diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1050-wifi-mt76-try-more-times-when-send-message-timeout.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1050-wifi-mt76-try-more-times-when-send-message-timeout.patch
new file mode 100644
index 0000000..9dd4eee
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1050-wifi-mt76-try-more-times-when-send-message-timeout.patch
@@ -0,0 +1,232 @@
+From 6095169dd81a2dc26314ded00075544ff2717350 Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Tue, 6 Feb 2024 14:32:46 +0800
+Subject: [PATCH 1/2] wifi: mt76: try more times when send message timeout.
+
+CR-Id: WCNCR00334773
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+---
+ dma.c        |  7 ++++--
+ mcu.c        | 66 ++++++++++++++++++++++++++++++++++++----------------
+ mt7915/mac.c | 45 +++++++++++------------------------
+ 3 files changed, 64 insertions(+), 54 deletions(-)
+
+diff --git a/dma.c b/dma.c
+index bbae84f..11de65c 100644
+--- a/dma.c
++++ b/dma.c
+@@ -504,9 +504,12 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
+ {
+ 	struct mt76_queue_buf buf = {};
+ 	dma_addr_t addr;
++	int ret = -ENOMEM;
+ 
+-	if (test_bit(MT76_MCU_RESET, &dev->phy.state))
++	if (test_bit(MT76_MCU_RESET, &dev->phy.state)) {
++		ret = -EAGAIN;
+ 		goto error;
++	}
+ 
+ 	if (q->queued + 1 >= q->ndesc - 1)
+ 		goto error;
+@@ -528,7 +531,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
+ 
+ error:
+ 	dev_kfree_skb(skb);
+-	return -ENOMEM;
++	return ret;
+ }
+ 
+ static int
+diff --git a/mcu.c b/mcu.c
+index fa4b054..de185cc 100644
+--- a/mcu.c
++++ b/mcu.c
+@@ -4,6 +4,7 @@
+  */
+ 
+ #include "mt76.h"
++#include "mt76_connac.h"
+ #include <linux/moduleparam.h>
+ 
+ struct sk_buff *
+@@ -74,35 +75,60 @@ int mt76_mcu_skb_send_and_get_msg(struct mt76_dev *dev, struct sk_buff *skb,
+ 				  int cmd, bool wait_resp,
+ 				  struct sk_buff **ret_skb)
+ {
++#define MT76_MSG_MAX_RETRY_CNT 3
+ 	unsigned long expires;
+-	int ret, seq;
++	int ret, seq, retry_cnt;
++	struct sk_buff *skb_tmp;
++	bool retry = wait_resp && is_connac_v2(dev);
+ 
+ 	if (ret_skb)
+ 		*ret_skb = NULL;
+ 
+ 	mutex_lock(&dev->mcu.mutex);
+-
+-	ret = dev->mcu_ops->mcu_skb_send_msg(dev, skb, cmd, &seq);
+-	if (ret < 0)
+-		goto out;
+-
+-	if (!wait_resp) {
+-		ret = 0;
+-		goto out;
++	retry_cnt = retry ? MT76_MSG_MAX_RETRY_CNT : 1;
++	while (retry_cnt) {
++		skb_tmp = mt76_mcu_msg_alloc(dev, skb->data, skb->len);
++		if (!skb_tmp)
++			goto out;
++
++		if (retry && retry_cnt < MT76_MSG_MAX_RETRY_CNT) {
++			if (test_bit(MT76_MCU_RESET, &dev->phy.state))
++				usleep_range(200000, 500000);
++			dev_err(dev->dev, "send message %08x timeout, try again(%d).\n",
++				cmd, (MT76_MSG_MAX_RETRY_CNT - retry_cnt));
++		}
++
++		ret = dev->mcu_ops->mcu_skb_send_msg(dev, skb_tmp, cmd, &seq);
++		if (ret < 0 && ret != -EAGAIN)
++			goto out;
++
