diff --git a/recipes-kernel/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch b/recipes-kernel/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch
new file mode 100644
index 0000000..af4f56d
--- /dev/null
+++ b/recipes-kernel/linux-mt76/files/patches/1009-mt76-mt7915-add-fw_version-dump.patch
@@ -0,0 +1,100 @@
+From 611d781ff9e39b474e71a59ec0ea7761a4274456 Mon Sep 17 00:00:00 2001
+From: Evelyn Tsai <evelyn.tsai@mediatek.com>
+Date: Wed, 17 Aug 2022 13:40:24 +0800
+Subject: [PATCH] mt76: mt7915: add fw_version dump
+
+---
+ mt76.h               |  4 ++++
+ mt76_connac_mcu.c    |  9 +++++++++
+ mt7915/mtk_debugfs.c | 19 +++++++++++++++++++
+ 3 files changed, 32 insertions(+)
+
+diff --git a/mt76.h b/mt76.h
+index 8325409a..9a0f0708 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -803,6 +803,10 @@ struct mt76_dev {
+ 		struct mt76_usb usb;
+ 		struct mt76_sdio sdio;
+ 	};
++
++	struct mt76_connac2_patch_hdr *patch_hdr;
++	struct mt76_connac2_fw_trailer *wm_hdr;
++	struct mt76_connac2_fw_trailer *wa_hdr;
+ };
+ 
+ struct mt76_power_limits {
+diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
+index 261181dc..47b2bce6 100644
+--- a/mt76_connac_mcu.c
++++ b/mt76_connac_mcu.c
+@@ -2883,6 +2883,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+ 		goto out;
+ 	}
+ 
++	dev->wm_hdr = devm_kzalloc(dev->dev, sizeof(*hdr), GFP_KERNEL);
++	memcpy(dev->wm_hdr, hdr, sizeof(*hdr));
++
+ 	release_firmware(fw);
+ 
+ 	if (!fw_wa)
+@@ -2908,6 +2911,9 @@ int mt76_connac2_load_ram(struct mt76_dev *dev, const char *fw_wm,
+ 		goto out;
+ 	}
+ 
++	dev->wa_hdr = devm_kzalloc(dev->dev, sizeof(*hdr), GFP_KERNEL);
++	memcpy(dev->wa_hdr, hdr, sizeof(*hdr));
++
+ 	snprintf(dev->hw->wiphy->fw_version,
+ 		 sizeof(dev->hw->wiphy->fw_version),
+ 		 "%.10s-%.15s", hdr->fw_ver, hdr->build_date);
+@@ -2978,6 +2984,9 @@ int mt76_connac2_load_patch(struct mt76_dev *dev, const char *fw_name)
+ 	dev_info(dev->dev, "HW/SW Version: 0x%x, Build Time: %.16s\n",
+ 		 be32_to_cpu(hdr->hw_sw_ver), hdr->build_date);
+ 
++	dev->patch_hdr = devm_kzalloc(dev->dev, sizeof(*hdr), GFP_KERNEL);
++	memcpy(dev->patch_hdr, hdr, sizeof(*hdr));
++
+ 	for (i = 0; i < be32_to_cpu(hdr->desc.n_region); i++) {
+ 		struct mt76_connac2_patch_sec *sec;
+ 		u32 len, addr, mode;
+diff --git a/mt7915/mtk_debugfs.c b/mt7915/mtk_debugfs.c
+index 222268fc..cfd0b303 100644
+--- a/mt7915/mtk_debugfs.c
++++ b/mt7915/mtk_debugfs.c
+@@ -2721,6 +2721,22 @@ static int mt7915_agginfo_read_band1(struct seq_file *s, void *data)
+ 	return 0;
+ }
+ 
++static int mt7915_dump_version(struct seq_file *s, void *data)
++{
++	struct mt7915_dev *dev = dev_get_drvdata(s->private);
++	struct mt76_dev *mdev = NULL;
++	seq_printf(s, "Version: 2.2.3.0\n");
++
++	if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
++		return 0;
++
++	mdev = &dev->mt76;
++	seq_printf(s, "Rom Patch Build Time: %.16s\n", mdev->patch_hdr->build_date);
++	seq_printf(s, "WM Patch Build Time: %.16s\n", mdev->wm_hdr->build_date);
++	seq_printf(s, "WA Patch Build Time: %.16s\n", mdev->wa_hdr->build_date);
++	return 0;
++}
++
+ /*usage: <en> <num> <len>
+ 	en: BIT(16) 0: sw amsdu  1: hw amsdu
+ 	num: GENMASK(15, 8) range 1-8
