1 // SPDX-License-Identifier: ISC
2 /* Copyright (C) 2020 MediaTek Inc. */
3 
4 #include <linux/devcoredump.h>
5 #include <linux/etherdevice.h>
6 #include <linux/timekeeping.h>
7 #include "mt7921.h"
8 #include "../dma.h"
9 #include "mac.h"
10 #include "mcu.h"
11 
12 static struct mt76_wcid *mt7921_rx_get_wcid(struct mt7921_dev *dev,
13 					    u16 idx, bool unicast)
14 {
15 	struct mt7921_sta *sta;
16 	struct mt76_wcid *wcid;
17 
18 	if (idx >= ARRAY_SIZE(dev->mt76.wcid))
19 		return NULL;
20 
21 	wcid = rcu_dereference(dev->mt76.wcid[idx]);
22 	if (unicast || !wcid)
23 		return wcid;
24 
25 	if (!wcid->sta)
26 		return NULL;
27 
28 	sta = container_of(wcid, struct mt7921_sta, wcid);
29 	if (!sta->vif)
30 		return NULL;
31 
32 	return &sta->vif->sta.wcid;
33 }
34 
35 void mt7921_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps)
36 {
37 }
38 EXPORT_SYMBOL_GPL(mt7921_sta_ps);
39 
40 bool mt7921_mac_wtbl_update(struct mt7921_dev *dev, int idx, u32 mask)
41 {
42 	mt76_rmw(dev, MT_WTBL_UPDATE, MT_WTBL_UPDATE_WLAN_IDX,
43 		 FIELD_PREP(MT_WTBL_UPDATE_WLAN_IDX, idx) | mask);
44 
45 	return mt76_poll(dev, MT_WTBL_UPDATE, MT_WTBL_UPDATE_BUSY,
46 			 0, 5000);
47 }
48 
49 void mt7921_mac_sta_poll(struct mt7921_dev *dev)
50 {
51 	static const u8 ac_to_tid[] = {
52 		[IEEE80211_AC_BE] = 0,
53 		[IEEE80211_AC_BK] = 1,
54 		[IEEE80211_AC_VI] = 4,
55 		[IEEE80211_AC_VO] = 6
56 	};
57 	struct ieee80211_sta *sta;
58 	struct mt7921_sta *msta;
59 	u32 tx_time[IEEE80211_NUM_ACS], rx_time[IEEE80211_NUM_ACS];
60 	LIST_HEAD(sta_poll_list);
61 	struct rate_info *rate;
62 	int i;
63 
64 	spin_lock_bh(&dev->sta_poll_lock);
65 	list_splice_init(&dev->sta_poll_list, &sta_poll_list);
66 	spin_unlock_bh(&dev->sta_poll_lock);
67 
68 	while (true) {
69 		bool clear = false;
70 		u32 addr, val;
71 		u16 idx;
72 		u8 bw;
73 
74 		spin_lock_bh(&dev->sta_poll_lock);
75 		if (list_empty(&sta_poll_list)) {
76 			spin_unlock_bh(&dev->sta_poll_lock);
77 			break;
78 		}
79 		msta = list_first_entry(&sta_poll_list,
80 					struct mt7921_sta, poll_list);
81 		list_del_init(&msta->poll_list);
82 		spin_unlock_bh(&dev->sta_poll_lock);
83 
84 		idx = msta->wcid.idx;
85 		addr = mt7921_mac_wtbl_lmac_addr(idx, MT_WTBL_AC0_CTT_OFFSET);
86 
87 		for (i = 0; i < IEEE80211_NUM_ACS; i++) {
88 			u32 tx_last = msta->airtime_ac[i];
89 			u32 rx_last = msta->airtime_ac[i + 4];
90 
91 			msta->airtime_ac[i] = mt76_rr(dev, addr);
92 			msta->airtime_ac[i + 4] = mt76_rr(dev, addr + 4);
93 
94 			tx_time[i] = msta->airtime_ac[i] - tx_last;
95 			rx_time[i] = msta->airtime_ac[i + 4] - rx_last;
96 
97 			if ((tx_last | rx_last) & BIT(30))
98 				clear = true;
99 
100 			addr += 8;
101 		}
102 
103 		if (clear) {
104 			mt7921_mac_wtbl_update(dev, idx,
105 					       MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
106 			memset(msta->airtime_ac, 0, sizeof(msta->airtime_ac));
107 		}
108 
109 		if (!msta->wcid.sta)
110 			continue;
111 
112 		sta = container_of((void *)msta, struct ieee80211_sta,
113 				   drv_priv);
114 		for (i = 0; i < IEEE80211_NUM_ACS; i++) {
115 			u8 q = mt76_connac_lmac_mapping(i);
116 			u32 tx_cur = tx_time[q];
117 			u32 rx_cur = rx_time[q];
118 			u8 tid = ac_to_tid[i];
119 
120 			if (!tx_cur && !rx_cur)
121 				continue;
122 
123 			ieee80211_sta_register_airtime(sta, tid, tx_cur,
124 						       rx_cur);
125 		}
126 
127 		/* We don't support reading GI info from txs packets.
128 		 * For accurate tx status reporting and AQL improvement,
129 		 * we need to make sure that flags match so polling GI
130 		 * from per-sta counters directly.
