xref: /linux/drivers/net/wireless/realtek/rtw89/fw.c (revision 64b14a184e83eb62ea0615e31a409956049d40e7)
1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 /* Copyright(c) 2019-2020  Realtek Corporation
3  */
4 
5 #include "cam.h"
6 #include "coex.h"
7 #include "debug.h"
8 #include "fw.h"
9 #include "mac.h"
10 #include "phy.h"
11 #include "reg.h"
12 
13 static struct sk_buff *rtw89_fw_h2c_alloc_skb(u32 len, bool header)
14 {
15 	struct sk_buff *skb;
16 	u32 header_len = 0;
17 
18 	if (header)
19 		header_len = H2C_HEADER_LEN;
20 
21 	skb = dev_alloc_skb(len + header_len + 24);
22 	if (!skb)
23 		return NULL;
24 	skb_reserve(skb, header_len + 24);
25 	memset(skb->data, 0, len);
26 
27 	return skb;
28 }
29 
30 struct sk_buff *rtw89_fw_h2c_alloc_skb_with_hdr(u32 len)
31 {
32 	return rtw89_fw_h2c_alloc_skb(len, true);
33 }
34 
35 struct sk_buff *rtw89_fw_h2c_alloc_skb_no_hdr(u32 len)
36 {
37 	return rtw89_fw_h2c_alloc_skb(len, false);
38 }
39 
40 static u8 _fw_get_rdy(struct rtw89_dev *rtwdev)
41 {
42 	u8 val = rtw89_read8(rtwdev, R_AX_WCPU_FW_CTRL);
43 
44 	return FIELD_GET(B_AX_WCPU_FWDL_STS_MASK, val);
45 }
46 
47 #define FWDL_WAIT_CNT 400000
48 int rtw89_fw_check_rdy(struct rtw89_dev *rtwdev)
49 {
50 	u8 val;
51 	int ret;
52 
53 	ret = read_poll_timeout_atomic(_fw_get_rdy, val,
54 				       val == RTW89_FWDL_WCPU_FW_INIT_RDY,
55 				       1, FWDL_WAIT_CNT, false, rtwdev);
56 	if (ret) {
57 		switch (val) {
58 		case RTW89_FWDL_CHECKSUM_FAIL:
59 			rtw89_err(rtwdev, "fw checksum fail\n");
60 			return -EINVAL;
61 
62 		case RTW89_FWDL_SECURITY_FAIL:
63 			rtw89_err(rtwdev, "fw security fail\n");
64 			return -EINVAL;
65 
66 		case RTW89_FWDL_CV_NOT_MATCH:
67 			rtw89_err(rtwdev, "fw cv not match\n");
68 			return -EINVAL;
69 
70 		default:
71 			return -EBUSY;
72 		}
73 	}
74 
75 	set_bit(RTW89_FLAG_FW_RDY, rtwdev->flags);
76 
77 	return 0;
78 }
79 
80 static int rtw89_fw_hdr_parser(struct rtw89_dev *rtwdev, const u8 *fw, u32 len,
81 			       struct rtw89_fw_bin_info *info)
82 {
83 	struct rtw89_fw_hdr_section_info *section_info;
84 	const u8 *fw_end = fw + len;
85 	const u8 *bin;
86 	u32 i;
87 
88 	if (!info)
89 		return -EINVAL;
90 
91 	info->section_num = GET_FW_HDR_SEC_NUM(fw);
92 	info->hdr_len = RTW89_FW_HDR_SIZE +
93 			info->section_num * RTW89_FW_SECTION_HDR_SIZE;
94 
95 	bin = fw + info->hdr_len;
96 
97 	/* jump to section header */
98 	fw += RTW89_FW_HDR_SIZE;
99 	section_info = info->section_info;
100 	for (i = 0; i < info->section_num; i++) {
101 		section_info->len = GET_FWSECTION_HDR_SEC_SIZE(fw);
102 		if (GET_FWSECTION_HDR_CHECKSUM(fw))
103 			section_info->len += FWDL_SECTION_CHKSUM_LEN;
104 		section_info->redl = GET_FWSECTION_HDR_REDL(fw);
105 		section_info->dladdr =
106 				GET_FWSECTION_HDR_DL_ADDR(fw) & 0x1fffffff;
107 		section_info->addr = bin;
108 		bin += section_info->len;
109 		fw += RTW89_FW_SECTION_HDR_SIZE;
110 		section_info++;
111 	}
112 
113 	if (fw_end != bin) {
114 		rtw89_err(rtwdev, "[ERR]fw bin size\n");
115 		return -EINVAL;
116 	}
117 
118 	return 0;
119 }
120 
121 static
122 int rtw89_mfw_recognize(struct rtw89_dev *rtwdev, enum rtw89_fw_type type,
123 			struct rtw89_fw_suit *fw_suit)
124 {
125 	struct rtw89_fw_info *fw_info = &rtwdev->fw;
126 	const u8 *mfw = fw_info->firmware->data;
127 	u32 mfw_len = fw_info->firmware->size;
128 	const struct rtw89_mfw_hdr *mfw_hdr = (const struct rtw89_mfw_hdr *)mfw;
129 	const struct rtw89_mfw_info *mfw_info;
130 	int i;
131 
132 	if (mfw_hdr->sig != RTW89_MFW_SIG) {
133 		rtw89_debug(rtwdev, RTW89_DBG_FW, "use legacy firmware\n");
134 		/* legacy firmware support normal type only */
135 		if (type != RTW89_FW_NORMAL)
136 			return -EINVAL;
137 		fw_suit->data = mfw;
138 		fw_suit->size = mfw_len;
139 		return 0;
140 	}
141 
142 	for (i = 0; i < mfw_hdr->fw_nr; i++) {
143 		mfw_info = &mfw_hdr->info[i];
144 		if (mfw_info->cv != rtwdev->hal.cv ||
145 		    mfw_info->type != type ||
146 		    mfw_info->mp)
147 			continue;
148 
149 		fw_suit->data = mfw + le32_to_cpu(mfw_info->shift);
150 		fw_suit->size = le32_to_cpu(mfw_info->size);
151 		return 0;
152 	}
153 
154 	rtw89_err(rtwdev, "no suitable firmware found\n");
155 	return -ENOENT;
156 }
157 
158 static void rtw89_fw_update_ver(struct rtw89_dev *rtwdev,
159 				enum rtw89_fw_type type,
160 				struct rtw89_fw_suit *fw_suit)
161 {
162 	const u8 *hdr = fw_suit->data;
163 
164 	fw_suit->major_ver = GET_FW_HDR_MAJOR_VERSION(hdr);
165 	fw_suit->minor_ver = GET_FW_HDR_MINOR_VERSION(hdr);
166 	fw_suit->sub_ver = GET_FW_HDR_SUBVERSION(hdr);
167 	fw_suit->sub_idex = GET_FW_HDR_SUBINDEX(hdr);
168 	fw_suit->build_year = GET_FW_HDR_YEAR(hdr);
169 	fw_suit->build_mon = GET_FW_HDR_MONTH(hdr);
170 	fw_suit->build_date = GET_FW_HDR_DATE(hdr);
171 	fw_suit->build_hour = GET_FW_HDR_HOUR(hdr);
172 	fw_suit->build_min = GET_FW_HDR_MIN(hdr);
173 	fw_suit->cmd_ver = GET_FW_HDR_CMD_VERSERION(hdr);
174 
175 	rtw89_info(rtwdev,
176 		   "Firmware version %u.%u.%u.%u, cmd version %u, type %u\n",
177 		   fw_suit->major_ver, fw_suit->minor_ver, fw_suit->sub_ver,
178 		   fw_suit->sub_idex, fw_suit->cmd_ver, type);
179 }
180 
181 static
182 int __rtw89_fw_recognize(struct rtw89_dev *rtwdev, enum rtw89_fw_type type)
183 {
184 	struct rtw89_fw_suit *fw_suit = rtw89_fw_suit_get(rtwdev, type);
185 	int ret;
186 
187 	ret = rtw89_mfw_recognize(rtwdev, type, fw_suit);
188 	if (ret)
189 		return ret;
190 
191 	rtw89_fw_update_ver(rtwdev, type, fw_suit);
192 
193 	return 0;
194 }
195 
196 static void rtw89_fw_recognize_features(struct rtw89_dev *rtwdev)
197 {
198 	const struct rtw89_chip_info *chip = rtwdev->chip;
199 	struct rtw89_fw_suit *fw_suit = rtw89_fw_suit_get(rtwdev, RTW89_FW_NORMAL);
200 
201 	if (chip->chip_id == RTL8852A &&
202 	    RTW89_FW_SUIT_VER_CODE(fw_suit) <= RTW89_FW_VER_CODE(0, 13, 29, 0))
203 		rtwdev->fw.old_ht_ra_format = true;
204 }
205 
206 int rtw89_fw_recognize(struct rtw89_dev *rtwdev)
207 {
208 	int ret;
209 
210 	ret = __rtw89_fw_recognize(rtwdev, RTW89_FW_NORMAL);
211 	if (ret)
212 		return ret;
213 
214 	/* It still works if wowlan firmware isn't existing. */
215 	__rtw89_fw_recognize(rtwdev, RTW89_FW_WOWLAN);
216 
217 	rtw89_fw_recognize_features(rtwdev);
