From 2d9b52d2246ee62a259eae1e18736c74bcab3366 Mon Sep 17 00:00:00 2001 From: Devin Wittmayer Date: Mon, 20 Jul 2026 16:27:36 -0700 Subject: [PATCH] wifi: mt76: restrict NPU/PPE active checks to MMIO devices CicadaTAK-Marker: CICADATAK-MT76-NPU-MMIO mt76_npu_device_active() and mt76_ppe_device_active() read dev->mmio.npu and dev->mmio.ppe_dev. The mmio, usb and sdio bus structs share a union in struct mt76_dev, so on USB and SDIO these read unrelated data from the usb/sdio struct, which is non-NULL in practice. mt76_npu_device_active() then returns true on USB, and mt76_rx_poll_complete() takes the offload path and skips mt76_rx_aggr_reorder(). RX A-MPDU subframes are delivered out of order and the peer's TCP stack treats that as loss: heavy retransmissions and reduced throughput in AP mode. Seen on mt7921u, mt7925u, mt76x2u and mt76x0u. Gate both helpers on mt76_is_mmio() so they only run for the bus type that owns the mmio union member. Fixes: 7fb554b1b623 ("wifi: mt76: Introduce the NPU generic layer") Cc: stable@vger.kernel.org Tested-by: Nick Morrow Signed-off-by: Devin Wittmayer Link: https://patch.msgid.link/20260720232640.41293-1-lucid_duck@justthetip.ca Signed-off-by: Felix Fietkau [CicadaTAK backport, 2026-10-24: openwrt/mt76 commit 2d9b52d2246e (mainline 7981aca2bd28) onto mt76 2025.11.06~eb567bc7, the tree's pin. The mt76.h hunk is upstream's, re-based (the helpers sit at line 1722 here, 1752 upstream). One line is ours: a MODULE_INFO in util.c carrying the marker, so a built mt76.ko can be told from stock (imagebuilder/tools/ package-readback.py). What it fixes on our hardware: on a USB device, mmio.npu overlays usb.rx_worker.state (dev+0x5f88 in this build), which is never zero while the RX worker runs, so mt76_rx_aggr_reorder() never ran. A subframe refilled after a higher one then reached mt76_check_ccmp_pn() with a lower PN and was dropped (RX_FLAG_ONLY_MONITOR) after the chip had BlockAcked it, with no counter moving: 77 % of the frames of a weak 2.4 GHz mesh link (mt76x0u). docs/plans/weak-24-load-loss-next-step.md, ROOT CAUSE.] --- mt76.h | 4 ++-- util.c | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) --- a/mt76.h +++ b/mt76.h @@ -1722,12 +1722,12 @@ static inline bool mt76_npu_device_active(struct mt76_dev *dev) { - return !!rcu_access_pointer(dev->mmio.npu); + return mt76_is_mmio(dev) && !!rcu_access_pointer(dev->mmio.npu); } static inline bool mt76_ppe_device_active(struct mt76_dev *dev) { - return !!rcu_access_pointer(dev->mmio.ppe_dev); + return mt76_is_mmio(dev) && !!rcu_access_pointer(dev->mmio.ppe_dev); } static inline int mt76_npu_send_msg(struct airoha_npu *npu, int ifindex, --- a/util.c +++ b/util.c @@ -143,3 +143,4 @@ MODULE_DESCRIPTION("MediaTek MT76x helpers"); MODULE_LICENSE("Dual BSD/GPL"); +MODULE_INFO(cicadatak, "CICADATAK-MT76-NPU-MMIO");