++		if (!wait_resp) {
++			ret = 0;
++			goto out;
++		}
++
++		expires = jiffies + dev->mcu.timeout;
++
++		do {
++			skb_tmp = mt76_mcu_get_response(dev, expires);
++			ret = dev->mcu_ops->mcu_parse_response(dev, cmd, skb_tmp, seq);
++			if (ret == -ETIMEDOUT)
++				break;
++
++			if (!ret && ret_skb)
++				*ret_skb = skb_tmp;
++			else
++				dev_kfree_skb(skb_tmp);
++
++			if (ret != -EAGAIN)
++				goto out;
++		} while (ret == -EAGAIN);
++
++		retry_cnt--;
+ 	}
+ 
+-	expires = jiffies + dev->mcu.timeout;
+-
+-	do {
+-		skb = mt76_mcu_get_response(dev, expires);
+-		ret = dev->mcu_ops->mcu_parse_response(dev, cmd, skb, seq);
+-		if (!ret && ret_skb)
+-			*ret_skb = skb;
+-		else
+-			dev_kfree_skb(skb);
+-	} while (ret == -EAGAIN);
+-
+ out:
++	dev_kfree_skb(skb);
+ 	mutex_unlock(&dev->mcu.mutex);
+ 
+ 	return ret;
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index aebfaf2..dd15d88 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -1392,14 +1392,6 @@ mt7915_mac_restart(struct mt7915_dev *dev)
+ 		}
+ 	}
+ 
+-	set_bit(MT76_RESET, &dev->mphy.state);
+-	set_bit(MT76_MCU_RESET, &dev->mphy.state);
+-	wake_up(&dev->mt76.mcu.wait);
+-	if (ext_phy) {
+-		set_bit(MT76_RESET, &ext_phy->state);
+-		set_bit(MT76_MCU_RESET, &ext_phy->state);
+-	}
+-
+ 	/* lock/unlock all queues to ensure that no tx is pending */
+ 	mt76_txq_schedule_all(&dev->mphy);
+ 	if (ext_phy)
+@@ -1500,11 +1492,18 @@ mt7915_mac_full_reset(struct mt7915_dev *dev)
+ 
+ 	dev->recovery.hw_full_reset = true;
+ 
+-	wake_up(&dev->mt76.mcu.wait);
+ 	ieee80211_stop_queues(mt76_hw(dev));
+ 	if (ext_phy)
+ 		ieee80211_stop_queues(ext_phy->hw);
+ 
++	set_bit(MT76_RESET, &dev->mphy.state);
++	set_bit(MT76_MCU_RESET, &dev->mphy.state);
++	wake_up(&dev->mt76.mcu.wait);
++	if (ext_phy) {
++		set_bit(MT76_RESET, &ext_phy->state);
++		set_bit(MT76_MCU_RESET, &ext_phy->state);
++	}
++
+ 	cancel_delayed_work_sync(&dev->mphy.mac_work);
+ 	if (ext_phy)
+ 		cancel_delayed_work_sync(&ext_phy->mac_work);
+@@ -1592,20 +1591,15 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ 
+ 	set_bit(MT76_RESET, &dev->mphy.state);
+ 	set_bit(MT76_MCU_RESET, &dev->mphy.state);
++	if (ext_phy)
++		set_bit(MT76_RESET, &ext_phy->state);
+ 	wake_up(&dev->mt76.mcu.wait);
+-	cancel_delayed_work_sync(&dev->mphy.mac_work);
+-	if (phy2) {
+-		set_bit(MT76_RESET, &phy2->mt76->state);
+-		cancel_delayed_work_sync(&phy2->mt76->mac_work);
+-	}
+-	cancel_delayed_work_sync(&dev->scs_work);
++
+ 	mt76_worker_disable(&dev->mt76.tx_worker);
+ 	mt76_for_each_q_rx(&dev->mt76, i)
+ 		napi_disable(&dev->mt76.napi[i]);
+ 	napi_disable(&dev->mt76.tx_napi);
+ 
+-	mutex_lock(&dev->mt76.mutex);
+-
+ 	if (mtk_wed_device_active(&dev->mt76.mmio.wed))
+ 		mtk_wed_device_stop(&dev->mt76.mmio.wed);
+ 
+@@ -1629,8 +1623,8 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ 
