  #endif
 diff --git a/mt76.h b/mt76.h
-index cba11f6..369e1e4 100644
+index cba11f6c..369e1e4b 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -1401,6 +1401,7 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
@@ -132,7 +132,7 @@
  		      struct napi_struct *napi);
  void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index e3fa064..1ae6c33 100644
+index e3fa0649..1ae6c339 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -4,6 +4,7 @@
@@ -211,7 +211,7 @@
  }
  
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 0984357..0d0ae7a 100644
+index 0984357a..0d0ae7ab 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -896,6 +896,18 @@ u32 mt7915_wed_init_buf(void *ptr, dma_addr_t phys, int token_id)
@@ -247,7 +247,7 @@
  	if (ext_phy)
  		ieee80211_stop_queues(ext_phy->hw);
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 04411e7..e0761e8 100644
+index 04411e77..e0761e89 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -619,6 +619,8 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
@@ -268,7 +268,7 @@
  	dev->mt76.rx_token_size = wed->wlan.rx_npkt;
  
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 5cc1924..89c13db 100644
+index 5cc19240..89c13dbe 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -554,6 +554,7 @@ void mt7915_wfsys_reset(struct mt7915_dev *dev);
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
index f2e9a93..df64e4d 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
@@ -1,7 +1,7 @@
-From 007ab43e5052b5bc21e5c720d09b30f0b56e6e79 Mon Sep 17 00:00:00 2001
+From 4a7d3194f24e390b37bd9b1349ee25a4ca5e17aa Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 2 Sep 2022 14:40:40 +0800
-Subject: [PATCH 3006/3013] mt76: mt7915: wed: enable red per-band token drop
+Subject: [PATCH 3006/3014] mt76: mt7915: wed: enable red per-band token drop
  for HW Path
 
 Limit the number of token used by each band. If a band uses too many token,
@@ -18,7 +18,7 @@
  5 files changed, 44 insertions(+), 10 deletions(-)
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 98b0074..21ea55d 100644
+index 98b00747..21ea55d1 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1174,13 +1174,13 @@ enum {
@@ -37,7 +37,7 @@
  	MCU_EXT_CMD_SET_RDD_PATTERN = 0x7d,
  	MCU_EXT_CMD_MWDS_SUPPORT = 0x80,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index f494d9f..116a5cc 100644
+index f494d9f6..116a5cc9 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2376,6 +2376,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
@@ -123,7 +123,7 @@
  int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set)
  {
 diff --git a/mt7915/mcu.h b/mt7915/mcu.h
-index f2f88cc..572cc16 100644
+index f2f88cc4..572cc16a 100644
 --- a/mt7915/mcu.h
 +++ b/mt7915/mcu.h
 @@ -285,6 +285,7 @@ enum {
@@ -135,7 +135,7 @@
  	MCU_WA_PARAM_RED_SHOW_STA = 0xf,
  	MCU_WA_PARAM_RED_TARGET_DELAY = 0x10,
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index e0761e8..b29fe7a 100644
+index e0761e89..b29fe7a4 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -759,7 +759,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
@@ -148,7 +148,7 @@
  	wed->wlan.tx_tbit[1] = is_mt7915(&dev->mt76) ? 5 : 31;
  	wed->wlan.txfree_tbit = is_mt7986(&dev->mt76) ? 2 : 1;
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 89c13db..2335f78 100644
+index 89c13dbe..2335f78f 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -56,6 +56,7 @@
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3007-mt76-mt7915-wed-find-rx-token-by-physical-address.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3007-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
index e3f9cfb..35d9a77 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3007-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3007-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
@@ -1,7 +1,7 @@
-From 7d67ffd5b29ee60e02da2bd19dfb12839393ca3c Mon Sep 17 00:00:00 2001
+From 7c2e0d8a456963e4d5df268b7b28ae8a5d0d94d9 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 25 Nov 2022 14:32:35 +0800
-Subject: [PATCH 3007/3013] mt76: mt7915: wed: find rx token by physical
+Subject: [PATCH 3007/3014] mt76: mt7915: wed: find rx token by physical
  address
 
