recipes-wifi/linux-mt76/files/patches-3.x/0086-wifi-mt76-mt7996-switch-to-per-link-data-structure-o.patch

From 88111ec93e8bfd47f020965dd075849bd2233e40 Mon Sep 17 00:00:00 2001
From: Shayne Chen <shayne.chen@mediatek.com>
Date: Mon, 27 Nov 2023 10:43:34 +0800
Subject: [PATCH 086/116] wifi: mt76: mt7996: switch to per-link data structure
 of sta

Introduce struct mt7996_link_sta, data structure for per-link STA.
Note that mt7996_sta now represents a peer legacy or MLD device.
This is a preliminary patch to add MLO support for mt7996 chipsets.

Co-developed-by: Bo Jiao <Bo.Jiao@mediatek.com>
Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
---
 mt7615/mcu.c      |   4 +-
 mt76_connac_mcu.c |  18 +-
 mt76_connac_mcu.h |   7 +-
 mt7915/mcu.c      |   4 +-
 mt7925/mcu.c      |   4 +-
 mt7996/debugfs.c  |  20 ++-
 mt7996/mac.c      | 109 ++++++------
 mt7996/main.c     | 223 +++++++++++++++---------
 mt7996/mcu.c      | 430 ++++++++++++++++++++++++----------------------
 mt7996/mt7996.h   |  44 +++--
 mt7996/testmode.c |   6 +-
 11 files changed, 482 insertions(+), 387 deletions(-)

diff --git a/mt7615/mcu.c b/mt7615/mcu.c
index a931066..8f4f203 100644
--- a/mt7615/mcu.c
+++ b/mt7615/mcu.c
@@ -862,8 +862,8 @@ mt7615_mcu_wtbl_sta_add(struct mt7615_phy *phy, struct ieee80211_vif *vif,
 		else
 			mvif->sta_added = true;
 	}
-	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, sskb, vif, sta, enable,
-				      new_entry);
+	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, sskb, vif, &sta->deflink,
+				      enable, new_entry);
 	if (enable && sta)
 		mt76_connac_mcu_sta_tlv(phy->mt76, sskb, sta, vif, 0,
 					MT76_STA_INFO_STATE_ASSOC);
diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
index 0c7b693..d83d314 100644
--- a/mt76_connac_mcu.c
+++ b/mt76_connac_mcu.c
@@ -371,9 +371,10 @@ EXPORT_SYMBOL_GPL(mt76_connac_mcu_bss_omac_tlv);
 
 void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
 				   struct ieee80211_vif *vif,
-				   struct ieee80211_sta *sta,
+				   struct ieee80211_link_sta *link_sta,
 				   bool enable, bool newly)
 {
+	struct ieee80211_sta *sta = link_sta ? link_sta->sta : NULL;
 	struct sta_rec_basic *basic;
 	struct tlv *tlv;
 	int conn_type;
@@ -431,7 +432,7 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
 		break;
 	}
 
-	memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
+	memcpy(basic->peer_addr, link_sta->addr, ETH_ALEN);
 	basic->qos = sta->wme;
 }
 EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_basic_tlv);
@@ -1055,7 +1056,7 @@ int mt76_connac_mcu_sta_cmd(struct mt76_phy *phy,
 		return PTR_ERR(skb);
 
 	if (info->sta || !info->offload_fw)
-		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif, info->sta,
+		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif, &info->sta->deflink,
 					      info->enable, info->newly);
 	if (info->sta && info->enable)
 		mt76_connac_mcu_sta_tlv(phy, skb, info->sta,
@@ -1306,7 +1307,8 @@ int mt76_connac_mcu_sta_ba(struct mt76_dev *dev, struct mt76_vif *mvif,
 EXPORT_SYMBOL_GPL(mt76_connac_mcu_sta_ba);
 
 u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
-			    enum nl80211_band band, struct ieee80211_sta *sta)
+			    enum nl80211_band band,
+			    struct ieee80211_link_sta *link_sta)
 {
 	struct mt76_dev *dev = phy->dev;
 	const struct ieee80211_sta_he_cap *he_cap;
@@ -1317,10 +1319,10 @@ u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
 	if (is_connac_v1(dev))
 		return 0x38;
 
-	if (sta) {
-		ht_cap = &sta->deflink.ht_cap;
-		vht_cap = &sta->deflink.vht_cap;
-		he_cap = &sta->deflink.he_cap;
+	if (link_sta) {
+		ht_cap = &link_sta->ht_cap;
+		vht_cap = &link_sta->vht_cap;
+		he_cap = &link_sta->he_cap;
 	} else {
 		struct ieee80211_supported_band *sband;
 
diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
index c19f8e0..740b9f5 100644
--- a/mt76_connac_mcu.h
+++ b/mt76_connac_mcu.h
@@ -1910,8 +1910,8 @@ int mt76_connac_mcu_set_channel_domain(struct mt76_phy *phy);
 int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif);
 void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
 				   struct ieee80211_vif *vif,
-				   struct ieee80211_sta *sta, bool enable,
-				   bool newly);
+				   struct ieee80211_link_sta *link_sta,
+				   bool enable, bool newly);
 void mt76_connac_mcu_wtbl_generic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
 				      struct ieee80211_vif *vif,
 				      struct ieee80211_sta *sta, void *sta_wtbl,
@@ -2019,7 +2019,8 @@ mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif);
 const struct ieee80211_sta_eht_cap *
 mt76_connac_get_eht_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif);
 u8 mt76_connac_get_phy_mode(struct mt76_phy *phy, struct ieee80211_vif *vif,
-			    enum nl80211_band band, struct ieee80211_sta *sta);
+			    enum nl80211_band band,
+			    struct ieee80211_link_sta *link_sta);
 u8 mt76_connac_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
 				enum nl80211_band band);
 
diff --git a/mt7915/mcu.c b/mt7915/mcu.c
index 363ea0e..cb2e3b2 100644
--- a/mt7915/mcu.c
+++ b/mt7915/mcu.c
@@ -1504,7 +1504,7 @@ mt7915_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7915_dev *dev,
 
 	ra->valid = true;
 	ra->auto_rate = true;
-	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, sta);
+	ra->phy_mode = mt76_connac_get_phy_mode(mphy, vif, band, &sta->deflink);
 	ra->channel = chandef->chan->hw_value;
 	ra->bw = sta->deflink.bandwidth;
 	ra->phy.bw = sta->deflink.bandwidth;
@@ -1669,7 +1669,7 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
 		return PTR_ERR(skb);
 
 	/* starec basic */
-	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, sta, enable,
+	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, &sta->deflink, enable,
 				      !rcu_access_pointer(dev->mt76.wcid[msta->wcid.idx]));
 	if (!enable)
 		goto out;
diff --git a/mt7925/mcu.c b/mt7925/mcu.c
index 652a9ac..80e1828 100644
--- a/mt7925/mcu.c
+++ b/mt7925/mcu.c
@@ -1626,7 +1626,7 @@ mt7925_mcu_sta_cmd(struct mt76_phy *phy,
 		return PTR_ERR(skb);
 
 	if (info->sta || !info->offload_fw)
-		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif, info->sta,
+		mt76_connac_mcu_sta_basic_tlv(dev, skb, info->vif, &info->sta->deflink,
 					      info->enable, info->newly);
 	if (info->sta && info->enable) {
 		mt7925_mcu_sta_phy_tlv(skb, info->vif, info->sta);
@@ -2092,7 +2092,7 @@ mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
 		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_OFDM_INDEX);
 
 	memcpy(basic_req->bssid, vif->bss_conf.bssid, ETH_ALEN);
-	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, sta);
+	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, &sta->deflink);
 	basic_req->bcn_interval = cpu_to_le16(vif->bss_conf.beacon_int);
 	basic_req->dtim_period = vif->bss_conf.dtim_period;
 	basic_req->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
diff --git a/mt7996/debugfs.c b/mt7996/debugfs.c
index 06015d6..56e2192 100644
--- a/mt7996/debugfs.c
+++ b/mt7996/debugfs.c
@@ -739,14 +739,15 @@ static void
 mt7996_sta_hw_queue_read(void *data, struct ieee80211_sta *sta)
 {
 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+	struct mt7996_link_sta *mlink = &msta->deflink;
 	struct mt7996_dev *dev = msta->vif->deflink.phy->dev;
 	struct seq_file *s = data;
 	u8 ac;
 
 	for (ac = 0; ac < 4; ac++) {
 		u32 qlen, ctrl, val;
-		u32 idx = msta->wcid.idx >> 5;
-		u8 offs = msta->wcid.idx & GENMASK(4, 0);
+		u32 idx = mlink->wcid.idx >> 5;
+		u8 offs = mlink->wcid.idx & GENMASK(4, 0);
 
 		ctrl = BIT(31) | BIT(11) | (ac << 24);
 		val = mt76_rr(dev, MT_PLE_AC_QEMPTY(ac, idx));
@@ -754,11 +755,11 @@ mt7996_sta_hw_queue_read(void *data, struct ieee80211_sta *sta)
 		if (val & BIT(offs))
 			continue;
 
-		mt76_wr(dev, MT_FL_Q0_CTRL, ctrl | msta->wcid.idx);
+		mt76_wr(dev, MT_FL_Q0_CTRL, ctrl | mlink->wcid.idx);
 		qlen = mt76_get_field(dev, MT_FL_Q3_CTRL,
 				      GENMASK(11, 0));
 		seq_printf(s, "\tSTA %pM wcid %d: AC%d%d queued:%d\n",
-			   sta->addr, msta->wcid.idx,
+			   sta->addr, mlink->wcid.idx,
 			   msta->vif->deflink.mt76.wmm_idx, ac, qlen);
 	}
 }
@@ -1041,7 +1042,7 @@ mt7996_airtime_read(struct seq_file *s, void *data)
 	struct mt76_dev *mdev = &dev->mt76;
 	struct mt76_sta_stats *stats;
 	struct ieee80211_sta *sta;
-	struct mt7996_sta *msta;
+	struct mt7996_link_sta *mlink;
 	struct mt76_wcid *wcid;
 	struct mt76_vif *vif;
 	u16 i;
@@ -1053,9 +1054,9 @@ mt7996_airtime_read(struct seq_file *s, void *data)
 		if (!wcid || !wcid->sta)
 			continue;
 
-		msta = container_of(wcid, struct mt7996_sta, wcid);
-		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
-		vif = &msta->vif->deflink.mt76;
+		mlink = container_of(wcid, struct mt7996_link_sta, wcid);
+		sta = container_of((void *)mlink->sta, struct ieee80211_sta, drv_priv);
+		vif = &mlink->sta->vif->deflink.mt76;
 		stats = &wcid->stats;
 
 		seq_printf(s, "%pM WCID: %hu BandIdx: %hhu OmacIdx: 0x%hhx\t"
@@ -1230,6 +1231,7 @@ static ssize_t mt7996_sta_fixed_rate_set(struct file *file,
 #define LONG_PREAMBLE 1
 	struct ieee80211_sta *sta = file->private_data;
 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+	struct mt7996_link_sta *mlink = &msta->deflink;
 	struct mt7996_dev *dev = msta->vif->deflink.phy->dev;
 	struct ra_rate phy = {};
 	char buf[100];
@@ -1265,7 +1267,7 @@ static ssize_t mt7996_sta_fixed_rate_set(struct file *file,
 		goto out;
 	}
 
-	phy.wlan_idx = cpu_to_le16(msta->wcid.idx);
+	phy.wlan_idx = cpu_to_le16(mlink->wcid.idx);
 	phy.gi = cpu_to_le16(gi);
 	phy.ltf = cpu_to_le16(ltf);
 	phy.ldpc = phy.ldpc ? 7 : 0;
diff --git a/mt7996/mac.c b/mt7996/mac.c
index 63b16f9..3cff43d 100644
--- a/mt7996/mac.c
+++ b/mt7996/mac.c
@@ -54,7 +54,7 @@ static const struct mt7996_dfs_radar_spec jp_radar_specs = {
 static struct mt76_wcid *mt7996_rx_get_wcid(struct mt7996_dev *dev,
 					    u16 idx, bool unicast)
 {
-	struct mt7996_sta *sta;
+	struct mt7996_link_sta *mlink;
 	struct mt76_wcid *wcid;
 
 	if (idx >= ARRAY_SIZE(dev->mt76.wcid))
@@ -67,11 +67,11 @@ static struct mt76_wcid *mt7996_rx_get_wcid(struct mt7996_dev *dev,
 	if (!wcid->sta)
 		return NULL;
 
-	sta = container_of(wcid, struct mt7996_sta, wcid);
-	if (!sta->vif)
+	mlink = container_of(wcid, struct mt7996_link_sta, wcid);
+	if (!mlink->sta->vif)
 		return NULL;
 
-	return &sta->vif->sta.wcid;
+	return &mlink->wcid;
 }
 
 bool mt7996_mac_wtbl_update(struct mt7996_dev *dev, int idx, u32 mask)
@@ -92,12 +92,11 @@ u32 mt7996_mac_wtbl_lmac_addr(struct mt7996_dev *dev, u16 wcid, u8 dw)
 }
 
 void mt7996_mac_enable_rtscts(struct mt7996_dev *dev,
-			      struct ieee80211_vif *vif, bool enable)
+			      struct mt7996_link_sta *mlink, bool enable)
 {
-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
 	u32 addr;
 
