802.11kvr Roaming

AN14212

802.11kvr, roaming, bgscan, wpa supplicant, fast transition, resource management, basic service set transition management, neighbor report, beacon report, wireless network management

NXP B.V.

802.11kvr Roaming

13 gen 2025 — NXP Wi-Fi radios support 802.11kvr roaming standards: • 802.11k (Radio Resource Measurement): provides information about the available APs and respective ...

AN14212: 802.11kvr Roaming – Application note

IW611: 2.4/5 GHz Dual-band 1x1 Wi-Fi 6 (802.11ax) Bluetooth 5.4 Solution | NXP Semiconductors

PDF Viewing Options

Not Your Device? Search For Manuals or Datasheets below:

File Info : application/pdf, 35 Pages, 1.49MB

Document DEVICE REPORTAN14212

AN14212
802.11kvr Roaming
Rev. 2.0 -- 13 January 2025

Application note

Document information

Information

Content

Keywords

802.11kvr, roaming, bgscan, wpa_supplicant, fast transition, resource management, basic service set transition management, neighbor report, beacon report, wireless network management

Abstract

Explains how to enable fast transition, configure wpa_supplicant, load the driver parameters. And describes different types of fast transition.

NXP Semiconductors

AN14212
802.11kvr Roaming

1 Introduction
NXP Wi-Fi radios support 802.11kvr roaming standards:
· 802.11k (Radio Resource Measurement): provides information about the available APs and respective RSSI to help the client choose the best AP.
· 802.11v (Wireless Network Management): provides information to the client about available APs for roaming, without a full scan.
· 802.11r (Fast Basic Service Set Transition): eliminates the need for fresh authentication when a client roams to another network.
This document explains how to use 802.11kvr for roaming.
Note: 802.11kvr is supported only in STA mode. Mobile AP mode does not support 802.11k, 802.11v, and 802.11r standards.
1.1 Supported devices
Refer to the feature list in the release note to check if 802.11kvr is supported in the software release package. The wireless SoCs that support 802.11kvr are:
· 88W8987 [5] · 88W8997 [6] · 88Q9098 [7] · 88W9098 [8] · IW416 [13] · IW611 [14] · IW612 [15] · IW620 [16] · AW611 [9] · AW690 [10] · AW692 [11] · AW693 [12]
1.2 Prerequisites
· Open source wpa_supplicant v2.10 or higher [17] · Open source kernel v4.6 or higher

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors
2 802.11kvr
Figure 1 shows the interaction between 802.11k, 802.11v, and 802.11r for roaming.

AN14212
802.11kvr Roaming

Before roaming: Reduce scan time
802.11k

Trigger roaming: Recommend STA to roam to better AP

Provides Neighbor Report

802.11v

Fast Transition to better AP

Time to roam! BSS transition management (BTM)

802.11r
During roaming: Reduce authentication time
Figure 1.Overview of 802.11kvr
802.11k is a Radio Resource Management (RRM) that provides mechanisms for APs and clients to dynamically measure the available radio resources. APs and clients can send neighbor reports, beacon reports, and link measurement reports to each other. · Neighbor reports: information about known neighbor APs to help STA better understand its surroundings · Beacon reports: information about channel configuration, location, coverage/frequency planning, and AP
detection · Link measurement reports: information about a requested link 802.11v is BSS transition management (BTM) with Wireless Network Management (WNM) that allows client devices to exchange information about the network topology. The information includes RF environment, making each client network aware of its surroundings. STA can send a BTM query to the AP and get a list of preferred candidates. · BTM query: A connected AP suggests the STA to roam to another APs with a better connection with a
preferred candidate list. 802.11r is Fast Basic Service Set Transition (FT), which is faster than normal roaming because it avoids a 4way handshake when transitioning from one AP to another. The two types of FT are over-the-air and over-thedistribution-system (over-the-DS).

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

3 Configuration
This section explains how to configure 802.11kvr.
3.1 Driver load parameters
To enable 802.11kvr, load the driver with the parameters:
host_mlme=1 cfg80211_wext = 0xf (STA mask of CFG80211 and WEXT control)
Note: For more details about the driver load parameters, refer to README in the SW release package. Example of driver loading:
insmod mlan.ko insmod moal.ko fw_name=nxp/<fw_name>.bin cfg80211_wext=0xf auto_ds=2 ps_mode=2
txpwrlimit_cfg=nxp/<power_table>.bin cal_data_cfg=nxp/WlanCalData.conf host_mlme=1 drvdbg=0x20037
Note: Setting dvrdbg = 0x20037 is optional and used to log roaming messages on dmesg.

