[][mac80211][wifi6][mt76][Remove revert patch and add sanity check]

[Description]
Remove revert patch and add sanity check to prevent kernel crash

[Release-log]
N/A

Change-Id: I60e733ccb06bc8a1daa55ccb05a12b6389b2efb1
Reviewed-on: https://gerrit.mediatek.inc/c/openwrt/feeds/mtk_openwrt_feeds/+/8605904
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0016-wifi-mt76-add-sanity-check-to-prevent-kernel-crash.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0016-wifi-mt76-add-sanity-check-to-prevent-kernel-crash.patch
new file mode 100644
index 0000000..09bb44f
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0016-wifi-mt76-add-sanity-check-to-prevent-kernel-crash.patch
@@ -0,0 +1,35 @@
+From 4d692fdbe6c9ac0cc538d37f96ed4267c627fb5f Mon Sep 17 00:00:00 2001
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+Date: Mon, 29 Jan 2024 15:33:24 +0800
+Subject: [PATCH] wifi: mt76: add sanity check to prevent kernel crash
+
+wcid may not be initialized when mac80211 calls mt76.tx and it would lead to
+kernel crash.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ tx.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/tx.c b/tx.c
+index 1809b032..4596b367 100644
+--- a/tx.c
++++ b/tx.c
+@@ -345,6 +345,14 @@ mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
+ 
+ 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, phy->band_idx);
+ 
++	if (!wcid->tx_pending.prev || !wcid->tx_pending.next) {
++		dev_warn(phy->dev->dev, "Un-initialized STA %pM wcid %d in mt76_tx\n",
++			 sta->addr, wcid->idx);
++
++		ieee80211_free_txskb(phy->hw, skb);
++		return;
++	}
++
+ 	spin_lock_bh(&wcid->tx_pending.lock);
+ 	__skb_queue_tail(&wcid->tx_pending, skb);
+ 	spin_unlock_bh(&wcid->tx_pending.lock);
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch
deleted file mode 100644
index cfa8066..0000000
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/2013-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-selected-.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 877b1fb4df6f2302b0eecbaf4311a1c432ee3c3a Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 23 Oct 2023 10:25:13 +0800
-Subject: [PATCH 71/76] Revert "wifi: mt76: mt7921: fix the wrong rate selected
- in fw for the chanctx driver"
-
-This reverts commit 9fc37b0ac5467cfe5e3d2ad8a29e9a7646ece2be.
----
- mt76_connac_mcu.c | 9 ++-------
- 1 file changed, 2 insertions(+), 7 deletions(-)
-
-diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
-index 4a7b694..e359388 100644
---- a/mt76_connac_mcu.c
-+++ b/mt76_connac_mcu.c
-@@ -847,9 +847,7 @@ void mt76_connac_mcu_sta_tlv(struct mt76_phy *mphy, struct sk_buff *skb,
- 			     struct ieee80211_vif *vif,
- 			     u8 rcpi, u8 sta_state)
- {
--	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
--	struct cfg80211_chan_def *chandef = mvif->ctx ?
--					    &mvif->ctx->def : &mphy->chandef;
-+	struct cfg80211_chan_def *chandef = &mphy->chandef;
- 	enum nl80211_band band = chandef->chan->band;
- 	struct mt76_dev *dev = mphy->dev;
- 	struct sta_rec_ra_info *ra_info;
-@@ -1355,10 +1353,7 @@ EXPORT_SYMBOL_GPL(mt76_connac_get_phy_mode);
- const struct ieee80211_sta_he_cap *
- mt76_connac_get_he_phy_cap(struct mt76_phy *phy, struct ieee80211_vif *vif)
- {
--	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
--	struct cfg80211_chan_def *chandef = mvif->ctx ?