218 
219 	return 0;
220 }
221 
222 void rtw89_h2c_pkt_set_hdr(struct rtw89_dev *rtwdev, struct sk_buff *skb,
223 			   u8 type, u8 cat, u8 class, u8 func,
224 			   bool rack, bool dack, u32 len)
225 {
226 	struct fwcmd_hdr *hdr;
227 
228 	hdr = (struct fwcmd_hdr *)skb_push(skb, 8);
229 
230 	if (!(rtwdev->fw.h2c_seq % 4))
231 		rack = true;
232 	hdr->hdr0 = cpu_to_le32(FIELD_PREP(H2C_HDR_DEL_TYPE, type) |
233 				FIELD_PREP(H2C_HDR_CAT, cat) |
234 				FIELD_PREP(H2C_HDR_CLASS, class) |
235 				FIELD_PREP(H2C_HDR_FUNC, func) |
236 				FIELD_PREP(H2C_HDR_H2C_SEQ, rtwdev->fw.h2c_seq));
237 
238 	hdr->hdr1 = cpu_to_le32(FIELD_PREP(H2C_HDR_TOTAL_LEN,
239 					   len + H2C_HEADER_LEN) |
240 				(rack ? H2C_HDR_REC_ACK : 0) |
241 				(dack ? H2C_HDR_DONE_ACK : 0));
242 
243 	rtwdev->fw.h2c_seq++;
244 }
245 
246 static void rtw89_h2c_pkt_set_hdr_fwdl(struct rtw89_dev *rtwdev,
247 				       struct sk_buff *skb,
248 				       u8 type, u8 cat, u8 class, u8 func,
249 				       u32 len)
250 {
251 	struct fwcmd_hdr *hdr;
252 
253 	hdr = (struct fwcmd_hdr *)skb_push(skb, 8);
254 
255 	hdr->hdr0 = cpu_to_le32(FIELD_PREP(H2C_HDR_DEL_TYPE, type) |
256 				FIELD_PREP(H2C_HDR_CAT, cat) |
257 				FIELD_PREP(H2C_HDR_CLASS, class) |
258 				FIELD_PREP(H2C_HDR_FUNC, func) |
259 				FIELD_PREP(H2C_HDR_H2C_SEQ, rtwdev->fw.h2c_seq));
260 
261 	hdr->hdr1 = cpu_to_le32(FIELD_PREP(H2C_HDR_TOTAL_LEN,
262 					   len + H2C_HEADER_LEN));
263 }
264 
265 static int __rtw89_fw_download_hdr(struct rtw89_dev *rtwdev, const u8 *fw, u32 len)
266 {
267 	struct sk_buff *skb;
268 	u32 ret = 0;
269 
270 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(len);
271 	if (!skb) {
272 		rtw89_err(rtwdev, "failed to alloc skb for fw hdr dl\n");
273 		return -ENOMEM;
274 	}
275 
276 	skb_put_data(skb, fw, len);
277 	SET_FW_HDR_PART_SIZE(skb->data, FWDL_SECTION_PER_PKT_LEN);
278 	rtw89_h2c_pkt_set_hdr_fwdl(rtwdev, skb, FWCMD_TYPE_H2C,
279 				   H2C_CAT_MAC, H2C_CL_MAC_FWDL,
280 				   H2C_FUNC_MAC_FWHDR_DL, len);
281 
282 	ret = rtw89_h2c_tx(rtwdev, skb, false);
283 	if (ret) {
284 		rtw89_err(rtwdev, "failed to send h2c\n");
285 		ret = -1;
286 		goto fail;
287 	}
288 
289 	return 0;
290 fail:
291 	dev_kfree_skb_any(skb);
292 
293 	return ret;
294 }
295 
296 static int rtw89_fw_download_hdr(struct rtw89_dev *rtwdev, const u8 *fw, u32 len)
297 {
298 	u8 val;
299 	int ret;
300 
301 	ret = __rtw89_fw_download_hdr(rtwdev, fw, len);
302 	if (ret) {
303 		rtw89_err(rtwdev, "[ERR]FW header download\n");
304 		return ret;
305 	}
306 
307 	ret = read_poll_timeout_atomic(rtw89_read8, val, val & B_AX_FWDL_PATH_RDY,
308 				       1, FWDL_WAIT_CNT, false,
309 				       rtwdev, R_AX_WCPU_FW_CTRL);
310 	if (ret) {
311 		rtw89_err(rtwdev, "[ERR]FWDL path ready\n");
312 		return ret;
313 	}
314 
315 	rtw89_write32(rtwdev, R_AX_HALT_H2C_CTRL, 0);
316 	rtw89_write32(rtwdev, R_AX_HALT_C2H_CTRL, 0);
317 
318 	return 0;
319 }
320 
321 static int __rtw89_fw_download_main(struct rtw89_dev *rtwdev,
322 				    struct rtw89_fw_hdr_section_info *info)
323 {
324 	struct sk_buff *skb;
325 	const u8 *section = info->addr;
326 	u32 residue_len = info->len;
327 	u32 pkt_len;
328 	int ret;
329 
330 	while (residue_len) {
331 		if (residue_len >= FWDL_SECTION_PER_PKT_LEN)
332 			pkt_len = FWDL_SECTION_PER_PKT_LEN;
333 		else
334 			pkt_len = residue_len;
335 
336 		skb = rtw89_fw_h2c_alloc_skb_no_hdr(pkt_len);
337 		if (!skb) {
338 			rtw89_err(rtwdev, "failed to alloc skb for fw dl\n");
339 			return -ENOMEM;
340 		}
341 		skb_put_data(skb, section, pkt_len);
342 
343 		ret = rtw89_h2c_tx(rtwdev, skb, true);
344 		if (ret) {
345 			rtw89_err(rtwdev, "failed to send h2c\n");
346 			ret = -1;
347 			goto fail;
348 		}
349 
350 		section += pkt_len;
351 		residue_len -= pkt_len;
352 	}
353 
354 	return 0;
355 fail:
356 	dev_kfree_skb_any(skb);
357 
358 	return ret;
359 }
360 
361 static int rtw89_fw_download_main(struct rtw89_dev *rtwdev, const u8 *fw,
362 				  struct rtw89_fw_bin_info *info)
363 {
364 	struct rtw89_fw_hdr_section_info *section_info = info->section_info;
365 	u8 section_num = info->section_num;
366 	int ret;
367 
368 	while (section_num--) {
369 		ret = __rtw89_fw_download_main(rtwdev, section_info);
370 		if (ret)
371 			return ret;
372 		section_info++;
373 	}
374 
375 	mdelay(5);
376 
377 	ret = rtw89_fw_check_rdy(rtwdev);
378 	if (ret) {
379 		rtw89_warn(rtwdev, "download firmware fail\n");
380 		return ret;
381 	}
382 
383 	return 0;
384 }
385 
386 static void rtw89_fw_prog_cnt_dump(struct rtw89_dev *rtwdev)
387 {
388 	u32 val32;
389 	u16 index;
390 
391 	rtw89_write32(rtwdev, R_AX_DBG_CTRL,
392 		      FIELD_PREP(B_AX_DBG_SEL0, FW_PROG_CNTR_DBG_SEL) |
393 		      FIELD_PREP(B_AX_DBG_SEL1, FW_PROG_CNTR_DBG_SEL));
394 	rtw89_write32_mask(rtwdev, R_AX_SYS_STATUS1, B_AX_SEL_0XC0_MASK, MAC_DBG_SEL);
395 
396 	for (index = 0; index < 15; index++) {
397 		val32 = rtw89_read32(rtwdev, R_AX_DBG_PORT_SEL);
398 		rtw89_err(rtwdev, "[ERR]fw PC = 0x%x\n", val32);
399 		fsleep(10);
400 	}
401 }
402 
403 static void rtw89_fw_dl_fail_dump(struct rtw89_dev *rtwdev)
404 {
405 	u32 val32;
406 	u16 val16;
407 
408 	val32 = rtw89_read32(rtwdev, R_AX_WCPU_FW_CTRL);
409 	rtw89_err(rtwdev, "[ERR]fwdl 0x1E0 = 0x%x\n", val32);
410 
411 	val16 = rtw89_read16(rtwdev, R_AX_BOOT_DBG + 2);
412 	rtw89_err(rtwdev, "[ERR]fwdl 0x83F2 = 0x%x\n", val16);
413 
414 	rtw89_fw_prog_cnt_dump(rtwdev);
415 }
416 
417 int rtw89_fw_download(struct rtw89_dev *rtwdev, enum rtw89_fw_type type)
418 {
419 	struct rtw89_fw_info *fw_info = &rtwdev->fw;
420 	struct rtw89_fw_suit *fw_suit = rtw89_fw_suit_get(rtwdev, type);
421 	struct rtw89_fw_bin_info info;
422 	const u8 *fw = fw_suit->data;
423 	u32 len = fw_suit->size;
424 	u8 val;
425 	int ret;
426 
427 	if (!fw || !len) {
428 		rtw89_err(rtwdev, "fw type %d isn't recognized\n", type);
429 		return -ENOENT;
430 	}
431 
432 	ret = rtw89_fw_hdr_parser(rtwdev, fw, len, &info);
433 	if (ret) {
434 		rtw89_err(rtwdev, "parse fw header fail\n");
435 		goto fwdl_err;
436 	}
437 
438 	ret = read_poll_timeout_atomic(rtw89_read8, val, val & B_AX_H2C_PATH_RDY,
439 				       1, FWDL_WAIT_CNT, false,
440 				       rtwdev, R_AX_WCPU_FW_CTRL);
