Iwpriv工作流程及常用命令使用

矫情吗；* 2022-08-06 05:12 1阅读 0赞

iwpriv工具通过ioctl动态获取相应无线网卡驱动的private\_args所有扩展参数

iwpriv是处理下面的wlan\_private\_args的所有扩展命令,iwpriv的实现上,是这样的,  
=>main  
=>set\_private  
=>iw\_get\_priv\_info获取wireless网卡所能处理的所有wlan\_private\_args类型.

dev\_ioctl  
=>wext\_handle\_ioctl  
=>wireless\_process\_ioctl  
if (cmd == SIOCGIWPRIV && dev->wireless\_handlers)  
return ioctl\_standard\_call(dev, ifr, cmd,  
&iw\_handler\_get\_private);  
static int ioctl\_standard\_call(struct net\_device \* dev,  
struct ifreq \* ifr,  
unsigned int cmd,  
iw\_handler handler)  
\{  
...  
/\* Call the handler \*/  
ret = handler(dev, &info, &(iwr->u), extra);  
if (user\_length < iwr->u.data.length) \{  
kfree(extra);  
return -E2BIG;  
//通知iwpriv,本wifi网卡对应的private命令还没有完,还有,这样iwpriv将会继续  
//maxpriv默认为16,即将以16个为一组,一组一组的从wifi网卡驱动读取该网卡所能支持的所有private\_args参数  
//newpriv = realloc(priv, maxpriv \* sizeof(priv\[0\]));继续申请,继续拷贝,知道将wifi网卡自定义的wlan\_private\_args参数全部  
//传出到iwpriv为止.  
\}  
...  
\}  
/\* New driver API : try to find the handler \*/  
handler = get\_handler(dev, cmd);//获取

if (handler) \{  
/\* Standard and private are not the same \*/  
if (cmd < SIOCIWFIRSTPRIV)  
return ioctl\_standard\_call(dev, ifr, cmd, handler);  
else

//如果有对应的handler,那么处理iwpriv的命令,可以我们的iwpriv都是由dev->do\_ioctl完成的.  
return ioctl\_private\_call(dev, ifr, cmd, handler);  
\}  
/\* Old driver API : call driver ioctl handler \*/  
if (dev->do\_ioctl)  
//如果dev->wireless\_handlers->standard和dev->wireless\_handlers->private\[index都不对该cmd作处理,那么由  
//dev->do\_ioctl = wlan\_do\_ioctl;我们驱动的最后处理函数wlan\_do\_ioctl处理.  
return dev->do\_ioctl(dev, ifr, cmd);

static iw\_handler get\_handler(struct net\_device \*dev, unsigned int cmd)  
\{  
/\* Don't "optimise" the following variable, it will crash \*/  
unsigned int index; /\* \*MUST\* be unsigned \*/

/\* Check if we have some wireless handlers defined \*/  
if (dev->wireless\_handlers == NULL)  
return NULL;

/\* Try as a standard command \*/  
index = cmd - SIOCIWFIRST;  
if (index < dev->wireless\_handlers->num\_standard)  
return dev->wireless\_handlers->standard\[index\];

/\* Try as a private command \*/  
index = cmd - SIOCIWFIRSTPRIV;//

if (index < dev->wireless\_handlers->num\_private)  
return dev->wireless\_handlers->private\[index\];//该private命令的handler.  
/\* Not found \*/  
return NULL;  
\}

下面wlan\_private\_args为本wifi网卡驱动的所能支持的所有命令,也就是iwpriv命令所能支持的所有命令

struct iw\_handler\_def wlan\_handler\_def = \{  
num\_standard:sizeof(wlan\_handler) / sizeof(iw\_handler),  
num\_private:sizeof(wlan\_private\_handler) / sizeof(iw\_handler),  
num\_private\_args:sizeof(wlan\_private\_args) / sizeof(struct iw\_priv\_args),  
standard:(iw\_handler \*) wlan\_handler,  
private:(iw\_handler \*) wlan\_private\_handler,  
private\_args:(struct iw\_priv\_args \*) wlan\_private\_args,  
\#if WIRELESS\_EXT > 20  
get\_wireless\_stats:wlan\_get\_wireless\_stats,  
\#endif  
\};

以下为示意代码,我们的wifi网卡驱动支持如下iwpriv命令.

