RE: [BUG] wifi: rtw88: Hard system freeze on RTL8821CE when power_save is enabled (LPS/ASPM conflict)

[Ping-Ke Shih <pkshih@realtek.com>]

Bitterblue Smith <rtl8821cerfe2@gmail.com> wrote:
> 
> On 28/03/2026 15:40, LB F wrote:
> > Hi Bitterblue,
> >
> > Thank you for the quick feedback. Full dmesg from the current boot
> > session is attached (dmesg_boot0_clean.txt, 332K, 3349 lines).
> >
> > It contains all 76 "unused phy status page" events with both hex
> > dumps (4-byte grouped and byte-level) in full, plus all surrounding
> > kernel context.
> >
> > The interesting observation you made about the MAC addresses being
> > 24 bytes lower than expected is very helpful — I hadn't noticed the
> > offset discrepancy. If you need the adapter and AP MAC addresses
> > for reference:
> >
> >   Adapter: 8c:c8:4b:68:d1:63
> >   AP:      6c:68:a4:1c:97:5b
> >
> > And yes, adding a NULL check in rtw_fw_adaptivity_result() seems
> > like a good defensive measure regardless of the root cause.
> >
> > Let me know if you need anything else or a different format.
> >
> > Best regards,
> > Oleksandr Havrylov
> 
> I made a mistake with the second print_hex_dump. It was supposed to
> print from rxdesc + 56. But not to worry, I think this is sufficient.
> 
> Some of the frames have what looks like a valid PHY status at byte 24:
> 
> [ 9926.365048] cachyos-x8664 kernel: rtw_8821ce 0000:13:00.0: unused phy status
> page (7)
> [ 9926.365451] cachyos-x8664 kernel: 00000000: 05da26ac b587f0af 0aa2e765
> f48d78f5  .&......e....x..
> [ 9926.365475] cachyos-x8664 kernel: 00000010: 3ffe9e00 49d11a5c 00002701
> 012a0000  ...?\..I.'....*.
> [ 9926.365496] cachyos-x8664 kernel: 00000020: 00000014 20000000 000000e2
> 0000000a  ....... ........
> [ 9926.365537] cachyos-x8664 kernel: 00000030: 0000001c
> 00000000                    ........
> 
> But RTW_RX_DESC_W0_SHIFT is not 0. Then rtw88 looks for the PHY
> status in the wrong place, in this case at byte 25. The official
> driver always looks for it at byte 24:
> 
> https://github.com/lwfinger/rtw88/blob/master/alt_rtl8821ce/hal/rtl8821c/pci
> /rtl8821ce_recv.c#L272
> 
> Unfortunately fixing that won't be enough.
> 
> The way rtw88 configures the chip, RTW_RX_DESC_W0_DRV_INFO_SIZE is
> supposed to be either 0 or 4, but in these frames it has many other
> values.
> 
> In this case:
> 
> [ 9986.214022] cachyos-x8664 kernel: rtw_8821ce 0000:13:00.0: unused phy status
> page (2)
> [ 9986.214512] cachyos-x8664 kernel: 00000000: 95515588 50ad66d1 893f252f
> 77ef35ae  .UQ..f.P/%?..5.w
> [ 9986.214544] cachyos-x8664 kernel: 00000010: 3ffe1e00 4d626889 00404288
> 684bc88c  ...?.hbM.B@...Kh
> [ 9986.214572] cachyos-x8664 kernel: 00000020: 686c63d1 5b971ca4 1ca4686c
> 73205a97  .clh...[lh...Z s
> [ 9986.214599] cachyos-x8664 kernel: 00000030: 4a670000
> 000b2000                    ..gJ. ..
> 
> the 802.11 header immediately follows the RX descriptor (there is
> no PHY status, which is not unusual) but RTW_RX_DESC_W0_PHYST is 1.
> 
> In station mode RTW_RX_DESC_W1_MACID is supposed to be 0 or 1 (I think),
> mostly 0. In these frames it has many other values.
> 
> RTW_RX_DESC_W0_PKT_LEN sometimes exceeds 11454. In one case it's 0.
> 
> In many of these frames bytes 25..31 don't look like a PHY status
> or 802.11 header.
> 
> If we can't find the reason for these weird frames, maybe the best
> way to filter them out is to check RTW_RX_DESC_W0_DRV_INFO_SIZE.
> It takes care of 67 out of the 76 weird frames in dmesg_boot0_clean.txt.


Agree. It looks like we need more validations to drop weird frames.

I have never seen lots of this kind of weird frames before.
Oleksandr, is it possible to sum up the conditions these weird frames
happened? such as enter LPS? with BT devices? or something else. 

Ping-Ke