-	addr = mt7996_mac_wtbl_lmac_addr(dev, mvif->sta.wcid.idx, 5);
+	addr = mt7996_mac_wtbl_lmac_addr(dev, mlink->wcid.idx, 5);
 	if (enable)
 		mt76_set(dev, addr, BIT(5));
 	else
@@ -349,7 +348,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
 	__le16 fc = 0;
 	int idx;
 	u8 hw_aggr = false;
-	struct mt7996_sta *msta = NULL;
+	struct mt7996_link_sta *mlink = NULL;
 
 	hw_aggr = status->aggr;
 	memset(status, 0, sizeof(*status));
@@ -380,10 +379,10 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
 	status->wcid = mt7996_rx_get_wcid(dev, idx, unicast);
 
 	if (status->wcid) {
-		msta = container_of(status->wcid, struct mt7996_sta, wcid);
+		mlink = container_of(status->wcid, struct mt7996_link_sta, wcid);
 		spin_lock_bh(&dev->mt76.sta_poll_lock);
-		if (list_empty(&msta->wcid.poll_list))
-			list_add_tail(&msta->wcid.poll_list,
+		if (list_empty(&mlink->wcid.poll_list))
+			list_add_tail(&mlink->wcid.poll_list,
 				      &dev->mt76.sta_poll_list);
 		spin_unlock_bh(&dev->mt76.sta_poll_lock);
 	}
@@ -592,7 +591,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
 #endif
 	} else {
 		status->flag |= RX_FLAG_8023;
-		mt7996_wed_check_ppe(dev, &dev->mt76.q_rx[q], msta, skb,
+		mt7996_wed_check_ppe(dev, &dev->mt76.q_rx[q], mlink ? mlink->sta : NULL, skb,
 				     *info);
 	}
 
@@ -942,6 +941,7 @@ static void
 mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
 {
 	struct mt7996_sta *msta;
+	struct mt7996_link_sta *mlink;
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 	bool is_8023 = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP;
 	u16 fc, tid;
@@ -970,7 +970,8 @@ mt7996_tx_check_aggr(struct ieee80211_sta *sta, struct sk_buff *skb)
 		return;
 
 	msta = (struct mt7996_sta *)sta->drv_priv;
-	if (!test_and_set_bit(tid, &msta->wcid.ampdu_state))
+	mlink = rcu_dereference(msta->link[0]);
+	if (!test_and_set_bit(tid, &mlink->wcid.ampdu_state))
 		ieee80211_start_tx_ba_session(sta, tid, 0);
 }
 
@@ -1048,7 +1049,7 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
 		 */
 		info = le32_to_cpu(*cur_info);
 		if (info & MT_TXFREE_INFO_PAIR) {
-			struct mt7996_sta *msta;
+			struct mt7996_link_sta *mlink;
 			u16 idx;
 
 			idx = FIELD_GET(MT_TXFREE_INFO_WLAN_ID, info);
@@ -1057,10 +1058,10 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
 			if (!sta)
 				continue;
 
-			msta = container_of(wcid, struct mt7996_sta, wcid);
+			mlink = container_of(wcid, struct mt7996_link_sta, wcid);
 			spin_lock_bh(&mdev->sta_poll_lock);
-			if (list_empty(&msta->wcid.poll_list))
-				list_add_tail(&msta->wcid.poll_list,
+			if (list_empty(&mlink->wcid.poll_list))
+				list_add_tail(&mlink->wcid.poll_list,
 					      &mdev->sta_poll_list);
 			spin_unlock_bh(&mdev->sta_poll_lock);
 			continue;
@@ -1265,7 +1266,7 @@ out:
 
 static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
 {
-	struct mt7996_sta *msta = NULL;
+	struct mt7996_link_sta *mlink;
 	struct mt76_wcid *wcid;
 	__le32 *txs_data = data;
 	u16 wcidx;
@@ -1286,16 +1287,15 @@ static void mt7996_mac_add_txs(struct mt7996_dev *dev, void *data)
 	if (!wcid)
 		goto out;
 
-	msta = container_of(wcid, struct mt7996_sta, wcid);
-
 	mt7996_mac_add_txs_skb(dev, wcid, pid, txs_data);
 
 	if (!wcid->sta)
 		goto out;
 
+	mlink = container_of(wcid, struct mt7996_link_sta, wcid);
 	spin_lock_bh(&dev->mt76.sta_poll_lock);
-	if (list_empty(&msta->wcid.poll_list))
-		list_add_tail(&msta->wcid.poll_list, &dev->mt76.sta_poll_list);
+	if (list_empty(&mlink->wcid.poll_list))
+		list_add_tail(&mlink->wcid.poll_list, &dev->mt76.sta_poll_list);
 	spin_unlock_bh(&dev->mt76.sta_poll_lock);
 
 out:
@@ -2242,8 +2242,9 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
 	struct ieee80211_sta *sta;
 	struct ieee80211_vif *vif;
 	struct ieee80211_bss_conf *conf;
+	struct ieee80211_link_sta *link_sta;
 	struct mt7996_bss_conf *mconf;
-	struct mt7996_sta *msta;
+	struct mt7996_link_sta *mlink;
 	u32 changed;
 	LIST_HEAD(list);
 
@@ -2251,24 +2252,25 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
 	list_splice_init(&dev->sta_rc_list, &list);
 
 	while (!list_empty(&list)) {
-		msta = list_first_entry(&list, struct mt7996_sta, rc_list);
-		list_del_init(&msta->rc_list);
-		changed = msta->changed;
-		msta->changed = 0;
+		mlink = list_first_entry(&list, struct mt7996_link_sta, rc_list);
+		list_del_init(&mlink->rc_list);
+		changed = mlink->changed;
+		mlink->changed = 0;
 		spin_unlock_bh(&dev->mt76.sta_poll_lock);
 
-		sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
-		vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
+		sta = container_of((void *)mlink->sta, struct ieee80211_sta, drv_priv);
+		link_sta = &sta->deflink;
+		vif = container_of((void *)mlink->sta->vif, struct ieee80211_vif, drv_priv);
 		conf = &vif->bss_conf;
-		mconf = &msta->vif->deflink;
+		mconf = &mlink->sta->vif->deflink;
 
 		if (changed & (IEEE80211_RC_SUPP_RATES_CHANGED |
 			       IEEE80211_RC_NSS_CHANGED |
 			       IEEE80211_RC_BW_CHANGED))
-			mt7996_mcu_add_rate_ctrl(dev, conf, mconf, sta, true);
+			mt7996_mcu_add_rate_ctrl(dev, conf, mconf, link_sta, mlink, true);
 
 		if (changed & IEEE80211_RC_SMPS_CHANGED)
-			mt7996_mcu_set_fixed_field(dev, mconf, sta, NULL,
+			mt7996_mcu_set_fixed_field(dev, mconf, link_sta, mlink, NULL,
 						   RATE_PARAM_MMPS_UPDATE);
 
 		spin_lock_bh(&dev->mt76.sta_poll_lock);
@@ -2561,7 +2563,7 @@ static int mt7996_mac_check_twt_req(struct ieee80211_twt_setup *twt)
 }
 
 static bool
-mt7996_mac_twt_param_equal(struct mt7996_sta *msta,
+mt7996_mac_twt_param_equal(struct mt7996_link_sta *mlink,
 			   struct ieee80211_twt_params *twt_agrt)
 {
 	u16 type = le16_to_cpu(twt_agrt->req_type);
@@ -2572,10 +2574,10 @@ mt7996_mac_twt_param_equal(struct mt7996_sta *msta,
 	for (i = 0; i < MT7996_MAX_STA_TWT_AGRT; i++) {
 		struct mt7996_twt_flow *f;
 
-		if (!(msta->twt.flowid_mask & BIT(i)))
+		if (!(mlink->twt.flowid_mask & BIT(i)))
 			continue;
 
-		f = &msta->twt.flow[i];
+		f = &mlink->twt.flow[i];
 		if (f->duration == twt_agrt->min_twt_dur &&
 		    f->mantissa == twt_agrt->mantissa &&
 		    f->exp == exp &&
@@ -2594,6 +2596,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
 {
 	enum ieee80211_twt_setup_cmd setup_cmd = TWT_SETUP_CMD_REJECT;
 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+	struct mt7996_link_sta *mlink;
 	struct ieee80211_twt_params *twt_agrt = (void *)twt->params;
 	u16 req_type = le16_to_cpu(twt_agrt->req_type);
 	enum ieee80211_twt_setup_cmd sta_setup_cmd;
@@ -2605,11 +2608,12 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
 		goto out;
 
 	mutex_lock(&dev->mt76.mutex);
+	mlink = mlink_dereference_protected(msta, 0);
 
 	if (dev->twt.n_agrt == MT7996_MAX_TWT_AGRT)
 		goto unlock;
 
-	if (hweight8(msta->twt.flowid_mask) == ARRAY_SIZE(msta->twt.flow))
+	if (hweight8(mlink->twt.flowid_mask) == ARRAY_SIZE(mlink->twt.flow))
 		goto unlock;
 
 	if (twt_agrt->min_twt_dur < MT7996_MIN_TWT_DUR) {
@@ -2618,10 +2622,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
 		goto unlock;
 	}
 
-	if (mt7996_mac_twt_param_equal(msta, twt_agrt))
+	if (mt7996_mac_twt_param_equal(mlink, twt_agrt))
 		goto unlock;
 
-	flowid = ffs(~msta->twt.flowid_mask) - 1;
+	flowid = ffs(~mlink->twt.flowid_mask) - 1;
 	twt_agrt->req_type &= ~cpu_to_le16(IEEE80211_TWT_REQTYPE_FLOWID);
 	twt_agrt->req_type |= le16_encode_bits(flowid,
 					       IEEE80211_TWT_REQTYPE_FLOWID);
@@ -2630,10 +2634,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
 	exp = FIELD_GET(IEEE80211_TWT_REQTYPE_WAKE_INT_EXP, req_type);
 	sta_setup_cmd = FIELD_GET(IEEE80211_TWT_REQTYPE_SETUP_CMD, req_type);
 
-	flow = &msta->twt.flow[flowid];
+	flow = &mlink->twt.flow[flowid];
 	memset(flow, 0, sizeof(*flow));
 	INIT_LIST_HEAD(&flow->list);
-	flow->wcid = msta->wcid.idx;
+	flow->wcid = mlink->wcid.idx;
 	flow->table_id = table_id;
 	flow->id = flowid;
 	flow->duration = twt_agrt->min_twt_dur;
@@ -2651,7 +2655,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
 
 		flow->sched = true;
 		flow->start_tsf = mt7996_mac_twt_sched_list_add(dev, flow);
-		curr_tsf = __mt7996_get_tsf(hw, &msta->vif->deflink);
+		curr_tsf = __mt7996_get_tsf(hw, &mlink->sta->vif->deflink);
 		div_u64_rem(curr_tsf - flow->start_tsf, interval, &rem);
 		flow_tsf = curr_tsf + interval - rem;
 		twt_agrt->twt = cpu_to_le64(flow_tsf);
@@ -2660,13 +2664,13 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
 	}
 	flow->tsf = le64_to_cpu(twt_agrt->twt);
 
-	if (mt7996_mcu_twt_agrt_update(dev, &msta->vif->deflink, flow,
+	if (mt7996_mcu_twt_agrt_update(dev, &mlink->sta->vif->deflink, flow,
 				       MCU_TWT_AGRT_ADD))
 		goto unlock;
 
 	setup_cmd = TWT_SETUP_CMD_ACCEPT;
 	dev->twt.table_mask |= BIT(table_id);
-	msta->twt.flowid_mask |= BIT(flowid);
+	mlink->twt.flowid_mask |= BIT(flowid);
 	dev->twt.n_agrt++;
 
 unlock:
@@ -2679,26 +2683,25 @@ out:
 }
 
 void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
-				  struct mt7996_sta *msta,
-				  u8 flowid)
+				  struct mt7996_link_sta *mlink, u8 flowid)
 {
 	struct mt7996_twt_flow *flow;
-	struct mt7996_bss_conf *mconf = mconf_dereference_protected(msta->vif, 0);
+	struct mt7996_bss_conf *mconf = mconf_dereference_protected(mlink->sta->vif, 0);
 
 	lockdep_assert_held(&dev->mt76.mutex);
 
-	if (flowid >= ARRAY_SIZE(msta->twt.flow))
+	if (flowid >= ARRAY_SIZE(mlink->twt.flow))
 		return;
 
-	if (!(msta->twt.flowid_mask & BIT(flowid)))
+	if (!(mlink->twt.flowid_mask & BIT(flowid)))
 		return;
 
-	flow = &msta->twt.flow[flowid];
+	flow = &mlink->twt.flow[flowid];
 	if (mt7996_mcu_twt_agrt_update(dev, mconf, flow, MCU_TWT_AGRT_DELETE))
 		return;
 
 	list_del_init(&flow->list);
-	msta->twt.flowid_mask &= ~BIT(flowid);
+	mlink->twt.flowid_mask &= ~BIT(flowid);
 	dev->twt.table_mask &= ~BIT(flow->table_id);
 	dev->twt.n_agrt--;
 }
@@ -2711,7 +2714,7 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
 	struct cfg80211_scan_request *req = phy->scan_req;
 	struct ieee80211_vif *vif = phy->scan_vif;
 	struct mt7996_vif *mvif;
-	struct mt76_wcid *wcid;
+	struct mt7996_link_sta *mlink;
 	struct ieee80211_tx_info *info;
 	struct sk_buff *skb;
 
@@ -2719,7 +2722,6 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
 		return;
 
 	mvif = (struct mt7996_vif *)vif->drv_priv;
-	wcid = &mvif->sta.wcid;
 
 	skb = ieee80211_probereq_get(hw, vif->addr,
 				     ssid->ssid, ssid->ssid_len, req->ie_len);
@@ -2752,7 +2754,8 @@ mt7996_scan_send_probe(struct mt7996_phy *phy, struct cfg80211_ssid *ssid,
 	}
 
 	local_bh_disable();
-	mt76_tx(phy->mt76, NULL, wcid, skb);
+	mlink = rcu_dereference(mvif->sta.link[0]);
+	mt76_tx(phy->mt76, NULL, &mlink->wcid, skb);
 	local_bh_enable();
 
 	rcu_read_unlock();
diff --git a/mt7996/main.c b/mt7996/main.c
index bc4863d..4e5ba58 100644
--- a/mt7996/main.c
+++ b/mt7996/main.c
@@ -229,6 +229,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
 	struct ieee80211_bss_conf *conf = &vif->bss_conf;
 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
 	struct mt7996_bss_conf *mconf = &mvif->deflink;
+	struct mt7996_link_sta *mlink = &mvif->sta.deflink;
 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
 	struct mt76_txq *mtxq;
@@ -268,14 +269,15 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
 
 	idx = MT7996_WTBL_RESERVED - mconf->mt76.idx;
 