+@@ -2952,6 +2968,9 @@ int mt7915_mtk_init_debugfs(struct mt7915_phy *phy, struct dentry *dir)
+ 
+ 	debugfs_create_u8("sku_disable", 0600, dir, &dev->dbg.sku_disable);
+ 
++	debugfs_create_devm_seqfile(dev->mt76.dev, "fw_version", dir,
++				    mt7915_dump_version);
++
+ 	return 0;
+ }
+ #endif
+-- 
+2.36.1
+
diff --git a/recipes-kernel/linux-mt76/files/patches/3002-mt76-add-wed-rx-support.patch b/recipes-kernel/linux-mt76/files/patches/3002-mt76-add-wed-rx-support.patch
index 49992bc..92dc07b 100644
--- a/recipes-kernel/linux-mt76/files/patches/3002-mt76-add-wed-rx-support.patch
+++ b/recipes-kernel/linux-mt76/files/patches/3002-mt76-add-wed-rx-support.patch
@@ -19,7 +19,7 @@
  mt7915/dma.c      |  25 +++--
  mt7915/init.c     |   9 ++
  mt7915/mac.c      | 103 ++++++++++++++++++-
- mt7915/main.c     |  25 ++++-
+ mt7915/main.c     |  26 ++++-
  mt7915/mcu.c      |  14 ++-
  mt7915/mcu.h      |   1 +
  mt7915/mmio.c     |  26 ++++-
@@ -29,7 +29,7 @@
  mt7921/mt7921.h   |   4 +-
  mt7921/pci_mac.c  |   4 +-
  tx.c              |  34 +++++++
- 24 files changed, 504 insertions(+), 81 deletions(-)
+ 24 files changed, 505 insertions(+), 81 deletions(-)
 
 diff --git a/dma.c b/dma.c
 index 03ee9109..4d4d4046 100644
@@ -1016,7 +1016,7 @@
 +	bool wed_wds = false;
  
 -	idx = mt76_wcid_alloc(dev->mt76.wcid_mask, MT7915_WTBL_STA);
-+	if (mtk_wed_device_active(&mdev->mmio.wed))
++	if (mtk_wed_device_active(&mdev->mmio.wed) && is_mt7986(mdev))
 +		wed_wds = !!test_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
 +
 +	if (wed_wds)
@@ -1026,11 +1026,12 @@
  	if (idx < 0)
  		return -ENOSPC;
  
-@@ -1107,6 +1114,13 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
+@@ -1107,6 +1114,14 @@ static void mt7915_sta_set_4addr(struct ieee80211_hw *hw,
  	else
  		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
  
 +	if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
++	    is_mt7986(&dev->mt76) &&
 +	    (msta->wcid.idx < MT7915_WTBL_WDS_START ||
 +	     msta->wcid.idx > MT7915_WTBL_WDS_END)) {
 +		mt7915_sta_remove(hw, vif, sta);
@@ -1040,7 +1041,7 @@
  	mt76_connac_mcu_wtbl_update_hdr_trans(&dev->mt76, vif, sta);
  }
  
-@@ -1449,9 +1463,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
+@@ -1449,9 +1464,12 @@ mt7915_net_fill_forward_path(struct ieee80211_hw *hw,
  	/* fw will find the wcid by dest addr */
  	if(is_mt7915(&dev->mt76))
  		path->mtk_wdma.wcid = 0xff;
diff --git a/recipes-kernel/linux-mt76/files/patches/3005-mt76-mt7915-add-statistic-for-HW-Tx-Path.patch b/recipes-kernel/linux-mt76/files/patches/3005-mt76-mt7915-add-statistic-for-HW-Tx-Path.patch
new file mode 100644
index 0000000..e99536a
--- /dev/null
+++ b/recipes-kernel/linux-mt76/files/patches/3005-mt76-mt7915-add-statistic-for-HW-Tx-Path.patch
@@ -0,0 +1,477 @@
+From c00e4e966cec137840f38cd0c7abf3f3237e9ea2 Mon Sep 17 00:00:00 2001
+From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
+Date: Thu, 21 Jul 2022 10:56:09 -0700
+Subject: [PATCH] mt76: mt7915: add statistic for H/W Tx Path
+
+Set PPDU_TXS2H_EN_B0/B1 to get PPDU txs.
+Add MT_PACKET_ID_WED for PPDU txs, and change MT_PACKET_ID_FIRST to 3
+to differentiate. We also need do byte cnt and pkt cnt for S/W path since
+we report it directly from mt7915_sta_statistics.
