WPA_CLI showing access point as connected when it shouldn't

Question

I'm using linux kernel 3.3 and am trying to use the wpa_cli utility to monitor the status of my WiFi connection. I'm using an Edimax WiFi dongle to connect to a wireless access point.

Normally I see something like this:

# wpa_cli status
Selected interface 'wlan0'
wpa_state=SCANNING
ip_address=XXX.XXX.XXX.XXX
address=XX:XX:XX:XX:XX:XX

Or the same thing but with wpa_state=COMPLETED.

Parsing the this text output allows me to see if my wireless connection is active or scanning. However, I have noticed that after powering off my access point wpa_state=COMPLETED is still being returned. Using the command:

# iwlist wlan0 scanning

Forces a scan and wpa_state will be correct.

Forces a scan and wpa_state will occasionally be correct, but usually not.

I'm wondering if I have a configuration incorrect somewhere, or if there's a more efficient way to do this (I'm essentially just wanting to see if my interface has an active connection or not). Here is /etc/wpa_supplicant.conf:

ctrl_interface=/var/run/wpa_supplicant
ap_scan=1
country=US


network={
    ssid="myssid"
    psk="mypsk"
    key_mgmt=WPA-PSK
    eap=
}

I would prefer to not force a scan every time, but instead let the driver/kernel modules handle that. This is my first time working with WiFi in Linux so I think it seems likely that I have configured something incorrectly. Can anyone point me in the right direction?

Update:

After some further investigation, I believe something weird is happening causing the kernel to return a cached version of the AP list. I am using the RTL8192cu driver, so I have begun debugging this. I think my issue may be related to this, but not the same exact bug as I have a more recent kernel then the 2.6 kernel used there.

Update 2:

My belief is that the issue may be somewhere in the kernel. In the file net/mac80211/scan.c, at line 214 in function ieee80211_scan_rx, I see a bssid from the BSS of my AP appear (when AP has power) and get put via ieee80211_rx_bss_put (here). At this point, it is returned in scan results and wpa_supplicant causes the MLME layer in the kernel to authenticate and connect with that AP. However, after disconnecting AP power, I never see the MLME layer relinquish it's atomic_t hold on that BSS. This causes the BSS to never to unlinked in the function cfg80211_bss_expire at the end of a scan (cfg80211_wext_giwscan), in file net/wireless/scan.c, line 205 (here).

Is there some configuration with wpa_supplicant I need to add to have the MLME layer decrement it's hold on the BSS, or is this clearly a kernel bug?

I've already tried:

# wpa_cli bss_expire_age 10
# wpa_cli bss_expire_count 2

and have not resolved my issue.

Solution

So after a lot of digging, I found that the issue was because of the kernel's rtlwifi driver. To me, it looks like the rtl8192cu driver was suppose to be responsible for handling missed beacons, by calling the function ieee80211_beacon_loss, but that call is nowhere to be found. I removed support for IEEE80211_HW_BEACON_FILTER in the rtlwifi driver and the issue has been fixed.

This patch is essentially the same changes that I made, and the comments in this file are part of what led to me this answer.

Comments

[ojs]

Think you should ask this question in the Linux Kernel Mailing List.

[zeus_masta_funk]

Good point. I will try that next and update here if I here anything. I have waited til this point because of the age of my kernel, but hopefully that will not be an issue.