From d35f304a7d0ec9612064a41b98338d9f712fbb48 Mon Sep 17 00:00:00 2001
From: Sujuan Chen <sujuan.chen@mediatek.com>
Date: Mon, 18 Sep 2023 11:04:53 +0800
Subject: [PATCH 09/22] add-wed-rx-support-for-mt7896

---
 arch/arm64/boot/dts/mediatek/mt7986a.dtsi     |  42 +-
 arch/arm64/boot/dts/mediatek/mt7986b.dtsi     |  42 +-
 drivers/net/ethernet/mediatek/Makefile        |   2 +-
 drivers/net/ethernet/mediatek/mtk_wed.c       | 639 ++++++++++++++++--
 drivers/net/ethernet/mediatek/mtk_wed.h       |  51 ++
 drivers/net/ethernet/mediatek/mtk_wed_ccif.c  | 133 ++++
 drivers/net/ethernet/mediatek/mtk_wed_ccif.h  |  45 ++
 .../net/ethernet/mediatek/mtk_wed_debugfs.c   |  90 +++
 drivers/net/ethernet/mediatek/mtk_wed_mcu.c   | 586 ++++++++++++++++
 drivers/net/ethernet/mediatek/mtk_wed_mcu.h   |  96 +++
 drivers/net/ethernet/mediatek/mtk_wed_regs.h  | 144 +++-
 drivers/net/ethernet/mediatek/mtk_wed_wo.c    | 564 ++++++++++++++++
 drivers/net/ethernet/mediatek/mtk_wed_wo.h    | 324 +++++++++
 include/linux/soc/mediatek/mtk_wed.h          | 126 +++-
 14 files changed, 2801 insertions(+), 83 deletions(-)
 create mode 100644 drivers/net/ethernet/mediatek/mtk_wed_ccif.c
 create mode 100644 drivers/net/ethernet/mediatek/mtk_wed_ccif.h
 create mode 100644 drivers/net/ethernet/mediatek/mtk_wed_mcu.c
 create mode 100644 drivers/net/ethernet/mediatek/mtk_wed_mcu.h
 create mode 100644 drivers/net/ethernet/mediatek/mtk_wed_wo.c
 create mode 100644 drivers/net/ethernet/mediatek/mtk_wed_wo.h

diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
index 3ff8994..c5dc5e8 100644
--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
@@ -65,6 +65,12 @@
 		interrupt-parent = <&gic>;
 		interrupts = <GIC_SPI 205 IRQ_TYPE_LEVEL_HIGH>;
 		mediatek,wed_pcie = <&wed_pcie>;
+		mediatek,ap2woccif = <&ap2woccif0>;
+		mediatek,wocpu_ilm = <&wocpu0_ilm>;
+		mediatek,wocpu_dlm = <&wocpu0_dlm>;
+		mediatek,wocpu_boot = <&cpu_boot>;
+		mediatek,wocpu_emi = <&wocpu0_emi>;
+		mediatek,wocpu_data = <&wocpu_data>;
 	};
 
 	wed1: wed@15011000 {
@@ -74,15 +80,26 @@
 		interrupt-parent = <&gic>;
 		interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>;
 		mediatek,wed_pcie = <&wed_pcie>;
+		mediatek,ap2woccif = <&ap2woccif1>;
+		mediatek,wocpu_ilm = <&wocpu1_ilm>;
+		mediatek,wocpu_dlm = <&wocpu1_dlm>;
+		mediatek,wocpu_boot = <&cpu_boot>;
+		mediatek,wocpu_emi = <&wocpu1_emi>;
+		mediatek,wocpu_data = <&wocpu_data>;
 	};
 
-	ap2woccif: ap2woccif@151A5000 {
-		compatible = "mediatek,ap2woccif";
-		reg = <0 0x151A5000 0 0x1000>,
-		      <0 0x151AD000 0 0x1000>;
+	ap2woccif0: ap2woccif@151A5000 {
+		compatible = "mediatek,ap2woccif", "syscon";
+		reg = <0 0x151A5000 0 0x1000>;
 		interrupt-parent = <&gic>;
-		interrupts = <GIC_SPI 211 IRQ_TYPE_LEVEL_HIGH>,
-			     <GIC_SPI 212 IRQ_TYPE_LEVEL_HIGH>;
+		interrupts = <GIC_SPI 211 IRQ_TYPE_LEVEL_HIGH>;
+        };
+
+	ap2woccif1: ap2woccif@0x151AD000 {
+		compatible = "mediatek,ap2woccif", "syscon";
+		reg = <0 0x151AD000 0 0x1000>;
+		interrupt-parent = <&gic>;
+		interrupts = <GIC_SPI 212 IRQ_TYPE_LEVEL_HIGH>;
         };
 
 	wocpu0_ilm: wocpu0_ilm@151E0000 {
@@ -95,10 +112,17 @@
                 reg = <0 0x151F0000 0 0x8000>;
         };
 
-	wocpu_dlm: wocpu_dlm@151E8000 {
+	wocpu0_dlm: wocpu_dlm@151E8000 {
+		compatible = "mediatek,wocpu_dlm";
+		reg = <0 0x151E8000 0 0x2000>;
+
+		resets = <&ethsysrst 0>;
+		reset-names = "wocpu_rst";
+	};
+
+	wocpu1_dlm: wocpu_dlm@0x151F8000 {
 		compatible = "mediatek,wocpu_dlm";
-		reg = <0 0x151E8000 0 0x2000>,
-		      <0 0x151F8000 0 0x2000>;
+		reg = <0 0x151F8000 0 0x2000>;
 
 		resets = <&ethsysrst 0>;
 		reset-names = "wocpu_rst";
diff --git a/arch/arm64/boot/dts/mediatek/mt7986b.dtsi b/arch/arm64/boot/dts/mediatek/mt7986b.dtsi
index 043e509..bfd2a02 100644
--- a/arch/arm64/boot/dts/mediatek/mt7986b.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt7986b.dtsi
@@ -65,6 +65,12 @@
 		interrupt-parent = <&gic>;
 		interrupts = <GIC_SPI 205 IRQ_TYPE_LEVEL_HIGH>;
 		mediatek,wed_pcie = <&wed_pcie>;
+		mediatek,ap2woccif = <&ap2woccif0>;
+		mediatek,wocpu_ilm = <&wocpu0_ilm>;
+		mediatek,wocpu_dlm = <&wocpu0_dlm>;
+		mediatek,wocpu_boot = <&cpu_boot>;
+		mediatek,wocpu_emi = <&wocpu0_emi>;
+		mediatek,wocpu_data = <&wocpu_data>;
 	};
 
 	wed1: wed@15011000 {
@@ -74,15 +80,26 @@
 		interrupt-parent = <&gic>;
 		interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>;
 		mediatek,wed_pcie = <&wed_pcie>;
+		mediatek,ap2woccif = <&ap2woccif1>;
+		mediatek,wocpu_ilm = <&wocpu1_ilm>;
+		mediatek,wocpu_dlm = <&wocpu1_dlm>;
+		mediatek,wocpu_boot = <&cpu_boot>;
+		mediatek,wocpu_emi = <&wocpu1_emi>;
+		mediatek,wocpu_data = <&wocpu_data>;
 	};
 
-	ap2woccif: ap2woccif@151A5000 {
-		compatible = "mediatek,ap2woccif";
-		reg = <0 0x151A5000 0 0x1000>,
-		      <0 0x151AD000 0 0x1000>;
+	ap2woccif0: ap2woccif@151A5000 {
+		compatible = "mediatek,ap2woccif", "syscon";
+		reg = <0 0x151A5000 0 0x1000>;
 		interrupt-parent = <&gic>;
-		interrupts = <GIC_SPI 211 IRQ_TYPE_LEVEL_HIGH>,
-			     <GIC_SPI 212 IRQ_TYPE_LEVEL_HIGH>;
+		interrupts = <GIC_SPI 211 IRQ_TYPE_LEVEL_HIGH>;
+        };
+
+	ap2woccif1: ap2woccif@0x151AD000 {
+		compatible = "mediatek,ap2woccif", "syscon";
+		reg = <0 0x151AD000 0 0x1000>;
+		interrupt-parent = <&gic>;
+		interrupts = <GIC_SPI 212 IRQ_TYPE_LEVEL_HIGH>;
         };
 
 	wocpu0_ilm: wocpu0_ilm@151E0000 {
@@ -95,10 +112,17 @@
                 reg = <0 0x151F0000 0 0x8000>;
         };
 
-	wocpu_dlm: wocpu_dlm@151E8000 {
+	wocpu0_dlm: wocpu_dlm@151E8000 {
+		compatible = "mediatek,wocpu_dlm";
+		reg = <0 0x151E8000 0 0x2000>;
+
+		resets = <&ethsysrst 0>;
+		reset-names = "wocpu_rst";
+	};
+
+	wocpu1_dlm: wocpu_dlm@0x151F8000 {
 		compatible = "mediatek,wocpu_dlm";
-		reg = <0 0x151E8000 0 0x2000>,
-		      <0 0x151F8000 0 0x2000>;
+		reg = <0 0x151F8000 0 0x2000>;
 
 		resets = <&ethsysrst 0>;
 		reset-names = "wocpu_rst";
diff --git a/arch/arm64/boot/dts/mediatek/mt7981.dtsi b/arch/arm64/boot/dts/mediatek/mt7981.dtsi
index d34943e7..512fb5d6 100644
--- a/arch/arm64/boot/dts/mediatek/mt7981.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt7981.dtsi
@@ -97,26 +97,29 @@
 		interrupt-parent = <&gic>;
 		interrupts = <GIC_SPI 205 IRQ_TYPE_LEVEL_HIGH>;
 		mediatek,wed_pcie = <&wed_pcie>;
+		mediatek,ap2woccif = <&ap2woccif0>;
+		mediatek,wocpu_ilm = <&wocpu0_ilm>;
+		mediatek,wocpu_dlm = <&wocpu0_dlm>;
+		mediatek,wocpu_boot = <&cpu_boot>;
+		mediatek,wocpu_emi = <&wocpu0_emi>;
+		mediatek,wocpu_data = <&wocpu_data>;
 	};
 
-	ap2woccif: ap2woccif@151A5000 {
-		compatible = "mediatek,ap2woccif";
-		reg = <0 0x151A5000 0 0x1000>,
-		      <0 0x151AD000 0 0x1000>;
+	ap2woccif0: ap2woccif@151A5000 {
+		compatible = "mediatek,ap2woccif", "syscon";
+		reg = <0 0x151A5000 0 0x1000>;
 		interrupt-parent = <&gic>;
-		interrupts = <GIC_SPI 211 IRQ_TYPE_LEVEL_HIGH>,
-			     <GIC_SPI 212 IRQ_TYPE_LEVEL_HIGH>;
-        };
+		interrupts = <GIC_SPI 211 IRQ_TYPE_LEVEL_HIGH>;
+	};
 
 	wocpu0_ilm: wocpu0_ilm@151E0000 {
 		compatible = "mediatek,wocpu0_ilm";
 		reg = <0 0x151E0000 0 0x8000>;
 	};
 
-	wocpu_dlm: wocpu_dlm@151E8000 {
+	wocpu0_dlm: wocpu_dlm@151E8000 {
 		compatible = "mediatek,wocpu_dlm";
-		reg = <0 0x151E8000 0 0x2000>,
-		      <0 0x151F8000 0 0x2000>;
+		reg = <0 0x151E8000 0 0x2000>;
 
 		resets = <&ethsysrst 0>;
 		reset-names = "wocpu_rst";
diff --git a/drivers/net/ethernet/mediatek/Makefile b/drivers/net/ethernet/mediatek/Makefile
index 4090132..fdbb90f 100644
--- a/drivers/net/ethernet/mediatek/Makefile
+++ b/drivers/net/ethernet/mediatek/Makefile
@@ -10,5 +10,5 @@ mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed.o
 ifdef CONFIG_DEBUG_FS
 mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed_debugfs.o
 endif
-obj-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed_ops.o
+obj-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed_ops.o mtk_wed_wo.o mtk_wed_mcu.o mtk_wed_ccif.o
 obj-$(CONFIG_NET_MEDIATEK_HNAT)			+= mtk_hnat/
diff --git a/drivers/net/ethernet/mediatek/mtk_wed.c b/drivers/net/ethernet/mediatek/mtk_wed.c
index 23e3dc5..4b2f1a2 100644
--- a/drivers/net/ethernet/mediatek/mtk_wed.c
+++ b/drivers/net/ethernet/mediatek/mtk_wed.c
@@ -13,11 +13,19 @@
 #include <linux/debugfs.h>
 #include <linux/iopoll.h>
 #include <linux/soc/mediatek/mtk_wed.h>
+
 #include "mtk_eth_soc.h"
 #include "mtk_wed_regs.h"
 #include "mtk_wed.h"
 #include "mtk_ppe.h"
-
+#include "mtk_wed_mcu.h"
+#include "mtk_wed_wo.h"
+
+struct wo_cmd_ring {
+	u32 q_base;
+	u32 cnt;
+	u32 unit;
+};
 static struct mtk_wed_hw *hw_list[2];
 static DEFINE_MUTEX(hw_lock);
 
@@ -51,6 +59,56 @@ wdma_set(struct mtk_wed_device *dev, u32 reg, u32 mask)
 	wdma_m32(dev, reg, 0, mask);
 }
 
+static void
+wdma_clr(struct mtk_wed_device *dev, u32 reg, u32 mask)
+{
+	wdma_m32(dev, reg, mask, 0);
+}
+
+static u32
+mtk_wdma_read_reset(struct mtk_wed_device *dev)
+{
+	return wdma_r32(dev, MTK_WDMA_GLO_CFG);
+}
+
+static void
+mtk_wdma_rx_reset(struct mtk_wed_device *dev)
+{
+	u32 status;
+	u32 mask = MTK_WDMA_GLO_CFG_RX_DMA_BUSY;
+	int i;
+
+	wdma_clr(dev, MTK_WDMA_GLO_CFG, MTK_WDMA_GLO_CFG_RX_DMA_EN);
+	if (readx_poll_timeout(mtk_wdma_read_reset, dev, status,
+			       !(status & mask), 0, 1000))
+		WARN_ON_ONCE(1);
+
+	for (i = 0; i < ARRAY_SIZE(dev->rx_wdma); i++)
+		if (!dev->rx_wdma[i].desc) {
+			wdma_w32(dev, MTK_WDMA_RING_RX(i) +
+				 MTK_WED_RING_OFS_CPU_IDX, 0);
+	}
+}
+
+static void
+mtk_wdma_tx_reset(struct mtk_wed_device *dev)
+{
+	u32 status;
+	u32 mask = MTK_WDMA_GLO_CFG_TX_DMA_BUSY;
+	int i;
+
+	wdma_clr(dev, MTK_WDMA_GLO_CFG, MTK_WDMA_GLO_CFG_TX_DMA_EN);
+	if (readx_poll_timeout(mtk_wdma_read_reset, dev, status,
+			       !(status & mask), 0, 1000))
+		WARN_ON_ONCE(1);
+
+	for (i = 0; i < ARRAY_SIZE(dev->tx_wdma); i++)
+		if (!dev->tx_wdma[i].desc) {
+			wdma_w32(dev, MTK_WDMA_RING_TX(i) +
+				 MTK_WED_RING_OFS_CPU_IDX, 0);
+	}
+}
+
 static u32
 mtk_wed_read_reset(struct mtk_wed_device *dev)
 {
@@ -68,6 +126,52 @@ mtk_wed_reset(struct mtk_wed_device *dev, u32 mask)
 		WARN_ON_ONCE(1);
 }
 
+static void
+mtk_wed_wo_reset(struct mtk_wed_device *dev)
+{
+	struct mtk_wed_wo *wo = dev->hw->wed_wo;
+	u8 state = WO_STATE_DISABLE;
+	u8 state_done = WOIF_DISABLE_DONE;
+	void __iomem *reg;
+	u32 value;
+	unsigned long timeout = jiffies + WOCPU_TIMEOUT;
+
+	mtk_wdma_tx_reset(dev);
+
+	mtk_wed_reset(dev, MTK_WED_RESET_WED);
+
+	mtk_wed_mcu_send_msg(wo, MODULE_ID_WO, MTK_WED_WO_CMD_CHANGE_STATE,
+			     &state, sizeof(state), false);
+
+	do {
+		value = wed_r32(dev, MTK_WED_SCR0 + 4 * WED_DUMMY_CR_WO_STATUS);
+	} while (value != state_done && !time_after(jiffies, timeout));
+
+	reg = ioremap(WOCPU_MCUSYS_RESET_ADDR, 4);
+	value = readl((void *)reg);
+	switch(dev->hw->index) {
+	case 0:
+		value |= WOCPU_WO0_MCUSYS_RESET_MASK;
+		writel(value, (void *)reg);
+		value &= ~WOCPU_WO0_MCUSYS_RESET_MASK;
+		writel(value, (void *)reg);
+		break;
+	case 1:
+		value |= WOCPU_WO1_MCUSYS_RESET_MASK;
+		writel(value, (void *)reg);
+		value &= ~WOCPU_WO1_MCUSYS_RESET_MASK;
+		writel(value, (void *)reg);
+		break;
+	default:
+		dev_err(dev->hw->dev, "wrong mtk_wed%d\n",
+			dev->hw->index);
+
+		break;
+	}
+
+	iounmap((void *)reg);
+}
+
 static struct mtk_wed_hw *
 mtk_wed_assign(struct mtk_wed_device *dev)
 {
@@ -178,7 +282,7 @@ mtk_wed_free_buffer(struct mtk_wed_device *dev)
 {
 	struct mtk_wdma_desc *desc = dev->buf_ring.desc;
 	void **page_list = dev->buf_ring.pages;
-	int page_idx;
+	int ring_size, page_idx;
 	int i;
 
 	if (!page_list)
@@ -187,7 +291,14 @@ mtk_wed_free_buffer(struct mtk_wed_device *dev)
 	if (!desc)
 		goto free_pagelist;
 
-	for (i = 0, page_idx = 0; i < dev->buf_ring.size; i += MTK_WED_BUF_PER_PAGE) {
+	if (dev->ver == MTK_WED_V1) {
+		ring_size = dev->wlan.nbuf & ~(MTK_WED_BUF_PER_PAGE - 1);
+	} else {
+		ring_size = MTK_WED_VLD_GROUP_SIZE * MTK_WED_PER_GROUP_PKT +
+			    MTK_WED_WDMA_RING_SIZE * 2;
+	}
+
+	for (i = 0, page_idx = 0; i < ring_size; i += MTK_WED_BUF_PER_PAGE) {
 		void *page = page_list[page_idx++];
 
 		if (!page)
@@ -198,13 +309,49 @@ mtk_wed_free_buffer(struct mtk_wed_device *dev)
 		__free_page(page);
 	}
 
-	dma_free_coherent(dev->hw->dev, dev->buf_ring.size * sizeof(*desc),
+	dma_free_coherent(dev->hw->dev, ring_size * sizeof(*desc),
 			  desc, dev->buf_ring.desc_phys);
 
 free_pagelist:
 	kfree(page_list);
 }
 
+static int
+mtk_wed_rx_bm_alloc(struct mtk_wed_device *dev)
+{
+	struct mtk_rxbm_desc *desc;
+	dma_addr_t desc_phys;
+	int ring_size;
+
+	ring_size = dev->wlan.rx_nbuf;
+	dev->rx_buf_ring.size = ring_size;
+	desc = dma_alloc_coherent(dev->hw->dev, ring_size * sizeof(*desc),
+				  &desc_phys, GFP_KERNEL);
+	if (!desc)
+		return -ENOMEM;
+
+	dev->rx_buf_ring.desc = desc;
+	dev->rx_buf_ring.desc_phys = desc_phys;
+
+	dev->wlan.init_rx_buf(dev, dev->wlan.rx_npkt);
+	return 0;
+}
+
+static void
+mtk_wed_free_rx_bm(struct mtk_wed_device *dev)
+{
+	struct mtk_rxbm_desc *desc = dev->rx_buf_ring.desc;
+	int ring_size = dev->rx_buf_ring.size;
+
+	if (!desc)
+		return;
+
+	dev->wlan.release_rx_buf(dev);
+
+	dma_free_coherent(dev->hw->dev, ring_size * sizeof(*desc),
+			  desc, dev->rx_buf_ring.desc_phys);
+}
+
 static void
 mtk_wed_free_ring(struct mtk_wed_device *dev, struct mtk_wed_ring *ring, int scale)
 {
@@ -226,13 +373,22 @@ mtk_wed_free_tx_rings(struct mtk_wed_device *dev)
 		mtk_wed_free_ring(dev, &dev->tx_wdma[i], dev->ver);
 }
 