+
+---
+ mt76.h             | 49 ++++++++++++++++-------------
+ mt76_connac.h      |  5 +--
+ mt76_connac2_mac.h | 14 +++++++++
+ mt76_connac_mac.c  | 77 +++++++++++++++++++++++++++++-----------------
+ mt7915/mac.c       | 12 ++++----
+ mt7915/main.c      | 16 +++++++++-
+ mt7915/mmio.c      | 22 +++++++++++++
+ mt7915/mt7915.h    |  2 --
+ mt7915/regs.h      |  4 +++
+ mt7921/mt7921.h    |  1 -
+ 10 files changed, 141 insertions(+), 61 deletions(-)
+
+diff --git a/mt76.h b/mt76.h
+index 9162213..720a419 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -267,6 +267,30 @@ DECLARE_EWMA(signal, 10, 8);
+ #define MT_WCID_TX_INFO_TXPWR_ADJ	GENMASK(25, 18)
+ #define MT_WCID_TX_INFO_SET		BIT(31)
+ 
++enum mt76_phy_type {
++	MT_PHY_TYPE_CCK,
++	MT_PHY_TYPE_OFDM,
++	MT_PHY_TYPE_HT,
++	MT_PHY_TYPE_HT_GF,
++	MT_PHY_TYPE_VHT,
++	MT_PHY_TYPE_HE_SU = 8,
++	MT_PHY_TYPE_HE_EXT_SU,
++	MT_PHY_TYPE_HE_TB,
++	MT_PHY_TYPE_HE_MU,
++	__MT_PHY_TYPE_HE_MAX,
++};
++
++struct mt76_sta_stats {
++	u64 tx_mode[__MT_PHY_TYPE_HE_MAX];
++	u64 tx_bw[4];		/* 20, 40, 80, 160 */
++	u64 tx_nss[4];		/* 1, 2, 3, 4 */
++	u64 tx_mcs[16];		/* mcs idx */
++	u64 tx_bytes;
++	u32 tx_packets;
++	u32 tx_retries;
++	u32 tx_failed;
++};
++
+ struct mt76_wcid {
+ 	struct mt76_rx_tid __rcu *aggr[IEEE80211_NUM_TIDS];
+ 
+@@ -295,6 +319,8 @@ struct mt76_wcid {
+ 
+ 	struct list_head list;
+ 	struct idr pktid;
++
++	struct mt76_sta_stats stats;
+ };
+ 
+ struct mt76_txq {
+@@ -341,7 +367,8 @@ struct mt76_rx_tid {
+ #define MT_PACKET_ID_MASK		GENMASK(6, 0)
+ #define MT_PACKET_ID_NO_ACK		0
+ #define MT_PACKET_ID_NO_SKB		1
+-#define MT_PACKET_ID_FIRST		2
++#define MT_PACKET_ID_WED		2
++#define MT_PACKET_ID_FIRST		3
+ #define MT_PACKET_ID_HAS_RATE		BIT(7)
+ /* This is timer for when to give up when waiting for TXS callback,
+  * with starting time being the time at which the DMA_DONE callback
+@@ -861,26 +888,6 @@ struct mt76_power_limits {
+ 	s8 ru[7][12];
+ };
+ 
+-enum mt76_phy_type {
+-	MT_PHY_TYPE_CCK,
+-	MT_PHY_TYPE_OFDM,
+-	MT_PHY_TYPE_HT,
+-	MT_PHY_TYPE_HT_GF,
+-	MT_PHY_TYPE_VHT,
+-	MT_PHY_TYPE_HE_SU = 8,
+-	MT_PHY_TYPE_HE_EXT_SU,
+-	MT_PHY_TYPE_HE_TB,
+-	MT_PHY_TYPE_HE_MU,
+-	__MT_PHY_TYPE_HE_MAX,
+-};
+-
+-struct mt76_sta_stats {
+-	u64 tx_mode[__MT_PHY_TYPE_HE_MAX];
+-	u64 tx_bw[4];		/* 20, 40, 80, 160 */
+-	u64 tx_nss[4];		/* 1, 2, 3, 4 */
+-	u64 tx_mcs[16];		/* mcs idx */
+-};
+-
+ struct mt76_ethtool_worker_info {
+ 	u64 *data;
+ 	int idx;
+diff --git a/mt76_connac.h b/mt76_connac.h
+index c8d8680..8f78d12 100644
+--- a/mt76_connac.h
++++ b/mt76_connac.h
+@@ -352,9 +352,10 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
+ 				 struct sk_buff *skb, struct mt76_wcid *wcid,
+ 				 struct ieee80211_key_conf *key, int pid,
+ 				 enum mt76_txq_id qid, u32 changed);
++bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
++				   __le32 *txs_data, struct mt76_sta_stats *stats);
+ bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
+-				  int pid, __le32 *txs_data,
+-				  struct mt76_sta_stats *stats);
++				  int pid, __le32 *txs_data);
+ void mt76_connac2_mac_decode_he_radiotap(struct mt76_dev *dev,
+ 					 struct sk_buff *skb,
+ 					 __le32 *rxv, u32 mode);
+diff --git a/mt76_connac2_mac.h b/mt76_connac2_mac.h
+index 67ce216..c7064ba 100644
+--- a/mt76_connac2_mac.h
++++ b/mt76_connac2_mac.h
+@@ -123,6 +123,12 @@ enum {
+ /* VHT/HE only use bits 0-3 */
+ #define MT_TX_RATE_IDX			GENMASK(5, 0)
+ 
++enum {
++	MT_TXS_MPDU_FM0,
++	MT_TXS_MPDU_FM1,
++	MT_TXS_PPDU_FM
++};
++
+ #define MT_TXS0_FIXED_RATE		BIT(31)
+ #define MT_TXS0_BW			GENMASK(30, 29)
+ #define MT_TXS0_TID			GENMASK(28, 26)
+@@ -158,6 +164,14 @@ enum {
+ 
+ #define MT_TXS4_TIMESTAMP		GENMASK(31, 0)
+ 
++/* PPDU based */
