[PATCH 0/2] wifi: iwlwifi: fix legacy-rate injection outside 2.4 GHz

[PATCH 0/2] wifi: iwlwifi: fix legacy-rate injection outside 2.4 GHz

[benthecarman via B4 Relay]

Both op modes pass mac80211's legacy rate index for an injected frame
to the driver's rate conversion unchanged. Outside 2.4 GHz that index
points into a bitrate table starting at 6 Mbps, so every injected
legacy rate is shifted down by the four CCK rates: 12 Mbps on 5 GHz
goes out as 5.5 Mbps CCK, which nothing on that band can receive.

I found this bringing up userspace AWDL (OWL) on an AX211: the peer
heard none of our data frames until the rate was remapped. Patch 1
(mvm) was tested on that hardware; patch 2 (mld) is the same fix and
build-tested only, as I have no iwlmld device.

Testing: patch 1 was tested on an Intel AX211 (iwlmvm, firmware
89.123cf747.0) with the same change applied to Ubuntu's 7.0.0-38
kernel, injecting AWDL frames at a radiotap rate of 12 Mbps on channel
44 (5220 MHz). Before, the TX response showed status 0x83 (long retry
limit) and rate_n_flags 0x8002; after, status 0x1, no retries,
rate_n_flags 0x8102, and the peer ACKed every frame. Against
iwlwifi-next both mvm/tx.c and mld/tx.c build without warnings at W=1,
but I could not boot an iwlwifi-next kernel, and patch 2 is untested
at runtime.

The bug was found, and the patches written, with help from an AI
assistant (Claude) during that debugging session; I reviewed and
tested them as described above.

Signed-off-by: benthecarman <benthecarman@live.com>
---
benthecarman (2):
      wifi: iwlwifi: mvm: Fix injected 5 GHz legacy rate
      wifi: iwlwifi: mld: Fix injected 5 GHz legacy rate

 drivers/net/wireless/intel/iwlwifi/mld/tx.c | 11 ++++++++++-
 drivers/net/wireless/intel/iwlwifi/mvm/tx.c |  8 ++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)
---
base-commit: 5d017b30f502e20bfb96ba534b1c36f060a06e98
change-id: 20261009-next-da884048e667

Best regards,
-- 
benthecarman <benthecarman1@gmail.com>

[PATCH 1/2] wifi: iwlwifi: mvm: Fix injected 5 GHz legacy rate

[benthecarman via B4 Relay]

From: benthecarman <benthecarman@live.com>

iwl_mvm_get_inject_tx_rate() passes the legacy rate index from
mac80211 straight to iwl_mvm_convert_rate_idx(). That index points
into the band's own bitrate table, which outside 2.4 GHz starts at
6 Mbps (iwl_cfg80211_rates[RATES_52_OFFS]), while the driver's indices
start with the four CCK rates. A frame injected at 12 Mbps on 5 or
6 GHz, index 2, therefore goes out as 5.5 Mbps CCK, which no receiver
on those bands can decode.

The non-injected path, iwl_mvm_get_tx_rate(), already adds
IWL_FIRST_OFDM_RATE outside 2.4 GHz. Do the same for injection.

Seen on an AX211 injecting data frames at 12 Mbps on channel 44: the
TX response showed rate_n_flags 0x8002 (CCK) and the peer never ACKed.
With this change it shows 0x8102 (12 Mbps OFDM) and every unicast
frame is ACKed on the first attempt.

Fixes: b99c4607973a ("wifi: iwlwifi: mvm: refactor TX rate handling")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: benthecarman <benthecarman@live.com>
---
 drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index d3c2fe830..fb7e48aa3 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -331,6 +331,14 @@ static u32 iwl_mvm_get_inject_tx_rate(struct iwl_mvm *mvm,
 	} else {
 		int rate_idx = info->control.rates[0].idx;
 
+		/*
+		 * mac80211 indexes the band's bitrates, which start at
+		 * 6 Mbps outside 2.4 GHz; remap to our rate indices as
+		 * iwl_mvm_get_tx_rate() does.
+		 */
+		if (info->band != NL80211_BAND_2GHZ)
+			rate_idx += IWL_FIRST_OFDM_RATE;
+
 		result = iwl_mvm_convert_rate_idx(mvm, info, rate_idx);
 	}
 

-- 
2.55.0

[PATCH 2/2] wifi: iwlwifi: mld: Fix injected 5 GHz legacy rate

[benthecarman via B4 Relay]

From: benthecarman <benthecarman@live.com>

iwl_mld_get_inject_tx_rate() hands the legacy rate index from mac80211
to iwl_mld_mac80211_rate_idx_to_fw(), which expects the driver's rate
indices. Outside 2.4 GHz the mac80211 index points into a bitrate
table that starts at 6 Mbps, so a 12 Mbps injection on 5 or 6 GHz goes
out as 5.5 Mbps CCK.