 The token id in RxDMAD may be incorrect when it is not the last frame due to
@@ -13,10 +13,10 @@
  1 file changed, 20 insertions(+), 1 deletion(-)
 
 diff --git a/dma.c b/dma.c
-index 35beec7..327ed3b 100644
+index 5163a8e9..0dce97fb 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -376,10 +376,29 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -406,11 +406,30 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  
  	if ((q->flags & MT_QFLAG_WED) &&
  	    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
@@ -25,7 +25,8 @@
  				      le32_to_cpu(desc->buf1));
 -		struct mt76_txwi_cache *t = mt76_rx_token_release(dev, token);
 +		struct mt76_txwi_cache *t;
-+
+ 		struct mt76_queue_buf qbuf;
+ 
 +		if (*more) {
 +			spin_lock_bh(&dev->rx_token_lock);
 +
@@ -42,7 +43,7 @@
 +			if (!find)
 +				return NULL;
 +		}
- 
++
 +		t = mt76_rx_token_release(dev, token);
  		if (!t)
  			return NULL;
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3008-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3008-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
index 6841e6e..4616fdd 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3008-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3008-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
@@ -1,7 +1,7 @@
-From d2ee77eae35b28f1a1ff66a7dc7e6b3ef82bcffe Mon Sep 17 00:00:00 2001
+From 66908ed646059fd3dd40a6430ba8337cfc69fbb7 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Fri, 25 Nov 2022 14:37:58 +0800
-Subject: [PATCH 3008/3013] mt76: mt7915: wed: drop scatter and gather frame
+Subject: [PATCH 3008/3014] mt76: mt7915: wed: drop scatter and gather frame
 
 The scatter and gather frame may be incorrect because WED and WO may
 send frames to host driver interleaved.
@@ -14,10 +14,10 @@
  3 files changed, 11 insertions(+)
 
 diff --git a/dma.c b/dma.c
-index 327ed3b..0914266 100644
+index 0dce97fb..98d2a29a 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -420,6 +420,15 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -470,6 +470,15 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  
  			*drop = !!(ctrl & (MT_DMA_CTL_TO_HOST_A |
  					   MT_DMA_CTL_DROP));
@@ -34,7 +34,7 @@
  	} else {
  		buf = e->buf;
 diff --git a/dma.h b/dma.h
-index 4b9bc7f..ce8ac42 100644
+index 4b9bc7f4..ce8ac426 100644
 --- a/dma.h
 +++ b/dma.h
 @@ -19,6 +19,7 @@
@@ -46,7 +46,7 @@
  #define MT_DMA_PPE_CPU_REASON		GENMASK(15, 11)
  #define MT_DMA_PPE_ENTRY		GENMASK(30, 16)
 diff --git a/mt76.h b/mt76.h
-index 369e1e4..b10a16f 100644
+index 369e1e4b..b10a16f8 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -30,6 +30,7 @@
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3009-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3009-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
index 6aa717b..c9f2a59 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3009-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3009-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
@@ -1,7 +1,7 @@
-From 74150a20593cebc6ae65e785ae3a784c0a21e23a Mon Sep 17 00:00:00 2001
+From 2610d420e26e59804355c34498acd79cf3c8336e Mon Sep 17 00:00:00 2001
 From: Lian Chen <lian.chen@mediatek.com>
 Date: Mon, 7 Nov 2022 14:47:44 +0800
-Subject: [PATCH 3009/3013] mt76: mt7915: wed: HW ATF support for mt7986
+Subject: [PATCH 3009/3014] mt76: mt7915: wed: HW ATF support for mt7986
 