++#define MT_TXS5_MPDU_TX_BYTE		GENMASK(22, 0)
++#define MT_TXS5_MPDU_TX_CNT		GENMASK(31, 23)
++
++#define MT_TXS6_MPDU_FAIL_CNT		GENMASK(31, 23)
++
++#define MT_TXS7_MPDU_RETRY_CNT		GENMASK(31, 23)
++
+ /* RXD DW1 */
+ #define MT_RXD1_NORMAL_WLAN_IDX		GENMASK(9, 0)
+ #define MT_RXD1_NORMAL_GROUP_1		BIT(11)
+diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
+index c1e8955..9e80cae 100644
+--- a/mt76_connac_mac.c
++++ b/mt76_connac_mac.c
+@@ -471,6 +471,9 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
+ 		p_fmt = mt76_is_mmio(dev) ? MT_TX_TYPE_CT : MT_TX_TYPE_SF;
+ 		q_idx = wmm_idx * MT76_CONNAC_MAX_WMM_SETS +
+ 			mt76_connac_lmac_mapping(skb_get_queue_mapping(skb));
++
++		wcid->stats.tx_bytes += skb->len;
++		wcid->stats.tx_packets++;
+ 	}
+ 
+ 	val = FIELD_PREP(MT_TXD0_TX_BYTES, skb->len + sz_txd) |
+@@ -539,35 +542,26 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi,
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac2_mac_write_txwi);
+ 
+-bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
+-				  int pid, __le32 *txs_data,
+-				  struct mt76_sta_stats *stats)
++bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid,
++				   __le32 *txs_data, struct mt76_sta_stats *stats)
+ {
+ 	struct ieee80211_supported_band *sband;
+ 	struct mt76_phy *mphy;
+-	struct ieee80211_tx_info *info;
+-	struct sk_buff_head list;
+ 	struct rate_info rate = {};
+-	struct sk_buff *skb;
+ 	bool cck = false;
+ 	u32 txrate, txs, mode;
+ 
+-	mt76_tx_status_lock(dev, &list);
+-	skb = mt76_tx_status_skb_get(dev, wcid, pid, &list);
+-	if (!skb)
+-		goto out;
+-
+ 	txs = le32_to_cpu(txs_data[0]);
+-
+-	info = IEEE80211_SKB_CB(skb);
+-	if (!(txs & MT_TXS0_ACK_ERROR_MASK))
+-		info->flags |= IEEE80211_TX_STAT_ACK;
+-
+-	info->status.ampdu_len = 1;
+-	info->status.ampdu_ack_len = !!(info->flags &
+-					IEEE80211_TX_STAT_ACK);
+-
+-	info->status.rates[0].idx = -1;
++	if (FIELD_GET(MT_TXS0_TXS_FORMAT, txs) == MT_TXS_PPDU_FM) {
++		stats->tx_bytes +=
++			le32_get_bits(txs_data[5], MT_TXS5_MPDU_TX_BYTE);
++		stats->tx_packets +=
++			le32_get_bits(txs_data[5], MT_TXS5_MPDU_TX_CNT);
++		stats->tx_failed +=
++			le32_get_bits(txs_data[6], MT_TXS6_MPDU_FAIL_CNT);
++		stats->tx_retries +=
++			le32_get_bits(txs_data[7], MT_TXS7_MPDU_RETRY_CNT);
++	}
+ 
+ 	txrate = FIELD_GET(MT_TXS0_TX_RATE, txs);
+ 
+@@ -602,7 +596,7 @@ bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
+ 	case MT_PHY_TYPE_HT:
+ 	case MT_PHY_TYPE_HT_GF:
+ 		if (rate.mcs > 31)
+-			goto out;
++			return false;
+ 
+ 		rate.flags = RATE_INFO_FLAGS_MCS;
+ 		if (wcid->rate.flags & RATE_INFO_FLAGS_SHORT_GI)
+@@ -610,7 +604,7 @@ bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
+ 		break;
+ 	case MT_PHY_TYPE_VHT:
+ 		if (rate.mcs > 9)
+-			goto out;
++			return false;
+ 
+ 		rate.flags = RATE_INFO_FLAGS_VHT_MCS;
+ 		break;
+@@ -619,14 +613,14 @@ bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
+ 	case MT_PHY_TYPE_HE_TB:
+ 	case MT_PHY_TYPE_HE_MU:
+ 		if (rate.mcs > 11)
+-			goto out;
++			return false;
+ 
+ 		rate.he_gi = wcid->rate.he_gi;
+ 		rate.he_dcm = FIELD_GET(MT_TX_RATE_DCM, txrate);
+ 		rate.flags = RATE_INFO_FLAGS_HE_MCS;
+ 		break;
+ 	default:
+-		goto out;
++		return false;
+ 	}
+ 
+ 	stats->tx_mode[mode]++;
+@@ -651,10 +645,37 @@ bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
+ 	}
+ 	wcid->rate = rate;
+ 
+-out:
+-	if (skb)
+-		mt76_tx_status_skb_done(dev, skb, &list);
++	return true;
++}
++EXPORT_SYMBOL_GPL(mt76_connac2_mac_fill_txs);
++
++bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
++				  int pid, __le32 *txs_data)
++{
++	struct mt76_sta_stats *stats = &wcid->stats;
++	struct sk_buff_head list;
++	struct sk_buff *skb;
++
++	if (pid < MT_PACKET_ID_FIRST)
