This document provides an overview of open-source 802.11 wireless device drivers, including how they work with the Linux kernel network stack. It describes the central network device data structure, socket buffers for packet transmission, and how the mac80211 framework and SoftMAC drivers like Ath9k interact. Specific driver functions like transmission paths and configurable parameters are outlined. An example of spectral scanning code for dynamic frequency selection is also summarized.

1. 1
Analysis of Open-Source
Drivers for 802.11 WLANs
Danh Nguyen
07/12/2013

2. 2
Summary
• How device drivers work
• Socket buffer
• Mac80211 walk through
• Ath9k walk through
• What’s configurable

3. 3
How Device Drivers Work

4. 4
Linux Kernel Stack

5. 5
struct net_device
• The central structure representing a network
device (drivers + HW) in kernel subsystem
• Network drivers allocate, initialize, and operate it
• Contains info about IF:
o Global: name, state, init function callbacks
o Hardware: memory, irq, port, dma channels
o Interface info: MAC addr, mtu, num. of TX queues (IF queues),
type, flags and features
o Device methods: kernel callbacks for features provided: `open()`,
`stop()`, `hard_start_xmit()`, `tx_timeout()`, `do_ioctl()`, etc.
o Utilities fields: tx/rx timestamps, private IF data (hw queues?),
multicast, spinlocks…

6. 6
Socket Buffer
• Important data structure to represent packets
(complete, down to PSDU) in kernel
• 2 parts:
o Packet data: actual PSDU memory allocation
o Management (`struct sk_buff *skb`)
 Management pointers to different part of packet data
› Layer headers (TCP, IP, MAC)
› PDU for each layer
• Where drivers / network subsystem can do DPI
before handing off to applications

7. 7
Socket Buffer (Cont.)

8. 8
Mac80211 Walk Through
• mac80211
o “Upper” MAC functions
 Data packaging –
attach/detach 802.11 headers
 TX/RX paths – include
software en-/decryption
 QoS (admission control)
o Control paths (MLME)
 De/Authenticate
 Beacon / Probe
 Timing Sync Function
o Monitor mode support
o Rate control
Cfg80211
SoftMAC Driver
- ath5k/9k, brcmsmac,
iwlwifi
Mac80211
- “Upper” MAC / MLME
Userspace
nl80211
Cfg80211_ops
Ieee8011_ops

9. 9
TX Path in mac80211

10. 10
Transmission Path: Kernel -> mac80211 -> ath9k

11. 11
SoftMAC Details
• IF Driver
o Mapping TX queues to HW
queues
o Control PHY
o Hardware signaling / sync /
interrupts
o Some with more control over
PHY than others (Atheros vs.
Broadcom)
Cfg80211
SoftMAC Driver
- ath5k/9k, brcmsmac,
iwlwifi
Mac80211
- “Upper” MAC / MLME
Userspace
nl80211
Cfg80211_ops
Ieee8011_ops

12. 12
Ath9k Walkthrough

13. 13
Transmission Path: ath9k -> hardware

14. 14
What’s Configurable
• All MAC Layer functionalities, upper or lower
• Ath9k keeps track of each HW queue lower-MAC
parameters (CSMA/CA parameters): CWmin, CWmax,
back-off values, AIFS, and other TX ops
o Set them based on mac80211 TX/RX params (`tid`)
• Ath9k maps mac80211 tx queues (4, as per 802.11e) to
HW queues (10, for Atheros)
o Per-packet mappings
o TX ops propagates from mac80211 -> ath9k -> PHY Firmware
• Some PHY parameters can be changed together w/
CSMA/CA params
o Code rates, bursting, antenna power, fix antenna via API
o Additional PHY control: modify open-source PHY firmware

15. 15
Example: Spectral Scanning
• Mobicom 2011 Demo: “Dynamic Frequency
Selection through Collaborative Reporting in
WLANs”
• In 802.11, channel selection performed by AP
o Based on RSSI
o Static -> not consistent with wireless medium
• A frequency selection algorithm
o Based on Mad-WiFi
o Switch operation channels based on channel and traffic
conditions
o Collaborative reporting: STAs feedback to APs

16. 16
Example: Spectral Scanning

17. 17
References
• Linux Device Drivers, 3rd Ed. (O’Reilly Book)
• http://nitlab.inf.uth.gr/NITlab/index.php/testbed/ha
rdware/sensors/2-uncategorised/367-dynamic-
frequency-selection-through-collaborative-
reporting-in-wlans (Demo)