441 	if (ret) {
442 		rtw89_err(rtwdev, "[ERR]H2C path ready\n");
443 		goto fwdl_err;
444 	}
445 
446 	ret = rtw89_fw_download_hdr(rtwdev, fw, info.hdr_len);
447 	if (ret) {
448 		ret = -EBUSY;
449 		goto fwdl_err;
450 	}
451 
452 	ret = rtw89_fw_download_main(rtwdev, fw, &info);
453 	if (ret) {
454 		ret = -EBUSY;
455 		goto fwdl_err;
456 	}
457 
458 	fw_info->h2c_seq = 0;
459 	fw_info->rec_seq = 0;
460 	rtwdev->mac.rpwm_seq_num = RPWM_SEQ_NUM_MAX;
461 	rtwdev->mac.cpwm_seq_num = CPWM_SEQ_NUM_MAX;
462 
463 	return ret;
464 
465 fwdl_err:
466 	rtw89_fw_dl_fail_dump(rtwdev);
467 	return ret;
468 }
469 
470 int rtw89_wait_firmware_completion(struct rtw89_dev *rtwdev)
471 {
472 	struct rtw89_fw_info *fw = &rtwdev->fw;
473 
474 	wait_for_completion(&fw->completion);
475 	if (!fw->firmware)
476 		return -EINVAL;
477 
478 	return 0;
479 }
480 
481 static void rtw89_load_firmware_cb(const struct firmware *firmware, void *context)
482 {
483 	struct rtw89_fw_info *fw = context;
484 	struct rtw89_dev *rtwdev = fw->rtwdev;
485 
486 	if (!firmware || !firmware->data) {
487 		rtw89_err(rtwdev, "failed to request firmware\n");
488 		complete_all(&fw->completion);
489 		return;
490 	}
491 
492 	fw->firmware = firmware;
493 	complete_all(&fw->completion);
494 }
495 
496 int rtw89_load_firmware(struct rtw89_dev *rtwdev)
497 {
498 	struct rtw89_fw_info *fw = &rtwdev->fw;
499 	const char *fw_name = rtwdev->chip->fw_name;
500 	int ret;
501 
502 	fw->rtwdev = rtwdev;
503 	init_completion(&fw->completion);
504 
505 	ret = request_firmware_nowait(THIS_MODULE, true, fw_name, rtwdev->dev,
506 				      GFP_KERNEL, fw, rtw89_load_firmware_cb);
507 	if (ret) {
508 		rtw89_err(rtwdev, "failed to async firmware request\n");
509 		return ret;
510 	}
511 
512 	return 0;
513 }
514 
515 void rtw89_unload_firmware(struct rtw89_dev *rtwdev)
516 {
517 	struct rtw89_fw_info *fw = &rtwdev->fw;
518 
519 	rtw89_wait_firmware_completion(rtwdev);
520 
521 	if (fw->firmware)
522 		release_firmware(fw->firmware);
523 }
524 
525 #define H2C_CAM_LEN 60
526 int rtw89_fw_h2c_cam(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif,
527 		     struct rtw89_sta *rtwsta, const u8 *scan_mac_addr)
528 {
529 	struct sk_buff *skb;
530 
531 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(H2C_CAM_LEN);
532 	if (!skb) {
533 		rtw89_err(rtwdev, "failed to alloc skb for fw dl\n");
534 		return -ENOMEM;
535 	}
536 	skb_put(skb, H2C_CAM_LEN);
537 	rtw89_cam_fill_addr_cam_info(rtwdev, rtwvif, rtwsta, scan_mac_addr, skb->data);
538 	rtw89_cam_fill_bssid_cam_info(rtwdev, rtwvif, skb->data);
539 
540 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
541 			      H2C_CAT_MAC,
542 			      H2C_CL_MAC_ADDR_CAM_UPDATE,
543 			      H2C_FUNC_MAC_ADDR_CAM_UPD, 0, 1,
544 			      H2C_CAM_LEN);
545 
546 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
547 		rtw89_err(rtwdev, "failed to send h2c\n");
548 		goto fail;
549 	}
550 
551 	return 0;
552 fail:
553 	dev_kfree_skb_any(skb);
554 
555 	return -EBUSY;
556 }
557 
558 #define H2C_BA_CAM_LEN 4
559 int rtw89_fw_h2c_ba_cam(struct rtw89_dev *rtwdev, bool valid, u8 macid,
560 			struct ieee80211_ampdu_params *params)
561 {
562 	struct sk_buff *skb;
563 
564 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(H2C_BA_CAM_LEN);
565 	if (!skb) {
566 		rtw89_err(rtwdev, "failed to alloc skb for h2c ba cam\n");
567 		return -ENOMEM;
568 	}
569 	skb_put(skb, H2C_BA_CAM_LEN);
570 	SET_BA_CAM_MACID(skb->data, macid);
571 	if (!valid)
572 		goto end;
573 	SET_BA_CAM_VALID(skb->data, valid);
574 	SET_BA_CAM_TID(skb->data, params->tid);
575 	if (params->buf_size > 64)
576 		SET_BA_CAM_BMAP_SIZE(skb->data, 4);
577 	else
578 		SET_BA_CAM_BMAP_SIZE(skb->data, 0);
579 	/* If init req is set, hw will set the ssn */
580 	SET_BA_CAM_INIT_REQ(skb->data, 0);
581 	SET_BA_CAM_SSN(skb->data, params->ssn);
582 
583 end:
584 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
585 			      H2C_CAT_MAC,
586 			      H2C_CL_BA_CAM,
587 			      H2C_FUNC_MAC_BA_CAM, 0, 1,
588 			      H2C_BA_CAM_LEN);
589 
590 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
591 		rtw89_err(rtwdev, "failed to send h2c\n");
592 		goto fail;
593 	}
594 
595 	return 0;
596 fail:
597 	dev_kfree_skb_any(skb);
598 
599 	return -EBUSY;
600 }
601 
602 #define H2C_LOG_CFG_LEN 12
603 int rtw89_fw_h2c_fw_log(struct rtw89_dev *rtwdev, bool enable)
604 {
605 	struct sk_buff *skb;
606 	u32 comp = enable ? BIT(RTW89_FW_LOG_COMP_INIT) | BIT(RTW89_FW_LOG_COMP_TASK) |
607 			    BIT(RTW89_FW_LOG_COMP_PS) | BIT(RTW89_FW_LOG_COMP_ERROR) : 0;
608 
609 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(H2C_LOG_CFG_LEN);
610 	if (!skb) {
611 		rtw89_err(rtwdev, "failed to alloc skb for fw log cfg\n");
612 		return -ENOMEM;
613 	}
614 
615 	skb_put(skb, H2C_LOG_CFG_LEN);
616 	SET_LOG_CFG_LEVEL(skb->data, RTW89_FW_LOG_LEVEL_SER);
617 	SET_LOG_CFG_PATH(skb->data, BIT(RTW89_FW_LOG_LEVEL_C2H));
618 	SET_LOG_CFG_COMP(skb->data, comp);
619 	SET_LOG_CFG_COMP_EXT(skb->data, 0);
620 
621 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
622 			      H2C_CAT_MAC,
623 			      H2C_CL_FW_INFO,
624 			      H2C_FUNC_LOG_CFG, 0, 0,
625 			      H2C_LOG_CFG_LEN);
626 
627 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
628 		rtw89_err(rtwdev, "failed to send h2c\n");
629 		goto fail;
630 	}
631 
632 	return 0;
633 fail:
634 	dev_kfree_skb_any(skb);
635 
636 	return -EBUSY;
637 }
638 
639 #define H2C_GENERAL_PKT_LEN 6
640 #define H2C_GENERAL_PKT_ID_UND 0xff
641 int rtw89_fw_h2c_general_pkt(struct rtw89_dev *rtwdev, u8 macid)
642 {
643 	struct sk_buff *skb;
644 
645 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(H2C_GENERAL_PKT_LEN);
646 	if (!skb) {
647 		rtw89_err(rtwdev, "failed to alloc skb for fw dl\n");
648 		return -ENOMEM;
649 	}
650 	skb_put(skb, H2C_GENERAL_PKT_LEN);
651 	SET_GENERAL_PKT_MACID(skb->data, macid);
652 	SET_GENERAL_PKT_PROBRSP_ID(skb->data, H2C_GENERAL_PKT_ID_UND);
653 	SET_GENERAL_PKT_PSPOLL_ID(skb->data, H2C_GENERAL_PKT_ID_UND);
654 	SET_GENERAL_PKT_NULL_ID(skb->data, H2C_GENERAL_PKT_ID_UND);
655 	SET_GENERAL_PKT_QOS_NULL_ID(skb->data, H2C_GENERAL_PKT_ID_UND);
656 	SET_GENERAL_PKT_CTS2SELF_ID(skb->data, H2C_GENERAL_PKT_ID_UND);