 Signed-off-by: Lian Chen <lian.chen@mediatek.com>
 ---
@@ -16,7 +16,7 @@
  mode change 100644 => 100755 mt7915/init.c
 
 diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
-index 21ea55d..86ce55d 100644
+index 21ea55d1..86ce55d1 100644
 --- a/mt76_connac_mcu.h
 +++ b/mt76_connac_mcu.h
 @@ -1159,6 +1159,7 @@ enum {
@@ -36,7 +36,7 @@
  	MCU_EXT_CMD_EFUSE_FREE_BLOCK = 0x4f,
  	MCU_EXT_CMD_TX_POWER_FEATURE_CTRL = 0x58,
 diff --git a/mt7915/debugfs.c b/mt7915/debugfs.c
-index 3ef2148..b178036 100644
+index 3ef2148b..b178036c 100644
 --- a/mt7915/debugfs.c
 +++ b/mt7915/debugfs.c
 @@ -12,6 +12,10 @@
@@ -468,7 +468,7 @@
 diff --git a/mt7915/init.c b/mt7915/init.c
 old mode 100644
 new mode 100755
-index e044f50..ef752e1
+index e044f503..ef752e10
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -563,10 +563,46 @@ mt7915_init_led_mux(struct mt7915_dev *dev)
@@ -529,7 +529,7 @@
  
  int mt7915_txbf_init(struct mt7915_dev *dev)
 diff --git a/mt7915/main.c b/mt7915/main.c
-index 7dd3973..c87f04b 100644
+index 7dd3973f..c87f04b1 100644
 --- a/mt7915/main.c
 +++ b/mt7915/main.c
 @@ -209,6 +209,7 @@ int mt7915_init_vif(struct mt7915_phy *phy, struct ieee80211_vif *vif, bool bf_e
@@ -576,7 +576,7 @@
  }
  
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 116a5cc..15f20ad 100644
+index 116a5cc9..15f20add 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -3529,6 +3529,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
@@ -752,7 +752,7 @@
  {
  #define MT_BF_PROCESSING	4
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index 2335f78..c3a0b32 100644
+index 2335f78f..c3a0b326 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -127,6 +127,58 @@ struct mt7915_twt_flow {
@@ -859,7 +859,7 @@
  int mt7915_mcu_set_txpower_sku(struct mt7915_phy *phy);
  int mt7915_mcu_get_txpower_sku(struct mt7915_phy *phy, s8 *txpower, int len,
 diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
-index f223871..d6ff7a5 100644
+index 576995dc..5e64fe91 100644
 --- a/mt7915/mtk_debugfs.c
 +++ b/mt7915/mtk_debugfs.c
 @@ -1368,7 +1368,6 @@ static EMPTY_QUEUE_INFO_T ple_txcmd_queue_empty_info[] = {
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3010-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3010-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
index 293bb81..7eb7d96 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3010-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3010-mt76-mt7915-wed-add-mt7916-2-pcie-support-when-wed-o.patch
@@ -1,7 +1,7 @@
-From f5d57a09b9aaa434403288bb2c07132120788891 Mon Sep 17 00:00:00 2001
+From 60ddcc5d8263f9bd6c62697adb479e5b00b8b514 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 2 Dec 2022 17:17:06 +0800
-Subject: [PATCH 3010/3013] mt76: mt7915: wed: add mt7916 2 pcie support when
+Subject: [PATCH 3010/3014] mt76: mt7915: wed: add mt7916 2 pcie support when
  wed on
 
 It should use bit 23 in interrupt mask for wfdma band1 data
@@ -15,7 +15,7 @@
  3 files changed, 13 insertions(+), 8 deletions(-)
 
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 1ae6c33..3626008 100644
+index 1ae6c339..36260085 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -88,8 +88,12 @@ static void mt7915_dma_config(struct mt7915_dev *dev)
@@ -34,7 +34,7 @@
  				   MT7916_RXQ_MCU_WA_MAIN);
  			TXQ_CONFIG(0, WFDMA0, MT_INT_WED_TX_DONE_BAND0,
 diff --git a/mt7915/mcu.c b/mt7915/mcu.c
-index 15f20ad..a268734 100644
+index 15f20add..a2687346 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
 @@ -2365,7 +2365,8 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
@@ -48,7 +48,7 @@
  						0, 0, 0);
  		else
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index b29fe7a..4bc8e8c 100644
+index b29fe7a4..4bc8e8cd 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -966,13 +966,13 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3011-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3011-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch
index 7de420c..bac87e6 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3011-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3011-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch
@@ -1,21 +1,21 @@
-From afd516f8fd841fc7fc46667edc57f2f10d92de46 Mon Sep 17 00:00:00 2001
-From: Evelyn Tsai <evelyn.tsai@mediatek.com>
-Date: Wed, 21 Dec 2022 09:47:01 +0800
-Subject: [PATCH 3011/3013] mt76: mt7915: wed: add rxwi for further in chip rro
- development
+From dc6f151a8420ce5569b1db103525543600b2f9b5 Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Fri, 6 Jan 2023 18:18:50 +0800
+Subject: [PATCH 3011/3014] mt76: mt7915: wed: add rxwi for further in chip rro
 
