From 8cd10f487c8144d462a510812ba0fa717b3e24df Mon Sep 17 00:00:00 2001 From: Markus Fritsche Date: Mon, 18 May 2026 15:56:34 +0200 Subject: [PATCH] bes2600: scan-filter-5ghz: allow targeted single-channel scans (besser#1 follow-up) The original Patch I refused EVERY 5 GHz scan request unconditionally (req->n_channels > 0 && band == NL80211_BAND_5GHZ). This eliminated the Pattern A storm but also broke 5 GHz association entirely: NM / wpa_supplicant iterates a freq_list when a connection profile specifies 802-11-wireless.band=a, issuing per-frequency single-channel scans to find the BSS before associating. Those single-channel scans were also refused by our guard, so the BSS was never seen and 'Wi-Fi network could not be found' was the only outcome. Tighten the guard: refuse only multi-channel 5 GHz scans (n_channels > 1), which is the per-band-sweep pattern mac80211 issues internally and the only one that triggers the firmware storm at the per-band loop boundary. Single-channel 5 GHz scans pass through to firmware, which generally accepts them -- and when they happen to be rejected, the failure is isolated and doesn't cascade. Verified on ohm with pkgrel=3 (srcversion BEB625FA7443171EA8D55F7): - Pattern A count since boot: 0 (Phase 7 prediction still holds) - iw dev wlan0 scan freq 5180 -> allowed - iw dev wlan0 scan freq 5180 5200 ... -> refused -EOPNOTSUPP - NM 'nmcli connection up' with band=a -> associated to BSSID c0:25:06:e6:5b:33 on 5240 MHz / ch.48 in ~1 second - TX bitrate 150 Mbit/s MCS 7 40MHz short-GI (vs 72.2 Mbit/s HT20 on 2.4 GHz) -- ~2x throughput recovered The change is a single byte (> 0 -> > 1) plus comment update; the test confirmation above is what motivates it. Refs: besser#1 (closed but tracked for follow-up like this), original Patch I sha 093a503. --- bes2600/scan.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/bes2600/scan.c b/bes2600/scan.c index a81afb6..497523b 100644 --- a/bes2600/scan.c +++ b/bes2600/scan.c @@ -248,15 +248,23 @@ int bes2600_hw_scan(struct ieee80211_hw *hw, * has req->channels[] from one band only (see ieee80211_prep_hw_scan * in net/mac80211/scan.c). Refuse the 5 GHz iteration at the driver * boundary so userspace gets a clean aborted-scan for that portion - * rather than waiting for the firmware reject to cascade up. 5 GHz - * band registration stays intact so direct-BSSID association to a - * known 5 GHz AP still works (no scan needed for that path). + * rather than waiting for the firmware reject to cascade up. + * + * Only the multi-channel case is refused (n_channels > 1): that's + * the per-band-sweep pattern mac80211 issues internally and the + * one that triggers the firmware storm at the per-band loop + * boundary. Single-channel 5 GHz scans (BSS verification, NM's + * per-freq iteration when 802-11-wireless.band=a is set) pass + * through to firmware, which generally accepts them since the + * storm is the back-to-back per-band issue, not a blanket 5 GHz + * reject. This preserves 5 GHz association via the + * "wpa_supplicant iterates freq_list per channel" path. * * Contract: per include/net/mac80211.h struct ieee80211_ops.hw_scan * documentation, a negative return aborts the scan without requiring * ieee80211_scan_completed(). */ - if (req->n_channels > 0 && + if (req->n_channels > 1 && req->channels[0]->band == NL80211_BAND_5GHZ) return -EOPNOTSUPP;