657 
658 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
659 			      H2C_CAT_MAC,
660 			      H2C_CL_FW_INFO,
661 			      H2C_FUNC_MAC_GENERAL_PKT, 0, 1,
662 			      H2C_GENERAL_PKT_LEN);
663 
664 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
665 		rtw89_err(rtwdev, "failed to send h2c\n");
666 		goto fail;
667 	}
668 
669 	return 0;
670 fail:
671 	dev_kfree_skb_any(skb);
672 
673 	return -EBUSY;
674 }
675 
676 #define H2C_LPS_PARM_LEN 8
677 int rtw89_fw_h2c_lps_parm(struct rtw89_dev *rtwdev,
678 			  struct rtw89_lps_parm *lps_param)
679 {
680 	struct sk_buff *skb;
681 
682 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(H2C_LPS_PARM_LEN);
683 	if (!skb) {
684 		rtw89_err(rtwdev, "failed to alloc skb for fw dl\n");
685 		return -ENOMEM;
686 	}
687 	skb_put(skb, H2C_LPS_PARM_LEN);
688 
689 	SET_LPS_PARM_MACID(skb->data, lps_param->macid);
690 	SET_LPS_PARM_PSMODE(skb->data, lps_param->psmode);
691 	SET_LPS_PARM_LASTRPWM(skb->data, lps_param->lastrpwm);
692 	SET_LPS_PARM_RLBM(skb->data, 1);
693 	SET_LPS_PARM_SMARTPS(skb->data, 1);
694 	SET_LPS_PARM_AWAKEINTERVAL(skb->data, 1);
695 	SET_LPS_PARM_VOUAPSD(skb->data, 0);
696 	SET_LPS_PARM_VIUAPSD(skb->data, 0);
697 	SET_LPS_PARM_BEUAPSD(skb->data, 0);
698 	SET_LPS_PARM_BKUAPSD(skb->data, 0);
699 
700 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
701 			      H2C_CAT_MAC,
702 			      H2C_CL_MAC_PS,
703 			      H2C_FUNC_MAC_LPS_PARM, 0, 1,
704 			      H2C_LPS_PARM_LEN);
705 
706 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
707 		rtw89_err(rtwdev, "failed to send h2c\n");
708 		goto fail;
709 	}
710 
711 	return 0;
712 fail:
713 	dev_kfree_skb_any(skb);
714 
715 	return -EBUSY;
716 }
717 
718 #define H2C_CMC_TBL_LEN 68
719 int rtw89_fw_h2c_default_cmac_tbl(struct rtw89_dev *rtwdev, u8 macid)
720 {
721 	struct rtw89_hal *hal = &rtwdev->hal;
722 	struct sk_buff *skb;
723 	u8 ntx_path = hal->antenna_tx ? hal->antenna_tx : RF_B;
724 	u8 map_b = hal->antenna_tx == RF_AB ? 1 : 0;
725 
726 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(H2C_CMC_TBL_LEN);
727 	if (!skb) {
728 		rtw89_err(rtwdev, "failed to alloc skb for fw dl\n");
729 		return -ENOMEM;
730 	}
731 	skb_put(skb, H2C_CMC_TBL_LEN);
732 	SET_CTRL_INFO_MACID(skb->data, macid);
733 	SET_CTRL_INFO_OPERATION(skb->data, 1);
734 	SET_CMC_TBL_TXPWR_MODE(skb->data, 0);
735 	SET_CMC_TBL_NTX_PATH_EN(skb->data, ntx_path);
736 	SET_CMC_TBL_PATH_MAP_A(skb->data, 0);
737 	SET_CMC_TBL_PATH_MAP_B(skb->data, map_b);
738 	SET_CMC_TBL_PATH_MAP_C(skb->data, 0);
739 	SET_CMC_TBL_PATH_MAP_D(skb->data, 0);
740 	SET_CMC_TBL_ANTSEL_A(skb->data, 0);
741 	SET_CMC_TBL_ANTSEL_B(skb->data, 0);
742 	SET_CMC_TBL_ANTSEL_C(skb->data, 0);
743 	SET_CMC_TBL_ANTSEL_D(skb->data, 0);
744 	SET_CMC_TBL_DOPPLER_CTRL(skb->data, 0);
745 	SET_CMC_TBL_TXPWR_TOLERENCE(skb->data, 0);
746 
747 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
748 			      H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,
749 			      H2C_FUNC_MAC_CCTLINFO_UD, 0, 1,
750 			      H2C_CMC_TBL_LEN);
751 
752 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
753 		rtw89_err(rtwdev, "failed to send h2c\n");
754 		goto fail;
755 	}
756 
757 	return 0;
758 fail:
759 	dev_kfree_skb_any(skb);
760 
761 	return -EBUSY;
762 }
763 
764 static void __get_sta_he_pkt_padding(struct rtw89_dev *rtwdev,
765 				     struct ieee80211_sta *sta, u8 *pads)
766 {
767 	bool ppe_th;
768 	u8 ppe16, ppe8;
769 	u8 nss = min(sta->rx_nss, rtwdev->hal.tx_nss) - 1;
770 	u8 ppe_thres_hdr = sta->he_cap.ppe_thres[0];
771 	u8 ru_bitmap;
772 	u8 n, idx, sh;
773 	u16 ppe;
774 	int i;
775 
776 	if (!sta->he_cap.has_he)
777 		return;
778 
779 	ppe_th = FIELD_GET(IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT,
780 			   sta->he_cap.he_cap_elem.phy_cap_info[6]);
781 	if (!ppe_th) {
782 		u8 pad;
783 
784 		pad = FIELD_GET(IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_MASK,
785 				sta->he_cap.he_cap_elem.phy_cap_info[9]);
786 
787 		for (i = 0; i < RTW89_PPE_BW_NUM; i++)
788 			pads[i] = pad;
789 	}
790 
791 	ru_bitmap = FIELD_GET(IEEE80211_PPE_THRES_RU_INDEX_BITMASK_MASK, ppe_thres_hdr);
792 	n = hweight8(ru_bitmap);
793 	n = 7 + (n * IEEE80211_PPE_THRES_INFO_PPET_SIZE * 2) * nss;
794 
795 	for (i = 0; i < RTW89_PPE_BW_NUM; i++) {
796 		if (!(ru_bitmap & BIT(i))) {
797 			pads[i] = 1;
798 			continue;
799 		}
800 
801 		idx = n >> 3;
802 		sh = n & 7;
803 		n += IEEE80211_PPE_THRES_INFO_PPET_SIZE * 2;
804 
805 		ppe = le16_to_cpu(*((__le16 *)&sta->he_cap.ppe_thres[idx]));
806 		ppe16 = (ppe >> sh) & IEEE80211_PPE_THRES_NSS_MASK;
807 		sh += IEEE80211_PPE_THRES_INFO_PPET_SIZE;
808 		ppe8 = (ppe >> sh) & IEEE80211_PPE_THRES_NSS_MASK;
809 
810 		if (ppe16 != 7 && ppe8 == 7)
811 			pads[i] = 2;
812 		else if (ppe8 != 7)
813 			pads[i] = 1;
814 		else
815 			pads[i] = 0;
816 	}
817 }
818 
819 int rtw89_fw_h2c_assoc_cmac_tbl(struct rtw89_dev *rtwdev,
820 				struct ieee80211_vif *vif,
821 				struct ieee80211_sta *sta)
822 {
823 	struct rtw89_hal *hal = &rtwdev->hal;
824 	struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv;
825 	struct rtw89_vif *rtwvif = (struct rtw89_vif *)vif->drv_priv;
826 	struct sk_buff *skb;
827 	u8 pads[RTW89_PPE_BW_NUM];
828 
829 	memset(pads, 0, sizeof(pads));
830 	__get_sta_he_pkt_padding(rtwdev, sta, pads);
831 
832 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(H2C_CMC_TBL_LEN);
833 	if (!skb) {
834 		rtw89_err(rtwdev, "failed to alloc skb for fw dl\n");
835 		return -ENOMEM;
836 	}
837 	skb_put(skb, H2C_CMC_TBL_LEN);
838 	SET_CTRL_INFO_MACID(skb->data, rtwsta->mac_id);
839 	SET_CTRL_INFO_OPERATION(skb->data, 1);
840 	SET_CMC_TBL_DISRTSFB(skb->data, 1);
841 	SET_CMC_TBL_DISDATAFB(skb->data, 1);
842 	if (hal->current_band_type == RTW89_BAND_2G)
843 		SET_CMC_TBL_RTS_RTY_LOWEST_RATE(skb->data, RTW89_HW_RATE_CCK1);
844 	else
845 		SET_CMC_TBL_RTS_RTY_LOWEST_RATE(skb->data, RTW89_HW_RATE_OFDM6);
846 	SET_CMC_TBL_RTS_TXCNT_LMT_SEL(skb->data, 0);
847 	SET_CMC_TBL_DATA_TXCNT_LMT_SEL(skb->data, 0);
848 	if (vif->type == NL80211_IFTYPE_STATION)
849 		SET_CMC_TBL_ULDL(skb->data, 1);
850 	else
851 		SET_CMC_TBL_ULDL(skb->data, 0);
852 	SET_CMC_TBL_MULTI_PORT_ID(skb->data, rtwvif->port);