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

3.2 wpa_supplicant
wpa_supplicant is the MAC Sublayer Management Entity (MLME) to send/receive RRM action frames, FT action frames, and BTM frames. Refer to /wpa_supplicant/README for more information. Note: Open source wpa_supplicant version v.2.10 or above must be used. wpa_supplicant must be built with the flag, CONFIG_80211R enabled. Step 1 Download wpa_supplicant open source code (wpa_supplicant-2.10.tar.gz) (see [17]). Step 2 Decompress the file.
tar -xvf wpa_supplicant-2.10.tar.gz
Step 3 Move to the wpa_supplicant directory. See Figure 2.
cd wpa_supplicant

Figure 2.wpa_supplicant directory content

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

Step 4 Enable the IEE80211R flag in the .config file.

CONFIG_IEEE80211R=y

Step 5 Build wpa_supplicant.

make

Example of output:

CC ../src/drivers/driver_nl80211.c CC ../src/drivers/driver_nl80211_capa.c CC ../src/drivers/driver_nl80211_event.c CC ../src/drivers/driver_nl80211_monitor.c ...

Step 6 Create the configuration file wpa_supplicant.conf. Example of wpa_supplicant.conf content:

ctrl_interface=/var/run/wpa_supplicant

ctrl_interface_group=0

update_config=1

ap_scan=1

network={

ssid="TEST_NETWORK"

key_mgmt=FT-PSK

# Fast Transition Key Management

proto=RSN

pairwise=CCMP

group=CCMP

psk="1234567890"

bgscan="simple:30:-75:120"

# Background scan settings

}

· Set the key management to FT-PSK or FT-EAP.

key_mgmt=FT-PSK key_mgmt=FT-EAP

· Set the background scanning parameters.

bgscan="simple :<short scan interval> : <signal strength threshold> : <long scan interval>"

Where: Table 1.Command parameters Parameter short scan interval
signal strength threshold long scan interval

Description
Perform a scan every X seconds when the signal strength is weaker than the threshold
Signal strength from AP (dBm)
Perform a scan every X seconds when the signal strength is higher than the threshold

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

Example of command:
bgscan="simple:30:-75:120"
In the example, a scan is performed every 30 seconds when the signal strength from the current AP is below -75dBm. If the signal strength is above -75dBm, the interval is every 120 seconds. Step 7 Run wpa_supplicant.
wpa_supplicant -B -Dnl80211 -<interface> -c/etc/wpa_supplicant.conf

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

4 wpa_cli
Once 802.11kvr is enabled, wpa_supplicant automatically handles roaming. The command line interface wpa_cli is used to interact with wpa_supplicant and trigger the following actions:
· Neighbor report · BTM query · Over-the-Air Fast Transition · Over-the-DS Fast Transition

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

5 Setup
The setup to demonstrate 802.11kvr consists of: · Enterprise Wireless LAN controller · at least two APs · at least one STA Note: Refer to the user manual of your Enterprise controller and APs to enable 802.11kvr.

Wireless LAN Controller

AP 1

AP 2

STA
Figure 3.802.11kvr set up example Step 1 Connect the APs to the Wireless LAN controller. Figure 4 shows the AP enabled with 802.11kvr. · AP MAC= d0:4d:c6:b2:07:32 · 802.11kvr (Link measurement and Neighbor report) is enabled in the AP.

Figure 4.Example of AP enabled with 802.11kvr

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

Step 2 Bring up the DUT in STA mode and define the configuration (Section 3).
Step 3 Connect the STA to the AP.
Figure 5 shows the STA enabled with 802.11kvr.
· AP MAC= d0:4d:c6:b2:07:32 · STA MAC= 00:04:9f:06:7a:f6 · STA and AP exchange association request and responses. · 802.11kvr (Link measurement and Neighbor report) is enabled in the Wi-Fi environment.

Figure 5.Example of STA enabled with 802.11kvr

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

6 802.11k examples
This section provides examples for Neighbor Report, Link measurement, and Beacon report.
6.1 Neighbor report
The example demonstrates a Neighbor report request from the STA. AP 1 responds with a list of neighboring APs on the same Wi-Fi network, including AP 2. If there are no other APs in the environment, the neighbor report is empty. wpa_supplicant handles the Neighbor reports. A wpa_cli command (in step 2) can be used to manually request a neighbor report.

Wireless LAN Controller

AP 1

AP 2

Neighbor Report Request

Neighbor Report Response

STA

Figure 6.Setup for Neighbor report
Step 1 Set up the environment (Section 5).
Step 2 Run the wpa_cli command to trigger a Neighbor report request.
./wpa_cli neighbor_rep_request
Command output example:
The log shows STA sending "RRM: Neighbor report request" to the AP.
RRM: Neighbor report request (for ), token=4 nl80211: Send Action frame (ifindex=3, freq=2422 MHz wait=0 ms no_cck=0 offchanok=1) nl80211: Drv Event 60 (NL80211_CMD_FRAME_TX_STATUS) received for mlan0 nl80211: Frame TX status event A1=00:11:32:ed:9e:b0 stype=13 cookie=0xf6573dff ack=1 nl80211: Frame TX status: cookie=0xf6573dff (match) (ack=1) mlan0: Event TX_STATUS (16) received mlan0: EVENT_TX_STATUS dst=00:11:32:ed:9e:b0 type=0 stype=13 Off-channel: Ignore Action TX status - no pending operation nl80211: BSS Event 59 (NL80211_CMD_FRAME) received for mlan0 nl80211: RX frame da=c0:95:da:00:e5:38 sa=00:11:32:ed:9e:b0 bssid=00:11:32:ed:9e:b0
freq=2422 ssi_signal=0 fc=0xd0 seq_ctrl=0x60 stype=13 (WLAN_FC_STYPE_ACTION) len=27 mlan0: Event RX_MGMT (18) received mlan0: Received Action frame: SA=00:11:32:ed:9e:b0 Category=5 DataLen=2 freq=2422 MHz