--					    &mvif->ctx->def : &phy->chandef;
--	enum nl80211_band band = chandef->chan->band;
-+	enum nl80211_band band = phy->chandef.chan->band;
- 	struct ieee80211_supported_band *sband;
- 
- 	sband = phy->hw->wiphy->bands[band];
--- 
-2.18.0
-
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/2014-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/2014-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch
deleted file mode 100644
index aae4f6c..0000000
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/2014-Revert-wifi-mt76-mt7921-fix-the-wrong-rate-pickup-fo.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From 371a05c81b4ae064bcf3b5409839048ffc45f447 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 23 Oct 2023 10:25:18 +0800
-Subject: [PATCH 72/76] Revert "wifi: mt76: mt7921: fix the wrong rate pickup
- for the chanctx driver"
-
-This reverts commit 66d5694e1898c5584a83c60876bec16909ebe2b0.
----
- mac80211.c        | 9 ++-------
- mt76.h            | 3 +--
- mt76_connac_mac.c | 7 ++-----
- 3 files changed, 5 insertions(+), 14 deletions(-)
-
-diff --git a/mac80211.c b/mac80211.c
-index 013298e..09c9eb2 100644
---- a/mac80211.c
-+++ b/mac80211.c
-@@ -1728,16 +1728,11 @@ mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
- }
- EXPORT_SYMBOL_GPL(mt76_init_queue);
- 
--u16 mt76_calculate_default_rate(struct mt76_phy *phy,
--				struct ieee80211_vif *vif, int rateidx)
-+u16 mt76_calculate_default_rate(struct mt76_phy *phy, int rateidx)
- {
--	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
--	struct cfg80211_chan_def *chandef = mvif->ctx ?
--					    &mvif->ctx->def :
--					    &phy->chandef;
- 	int offset = 0;
- 
--	if (chandef->chan->band != NL80211_BAND_2GHZ)
-+	if (phy->chandef.chan->band != NL80211_BAND_2GHZ)
- 		offset = 4;
- 
- 	/* pick the lowest rate for hidden nodes */
-diff --git a/mt76.h b/mt76.h
-index 5fea9a5..d082b24 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -1262,8 +1262,7 @@ bool mt76_check_bin_file_mode(struct mt76_dev *dev);
- struct mt76_queue *
- mt76_init_queue(struct mt76_dev *dev, int qid, int idx, int n_desc,
- 		int ring_base, void *wed, u32 flags);
--u16 mt76_calculate_default_rate(struct mt76_phy *phy,
--				struct ieee80211_vif *vif, int rateidx);
-+u16 mt76_calculate_default_rate(struct mt76_phy *phy, int rateidx);
- static inline int mt76_init_tx_queue(struct mt76_phy *phy, int qid, int idx,
- 				     int n_desc, int ring_base, void *wed,
- 				     u32 flags)
-diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
-index 362d937..83d0dd2 100644
---- a/mt76_connac_mac.c
-+++ b/mt76_connac_mac.c
-@@ -294,10 +294,7 @@ u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy,
- 				 struct ieee80211_vif *vif,
- 				 bool beacon, bool mcast)
- {
--	struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
--	struct cfg80211_chan_def *chandef = mvif->ctx ?
--					    &mvif->ctx->def : &mphy->chandef;
--	u8 nss = 0, mode = 0, band = chandef->chan->band;
-+	u8 nss = 0, mode = 0, band = mphy->chandef.chan->band;
- 	int rateidx = 0, mcast_rate;
- 
- 	if (!vif)
-@@ -330,7 +327,7 @@ u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy,
- 		rateidx = ffs(vif->bss_conf.basic_rates) - 1;
- 
- legacy:
--	rateidx = mt76_calculate_default_rate(mphy, vif, rateidx);
-+	rateidx = mt76_calculate_default_rate(mphy, rateidx);
- 	mode = rateidx >> 8;
- 	rateidx &= GENMASK(7, 0);
- out:
--- 
-2.18.0
-
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/2015-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/2015-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch
deleted file mode 100644
index 474ef7b..0000000
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/2015-Revert-wifi-mt76-move-struct-ieee80211_chanctx_conf-.patch
+++ /dev/null
@@ -1,121 +0,0 @@
-From c5df80abbbbcfe8b3845a03ca48fc7745ba0d972 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 23 Oct 2023 10:25:25 +0800
-Subject: [PATCH 73/76] Revert "wifi: mt76: move struct ieee80211_chanctx_conf
- up to struct mt76_vif"
-
-This reverts commit d1881b1b2bf6018d1cb1b91e4301a60021cacaa3.
