Re: [PATCH v2 2/2] wifi: mac80211: send wake nullfunc when TIM bit is set while awake

[Johannes Berg]

On Tue, 2026-11-03 at 11:06 +0000, Lee Jones wrote:
> When an AP's Beacon TIM element indicates buffered unicast traffic for a
> station's AID, the AP believes the station is in power-save mode.  If
> the station is actually awake (IEEE80211_CONF_PS is not set) and
> dynamic power-save is disabled (dynamic_ps_timeout == 0, for instance
> when power-save is disabled on the interface), ieee80211_rx_mgmt_beacon()
> currently takes neither the dynamic-PS wakeup branch nor the PS-Poll
> branch.
> 
> As a result, if the AP's power-save state for the station becomes
> desynchronised (for example, due to an unauthenticated frame with the PM
> bit set), an awake client with power-save disabled ignores its AID bit
> in the TIM and never transmits a nullfunc frame with PM=0 to flush the
> AP's buffered frames.
> 
> Send a wake nullfunc frame in ieee80211_rx_mgmt_beacon() whenever the
> TIM indicates buffered traffic for the station while IEEE80211_CONF_PS
> is not set.
> 
> Fixes: 6f0756a38fc4 ("mac80211: do not send pspoll when powersave is disabled")
> Cc: stable@xxxxxxxxxxxxxxx

I'm somewhat worried that this is going to cause another issue on broken
APs that just never clear the TIM and we'd send NDPs all the time, but I
guess if that were the case then we'd have figured it out in iwlwifi
maybe.

I might still not want to put it in wireless/stable until we have more
experience with it though.

(Also not sure about the other patch for stable, it's a bit more of a
cleanup really?)

johannes