+static void
+mtk_wed_free_rx_rings(struct mtk_wed_device *dev)
+{
+	mtk_wed_free_rx_bm(dev);
+	mtk_wed_free_ring(dev, &dev->rro.rro_ring, 1);
+}
+
 static void
 mtk_wed_set_int(struct mtk_wed_device *dev, u32 irq_mask)
 {
 	u32 wdma_mask;
 
 	wdma_mask = FIELD_PREP(MTK_WDMA_INT_MASK_RX_DONE, GENMASK(1, 0));
-
+	if (dev->ver > MTK_WED_V1)
+		wdma_mask |= FIELD_PREP(MTK_WDMA_INT_MASK_TX_DONE,
+					GENMASK(1, 0));
 	/* wed control cr set */
 	wed_set(dev, MTK_WED_CTRL,
 		MTK_WED_CTRL_WDMA_INT_AGENT_EN |
@@ -251,7 +407,7 @@ mtk_wed_set_int(struct mtk_wed_device *dev, u32 irq_mask)
 		wed_set(dev, MTK_WED_WPDMA_INT_CTRL,
 			MTK_WED_WPDMA_INT_CTRL_SUBRT_ADV);
 	} else {
-		/* initail tx interrupt trigger */
+
 		wed_w32(dev, MTK_WED_WPDMA_INT_CTRL_TX,
 			MTK_WED_WPDMA_INT_CTRL_TX0_DONE_EN |
 			MTK_WED_WPDMA_INT_CTRL_TX0_DONE_CLR |
@@ -262,22 +418,30 @@ mtk_wed_set_int(struct mtk_wed_device *dev, u32 irq_mask)
 			FIELD_PREP(MTK_WED_WPDMA_INT_CTRL_TX1_DONE_TRIG,
 				   dev->wlan.tx_tbit[1]));
 
-		/* initail txfree interrupt trigger */
 		wed_w32(dev, MTK_WED_WPDMA_INT_CTRL_TX_FREE,
 			MTK_WED_WPDMA_INT_CTRL_TX_FREE_DONE_EN |
 			MTK_WED_WPDMA_INT_CTRL_TX_FREE_DONE_CLR |
 			FIELD_PREP(MTK_WED_WPDMA_INT_CTRL_TX_FREE_DONE_TRIG,
 				    dev->wlan.txfree_tbit));
+
+		wed_w32(dev, MTK_WED_WPDMA_INT_CTRL_RX,
+			MTK_WED_WPDMA_INT_CTRL_RX0_EN |
+			MTK_WED_WPDMA_INT_CTRL_RX0_CLR |
+			MTK_WED_WPDMA_INT_CTRL_RX1_EN |
+			MTK_WED_WPDMA_INT_CTRL_RX1_CLR |
+			FIELD_PREP(MTK_WED_WPDMA_INT_CTRL_RX0_DONE_TRIG,
+				   dev->wlan.rx_tbit[0]) |
+			FIELD_PREP(MTK_WED_WPDMA_INT_CTRL_RX1_DONE_TRIG,
+				   dev->wlan.rx_tbit[1]));
 	}
-	/* initail wdma interrupt agent */
 	wed_w32(dev, MTK_WED_WDMA_INT_TRIGGER, wdma_mask);
 	if (dev->ver == MTK_WED_V1) {
 		wed_clr(dev, MTK_WED_WDMA_INT_CTRL, wdma_mask);
 	} else {
 		wed_w32(dev, MTK_WED_WDMA_INT_CLR, wdma_mask);
 		wed_set(dev, MTK_WED_WDMA_INT_CTRL,
-			FIELD_PREP(MTK_WED_WDMA_INT_POLL_SRC_SEL,dev->wdma_idx));
-
+			FIELD_PREP(MTK_WED_WDMA_INT_POLL_SRC_SEL,
+				   dev->wdma_idx));
 	}
 
 	wdma_w32(dev, MTK_WDMA_INT_MASK, wdma_mask);
@@ -312,6 +476,40 @@ mtk_wed_set_512_support(struct mtk_wed_device *dev, bool en)
 	}
 }
 
+static void
+mtk_wed_check_wfdma_rx_fill(struct mtk_wed_device *dev, int idx)
+{
+#define MTK_WFMDA_RX_DMA_EN 	BIT(2)
+
+	int timeout = 3;
+	u32 cur_idx, regs;
+
+	do {
+		regs = MTK_WED_WPDMA_RING_RX_DATA(idx) +
+		       MTK_WED_RING_OFS_CPU_IDX;
+		cur_idx = wed_r32(dev, regs);
+		if (cur_idx == MTK_WED_RX_RING_SIZE - 1)
+			break;
+
+		usleep_range(100000, 200000);
+		timeout--;
+	} while (timeout > 0);
+
+	if (timeout) {
+		unsigned int val;
+
+		val = wifi_r32(dev, dev->wlan.wpdma_rx_glo -
+			       dev->wlan.phy_base);
+		val |= MTK_WFMDA_RX_DMA_EN;
+
+		wifi_w32(dev, dev->wlan.wpdma_rx_glo -
+			 dev->wlan.phy_base, val);
+	} else {
+		dev_err(dev->hw->dev, "mtk_wed%d: rx dma enable failed!\n",
+			       dev->hw->index);
+	}
+}
+
 static void
 mtk_wed_dma_enable(struct mtk_wed_device *dev)
 {
@@ -336,9 +534,15 @@ mtk_wed_dma_enable(struct mtk_wed_device *dev)
 		wdma_set(dev, MTK_WDMA_GLO_CFG,
 			 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES);
 	} else {
+		int idx = 0;
+
 		wed_set(dev, MTK_WED_WPDMA_CTRL,
 			MTK_WED_WPDMA_CTRL_SDL1_FIXED);
 
+		wed_set(dev, MTK_WED_WDMA_GLO_CFG,
+			MTK_WED_WDMA_GLO_CFG_TX_DRV_EN |
+			MTK_WED_WDMA_GLO_CFG_TX_DDONE_CHK);
+
 		wed_set(dev, MTK_WED_WPDMA_GLO_CFG,
 			MTK_WED_WPDMA_GLO_CFG_RX_DRV_R0_PKT_PROC |
 			MTK_WED_WPDMA_GLO_CFG_RX_DRV_R0_CRX_SYNC);
@@ -346,6 +550,15 @@ mtk_wed_dma_enable(struct mtk_wed_device *dev)
 		wed_clr(dev, MTK_WED_WPDMA_GLO_CFG,
 			MTK_WED_WPDMA_GLO_CFG_TX_TKID_KEEP |
 			MTK_WED_WPDMA_GLO_CFG_TX_DMAD_DW3_PREV);
+
+		wed_set(dev, MTK_WED_WPDMA_RX_D_GLO_CFG,
+			MTK_WED_WPDMA_RX_D_RX_DRV_EN |
+			FIELD_PREP(MTK_WED_WPDMA_RX_D_RXD_READ_LEN, 0x18) |
+			FIELD_PREP(MTK_WED_WPDMA_RX_D_INIT_PHASE_RXEN_SEL,
+				   0x2));
+
+		for (idx = 0; idx < MTK_WED_RX_QUEUES; idx++)
+			mtk_wed_check_wfdma_rx_fill(dev, idx);
 	}
 }
 
@@ -363,19 +576,23 @@ mtk_wed_dma_disable(struct mtk_wed_device *dev)
 		MTK_WED_GLO_CFG_TX_DMA_EN |
 		MTK_WED_GLO_CFG_RX_DMA_EN);
 
-	wdma_m32(dev, MTK_WDMA_GLO_CFG,
+	wdma_clr(dev, MTK_WDMA_GLO_CFG,
 		 MTK_WDMA_GLO_CFG_TX_DMA_EN |
 		 MTK_WDMA_GLO_CFG_RX_INFO1_PRERES |
-		 MTK_WDMA_GLO_CFG_RX_INFO2_PRERES, 0);
+		 MTK_WDMA_GLO_CFG_RX_INFO2_PRERES);
 
 	if (dev->ver == MTK_WED_V1) {
 		regmap_write(dev->hw->mirror, dev->hw->index * 4, 0);
-		wdma_m32(dev, MTK_WDMA_GLO_CFG,
-			 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES, 0);
+		wdma_clr(dev, MTK_WDMA_GLO_CFG,
+			 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES);
 	} else {
 		wed_clr(dev, MTK_WED_WPDMA_GLO_CFG,
 			MTK_WED_WPDMA_GLO_CFG_RX_DRV_R0_PKT_PROC |
 			MTK_WED_WPDMA_GLO_CFG_RX_DRV_R0_CRX_SYNC);
+		wed_clr(dev, MTK_WED_WPDMA_RX_D_GLO_CFG,
+			MTK_WED_WPDMA_RX_D_RX_DRV_EN);
+		wed_clr(dev, MTK_WED_WDMA_GLO_CFG,
+			MTK_WED_WDMA_GLO_CFG_TX_DDONE_CHK);
 	}
 }
 
@@ -383,10 +600,12 @@ static void
 mtk_wed_stop(struct mtk_wed_device *dev)
 {
 	mtk_wed_dma_disable(dev);
+	mtk_wed_set_512_support(dev, false);
 
-	if (dev->ver > MTK_WED_V1)
-		mtk_wed_set_512_support(dev, false);
-
+	if (dev->ver > MTK_WED_V1) {
+		wed_w32(dev, MTK_WED_EXT_INT_MASK1, 0);
+		wed_w32(dev, MTK_WED_EXT_INT_MASK2, 0);
+	}
 	mtk_wed_set_ext_int(dev, false);
 
 	wed_clr(dev, MTK_WED_CTRL,
@@ -395,6 +614,11 @@ mtk_wed_stop(struct mtk_wed_device *dev)
 		MTK_WED_CTRL_WED_TX_BM_EN |
 		MTK_WED_CTRL_WED_TX_FREE_AGENT_EN);
 
+	if (dev->ver > MTK_WED_V1) {
+		wed_clr(dev, MTK_WED_CTRL,
+			MTK_WED_CTRL_WED_RX_BM_EN);
+	}
+
 	wed_w32(dev, MTK_WED_WPDMA_INT_TRIGGER, 0);
 	wed_w32(dev, MTK_WED_WDMA_INT_TRIGGER, 0);
 	wdma_w32(dev, MTK_WDMA_INT_MASK, 0);
@@ -417,10 +641,21 @@ mtk_wed_detach(struct mtk_wed_device *dev)
 
 	mtk_wed_reset(dev, MTK_WED_RESET_WED);
 
+	wdma_clr(dev, MTK_WDMA_GLO_CFG, MTK_WDMA_GLO_CFG_TX_DMA_EN);
+	wdma_w32(dev, MTK_WDMA_RESET_IDX, MTK_WDMA_RESET_IDX_TX);
+	wdma_w32(dev, MTK_WDMA_RESET_IDX, 0);
+
 	mtk_wed_free_buffer(dev);
 	mtk_wed_free_tx_rings(dev);
+	if (dev->ver > MTK_WED_V1) {
+		mtk_wed_wo_reset(dev);
+		mtk_wed_free_rx_rings(dev);
+		mtk_wed_wo_exit(hw);
+	}
+
+	mtk_wdma_rx_reset(dev);
 
-	if (dev->wlan.bus_type == MTK_BUS_TYPE_PCIE) {
+	if (dev->wlan.bus_type == MTK_WED_BUS_PCIE) {
 		wlan_node = dev->wlan.pci_dev->dev.of_node;
 		if (of_dma_is_coherent(wlan_node))
 			regmap_update_bits(hw->hifsys, HIFSYS_DMA_AG_MAP,
@@ -443,7 +678,7 @@ mtk_wed_bus_init(struct mtk_wed_device *dev)
 {
 #define PCIE_BASE_ADDR0 0x11280000
 
-	if (dev->wlan.bus_type == MTK_BUS_TYPE_PCIE) {
+	if (dev->wlan.bus_type == MTK_WED_BUS_PCIE) {
 		struct device_node *node;
 		void __iomem * base_addr;
 		u32 value = 0;
@@ -477,7 +712,6 @@ mtk_wed_bus_init(struct mtk_wed_device *dev)
 		value = wed_r32(dev, MTK_WED_PCIE_CFG_INTM);
 		value = wed_r32(dev, MTK_WED_PCIE_CFG_BASE);
 
-		/* pcie interrupt status trigger register */
 		wed_w32(dev, MTK_WED_PCIE_INT_TRIGGER, BIT(24));
 		wed_r32(dev, MTK_WED_PCIE_INT_TRIGGER);
 
@@ -485,7 +719,7 @@ mtk_wed_bus_init(struct mtk_wed_device *dev)
 		value = wed_r32(dev, MTK_WED_PCIE_INT_CTRL);
 		wed_set(dev, MTK_WED_PCIE_INT_CTRL,
 			MTK_WED_PCIE_INT_CTRL_MSK_EN_POLA);
-	} else if (dev->wlan.bus_type == MTK_BUS_TYPE_AXI) {
+	} else if (dev->wlan.bus_type == MTK_WED_BUS_AXI) {
 		wed_set(dev, MTK_WED_WPDMA_INT_CTRL,
 			MTK_WED_WPDMA_INT_CTRL_SIG_SRC |
 			FIELD_PREP(MTK_WED_WPDMA_INT_CTRL_SRC_SEL, 0));
@@ -501,6 +735,9 @@ mtk_wed_set_wpdma(struct mtk_wed_device *dev)
 		wed_w32(dev, MTK_WED_WPDMA_CFG_INT_MASK,  dev->wlan.wpdma_mask);
 		wed_w32(dev, MTK_WED_WPDMA_CFG_TX,  dev->wlan.wpdma_tx);
 		wed_w32(dev, MTK_WED_WPDMA_CFG_TX_FREE,  dev->wlan.wpdma_txfree);
+
+		wed_w32(dev, MTK_WED_WPDMA_RX_GLO_CFG,  dev->wlan.wpdma_rx_glo);
+		wed_w32(dev, MTK_WED_WPDMA_RX_RING,  dev->wlan.wpdma_rx);
 	} else {
 		wed_w32(dev, MTK_WED_WPDMA_CFG_BASE,  dev->wlan.wpdma_phys);
 	}
@@ -549,24 +786,92 @@ mtk_wed_hw_init_early(struct mtk_wed_device *dev)
 			FIELD_PREP(MTK_WED_WDMA_OFST1_RX_CTRL,
 				   MTK_WDMA_RING_RX(0)));
 	}
+}
 
+static void
+mtk_wed_rx_bm_hw_init(struct mtk_wed_device *dev)
+{
+	wed_w32(dev, MTK_WED_RX_BM_RX_DMAD,
+		FIELD_PREP(MTK_WED_RX_BM_RX_DMAD_SDL0,  dev->wlan.rx_size));
+
+	wed_w32(dev, MTK_WED_RX_BM_BASE, dev->rx_buf_ring.desc_phys);
+
+	wed_w32(dev, MTK_WED_RX_BM_INIT_PTR, MTK_WED_RX_BM_INIT_SW_TAIL |
+		FIELD_PREP(MTK_WED_RX_BM_SW_TAIL, dev->wlan.rx_npkt));
+
+	wed_w32(dev, MTK_WED_RX_BM_DYN_ALLOC_TH,
+		FIELD_PREP(MTK_WED_RX_BM_DYN_ALLOC_TH_H, 0xffff));
+
+	wed_set(dev, MTK_WED_CTRL, MTK_WED_CTRL_WED_RX_BM_EN);
 }
 
 static void
-mtk_wed_hw_init(struct mtk_wed_device *dev)
+mtk_wed_rro_hw_init(struct mtk_wed_device *dev)
+{
+	wed_w32(dev, MTK_WED_RROQM_MIOD_CFG,
+		FIELD_PREP(MTK_WED_RROQM_MIOD_MID_DW, 0x70 >> 2) |
+		FIELD_PREP(MTK_WED_RROQM_MIOD_MOD_DW, 0x10 >> 2) |
+		FIELD_PREP(MTK_WED_RROQM_MIOD_ENTRY_DW,
+			   MTK_WED_MIOD_ENTRY_CNT >> 2));
+
+	wed_w32(dev, MTK_WED_RROQM_MIOD_CTRL0, dev->rro.miod_desc_phys);
+
+	wed_w32(dev, MTK_WED_RROQM_MIOD_CTRL1,
+		FIELD_PREP(MTK_WED_RROQM_MIOD_CNT, MTK_WED_MIOD_CNT));
+
+	wed_w32(dev, MTK_WED_RROQM_FDBK_CTRL0, dev->rro.fdbk_desc_phys);
+
+	wed_w32(dev, MTK_WED_RROQM_FDBK_CTRL1,
+		FIELD_PREP(MTK_WED_RROQM_FDBK_CNT, MTK_WED_FB_CMD_CNT));
+
+	wed_w32(dev, MTK_WED_RROQM_FDBK_CTRL2, 0);
+
+	wed_w32(dev, MTK_WED_RROQ_BASE_L, dev->rro.rro_ring.desc_phys);
+
+	wed_set(dev, MTK_WED_RROQM_RST_IDX,
+		MTK_WED_RROQM_RST_IDX_MIOD |
+		MTK_WED_RROQM_RST_IDX_FDBK);
+
+	wed_w32(dev, MTK_WED_RROQM_RST_IDX, 0);
+
+	wed_w32(dev, MTK_WED_RROQM_MIOD_CTRL2, MTK_WED_MIOD_CNT -1);
+
+	wed_set(dev, MTK_WED_CTRL, MTK_WED_CTRL_RX_RRO_QM_EN);
+}
+
+static void
+mtk_wed_route_qm_hw_init(struct mtk_wed_device *dev)
+{
+	wed_w32(dev, MTK_WED_RESET, MTK_WED_RESET_RX_ROUTE_QM);
+
+	do {
+		udelay(100);
+
+		if (!(wed_r32(dev, MTK_WED_RESET) & MTK_WED_RESET_RX_ROUTE_QM))
+			break;
+	} while (1);
+
+	/* configure RX_ROUTE_QM */
+	wed_clr(dev, MTK_WED_RTQM_GLO_CFG, MTK_WED_RTQM_Q_RST);
+	wed_clr(dev, MTK_WED_RTQM_GLO_CFG, MTK_WED_RTQM_TXDMAD_FPORT);
+	wed_set(dev, MTK_WED_RTQM_GLO_CFG,
+		FIELD_PREP(MTK_WED_RTQM_TXDMAD_FPORT, 0x3 + dev->hw->index));
+	wed_clr(dev, MTK_WED_RTQM_GLO_CFG, MTK_WED_RTQM_Q_RST);
+
+	/* enable RX_ROUTE_QM */
+	wed_set(dev, MTK_WED_CTRL, MTK_WED_CTRL_RX_ROUTE_QM_EN);
+}
+
+static void
+mtk_wed_tx_hw_init(struct mtk_wed_device *dev)
 {
 	int size = dev->buf_ring.size;
 	int rev_size = MTK_WED_TX_RING_SIZE / 2;
 	int thr = 1;
 
-	if (dev->init_done)
-		return;
-
-	dev->init_done = true;
-	mtk_wed_set_ext_int(dev, false);
-
 	if (dev->ver > MTK_WED_V1) {
-		size = MTK_WED_WDMA_RING_SIZE * 2 + dev->buf_ring.size;
+		size = MTK_WED_WDMA_RING_SIZE * ARRAY_SIZE(dev->tx_wdma) +
+		       dev->buf_ring.size;
 		rev_size = size;
 		thr = 0;
 	}
@@ -609,13 +914,46 @@ mtk_wed_hw_init(struct mtk_wed_device *dev)
 }
 
 static void
-mtk_wed_ring_reset(struct mtk_wdma_desc *desc, int size, int scale)
+mtk_wed_rx_hw_init(struct mtk_wed_device *dev)
 {
+	wed_w32(dev, MTK_WED_WPDMA_RX_D_RST_IDX,
+		MTK_WED_WPDMA_RX_D_RST_CRX_IDX |
+		MTK_WED_WPDMA_RX_D_RST_DRV_IDX);
+
+	wed_w32(dev, MTK_WED_WPDMA_RX_D_RST_IDX, 0);
+
+	mtk_wed_rx_bm_hw_init(dev);
+	mtk_wed_rro_hw_init(dev);
+	mtk_wed_route_qm_hw_init(dev);
+}
+
+static void
+mtk_wed_hw_init(struct mtk_wed_device *dev)
+{
+	if (dev->init_done)
+		return;
+
+	dev->init_done = true;
+	mtk_wed_set_ext_int(dev, false);
+	mtk_wed_tx_hw_init(dev);
+	if (dev->ver > MTK_WED_V1)
+		mtk_wed_rx_hw_init(dev);
+}
+
+static void
+mtk_wed_ring_reset(struct mtk_wdma_desc *desc, int size, int scale, bool tx)
+{
+	__le32 ctrl;
 	int i;
 