+ 	clear_bit(MT76_MCU_RESET, &dev->mphy.state);
+ 	clear_bit(MT76_RESET, &dev->mphy.state);
+-	if (phy2)
+-		clear_bit(MT76_RESET, &phy2->mt76->state);
++	if (ext_phy)
++		clear_bit(MT76_RESET, &ext_phy->state);
+ 
+ 	local_bh_disable();
+ 	mt76_for_each_q_rx(&dev->mt76, i) {
+@@ -1652,21 +1646,8 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ 	if (ext_phy)
+ 		ieee80211_wake_queues(ext_phy->hw);
+ 
+-	mutex_unlock(&dev->mt76.mutex);
+-
+ 	mt7915_update_beacons(dev);
+ 
+-	ieee80211_queue_delayed_work(mt76_hw(dev), &dev->mphy.mac_work,
+-				     MT7915_WATCHDOG_TIME);
+-	if (phy2)
+-		ieee80211_queue_delayed_work(ext_phy->hw,
+-					     &phy2->mt76->mac_work,
+-					     MT7915_WATCHDOG_TIME);
+-
+-	if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
+-	    mtk_wed_get_rx_capa(&dev->mt76.mmio.wed))
+-		ieee80211_queue_delayed_work(mt76_hw(dev), &dev->scs_work, HZ);
+-
+ 	dev_info(dev->mt76.dev,"\n%s L1 SER recovery completed.",
+ 		 wiphy_name(dev->mt76.hw->wiphy));
+ }
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1051-wifi-mt76-mt7915-add-SER-overlap-handle.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1051-wifi-mt76-mt7915-add-SER-overlap-handle.patch
new file mode 100644
index 0000000..b40ebde
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1051-wifi-mt76-mt7915-add-SER-overlap-handle.patch
@@ -0,0 +1,138 @@
+From d9ec9b87f64abcfec2a8ae78648a30f4c120842d Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Tue, 6 Feb 2024 14:46:59 +0800
+Subject: [PATCH 2/2] wifi: mt76: mt7915: add SER overlap handle
+
+CR-ID: WCNCR00355921
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+---
+ dma.c        |  3 ++-
+ mcu.c        |  7 +++++--
+ mt76.h       |  9 +++++++++
+ mt7915/mac.c | 11 +++++++++++
+ mt7915/mcu.c |  7 +++++++
+ 5 files changed, 34 insertions(+), 3 deletions(-)
+
+diff --git a/dma.c b/dma.c
+index 11de65c..cb26dc3 100644
+--- a/dma.c
++++ b/dma.c
+@@ -506,7 +506,8 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
+ 	dma_addr_t addr;
+ 	int ret = -ENOMEM;
+ 
+-	if (test_bit(MT76_MCU_RESET, &dev->phy.state)) {
++	if (test_bit(MT76_MCU_RESET, &dev->phy.state) ||
++	    dev->recovery_state == MT76_RECOVERY_TRIGGERED) {
+ 		ret = -EAGAIN;
+ 		goto error;
+ 	}
+diff --git a/mcu.c b/mcu.c
+index de185cc..1bc94e8 100644
+--- a/mcu.c
++++ b/mcu.c
+@@ -42,7 +42,9 @@ struct sk_buff *mt76_mcu_get_response(struct mt76_dev *dev,
+ 	timeout = expires - jiffies;
+ 	wait_event_timeout(dev->mcu.wait,
+ 			   (!skb_queue_empty(&dev->mcu.res_q) ||
+-			    test_bit(MT76_MCU_RESET, &dev->phy.state)),
++			    test_bit(MT76_MCU_RESET, &dev->phy.state) ||
++			    dev->recovery_state == MT76_RECOVERY_TRIGGERED ||
++			    dev->recovery_state == MT76_RECOVERY_OVERLAP_TRIGGERED),
+ 			   timeout);
+ 	return skb_dequeue(&dev->mcu.res_q);
+ }
+@@ -92,7 +94,8 @@ int mt76_mcu_skb_send_and_get_msg(struct mt76_dev *dev, struct sk_buff *skb,
