[PATCH 1/3] MLD: Scan the channels of missing links for the ML probe

[Louis Kotze]

wpa_supplicant_connect_ml_missing() scanned only the channel of the
association link, relying on the AP MLD to respond to the ML probe
request with complete per-STA profiles for the missing links. Not all
AP MLDs respond to ML probe requests with that information (observed
with a TP-Link Deco BE65 in a 5 GHz + 6 GHz AP MLD configuration), in
which case the scan did not update the BSS table entries for the
missing links and the association proceeded without those links.

Include the channels of the missing links in the scan so that the
information can also get updated from the Beacon or Probe Response
frames of the affiliated APs themselves. The channels are known from
the RNR information in the association link's scan entry. Use the
wildcard BSSID for such a scan so that the affiliated APs on the other
channels respond to the probe requests; a probe request that carries
the association link's BSSID would be ignored by them.

Signed-off-by: Louis Kotze <loukot at gmail.com>
---
 wpa_supplicant/events.c | 28 ++++++++++++++++++++++++++--
 wpa_supplicant/scan.c   |  9 ++++++++-
 2 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
index 5faeddfbe..5995da113 100644
--- a/wpa_supplicant/events.c
+++ b/wpa_supplicant/events.c
@@ -1927,7 +1927,9 @@ static int wpa_supplicant_connect_ml_missing(struct wpa_supplicant *wpa_s,
 					     struct wpa_ssid *ssid)
 {
 	int *freqs;
+	unsigned int num_freqs, i;
 	u16 missing_links = 0, removed_links, usable_links;
+	u8 link_id;
 
 	if (!((wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_MLO) &&
 	      (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME)))
@@ -1948,7 +1950,7 @@ static int wpa_supplicant_connect_ml_missing(struct wpa_supplicant *wpa_s,
 		"MLD: Doing an ML probe for missing links 0x%04x",
 		missing_links);
 
-	freqs = os_malloc(sizeof(int) * 2);
+	freqs = os_malloc(sizeof(int) * (MAX_NUM_MLD_LINKS + 2));
 	if (!freqs)
 		return 0;
 
@@ -1956,7 +1958,29 @@ static int wpa_supplicant_connect_ml_missing(struct wpa_supplicant *wpa_s,
 	wpa_s->ml_connect_probe_bss = selected;
 
 	freqs[0] = selected->freq;
-	freqs[1] = 0;
+	num_freqs = 1;
+
+	/*
+	 * Also visit the channels of the missing links. The ML probe request
+	 * on the association link's channel is sufficient when the AP MLD
+	 * responds to it with complete per-STA profiles, but not all APs do
+	 * so. Scanning the channels of the missing links allows the
+	 * information to be updated from the Beacon or Probe Response frames
+	 * of the affiliated APs themselves.
+	 */
+	for_each_link(missing_links, link_id) {
+		int freq = selected->mld_links[link_id].freq;
+
+		if (!freq)
+			continue;
+		for (i = 0; i < num_freqs; i++) {
+			if (freqs[i] == freq)
+				break;
+		}
+		if (i == num_freqs)
+			freqs[num_freqs++] = freq;
+	}
+	freqs[num_freqs] = 0;
 
 	wpa_s->manual_scan_passive = 0;
 	wpa_s->manual_scan_use_id = 0;
diff --git a/wpa_supplicant/scan.c b/wpa_supplicant/scan.c
index b70505856..8be32d85f 100644
--- a/wpa_supplicant/scan.c
+++ b/wpa_supplicant/scan.c
@@ -1485,7 +1485,14 @@ ssid_list_set:
 		}
 	} else if (!is_zero_ether_addr(wpa_s->ml_probe_bssid)) {
 		wpa_printf(MSG_DEBUG, "Scanning for ML probe request");
-		params.bssid = wpa_s->ml_probe_bssid;
+		/*
+		 * When the scan visits the channels of the missing links in
+		 * addition to the association link's channel, use the wildcard
+		 * BSSID so that the affiliated APs on those channels respond
+		 * to the probe requests, too.
+		 */
+		if (!params.freqs || !params.freqs[0] || !params.freqs[1])
+			params.bssid = wpa_s->ml_probe_bssid;
 		params.min_probe_req_content = true;
 	}
 
-- 
2.55.0