![Page 1: Analysis of Open-Source Drivers for IEEE 802.11 WLANs](https://reader034.vdocuments.us/reader034/viewer/2022042604/5889c77e1a28abca448b612f/html5/thumbnails/1.jpg)
1
Analysis of Open-Source
Drivers for 802.11 WLANs
Danh Nguyen
07/12/2013
![Page 2: Analysis of Open-Source Drivers for IEEE 802.11 WLANs](https://reader034.vdocuments.us/reader034/viewer/2022042604/5889c77e1a28abca448b612f/html5/thumbnails/2.jpg)
2
Summary
• How device drivers work
• Socket buffer
• Mac80211 walk through
• Ath9k walk through
• What’s configurable
![Page 3: Analysis of Open-Source Drivers for IEEE 802.11 WLANs](https://reader034.vdocuments.us/reader034/viewer/2022042604/5889c77e1a28abca448b612f/html5/thumbnails/3.jpg)
3
How Device Drivers Work
![Page 4: Analysis of Open-Source Drivers for IEEE 802.11 WLANs](https://reader034.vdocuments.us/reader034/viewer/2022042604/5889c77e1a28abca448b612f/html5/thumbnails/4.jpg)
4
Linux Kernel Stack
![Page 5: Analysis of Open-Source Drivers for IEEE 802.11 WLANs](https://reader034.vdocuments.us/reader034/viewer/2022042604/5889c77e1a28abca448b612f/html5/thumbnails/5.jpg)
5
struct net_device
• The central structure representing a network
device (drivers + HW) in kernel subsystem
• Network drivers allocate, initialize, and operate it
• Contains info about IF: o Global: name, state, init function callbacks
o Hardware: memory, irq, port, dma channels
o Interface info: MAC addr, mtu, num. of TX queues (IF queues),
type, flags and features
o Device methods: kernel callbacks for features provided: `open()`,
`stop()`, `hard_start_xmit()`, `tx_timeout()`, `do_ioctl()`, etc.
o Utilities fields: tx/rx timestamps, private IF data (hw queues?),
multicast, spinlocks…
![Page 6: Analysis of Open-Source Drivers for IEEE 802.11 WLANs](https://reader034.vdocuments.us/reader034/viewer/2022042604/5889c77e1a28abca448b612f/html5/thumbnails/6.jpg)
6
Socket Buffer
• Important data structure to represent packets
(complete, down to PSDU) in kernel
• 2 parts:
o Packet data: actual PSDU memory allocation
o Management (`struct sk_buff *skb`)
Management pointers to different part of packet data
› Layer headers (TCP, IP, MAC)
› PDU for each layer
• Where drivers / network subsystem can do DPI
before handing off to applications
![Page 7: Analysis of Open-Source Drivers for IEEE 802.11 WLANs](https://reader034.vdocuments.us/reader034/viewer/2022042604/5889c77e1a28abca448b612f/html5/thumbnails/7.jpg)
7
Socket Buffer (Cont.)
![Page 8: Analysis of Open-Source Drivers for IEEE 802.11 WLANs](https://reader034.vdocuments.us/reader034/viewer/2022042604/5889c77e1a28abca448b612f/html5/thumbnails/8.jpg)
8
Mac80211 Walk Through
• mac80211
o “Upper” MAC functions
Data packaging –
attach/detach 802.11 headers
TX/RX paths – include
software en-/decryption
QoS (admission control)
o Control paths (MLME)
De/Authenticate
Beacon / Probe
Timing Sync Function
o Monitor mode support
o Rate control
Cfg80211
SoftMAC Driver
- ath5k/9k, brcmsmac,
iwlwifi
Mac80211
- “Upper” MAC / MLME
Userspace
nl80211
Cfg80211_ops
Ieee8011_ops
![Page 9: Analysis of Open-Source Drivers for IEEE 802.11 WLANs](https://reader034.vdocuments.us/reader034/viewer/2022042604/5889c77e1a28abca448b612f/html5/thumbnails/9.jpg)
9
TX Path in mac80211
![Page 10: Analysis of Open-Source Drivers for IEEE 802.11 WLANs](https://reader034.vdocuments.us/reader034/viewer/2022042604/5889c77e1a28abca448b612f/html5/thumbnails/10.jpg)
10
Transmission Path: Kernel -> mac80211 -> ath9k
![Page 11: Analysis of Open-Source Drivers for IEEE 802.11 WLANs](https://reader034.vdocuments.us/reader034/viewer/2022042604/5889c77e1a28abca448b612f/html5/thumbnails/11.jpg)
11
SoftMAC Details
• IF Driver
o Mapping TX queues to HW
queues
o Control PHY
o Hardware signaling / sync /
interrupts
o Some with more control over
PHY than others (Atheros vs.
