Re: [PATCH v2 2/2] wifi: mac80211: send wake nullfunc when TIM bit is set while awake

[Lee Jones]

On Tue, 03 Nov 2026, Johannes Berg wrote:

> On Tue, 2026-11-03 at 11:06 +0000, Lee Jones wrote:
> > When an AP's Beacon TIM element indicates buffered unicast traffic for a
> > station's AID, the AP believes the station is in power-save mode.  If
> > the station is actually awake (IEEE80211_CONF_PS is not set) and
> > dynamic power-save is disabled (dynamic_ps_timeout == 0, for instance
> > when power-save is disabled on the interface), ieee80211_rx_mgmt_beacon()
> > currently takes neither the dynamic-PS wakeup branch nor the PS-Poll
> > branch.
> > 
> > As a result, if the AP's power-save state for the station becomes
> > desynchronised (for example, due to an unauthenticated frame with the PM
> > bit set), an awake client with power-save disabled ignores its AID bit
> > in the TIM and never transmits a nullfunc frame with PM=0 to flush the
> > AP's buffered frames.
> > 
> > Send a wake nullfunc frame in ieee80211_rx_mgmt_beacon() whenever the
> > TIM indicates buffered traffic for the station while IEEE80211_CONF_PS
> > is not set.
> > 
> > Fixes: 6f0756a38fc4 ("mac80211: do not send pspoll when powersave is disabled")
> > Cc: stable@xxxxxxxxxxxxxxx
> 
> I'm somewhat worried that this is going to cause another issue on broken
> APs that just never clear the TIM and we'd send NDPs all the time, but I
> guess if that were the case then we'd have figured it out in iwlwifi
> maybe.
> 
> I might still not want to put it in wireless/stable until we have more
> experience with it though.
> 
> (Also not sure about the other patch for stable, it's a bit more of a
> cleanup really?)

Your call bud.

If you want to strip the Cc: and Fixes: tags, I have no issue with it.

-- 
Lee Jones