Mt76 page_pool not working (arm + usb ?)

Hello,

I was compiling openwrt for a Raspberry Pi 2 (cortex-a7 900mhz) and ran into a problem where both a mt7612u and a mt7921u adapter wouldn't work.

Tue Jul 25 06:02:33 2023 kern.info kernel: [   14.118281] usbhid: USB HID core driver
Tue Jul 25 06:02:33 2023 kern.info kernel: [   14.281994] usbcore: registered new interface driver mt76x2u
Tue Jul 25 06:02:33 2023 kern.info kernel: [   14.620943] usb 1-1.5: reset high-speed USB device number 4 using dwc_otg
Tue Jul 25 06:02:33 2023 kern.warn kernel: [   14.771004] page_pool_create() gave up with errno -22
Tue Jul 25 06:02:33 2023 kern.warn kernel: [   14.777896] mt7921u: probe of 1-1.5:1.3 failed with error -22
Tue Jul 25 06:02:33 2023 kern.info kernel: [   14.785452] usbcore: registered new interface driver mt7921u
Tue Jul 25 06:02:40 2023 kern.info kernel: [   22.971062] usb 1-1.5: reset high-speed USB device number 4 using dwc_otg
Tue Jul 25 06:02:40 2023 kern.warn kernel: [   23.260946] page_pool_create() gave up with errno -22
Tue Jul 25 06:02:40 2023 kern.warn kernel: [   23.268388] mt7921u: probe of 1-1.5:1.3 failed with error -22

So I went and reverted the page pool support from the mt76 driver, and the problem is gone, patch below:

diff --git a/dma.c b/dma.c
index 05d9ab3c..5d773dea 100644
--- a/dma.c
+++ b/dma.c
@@ -173,7 +173,7 @@ mt76_free_pending_rxwi(struct mt76_dev *dev)
        local_bh_disable();
        while ((t = __mt76_get_rxwi(dev)) != NULL) {
                if (t->ptr)
-                       mt76_put_page_pool_buf(t->ptr, false);
+                       skb_free_frag(t->ptr);
                kfree(t);
        }
        local_bh_enable();
@@ -409,9 +409,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
                if (!t)
                        return NULL;
 
-               dma_sync_single_for_cpu(dev->dma_dev, t->dma_addr,
-                               SKB_WITH_OVERHEAD(q->buf_size),
-                               page_pool_get_dma_dir(q->page_pool));
+               dma_unmap_single(dev->dma_dev, t->dma_addr,
+                                SKB_WITH_OVERHEAD(q->buf_size),
+                                DMA_FROM_DEVICE);
 
                buf = t->ptr;
                t->dma_addr = 0;
@@ -430,9 +430,9 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
        } else {
                buf = e->buf;
                e->buf = NULL;
-               dma_sync_single_for_cpu(dev->dma_dev, e->dma_addr[0],
-                               SKB_WITH_OVERHEAD(q->buf_size),
-                               page_pool_get_dma_dir(q->page_pool));
+               dma_unmap_single(dev->dma_dev, e->dma_addr[0],
+                                SKB_WITH_OVERHEAD(q->buf_size),
+                                DMA_FROM_DEVICE);
        }
 
        return buf;
@@ -592,11 +592,11 @@ free_skb:
 }
 
 static int
-mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
-                bool allow_direct)
+mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
 {
        int len = SKB_WITH_OVERHEAD(q->buf_size);
-       int frames = 0;
+       int frames = 0, offset = q->buf_offset;
+       dma_addr_t addr;
 
        if (!q->ndesc)
                return 0;
@@ -604,25 +604,26 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q,
        spin_lock_bh(&q->lock);
 
        while (q->queued < q->ndesc - 1) {
-               enum dma_data_direction dir;
                struct mt76_queue_buf qbuf;
-               dma_addr_t addr;
-               int offset;
-               void *buf;
+               void *buf = NULL;
 
-               buf = mt76_get_page_pool_buf(q, &offset, q->buf_size);
+               buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
                if (!buf)
                        break;
 