+	if (tx)
+		ctrl = cpu_to_le32(MTK_WDMA_DESC_CTRL_DMA_DONE);
+	else
+		ctrl = cpu_to_le32(MTK_WFDMA_DESC_CTRL_TO_HOST);
+
 	for (i = 0; i < size; i++) {
 		desc->buf0 = 0;
-		desc->ctrl = cpu_to_le32(MTK_WDMA_DESC_CTRL_DMA_DONE);
+		desc->ctrl = ctrl;
 		desc->buf1 = 0;
 		desc->info = 0;
 		desc += scale;
@@ -674,7 +1012,7 @@ mtk_wed_reset_dma(struct mtk_wed_device *dev)
 		if (!desc)
 			continue;
 
-		mtk_wed_ring_reset(desc, MTK_WED_TX_RING_SIZE, dev->ver);
+		mtk_wed_ring_reset(desc, MTK_WED_TX_RING_SIZE, dev->ver, true);
 	}
 
 	if (mtk_wed_poll_busy(dev))
@@ -692,6 +1030,8 @@ mtk_wed_reset_dma(struct mtk_wed_device *dev)
 	wdma_w32(dev, MTK_WDMA_RESET_IDX, MTK_WDMA_RESET_IDX_RX);
 	wdma_w32(dev, MTK_WDMA_RESET_IDX, 0);
 
+	mtk_wdma_rx_reset(dev);
+
 	if (busy) {
 		mtk_wed_reset(dev, MTK_WED_RESET_WDMA_INT_AGENT);
 		mtk_wed_reset(dev, MTK_WED_RESET_WDMA_RX_DRV);
@@ -729,9 +1069,24 @@ mtk_wed_reset_dma(struct mtk_wed_device *dev)
 
 }
 
+static int
+mtk_wed_rro_ring_alloc(struct mtk_wed_device *dev, struct mtk_wed_ring *ring,
+		   int size)
+{
+	ring->desc = dma_alloc_coherent(dev->hw->dev,
+					size * sizeof(*ring->desc),
+					&ring->desc_phys, GFP_KERNEL);
+	if (!ring->desc)
+		return -ENOMEM;
+
+	ring->size = size;
+	memset(ring->desc, 0, size);
+	return 0;
+}
+
 static int
 mtk_wed_ring_alloc(struct mtk_wed_device *dev, struct mtk_wed_ring *ring,
-		   int size, int scale)
+		   int size, int scale, bool tx)
 {
 	ring->desc = dma_alloc_coherent(dev->hw->dev,
 					size * sizeof(*ring->desc) * scale,
@@ -740,17 +1095,18 @@ mtk_wed_ring_alloc(struct mtk_wed_device *dev, struct mtk_wed_ring *ring,
 		return -ENOMEM;
 
 	ring->size = size;
-	mtk_wed_ring_reset(ring->desc, size, scale);
+	mtk_wed_ring_reset(ring->desc, size, scale, tx);
 
 	return 0;
 }
 
 static int
-mtk_wed_wdma_ring_setup(struct mtk_wed_device *dev, int idx, int size)
+mtk_wed_wdma_rx_ring_setup(struct mtk_wed_device *dev, int idx, int size)
 {
 	struct mtk_wed_ring *wdma = &dev->tx_wdma[idx];
 
-	if (mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE, dev->ver))
+	if (mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE,
+			       dev->ver, true))
 		return -ENOMEM;
 
 	wdma_w32(dev, MTK_WDMA_RING_RX(idx) + MTK_WED_RING_OFS_BASE,
@@ -767,22 +1123,143 @@ mtk_wed_wdma_ring_setup(struct mtk_wed_device *dev, int idx, int size)
 	return 0;
 }
 
+static int
+mtk_wed_wdma_tx_ring_setup(struct mtk_wed_device *dev, int idx, int size)
+{
+	struct mtk_wed_ring *wdma = &dev->rx_wdma[idx];
+
+	if (mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE,
+			       dev->ver, true))
+		return -ENOMEM;
+
+	wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_BASE,
+		 wdma->desc_phys);
+	wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_COUNT,
+		 size);
+	wdma_w32(dev,
+		 MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_CPU_IDX, 0);
+	wdma_w32(dev,
+		 MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_DMA_IDX, 0);
+
+	if (idx == 0)  {
+		wed_w32(dev, MTK_WED_WDMA_RING_TX
+			+ MTK_WED_RING_OFS_BASE, wdma->desc_phys);
+		wed_w32(dev, MTK_WED_WDMA_RING_TX
+			+ MTK_WED_RING_OFS_COUNT, size);
+		wed_w32(dev, MTK_WED_WDMA_RING_TX
+			+ MTK_WED_RING_OFS_CPU_IDX, 0);
+		wed_w32(dev, MTK_WED_WDMA_RING_TX
+			+ MTK_WED_RING_OFS_DMA_IDX, 0);
+	}
+
+	return 0;
+}
+
+static int
+mtk_wed_rro_alloc(struct mtk_wed_device *dev)
+{
+	struct device_node *np, *node = dev->hw->node;
+	struct mtk_wed_ring *ring;
+	struct resource res;
+	int ret;
+
+	np = of_parse_phandle(node, "mediatek,wocpu_dlm", 0);
+	if (!np)
+		return -ENODEV;
+
+	ret = of_address_to_resource(np, 0, &res);
+	if (ret)
+		return ret;
+
+	dev->rro.rro_desc = ioremap(res.start, resource_size(&res));
+
+	ring = &dev->rro.rro_ring;
+
+	dev->rro.miod_desc_phys = res.start;
+
+	dev->rro.mcu_view_miod = MTK_WED_WOCPU_VIEW_MIOD_BASE;
+	dev->rro.fdbk_desc_phys = MTK_WED_MIOD_ENTRY_CNT * MTK_WED_MIOD_CNT
+				  + dev->rro.miod_desc_phys;
+
+	if (mtk_wed_rro_ring_alloc(dev, ring, MTK_WED_RRO_QUE_CNT))
+		return -ENOMEM;
+
+	return 0;
+}
+
+static int
+mtk_wed_rro_cfg(struct mtk_wed_device *dev)
+{
+	struct mtk_wed_wo *wo = dev->hw->wed_wo;
+	struct {
+		struct wo_cmd_ring ring[2];
+
+		u32 wed;
+		u8 ver;
+	} req = {
+		.ring = {
+			[0] = {
+				.q_base = dev->rro.mcu_view_miod,
+				.cnt = MTK_WED_MIOD_CNT,
+				.unit = MTK_WED_MIOD_ENTRY_CNT,
+			},
+			[1] = {
+				.q_base = dev->rro.mcu_view_miod +
+					  MTK_WED_MIOD_ENTRY_CNT *
+					  MTK_WED_MIOD_CNT,
+				.cnt = MTK_WED_FB_CMD_CNT,
+				.unit = 4,
+			},
+		},
+		.wed = 0,
+	};
+
+	return mtk_wed_mcu_send_msg(wo, MODULE_ID_WO, MTK_WED_WO_CMD_WED_CFG,
+				    &req, sizeof(req), true);
+}
+
+static int
+mtk_wed_send_msg(struct mtk_wed_device *dev, int cmd_id, void *data, int len)
+{
+	struct mtk_wed_wo *wo = dev->hw->wed_wo;
+
+	if (dev->ver == MTK_WED_V1)
+		return 0;
+
+	return mtk_wed_mcu_send_msg(wo, MODULE_ID_WO, cmd_id, data, len, true);
+}
+
+static void
+mtk_wed_ppe_check(struct mtk_wed_device *dev, struct sk_buff *skb,
+			u32 reason, u32 hash)
+{
+	int idx = dev->hw->index;
+	struct mtk_eth *eth = dev->hw->eth;
+	struct ethhdr *eh;
+
+	if (reason == MTK_PPE_CPU_REASON_HIT_UNBIND_RATE_REACHED) {
+		if (!skb)
+			return;
+
+		skb_set_mac_header(skb, 0);
+		eh = eth_hdr(skb);
+		skb->protocol = eh->h_proto;
+		mtk_ppe_check_skb(eth->ppe[idx], skb, hash);
+	}
+}
+
 static void
 mtk_wed_start(struct mtk_wed_device *dev, u32 irq_mask)
 {
-	u32 wdma_mask;
-	int i;
+	int i, ret;
 
 	for (i = 0; i < ARRAY_SIZE(dev->tx_wdma); i++)
 		if (!dev->tx_wdma[i].desc)
-			mtk_wed_wdma_ring_setup(dev, i, 16);
-
+			mtk_wed_wdma_rx_ring_setup(dev, i, 16);
 
 	mtk_wed_hw_init(dev);
 
 	mtk_wed_set_int(dev, irq_mask);
-
-
 	mtk_wed_set_ext_int(dev, true);
 
 	if (dev->ver == MTK_WED_V1) {
@@ -797,8 +1274,20 @@ mtk_wed_start(struct mtk_wed_device *dev, u32 irq_mask)
 		val |= BIT(0);
 		regmap_write(dev->hw->mirror, dev->hw->index * 4, val);
 	} else {
-		mtk_wed_set_512_support(dev, dev->wlan.wcid_512);
+		/* driver set mid ready and only once */
+		wed_w32(dev, MTK_WED_EXT_INT_MASK1,
+			MTK_WED_EXT_INT_STATUS_WPDMA_MID_RDY);
+		wed_w32(dev, MTK_WED_EXT_INT_MASK2,
+			MTK_WED_EXT_INT_STATUS_WPDMA_MID_RDY);
+
+		wed_r32(dev, MTK_WED_EXT_INT_MASK1);
+		wed_r32(dev, MTK_WED_EXT_INT_MASK2);
+
+		ret = mtk_wed_rro_cfg(dev);
+		if (ret)
+			return;
 	}
+	mtk_wed_set_512_support(dev, dev->wlan.wcid_512);
 
 	mtk_wed_dma_enable(dev);
 	dev->running = true;
@@ -809,6 +1298,7 @@ mtk_wed_attach(struct mtk_wed_device *dev)
 	__releases(RCU)
 {
 	struct mtk_wed_hw *hw;
+	struct device *device;
 	u16 ver;
 	int ret = 0;
 
@@ -829,6 +1319,12 @@ mtk_wed_attach(struct mtk_wed_device *dev)
 		goto out;
 	}
 
+	device = dev->wlan.bus_type == MTK_WED_BUS_PCIE
+	? &dev->wlan.pci_dev->dev
+	: &dev->wlan.platform_dev->dev;
+	dev_info(device, "attaching wed device %d version %d\n",
+		 hw->index, hw->ver);
+
 	dev->hw = hw;
 	dev->dev = hw->dev;
 	dev->irq = hw->irq;
@@ -847,9 +1343,17 @@ mtk_wed_attach(struct mtk_wed_device *dev)
 	dev->rev_id = ((dev->ver << 28) | ver << 16);
 
 	ret = mtk_wed_buffer_alloc(dev);
-	if (ret) {
-		mtk_wed_detach(dev);
-		goto out;
+	if (ret)
+		goto error;
+
+	if (dev->ver > MTK_WED_V1) {
+		ret = mtk_wed_rx_bm_alloc(dev);
+		if (ret)
+			goto error;
+
+		ret = mtk_wed_rro_alloc(dev);
+		if (ret)
+			goto error;
 	}
 
 	mtk_wed_hw_init_early(dev);
@@ -857,7 +1361,12 @@ mtk_wed_attach(struct mtk_wed_device *dev)
 	if (dev->ver == MTK_WED_V1)
 		regmap_update_bits(hw->hifsys, HIFSYS_DMA_AG_MAP,
 				   BIT(hw->index), 0);
+	else
+		ret = mtk_wed_wo_init(hw);
 
+error:
+	if (ret)
+		mtk_wed_detach(dev);
 out:
 	mutex_unlock(&hw_lock);
 
@@ -883,10 +1392,10 @@ mtk_wed_tx_ring_setup(struct mtk_wed_device *dev, int idx, void __iomem *regs)
 
 	BUG_ON(idx > ARRAY_SIZE(dev->tx_ring));
 
-	if (mtk_wed_ring_alloc(dev, ring, MTK_WED_TX_RING_SIZE, 1))
+	if (mtk_wed_ring_alloc(dev, ring, MTK_WED_TX_RING_SIZE, 1, true))
 		return -ENOMEM;
 
-	if (mtk_wed_wdma_ring_setup(dev, idx, MTK_WED_WDMA_RING_SIZE))
+	if (mtk_wed_wdma_rx_ring_setup(dev, idx, MTK_WED_WDMA_RING_SIZE))
 		return -ENOMEM;
 
 	ring->reg_base = MTK_WED_RING_TX(idx);
@@ -933,6 +1442,35 @@ mtk_wed_txfree_ring_setup(struct mtk_wed_device *dev, void __iomem *regs)
 	return 0;
 }
 
+static int
+mtk_wed_rx_ring_setup(struct mtk_wed_device *dev, int idx, void __iomem *regs)
+{
+	struct mtk_wed_ring *ring = &dev->rx_ring[idx];
+
+	BUG_ON(idx > ARRAY_SIZE(dev->rx_ring));
+
+
+	if (mtk_wed_ring_alloc(dev, ring, MTK_WED_RX_RING_SIZE, 1, false))
+		return -ENOMEM;
+
+	if (mtk_wed_wdma_tx_ring_setup(dev, idx, MTK_WED_WDMA_RING_SIZE))
+		return -ENOMEM;
+
+	ring->reg_base = MTK_WED_RING_RX_DATA(idx);
+	ring->wpdma = regs;
+
+	/* WPDMA ->  WED */
+	wpdma_rx_w32(dev, idx, MTK_WED_RING_OFS_BASE, ring->desc_phys);
+	wpdma_rx_w32(dev, idx, MTK_WED_RING_OFS_COUNT, MTK_WED_RX_RING_SIZE);
+
+	wed_w32(dev, MTK_WED_WPDMA_RING_RX_DATA(idx) + MTK_WED_RING_OFS_BASE,
+		ring->desc_phys);
+	wed_w32(dev, MTK_WED_WPDMA_RING_RX_DATA(idx) + MTK_WED_RING_OFS_COUNT,
+		MTK_WED_RX_RING_SIZE);
+
+	return 0;
+}
+
 static u32
 mtk_wed_irq_get(struct mtk_wed_device *dev, u32 mask)
 {
@@ -1022,6 +1560,8 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
 		.attach = mtk_wed_attach,
 		.tx_ring_setup = mtk_wed_tx_ring_setup,
 		.txfree_ring_setup = mtk_wed_txfree_ring_setup,
+		.rx_ring_setup = mtk_wed_rx_ring_setup,
+		.msg_update = mtk_wed_send_msg,
 		.start = mtk_wed_start,
 		.stop = mtk_wed_stop,
 		.reset_dma = mtk_wed_reset_dma,
@@ -1030,6 +1570,7 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
 		.irq_get = mtk_wed_irq_get,
 		.irq_set_mask = mtk_wed_irq_set_mask,
 		.detach = mtk_wed_detach,
+		.ppe_check = mtk_wed_ppe_check,
 	};
 	struct device_node *eth_np = eth->dev->of_node;
 	struct platform_device *pdev;
@@ -1069,6 +1610,7 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
 	hw->wdma_phy = wdma_phy;
 	hw->index = index;
 	hw->irq = irq;
+	hw->ver = MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2) ? 2 : 1;
 
 	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
 		hw->mirror = syscon_regmap_lookup_by_phandle(eth_np,
@@ -1085,6 +1627,7 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
 			regmap_write(hw->mirror, 0, 0);
 			regmap_write(hw->mirror, 4, 0);
 		}
+		hw->ver = MTK_WED_V1;
 	}
 
 	mtk_wed_hw_add_debugfs(hw);
diff --git a/drivers/net/ethernet/mediatek/mtk_wed.h b/drivers/net/ethernet/mediatek/mtk_wed.h
index 9b17b74..8ef5253 100644
--- a/drivers/net/ethernet/mediatek/mtk_wed.h
+++ b/drivers/net/ethernet/mediatek/mtk_wed.h
@@ -13,6 +13,7 @@
 #define MTK_WED_PKT_SIZE		1900
 #define MTK_WED_BUF_SIZE		2048
 #define MTK_WED_BUF_PER_PAGE		(PAGE_SIZE / 2048)
+#define MTK_WED_RX_RING_SIZE		1536
 
 #define MTK_WED_TX_RING_SIZE		2048
 #define MTK_WED_WDMA_RING_SIZE		512
@@ -21,8 +22,15 @@
 #define MTK_WED_PER_GROUP_PKT		128
 
 #define MTK_WED_FBUF_SIZE		128
+#define MTK_WED_MIOD_CNT		16
+#define MTK_WED_FB_CMD_CNT		1024
+#define MTK_WED_RRO_QUE_CNT		8192
+#define MTK_WED_MIOD_ENTRY_CNT		128
+
+#define MODULE_ID_WO		1
 
 struct mtk_eth;
+struct mtk_wed_wo;
 
 struct mtk_wed_hw {
 	struct device_node *node;
@@ -34,12 +42,14 @@ struct mtk_wed_hw {
 	struct regmap *mirror;
 	struct dentry *debugfs_dir;
 	struct mtk_wed_device *wed_dev;
+	struct mtk_wed_wo *wed_wo;
 	u32 debugfs_reg;
 	u32 num_flows;
 	u32 wdma_phy;
 	char dirname[5];
 	int irq;
 	int index;
+	u32 ver;
 };
 
 struct mtk_wdma_info {
@@ -66,6 +76,18 @@ wed_r32(struct mtk_wed_device *dev, u32 reg)
 	return val;
 }
 
+static inline u32
+wifi_r32(struct mtk_wed_device *dev, u32 reg)
+{
+	return readl(dev->wlan.base + reg);
+}
+
+static inline void
+wifi_w32(struct mtk_wed_device *dev, u32 reg, u32 val)
+{
+	writel(val, dev->wlan.base + reg);
+}
+
 static inline void
 wdma_w32(struct mtk_wed_device *dev, u32 reg, u32 val)
 {
@@ -114,6 +136,23 @@ wpdma_txfree_w32(struct mtk_wed_device *dev, u32 reg, u32 val)
 	writel(val, dev->txfree_ring.wpdma + reg);
 }
 
+static inline u32
+wpdma_rx_r32(struct mtk_wed_device *dev, int ring, u32 reg)
+{
+	if (!dev->rx_ring[ring].wpdma)
+		return 0;
+
+	return readl(dev->rx_ring[ring].wpdma + reg);
+}
+
+static inline void
+wpdma_rx_w32(struct mtk_wed_device *dev, int ring, u32 reg, u32 val)
+{
+	if (!dev->rx_ring[ring].wpdma)
+		return;
+
+	writel(val, dev->rx_ring[ring].wpdma + reg);
+}
 void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
 		    void __iomem *wdma, u32 wdma_phy, int index);
 void mtk_wed_exit(void);
@@ -146,4 +185,16 @@ static inline void mtk_wed_hw_add_debugfs(struct mtk_wed_hw *hw)
 }
 #endif
 