-	INIT_LIST_HEAD(&mvif->sta.rc_list);
-	INIT_LIST_HEAD(&mvif->sta.wcid.poll_list);
-	mvif->sta.wcid.idx = idx;
-	mvif->sta.wcid.phy_idx = band_idx;
-	mvif->sta.wcid.hw_key_idx = -1;
-	mvif->sta.wcid.tx_info |= MT_WCID_TX_INFO_SET;
-	mvif->sta.vif = mvif;
-	mt76_wcid_init(&mvif->sta.wcid);
+	INIT_LIST_HEAD(&mlink->rc_list);
+	INIT_LIST_HEAD(&mlink->wcid.poll_list);
+	mlink->wcid.idx = idx;
+	mlink->wcid.phy_idx = band_idx;
+	mlink->wcid.hw_key_idx = -1;
+	mlink->wcid.tx_info |= MT_WCID_TX_INFO_SET;
+	mlink->sta = &mvif->sta;
+	mlink->sta->vif = mvif;
+	mt76_wcid_init(&mlink->wcid);
 
 	mt7996_mac_wtbl_update(dev, idx,
 			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
@@ -297,14 +299,15 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
 
 	mt7996_init_bitrate_mask(mconf);
 
-	mt7996_mcu_add_bss_info(phy, conf, mconf, true);
+	mt7996_mcu_add_bss_info(phy, conf, mconf, mlink, true);
 	/* defer the first STA_REC of BMC entry to BSS_CHANGED_BSSID for STA
 	 * interface, since firmware only records BSSID when the entry is new
 	 */
 	if (vif->type != NL80211_IFTYPE_STATION)
-		mt7996_mcu_add_sta(dev, conf, mconf, NULL, true, true);
-	rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid);
+		mt7996_mcu_add_sta(dev, conf, mconf, NULL, mlink, true, true);
+	rcu_assign_pointer(dev->mt76.wcid[idx], &mlink->wcid);
 	rcu_assign_pointer(mvif->link[0], mconf);
+	rcu_assign_pointer(mvif->sta.link[0], mlink);
 
 out:
 	mutex_unlock(&dev->mt76.mutex);
@@ -318,10 +321,10 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
 	struct ieee80211_bss_conf *conf;
 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
 	struct mt7996_bss_conf *mconf;
-	struct mt7996_sta *msta = &mvif->sta;
+	struct mt7996_link_sta *mlink = &mvif->sta.deflink;
 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
-	int idx = msta->wcid.idx;
+	int idx = mlink->wcid.idx;
 
 	cancel_delayed_work_sync(&phy->scan_work);
 
@@ -329,8 +332,8 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
 
 	conf = link_conf_dereference_protected(vif, 0);
 	mconf = mconf_dereference_protected(mvif, 0);
-	mt7996_mcu_add_sta(dev, conf, mconf, NULL, false, false);
-	mt7996_mcu_add_bss_info(phy, conf, mconf, false);
+	mt7996_mcu_add_sta(dev, conf, mconf, NULL, mlink, false, false);
+	mt7996_mcu_add_bss_info(phy, conf, mconf, mlink, false);
 
 	if (vif == phy->monitor_vif)
 		phy->monitor_vif = NULL;
@@ -343,12 +346,13 @@ static void mt7996_remove_interface(struct ieee80211_hw *hw,
 	phy->omac_mask &= ~BIT_ULL(mconf->mt76.omac_idx);
 
 	spin_lock_bh(&dev->mt76.sta_poll_lock);
-	if (!list_empty(&msta->wcid.poll_list))
-		list_del_init(&msta->wcid.poll_list);
+	if (!list_empty(&mlink->wcid.poll_list))
+		list_del_init(&mlink->wcid.poll_list);
 	spin_unlock_bh(&dev->mt76.sta_poll_lock);
 
-	mt76_wcid_cleanup(&dev->mt76, &msta->wcid);
+	mt76_wcid_cleanup(&dev->mt76, &mlink->wcid);
 	rcu_assign_pointer(mvif->link[0], NULL);
+	rcu_assign_pointer(mvif->sta.link[0], NULL);
 
 	mutex_unlock(&dev->mt76.mutex);
 }
@@ -447,10 +451,10 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
 	struct mt7996_sta *msta = sta ? (struct mt7996_sta *)sta->drv_priv :
 				  &mvif->sta;
-	struct mt76_wcid *wcid = &msta->wcid;
 	struct mt7996_bss_conf *mconf;
+	struct mt7996_link_sta *mlink;
 	struct ieee80211_bss_conf *conf;
-	u8 *wcid_keyidx = &wcid->hw_key_idx;
+	u8 *wcid_keyidx;
 	int idx = key->keyidx;
 	int err = 0;
 
@@ -464,6 +468,12 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 	    !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
 		return -EOPNOTSUPP;
 
+	mutex_lock(&dev->mt76.mutex);
+	conf = link_conf_dereference_protected(vif, 0);
+	mconf = mconf_dereference_protected(mvif, 0);
+	mlink = mlink_dereference_protected(msta, 0);
+	wcid_keyidx = &mlink->wcid.hw_key_idx;
+
 	/* fall back to sw encryption for unsupported ciphers */
 	switch (key->cipher) {
 	case WLAN_CIPHER_SUITE_TKIP:
@@ -486,16 +496,13 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 	case WLAN_CIPHER_SUITE_WEP40:
 	case WLAN_CIPHER_SUITE_WEP104:
 	default:
+		mutex_unlock(&dev->mt76.mutex);
 		return -EOPNOTSUPP;
 	}
 
-	mutex_lock(&dev->mt76.mutex);
-
-	conf = link_conf_dereference_protected(vif, 0);
-	mconf = mconf_dereference_protected(mvif, 0);
 	if (cmd == SET_KEY && !sta && !mconf->mt76.cipher) {
 		mconf->mt76.cipher = mt76_connac_mcu_get_cipher(key->cipher);
-		mt7996_mcu_add_bss_info(phy, conf, mconf, true);
+		mt7996_mcu_add_bss_info(phy, conf, mconf, mlink, true);
 	}
 
 	if (cmd == SET_KEY) {
@@ -506,14 +513,14 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 		goto out;
 	}
 
-	mt76_wcid_key_setup(&dev->mt76, wcid, key);
+	mt76_wcid_key_setup(&dev->mt76, &mlink->wcid, key);
 
 	if (key->keyidx == 6 || key->keyidx == 7)
-		err = mt7996_mcu_bcn_prot_enable(dev, conf, mconf, key);
+		err = mt7996_mcu_bcn_prot_enable(dev, conf, mconf, mlink, key);
 	else
 		err = mt7996_mcu_add_key(&dev->mt76, mconf, key,
 					 MCU_WMWA_UNI_CMD(STA_REC_UPDATE),
-					 &msta->wcid, cmd);
+					 &mlink->wcid, cmd);
 out:
 	mutex_unlock(&dev->mt76.mutex);
 
@@ -716,25 +723,27 @@ static void mt7996_bss_info_changed(struct ieee80211_hw *hw,
 {
 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
 	struct mt7996_bss_conf *mconf;
+	struct mt7996_link_sta *mlink;
 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
 
 	mutex_lock(&dev->mt76.mutex);
 
 	mconf = mconf_dereference_protected(mvif, 0);
+	mlink = mlink_dereference_protected(&mvif->sta, 0);
 	/* station mode uses BSSID to map the wlan entry to a peer,
 	 * and then peer references bss_info_rfch to set bandwidth cap.
 	 */
 	if ((changed & BSS_CHANGED_BSSID && !is_zero_ether_addr(info->bssid)) ||
 	    (changed & BSS_CHANGED_ASSOC && vif->cfg.assoc) ||
 	    (changed & BSS_CHANGED_BEACON_ENABLED && info->enable_beacon)) {
-		mt7996_mcu_add_bss_info(phy, info, mconf, true);
-		mt7996_mcu_add_sta(dev, info, mconf, NULL, true,
+		mt7996_mcu_add_bss_info(phy, info, mconf, mlink, true);
+		mt7996_mcu_add_sta(dev, info, mconf, NULL, mlink, true,
 				   !!(changed & BSS_CHANGED_BSSID));
 	}
 
 	if (changed & BSS_CHANGED_ERP_CTS_PROT)
-		mt7996_mac_enable_rtscts(dev, vif, info->use_cts_prot);
+		mt7996_mac_enable_rtscts(dev, mlink, info->use_cts_prot);
 
 	if (changed & BSS_CHANGED_ERP_SLOT) {
 		int slottime = info->use_short_slot ? 9 : 20;
@@ -805,6 +814,7 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
 	struct mt7996_bss_conf *mconf = mconf_dereference_protected(mvif, 0);
+	struct mt7996_link_sta *mlink = &msta->deflink;
 	u8 band_idx = mconf->phy->mt76->band_idx;
 	int idx;
 
@@ -816,13 +826,16 @@ int mt7996_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 	if (idx < 0)
 		return -ENOSPC;
 
-	INIT_LIST_HEAD(&msta->rc_list);
-	INIT_LIST_HEAD(&msta->wcid.poll_list);
+	INIT_LIST_HEAD(&mlink->rc_list);
+	INIT_LIST_HEAD(&mlink->wcid.poll_list);
 	msta->vif = mvif;
-	msta->wcid.sta = 1;
-	msta->wcid.idx = idx;
-	msta->wcid.phy_idx = band_idx;
-	msta->wcid.tx_info |= MT_WCID_TX_INFO_SET;
+	mlink->wcid.sta = 1;
+	mlink->wcid.idx = idx;
+	mlink->wcid.phy_idx = band_idx;
+	mlink->wcid.tx_info |= MT_WCID_TX_INFO_SET;
+	mlink->sta = msta;
+
+	rcu_assign_pointer(msta->link[0], mlink);
 
 #ifdef CONFIG_MTK_VENDOR
 	mt7996_vendor_amnt_sta_remove(mconf->phy, sta);
@@ -855,19 +868,25 @@ void mt7996_mac_sta_assoc(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
 	struct mt7996_bss_conf *mconf;
+	struct mt7996_link_sta *mlink;
 	struct ieee80211_bss_conf *conf;
+	struct ieee80211_link_sta *link_sta;
 
 	mutex_lock(&dev->mt76.mutex);
 
-	mt7996_mac_wtbl_update(dev, msta->wcid.idx,
-			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
-
 	conf = link_conf_dereference_protected(vif, 0);
 	mconf = mconf_dereference_protected(mvif, 0);
-	mt7996_mcu_add_sta(dev, conf, mconf, sta, true, true);
-	mt7996_mcu_add_rate_ctrl(dev, conf, mconf, sta, false);
+	link_sta = link_sta_dereference_protected(sta, 0);
+	mlink = mlink_dereference_protected(msta, 0);
 
-	ewma_avg_signal_init(&msta->avg_ack_signal);
+	mt7996_mac_wtbl_update(dev, mlink->wcid.idx,
+			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
+
+	mt7996_mcu_add_sta(dev, conf, mconf, link_sta, mlink, true, true);
+	mt7996_mcu_add_rate_ctrl(dev, conf, mconf, link_sta, mlink, false);
+	mlink->wcid.tx_info |= MT_WCID_TX_INFO_SET;
+
+	ewma_avg_signal_init(&mlink->avg_ack_signal);
 
 	mutex_unlock(&dev->mt76.mutex);
 }
@@ -879,25 +898,31 @@ void mt7996_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
 	struct mt7996_bss_conf *mconf;
+	struct mt7996_link_sta *mlink;
 	struct ieee80211_bss_conf *conf;
+	struct ieee80211_link_sta *link_sta;
 	int i;
 
 	conf = link_conf_dereference_protected(vif, 0);
 	mconf = mconf_dereference_protected(mvif, 0);
-	mt7996_mcu_add_sta(dev, conf, mconf, sta, false, false);
+	link_sta = link_sta_dereference_protected(sta, 0);
+	mlink = mlink_dereference_protected(msta, 0);
+	mt7996_mcu_add_sta(dev, conf, mconf, link_sta, mlink, false, false);
 
-	mt7996_mac_wtbl_update(dev, msta->wcid.idx,
+	mt7996_mac_wtbl_update(dev, mlink->wcid.idx,
 			       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
 
-	for (i = 0; i < ARRAY_SIZE(msta->twt.flow); i++)
-		mt7996_mac_twt_teardown_flow(dev, msta, i);
+	for (i = 0; i < ARRAY_SIZE(mlink->twt.flow); i++)
+		mt7996_mac_twt_teardown_flow(dev, mlink, i);
 
 	spin_lock_bh(&mdev->sta_poll_lock);
-	if (!list_empty(&msta->wcid.poll_list))
-		list_del_init(&msta->wcid.poll_list);
-	if (!list_empty(&msta->rc_list))
-		list_del_init(&msta->rc_list);
+	if (!list_empty(&mlink->wcid.poll_list))
+		list_del_init(&mlink->wcid.poll_list);
+	if (!list_empty(&mlink->rc_list))
+		list_del_init(&mlink->rc_list);
 	spin_unlock_bh(&mdev->sta_poll_lock);
+
+	rcu_assign_pointer(msta->link[0], NULL);
 }
 
 static void mt7996_tx(struct ieee80211_hw *hw,
@@ -909,19 +934,22 @@ static void mt7996_tx(struct ieee80211_hw *hw,
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 	struct ieee80211_vif *vif = info->control.vif;
 	struct mt76_wcid *wcid = &dev->mt76.global_wcid;
+	struct mt7996_link_sta *mlink;
 
 	if (control->sta) {
-		struct mt7996_sta *sta;
+		struct mt7996_sta *msta;
 
