How does rrm work?

anom3 · March 10, 2020, 12:04am

Any idea how to interpret the data returned by the beacon reports? I have no idea how to pull some sort of RSSI out of there and force a roam via bss-tm to the best AP.

I got pretty much everything working, except for that.

I am using hostapd_cli for what its worth, but when i specify multiple neighbor= parameters the client will always just roam to the first one I provide. Even if its clearly a weaker signal.

PolynomialDivision · March 19, 2020, 8:40am

I have done some Pull Request, that parses beacon reports:

ParanoidZoid · March 19, 2020, 9:54am

Forgive me for being a bit of a newbie, but once I patch the build dir with this - how can it be integrated in to this script?

PolynomialDivision · March 19, 2020, 10:36am

What do you mean by patch the build dir with this?

ParanoidZoid · March 20, 2020, 12:39pm

I patched openwrt/hostapd with your PR.

I'd like to just know if it does the job automatically once I set beacon_requests=1 or do I need to do something else like the umdns script in the previous posts in this thread.

EDIT:
Tested your patch and tested the command:

ubus call hostapd.wlan0 rrm_beacon_req '{"addr":"00:xx:xx:xx:xx:xx", "op_class":0, "channel":1,"duration":1,"mode":2,"bssid":"ff:ff:ff:ff:ff:ff", "ssid":""}

on QCA988X-ath10k-ct-htt, Archer A7v5, the following command works and logread gives me a hex string:

ubus call hostapd.wlan0 rrm_beacon_req '{"addr":"AA:BB:CC:XX:YY:ZZ", "op_class":1, "channel":48,"duration":100,"mode":0,"bssid":"ZZ:YY:XX:AA:BB:CC", "ssid":
"SSID"}'

It returns hex values like: 012a754b36

For ath10k-ct-htt, it was key that I set duration to 100 and mode to 0 for the report to be generated.

EDIT2:
My iPhone 11 Pro creates more detailed beacon reports and supports active/passive beacons. I don't want to post the hex output since using a Hex2ASCII converter shows my SSID and RegDomain settings.

kaputorwon · March 21, 2020, 2:23pm

I would like to know what happens when you issue a command "ubus call hostapd.wlan0 rrm_beacon_req" on the AP with the patch.

Does AP send an action frame to the client and client responds with neighbor AP list?

ParanoidZoid · March 21, 2020, 3:54pm

Yes, the AP sends an action rame to the client to initiate the beacon report request. Currently you have to manually specify a client that you'll receive reports from.
It responds with a hex string. Depending on the distance from the router, the hex string may or may not get cut off. When the SNR is low, the client produces a long hex string, which when converted to ASCII contains details on SSID and regdomain. However the rest of the message is garbled.

PolynomialDivision · March 21, 2020, 4:05pm

If you look at my commit message:

But you have to subscribe to notifications! Then the hex string will be automatically formated into a json object that gives you all information you need.

I did that here:

github.com

berlin-open-wireless-lab/DAWN/blob/master/src/utils/ubus.c#L1319


    if (ubus_register_subscriber(ctx, &hostapd_entry->subscriber)) {
        fprintf(stderr, "Failed to register subscriber!");
        return false;
    }


    list_add(&hostapd_entry->list, &hostapd_sock_list);


    return subscribe(hostapd_entry);
}


void subscribe_to_new_interfaces(const char *hostapd_sock_path) {
    DIR *dirp;
    struct dirent *entry;
    struct hostapd_sock_entry *sub = NULL;


    if (ctx == NULL) {
        return;
    }


    dirp = opendir(hostapd_sock_path);  // error handling?
    if (!dirp) {

And then you will receive blobmessages.

PolynomialDivision · March 21, 2020, 4:09pm

An easyer way is to delete that if:

And do

 ubus monitor

or more specific

ubus monitor [ubus hostapd inferface]

Then u don't have to write a whole daemon that is subscribing to this notifications.

Edit:

Okay the link does not work.

Delete in my patch:

if (!hapd->ubus.obj.has_subscribers)
		return;

Edit:
@ParanoidZoid, @kaputorwon: Please indicate on Github, that you tested the PR.

kaputorwon · March 21, 2020, 4:18pm

@ParanoidZoid, @kaputorwon: Please indicate on Github, that you tested the PR.
I have yet to test your patch since my build is not ready yet. It's very interesting. I appreciate your great work!

I would like to know how AP collects neighboring AP prior to sending neighboring report down to client. Where does AP keep the AP lists?

PolynomialDivision · March 21, 2020, 4:26pm

I tried several things. But currently, I had no time to go on.

