wifi: rtw89: rtw8922ae: HWSI bus lockup during RF recalibration on AP bandwidth change

["Jeffrey Wälti" <jeffrey@waelti.dev>]

Hi,
 
I am experiencing a reproducible HWSI bus lockup on the RTL8922AE
(rtw89_8922ae) triggered by the connected AP changing its advertised
bandwidth in a beacon. During the lockup, the radio is unresponsive and the only fix I could find is reconnecting to the network.
 
The issue occurs on every boot within seconds of association, and also during normal operation whenever the AP re-advertises its
channel width.
 
I have tested with both the in-tree driver on kernel 6.19 and the
latest out-of-tree driver from morrownr/rtw89 (git HEAD). Both
reproduce the issue identically.

User-visible impact
-------------------
 
During the HWSI busy window, all network traffic basically stops. Existing TCP connections stall and time-sensitive applications (VoIP, video calls) break. The Wi-Fi/BT coexistence is also disrupted, causing paired Bluetooth devices to disconnect.
 
The issue reproduces on every association and also during
runtime when the AP periodically re-advertises its bandwidth (sometimes every few minutes), making connectivity unreliable.

Boot-to-bug dmesg (trimmed to relevant entries)
------------------------------------------------

[   17.659262] rtw89_8922ae 0000:03:00.0: loaded firmware rtw89/rtw8922a_fw-4.bin
[   17.659440] rtw89_8922ae 0000:03:00.0: enabling device (0000 -> 0003)
[   17.666964] rtw89_8922ae 0000:03:00.0: Firmware version 0.35.80.3 (8ef4f0cf), cmd version 1, type 1
[   17.666968] rtw89_8922ae 0000:03:00.0: Firmware version 0.35.80.3 (8ef4f0cf), cmd version 1, type 3
[   17.685115] rtw89_8922ae 0000:03:00.0: chip rfe_type is 1
[   17.685886] input: HD-Audio Generic Mic as /devices/pci0000:00/0000:00:08.1/0000:04:00.6/sound/card1/input24
[   17.685913] input: HD-Audio Generic Headphone as /devices/pci0000:00/0000:00:08.1/0000:04:00.6/sound/card1/input25
[   17.687499] rtw89_8922ae 0000:03:00.0: Firmware version 0.1.0.0 (7b393818), cmd version 0, type 64
[   17.687504] rtw89_8922ae 0000:03:00.0: Firmware element BB version: 00 49 00 00
[   17.687511] rtw89_8922ae 0000:03:00.0: Firmware element radio A version: 00 33 00 00
[   17.687516] rtw89_8922ae 0000:03:00.0: Firmware element NCTL version: 00 0f 00 00
[   17.687536] rtw89_8922ae 0000:03:00.0: Firmware element TXPWR version: 00 46 00 00
[   17.687537] rtw89_8922ae 0000:03:00.0: Firmware element TXPWR version: 00 46 00 00
[   17.687538] rtw89_8922ae 0000:03:00.0: Firmware element TXPWR version: 00 46 00 00
[   17.687546] rtw89_8922ae 0000:03:00.0: Firmware element PWR_TRK version: 00 33 00 00
[   17.687550] rtw89_8922ae 0000:03:00.0: Firmware element REGD version: 00 49 00 08
[   17.691873] rtw89_8922ae 0000:03:00.0: rfkill hardware state changed to enable
[   18.108033] systemd-journald[808]: Received client request to flush runtime journal.
[   18.367229] input: keyd virtual keyboard as /devices/virtual/input/input26
[   18.383013] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[   18.383017] Bluetooth: BNEP filters: protocol multicast
[   18.383021] Bluetooth: BNEP socket layer initialized
[   18.410929] input: keyd virtual pointer as /devices/virtual/input/input27
[   18.464298] Bluetooth: hci0: RTL: fw version 0x41c0c905
[   18.647322] Bluetooth: hci0: AOSP extensions version v1.00
[   18.647546] Bluetooth: MGMT ver 1.23
[   18.655814] NET: Registered PF_ALG protocol family
[   21.985205] wlan0: authenticate with 7c:10:c9:b5:b4:4c (local address=7c:fa:80:c3:5b:f9)
[   21.985210] wlan0: send auth to 7c:10:c9:b5:b4:4c (try 1/3)
[   22.001200] wlan0: authenticate with 7c:10:c9:b5:b4:4c (local address=7c:fa:80:c3:5b:f9)
[   22.001210] wlan0: send auth to 7c:10:c9:b5:b4:4c (try 1/3)
[   22.002893] wlan0: authenticated
[   22.003792] wlan0: associate with 7c:10:c9:b5:b4:4c (try 1/3)
[   22.005327] wlan0: RX AssocResp from 7c:10:c9:b5:b4:4c (capab=0x1011 status=0 aid=17)
[   22.111182] wlan0: associated
[   22.111255] wlan0: Ignore NSS change to invalid 4 in VHT opmode notif from 7c:10:c9:b5:b4:4c
[   22.111263] wlan0: Limiting TX power to 23 (23 - 0) dBm as advertised by 7c:10:c9:b5:b4:4c
[   32.623170] hid-sensor-hub 0020:1022:0001.0004: hidraw3: SENSOR HUB HID v0.00 Device [hid-amdsfh 1022:0001] on pcie_mp2_amd
[   33.076564] wlan0: AP 7c:10:c9:b5:b4:4c changed bandwidth in beacon, new used config is 5220.000 MHz, width 5 (5250.000/0 MHz)
[   33.090085] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
[   33.102460] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI is busy
[   33.114775] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
[   33.127371] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI is busy
[   33.141826] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
[   33.153783] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
[   33.165901] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
[   33.178402] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI is busy
[   33.191675] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI is busy
[   33.205185] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
[   33.217544] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI is busy
[   33.229788] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
[   33.242802] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI is busy
[   33.257200] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
[   33.269858] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI is busy
[   33.282153] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
[   33.295625] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI is busy
[   33.307822] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
[   33.320258] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI is busy
[   33.332693] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
[   33.345004] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI is busy
[   33.360051] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
[   33.373084] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
[   33.385703] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
[   33.397827] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI is busy
[   33.411372] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI is busy
[   33.426744] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
[   33.438969] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI is busy
[   33.451407] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
[   33.464456] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI is busy
[   33.477296] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
[   33.489589] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI is busy
[   33.502064] rtw89_8922ae 0000:03:00.0: poll HWSI is busy
[   33.514235] rtw89_8922ae 0000:03:00.0: [rtw89_phy_write_full_rf_v2_a] HWSI is busy
[   33.514249] wlan0: Ignore NSS change to invalid 4 in VHT opmode notif from 7c:10:c9:b5:b4:4c
[   34.491697] rfkill: input handler disabled
[   34.778186] Bluetooth: RFCOMM TTY layer initialized
[   34.778198] Bluetooth: RFCOMM socket layer initialized
[   34.778201] Bluetooth: RFCOMM ver 1.11
[   39.723603] rfkill: input handler enabled
[   40.871391] rfkill: input handler disabled
[   41.010414] nvme nvme0: using unchecked data buffer
[   43.272141] warning: `ThreadPoolForeg' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211