-		sta = (struct mt7996_sta *)control->sta->drv_priv;
-		wcid = &sta->wcid;
+		msta = (struct mt7996_sta *)control->sta->drv_priv;
+		mlink = rcu_dereference(msta->link[0]);
+		wcid = &mlink->wcid;
 	}
 
 	if (vif && !control->sta) {
 		struct mt7996_vif *mvif;
 
 		mvif = (struct mt7996_vif *)vif->drv_priv;
-		wcid = &mvif->sta.wcid;
+		mlink = rcu_dereference(mvif->sta.link[0]);
+		wcid = &mlink->wcid;
 	}
 
 	mt76_tx(mphy, control->sta, wcid, skb);
@@ -948,6 +976,7 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 	struct ieee80211_sta *sta = params->sta;
 	struct ieee80211_txq *txq = sta->txq[params->tid];
 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+	struct mt7996_link_sta *mlink;
 	u16 tid = params->tid;
 	u16 ssn = params->ssn;
 	struct mt76_txq *mtxq;
@@ -959,14 +988,15 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 	mtxq = (struct mt76_txq *)txq->drv_priv;
 
 	mutex_lock(&dev->mt76.mutex);
+	mlink = mlink_dereference_protected(msta, 0);
 	switch (action) {
 	case IEEE80211_AMPDU_RX_START:
-		mt76_rx_aggr_start(&dev->mt76, &msta->wcid, tid, ssn,
+		mt76_rx_aggr_start(&dev->mt76, &mlink->wcid, tid, ssn,
 				   params->buf_size);
 		ret = mt7996_mcu_add_rx_ba(dev, params, true);
 		break;
 	case IEEE80211_AMPDU_RX_STOP:
-		mt76_rx_aggr_stop(&dev->mt76, &msta->wcid, tid);
+		mt76_rx_aggr_stop(&dev->mt76, &mlink->wcid, tid);
 		ret = mt7996_mcu_add_rx_ba(dev, params, false);
 		break;
 	case IEEE80211_AMPDU_TX_OPERATIONAL:
@@ -977,16 +1007,16 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
 		mtxq->aggr = false;
-		clear_bit(tid, &msta->wcid.ampdu_state);
+		clear_bit(tid, &mlink->wcid.ampdu_state);
 		ret = mt7996_mcu_add_tx_ba(dev, params, false);
 		break;
 	case IEEE80211_AMPDU_TX_START:
-		set_bit(tid, &msta->wcid.ampdu_state);
+		set_bit(tid, &mlink->wcid.ampdu_state);
 		ret = IEEE80211_AMPDU_TX_START_IMMEDIATE;
 		break;
 	case IEEE80211_AMPDU_TX_STOP_CONT:
 		mtxq->aggr = false;
-		clear_bit(tid, &msta->wcid.ampdu_state);
+		clear_bit(tid, &mlink->wcid.ampdu_state);
 		ret = mt7996_mcu_add_tx_ba(dev, params, false);
 		ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
 		break;
@@ -1165,10 +1195,19 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
 				  struct ieee80211_sta *sta,
 				  struct station_info *sinfo)
 {
+	struct mt7996_dev *dev = mt7996_hw_dev(hw);
 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
-	struct rate_info *txrate = &msta->wcid.rate;
+	struct mt7996_link_sta *mlink;
+	struct rate_info *txrate;
 
+	/* TODO: support per-link rate report */
+	mutex_lock(&dev->mt76.mutex);
+	mlink = mlink_dereference_protected(msta, 0);
+	if (!mlink)
+		goto out;
+
+	txrate = &mlink->wcid.rate;
 	if (txrate->legacy || txrate->flags) {
 		if (txrate->legacy) {
 			sinfo->txrate.legacy = txrate->legacy;
@@ -1187,44 +1226,52 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
 	sinfo->txrate.flags = txrate->flags;
 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
 
-	sinfo->tx_failed = msta->wcid.stats.tx_failed;
+	sinfo->tx_failed = mlink->wcid.stats.tx_failed;
 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
 
-	sinfo->tx_retries = msta->wcid.stats.tx_retries;
+	sinfo->tx_retries = mlink->wcid.stats.tx_retries;
 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
 
-	sinfo->ack_signal = (s8)msta->ack_signal;
+	sinfo->ack_signal = (s8)mlink->ack_signal;
 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL);
 
-	sinfo->avg_ack_signal = -(s8)ewma_avg_signal_read(&msta->avg_ack_signal);
+	sinfo->avg_ack_signal = -(s8)ewma_avg_signal_read(&mlink->avg_ack_signal);
 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL_AVG);
 
 	if (mtk_wed_device_active(&phy->dev->mt76.mmio.wed)) {
-		sinfo->tx_bytes = msta->wcid.stats.tx_bytes;
+		sinfo->tx_bytes = mlink->wcid.stats.tx_bytes;
 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES64);
 
-		sinfo->rx_bytes = msta->wcid.stats.rx_bytes;
+		sinfo->rx_bytes = mlink->wcid.stats.rx_bytes;
 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES64);
 
-		sinfo->tx_packets = msta->wcid.stats.tx_packets;
+		sinfo->tx_packets = mlink->wcid.stats.tx_packets;
 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
 
-		sinfo->rx_packets = msta->wcid.stats.rx_packets;
+		sinfo->rx_packets = mlink->wcid.stats.rx_packets;
 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
 	}
+out:
+	mutex_unlock(&dev->mt76.mutex);
 }
 
 static void mt7996_sta_rc_work(void *data, struct ieee80211_sta *sta)
 {
 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+	struct mt7996_link_sta *mlink;
 	struct mt7996_dev *dev = msta->vif->dev;
 	u32 *changed = data;
 
+	rcu_read_lock();
+	mlink = rcu_dereference(msta->link[0]);
+
 	spin_lock_bh(&dev->mt76.sta_poll_lock);
-	msta->changed |= *changed;
-	if (list_empty(&msta->rc_list))
-		list_add_tail(&msta->rc_list, &dev->sta_rc_list);
+	mlink->changed |= *changed;
+	if (list_empty(&mlink->rc_list))
+		list_add_tail(&mlink->rc_list, &dev->sta_rc_list);
 	spin_unlock_bh(&dev->mt76.sta_poll_lock);
+
+	rcu_read_unlock();
 }
 
 static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
@@ -1238,7 +1285,7 @@ static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
 
 	if (!msta->vif) {
 		dev_warn(dev->mt76.dev, "Un-initialized STA %pM wcid %d in rc_work\n",
-			 sta->addr, msta->wcid.idx);
+			 sta->addr, msta->deflink.wcid.idx);
 		return;
 	}
 
@@ -1284,16 +1331,18 @@ static void mt7996_sta_set_4addr(struct ieee80211_hw *hw,
 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
 	struct mt7996_bss_conf *mconf;
+	struct mt7996_link_sta *mlink;
 
 	mutex_lock(&dev->mt76.mutex);
 	mconf = mconf_dereference_protected(mvif, 0);
+	mlink = mlink_dereference_protected(msta, 0);
 
 	if (enabled)
-		set_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
+		set_bit(MT_WCID_FLAG_4ADDR, &mlink->wcid.flags);
 	else
-		clear_bit(MT_WCID_FLAG_4ADDR, &msta->wcid.flags);
+		clear_bit(MT_WCID_FLAG_4ADDR, &mlink->wcid.flags);
 
-	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, sta);
+	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, mlink);
 	mutex_unlock(&dev->mt76.mutex);
 }
 
@@ -1306,16 +1355,18 @@ static void mt7996_sta_set_decap_offload(struct ieee80211_hw *hw,
 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
 	struct mt7996_bss_conf *mconf;
+	struct mt7996_link_sta *mlink;
 
 	mutex_lock(&dev->mt76.mutex);
 	mconf = mconf_dereference_protected(mvif, 0);
+	mlink = mlink_dereference_protected(msta, 0);
 
 	if (enabled)
-		set_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
+		set_bit(MT_WCID_FLAG_HDR_TRANS, &mlink->wcid.flags);
 	else
-		clear_bit(MT_WCID_FLAG_HDR_TRANS, &msta->wcid.flags);
+		clear_bit(MT_WCID_FLAG_HDR_TRANS, &mlink->wcid.flags);
 
-	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, sta);
+	mt7996_mcu_wtbl_update_hdr_trans(dev, vif, mconf, mlink);
 	mutex_unlock(&dev->mt76.mutex);
 }
 
@@ -1448,11 +1499,12 @@ static void mt7996_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
 {
 	struct mt76_ethtool_worker_info *wi = wi_data;
 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+	struct mt7996_link_sta *mlink = &msta->deflink;
 
 	if (msta->vif->deflink.mt76.idx != wi->idx)
 		return;
 
-	mt76_ethtool_worker(wi, &msta->wcid.stats, true);
+	mt76_ethtool_worker(wi, &mlink->wcid.stats, true);
 }
 
 static
@@ -1555,10 +1607,12 @@ mt7996_twt_teardown_request(struct ieee80211_hw *hw,
 			    u8 flowid)
 {
 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+	struct mt7996_link_sta *mlink;
 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
 
 	mutex_lock(&dev->mt76.mutex);
-	mt7996_mac_twt_teardown_flow(dev, msta, flowid);
+	mlink = mlink_dereference_protected(msta, 0);
+	mt7996_mac_twt_teardown_flow(dev, mlink, flowid);
 	mutex_unlock(&dev->mt76.mutex);
 }
 
@@ -1681,6 +1735,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
 	struct mt7996_bss_conf *mconf = &mvif->deflink;
 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+	struct mt7996_link_sta *mlink = &msta->deflink;
 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
 	struct mt7996_phy *phy = mt7996_hw_phy(hw);
 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
@@ -1703,7 +1758,7 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
 	if (!mtk_wed_device_active(wed))
 		return -ENODEV;
 
-	if (msta->wcid.idx > MT7996_WTBL_STA)
+	if (mlink->wcid.idx > MT7996_WTBL_STA)
 		return -EIO;
 
 	path->type = DEV_PATH_MTK_WDMA;
@@ -1711,11 +1766,11 @@ mt7996_net_fill_forward_path(struct ieee80211_hw *hw,
 	path->mtk_wdma.wdma_idx = wed->wdma_idx;
 	path->mtk_wdma.bss = mconf->mt76.idx;
 	path->mtk_wdma.queue = 0;
-	path->mtk_wdma.wcid = msta->wcid.idx;
+	path->mtk_wdma.wcid = mlink->wcid.idx;
 
 	if (ieee80211_hw_check(hw, SUPPORTS_AMSDU_IN_AMPDU) &&
 	    mtk_wed_is_amsdu_supported(wed))
-		path->mtk_wdma.amsdu = msta->wcid.amsdu;
+		path->mtk_wdma.amsdu = mlink->wcid.amsdu;
 	else
 		path->mtk_wdma.amsdu = 0;
 
diff --git a/mt7996/mcu.c b/mt7996/mcu.c
index ebd3192..cab4a0a 100644
--- a/mt7996/mcu.c
+++ b/mt7996/mcu.c
@@ -117,13 +117,13 @@ mt7996_mcu_get_sta_nss(u16 mcs_map)
 }
 
 static void
-mt7996_mcu_set_sta_he_mcs(struct ieee80211_sta *sta,
+mt7996_mcu_set_sta_he_mcs(struct ieee80211_link_sta *link_sta,
 			  struct mt7996_bss_conf *mconf,
 			  __le16 *he_mcs, u16 mcs_map)
 {
 	enum nl80211_band band = mconf->phy->mt76->chandef.chan->band;
 	const u16 *mask = mconf->bitrate_mask.control[band].he_mcs;
-	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
+	int nss, max_nss = link_sta->rx_nss > 3 ? 4 : link_sta->rx_nss;
 
 	for (nss = 0; nss < max_nss; nss++) {
 		int mcs;
@@ -166,11 +166,11 @@ mt7996_mcu_set_sta_he_mcs(struct ieee80211_sta *sta,
 }
 
 static void
-mt7996_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
-			   const u16 *mask)
+mt7996_mcu_set_sta_vht_mcs(struct ieee80211_link_sta *link_sta,
+			   __le16 *vht_mcs, const u16 *mask)
 {
-	u16 mcs, mcs_map = le16_to_cpu(sta->deflink.vht_cap.vht_mcs.rx_mcs_map);
-	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
+	u16 mcs, mcs_map = le16_to_cpu(link_sta->vht_cap.vht_mcs.rx_mcs_map);
+	int nss, max_nss = link_sta->rx_nss > 3 ? 4 : link_sta->rx_nss;
 
 	for (nss = 0; nss < max_nss; nss++, mcs_map >>= 2) {
 		switch (mcs_map & 0x3) {
@@ -192,13 +192,13 @@ mt7996_mcu_set_sta_vht_mcs(struct ieee80211_sta *sta, __le16 *vht_mcs,
 }
 
 static void
-mt7996_mcu_set_sta_ht_mcs(struct ieee80211_sta *sta, u8 *ht_mcs,
+mt7996_mcu_set_sta_ht_mcs(struct ieee80211_link_sta *link_sta, u8 *ht_mcs,
 			  const u8 *mask)
 {
-	int nss, max_nss = sta->deflink.rx_nss > 3 ? 4 : sta->deflink.rx_nss;
+	int nss, max_nss = link_sta->rx_nss > 3 ? 4 : link_sta->rx_nss;
 
 	for (nss = 0; nss < max_nss; nss++)
-		ht_mcs[nss] = sta->deflink.ht_cap.mcs.rx_mask[nss] & mask[nss];
+		ht_mcs[nss] = link_sta->ht_cap.mcs.rx_mask[nss] & mask[nss];
 }
 
 static int
@@ -531,14 +531,14 @@ static inline void __mt7996_stat_to_netdev(struct mt76_phy *mphy,
 					   u32 tx_bytes, u32 rx_bytes,
 					   u32 tx_packets, u32 rx_packets)
 {
-	struct mt7996_sta *msta;
+	struct mt7996_link_sta *mlink;
 	struct ieee80211_vif *vif;
 	struct wireless_dev *wdev;
 
 	if (wiphy_ext_feature_isset(mphy->hw->wiphy,
 				    NL80211_EXT_FEATURE_STAS_COUNT)) {
-		msta = container_of(wcid, struct mt7996_sta, wcid);
-		vif = container_of((void *)msta->vif, struct ieee80211_vif,
+		mlink = container_of(wcid, struct mt7996_link_sta, wcid);
+		vif = container_of((void *)mlink->sta->vif, struct ieee80211_vif,
 				   drv_priv);
 		wdev = ieee80211_vif_to_wdev(vif);
 
