修改WiFi beacon幀

http://blog.csdn.net/UsSam/article/details/18040871

 

最近需要對OpenWRT內核中的beacon幀做修改

要修改beacon幀，就需要了解幀的寫入和發送的過程

beacon幀發送機制：
    beacon幀的發送是通過tasklet機制實現的，tasklet是軟中斷實現的下半部處理機制，用於中斷處理流程的下半部。核心函數是beacon.c中的ath9k_beacon_tasklet函數，（將該函數的指針傳遞給tasklet_init()即可實現tasklet_struct的動態創建，當tasklet被調度以后，ath9k_beacon_tasklet函數會被執行）。函數體如下所示：

void ath9k_beacon_tasklet(unsigned long data)
{
    struct ath_softc *sc = (struct ath_softc *)data;
    struct ath_hw *ah = sc->sc_ah;
    struct ath_common *common = ath9k_hw_common(ah);
    struct ath_buf *bf = NULL;
    ...

    bf = ath9k_beacon_generate(sc->hw, vif);

    ...
    if (bf) {
        ath9k_reset_beacon_status(sc);


        ath_dbg(common, BEACON, "Transmitting beacon for slot: %d\n", slot);


        /* NB: cabq traffic should already be queued and primed */
        ath9k_hw_puttxbuf(ah, sc->beacon.beaconq, bf->bf_daddr);

        if (!edma)
        {
            ath9k_hw_txstart(ah, sc->beacon.beaconq);
        }
    }
}

研究收發機制是為了修改beacon幀，因此接下來我們看一看beacon幀是如何產生的。這就要研究剛才提到的ath9k_beacon_generate函數了。ath9k_beacon_generate函數體如下所示：

static struct ath_buf *ath9k_beacon_generate(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
{
    struct ath_softc *sc = hw->priv;
    struct ath_common *common = ath9k_hw_common(sc->sc_ah);
    struct ath_buf *bf;
    struct ath_vif *avp = (void *)vif->drv_priv;
    struct sk_buff *skb;
    struct ath_txq *cabq = sc->beacon.cabq;
    struct ieee80211_tx_info *info;
    struct ieee80211_mgmt *mgmt_hdr;
    int cabq_depth;


    if (avp->av_bcbuf == NULL)
        return NULL;


    bf = avp->av_bcbuf;
    skb = bf->bf_mpdu;
    if (skb) {
        dma_unmap_single(sc->dev, bf->bf_buf_addr, skb->len, DMA_TO_DEVICE);
        dev_kfree_skb_any(skb);
        bf->bf_buf_addr = 0;
        bf->bf_mpdu = NULL;              /*清空緩存*/
    }



    skb = ieee80211_beacon_get(hw, vif);<strong>
</strong>


    if (skb == NULL)
        return NULL;                    /*skb生成失敗退出*/

    bf->bf_mpdu = skb;                   /*將生成的beacon幀緩存賦給bf結構體，此處是指針賦值，可以只用任一指針對對象進行修改*/





    mgmt_hdr = (struct ieee80211_mgmt *)skb->data;
    mgmt_hdr->u.beacon.timestamp = avp->tsf_adjust;       /*用ieee80211_mgmt結構體將skb->data中的前面若干個字段提取出來（包括frame_control,duration,da,sa,bssid,seqctrl,以及beacon幀特有的timestamp,beacon interval,capability information,variable字段），並對其timestamp字段進行數據的寫入*/


    ...

    return bf;
}