[PATCH 1/2] wifi: mt76: mt7996: disable beacons when going offchannel

[PATCH 1/2] wifi: mt76: mt7996: disable beacons when going offchannel

[Felix Fietkau]

Avoid leaking beacons on unrelated channels during scanning/roc

Fixes: c56d6edebc1f ("wifi: mt76: mt7996: use emulated hardware scan support")
Reported-by: Chad Monroe <chad.monroe@adtran.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 .../net/wireless/mediatek/mt76/mt7996/mac.c   | 46 +++++++++++--------
 .../net/wireless/mediatek/mt76/mt7996/main.c  |  5 ++
 .../net/wireless/mediatek/mt76/mt7996/mcu.c   | 11 +++--
 .../wireless/mediatek/mt76/mt7996/mt7996.h    |  1 +
 4 files changed, 42 insertions(+), 21 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
index 6333a064c4f7..d3d3b96f7dd2 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
@@ -1698,17 +1698,37 @@ mt7996_wait_reset_state(struct mt7996_dev *dev, u32 state)
 static void
 mt7996_update_vif_beacon(void *priv, u8 *mac, struct ieee80211_vif *vif)
 {
-	struct ieee80211_hw *hw = priv;
+	struct ieee80211_bss_conf *link_conf;
+	struct mt7996_phy *phy = priv;
+	struct mt7996_dev *dev = phy->dev;
+	unsigned int link_id;
+
 
 	switch (vif->type) {
 	case NL80211_IFTYPE_MESH_POINT:
 	case NL80211_IFTYPE_ADHOC:
 	case NL80211_IFTYPE_AP:
-		mt7996_mcu_add_beacon(hw, vif, &vif->bss_conf);
 		break;
 	default:
-		break;
+		return;
 	}
+
+	for_each_vif_active_link(vif, link_conf, link_id) {
+		struct mt7996_vif_link *link;
+
+		link = mt7996_vif_link(dev, vif, link_id);
+		if (link->phy != phy)
+			continue;
+
+		mt7996_mcu_add_beacon(dev->mt76.hw, vif, link_conf);
+	}
+}
+
+void mt7996_mac_update_beacons(struct mt7996_phy *phy)
+{
+	ieee80211_iterate_active_interfaces(phy->mt76->hw,
+					    IEEE80211_IFACE_ITER_RESUME_ALL,
+					    mt7996_update_vif_beacon, phy);
 }
 
 static void
@@ -1716,25 +1736,15 @@ mt7996_update_beacons(struct mt7996_dev *dev)
 {
 	struct mt76_phy *phy2, *phy3;
 
-	ieee80211_iterate_active_interfaces(dev->mt76.hw,
-					    IEEE80211_IFACE_ITER_RESUME_ALL,
-					    mt7996_update_vif_beacon, dev->mt76.hw);
+	mt7996_mac_update_beacons(&dev->phy);
 
 	phy2 = dev->mt76.phys[MT_BAND1];
-	if (!phy2)
-		return;
-
-	ieee80211_iterate_active_interfaces(phy2->hw,
-					    IEEE80211_IFACE_ITER_RESUME_ALL,
-					    mt7996_update_vif_beacon, phy2->hw);
+	if (phy2)
+		mt7996_mac_update_beacons(phy2->priv);
 
 	phy3 = dev->mt76.phys[MT_BAND2];
-	if (!phy3)
-		return;
-
-	ieee80211_iterate_active_interfaces(phy3->hw,
-					    IEEE80211_IFACE_ITER_RESUME_ALL,
-					    mt7996_update_vif_beacon, phy3->hw);
+	if (phy3)
+		mt7996_mac_update_beacons(phy3->priv);
 }
 
 void mt7996_tx_token_put(struct mt7996_dev *dev)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index 3d5ba568243b..38d15963ec58 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -558,6 +558,9 @@ int mt7996_set_channel(struct mt76_phy *mphy)
 	struct mt7996_phy *phy = mphy->priv;
 	int ret;
 
+	if (mphy->offchannel)
+		mt7996_mac_update_beacons(phy);
+
 	ret = mt7996_mcu_set_chan_info(phy, UNI_CHANNEL_SWITCH);
 	if (ret)
 		goto out;
@@ -575,6 +578,8 @@ int mt7996_set_channel(struct mt76_phy *mphy)
 
 	mt7996_mac_reset_counters(phy);
 	phy->noise = 0;
+	if (!mphy->offchannel)
+		mt7996_mac_update_beacons(phy);
 