853 	SET_CMC_TBL_NOMINAL_PKT_PADDING(skb->data, pads[RTW89_CHANNEL_WIDTH_20]);
854 	SET_CMC_TBL_NOMINAL_PKT_PADDING40(skb->data, pads[RTW89_CHANNEL_WIDTH_40]);
855 	SET_CMC_TBL_NOMINAL_PKT_PADDING80(skb->data, pads[RTW89_CHANNEL_WIDTH_80]);
856 	SET_CMC_TBL_BSR_QUEUE_SIZE_FORMAT(skb->data, sta->he_cap.has_he);
857 
858 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
859 			      H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,
860 			      H2C_FUNC_MAC_CCTLINFO_UD, 0, 1,
861 			      H2C_CMC_TBL_LEN);
862 
863 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
864 		rtw89_err(rtwdev, "failed to send h2c\n");
865 		goto fail;
866 	}
867 
868 	return 0;
869 fail:
870 	dev_kfree_skb_any(skb);
871 
872 	return -EBUSY;
873 }
874 
875 int rtw89_fw_h2c_txtime_cmac_tbl(struct rtw89_dev *rtwdev,
876 				 struct rtw89_sta *rtwsta)
877 {
878 	struct sk_buff *skb;
879 
880 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(H2C_CMC_TBL_LEN);
881 	if (!skb) {
882 		rtw89_err(rtwdev, "failed to alloc skb for fw dl\n");
883 		return -ENOMEM;
884 	}
885 	skb_put(skb, H2C_CMC_TBL_LEN);
886 	SET_CTRL_INFO_MACID(skb->data, rtwsta->mac_id);
887 	SET_CTRL_INFO_OPERATION(skb->data, 1);
888 	if (rtwsta->cctl_tx_time) {
889 		SET_CMC_TBL_AMPDU_TIME_SEL(skb->data, 1);
890 		SET_CMC_TBL_AMPDU_MAX_TIME(skb->data, rtwsta->ampdu_max_time);
891 	}
892 	if (rtwsta->cctl_tx_retry_limit) {
893 		SET_CMC_TBL_DATA_TXCNT_LMT_SEL(skb->data, 1);
894 		SET_CMC_TBL_DATA_TX_CNT_LMT(skb->data, rtwsta->data_tx_cnt_lmt);
895 	}
896 
897 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
898 			      H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,
899 			      H2C_FUNC_MAC_CCTLINFO_UD, 0, 1,
900 			      H2C_CMC_TBL_LEN);
901 
902 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
903 		rtw89_err(rtwdev, "failed to send h2c\n");
904 		goto fail;
905 	}
906 
907 	return 0;
908 fail:
909 	dev_kfree_skb_any(skb);
910 
911 	return -EBUSY;
912 }
913 
914 #define H2C_VIF_MAINTAIN_LEN 4
915 int rtw89_fw_h2c_vif_maintain(struct rtw89_dev *rtwdev,
916 			      struct rtw89_vif *rtwvif,
917 			      enum rtw89_upd_mode upd_mode)
918 {
919 	struct sk_buff *skb;
920 
921 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(H2C_VIF_MAINTAIN_LEN);
922 	if (!skb) {
923 		rtw89_err(rtwdev, "failed to alloc skb for h2c join\n");
924 		return -ENOMEM;
925 	}
926 	skb_put(skb, H2C_VIF_MAINTAIN_LEN);
927 	SET_FWROLE_MAINTAIN_MACID(skb->data, rtwvif->mac_id);
928 	SET_FWROLE_MAINTAIN_SELF_ROLE(skb->data, rtwvif->self_role);
929 	SET_FWROLE_MAINTAIN_UPD_MODE(skb->data, upd_mode);
930 	SET_FWROLE_MAINTAIN_WIFI_ROLE(skb->data, rtwvif->wifi_role);
931 
932 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
933 			      H2C_CAT_MAC, H2C_CL_MAC_MEDIA_RPT,
934 			      H2C_FUNC_MAC_FWROLE_MAINTAIN, 0, 1,
935 			      H2C_VIF_MAINTAIN_LEN);
936 
937 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
938 		rtw89_err(rtwdev, "failed to send h2c\n");
939 		goto fail;
940 	}
941 
942 	return 0;
943 fail:
944 	dev_kfree_skb_any(skb);
945 
946 	return -EBUSY;
947 }
948 
949 #define H2C_JOIN_INFO_LEN 4
950 int rtw89_fw_h2c_join_info(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif,
951 			   u8 dis_conn)
952 {
953 	struct sk_buff *skb;
954 
955 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(H2C_JOIN_INFO_LEN);
956 	if (!skb) {
957 		rtw89_err(rtwdev, "failed to alloc skb for h2c join\n");
958 		return -ENOMEM;
959 	}
960 	skb_put(skb, H2C_JOIN_INFO_LEN);
961 	SET_JOININFO_MACID(skb->data, rtwvif->mac_id);
962 	SET_JOININFO_OP(skb->data, dis_conn);
963 	SET_JOININFO_BAND(skb->data, rtwvif->mac_idx);
964 	SET_JOININFO_WMM(skb->data, rtwvif->wmm);
965 	SET_JOININFO_TGR(skb->data, rtwvif->trigger);
966 	SET_JOININFO_ISHESTA(skb->data, 0);
967 	SET_JOININFO_DLBW(skb->data, 0);
968 	SET_JOININFO_TF_MAC_PAD(skb->data, 0);
969 	SET_JOININFO_DL_T_PE(skb->data, 0);
970 	SET_JOININFO_PORT_ID(skb->data, rtwvif->port);
971 	SET_JOININFO_NET_TYPE(skb->data, rtwvif->net_type);
972 	SET_JOININFO_WIFI_ROLE(skb->data, rtwvif->wifi_role);
973 	SET_JOININFO_SELF_ROLE(skb->data, rtwvif->self_role);
974 
975 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
976 			      H2C_CAT_MAC, H2C_CL_MAC_MEDIA_RPT,
977 			      H2C_FUNC_MAC_JOININFO, 0, 1,
978 			      H2C_JOIN_INFO_LEN);
979 
980 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
981 		rtw89_err(rtwdev, "failed to send h2c\n");
982 		goto fail;
983 	}
984 
985 	return 0;
986 fail:
987 	dev_kfree_skb_any(skb);
988 
989 	return -EBUSY;
990 }
991 
992 int rtw89_fw_h2c_macid_pause(struct rtw89_dev *rtwdev, u8 sh, u8 grp,
993 			     bool pause)
994 {
995 	struct rtw89_fw_macid_pause_grp h2c = {{0}};
996 	u8 len = sizeof(struct rtw89_fw_macid_pause_grp);
997 	struct sk_buff *skb;
998 
999 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(H2C_JOIN_INFO_LEN);
1000 	if (!skb) {
1001 		rtw89_err(rtwdev, "failed to alloc skb for h2c join\n");
1002 		return -ENOMEM;
1003 	}
1004 	h2c.mask_grp[grp] = cpu_to_le32(BIT(sh));
1005 	if (pause)
1006 		h2c.pause_grp[grp] = cpu_to_le32(BIT(sh));
1007 	skb_put_data(skb, &h2c, len);
1008 
1009 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
1010 			      H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,
1011 			      H2C_FUNC_MAC_MACID_PAUSE, 1, 0,
1012 			      len);
1013 
1014 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
1015 		rtw89_err(rtwdev, "failed to send h2c\n");
1016 		goto fail;
1017 	}
1018 
1019 	return 0;
1020 fail:
1021 	dev_kfree_skb_any(skb);
1022 
1023 	return -EBUSY;
1024 }
1025 
1026 #define H2C_EDCA_LEN 12
1027 int rtw89_fw_h2c_set_edca(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif,
1028 			  u8 ac, u32 val)
1029 {
1030 	struct sk_buff *skb;
1031 
1032 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(H2C_EDCA_LEN);
1033 	if (!skb) {
1034 		rtw89_err(rtwdev, "failed to alloc skb for h2c edca\n");
1035 		return -ENOMEM;
1036 	}
1037 	skb_put(skb, H2C_EDCA_LEN);
1038 	RTW89_SET_EDCA_SEL(skb->data, 0);
1039 	RTW89_SET_EDCA_BAND(skb->data, rtwvif->mac_idx);
1040 	RTW89_SET_EDCA_WMM(skb->data, 0);
1041 	RTW89_SET_EDCA_AC(skb->data, ac);
1042 	RTW89_SET_EDCA_PARAM(skb->data, val);
1043 