-               addr = page_pool_get_dma_addr(virt_to_head_page(buf)) + offset;
-               dir = page_pool_get_dma_dir(q->page_pool);
-               dma_sync_single_for_device(dev->dma_dev, addr, len, dir);
+               addr = dma_map_single(dev->dma_dev, buf, len, DMA_FROM_DEVICE);
+               if (unlikely(dma_mapping_error(dev->dma_dev, addr))) {
+                       skb_free_frag(buf);
+                       break;
+               }
 
-               qbuf.addr = addr + q->buf_offset;
-               qbuf.len = len - q->buf_offset;
+               qbuf.addr = addr + offset;
+               qbuf.len = len - offset;
                qbuf.skip_unmap = false;
                if (mt76_dma_add_rx_buf(dev, q, &qbuf, buf) < 0) {
-                       mt76_put_page_pool_buf(buf, allow_direct);
+                       dma_unmap_single(dev->dma_dev, addr, len,
+                                        DMA_FROM_DEVICE);
+                       skb_free_frag(buf);
                        break;
                }
                frames++;
@@ -666,7 +667,7 @@ int mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q, bool reset)
                /* WED txfree queue needs ring to be initialized before setup */
                q->flags = 0;
                mt76_dma_queue_reset(dev, q);
-               mt76_dma_rx_fill(dev, q, false);
+               mt76_dma_rx_fill(dev, q);
                q->flags = flags;
 
                ret = mtk_wed_device_txfree_ring_setup(wed, q->regs);
@@ -714,10 +715,6 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
        if (!q->entry)
                return -ENOMEM;
 
-       ret = mt76_create_page_pool(dev, q);
-       if (ret)
-               return ret;
-
        ret = mt76_dma_wed_setup(dev, q, false);
        if (ret)
                return ret;
@@ -731,6 +728,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
 static void
 mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
 {
+       struct page *page;
        void *buf;
        bool more;
 
@@ -744,7 +742,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
                if (!buf)
                        break;
 
-               mt76_put_page_pool_buf(buf, false);
+               skb_free_frag(buf);
        } while (1);
 
        if (q->rx_head) {
@@ -753,6 +751,13 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
        }
 
        spin_unlock_bh(&q->lock);
+
+       if (!q->rx_page.va)
+               return;
+
+       page = virt_to_page(q->rx_page.va);
+       __page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
+       memset(&q->rx_page, 0, sizeof(q->rx_page));
 }
 
 static void
@@ -773,7 +778,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
        mt76_dma_wed_setup(dev, q, true);
        if (q->flags != MT_WED_Q_TXFREE) {
                mt76_dma_sync_idx(dev, q);
-               mt76_dma_rx_fill(dev, q, false);
+               mt76_dma_rx_fill(dev, q);
        }
 }
 
@@ -791,7 +796,7 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
 
                skb_add_rx_frag(skb, nr_frags, page, offset, len, q->buf_size);
        } else {
-               mt76_put_page_pool_buf(data, true);
+               skb_free_frag(data);
        }
 
        if (more)
@@ -864,7 +869,6 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
                        goto free_frag;
 
                skb_reserve(skb, q->buf_offset);
-               skb_mark_for_recycle(skb);
 
                *(u32 *)skb->cb = info;
 
@@ -880,10 +884,10 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
                continue;
 
 free_frag:
-               mt76_put_page_pool_buf(data, true);
+               skb_free_frag(data);
        }
 
-       mt76_dma_rx_fill(dev, q, true);
+       mt76_dma_rx_fill(dev, q);
        return done;
 }
 
@@ -928,7 +932,7 @@ mt76_dma_init(struct mt76_dev *dev,
 
        mt76_for_each_q_rx(dev, i) {
                netif_napi_add(&dev->napi_dev, &dev->napi[i], poll);
-               mt76_dma_rx_fill(dev, &dev->q_rx[i], false);
+               mt76_dma_rx_fill(dev, &dev->q_rx[i]);
                napi_enable(&dev->napi[i]);
        }
 
