MediaTek 7916 Crash with Linux Kernel

We have observed system crashes with the AW7916-NPD card, which uses the MediaTek MT7916AN and the mt7915e driver.

Although this was observed on Linux and not OpenWRT, we are hoping that with the knowledge and experience that this community has that a solution might be possible.

The test we have conducted is to unload the mt7915e kernel module, and then reload it. We observed a system crash usually within several (fewer than 10) loops of this process.

Included is output from the system logs showing a kernel stack trace around the time of the crash. We have tried several older and newer kernels, including 6.1 and 6.6, and have experienced a crash with each version.

Running the same test on an OpenWRT box shows that it is stable, and does not have this issue.

Additionally, we’ve noted that these issues seem to potentially be related to this one, we’ve encountered some of the same errors, however none of these issues seem to result in a full system crash and reboot.
https://github.com/openwrt/mt76/issues/690
https://github.com/openwrt/mt76/issues/776
https://github.com/openwrt/mt76/issues/852
https://github.com/openwrt/mt76/issues/972

Have others experienced this or similar issues? Please let us know if there is any other information we can provide to help debug this issue.

Linux Information
Kernel: 6.14.5-1.el9.elrepo.x86_64

mt7915e 0000:51:00.0: HW/SW Version: 0x8a108a10, Build Time: 20240823172725a
mt7915e 0000:51:00.0: WM Firmware Version: ____000000, Build Time: 20240823172741
mt7915e 0000:51:00.0: WA Firmware Version: DEV_000000, Build Time: 20240823172837

OpenWRT Information

Linux OpenWrt 6.6.89 #0 SMP Sun May 11 13:26:08 2025 x86_64 GNU/Linux
root@OpenWrt:~# cat /etc/openwrt_release 
DISTRIB_ID='OpenWrt'
DISTRIB_RELEASE='SNAPSHOT'
DISTRIB_REVISION='r29548-2a9316fbfb'
DISTRIB_TARGET='x86/64'
DISTRIB_ARCH='x86_64'
DISTRIB_DESCRIPTION='OpenWrt SNAPSHOT r29548-2a9316fbfb'
DISTRIB_TAINTS=''
root@OpenWrt:~#

Test

while true ; do 
    modprobe -r mt7915e ;
    sleep 5 ; 
    modprobe mt7915e ; 
    sleep 5 ;
done