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
- dma.c           | 98 +++++++++++++++++++++++++------------------------
- mac80211.c      |  2 +-
- mt76.h          | 24 +++++++-----
- mt7915/dma.c    |  2 -
- mt7915/mmio.c   | 21 ++++++-----
- mt7915/mt7915.h |  1 +
- tx.c            | 16 ++++----
- 7 files changed, 86 insertions(+), 78 deletions(-)
+ dma.c           | 107 ++++++++++++++++++++++++------------------------
+ mac80211.c      |   2 +-
+ mt76.h          |  24 +++++++----
+ mt7915/dma.c    |   2 -
+ mt7915/mmio.c   |  21 +++++-----
+ mt7915/mt7915.h |   1 +
+ tx.c            |  16 ++++----
+ 7 files changed, 90 insertions(+), 83 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 0914266..7ef272e 100644
+index 98d2a29a..21f26df7 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -59,17 +59,17 @@ mt76_alloc_txwi(struct mt76_dev *dev)
@@ -129,6 +129,45 @@
  }
 @@ -209,7 +209,7 @@ mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q)
  static int
+ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+ 		    struct mt76_queue_buf *buf, void *data,
+-		    struct mt76_txwi_cache *txwi)
++		    struct mt76_rxwi_cache *rxwi)
+ {
+ 	struct mt76_desc *desc = &q->desc[q->head];
+ 	struct mt76_queue_entry *entry = &q->entry[q->head];
+@@ -221,15 +221,15 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+ 
+ 	if ((q->flags & MT_QFLAG_WED) &&
+ 	    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
+-		if(!txwi) {
+-			txwi = mt76_get_rxwi(dev);
+-			if (!txwi)
++		if(!rxwi) {
++			rxwi = mt76_get_rxwi(dev);
++			if (!rxwi)
+ 				return -ENOMEM;
+ 		}
+ 
+-		rx_token = mt76_rx_token_consume(dev, data, txwi, buf->addr);
++		rx_token = mt76_rx_token_consume(dev, data, rxwi, buf->addr);
+ 		if (rx_token < 0) {
+-			mt76_put_rxwi(dev, txwi);
++			mt76_put_rxwi(dev, rxwi);
+ 			return -ENOMEM;
+ 		}
+ 
+@@ -244,7 +244,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+ 
+ 	entry->dma_addr[0] = buf->addr;
+ 	entry->dma_len[0] = buf->len;
+-	entry->txwi = txwi;
++	entry->rxwi = rxwi;
+ 	entry->buf = data;
+ 	entry->wcid = 0xffff;
+ 	entry->skip_buf1 = true;
+@@ -257,7 +257,7 @@ mt76_dma_add_rx_buf(struct mt76_dev *dev, struct mt76_queue *q,
+ static int
  mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
  		 struct mt76_queue_buf *buf, int nbufs, u32 info,
 -		 struct sk_buff *skb, void *txwi)
@@ -136,24 +175,7 @@
  {
  	struct mt76_queue_entry *entry;
  	struct mt76_desc *desc;
-@@ -227,13 +227,13 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
- 
- 		if ((q->flags & MT_QFLAG_WED) &&
- 		    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
--			struct mt76_txwi_cache *t = txwi;
-+			struct mt76_rxwi_cache *r = rxwi;
- 			int rx_token;
- 
--			if (!t)
-+			if (!r)
- 				return -ENOMEM;
- 
--			rx_token = mt76_rx_token_consume(dev, (void *)skb, t,
-+			rx_token = mt76_rx_token_consume(dev, (void *)skb, r,
- 							 buf[0].addr);
- 			if (rx_token < 0)
- 				return -ENOMEM;
-@@ -280,6 +280,7 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -310,6 +310,7 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
  	}
  
  	q->entry[idx].txwi = txwi;
@@ -161,12 +183,13 @@
  	q->entry[idx].skb = skb;
  	q->entry[idx].wcid = 0xffff;
  