1044 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
1045 			      H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,
1046 			      H2C_FUNC_USR_EDCA, 0, 1,
1047 			      H2C_EDCA_LEN);
1048 
1049 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
1050 		rtw89_err(rtwdev, "failed to send h2c\n");
1051 		goto fail;
1052 	}
1053 
1054 	return 0;
1055 fail:
1056 	dev_kfree_skb_any(skb);
1057 
1058 	return -EBUSY;
1059 }
1060 
1061 #define H2C_OFLD_CFG_LEN 8
1062 int rtw89_fw_h2c_set_ofld_cfg(struct rtw89_dev *rtwdev)
1063 {
1064 	static const u8 cfg[] = {0x09, 0x00, 0x00, 0x00, 0x5e, 0x00, 0x00, 0x00};
1065 	struct sk_buff *skb;
1066 
1067 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(H2C_OFLD_CFG_LEN);
1068 	if (!skb) {
1069 		rtw89_err(rtwdev, "failed to alloc skb for h2c ofld\n");
1070 		return -ENOMEM;
1071 	}
1072 	skb_put_data(skb, cfg, H2C_OFLD_CFG_LEN);
1073 
1074 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
1075 			      H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,
1076 			      H2C_FUNC_OFLD_CFG, 0, 1,
1077 			      H2C_OFLD_CFG_LEN);
1078 
1079 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
1080 		rtw89_err(rtwdev, "failed to send h2c\n");
1081 		goto fail;
1082 	}
1083 
1084 	return 0;
1085 fail:
1086 	dev_kfree_skb_any(skb);
1087 
1088 	return -EBUSY;
1089 }
1090 
1091 #define H2C_RA_LEN 16
1092 int rtw89_fw_h2c_ra(struct rtw89_dev *rtwdev, struct rtw89_ra_info *ra, bool csi)
1093 {
1094 	struct sk_buff *skb;
1095 	u8 *cmd;
1096 
1097 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(H2C_RA_LEN);
1098 	if (!skb) {
1099 		rtw89_err(rtwdev, "failed to alloc skb for h2c join\n");
1100 		return -ENOMEM;
1101 	}
1102 	skb_put(skb, H2C_RA_LEN);
1103 	cmd = skb->data;
1104 	rtw89_debug(rtwdev, RTW89_DBG_RA,
1105 		    "ra cmd msk: %llx ", ra->ra_mask);
1106 
1107 	RTW89_SET_FWCMD_RA_MODE(cmd, ra->mode_ctrl);
1108 	RTW89_SET_FWCMD_RA_BW_CAP(cmd, ra->bw_cap);
1109 	RTW89_SET_FWCMD_RA_MACID(cmd, ra->macid);
1110 	RTW89_SET_FWCMD_RA_DCM(cmd, ra->dcm_cap);
1111 	RTW89_SET_FWCMD_RA_ER(cmd, ra->er_cap);
1112 	RTW89_SET_FWCMD_RA_INIT_RATE_LV(cmd, ra->init_rate_lv);
1113 	RTW89_SET_FWCMD_RA_UPD_ALL(cmd, ra->upd_all);
1114 	RTW89_SET_FWCMD_RA_SGI(cmd, ra->en_sgi);
1115 	RTW89_SET_FWCMD_RA_LDPC(cmd, ra->ldpc_cap);
1116 	RTW89_SET_FWCMD_RA_STBC(cmd, ra->stbc_cap);
1117 	RTW89_SET_FWCMD_RA_SS_NUM(cmd, ra->ss_num);
1118 	RTW89_SET_FWCMD_RA_GILTF(cmd, ra->giltf);
1119 	RTW89_SET_FWCMD_RA_UPD_BW_NSS_MASK(cmd, ra->upd_bw_nss_mask);
1120 	RTW89_SET_FWCMD_RA_UPD_MASK(cmd, ra->upd_mask);
1121 	RTW89_SET_FWCMD_RA_MASK_0(cmd, FIELD_GET(MASKBYTE0, ra->ra_mask));
1122 	RTW89_SET_FWCMD_RA_MASK_1(cmd, FIELD_GET(MASKBYTE1, ra->ra_mask));
1123 	RTW89_SET_FWCMD_RA_MASK_2(cmd, FIELD_GET(MASKBYTE2, ra->ra_mask));
1124 	RTW89_SET_FWCMD_RA_MASK_3(cmd, FIELD_GET(MASKBYTE3, ra->ra_mask));
1125 	RTW89_SET_FWCMD_RA_MASK_4(cmd, FIELD_GET(MASKBYTE4, ra->ra_mask));
1126 
1127 	if (csi) {
1128 		RTW89_SET_FWCMD_RA_BFEE_CSI_CTL(cmd, 1);
1129 		RTW89_SET_FWCMD_RA_BAND_NUM(cmd, ra->band_num);
1130 		RTW89_SET_FWCMD_RA_CR_TBL_SEL(cmd, ra->cr_tbl_sel);
1131 		RTW89_SET_FWCMD_RA_FIXED_CSI_RATE_EN(cmd, ra->fixed_csi_rate_en);
1132 		RTW89_SET_FWCMD_RA_RA_CSI_RATE_EN(cmd, ra->ra_csi_rate_en);
1133 		RTW89_SET_FWCMD_RA_FIXED_CSI_MCS_SS_IDX(cmd, ra->csi_mcs_ss_idx);
1134 		RTW89_SET_FWCMD_RA_FIXED_CSI_MODE(cmd, ra->csi_mode);
1135 		RTW89_SET_FWCMD_RA_FIXED_CSI_GI_LTF(cmd, ra->csi_gi_ltf);
1136 		RTW89_SET_FWCMD_RA_FIXED_CSI_BW(cmd, ra->csi_bw);
1137 	}
1138 
1139 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
1140 			      H2C_CAT_OUTSRC, H2C_CL_OUTSRC_RA,
1141 			      H2C_FUNC_OUTSRC_RA_MACIDCFG, 0, 0,
1142 			      H2C_RA_LEN);
1143 
1144 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
1145 		rtw89_err(rtwdev, "failed to send h2c\n");
1146 		goto fail;
1147 	}
1148 
1149 	return 0;
1150 fail:
1151 	dev_kfree_skb_any(skb);
1152 
1153 	return -EBUSY;
1154 }
1155 
1156 #define H2C_LEN_CXDRVHDR 2
1157 #define H2C_LEN_CXDRVINFO_INIT (12 + H2C_LEN_CXDRVHDR)
1158 int rtw89_fw_h2c_cxdrv_init(struct rtw89_dev *rtwdev)
1159 {
1160 	struct rtw89_btc *btc = &rtwdev->btc;
1161 	struct rtw89_btc_dm *dm = &btc->dm;
1162 	struct rtw89_btc_init_info *init_info = &dm->init_info;
1163 	struct rtw89_btc_module *module = &init_info->module;
1164 	struct rtw89_btc_ant_info *ant = &module->ant;
1165 	struct sk_buff *skb;
1166 	u8 *cmd;
1167 
1168 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(H2C_LEN_CXDRVINFO_INIT);
1169 	if (!skb) {
1170 		rtw89_err(rtwdev, "failed to alloc skb for h2c cxdrv_init\n");
1171 		return -ENOMEM;
1172 	}
1173 	skb_put(skb, H2C_LEN_CXDRVINFO_INIT);
1174 	cmd = skb->data;
1175 
1176 	RTW89_SET_FWCMD_CXHDR_TYPE(cmd, CXDRVINFO_INIT);
1177 	RTW89_SET_FWCMD_CXHDR_LEN(cmd, H2C_LEN_CXDRVINFO_INIT - H2C_LEN_CXDRVHDR);
1178 
1179 	RTW89_SET_FWCMD_CXINIT_ANT_TYPE(cmd, ant->type);
1180 	RTW89_SET_FWCMD_CXINIT_ANT_NUM(cmd, ant->num);
1181 	RTW89_SET_FWCMD_CXINIT_ANT_ISO(cmd, ant->isolation);
1182 	RTW89_SET_FWCMD_CXINIT_ANT_POS(cmd, ant->single_pos);
1183 	RTW89_SET_FWCMD_CXINIT_ANT_DIVERSITY(cmd, ant->diversity);
1184 
1185 	RTW89_SET_FWCMD_CXINIT_MOD_RFE(cmd, module->rfe_type);
1186 	RTW89_SET_FWCMD_CXINIT_MOD_CV(cmd, module->cv);
1187 	RTW89_SET_FWCMD_CXINIT_MOD_BT_SOLO(cmd, module->bt_solo);
1188 	RTW89_SET_FWCMD_CXINIT_MOD_BT_POS(cmd, module->bt_pos);
1189 	RTW89_SET_FWCMD_CXINIT_MOD_SW_TYPE(cmd, module->switch_type);
1190 
1191 	RTW89_SET_FWCMD_CXINIT_WL_GCH(cmd, init_info->wl_guard_ch);
1192 	RTW89_SET_FWCMD_CXINIT_WL_ONLY(cmd, init_info->wl_only);
1193 	RTW89_SET_FWCMD_CXINIT_WL_INITOK(cmd, init_info->wl_init_ok);
1194 	RTW89_SET_FWCMD_CXINIT_DBCC_EN(cmd, init_info->dbcc_en);
1195 	RTW89_SET_FWCMD_CXINIT_CX_OTHER(cmd, init_info->cx_other);
1196 	RTW89_SET_FWCMD_CXINIT_BT_ONLY(cmd, init_info->bt_only);
1197 
1198 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
1199 			      H2C_CAT_OUTSRC, BTFC_SET,
1200 			      SET_DRV_INFO, 0, 0,
1201 			      H2C_LEN_CXDRVINFO_INIT);
1202 
1203 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
1204 		rtw89_err(rtwdev, "failed to send h2c\n");
1205 		goto fail;
1206 	}
1207 
1208 	return 0;
1209 fail:
1210 	dev_kfree_skb_any(skb);
