[PATCH v1] wifi: mt76: mt7925: Fix MCU command timeouts during module unload

[PATCH v1] wifi: mt76: mt7925: Fix MCU command timeouts during module unload

[Eason Lai]

Move MT76_REMOVED flag setting from mt7925_pci_remove() to after
mt76_unregister_device() completes. Setting it too early causes
mt792x_irq_handler() to drop MCU completion interrupts, timing out
teardown commands (scan abort, BSS_INFO_UPDATE, etc).

The flag must still be set before napi_disable() to prevent reset_work
from re-enabling NAPI and causing deadlock. Also guard mt792x_reset()
to skip queuing work when device is removed.

Fixes: 896f4dfd68e1 ("wifi: mt76: mt7925: Fix unregister deadlock")

Signed-off-by: Eason Lai <eason.lai@mediatek.com>
---
 drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 4 ++--
 drivers/net/wireless/mediatek/mt76/mt792x_mac.c | 3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/pci.c b/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
index 02ef09dd797d..93c823eb7501 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
@@ -47,9 +47,10 @@ static void mt7925e_unregister_device(struct mt792x_dev *dev)
 	if (dev->phy.chip_cap & MT792x_CHIP_CAP_WF_RF_PIN_CTRL_EVT_EN)
 		wiphy_rfkill_stop_polling(hw->wiphy);
 
-	cancel_work_sync(&dev->reset_work);
 	cancel_work_sync(&dev->init_work);
 	mt76_unregister_device(&dev->mt76);
+	set_bit(MT76_REMOVED, &dev->mphy.state);
+	cancel_work_sync(&dev->reset_work);
 	mt76_for_each_q_rx(&dev->mt76, i)
 		napi_disable(&dev->mt76.napi[i]);
 	cancel_delayed_work_sync(&pm->ps_work);
@@ -725,7 +726,6 @@ static void mt7925_pci_remove(struct pci_dev *pdev)
 	struct mt76_dev *mdev = pci_get_drvdata(pdev);
 	struct mt792x_dev *dev = container_of(mdev, struct mt792x_dev, mt76);
 
-	set_bit(MT76_REMOVED, &mdev->phy.state);
 	mt7925e_unregister_device(dev);
 	devm_free_irq(&pdev->dev, pdev->irq, dev);
 	mt76_free_device(&dev->mt76);
diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_mac.c b/drivers/net/wireless/mediatek/mt76/mt792x_mac.c
index 888e5a505673..1e20b333cc61 100644
--- a/drivers/net/wireless/mediatek/mt76/mt792x_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt792x_mac.c
@@ -278,6 +278,9 @@ void mt792x_reset(struct mt76_dev *mdev)
 	if (pm->suspended)
 		return;
 
+	if (test_bit(MT76_REMOVED, &mdev->phy.state))
+		return;
+
 	queue_work(dev->mt76.wq, &dev->reset_work);
 }
 EXPORT_SYMBOL_GPL(mt792x_reset);
-- 
2.45.2

Re: [PATCH v1] wifi: mt76: mt7925: Fix MCU command timeouts during module unload

[Devin Wittmayer]

Tested this on an MT7927 here, against a reproduction I built on
2026-08-02 when I hit the same teardown. It fixes it.

mt7925e on 7.1.5, morrownr/mt76 at 217ee83d, which carries the
unregister-deadlock change your Fixes tag names (openwrt 98c13eb564e5).
Each cycle associates WPA2 at 2412 MHz, runs a 1400-byte ICMP flood, and
rmmods with that traffic in flight, RX sampled off statistics/rx_packets
immediately before the unload at 375 to 807 pps across both arms. Both
arms built in the same directory, so only mt7925e and mt792x_lib differ
between them.

  condition              stock                      patched
  associated, 10 cycles  59-60 s, 19 timeouts each  0-1 s, none
  idle, 3 cycles         9-10 s, 3 timeouts each    0 s, none

No warnings or call traces in any window on either arm.

The idle row is worth a line in the commit message: with nothing
associated it still costs 9 to 10 seconds, so a bare rmmod does reach
this, just small enough there to read as normal teardown.

Tested-by: Devin Wittmayer <lucid_duck@justthetip.ca>

Re: [PATCH v1] wifi: mt76: mt7925: Fix MCU command timeouts during module unload

[Eason Lai (賴易聖)]

On Wed, 2026-08-05 at 10:46 -0700, Devin Wittmayer wrote:
> 
> Tested this on an MT7927 here, against a reproduction I built on
> 2026-08-02 when I hit the same teardown. It fixes it.
> 
> mt7925e on 7.1.5, morrownr/mt76 at 217ee83d, which carries the
> unregister-deadlock change your Fixes tag names (openwrt
> 98c13eb564e5).
> Each cycle associates WPA2 at 2412 MHz, runs a 1400-byte ICMP flood,
> and
> rmmods with that traffic in flight, RX sampled off
> statistics/rx_packets
> immediately before the unload at 375 to 807 pps across both arms.
> Both
> arms built in the same directory, so only mt7925e and mt792x_lib
> differ
> between them.
> 
>   condition              stock                      patched
>   associated, 10 cycles  59-60 s, 19 timeouts each  0-1 s, none
>   idle, 3 cycles         9-10 s, 3 timeouts each    0 s, none
> 
> No warnings or call traces in any window on either arm.
> 
> The idle row is worth a line in the commit message: with nothing
> associated it still costs 9 to 10 seconds, so a bare rmmod does reach
> this, just small enough there to read as normal teardown.
> 
> Tested-by: Devin Wittmayer <lucid_duck@justthetip.ca>

I will update the commit message for v2 based on your suggestion.

Thanks,
Eason