+ 			goto out;
+ 
+ 		if (retry && retry_cnt < MT76_MSG_MAX_RETRY_CNT) {
+-			if (test_bit(MT76_MCU_RESET, &dev->phy.state))
++			if (test_bit(MT76_MCU_RESET, &dev->phy.state) ||
++			    dev->recovery_state == MT76_RECOVERY_TRIGGERED)
+ 				usleep_range(200000, 500000);
+ 			dev_err(dev->dev, "send message %08x timeout, try again(%d).\n",
+ 				cmd, (MT76_MSG_MAX_RETRY_CNT - retry_cnt));
+diff --git a/mt76.h b/mt76.h
+index 4291acd..484fc5b 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -477,6 +477,14 @@ enum {
+ 	MT76_STATE_WED_RESET,
+ };
+ 
++enum {
++	MT76_RECOVERY_INIT,
++	MT76_RECOVERY_TRIGGERED,
++	MT76_RECOVERY_OVERLAP_TRIGGERED,
++	MT76_RECOVERY_PROCESS,
++	MT76_RECOVERY_DONE = MT76_RECOVERY_INIT,
++};
++
+ struct mt76_hw_cap {
+ 	bool has_2ghz;
+ 	bool has_5ghz;
+@@ -940,6 +948,7 @@ struct mt76_dev {
+ 	wait_queue_head_t tx_wait;
+ 	/* spinclock used to protect wcid pktid linked list */
+ 	spinlock_t status_lock;
++	u16 recovery_state;
+ 
+ 	u32 wcid_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
+ 	u32 wcid_phy_mask[DIV_ROUND_UP(MT76_N_WCIDS, 32)];
+diff --git a/mt7915/mac.c b/mt7915/mac.c
+index dd15d88..c1df503 100644
+--- a/mt7915/mac.c
++++ b/mt7915/mac.c
+@@ -1582,6 +1582,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ 	if (!(READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA))
+ 		return;
+ 
++	dev->mt76.recovery_state = MT76_RECOVERY_PROCESS;
+ 	dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.",
+ 		 wiphy_name(dev->mt76.hw->wiphy));
+ 
+@@ -1648,6 +1649,7 @@ void mt7915_mac_reset_work(struct work_struct *work)
+ 
+ 	mt7915_update_beacons(dev);
+ 
++	dev->mt76.recovery_state = MT76_RECOVERY_DONE;
+ 	dev_info(dev->mt76.dev,"\n%s L1 SER recovery completed.",
+ 		 wiphy_name(dev->mt76.hw->wiphy));
+ }
+@@ -1786,6 +1788,15 @@ void mt7915_reset(struct mt7915_dev *dev)
+ 		return;
+ 	}
+ 
++	if ((READ_ONCE(dev->recovery.state) & MT_MCU_CMD_STOP_DMA)) {
++		if (dev->mt76.recovery_state != MT76_RECOVERY_DONE)
++			dev->mt76.recovery_state = MT76_RECOVERY_OVERLAP_TRIGGERED;
++		else
++			dev->mt76.recovery_state = MT76_RECOVERY_TRIGGERED;
++
++		wake_up(&dev->mt76.mcu.wait);
++	}
++
+ 	queue_work(dev->mt76.wq, &dev->reset_work);
+ 	wake_up(&dev->reset_wait);
+ }
+diff --git a/mt7915/mcu.c b/mt7915/mcu.c
+index 4bd7a3b..d80a61a 100644
+--- a/mt7915/mcu.c
++++ b/mt7915/mcu.c
+@@ -198,6 +198,13 @@ mt7915_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+ 	enum mt76_mcuq_id qid;
+ 	int ret;
+ 
++	if (mdev->recovery_state == MT76_RECOVERY_OVERLAP_TRIGGERED) {
++		dev_info(dev->mt76.dev,"\n%s L1 SER recovery overlap, drop message %08x.",
++			 wiphy_name(dev->mt76.hw->wiphy), cmd);
++		dev_kfree_skb(skb);
++		return -EPERM;
++	}
++
+ 	ret = mt76_connac2_mcu_fill_message(mdev, skb, cmd, wait_seq);
+ 
+ 	if (ret)
+-- 
+2.18.0
+