static const struct iw\_priv\_args wlan\_private\_args\[\] = \{  
"extscan"/ "hostcmd"/ "arpfilter"/ "regrdwr"/ "sdcmd52rw"/  
"sdcmd53rw"/ "setgetconf"/ "getcis"/ "scantype"/ "deauth"  
"getNF"/ "getRSSI"/ "bgscan"/ "enable11d"/ "adhocgrate"  
"sdioclock"/ "wmm"/ "uapsdnullgen"/ "setcoalescing"/ "adhocgprot"  
"setpowercons"/ "wmm\_qosinfo"/ "lolisteninter"/ "fwwakeupmethod"  
"psnullinterval"/ "bcnmisto"/ "adhocawakepd"/ "moduletype"  
"autodeepsleep"/ "enhanceps"/ "wakeupmt"/ "setrxant"/ "settxant"  
"authalgs"/ "encryptionmode"/ "setregioncode"/ "setlisteninter"  
"setmultipledtim"/ "setbcnavg"/ "setdataavg"/ "associate"/ "getregioncode"  
"getlisteninter"/ "getmultipledtim"/ "gettxrate"/ "getbcnavg"  
"getdataavg"/ "getrxant"/ "gettxant"/ "gettsf"/ "wpssession"  
"deepsleep"/ "adhocstop"/ "radioon"/ "radiooff"/ "rmaeskey"  
"crypto\_test"/ "reasso-on"/ "reasso-off"/ "wlanidle-on"/ "wlanidle-off"  
"sleepparams"/ "requesttpc"/ "powercap"/ "measreq"/ "bca-ts"  
"scanmode"/ "getadhocstatus"/ "setgenie"/ "getgenie"/ "qstatus"  
"ts\_status"/ "setaeskey"/ "getaeskey"/ "version"/ "verext"/ "setwpaie"  
"setband"/ "setadhocch"/ "chanswann"/ "getband"/ "getadhocch"  
"getlog"/ "tpccfg"/ "scanprobes"/ "ledgpio"/ "sleeppd"/ "rateadapt"  
"getSNR"/ "getrate"/ "getrxinfo"/ "atimwindow"/ "bcninterval"/ "sdiopullctrl"  
"scantime"/ "sysclock"/ "txcontrol"/ "hscfg"/ "hssetpara"/ "inactoext"  
"dbgscfg"/ "drvdbg"/ "drvdelaymax"/ "intfctrl"/ "setquietie"/ ""  
"setuserscan"/ "getscantable"/ "setmrvltlv"/ "getassocrsp"/ "addts"  
"delts"/ "qconfig"/ "qstats"/ "txpktstats"/ "getcfptable"/ "mefcfg"  
"getmem"

\};

浅析ethx网卡控制函数ioctl实现具体流程

====================  
1.应用层程序iwpriv  
wireless tools网络配置应用程序iwpriv命令格式:  
iwpriv ethX private-command \[parameters\]

iwpriv部分实现源码如下:  
int main(int argc, char \*argv\[\])  
\{  
...  
sockfd = socket(AF\_INET, SOCK\_STREAM, 0);  
...  
ioctl(sockfd, ioctl\_val, &iwr);//将控制命令通过ioctl发送到无线网卡  
...  
\}  
====================  
2.系统调用sys\_ioctl  
应用层通过ioctl(sockfd, ioctl\_val, &iwr);触发sys\_ioctl系统调用,实际流程:  
sys\_ioctl=>vfs\_ioctl=>do\_ioctl=最后调用  
filp->f\_op->unlocked\_ioctl执行具体的ioctl操作,该操作就是sock\_ioctl,至于为什么是sock\_ioctl,后边作了进一步分析  
sock\_ioctl=>  
\{  
...  
\#ifdef CONFIG\_WIRELESS\_EXT  
if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) \{  
err = dev\_ioctl(net, cmd, argp);//