@@ -979,8 +983,6 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
 
                netif_napi_del(&dev->napi[i]);
                mt76_dma_rx_cleanup(dev, q);
-
-               page_pool_destroy(q->page_pool);
        }
 
        mt76_free_pending_txwi(dev);
diff --git a/mac80211.c b/mac80211.c
index 85407387..76cb08b1 100644
--- a/mac80211.c
+++ b/mac80211.c
@@ -4,7 +4,6 @@
  */
 #include <linux/sched.h>
 #include <linux/of.h>
-#include <net/page_pool.h>
 #include "mt76.h"
 
 #define CHAN2G(_idx, _freq) {                  \
@@ -563,47 +562,6 @@ void mt76_unregister_phy(struct mt76_phy *phy)
 }
 EXPORT_SYMBOL_GPL(mt76_unregister_phy);
 
-int mt76_create_page_pool(struct mt76_dev *dev, struct mt76_queue *q)
-{
-       struct page_pool_params pp_params = {
-               .order = 0,
-               .flags = PP_FLAG_PAGE_FRAG,
-               .nid = NUMA_NO_NODE,
-               .dev = dev->dma_dev,
-       };
-       int idx = q - dev->q_rx;
-
-       switch (idx) {
-       case MT_RXQ_MAIN:
-       case MT_RXQ_BAND1:
-       case MT_RXQ_BAND2:
-               pp_params.pool_size = 256;
-               break;
-       default:
-               pp_params.pool_size = 16;
-               break;
-       }
-
-       if (mt76_is_mmio(dev)) {
-               /* rely on page_pool for DMA mapping */
-               pp_params.flags |= PP_FLAG_DMA_MAP | PP_FLAG_DMA_SYNC_DEV;
-               pp_params.dma_dir = DMA_FROM_DEVICE;
-               pp_params.max_len = PAGE_SIZE;
-               pp_params.offset = 0;
-       }
-
-       q->page_pool = page_pool_create(&pp_params);
-       if (IS_ERR(q->page_pool)) {
-               int err = PTR_ERR(q->page_pool);
-
-               q->page_pool = NULL;
-               return err;
-       }
-
-       return 0;
-}
-EXPORT_SYMBOL_GPL(mt76_create_page_pool);
-
 struct mt76_dev *
 mt76_alloc_device(struct device *pdev, unsigned int size,
                  const struct ieee80211_ops *ops,
@@ -1748,21 +1706,6 @@ void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
 }
 EXPORT_SYMBOL_GPL(mt76_ethtool_worker);
 
-void mt76_ethtool_page_pool_stats(struct mt76_dev *dev, u64 *data, int *index)
-{
-#ifdef CONFIG_PAGE_POOL_STATS
-       struct page_pool_stats stats = {};
-       int i;
-
-       mt76_for_each_q_rx(dev, i)
-               page_pool_get_stats(dev->q_rx[i].page_pool, &stats);
-
-       page_pool_ethtool_stats_get(data, &stats);
-       *index += page_pool_ethtool_stats_get_count();
-#endif
-}
-EXPORT_SYMBOL_GPL(mt76_ethtool_page_pool_stats);
-
 enum mt76_dfs_state mt76_phy_dfs_state(struct mt76_phy *phy)
 {
        struct ieee80211_hw *hw = phy->hw;
diff --git a/mt76.h b/mt76.h
index 034ab90c..c668e1b5 100644
--- a/mt76.h
+++ b/mt76.h
@@ -202,7 +202,7 @@ struct mt76_queue {
 
        dma_addr_t desc_dma;
        struct sk_buff *rx_head;
-       struct page_pool *page_pool;
+       struct page_frag_cache rx_page;
 };
 
 struct mt76_mcu_ops {
@@ -1424,7 +1424,6 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
        return usb_bulk_msg(udev, pipe, data, len, actual_len, timeout);
 }
 