You can try to send a neighbor-report-element with a bss-transition like I tried here:

github.com

berlin-open-wireless-lab/DAWN/blob/bandsteering/src/utils/ubus.c#L1091


    struct hostapd_sock_entry *sub;


blob_buf_init(&b, 0);
blobmsg_add_macaddr(&b, "addr", client_addr);
blobmsg_add_u32(&b, "duration", duration);


// ToDo: maybe exchange to a list of aps
void* nbs = blobmsg_open_array(&b, "neighbors");
if(dest_ap!=NULL)
{
    blobmsg_add_string(&b, NULL, dest_ap);
    printf("BSS TRANSITION TO %s\n", dest_ap);
}


blobmsg_close_array(&b, nbs);
list_for_each_entry(sub, &hostapd_sock_list, list)
{
    if (sub->subscribed) {
        int timeout = 1;
        ubus_invoke(ctx, id, "wnm_disassoc_imminent", b.head, NULL, NULL, timeout * 1000);
    }

So you guide the client to a specific AP. So bss transition is based on neighbor reports.

kaputorwon · March 21, 2020, 5:08pm

My intention is to exercise 11k protocol by itself. We have two RM capabilities in the beacon to enable through ubus call hostapd.wlan0 bss_mgmt_enable '{"neighbor_report":True, "beacon_report":True}'. I just wanted to find out how an AP collects neighbor AP list. My query is if AP collects neighbor ap list by scanning or by sending action frame to client and client responds with it's scan results. I am not attempting to do client guided roaming. Thanks.

PolynomialDivision · March 21, 2020, 7:02pm

There are different use cases:

AP exchange NB reports through backbone and clients request roaming possibilites through beacon
AP requests NB report from client to get hearing map information
...

I'm not sure, what else.

kaputorwon · March 21, 2020, 9:49pm

Thanks for the response. I am pursuing pt.#2 which you've done it with your patch, I guess.

PolynomialDivision · March 22, 2020, 11:48am

What are your plans in terms of coding? I sent a mail via openwrt mailing list and hopefully it is getting merged.

kaputorwon · March 22, 2020, 12:23pm

I have no plan to do any coding at the moment as regards to rrm feature. I'm just curious to see whether there is any of 802.11k feature/protocol in place in the OpenWrt. Anyway I appreciate your contribution!

PolynomialDivision · April 5, 2020, 8:56am

Could we maybe finally package that script?

ParanoidZoid · April 13, 2020, 5:08pm

In /etc/init.d/neighbor_report:

#!/bin/sh /etc/rc.common

START=90

USE_PROCD=1

radios=$(ubus list | grep hostapd.wlan)

start_service() {
	local rrm_own
	
	OIFS=$IFS
	IFS=$'\n'

	for value in ${radios}
	do
		rrm_own=${rrm_own}",$(ubus call ${value} rrm_nr_get_own | jsonfilter -e '$.value')"
	done

	IFS=$OIFS

	procd_open_instance
	procd_set_param command /bin/sh "/usr/bin/rrm"
	procd_add_mdns "rrm" "udp" "" "${rrm_own:1}"
	procd_close_instance
}

service_triggers()
{
	procd_add_reload_trigger wireless
}

In /usr/bin/rrm

#!/bin/sh

radios=$(ubus list | grep hostapd.wlan)

_discover_neighbors() {
	local rrm_neighbors

	ubus call umdns update
	sleep 2

	rrm_neighbors=$(ubus call umdns browse | jsonfilter -e '@["_rrm._udp"][*].txt')

	for value in ${rrm_neighbors}
	do
		rrm_nr_lists=${rrm_nr_lists}",${value}"
	done
}

_append_own() {
	for value in ${radios}
	do
		rrm_nr_lists=${rrm_nr_lists}",$(ubus call ${value} rrm_nr_get_own | jsonfilter -e '$.value')"
	done
}

while true
do
	OIFS=$IFS
	IFS=$'\n'

	rrm_nr_lists=""

	_discover_neighbors
	_append_own

	for value in ${radios}
	do
		ubus call ${value} bss_mgmt_enable '{"neighbor_report": true}'
		eval "ubus call ${value} rrm_nr_set '{ \"list\": [ ${rrm_nr_lists:1} ] }'"
	done

	sleep 60

	IFS=$OIFS
done

exit 0

These scripts would probably fare better if they were (1) integrated as easily as 802.11r is now enabled via mac80211.sh and (2) lives as a hotplud.d script watching the wlan0/wlan1 interface(s). Right now, I don't really have the time to figure this out myself and this script from @sotux and @muddyfeet does what it needs to do albeit a few caveats if something is shut down/rebooted.

Additionally, umdns is a requirement.

PolynomialDivision · April 17, 2020, 11:26am

I'm now able to set the nr reports for hostapd with dawn:

IanC · May 8, 2020, 1:35pm

I'm playing with the ubus commands to see how my devices respond to manual instructions. I'm finding that one of the APs is missing the wnm_disassoc_imminent method from ubus -v list hostapd.wlan0-1.

/tmp/run/hostapd-phy0.conf look very similar on each device, and both have disassoc_low_ack=1

Can anyone give me a clue if that is a hardware, driver, configuration or perhaps package snag?

In case it helps, the one without the method is running ath79/tiny DTS style, the one with it is ar71xx/nand.

EDIT: Looks like this may depend on hostapd and / or other things being compiled with CONFIG_WNM_AP defined...