Re: rtw88: RTL8822BE (10ec:b822) never authenticates on 5 GHz with a Huawei router; poor 2.4 GHz link; same hardware works fine on Windows

[Luka Gejak <luka.gejak@linux.dev>]

Hi Pablo and Bitterblue,

On November 12, 2026 4:50:55 PM GMT+01:00, Bitterblue Smith
<rtl8821cerfe2@gmail.com> wrote:
>On 11/11/2026 23:00, Pablo Martínez Ríos wrote:
>>
>> What would you like me to try next?
>
> I don't have other ideas.

I had a look and I think this could be EDCCA. With the country set to ES,
rtw88 runs the ETSI adaptivity mode. The RTL8822B firmware doesn't do that
part itself, so the driver sets the energy detect threshold in
rtw8822b_adaptivity():

        l2h = min_t(s8, igi, dm_info->l2h_th_ini);
        h2l = l2h - EDCCA_L2H_H2L_DIFF;

l2h_th_ini is 36 for ETSI, so the threshold follows IGI down. Before the
association rtw88 has no station entry yet, so the DIG lets IGI drop to
its 0x1c floor. That gives L2H 28 and H2L 21, nominally -82 and -89 dBm.
As long as the energy on the channel stays above that, the MAC holds every
frame, so the authentication frames may never leave the card.

As far as I can see that fits most of what you measured. On 40 and 80 MHz
the receiver takes in the whole channel, so it likely sees more noise and
more traffic from other networks than on 20 MHz. That would explain why
the AP only ACKed your injected frames on 20 MHz.

Once associated, the DIG raises IGI at a much lower false alarm count, so
the threshold can sit higher. That may be why the link survived the walk
upstairs. To leave LPS the firmware also needs a null frame ACKed by the
AP, so the "firmware failed to leave lps state" messages could come from
the same thing.

Your kernels use the same rule on 2.4 GHz, which might explain the bad
times of day there as well. Josef already relaxed it for 2.4 GHz in
rtw-next with commit b0435910e47d.

The one result that doesn't fit is 00. With 00 the driver uses the normal
threshold, which never goes below 48 (nominally -62 dBm), so I would
expect 00 to work from upstairs. Could you check "iw reg get" right before
you connect, once with 00 and once with ES? After a connection the country
element of your router can switch it to ES.

Could you also try the patch below with ES set? On 5 GHz it uses a fixed
L2H of 45, nominally -65 dBm, which is 3 dB below the EN 301 893 level
over 20 MHz. It also carries Josef's 2.4 GHz change, so it should apply to
your 6.12 sources. If it helps, I will send it properly for rtw-next.

diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822b.c b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
@@ -1565,6 +1565,16 @@ static void rtw8822b_adaptivity(struct rtw_dev *rtwdev)
        if (dm_info->edcca_mode == RTW_EDCCA_NORMAL) {
                l2h = max_t(s8, igi + EDCCA_IGI_L2H_DIFF, EDCCA_TH_L2H_LB);
                h2l = l2h - EDCCA_L2H_H2L_DIFF_NORMAL;
+       } else if (rtwdev->regd.dfs_region == NL80211_DFS_ETSI &&
+                  rtwdev->hal.current_band_type == RTW_BAND_2G) {
+               /* follow the normal threshold, capped for EN 300 328 */
+               l2h = max_t(s8, igi + EDCCA_IGI_L2H_DIFF, EDCCA_TH_L2H_LB);
+               l2h = min_t(s8, l2h, RTW8822B_EDCCA_ETSI_2G);
+               h2l = l2h - EDCCA_L2H_H2L_DIFF;
+       } else if (rtwdev->regd.dfs_region == NL80211_DFS_ETSI &&
+                  rtwdev->hal.current_band_type == RTW_BAND_5G) {
+               l2h = RTW8822B_EDCCA_ETSI_5G;
+               h2l = l2h - EDCCA_L2H_H2L_DIFF;
        } else {
                l2h = min_t(s8, igi, dm_info->l2h_th_ini);
                h2l = l2h - EDCCA_L2H_H2L_DIFF;
diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822b.h b/drivers/net/wireless/realtek/rtw88/rtw8822b.h
--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.h
+++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.h
@@ -149,6 +149,10 @@ _rtw_write32s_mask(struct rtw_dev *rtwdev, u32 addr, u32 mask, u32 data)
 #define GET_PHY_STAT_P1_RXSNR_B(phy_stat)                                      \
        le32_get_bits(*((__le32 *)(phy_stat) + 0x06), GENMASK(15, 8))

+/* nominally -60 dBm: 3 dB below the EN 300 328 level at 20 dBm e.i.r.p. */
+#define RTW8822B_EDCCA_ETSI_2G 50
+/* nominally -65 dBm: 3 dB below the EN 301 893 level over 20 MHz */
+#define RTW8822B_EDCCA_ETSI_5G 45
 #define RTW8822B_EDCCA_MAX     0x7f
 #define RTW8822B_EDCCA_SRC_DEF 1
 #define REG_HTSTFWT    0x800

Best regards,
Luka Gejak