131 		 */
132 		rate = &msta->wcid.rate;
133 		addr = mt7921_mac_wtbl_lmac_addr(idx,
134 						 MT_WTBL_TXRX_CAP_RATE_OFFSET);
135 		val = mt76_rr(dev, addr);
136 
137 		switch (rate->bw) {
138 		case RATE_INFO_BW_160:
139 			bw = IEEE80211_STA_RX_BW_160;
140 			break;
141 		case RATE_INFO_BW_80:
142 			bw = IEEE80211_STA_RX_BW_80;
143 			break;
144 		case RATE_INFO_BW_40:
145 			bw = IEEE80211_STA_RX_BW_40;
146 			break;
147 		default:
148 			bw = IEEE80211_STA_RX_BW_20;
149 			break;
150 		}
151 
152 		if (rate->flags & RATE_INFO_FLAGS_HE_MCS) {
153 			u8 offs = MT_WTBL_TXRX_RATE_G2_HE + 2 * bw;
154 
155 			rate->he_gi = (val & (0x3 << offs)) >> offs;
156 		} else if (rate->flags &
157 			   (RATE_INFO_FLAGS_VHT_MCS | RATE_INFO_FLAGS_MCS)) {
158 			if (val & BIT(MT_WTBL_TXRX_RATE_G2 + bw))
159 				rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
160 			else
161 				rate->flags &= ~RATE_INFO_FLAGS_SHORT_GI;
162 		}
163 	}
164 }
165 EXPORT_SYMBOL_GPL(mt7921_mac_sta_poll);
166 
167 static void
168 mt7921_get_status_freq_info(struct mt7921_dev *dev, struct mt76_phy *mphy,
169 			    struct mt76_rx_status *status, u8 chfreq)
170 {
171 	if (!test_bit(MT76_HW_SCANNING, &mphy->state) &&
172 	    !test_bit(MT76_HW_SCHED_SCANNING, &mphy->state) &&
173 	    !test_bit(MT76_STATE_ROC, &mphy->state)) {
174 		status->freq = mphy->chandef.chan->center_freq;
175 		status->band = mphy->chandef.chan->band;
176 		return;
177 	}
178 
179 	if (chfreq > 180) {
180 		status->band = NL80211_BAND_6GHZ;
181 		chfreq = (chfreq - 181) * 4 + 1;
182 	} else if (chfreq > 14) {
183 		status->band = NL80211_BAND_5GHZ;
184 	} else {
185 		status->band = NL80211_BAND_2GHZ;
186 	}
187 	status->freq = ieee80211_channel_to_frequency(chfreq, status->band);
188 }
189 
190 static void
191 mt7921_mac_rssi_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)
192 {
193 	struct sk_buff *skb = priv;
194 	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
195 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
196 	struct ieee80211_hdr *hdr = mt76_skb_get_hdr(skb);
197 
198 	if (status->signal > 0)
199 		return;
200 
201 	if (!ether_addr_equal(vif->addr, hdr->addr1))
202 		return;
203 
204 	ewma_rssi_add(&mvif->rssi, -status->signal);
205 }
206 
207 static void
208 mt7921_mac_assoc_rssi(struct mt7921_dev *dev, struct sk_buff *skb)
209 {
210 	struct ieee80211_hdr *hdr = mt76_skb_get_hdr(skb);
211 
212 	if (!ieee80211_is_assoc_resp(hdr->frame_control) &&
213 	    !ieee80211_is_auth(hdr->frame_control))
214 		return;
215 
216 	ieee80211_iterate_active_interfaces_atomic(mt76_hw(dev),
217 		IEEE80211_IFACE_ITER_RESUME_ALL,
218 		mt7921_mac_rssi_iter, skb);
219 }
220 
221 static int
222 mt7921_mac_fill_rx(struct mt7921_dev *dev, struct sk_buff *skb)
223 {
224 	u32 csum_mask = MT_RXD0_NORMAL_IP_SUM | MT_RXD0_NORMAL_UDP_TCP_SUM;
225 	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
226 	bool hdr_trans, unicast, insert_ccmp_hdr = false;
227 	u8 chfreq, qos_ctl = 0, remove_pad, amsdu_info;
228 	u16 hdr_gap;
229 	__le32 *rxv = NULL, *rxd = (__le32 *)skb->data;
230 	struct mt76_phy *mphy = &dev->mt76.phy;
231 	struct mt7921_phy *phy = &dev->phy;
232 	struct ieee80211_supported_band *sband;
233 	u32 rxd0 = le32_to_cpu(rxd[0]);
234 	u32 rxd1 = le32_to_cpu(rxd[1]);
235 	u32 rxd2 = le32_to_cpu(rxd[2]);
236 	u32 rxd3 = le32_to_cpu(rxd[3]);
237 	u32 rxd4 = le32_to_cpu(rxd[4]);
238 	struct mt7921_sta *msta;
239 	u16 seq_ctrl = 0;
240 	__le16 fc = 0;
241 	u8 mode = 0;
242 	int i, idx;
243 
244 	memset(status, 0, sizeof(*status));
245 
246 	if (rxd1 & MT_RXD1_NORMAL_BAND_IDX)
247 		return -EINVAL;
248 
249 	if (!test_bit(MT76_STATE_RUNNING, &mphy->state))
250 		return -EINVAL;
251 
252 	if (rxd2 & MT_RXD2_NORMAL_AMSDU_ERR)
253 		return -EINVAL;
254 
255 	hdr_trans = rxd2 & MT_RXD2_NORMAL_HDR_TRANS;
256 	if (hdr_trans && (rxd1 & MT_RXD1_NORMAL_CM))
257 		return -EINVAL;
258 
259 	/* ICV error or CCMP/BIP/WPI MIC error */
260 	if (rxd1 & MT_RXD1_NORMAL_ICV_ERR)
261 		status->flag |= RX_FLAG_ONLY_MONITOR;
262 
263 	chfreq = FIELD_GET(MT_RXD3_NORMAL_CH_FREQ, rxd3);