++		return false;
+ 
++	mt76_tx_status_lock(dev, &list);
++	skb = mt76_tx_status_skb_get(dev, wcid, pid, &list);
++	if (skb) {
++		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++
++		if (!(le32_to_cpu(txs_data[0]) & MT_TXS0_ACK_ERROR_MASK))
++			info->flags |= IEEE80211_TX_STAT_ACK;
++
++		info->status.rates[0].idx = -1;
++		info->status.ampdu_len = 1;
++		info->status.ampdu_ack_len = !!(info->flags &
++						IEEE80211_TX_STAT_ACK);
++		stats->tx_failed += !(info->flags & IEEE80211_TX_STAT_ACK);
++
++		mt76_connac2_mac_fill_txs(dev, wcid, txs_data, stats);
++		mt76_tx_status_skb_done(dev, skb, &list);
++	}
+ 	mt76_tx_status_unlock(dev, &list);
+ 
+ 	return !!skb;
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 1f8e123..5f42b46 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -1152,13 +1152,10 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
+ 	u16 wcidx;
+ 	u8 pid;
+ 
+-	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) > 1)
+-		return;
+-
+ 	wcidx = le32_get_bits(txs_data[2], MT_TXS2_WCID);
+ 	pid = le32_get_bits(txs_data[3], MT_TXS3_PID);
+ 
+-	if (pid < MT_PACKET_ID_FIRST)
++	if (pid < MT_PACKET_ID_WED)
+ 		return;
+ 
+ 	if (wcidx >= mt7915_wtbl_size(dev))
+@@ -1172,8 +1169,11 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
+ 
+ 	msta = container_of(wcid, struct mt7915_sta, wcid);
+ 
+-	mt76_connac2_mac_add_txs_skb(&dev->mt76, wcid, pid, txs_data,
+-				     &msta->stats);
++	if (pid == MT_PACKET_ID_WED)
++		mt76_connac2_mac_fill_txs(&dev->mt76, wcid, txs_data,
++					  &msta->wcid.stats);
++	else
++		mt76_connac2_mac_add_txs_skb(&dev->mt76, wcid, pid, txs_data);
+ 	if (!wcid->sta)
+ 		goto out;
+ 
+diff --git a/mt7915/main.c b/mt7915/main.c
+index cfc522f..85d6be8 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -1042,6 +1042,20 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+ 	}
+ 	sinfo->txrate.flags = txrate->flags;
+ 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
++
++	if (mtk_wed_device_active(&phy->dev->mt76.mmio.wed)) {
++		sinfo->tx_bytes = msta->wcid.stats.tx_bytes;
++		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES64);
++
++		sinfo->tx_packets = msta->wcid.stats.tx_packets;
++		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
++
++		sinfo->tx_failed = msta->wcid.stats.tx_failed;
++		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
++
++		sinfo->tx_retries = msta->wcid.stats.tx_retries;
++		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
++	}
+ }
+ 
+ static void mt7915_sta_rc_work(void *data, struct ieee80211_sta *sta)
+@@ -1256,7 +1270,7 @@ static void mt7915_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
+ 	if (msta->vif->mt76.idx != wi->idx)
+ 		return;
+ 
+-	mt76_ethtool_worker(wi, &msta->stats);
++	mt76_ethtool_worker(wi, &msta->wcid.stats);
+ }
+ 
+ static
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 08ff556..080bfe7 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -92,6 +92,7 @@ static const u32 mt7915_offs[] = {
+ 	[AGG_AWSCR0]		= 0x05c,
+ 	[AGG_PCR0]		= 0x06c,
+ 	[AGG_ACR0]		= 0x084,
++	[AGG_ACR4]		= 0x08C,
+ 	[AGG_MRCR]		= 0x098,
+ 	[AGG_ATCR1]		= 0x0f0,
+ 	[AGG_ATCR3]		= 0x0f4,
+@@ -167,6 +168,7 @@ static const u32 mt7916_offs[] = {
+ 	[AGG_AWSCR0]		= 0x030,
+ 	[AGG_PCR0]		= 0x040,
+ 	[AGG_ACR0]		= 0x054,
++	[AGG_ACR4]		= 0x05C,
+ 	[AGG_MRCR]		= 0x068,
+ 	[AGG_ATCR1]		= 0x1a8,
+ 	[AGG_ATCR3]		= 0x080,
+@@ -668,9 +670,12 @@ irqreturn_t mt7915_irq_handler(int irq, void *dev_instance)
+ static int mt7915_wed_offload_enable(struct mtk_wed_device *wed)
+ {
+ 	struct mt7915_dev *dev;
++	struct mt7915_phy *phy;
+ 	int ret;
+ 
+ 	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
++	if (!dev)
++		return -EINVAL;
+ 
+ 	spin_lock_bh(&dev->mt76.token_lock);