-void mt76_ethtool_page_pool_stats(struct mt76_dev *dev, u64 *data, int *index);
 void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
                         struct mt76_sta_stats *stats, bool eht);
 int mt76_skb_adjust_pad(struct sk_buff *skb, int pad);
@@ -1536,25 +1535,6 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
 struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
 int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
                          struct mt76_txwi_cache *r, dma_addr_t phys);
-int mt76_create_page_pool(struct mt76_dev *dev, struct mt76_queue *q);
-static inline void mt76_put_page_pool_buf(void *buf, bool allow_direct)
-{
-       struct page *page = virt_to_head_page(buf);
-
-       page_pool_put_full_page(page->pp, page, allow_direct);
-}
-
-static inline void *
-mt76_get_page_pool_buf(struct mt76_queue *q, u32 *offset, u32 size)
-{
-       struct page *page;
-
-       page = page_pool_dev_alloc_frag(q->page_pool, offset, size);
-       if (!page)
-               return NULL;
-
-       return page_address(page) + *offset;
-}
 
 static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
 {
diff --git a/mt7915/main.c b/mt7915/main.c
index 33bfa4a6..e1eb4695 100644
--- a/mt7915/main.c
+++ b/mt7915/main.c
@@ -1382,22 +1382,19 @@ void mt7915_get_et_strings(struct ieee80211_hw *hw,
                           struct ieee80211_vif *vif,
                           u32 sset, u8 *data)
 {
-       if (sset != ETH_SS_STATS)
-               return;
-
-       memcpy(data, *mt7915_gstrings_stats, sizeof(mt7915_gstrings_stats));
-       data += sizeof(mt7915_gstrings_stats);
-       page_pool_ethtool_stats_get_strings(data);
+       if (sset == ETH_SS_STATS)
+               memcpy(data, *mt7915_gstrings_stats,
+                      sizeof(mt7915_gstrings_stats));
 }
 
 static
 int mt7915_get_et_sset_count(struct ieee80211_hw *hw,
                             struct ieee80211_vif *vif, int sset)
 {
-       if (sset != ETH_SS_STATS)
-               return 0;
+       if (sset == ETH_SS_STATS)
+               return MT7915_SSTATS_LEN;
 
-       return MT7915_SSTATS_LEN + page_pool_ethtool_stats_get_count();
+       return 0;
 }
 
 static void mt7915_ethtool_worker(void *wi_data, struct ieee80211_sta *sta)
@@ -1425,7 +1422,7 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
                .idx = mvif->mt76.idx,
        };
        /* See mt7915_ampdu_stat_read_phy, etc */
-       int i, ei = 0, stats_size;
+       int i, ei = 0;
 
        mutex_lock(&dev->mt76.mutex);
 
@@ -1537,12 +1534,9 @@ void mt7915_get_et_stats(struct ieee80211_hw *hw,
                return;
 
        ei += wi.worker_stat_count;
-
-       mt76_ethtool_page_pool_stats(&dev->mt76, &data[ei], &ei);
-
-       stats_size = MT7915_SSTATS_LEN + page_pool_ethtool_stats_get_count();
-       if (ei != stats_size)
-               dev_err(dev->mt76.dev, "ei: %d size: %d", ei, stats_size);
+       if (ei != MT7915_SSTATS_LEN)
+               dev_err(dev->mt76.dev, "ei: %d  MT7915_SSTATS_LEN: %d",
+                       ei, (int)MT7915_SSTATS_LEN);
 }
 
 static void
diff --git a/mt7915/mmio.c b/mt7915/mmio.c
index fc7ace63..8d92e76d 100644
--- a/mt7915/mmio.c
+++ b/mt7915/mmio.c
@@ -570,9 +570,13 @@ static void mt7915_mmio_wed_offload_disable(struct mtk_wed_device *wed)
 static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
 {
        struct mt7915_dev *dev;
+       u32 length;
        int i;
 
        dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
+       length = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_size +
+                               sizeof(struct skb_shared_info));
+
        for (i = 0; i < dev->mt76.rx_token_size; i++) {
                struct mt76_txwi_cache *t;
 