264 	unicast = FIELD_GET(MT_RXD3_NORMAL_ADDR_TYPE, rxd3) == MT_RXD3_NORMAL_U2M;
265 	idx = FIELD_GET(MT_RXD1_NORMAL_WLAN_IDX, rxd1);
266 	status->wcid = mt7921_rx_get_wcid(dev, idx, unicast);
267 
268 	if (status->wcid) {
269 		msta = container_of(status->wcid, struct mt7921_sta, wcid);
270 		spin_lock_bh(&dev->sta_poll_lock);
271 		if (list_empty(&msta->poll_list))
272 			list_add_tail(&msta->poll_list, &dev->sta_poll_list);
273 		spin_unlock_bh(&dev->sta_poll_lock);
274 	}
275 
276 	mt7921_get_status_freq_info(dev, mphy, status, chfreq);
277 
278 	switch (status->band) {
279 	case NL80211_BAND_5GHZ:
280 		sband = &mphy->sband_5g.sband;
281 		break;
282 	case NL80211_BAND_6GHZ:
283 		sband = &mphy->sband_6g.sband;
284 		break;
285 	default:
286 		sband = &mphy->sband_2g.sband;
287 		break;
288 	}
289 
290 	if (!sband->channels)
291 		return -EINVAL;
292 
293 	if ((rxd0 & csum_mask) == csum_mask)
294 		skb->ip_summed = CHECKSUM_UNNECESSARY;
295 
296 	if (rxd1 & MT_RXD1_NORMAL_FCS_ERR)
297 		status->flag |= RX_FLAG_FAILED_FCS_CRC;
298 
299 	if (rxd1 & MT_RXD1_NORMAL_TKIP_MIC_ERR)
300 		status->flag |= RX_FLAG_MMIC_ERROR;
301 
302 	if (FIELD_GET(MT_RXD1_NORMAL_SEC_MODE, rxd1) != 0 &&
303 	    !(rxd1 & (MT_RXD1_NORMAL_CLM | MT_RXD1_NORMAL_CM))) {
304 		status->flag |= RX_FLAG_DECRYPTED;
305 		status->flag |= RX_FLAG_IV_STRIPPED;
306 		status->flag |= RX_FLAG_MMIC_STRIPPED | RX_FLAG_MIC_STRIPPED;
307 	}
308 
309 	remove_pad = FIELD_GET(MT_RXD2_NORMAL_HDR_OFFSET, rxd2);
310 
311 	if (rxd2 & MT_RXD2_NORMAL_MAX_LEN_ERROR)
312 		return -EINVAL;
313 
314 	rxd += 6;
315 	if (rxd1 & MT_RXD1_NORMAL_GROUP_4) {
316 		u32 v0 = le32_to_cpu(rxd[0]);
317 		u32 v2 = le32_to_cpu(rxd[2]);
318 
319 		fc = cpu_to_le16(FIELD_GET(MT_RXD6_FRAME_CONTROL, v0));
320 		seq_ctrl = FIELD_GET(MT_RXD8_SEQ_CTRL, v2);
321 		qos_ctl = FIELD_GET(MT_RXD8_QOS_CTL, v2);
322 
323 		rxd += 4;
324 		if ((u8 *)rxd - skb->data >= skb->len)
325 			return -EINVAL;
326 	}
327 
328 	if (rxd1 & MT_RXD1_NORMAL_GROUP_1) {
329 		u8 *data = (u8 *)rxd;
330 
331 		if (status->flag & RX_FLAG_DECRYPTED) {
332 			switch (FIELD_GET(MT_RXD1_NORMAL_SEC_MODE, rxd1)) {
333 			case MT_CIPHER_AES_CCMP:
334 			case MT_CIPHER_CCMP_CCX:
335 			case MT_CIPHER_CCMP_256:
336 				insert_ccmp_hdr =
337 					FIELD_GET(MT_RXD2_NORMAL_FRAG, rxd2);
338 				fallthrough;
339 			case MT_CIPHER_TKIP:
340 			case MT_CIPHER_TKIP_NO_MIC:
341 			case MT_CIPHER_GCMP:
342 			case MT_CIPHER_GCMP_256:
343 				status->iv[0] = data[5];
344 				status->iv[1] = data[4];
345 				status->iv[2] = data[3];
346 				status->iv[3] = data[2];
347 				status->iv[4] = data[1];
348 				status->iv[5] = data[0];
349 				break;
350 			default:
351 				break;
352 			}
353 		}
354 		rxd += 4;
355 		if ((u8 *)rxd - skb->data >= skb->len)
356 			return -EINVAL;
357 	}
358 
359 	if (rxd1 & MT_RXD1_NORMAL_GROUP_2) {
360 		status->timestamp = le32_to_cpu(rxd[0]);
361 		status->flag |= RX_FLAG_MACTIME_START;
362 
363 		if (!(rxd2 & MT_RXD2_NORMAL_NON_AMPDU)) {
364 			status->flag |= RX_FLAG_AMPDU_DETAILS;
365 
366 			/* all subframes of an A-MPDU have the same timestamp */
367 			if (phy->rx_ampdu_ts != status->timestamp) {
368 				if (!++phy->ampdu_ref)
369 					phy->ampdu_ref++;
370 			}
371 			phy->rx_ampdu_ts = status->timestamp;
372 
373 			status->ampdu_ref = phy->ampdu_ref;
374 		}
375 
376 		rxd += 2;
377 		if ((u8 *)rxd - skb->data >= skb->len)
378 			return -EINVAL;
379 	}
380 
381 	/* RXD Group 3 - P-RXV */
382 	if (rxd1 & MT_RXD1_NORMAL_GROUP_3) {
383 		u32 v0, v1;
384 		int ret;
385 
386 		rxv = rxd;
387 		rxd += 2;
388 		if ((u8 *)rxd - skb->data >= skb->len)
389 			return -EINVAL;
390 
391 		v0 = le32_to_cpu(rxv[0]);
392 		v1 = le32_to_cpu(rxv[1]);
393 
394 		if (v0 & MT_PRXV_HT_AD_CODE)
395 			status->enc_flags |= RX_ENC_FLAG_LDPC;
396 
397 		status->chains = mphy->antenna_mask;
398 		status->chain_signal[0] = to_rssi(MT_PRXV_RCPI0, v1);
399 		status->chain_signal[1] = to_rssi(MT_PRXV_RCPI1, v1);
400 		status->chain_signal[2] = to_rssi(MT_PRXV_RCPI2, v1);
401 		status->chain_signal[3] = to_rssi(MT_PRXV_RCPI3, v1);
402 		status->signal = -128;