----
- mt76.h        |  1 -
- mt7921/main.c | 12 ++++++------
- mt792x.h      |  1 +
- mt792x_core.c |  4 ++--
- 4 files changed, 9 insertions(+), 9 deletions(-)
-
-diff --git a/mt76.h b/mt76.h
-index d082b24..699d84e 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -836,7 +836,6 @@ struct mt76_vif {
- 	u8 basic_rates_idx;
- 	u8 mcast_rates_idx;
- 	u8 beacon_rates_idx;
--	struct ieee80211_chanctx_conf *ctx;
- };
- 
- struct mt76_phy {
-diff --git a/mt7921/main.c b/mt7921/main.c
-index aa0cd78..ffcad1e 100644
---- a/mt7921/main.c
-+++ b/mt7921/main.c
-@@ -801,7 +801,7 @@ void mt7921_mac_sta_assoc(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 
- 	if (vif->type == NL80211_IFTYPE_STATION && !sta->tdls)
- 		mt76_connac_mcu_uni_add_bss(&dev->mphy, vif, &mvif->sta.wcid,
--					    true, mvif->mt76.ctx);
-+					    true, mvif->ctx);
- 
- 	ewma_avg_signal_init(&msta->avg_ack_signal);
- 
-@@ -836,7 +836,7 @@ void mt7921_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
- 		if (!sta->tdls)
- 			mt76_connac_mcu_uni_add_bss(&dev->mphy, vif,
- 						    &mvif->sta.wcid, false,
--						    mvif->mt76.ctx);
-+						    mvif->ctx);
- 	}
- 
- 	spin_lock_bh(&dev->mt76.sta_poll_lock);
-@@ -1255,7 +1255,7 @@ mt7921_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 	mt792x_mutex_acquire(dev);
- 
- 	err = mt76_connac_mcu_uni_add_bss(phy->mt76, vif, &mvif->sta.wcid,
--					  true, mvif->mt76.ctx);
-+					  true, mvif->ctx);
- 	if (err)
- 		goto out;
- 
-@@ -1287,7 +1287,7 @@ mt7921_stop_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
- 		goto out;
- 
- 	mt76_connac_mcu_uni_add_bss(phy->mt76, vif, &mvif->sta.wcid, false,
--				    mvif->mt76.ctx);
-+				    mvif->ctx);
- 
- out:
- 	mt792x_mutex_release(dev);
-@@ -1312,7 +1312,7 @@ static void mt7921_ctx_iter(void *priv, u8 *mac,
- 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
- 	struct ieee80211_chanctx_conf *ctx = priv;
- 
--	if (ctx != mvif->mt76.ctx)
-+	if (ctx != mvif->ctx)
- 		return;
- 
- 	if (vif->type == NL80211_IFTYPE_MONITOR)
-@@ -1345,7 +1345,7 @@ static void mt7921_mgd_prepare_tx(struct ieee80211_hw *hw,
- 		       jiffies_to_msecs(HZ);
- 
- 	mt792x_mutex_acquire(dev);
--	mt7921_set_roc(mvif->phy, mvif, mvif->mt76.ctx->def.chan, duration,
-+	mt7921_set_roc(mvif->phy, mvif, mvif->ctx->def.chan, duration,
- 		       MT7921_ROC_REQ_JOIN);
- 	mt792x_mutex_release(dev);
- }
-diff --git a/mt792x.h b/mt792x.h
-index 3c897b3..558753f 100644
---- a/mt792x.h
-+++ b/mt792x.h
-@@ -106,6 +106,7 @@ struct mt792x_vif {
- 	struct ewma_rssi rssi;
- 
- 	struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS];
-+	struct ieee80211_chanctx_conf *ctx;
- };
- 
- struct mt792x_phy {