-@@ -379,13 +380,13 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -409,14 +410,14 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  		u32 id, find = 0;
  		u32 token = FIELD_GET(MT_DMA_CTL_TOKEN,
  				      le32_to_cpu(desc->buf1));
 -		struct mt76_txwi_cache *t;
 +		struct mt76_rxwi_cache *r;
+ 		struct mt76_queue_buf qbuf;
  
  		if (*more) {
  			spin_lock_bh(&dev->rx_token_lock);
@@ -178,7 +201,7 @@
  					find = 1;
  					desc->buf1 = FIELD_PREP(MT_DMA_CTL_TOKEN, id);
  					token = id;
-@@ -398,11 +399,11 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -429,11 +430,11 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  				return NULL;
  		}
  
@@ -193,21 +216,45 @@
  				 SKB_WITH_OVERHEAD(q->buf_size),
  				 DMA_FROM_DEVICE);
  
-@@ -410,10 +411,10 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -441,27 +442,27 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  		if (!buf)
  			return NULL;
  
 -		memcpy(buf, t->ptr, SKB_WITH_OVERHEAD(q->buf_size));
--		t->dma_addr = 0;
 +		memcpy(buf, r->ptr, SKB_WITH_OVERHEAD(q->buf_size));
-+		r->dma_addr = 0;
+ 
+-		t->dma_addr = dma_map_single(dev->dma_dev, t->ptr,
++		r->dma_addr = dma_map_single(dev->dma_dev, r->ptr,
+ 					     SKB_WITH_OVERHEAD(q->buf_size),
+ 					     DMA_FROM_DEVICE);
+-		if (unlikely(dma_mapping_error(dev->dma_dev, t->dma_addr))) {
+-			skb_free_frag(t->ptr);
+-			mt76_put_rxwi(dev, t);
++		if (unlikely(dma_mapping_error(dev->dma_dev, r->dma_addr))) {
++			skb_free_frag(r->ptr);
++			mt76_put_rxwi(dev, r);
+ 			return NULL;
+ 		}
  
--		mt76_put_rxwi(dev, t);
-+		mt76_put_rxwi(dev, r);
+-		qbuf.addr = t->dma_addr;
++		qbuf.addr = r->dma_addr;
+ 		qbuf.len = SKB_WITH_OVERHEAD(q->buf_size);
+ 		qbuf.skip_unmap = false;
+ 
+-		if (mt76_dma_add_rx_buf(dev, q, &qbuf, t->ptr, t) < 0) {
+-			dma_unmap_single(dev->dma_dev, t->dma_addr,
++		if (mt76_dma_add_rx_buf(dev, q, &qbuf, r->ptr, r) < 0) {
++			dma_unmap_single(dev->dma_dev, r->dma_addr,
+ 					 SKB_WITH_OVERHEAD(q->buf_size),
+ 					 DMA_FROM_DEVICE);
+-			skb_free_frag(t->ptr);
+-			mt76_put_rxwi(dev, t);
++			skb_free_frag(r->ptr);
++			mt76_put_rxwi(dev, r);
+ 			return NULL;
+ 		}
  
- 		if (drop) {
- 			u32 ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
-@@ -481,7 +482,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -531,7 +532,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
  	buf.len = skb->len;
  
  	spin_lock_bh(&q->lock);
@@ -216,7 +263,7 @@
  	mt76_dma_kick_queue(dev, q);
  	spin_unlock_bh(&q->lock);
  
