From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-189.mta1.migadu.com (out-189.mta1.migadu.com [95.215.58.189]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A8ACE2EC571 for ; Thu, 7 May 2026 16:27:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.189 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778171266; cv=none; b=qTTVTBFOsT0aki19SVN15mhlImu+H58Eb9TnMnanrKRN4lMEEuI6R22em/TfvkGWzFYtRutgloIkf/UnwqU1F453Xn1cJcMNbpUd7Gp4nhwSOxAF/hANDikIVUAj0xdR1OQgpWv9WOEwsfjC76EcUwwgVQW1dBi892+3ZxuA3qA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778171266; c=relaxed/simple; bh=Xr1PRu2BgzSpDj3RS03CjWCgwoqsxe1LZ73FJODdbs4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=GbIR7emuQZIxWGVK13upNMskHBJ2wrov8/o5Lj2iNgPTZi3eC4JTSpOoUwPoHvXYYZqU/4ILxxw1S+z8AUTFn7n0xhw53PSCc3/6QA1A5kfzmY//OrzFbyN04VeH7yBgY/FbZE8fr9h91dlxGGeve2WPeVLaHPeQetfV1tJW7Og= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=KT3vouDS; arc=none smtp.client-ip=95.215.58.189 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="KT3vouDS" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1778171262; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=gb9ChjzShQDBgeDOk51gMnRUsvuczWK282t+xBJEbjk=; b=KT3vouDSbHIMUoa2f+pvk0vp7djBlKW+Q1N5UFoPZiyZOKObJiwHa8aaU268oQvflHxT+y /9F97JML1kfJ7CKx9PmGiODoSesc9Y7xD5bXf+FnBNjKM2zxRtA7/p/yfQwyDQk9feS6Gk BKuRF2+BHt0PU4VMTUnc3w2sHuFsaS8= From: luka.gejak@linux.dev To: Ping-Ke Shih , Kalle Valo Cc: Stanislaw Gruszka , Yan-Hsuan Chuang , Brian Norris , linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Luka Gejak , stable@vger.kernel.org Subject: [PATCH v2 1/2] wifi: rtw88: increase TX report timeout to fix race condition Date: Thu, 7 May 2026 18:27:04 +0200 Message-ID: <20260507162704.68583-1-luka.gejak@linux.dev> Precedence: bulk X-Mailing-List: linux-wireless@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT From: Luka Gejak The driver expects the firmware to report TX status within 500ms. However, a timeout can be triggered when the hardware performs background scans while under TX load. During these scans, the firmware stays off-channel for periods exceeding 500ms, delaying the delivery of TX reports back to the driver. When this occurs, the purge timer fires prematurely and drops the tracking skbs from the queue. This results in the host stack interpreting the missing status as packet loss, leading to TCP window collapse. In testing with iperf3, this causes throughput to drop from ~90 Mbps to near-zero for approximately 2 seconds until the connection recovers. Increase RTW_TX_PROBE_TIMEOUT to 2500ms for RTL8723DU. This duration is sufficient to accommodate off-channel dwell time during full background scans, ensuring the purge timer only trips during genuine firmware lockups and preventing unnecessary TCP retransmission cycles. Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver") Cc: stable@vger.kernel.org Tested-by: Luka Gejak Signed-off-by: Luka Gejak --- Changes in v2: -Isolated the change to RTL8723DU as requested by Ping-Ke drivers/net/wireless/realtek/rtw88/tx.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/realtek/rtw88/tx.c b/drivers/net/wireless/realtek/rtw88/tx.c index 3106edb84fb4..7fab83c3f6b5 100644 --- a/drivers/net/wireless/realtek/rtw88/tx.c +++ b/drivers/net/wireless/realtek/rtw88/tx.c @@ -196,6 +196,7 @@ void rtw_tx_report_purge_timer(struct timer_list *t) void rtw_tx_report_enqueue(struct rtw_dev *rtwdev, struct sk_buff *skb, u8 sn) { struct rtw_tx_report *tx_report = &rtwdev->tx_report; + unsigned long timeout; unsigned long flags; u8 *drv_data; @@ -207,7 +208,13 @@ void rtw_tx_report_enqueue(struct rtw_dev *rtwdev, struct sk_buff *skb, u8 sn) __skb_queue_tail(&tx_report->queue, skb); spin_unlock_irqrestore(&tx_report->q_lock, flags); - mod_timer(&tx_report->purge_timer, jiffies + RTW_TX_PROBE_TIMEOUT); + if (rtwdev->chip->id == RTW_CHIP_TYPE_8723D && + rtwdev->hci.type == RTW_HCI_TYPE_USB) + timeout = msecs_to_jiffies(2500); + else + timeout = RTW_TX_PROBE_TIMEOUT; + + mod_timer(&tx_report->purge_timer, jiffies + timeout); } EXPORT_SYMBOL(rtw_tx_report_enqueue); -- 2.54.0