mt7915_mac_sta_poll() performs direct MMIO reads of WTBL entries for airtime accounting, GI reporting, and RSSI. It is called from mt7915_mac_tx_free_done(), which runs in NAPI context on every TX-Free-Done event. The high-frequency WTBL access races with firmware WTBL operations, causing kernel warnings and panics at mt7915_mac_wtbl_lmac_addr, followed by MCU message timeouts and firmware communication breakdown. Move mt7915_mac_sta_poll() into mt7915_mac_work() at the periodic 5th tick, under the device mutex. This reduces the access frequency from thousands of times per second to once every ~5 seconds, serializes it with other driver operations, and eliminates the NAPI-context WTBL access that triggers the race. Vendor driver analysis (mt_wifi.ko from MT7981 firmware) confirms the vendor's TX-free handler (red_tx_free_handle) performs no WTBL reads or station polling. Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets") Link: https://github.com/openwrt/mt76/issues/1067 Signed-off-by: Joshua Klinesmith --- drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c index 34a0690c5864..2f307c4caff1 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c @@ -864,8 +864,6 @@ mt7915_mac_tx_free_done(struct mt7915_dev *dev, { struct sk_buff *skb, *tmp; - mt7915_mac_sta_poll(dev); - if (wake) mt76_set_tx_blocked(&dev->mt76, false); @@ -2012,6 +2010,7 @@ void mt7915_mac_work(struct work_struct *work) if (++mphy->mac_work_count == 5) { mphy->mac_work_count = 0; + mt7915_mac_sta_poll(phy->dev); mt7915_mac_update_stats(phy); mt7915_mac_severe_check(phy); -- 2.43.0