 out:
 	ieee80211_queue_delayed_work(mphy->hw, &mphy->mac_work,
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index a6cd82ccf5e4..64ac45920509 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -2770,13 +2770,15 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 			  struct ieee80211_bss_conf *link_conf)
 {
 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
-	struct mt76_vif_link *mlink = mt76_vif_conf_link(&dev->mt76, vif, link_conf);
+	struct mt7996_vif_link *link = mt7996_vif_conf_link(dev, vif, link_conf);
+	struct mt76_vif_link *mlink = link ? &link->mt76 : NULL;
 	struct ieee80211_mutable_offsets offs;
 	struct ieee80211_tx_info *info;
 	struct sk_buff *skb, *rskb;
 	struct tlv *tlv;
 	struct bss_bcn_content_tlv *bcn;
 	int len, extra_len = 0;
+	bool enabled = link_conf->enable_beacon;
 
 	if (link_conf->nontransmitted)
 		return 0;
@@ -2784,13 +2786,16 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 	if (!mlink)
 		return -EINVAL;
 
+	if (link->phy && link->phy->mt76->offchannel)
+		enabled = false;
+
 	rskb = __mt7996_mcu_alloc_bss_req(&dev->mt76, mlink,
 					  MT7996_MAX_BSS_OFFLOAD_SIZE);
 	if (IS_ERR(rskb))
 		return PTR_ERR(rskb);
 
 	skb = ieee80211_beacon_get_template(hw, vif, &offs, link_conf->link_id);
-	if (link_conf->enable_beacon && !skb) {
+	if (enabled && !skb) {
 		dev_kfree_skb(rskb);
 		return -EINVAL;
 	}
@@ -2809,7 +2814,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 	len = ALIGN(sizeof(*bcn) + MT_TXD_SIZE + extra_len, 4);
 	tlv = mt7996_mcu_add_uni_tlv(rskb, UNI_BSS_INFO_BCN_CONTENT, len);
 	bcn = (struct bss_bcn_content_tlv *)tlv;
-	bcn->enable = link_conf->enable_beacon;
+	bcn->enable = enabled;
 	if (!bcn->enable)
 		goto out;
 
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
index a7b6f328af39..b98cfe6e5be8 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
@@ -741,6 +741,7 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
 			   struct sk_buff *skb, struct mt76_wcid *wcid,
 			   struct ieee80211_key_conf *key, int pid,
 			   enum mt76_txq_id qid, u32 changed);
+void mt7996_mac_update_beacons(struct mt7996_phy *phy);
 void mt7996_mac_set_coverage_class(struct mt7996_phy *phy);
 void mt7996_mac_work(struct work_struct *work);
 void mt7996_mac_reset_work(struct work_struct *work);
-- 
2.50.1

[PATCH 2/2] wifi: mt76: prevent non-offchannel mgmt tx during scan/roc

[Felix Fietkau]

Only put probe request packets in the offchannel queue if
IEEE80211_TX_CTRL_DONT_USE_RATE_MASK is set and IEEE80211_TX_CTL_TX_OFFCHAN
is unset.

Fixes: 0b3be9d1d34e ("wifi: mt76: add separate tx scheduling queue for off-channel tx")
Reported-by: Chad Monroe <chad.monroe@adtran.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 drivers/net/wireless/mediatek/mt76/tx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c
index e6cf16706667..03b042fdf997 100644
--- a/drivers/net/wireless/mediatek/mt76/tx.c
+++ b/drivers/net/wireless/mediatek/mt76/tx.c
@@ -332,6 +332,7 @@ mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
 	struct mt76_wcid *wcid, struct sk_buff *skb)
 {
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+	struct ieee80211_hdr *hdr = (void *)skb->data;
 	struct sk_buff_head *head;
 
 	if (mt76_testmode_enabled(phy)) {
@@ -349,7 +350,8 @@ mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
 	info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, phy->band_idx);
 
 	if ((info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) ||
-	    (info->control.flags & IEEE80211_TX_CTRL_DONT_USE_RATE_MASK))
+	    ((info->control.flags & IEEE80211_TX_CTRL_DONT_USE_RATE_MASK) &&
+	     ieee80211_is_probe_req(hdr->frame_control)))
 		head = &wcid->tx_offchannel;
 	else
 		head = &wcid->tx_pending;
-- 
2.50.1

Re: [PATCH 1/2] wifi: mt76: mt7996: disable beacons when going offchannel

[Ben Greear]