Add IWL_FIRST_OFDM_RATE outside 2.4 GHz, as mvm does for frames that
are not injected.

Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: benthecarman <benthecarman@live.com>
---
 drivers/net/wireless/intel/iwlwifi/mld/tx.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/tx.c b/drivers/net/wireless/intel/iwlwifi/mld/tx.c
index fc501ac0c..317573b5e 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/tx.c
@@ -599,7 +599,16 @@ static u32 iwl_mld_get_inject_tx_rate(struct iwl_mld *mld,
 		if (u32_get_bits(info->flags, IEEE80211_TX_CTL_STBC))
 			result |= RATE_MCS_STBC_MSK;
 	} else {
-		result = iwl_mld_mac80211_rate_idx_to_fw(mld, info, rate->idx);
+		int rate_idx = rate->idx;
+
+		/*
+		 * mac80211 indexes the band's bitrates, which start at
+		 * 6 Mbps outside 2.4 GHz; remap to our rate indices.
+		 */
+		if (info->band != NL80211_BAND_2GHZ)
+			rate_idx += IWL_FIRST_OFDM_RATE;
+
+		result = iwl_mld_mac80211_rate_idx_to_fw(mld, info, rate_idx);
 	}
 
 	if (info->control.antennas)

-- 
2.55.0

RE: [PATCH 2/2] wifi: iwlwifi: mld: Fix injected 5 GHz legacy rate

[Korenblit, Miriam Rachel]

> -----Original Message-----
> From: benthecarman via B4 Relay
> <devnull+benthecarman1.gmail.com@kernel.org>
> Sent: Saturday, October 10, 2026 5:42 AM
> To: Korenblit, Miriam Rachel <miriam.rachel.korenblit@intel.com>
> Cc: Johannes Berg <johannes@sipsolutions.net>; linux-wireless@vger.kernel.org;
> linux-kernel@vger.kernel.org; benthecarman <benthecarman@live.com>
> Subject: [PATCH 2/2] wifi: iwlwifi: mld: Fix injected 5 GHz legacy rate
> 
> From: benthecarman <benthecarman@live.com>
> 
> iwl_mld_get_inject_tx_rate() hands the legacy rate index from mac80211 to
> iwl_mld_mac80211_rate_idx_to_fw(), which expects the driver's rate indices.
> Outside 2.4 GHz the mac80211 index points into a bitrate table that starts at 6
> Mbps, so a 12 Mbps injection on 5 or 6 GHz goes out as 5.5 Mbps CCK.
> 
> Add IWL_FIRST_OFDM_RATE outside 2.4 GHz, as mvm does for frames that are
> not injected.
> 
> Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver")
> Assisted-by: Claude:claude-opus-5-5
> Signed-off-by: benthecarman <benthecarman@live.com>
Please use a proper readable user name.
> ---
>  drivers/net/wireless/intel/iwlwifi/mld/tx.c | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/intel/iwlwifi/mld/tx.c
> b/drivers/net/wireless/intel/iwlwifi/mld/tx.c
> index fc501ac0c..317573b5e 100644
> --- a/drivers/net/wireless/intel/iwlwifi/mld/tx.c
> +++ b/drivers/net/wireless/intel/iwlwifi/mld/tx.c
> @@ -599,7 +599,16 @@ static u32 iwl_mld_get_inject_tx_rate(struct iwl_mld
> *mld,
>  		if (u32_get_bits(info->flags, IEEE80211_TX_CTL_STBC))
>  			result |= RATE_MCS_STBC_MSK;
>  	} else {
> -		result = iwl_mld_mac80211_rate_idx_to_fw(mld, info, rate-
> >idx);
> +		int rate_idx = rate->idx;
> +
> +		/*
> +		 * mac80211 indexes the band's bitrates, which start at
> +		 * 6 Mbps outside 2.4 GHz; remap to our rate indices.
> +		 */
> +		if (info->band != NL80211_BAND_2GHZ)
> +			rate_idx += IWL_FIRST_OFDM_RATE;
> +
> +		result = iwl_mld_mac80211_rate_idx_to_fw(mld, info, rate_idx);
>  	}
> 
>  	if (info->control.antennas)
> 
> --
> 2.55.0
>