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

Figure 7 shows a sniffer capture example of the Neighbor Report Request from the STA to the AP.
· STA MAC= 00:04:9f:06:7a:f6 · AP MAC= d0:4d:c6:b2:07:32

Figure 7.Example of Neighbor report request from STA to AP
Step 3 Look for AP response (Neighbor report displayed on the console of the STA).
Command output example:
The log shows "RRM: New Neighbor Report".
<3>CTRL-EVENT-SCAN-RESULTS <3>RRM-NEIGHBOR-REP-RECEIVED bssid=dc:ce:c1:23:9a:4b info=0x2f7 op_class=115 chan=40
phy_type=7 <3>RRM-NEIGHBOR-REP-RECEIVED bssid=dc:ce:c1:23:9a:44 info=0x2e7 op_class=81 chan=1
phy_type=7 <3>CTRL-EVENT-SCAN-STARTED <3>CTRL-EVENT-SCAN-RESULTS ... RRM: New Neighbor Report - hexdump(len=31): 02 34 0d d0 4d c6 b2 07 32 f7 02 00 00 7d a1
07 34 d0 4d c6 b2 07 12 e7 02 00 00 51 0b 07 mlan0: RRM: Notifying neighbor report (token = 2) mlan0: RRM-NEIGHBOR-REP-RECEIVED bssid= d0:4d:c6:b2:07:32 info=0x2f7 op_class=125
chan=161 phy_type=7 mlan0: RRM-NEIGHBOR-REP-RECEIVED bssid= d0:4d:c6:b2:07:12 info=0x2e7 op_class=81 chan=11
phy_type=7

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors
Figure 8 shows a sniffer capture example of Neighbor report response from the AP. · AP MAC= d0:4d:c6:b2:07:32 · STA MAC= 00:04:9f:06:7a:f6

AN14212
802.11kvr Roaming

Figure 8.Neighbor report response from the AP

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

6.2 Link measurement
wpa_supplicant initiates link measurement requests and responses to and from the AP and STA. In this example, the STA sends a link measurement report to the AP.

Wireless LAN Controller

AP 1

AP 2

Link Measurement Request

Link Measurement Response

STA

Figure 9.Link measurement setup
Step 1 Set up the environment (Section 5). Step 2 The AP sends a link measurement request to the STA. The request shows on the console of the STA. Example of output:
mlan0: Received Action frame: SA=cc:88:c7:10:d7:11 Category=5 DataLen=31 freq=5805 MHz Measurement request type 5 token 151 SSID subelement with zero length - wildcard SSID
Figure 10 shows an example of the STA receiving a link measurement request from the AP. · AP MAC= d0:4d:c6:b2:07:32 · STA MAC= 00:04:9f:06:7a:f6

Figure 10.Example of STA receiving link measurement request from the AP

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

Step 3 STA responds with a link measurement response on the console. Command output example:
RRM: Radio Measurement report - hexdump(len=35): 27 21 97 00 05 80 a1 00 00 00 00 00 00 00 00 00 00 09 3e ff cc 88 c7 10 d7 11 00 00 00 00 00 02 02 01 00
nl80211: Send Action frame (ifindex=3, freq=5805 MHz wait=0 ms no_cck=0 offchanok=1)
Figure 11 shows an example of link measurement response from STA to AP. · AP MAC= d0:4d:c6:b2:07:32 · STA MAC= 00:04:9f:06:7a:f6

Figure 11.Example of link measurement response from the STA to the AP

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

6.3 Beacon report
wpa_supplicant initiates the STA and AP to send beacon reports to each other. In this example, the STA sends a beacon report to the AP.

