RE: wifi: rtw89: rtw8922ae: HWSI bus lockup during RF recalibration on AP bandwidth change

[Ping-Ke Shih <pkshih@realtek.com>]

Jeffrey Wälti <jeffrey@waelti.dev> wrote:
> Hi,
> 
> I am experiencing a reproducible HWSI bus lockup on the RTL8922AE
> (rtw89_8922ae) triggered by the connected AP changing its advertised
> bandwidth in a beacon. During the lockup, the radio is unresponsive and the only
> fix I could find is reconnecting to the network.
> 
> The issue occurs on every boot within seconds of association, and also during
> normal operation whenever the AP re-advertises its
> channel width.
> 
> I have tested with both the in-tree driver on kernel 6.19 and the
> latest out-of-tree driver from morrownr/rtw89 (git HEAD). Both
> reproduce the issue identically.

Please try to disable power save and ASPM by
1) iw wlan0 set power_save off
2) reference and install https://github.com/lwfinger/rtw89/blob/main/70-rtw89.conf 
   and then cold reboot.

> 
> User-visible impact
> -------------------
> 
> During the HWSI busy window, all network traffic basically stops. Existing TCP
> connections stall and time-sensitive applications (VoIP, video calls) break. The
> Wi-Fi/BT coexistence is also disrupted, causing paired Bluetooth devices to
> disconnect.
> 
> The issue reproduces on every association and also during
> runtime when the AP periodically re-advertises its bandwidth (sometimes every
> few minutes), making connectivity unreliable.
> 
> Boot-to-bug dmesg (trimmed to relevant entries)
> ------------------------------------------------
> 
> [   17.659262] rtw89_8922ae 0000:03:00.0: loaded firmware
> rtw89/rtw8922a_fw-4.bin
> [   17.659440] rtw89_8922ae 0000:03:00.0: enabling device (0000 -> 0003)
> [   17.666964] rtw89_8922ae 0000:03:00.0: Firmware version 0.35.80.3 (8ef4f0cf),
> cmd version 1, type 1
> [   17.666968] rtw89_8922ae 0000:03:00.0: Firmware version 0.35.80.3 (8ef4f0cf),
> cmd version 1, type 3
> [   17.685115] rtw89_8922ae 0000:03:00.0: chip rfe_type is 1
> [   17.685886] input: HD-Audio Generic Mic as
> /devices/pci0000:00/0000:00:08.1/0000:04:00.6/sound/card1/input24
> [   17.685913] input: HD-Audio Generic Headphone as
> /devices/pci0000:00/0000:00:08.1/0000:04:00.6/sound/card1/input25
> [   17.687499] rtw89_8922ae 0000:03:00.0: Firmware version 0.1.0.0 (7b393818),
> cmd version 0, type 64
> [   17.687504] rtw89_8922ae 0000:03:00.0: Firmware element BB version: 00 49 00
> 00
> [   17.687511] rtw89_8922ae 0000:03:00.0: Firmware element radio A version: 00
> 33 00 00
> [   17.687516] rtw89_8922ae 0000:03:00.0: Firmware element NCTL version: 00 0f
> 00 00
> [   17.687536] rtw89_8922ae 0000:03:00.0: Firmware element TXPWR version: 00 46
> 00 00
> [   17.687537] rtw89_8922ae 0000:03:00.0: Firmware element TXPWR version: 00 46
> 00 00
> [   17.687538] rtw89_8922ae 0000:03:00.0: Firmware element TXPWR version: 00 46
> 00 00
> [   17.687546] rtw89_8922ae 0000:03:00.0: Firmware element PWR_TRK version: 00
> 33 00 00
> [   17.687550] rtw89_8922ae 0000:03:00.0: Firmware element REGD version: 00 49
> 00 08
> [   17.691873] rtw89_8922ae 0000:03:00.0: rfkill hardware state changed to
> enable
> [   18.108033] systemd-journald[808]: Received client request to flush runtime
> journal.
> [   18.367229] input: keyd virtual keyboard as /devices/virtual/input/input26
> [   18.383013] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
> [   18.383017] Bluetooth: BNEP filters: protocol multicast
> [   18.383021] Bluetooth: BNEP socket layer initialized
> [   18.410929] input: keyd virtual pointer as /devices/virtual/input/input27
> [   18.464298] Bluetooth: hci0: RTL: fw version 0x41c0c905
> [   18.647322] Bluetooth: hci0: AOSP extensions version v1.00
> [   18.647546] Bluetooth: MGMT ver 1.23
> [   18.655814] NET: Registered PF_ALG protocol family
> [   21.985205] wlan0: authenticate with 7c:10:c9:b5:b4:4c (local
> address=7c:fa:80:c3:5b:f9)
> [   21.985210] wlan0: send auth to 7c:10:c9:b5:b4:4c (try 1/3)
> [   22.001200] wlan0: authenticate with 7c:10:c9:b5:b4:4c (local
> address=7c:fa:80:c3:5b:f9)
> [   22.001210] wlan0: send auth to 7c:10:c9:b5:b4:4c (try 1/3)
> [   22.002893] wlan0: authenticated
> [   22.003792] wlan0: associate with 7c:10:c9:b5:b4:4c (try 1/3)
> [   22.005327] wlan0: RX AssocResp from 7c:10:c9:b5:b4:4c (capab=0x1011
> status=0 aid=17)
> [   22.111182] wlan0: associated
> [   22.111255] wlan0: Ignore NSS change to invalid 4 in VHT opmode notif from
> 7c:10:c9:b5:b4:4c
> [   22.111263] wlan0: Limiting TX power to 23 (23 - 0) dBm as advertised by
> 7c:10:c9:b5:b4:4c
> [   32.623170] hid-sensor-hub 0020:1022:0001.0004: hidraw3: SENSOR HUB HID
> v0.00 Device [hid-amdsfh 1022:0001] on pcie_mp2_amd
> [   33.076564] wlan0: AP 7c:10:c9:b5:b4:4c changed bandwidth in beacon, new used
> config is 5220.000 MHz, width 5 (5250.000/0 MHz)
> [   33.090085] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