+int wed_wo_hardware_init(struct mtk_wed_wo *wo, irq_handler_t isr);
+void wed_wo_hardware_exit(struct mtk_wed_wo *wo);
+int wed_wo_mcu_init(struct mtk_wed_wo *wo);
+int mtk_wed_exception_init(struct mtk_wed_wo *wo);
+void mtk_wed_mcu_rx_unsolicited_event(struct mtk_wed_wo *wo, struct sk_buff *skb);
+int mtk_wed_mcu_cmd_sanity_check(struct mtk_wed_wo *wo, struct sk_buff *skb);
+void wed_wo_mcu_debugfs(struct mtk_wed_hw *hw, struct dentry *dir);
+void mtk_wed_mcu_rx_event(struct mtk_wed_wo *wo, struct sk_buff *skb);
+int mtk_wed_mcu_send_msg(struct mtk_wed_wo *wo,int to_id, int cmd,
+			const void *data, int len, bool wait_resp);
+int mtk_wed_wo_rx_poll(struct napi_struct *napi, int budget);
+
 #endif
diff --git a/drivers/net/ethernet/mediatek/mtk_wed_ccif.c b/drivers/net/ethernet/mediatek/mtk_wed_ccif.c
new file mode 100644
index 0000000..951278b
--- /dev/null
+++ b/drivers/net/ethernet/mediatek/mtk_wed_ccif.c
@@ -0,0 +1,133 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <linux/soc/mediatek/mtk_wed.h>
+#include <linux/of_address.h>
+#include <linux/mfd/syscon.h>
+#include <linux/of_irq.h>
+#include "mtk_wed_ccif.h"
+#include "mtk_wed_regs.h"
+#include "mtk_wed_wo.h"
+
+static inline void woif_set_isr(struct mtk_wed_wo *wo, u32 mask)
+{
+	woccif_w32(wo, MTK_WED_WO_CCIF_IRQ0_MASK, mask);
+}
+
+static inline u32 woif_get_csr(struct mtk_wed_wo *wo)
+{
+	u32 val;
+
+	val = woccif_r32(wo, MTK_WED_WO_CCIF_RCHNUM);
+
+	return  val & MTK_WED_WO_CCIF_RCHNUM_MASK;
+}
+
+static inline void woif_set_ack(struct mtk_wed_wo *wo, u32 mask)
+{
+	woccif_w32(wo, MTK_WED_WO_CCIF_ACK, mask);
+}
+
+static inline void woif_kickout(struct mtk_wed_wo *wo)
+{
+	woccif_w32(wo, MTK_WED_WO_CCIF_BUSY, 1 << MTK_WED_WO_TXCH_NUM);
+	woccif_w32(wo, MTK_WED_WO_CCIF_TCHNUM, MTK_WED_WO_TXCH_NUM);
+}
+
+static inline void woif_clear_int(struct mtk_wed_wo *wo, u32 mask)
+{
+	woccif_w32(wo, MTK_WED_WO_CCIF_ACK, mask);
+	woccif_r32(wo, MTK_WED_WO_CCIF_RCHNUM);
+}
+
+int wed_wo_hardware_init(struct mtk_wed_wo *wo, irq_handler_t isr)
+{
+	static const struct wed_wo_drv_ops wo_drv_ops = {
+		.kickout = woif_kickout,
+		.set_ack = woif_set_ack,
+		.set_isr = woif_set_isr,
+		.get_csr = woif_get_csr,
+		.clear_int = woif_clear_int,
+	};
+	struct device_node *np, *node = wo->hw->node;
+	struct wed_wo_queue_regs queues;
+	struct regmap *regs;
+	int ret;
+
+	np = of_parse_phandle(node, "mediatek,ap2woccif", 0);
+	if (!np)
+		return -ENODEV;
+
+	regs = syscon_regmap_lookup_by_phandle(np, NULL);
+	if (!regs)
+		return -ENODEV;
+
+	wo->drv_ops = &wo_drv_ops;
+
+	wo->ccif.regs = regs;
+	wo->ccif.irq = irq_of_parse_and_map(np, 0);
+
+	spin_lock_init(&wo->ccif.irq_lock);
+
+	ret = request_irq(wo->ccif.irq, isr, IRQF_TRIGGER_HIGH,
+			  "wo_ccif_isr", wo);
+	if (ret)
+		goto free_irq;
+
+	queues.desc_base = MTK_WED_WO_CCIF_DUMMY1;
+	queues.ring_size = MTK_WED_WO_CCIF_DUMMY2;
+	queues.cpu_idx = MTK_WED_WO_CCIF_DUMMY3;
+	queues.dma_idx = MTK_WED_WO_CCIF_SHADOW4;
+
+	ret = mtk_wed_wo_q_alloc(wo, &wo->q_tx, MTK_WED_WO_RING_SIZE,
+				 MTK_WED_WO_CMD_LEN, MTK_WED_WO_TXCH_NUM,
+				 &queues);
+
+	if (ret)
+		goto free_irq;
+
+	queues.desc_base = MTK_WED_WO_CCIF_DUMMY5;
+	queues.ring_size = MTK_WED_WO_CCIF_DUMMY6;
+	queues.cpu_idx = MTK_WED_WO_CCIF_DUMMY7;
+	queues.dma_idx = MTK_WED_WO_CCIF_SHADOW8;
+
+	ret = mtk_wed_wo_q_alloc(wo, &wo->q_rx, MTK_WED_WO_RING_SIZE,
+				 MTK_WED_WO_CMD_LEN, MTK_WED_WO_RXCH_NUM,
+				 &queues);
+	if (ret)
+		goto free_irq;
+
+	wo->ccif.q_int_mask = MTK_WED_WO_RXCH_INT_MASK;
+
+	ret = mtk_wed_wo_q_init(wo, mtk_wed_wo_rx_poll);
+	if (ret)
+		goto free_irq;
+
+	wo->ccif.q_exep_mask = MTK_WED_WO_EXCEPTION_INT_MASK;
+	wo->ccif.irqmask = MTK_WED_WO_ALL_INT_MASK;
+
+	/* rx queue irqmask */
+	wo->drv_ops->set_isr(wo, wo->ccif.irqmask);
+
+	return 0;
+
+free_irq:
+	free_irq(wo->ccif.irq, wo);
+
+	return ret;
+}
+
+void wed_wo_hardware_exit(struct mtk_wed_wo *wo)
+{
+	wo->drv_ops->set_isr(wo, 0);
+
+	disable_irq(wo->ccif.irq);
+	free_irq(wo->ccif.irq, wo);
+
+	tasklet_disable(&wo->irq_tasklet);
+	netif_napi_del(&wo->napi);
+
+	mtk_wed_wo_q_tx_clean(wo, &wo->q_tx);
+	mtk_wed_wo_q_rx_clean(wo, &wo->q_rx);
+	mtk_wed_wo_q_free(wo, &wo->q_tx);
+	mtk_wed_wo_q_free(wo, &wo->q_rx);
+}
diff --git a/drivers/net/ethernet/mediatek/mtk_wed_ccif.h b/drivers/net/ethernet/mediatek/mtk_wed_ccif.h
new file mode 100644
index 0000000..68ade44
--- /dev/null
+++ b/drivers/net/ethernet/mediatek/mtk_wed_ccif.h
@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#ifndef __MTK_WED_CCIF_H
+#define __MTK_WED_CCIF_H
+
+#define MTK_WED_WO_RING_SIZE	256
+#define MTK_WED_WO_CMD_LEN	1504
+
+#define MTK_WED_WO_TXCH_NUM	0
+#define MTK_WED_WO_RXCH_NUM	1
+#define MTK_WED_WO_RXCH_WO_EXCEPTION	7
+
+#define MTK_WED_WO_TXCH_INT_MASK	BIT(0)
+#define MTK_WED_WO_RXCH_INT_MASK	BIT(1)
+#define MTK_WED_WO_EXCEPTION_INT_MASK	BIT(7)
+#define MTK_WED_WO_ALL_INT_MASK		MTK_WED_WO_RXCH_INT_MASK |	\
+					MTK_WED_WO_EXCEPTION_INT_MASK
+
+#define MTK_WED_WO_CCIF_BUSY		0x004
+#define MTK_WED_WO_CCIF_START		0x008
+#define MTK_WED_WO_CCIF_TCHNUM		0x00c
+#define MTK_WED_WO_CCIF_RCHNUM		0x010
+#define MTK_WED_WO_CCIF_RCHNUM_MASK	GENMASK(7, 0)
+
+#define MTK_WED_WO_CCIF_ACK		0x014
+#define MTK_WED_WO_CCIF_IRQ0_MASK	0x018
+#define MTK_WED_WO_CCIF_IRQ1_MASK	0x01c
+#define MTK_WED_WO_CCIF_DUMMY1		0x020
+#define MTK_WED_WO_CCIF_DUMMY2		0x024
+#define MTK_WED_WO_CCIF_DUMMY3		0x028
+#define MTK_WED_WO_CCIF_DUMMY4		0x02c
+#define MTK_WED_WO_CCIF_SHADOW1		0x030
+#define MTK_WED_WO_CCIF_SHADOW2		0x034
+#define MTK_WED_WO_CCIF_SHADOW3		0x038
+#define MTK_WED_WO_CCIF_SHADOW4		0x03c
+#define MTK_WED_WO_CCIF_DUMMY5		0x050
+#define MTK_WED_WO_CCIF_DUMMY6		0x054
+#define MTK_WED_WO_CCIF_DUMMY7		0x058
+#define MTK_WED_WO_CCIF_DUMMY8		0x05c
+#define MTK_WED_WO_CCIF_SHADOW5		0x060
+#define MTK_WED_WO_CCIF_SHADOW6		0x064
+#define MTK_WED_WO_CCIF_SHADOW7		0x068
+#define MTK_WED_WO_CCIF_SHADOW8		0x06c
+
+#endif
diff --git a/drivers/net/ethernet/mediatek/mtk_wed_debugfs.c b/drivers/net/ethernet/mediatek/mtk_wed_debugfs.c
index f420f18..4a9e684 100644
--- a/drivers/net/ethernet/mediatek/mtk_wed_debugfs.c
+++ b/drivers/net/ethernet/mediatek/mtk_wed_debugfs.c
@@ -2,6 +2,7 @@
 /* Copyright (C) 2021 Felix Fietkau <nbd@nbd.name> */
 
 #include <linux/seq_file.h>
+#include <linux/soc/mediatek/mtk_wed.h>
 #include "mtk_wed.h"
 #include "mtk_wed_regs.h"
 
@@ -18,6 +19,8 @@ enum {
 	DUMP_TYPE_WDMA,
 	DUMP_TYPE_WPDMA_TX,
 	DUMP_TYPE_WPDMA_TXFREE,
+	DUMP_TYPE_WPDMA_RX,
+	DUMP_TYPE_WED_RRO,
 };
 
 #define DUMP_STR(_str) { _str, 0, DUMP_TYPE_STRING }
@@ -36,6 +39,10 @@ enum {
 
 #define DUMP_WPDMA_TX_RING(_n) DUMP_RING("WPDMA_TX" #_n, 0, DUMP_TYPE_WPDMA_TX, _n)
 #define DUMP_WPDMA_TXFREE_RING DUMP_RING("WPDMA_RX1", 0, DUMP_TYPE_WPDMA_TXFREE)
+#define DUMP_WPDMA_RX_RING(_n)	DUMP_RING("WPDMA_RX" #_n, 0, DUMP_TYPE_WPDMA_RX, _n)
+#define DUMP_WED_RRO_RING(_base)DUMP_RING("WED_RRO_MIOD", MTK_##_base, DUMP_TYPE_WED_RRO)
+#define DUMP_WED_RRO_FDBK(_base)DUMP_RING("WED_RRO_FDBK", MTK_##_base, DUMP_TYPE_WED_RRO)
+
 
 static void
 print_reg_val(struct seq_file *s, const char *name, u32 val)
@@ -58,6 +65,7 @@ dump_wed_regs(struct seq_file *s, struct mtk_wed_device *dev,
 				   cur->name);
 			continue;
 		case DUMP_TYPE_WED:
+		case DUMP_TYPE_WED_RRO:
 			val = wed_r32(dev, cur->offset);
 			break;
 		case DUMP_TYPE_WDMA:
@@ -69,6 +77,9 @@ dump_wed_regs(struct seq_file *s, struct mtk_wed_device *dev,
 		case DUMP_TYPE_WPDMA_TXFREE:
 			val = wpdma_txfree_r32(dev, cur->offset);
 			break;
+		case DUMP_TYPE_WPDMA_RX:
+			val = wpdma_rx_r32(dev, cur->base, cur->offset);
+			break;
 		}
 		print_reg_val(s, cur->name, val);
 	}
@@ -132,6 +143,81 @@ wed_txinfo_show(struct seq_file *s, void *data)
 }
 DEFINE_SHOW_ATTRIBUTE(wed_txinfo);
 
+static int
+wed_rxinfo_show(struct seq_file *s, void *data)
+{
+	static const struct reg_dump regs[] = {
+		DUMP_STR("WPDMA RX"),
+		DUMP_WPDMA_RX_RING(0),
+		DUMP_WPDMA_RX_RING(1),
+
+		DUMP_STR("WPDMA RX"),
+		DUMP_WED(WED_WPDMA_RX_D_MIB(0)),
+		DUMP_WED_RING(WED_WPDMA_RING_RX_DATA(0)),
+		DUMP_WED(WED_WPDMA_RX_D_PROCESSED_MIB(0)),
+		DUMP_WED(WED_WPDMA_RX_D_MIB(1)),
+		DUMP_WED_RING(WED_WPDMA_RING_RX_DATA(1)),
+		DUMP_WED(WED_WPDMA_RX_D_PROCESSED_MIB(1)),
+		DUMP_WED(WED_WPDMA_RX_D_COHERENT_MIB),
+
+		DUMP_STR("WED RX"),
+		DUMP_WED_RING(WED_RING_RX_DATA(0)),
+		DUMP_WED_RING(WED_RING_RX_DATA(1)),
+
+		DUMP_STR("WED RRO"),
+		DUMP_WED_RRO_RING(WED_RROQM_MIOD_CTRL0),
+		DUMP_WED(WED_RROQM_MID_MIB),
+		DUMP_WED(WED_RROQM_MOD_MIB),
+		DUMP_WED(WED_RROQM_MOD_COHERENT_MIB),
+		DUMP_WED_RRO_FDBK(WED_RROQM_FDBK_CTRL0),
+		DUMP_WED(WED_RROQM_FDBK_IND_MIB),
+		DUMP_WED(WED_RROQM_FDBK_ENQ_MIB),
+		DUMP_WED(WED_RROQM_FDBK_ANC_MIB),
+		DUMP_WED(WED_RROQM_FDBK_ANC2H_MIB),
+
+		DUMP_STR("WED Route QM"),
+		DUMP_WED(WED_RTQM_R2H_MIB(0)),
+		DUMP_WED(WED_RTQM_R2Q_MIB(0)),
+		DUMP_WED(WED_RTQM_Q2H_MIB(0)),
+		DUMP_WED(WED_RTQM_R2H_MIB(1)),
+		DUMP_WED(WED_RTQM_R2Q_MIB(1)),
+		DUMP_WED(WED_RTQM_Q2H_MIB(1)),
+		DUMP_WED(WED_RTQM_Q2N_MIB),
+		DUMP_WED(WED_RTQM_Q2B_MIB),
+		DUMP_WED(WED_RTQM_PFDBK_MIB),
+
+		DUMP_STR("WED WDMA TX"),
+		DUMP_WED(WED_WDMA_TX_MIB),
+		DUMP_WED_RING(WED_WDMA_RING_TX),
+
+		DUMP_STR("WDMA TX"),
+		DUMP_WDMA(WDMA_GLO_CFG),
+		DUMP_WDMA_RING(WDMA_RING_TX(0)),
+		DUMP_WDMA_RING(WDMA_RING_TX(1)),
+
+		DUMP_STR("WED RX BM"),
+		DUMP_WED(WED_RX_BM_BASE),
+		DUMP_WED(WED_RX_BM_RX_DMAD),
+		DUMP_WED(WED_RX_BM_PTR),
+		DUMP_WED(WED_RX_BM_TKID_MIB),
+		DUMP_WED(WED_RX_BM_BLEN),
+		DUMP_WED(WED_RX_BM_STS),
+		DUMP_WED(WED_RX_BM_INTF2),
+		DUMP_WED(WED_RX_BM_INTF),
+		DUMP_WED(WED_RX_BM_ERR_STS),
+	};
+
+	struct mtk_wed_hw *hw = s->private;
+	struct mtk_wed_device *dev = hw->wed_dev;
+
+	if (!dev)
+		return 0;
+
+	dump_wed_regs(s, dev, regs, ARRAY_SIZE(regs));
+
+	return 0;
+}
+DEFINE_SHOW_ATTRIBUTE(wed_rxinfo);
 