@@ -580,7 +584,9 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
                if (!t || !t->ptr)
                        continue;
 
-               mt76_put_page_pool_buf(t->ptr, false);
+               dma_unmap_single(dev->mt76.dma_dev, t->dma_addr,
+                                wed->wlan.rx_size, DMA_FROM_DEVICE);
+               __free_pages(virt_to_page(t->ptr), get_order(length));
                t->ptr = NULL;
 
                mt76_put_rxwi(&dev->mt76, t);
@@ -592,38 +598,47 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
 static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
 {
        struct mtk_rxbm_desc *desc = wed->rx_buf_ring.desc;
-       struct mt76_txwi_cache *t = NULL;
        struct mt7915_dev *dev;
-       struct mt76_queue *q;
-       int i, len;
+       u32 length;
+       int i;
 
        dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-       q = &dev->mt76.q_rx[MT_RXQ_MAIN];
-       len = SKB_WITH_OVERHEAD(q->buf_size);
+       length = SKB_DATA_ALIGN(NET_SKB_PAD + wed->wlan.rx_size +
+                               sizeof(struct skb_shared_info));
 
        for (i = 0; i < size; i++) {
-               enum dma_data_direction dir;
-               dma_addr_t addr;
-               u32 offset;
+               struct mt76_txwi_cache *t = mt76_get_rxwi(&dev->mt76);
+               dma_addr_t phy_addr;
+               struct page *page;
                int token;
-               void *buf;
+               void *ptr;
 
-               t = mt76_get_rxwi(&dev->mt76);
                if (!t)
                        goto unmap;
 
-               buf = mt76_get_page_pool_buf(q, &offset, q->buf_size);
-               if (!buf)
+               page = __dev_alloc_pages(GFP_KERNEL, get_order(length));
+               if (!page) {
+                       mt76_put_rxwi(&dev->mt76, t);
                        goto unmap;
+               }
 
-               addr = page_pool_get_dma_addr(virt_to_head_page(buf)) + offset;
-               dir = page_pool_get_dma_dir(q->page_pool);
-               dma_sync_single_for_device(dev->mt76.dma_dev, addr, len, dir);
+               ptr = page_address(page);
+               phy_addr = dma_map_single(dev->mt76.dma_dev, ptr,
+                                         wed->wlan.rx_size,
+                                         DMA_TO_DEVICE);
+               if (unlikely(dma_mapping_error(dev->mt76.dev, phy_addr))) {
+                       __free_pages(page, get_order(length));
+                       mt76_put_rxwi(&dev->mt76, t);
+                       goto unmap;
+               }
 
-               desc->buf0 = cpu_to_le32(addr);
-               token = mt76_rx_token_consume(&dev->mt76, buf, t, addr);
+               desc->buf0 = cpu_to_le32(phy_addr);
+               token = mt76_rx_token_consume(&dev->mt76, ptr, t, phy_addr);
                if (token < 0) {
-                       mt76_put_page_pool_buf(buf, false);
+                       dma_unmap_single(dev->mt76.dma_dev, phy_addr,
+                                        wed->wlan.rx_size, DMA_TO_DEVICE);
+                       __free_pages(page, get_order(length));
+                       mt76_put_rxwi(&dev->mt76, t);
                        goto unmap;
                }
 