Wireless LAN Controller

AP 1

AP 2

Send Beacon Report
STA
Figure 12.Beacon report setup Step 1 Set up the environment (Section 5). Step 2 STA sends a beacon report to the AP. Figure 13 shows a sniffer capture example of the STA sending a Beacon Report to the AP. · AP MAC= d0:4d:c6:b2:07:32 · STA MAC= 00:04:9f:06:7a:f6

Figure 13.Example of the STA sending a beacon report to the AP

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

7 802.11v example
The example shows a BSS transition management query (BTM) from the STA. The AP responds with a request for the STA to roam based on a preferred candidate list. The request is in a BSS management frame.
If the AP is configured with disassociation imminent function enabled, the STA is forced to roam to a better AP. If disassociation imminent function is disabled, the STA can reject or accept the request. Refer to the user manual of the AP manual for this configuration.
wpa_supplicant handles BTM queries. Issue a wpa_cli command (in step 2) to manually send a BTM query.
Figure 14 shows the BTM query sequence, where:
1. BTM query 2. BTM request 3. BTM response

Wireless LAN Controller

AP 1

AP 2

12 3

STA
Figure 14.BTM query communication Step 1 Set up the environment (Section 5). Step 2 Issue a wpa_cli command to trigger a BTM query.
./wpa_cli wnm_bss_query 1

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

Command output example:
WNM: Send BSS Transition Management Query to 00:11:32:ed:9e:b0 query_reason=1 nl80211: Send[ 3172.437052] wlan: mlan0 START SCAN Action frame (ifindex=3, freq=2422 MHz wait=0 ms no_cck=0 offchanok=1) OK nl80211: Drv Event 60 (NL80211_CMD_FRAME_TX_STATUS) received for mlan0 nl80211: Frame TX status event A1=00:11:32:ed:9e:b0 stype=13 cookie=0x75319743 ack=1 nl80211: Frame TX status: cookie=0x75319743 (match) (ack=1) mlan0: Event TX_STATUS (16) received mlan0: EVENT_TX_STATUS dst=00:11:32:ed:9e:b0 type=0 stype=13 Off-channel: Ignore Action TX status - no pending operation nl80211: BSS Event 59 (NL80211_CMD_FRAME) received for mlan0 nl80211: RX frame da=c0:95:da:00:e5:38 sa=00:11:32:ed:9e:b0 bssid=00:11:32:ed:9e:b0
freq=2422 ssi_signal=0 fc=0xd0 seq_ctrl=0x90 stype=13 (WLAN_FC_STYPE_ACTION) len=54 mlan0: Event RX_MGMT (18) received mlan0: Received Action frame: SA=00:11:32:ed:9e:b0 Category=10 DataLen=29 freq=2422 MHz WNM: RX action 7 from 00:11:32:ed:9e:b0
Figure 15 shows the example where the STA sends a BTM query to the AP 1.
· STA MAC= c0:95:da:00:e5:38 · AP MAC= dc:ce:c1:23:9a:4b

Figure 15.Example of STA sending a BTM query to the AP 1

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

Step 3 AP 1 sends STA a BTM request with a preferred candidate list. The request is displayed on the console of the STA. The STA decides whether to roam or not based on this information.
dmesg output example:
WNM: BSS Transition Management Request: dialog_token=1 request_mode=0x1 disassoc_timer=0 validity_interval=100
mlan0: WNM: Preferred List Available WNM: Neighbor report tag 52 WNM: Subelement id=6 le[ 3172.532203] wlan: SCAN COMPLETED: scanned AP count=1 n=3 WNM: Subelement id=3 len=1 ... WNM: BSS Transition Candidate List 0: 00:11:32:ed:9e:b0 info=0x17 op_class=12 chan=3 phy=0 pref=1 freq=2422 WNM: Candidate list valid for 10240 ms mlan0: WNM: Fetch current scan results from the driver for checking transition candidates nl80211: Received scan results (1 BSSes) nl80211: Scan results indicate BSS status with 00:11:32:ed:9e:b0 as associated mlan0: WNM: No transition candidate matches existing scan results WNM: Scan 1 frequencies based on transition candidate list WNM: Scan only for a specific BSSID since there is only a single candidate
00:11:32:ed:9e:b0 mlan0: Setting scan request: 0.000000 sec mlan0: Starting AP scan for wildcard SSID WPS: Building WPS IE for Probe Request WPS: * Version (hardcoded 0x10) WPS: * Request Type WPS: * Config Methods (3108) WPS: * UUID-E WPS: * Primary Device Type WPS: * RF Bands (3) WPS: * Association State WPS: * Configuration Error (0) WPS: * Device Password ID (0) WPS: * Manufacturer WPS: * Model Name WPS: * Model Number WPS: * Device Name WPS: * Version2 (0x20) P2P: * P2P IE header P2P: * Capability dev=25 group=00 P2P: * Listen Channel: Regulatory Class 81 Channel 6 mlan0: Optimize scan based on previously generated frequency list mlan0: Scan a previously specified BSSID 00:11:32:ed:9e:b0 and SSID synology_wifi_2.4G mlan0: Add radio work 'scan'@0xaaab1e40e190 mlan0: First radio work item in the queue - schedule start immediately mlan0: Starting radio work 'scan'@0xaaab1e40e190 after 0.000030 second wait mlan0: nl80211: scan request nl80211: Scan for a specific BSSID: 00:11:32:ed:9e:b0 Scan requested (ret=0) - scan timeout 30 seconds nl80211: Drv Event 33 (NL80211_CMD_TRIGGER_SCAN) received for mlan0 mlan0: nl80211: Scan trigger

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors
Figure 16 shows an example of BTM query request from the AP to the STA. · STA MAC= c0:95:da:00:e5:38 · AP MAC= dc:ce:c1:23:9a:4b · Preferred candidate list with the AP BSSID = 00:a6:ca:42:8b (AP 2). · Dissociation Imminent enabled. STA is forced to roam.