-@@ -558,7 +559,7 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -608,7 +609,7 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
  		goto unmap;
  
  	return mt76_dma_add_buf(dev, q, tx_info.buf, tx_info.nbuf,
@@ -225,44 +272,8 @@
  
  unmap:
  	for (n--; n > 0; n--)
-@@ -598,20 +599,21 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 	spin_lock_bh(&q->lock);
- 
- 	while (q->queued < q->ndesc - 1) {
--		struct mt76_txwi_cache *t = NULL;
-+		struct mt76_rxwi_cache *r = NULL;
- 		struct mt76_queue_buf qbuf;
- 		bool skip_alloc = false;
- 		void *buf = NULL;
- 
- 		if ((q->flags & MT_QFLAG_WED) &&
- 		    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
--			t = mt76_get_rxwi(dev);
--			if (!t)
-+			r = mt76_get_rxwi(dev);
-+			if (!r)
- 				break;
- 
--			if (t->ptr) {
-+			/* reuse skb buf for wed rx copy*/
-+			if (r->ptr) {
- 				skip_alloc = true;
--				buf = t->ptr;
-+				buf = r->ptr;
- 			}
- 		}
- 
-@@ -630,7 +632,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 		qbuf.addr = addr + offset;
- 		qbuf.len = len - offset;
- 		qbuf.skip_unmap = false;
--		if (mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, t) < 0) {
-+		if (mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, NULL, r) < 0) {
- 			dma_unmap_single(dev->dma_dev, addr, len,
- 					 DMA_FROM_DEVICE);
- 			skb_free_frag(buf);
 diff --git a/mac80211.c b/mac80211.c
-index de9ef23..818f4f0 100644
+index de9ef237..818f4f0c 100644
 --- a/mac80211.c
 +++ b/mac80211.c
 @@ -597,7 +597,6 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
@@ -282,7 +293,7 @@
  	for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
  		skb_queue_head_init(&dev->rx_skb[i]);
 diff --git a/mt76.h b/mt76.h
-index b10a16f..631c4cc 100644
+index b10a16f8..631c4ccd 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -166,6 +166,7 @@ struct mt76_queue_entry {
@@ -353,7 +364,7 @@
  static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
  {
 diff --git a/mt7915/dma.c b/mt7915/dma.c
-index 3626008..9cbd362 100644
+index 36260085..9cbd3625 100644
 --- a/mt7915/dma.c
 +++ b/mt7915/dma.c
 @@ -492,7 +492,6 @@ int mt7915_dma_init(struct mt7915_dev *dev, struct mt7915_phy *phy2)
@@ -373,7 +384,7 @@
  
  		/* rx data queue for band1 */
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 4bc8e8c..09b3973 100644
+index 4bc8e8cd..09b39730 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -605,18 +605,18 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
@@ -438,7 +449,7 @@
  		.tx_complete_skb = mt76_connac_tx_complete_skb,
  		.rx_skb = mt7915_queue_rx_skb,
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index c3a0b32..91b98ed 100644
+index c3a0b326..91b98ede 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -57,6 +57,7 @@
@@ -450,7 +461,7 @@
  #define MT7915_CFEND_RATE_DEFAULT	0x49	/* OFDM 24M */
  #define MT7915_CFEND_RATE_11B		0x03	/* 11B LP, 11M */
 diff --git a/tx.c b/tx.c
-index 6d55566..a72b777 100644
+index 6d55566f..a72b7779 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -756,16 +756,16 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3012-mt76-mt7915-wed-fix-potential-memory-leakage.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3012-mt76-mt7915-wed-fix-potential-memory-leakage.patch
index 648cf4f..cdb5320 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3012-mt76-mt7915-wed-fix-potential-memory-leakage.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3012-mt76-mt7915-wed-fix-potential-memory-leakage.patch
@@ -1,35 +1,22 @@
-From 4f947075bef0a413742d8f47b869b3087e242ca8 Mon Sep 17 00:00:00 2001
+From 5f7175246f6a734b63ecd336f1b3ad0bc4f37048 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
-Date: Fri, 16 Dec 2022 12:16:40 +0800
-Subject: [PATCH 3012/3013] mt76: mt7915: wed: fix potential memory leakage
+Date: Fri, 6 Jan 2023 18:25:51 +0800
+Subject: [PATCH 3012/3014] mt76: mt7915: wed: fix potential memory leakage
 