-diff --git a/mt792x_core.c b/mt792x_core.c
-index 502be22..1228a8a 100644
---- a/mt792x_core.c
-+++ b/mt792x_core.c
-@@ -265,7 +265,7 @@ int mt792x_assign_vif_chanctx(struct ieee80211_hw *hw,
- 	struct mt792x_dev *dev = mt792x_hw_dev(hw);
- 
- 	mutex_lock(&dev->mt76.mutex);
--	mvif->mt76.ctx = ctx;
-+	mvif->ctx = ctx;
- 	mutex_unlock(&dev->mt76.mutex);
- 
- 	return 0;
-@@ -281,7 +281,7 @@ void mt792x_unassign_vif_chanctx(struct ieee80211_hw *hw,
- 	struct mt792x_dev *dev = mt792x_hw_dev(hw);
- 
- 	mutex_lock(&dev->mt76.mutex);
--	mvif->mt76.ctx = NULL;
-+	mvif->ctx = NULL;
- 	mutex_unlock(&dev->mt76.mutex);
- }
- EXPORT_SYMBOL_GPL(mt792x_unassign_vif_chanctx);
--- 
-2.18.0
-
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/2016-Revert-wifi-mt76-fix-race-condition-related-to-check.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/2016-Revert-wifi-mt76-fix-race-condition-related-to-check.patch
deleted file mode 100644
index 10eeb5e..0000000
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/2016-Revert-wifi-mt76-fix-race-condition-related-to-check.patch
+++ /dev/null
@@ -1,256 +0,0 @@
-From 32681b271d223bd7646372cae382c11d8784797b Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Mon, 23 Oct 2023 10:26:01 +0800
-Subject: [PATCH 74/76] Revert "wifi: mt76: fix race condition related to
- checking tx queue fill status"
-
-This reverts commit f1e1e67d97d1e9a8bb01b59ab20c45ebc985a958.
----
- mac80211.c |  27 --------------
- mt76.h     |   5 ---
- tx.c       | 108 ++++++++++-------------------------------------------
- 3 files changed, 20 insertions(+), 120 deletions(-)
-
-diff --git a/mac80211.c b/mac80211.c
-index 09c9eb2..5e01353 100644
---- a/mac80211.c
-+++ b/mac80211.c
-@@ -438,9 +438,6 @@ mt76_phy_init(struct mt76_phy *phy, struct ieee80211_hw *hw)
- 	struct mt76_dev *dev = phy->dev;
- 	struct wiphy *wiphy = hw->wiphy;
- 
--	INIT_LIST_HEAD(&phy->tx_list);
--	spin_lock_init(&phy->tx_lock);
--
- 	SET_IEEE80211_DEV(hw, dev->dev);
- 	SET_IEEE80211_PERM_ADDR(hw, phy->macaddr);
- 
-@@ -673,7 +670,6 @@ int mt76_register_device(struct mt76_dev *dev, bool vht,
- 	int ret;
- 
- 	dev_set_drvdata(dev->dev, dev);
--	mt76_wcid_init(&dev->global_wcid);
- 	ret = mt76_phy_init(phy, hw);
- 	if (ret)
- 		return ret;
-@@ -729,7 +725,6 @@ void mt76_unregister_device(struct mt76_dev *dev)
- 	if (IS_ENABLED(CONFIG_MT76_LEDS))
- 		mt76_led_cleanup(&dev->phy);
- 	mt76_tx_status_check(dev, true);
--	mt76_wcid_cleanup(dev, &dev->global_wcid);
- 	ieee80211_unregister_hw(hw);
- }
- EXPORT_SYMBOL_GPL(mt76_unregister_device);
-@@ -1477,9 +1472,6 @@ EXPORT_SYMBOL_GPL(mt76_sta_pre_rcu_remove);
- 
- void mt76_wcid_init(struct mt76_wcid *wcid)
- {
--	INIT_LIST_HEAD(&wcid->tx_list);