AN14212
802.11kvr Roaming

Figure 16.Example of BTM query request from the AP to the STA

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

Step 4 STA responds to the request of AP1 to roam to a different AP.
Note: STA roams using 802.11r. Refer to Section 9.
Figure 17 shows an example of the STA response to AP 1 with the decision to roam to AP 2.
· STA MAC= c0:95:da:00:e5:38 · AP MAC= dc:ce:c1:23:9a:4b · BSS Transition Target BSS = 00:a6:ca:42:8b (decides to roam to AP 2)

Figure 17.Example of the STA response to AP 1

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

8 802.11r examples
This section provides an example for over-the-air and over-the-distribution-system (over-the-DS) Fast Transition. A EAPoL key 4-way handshake is not required for FT.
8.1 Over-the-air fast transition (FT)
In Over-the-Air FT, the STA directly communicates with the target AP using IEEE 802.11 FT-Auth and FT(Re)Association during the FT association flow. The capability for FT is advertised in the Beacon Mobility Domain Information Element of the AP. In this example, the wireless LAN controller is configured for over-the-air FT. The STA is connected to AP1 at location A. As the STA moves closer to AP2 at location B, the received signal strength from AP1 drops below the set signal threshold. The STA automatically switches to AP2. wpa_supplicant handles Over-the-Air FT. The following wpa_cli command can also be used to manually trigger Over-the-Air FT.
./wpa_cli -i mlan0 ROAM <MACaddress of Target AP >
Figure 18 shows Over-the-Air FT communication. The arrows represent the Over-the-Air FT sequence: 1. Authentication 2. Authentication 3. Reassociation Request 4. Reassociation Response

Wireless LAN Controller

AP 1

AP 2

12 34

STA

Location A
Figure 18.Over-the-air FT communication

Location B

Step 1 Set up the environment (Section 5). Step 2 Move STA closer to AP 2 until the signal strength from AP1 is less than the threshold.

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

Step 3 STA roams from AP 1 to AP 2, which is also shown on the console.
Command output example:
wlan: send out FT auth,wait for auth response wlan : FT response target AP 08:XX:XX:XX:2f:90 wlan: FT auth received Fast BSS Transition use ft-over-air wlan: Fast Bss transition to bssid 08:XX:XX:XX:2f:90 successfully
Figure 19 shows a sniffer capture example of Over-the-Air FT.
· AP 1 MAC= 08:cc:68:b4:2b:a0 · STA MAC= 00:50:43:22:10:72 · AP 2 MAC= 08:cc:68:b4:2f:90 · Over-the-Air Transition sequence of Authentication, Authentication, Reassociation Request, and
Reassociation Response.

Figure 19.Sniffer capture example of Over-the-Air FT

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

8.1.1 Over-the-Air FT flow The Figure 20 shows the interaction between the wpa_supplicant, Wi-Fi driver, and firmware. The wpa_supplicant commands (in uppercase) are defined in hostap/src/drivers/nl80211_copy.h. For more details about the driver to firmware APIs, refer to [1], [2], [3], and [4].

wpa_supplicant

driver

firmware

HostCmd_802_11_SUBSCRIBE_EVENT

RSSI LOW EVENT

Select Network

SCAN SCAN RESULTS

HostCmd_802_11_SCAN_EXT SCAN RESULTS

Current AP
AUTH Frame AUTH Response

ASSOCIATE ASSOCIATE RESPONSE

HostCmd_802_11_ASSOCIATE HostCmdResp_802_11_ASSOCIATE

Reassociation Request Frame Reassociation Response Frame

NL80211_CMD_NEW_KEY NL80211_CMD_NEW_KEY

HostCmd_802_11_CMD_KEY_MATERIAL HostCmd_802_11_CMD_KEY_MATERIAL

Install PTK Install GTK

Target AP

Figure 20.Over-the-Air FT flow

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

8.2 Over-the-DS fast transition (FT)
In over-the-DS FT, the STA communicates with the target AP through the current AP. STA sends IEEE 802.11 FT action frames to the current AP, which forwards the frames to the target. The capability for FT is advertised in the Beacon Mobility Domain Information Element of the AP.
In this example, the wireless LAN controller is configured for Over-the-DS FT. The STA is connected to AP1 at location A. When the STA moves closer to AP2 at location B, the received signal strength from AP1 drops below the set signal threshold. The STA is triggered to roam to AP 2 when the wpa_supplicant command is issued.
Note: Open source wpa_supplicant does not support automatic roaming Over-the-DS. The command to manually trigger Over-the-DS FT is:
./wpa_cli -i mlan0 FT_DS <MACaddress of Target AP >
Figure 21 shows Over-the-DS FT communication. The arrows represent the FT Over-the-DS sequence:
1. Action Frame (Fast Transfer Request) 2. Action Frame (Fast Transfer Response) 3. Reassociation Request 4. Reassociation Response

Wireless LAN Controller

AP 1

AP 2

2 1

STA

Location A
Figure 21.Over-the-DS FT communication

Location B

Step 1 Set up the environment (Section 5). Step 2 Move STA closer to AP 2, where the signal strength from AP 1 will be less than the threshold. Step 3 Run the wpa_cli command to trigger Over-the-DS FT.