\} else  
\#endif  
...  
\}  
dev\_ioctl=>wext\_handle\_ioctl  
\{  
...  
/\* Take care of Wireless Extensions \*/  
if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST)  
return wext\_handle\_ioctl(net, &ifr, cmd, arg);  
...  
\}  
wext\_handle\_ioctl=>wireless\_process\_ioctl=>  
然后通过if ((dev = \_\_dev\_get\_by\_name(net, ifr->ifr\_name)) == NULL)函数,  
从系统管理的net链表中,把ioctl指定的ethX对应的struct net\_device摘出来,  
最后调用ioctl\_private\_call(handler)或者调用dev->do\_ioctl(dev, ifr, cmd)来处理该ioctl,  
这两个函数分别指向wlan\_handler\_def和wlan\_do\_ioctl  
====================  
3.wifi网卡是怎么登记到kernel上的  
wlan\_probe()=>wlan\_add\_card()=>alloc\_etherdev()=>  
之后将操作方法添加到struct net\_device \*dev=alloc\_etherdev()申请的dev上去,其中包括:  
...  
/\* Setup the OS Interface to our functions \*/  
dev->open = wlan\_open;  
dev->hard\_start\_xmit = wlan\_hard\_start\_xmit;  
dev->stop = wlan\_close;  
dev->do\_ioctl = wlan\_do\_ioctl;  
dev->set\_mac\_address = wlan\_set\_mac\_address;

dev->tx\_timeout = wlan\_tx\_timeout;  
dev->get\_stats = wlan\_get\_stats;  
dev->watchdog\_timeo = MRVDRV\_DEFAULT\_WATCHDOG\_TIMEOUT;  
dev->wireless\_handlers = (struct iw\_handler\_def \*) &wlan\_handler\_def;  
dev->set\_multicast\_list = wlan\_set\_multicast\_list;  
...  
4.socket系统调用如何关联上ioctl和ethX设备

asmlinkage long sys\_socket(int family, int type, int protocol);

sys\_socket=>sock\_create=>\_\_sock\_create=>sock = sock\_alloc();通过sock\_mnt->mnt\_sb从socket文件系统的超级块上申请一个inode节点,这样也就同时获得了由该inode描述的一个sock结构体单元,所以sokcet和dentry目录项等效,  
接下来从net\_families全局管理结构体中找到当前family对应的ops操作集,  
net\_proto\_family \*pf=net\_families\[family\];  
pf->create(net, sock, protocol);//核心调用,对于ipv4,就是inet\_create  
以ipv4为例  
static struct net\_proto\_family inet\_family\_ops = \{  
.family = PF\_INET,  
.create = inet\_create,  
.owner = THIS\_MODULE,  
\};  
还记得上面应用层创建sokcet的函数吧,  
sockfd = socket(AF\_INET, SOCK\_STREAM, 0);//AF\_INET虽然等于PF\_INET,但是因为种种原因我们提倡使用PF\_INET  
可见family等于AF\_INET,type等于SOCK\_STREAM,协议protocol为0,也就是采用IP协议,  
inet\_create=>inetsw\[sock->type\]也就是inetsw\[SOCK\_STREAM\],  
从inetsw\[sock->type\]中找到已经登记的protocol网络协议处理函数,  
inetsw\[\]是怎么填充的呢?inet\_init()=>inet\_register\_protosw(inetsw\_array)=>这样inetsw\_array中的所有protocol处理模块都将登记到inetsw中了,  
static struct inet\_protosw inetsw\_array\[\] =  
\{  
\{  
.type = SOCK\_STREAM,  
.protocol = IPPROTO\_TCP,  
.prot = &tcp\_prot,  
.ops = &inet\_stream\_ops,  
.capability = -1,  
.no\_check = 0,  
.flags = INET\_PROTOSW\_PERMANENT | INET\_PROTOSW\_ICSK,  
\},

\{  
.type = SOCK\_DGRAM,  
.protocol = IPPROTO\_UDP,  
.prot = &udp\_prot,  
.ops = &inet\_dgram\_ops,  
.capability = -1,  
.no\_check = UDP\_CSUM\_DEFAULT,  
.flags = INET\_PROTOSW\_PERMANENT,  
\},

