From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-173.mta1.migadu.com (out-173.mta1.migadu.com [95.215.58.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A95832FE04E for ; Wed, 13 May 2026 18:10:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778695816; cv=none; b=hqOrMKCAgRD/uyeMluWM3f87C+9cO5SZNM0Z6szYYbThRepvKhBj19PDqPMBowDhxVrucF31qfdyUepKLgJ6602IpZF1wmlPNj3BU00u+W91oe29bgIsXZDnftPEh7/0TS7l11Sp7NgtHV24vUits0L3/G944h16dJ9SKnHxBDw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778695816; c=relaxed/simple; bh=sJtHrEMTFFpjbfbBxtT8DmeJ+xf4OampWD4O1gu7XZE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=aX8crdrk8lRKxLPyuO46djBgomNqWI+YG3WoMY0Xixd5fisPr5hiEHkOFNDblg3f+ys/Y/M8AjhR2U15Fm9KgntbLOus/U6huqctna6UzfdxYUo+QhYXdmrxiW4L/pagjRBe3xiTwVmHttfrY0ZbrNaPpw5/+LWJOTGahyht9Dw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=Z07gbawt; arc=none smtp.client-ip=95.215.58.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="Z07gbawt" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1778695802; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=5Mndf8I3e0nWas0WTii+mXglPnbHTyRnv4gH4/oY+ls=; b=Z07gbawtRzpsC5jotyv3IW87ib49IfaiTjmPf27Bta5iIuZ34Ydi3SdWzjXIulDBI++v7v Jh2mjtVbDmp3WqojZfc3kryJl2e4Gi9p6LR/u6l6PvjRtVdcecHuunFBqeTarFS1oehQTH Hr/k0vdK4lpPeC7xarPmIQXz4B9n90Q= From: luka.gejak@linux.dev To: Ping-Ke Shih , Kalle Valo Cc: Sascha Hauer , linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Luka Gejak , stable@vger.kernel.org Subject: [PATCH v3] wifi: rtw88: increase TX report timeout to fix race condition Date: Wed, 13 May 2026 20:09:35 +0200 Message-ID: <20260513180935.13289-1-luka.gejak@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT From: Luka Gejak The driver expects the firmware to report TX status within 500ms. However, a timeout can be triggered when the hardware performs background scans while under TX load. During these scans, the firmware stays off-channel for periods exceeding 500ms, delaying the delivery of TX reports back to the driver. When this occurs, the purge timer fires prematurely and drops the tracking skbs from the queue. This results in the host stack interpreting the missing status as packet loss, leading to TCP window collapse. In testing with iperf3, this causes throughput to drop from ~90 Mbps to near-zero for approximately 2 seconds until the connection recovers. Increase RTW_TX_PROBE_TIMEOUT to 2500ms for RTL8723DU. This duration is sufficient to accommodate off-channel dwell time during full background scans, ensuring the purge timer only trips during genuine firmware lockups and preventing unnecessary TCP retransmission cycles. Fixes: a82dfd33d123 ("wifi: rtw88: Add common USB chip support") Cc: stable@vger.kernel.org Tested-by: Luka Gejak Signed-off-by: Luka Gejak --- Changes in v3: -Declared timeout with RTW_TX_PROBE_TIMEOUT as the default value and removed the else branch. -Updated the Fixes tag to the commit that introduced USB support. Changes in v2: -Isolated the change to RTL8723DU as requested by Ping-Ke drivers/net/wireless/realtek/rtw88/tx.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/realtek/rtw88/tx.c b/drivers/net/wireless/realtek/rtw88/tx.c index 3106edb84fb4..a6e43314a4e9 100644 --- a/drivers/net/wireless/realtek/rtw88/tx.c +++ b/drivers/net/wireless/realtek/rtw88/tx.c @@ -196,6 +196,7 @@ void rtw_tx_report_purge_timer(struct timer_list *t) void rtw_tx_report_enqueue(struct rtw_dev *rtwdev, struct sk_buff *skb, u8 sn) { struct rtw_tx_report *tx_report = &rtwdev->tx_report; + unsigned long timeout = RTW_TX_PROBE_TIMEOUT; unsigned long flags; u8 *drv_data; @@ -207,7 +208,11 @@ void rtw_tx_report_enqueue(struct rtw_dev *rtwdev, struct sk_buff *skb, u8 sn) __skb_queue_tail(&tx_report->queue, skb); spin_unlock_irqrestore(&tx_report->q_lock, flags); - mod_timer(&tx_report->purge_timer, jiffies + RTW_TX_PROBE_TIMEOUT); + if (rtwdev->chip->id == RTW_CHIP_TYPE_8723D && + rtwdev->hci.type == RTW_HCI_TYPE_USB) + timeout = msecs_to_jiffies(2500); + + mod_timer(&tx_report->purge_timer, jiffies + timeout); } EXPORT_SYMBOL(rtw_tx_report_enqueue); -- 2.54.0