403 		for (i = 0; i < hweight8(mphy->antenna_mask); i++) {
404 			if (!(status->chains & BIT(i)) ||
405 			    status->chain_signal[i] >= 0)
406 				continue;
407 
408 			status->signal = max(status->signal,
409 					     status->chain_signal[i]);
410 		}
411 
412 		ret = mt76_connac2_mac_fill_rx_rate(&dev->mt76, status, sband,
413 						    rxv, &mode);
414 		if (ret < 0)
415 			return ret;
416 
417 		if (rxd1 & MT_RXD1_NORMAL_GROUP_5) {
418 			rxd += 18;
419 			if ((u8 *)rxd - skb->data >= skb->len)
420 				return -EINVAL;
421 		}
422 	}
423 
424 	amsdu_info = FIELD_GET(MT_RXD4_NORMAL_PAYLOAD_FORMAT, rxd4);
425 	status->amsdu = !!amsdu_info;
426 	if (status->amsdu) {
427 		status->first_amsdu = amsdu_info == MT_RXD4_FIRST_AMSDU_FRAME;
428 		status->last_amsdu = amsdu_info == MT_RXD4_LAST_AMSDU_FRAME;
429 	}
430 
431 	hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
432 	if (hdr_trans && ieee80211_has_morefrags(fc)) {
433 		struct ieee80211_vif *vif;
434 		int err;
435 
436 		if (!msta || !msta->vif)
437 			return -EINVAL;
438 
439 		vif = container_of((void *)msta->vif, struct ieee80211_vif,
440 				   drv_priv);
441 		err = mt76_connac2_reverse_frag0_hdr_trans(vif, skb, hdr_gap);
442 		if (err)
443 			return err;
444 
445 		hdr_trans = false;
446 	} else {
447 		skb_pull(skb, hdr_gap);
448 		if (!hdr_trans && status->amsdu) {
449 			memmove(skb->data + 2, skb->data,
450 				ieee80211_get_hdrlen_from_skb(skb));
451 			skb_pull(skb, 2);
452 		}
453 	}
454 
455 	if (!hdr_trans) {
456 		struct ieee80211_hdr *hdr;
457 
458 		if (insert_ccmp_hdr) {
459 			u8 key_id = FIELD_GET(MT_RXD1_NORMAL_KEY_ID, rxd1);
460 
461 			mt76_insert_ccmp_hdr(skb, key_id);
462 		}
463 
464 		hdr = mt76_skb_get_hdr(skb);
465 		fc = hdr->frame_control;
466 		if (ieee80211_is_data_qos(fc)) {
467 			seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
468 			qos_ctl = *ieee80211_get_qos_ctl(hdr);
469 		}
470 	} else {
471 		status->flag |= RX_FLAG_8023;
472 	}
473 
474 	mt7921_mac_assoc_rssi(dev, skb);
475 
476 	if (rxv && mode >= MT_PHY_TYPE_HE_SU && !(status->flag & RX_FLAG_8023))
477 		mt76_connac2_mac_decode_he_radiotap(&dev->mt76, skb, rxv, mode);
478 
479 	if (!status->wcid || !ieee80211_is_data_qos(fc))
480 		return 0;
481 
482 	status->aggr = unicast && !ieee80211_is_qos_nullfunc(fc);
483 	status->seqno = IEEE80211_SEQ_TO_SN(seq_ctrl);
484 	status->qos_ctl = qos_ctl;
485 
486 	return 0;
487 }
488 
489 void mt7921_tx_check_aggr(struct ieee80211_sta *sta, __le32 *txwi)
490 {
491 	struct mt7921_sta *msta;
492 	u16 fc, tid;
493 	u32 val;
494 
495 	if (!sta || !(sta->deflink.ht_cap.ht_supported || sta->deflink.he_cap.has_he))
496 		return;
497 
498 	tid = le32_get_bits(txwi[1], MT_TXD1_TID);
499 	if (tid >= 6) /* skip VO queue */
500 		return;
501 
502 	val = le32_to_cpu(txwi[2]);
503 	fc = FIELD_GET(MT_TXD2_FRAME_TYPE, val) << 2 |
504 	     FIELD_GET(MT_TXD2_SUB_TYPE, val) << 4;
505 	if (unlikely(fc != (IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA)))
506 		return;
507 
508 	msta = (struct mt7921_sta *)sta->drv_priv;
509 	if (!test_and_set_bit(tid, &msta->ampdu_state))
510 		ieee80211_start_tx_ba_session(sta, tid, 0);
511 }
512 EXPORT_SYMBOL_GPL(mt7921_tx_check_aggr);
513 
514 void mt7921_mac_add_txs(struct mt7921_dev *dev, void *data)
515 {
516 	struct mt7921_sta *msta = NULL;
517 	struct mt76_wcid *wcid;
518 	__le32 *txs_data = data;
519 	u16 wcidx;
520 	u8 pid;
521 
522 	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) > 1)
523 		return;
524 
525 	wcidx = le32_get_bits(txs_data[2], MT_TXS2_WCID);
526 	pid = le32_get_bits(txs_data[3], MT_TXS3_PID);
527 
528 	if (pid < MT_PACKET_ID_FIRST)
529 		return;
530 
531 	if (wcidx >= MT7921_WTBL_SIZE)
532 		return;
533 
534 	rcu_read_lock();
535 
536 	wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
537 	if (!wcid)
538 		goto out;
539 
540 	msta = container_of(wcid, struct mt7921_sta, wcid);
541 
542 	mt76_connac2_mac_add_txs_skb(&dev->mt76, wcid, pid, txs_data,
543 				     &msta->stats);
544 	if (!wcid->sta)
545 		goto out;
546 
547 	spin_lock_bh(&dev->sta_poll_lock);
