I'm working on background scan algorithm. In backport 5.4-rc8-1 from openwrt I found an issue on background scan in mac80211. In background scan we must send a power save indication to the AP to avoid packets lost during the scan. The previous version of mac80211 (a very old version) used a null function to send the power save status to the AP. In this backport (5.4-rc8-1) this null function was replaced by QOS null function, and this frame is never sent when the power save bit is set to 1. I found the origin of this issue and she still present in the latest version of mac80211. In the function ieee80211_tx_h_check_assoc from net/mac80211/tx.c a test is wrong. Please find below the part of the patch necessary to fix this issue (the other hunk in my patch concern my work). @@ -297,7 +297,8 @@ ieee80211_tx_h_check_assoc(struct ieee80 if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) && test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) && !ieee80211_is_probe_req(hdr->frame_control) && - !ieee80211_is_nullfunc(hdr->frame_control)) + !ieee80211_is_nullfunc(hdr->frame_control) && + !ieee80211_is_qos_nullfunc(hdr->frame_control)) /* * When software scanning only nullfunc frames (to notify * the sleep state to the AP) and probe requests (for the Sorry I know it is not correctly formated, but at this time I cannot generated a correct patch. This patch is very easy to apply in the main branch. Regards. Cédric Voncken