[Bug report] rtw89_8852ae: WoWLAN resume fails with "c2h reg timeout" and "failed to resume for wow -110" on s2idle

[Bug report] rtw89_8852ae: WoWLAN resume fails with "c2h reg timeout" and "failed to resume for wow -110" on s2idle

[Shalok Shalom]

Hi,

I am reporting a reproducible failure in the `rtw89` driver for the Realtek RTL8852AE (PCIe) when using Wake-on-WLAN (WoWLAN) with `s2idle` suspend. This does not happen always, but frequently. 
The system fails to resume from suspend when a magic packet is received, and the kernel log shows a firmware communication timeout followed by a failure to swap back to normal firmware.

The failure begins at `rtw89_fw_read_c2h_reg()` (the C2H timeout), which cascades into the AOAC read failure and the firmware swap failure (`-110`). The driver's recovery path has been hardened against a subsequent crash (CVE-2025-21730), but the initial timeout on the PCIe interface during `s2idle` resume is not resolved by any patch I could identify in the current source tree.


Hardware and Software Environment

-   Laptop: Lenovo Yoga 7 Carbon 14ACN6
    
-   Wi-Fi: Realtek RTL8852AE (PCIe)
    
-   Kernel: 7.2.11-zen1-1-zen (Zen branch) and 6.18.57-2 (LTS branch)
    
-   Firmware: rtw8852a_fw-1.bin, version 0.13.36.2
    
-   Sleep state: s2idle (S3 is not exposed by the firmware; confirmed via `cat /sys/power/mem_sleep`)
    
-   WoWLAN trigger: magic-packet only (`iw phy0 wowlan enable magic-packet`)
    
    
    

Steps to Reproduce

1.  Enable WoWLAN: `sudo iw phy0 wowlan enable magic-packet`
    
2.  Suspend: `systemctl suspend`
    
3.  Send a WoL magic packet to the laptop's Wi-Fi MAC address from another device on the same network. (Via OpenWOL from Android)
    
4.  Observe: the laptop does not wake.
    


Output of lspci -nnk

01:00.0 Network controller [0280]: Realtek Semiconductor Co., Ltd. RTL8852AE 802.11ax PCIe Wireless Network Adapter [10ec:8852]
Subsystem: Lenovo Device [17aa:4852]
Kernel driver in use: rtw89_8852ae
Kernel modules: rtw89_8852ae

Actual Behavior

The system fails to resume from `s2idle`. The following `dmesg` sequence is captured after a failed wake attempt:

[ 2359.543559] rtw89_8852ae 0000:01:00.0: c2h reg timeout[ 2359.543563] rtw89_8852ae 0000:01:00.0: wow: failed to get aoac rpt by reg
[ 2359.644802] rtw89_8852ae 0000:01:00.0: wow: failed to get aoac rpt by pkt
[ 2360.305270] rtw89_8852ae 0000:01:00.0: failed to check wow status disabled
[ 2360.305278] rtw89_8852ae 0000:01:00.0: wow: failed to check disable fw ready
[ 2360.305280] rtw89_8852ae 0000:01:00.0: wow: failed to swap to normal fw
[ 2360.305282] rtw89_8852ae 0000:01:00.0: failed to disable wow
[ 2360.305285] rtw89_8852ae 0000:01:00.0: failed to resume for wow -110
[ 2361.916657] rtw89_8852ae 0000:01:00.0: rtw89_hw_scan_offload failed ret -110
[ 2361.921475] rtw89_8852ae 0000:01:00.0: failed to set wakeup event
[ 2361.921483] rtw89_8852ae 0000:01:00.0: failed to suspend for wow -1


Expected Behavior

The system should reliably resume from `s2idle` when a magic packet is received.


Workaround Already Tested (Falsified)

The following have been tried and did not resolve the issue:

-   ASPM/PS module parameters: The following parameters were set and verified as active (`Y`), but the failure persisted:
    `options rtw89_pci disable_clkreq=y disable_aspm_l1=y disable_aspm_l1ss=y`
    `options rtw89_core disable_ps_mode=y`
    
-   `` `disconnect` trigger: The failure occurs even when WoWLAN is configured to wake on `magic-packet` only.  ``
    



Conclusion

The failure appears to be a race condition in the `rtw89` driver's firmware communication layer during the WoWLAN resume path in `s2idle`. 
A related patch for USB devices (`rtw89_fw_read_c2h_reg` timeout) exists, but it is explicitly scoped to USB transport (RTL8851BU) and does not apply to this PCIe device.