@@ -1236,10 +1236,10 @@ __mt7996_mcu_alloc_bss_req(struct mt76_dev *dev, struct mt76_vif *mvif, int len)
 
 int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
 			    struct ieee80211_bss_conf *conf,
-			    struct mt7996_bss_conf *mconf, int enable)
+			    struct mt7996_bss_conf *mconf,
+			    struct mt7996_link_sta *mlink, int enable)
 {
 	struct ieee80211_vif *vif = conf->vif;
-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
 	struct mt7996_dev *dev = phy->dev;
 	struct sk_buff *skb;
 
@@ -1255,7 +1255,7 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
 
 	/* bss_basic must be first */
 	mt7996_mcu_bss_basic_tlv(skb, conf, mconf, NULL, phy->mt76,
-				 mvif->sta.wcid.idx, enable);
+				 mlink->wcid.idx, enable);
 	mt7996_mcu_bss_sec_tlv(skb, mconf);
 
 	if (vif->type == NL80211_IFTYPE_MONITOR)
@@ -1335,9 +1335,10 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
 {
 	struct mt7996_sta *msta = (struct mt7996_sta *)params->sta->drv_priv;
 	struct mt7996_bss_conf *mconf = mconf_dereference_protected(msta->vif, 0);
+	struct mt7996_link_sta *mlink = mlink_dereference_protected(msta, 0);
 
 	if (enable && !params->amsdu)
-		msta->wcid.amsdu = false;
+		mlink->wcid.amsdu = false;
 
 	return mt7996_mcu_sta_ba(dev, &mconf->mt76, params, enable, true);
 }
@@ -1355,15 +1356,15 @@ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
 static void
 mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
 		      struct mt7996_bss_conf *mconf,
-		      struct ieee80211_sta *sta)
+		      struct ieee80211_link_sta *link_sta)
 {
-	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
+	struct ieee80211_he_cap_elem *elem = &link_sta->he_cap.he_cap_elem;
 	struct ieee80211_he_mcs_nss_supp mcs_map;
 	struct sta_rec_he_v2 *he;
 	struct tlv *tlv;
 	int i = 0;
 
-	if (!sta->deflink.he_cap.has_he)
+	if (!link_sta->he_cap.has_he)
 		return;
 
 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_V2, sizeof(*he));
@@ -1380,21 +1381,21 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
 		u8p_replace_bits(&he->he_phy_cap[1], conf->he_ldpc,
 				 IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD);
 
-	mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
-	switch (sta->deflink.bandwidth) {
+	mcs_map = link_sta->he_cap.he_mcs_nss_supp;
+	switch (link_sta->bandwidth) {
 	case IEEE80211_STA_RX_BW_160:
 		if (elem->phy_cap_info[0] &
 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
-			mt7996_mcu_set_sta_he_mcs(sta, mconf,
+			mt7996_mcu_set_sta_he_mcs(link_sta, mconf,
 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
 						  le16_to_cpu(mcs_map.rx_mcs_80p80));
 
-		mt7996_mcu_set_sta_he_mcs(sta, mconf,
+		mt7996_mcu_set_sta_he_mcs(link_sta, mconf,
 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
 					  le16_to_cpu(mcs_map.rx_mcs_160));
 		fallthrough;
 	default:
-		mt7996_mcu_set_sta_he_mcs(sta, mconf,
+		mt7996_mcu_set_sta_he_mcs(link_sta, mconf,
 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
 					  le16_to_cpu(mcs_map.rx_mcs_80));
 		break;
@@ -1404,24 +1405,25 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_bss_conf *conf,
 }
 
 static void
-mt7996_mcu_sta_he_6g_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+mt7996_mcu_sta_he_6g_tlv(struct sk_buff *skb,
+			 struct ieee80211_link_sta *link_sta)
 {
 	struct sta_rec_he_6g_capa *he_6g;
 	struct tlv *tlv;
 
-	if (!sta->deflink.he_6ghz_capa.capa)
+	if (!link_sta->he_6ghz_capa.capa)
 		return;
 
 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HE_6G, sizeof(*he_6g));
 
 	he_6g = (struct sta_rec_he_6g_capa *)tlv;
-	he_6g->capa = sta->deflink.he_6ghz_capa.capa;
+	he_6g->capa = link_sta->he_6ghz_capa.capa;
 }
 
 static void
-mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
 {
-	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+	struct mt7996_sta *msta = (struct mt7996_sta *)link_sta->sta->drv_priv;
 	struct ieee80211_vif *vif = container_of((void *)msta->vif,
 						 struct ieee80211_vif, drv_priv);
 	struct ieee80211_eht_mcs_nss_supp *mcs_map;
@@ -1429,11 +1431,11 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
 	struct sta_rec_eht *eht;
 	struct tlv *tlv;
 
-	if (!sta->deflink.eht_cap.has_eht)
+	if (!link_sta->eht_cap.has_eht)
 		return;
 
-	mcs_map = &sta->deflink.eht_cap.eht_mcs_nss_supp;
-	elem = &sta->deflink.eht_cap.eht_cap_elem;
+	mcs_map = &link_sta->eht_cap.eht_mcs_nss_supp;
+	elem = &link_sta->eht_cap.eht_cap_elem;
 
 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EHT, sizeof(*eht));
 
@@ -1444,7 +1446,7 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
 	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
 
 	if (vif->type != NL80211_IFTYPE_STATION &&
-	    (sta->deflink.he_cap.he_cap_elem.phy_cap_info[0] &
+	    (link_sta->he_cap.he_cap_elem.phy_cap_info[0] &
 	     (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G |
 	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
 	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
@@ -1460,44 +1462,44 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
 }
 
 static void
-mt7996_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+mt7996_mcu_sta_ht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
 {
 	struct sta_rec_ht_uni *ht;
 	struct tlv *tlv;
 
-	if (!sta->deflink.ht_cap.ht_supported)
+	if (!link_sta->ht_cap.ht_supported)
 		return;
 
 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HT, sizeof(*ht));
 
 	ht = (struct sta_rec_ht_uni *)tlv;
-	ht->ht_cap = cpu_to_le16(sta->deflink.ht_cap.cap);
-	ht->ampdu_param = u8_encode_bits(sta->deflink.ht_cap.ampdu_factor,
+	ht->ht_cap = cpu_to_le16(link_sta->ht_cap.cap);
+	ht->ampdu_param = u8_encode_bits(link_sta->ht_cap.ampdu_factor,
 					 IEEE80211_HT_AMPDU_PARM_FACTOR) |
-			  u8_encode_bits(sta->deflink.ht_cap.ampdu_density,
+			  u8_encode_bits(link_sta->ht_cap.ampdu_density,
 					 IEEE80211_HT_AMPDU_PARM_DENSITY);
 }
 
 static void
-mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_link_sta *link_sta)
 {
 	struct sta_rec_vht *vht;
 	struct tlv *tlv;
 #ifdef CONFIG_MTK_VENDOR
-	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+	struct mt7996_sta *msta = (struct mt7996_sta *)link_sta->sta->drv_priv;
 	struct mt7996_phy *phy = (struct mt7996_phy *)msta->vif->deflink.phy;
 #endif
 
 	/* For 6G band, this tlv is necessary to let hw work normally */
-	if (!sta->deflink.he_6ghz_capa.capa && !sta->deflink.vht_cap.vht_supported)
+	if (!link_sta->he_6ghz_capa.capa && !link_sta->vht_cap.vht_supported)
 		return;
 
 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_VHT, sizeof(*vht));
 
 	vht = (struct sta_rec_vht *)tlv;
-	vht->vht_cap = cpu_to_le32(sta->deflink.vht_cap.cap);
-	vht->vht_rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
-	vht->vht_tx_mcs_map = sta->deflink.vht_cap.vht_mcs.tx_mcs_map;
+	vht->vht_cap = cpu_to_le32(link_sta->vht_cap.cap);
+	vht->vht_rx_mcs_map = link_sta->vht_cap.vht_mcs.rx_mcs_map;
+	vht->vht_tx_mcs_map = link_sta->vht_cap.vht_mcs.tx_mcs_map;
 #ifdef CONFIG_MTK_VENDOR
 	vht->rts_bw_sig = phy->rts_bw_sig;
 #endif
@@ -1505,9 +1507,10 @@ mt7996_mcu_sta_vht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
 
 static void
 mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
-			 struct ieee80211_vif *vif, struct ieee80211_sta *sta)
+			 struct ieee80211_vif *vif,
+			 struct ieee80211_link_sta *link_sta,
+			 struct mt7996_link_sta *mlink)
 {
-	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
 	struct sta_rec_amsdu *amsdu;
 	struct tlv *tlv;
 
@@ -1516,16 +1519,16 @@ mt7996_mcu_sta_amsdu_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
 	    vif->type != NL80211_IFTYPE_AP)
 		return;
 
-	if (!sta->deflink.agg.max_amsdu_len)
+	if (!link_sta->agg.max_amsdu_len)
 		return;
 
 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HW_AMSDU, sizeof(*amsdu));
 	amsdu = (struct sta_rec_amsdu *)tlv;
 	amsdu->max_amsdu_num = 8;
 	amsdu->amsdu_en = true;
-	msta->wcid.amsdu = true;
+	mlink->wcid.amsdu = true;
 
-	switch (sta->deflink.agg.max_amsdu_len) {
+	switch (link_sta->agg.max_amsdu_len) {
 	case IEEE80211_MAX_MPDU_LEN_VHT_11454:
 		amsdu->max_mpdu_size =
 			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
@@ -1544,10 +1547,10 @@ static void
 mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
 			struct ieee80211_bss_conf *conf,
 			struct mt7996_bss_conf *mconf,
-			struct ieee80211_sta *sta)
+			struct ieee80211_link_sta *link_sta)
 {
 	struct mt7996_phy *phy = mconf->phy;
-	struct ieee80211_he_cap_elem *elem = &sta->deflink.he_cap.he_cap_elem;
+	struct ieee80211_he_cap_elem *elem = &link_sta->he_cap.he_cap_elem;
 	struct sta_rec_muru *muru;
 	struct tlv *tlv;
 
@@ -1567,11 +1570,11 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
 	muru->cfg.ofdma_dl_en = !!(phy->muru_onoff & OFDMA_DL);
 	muru->cfg.ofdma_ul_en = !!(phy->muru_onoff & OFDMA_UL);
 
-	if (sta->deflink.vht_cap.vht_supported)
+	if (link_sta->vht_cap.vht_supported)
 		muru->mimo_dl.vht_mu_bfee =
-			!!(sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
+			!!(link_sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
 
-	if (!sta->deflink.he_cap.has_he)
+	if (!link_sta->he_cap.has_he)
 		return;
 
 	muru->mimo_dl.partial_bw_dl_mimo =
@@ -1604,7 +1607,7 @@ mt7996_mcu_sta_muru_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
 static inline bool
 mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
 			struct mt7996_bss_conf *mconf,
-			struct ieee80211_sta *sta, bool bfee)
+			struct ieee80211_link_sta *link_sta, bool bfee)
 {
 	int sts = hweight16(phy->mt76->chainmask);
 
@@ -1615,8 +1618,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
 	if (!bfee && sts < 2)
 		return false;
 
-	if (sta->deflink.eht_cap.has_eht) {
-		struct ieee80211_sta_eht_cap *pc = &sta->deflink.eht_cap;
+	if (link_sta->eht_cap.has_eht) {
+		struct ieee80211_sta_eht_cap *pc = &link_sta->eht_cap;
 		struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
 
 		if (bfee)
@@ -1627,8 +1630,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
 			       EHT_PHY(CAP0_SU_BEAMFORMER, pe->phy_cap_info[0]);
 	}
 
-	if (sta->deflink.he_cap.has_he) {
-		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
+	if (link_sta->he_cap.has_he) {
+		struct ieee80211_he_cap_elem *pe = &link_sta->he_cap.he_cap_elem;
 
 		if (bfee)
 			return conf->he_su_beamformee &&
@@ -1638,8 +1641,8 @@ mt7996_is_ebf_supported(struct mt7996_phy *phy, struct ieee80211_bss_conf *conf,
 			       HE_PHY(CAP4_SU_BEAMFORMEE, pe->phy_cap_info[4]);
 	}
 