--	skb_queue_head_init(&wcid->tx_pending);
--
- 	INIT_LIST_HEAD(&wcid->list);
- 	idr_init(&wcid->pktid);
- }
-@@ -1487,32 +1479,13 @@ EXPORT_SYMBOL_GPL(mt76_wcid_init);
- 
- void mt76_wcid_cleanup(struct mt76_dev *dev, struct mt76_wcid *wcid)
- {
--	struct mt76_phy *phy = dev->phys[wcid->phy_idx];
--	struct ieee80211_hw *hw;
- 	struct sk_buff_head list;
--	struct sk_buff *skb;
- 
- 	mt76_tx_status_lock(dev, &list);
- 	mt76_tx_status_skb_get(dev, wcid, -1, &list);
- 	mt76_tx_status_unlock(dev, &list);
- 
- 	idr_destroy(&wcid->pktid);
--
--	spin_lock_bh(&phy->tx_lock);
--
--	if (!list_empty(&wcid->tx_list))
--		list_del_init(&wcid->tx_list);
--
--	spin_lock(&wcid->tx_pending.lock);
--	skb_queue_splice_tail_init(&wcid->tx_pending, &list);
--	spin_unlock(&wcid->tx_pending.lock);
--
--	spin_unlock_bh(&phy->tx_lock);
--
--	while ((skb = __skb_dequeue(&list)) != NULL) {
--		hw = mt76_tx_status_get_hw(dev, skb);
--		ieee80211_free_txskb(hw, skb);
--	}
- }
- EXPORT_SYMBOL_GPL(mt76_wcid_cleanup);
- 
-diff --git a/mt76.h b/mt76.h
-index 699d84e..70801f7 100644
---- a/mt76.h
-+++ b/mt76.h
-@@ -380,9 +380,6 @@ struct mt76_wcid {
- 	u32 tx_info;
- 	bool sw_iv;
- 
--	struct list_head tx_list;
--	struct sk_buff_head tx_pending;
--
- 	struct list_head list;
- 	struct idr pktid;
- 
-@@ -846,8 +843,6 @@ struct mt76_phy {
- 	unsigned long state;
- 	u8 band_idx;
- 
--	spinlock_t tx_lock;
--	struct list_head tx_list;
- 	struct mt76_queue *q_tx[__MT_TXQ_MAX];
- 
- 	struct cfg80211_chan_def chandef;
-diff --git a/tx.c b/tx.c
-index 96f9009..c88fb29 100644
---- a/tx.c
-+++ b/tx.c
-@@ -328,32 +328,40 @@ void
- mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
- 	struct mt76_wcid *wcid, struct sk_buff *skb)
- {
-+	struct mt76_dev *dev = phy->dev;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-+	struct mt76_queue *q;
-+	int qid = skb_get_queue_mapping(skb);
- 
- 	if (mt76_testmode_enabled(phy)) {
- 		ieee80211_free_txskb(phy->hw, skb);
- 		return;
- 	}
- 
--	if (WARN_ON(skb_get_queue_mapping(skb) >= MT_TXQ_PSD))
--		skb_set_queue_mapping(skb, MT_TXQ_BE);
-+	if (WARN_ON(qid >= MT_TXQ_PSD)) {
-+		qid = MT_TXQ_BE;
-+		skb_set_queue_mapping(skb, qid);
-+	}
-+
-+	if ((dev->drv->drv_flags & MT_DRV_HW_MGMT_TXQ) &&
-+	    !(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
-+	    !ieee80211_is_data(hdr->frame_control) &&
-+	    !ieee80211_is_bufferable_mmpdu(skb)) {
-+		qid = MT_TXQ_PSD;
-+	}
- 
- 	if (wcid && !(wcid->tx_info & MT_WCID_TX_INFO_SET))
- 		ieee80211_get_tx_rates(info->control.vif, sta, skb,
- 				       info->control.rates, 1);
- 
- 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, phy->band_idx);
-+	q = phy->q_tx[qid];
- 
--	spin_lock_bh(&wcid->tx_pending.lock);
