RE: [BUG] wifi: rtw88: Hard system freeze on RTL8821CE when power_save is enabled (LPS/ASPM conflict)

From: Ping-Ke Shih

Date: Tue Mar 17 2026 - 20:59:09 EST


LB F <goainwo@xxxxxxxxx> wrote:
> Ping-Ke Shih <pkshih@xxxxxxxxxxx> wrote:
> > To reproduce this reliable, you need to remove driver ko and mac80211.ko,
> > and reinstall them.
> >
> > However, you have confirmed this is the symptom. I think only if you
> > want to dig why the rate reported by hardware is weird, otherwise we
> > can ignore this warning.
>
> Following your suggestion, I performed a full stack reload including
> mac80211.ko and cfg80211.ko, and was able to reproduce the warning:
>
> [152.226055] Rate marked as a VHT rate but data is invalid: MCS: 0, NSS: 0
> [152.226057] WARNING: net/mac80211/rx.c:5491 at
> ieee80211_rx_list+0x177/0x1020 [mac80211]
> [152.226336] CPU: 2 UID: 0 PID: 638 Comm: irq/56-rtw_pci Tainted: G
> IOE 6.19.7-1-cachyos
> [152.226344] Hardware name: HP HP Notebook/81F0, BIOS F.50 11/20/2020
>
> One observation worth mentioning: the warning triggered approximately
> 72 seconds after initial association, coinciding with a Bluetooth
> device connecting to the system. This may suggest the NSS=0 condition
> occurs during BT coexistence negotiation rather than during normal
> WiFi traffic. I am not sure if this is relevant, but I wanted to
> mention it in case it helps narrow down the root cause.
>
> I also noticed the offset is now +0x177, which matches exactly what
> you showed from v6.19.6. The earlier +0x183 was likely an artifact of
> CachyOS's LTO optimizations while mac80211 had been resident for a
> long time.
>
> As you noted, this appears to be a separate issue from the freeze and
> h2c timeout problems, so I leave it to your judgment whether it
> warrants further investigation.

I add a printk to show the case VHT and NSS==0 as below. Please help to
collect the output, and then I can see what it happened.

diff --git a/drivers/net/wireless/realtek/rtw88/rx.c b/drivers/net/wireless/realtek/rtw88/rx.c
index 8b0afaaffaa0..a4e3a3bce748 100644
--- a/drivers/net/wireless/realtek/rtw88/rx.c
+++ b/drivers/net/wireless/realtek/rtw88/rx.c
@@ -230,6 +230,11 @@ static void rtw_rx_fill_rx_status(struct rtw_dev *rtwdev,
&rx_status->nss);
}

+ if (rx_status->encoding == RX_ENC_VHT && rx_status->nss == 0) {
+ printk("VHT NSS=0 pkt_stat->rate=0x%x rx_status->band=%d rx_status->rate_idx=%d\n",
+ pkt_stat->rate, rx_status->band, rx_status->rate_idx);
+ }
+
rx_status->flag |= RX_FLAG_MACTIME_START;
rx_status->mactime = pkt_stat->tsf_low;

>
> ---
>
> I would like to take this opportunity to thank you sincerely for your
> time, patience, and expertise throughout this whole process. From your
> very first response to the final v2 patch, your guidance made it
> possible to properly identify and resolve a bug that had been causing
> real frustration for users of this hardware for a long time.

I also thanks for your time and help. :)

Ping-Ke