548 	if (list_empty(&msta->poll_list))
549 		list_add_tail(&msta->poll_list, &dev->sta_poll_list);
550 	spin_unlock_bh(&dev->sta_poll_lock);
551 
552 out:
553 	rcu_read_unlock();
554 }
555 EXPORT_SYMBOL_GPL(mt7921_mac_add_txs);
556 
557 void mt7921_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
558 			 struct sk_buff *skb)
559 {
560 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
561 	__le32 *rxd = (__le32 *)skb->data;
562 	__le32 *end = (__le32 *)&skb->data[skb->len];
563 	enum rx_pkt_type type;
564 	u16 flag;
565 
566 	type = le32_get_bits(rxd[0], MT_RXD0_PKT_TYPE);
567 	flag = le32_get_bits(rxd[0], MT_RXD0_PKT_FLAG);
568 
569 	if (type == PKT_TYPE_RX_EVENT && flag == 0x1)
570 		type = PKT_TYPE_NORMAL_MCU;
571 
572 	switch (type) {
573 	case PKT_TYPE_RX_EVENT:
574 		mt7921_mcu_rx_event(dev, skb);
575 		break;
576 	case PKT_TYPE_TXS:
577 		for (rxd += 2; rxd + 8 <= end; rxd += 8)
578 			mt7921_mac_add_txs(dev, rxd);
579 		dev_kfree_skb(skb);
580 		break;
581 	case PKT_TYPE_NORMAL_MCU:
582 	case PKT_TYPE_NORMAL:
583 		if (!mt7921_mac_fill_rx(dev, skb)) {
584 			mt76_rx(&dev->mt76, q, skb);
585 			return;
586 		}
587 		fallthrough;
588 	default:
589 		dev_kfree_skb(skb);
590 		break;
591 	}
592 }
593 EXPORT_SYMBOL_GPL(mt7921_queue_rx_skb);
594 
595 void mt7921_mac_reset_counters(struct mt7921_phy *phy)
596 {
597 	struct mt7921_dev *dev = phy->dev;
598 	int i;
599 
600 	for (i = 0; i < 4; i++) {
601 		mt76_rr(dev, MT_TX_AGG_CNT(0, i));
602 		mt76_rr(dev, MT_TX_AGG_CNT2(0, i));
603 	}
604 
605 	dev->mt76.phy.survey_time = ktime_get_boottime();
606 	memset(&dev->mt76.aggr_stats[0], 0, sizeof(dev->mt76.aggr_stats) / 2);
607 
608 	/* reset airtime counters */
609 	mt76_rr(dev, MT_MIB_SDR9(0));
610 	mt76_rr(dev, MT_MIB_SDR36(0));
611 	mt76_rr(dev, MT_MIB_SDR37(0));
612 
613 	mt76_set(dev, MT_WF_RMAC_MIB_TIME0(0), MT_WF_RMAC_MIB_RXTIME_CLR);
614 	mt76_set(dev, MT_WF_RMAC_MIB_AIRTIME0(0), MT_WF_RMAC_MIB_RXTIME_CLR);
615 }
616 
617 void mt7921_mac_set_timing(struct mt7921_phy *phy)
618 {
619 	s16 coverage_class = phy->coverage_class;
620 	struct mt7921_dev *dev = phy->dev;
621 	u32 val, reg_offset;
622 	u32 cck = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, 231) |
623 		  FIELD_PREP(MT_TIMEOUT_VAL_CCA, 48);
624 	u32 ofdm = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, 60) |
625 		   FIELD_PREP(MT_TIMEOUT_VAL_CCA, 28);
626 	bool is_2ghz = phy->mt76->chandef.chan->band == NL80211_BAND_2GHZ;
627 	int sifs = is_2ghz ? 10 : 16, offset;
628 
629 	if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
630 		return;
631 
632 	mt76_set(dev, MT_ARB_SCR(0),
633 		 MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
634 	udelay(1);
635 
636 	offset = 3 * coverage_class;
637 	reg_offset = FIELD_PREP(MT_TIMEOUT_VAL_PLCP, offset) |
638 		     FIELD_PREP(MT_TIMEOUT_VAL_CCA, offset);
639 
640 	mt76_wr(dev, MT_TMAC_CDTR(0), cck + reg_offset);
641 	mt76_wr(dev, MT_TMAC_ODTR(0), ofdm + reg_offset);
642 	mt76_wr(dev, MT_TMAC_ICR0(0),
643 		FIELD_PREP(MT_IFS_EIFS, 360) |
644 		FIELD_PREP(MT_IFS_RIFS, 2) |
645 		FIELD_PREP(MT_IFS_SIFS, sifs) |
646 		FIELD_PREP(MT_IFS_SLOT, phy->slottime));
647 
648 	if (phy->slottime < 20 || !is_2ghz)
649 		val = MT7921_CFEND_RATE_DEFAULT;
650 	else
651 		val = MT7921_CFEND_RATE_11B;
652 
653 	mt76_rmw_field(dev, MT_AGG_ACR0(0), MT_AGG_ACR_CFEND_RATE, val);
654 	mt76_clear(dev, MT_ARB_SCR(0),
655 		   MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE);
656 }
657 
658 static u8
659 mt7921_phy_get_nf(struct mt7921_phy *phy, int idx)
660 {
661 	return 0;
662 }
663 
664 static void
665 mt7921_phy_update_channel(struct mt76_phy *mphy, int idx)
666 {
667 	struct mt7921_dev *dev = container_of(mphy->dev, struct mt7921_dev, mt76);
668 	struct mt7921_phy *phy = (struct mt7921_phy *)mphy->priv;
669 	struct mt76_channel_state *state;
670 	u64 busy_time, tx_time, rx_time, obss_time;
671 	int nf;
672 
673 	busy_time = mt76_get_field(dev, MT_MIB_SDR9(idx),
674 				   MT_MIB_SDR9_BUSY_MASK);
675 	tx_time = mt76_get_field(dev, MT_MIB_SDR36(idx),
676 				 MT_MIB_SDR36_TXTIME_MASK);