+ 	dev->mt76.token_size = wed->wlan.token_start;
+@@ -681,18 +686,35 @@ static int mt7915_wed_offload_enable(struct mtk_wed_device *wed)
+ 	if (!ret)
+ 		return -EAGAIN;
+ 
++	phy = &dev->phy;
++	mt76_set(dev, MT_AGG_ACR4(phy->band_idx), MT_AGG_ACR_PPDU_TXS2H);
++
++	phy = dev->mt76.phy2 ? dev->mt76.phy2->priv : NULL;
++	if (phy)
++		mt76_set(dev, MT_AGG_ACR4(phy->band_idx), MT_AGG_ACR_PPDU_TXS2H);
++
+ 	return 0;
+ }
+ 
+ static void mt7915_wed_offload_disable(struct mtk_wed_device *wed)
+ {
+ 	struct mt7915_dev *dev;
++	struct mt7915_phy *phy;
+ 
+ 	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
++	if (!dev)
++		return;
+ 
+ 	spin_lock_bh(&dev->mt76.token_lock);
+ 	dev->mt76.token_size = wed->wlan.token_start;//MT7915_TOKEN_SIZE;
+ 	spin_unlock_bh(&dev->mt76.token_lock);
++
++	phy = &dev->phy;
++	mt76_clear(dev, MT_AGG_ACR4(phy->band_idx), MT_AGG_ACR_PPDU_TXS2H);
++
++	phy = dev->mt76.phy2 ? dev->mt76.phy2->priv : NULL;
++	if (phy)
++		mt76_clear(dev, MT_AGG_ACR4(phy->band_idx), MT_AGG_ACR_PPDU_TXS2H);
+ }
+ #endif
+ 
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index 22399cc..065c16c 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -139,8 +139,6 @@ struct mt7915_sta {
+ 	unsigned long jiffies;
+ 	unsigned long ampdu_state;
+ 
+-	struct mt76_sta_stats stats;
+-
+ 	struct mt76_connac_sta_key_conf bip;
+ 
+ 	struct {
+diff --git a/mt7915/regs.h b/mt7915/regs.h
+index 08bf84c..694cc56 100644
+--- a/mt7915/regs.h
++++ b/mt7915/regs.h
+@@ -58,6 +58,7 @@ enum offs_rev {
+ 	AGG_AWSCR0,
+ 	AGG_PCR0,
+ 	AGG_ACR0,
++	AGG_ACR4,
+ 	AGG_MRCR,
+ 	AGG_ATCR1,
+ 	AGG_ATCR3,
+@@ -495,6 +496,9 @@ enum offs_rev {
+ #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
+ #define MT_AGG_ACR_BAR_RATE		GENMASK(29, 16)
+ 
++#define MT_AGG_ACR4(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR4))
++#define MT_AGG_ACR_PPDU_TXS2H		BIT(1)
++
+ #define MT_AGG_MRCR(_band)		MT_WF_AGG(_band, __OFFS(AGG_MRCR))
+ #define MT_AGG_MRCR_BAR_CNT_LIMIT		GENMASK(15, 12)
+ #define MT_AGG_MRCR_LAST_RTS_CTS_RN		BIT(6)
+diff --git a/mt7921/mt7921.h b/mt7921/mt7921.h
+index 4b2e974..f48295f 100644
+--- a/mt7921/mt7921.h
++++ b/mt7921/mt7921.h
+@@ -100,7 +100,6 @@ struct mt7921_sta {
+ 
+ 	unsigned long last_txs;
+ 	unsigned long ampdu_state;
+-	struct mt76_sta_stats stats;
+ 
+ 	struct mt76_connac_sta_key_conf bip;
+ };
+-- 
+2.32.0
+
diff --git a/recipes-kernel/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-HW-Rx-Path.patch b/recipes-kernel/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-HW-Rx-Path.patch
new file mode 100644
index 0000000..e91955f
--- /dev/null
+++ b/recipes-kernel/linux-mt76/files/patches/3006-mt76-mt7915-add-statistic-for-HW-Rx-Path.patch
@@ -0,0 +1,252 @@
+From 12b7c7a035359298fc7d14ae3a6dbc16ec0b70ad Mon Sep 17 00:00:00 2001
+From: Yi-Chia Hsieh <Yi-Chia.Hsieh@mediatek.com>
+Date: Fri, 5 Aug 2022 13:58:11 -0700
+Subject: [PATCH] mt76: mt7915: add statistic for H/W Rx Path
+
+Change-Id: Id94d663f08e91c83d296bd57e5e9b65a505ae1c7
+---
+ mt76.h            |  4 ++++
+ mt76_connac.h     |  5 +++++
+ mt76_connac_mcu.h | 35 +++++++++++++++++++++++++++++++++++
+ mt7915/mac.c      | 26 ++++++++++++++++++++++++++
+ mt7915/main.c     |  9 ++++++++-
+ mt7915/mcu.c      | 21 +++++++++++++++++++++
+ mt7915/mmio.c     |  6 ++++++
+ mt7915/mt7915.h   |  3 +++
+ 8 files changed, 108 insertions(+), 1 deletion(-)
+
+diff --git a/mt76.h b/mt76.h
+index a65e7a3..e56fd58 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -289,6 +289,10 @@ struct mt76_sta_stats {
+ 	u32 tx_packets;
+ 	u32 tx_retries;
+ 	u32 tx_failed;
++	u64 rx_bytes;
++	u32 rx_packets;
++	u32 rx_error;
++	u32 rx_drop;
+ };
+ 
+ struct mt76_wcid {
+diff --git a/mt76_connac.h b/mt76_connac.h