-	if (sta->deflink.vht_cap.vht_supported) {
-		u32 cap = sta->deflink.vht_cap.cap;
+	if (link_sta->vht_cap.vht_supported) {
+		u32 cap = link_sta->vht_cap.cap;
 
 		if (bfee)
 			return conf->vht_su_beamformee &&
@@ -1662,10 +1665,10 @@ mt7996_mcu_sta_sounding_rate(struct sta_rec_bf *bf)
 }
 
 static void
-mt7996_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
-		       struct sta_rec_bf *bf)
+mt7996_mcu_sta_bfer_ht(struct ieee80211_link_sta *link_sta,
+		       struct mt7996_phy *phy, struct sta_rec_bf *bf)
 {
-	struct ieee80211_mcs_info *mcs = &sta->deflink.ht_cap.mcs;
+	struct ieee80211_mcs_info *mcs = &link_sta->ht_cap.mcs;
 	u8 n = 0;
 
 	bf->tx_mode = MT_PHY_TYPE_HT;
@@ -1687,10 +1690,11 @@ mt7996_mcu_sta_bfer_ht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
 }
 
 static void
-mt7996_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
-			struct sta_rec_bf *bf, bool explicit)
+mt7996_mcu_sta_bfer_vht(struct ieee80211_link_sta *link_sta,
+			struct mt7996_phy *phy, struct sta_rec_bf *bf,
+			bool explicit)
 {
-	struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
+	struct ieee80211_sta_vht_cap *pc = &link_sta->vht_cap;
 	struct ieee80211_sta_vht_cap *vc = &phy->mt76->sband_5g.sband.vht_cap;
 	u16 mcs_map = le16_to_cpu(pc->vht_mcs.rx_mcs_map);
 	u8 nss_mcs = mt7996_mcu_get_sta_nss(mcs_map);
@@ -1711,23 +1715,24 @@ mt7996_mcu_sta_bfer_vht(struct ieee80211_sta *sta, struct mt7996_phy *phy,
 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
 		bf->ibf_ncol = bf->ncol;
 
-		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
+		if (link_sta->bandwidth == IEEE80211_STA_RX_BW_160)
 			bf->nrow = 1;
 	} else {
 		bf->nrow = tx_ant;
 		bf->ncol = min_t(u8, nss_mcs, bf->nrow);
 		bf->ibf_ncol = nss_mcs;
 
-		if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_160)
+		if (link_sta->bandwidth == IEEE80211_STA_RX_BW_160)
 			bf->ibf_nrow = 1;
 	}
 }
 
 static void
-mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
-		       struct mt7996_phy *phy, struct sta_rec_bf *bf)
+mt7996_mcu_sta_bfer_he(struct ieee80211_link_sta *link_sta,
+		       struct ieee80211_vif *vif, struct mt7996_phy *phy,
+		       struct sta_rec_bf *bf)
 {
-	struct ieee80211_sta_he_cap *pc = &sta->deflink.he_cap;
+	struct ieee80211_sta_he_cap *pc = &link_sta->he_cap;
 	struct ieee80211_he_cap_elem *pe = &pc->he_cap_elem;
 	const struct ieee80211_sta_he_cap *vc =
 		mt76_connac_get_he_phy_cap(phy->mt76, vif);
@@ -1752,7 +1757,7 @@ mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
 	bf->ibf_ncol = bf->ncol;
 
-	if (sta->deflink.bandwidth != IEEE80211_STA_RX_BW_160)
+	if (link_sta->bandwidth != IEEE80211_STA_RX_BW_160)
 		return;
 
 	/* go over for 160MHz and 80p80 */
@@ -1784,10 +1789,11 @@ mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
 }
 
 static void
-mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
-			struct mt7996_phy *phy, struct sta_rec_bf *bf)
+mt7996_mcu_sta_bfer_eht(struct ieee80211_link_sta *link_sta,
+			struct ieee80211_vif *vif, struct mt7996_phy *phy,
+			struct sta_rec_bf *bf)
 {
-	struct ieee80211_sta_eht_cap *pc = &sta->deflink.eht_cap;
+	struct ieee80211_sta_eht_cap *pc = &link_sta->eht_cap;
 	struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
 	struct ieee80211_eht_mcs_nss_supp *eht_nss = &pc->eht_mcs_nss_supp;
 	const struct ieee80211_sta_eht_cap *vc =
@@ -1810,10 +1816,10 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
 	bf->ncol = min_t(u8, nss_mcs, bf->nrow);
 	bf->ibf_ncol = bf->ncol;
 
-	if (sta->deflink.bandwidth < IEEE80211_STA_RX_BW_160)
+	if (link_sta->bandwidth < IEEE80211_STA_RX_BW_160)
 		return;
 
-	switch (sta->deflink.bandwidth) {
+	switch (link_sta->bandwidth) {
 	case IEEE80211_STA_RX_BW_160:
 		snd_dim = EHT_PHY(CAP2_SOUNDING_DIM_160MHZ_MASK, ve->phy_cap_info[2]);
 		sts = EHT_PHY(CAP1_BEAMFORMEE_SS_160MHZ_MASK, pe->phy_cap_info[1]);
@@ -1842,7 +1848,7 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
 static void
 mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
 			struct ieee80211_bss_conf *conf, struct mt7996_bss_conf *mconf,
-			struct ieee80211_sta *sta)
+			struct ieee80211_link_sta *link_sta)
 {
 	struct mt7996_phy *phy = mconf->phy;
 	int tx_ant = hweight16(phy->mt76->chainmask) - 1;
@@ -1856,10 +1862,10 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
 	};
 	bool ebf;
 
-	if (!(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
+	if (!(link_sta->ht_cap.ht_supported || link_sta->he_cap.has_he))
 		return;
 
-	ebf = mt7996_is_ebf_supported(phy, conf, mconf, sta, false);
+	ebf = mt7996_is_ebf_supported(phy, conf, mconf, link_sta, false);
 	if (!ebf && !dev->ibf)
 		return;
 
@@ -1870,23 +1876,23 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
 	 * vht: support eBF and iBF
 	 * ht: iBF only, since mac80211 lacks of eBF support
 	 */
-	if (sta->deflink.eht_cap.has_eht && ebf)
-		mt7996_mcu_sta_bfer_eht(sta, conf->vif, phy, bf);
-	else if (sta->deflink.he_cap.has_he && ebf)
-		mt7996_mcu_sta_bfer_he(sta, conf->vif, phy, bf);
-	else if (sta->deflink.vht_cap.vht_supported)
-		mt7996_mcu_sta_bfer_vht(sta, phy, bf, ebf);
-	else if (sta->deflink.ht_cap.ht_supported)
-		mt7996_mcu_sta_bfer_ht(sta, phy, bf);
+	if (link_sta->eht_cap.has_eht && ebf)
+		mt7996_mcu_sta_bfer_eht(link_sta, conf->vif, phy, bf);
+	else if (link_sta->he_cap.has_he && ebf)
+		mt7996_mcu_sta_bfer_he(link_sta, conf->vif, phy, bf);
+	else if (link_sta->vht_cap.vht_supported)
+		mt7996_mcu_sta_bfer_vht(link_sta, phy, bf, ebf);
+	else if (link_sta->ht_cap.ht_supported)
+		mt7996_mcu_sta_bfer_ht(link_sta, phy, bf);
 	else
 		return;
 
 	bf->bf_cap = ebf ? ebf : dev->ibf << 1;
-	bf->bw = sta->deflink.bandwidth;
-	bf->ibf_dbw = sta->deflink.bandwidth;
+	bf->bw = link_sta->bandwidth;
+	bf->ibf_dbw = link_sta->bandwidth;
 	bf->ibf_nrow = tx_ant;
 
-	if (!ebf && sta->deflink.bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
+	if (!ebf && link_sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
 		bf->ibf_timeout = 0x48;
 	else
 		bf->ibf_timeout = 0x18;
@@ -1896,7 +1902,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
 	else
 		bf->mem_20m = matrix[bf->nrow][bf->ncol];
 
-	switch (sta->deflink.bandwidth) {
+	switch (link_sta->bandwidth) {
 	case IEEE80211_STA_RX_BW_160:
 	case IEEE80211_STA_RX_BW_80:
 		bf->mem_total = bf->mem_20m * 2;
@@ -1913,7 +1919,8 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
 static void
 mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
 			struct ieee80211_bss_conf *conf,
-			struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta)
+			struct mt7996_bss_conf *mconf,
+			struct ieee80211_link_sta *link_sta)
 {
 	struct mt7996_phy *phy = mconf->phy;
 	int tx_ant = hweight8(phy->mt76->antenna_mask) - 1;
@@ -1921,22 +1928,22 @@ mt7996_mcu_sta_bfee_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
 	struct tlv *tlv;
 	u8 nrow = 0;
 
-	if (!(sta->deflink.vht_cap.vht_supported || sta->deflink.he_cap.has_he))
+	if (!(link_sta->vht_cap.vht_supported || link_sta->he_cap.has_he))
 		return;
 
-	if (!mt7996_is_ebf_supported(phy, conf, mconf, sta, true))
+	if (!mt7996_is_ebf_supported(phy, conf, mconf, link_sta, true))
 		return;
 
 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_BFEE, sizeof(*bfee));
 	bfee = (struct sta_rec_bfee *)tlv;
 
-	if (sta->deflink.he_cap.has_he) {
-		struct ieee80211_he_cap_elem *pe = &sta->deflink.he_cap.he_cap_elem;
+	if (link_sta->he_cap.has_he) {
+		struct ieee80211_he_cap_elem *pe = &link_sta->he_cap.he_cap_elem;
 
 		nrow = HE_PHY(CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
 			      pe->phy_cap_info[5]);
-	} else if (sta->deflink.vht_cap.vht_supported) {
-		struct ieee80211_sta_vht_cap *pc = &sta->deflink.vht_cap;
+	} else if (link_sta->vht_cap.vht_supported) {
+		struct ieee80211_sta_vht_cap *pc = &link_sta->vht_cap;
 
 		nrow = FIELD_GET(IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK,
 				 pc->cap);
@@ -1973,25 +1980,24 @@ mt7996_mcu_sta_hdrt_tlv(struct mt7996_dev *dev, struct sk_buff *skb)
 static void
 mt7996_mcu_sta_hdr_trans_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
 			     struct ieee80211_vif *vif,
-			     struct ieee80211_sta *sta)
+			     struct mt7996_link_sta *mlink)
 {
 	struct sta_rec_hdr_trans *hdr_trans;
-	struct mt76_wcid *wcid;
+	struct mt76_wcid *wcid = &mlink->wcid;
 	struct tlv *tlv;
 
 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_HDR_TRANS, sizeof(*hdr_trans));
 	hdr_trans = (struct sta_rec_hdr_trans *)tlv;
 	hdr_trans->dis_rx_hdr_tran = true;
 
+	if (!wcid->sta)
+		return;
+
 	if (vif->type == NL80211_IFTYPE_STATION)
 		hdr_trans->to_ds = true;
 	else
 		hdr_trans->from_ds = true;
 
-	if (!sta)
-		return;
-
-	wcid = (struct mt76_wcid *)sta->drv_priv;
 	hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags);
 	if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) {
 		hdr_trans->to_ds = true;
@@ -2048,16 +2054,17 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
 
 int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
 			       struct mt7996_bss_conf *mconf,
-			       struct ieee80211_sta *sta, void *data, u32 field)
+			       struct ieee80211_link_sta *link_sta,
+			       struct mt7996_link_sta *mlink, void *data,
+			       u32 field)
 {
-	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
 	struct sta_phy_uni *phy = data;
 	struct sta_rec_ra_fixed_uni *ra;
 	struct sk_buff *skb;
 	struct tlv *tlv;
 
 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
-					      &msta->wcid,
+					      &mlink->wcid,
 					      MT7996_STA_UPDATE_MAX_SIZE);
 	if (IS_ERR(skb))
 		return PTR_ERR(skb);
@@ -2076,7 +2083,7 @@ int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
 			ra->phy = *phy;
 		break;
 	case RATE_PARAM_MMPS_UPDATE:
-		ra->mmps_mode = mt7996_mcu_get_mmps_mode(sta->deflink.smps_mode);
+		ra->mmps_mode = mt7996_mcu_get_mmps_mode(link_sta->smps_mode);
 		break;
 	default:
 		break;
@@ -2091,7 +2098,8 @@ static int
 mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
 			       struct ieee80211_bss_conf *conf,
 			       struct mt7996_bss_conf *mconf,
-			       struct ieee80211_sta *sta)
+			       struct ieee80211_link_sta *link_sta,
+			       struct mt7996_link_sta *mlink)
 {
 	struct cfg80211_chan_def *chandef = &mconf->phy->mt76->chandef;
 	struct cfg80211_bitrate_mask *mask = &mconf->bitrate_mask;
@@ -2115,11 +2123,11 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
 		}								\
 	} while (0)
 
-	if (sta->deflink.he_cap.has_he) {
+	if (link_sta->he_cap.has_he) {
 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
-	} else if (sta->deflink.vht_cap.vht_supported) {
+	} else if (link_sta->vht_cap.vht_supported) {
 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
-	} else if (sta->deflink.ht_cap.ht_supported) {
+	} else if (link_sta->ht_cap.ht_supported) {
 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
 	} else {
 		nrates = hweight32(mask->control[band].legacy);
@@ -2136,8 +2144,8 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
 
 	/* fixed single rate */
 	if (nrates == 1) {
-		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
-						 RATE_PARAM_FIXED_MCS);
+		ret = mt7996_mcu_set_fixed_field(dev, mconf, link_sta, mlink,
+						 &phy, RATE_PARAM_FIXED_MCS);
 		if (ret)
 			return ret;
 	}
@@ -2145,29 +2153,28 @@ mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
 	/* fixed GI */
 	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
 	    mask->control[band].he_gi != GENMASK(7, 0)) {
-		struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
 		u32 addr;
 