 static int
 mtk_wed_reg_set(void *data, u64 val)
@@ -175,4 +261,8 @@ void mtk_wed_hw_add_debugfs(struct mtk_wed_hw *hw)
 	debugfs_create_u32("regidx", 0600, dir, &hw->debugfs_reg);
 	debugfs_create_file_unsafe("regval", 0600, dir, hw, &fops_regval);
 	debugfs_create_file_unsafe("txinfo", 0400, dir, hw, &wed_txinfo_fops);
+	debugfs_create_file_unsafe("rxinfo", 0400, dir, hw, &wed_rxinfo_fops);
+	if (hw->ver != MTK_WED_V1) {
+		wed_wo_mcu_debugfs(hw, dir);
+	}
 }
diff --git a/drivers/net/ethernet/mediatek/mtk_wed_mcu.c b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
new file mode 100644
index 0000000..96e30a3
--- /dev/null
+++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
@@ -0,0 +1,590 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <linux/skbuff.h>
+#include <linux/debugfs.h>
+#include <linux/firmware.h>
+#include <linux/of_address.h>
+#include <linux/soc/mediatek/mtk_wed.h>
+#include "mtk_wed_regs.h"
+#include "mtk_wed_mcu.h"
+#include "mtk_wed_wo.h"
+
+struct sk_buff *
+mtk_wed_mcu_msg_alloc(struct mtk_wed_wo *wo,
+		      const void *data, int data_len)
+{
+	const struct wed_wo_mcu_ops *ops = wo->mcu_ops;
+	int length = ops->headroom + data_len;
+	struct sk_buff *skb;
+
+	skb = alloc_skb(length, GFP_KERNEL);
+	if (!skb)
+		return NULL;
+
+	memset(skb->head, 0, length);
+	skb_reserve(skb, ops->headroom);
+
+	if (data && data_len)
+		skb_put_data(skb, data, data_len);
+
+	return skb;
+}
+
+struct sk_buff *
+mtk_wed_mcu_get_response(struct mtk_wed_wo *wo, unsigned long expires)
+{
+	unsigned long timeout;
+
+	if (!time_is_after_jiffies(expires))
+		return NULL;
+
+	timeout = expires - jiffies;
+	wait_event_timeout(wo->mcu.wait,
+			   (!skb_queue_empty(&wo->mcu.res_q)),
+			   timeout);
+
+	return skb_dequeue(&wo->mcu.res_q);
+}
+
+int
+mtk_wed_mcu_skb_send_and_get_msg(struct mtk_wed_wo *wo,
+				 int to_id, int cmd, struct sk_buff *skb,
+				 bool wait_resp, struct sk_buff **ret_skb)
+{
+	unsigned long expires;
+	int ret, seq;
+
+	if (ret_skb)
+		*ret_skb = NULL;
+
+	mutex_lock(&wo->mcu.mutex);
+
+	ret = wo->mcu_ops->mcu_skb_send_msg(wo, to_id, cmd, skb, &seq, wait_resp);
+	if (ret < 0)
+		goto out;
+
+	if (!wait_resp) {
+		ret = 0;
+		goto out;
+	}
+
+	expires = jiffies + wo->mcu.timeout;
+
+	do {
+		skb = mtk_wed_mcu_get_response(wo, expires);
+		ret = wo->mcu_ops->mcu_parse_response(wo, cmd, skb, seq);
+
+		if (!ret && ret_skb)
+			*ret_skb = skb;
+		else
+			dev_kfree_skb(skb);
+	} while (ret == -EAGAIN);
+
+out:
+	mutex_unlock(&wo->mcu.mutex);
+
+	return ret;
+}
+
+void mtk_wed_mcu_rx_event(struct mtk_wed_wo *wo,
+			struct sk_buff *skb)
+{
+	skb_queue_tail(&wo->mcu.res_q, skb);
+	wake_up(&wo->mcu.wait);
+}
+
+static int mtk_wed_mcu_send_and_get_msg(struct mtk_wed_wo *wo,
+			int to_id, int cmd, const void *data, int len,
+			bool wait_resp, struct sk_buff **ret_skb)
+{
+	struct sk_buff *skb;
+
+	skb = mtk_wed_mcu_msg_alloc(wo, data, len);
+	if (!skb)
+		return -ENOMEM;
+
+	return mtk_wed_mcu_skb_send_and_get_msg(wo, to_id, cmd, skb, wait_resp, ret_skb);
+}
+
+int
+mtk_wed_mcu_send_msg(struct mtk_wed_wo *wo,
+			int to_id, int cmd,
+			const void *data, int len, bool wait_resp)
+{
+	struct sk_buff *skb = NULL;
+	int ret = 0;
+
+	ret = mtk_wed_mcu_send_and_get_msg(wo, to_id, cmd, data,
+					   len, wait_resp, &skb);
+	if (skb)
+		dev_kfree_skb(skb);
+
+	return ret;
+}
+
+int mtk_wed_exception_init(struct mtk_wed_wo *wo)
+{
+	struct wed_wo_exception *exp = &wo->exp;
+	struct {
+		u32 arg0;
+		u32 arg1;
+	}req;
+
+	exp->log_size = EXCEPTION_LOG_SIZE;
+	exp->log = kmalloc(exp->log_size, GFP_ATOMIC);
+	if (!exp->log)
+		return -ENOMEM;
+
+	memset(exp->log, 0, exp->log_size);
+	exp->phys = dma_map_single(wo->hw->dev, exp->log, exp->log_size,
+				   DMA_FROM_DEVICE);
+
+	if (unlikely(dma_mapping_error(wo->hw->dev, exp->phys))) {
+		dev_info(wo->hw->dev, "dma map error\n");
+		goto free;
+	}
+
+	req.arg0 = (u32)exp->phys;
+	req.arg1 = (u32)exp->log_size;
+
+	return mtk_wed_mcu_send_msg(wo, MODULE_ID_WO, MTK_WED_WO_CMD_EXCEPTION_INIT,
+				    &req, sizeof(req), false);
+
+free:
+	kfree(exp->log);
+	return -ENOMEM;
+}
+
+int
+mtk_wed_mcu_cmd_sanity_check(struct mtk_wed_wo *wo, struct sk_buff *skb)
+{
+	struct wed_cmd_hdr *hdr = (struct wed_cmd_hdr *)skb->data;
+
+	if (hdr->ver != 0)
+		return WARP_INVALID_PARA_STATUS;
+
+	if (skb->len < sizeof(struct wed_cmd_hdr))
+		return WARP_INVALID_PARA_STATUS;
+
+	if (skb->len != hdr->length)
+		return WARP_INVALID_PARA_STATUS;
+
+	return WARP_OK_STATUS;
+}
+
+void
+mtk_wed_mcu_rx_unsolicited_event(struct mtk_wed_wo *wo, struct sk_buff *skb)
+{
+	struct mtk_wed_device *wed = wo->hw->wed_dev;
+	struct wed_cmd_hdr *hdr = (struct wed_cmd_hdr *)skb->data;
+	struct wed_wo_log *record;
+	struct mtk_wed_wo_rx_stats *rxcnt;
+	char *msg = (char *)(skb->data + sizeof(struct wed_cmd_hdr));
+	u16 msg_len = skb->len - sizeof(struct wed_cmd_hdr);
+	u32 i, cnt = 0;
+
+	switch (hdr->cmd_id) {
+	case WO_EVT_LOG_DUMP:
+		pr_info("[WO LOG]: %s\n", msg);
+		break;
+	case WO_EVT_PROFILING:
+		cnt = msg_len / (sizeof(struct wed_wo_log));
+		record = (struct wed_wo_log *) msg;
+		dev_info(wo->hw->dev, "[WO Profiling]: %d report arrived!\n", cnt);
+
+		for (i = 0 ; i < cnt ; i++) {
+			//PROFILE_STAT(wo->total, record[i].total);
+			//PROFILE_STAT(wo->mod, record[i].mod);
+			//PROFILE_STAT(wo->rro, record[i].rro);
+
+			dev_info(wo->hw->dev, "[WO Profiling]:  SN:%u with latency: total=%u, rro:%u, mod:%u\n",
+				 record[i].sn,
+				 record[i].total,
+				 record[i].rro,
+				 record[i].mod);
+		}
+		break;
+	case WO_EVT_RXCNT_INFO:
+		cnt = *(u32 *)msg;
+		rxcnt = (struct mtk_wed_wo_rx_stats *)((u32 *)msg+1);
+
+		for (i = 0; i < cnt; i++)
+			if (wed->wlan.update_wo_rx_stats)
+				wed->wlan.update_wo_rx_stats(wed, &rxcnt[i]);
+		break;
+	default:
+		break;
+	}
+
+	dev_kfree_skb(skb);
+
+}
+
+static int
+mtk_wed_load_firmware(struct mtk_wed_wo *wo)
+{
+	struct fw_info {
+		__le32 decomp_crc;
+		__le32 decomp_len;
+		__le32 decomp_blk_sz;
+		u8 reserved[4];
+		__le32 addr;
+		__le32 len;
+		u8 feature_set;
+		u8 reserved1[15];
+	} __packed *region;
+
+	char *mcu;
+	const struct mtk_wed_fw_trailer *hdr;
+	static u8 shared[MAX_REGION_SIZE] = {0};
+	const struct firmware *fw;
+	int ret, i;
+	u32 ofs = 0;
+	u32 boot_cr, val;
+
+	if (of_device_is_compatible(wo->hw->node, "mediatek,mt7981-wed"))
+		mcu = MT7981_FIRMWARE_WO;
+	else
+		mcu = wo->hw->index ? MT7986_FIRMWARE_WO_2 :
+				      MT7986_FIRMWARE_WO_1;
+
+	ret = request_firmware(&fw, mcu, wo->hw->dev);
+	if (ret)
+		return ret;
+
+	hdr = (const struct mtk_wed_fw_trailer *)(fw->data + fw->size -
+						  sizeof(*hdr));
+
+	dev_info(wo->hw->dev, "WO Firmware Version: %.10s, Build Time: %.15s\n",
+		 hdr->fw_ver, hdr->build_date);
+
+	for (i = 0; i < hdr->n_region; i++) {
+		int j = 0;
+		region = (struct fw_info *)(fw->data + fw->size -
+					    sizeof(*hdr) -
+					    sizeof(*region) *
+					    (hdr->n_region - i));
+
+		while (j < MAX_REGION_SIZE) {
+			struct mtk_wed_fw_region *wo_region;
+
+			wo_region = &wo->region[j];
+			if (!wo_region->addr)
+				break;
+
+			if (wo_region->addr_pa == region->addr) {
+				if (!wo_region->shared) {
+					memcpy(wo_region->addr,
+					       fw->data + ofs, region->len);
+				} else if (!shared[j]) {
+					memcpy(wo_region->addr,
+					       fw->data + ofs, region->len);
+					shared[j] = true;
+				}
+			}
+			j++;
+		}
+
+		if (j == __WO_REGION_MAX) {
+			ret = -ENOENT;
+			goto done;
+		}
+		ofs += region->len;
+	}
+
+	/* write the start address */
+	boot_cr = wo->hw->index ?
+		WOX_MCU_CFG_LS_WA_BOOT_ADDR_ADDR : WOX_MCU_CFG_LS_WM_BOOT_ADDR_ADDR;
+	wo_w32(wo, boot_cr, (wo->region[WO_REGION_EMI].addr_pa >> 16));
+
+	/* wo firmware reset */
+	wo_w32(wo, WOX_MCU_CFG_LS_WF_MCCR_CLR_ADDR, 0xc00);
+
+	val = wo_r32(wo, WOX_MCU_CFG_LS_WF_MCU_CFG_WM_WA_ADDR);
+
+	val |= wo->hw->index ? WOX_MCU_CFG_LS_WF_MCU_CFG_WM_WA_WA_CPU_RSTB_MASK :
+		WOX_MCU_CFG_LS_WF_MCU_CFG_WM_WA_WM_CPU_RSTB_MASK;
+
+	wo_w32(wo, WOX_MCU_CFG_LS_WF_MCU_CFG_WM_WA_ADDR, val);
+
+done:
+	release_firmware(fw);
+
+	return ret;
+}
+
+static int
+mtk_wed_get_firmware_region(struct mtk_wed_wo *wo)
+{
+	struct device_node *node, *np = wo->hw->node;
+	struct mtk_wed_fw_region *region;
+	struct resource res;
+	const char *compat;
+	int i, ret;
+
+	static const char *const wo_region_compat[__WO_REGION_MAX] = {
+		[WO_REGION_EMI] = WOCPU_EMI_DEV_NODE,
+		[WO_REGION_ILM] = WOCPU_ILM_DEV_NODE,
+		[WO_REGION_DATA] = WOCPU_DATA_DEV_NODE,
+		[WO_REGION_BOOT] = WOCPU_BOOT_DEV_NODE,
+	};
+
+	for (i = 0; i < __WO_REGION_MAX; i++) {
+		region = &wo->region[i];
+		compat = wo_region_compat[i];
+
+		node = of_parse_phandle(np, compat, 0);
+		if (!node)
+			return -ENODEV;
+
+		ret = of_address_to_resource(node, 0, &res);
+		if (ret)
+			return ret;
+
+		region->addr_pa = res.start;
+		region->size = resource_size(&res);
+		region->addr = ioremap(region->addr_pa, region->size);
+
+		of_property_read_u32_index(node, "shared", 0, &region->shared);
+	}
+
+	return 0;
+}
+
+static int
+wo_mcu_send_message(struct mtk_wed_wo *wo,
+			int to_id, int cmd, struct sk_buff *skb,
+			int *wait_seq, bool wait_resp)
+{
+	struct wed_cmd_hdr  *hdr;
+	u8 seq = 0;
+
+	/* TDO: make dynamic based on msg type */
+	wo->mcu.timeout = 20 * HZ;
+
+	if (wait_resp && wait_seq) {
+		seq = wo->mcu.msg_seq++ ;
+		*wait_seq = seq;
+	}
+
+	hdr = (struct wed_cmd_hdr *)skb_push(skb, sizeof(*hdr));
+
+	hdr->cmd_id = cmd;
+	hdr->length = cpu_to_le16(skb->len);
+	hdr->uni_id = seq;
+
+	if (to_id == MODULE_ID_WO)
+		hdr->flag |= WARP_CMD_FLAG_FROM_TO_WO;
+
+	if (wait_resp && wait_seq)
+		hdr->flag |= WARP_CMD_FLAG_NEED_RSP;
+
+	return mtk_wed_wo_q_tx_skb(wo, &wo->q_tx, skb);
+}
+
+static int
+wo_mcu_parse_response(struct mtk_wed_wo *wo, int cmd,
+			  struct sk_buff *skb, int seq)
+{
+	struct mtk_wed_device *wed = wo->hw->wed_dev;
+	struct wed_cmd_hdr  *hdr;
+	struct mtk_wed_wo_rx_stats *rxcnt = NULL;
+	u32 i, cnt = 0;
+
+	if (!skb) {
+		dev_err(wo->hw->dev, "Message %08x (seq %d) timeout\n",
+			cmd, seq);
+		return -ETIMEDOUT;
+	}
+
+	hdr = (struct wed_cmd_hdr *)skb->data;
+	if (seq != hdr->uni_id) {
+		dev_err(wo->hw->dev, "Message %08x (seq %d) with not match uid(%d)\n",
+			cmd, seq, hdr->uni_id);
+		return -EAGAIN;
+	}
+
+	skb_pull(skb, sizeof(struct wed_cmd_hdr));
+
+	switch (cmd) {
+	case MTK_WED_WO_CMD_RXCNT_INFO:
+		cnt = *(u32 *)skb->data;
+		rxcnt = (struct mtk_wed_wo_rx_stats *)((u32 *)skb->data+1);
+
+		for (i = 0; i < cnt; i++)
+			if (wed->wlan.update_wo_rx_stats)
+				wed->wlan.update_wo_rx_stats(wed, &rxcnt[i]);
+		break;
+	default:
+		break;
+	}
+
+	return 0;
+}
+
+int wed_wo_mcu_init(struct mtk_wed_wo *wo)
+{
+	static const struct wed_wo_mcu_ops wo_mcu_ops = {
+		.headroom = sizeof(struct wed_cmd_hdr),
+		.mcu_skb_send_msg = wo_mcu_send_message,
+		.mcu_parse_response = wo_mcu_parse_response,
+		/*TDO .mcu_restart = wo_mcu_restart,*/
+	};
+	unsigned long timeout = jiffies + FW_DL_TIMEOUT;
+	int ret;
+	u32 val;
+
+	wo->mcu_ops = &wo_mcu_ops;
+
+	ret = mtk_wed_get_firmware_region(wo);
+	if (ret)
+		return ret;
+
+	/* set dummy cr */
+	wed_w32(wo->hw->wed_dev, MTK_WED_SCR0 + 4 * WED_DUMMY_CR_FWDL,
+		wo->hw->index + 1);
+
+	ret = mtk_wed_load_firmware(wo);
+	if (ret)
+		return ret;
+
+	do {
+		/* get dummy cr */
+		val = wed_r32(wo->hw->wed_dev, MTK_WED_SCR0 + 4 * WED_DUMMY_CR_FWDL);
+	} while (val != 0 && !time_after(jiffies, timeout));
+
+	if (val)
+		return -EBUSY;
+
+	return 0;
+}
+
+static ssize_t
+mtk_wed_wo_ctrl(struct file *file,
+			 const char __user *user_buf,
+			 size_t count,
+			 loff_t *ppos)
+{
+	struct mtk_wed_hw *hw = file->private_data;
+	struct mtk_wed_wo *wo = hw->wed_wo;
+	char buf[100], *cmd = NULL, *input[11] = {0};
+	char msgbuf[128] = {0};
+	struct wo_cmd_query *query = (struct wo_cmd_query *)msgbuf;
+	u32 cmd_id;
+	bool wait = false;
+	char *sub_str = NULL;
+	int  input_idx = 0, input_total = 0, scan_num = 0;
+	char *p;
+
+	if (count > sizeof(buf))
+		return -EINVAL;
+
+	if (copy_from_user(buf, user_buf, count))
+		return -EFAULT;
+
+	if (count && buf[count - 1] == '\n')
+		buf[count - 1] = '\0';
+	else
+		buf[count] = '\0';
+
+	p = buf;
+
+	while ((sub_str = strsep(&p, " ")) != NULL) {
+		input[input_idx] = sub_str;
+		input_idx++;
+		input_total++;
+	}
+	cmd = input[0];
+	if (input_total == 1 && cmd) {
+		if (strncmp(cmd, "bainfo", strlen(cmd)) == 0) {
+			cmd_id = MTK_WED_WO_CMD_BA_INFO_DUMP;
+		} else if (strncmp(cmd, "bactrl", strlen(cmd)) == 0) {
+			cmd_id = MTK_WED_WO_CMD_BA_CTRL_DUMP;
+		} else if (strncmp(cmd, "fbcmdq", strlen(cmd)) == 0) {
+			cmd_id = MTK_WED_WO_CMD_FBCMD_Q_DUMP;
+		} else if (strncmp(cmd, "logflush", strlen(cmd)) == 0) {
+			cmd_id = MTK_WED_WO_CMD_LOG_FLUSH;
+		} else if (strncmp(cmd, "cpustat.dump", strlen(cmd)) == 0) {
+			cmd_id = MTK_WED_WO_CMD_CPU_STATS_DUMP;
+		} else if (strncmp(cmd, "state", strlen(cmd)) == 0) {
+			cmd_id = MTK_WED_WO_CMD_WED_RX_STAT;
+		} else if (strncmp(cmd, "prof_hit_dump", strlen(cmd)) == 0) {
+			//wo_profiling_report();
+			return count;
+		} else if (strncmp(cmd, "rxcnt_info", strlen(cmd)) == 0) {
+			cmd_id = MTK_WED_WO_CMD_RXCNT_INFO;
+			wait = true;
+		} else {
+			pr_info("(%s) unknown comand string(%s)!\n", __func__, cmd);
+			 return count;
+		}
+	}  else if (input_total > 1) {
+		for (input_idx = 1 ; input_idx < input_total ; input_idx++) {
+			scan_num = sscanf(input[input_idx], "%u", &query->query0+(input_idx - 1));
+
+			if (scan_num < 1) {
+				pr_info("(%s) require more input!\n", __func__);
+				return count;
+			}
+		}
+		if(strncmp(cmd, "devinfo", strlen(cmd)) == 0) {
+			cmd_id = MTK_WED_WO_CMD_DEV_INFO_DUMP;
+		} else if (strncmp(cmd, "bssinfo", strlen(cmd)) == 0) {
+			cmd_id = MTK_WED_WO_CMD_BSS_INFO_DUMP;
+		} else if (strncmp(cmd, "starec", strlen(cmd)) == 0) {
+			cmd_id = MTK_WED_WO_CMD_STA_REC_DUMP;
+		} else if (strncmp(cmd, "starec_ba", strlen(cmd)) == 0) {
+			cmd_id = MTK_WED_WO_CMD_STA_BA_DUMP;
+		} else if (strncmp(cmd, "logctrl", strlen(cmd)) == 0) {
+			cmd_id = MTK_WED_WO_CMD_FW_LOG_CTRL;
+		} else if (strncmp(cmd, "cpustat.en", strlen(cmd)) == 0) {
+			cmd_id = MTK_WED_WO_CMD_CPU_STATS_ENABLE;
+		} else if (strncmp(cmd, "prof_conf", strlen(cmd)) == 0) {
+			cmd_id = MTK_WED_WO_CMD_PROF_CTRL;
+		} else if (strncmp(cmd, "rxcnt_ctrl", strlen(cmd)) == 0) {
+			cmd_id = MTK_WED_WO_CMD_RXCNT_CTRL;
+		} else if (strncmp(cmd, "dbg_set", strlen(cmd)) == 0) {
+			cmd_id = MTK_WED_WO_CMD_DBG_INFO;
+		}
+	} else {
+		dev_info(hw->dev, "usage: echo cmd='cmd_str' > wo_write\n");
+		dev_info(hw->dev, "cmd_str value range:\n");
+		dev_info(hw->dev, "\tbainfo:\n");
+		dev_info(hw->dev, "\tbactrl:\n");
+		dev_info(hw->dev, "\tfbcmdq:\n");
+		dev_info(hw->dev, "\tlogflush:\n");
+		dev_info(hw->dev, "\tcpustat.dump:\n");
+		dev_info(hw->dev, "\tprof_hit_dump:\n");
+		dev_info(hw->dev, "\trxcnt_info:\n");
+		dev_info(hw->dev, "\tdevinfo:\n");
+		dev_info(hw->dev, "\tbssinfo:\n");
+		dev_info(hw->dev, "\tstarec:\n");
+		dev_info(hw->dev, "\tstarec_ba:\n");
+		dev_info(hw->dev, "\tlogctrl:\n");
+		dev_info(hw->dev, "\tcpustat.en:\n");
+		dev_info(hw->dev, "\tprof_conf:\n");
+		dev_info(hw->dev, "\trxcnt_ctrl:\n");
+		dev_info(hw->dev, "\tdbg_set [level] [category]:\n");
+		return count;
+	}
+
+	mtk_wed_mcu_send_msg(wo, MODULE_ID_WO, cmd_id, (void *)msgbuf, sizeof(struct wo_cmd_query), wait);
+
+	return count;
+
+}
+
+static const struct file_operations fops_wo_ctrl = {
+	.write = mtk_wed_wo_ctrl,
+	.open = simple_open,
+	.llseek = default_llseek,
+};
+
+void wed_wo_mcu_debugfs(struct mtk_wed_hw *hw, struct dentry *dir)
+{
+	if (!dir)
+		return;
+
+	debugfs_create_file("wo_write", 0600, dir, hw, &fops_wo_ctrl);
+}
+
diff --git a/drivers/net/ethernet/mediatek/mtk_wed_mcu.h b/drivers/net/ethernet/mediatek/mtk_wed_mcu.h
new file mode 100644
index 0000000..19e1199
--- /dev/null
+++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.h
@@ -0,0 +1,97 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#ifndef __MTK_WED_MCU_H
+#define __MTK_WED_MCU_H
+
+#define EXCEPTION_LOG_SIZE		32768
+#define WOCPU_MCUSYS_RESET_ADDR		0x15194050
+#define WOCPU_WO0_MCUSYS_RESET_MASK 	0x20
+#define WOCPU_WO1_MCUSYS_RESET_MASK 	0x1
+
+#define WARP_INVALID_LENGTH_STATUS (-2)
+#define WARP_NULL_POINTER_STATUS (-3)
+#define WARP_INVALID_PARA_STATUS (-4)
+#define WARP_NOT_HANDLE_STATUS (-5)
+#define WARP_FAIL_STATUS (-1)
+#define WARP_OK_STATUS (0)
+#define WARP_ALREADY_DONE_STATUS (1)
+
+#define MT7981_FIRMWARE_WO		"mediatek/mt7981_wo.bin"
+#define MT7986_FIRMWARE_WO_1		"mediatek/mt7986_wo_0.bin"
+#define MT7986_FIRMWARE_WO_2		"mediatek/mt7986_wo_1.bin"
+
+#define WOCPU_EMI_DEV_NODE		"mediatek,wocpu_emi"
+#define WOCPU_ILM_DEV_NODE		"mediatek,wocpu_ilm"
+#define WOCPU_DLM_DEV_NODE		"mediatek,wocpu_dlm"
+#define WOCPU_DATA_DEV_NODE		"mediatek,wocpu_data"
+#define WOCPU_BOOT_DEV_NODE		"mediatek,wocpu_boot"
+
+#define FW_DL_TIMEOUT		((3000 * HZ) / 1000)
+#define WOCPU_TIMEOUT		((1000 * HZ) / 1000)
+
+#define MAX_REGION_SIZE	3
+
+#define WOX_MCU_CFG_LS_BASE	0 /*0x15194000*/
+
+#define WOX_MCU_CFG_LS_HW_VER_ADDR		(WOX_MCU_CFG_LS_BASE + 0x000) // 4000
+#define WOX_MCU_CFG_LS_FW_VER_ADDR		(WOX_MCU_CFG_LS_BASE + 0x004) // 4004
+#define WOX_MCU_CFG_LS_CFG_DBG1_ADDR		(WOX_MCU_CFG_LS_BASE + 0x00C) // 400C
+#define WOX_MCU_CFG_LS_CFG_DBG2_ADDR 		(WOX_MCU_CFG_LS_BASE + 0x010) // 4010
+#define WOX_MCU_CFG_LS_WF_MCCR_ADDR		(WOX_MCU_CFG_LS_BASE + 0x014) // 4014
+#define WOX_MCU_CFG_LS_WF_MCCR_SET_ADDR		(WOX_MCU_CFG_LS_BASE + 0x018) // 4018
+#define WOX_MCU_CFG_LS_WF_MCCR_CLR_ADDR		(WOX_MCU_CFG_LS_BASE + 0x01C) // 401C
+#define WOX_MCU_CFG_LS_WF_MCU_CFG_WM_WA_ADDR	(WOX_MCU_CFG_LS_BASE + 0x050) // 4050
+#define WOX_MCU_CFG_LS_WM_BOOT_ADDR_ADDR 	(WOX_MCU_CFG_LS_BASE + 0x060) // 4060
+#define WOX_MCU_CFG_LS_WA_BOOT_ADDR_ADDR	(WOX_MCU_CFG_LS_BASE + 0x064) // 4064
+
+#define WOX_MCU_CFG_LS_WF_MCU_CFG_WM_WA_WM_CPU_RSTB_MASK	BIT(5)
+#define WOX_MCU_CFG_LS_WF_MCU_CFG_WM_WA_WA_CPU_RSTB_MASK	BIT(0)
+
+
+enum wo_event_id {
+	WO_EVT_LOG_DUMP = 0x1,
+	WO_EVT_PROFILING = 0x2,
+	WO_EVT_RXCNT_INFO = 0x3
+};
+
+enum wo_state {
+	WO_STATE_UNDEFINED 	= 0x0,
+	WO_STATE_INIT 		= 0x1,
+	WO_STATE_ENABLE		= 0x2,
+	WO_STATE_DISABLE	= 0x3,
+	WO_STATE_HALT		= 0x4,
+	WO_STATE_GATING		= 0x5,
+	WO_STATE_SER_RESET 	= 0x6,
+	WO_STATE_WF_RESET	= 0x7,
+	WO_STATE_END
+};
+
+enum wo_done_state {
+	WOIF_UNDEFINED		= 0,
+	WOIF_DISABLE_DONE 	= 1,
+	WOIF_TRIGGER_ENABLE	= 2,
+	WOIF_ENABLE_DONE	= 3,
+	WOIF_TRIGGER_GATING	= 4,
+	WOIF_GATING_DONE	= 5,
+	WOIF_TRIGGER_HALT	= 6,
+	WOIF_HALT_DONE		= 7,
+};
+
+enum wed_dummy_cr_idx {
+	WED_DUMMY_CR_FWDL = 0,
+	WED_DUMMY_CR_WO_STATUS = 1
+};
+
+struct mtk_wed_fw_trailer {
+	u8 chip_id;
+	u8 eco_code;
+	u8 n_region;
+	u8 format_ver;
+	u8 format_flag;
+	u8 reserved[2];
+	char fw_ver[10];
+	char build_date[15];
+	u32 crc;
+};
+
+#endif
diff --git a/drivers/net/ethernet/mediatek/mtk_wed_regs.h b/drivers/net/ethernet/mediatek/mtk_wed_regs.h
index 14e0e21..31871f7 100644
--- a/drivers/net/ethernet/mediatek/mtk_wed_regs.h
+++ b/drivers/net/ethernet/mediatek/mtk_wed_regs.h
@@ -4,6 +4,8 @@
 #ifndef __MTK_WED_REGS_H
 #define __MTK_WED_REGS_H
 
