1. 1
Analysis of Open-Source
Drivers for 802.11 WLANs
Danh Nguyen
07/12/2013

2. 2
Summary
• How device drivers work
• Socket buffer
• Mac80211 walk through
• Ath9k walk through
• What’s configurable

3. 3
How Device Drivers Work

4. 4
Linux Kernel Stack

5. 5
struct net_device
• The central structure representing a network
device (drivers + HW) in kernel subsystem
• Network drivers allocate, initialize, and operate it
• Contains info about IF:
o Global: name, state, init function callbacks
o Hardware: memory, irq, port, dma channels
o Interface info: MAC addr, mtu, num. of TX queues (IF queues),
type, flags and features
o Device methods: kernel callbacks for features provided: `open()`,
`stop()`, `hard_start_xmit()`, `tx_timeout()`, `do_ioctl()`, etc.
o Utilities fields: tx/rx timestamps, private IF data (hw queues?),
multicast, spinlocks…

6. 6
Socket Buffer
• Important data structure to represent packets
(complete, down to PSDU) in kernel
• 2 parts:
o Packet data: actual PSDU memory allocation
o Management (`struct sk_buff *skb`)
 Management pointers to different part of packet data
› Layer headers (TCP, IP, MAC)
› PDU for each layer
• Where drivers / network subsystem can do DPI
before handing off to applications

7. 7
Socket Buffer (Cont.)

8. 8
Mac80211 Walk Through
• mac80211
o “Upper” MAC functions
 Data packaging –
attach/detach 802.11 headers
 TX/RX paths – include
software en-/decryption
 QoS (admission control)
o Control paths (MLME)
 De/Authenticate
 Beacon / Probe
 Timing Sync Function
o Monitor mode support
o Rate control
Cfg80211
SoftMAC Driver
- ath5k/9k, brcmsmac,
iwlwifi
Mac80211
- “Upper” MAC / MLME
Userspace
nl80211
Cfg80211_ops
Ieee8011_ops

9. 9
TX Path in mac80211

10. 10
Transmission Path: Kernel -> mac80211 -> ath9k

11. 11
SoftMAC Details
• IF Driver
o Mapping TX queues to HW
queues
o Control PHY
o Hardware signaling / sync /
interrupts
o Some with more control over
PHY than others (Atheros vs.
Broadcom)
Cfg80211
SoftMAC Driver
- ath5k/9k, brcmsmac,
iwlwifi
Mac80211
- “Upper” MAC / MLME
Userspace
nl80211
Cfg80211_ops
Ieee8011_ops

12. 12
Ath9k Walkthrough

13. 13
Transmission Path: ath9k -> hardware

14. 14
What’s Configurable
• All MAC Layer functionalities, upper or lower
• Ath9k keeps track of each HW queue lower-MAC
parameters (CSMA/CA parameters): CWmin, CWmax,
back-off values, AIFS, and other TX ops
o Set them based on mac80211 TX/RX params (`tid`)
• Ath9k maps mac80211 tx queues (4, as per 802.11e) to
HW queues (10, for Atheros)
o Per-packet mappings
o TX ops propagates from mac80211 -> ath9k -> PHY Firmware
• Some PHY parameters can be changed together w/
CSMA/CA params
o Code rates, bursting, antenna power, fix antenna via API
o Additional PHY control: modify open-source PHY firmware

15. 15
Example: Spectral Scanning
• Mobicom 2011 Demo: “Dynamic Frequency
Selection through Collaborative Reporting in
WLANs”
• In 802.11, channel selection performed by AP
o Based on RSSI
o Static -> not consistent with wireless medium
• A frequency selection algorithm
o Based on Mad-WiFi
o Switch operation channels based on channel and traffic
conditions
o Collaborative reporting: STAs feedback to APs

16. 16
Example: Spectral Scanning

17. 17
References
• Linux Device Drivers, 3rd Ed. (O’Reilly Book)
• http://nitlab.inf.uth.gr/NITlab/index.php/testbed/ha
rdware/sensors/2-uncategorised/367-dynamic-
frequency-selection-through-collaborative-
reporting-in-wlans (Demo)