 		/* firmware updates only TXCMD but doesn't take WTBL into
 		 * account, so driver should update here to reflect the
 		 * actual txrate hardware sends out.
 		 */
-		addr = mt7996_mac_wtbl_lmac_addr(dev, msta->wcid.idx, 7);
-		if (sta->deflink.he_cap.has_he)
+		addr = mt7996_mac_wtbl_lmac_addr(dev, mlink->wcid.idx, 7);
+		if (link_sta->he_cap.has_he)
 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
 		else
 			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
 
-		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
-						 RATE_PARAM_FIXED_GI);
+		ret = mt7996_mcu_set_fixed_field(dev, mconf, link_sta, mlink,
+						 &phy, RATE_PARAM_FIXED_GI);
 		if (ret)
 			return ret;
 	}
 
 	/* fixed HE_LTF */
 	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
-		ret = mt7996_mcu_set_fixed_field(dev, mconf, sta, &phy,
-						 RATE_PARAM_FIXED_HE_LTF);
+		ret = mt7996_mcu_set_fixed_field(dev, mconf, link_sta, mlink,
+						 &phy, RATE_PARAM_FIXED_HE_LTF);
 		if (ret)
 			return ret;
 	}
@@ -2179,7 +2186,7 @@ static void
 mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
 			     struct ieee80211_bss_conf *conf,
 			     struct mt7996_bss_conf *mconf,
-			     struct ieee80211_sta *sta)
+			     struct ieee80211_link_sta *link_sta)
 {
 #define INIT_RCPI 180
 	struct mt76_phy *mphy = mconf->phy->mt76;
@@ -2188,20 +2195,20 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
 	enum nl80211_band band = chandef->chan->band;
 	struct sta_rec_ra_uni *ra;
 	struct tlv *tlv;
-	u32 supp_rate = sta->deflink.supp_rates[band];
-	u32 cap = sta->wme ? STA_CAP_WMM : 0;
+	u32 supp_rate = link_sta->supp_rates[band];
+	u32 cap = link_sta->sta->wme ? STA_CAP_WMM : 0;
 
 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra));
 	ra = (struct sta_rec_ra_uni *)tlv;
 
 	ra->valid = true;
 	ra->auto_rate = true;
-	ra->phy_mode = mt76_connac_get_phy_mode(mphy, conf->vif, band, sta);
+	ra->phy_mode = mt76_connac_get_phy_mode(mphy, conf->vif, band, link_sta);
 	ra->channel = chandef->chan->hw_value;
-	ra->bw = (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_320) ?
-		 CMD_CBW_320MHZ : sta->deflink.bandwidth;
+	ra->bw = (link_sta->bandwidth == IEEE80211_STA_RX_BW_320) ?
+		 CMD_CBW_320MHZ : link_sta->bandwidth;
 	ra->phy.bw = ra->bw;
-	ra->mmps_mode = mt7996_mcu_get_mmps_mode(sta->deflink.smps_mode);
+	ra->mmps_mode = mt7996_mcu_get_mmps_mode(link_sta->smps_mode);
 
 	if (supp_rate) {
 		supp_rate &= mask->control[band].legacy;
@@ -2221,60 +2228,60 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
 		}
 	}
 
-	if (sta->deflink.ht_cap.ht_supported) {
+	if (link_sta->ht_cap.ht_supported) {
 		ra->supp_mode |= MODE_HT;
-		ra->af = sta->deflink.ht_cap.ampdu_factor;
-		ra->ht_gf = !!(sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
+		ra->af = link_sta->ht_cap.ampdu_factor;
+		ra->ht_gf = !!(link_sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD);
 
 		cap |= STA_CAP_HT;
-		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
+		if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20)
 			cap |= STA_CAP_SGI_20;
-		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
+		if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
 			cap |= STA_CAP_SGI_40;
-		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
+		if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC)
 			cap |= STA_CAP_TX_STBC;
-		if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
+		if (link_sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
 			cap |= STA_CAP_RX_STBC;
 		if (conf->ht_ldpc &&
-		    (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
+		    (link_sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
 			cap |= STA_CAP_LDPC;
 
-		mt7996_mcu_set_sta_ht_mcs(sta, ra->ht_mcs,
+		mt7996_mcu_set_sta_ht_mcs(link_sta, ra->ht_mcs,
 					  mask->control[band].ht_mcs);
 		ra->supp_ht_mcs = *(__le32 *)ra->ht_mcs;
 	}
 
-	if (sta->deflink.vht_cap.vht_supported) {
+	if (link_sta->vht_cap.vht_supported) {
 		u8 af;
 
 		ra->supp_mode |= MODE_VHT;
 		af = FIELD_GET(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
-			       sta->deflink.vht_cap.cap);
+			       link_sta->vht_cap.cap);
 		ra->af = max_t(u8, ra->af, af);
 
 		cap |= STA_CAP_VHT;
-		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
+		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
 			cap |= STA_CAP_VHT_SGI_80;
-		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
+		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_160)
 			cap |= STA_CAP_VHT_SGI_160;
-		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
+		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
 			cap |= STA_CAP_VHT_TX_STBC;
-		if (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
+		if (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_RXSTBC_1)
 			cap |= STA_CAP_VHT_RX_STBC;
 		if (conf->vht_ldpc &&
-		    (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
+		    (link_sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC))
 			cap |= STA_CAP_VHT_LDPC;
 
-		mt7996_mcu_set_sta_vht_mcs(sta, ra->supp_vht_mcs,
+		mt7996_mcu_set_sta_vht_mcs(link_sta, ra->supp_vht_mcs,
 					   mask->control[band].vht_mcs);
 	}
 
-	if (sta->deflink.he_cap.has_he) {
+	if (link_sta->he_cap.has_he) {
 		ra->supp_mode |= MODE_HE;
 		cap |= STA_CAP_HE;
 
-		if (sta->deflink.he_6ghz_capa.capa)
-			ra->af = le16_get_bits(sta->deflink.he_6ghz_capa.capa,
+		if (link_sta->he_6ghz_capa.capa)
+			ra->af = le16_get_bits(link_sta->he_6ghz_capa.capa,
 					       IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP);
 	}
 	ra->sta_cap = cpu_to_le32(cap);
@@ -2285,14 +2292,14 @@ mt7996_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb, struct mt7996_dev *dev,
 int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
 			     struct ieee80211_bss_conf *conf,
 			     struct mt7996_bss_conf *mconf,
-			     struct ieee80211_sta *sta, bool changed)
+			     struct ieee80211_link_sta *link_sta,
+			     struct mt7996_link_sta *mlink, bool changed)
 {
-	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
 	struct sk_buff *skb;
 	int ret;
 
 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
-					      &msta->wcid,
+					      &mlink->wcid,
 					      MT7996_STA_UPDATE_MAX_SIZE);
 	if (IS_ERR(skb))
 		return PTR_ERR(skb);
@@ -2302,26 +2309,27 @@ int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
 	 * update sta_rec_he here.
 	 */
 	if (changed)
-		mt7996_mcu_sta_he_tlv(skb, conf, mconf, sta);
+		mt7996_mcu_sta_he_tlv(skb, conf, mconf, link_sta);
 
 	/* sta_rec_ra accommodates BW, NSS and only MCS range format
 	 * i.e 0-{7,8,9} for VHT.
 	 */
-	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, conf, mconf, sta);
+	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, conf, mconf, link_sta);
 
 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
 				    MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
 	if (ret)
 		return ret;
 
-	return mt7996_mcu_add_rate_ctrl_fixed(dev, conf, mconf, sta);
+	return mt7996_mcu_add_rate_ctrl_fixed(dev, conf, mconf, link_sta, mlink);
 }
 
 static int
-mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf, struct mt7996_sta *msta)
+mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf,
+			struct mt7996_link_sta *mlink)
 {
 	struct mt7996_phy *phy = mconf->phy;
-	struct mt7996_vow_sta_ctrl *vow = &msta->vow;
+	struct mt7996_vow_sta_ctrl *vow = &mlink->vow;
 	u8 omac_idx = mconf->mt76.omac_idx;
 	int ret;
 
@@ -2339,73 +2347,70 @@ mt7996_mcu_sta_init_vow(struct mt7996_bss_conf *mconf, struct mt7996_sta *msta)
 	vow->drr_quantum[IEEE80211_AC_BE] = VOW_DRR_QUANTUM_IDX2;
 	vow->drr_quantum[IEEE80211_AC_BK] = VOW_DRR_QUANTUM_IDX2;
 
-	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_BSS_GROUP);
+	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, mlink, VOW_DRR_CTRL_STA_BSS_GROUP);
 	if (ret)
 		return ret;
 
-	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_PAUSE);
+	ret = mt7996_mcu_set_vow_drr_ctrl(phy, mconf, mlink, VOW_DRR_CTRL_STA_PAUSE);
 	if (ret)
 		return ret;
 
-	return mt7996_mcu_set_vow_drr_ctrl(phy, mconf, msta, VOW_DRR_CTRL_STA_ALL);
+	return mt7996_mcu_set_vow_drr_ctrl(phy, mconf, mlink, VOW_DRR_CTRL_STA_ALL);
 }
 
 int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
-		       struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta,
-		       bool enable, bool newly)
+		       struct mt7996_bss_conf *mconf,
+		       struct ieee80211_link_sta *link_sta,
+		       struct mt7996_link_sta *mlink, bool enable, bool newly)
 {
 	struct ieee80211_vif *vif = conf->vif;
-	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
-	struct mt7996_sta *msta;
 	struct sk_buff *skb;
 	int ret;
 
-	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mvif->sta;
-
 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
-					      &msta->wcid,
+					      &mlink->wcid,
 					      MT7996_STA_UPDATE_MAX_SIZE);
 	if (IS_ERR(skb))
 		return PTR_ERR(skb);
 
 	/* starec basic */
-	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, sta, enable, newly);
+	mt76_connac_mcu_sta_basic_tlv(&dev->mt76, skb, vif, link_sta, enable, newly);
 
 	if (!enable)
 		goto out;
 
 	/* starec hdr trans */
-	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, sta);
+	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, mlink);
 	/* starec tx proc */
 	mt7996_mcu_sta_tx_proc_tlv(skb);
 
 	/* tag order is in accordance with firmware dependency. */
-	if (sta) {
+	if (link_sta) {
 		/* starec hdrt mode */
 		mt7996_mcu_sta_hdrt_tlv(dev, skb);
 		/* starec bfer */
-		mt7996_mcu_sta_bfer_tlv(dev, skb, conf, mconf, sta);
+		mt7996_mcu_sta_bfer_tlv(dev, skb, conf, mconf, link_sta);
 		/* starec ht */
-		mt7996_mcu_sta_ht_tlv(skb, sta);
+		mt7996_mcu_sta_ht_tlv(skb, link_sta);
 		/* starec vht */
-		mt7996_mcu_sta_vht_tlv(skb, sta);
+		mt7996_mcu_sta_vht_tlv(skb, link_sta);
 		/* starec uapsd */
-		mt76_connac_mcu_sta_uapsd(skb, vif, sta);
+		mt76_connac_mcu_sta_uapsd(skb, vif, link_sta->sta);
 		/* starec amsdu */
-		mt7996_mcu_sta_amsdu_tlv(dev, skb, vif, sta);
+		mt7996_mcu_sta_amsdu_tlv(dev, skb, vif, link_sta, mlink);
 		/* starec he */
-		mt7996_mcu_sta_he_tlv(skb, conf, mconf, sta);
+		mt7996_mcu_sta_he_tlv(skb, conf, mconf, link_sta);
 		/* starec he 6g*/
-		mt7996_mcu_sta_he_6g_tlv(skb, sta);
+		mt7996_mcu_sta_he_6g_tlv(skb, link_sta);
 		/* starec eht */
-		mt7996_mcu_sta_eht_tlv(skb, sta);
+		mt7996_mcu_sta_eht_tlv(skb, link_sta);
 		/* starec muru */
-		mt7996_mcu_sta_muru_tlv(dev, skb, conf, mconf, sta);
+		mt7996_mcu_sta_muru_tlv(dev, skb, conf, mconf, link_sta);
 		/* starec bfee */
-		mt7996_mcu_sta_bfee_tlv(dev, skb, conf, mconf, sta);
+		mt7996_mcu_sta_bfee_tlv(dev, skb, conf, mconf, link_sta);
 	}
 
-	ret = mt7996_mcu_sta_init_vow(mconf, msta);
+	ret = mt7996_mcu_sta_init_vow(mconf, mlink);
 	if (ret) {
 		dev_kfree_skb(skb);
 		return ret;
@@ -2481,16 +2486,16 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
 
 static int mt7996_mcu_get_pn(struct mt7996_dev *dev,
 			     struct ieee80211_bss_conf *conf,
-			     struct mt7996_bss_conf *mconf, u8 *pn)
+			     struct mt7996_bss_conf *mconf,
+			     struct mt7996_link_sta *mlink, u8 *pn)
 {
 #define TSC_TYPE_BIGTK_PN 2
-	struct mt7996_vif *mvif = (struct mt7996_vif *)conf->vif->drv_priv;
 	struct sta_rec_pn_info *pn_info;
 	struct sk_buff *skb, *rskb;
 	struct tlv *tlv;
 	int ret;
 
-	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76, &mvif->sta.wcid);
+	skb = mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76, &mlink->wcid);
 	if (IS_ERR(skb))
 		return PTR_ERR(skb);
 
@@ -2517,6 +2522,7 @@ static int mt7996_mcu_get_pn(struct mt7996_dev *dev,
 int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
 			       struct ieee80211_bss_conf *conf,
 			       struct mt7996_bss_conf *mconf,
+			       struct mt7996_link_sta *mlink,
 			       struct ieee80211_key_conf *key)
 {
 	struct mt7996_mcu_bcn_prot_tlv *bcn_prot;
@@ -2535,7 +2541,7 @@ int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
 
 	bcn_prot = (struct mt7996_mcu_bcn_prot_tlv *)tlv;
 
