Re: [BUG] wifi: rtw88: Hard system freeze on RTL8821CE when power_save is enabled (LPS/ASPM conflict)

[Bitterblue Smith <rtl8821cerfe2@gmail.com>]

On 28/03/2026 15:40, LB F wrote:
> Hi Bitterblue,
> 
> Thank you for the quick feedback. Full dmesg from the current boot
> session is attached (dmesg_boot0_clean.txt, 332K, 3349 lines).
> 
> It contains all 76 "unused phy status page" events with both hex
> dumps (4-byte grouped and byte-level) in full, plus all surrounding
> kernel context.
> 
> The interesting observation you made about the MAC addresses being
> 24 bytes lower than expected is very helpful — I hadn't noticed the
> offset discrepancy. If you need the adapter and AP MAC addresses
> for reference:
> 
>   Adapter: 8c:c8:4b:68:d1:63
>   AP:      6c:68:a4:1c:97:5b
> 
> And yes, adding a NULL check in rtw_fw_adaptivity_result() seems
> like a good defensive measure regardless of the root cause.
> 
> Let me know if you need anything else or a different format.
> 
> Best regards,
> Oleksandr Havrylov

I made a mistake with the second print_hex_dump. It was supposed to
print from rxdesc + 56. But not to worry, I think this is sufficient.

Some of the frames have what looks like a valid PHY status at byte 24:

[ 9926.365048] cachyos-x8664 kernel: rtw_8821ce 0000:13:00.0: unused phy status page (7)
[ 9926.365451] cachyos-x8664 kernel: 00000000: 05da26ac b587f0af 0aa2e765 f48d78f5  .&......e....x..
[ 9926.365475] cachyos-x8664 kernel: 00000010: 3ffe9e00 49d11a5c 00002701 012a0000  ...?\..I.'....*.
[ 9926.365496] cachyos-x8664 kernel: 00000020: 00000014 20000000 000000e2 0000000a  ....... ........
[ 9926.365537] cachyos-x8664 kernel: 00000030: 0000001c 00000000                    ........

But RTW_RX_DESC_W0_SHIFT is not 0. Then rtw88 looks for the PHY
status in the wrong place, in this case at byte 25. The official
driver always looks for it at byte 24:

https://github.com/lwfinger/rtw88/blob/master/alt_rtl8821ce/hal/rtl8821c/pci/rtl8821ce_recv.c#L272

Unfortunately fixing that won't be enough.

The way rtw88 configures the chip, RTW_RX_DESC_W0_DRV_INFO_SIZE is
supposed to be either 0 or 4, but in these frames it has many other
values.

In this case:

[ 9986.214022] cachyos-x8664 kernel: rtw_8821ce 0000:13:00.0: unused phy status page (2)
[ 9986.214512] cachyos-x8664 kernel: 00000000: 95515588 50ad66d1 893f252f 77ef35ae  .UQ..f.P/%?..5.w
[ 9986.214544] cachyos-x8664 kernel: 00000010: 3ffe1e00 4d626889 00404288 684bc88c  ...?.hbM.B@...Kh
[ 9986.214572] cachyos-x8664 kernel: 00000020: 686c63d1 5b971ca4 1ca4686c 73205a97  .clh...[lh...Z s
[ 9986.214599] cachyos-x8664 kernel: 00000030: 4a670000 000b2000                    ..gJ. ..

the 802.11 header immediately follows the RX descriptor (there is
no PHY status, which is not unusual) but RTW_RX_DESC_W0_PHYST is 1.

In station mode RTW_RX_DESC_W1_MACID is supposed to be 0 or 1 (I think),
mostly 0. In these frames it has many other values.

RTW_RX_DESC_W0_PKT_LEN sometimes exceeds 11454. In one case it's 0.

In many of these frames bytes 25..31 don't look like a PHY status
or 802.11 header.

If we can't find the reason for these weird frames, maybe the best
way to filter them out is to check RTW_RX_DESC_W0_DRV_INFO_SIZE.
It takes care of 67 out of the 76 weird frames in dmesg_boot0_clean.txt.