[PATCH rtw-next v2 0/3] wifi: rtw88: usb: keep bmc traffic from exhausting the TX page pool

From: Mehmet Fide

Date: Mon Sep 07 2026 - 15:09:19 EST


From: Mehmet Fide <mehmet.fide@xxxxxxxxxxxxxxxxxx>

An rtw88 USB AP with one station in power save and ordinary multicast
chatter (mDNS, SSDP) starves its own TX page pool: every broadcast and
multicast frame goes to the after-DTIM high queue, which drains a few
frames per DTIM inside a 2 TU ATIM window, and the driver hands over as
many as the network produces. On an RTL8822BU the free page count at
0x240 goes from 1803 to 16 in ~100 s and stays there for as long as the
traffic lasts; nothing else gets out, nobody can join, the reserved page
download fails ("error beacon valid"). Only a reboot recovers.

The series closes this from three sides:

1/3 bounds what the driver feeds the high queue (a small budget below
the measured drain rate, the excess leaves on the AC queue),
2/3 admits only the frames a dozing station actually needs to the
after-DTIM path (ARP, EAPOL, DHCP, the vendor driver's default
"allow special" filter), everything else goes out at line rate,
3/3 widens the ATIM window to 0xa while an AP interface is up, as the
vendor driver does, so the high queue drains faster to begin with.

With 1/3 + 2/3 the pool stays at 1803 through a 180 s storm on the
RTL8822BU, a DHCP flood still takes the after-DTIM path and is held by
the budget, join/ping cycling without power save is unchanged (10/10).
3/3 comes from the review of v1. The beacon-early C2H that Ping-Ke found
usable in AP mode is the long-term route to
IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING; that is a separate series, this
one does not depend on it.

v1: https://lore.kernel.org/linux-wireless/20260902104146.3853102-1-mehmet.fide@xxxxxxxxx/

v2:
- 1/3: macro for the refill interval, 'budget' naming, refill
bookkeeping rewritten and commented, blank lines (Ping-Ke)
- 2/3: classification from skb->protocol / ip_hdr() / udp_hdr() and the
control port flag as in rtw89, SNAP parser gone, include order (Ping-Ke)
- 3/3: new, REG_ATIMWND 0xa in AP mode, default restored on stop (Ping-Ke)

Mehmet Fide (3):
wifi: rtw88: usb: bound what the driver feeds the after-DTIM queue
wifi: rtw88: usb: only let the frames a dozing station needs use the
after-DTIM queue
wifi: rtw88: widen the ATIM window while an AP interface is up

drivers/net/wireless/realtek/rtw88/mac80211.c | 2 +
drivers/net/wireless/realtek/rtw88/reg.h | 2 +
drivers/net/wireless/realtek/rtw88/usb.c | 65 +++++++++++++++++--
drivers/net/wireless/realtek/rtw88/usb.h | 5 ++
4 files changed, 70 insertions(+), 4 deletions(-)


base-commit: 81510c3d6f2199889a4a936d8cf8b9e05911b10e
--
2.55.0