-	ret = mt7996_mcu_get_pn(dev, conf, mconf, pn);
+	ret = mt7996_mcu_get_pn(dev, conf, mconf, mlink, pn);
 	if (ret) {
 		dev_kfree_skb(skb);
 		return ret;
@@ -4811,21 +4817,18 @@ int mt7996_mcu_rdd_background_disable_timer(struct mt7996_dev *dev, bool disable
 int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
 				     struct ieee80211_vif *vif,
 				     struct mt7996_bss_conf *mconf,
-				     struct ieee80211_sta *sta)
+				     struct mt7996_link_sta *mlink)
 {
-	struct mt7996_sta *msta;
 	struct sk_buff *skb;
 
-	msta = sta ? (struct mt7996_sta *)sta->drv_priv : &mconf->vif->sta;
-
 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &mconf->mt76,
-					      &msta->wcid,
+					      &mlink->wcid,
 					      MT7996_STA_UPDATE_MAX_SIZE);
 	if (IS_ERR(skb))
 		return PTR_ERR(skb);
 
 	/* starec hdr trans */
-	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, sta);
+	mt7996_mcu_sta_hdr_trans_tlv(dev, skb, vif, mlink);
 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
 				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
 }
@@ -5014,7 +5017,7 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
 	switch (tag) {
 	case UNI_PER_STA_RSSI:
 		for (i = 0; i < sta_num; ++i) {
-			struct mt7996_sta *msta;
+			struct mt7996_link_sta *mlink;
 			struct mt76_phy *phy;
 			s8 rssi[4];
 			u8 *rcpi;
@@ -5028,10 +5031,10 @@ int mt7996_mcu_get_per_sta_info(struct mt76_dev *dev, u16 tag,
 				rssi[2] = to_rssi(MT_PRXV_RCPI0, rcpi[2]);
 				rssi[3] = to_rssi(MT_PRXV_RCPI0, rcpi[3]);
 
-				msta = container_of(wcid, struct mt7996_sta, wcid);
-				phy = msta->vif->phy->mt76;
-				msta->ack_signal = mt76_rx_signal(phy->antenna_mask, rssi);
-				ewma_avg_signal_add(&msta->avg_ack_signal, -msta->ack_signal);
+				mlink = container_of(wcid, struct mt7996_link_sta, wcid);
+				phy = mlink->sta->vif->deflink.phy->mt76;
+				mlink->ack_signal = mt76_rx_signal(phy->antenna_mask, rssi);
+				ewma_avg_signal_add(&mlink->avg_ack_signal, -mlink->ack_signal);
 			} else {
 				ret = -EINVAL;
 				dev_err(dev->dev, "Failed to update RSSI for "
@@ -5069,7 +5072,7 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
 {
 	u16 sta_list[PER_STA_INFO_MAX_NUM];
 	LIST_HEAD(sta_poll_list);
-	struct mt7996_sta *msta;
+	struct mt7996_link_sta *mlink;
 	int i, ret;
 	bool empty = false;
 
@@ -5089,13 +5092,13 @@ int mt7996_mcu_get_rssi(struct mt76_dev *dev)
 				empty = true;
 				break;
 			}
-			msta = list_first_entry(&sta_poll_list,
-			                        struct mt7996_sta,
+			mlink = list_first_entry(&sta_poll_list,
+			                        struct mt7996_link_sta,
 			                        wcid.poll_list);
-			list_del_init(&msta->wcid.poll_list);
+			list_del_init(&mlink->wcid.poll_list);
 			spin_unlock_bh(&dev->sta_poll_lock);
 
-			sta_list[i] = msta->wcid.idx;
+			sta_list[i] = mlink->wcid.idx;
 		}
 
 		ret = mt7996_mcu_get_per_sta_info(dev, UNI_PER_STA_RSSI,
@@ -5385,10 +5388,18 @@ int mt7996_mcu_set_scs_stats(struct mt7996_phy *phy)
 void mt7996_sta_rssi_work(void *data, struct ieee80211_sta *sta)
 {
 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+	struct mt7996_link_sta *mlink;
 	struct mt7996_phy *poll_phy = (struct mt7996_phy *) data;
 
-	if (poll_phy->scs_ctrl.sta_min_rssi > msta->ack_signal)
-		poll_phy->scs_ctrl.sta_min_rssi = msta->ack_signal;
+	mutex_lock(&poll_phy->dev->mt76.mutex);
+	mlink = mlink_dereference_protected(msta, 0);
+	if (!mlink)
+		goto out;
+
+	if (poll_phy->scs_ctrl.sta_min_rssi > mlink->ack_signal)
+		poll_phy->scs_ctrl.sta_min_rssi = mlink->ack_signal;
+out:
+	mutex_unlock(&poll_phy->dev->mt76.mutex);
 }
 
 void mt7996_mcu_scs_sta_poll(struct work_struct *work)
@@ -5464,9 +5475,10 @@ int mt7996_mcu_set_scs(struct mt7996_phy *phy, u8 enable)
 
 int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
 				struct mt7996_bss_conf *mconf,
-				struct mt7996_sta *msta, enum vow_drr_ctrl_id id)
+				struct mt7996_link_sta *mlink,
+				enum vow_drr_ctrl_id id)
 {
-	struct mt7996_vow_sta_ctrl *vow = msta ? &msta->vow : NULL;
+	struct mt7996_vow_sta_ctrl *vow = mlink ? &mlink->vow : NULL;
 	u32 val = 0;
 	struct {
 		u8 __rsv1[4];
@@ -5488,11 +5500,11 @@ int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
 	} __packed req = {
 		.tag = cpu_to_le16(UNI_VOW_DRR_CTRL),
 		.len = cpu_to_le16(sizeof(req) - 4),
-		.wlan_idx = cpu_to_le16(msta ? msta->wcid.idx : 0),
+		.wlan_idx = cpu_to_le16(mlink ? mlink->wcid.idx : 0),
 		.band_idx = phy->mt76->band_idx,
-		.wmm_idx = msta ? mconf->mt76.wmm_idx : 0,
+		.wmm_idx = mlink ? mconf->mt76.wmm_idx : 0,
 		.ctrl_id = cpu_to_le32(id),
-		.omac_idx = msta ? mconf->mt76.omac_idx : 0
+		.omac_idx = mlink ? mconf->mt76.omac_idx : 0
 	};
 
 	switch (id) {
diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
index 6b03ee1..3701720 100644
--- a/mt7996/mt7996.h
+++ b/mt7996/mt7996.h
@@ -302,10 +302,10 @@ struct mt7996_vow_sta_ctrl {
 	u8 drr_quantum[IEEE80211_NUM_ACS];
 };
 
-struct mt7996_sta {
+struct mt7996_link_sta {
 	struct mt76_wcid wcid; /* must be first */
 
-	struct mt7996_vif *vif;
+	struct mt7996_sta *sta;
 
 	struct list_head rc_list;
 
@@ -324,6 +324,13 @@ struct mt7996_sta {
 	struct mt7996_vow_sta_ctrl vow;
 };
 
+struct mt7996_sta {
+	struct mt7996_link_sta deflink;
+	struct mt7996_link_sta __rcu *link[IEEE80211_MLD_MAX_NUM_LINKS];
+
+	struct mt7996_vif *vif;
+};
+
 struct mt7996_bss_conf {
 	struct mt76_vif mt76; /* must be first */
 
@@ -783,6 +790,13 @@ mconf_dereference_protected(struct mt7996_vif *mvif, u8 link_id)
 					 lockdep_is_held(&mvif->dev->mt76.mutex));
 }
 
+static inline struct mt7996_link_sta *
+mlink_dereference_protected(struct mt7996_sta *msta, u8 link_id)
+{
+	return rcu_dereference_protected(msta->link[link_id],
+					 lockdep_is_held(&msta->vif->dev->mt76.mutex));
+}
+
 extern const struct ieee80211_ops mt7996_ops;
 extern struct pci_driver mt7996_pci_driver;
 extern struct pci_driver mt7996_hif_driver;
@@ -827,10 +841,12 @@ int mt7996_mcu_add_dev_info(struct mt7996_phy *phy,
 			    struct mt7996_bss_conf *mconf, bool enable);
 int mt7996_mcu_add_bss_info(struct mt7996_phy *phy,
 			    struct ieee80211_bss_conf *conf,
-			    struct mt7996_bss_conf *mconf, int enable);
+			    struct mt7996_bss_conf *mconf,
+			    struct mt7996_link_sta *mlink, int enable);
 int mt7996_mcu_add_sta(struct mt7996_dev *dev, struct ieee80211_bss_conf *conf,
-		       struct mt7996_bss_conf *mconf, struct ieee80211_sta *sta,
-		       bool enable, bool newly);
+		       struct mt7996_bss_conf *mconf,
+		       struct ieee80211_link_sta *link_sta,
+		       struct mt7996_link_sta *mlink, bool enable, bool newly);
 int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
 			 struct ieee80211_ampdu_params *params,
 			 bool add);
@@ -852,7 +868,8 @@ int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy,
 int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
 			     struct ieee80211_bss_conf *conf,
 			     struct mt7996_bss_conf *mconf,
-			     struct ieee80211_sta *sta, bool changed);
+			     struct ieee80211_link_sta *link_sta,
+			     struct mt7996_link_sta *mlink, bool changed);
 int mt7996_set_channel(struct mt7996_phy *phy, struct cfg80211_chan_def *chandef);
 int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag);
 int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct mt7996_bss_conf *mconf);
@@ -860,7 +877,9 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
 				   void *data, u16 version);
 int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
 			       struct mt7996_bss_conf *mconf,
-			       struct ieee80211_sta *sta, void *data, u32 field);
+			       struct ieee80211_link_sta *link_sta,
+			       struct mt7996_link_sta *mlink, void *data,
+			       u32 field);
 int mt7996_mcu_set_eeprom(struct mt7996_dev *dev);
 int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *read_buf);
 int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num);
@@ -916,7 +935,8 @@ void mt7996_mcu_scs_sta_poll(struct work_struct *work);
 int mt7996_mcu_set_band_confg(struct mt7996_phy *phy, u16 option, bool enable);
 int mt7996_mcu_set_vow_drr_ctrl(struct mt7996_phy *phy,
 				struct mt7996_bss_conf *mconf,
-				struct mt7996_sta *msta, enum vow_drr_ctrl_id id);
+				struct mt7996_link_sta *mlink,
+				enum vow_drr_ctrl_id id);
 int mt7996_mcu_set_vow_feature_ctrl(struct mt7996_phy *phy);
 void mt7996_mcu_wmm_pbc_work(struct work_struct *work);
 
@@ -983,7 +1003,7 @@ void mt7996_mac_reset_counters(struct mt7996_phy *phy);
 void mt7996_mac_cca_stats_reset(struct mt7996_phy *phy);
 void mt7996_mac_enable_nf(struct mt7996_dev *dev, u8 band);
 void mt7996_mac_enable_rtscts(struct mt7996_dev *dev,
-			      struct ieee80211_vif *vif, bool enable);
+			      struct mt7996_link_sta *mlink, bool enable);
 void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
 			   struct sk_buff *skb, struct mt76_wcid *wcid,
 			   struct ieee80211_key_conf *key, int pid,
@@ -1001,8 +1021,7 @@ void mt7996_mac_dump_work(struct work_struct *work);
 void mt7996_mac_sta_rc_work(struct work_struct *work);
 void mt7996_mac_update_stats(struct mt7996_phy *phy);
 void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
-				  struct mt7996_sta *msta,
-				  u8 flowid);
+				  struct mt7996_link_sta *mlink, u8 flowid);
 void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
 			      struct ieee80211_sta *sta,
 			      struct ieee80211_twt_setup *twt);
@@ -1031,11 +1050,12 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_bss_conf *mconf,
 int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
 			       struct ieee80211_bss_conf *conf,
 			       struct mt7996_bss_conf *mconf,
+			       struct mt7996_link_sta *mlink,
 			       struct ieee80211_key_conf *key);
 int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
 				     struct ieee80211_vif *vif,
 				     struct mt7996_bss_conf *mconf,
-				     struct ieee80211_sta *sta);
+				     struct mt7996_link_sta *mlink);
 int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode);
 int mt7996_mcu_set_pp_en(struct mt7996_phy *phy, u8 mode, u16 bitmap);
 #ifdef CONFIG_MAC80211_DEBUGFS
diff --git a/mt7996/testmode.c b/mt7996/testmode.c
index bf55b43..ba17f94 100644
--- a/mt7996/testmode.c
+++ b/mt7996/testmode.c
@@ -235,8 +235,8 @@ mt7996_tm_init(struct mt7996_phy *phy, bool en)
 
 	mt7996_tm_rf_switch_mode(dev, rf_test_mode);
 
-	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, en);
-	mt7996_mcu_add_sta(dev, &phy->monitor_vif->bss_conf, &mvif->deflink, NULL, en, false);
+	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, &mvif->sta.deflink, en);
+	mt7996_mcu_add_sta(dev, &phy->monitor_vif->bss_conf, &mvif->deflink, NULL, &mvif->sta.deflink, en, false);
 
 	mt7996_tm_set(dev, SET_ID(BAND_IDX), phy->mt76->band_idx);
 
@@ -1186,7 +1186,7 @@ mt7996_tm_txbf_init(struct mt7996_phy *phy, u16 *val)
 	phy->omac_mask |= BIT_ULL(mvif->deflink.mt76.omac_idx);
 
 	mt7996_mcu_add_dev_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, true);
-	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, true);
+	mt7996_mcu_add_bss_info(phy, &phy->monitor_vif->bss_conf, &mvif->deflink, &mvif->sta.deflink, true);
 
 	if (td->ibf) {
 		if (td->is_txbf_dut) {
-- 
2.18.0