1

Analysis of Open-Source

Drivers for 802.11 WLANs

Danh Nguyen

07/12/2013

2

Summary

• How device drivers work

• Socket buffer

• Mac80211 walk through

• Ath9k walk through

• What’s configurable

3

How Device Drivers Work

4

Linux Kernel Stack

5

struct net_device

• The central structure representing a network

device (drivers + HW) in kernel subsystem

• Network drivers allocate, initialize, and operate it

• Contains info about IF: o Global: name, state, init function callbacks

o Hardware: memory, irq, port, dma channels

o Interface info: MAC addr, mtu, num. of TX queues (IF queues),

type, flags and features

o Device methods: kernel callbacks for features provided: `open()`,

`stop()`, `hard_start_xmit()`, `tx_timeout()`, `do_ioctl()`, etc.

o Utilities fields: tx/rx timestamps, private IF data (hw queues?),

multicast, spinlocks…

6

Socket Buffer

• Important data structure to represent packets

(complete, down to PSDU) in kernel

• 2 parts:

o Packet data: actual PSDU memory allocation

o Management (`struct sk_buff *skb`)

Management pointers to different part of packet data

› Layer headers (TCP, IP, MAC)

› PDU for each layer

• Where drivers / network subsystem can do DPI

before handing off to applications

7

Socket Buffer (Cont.)

8

Mac80211 Walk Through

• mac80211

o “Upper” MAC functions

Data packaging –

attach/detach 802.11 headers

TX/RX paths – include

software en-/decryption

QoS (admission control)

o Control paths (MLME)

De/Authenticate

Beacon / Probe

Timing Sync Function

o Monitor mode support

o Rate control

Cfg80211

SoftMAC Driver

- ath5k/9k, brcmsmac,

iwlwifi

Mac80211

- “Upper” MAC / MLME

Userspace

nl80211

Cfg80211_ops

Ieee8011_ops

9

TX Path in mac80211

10

Transmission Path: Kernel -> mac80211 -> ath9k

11

SoftMAC Details

• IF Driver

o Mapping TX queues to HW

queues

o Control PHY

o Hardware signaling / sync /

interrupts

o Some with more control over

PHY than others (Atheros vs.

Broadcom)

Cfg80211

SoftMAC Driver

- ath5k/9k, brcmsmac,

iwlwifi

Mac80211

- “Upper” MAC / MLME

Userspace

nl80211

Cfg80211_ops

Ieee8011_ops

12

Ath9k Walkthrough

13

Transmission Path: ath9k -> hardware

14

What’s Configurable

• All MAC Layer functionalities, upper or lower

• Ath9k keeps track of each HW queue lower-MAC

parameters (CSMA/CA parameters): CWmin, CWmax,

back-off values, AIFS, and other TX ops

o Set them based on mac80211 TX/RX params (`tid`)

• Ath9k maps mac80211 tx queues (4, as per 802.11e) to

HW queues (10, for Atheros)

o Per-packet mappings

o TX ops propagates from mac80211 -> ath9k -> PHY Firmware

• Some PHY parameters can be changed together w/

CSMA/CA params

o Code rates, bursting, antenna power, fix antenna via API

o Additional PHY control: modify open-source PHY firmware

15

Example: Spectral Scanning

• Mobicom 2011 Demo: “Dynamic Frequency

Selection through Collaborative Reporting in

WLANs”

• In 802.11, channel selection performed by AP

o Based on RSSI

o Static -> not consistent with wireless medium

• A frequency selection algorithm

o Based on Mad-WiFi

o Switch operation channels based on channel and traffic

conditions

o Collaborative reporting: STAs feedback to APs

16

Example: Spectral Scanning

17

References

• Linux Device Drivers, 3rd Ed. (O’Reilly Book)

• http://nitlab.inf.uth.gr/NITlab/index.php/testbed/ha

rdware/sensors/2-uncategorised/367-dynamic-

frequency-selection-through-collaborative-

reporting-in-wlans (Demo)