On 8/13/25 05:11, Felix Fietkau wrote:
> Avoid leaking beacons on unrelated channels during scanning/roc
> 
> Fixes: c56d6edebc1f ("wifi: mt76: mt7996: use emulated hardware scan support")
> Reported-by: Chad Monroe <chad.monroe@adtran.com>
> Signed-off-by: Felix Fietkau <nbd@nbd.name>
> ---
>   .../net/wireless/mediatek/mt76/mt7996/mac.c   | 46 +++++++++++--------
>   .../net/wireless/mediatek/mt76/mt7996/main.c  |  5 ++
>   .../net/wireless/mediatek/mt76/mt7996/mcu.c   | 11 +++--
>   .../wireless/mediatek/mt76/mt7996/mt7996.h    |  1 +
>   4 files changed, 42 insertions(+), 21 deletions(-)
> 
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
> index 6333a064c4f7..d3d3b96f7dd2 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
> @@ -1698,17 +1698,37 @@ mt7996_wait_reset_state(struct mt7996_dev *dev, u32 state)
>   static void
>   mt7996_update_vif_beacon(void *priv, u8 *mac, struct ieee80211_vif *vif)
>   {
> -	struct ieee80211_hw *hw = priv;
> +	struct ieee80211_bss_conf *link_conf;
> +	struct mt7996_phy *phy = priv;
> +	struct mt7996_dev *dev = phy->dev;
> +	unsigned int link_id;
> +
>   
>   	switch (vif->type) {
>   	case NL80211_IFTYPE_MESH_POINT:
>   	case NL80211_IFTYPE_ADHOC:
>   	case NL80211_IFTYPE_AP:
> -		mt7996_mcu_add_beacon(hw, vif, &vif->bss_conf);
>   		break;
>   	default:
> -		break;
> +		return;
>   	}
> +
> +	for_each_vif_active_link(vif, link_conf, link_id) {
> +		struct mt7996_vif_link *link;
> +
> +		link = mt7996_vif_link(dev, vif, link_id);
> +		if (link->phy != phy)
> +			continue;
> +
> +		mt7996_mcu_add_beacon(dev->mt76.hw, vif, link_conf);
> +	}

Hello Felix,

We attempted to backport this into our tree, and we found that 'link'
in the code above is NULL sometimes and we were seeing crashes.  Adding
a check for null seems to have fixed it.

Possibly this does not happen in upstream code, so just FYI.

Thanks,
Ben

-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com

Re: [PATCH 1/2] wifi: mt76: mt7996: disable beacons when going offchannel

[Felix Fietkau]

On 19.08.25 19:27, Ben Greear wrote:
> On 8/13/25 05:11, Felix Fietkau wrote:
>> Avoid leaking beacons on unrelated channels during scanning/roc
>> 
>> Fixes: c56d6edebc1f ("wifi: mt76: mt7996: use emulated hardware scan support")
>> Reported-by: Chad Monroe <chad.monroe@adtran.com>
>> Signed-off-by: Felix Fietkau <nbd@nbd.name>
>> ---
>>   .../net/wireless/mediatek/mt76/mt7996/mac.c   | 46 +++++++++++--------
>>   .../net/wireless/mediatek/mt76/mt7996/main.c  |  5 ++
>>   .../net/wireless/mediatek/mt76/mt7996/mcu.c   | 11 +++--
>>   .../wireless/mediatek/mt76/mt7996/mt7996.h    |  1 +
>>   4 files changed, 42 insertions(+), 21 deletions(-)
>> 
>> diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
>> index 6333a064c4f7..d3d3b96f7dd2 100644
>> --- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
>> +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
>> @@ -1698,17 +1698,37 @@ mt7996_wait_reset_state(struct mt7996_dev *dev, u32 state)
>>   static void
>>   mt7996_update_vif_beacon(void *priv, u8 *mac, struct ieee80211_vif *vif)
>>   {
>> -	struct ieee80211_hw *hw = priv;
>> +	struct ieee80211_bss_conf *link_conf;
>> +	struct mt7996_phy *phy = priv;
>> +	struct mt7996_dev *dev = phy->dev;
>> +	unsigned int link_id;
>> +
>>   
>>   	switch (vif->type) {
>>   	case NL80211_IFTYPE_MESH_POINT:
>>   	case NL80211_IFTYPE_ADHOC:
>>   	case NL80211_IFTYPE_AP:
>> -		mt7996_mcu_add_beacon(hw, vif, &vif->bss_conf);
>>   		break;
>>   	default:
>> -		break;
>> +		return;
>>   	}
>> +
>> +	for_each_vif_active_link(vif, link_conf, link_id) {
>> +		struct mt7996_vif_link *link;
>> +
>> +		link = mt7996_vif_link(dev, vif, link_id);
>> +		if (link->phy != phy)
>> +			continue;
>> +
>> +		mt7996_mcu_add_beacon(dev->mt76.hw, vif, link_conf);
>> +	}
> 
> Hello Felix,
> 
> We attempted to backport this into our tree, and we found that 'link'
> in the code above is NULL sometimes and we were seeing crashes.  Adding
> a check for null seems to have fixed it.
> 
> Possibly this does not happen in upstream code, so just FYI.

Thanks. I was made aware of the same bug in OpenWrt earlier and I've 
adjusted the commit in my tree accordingly.

- Felix