./wpa_cli -i mlan0 FT_DS <MACaddress of Target AP >

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

Step 4 The STA roams from AP 2 to AP 1 (also shown on the console). Output example:
wlan: send out FT request,wait for FT response wlan : FT response target AP 08:XX:XX:XX:2f:90 wlan: received FT response Fast BSS transition to bssid 08:XX:XX:XX:2f:90 successfully
Figure 22 shows a sniffer capture example of Over-the-DS FT.
· AP 1 MAC= 08:cc:68:b4:2b:a0 · STA MAC= 00:50:43:22:10:72 · AP 2 MAC= 08:cc:68:b4:2f:90 · Over-the-DS FT sequence of Action, Action, Reassociation Request, and Reassociation Response.

Figure 22.Sniffer capture example of Over-the-DS FT

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

8.2.1 Over-the-DS FT flow Figure 23 shows the interaction between the wpa_supplicant, Wi-Fi driver, and firmware. The wpa_supplicant commands (in uppercase) are defined in hostap/src/drivers/nl80211_copy.h. For more details about the driver to firmware APIs, refer to [1], [2], [3], and [4].

wpa_supplicant

driver

Firmware

Select Network

SCAN

HostCmd_802_11_SUBSCRIBE_EVENT RSSI LOW EVENT
HostCmd_802_11_SCAN_EXT

SCAN RESULTS

SCAN RESULTS FT Request Action Frame

FT Response ACTION Frame

ASSOCIATE ASSOCIATE RESPONSE NL80211_CMD_NEW_KEY NL80211_CMD_NEW_KEY

HostCmd_802_11_ASSOCIATE HostCmdResp_802_11_ASSOCIATE HostCmd_802_11_CMD_KEY_MATERIAL HostCmd_802_11_CMD_KEY_MATERIAL

Install PTK Install GTK

Current AP
FT Request FT Response Reassociation Request Frame Reassociation Response Frame

Target AP

Figure 23.Over-the-DS FT flow

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

9 Abbreviations

Table 2.Abbreviations

Abbreviation

Description

Access point

bgscan

Background scan

BSS

Basic service set

BTM

BSS transition management

Distribution system

DUT

Device under test

ESS

Extended service set

Fast transition

MLME

MAC sublayer management entity

RRM

Radio resource management

RSSI

Receive signal strength indication

STA

Station

WNM

Wireless network management

wpa_cli

Command line interface for wpa_supplicant

AN14212
802.11kvr Roaming

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

10 References
[1] Application note AN13296: Embedded Wi-Fi Subsystem API Specification V16 (link) [2] Application note AN13297: Embedded Wi-Fi Subsystem API Specification V17 (link) [3] Application note AN13538: Embedded Wi-Fi Subsystem API Specification V18 (link) [4] Application note AN14314: Embedded Wi-Fi Subsystem API Specification for AW692/AW693 (link) [5] Webpage 88W8987: 2.4/5 GHz Dual-Band 1x1 Wi-Fi® 5 (802.11ac) + Bluetooth® Solution (link) [6] Webpage 88W8997: 2.4/5 GHz Dual-Band 2x2 Wi-Fi® 5 (802.11ac) + Bluetooth® Solution (link) [7] Webpage 88Q9098: 2.4/5 GHz Dual-Band 2x2 Wi-Fi® 6 (802.11ax) + Bluetooth® Automotive Solution
(link) [8] Webpage 88W9098: 2.4/5 GHz Dual-Band 2x2 Wi-Fi® 6 (802.11ax) + Bluetooth® (link) [9] Webpage AW611: 2.4/5GHz Dual-band 1x1 Wi-Fi® 6 (802.11ax) + Bluetooth® Automotive Solution (link) [10] Webpage AW690: Wi-Fi® 6 1x1 Concurrent Dual Wi-Fi (CDW) and Bluetooth® Combo SoC (link) [11] Webpage AW692: 2x2 Single-band (5 GHz) Concurrent Dual Wi-Fi® 6, 1x1 (2.4 GHz) Wi-Fi 6, and
Bluetooth® Combo Solution (link) [12] Webpage AW693: 2x2 Dual-band (5-7 GHz), 1x1 (2.4 GHz) Concurrent Dual Wi-Fi 6/6E and Bluetooth
Combo Solution (link) [13] Webpage IW416: 2.4/5 GHz Dual-Band 1x1 Wi-Fi® 4 (802.11n) + Bluetooth® Solution (link) [14] Webpage IW611: 2.4/5GHz Dual-band 1x1 Wi-Fi® 6 (802.11ax) + Bluetooth® Solution (link) [15] Webpage IW612: 2.4/5 GHz Dual-Band 1x1 Wi-Fi® 6 (802.11ax) + Bluetooth® + 802.15.4 Tri-radio
Solution (link) [16] Webpage IW620: 2.4/5 GHz Dual-Band 2x2 Wi-Fi® 6 (802.11ax) + Bluetooth® Solution (link) [17] Webpage Linux WPA/WPA2/WPA3/IEEE 802.1X Supplicant (link)

