wifi: mt76: mt7996: fix RX buffer size of MCU event

Some management frames are first processed by the firmware and then
passed to the driver through the MCU event rings. In CONNAC3, event rings
do not support scatter-gather and have a size limitation of 2048 bytes.
If a packet sized between 1728 and 2048 bytes arrives from an event ring,
the ring will hang because the driver attempts to use scatter-gather to
process it.

To fix this, include the size of struct skb_shared_info in the MCU RX
buffer size to prevent scatter-gather from being used for event skb in
mt76_dma_rx_fill_buf().

Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Co-developed-by: Peter Chiu <chui-hao.chiu@mediatek.com>
Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Link: https://patch.msgid.link/20250515032952.1653494-7-shayne.chen@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/dma.c b/drivers/net/wireless/mediatek/mt76/mt7996/dma.c
index fe8cc1d3f7388d3c3313cd563ea1472a9313f3d7..c8bef0b2a14445224689efb4c0fee6c80387a7fa 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7996/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/dma.c
@@ -531,7 +531,7 @@ int mt7996_dma_init(struct mt7996_dev *dev)
        ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_MCU],
                               MT_RXQ_ID(MT_RXQ_MCU),
                               MT7996_RX_MCU_RING_SIZE,
-                              MT_RX_BUF_SIZE,
+                              MT7996_RX_MCU_BUF_SIZE,
                               MT_RXQ_RING_BASE(MT_RXQ_MCU));
        if (ret)
                return ret;
@@ -540,7 +540,7 @@ int mt7996_dma_init(struct mt7996_dev *dev)
        ret = mt76_queue_alloc(dev, &dev->mt76.q_rx[MT_RXQ_MCU_WA],
                               MT_RXQ_ID(MT_RXQ_MCU_WA),
                               MT7996_RX_MCU_RING_SIZE_WA,
-                              MT_RX_BUF_SIZE,
+                              MT7996_RX_MCU_BUF_SIZE,
                               MT_RXQ_RING_BASE(MT_RXQ_MCU_WA));
        if (ret)
                return ret;

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
index c75189a023165c09a95ff3229785b57a2d1c376f..1ad6bc046f7c01d43452252ed46677d42e0c8850 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
@@ -29,6 +29,9 @@
 #define MT7996_RX_RING_SIZE            1536
 #define MT7996_RX_MCU_RING_SIZE                512
 #define MT7996_RX_MCU_RING_SIZE_WA     1024
+/* scatter-gather of mcu event is not supported in connac3 */
+#define MT7996_RX_MCU_BUF_SIZE         (2048 + \
+                                        SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
 
 #define MT7996_DEVICE_ID               0x7990
 #define MT7996_DEVICE_ID_2             0x7991