> [   33.102460] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI
> is busy
> [   33.114775] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
> [   33.127371] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI
> is busy
> [   33.141826] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
> [   33.153783] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
> [   33.165901] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
> [   33.178402] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI
> is busy
> [   33.191675] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI
> is busy
> [   33.205185] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
> [   33.217544] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI
> is busy
> [   33.229788] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
> [   33.242802] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI
> is busy
> [   33.257200] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
> [   33.269858] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI
> is busy
> [   33.282153] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
> [   33.295625] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI
> is busy
> [   33.307822] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
> [   33.320258] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI
> is busy
> [   33.332693] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
> [   33.345004] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI
> is busy
> [   33.360051] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
> [   33.373084] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
> [   33.385703] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
> [   33.397827] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI
> is busy
> [   33.411372] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI
> is busy
> [   33.426744] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
> [   33.438969] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI
> is busy
> [   33.451407] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
> [   33.464456] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI
> is busy
> [   33.477296] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
> [   33.489589] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI
> is busy
> [   33.502064] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
> [   33.514235] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI
> is busy
> [   33.514249] wlan0: Ignore NSS change to invalid 4 in VHT opmode notif from
> 7c:10:c9:b5:b4:4c
> [   34.491697] rfkill: input handler disabled
> [   34.778186] Bluetooth: RFCOMM TTY layer initialized
> [   34.778198] Bluetooth: RFCOMM socket layer initialized
> [   34.778201] Bluetooth: RFCOMM ver 1.11
> [   39.723603] rfkill: input handler enabled
> [   40.871391] rfkill: input handler disabled
> [   41.010414] nvme nvme0: using unchecked data buffer
> [   43.272141] warning: `ThreadPoolForeg' uses wireless extensions which will
> stop working for Wi-Fi 7 hardware; use nl80211
> 
> Environment
> -----------
> 
> Linux version 6.19.9-1-cachyos (linux-cachyos@cachyos) (clang version 22.1.1,
> LLD 22.1.1) #1 SMP PREEMPT_DYNAMIC Thu, 19 Mar 2026 20:13:27 +0000
> 
> 03:00.0 Network controller [0280]: Realtek Semiconductor Co., Ltd. RTL8922AE
> 802.11be PCIe Wireless Network Adapter [10ec:8922] (rev 01)
>         Subsystem: Lenovo Device [17aa:4922]
>         Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr-
> Stepping- SERR- FastB2B- DisINTx+
>         Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort-
> <MAbort- >SERR- <PERR- INTx-
>         Latency: 0
>         Interrupt: pin A routed to IRQ 112
>         IOMMU group: 15
>         Region 0: I/O ports at 2000 [size=256]
>         Region 2: Memory at 80b00000 (64-bit, non-prefetchable) [size=1M]
>         Capabilities: <access denied>
>         Kernel driver in use: rtw89_8922ae
>         Kernel modules: rtw89_8922ae
> 
> rtw89_8922ae           12288  0
> rtw89_8922a            77824  1 rtw89_8922ae
> rtw89_pci             131072  1 rtw89_8922ae
> rtw89_core           1236992  2 rtw89_8922a,rtw89_pci
> mac80211             1806336  2 rtw89_core,rtw89_pci
> cfg80211             1523712  3 rtw89_core,rtw89_8922a,mac80211
> rfkill                 45056  9 rtw89_core,bluetooth,ideapad_laptop,cfg80211
> 
> Hardware:    Lenovo Yoga 7 2-in-1 14AKP10 (machine type 83JR)
> Chip:        RTL8922AE (PCI ID 10ec:8922)
> Firmware:    rtw89/rtw8922a_fw-4.bin, version 0.35.80.3 (8ef4f0cf)
> RFE type:    1
> 
> I am happy to provide additional debugging information, test patches, or collect
> further traces if needed.

Please help to test the latest kernel 7.0-rc with additional patch [1].

[1] https://lore.kernel.org/linux-wireless/20260310080146.31113-4-pkshih@realtek.com/

Ping-Ke