ShalokShalom

RE: [Bug report] rtw89_8852ae: WoWLAN resume fails with "c2h reg timeout" and "failed to resume for wow -110" on s2idle

[Ping-Ke Shih]

Shalok Shalom <shalokshalom@protonmail.ch> wrote:
> Hi,
> 
> I am reporting a reproducible failure in the `rtw89` driver for the Realtek RTL8852AE (PCIe) when using
> Wake-on-WLAN (WoWLAN) with `s2idle` suspend. This does not happen always, but frequently.
> The system fails to resume from suspend when a magic packet is received, and the kernel log shows a
> firmware communication timeout followed by a failure to swap back to normal firmware.
> 
> The failure begins at `rtw89_fw_read_c2h_reg()` (the C2H timeout), which cascades into the AOAC read
> failure and the firmware swap failure (`-110`). The driver's recovery path has been hardened against
> a subsequent crash (CVE-2025-21730), but the initial timeout on the PCIe interface during `s2idle` resume
> is not resolved by any patch I could identify in the current source tree.
> 
> 
> Hardware and Software Environment
> 
> -   Laptop: Lenovo Yoga 7 Carbon 14ACN6
> 
> -   Wi-Fi: Realtek RTL8852AE (PCIe)
> 
> -   Kernel: 7.2.11-zen1-1-zen (Zen branch) and 6.18.57-2 (LTS branch)
> 
> -   Firmware: rtw8852a_fw-1.bin, version 0.13.36.2
> 
> -   Sleep state: s2idle (S3 is not exposed by the firmware; confirmed via `cat /sys/power/mem_sleep`)
> 
> -   WoWLAN trigger: magic-packet only (`iw phy0 wowlan enable magic-packet`)
> 
> 
> 
> 
> Steps to Reproduce
> 
> 1.  Enable WoWLAN: `sudo iw phy0 wowlan enable magic-packet`

Please try to disable d3cold before entering suspend.

echo 0 > /sys/bus/pci/devices/<device_address>/d3cold_allowed

Use 'lspci' to check the <device_address>.

> 
> 2.  Suspend: `systemctl suspend`
> 
> 3.  Send a WoL magic packet to the laptop's Wi-Fi MAC address from another device on the same network.
> (Via OpenWOL from Android)
> 
> 4.  Observe: the laptop does not wake.
> 
> 
> 
> Output of lspci -nnk
> 
> 01:00.0 Network controller [0280]: Realtek Semiconductor Co., Ltd. RTL8852AE 802.11ax PCIe Wireless
> Network Adapter [10ec:8852]
> Subsystem: Lenovo Device [17aa:4852]
> Kernel driver in use: rtw89_8852ae
> Kernel modules: rtw89_8852ae
> 
> Actual Behavior
> 
> The system fails to resume from `s2idle`. The following `dmesg` sequence is captured after a failed
> wake attempt:
> 
> [ 2359.543559] rtw89_8852ae 0000:01:00.0: c2h reg timeout[ 2359.543563] rtw89_8852ae 0000:01:00.0: wow:
> failed to get aoac rpt by reg
> [ 2359.644802] rtw89_8852ae 0000:01:00.0: wow: failed to get aoac rpt by pkt
> [ 2360.305270] rtw89_8852ae 0000:01:00.0: failed to check wow status disabled
> [ 2360.305278] rtw89_8852ae 0000:01:00.0: wow: failed to check disable fw ready
> [ 2360.305280] rtw89_8852ae 0000:01:00.0: wow: failed to swap to normal fw
> [ 2360.305282] rtw89_8852ae 0000:01:00.0: failed to disable wow
> [ 2360.305285] rtw89_8852ae 0000:01:00.0: failed to resume for wow -110
> [ 2361.916657] rtw89_8852ae 0000:01:00.0: rtw89_hw_scan_offload failed ret -110
> [ 2361.921475] rtw89_8852ae 0000:01:00.0: failed to set wakeup event
> [ 2361.921483] rtw89_8852ae 0000:01:00.0: failed to suspend for wow -1

Since you didn't share the log before these errors, I just guess the device got lost
from d3cold resume. Please try the command above.