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

11 Note about the source code in the document
The example code shown in this document has the following copyright and BSD-3-Clause license:
Copyright 2024-2025 NXP Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials must be provided with the distribution.
3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

12 Revision history

Table 3.Revision history Document ID
AN14212 v.2.0

Release date 13 January 2025

AN14212 v.1.0

22 August 2024

Description
· Changed the access of the document to public. · Supersedes AN13888 802.11r and fast transition (FT).
· Initial version

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

Legal information
Definitions
Draft -- A draft status on a document indicates that the content is still under internal review and subject to formal approval, which may result in modifications or additions. NXP Semiconductors does not give any representations or warranties as to the accuracy or completeness of information included in a draft version of a document and shall have no liability for the consequences of use of such information.
Disclaimers
Limited warranty and liability -- Information in this document is believed to be accurate and reliable. However, NXP Semiconductors does not give any representations or warranties, expressed or implied, as to the accuracy or completeness of such information and shall have no liability for the consequences of use of such information. NXP Semiconductors takes no responsibility for the content in this document if provided by an information source outside of NXP Semiconductors. In no event shall NXP Semiconductors be liable for any indirect, incidental, punitive, special or consequential damages (including - without limitation lost profits, lost savings, business interruption, costs related to the removal or replacement of any products or rework charges) whether or not such damages are based on tort (including negligence), warranty, breach of contract or any other legal theory. Notwithstanding any damages that customer might incur for any reason whatsoever, NXP Semiconductors' aggregate and cumulative liability towards customer for the products described herein shall be limited in accordance with the Terms and conditions of commercial sale of NXP Semiconductors.
Right to make changes -- NXP Semiconductors reserves the right to make changes to information published in this document, including without limitation specifications and product descriptions, at any time and without notice. This document supersedes and replaces all information supplied prior to the publication hereof.
Suitability for use -- NXP Semiconductors products are not designed, authorized or warranted to be suitable for use in life support, life-critical or safety-critical systems or equipment, nor in applications where failure or malfunction of an NXP Semiconductors product can reasonably be expected to result in personal injury, death or severe property or environmental damage. NXP Semiconductors and its suppliers accept no liability for inclusion and/or use of NXP Semiconductors products in such equipment or applications and therefore such inclusion and/or use is at the customer's own risk.
Applications -- Applications that are described herein for any of these products are for illustrative purposes only. NXP Semiconductors makes no representation or warranty that such applications will be suitable for the specified use without further testing or modification. Customers are responsible for the design and operation of their applications and products using NXP Semiconductors products, and NXP Semiconductors accepts no liability for any assistance with applications or customer product design. It is customer's sole responsibility to determine whether the NXP Semiconductors product is suitable and fit for the customer's applications and products planned, as well as for the planned application and use of customer's third party customer(s). Customers should provide appropriate design and operating safeguards to minimize the risks associated with their applications and products. NXP Semiconductors does not accept any liability related to any default, damage, costs or problem which is based on any weakness or default in the customer's applications or products, or the application or use by customer's third party customer(s). Customer is responsible for doing all necessary testing for the customer's applications and products using NXP Semiconductors products in order to avoid a default of the applications and the products or of the application or use by customer's third party customer(s). NXP does not accept any liability in this respect.