Environment
-----------

Linux version 6.19.9-1-cachyos (linux-cachyos@cachyos) (clang version 22.1.1, LLD 22.1.1) #1 SMP PREEMPT_DYNAMIC Thu, 19 Mar 2026 20:13:27 +0000

03:00.0 Network controller [0280]: Realtek Semiconductor Co., Ltd. RTL8922AE 802.11be PCIe Wireless Network Adapter [10ec:8922] (rev 01)
	Subsystem: Lenovo Device [17aa:4922]
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 112
	IOMMU group: 15
	Region 0: I/O ports at 2000 [size=256]
	Region 2: Memory at 80b00000 (64-bit, non-prefetchable) [size=1M]
	Capabilities: <access denied>
	Kernel driver in use: rtw89_8922ae
	Kernel modules: rtw89_8922ae

rtw89_8922ae           12288  0
rtw89_8922a            77824  1 rtw89_8922ae
rtw89_pci             131072  1 rtw89_8922ae
rtw89_core           1236992  2 rtw89_8922a,rtw89_pci
mac80211             1806336  2 rtw89_core,rtw89_pci
cfg80211             1523712  3 rtw89_core,rtw89_8922a,mac80211
rfkill                 45056  9 rtw89_core,bluetooth,ideapad_laptop,cfg80211

Hardware:    Lenovo Yoga 7 2-in-1 14AKP10 (machine type 83JR)
Chip:        RTL8922AE (PCI ID 10ec:8922)
Firmware:    rtw89/rtw8922a_fw-4.bin, version 0.35.80.3 (8ef4f0cf)
RFE type:    1

I am happy to provide additional debugging information, test patches, or collect further traces if needed.
 
Thanks,
Jeffrey Wälti