[PATCH v2] wifi: rtw88: increase TX report timeout to fix race condition

[PATCH v2] wifi: rtw88: increase TX report timeout to fix race condition

[luka.gejak]

From: Luka Gejak <luka.gejak@linux.dev>

The driver expects the firmware to report TX status within 500ms.
However, a timeout can be triggered when the hardware performs
background scans while under TX load. During these scans, the firmware
stays off-channel for periods exceeding 500ms, delaying the delivery of
TX reports back to the driver.

When this occurs, the purge timer fires prematurely and drops the
tracking skbs from the queue. This results in the host stack
interpreting the missing status as packet loss, leading to TCP window
collapse. In testing with iperf3, this causes throughput to drop from
~90 Mbps to near-zero for approximately 2 seconds until the connection
recovers.

Increase RTW_TX_PROBE_TIMEOUT to 2500ms for RTL8723DU. This duration is
sufficient to accommodate off-channel dwell time during full background
scans, ensuring the purge timer only trips during genuine firmware
lockups and preventing unnecessary TCP retransmission cycles.

Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
Cc: stable@vger.kernel.org
Tested-by: Luka Gejak <luka.gejak@linux.dev>
Signed-off-by: Luka Gejak <luka.gejak@linux.dev>
---
Changes in v2:
 -Isolated the change to RTL8723DU as requested by Ping-Ke

 drivers/net/wireless/realtek/rtw88/tx.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtw88/tx.c b/drivers/net/wireless/realtek/rtw88/tx.c
index 3106edb84fb4..7fab83c3f6b5 100644
--- a/drivers/net/wireless/realtek/rtw88/tx.c
+++ b/drivers/net/wireless/realtek/rtw88/tx.c
@@ -196,6 +196,7 @@ void rtw_tx_report_purge_timer(struct timer_list *t)
 void rtw_tx_report_enqueue(struct rtw_dev *rtwdev, struct sk_buff *skb, u8 sn)
 {
 	struct rtw_tx_report *tx_report = &rtwdev->tx_report;
+	unsigned long timeout;
 	unsigned long flags;
 	u8 *drv_data;
 
@@ -207,7 +208,13 @@ void rtw_tx_report_enqueue(struct rtw_dev *rtwdev, struct sk_buff *skb, u8 sn)
 	__skb_queue_tail(&tx_report->queue, skb);
 	spin_unlock_irqrestore(&tx_report->q_lock, flags);
 
-	mod_timer(&tx_report->purge_timer, jiffies + RTW_TX_PROBE_TIMEOUT);
+	if (rtwdev->chip->id == RTW_CHIP_TYPE_8723D &&
+	    rtwdev->hci.type == RTW_HCI_TYPE_USB)
+		timeout = msecs_to_jiffies(2500);
+	else
+		timeout = RTW_TX_PROBE_TIMEOUT;
+
+	mod_timer(&tx_report->purge_timer, jiffies + timeout);
 }
 EXPORT_SYMBOL(rtw_tx_report_enqueue);
 
-- 
2.54.0

RE: [PATCH v2] wifi: rtw88: increase TX report timeout to fix race condition

[Ping-Ke Shih]

luka.gejak@linux.dev <luka.gejak@linux.dev> wrote:
> From: Luka Gejak <luka.gejak@linux.dev>
> 
> The driver expects the firmware to report TX status within 500ms.
> However, a timeout can be triggered when the hardware performs
> background scans while under TX load. During these scans, the firmware
> stays off-channel for periods exceeding 500ms, delaying the delivery of
> TX reports back to the driver.
> 
> When this occurs, the purge timer fires prematurely and drops the
> tracking skbs from the queue. This results in the host stack
> interpreting the missing status as packet loss, leading to TCP window
> collapse. In testing with iperf3, this causes throughput to drop from
> ~90 Mbps to near-zero for approximately 2 seconds until the connection
> recovers.
> 
> Increase RTW_TX_PROBE_TIMEOUT to 2500ms for RTL8723DU. This duration is
> sufficient to accommodate off-channel dwell time during full background
> scans, ensuring the purge timer only trips during genuine firmware
> lockups and preventing unnecessary TCP retransmission cycles.
> 
> Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")

I don't think this commit introduce USB support. 

> Cc: stable@vger.kernel.org
> Tested-by: Luka Gejak <luka.gejak@linux.dev>
> Signed-off-by: Luka Gejak <luka.gejak@linux.dev>
> ---
> Changes in v2:
>  -Isolated the change to RTL8723DU as requested by Ping-Ke
> 
>  drivers/net/wireless/realtek/rtw88/tx.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/realtek/rtw88/tx.c b/drivers/net/wireless/realtek/rtw88/tx.c
> index 3106edb84fb4..7fab83c3f6b5 100644
> --- a/drivers/net/wireless/realtek/rtw88/tx.c
> +++ b/drivers/net/wireless/realtek/rtw88/tx.c
> @@ -196,6 +196,7 @@ void rtw_tx_report_purge_timer(struct timer_list *t)
>  void rtw_tx_report_enqueue(struct rtw_dev *rtwdev, struct sk_buff *skb, u8 sn)
>  {
>         struct rtw_tx_report *tx_report = &rtwdev->tx_report;
> +       unsigned long timeout;

Declare RTW_TX_PROBE_TIMEOUT as default value.

unsigned long timeout = RTW_TX_PROBE_TIMEOUT;

>         unsigned long flags;
>         u8 *drv_data;
> 
> @@ -207,7 +208,13 @@ void rtw_tx_report_enqueue(struct rtw_dev *rtwdev, struct sk_buff *skb, u8 sn)
>         __skb_queue_tail(&tx_report->queue, skb);
>         spin_unlock_irqrestore(&tx_report->q_lock, flags);
> 
> -       mod_timer(&tx_report->purge_timer, jiffies + RTW_TX_PROBE_TIMEOUT);
> +       if (rtwdev->chip->id == RTW_CHIP_TYPE_8723D &&
> +           rtwdev->hci.type == RTW_HCI_TYPE_USB)
> +               timeout = msecs_to_jiffies(2500);

Only RTL8723DU uses different setting treated as an exception by if-condition.

> +       else
> +               timeout = RTW_TX_PROBE_TIMEOUT;
> +
> +       mod_timer(&tx_report->purge_timer, jiffies + timeout);
>  }
>  EXPORT_SYMBOL(rtw_tx_report_enqueue);
> 
> --
> 2.54.0