1211 
1212 	return -EBUSY;
1213 }
1214 
1215 #define H2C_LEN_CXDRVINFO_ROLE (4 + 12 * RTW89_MAX_HW_PORT_NUM + H2C_LEN_CXDRVHDR)
1216 int rtw89_fw_h2c_cxdrv_role(struct rtw89_dev *rtwdev)
1217 {
1218 	struct rtw89_btc *btc = &rtwdev->btc;
1219 	struct rtw89_btc_wl_info *wl = &btc->cx.wl;
1220 	struct rtw89_btc_wl_role_info *role_info = &wl->role_info;
1221 	struct rtw89_btc_wl_role_info_bpos *bpos = &role_info->role_map.role;
1222 	struct rtw89_btc_wl_active_role *active = role_info->active_role;
1223 	struct sk_buff *skb;
1224 	u8 *cmd;
1225 	int i;
1226 
1227 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(H2C_LEN_CXDRVINFO_ROLE);
1228 	if (!skb) {
1229 		rtw89_err(rtwdev, "failed to alloc skb for h2c cxdrv_role\n");
1230 		return -ENOMEM;
1231 	}
1232 	skb_put(skb, H2C_LEN_CXDRVINFO_ROLE);
1233 	cmd = skb->data;
1234 
1235 	RTW89_SET_FWCMD_CXHDR_TYPE(cmd, CXDRVINFO_ROLE);
1236 	RTW89_SET_FWCMD_CXHDR_LEN(cmd, H2C_LEN_CXDRVINFO_ROLE - H2C_LEN_CXDRVHDR);
1237 
1238 	RTW89_SET_FWCMD_CXROLE_CONNECT_CNT(cmd, role_info->connect_cnt);
1239 	RTW89_SET_FWCMD_CXROLE_LINK_MODE(cmd, role_info->link_mode);
1240 
1241 	RTW89_SET_FWCMD_CXROLE_ROLE_NONE(cmd, bpos->none);
1242 	RTW89_SET_FWCMD_CXROLE_ROLE_STA(cmd, bpos->station);
1243 	RTW89_SET_FWCMD_CXROLE_ROLE_AP(cmd, bpos->ap);
1244 	RTW89_SET_FWCMD_CXROLE_ROLE_VAP(cmd, bpos->vap);
1245 	RTW89_SET_FWCMD_CXROLE_ROLE_ADHOC(cmd, bpos->adhoc);
1246 	RTW89_SET_FWCMD_CXROLE_ROLE_ADHOC_MASTER(cmd, bpos->adhoc_master);
1247 	RTW89_SET_FWCMD_CXROLE_ROLE_MESH(cmd, bpos->mesh);
1248 	RTW89_SET_FWCMD_CXROLE_ROLE_MONITOR(cmd, bpos->moniter);
1249 	RTW89_SET_FWCMD_CXROLE_ROLE_P2P_DEV(cmd, bpos->p2p_device);
1250 	RTW89_SET_FWCMD_CXROLE_ROLE_P2P_GC(cmd, bpos->p2p_gc);
1251 	RTW89_SET_FWCMD_CXROLE_ROLE_P2P_GO(cmd, bpos->p2p_go);
1252 	RTW89_SET_FWCMD_CXROLE_ROLE_NAN(cmd, bpos->nan);
1253 
1254 	for (i = 0; i < RTW89_MAX_HW_PORT_NUM; i++, active++) {
1255 		RTW89_SET_FWCMD_CXROLE_ACT_CONNECTED(cmd, active->connected, i);
1256 		RTW89_SET_FWCMD_CXROLE_ACT_PID(cmd, active->pid, i);
1257 		RTW89_SET_FWCMD_CXROLE_ACT_PHY(cmd, active->phy, i);
1258 		RTW89_SET_FWCMD_CXROLE_ACT_NOA(cmd, active->noa, i);
1259 		RTW89_SET_FWCMD_CXROLE_ACT_BAND(cmd, active->band, i);
1260 		RTW89_SET_FWCMD_CXROLE_ACT_CLIENT_PS(cmd, active->client_ps, i);
1261 		RTW89_SET_FWCMD_CXROLE_ACT_BW(cmd, active->bw, i);
1262 		RTW89_SET_FWCMD_CXROLE_ACT_ROLE(cmd, active->role, i);
1263 		RTW89_SET_FWCMD_CXROLE_ACT_CH(cmd, active->ch, i);
1264 		RTW89_SET_FWCMD_CXROLE_ACT_TX_LVL(cmd, active->tx_lvl, i);
1265 		RTW89_SET_FWCMD_CXROLE_ACT_RX_LVL(cmd, active->rx_lvl, i);
1266 		RTW89_SET_FWCMD_CXROLE_ACT_TX_RATE(cmd, active->tx_rate, i);
1267 		RTW89_SET_FWCMD_CXROLE_ACT_RX_RATE(cmd, active->rx_rate, i);
1268 	}
1269 
1270 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
1271 			      H2C_CAT_OUTSRC, BTFC_SET,
1272 			      SET_DRV_INFO, 0, 0,
1273 			      H2C_LEN_CXDRVINFO_ROLE);
1274 
1275 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
1276 		rtw89_err(rtwdev, "failed to send h2c\n");
1277 		goto fail;
1278 	}
1279 
1280 	return 0;
1281 fail:
1282 	dev_kfree_skb_any(skb);
1283 
1284 	return -EBUSY;
1285 }
1286 
1287 #define H2C_LEN_CXDRVINFO_CTRL (4 + H2C_LEN_CXDRVHDR)
1288 int rtw89_fw_h2c_cxdrv_ctrl(struct rtw89_dev *rtwdev)
1289 {
1290 	struct rtw89_btc *btc = &rtwdev->btc;
1291 	struct rtw89_btc_ctrl *ctrl = &btc->ctrl;
1292 	struct sk_buff *skb;
1293 	u8 *cmd;
1294 
1295 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(H2C_LEN_CXDRVINFO_CTRL);
1296 	if (!skb) {
1297 		rtw89_err(rtwdev, "failed to alloc skb for h2c cxdrv_ctrl\n");
1298 		return -ENOMEM;
1299 	}
1300 	skb_put(skb, H2C_LEN_CXDRVINFO_CTRL);
1301 	cmd = skb->data;
1302 
1303 	RTW89_SET_FWCMD_CXHDR_TYPE(cmd, CXDRVINFO_CTRL);
1304 	RTW89_SET_FWCMD_CXHDR_LEN(cmd, H2C_LEN_CXDRVINFO_CTRL - H2C_LEN_CXDRVHDR);
1305 
1306 	RTW89_SET_FWCMD_CXCTRL_MANUAL(cmd, ctrl->manual);
1307 	RTW89_SET_FWCMD_CXCTRL_IGNORE_BT(cmd, ctrl->igno_bt);
1308 	RTW89_SET_FWCMD_CXCTRL_ALWAYS_FREERUN(cmd, ctrl->always_freerun);
1309 	RTW89_SET_FWCMD_CXCTRL_TRACE_STEP(cmd, ctrl->trace_step);
1310 
1311 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
1312 			      H2C_CAT_OUTSRC, BTFC_SET,
1313 			      SET_DRV_INFO, 0, 0,
1314 			      H2C_LEN_CXDRVINFO_CTRL);
1315 
1316 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
1317 		rtw89_err(rtwdev, "failed to send h2c\n");
1318 		goto fail;
1319 	}
1320 
1321 	return 0;
1322 fail:
1323 	dev_kfree_skb_any(skb);
1324 
1325 	return -EBUSY;
1326 }
1327 
1328 #define H2C_LEN_CXDRVINFO_RFK (4 + H2C_LEN_CXDRVHDR)
1329 int rtw89_fw_h2c_cxdrv_rfk(struct rtw89_dev *rtwdev)
1330 {
1331 	struct rtw89_btc *btc = &rtwdev->btc;
1332 	struct rtw89_btc_wl_info *wl = &btc->cx.wl;
1333 	struct rtw89_btc_wl_rfk_info *rfk_info = &wl->rfk_info;
1334 	struct sk_buff *skb;
1335 	u8 *cmd;
1336 
1337 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(H2C_LEN_CXDRVINFO_RFK);
1338 	if (!skb) {
1339 		rtw89_err(rtwdev, "failed to alloc skb for h2c cxdrv_ctrl\n");
1340 		return -ENOMEM;
1341 	}
1342 	skb_put(skb, H2C_LEN_CXDRVINFO_RFK);
1343 	cmd = skb->data;
1344 
1345 	RTW89_SET_FWCMD_CXHDR_TYPE(cmd, CXDRVINFO_RFK);
1346 	RTW89_SET_FWCMD_CXHDR_LEN(cmd, H2C_LEN_CXDRVINFO_RFK - H2C_LEN_CXDRVHDR);
1347 
1348 	RTW89_SET_FWCMD_CXRFK_STATE(cmd, rfk_info->state);
1349 	RTW89_SET_FWCMD_CXRFK_PATH_MAP(cmd, rfk_info->path_map);
1350 	RTW89_SET_FWCMD_CXRFK_PHY_MAP(cmd, rfk_info->phy_map);
1351 	RTW89_SET_FWCMD_CXRFK_BAND(cmd, rfk_info->band);
1352 	RTW89_SET_FWCMD_CXRFK_TYPE(cmd, rfk_info->type);
1353 
1354 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
1355 			      H2C_CAT_OUTSRC, BTFC_SET,
1356 			      SET_DRV_INFO, 0, 0,
1357 			      H2C_LEN_CXDRVINFO_RFK);
1358 
1359 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
1360 		rtw89_err(rtwdev, "failed to send h2c\n");
1361 		goto fail;
1362 	}
1363 
1364 	return 0;
1365 fail:
1366 	dev_kfree_skb_any(skb);
1367 
1368 	return -EBUSY;
1369 }
1370 
1371 int rtw89_fw_h2c_rf_reg(struct rtw89_dev *rtwdev,
1372 			struct rtw89_fw_h2c_rf_reg_info *info,
1373 			u16 len, u8 page)
1374 {
1375 	struct sk_buff *skb;
1376 	u8 class = info->rf_path == RF_PATH_A ?
