[PATCH 0/3] MLD: Scan each missing link separately after the ML probe

[Louis Kotze]

wpa_supplicant_connect_ml_missing() sends a multi-link probe request on
the channel of the association link and then associates with whatever
link information the AP MLD returned. Not all AP MLDs return the per-STA
profiles of the requested APs, and the association then proceeds without
those links.

This series adds a second phase: once the multi-link probe response has
been processed, each link that is still missing is scanned on its own
channel with the Probe Request frame addressed to the affiliated AP of
that link and without a Probe Request Multi-Link element. The channel
and the BSSID of each link come from the RNR information in the scan
entry of the association link.

This replaces commit 517b0d7cc841 ("MLD: Scan the channels of missing
links for the ML probe"), which was reverted in 439c946b5 after
Michael-cy Lee pointed out that adding the channels to the multi-link
probe scan forced the BSSID out of the scan request, so the Probe
Request frames went out with a broadcast Address 3, contrary to IEEE Std
802.11be-2024, 35.3.4.2.

The channels cannot be folded back into the multi-link probe scan. Only
a single BSSID can be specified per scan request, so the correct Address
3 for each link is not expressible within one scan, and using the
association link's BSSID would leave cfg80211 filtering the channel of a
co-located 6 GHz affiliated AP out of the scan.

Patch 1 adds a hostapd testing option that leaves the requested per-STA
profiles out of the multi-link probe response, since hostapd always
includes them and the case could otherwise not be reproduced in hwsim.
Patch 2 is the wpa_supplicant change. Patch 3 is the test.

Testing: in hwsim, an AP MLD with three links where two are missing from
the multi-link probe response ends up associating with all three, one
directed scan per missing link, and the Probe Request frames for those
scans carry the affiliated AP's BSSID in Address 3 and no Multi-Link
element. Without patch 2 the same test fails with the links absent. The
remaining eht test cases pass here, apart from one that needs brctl and
five that need CONFIG_WPA_TRACE_BFD.

On a TP-Link Deco BE65, scanning only the 5 GHz channel leaves the 6 GHz
affiliated link missing, the AP does not describe it in the multi-link
probe response, and the new scan finds it and carries it into the
association request as link 2. Without this series the link is not
discovered at all, since an unrestricted scan does not find it either: 6
GHz is passive-scan under the regulatory rules in force here.

That AP then sent no Association Response to any of the three
association requests that carried two links, on either anchor: two timed
out and the third was torn down locally before a response arrived, and
the connection fell back to single link. This is not rate limiting,
since single-link association requests succeeded in the same runs. The
extra work is bounded to one scan per link that the AP MLD did not
describe, but on that AP the net effect is a slower connect for the same
single-link result, which is worth knowing before this is applied.

Michael, you offered to test this on an AP MLD. The question I cannot
answer here is whether an AP MLD that does answer a multi-link
association accepts the link once the client has discovered it this way.
Patch 1 reproduces the case on any hostapd built with
CONFIG_TESTING_OPTIONS, using no_ml_probe_sta_profiles=1, so this does
not need particular hardware. The lines to look for in the
wpa_supplicant debug log are "MLD: Scan link N (<bssid> <freq> MHz) that
is still missing after the ML probe" and "Scan a previously specified
BSSID <bssid>", followed by valid_links in the following "MLD: In
association" line.

Louis Kotze (3):
  AP: Add testing option to omit per-STA profiles from ML probe response
  MLD: Scan each missing link separately after the ML probe
  tests: MLD association with links missing from the ML probe response

 hostapd/config_file.c             |  2 +
 src/ap/ap_config.h                |  1 +
 src/ap/beacon.c                   |  8 +++
 tests/hwsim/test_eht.py           | 58 +++++++++++++++++++
 wpa_supplicant/bss.c              |  1 +
 wpa_supplicant/events.c           | 96 +++++++++++++++++++++++++++++++
 wpa_supplicant/notify.c           |  1 +
 wpa_supplicant/wpa_supplicant.c   |  1 +
 wpa_supplicant/wpa_supplicant_i.h |  5 ++
 9 files changed, 173 insertions(+)


base-commit: 72947de47ebab3748283eabf1459ba9aebad7288
-- 
2.55.0