Luka Gejak <luka.gejak@linux.dev> wrote:
> Hi Ping-Ke,
> On August 31, 2026 4:23:48 AM GMT+02:00, Ping-Ke Shih <pkshih@realtek.com> wrote:
> 
> The probe_wait_ms test you suggested has run, nine hours in the tester's
> poor signal environment. At 2000 ms he saw one "Failed to send nullfunc
> ... disconnecting". At 500 ms it was one every twenty to forty seconds.
> Same environment, same driver.

Without proper quota message, I need coming back to previous mail and finding
out the stuff you want to discuss...

I don't know how bad the poor signal environment was. But 2000ms looks very
strange to me, it is too large. Have you captured air sniffer to see what
happened? 

I think we can check three points
1) If the probe uses low rate (e.g. 6M)
2) signal strength  
3) signal quality 
   Without hardware equipment, this is hard to us. I think we can compare
   the link rate with other WiFi card at the same distance far from AP.


> 
> > But I feel this case, using ieee80211_purge_tx_queue() is equivalent?
> 
> Not equivalent. ieee80211_purge_tx_queue() calls ieee80211_free_txskb(),
> which calls ieee80211_report_used_skb() with dropped = true: that
> settles the airtime accounting and frees the skb properly, but never
> reaches ieee80211_sta_tx_notify(). Only ieee80211_tx_status_*() does. It
> fixes the ownership bug and tells the connection poll nothing, which
> given the above does not matter.

The ieee80211_purge_tx_queue() I mentioned is to reference to the point:

> >   rtw_tx_report_purge_timer() -> skb_queue_purge()
> I think it should use ieee80211_purge_tx_queue() instead of skb_queue_purge().

Ping-Ke Shih <pkshih@realtek.com> wrote:
> Without proper quota message, I need coming back to previous mail and finding
> out the stuff you want to discuss...

Sorry, my last reply dropped your text. Quoting properly from here.

> I don't know how bad the poor signal environment was. But 2000ms looks very
> strange to me, it is too large. Have you captured air sniffer to see what
> happened?
>
> I think we can check three points
> 1) If the probe uses low rate (e.g. 6M)
> 2) signal strength
> 3) signal quality

Agreed that 2000 ms is not a sane number, and I am not proposing it as
one. I raised it only because it separates a late report from a missing
one, and it did.

No air capture: that is the tester's board and environment, not mine, so
I cannot sniff it. I will ask him for the three points above.

The one measurement I do have that speaks to all three is a comparison
within the same link and the same window. Nullfunc reports come back in
400 to 1000 ms, worst case 1460 ms (appeared only once), while management
frames on that same link come back in 0 to 20 ms. A 6M probe rate or a weak
signal would slow both, so whatever is happening is specific to the nullfunc
path rather than to the air, and it looks like firmware retry time.

So I am not asking for anything here and there is no patch attached to
it. If his three answers say otherwise I will come back with them.

> The ieee80211_purge_tx_queue() I mentioned is to reference to the point:
>
>>>   rtw_tx_report_purge_timer() -> skb_queue_purge()
>> I think it should use ieee80211_purge_tx_queue() instead of skb_queue_purge().

Understood, and that is what I have. I answered a question you had not
asked last time.

  wifi: rtw88: tx: hand timed out TX report frames back to mac80211

No chip condition. It is the same pattern rtw_txq_push_skb() already
uses in rtw-next, which hands the skb back with ieee80211_free_txskb()
when the HCI write fails, applied to the report timeout instead.

I will send it together with the SDIO padding fix once the preparation
series is applied, to keep them out of the way while that is in review.

Best regards,
Luka Gejak