@@ -635,8 +650,6 @@ static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
        return 0;
 
 unmap:
-       if (t)
-               mt76_put_rxwi(&dev->mt76, t);
        mt7915_mmio_wed_release_rx_buf(wed);
        return -ENOMEM;
 }
diff --git a/mt7921/main.c b/mt7921/main.c
index 87067ac3..022cd348 100644
--- a/mt7921/main.c
+++ b/mt7921/main.c
@@ -1087,34 +1087,17 @@ static void
 mt7921_get_et_strings(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                      u32 sset, u8 *data)
 {
-       struct mt7921_dev *dev = mt7921_hw_dev(hw);
-
        if (sset != ETH_SS_STATS)
                return;
 
        memcpy(data, *mt7921_gstrings_stats, sizeof(mt7921_gstrings_stats));
-
-       if (mt76_is_sdio(&dev->mt76))
-               return;
-
-       data += sizeof(mt7921_gstrings_stats);
-       page_pool_ethtool_stats_get_strings(data);
 }
 
 static int
 mt7921_get_et_sset_count(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                         int sset)
 {
-       struct mt7921_dev *dev = mt7921_hw_dev(hw);
-
-       if (sset != ETH_SS_STATS)
-               return 0;
-
-       if (mt76_is_sdio(&dev->mt76))
-               return ARRAY_SIZE(mt7921_gstrings_stats);
-
-       return ARRAY_SIZE(mt7921_gstrings_stats) +
-              page_pool_ethtool_stats_get_count();
+       return sset == ETH_SS_STATS ? ARRAY_SIZE(mt7921_gstrings_stats) : 0;
 }
 
 static void
@@ -1134,7 +1117,6 @@ void mt7921_get_et_stats(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                         struct ethtool_stats *stats, u64 *data)
 {
        struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
-       int stats_size = ARRAY_SIZE(mt7921_gstrings_stats);
        struct mt7921_phy *phy = mt7921_hw_phy(hw);
        struct mt7921_dev *dev = phy->dev;
        struct mt76_mib_stats *mib = &phy->mib;
@@ -1190,14 +1172,9 @@ void mt7921_get_et_stats(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                return;
 
        ei += wi.worker_stat_count;
-
-       if (!mt76_is_sdio(&dev->mt76)) {
-               mt76_ethtool_page_pool_stats(&dev->mt76, &data[ei], &ei);
-               stats_size += page_pool_ethtool_stats_get_count();
-       }
-
-       if (ei != stats_size)
-               dev_err(dev->mt76.dev, "ei: %d  SSTATS_LEN: %d", ei, stats_size);
+       if (ei != ARRAY_SIZE(mt7921_gstrings_stats))
+               dev_err(dev->mt76.dev, "ei: %d  SSTATS_LEN: %zu",
+                       ei, ARRAY_SIZE(mt7921_gstrings_stats));
 }
 
 static u64
diff --git a/usb.c b/usb.c
index 5e5c7bf5..3e281715 100644
--- a/usb.c
+++ b/usb.c
@@ -319,27 +319,29 @@ mt76u_set_endpoints(struct usb_interface *intf,
 
 static int
 mt76u_fill_rx_sg(struct mt76_dev *dev, struct mt76_queue *q, struct urb *urb,
-                int nsgs)
+                int nsgs, gfp_t gfp)
 {
        int i;
 
        for (i = 0; i < nsgs; i++) {
+               struct page *page;
                void *data;
                int offset;
 
-               data = mt76_get_page_pool_buf(q, &offset, q->buf_size);
+               data = page_frag_alloc(&q->rx_page, q->buf_size, gfp);
                if (!data)
                        break;
 
-               sg_set_page(&urb->sg[i], virt_to_head_page(data), q->buf_size,
-                           offset);
+               page = virt_to_head_page(data);
+               offset = data - page_address(page);
+               sg_set_page(&urb->sg[i], page, q->buf_size, offset);
        }
 
        if (i < nsgs) {
                int j;
 
                for (j = nsgs; j < urb->num_sgs; j++)
-                       mt76_put_page_pool_buf(sg_virt(&urb->sg[j]), false);
+                       skb_free_frag(sg_virt(&urb->sg[j]));
                urb->num_sgs = i;
        }
 