677 	rx_time = mt76_get_field(dev, MT_MIB_SDR37(idx),
678 				 MT_MIB_SDR37_RXTIME_MASK);
679 	obss_time = mt76_get_field(dev, MT_WF_RMAC_MIB_AIRTIME14(idx),
680 				   MT_MIB_OBSSTIME_MASK);
681 
682 	nf = mt7921_phy_get_nf(phy, idx);
683 	if (!phy->noise)
684 		phy->noise = nf << 4;
685 	else if (nf)
686 		phy->noise += nf - (phy->noise >> 4);
687 
688 	state = mphy->chan_state;
689 	state->cc_busy += busy_time;
690 	state->cc_tx += tx_time;
691 	state->cc_rx += rx_time + obss_time;
692 	state->cc_bss_rx += rx_time;
693 	state->noise = -(phy->noise >> 4);
694 }
695 
696 void mt7921_update_channel(struct mt76_phy *mphy)
697 {
698 	struct mt7921_dev *dev = container_of(mphy->dev, struct mt7921_dev, mt76);
699 
700 	if (mt76_connac_pm_wake(mphy, &dev->pm))
701 		return;
702 
703 	mt7921_phy_update_channel(mphy, 0);
704 	/* reset obss airtime */
705 	mt76_set(dev, MT_WF_RMAC_MIB_TIME0(0), MT_WF_RMAC_MIB_RXTIME_CLR);
706 
707 	mt76_connac_power_save_sched(mphy, &dev->pm);
708 }
709 EXPORT_SYMBOL_GPL(mt7921_update_channel);
710 
711 static void
712 mt7921_vif_connect_iter(void *priv, u8 *mac,
713 			struct ieee80211_vif *vif)
714 {
715 	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
716 	struct mt7921_dev *dev = mvif->phy->dev;
717 	struct ieee80211_hw *hw = mt76_hw(dev);
718 
719 	if (vif->type == NL80211_IFTYPE_STATION)
720 		ieee80211_disconnect(vif, true);
721 
722 	mt76_connac_mcu_uni_add_dev(&dev->mphy, vif, &mvif->sta.wcid, true);
723 	mt7921_mcu_set_tx(dev, vif);
724 
725 	if (vif->type == NL80211_IFTYPE_AP) {
726 		mt76_connac_mcu_uni_add_bss(dev->phy.mt76, vif, &mvif->sta.wcid,
727 					    true);
728 		mt7921_mcu_sta_update(dev, NULL, vif, true,
729 				      MT76_STA_INFO_STATE_NONE);
730 		mt7921_mcu_uni_add_beacon_offload(dev, hw, vif, true);
731 	}
732 }
733 
734 /* system error recovery */
735 void mt7921_mac_reset_work(struct work_struct *work)
736 {
737 	struct mt7921_dev *dev = container_of(work, struct mt7921_dev,
738 					      reset_work);
739 	struct ieee80211_hw *hw = mt76_hw(dev);
740 	struct mt76_connac_pm *pm = &dev->pm;
741 	int i, ret;
742 
743 	dev_dbg(dev->mt76.dev, "chip reset\n");
744 	dev->hw_full_reset = true;
745 	ieee80211_stop_queues(hw);
746 
747 	cancel_delayed_work_sync(&dev->mphy.mac_work);
748 	cancel_delayed_work_sync(&pm->ps_work);
749 	cancel_work_sync(&pm->wake_work);
750 
751 	for (i = 0; i < 10; i++) {
752 		mutex_lock(&dev->mt76.mutex);
753 		ret = mt7921_dev_reset(dev);
754 		mutex_unlock(&dev->mt76.mutex);
755 
756 		if (!ret)
757 			break;
758 	}
759 
760 	if (i == 10)
761 		dev_err(dev->mt76.dev, "chip reset failed\n");
762 
763 	if (test_and_clear_bit(MT76_HW_SCANNING, &dev->mphy.state)) {
764 		struct cfg80211_scan_info info = {
765 			.aborted = true,
766 		};
767 
768 		ieee80211_scan_completed(dev->mphy.hw, &info);
769 	}
770 
771 	dev->hw_full_reset = false;
772 	pm->suspended = false;
773 	ieee80211_wake_queues(hw);
774 	ieee80211_iterate_active_interfaces(hw,
775 					    IEEE80211_IFACE_ITER_RESUME_ALL,
776 					    mt7921_vif_connect_iter, NULL);
777 	mt76_connac_power_save_sched(&dev->mt76.phy, pm);
778 }
779 
780 void mt7921_reset(struct mt76_dev *mdev)
781 {
782 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
783 
784 	if (!dev->hw_init_done)
785 		return;
786 
787 	if (dev->hw_full_reset)
788 		return;
789 
790 	queue_work(dev->mt76.wq, &dev->reset_work);
791 }
792 
793 void mt7921_mac_update_mib_stats(struct mt7921_phy *phy)
794 {
795 	struct mt7921_dev *dev = phy->dev;
796 	struct mib_stats *mib = &phy->mib;
797 	int i, aggr0 = 0, aggr1;
798 	u32 val;
799 
800 	mib->fcs_err_cnt += mt76_get_field(dev, MT_MIB_SDR3(0),
801 					   MT_MIB_SDR3_FCS_ERR_MASK);
802 	mib->ack_fail_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR3(0),
803 					    MT_MIB_ACK_FAIL_COUNT_MASK);
804 	mib->ba_miss_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR2(0),
805 					   MT_MIB_BA_FAIL_COUNT_MASK);
806 	mib->rts_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR0(0),
807 				       MT_MIB_RTS_COUNT_MASK);
808 	mib->rts_retries_cnt += mt76_get_field(dev, MT_MIB_MB_BSDR1(0),