+index 8f78d12..41d6525 100644
+--- a/mt76_connac.h
++++ b/mt76_connac.h
+@@ -218,6 +218,11 @@ static inline bool is_mt76_fw_txp(struct mt76_dev *dev)
+ 	}
+ }
+ 
++static inline bool is_wo_mcu(struct mt76_dev *dev)
++{
++	return is_mt7986(dev);
++}
++
+ static inline u8 mt76_connac_chan_bw(struct cfg80211_chan_def *chandef)
+ {
+ 	static const u8 width_to_bw[] = {
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index ca68172..722e859 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1200,6 +1200,41 @@ enum {
+ 	MCU_CE_CMD_GET_TXPWR = 0xd0,
+ };
+ 
++enum wo_event_id {
++	WO_EVT_LOG_DUMP = 0x1,
++	WO_EVT_PROFILING = 0x2,
++	WO_EVT_RXCNT_INFO = 0x3
++};
++
++enum wo_cmd_id {
++	WO_CMD_WED_CFG = 0,
++	WO_CMD_WED_RX_STAT,
++	WO_CMD_RRO_SER,
++	WO_CMD_DBG_INFO,
++	WO_CMD_DEV_INFO,
++	WO_CMD_BSS_INFO,
++	WO_CMD_STA_REC,
++	WO_CMD_DEV_INFO_DUMP,
++	WO_CMD_BSS_INFO_DUMP,
++	WO_CMD_STA_REC_DUMP,
++	WO_CMD_BA_INFO_DUMP,
++	WO_CMD_FBCMD_Q_DUMP,
++	WO_CMD_FW_LOG_CTRL,
++	WO_CMD_LOG_FLUSH,
++	WO_CMD_CHANGE_STATE,
++	WO_CMD_CPU_STATS_ENABLE,
++	WO_CMD_CPU_STATS_DUMP,
++	WO_CMD_EXCEPTION_INIT,
++	WO_CMD_PROF_CTRL,
++	WO_CMD_STA_BA_DUMP,
++	WO_CMD_BA_CTRL_DUMP,
++	WO_CMD_RXCNT_CTRL,
++	WO_CMD_RXCNT_INFO,
++	WO_CMD_SET_CAP,
++	WO_CMD_CCIF_RING_DUMP,
++	WO_CMD_WED_END
++};
++
+ enum {
+ 	PATCH_SEM_RELEASE,
+ 	PATCH_SEM_GET
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index 5ee9bb2..9ce5a60 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -938,6 +938,31 @@ void mt7915_wed_trigger_ser(struct mtk_wed_device *wed)
+ 	return;
+ }
+ 
++void mt7915_wed_update_wo_rxcnt(struct mtk_wed_device *wed,
++				    struct wo_cmd_rxcnt_t *rxcnt)
++{
++	struct mt7915_dev *dev;
++	struct mt76_wcid *wcid;
++
++	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
++	if (rxcnt->wlan_idx >= mt7915_wtbl_size(dev))
++		return;
++
++	rcu_read_lock();
++
++	wcid = rcu_dereference(dev->mt76.wcid[rxcnt->wlan_idx]);
++	if (!wcid)
++		goto out;
++
++	wcid->stats.rx_bytes += rxcnt->rx_byte_cnt;
++	wcid->stats.rx_packets += rxcnt->rx_pkt_cnt;
++	wcid->stats.rx_error += rxcnt->rx_err_cnt;
++	wcid->stats.rx_drop += rxcnt->rx_drop_cnt;
++
++out:
++	rcu_read_unlock();
++}
++
+ static void
+ mt7915_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
+ {
+@@ -1173,6 +1198,7 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data)
+ 					  &msta->wcid.stats);
+ 	else
+ 		mt76_connac2_mac_add_txs_skb(&dev->mt76, wcid, pid, txs_data);
++
+ 	if (!wcid->sta)
+ 		goto out;
+ 
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 7935774..a73c488 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -1028,7 +1028,8 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+ 	struct rate_info *txrate = &msta->wcid.rate;
+ 	struct rate_info rxrate = {};
+ 
+-	if (is_mt7915(&phy->dev->mt76) &&
++	if ((is_mt7915(&phy->dev->mt76) ||
++	    mtk_wed_device_active(&phy->dev->mt76.mmio.wed)) &&
+ 	    !mt7915_mcu_get_rx_rate(phy, vif, sta, &rxrate)) {
+ 		sinfo->rxrate = rxrate;
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
+@@ -1062,6 +1063,12 @@ static void mt7915_sta_statistics(struct ieee80211_hw *hw,
+ 
+ 		sinfo->tx_retries = msta->wcid.stats.tx_retries;
+ 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
++
++		sinfo->rx_bytes = msta->wcid.stats.rx_bytes;
++		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES64);
++
++		sinfo->rx_packets = msta->wcid.stats.rx_packets;
++		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
+ 	}
+ }
+ 
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 1272bee..8536b1e 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -293,6 +293,27 @@ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3)
+ 	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), false);
