[PATCH 0/3] MLD: Fix association failures from stale per-link BSS entries

[Louis Kotze]

Association with an AP MLD fails or silently degrades to fewer links
when the scan entry for an affiliated link is older than the kernel
accepts for association. cfg80211 requires a scan entry newer than 30
seconds (IEEE80211_SCAN_RESULT_EXPIRE) for every requested link, while
wpa_supplicant considered a link usable as long as its entry was still
in the local BSS table (up to bss_expiration_age, 180 seconds by
default). Since the entries for the links of the current AP MLD are not
refreshed while associated, a reassociation or roam attempt after about
30 seconds of idle time included a link whose entry the kernel had
already expired. The association then failed with

nl80211: kernel reports: Error fetching BSS for link
wlan0: nl80211: MLME command failed (assoc): ret=-2 (No such file or directory)

after which the partner link BSSID was ignore-listed for 10 seconds and
the retry came up with fewer links, i.e., the connection silently
degraded to single-link.

Observed and reproduced on rtw89 (RTL8922AU) against a TP-Link Deco
BE65 5 GHz + 6 GHz AP MLD. MT7925 users report the same signature at
MLO roam time, attributed there to the driver/firmware.

The first patch makes the ML probe scan also visit the channels of the
missing links (with the wildcard BSSID so the affiliated APs respond),
since not all AP MLDs respond to an ML probe request with complete
per-STA profiles (the Deco BE65 does not). The second patch treats a
stale per-link entry as missing so that the ML probe mechanism
refreshes it before association, and so that a link that still cannot
be refreshed gets excluded from the association request instead of
failing the whole attempt in the kernel. The third patch adds an hwsim
test case covering reassociation with stale entries.

Tested with hwsim (the new test case fails without the two fixes,
reproducing the exact failure signature above, and passes with them;
eht_mld_connect_probes and eht_mld_connect_probes_hidden still pass)
and on real hardware (rtw89/RTL8922AU + Deco BE65), where the
previously failing idle reassociation now sends the ML probe on both
channels, refreshes the stale partner link entry, and builds the
two-link association request without the kernel error. Completing that
association against this AP is currently blocked by what looks like an
unrelated regression on the main branch (duplicated IEs in the
association request when two links are included, which this AP answers
to with silence; wpa_supplicant 2.11 sends each IE once and associates
on both links). I will follow up on that separately once bisected.

Louis Kotze (3):
  MLD: Scan the channels of missing links for the ML probe
  MLD: Treat stale per-link scan entries as missing links
  tests: MLD reassociation with stale per-link BSS entries

 tests/hwsim/test_eht.py | 49 +++++++++++++++++++++++++++++++++++++++++
 wpa_supplicant/bss.c    | 28 +++++++++++++++++++++++
 wpa_supplicant/events.c | 28 +++++++++++++++++++++--
 wpa_supplicant/scan.c   |  9 +++++++-
 4 files changed, 111 insertions(+), 3 deletions(-)

-- 
2.55.0