809 					       MT_MIB_RTS_FAIL_COUNT_MASK);
810 
811 	mib->tx_ampdu_cnt += mt76_rr(dev, MT_MIB_SDR12(0));
812 	mib->tx_mpdu_attempts_cnt += mt76_rr(dev, MT_MIB_SDR14(0));
813 	mib->tx_mpdu_success_cnt += mt76_rr(dev, MT_MIB_SDR15(0));
814 
815 	val = mt76_rr(dev, MT_MIB_SDR32(0));
816 	mib->tx_pkt_ebf_cnt += FIELD_GET(MT_MIB_SDR9_EBF_CNT_MASK, val);
817 	mib->tx_pkt_ibf_cnt += FIELD_GET(MT_MIB_SDR9_IBF_CNT_MASK, val);
818 
819 	val = mt76_rr(dev, MT_ETBF_TX_APP_CNT(0));
820 	mib->tx_bf_ibf_ppdu_cnt += FIELD_GET(MT_ETBF_TX_IBF_CNT, val);
821 	mib->tx_bf_ebf_ppdu_cnt += FIELD_GET(MT_ETBF_TX_EBF_CNT, val);
822 
823 	val = mt76_rr(dev, MT_ETBF_RX_FB_CNT(0));
824 	mib->tx_bf_rx_fb_all_cnt += FIELD_GET(MT_ETBF_RX_FB_ALL, val);
825 	mib->tx_bf_rx_fb_he_cnt += FIELD_GET(MT_ETBF_RX_FB_HE, val);
826 	mib->tx_bf_rx_fb_vht_cnt += FIELD_GET(MT_ETBF_RX_FB_VHT, val);
827 	mib->tx_bf_rx_fb_ht_cnt += FIELD_GET(MT_ETBF_RX_FB_HT, val);
828 
829 	mib->rx_mpdu_cnt += mt76_rr(dev, MT_MIB_SDR5(0));
830 	mib->rx_ampdu_cnt += mt76_rr(dev, MT_MIB_SDR22(0));
831 	mib->rx_ampdu_bytes_cnt += mt76_rr(dev, MT_MIB_SDR23(0));
832 	mib->rx_ba_cnt += mt76_rr(dev, MT_MIB_SDR31(0));
833 
834 	for (i = 0; i < ARRAY_SIZE(mib->tx_amsdu); i++) {
835 		val = mt76_rr(dev, MT_PLE_AMSDU_PACK_MSDU_CNT(i));
836 		mib->tx_amsdu[i] += val;
837 		mib->tx_amsdu_cnt += val;
838 	}
839 
840 	for (i = 0, aggr1 = aggr0 + 4; i < 4; i++) {
841 		u32 val2;
842 
843 		val = mt76_rr(dev, MT_TX_AGG_CNT(0, i));
844 		val2 = mt76_rr(dev, MT_TX_AGG_CNT2(0, i));
845 
846 		dev->mt76.aggr_stats[aggr0++] += val & 0xffff;
847 		dev->mt76.aggr_stats[aggr0++] += val >> 16;
848 		dev->mt76.aggr_stats[aggr1++] += val2 & 0xffff;
849 		dev->mt76.aggr_stats[aggr1++] += val2 >> 16;
850 	}
851 }
852 
853 void mt7921_mac_work(struct work_struct *work)
854 {
855 	struct mt7921_phy *phy;
856 	struct mt76_phy *mphy;
857 
858 	mphy = (struct mt76_phy *)container_of(work, struct mt76_phy,
859 					       mac_work.work);
860 	phy = mphy->priv;
861 
862 	mt7921_mutex_acquire(phy->dev);
863 
864 	mt76_update_survey(mphy);
865 	if (++mphy->mac_work_count == 2) {
866 		mphy->mac_work_count = 0;
867 
868 		mt7921_mac_update_mib_stats(phy);
869 	}
870 
871 	mt7921_mutex_release(phy->dev);
872 
873 	mt76_tx_status_check(mphy->dev, false);
874 	ieee80211_queue_delayed_work(phy->mt76->hw, &mphy->mac_work,
875 				     MT7921_WATCHDOG_TIME);
876 }
877 
878 void mt7921_pm_wake_work(struct work_struct *work)
879 {
880 	struct mt7921_dev *dev;
881 	struct mt76_phy *mphy;
882 
883 	dev = (struct mt7921_dev *)container_of(work, struct mt7921_dev,
884 						pm.wake_work);
885 	mphy = dev->phy.mt76;
886 
887 	if (!mt7921_mcu_drv_pmctrl(dev)) {
888 		struct mt76_dev *mdev = &dev->mt76;
889 		int i;
890 
891 		if (mt76_is_sdio(mdev)) {
892 			mt76_connac_pm_dequeue_skbs(mphy, &dev->pm);
893 			mt76_worker_schedule(&mdev->sdio.txrx_worker);
894 		} else {
895 			local_bh_disable();
896 			mt76_for_each_q_rx(mdev, i)
897 				napi_schedule(&mdev->napi[i]);
898 			local_bh_enable();
899 			mt76_connac_pm_dequeue_skbs(mphy, &dev->pm);
900 			mt76_connac_tx_cleanup(mdev);
901 		}
902 		if (test_bit(MT76_STATE_RUNNING, &mphy->state))
903 			ieee80211_queue_delayed_work(mphy->hw, &mphy->mac_work,
904 						     MT7921_WATCHDOG_TIME);
905 	}
906 
907 	ieee80211_wake_queues(mphy->hw);
908 	wake_up(&dev->pm.wait);
909 }
910 
911 void mt7921_pm_power_save_work(struct work_struct *work)
912 {
913 	struct mt7921_dev *dev;
914 	unsigned long delta;
915 	struct mt76_phy *mphy;
916 
917 	dev = (struct mt7921_dev *)container_of(work, struct mt7921_dev,
918 						pm.ps_work.work);
919 	mphy = dev->phy.mt76;
920 
921 	delta = dev->pm.idle_timeout;
922 	if (test_bit(MT76_HW_SCANNING, &mphy->state) ||
923 	    test_bit(MT76_HW_SCHED_SCANNING, &mphy->state) ||
924 	    dev->fw_assert)
925 		goto out;
926 
927 	if (mutex_is_locked(&dev->mt76.mutex))
928 		/* if mt76 mutex is held we should not put the device
929 		 * to sleep since we are currently accessing device
930 		 * register map. We need to wait for the next power_save
931 		 * trigger.