+#define MTK_WFDMA_DESC_CTRL_TO_HOST		BIT(8)
+
 #if defined(CONFIG_MEDIATEK_NETSYS_V2)
 #define MTK_WDMA_DESC_CTRL_LEN1			GENMASK(13, 0)
 #define MTK_WDMA_DESC_CTRL_LAST_SEG1		BIT(14)
@@ -16,6 +18,7 @@
 #define MTK_WDMA_DESC_CTRL_LEN0			GENMASK(29, 16)
 #define MTK_WDMA_DESC_CTRL_LAST_SEG0		BIT(30)
 #define MTK_WDMA_DESC_CTRL_DMA_DONE		BIT(31)
+#define MTK_WED_RX_BM_TOKEN			GENMASK(31, 16)
 
 struct mtk_wdma_desc {
 	__le32 buf0;
@@ -42,6 +45,8 @@ struct mtk_wdma_desc {
 #define MTK_WED_RESET_WED_TX_DMA			BIT(12)
 #define MTK_WED_RESET_WDMA_RX_DRV			BIT(17)
 #define MTK_WED_RESET_WDMA_INT_AGENT			BIT(19)
+#define MTK_WED_RESET_RX_RRO_QM				BIT(20)
+#define MTK_WED_RESET_RX_ROUTE_QM			BIT(21)
 #define MTK_WED_RESET_WED				BIT(31)
 
 #define MTK_WED_CTRL					0x00c
@@ -53,8 +58,12 @@ struct mtk_wdma_desc {
 #define MTK_WED_CTRL_WED_TX_BM_BUSY			BIT(9)
 #define MTK_WED_CTRL_WED_TX_FREE_AGENT_EN		BIT(10)
 #define MTK_WED_CTRL_WED_TX_FREE_AGENT_BUSY		BIT(11)
-#define MTK_WED_CTRL_RESERVE_EN				BIT(12)
-#define MTK_WED_CTRL_RESERVE_BUSY			BIT(13)
+#define MTK_WED_CTRL_WED_RX_BM_EN			BIT(12)
+#define MTK_WED_CTRL_WED_RX_BM_BUSY			BIT(13)
+#define MTK_WED_CTRL_RX_RRO_QM_EN			BIT(14)
+#define MTK_WED_CTRL_RX_RRO_QM_BUSY			BIT(15)
+#define MTK_WED_CTRL_RX_ROUTE_QM_EN			BIT(16)
+#define MTK_WED_CTRL_RX_ROUTE_QM_BUSY			BIT(17)
 #define MTK_WED_CTRL_FINAL_DIDX_READ			BIT(24)
 #define MTK_WED_CTRL_ETH_DMAD_FMT			BIT(25)
 #define MTK_WED_CTRL_MIB_READ_CLEAR			BIT(28)
@@ -69,8 +78,8 @@ struct mtk_wdma_desc {
 #define MTK_WED_EXT_INT_STATUS_TX_TKID_LO_TH		BIT(10)
 #define MTK_WED_EXT_INT_STATUS_TX_TKID_HI_TH		BIT(11)
 #endif
-#define MTK_WED_EXT_INT_STATUS_RX_FBUF_LO_TH		BIT(12)
-#define MTK_WED_EXT_INT_STATUS_RX_FBUF_HI_TH		BIT(13)
+#define MTK_WED_EXT_INT_STATUS_RX_FREE_AT_EMPTY		BIT(12)
+#define MTK_WED_EXT_INT_STATUS_RX_FBUF_DMAD_ER		BIT(13)
 #define MTK_WED_EXT_INT_STATUS_RX_DRV_R_RESP_ERR	BIT(16)
 #define MTK_WED_EXT_INT_STATUS_RX_DRV_W_RESP_ERR	BIT(17)
 #define MTK_WED_EXT_INT_STATUS_RX_DRV_COHERENT		BIT(18)
@@ -87,8 +96,8 @@ struct mtk_wdma_desc {
 #define MTK_WED_EXT_INT_STATUS_ERROR_MASK		(MTK_WED_EXT_INT_STATUS_TF_LEN_ERR | \
 							 MTK_WED_EXT_INT_STATUS_TKID_WO_PYLD | \
 							 MTK_WED_EXT_INT_STATUS_TKID_TITO_INVALID | \
-							 MTK_WED_EXT_INT_STATUS_RX_FBUF_LO_TH | \
-							 MTK_WED_EXT_INT_STATUS_RX_FBUF_HI_TH | \
+							 MTK_WED_EXT_INT_STATUS_RX_FREE_AT_EMPTY | \
+							 MTK_WED_EXT_INT_STATUS_RX_FBUF_DMAD_ER | \
 							 MTK_WED_EXT_INT_STATUS_RX_DRV_R_RESP_ERR | \
 							 MTK_WED_EXT_INT_STATUS_RX_DRV_W_RESP_ERR | \
 							 MTK_WED_EXT_INT_STATUS_RX_DRV_INIT_WDMA_EN | \
@@ -96,6 +105,8 @@ struct mtk_wdma_desc {
 							 MTK_WED_EXT_INT_STATUS_TX_DMA_W_RESP_ERR)
 
 #define MTK_WED_EXT_INT_MASK				0x028
+#define MTK_WED_EXT_INT_MASK1				0x02c
+#define MTK_WED_EXT_INT_MASK2				0x030
 
 #define MTK_WED_STATUS					0x060
 #define MTK_WED_STATUS_TX				GENMASK(15, 8)
@@ -183,6 +194,9 @@ struct mtk_wdma_desc {
 
 #define MTK_WED_RING_RX(_n)				(0x400 + (_n) * 0x10)
 
+#define MTK_WED_RING_RX_DATA(_n)			(0x420 + (_n) * 0x10)
+
+#define MTK_WED_SCR0					0x3c0
 #define MTK_WED_WPDMA_INT_TRIGGER			0x504
 #define MTK_WED_WPDMA_INT_TRIGGER_RX_DONE		BIT(1)
 #define MTK_WED_WPDMA_INT_TRIGGER_TX_DONE		GENMASK(5, 4)
@@ -239,13 +253,19 @@ struct mtk_wdma_desc {
 
 #define MTK_WED_WPDMA_INT_CTRL_TX			0x530
 #define MTK_WED_WPDMA_INT_CTRL_TX0_DONE_EN 		BIT(0)
-#define MTK_WED_WPDMA_INT_CTRL_TX0_DONE_CLR 		BIT(1)
+#define MTK_WED_WPDMA_INT_CTRL_TX0_DONE_CLR		BIT(1)
 #define MTK_WED_WPDMA_INT_CTRL_TX0_DONE_TRIG		GENMASK(6, 2)
 #define MTK_WED_WPDMA_INT_CTRL_TX1_DONE_EN		BIT(8)
 #define MTK_WED_WPDMA_INT_CTRL_TX1_DONE_CLR		BIT(9)
 #define MTK_WED_WPDMA_INT_CTRL_TX1_DONE_TRIG		GENMASK(14, 10)
 
 #define MTK_WED_WPDMA_INT_CTRL_RX			0x534
+#define MTK_WED_WPDMA_INT_CTRL_RX0_EN			BIT(0)
+#define MTK_WED_WPDMA_INT_CTRL_RX0_CLR			BIT(1)
+#define MTK_WED_WPDMA_INT_CTRL_RX0_DONE_TRIG		GENMASK(6, 2)
+#define MTK_WED_WPDMA_INT_CTRL_RX1_EN			BIT(8)
+#define MTK_WED_WPDMA_INT_CTRL_RX1_CLR			BIT(9)
+#define MTK_WED_WPDMA_INT_CTRL_RX1_DONE_TRIG		GENMASK(14, 10)
 
 #define MTK_WED_WPDMA_INT_CTRL_TX_FREE			0x538
 #define MTK_WED_WPDMA_INT_CTRL_TX_FREE_DONE_EN		BIT(0)
@@ -270,13 +290,40 @@ struct mtk_wdma_desc {
 #define MTK_WED_WPDMA_TX_MIB(_n)			(0x5a0 + (_n) * 4)
 #define MTK_WED_WPDMA_TX_COHERENT_MIB(_n)		(0x5d0 + (_n) * 4)
 
+#define MTK_WED_WPDMA_RX_MIB(_n)			(0x5e0 + (_n) * 4)
+#define MTK_WED_WPDMA_RX_COHERENT_MIB(_n)		(0x5f0 + (_n) * 4)
+
 #define MTK_WED_WPDMA_RING_TX(_n)			(0x600 + (_n) * 0x10)
 #define MTK_WED_WPDMA_RING_RX(_n)			(0x700 + (_n) * 0x10)
+#define MTK_WED_WPDMA_RING_RX_DATA(_n)			(0x730 + (_n) * 0x10)
+
+#define MTK_WED_WPDMA_RX_D_GLO_CFG			0x75c
+#define MTK_WED_WPDMA_RX_D_RX_DRV_EN			BIT(0)
+#define MTK_WED_WPDMA_RX_D_INIT_PHASE_RXEN_SEL		GENMASK(11, 7)
+#define MTK_WED_WPDMA_RX_D_RXD_READ_LEN			GENMASK(31, 24)
+
+#define MTK_WED_WPDMA_RX_D_RST_IDX			0x760
+#define MTK_WED_WPDMA_RX_D_RST_CRX_IDX			GENMASK(17, 16)
+#define MTK_WED_WPDMA_RX_D_RST_DRV_IDX			GENMASK(25, 24)
+
+#define MTK_WED_WPDMA_RX_GLO_CFG			0x76c
+#define MTK_WED_WPDMA_RX_RING				0x770
+
+#define MTK_WED_WPDMA_RX_D_MIB(_n)			(0x774 + (_n) * 4)
+#define MTK_WED_WPDMA_RX_D_PROCESSED_MIB(_n)		(0x784 + (_n) * 4)
+#define MTK_WED_WPDMA_RX_D_COHERENT_MIB			0x78c
+
+#define MTK_WED_WDMA_RING_TX				0x800
+
+#define MTK_WED_WDMA_TX_MIB				0x810
+
+
 #define MTK_WED_WDMA_RING_RX(_n)			(0x900 + (_n) * 0x10)
 #define MTK_WED_WDMA_RX_THRES(_n)			(0x940 + (_n) * 0x4)
 
 #define MTK_WED_WDMA_GLO_CFG				0xa04
 #define MTK_WED_WDMA_GLO_CFG_TX_DRV_EN			BIT(0)
+#define MTK_WED_WDMA_GLO_CFG_TX_DDONE_CHK		BIT(1)
 #define MTK_WED_WDMA_GLO_CFG_RX_DRV_EN			BIT(2)
 #define MTK_WED_WDMA_GLO_CFG_RX_DRV_BUSY		BIT(3)
 #define MTK_WED_WDMA_GLO_CFG_BT_SIZE			GENMASK(5, 4)
@@ -320,6 +367,20 @@ struct mtk_wdma_desc {
 #define MTK_WED_WDMA_RX_RECYCLE_MIB(_n)			(0xae8 + (_n) * 4)
 #define MTK_WED_WDMA_RX_PROCESSED_MIB(_n)		(0xaf0 + (_n) * 4)
 
+#define MTK_WED_RX_BM_RX_DMAD				0xd80
+#define MTK_WED_RX_BM_RX_DMAD_SDL0			GENMASK(13, 0)
+
+#define MTK_WED_RX_BM_BASE				0xd84
+#define MTK_WED_RX_BM_INIT_PTR				0xd88
+#define MTK_WED_RX_BM_SW_TAIL 				GENMASK(15, 0)
+#define MTK_WED_RX_BM_INIT_SW_TAIL			BIT(16)
+
+#define MTK_WED_RX_PTR					0xd8c
+
+#define MTK_WED_RX_BM_DYN_ALLOC_TH			0xdb4
+#define MTK_WED_RX_BM_DYN_ALLOC_TH_H			GENMASK(31, 16)
+#define MTK_WED_RX_BM_DYN_ALLOC_TH_L			GENMASK(15, 0)
+
 #define MTK_WED_RING_OFS_BASE				0x00
 #define MTK_WED_RING_OFS_COUNT				0x04
 #define MTK_WED_RING_OFS_CPU_IDX			0x08
@@ -330,12 +391,13 @@ struct mtk_wdma_desc {
 
 #define MTK_WDMA_GLO_CFG				0x204
 #define MTK_WDMA_GLO_CFG_TX_DMA_EN			BIT(0)
+#define MTK_WDMA_GLO_CFG_TX_DMA_BUSY			BIT(1)
 #define MTK_WDMA_GLO_CFG_RX_DMA_EN			BIT(2)
+#define MTK_WDMA_GLO_CFG_RX_DMA_BUSY			BIT(3)
 #define MTK_WDMA_GLO_CFG_RX_INFO3_PRERES		BIT(26)
 #define MTK_WDMA_GLO_CFG_RX_INFO2_PRERES		BIT(27)
 #define MTK_WDMA_GLO_CFG_RX_INFO1_PRERES		BIT(28)
 
-
 #define MTK_WDMA_RESET_IDX				0x208
 #define MTK_WDMA_RESET_IDX_TX				GENMASK(3, 0)
 #define MTK_WDMA_RESET_IDX_RX				GENMASK(17, 16)
@@ -359,4 +421,70 @@ struct mtk_wdma_desc {
 /* DMA channel mapping */
 #define HIFSYS_DMA_AG_MAP				0x008
 