Broadcom)
Cfg80211
SoftMAC Driver
- ath5k/9k, brcmsmac,
iwlwifi
Mac80211
- “Upper” MAC / MLME
Userspace
nl80211
Cfg80211_ops
Ieee8011_ops
![Page 12: Analysis of Open-Source Drivers for IEEE 802.11 WLANs](https://reader034.vdocuments.us/reader034/viewer/2022042604/5889c77e1a28abca448b612f/html5/thumbnails/12.jpg)
12
Ath9k Walkthrough
![Page 13: Analysis of Open-Source Drivers for IEEE 802.11 WLANs](https://reader034.vdocuments.us/reader034/viewer/2022042604/5889c77e1a28abca448b612f/html5/thumbnails/13.jpg)
13
Transmission Path: ath9k -> hardware
![Page 14: Analysis of Open-Source Drivers for IEEE 802.11 WLANs](https://reader034.vdocuments.us/reader034/viewer/2022042604/5889c77e1a28abca448b612f/html5/thumbnails/14.jpg)
14
What’s Configurable
• All MAC Layer functionalities, upper or lower
• Ath9k keeps track of each HW queue lower-MAC
parameters (CSMA/CA parameters): CWmin, CWmax,
back-off values, AIFS, and other TX ops
o Set them based on mac80211 TX/RX params (`tid`)
• Ath9k maps mac80211 tx queues (4, as per 802.11e) to
HW queues (10, for Atheros)
o Per-packet mappings
o TX ops propagates from mac80211 -> ath9k -> PHY Firmware
• Some PHY parameters can be changed together w/
CSMA/CA params
o Code rates, bursting, antenna power, fix antenna via API
o Additional PHY control: modify open-source PHY firmware
![Page 15: Analysis of Open-Source Drivers for IEEE 802.11 WLANs](https://reader034.vdocuments.us/reader034/viewer/2022042604/5889c77e1a28abca448b612f/html5/thumbnails/15.jpg)
15
Example: Spectral Scanning
• Mobicom 2011 Demo: “Dynamic Frequency
Selection through Collaborative Reporting in
WLANs”
• In 802.11, channel selection performed by AP
o Based on RSSI
o Static -> not consistent with wireless medium
• A frequency selection algorithm
o Based on Mad-WiFi
o Switch operation channels based on channel and traffic
conditions
o Collaborative reporting: STAs feedback to APs
![Page 16: Analysis of Open-Source Drivers for IEEE 802.11 WLANs](https://reader034.vdocuments.us/reader034/viewer/2022042604/5889c77e1a28abca448b612f/html5/thumbnails/16.jpg)
16
Example: Spectral Scanning
![Page 17: Analysis of Open-Source Drivers for IEEE 802.11 WLANs](https://reader034.vdocuments.us/reader034/viewer/2022042604/5889c77e1a28abca448b612f/html5/thumbnails/17.jpg)
17
References
• Linux Device Drivers, 3rd Ed. (O’Reilly Book)
• http://nitlab.inf.uth.gr/NITlab/index.php/testbed/ha
rdware/sensors/2-uncategorised/367-dynamic-
frequency-selection-through-collaborative-
reporting-in-wlans (Demo)