932 		 */
933 		goto out;
934 
935 	if (time_is_after_jiffies(dev->pm.last_activity + delta)) {
936 		delta = dev->pm.last_activity + delta - jiffies;
937 		goto out;
938 	}
939 
940 	if (!mt7921_mcu_fw_pmctrl(dev)) {
941 		cancel_delayed_work_sync(&mphy->mac_work);
942 		return;
943 	}
944 out:
945 	queue_delayed_work(dev->mt76.wq, &dev->pm.ps_work, delta);
946 }
947 
948 void mt7921_coredump_work(struct work_struct *work)
949 {
950 	struct mt7921_dev *dev;
951 	char *dump, *data;
952 
953 	dev = (struct mt7921_dev *)container_of(work, struct mt7921_dev,
954 						coredump.work.work);
955 
956 	if (time_is_after_jiffies(dev->coredump.last_activity +
957 				  4 * MT76_CONNAC_COREDUMP_TIMEOUT)) {
958 		queue_delayed_work(dev->mt76.wq, &dev->coredump.work,
959 				   MT76_CONNAC_COREDUMP_TIMEOUT);
960 		return;
961 	}
962 
963 	dump = vzalloc(MT76_CONNAC_COREDUMP_SZ);
964 	data = dump;
965 
966 	while (true) {
967 		struct sk_buff *skb;
968 
969 		spin_lock_bh(&dev->mt76.lock);
970 		skb = __skb_dequeue(&dev->coredump.msg_list);
971 		spin_unlock_bh(&dev->mt76.lock);
972 
973 		if (!skb)
974 			break;
975 
976 		skb_pull(skb, sizeof(struct mt76_connac2_mcu_rxd));
977 		if (!dump || data + skb->len - dump > MT76_CONNAC_COREDUMP_SZ) {
978 			dev_kfree_skb(skb);
979 			continue;
980 		}
981 
982 		memcpy(data, skb->data, skb->len);
983 		data += skb->len;
984 
985 		dev_kfree_skb(skb);
986 	}
987 
988 	if (dump)
989 		dev_coredumpv(dev->mt76.dev, dump, MT76_CONNAC_COREDUMP_SZ,
990 			      GFP_KERNEL);
991 
992 	mt7921_reset(&dev->mt76);
993 }
994 
995 /* usb_sdio */
996 static void
997 mt7921_usb_sdio_write_txwi(struct mt7921_dev *dev, struct mt76_wcid *wcid,
998 			   enum mt76_txq_id qid, struct ieee80211_sta *sta,
999 			   struct ieee80211_key_conf *key, int pid,
1000 			   struct sk_buff *skb)
1001 {
1002 	__le32 *txwi = (__le32 *)(skb->data - MT_SDIO_TXD_SIZE);
1003 
1004 	memset(txwi, 0, MT_SDIO_TXD_SIZE);
1005 	mt76_connac2_mac_write_txwi(&dev->mt76, txwi, skb, wcid, key, pid, qid, 0);
1006 	skb_push(skb, MT_SDIO_TXD_SIZE);
1007 }
1008 
1009 int mt7921_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
1010 				   enum mt76_txq_id qid, struct mt76_wcid *wcid,
1011 				   struct ieee80211_sta *sta,
1012 				   struct mt76_tx_info *tx_info)
1013 {
1014 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
1015 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
1016 	struct ieee80211_key_conf *key = info->control.hw_key;
1017 	struct sk_buff *skb = tx_info->skb;
1018 	int err, pad, pktid, type;
1019 
1020 	if (unlikely(tx_info->skb->len <= ETH_HLEN))
1021 		return -EINVAL;
1022 
1023 	if (!wcid)
1024 		wcid = &dev->mt76.global_wcid;
1025 
1026 	if (sta) {
1027 		struct mt7921_sta *msta = (struct mt7921_sta *)sta->drv_priv;
1028 
1029 		if (time_after(jiffies, msta->last_txs + HZ / 4)) {
1030 			info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
1031 			msta->last_txs = jiffies;
1032 		}
1033 	}
1034 
1035 	pktid = mt76_tx_status_skb_add(&dev->mt76, wcid, skb);
1036 	mt7921_usb_sdio_write_txwi(dev, wcid, qid, sta, key, pktid, skb);
1037 
1038 	type = mt76_is_sdio(mdev) ? MT7921_SDIO_DATA : 0;
1039 	mt7921_skb_add_usb_sdio_hdr(dev, skb, type);
1040 	pad = round_up(skb->len, 4) - skb->len;
1041 	if (mt76_is_usb(mdev))
1042 		pad += 4;
1043 
1044 	err = mt76_skb_adjust_pad(skb, pad);
1045 	if (err)
1046 		/* Release pktid in case of error. */
1047 		idr_remove(&wcid->pktid, pktid);
1048 
1049 	return err;
1050 }
1051 EXPORT_SYMBOL_GPL(mt7921_usb_sdio_tx_prepare_skb);
1052 
1053 void mt7921_usb_sdio_tx_complete_skb(struct mt76_dev *mdev,
1054 				     struct mt76_queue_entry *e)
1055 {
1056 	__le32 *txwi = (__le32 *)(e->skb->data + MT_SDIO_HDR_SIZE);
1057 	unsigned int headroom = MT_SDIO_TXD_SIZE + MT_SDIO_HDR_SIZE;
1058 	struct ieee80211_sta *sta;
1059 	struct mt76_wcid *wcid;
1060 	u16 idx;
1061 
1062 	idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX);
1063 	wcid = rcu_dereference(mdev->wcid[idx]);
1064 	sta = wcid_to_sta(wcid);
1065 
1066 	if (sta && likely(e->skb->protocol != cpu_to_be16(ETH_P_PAE)))
1067 		mt7921_tx_check_aggr(sta, txwi);
1068 
1069 	skb_pull(e->skb, headroom);
1070 	mt76_tx_complete_skb(mdev, e->wcid, e->skb);
1071 }
1072 EXPORT_SYMBOL_GPL(mt7921_usb_sdio_tx_complete_skb);
1073 
1074 bool mt7921_usb_sdio_tx_status_data(struct mt76_dev *mdev, u8 *update)
1075 {
1076 	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
1077 
1078 	mt7921_mutex_acquire(dev);
1079 	mt7921_mac_sta_poll(dev);
1080 	mt7921_mutex_release(dev);
1081 
1082 	return false;
1083 }
1084 EXPORT_SYMBOL_GPL(mt7921_usb_sdio_tx_status_data);
1085 
1086 #if IS_ENABLED(CONFIG_IPV6)
1087 void mt7921_set_ipv6_ns_work(struct work_struct *work)
1088 {
1089 	struct mt7921_dev *dev = container_of(work, struct mt7921_dev,
1090 						ipv6_ns_work);
1091 	struct sk_buff *skb;
1092 	int ret = 0;
1093 
1094 	do {
1095 		skb = skb_dequeue(&dev->ipv6_ns_list);
1096 
1097 		if (!skb)
1098 			break;
1099 
1100 		mt7921_mutex_acquire(dev);
1101 		ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
1102 					    MCU_UNI_CMD(OFFLOAD), true);
1103 		mt7921_mutex_release(dev);
1104 
1105 	} while (!ret);
1106 
1107 	if (ret)
1108 		skb_queue_purge(&dev->ipv6_ns_list);
1109 }
1110 #endif
1111