@@ -352,16 +354,15 @@ mt76u_fill_rx_sg(struct mt76_dev *dev, struct mt76_queue *q, struct urb *urb,
 
 static int
 mt76u_refill_rx(struct mt76_dev *dev, struct mt76_queue *q,
-               struct urb *urb, int nsgs)
+               struct urb *urb, int nsgs, gfp_t gfp)
 {
        enum mt76_rxq_id qid = q - &dev->q_rx[MT_RXQ_MAIN];
-       int offset;
 
        if (qid == MT_RXQ_MAIN && dev->usb.sg_en)
-               return mt76u_fill_rx_sg(dev, q, urb, nsgs);
+               return mt76u_fill_rx_sg(dev, q, urb, nsgs, gfp);
 
        urb->transfer_buffer_length = q->buf_size;
-       urb->transfer_buffer = mt76_get_page_pool_buf(q, &offset, q->buf_size);
+       urb->transfer_buffer = page_frag_alloc(&q->rx_page, q->buf_size, gfp);
 
        return urb->transfer_buffer ? 0 : -ENOMEM;
 }
@@ -399,7 +400,7 @@ mt76u_rx_urb_alloc(struct mt76_dev *dev, struct mt76_queue *q,
        if (err)
                return err;
 
-       return mt76u_refill_rx(dev, q, e->urb, sg_size);
+       return mt76u_refill_rx(dev, q, e->urb, sg_size, GFP_KERNEL);
 }
 
 static void mt76u_urb_free(struct urb *urb)
@@ -407,10 +408,10 @@ static void mt76u_urb_free(struct urb *urb)
        int i;
 
        for (i = 0; i < urb->num_sgs; i++)
-               mt76_put_page_pool_buf(sg_virt(&urb->sg[i]), false);
+               skb_free_frag(sg_virt(&urb->sg[i]));
 
        if (urb->transfer_buffer)
-               mt76_put_page_pool_buf(urb->transfer_buffer, false);
+               skb_free_frag(urb->transfer_buffer);
 
        usb_free_urb(urb);
 }
@@ -546,8 +547,6 @@ mt76u_process_rx_entry(struct mt76_dev *dev, struct urb *urb,
                len -= data_len;
                nsgs++;
        }
-
-       skb_mark_for_recycle(skb);
        dev->drv->rx_skb(dev, MT_RXQ_MAIN, skb, NULL);
 
        return nsgs;
@@ -613,7 +612,7 @@ mt76u_process_rx_queue(struct mt76_dev *dev, struct mt76_queue *q)
 
                count = mt76u_process_rx_entry(dev, urb, q->buf_size);
                if (count > 0) {
-                       err = mt76u_refill_rx(dev, q, urb, count);
+                       err = mt76u_refill_rx(dev, q, urb, count, GFP_ATOMIC);
                        if (err < 0)
                                break;
                }
@@ -664,10 +663,6 @@ mt76u_alloc_rx_queue(struct mt76_dev *dev, enum mt76_rxq_id qid)
        struct mt76_queue *q = &dev->q_rx[qid];
        int i, err;
 
-       err = mt76_create_page_pool(dev, q);
-       if (err)
-               return err;
-
        spin_lock_init(&q->lock);
        q->entry = devm_kcalloc(dev->dev,
                                MT_NUM_RX_ENTRIES, sizeof(*q->entry),
@@ -696,6 +691,7 @@ EXPORT_SYMBOL_GPL(mt76u_alloc_mcu_queue);
 static void
 mt76u_free_rx_queue(struct mt76_dev *dev, struct mt76_queue *q)
 {
+       struct page *page;
        int i;
 
        for (i = 0; i < q->ndesc; i++) {
@@ -705,8 +701,13 @@ mt76u_free_rx_queue(struct mt76_dev *dev, struct mt76_queue *q)
                mt76u_urb_free(q->entry[i].urb);
                q->entry[i].urb = NULL;
        }
-       page_pool_destroy(q->page_pool);
-       q->page_pool = NULL;
+
+       if (!q->rx_page.va)
+               return;
+
+       page = virt_to_page(q->rx_page.va);
+       __page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
+       memset(&q->rx_page, 0, sizeof(q->rx_page));
 }
 
 static void mt76u_free_rx(struct mt76_dev *dev)