+#define MTK_WED_RTQM_GLO_CFG				0xb00
+#define MTK_WED_RTQM_BUSY	 			BIT(1)
+#define MTK_WED_RTQM_Q_RST	 			BIT(2)
+#define MTK_WED_RTQM_Q_DBG_BYPASS			BIT(5)
+#define MTK_WED_RTQM_TXDMAD_FPORT			GENMASK(23, 20)
+
+#define MTK_WED_RTQM_R2H_MIB(_n)			(0xb70 + (_n) * 0x4)
+#define MTK_WED_RTQM_R2Q_MIB(_n)			(0xb78 + (_n) * 0x4)
+#define MTK_WED_RTQM_Q2N_MIB				0xb80
+#define MTK_WED_RTQM_Q2H_MIB(_n)			(0xb84 + (_n) * 0x4)
+
+#define MTK_WED_RTQM_Q2B_MIB				0xb8c
+#define MTK_WED_RTQM_PFDBK_MIB				0xb90
+
+#define MTK_WED_RROQM_GLO_CFG				0xc04
+#define MTK_WED_RROQM_RST_IDX				0xc08
+#define MTK_WED_RROQM_RST_IDX_MIOD 			BIT(0)
+#define MTK_WED_RROQM_RST_IDX_FDBK 			BIT(4)
+
+#define MTK_WED_RROQM_MIOD_CTRL0			0xc40
+#define MTK_WED_RROQM_MIOD_CTRL1			0xc44
+#define MTK_WED_RROQM_MIOD_CNT 				GENMASK(11, 0)
+
+#define MTK_WED_RROQM_MIOD_CTRL2			0xc48
+#define MTK_WED_RROQM_MIOD_CTRL3			0xc4c
+
+#define MTK_WED_RROQM_FDBK_CTRL0			0xc50
+#define MTK_WED_RROQM_FDBK_CTRL1			0xc54
+#define MTK_WED_RROQM_FDBK_CNT 				GENMASK(11, 0)
+
+#define MTK_WED_RROQM_FDBK_CTRL2			0xc58
+
+#define MTK_WED_RROQ_BASE_L				0xc80
+#define MTK_WED_RROQ_BASE_H				0xc84
+
+#define MTK_WED_RROQM_MIOD_CFG                          0xc8c
+#define MTK_WED_RROQM_MIOD_MID_DW 			GENMASK(5, 0)
+#define MTK_WED_RROQM_MIOD_MOD_DW			GENMASK(13, 8)
+#define MTK_WED_RROQM_MIOD_ENTRY_DW			GENMASK(22, 16)
+
+#define MTK_WED_RROQM_MID_MIB				0xcc0
+#define MTK_WED_RROQM_MOD_MIB				0xcc4
+#define MTK_WED_RROQM_MOD_COHERENT_MIB			0xcc8
+#define MTK_WED_RROQM_FDBK_MIB				0xcd0
+#define MTK_WED_RROQM_FDBK_COHERENT_MIB			0xcd4
+#define MTK_WED_RROQM_FDBK_IND_MIB			0xce0
+#define MTK_WED_RROQM_FDBK_ENQ_MIB			0xce4
+#define MTK_WED_RROQM_FDBK_ANC_MIB			0xce8
+#define MTK_WED_RROQM_FDBK_ANC2H_MIB			0xcec
+
+#define MTK_WED_RX_BM_RX_DMAD  				0xd80
+#define MTK_WED_RX_BM_BASE				0xd84
+#define MTK_WED_RX_BM_INIT_PTR				0xd88
+#define MTK_WED_RX_BM_PTR	      			0xd8c
+#define MTK_WED_RX_BM_PTR_HEAD				GENMASK(32, 16)
+#define MTK_WED_RX_BM_PTR_TAIL				GENMASK(15, 0)
+
+#define MTK_WED_RX_BM_BLEN	      			0xd90
+#define MTK_WED_RX_BM_STS				0xd94
+#define MTK_WED_RX_BM_INTF2				0xd98
+#define MTK_WED_RX_BM_INTF				0xd9c
+#define MTK_WED_RX_BM_ERR_STS				0xda8
+
+#define MTK_WED_WOCPU_VIEW_MIOD_BASE		 	0x8000
+#define MTK_WED_PCIE_INT_MASK				0x0
+
 #endif
diff --git a/drivers/net/ethernet/mediatek/mtk_wed_wo.c b/drivers/net/ethernet/mediatek/mtk_wed_wo.c
new file mode 100644
index 0000000..54b7787
--- /dev/null
+++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.c
@@ -0,0 +1,564 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <linux/kernel.h>
+#include <linux/bitfield.h>
+#include <linux/dma-mapping.h>
+#include <linux/skbuff.h>
+#include <linux/of_platform.h>
+#include <linux/interrupt.h>
+#include <linux/of_address.h>
+#include <linux/iopoll.h>
+#include <linux/soc/mediatek/mtk_wed.h>
+#include "mtk_wed.h"
+#include "mtk_wed_regs.h"
+#include "mtk_wed_ccif.h"
+#include "mtk_wed_wo.h"
+
+struct wed_wo_profile_stat profile_total[6] = {
+	{1001, 0},
+	{1501, 0},
+	{3001, 0},
+	{5001, 0},
+	{10001, 0},
+	{0xffffffff, 0}
+};
+
+struct wed_wo_profile_stat profiling_mod[6] = {
+	{1001, 0},
+	{1501, 0},
+	{3001, 0},
+	{5001, 0},
+	{10001, 0},
+	{0xffffffff, 0}
+};
+
+struct wed_wo_profile_stat profiling_rro[6] = {
+	{1001, 0},
+	{1501, 0},
+	{3001, 0},
+	{5001, 0},
+	{10001, 0},
+	{0xffffffff, 0}
+};
+
+static void
+woif_q_sync_idx(struct mtk_wed_wo *wo, struct wed_wo_queue *q)
+{
+	woccif_w32(wo, q->regs->desc_base, q->desc_dma);
+	woccif_w32(wo, q->regs->ring_size, q->ndesc);
+
+}
+
+static void
+woif_q_reset(struct mtk_wed_wo *dev, struct wed_wo_queue *q)
+{
+
+	if (!q || !q->ndesc)
+		return;
+
+	woccif_w32(dev, q->regs->cpu_idx, 0);
+
+	woif_q_sync_idx(dev, q);
+}
+
+static void
+woif_q_kick(struct mtk_wed_wo *wo, struct wed_wo_queue *q, int offset)
+{
+	wmb();
+	woccif_w32(wo, q->regs->cpu_idx, q->head + offset);
+}
+
+static int
+woif_q_rx_fill(struct mtk_wed_wo *wo, struct wed_wo_queue *q, bool rx)
+{
+	int len = q->buf_size, frames = 0;
+	struct wed_wo_queue_entry *entry;
+	struct page_frag_cache *page = &q->tx_page;
+	struct wed_wo_desc *desc;
+	dma_addr_t addr;
+	u32 ctrl = 0;
+	void *buf;
+
+	if (!q->ndesc)
+		return 0;
+
+	spin_lock_bh(&q->lock);
+
+	if(rx)
+		page = &q->rx_page;
+
+	while (q->queued < q->ndesc) {
+		buf = page_frag_alloc(page, len, GFP_ATOMIC);
+		if (!buf)
+			break;
+
+		addr = dma_map_single(wo->hw->dev, buf, len, DMA_FROM_DEVICE);
+		if (unlikely(dma_mapping_error(wo->hw->dev, addr))) {
+			skb_free_frag(buf);
+			break;
+		}
+
+		q->head = (q->head + 1) % q->ndesc;
+
+		desc = &q->desc[q->head];
+		entry = &q->entry[q->head];
+
+		entry->dma_addr = addr;
+		entry->dma_len = len;
+
+		if (rx) {
+			ctrl = FIELD_PREP(WED_CTL_SD_LEN0, entry->dma_len);
+			ctrl |= WED_CTL_LAST_SEC0;
+
+			WRITE_ONCE(desc->buf0, cpu_to_le32(addr));
+			WRITE_ONCE(desc->ctrl, cpu_to_le32(ctrl));
+		}
+		q->queued++;
+		q->entry[q->head].buf = buf;
+
+		frames++;
+	}
+
+	spin_unlock_bh(&q->lock);
+
+	return frames;
+}
+
+static void
+woif_q_rx_fill_process(struct mtk_wed_wo *wo, struct wed_wo_queue *q)
+{
+	if(woif_q_rx_fill(wo, q, true))
+		woif_q_kick(wo, q, -1);
+}
+
+static int
+woif_q_alloc(struct mtk_wed_wo *dev, struct wed_wo_queue *q,
+		     int n_desc, int bufsize, int idx,
+		     struct wed_wo_queue_regs *regs)
+{
+	struct wed_wo_queue_regs *q_regs;
+	int size;
+
+	spin_lock_init(&q->lock);
+	spin_lock_init(&q->cleanup_lock);
+
+	q_regs = devm_kzalloc(dev->hw->dev, sizeof(*q_regs), GFP_KERNEL);
+
+	q_regs->desc_base = regs->desc_base;
+	q_regs->ring_size = regs->ring_size;
+	q_regs->cpu_idx = regs->cpu_idx;
+	q_regs->dma_idx = regs->dma_idx;
+
+	q->regs = q_regs;
+	q->ndesc = n_desc;
+	q->buf_size = bufsize;
+
+	size = q->ndesc * sizeof(struct wed_wo_desc);
+
+	q->desc = dmam_alloc_coherent(dev->hw->dev, size,
+				      &q->desc_dma, GFP_KERNEL);
+	if (!q->desc)
+		return -ENOMEM;
+
+	size = q->ndesc * sizeof(*q->entry);
+	q->entry = devm_kzalloc(dev->hw->dev, size, GFP_KERNEL);
+	if (!q->entry)
+		return -ENOMEM;
+
+	if (idx == 0) {
+		/* alloc tx buf */
+		woif_q_rx_fill(dev, &dev->q_tx, false);
+		woif_q_reset(dev, &dev->q_tx);
+	}
+
+	return 0;
+}
+
+static void
+woif_q_free(struct mtk_wed_wo *dev, struct wed_wo_queue *q)
+{
+	int size;
+
+	if (!q)
+		return;
+
+	if (!q->desc)
+		return;
+
+	woccif_w32(dev, q->regs->cpu_idx, 0);
+
+	size = q->ndesc * sizeof(struct wed_wo_desc);
+	dma_free_coherent(dev->hw->dev, size, q->desc, q->desc_dma);
+}
+
+static void
+woif_q_tx_clean(struct mtk_wed_wo *wo, struct wed_wo_queue *q)
+{
+	struct page *page;
+	int i = 0;
+
+	if (!q || !q->ndesc)
+		return;
+
+	spin_lock_bh(&q->lock);
+	while (i < q->ndesc) {
+		struct wed_wo_queue_entry *e;
+
+		e = &q->entry[i];
+		i++;
+
+		if (!e)
+			continue;
+		dma_unmap_single(wo->hw->dev, e->dma_addr, e->dma_len,
+				 DMA_TO_DEVICE);
+
+		skb_free_frag(e->buf);
+	}
+	spin_unlock_bh(&q->lock);
+
+	if (!q->tx_page.va)
+		return;
+
+	page = virt_to_page(q->tx_page.va);
+	__page_frag_cache_drain(page, q->tx_page.pagecnt_bias);
+	memset(&q->tx_page, 0, sizeof(q->tx_page));
+}
+
+static void *
+woif_q_deq(struct mtk_wed_wo *wo, struct wed_wo_queue *q, bool flush,
+		 int *len, u32 *info, bool *more)
+{
+	int buf_len = SKB_WITH_OVERHEAD(q->buf_size);
+	struct wed_wo_queue_entry *e;
+	struct wed_wo_desc *desc;
+	int idx = (q->tail + 1) % q->ndesc;;
+	void *buf;
+
+	*more = false;
+	if (!q->queued)
+		return NULL;
+
+	if (flush)
+		q->desc[idx].ctrl |= cpu_to_le32(WED_CTL_DMA_DONE);
+	else if (!(q->desc[idx].ctrl & cpu_to_le32(WED_CTL_DMA_DONE)))
+		return NULL;
+
+	q->tail = idx;
+	q->queued--;
+
+	desc = &q->desc[idx];
+	e = &q->entry[idx];
+
+	buf = e->buf;
+	if (len) {
+		u32 ctl = le32_to_cpu(READ_ONCE(desc->ctrl));
+		*len = FIELD_GET(WED_CTL_SD_LEN0, ctl);
+		*more = !(ctl & WED_CTL_LAST_SEC0);
+	}
+
+	if (info)
+		*info = le32_to_cpu(desc->info);
+	if(buf)
+		dma_unmap_single(wo->hw->dev, e->dma_addr, buf_len,
+				 DMA_FROM_DEVICE);
+	e->skb = NULL;
+
+	return buf;
+}
+
+static void
+woif_q_rx_clean(struct mtk_wed_wo *wo, struct wed_wo_queue *q)
+{
+	struct page *page;
+	void *buf;
+	bool more;
+
+	if (!q->ndesc)
+		return;
+
+	spin_lock_bh(&q->lock);
+	do {
+		buf = woif_q_deq(wo, q, true, NULL, NULL, &more);
+		if (!buf)
+			break;
+
+		skb_free_frag(buf);
+	} while (1);
+	spin_unlock_bh(&q->lock);
+
+	if (!q->rx_page.va)
+		return;
+
+	page = virt_to_page(q->rx_page.va);
+	__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
+	memset(&q->rx_page, 0, sizeof(q->rx_page));
+}
+
+static int
+woif_q_init(struct mtk_wed_wo *dev,
+	       int (*poll)(struct napi_struct *napi, int budget))
+{
+	init_dummy_netdev(&dev->napi_dev);
+	snprintf(dev->napi_dev.name, sizeof(dev->napi_dev.name), "%s",
+		 "woif_q");
+
+	if (dev->q_rx.ndesc) {
+		netif_napi_add(&dev->napi_dev, &dev->napi, poll, 64);
+		woif_q_rx_fill(dev, &dev->q_rx, true);
+		woif_q_reset(dev, &dev->q_rx);
+		napi_enable(&dev->napi);
+	}
+
+	return 0;
+}
+
+void woif_q_rx_skb(struct mtk_wed_wo *wo, struct sk_buff *skb)
+{
+	struct wed_cmd_hdr *hdr = (struct wed_cmd_hdr *)skb->data;
+	int ret;
+
+	ret = mtk_wed_mcu_cmd_sanity_check(wo, skb);
+	if (ret)
+		goto free_skb;
+
+	if (WED_WO_CMD_FLAG_IS_RSP(hdr))
+		mtk_wed_mcu_rx_event(wo, skb);
+	else
+		mtk_wed_mcu_rx_unsolicited_event(wo, skb);
+
+	return;
+free_skb:
+	dev_kfree_skb(skb);
+}
+
+static int
+woif_q_tx_skb(struct mtk_wed_wo *wo, struct wed_wo_queue *q,
+		      struct sk_buff *skb)
+{
+	struct wed_wo_queue_entry *entry;
+	struct wed_wo_desc *desc;
+	int len, ret = 0, idx = -1;
+	dma_addr_t addr;
+	u32 ctrl = 0;
+
+	len = skb->len;
+	spin_lock_bh(&q->lock);
+
+	q->tail = woccif_r32(wo, q->regs->dma_idx);
+	q->head = (q->head + 1) % q->ndesc;
+	if (q->tail == q->head) {
+		ret = -ENOMEM;
+		goto error;
+	}
+
+	idx = q->head;
+	desc = &q->desc[idx];
+	entry = &q->entry[idx];
+
+	if (len > entry->dma_len) {
+		ret = -ENOMEM;
+		goto error;
+	}
+	addr = entry->dma_addr;
+
+	dma_sync_single_for_cpu(wo->hw->dev, addr, len, DMA_TO_DEVICE);
+	memcpy(entry->buf, skb->data, len);
+	dma_sync_single_for_device(wo->hw->dev, addr, len, DMA_TO_DEVICE);
+
+	ctrl = FIELD_PREP(WED_CTL_SD_LEN0, len);
+	ctrl |= WED_CTL_LAST_SEC0;
+	ctrl |= WED_CTL_DMA_DONE;
+
+	WRITE_ONCE(desc->buf0, cpu_to_le32(addr));
+	WRITE_ONCE(desc->ctrl, cpu_to_le32(ctrl));
+
+	woif_q_kick(wo, q, 0);
+	wo->drv_ops->kickout(wo);
+
+	spin_unlock_bh(&q->lock);
+
+error:
+	dev_kfree_skb(skb);
+	return ret;
+}
+
+static const struct wed_wo_queue_ops wo_queue_ops = {
+	.init = woif_q_init,
+	.alloc = woif_q_alloc,
+	.free = woif_q_free,
+	.reset = woif_q_reset,
+	.tx_skb = woif_q_tx_skb,
+	.tx_clean = woif_q_tx_clean,
+	.rx_clean = woif_q_rx_clean,
+	.kick = woif_q_kick,
+};
+
+static int
+mtk_wed_wo_rx_process(struct mtk_wed_wo *wo, struct wed_wo_queue *q, int budget)
+{
+	int len, done = 0;
+	struct sk_buff *skb;
+	unsigned char *data;
+	bool more;
+
+	while (done < budget) {
+		u32 info;
+
+		data = woif_q_deq(wo, q, false, &len, &info, &more);
+		if (!data)
+			break;
+
+		skb = build_skb(data, q->buf_size);
+		if (!skb) {
+			skb_free_frag(data);
+			continue;
+		}
+
+		__skb_put(skb, len);
+		done++;
+
+		woif_q_rx_skb(wo, skb);
+	}
+
+	woif_q_rx_fill_process(wo, q);
+
+	return done;
+}
+
+void mtk_wed_wo_set_isr_mask(struct mtk_wed_wo *wo, bool set,
+		       u32 clear, u32 val)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&wo->ccif.irq_lock, flags);
+	wo->ccif.irqmask &= ~clear;
+	wo->ccif.irqmask |= val;
+	if (set)
+		wo->drv_ops->set_isr(wo, wo->ccif.irqmask);
+
+	spin_unlock_irqrestore(&wo->ccif.irq_lock, flags);
+}
+
+static inline void mtk_wed_wo_set_ack_mask(struct mtk_wed_wo *wo, u32 mask)
+{
+	wo->drv_ops->set_ack(wo, mask);
+}
+
+static void mtk_wed_wo_poll_complete(struct mtk_wed_wo *wo)
+{
+	mtk_wed_wo_set_ack_mask(wo, wo->ccif.q_int_mask);
+	mtk_wed_wo_isr_enable(wo, wo->ccif.q_int_mask);
+}
+
+int mtk_wed_wo_rx_poll(struct napi_struct *napi, int budget)
+{
+	struct mtk_wed_wo *wo;
+	int done = 0, cur;
+
+	wo = container_of(napi->dev, struct mtk_wed_wo, napi_dev);
+
+	rcu_read_lock();
+
+	do {
+		cur = mtk_wed_wo_rx_process(wo, &wo->q_rx, budget - done);
+		/* rx packet handle */
+		done += cur;
+	} while (cur && done < budget);
+
+	rcu_read_unlock();
+
+	if (done < budget && napi_complete(napi))
+		mtk_wed_wo_poll_complete(wo);
+
+	return done;
+}
+
+static void mtk_wed_wo_isr_tasklet(unsigned long data)
+{
+	struct mtk_wed_wo *wo = (struct mtk_wed_wo *)data;
+	u32 intr, mask;
+
+	/* disable isr */
+	wo->drv_ops->set_isr(wo, 0);
+
+	intr = wo->drv_ops->get_csr(wo);
+	intr &= wo->ccif.irqmask;
+
+	mask = intr & (wo->ccif.q_int_mask | wo->ccif.q_exep_mask);
+	mtk_wed_wo_isr_disable(wo, mask);
+
+	if (intr & wo->ccif.q_int_mask)
+		napi_schedule(&wo->napi);
+
+	if (intr & wo->ccif.q_exep_mask) {
+		/* todo */
+	}
+}
+
+static irqreturn_t mtk_wed_wo_isr_handler(int irq, void *wo_instance)
+{
+	struct mtk_wed_wo *wo = wo_instance;
+
+	wo->drv_ops->set_isr(wo, 0);
+
+	tasklet_schedule(&wo->irq_tasklet);
+
+	return IRQ_HANDLED;
+}
+
+int mtk_wed_wo_init(struct mtk_wed_hw *hw)
+{
+	struct mtk_wed_wo *wo;
+	int ret = 0;
+
+	wo = kzalloc(sizeof(struct mtk_wed_wo), GFP_KERNEL);
+	if (!wo)
+		return -ENOMEM;
+
+	wo->hw = hw;
+	wo->queue_ops = &wo_queue_ops;
+	hw->wed_wo = wo;
+
+	tasklet_init(&wo->irq_tasklet, mtk_wed_wo_isr_tasklet,
+		     (unsigned long)wo);
+
+	skb_queue_head_init(&wo->mcu.res_q);
+	init_waitqueue_head(&wo->mcu.wait);
+	mutex_init(&wo->mcu.mutex);
+
+	ret = wed_wo_hardware_init(wo, mtk_wed_wo_isr_handler);
+	if (ret)
+		goto error;
+
+	/* fw download */
+	ret = wed_wo_mcu_init(wo);
+	if (ret)
+		goto error;
+
+	ret = mtk_wed_exception_init(wo);
+	if (ret)
+		goto error;
+
+	return ret;
+
+error:
+	kfree(wo);
+
+	return ret;
+}
+
+void mtk_wed_wo_exit(struct mtk_wed_hw *hw)
+{
+	struct mtk_wed_wo *wo = hw->wed_wo;
+
+	wed_wo_hardware_exit(wo);
+
+	if (wo->exp.log) {
+		dma_unmap_single(wo->hw->dev, wo->exp.phys, wo->exp.log_size, DMA_FROM_DEVICE);
+		kfree(wo->exp.log);
+	}
+
+	wo->hw = NULL;
+	memset(wo, 0, sizeof(*wo));
+	kfree(wo);
+}
diff --git a/drivers/net/ethernet/mediatek/mtk_wed_wo.h b/drivers/net/ethernet/mediatek/mtk_wed_wo.h
new file mode 100644
index 0000000..548b38e
--- /dev/null
+++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.h
@@ -0,0 +1,324 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright (C) 2021 Felix Fietkau <nbd@nbd.name> */
+
+#ifndef __MTK_WED_WO_H
+#define __MTK_WED_WO_H
+
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include "mtk_wed.h"
+
+#define WED_CTL_SD_LEN1		GENMASK(13, 0)
+#define WED_CTL_LAST_SEC1	BIT(14)
+#define WED_CTL_BURST		BIT(15)
+#define WED_CTL_SD_LEN0_SHIFT	16
+#define WED_CTL_SD_LEN0		GENMASK(29, 16)
+#define WED_CTL_LAST_SEC0	BIT(30)
+#define WED_CTL_DMA_DONE	BIT(31)
+#define WED_INFO_WINFO		GENMASK(15, 0)
+
+#define MTK_WED_WO_TXQ_FREE_THR		10
+
+#define WED_WO_PROFILE_MAX_LVL		6
+
+
+enum mtk_wed_fw_region_id {
+	WO_REGION_EMI = 0,
+	WO_REGION_ILM,
+	WO_REGION_DATA,
+	WO_REGION_BOOT,
+	__WO_REGION_MAX
+};
+
+struct wed_wo_profile_stat {
+	u32 bound;
+	u32 record;
+};
+
+#define PROFILE_STAT(record, val) do {			\
+		u8 lvl = 0;				\
+		while (lvl < WED_WO_PROFILE_MAX_LVL) {	\
+			if (val < record[lvl].bound) {	\
+				record[lvl].record++;	\
+				break;			\
+			}				\
+			lvl++;				\
+		}					\
+	} while (0)
+
+/* align with wo report structure */
+struct wed_wo_log {
+	u32 sn;
+	u32 total;
+	u32 rro;
+	u32 mod;
+};
+
+struct wed_wo_rxcnt {
+	u16 wlan_idx;
+	u16 tid;
+	u32 rx_pkt_cnt;
+	u32 rx_byte_cnt;
+	u32 rx_err_cnt;
+	u32 rx_drop_cnt;
+};
+
+struct wed_wo_queue {
+	struct wed_wo_queue_regs *regs;
+
+	spinlock_t lock;
+	spinlock_t cleanup_lock;
+	struct wed_wo_queue_entry *entry;
+	struct wed_wo_desc *desc;
+
+	u16 first;
+	u16 head;
+	u16 tail;
+	int ndesc;
+	int queued;
+	int buf_size;
+
+	u8 hw_idx;
+	u8 qid;
+	u8 flags;
+
+	dma_addr_t desc_dma;
+	struct page_frag_cache rx_page;
+	struct page_frag_cache tx_page;
+};
+
+
+struct wed_wo_mmio {
+	struct regmap *regs;
+
+	spinlock_t irq_lock;
+	u8 irq;
+	u32 irqmask;
+
+	u32 q_int_mask;
+	u32 q_exep_mask;
+};
+
+struct wed_wo_mcu {
+	struct mutex mutex;
+	u32 msg_seq;
+	int timeout;
+
+	struct sk_buff_head res_q;
+	wait_queue_head_t wait;
+};
+
+struct wed_wo_exception {
+	void* log;
+	int log_size;
+	dma_addr_t phys;
+};
+
+struct wed_wo_queue_regs {
+	u32 desc_base;
+	u32 ring_size;
+	u32 cpu_idx;
+	u32 dma_idx;
+};
+
+struct wed_wo_desc {
+	__le32 buf0;
+	__le32 ctrl;
+	__le32 buf1;
+	__le32 info;
+	__le32 reserved[4];
+} __packed __aligned(32);
+
+struct wed_wo_queue_entry {
+	union {
+		void *buf;
+		struct sk_buff *skb;
+	};
+
+	u32 dma_addr;
+	u16 dma_len;
+	u16 wcid;
+	bool skip_buf0:1;
+	bool skip_buf1:1;
+	bool done:1;
+};
+
+struct wo_cmd_query {
+	u32 query0;
+	u32 query1;
+};
+
+struct wed_cmd_hdr {
+	/*DW0*/
+	u8 ver;
+	u8 cmd_id;
+	u16 length;
+
+	/*DW1*/
+	u16 uni_id;
+	u16 flag;
+
+	/*DW2*/
+	int status;
+
+	/*DW3*/
+	u8 reserved[20];
+};
+
+struct mtk_wed_fw_region {
+	void *addr;
+	u32 addr_pa;
+	u32 size;
+	u32 shared;
+};
+
+struct wed_wo_queue_ops;
+struct wed_wo_drv_ops;
+struct wed_wo_mcu_ops;
+
+struct wo_rx_total_cnt {
+	u64 rx_pkt_cnt;
+	u64 rx_byte_cnt;
+	u64 rx_err_cnt;
+	u64 rx_drop_cnt;
+};
+
+struct mtk_wed_wo {
+	struct mtk_wed_hw *hw;
+
+	struct wed_wo_mmio ccif;
+	struct wed_wo_mcu mcu;
+	struct wed_wo_exception exp;
+
+	const struct wed_wo_drv_ops *drv_ops;
+	const struct wed_wo_mcu_ops *mcu_ops;
+	const struct wed_wo_queue_ops *queue_ops;
+
+	struct net_device napi_dev;
+	spinlock_t rx_lock;
+	struct napi_struct napi;
+	struct sk_buff_head rx_skb;
+	struct wed_wo_queue q_rx;
+	struct tasklet_struct irq_tasklet;
+
+	struct wed_wo_queue q_tx;
+
+	struct mtk_wed_fw_region region[__WO_REGION_MAX];
+
+	struct wed_wo_profile_stat total[WED_WO_PROFILE_MAX_LVL];
+	struct wed_wo_profile_stat mod[WED_WO_PROFILE_MAX_LVL];
+	struct wed_wo_profile_stat rro[WED_WO_PROFILE_MAX_LVL];
+	char dirname[4];
+	struct wo_rx_total_cnt wo_rxcnt[8][544];
+};
+
+struct wed_wo_queue_ops {
+	int (*init)(struct mtk_wed_wo *wo,
+		    int (*poll)(struct napi_struct *napi, int budget));
+
+	int (*alloc)(struct mtk_wed_wo *wo, struct wed_wo_queue *q,
+		     int idx, int n_desc, int bufsize,
+		     struct wed_wo_queue_regs *regs);
+	void (*free)(struct mtk_wed_wo *wo, struct wed_wo_queue *q);
+	void (*reset)(struct mtk_wed_wo *wo, struct wed_wo_queue *q);
+
+	int (*tx_skb)(struct mtk_wed_wo *wo, struct wed_wo_queue *q,
+		      struct sk_buff *skb);
+	void (*tx_clean)(struct mtk_wed_wo *wo, struct wed_wo_queue *q);
+
+	void (*rx_clean)(struct mtk_wed_wo *wo, struct wed_wo_queue *q);
+
+	void (*kick)(struct mtk_wed_wo *wo, struct wed_wo_queue *q, int offset);
+};
+
+struct wed_wo_drv_ops {
+	void (*kickout)(struct mtk_wed_wo *wo);
+	void (*set_ack)(struct mtk_wed_wo *wo, u32 mask);
+	void (*set_isr)(struct mtk_wed_wo *wo, u32 mask);
+	u32 (*get_csr)(struct mtk_wed_wo *wo);
+	int (*tx_prepare_skb)(struct mtk_wed_wo *wo);
+	bool (*check_excpetion)(struct mtk_wed_wo *wo);
+	void (*clear_int)(struct mtk_wed_wo *wo, u32 mask);
+};
+
+struct wed_wo_mcu_ops {
+	u32 headroom;
+
+	int (*mcu_skb_send_msg)(struct mtk_wed_wo *wo, int to_id,
+				int cmd, struct sk_buff *skb,
+				int *seq, bool wait_resp);
+
+	int (*mcu_parse_response)(struct mtk_wed_wo *wo, int cmd,
+				  struct sk_buff *skb, int seq);
+
+	int (*mcu_restart)(struct mtk_wed_wo *wo);
+};
+
+#define mtk_wed_wo_q_init(wo, ...)	(wo)->queue_ops->init((wo), __VA_ARGS__)
+#define mtk_wed_wo_q_alloc(wo, ...)	(wo)->queue_ops->alloc((wo), __VA_ARGS__)
+#define mtk_wed_wo_q_free(wo, ...)	(wo)->queue_ops->free((wo), __VA_ARGS__)
+#define mtk_wed_wo_q_reset(wo, ...)	(wo)->queue_ops->reset((wo), __VA_ARGS__)
+#define mtk_wed_wo_q_tx_skb(wo, ...)	(wo)->queue_ops->tx_skb((wo), __VA_ARGS__)
+#define mtk_wed_wo_q_tx_clean(wo, ...)	(wo)->queue_ops->tx_clean((wo), __VA_ARGS__)
+#define mtk_wed_wo_q_rx_clean(wo, ...)	(wo)->queue_ops->rx_clean((wo), __VA_ARGS__)
+#define mtk_wed_wo_q_kick(wo, ...)	(wo)->queue_ops->kick((wo), __VA_ARGS__)
+
+enum {
+	WARP_CMD_FLAG_RSP		= 1 << 0, /* is responce*/
+	WARP_CMD_FLAG_NEED_RSP		= 1 << 1, /* need responce */
+	WARP_CMD_FLAG_FROM_TO_WO	= 1 << 2, /* send between host and wo */
+};
+
+#define WED_WO_CMD_FLAG_IS_RSP(_hdr)		((_hdr)->flag & (WARP_CMD_FLAG_RSP))
+#define WED_WO_CMD_FLAG_SET_RSP(_hdr)		((_hdr)->flag |= (WARP_CMD_FLAG_RSP))
+#define WED_WO_CMD_FLAG_IS_NEED_RSP(_hdr)	((_hdr)->flag & (WARP_CMD_FLAG_NEED_RSP))
+#define WED_WO_CMD_FLAG_SET_NEED_RSP(_hdr)	((_hdr)->flag |= (WARP_CMD_FLAG_NEED_RSP))
+#define WED_WO_CMD_FLAG_IS_FROM_TO_WO(_hdr)	((_hdr)->flag & (WARP_CMD_FLAG_FROM_TO_WO))
+#define WED_WO_CMD_FLAG_SET_FROM_TO_WO(_hdr)	((_hdr)->flag |= (WARP_CMD_FLAG_FROM_TO_WO))
+
+void mtk_wed_wo_set_isr_mask(struct mtk_wed_wo *wo, bool set,
+			     u32 clear, u32 val);
+
+static inline void mtk_wed_wo_isr_enable(struct mtk_wed_wo *wo, u32 mask)
+{
+	mtk_wed_wo_set_isr_mask(wo, false, 0, mask);
+
+	tasklet_schedule(&wo->irq_tasklet);
+}
+
+static inline void mtk_wed_wo_isr_disable(struct mtk_wed_wo *wo, u32 mask)
+{
+	mtk_wed_wo_set_isr_mask(wo, true, mask, 0);
+}
+
+static inline void
+wo_w32(struct mtk_wed_wo *dev, u32 reg, u32 val)
+{
+	writel(val, dev->region[WO_REGION_BOOT].addr + reg);
+}
+
+static inline u32
+wo_r32(struct mtk_wed_wo *dev, u32 reg)
+{
+	return readl(dev->region[WO_REGION_BOOT].addr + reg);
+}
+static inline void
+woccif_w32(struct mtk_wed_wo *dev, u32 reg, u32 val)
+{
+	regmap_write(dev->ccif.regs, reg, val);
+}
+
+static inline u32
+woccif_r32(struct mtk_wed_wo *dev, u32 reg)
+{
+	unsigned int val;
+
+	regmap_read(dev->ccif.regs, reg, &val);
+
+	return val;
+}
+
+int mtk_wed_wo_init(struct mtk_wed_hw *hw);
+void mtk_wed_wo_exit(struct mtk_wed_hw *hw);
+#endif
+
diff --git a/include/linux/soc/mediatek/mtk_wed.h b/include/linux/soc/mediatek/mtk_wed.h
index e914cb4..e8fca31 100644
--- a/include/linux/soc/mediatek/mtk_wed.h
+++ b/include/linux/soc/mediatek/mtk_wed.h
@@ -6,7 +6,39 @@
 #include <linux/regmap.h>
 #include <linux/pci.h>
 