--	__skb_queue_tail(&wcid->tx_pending, skb);
--	spin_unlock_bh(&wcid->tx_pending.lock);
--
--	spin_lock_bh(&phy->tx_lock);
--	if (list_empty(&wcid->tx_list))
--		list_add_tail(&wcid->tx_list, &phy->tx_list);
--	spin_unlock_bh(&phy->tx_lock);
--
--	mt76_worker_schedule(&phy->dev->tx_worker);
-+	spin_lock_bh(&q->lock);
-+	__mt76_tx_queue_skb(phy, qid, skb, wcid, sta, NULL);
-+	dev->queue_ops->kick(dev, q);
-+	spin_unlock_bh(&q->lock);
- }
- EXPORT_SYMBOL_GPL(mt76_tx);
- 
-@@ -584,86 +592,10 @@ void mt76_txq_schedule(struct mt76_phy *phy, enum mt76_txq_id qid)
- }
- EXPORT_SYMBOL_GPL(mt76_txq_schedule);
- 
--static int
--mt76_txq_schedule_pending_wcid(struct mt76_phy *phy, struct mt76_wcid *wcid)
--{
--	struct mt76_dev *dev = phy->dev;
--	struct ieee80211_sta *sta;
--	struct mt76_queue *q;
--	struct sk_buff *skb;
--	int ret = 0;
--
--	spin_lock(&wcid->tx_pending.lock);
--	while ((skb = skb_peek(&wcid->tx_pending)) != NULL) {
--		struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
--		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
--		int qid = skb_get_queue_mapping(skb);
--
--		if ((dev->drv->drv_flags & MT_DRV_HW_MGMT_TXQ) &&
--		    !(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
--		    !ieee80211_is_data(hdr->frame_control) &&
--		    !ieee80211_is_bufferable_mmpdu(skb))
--			qid = MT_TXQ_PSD;
--
--		q = phy->q_tx[qid];
--		if (mt76_txq_stopped(q)) {
--			ret = -1;
--			break;
--		}
--
--		__skb_unlink(skb, &wcid->tx_pending);
--		spin_unlock(&wcid->tx_pending.lock);
--
--		sta = wcid_to_sta(wcid);
--		spin_lock(&q->lock);
--		__mt76_tx_queue_skb(phy, qid, skb, wcid, sta, NULL);
--		dev->queue_ops->kick(dev, q);
--		spin_unlock(&q->lock);
--
--		spin_lock(&wcid->tx_pending.lock);
--	}
--	spin_unlock(&wcid->tx_pending.lock);
--
--	return ret;
--}
--
--static void mt76_txq_schedule_pending(struct mt76_phy *phy)
--{
--	if (list_empty(&phy->tx_list))
--		return;
--
--	local_bh_disable();
--	rcu_read_lock();
--
--	spin_lock(&phy->tx_lock);
--	while (!list_empty(&phy->tx_list)) {
--		struct mt76_wcid *wcid = NULL;
--		int ret;
--
--		wcid = list_first_entry(&phy->tx_list, struct mt76_wcid, tx_list);
--		list_del_init(&wcid->tx_list);
--
--		spin_unlock(&phy->tx_lock);
--		ret = mt76_txq_schedule_pending_wcid(phy, wcid);
--		spin_lock(&phy->tx_lock);
--
--		if (ret) {
--			if (list_empty(&wcid->tx_list))
--				list_add_tail(&wcid->tx_list, &phy->tx_list);
--			break;
--		}
--	}
--	spin_unlock(&phy->tx_lock);
--
--	rcu_read_unlock();
--	local_bh_enable();
--}
--
- void mt76_txq_schedule_all(struct mt76_phy *phy)
- {
- 	int i;
- 
--	mt76_txq_schedule_pending(phy);
- 	for (i = 0; i <= MT_TXQ_BK; i++)
- 		mt76_txq_schedule(phy, i);
- }
--- 
-2.18.0
-