[PATCH] netdev: Fix premature ECSA channel switch timeout for mt7925

[PATCH] netdev: Fix premature ECSA channel switch timeout for mt7925

[arpan]

The mt7925 cards get stuck and disconnect during Extended Channel Switch
Announcement (ECSA) events because the kernel considers them stuck.

This occurs because the kernel sends an imminent channel switch
notification (NL80211_CMD_CH_SWITCH_NOTIFY with the
NL80211_ATTR_CH_SWITCH_COUNT attribute present) prior to the physical
switch. iwd was previously ignoring the countdown attribute and
immediately initiating an active scan to re-query the AP. Sending a
scan command while the firmware is trying to tune the radio causes the
mt7925 firmware to time out.

This patch adds a check to see if the countdown attribute is present for
mt7925 interfaces. If it is, we wait for the second notification (which
omits the count) that confirms the switch is physically completed before
proceeding with the internal state updates.

Signed-off-by: Arpan <arpanpramanik015@gmail.com>
---
 src/netdev.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/src/netdev.c b/src/netdev.c
index e639a1f8..96b48ac3 100644
--- a/src/netdev.c
+++ b/src/netdev.c
@@ -5428,12 +5428,32 @@ static void netdev_channel_switch_event(struct l_genl_msg *msg,
 {
 	_auto_(l_free) struct band_chandef *chandef = NULL;
 
+	uint32_t count;
+	const char *driver;
+
 	if (netdev->type != NL80211_IFTYPE_STATION)
 		return;
 
 	if (L_WARN_ON(!netdev->connected))
 		return;
 
+	driver = wiphy_get_driver(netdev_get_wiphy(netdev));
+
+	/*
+	 * If the channel switch countdown is present, the switch is imminent
+	 * but has not happened yet. Wait for the second CH_SWITCH_NOTIFY
+	 * event (which omits the count) to avoid interrupting the firmware
+	 * by prematurely starting a scan.
+	 *
+	 * Restrict this workaround to mt7925 cards as requested.
+	 */
+	if (driver && !strncmp(driver, "mt7925", 6) &&
+			nl80211_parse_attrs(msg, NL80211_ATTR_CH_SWITCH_COUNT, &count,
+				NL80211_ATTR_UNSPEC) == 0) {
+		l_debug("Channel switch imminent in %u TBTTs, waiting...", count);
+		return;
+	}
+
 	chandef = l_new(struct band_chandef, 1);
 
 	if (nl80211_parse_chandef(msg, chandef) < 0) {
-- 
2.55.0

Re: [PATCH] netdev: Fix premature ECSA channel switch timeout for mt7925

[James Prestwood]

Hi Arpan,

On 7/29/26 1:13 PM, arpan wrote:
> The mt7925 cards get stuck and disconnect during Extended Channel Switch
> Announcement (ECSA) events because the kernel considers them stuck.
>
> This occurs because the kernel sends an imminent channel switch
> notification (NL80211_CMD_CH_SWITCH_NOTIFY with the
> NL80211_ATTR_CH_SWITCH_COUNT attribute present) prior to the physical
> switch. iwd was previously ignoring the countdown attribute and
> immediately initiating an active scan to re-query the AP. Sending a
> scan command while the firmware is trying to tune the radio causes the
> mt7925 firmware to time out.
>
> This patch adds a check to see if the countdown attribute is present for
> mt7925 interfaces. If it is, we wait for the second notification (which
> omits the count) that confirms the switch is physically completed before
> proceeding with the internal state updates.
>
> Signed-off-by: Arpan <arpanpramanik015@gmail.com>
> ---
>   src/netdev.c | 20 ++++++++++++++++++++
>   1 file changed, 20 insertions(+)
>
> diff --git a/src/netdev.c b/src/netdev.c
> index e639a1f8..96b48ac3 100644
> --- a/src/netdev.c
> +++ b/src/netdev.c
> @@ -5428,12 +5428,32 @@ static void netdev_channel_switch_event(struct l_genl_msg *msg,
>   {
>   	_auto_(l_free) struct band_chandef *chandef = NULL;
>   
> +	uint32_t count;
> +	const char *driver;
> +
>   	if (netdev->type != NL80211_IFTYPE_STATION)
>   		return;
>   
>   	if (L_WARN_ON(!netdev->connected))
>   		return;
>   
> +	driver = wiphy_get_driver(netdev_get_wiphy(netdev));
> +
> +	/*
> +	 * If the channel switch countdown is present, the switch is imminent
> +	 * but has not happened yet. Wait for the second CH_SWITCH_NOTIFY
> +	 * event (which omits the count) to avoid interrupting the firmware
> +	 * by prematurely starting a scan.
> +	 *
> +	 * Restrict this workaround to mt7925 cards as requested.
> +	 */
> +	if (driver && !strncmp(driver, "mt7925", 6) &&
> +			nl80211_parse_attrs(msg, NL80211_ATTR_CH_SWITCH_COUNT, &count,
> +				NL80211_ATTR_UNSPEC) == 0) {
> +		l_debug("Channel switch imminent in %u TBTTs, waiting...", count);
> +		return;
> +	}
> +
>   	chandef = l_new(struct band_chandef, 1);
>   
>   	if (nl80211_parse_chandef(msg, chandef) < 0) {

My only confusion is why this attribute is used with 
NL80211_CMD_CH_SWITCH_NOTIFY since its not indicated as such in the 
nl80211 docs. It does mention the attribute with 
NL80211_CMD_CH_SWITCH_STARTED_NOTIFY though. Would you be able to 
capture iwmon logs so we can see the sequence of events, maybe there's 
some details hidden in there.

Based on the documentation for NL80211_CMD_CH_SWITCH_NOTIFY:

"This indication may also be sent when a remotely-initiated switch 
(e.g., when a STA receives a CSA from the remote AP) is completed;"

I read this as the channel switch is done, and userspace just needs to 
be informed. Not the behavior here where its _started_ and you need to 
wait for it to complete...

Maybe this is a specific behavior of the mt7925 (which would be 
unfortunate) but in general we'd like to avoid driver specific 
workarounds if at all possible.

Thanks,

James