Terms and conditions of commercial sale -- NXP Semiconductors products are sold subject to the general terms and conditions of commercial sale, as published at https://www.nxp.com/profile/terms, unless otherwise agreed in a valid written individual agreement. In case an individual agreement is concluded only the terms and conditions of the respective agreement shall apply. NXP Semiconductors hereby expressly objects to applying the customer's general terms and conditions with regard to the purchase of NXP Semiconductors products by customer.
Export control -- This document as well as the item(s) described herein may be subject to export control regulations. Export might require a prior authorization from competent authorities.
Suitability for use in non-automotive qualified products -- Unless this document expressly states that this specific NXP Semiconductors product is automotive qualified, the product is not suitable for automotive use. It is neither qualified nor tested in accordance with automotive testing or application requirements. NXP Semiconductors accepts no liability for inclusion and/or use of non-automotive qualified products in automotive equipment or applications. In the event that customer uses the product for design-in and use in automotive applications to automotive specifications and standards, customer (a) shall use the product without NXP Semiconductors' warranty of the product for such automotive applications, use and specifications, and (b) whenever customer uses the product for automotive applications beyond NXP Semiconductors' specifications such use shall be solely at customer's own risk, and (c) customer fully indemnifies NXP Semiconductors for any liability, damages or failed product claims resulting from customer design and use of the product for automotive applications beyond NXP Semiconductors' standard warranty and NXP Semiconductors' product specifications.
HTML publications -- An HTML version, if available, of this document is provided as a courtesy. Definitive information is contained in the applicable document in PDF format. If there is a discrepancy between the HTML document and the PDF document, the PDF document has priority.
Translations -- A non-English (translated) version of a document, including the legal information in that document, is for reference only. The English version shall prevail in case of any discrepancy between the translated and English versions.
Security -- Customer understands that all NXP products may be subject to unidentified vulnerabilities or may support established security standards or specifications with known limitations. Customer is responsible for the design and operation of its applications and products throughout their lifecycles to reduce the effect of these vulnerabilities on customer's applications and products. Customer's responsibility also extends to other open and/or proprietary technologies supported by NXP products for use in customer's applications. NXP accepts no liability for any vulnerability. Customer should regularly check security updates from NXP and follow up appropriately. Customer shall select products with security features that best meet rules, regulations, and standards of the intended application and make the ultimate design decisions regarding its products and is solely responsible for compliance with all legal, regulatory, and security related requirements concerning its products, regardless of any information or support that may be provided by NXP. NXP has a Product Security Incident Response Team (PSIRT) (reachable at [email protected]) that manages the investigation, reporting, and solution release to security vulnerabilities of NXP products.
NXP B.V. -- NXP B.V. is not an operating company and it does not distribute or sell products.
Trademarks
Notice: All referenced brands, product names, service names, and trademarks are the property of their respective owners.
NXP -- wordmark and logo are trademarks of NXP B.V.

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

Tables

Tab. 1. Command parameters .......................................6 Tab. 2. Abbreviations ...................................................28

Tab. 3. Revision history ...............................................31

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

AN14212
802.11kvr Roaming

Figures

Fig. 1. Fig. 2. Fig. 3. Fig. 4. Fig. 5. Fig. 6. Fig. 7.
Fig. 8. Fig. 9. Fig. 10.
Fig. 11.
Fig. 12.

Overview of 802.11kvr .......................................3 wpa_supplicant directory content ...................... 5 802.11kvr set up example ................................. 9 Example of AP enabled with 802.11kvr ............. 9 Example of STA enabled with 802.11kvr ......... 10 Setup for Neighbor report ............................... 11 Example of Neighbor report request from STA to AP ....................................................... 12 Neighbor report response from the AP ............13 Link measurement setup .................................14 Example of STA receiving link measurement request from the AP ................. 14 Example of link measurement response from the STA to the AP ...................................15 Beacon report setup ........................................16

Fig. 13.
Fig. 14. Fig. 15.
Fig. 16.
Fig. 17. Fig. 18. Fig. 19. Fig. 20. Fig. 21. Fig. 22. Fig. 23.

Example of the STA sending a beacon report to the AP .............................................. 16 BTM query communication ............................. 17 Example of STA sending a BTM query to the AP 1 .......................................................... 18 Example of BTM query request from the AP to the STA ................................................. 20 Example of the STA response to AP 1 ............ 21 Over-the-air FT communication .......................22 Sniffer capture example of Over-the-Air FT .....23 Over-the-Air FT flow ........................................24 Over-the-DS FT communication ......................25 Sniffer capture example of Over-the-DS FT .... 26 Over-the-DS FT flow ....................................... 27

AN14212
Application note

All information provided in this document is subject to legal disclaimers.
Rev. 2.0 -- 13 January 2025

NXP Semiconductors

Contents

1 1.1 1.2 2 3 3.1 3.2 4 5 6 6.1 6.2 6.3 7 8 8.1 8.1.1 8.2 8.2.1 9 10 11
12

Introduction ...................................................... 2 Supported devices ............................................. 2 Prerequisites ...................................................... 2 802.11kvr ...........................................................3 Configuration ................................................... 4 Driver load parameters ...................................... 4 wpa_supplicant .................................................. 5 wpa_cli .............................................................. 8 Setup ................................................................. 9 802.11k examples ...........................................11 Neighbor report ................................................11 Link measurement ........................................... 14 Beacon report .................................................. 16 802.11v example ............................................ 17 802.11r examples ........................................... 22 Over-the-air fast transition (FT) ....................... 22 Over-the-Air FT flow ........................................ 24 Over-the-DS fast transition (FT) ...................... 25 Over-the-DS FT flow ........................................27 Abbreviations ................................................. 28 References ......................................................29 Note about the source code in the document ........................................................30 Revision history .............................................31 Legal information ...........................................32

AN14212
802.11kvr Roaming

Please be aware that important notices concerning this document and the product(s) described herein, have been included in section 'Legal information'.

For more information, please visit: https://www.nxp.com

Document feedback
Date of release: 13 January 2025 Document identifier: AN14212

Apache FOP Version 2.6