1377 		   H2C_CL_OUTSRC_RF_REG_A : H2C_CL_OUTSRC_RF_REG_B;
1378 
1379 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(len);
1380 	if (!skb) {
1381 		rtw89_err(rtwdev, "failed to alloc skb for h2c rf reg\n");
1382 		return -ENOMEM;
1383 	}
1384 	skb_put_data(skb, info->rtw89_phy_config_rf_h2c[page], len);
1385 
1386 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
1387 			      H2C_CAT_OUTSRC, class, page, 0, 0,
1388 			      len);
1389 
1390 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
1391 		rtw89_err(rtwdev, "failed to send h2c\n");
1392 		goto fail;
1393 	}
1394 
1395 	return 0;
1396 fail:
1397 	dev_kfree_skb_any(skb);
1398 
1399 	return -EBUSY;
1400 }
1401 
1402 int rtw89_fw_h2c_raw_with_hdr(struct rtw89_dev *rtwdev,
1403 			      u8 h2c_class, u8 h2c_func, u8 *buf, u16 len,
1404 			      bool rack, bool dack)
1405 {
1406 	struct sk_buff *skb;
1407 
1408 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(len);
1409 	if (!skb) {
1410 		rtw89_err(rtwdev, "failed to alloc skb for raw with hdr\n");
1411 		return -ENOMEM;
1412 	}
1413 	skb_put_data(skb, buf, len);
1414 
1415 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
1416 			      H2C_CAT_OUTSRC, h2c_class, h2c_func, rack, dack,
1417 			      len);
1418 
1419 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
1420 		rtw89_err(rtwdev, "failed to send h2c\n");
1421 		goto fail;
1422 	}
1423 
1424 	return 0;
1425 fail:
1426 	dev_kfree_skb_any(skb);
1427 
1428 	return -EBUSY;
1429 }
1430 
1431 int rtw89_fw_h2c_raw(struct rtw89_dev *rtwdev, const u8 *buf, u16 len)
1432 {
1433 	struct sk_buff *skb;
1434 
1435 	skb = rtw89_fw_h2c_alloc_skb_no_hdr(len);
1436 	if (!skb) {
1437 		rtw89_err(rtwdev, "failed to alloc skb for h2c raw\n");
1438 		return -ENOMEM;
1439 	}
1440 	skb_put_data(skb, buf, len);
1441 
1442 	if (rtw89_h2c_tx(rtwdev, skb, false)) {
1443 		rtw89_err(rtwdev, "failed to send h2c\n");
1444 		goto fail;
1445 	}
1446 
1447 	return 0;
1448 fail:
1449 	dev_kfree_skb_any(skb);
1450 
1451 	return -EBUSY;
1452 }
1453 
1454 void rtw89_fw_send_all_early_h2c(struct rtw89_dev *rtwdev)
1455 {
1456 	struct rtw89_early_h2c *early_h2c;
1457 
1458 	lockdep_assert_held(&rtwdev->mutex);
1459 
1460 	list_for_each_entry(early_h2c, &rtwdev->early_h2c_list, list) {
1461 		rtw89_fw_h2c_raw(rtwdev, early_h2c->h2c, early_h2c->h2c_len);
1462 	}
1463 }
1464 
1465 void rtw89_fw_free_all_early_h2c(struct rtw89_dev *rtwdev)
1466 {
1467 	struct rtw89_early_h2c *early_h2c, *tmp;
1468 
1469 	mutex_lock(&rtwdev->mutex);
1470 	list_for_each_entry_safe(early_h2c, tmp, &rtwdev->early_h2c_list, list) {
1471 		list_del(&early_h2c->list);
1472 		kfree(early_h2c->h2c);
1473 		kfree(early_h2c);
1474 	}
1475 	mutex_unlock(&rtwdev->mutex);
1476 }
1477 
1478 void rtw89_fw_c2h_irqsafe(struct rtw89_dev *rtwdev, struct sk_buff *c2h)
1479 {
1480 	skb_queue_tail(&rtwdev->c2h_queue, c2h);
1481 	ieee80211_queue_work(rtwdev->hw, &rtwdev->c2h_work);
1482 }
1483 
1484 static void rtw89_fw_c2h_cmd_handle(struct rtw89_dev *rtwdev,
1485 				    struct sk_buff *skb)
1486 {
1487 	u8 category = RTW89_GET_C2H_CATEGORY(skb->data);
1488 	u8 class = RTW89_GET_C2H_CLASS(skb->data);
1489 	u8 func = RTW89_GET_C2H_FUNC(skb->data);
1490 	u16 len = RTW89_GET_C2H_LEN(skb->data);
1491 	bool dump = true;
1492 
1493 	if (!test_bit(RTW89_FLAG_RUNNING, rtwdev->flags))
1494 		return;
1495 
1496 	switch (category) {
1497 	case RTW89_C2H_CAT_TEST:
1498 		break;
1499 	case RTW89_C2H_CAT_MAC:
1500 		rtw89_mac_c2h_handle(rtwdev, skb, len, class, func);
1501 		if (class == RTW89_MAC_C2H_CLASS_INFO &&
1502 		    func == RTW89_MAC_C2H_FUNC_C2H_LOG)
1503 			dump = false;
1504 		break;
1505 	case RTW89_C2H_CAT_OUTSRC:
1506 		if (class >= RTW89_PHY_C2H_CLASS_BTC_MIN &&
1507 		    class <= RTW89_PHY_C2H_CLASS_BTC_MAX)
1508 			rtw89_btc_c2h_handle(rtwdev, skb, len, class, func);
1509 		else
1510 			rtw89_phy_c2h_handle(rtwdev, skb, len, class, func);
1511 		break;
1512 	}
1513 
1514 	if (dump)
1515 		rtw89_hex_dump(rtwdev, RTW89_DBG_FW, "C2H: ", skb->data, skb->len);
1516 }
1517 
1518 void rtw89_fw_c2h_work(struct work_struct *work)
1519 {
1520 	struct rtw89_dev *rtwdev = container_of(work, struct rtw89_dev,
1521 						c2h_work);
1522 	struct sk_buff *skb, *tmp;
1523 
1524 	skb_queue_walk_safe(&rtwdev->c2h_queue, skb, tmp) {
1525 		skb_unlink(skb, &rtwdev->c2h_queue);
1526 		mutex_lock(&rtwdev->mutex);
1527 		rtw89_fw_c2h_cmd_handle(rtwdev, skb);
1528 		mutex_unlock(&rtwdev->mutex);
1529 		dev_kfree_skb_any(skb);
1530 	}
1531 }
1532 
1533 static int rtw89_fw_write_h2c_reg(struct rtw89_dev *rtwdev,
1534 				  struct rtw89_mac_h2c_info *info)
1535 {
1536 	static const u32 h2c_reg[RTW89_H2CREG_MAX] = {
1537 		R_AX_H2CREG_DATA0, R_AX_H2CREG_DATA1,
1538 		R_AX_H2CREG_DATA2, R_AX_H2CREG_DATA3
1539 	};
1540 	u8 i, val, len;
1541 	int ret;
1542 
1543 	ret = read_poll_timeout(rtw89_read8, val, val == 0, 1000, 5000, false,
1544 				rtwdev, R_AX_H2CREG_CTRL);
1545 	if (ret) {
1546 		rtw89_warn(rtwdev, "FW does not process h2c registers\n");
1547 		return ret;
1548 	}
1549 
1550 	len = DIV_ROUND_UP(info->content_len + RTW89_H2CREG_HDR_LEN,
1551 			   sizeof(info->h2creg[0]));
1552 
1553 	RTW89_SET_H2CREG_HDR_FUNC(&info->h2creg[0], info->id);
1554 	RTW89_SET_H2CREG_HDR_LEN(&info->h2creg[0], len);
1555 	for (i = 0; i < RTW89_H2CREG_MAX; i++)
1556 		rtw89_write32(rtwdev, h2c_reg[i], info->h2creg[i]);
1557 
1558 	rtw89_write8(rtwdev, R_AX_H2CREG_CTRL, B_AX_H2CREG_TRIGGER);
1559 
1560 	return 0;
1561 }
1562 
1563 static int rtw89_fw_read_c2h_reg(struct rtw89_dev *rtwdev,
1564 				 struct rtw89_mac_c2h_info *info)
1565 {
1566 	static const u32 c2h_reg[RTW89_C2HREG_MAX] = {
1567 		R_AX_C2HREG_DATA0, R_AX_C2HREG_DATA1,
1568 		R_AX_C2HREG_DATA2, R_AX_C2HREG_DATA3
1569 	};
1570 	u32 ret;
1571 	u8 i, val;
1572 
1573 	info->id = RTW89_FWCMD_C2HREG_FUNC_NULL;
1574 
1575 	ret = read_poll_timeout_atomic(rtw89_read8, val, val, 1,
1576 				       RTW89_C2H_TIMEOUT, false, rtwdev,
1577 				       R_AX_C2HREG_CTRL);
1578 	if (ret) {
1579 		rtw89_warn(rtwdev, "c2h reg timeout\n");
1580 		return ret;
1581 	}
1582 
1583 	for (i = 0; i < RTW89_C2HREG_MAX; i++)
1584 		info->c2hreg[i] = rtw89_read32(rtwdev, c2h_reg[i]);
1585 
1586 	rtw89_write8(rtwdev, R_AX_C2HREG_CTRL, 0);
1587 
1588 	info->id = RTW89_GET_C2H_HDR_FUNC(*info->c2hreg);
1589 	info->content_len = (RTW89_GET_C2H_HDR_LEN(*info->c2hreg) << 2) -
1590 				RTW89_C2HREG_HDR_LEN;
1591 
1592 	return 0;
1593 }
1594 
1595 int rtw89_fw_msg_reg(struct rtw89_dev *rtwdev,
1596 		     struct rtw89_mac_h2c_info *h2c_info,
1597 		     struct rtw89_mac_c2h_info *c2h_info)
1598 {
1599 	u32 ret;
1600 
1601 	if (h2c_info && h2c_info->id != RTW89_FWCMD_H2CREG_FUNC_GET_FEATURE)
1602 		lockdep_assert_held(&rtwdev->mutex);
1603 
1604 	if (!h2c_info && !c2h_info)
1605 		return -EINVAL;
1606 
1607 	if (!h2c_info)
1608 		goto recv_c2h;
1609 
1610 	ret = rtw89_fw_write_h2c_reg(rtwdev, h2c_info);
1611 	if (ret)
1612 		return ret;
1613 
1614 recv_c2h:
1615 	if (!c2h_info)
1616 		return 0;
1617 
1618 	ret = rtw89_fw_read_c2h_reg(rtwdev, c2h_info);
1619 	if (ret)
1620 		return ret;
1621 
1622 	return 0;
1623 }
1624 
1625 void rtw89_fw_st_dbg_dump(struct rtw89_dev *rtwdev)
1626 {
1627 	if (!test_bit(RTW89_FLAG_POWERON, rtwdev->flags)) {
1628 		rtw89_err(rtwdev, "[ERR]pwr is off\n");
1629 		return;
1630 	}
1631 
1632 	rtw89_info(rtwdev, "FW status = 0x%x\n", rtw89_read32(rtwdev, R_AX_UDM0));
1633 	rtw89_info(rtwdev, "FW BADADDR = 0x%x\n", rtw89_read32(rtwdev, R_AX_UDM1));
1634 	rtw89_info(rtwdev, "FW EPC/RA = 0x%x\n", rtw89_read32(rtwdev, R_AX_UDM2));
1635 	rtw89_info(rtwdev, "FW MISC = 0x%x\n", rtw89_read32(rtwdev, R_AX_UDM3));
1636 	rtw89_info(rtwdev, "R_AX_HALT_C2H = 0x%x\n",
1637 		   rtw89_read32(rtwdev, R_AX_HALT_C2H));
1638 	rtw89_info(rtwdev, "R_AX_SER_DBG_INFO = 0x%x\n",
1639 		   rtw89_read32(rtwdev, R_AX_SER_DBG_INFO));
1640 
1641 	rtw89_fw_prog_cnt_dump(rtwdev);
1642 }
1643