+ }
+ 
++int mt7915_mcu_wo_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2)
++{
++	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
++	struct {
++		__le32 args[2];
++	} req = {
++		.args = {
++			cpu_to_le32(a1),
++			cpu_to_le32(a2),
++		},
++	};
++
++	if (!mtk_wed_device_active(wed))
++		return -1;
++
++	if (!is_wo_mcu(&dev->mt76))
++		return -1;
++
++	return mtk_soc_wed_ops->msg_update(wed, cmd, (void *)&req, sizeof(req));
++}
++
+ static void
+ mt7915_mcu_csa_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
+ {
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index f8dd553..bd80315 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -9,6 +9,7 @@
+ #include "mt7915.h"
+ #include "mac.h"
+ #include "../trace.h"
++#include "../mt76_connac_mcu.h"
+ 
+ static bool wed_enable = true;
+ module_param(wed_enable, bool, 0644);
+@@ -781,6 +782,8 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+ 
+ 	wed->wlan.ser_trigger = mt7915_wed_trigger_ser;
+ 
++	wed->wlan.update_wo_rxcnt = mt7915_wed_update_wo_rxcnt;
++
+ 	dev->mt76.rx_token_size = wed->wlan.rx_pkt;
+ 	if (mtk_wed_device_attach(wed) != 0)
+ 		return 0;
+@@ -792,6 +795,9 @@ mt7915_pci_wed_init(struct mt7915_dev *dev, struct device *pdev, int *irq)
+ 	if (ret)
+ 		return ret;
+ 
++	if (is_wo_mcu(&dev->mt76))
++		mt7915_mcu_wo_cmd(dev, WO_CMD_RXCNT_CTRL, 1, 6);
++
+ 	return 1;
+ #else
+ 	return 0;
+diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
+index b4d6b55..c02cc87 100644
+--- a/mt7915/mt7915.h
++++ b/mt7915/mt7915.h
+@@ -546,6 +546,8 @@ u32 mt7915_wed_init_rx_buf(struct mtk_wed_device *wed,
+ 				int pkt_num);
+ void mt7915_wed_release_rx_buf(struct mtk_wed_device *wed);
+ void mt7915_wed_trigger_ser(struct mtk_wed_device *wed);
++void mt7915_wed_update_wo_rxcnt(struct mtk_wed_device *wed,
++				struct wo_cmd_rxcnt_t *rxcnt);
+ int mt7915_register_device(struct mt7915_dev *dev);
+ void mt7915_unregister_device(struct mt7915_dev *dev);
+ int mt7915_eeprom_init(struct mt7915_dev *dev);
+@@ -630,6 +632,7 @@ int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
+ 				     struct cfg80211_chan_def *chandef);
+ int mt7915_mcu_rf_regval(struct mt7915_dev *dev, u32 regidx, u32 *val, bool set);
+ int mt7915_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a3);
++int mt7915_mcu_wo_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2);
+ int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 type, u8 ctrl);
+ int mt7915_mcu_fw_dbg_ctrl(struct mt7915_dev *dev, u32 module, u8 level);
+ void mt7915_mcu_rx_event(struct mt7915_dev *dev, struct sk_buff *skb);
+-- 
+2.32.0
+
diff --git a/recipes-kernel/linux-mt76/files/patches/patches.inc b/recipes-kernel/linux-mt76/files/patches/patches.inc
index cb34658..eba8ebf 100644
--- a/recipes-kernel/linux-mt76/files/patches/patches.inc
+++ b/recipes-kernel/linux-mt76/files/patches/patches.inc
@@ -18,6 +18,7 @@
     file://1006-mt76-mt7915-add-L0.5-system-error-recovery-support.patch \
     file://1007-mt76-mt7915-add-support-for-runtime-set-in-band-disc.patch \
     file://1008-mt76-mt7915-add-mt76-vendor-muru-onoff-command.patch \
+    file://1009-mt76-mt7915-add-fw_version-dump.patch \
     file://1111-mt76-testmode-additional-supports.patch \
     file://1112-mt76-mt7915-init-rssi-in-WTBL-when-add-station.patch \
     file://1113-mt76-mt7915-reduce-TWT-SP-sent-to-FW-for-cert.patch \
@@ -32,4 +33,6 @@
     file://3002-mt76-add-wed-rx-support.patch \
     file://3003-mt76-add-fill-receive-path-to-report-wed-idx.patch \
     file://3004-mt76-add-ser-spport-when-wed-on.patch \
+    file://3005-mt76-mt7915-add-statistic-for-HW-Tx-Path.patch \
+    file://3006-mt76-mt7915-add-statistic-for-HW-Rx-Path.patch \
     "