+#define WED_WO_STA_REC			0x6
+
 #define MTK_WED_TX_QUEUES		2
+#define MTK_WED_RX_QUEUES		2
+
+enum mtk_wed_wo_cmd {
+	MTK_WED_WO_CMD_WED_CFG,
+	MTK_WED_WO_CMD_WED_RX_STAT,
+	MTK_WED_WO_CMD_RRO_SER,
+	MTK_WED_WO_CMD_DBG_INFO,
+	MTK_WED_WO_CMD_DEV_INFO,
+	MTK_WED_WO_CMD_BSS_INFO,
+	MTK_WED_WO_CMD_STA_REC,
+	MTK_WED_WO_CMD_DEV_INFO_DUMP,
+	MTK_WED_WO_CMD_BSS_INFO_DUMP,
+	MTK_WED_WO_CMD_STA_REC_DUMP,
+	MTK_WED_WO_CMD_BA_INFO_DUMP,
+	MTK_WED_WO_CMD_FBCMD_Q_DUMP,
+	MTK_WED_WO_CMD_FW_LOG_CTRL,
+	MTK_WED_WO_CMD_LOG_FLUSH,
+	MTK_WED_WO_CMD_CHANGE_STATE,
+	MTK_WED_WO_CMD_CPU_STATS_ENABLE,
+	MTK_WED_WO_CMD_CPU_STATS_DUMP,
+	MTK_WED_WO_CMD_EXCEPTION_INIT,
+	MTK_WED_WO_CMD_PROF_CTRL,
+	MTK_WED_WO_CMD_STA_BA_DUMP,
+	MTK_WED_WO_CMD_BA_CTRL_DUMP,
+	MTK_WED_WO_CMD_RXCNT_CTRL,
+	MTK_WED_WO_CMD_RXCNT_INFO,
+	MTK_WED_WO_CMD_SET_CAP,
+	MTK_WED_WO_CMD_CCIF_RING_DUMP,
+	MTK_WED_WO_CMD_WED_END
+};
 
 enum {
 	MTK_NO_WED,
@@ -15,10 +47,9 @@ enum {
 	MTK_WED_VMAX
 };
 
-enum {
-	MTK_BUS_TYPE_PCIE,
-	MTK_BUS_TYPE_AXI,
-	MTK_BUS_TYPE_MAX
+enum mtk_wed_bus_tye {
+	MTK_WED_BUS_PCIE,
+	MTK_WED_BUS_AXI,
 };
 
 struct mtk_wed_hw;
@@ -33,6 +64,33 @@ struct mtk_wed_ring {
 	void __iomem *wpdma;
 };
 
+struct mtk_rxbm_desc {
+	__le32 buf0;
+	__le32 token;
+} __packed __aligned(4);
+
+struct dma_buf {
+	int size;
+	void **pages;
+	struct mtk_wdma_desc *desc;
+	dma_addr_t desc_phys;
+};
+
+struct dma_entry {
+	int size;
+	struct mtk_rxbm_desc *desc;
+	dma_addr_t desc_phys;
+};
+
+struct mtk_wed_wo_rx_stats {
+	__le16 wlan_idx;
+	__le16 tid;
+	__le32 rx_pkt_cnt;
+	__le32 rx_byte_cnt;
+	__le32 rx_err_cnt;
+	__le32 rx_drop_cnt;
+};
+
 struct mtk_wed_device {
 #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 	const struct mtk_wed_ops *ops;
@@ -47,37 +105,64 @@ struct mtk_wed_device {
 	struct mtk_wed_ring tx_ring[MTK_WED_TX_QUEUES];
 	struct mtk_wed_ring txfree_ring;
 	struct mtk_wed_ring tx_wdma[MTK_WED_TX_QUEUES];
+	struct mtk_wed_ring rx_ring[MTK_WED_RX_QUEUES];
+	struct mtk_wed_ring rx_wdma[MTK_WED_RX_QUEUES];
+
+	struct dma_buf buf_ring;
 
 	struct {
 		int size;
-		void **pages;
-		struct mtk_wdma_desc *desc;
+		struct page_frag_cache rx_page;
+		struct mtk_rxbm_desc *desc;
 		dma_addr_t desc_phys;
-	} buf_ring;
+	} rx_buf_ring;
+
+	struct {
+		struct mtk_wed_ring rro_ring;
+		void __iomem *rro_desc;
+		dma_addr_t miod_desc_phys;
+		dma_addr_t fdbk_desc_phys;
+		u32 mcu_view_miod;
+	} rro;
 
 	/* filled by driver: */
 	struct {
-		struct pci_dev *pci_dev;
+		union {
+			struct platform_device *platform_dev;
+			struct pci_dev *pci_dev;
+		};
 		void __iomem *base;
 		u32 bus_type;
+		u32 phy_base;
 
 		u32 wpdma_phys;
 		u32 wpdma_int;
 		u32 wpdma_mask;
 		u32 wpdma_tx;
 		u32 wpdma_txfree;
+		u32 wpdma_rx_glo;
+		u32 wpdma_rx;
 
 		u8 tx_tbit[MTK_WED_TX_QUEUES];
+		u8 rx_tbit[MTK_WED_RX_QUEUES];
 		u8 txfree_tbit;
 
 		u16 token_start;
 		unsigned int nbuf;
+		unsigned int rx_nbuf;
+		unsigned int rx_npkt;
+		unsigned int rx_size;
 
 		bool wcid_512;
 
 		u32 (*init_buf)(void *ptr, dma_addr_t phys, int token_id);
 		int (*offload_enable)(struct mtk_wed_device *wed);
 		void (*offload_disable)(struct mtk_wed_device *wed);
+		u32 (*init_rx_buf)(struct mtk_wed_device *wed,
+				   int pkt_num);
+		void (*release_rx_buf)(struct mtk_wed_device *wed);
+		void (*update_wo_rx_stats)(struct mtk_wed_device *wed,
+					   struct mtk_wed_wo_rx_stats *stats);
 	} wlan;
 #endif
 };
@@ -88,6 +173,10 @@ struct mtk_wed_ops {
 			     void __iomem *regs);
 	int (*txfree_ring_setup)(struct mtk_wed_device *dev,
 				 void __iomem *regs);
+	int (*rx_ring_setup)(struct mtk_wed_device *dev, int ring,
+				 void __iomem *regs);
+	int (*msg_update)(struct mtk_wed_device *dev, int cmd_id,
+			  void *data, int len);
 	void (*detach)(struct mtk_wed_device *dev);
 
 	void (*stop)(struct mtk_wed_device *dev);
@@ -99,6 +188,8 @@ struct mtk_wed_ops {
 
 	u32 (*irq_get)(struct mtk_wed_device *dev, u32 mask);
 	void (*irq_set_mask)(struct mtk_wed_device *dev, u32 mask);
+	void (*ppe_check)(struct mtk_wed_device *dev, struct sk_buff *skb,
+			  u32 reason, u32 hash);
 };
 
 extern const struct mtk_wed_ops __rcu *mtk_soc_wed_ops;
@@ -123,6 +214,16 @@ mtk_wed_device_attach(struct mtk_wed_device *dev)
 	return ret;
 }
 
+static inline bool
+mtk_wed_get_rx_capa(struct mtk_wed_device *dev)
+{
+#ifdef CONFIG_NET_MEDIATEK_SOC_WED
+	return dev->ver != 1;
+#else
+	return false;
+#endif
+}
+
 #ifdef CONFIG_NET_MEDIATEK_SOC_WED
 #define mtk_wed_device_active(_dev) !!(_dev)->ops
 #define mtk_wed_device_detach(_dev) (_dev)->ops->detach(_dev)
@@ -131,6 +232,10 @@ mtk_wed_device_attach(struct mtk_wed_device *dev)
 	(_dev)->ops->tx_ring_setup(_dev, _ring, _regs)
 #define mtk_wed_device_txfree_ring_setup(_dev, _regs) \
 	(_dev)->ops->txfree_ring_setup(_dev, _regs)
+#define mtk_wed_device_rx_ring_setup(_dev, _ring, _regs) \
+	(_dev)->ops->rx_ring_setup(_dev, _ring, _regs)
+#define mtk_wed_device_update_msg(_dev, _id, _msg, _len) \
+	(_dev)->ops->msg_update(_dev, _id, _msg, _len)
 #define mtk_wed_device_reg_read(_dev, _reg) \
 	(_dev)->ops->reg_read(_dev, _reg)
 #define mtk_wed_device_reg_write(_dev, _reg, _val) \
@@ -139,6 +244,8 @@ mtk_wed_device_attach(struct mtk_wed_device *dev)
 	(_dev)->ops->irq_get(_dev, _mask)
 #define mtk_wed_device_irq_set_mask(_dev, _mask) \
 	(_dev)->ops->irq_set_mask(_dev, _mask)
+#define mtk_wed_device_ppe_check(_dev, _skb, _reason, _hash) \
+	(_dev)->ops->ppe_check(_dev, _skb, _reason, _hash)
 #else
 static inline bool mtk_wed_device_active(struct mtk_wed_device *dev)
 {
@@ -148,10 +255,13 @@ static inline bool mtk_wed_device_active(struct mtk_wed_device *dev)
 #define mtk_wed_device_start(_dev, _mask) do {} while (0)
 #define mtk_wed_device_tx_ring_setup(_dev, _ring, _regs) -ENODEV
 #define mtk_wed_device_txfree_ring_setup(_dev, _ring, _regs) -ENODEV
+#define mtk_wed_device_rx_ring_setup(_dev, _ring, _regs) -ENODEV
+#define mtk_wed_device_update_msg(_dev, _id, _msg, _len) -ENODEV
 #define mtk_wed_device_reg_read(_dev, _reg) 0
 #define mtk_wed_device_reg_write(_dev, _reg, _val) do {} while (0)
 #define mtk_wed_device_irq_get(_dev, _mask) 0
 #define mtk_wed_device_irq_set_mask(_dev, _mask) do {} while (0)
+#define mtk_wed_device_ppe_check(_dev, _hash)  do {} while (0)
 #endif
 
 #endif
-- 
2.18.0