Kernel Log

May  9 12:16:32 localhost NetworkManager[1135]: <info>  [1746807392.6554] radio killswitch /sys/devices/pci0000:89/0000:89:02.0/0000:8a:00.0/ieee80211/phy6/rfkill6 disappeared
May  9 12:16:32 localhost systemd[1]: Starting Load/Save RF Kill Switch Status...
May  9 12:16:32 localhost systemd[1]: Started Load/Save RF Kill Switch Status.
May  9 12:16:32 localhost gnome-shell[1711]: Removing a network device that was not added
May  9 12:16:32 localhost NetworkManager[1135]: <info>  [1746807392.7234] radio killswitch /sys/devices/pci0000:89/0000:89:02.0/0000:8a:00.0/ieee80211/phy5/rfkill5 disappeared
May  9 12:16:32 localhost kernel: ------------[ cut here ]------------
May  9 12:16:32 localhost kernel: WARNING: CPU: 14 PID: 6888 at net/core/page_pool.c:1152 page_pool_disable_direct_recycling+0x50/0x60
May  9 12:16:32 localhost kernel: Modules linked in: snd_seq_dummy(E) snd_hrtimer(E) snd_seq(E) snd_seq_device(E) snd_timer(E) snd(E) soundcore(E) sunrpc(E) vfat(E) fat(E) iwlmvm(E) mt7915e(E-) mt76_connac_lib(E) mt76(E) intel_rapl_msr(E) intel_rapl_common(E) mac80211(E) intel_uncore_frequency(E) intel_uncore_frequency_common(E) iwlwifi(E) i10nm_edac(E) skx_edac_common(E) nfit(E) libnvdimm(E) libarc4(E) x86_pkg_temp_thermal(E) intel_powerclamp(E) cfg80211(E) iTCO_wdt(E) intel_pmc_bxt(E) ipmi_ssif(E) coretemp(E) iTCO_vendor_support(E) rapl(E) isst_if_mmio(E) intel_cstate(E) isst_if_mbox_pci(E) intel_uncore(E) pcspkr(E) dax_hmem(E) intel_th_gth(E) i2c_i801(E) rfkill(E) isst_if_common(E) mei_me(E) ftdi_sio(E) i2c_mux(E) intel_th_pci(E) i2c_smbus(E) mei(E) intel_vsec(E) intel_th(E) intel_pch_thermal(E) ioatdma(E) acpi_power_meter(E) ipmi_si(E) acpi_ipmi(E) ipmi_devintf(E) ipmi_msghandler(E) acpi_pad(E) joydev(E) dm_mod(E) sd_mod(E) sg(E) xfs(E) ast(E) drm_client_lib(E) drm_shmem_helper(E) drm_kms_helper(E) ahci(E) libahci(E) drm(E) i40e(E)
May  9 12:16:32 localhost kernel: igb(E) nvme(E) libata(E) polyval_clmulni(E) nvme_core(E) polyval_generic(E) ghash_clmulni_intel(E) libie(E) dca(E) i2c_algo_bit(E) fuse(E)
May  9 12:16:32 localhost kernel: CPU: 14 UID: 0 PID: 6888 Comm: modprobe Kdump: loaded Tainted: G            E      6.14.5-1.el9.elrepo.x86_64 #1
May  9 12:16:32 localhost kernel: Tainted: [E]=UNSIGNED_MODULE
May  9 12:16:32 localhost kernel: Hardware name: Supermicro Super Server/X12SPL-F, BIOS 1.9 01/03/2024
May  9 12:16:32 localhost kernel: RIP: 0010:page_pool_disable_direct_recycling+0x50/0x60
May  9 12:16:32 localhost kernel: Code: f8 ff 75 2a 48 c7 c7 e0 10 33 b0 e8 aa 47 24 00 48 c7 43 18 00 00 00 00 5b 48 c7 c7 e0 10 33 b0 e9 f5 30 24 00 c3 cc cc cc cc <0f> 0b eb ce 0f 0b eb d2 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90
May  9 12:16:32 localhost kernel: RSP: 0018:ff54d3c24857fd70 EFLAGS: 00010246
May  9 12:16:32 localhost kernel: RAX: ff31549d05882890 RBX: ff31549d058e8000 RCX: 0000000000000000
May  9 12:16:32 localhost kernel: RDX: 0000000000000000 RSI: ffffffffaf63b4b6 RDI: ff31549d058e8000
May  9 12:16:32 localhost kernel: RBP: ff31549d05882020 R08: 0000000000000000 R09: ff54d3c24857fd57
May  9 12:16:32 localhost kernel: R10: 0000000000000000 R11: 00000000000005ff R12: ff31549d05882a40
May  9 12:16:32 localhost kernel: R13: ff31549d058850e0 R14: ff31549d05882758 R15: ffffffffc11ac9d8
May  9 12:16:32 localhost kernel: FS:  00007f7d3a984740(0000) GS:ff3154abffb00000(0000) knlGS:0000000000000000
May  9 12:16:32 localhost kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
May  9 12:16:32 localhost kernel: CR2: 00007f7d3a0e1ef0 CR3: 0000000125292006 CR4: 0000000000771ef0
May  9 12:16:32 localhost kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
May  9 12:16:32 localhost kernel: DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
May  9 12:16:32 localhost kernel: PKRU: 55555554
May  9 12:16:32 localhost kernel: Call Trace:
May  9 12:16:32 localhost kernel: <TASK>
May  9 12:16:32 localhost kernel: page_pool_destroy+0x41/0x150
May  9 12:16:32 localhost kernel: mt76_dma_cleanup+0x161/0x260 [mt76]
May  9 12:16:32 localhost kernel: mt7915_stop_hardware+0x1e/0x40 [mt7915e]
May  9 12:16:32 localhost kernel: mt7915_unregister_device+0xb6/0xd0 [mt7915e]
May  9 12:16:32 localhost kernel: pci_device_remove+0x3b/0xb0
May  9 12:16:32 localhost kernel: device_release_driver_internal+0x193/0x200
May  9 12:16:32 localhost kernel: driver_detach+0x44/0x90
May  9 12:16:32 localhost kernel: bus_remove_driver+0x69/0xf0
May  9 12:16:32 localhost kernel: pci_unregister_driver+0x2a/0xb0
May  9 12:16:32 localhost kernel: mt7915_exit+0xc/0x9b0 [mt7915e]
May  9 12:16:32 localhost kernel: __do_sys_delete_module.constprop.0+0x176/0x310
May  9 12:16:32 localhost kernel: ? syscall_trace_enter+0xfb/0x1c0
May  9 12:16:32 localhost kernel: do_syscall_64+0x60/0x180
May  9 12:16:32 localhost kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e
May  9 12:16:32 localhost kernel: RIP: 0033:0x7f7d3a10ee2b
May  9 12:16:32 localhost kernel: Code: 73 01 c3 48 8b 0d f5 af 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c5 af 0e 00 f7 d8 64 89 01 48
May  9 12:16:32 localhost kernel: RSP: 002b:00007fff85565968 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
May  9 12:16:32 localhost kernel: RAX: ffffffffffffffda RBX: 000055da8dabfdf0 RCX: 00007f7d3a10ee2b
May  9 12:16:32 localhost kernel: RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055da8dabfe58
May  9 12:16:32 localhost kernel: RBP: 000055da8dabfdf0 R08: 0000000000000000 R09: 0000000000000000
May  9 12:16:32 localhost kernel: R10: 00007f7d3a19eac0 R11: 0000000000000206 R12: 000055da8dabfe58
May  9 12:16:32 localhost kernel: R13: 0000000000000000 R14: 000055da8dabfe58 R15: 00007fff85567c98
May  9 12:16:32 localhost kernel: </TASK>
May  9 12:16:32 localhost kernel: ---[ end trace 0000000000000000 ]---

Description

Contributor guide

First steps

Research direction

Assessment