 release rx queue pages in mt7915_mmio_wed_release_rx_buf.
 recycle rxwi when mt76_dma_add_buf() call fails.
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
- dma.c         | 16 ++++++++++------
+ dma.c         | 12 +++++++-----
  mt7915/mmio.c | 15 +++++++++++++++
- 2 files changed, 25 insertions(+), 6 deletions(-)
+ 2 files changed, 22 insertions(+), 5 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 7ef272e..0925daf 100644
+index 21f26df7..cb1fd9c6 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -633,9 +633,11 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
- 		qbuf.len = len - offset;
- 		qbuf.skip_unmap = false;
- 		if (mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, NULL, r) < 0) {
-+			mt76_put_rxwi(dev, r);
- 			dma_unmap_single(dev->dma_dev, addr, len,
- 					 DMA_FROM_DEVICE);
--			skb_free_frag(buf);
-+			if (!skip_alloc)
-+				skb_free_frag(buf);
- 			break;
- 		}
- 		frames++;
-@@ -758,12 +760,14 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -795,12 +795,14 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  	} while (1);
  	spin_unlock_bh(&q->lock);
  
@@ -50,7 +37,7 @@
  
  static void
 diff --git a/mt7915/mmio.c b/mt7915/mmio.c
-index 09b3973..419338c 100644
+index 09b39730..419338cc 100644
 --- a/mt7915/mmio.c
 +++ b/mt7915/mmio.c
 @@ -621,12 +621,27 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3013-mt76-mt7915-add-mt7915_net_setup_tc-to-support-wifi2.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3013-mt76-mt7915-add-mt7915_net_setup_tc-to-support-wifi2.patch
index 3d58696..6c8e2ee 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3013-mt76-mt7915-add-mt7915_net_setup_tc-to-support-wifi2.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3013-mt76-mt7915-add-mt7915_net_setup_tc-to-support-wifi2.patch
@@ -1,7 +1,7 @@
 From 7786c799b9c6dfc3d09079e65e896467a62724c7 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Tue, 27 Dec 2022 09:45:14 +0800
-Subject: [PATCH 3013/3013] mt76: mt7915: add mt7915_net_setup_tc to support
+Subject: [PATCH 3013/3014] mt76: mt7915: add mt7915_net_setup_tc to support
  wifi2wifi offload
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3014-mt76-mt7915-drop-the-wrong-judgment-condition-to-sup.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3014-mt76-mt7915-drop-the-wrong-judgment-condition-to-sup.patch
new file mode 100644
index 0000000..aced902
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3014-mt76-mt7915-drop-the-wrong-judgment-condition-to-sup.patch
@@ -0,0 +1,28 @@
+From 47277f4e21c57fb04aa0d31c24a50a5a42ec8d78 Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Fri, 6 Jan 2023 18:29:08 +0800
+Subject: [PATCH 3014/3014] mt76: mt7915: drop the wrong judgment condition to
+ support ppdu txs
+
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+---
+ mt7915/mac.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 0d0ae7ab..41c117f3 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -1126,9 +1126,6 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
+ 	u16 wcidx;
+ 	u8 pid;
+ 
+-	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) > 1)
+-		return;
+-
+ 	wcidx = le32_get_bits(txs_data[2], MT_TXS2_WCID);
+ 	pid = le32_get_bits(txs_data[3], MT_TXS3_PID);
+ 
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/4004-mt76-revert-for-backports-5.15-wireless-stack.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/4004-mt76-revert-for-backports-5.15-wireless-stack.patch
index d9573b8..6c1df10 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/4004-mt76-revert-for-backports-5.15-wireless-stack.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/4004-mt76-revert-for-backports-5.15-wireless-stack.patch
@@ -25,7 +25,7 @@
 index 0925daf4..08169bae 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -945,7 +945,7 @@ mt76_dma_init(struct mt76_dev *dev,
+@@ -980,7 +980,7 @@ mt76_dma_init(struct mt76_dev *dev,
  	dev->napi_dev.threaded = 1;
  
  	mt76_for_each_q_rx(dev, i) {