From nobody Mon Apr 6 15:50:40 2026 Received: from rtits2.realtek.com.tw (rtits2.realtek.com [211.75.126.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 24ED140DFB2; Thu, 19 Mar 2026 00:49:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=211.75.126.72 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773881389; cv=none; b=lRn+HoqK7N1zZBDRGlLi2Db2f2cLuS9AnPBipjQG80GUVSXNapchaUm/wbIGfZw9/q1wpwrVw8bZcw3sbnp4VMazuygl9fvi1madcIbAvcM4xOxGJxLo5x7vfTvT9HdsELoXpY+tkDkJe2iGIC8CDBpfHE4MhM3TBrekLP2MDoQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773881389; c=relaxed/simple; bh=SBK5K1jKJ4P0dbtMkTr7pHbYswyxwYh0VXbHjyvwiyU=; h=From:To:CC:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:MIME-Version; b=LIgqu4JeyV44ruX2o00HKqKIC8FvO9l2JtWadPlQCCsEBDwDGLJPMeWK+iWBgJ06u6EDGijFzugoapceXNNX+Wj1jMkYSr6SHiRt9tm1aRVtDMfqsFqZphX+z8IfTJPQ7TxFrlWSq0Wl1HiglBV8Mojcu8E6fCSJ3qx9PbKAmJ0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=realtek.com; spf=pass smtp.mailfrom=realtek.com; dkim=pass (2048-bit key) header.d=realtek.com header.i=@realtek.com header.b=HTe03mGZ; arc=none smtp.client-ip=211.75.126.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=realtek.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=realtek.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=realtek.com header.i=@realtek.com header.b="HTe03mGZ" X-SpamFilter-By: ArmorX SpamTrap 5.80 with qID 62J0ngZM32698014, This message is accepted by code: ctloc85258 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=realtek.com; s=dkim; t=1773881383; bh=SBK5K1jKJ4P0dbtMkTr7pHbYswyxwYh0VXbHjyvwiyU=; h=From:To:CC:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:Content-Transfer-Encoding:MIME-Version; b=HTe03mGZKqeVrW9pyBhb4yjOSzvQX7qAP4REMZYuFkQ18pF+08hsrQq4Ph0hh2sT+ ct5wgYLa3HNXhEdCo+h+xSKtlIqYN62xqWltkAnaEYP5iYsd2PtwbK+7MzYZ1p2WNU cl07EO0yNZSoIEHYQUJytCvIrAw4eHiQ2AnbrDkCLaz9LD+KnTrTjJzIe7ZwPzKW6b TnCMXcAzJC1aG3vVqGB0a6EmqlTfw4619deihV6wMvToJu7PGpjtX4oKayHcRw4PN5 4zHRy8QQOvOIZIn6bdLVgIF5yjnPGGn0tQVTisbNv0x6B16i5dw37NoYkYTiD427BP 6/GmTXku59AtQ== Received: from mail.realtek.com (rtkexhmbs02.realtek.com.tw[172.21.6.41]) by rtits2.realtek.com.tw (8.15.2/3.21/5.94) with ESMTPS id 62J0ngZM32698014 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 19 Mar 2026 08:49:42 +0800 Received: from RTKEXHMBS05.realtek.com.tw (10.21.1.55) by RTKEXHMBS02.realtek.com.tw (172.21.6.41) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1748.10; Thu, 19 Mar 2026 08:49:43 +0800 Received: from RTKEXHMBS06.realtek.com.tw (10.21.1.56) by RTKEXHMBS05.realtek.com.tw (10.21.1.55) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1748.10; Thu, 19 Mar 2026 08:49:43 +0800 Received: from RTKEXHMBS06.realtek.com.tw ([fe80::4cbd:6c6c:b92b:3913]) by RTKEXHMBS06.realtek.com.tw ([fe80::4cbd:6c6c:b92b:3913%10]) with mapi id 15.02.1748.010; Thu, 19 Mar 2026 08:49:43 +0800 From: Ping-Ke Shih To: LB F CC: "linux-wireless@vger.kernel.org" , "linux-kernel@vger.kernel.org" Subject: RE: [BUG] wifi: rtw88: Hard system freeze on RTL8821CE when power_save is enabled (LPS/ASPM conflict) Thread-Topic: [BUG] wifi: rtw88: Hard system freeze on RTL8821CE when power_save is enabled (LPS/ASPM conflict) Thread-Index: AQHcsA6WTRRnBRFJhEKVxaR7JwwWq7Wm+M9wgAAbfgCAAX9nAIAAB6mAgAAK64CAAElZAIABMBnAgADMOgCAACdjAIAAB1+AgAJAYICAAB3nAIAAxOYAgAJBRiCAAKEnAIAA2QBQgAD06wCAAJVNMIAA+6oAgAAHnYCAAIx7YA== Date: Thu, 19 Mar 2026 00:49:43 +0000 Message-ID: <0709aa3f3d67430c8392537a489f3d36@realtek.com> References: <1e96af437fa24674b353ddb530b2d8e7@realtek.com> <792645eed36041f0b3df951f1b28a08a@realtek.com> <458ed80e39734ea99610050140bb31ce@realtek.com> <1bd495ffe57c47eb827eec084729afa2@realtek.com> In-Reply-To: Accept-Language: en-US, zh-TW Content-Language: zh-TW Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 LB F wrote: > Hi Ping-Ke, >=20 > I successfully collected the output with your diagnostic printk. >=20 > Here is the exact log entry triggered when the warning fires: >=20 > [ 180.424146] VHT NSS=3D0 pkt_stat->rate=3D0x65 rx_status->band=3D1 > rx_status->rate_idx=3D0 > [ 180.424157] WARNING: net/mac80211/rx.c:5491 at > ieee80211_rx_list+0x177/0x1020 [mac80211] >=20 > Looking at the rtw88 source code, this perfectly explains why `nss` is 0: > 1. The hardware/firmware reports `pkt_stat->rate =3D 0x65` (101 in decima= l). > 2. `rtw_rx_fill_rx_status()` checks if `pkt_stat->rate >=3D > DESC_RATEVHT1SS_MCS0` (which is `0x2c`). Since `0x65 >=3D 0x2c`, it > correctly sets `rx_status->encoding =3D RX_ENC_VHT`. > 3. It then calls `rtw_desc_to_mcsrate(pkt_stat->rate, > &rx_status->rate_idx, &rx_status->nss)`. > 4. Inside `rtw_desc_to_mcsrate()`, the value `0x65` falls completely > outside any known bounds. The highest defined rate in `enum > rtw_trx_desc_rate` is `DESC_RATEVHT4SS_MCS9` (`0x53`). The HT range > (`DESC_RATEMCS0` to `DESC_RATEMCS31`) ends at `0x2b`. > 5. Because `0x65` matches absolutely none of the `if/else` brackets in > `rtw_desc_to_mcsrate()`, the function simply returns without mutating > `mcs` and `nss`. > 6. Since `rx_status` was initialized with `memset(rx_status, 0, ...)` > at the beginning of the function, `rx_status->nss` remains `0`. >=20 > So mac80211 complains because the rtw88 driver doesn't know what rate > `0x65` means, leaves NSS at 0, but still flags it as a VHT packet. >=20 > Any idea what `0x65` represents from the hardware's perspective? Is it > a firmware bug or a proprietary control/management frame rate index? >=20 > Looking forward to your thoughts! Not sure what hardware get wrong. Let's validate rate when reading from hardware. Since 1M rate can only 20MHz, I set it together.=20 Please help to test below. I suppose you can see "weird rate=3Dxxx", but=20 "WARNING: net/mac80211/rx.c:5491" disappears.=20 diff --git a/drivers/net/wireless/realtek/rtw88/rx.c b/drivers/net/wireless= /realtek/rtw88/rx.c index 8b0afaaffaa0..3d5e48264fc5 100644 --- a/drivers/net/wireless/realtek/rtw88/rx.c +++ b/drivers/net/wireless/realtek/rtw88/rx.c @@ -295,6 +295,12 @@ void rtw_rx_query_rx_desc(struct rtw_dev *rtwdev, void= *rx_desc8, pkt_stat->tsf_low =3D le32_get_bits(rx_desc->w5, RTW_RX_DESC_W5_TSF= L); + if (pkt_stat->rate >=3D DESC_RATE_MAX) { + printk("weird rate=3D%d\n", pkt_stat->rate); + pkt_stat->rate =3D DESC_RATE1M; + pkt_stat->bw =3D RTW_CHANNEL_WIDTH_20; + } + /* drv_info_sz is in unit of 8-bytes */ pkt_stat->drv_info_sz *=3D 8; Ping-Ke