\{  
.type = SOCK\_RAW,  
.protocol = IPPROTO\_IP, /\* wild card \*/  
.prot = &raw\_prot,  
.ops = &inet\_sockraw\_ops,  
.capability = CAP\_NET\_RAW,  
.no\_check = UDP\_CSUM\_DEFAULT,  
.flags = INET\_PROTOSW\_REUSE,  
\}  
\};  
至于inet\_init,则是以fs\_initcall(inet\_init)方式,以5号优先级被build in到了内核中,当kernel启动时会在start\_kernel=>rest\_init=>kernel\_init=>do\_basic\_setup=>do\_initcalls中依据优先级号优先于其他module驱动被调用.  
这样sock->ops = answer->ops;对于ipv4也就等于inet\_stream\_ops,  
接下来就是将ops填充到file操作指针中了,  
sys\_socket=>sock\_map\_fd=>sock\_attach\_fd=>  
dentry->d\_op = &sockfs\_dentry\_operations;  
init\_file(file, sock\_mnt, dentry, FMODE\_READ | FMODE\_WRITE, &socket\_file\_ops);  
file->private\_data = sock;  
其中init\_file=>file->f\_op = fop;也就是file->f\_op = socket\_file\_ops;  
所以read(),wirte(),poll()和ioctl()应用程序调用的file->f\_op就是socket\_file\_ops了,  
比如:  
read()对应sock\_aio\_read网络异步读  
write()对应sock\_aio\_write网络异步写  
ioctl()对应sock\_ioctl

socket\_file\_ops结构体具体实现如下:  
static const struct file\_operations socket\_file\_ops = \{  
.owner = THIS\_MODULE,  
.llseek = no\_llseek,  
.aio\_read = sock\_aio\_read,  
.aio\_write = sock\_aio\_write,  
.poll = sock\_poll,  
.unlocked\_ioctl = sock\_ioctl,  
\#ifdef CONFIG\_COMPAT  
.compat\_ioctl = compat\_sock\_ioctl,  
\#endif  
.mmap = sock\_mmap,  
.open = sock\_no\_open, /\* special open code to disallow open via /proc \*/  
.release = sock\_close,  
.fasync = sock\_fasync,  
.sendpage = sock\_sendpage,  
.splice\_write = generic\_splice\_sendpage,  
\};  
网卡控制因为涉及到的知识点比较多,上面只是从宏观上对数据流程做了一个简单的介绍,深入到其中的每个知识点,都会牵扯出一系列文章,读者需要自己去一个个的慢慢深入,希望本文能够对刚刚接触网络驱动的读者有所帮助和启发【gliethttp.Leith】

wireless extention扩展接口Blog作者的回复:  
wlan\_add\_card=>  
wlan\_create\_thread(wlan\_service\_main\_thread, &priv->MainThread, "wlan\_main\_service");  
=>wlan\_service\_main\_thread=>wlan\_exec\_next\_cmd=>  
将调用wlan\_enter\_ps和wlan\_exit\_ps

sbi\_interrupt=>从sdio口上传来的中断数据,sdio\_irq\_thread=>process\_sdio\_pending\_irqs=>调用func->irq\_handler(func);即本.  
在mmc\_signal\_sdio\_irq=>将调用wake\_up\_process(host->sdio\_irq\_thread);来唤醒该irq处理线程,可能还有其他命令需要处理wlan\_exec\_next\_cmd  
这个pxamci\_irq就是mmc的物理irq中断了,pxamci\_irq=>mmc\_signal\_sdio\_irq(host->mmc);

wlan\_exec\_next\_cmd=>只要cmd链表上CmdNode还存在,  
那么就会执行wlan\_dnld\_cmd\_to\_fw(wlan\_private \* priv, CmdCtrlNode \* CmdNode)将CmdNode中的数据下发下去,  
然后重新触发wlan\_mod\_timer(&Adapter->MrvDrvCommandTimer, MRVDRV\_TIMER\_5S);  
也就是wlan\_cmd\_timeout\_func命令超时处理函数,  
在cmd已经有了恢复之后,在主线程中调用wlan\_process\_cmdresp,立即调用wlan\_cancel\_timer(&Adapter->MrvDrvCommandTimer);来删除定时器

wlan\_service\_main\_thread=>每次唤醒都会检查  
====  
/\* Execute the next command \*/  
if (!priv->wlan\_dev.cmd\_sent && !Adapter->CurCmd)  
wlan\_exec\_next\_cmd(priv);  
====

wlan\_prepare\_cmd=>  
wlan\_hostcmd\_ioctl=>  
获取一个空闲的CmdNode节点wlan\_get\_cmd\_node,当完成赋值之后,执行如下语句,将CmdNode节点添加到处理队列中:  
wlan\_insert\_cmd\_to\_pending\_q(Adapter, CmdNode, TRUE);  
wake\_up\_interruptible(&priv->MainThread.waitQ);  
另外在数组中  
/\*  
\* iwconfig settable callbacks  
\*/  
static const iw\_handler wlan\_handler\[\]这个数组中全部是回调函数,

/\*\* wlan\_handler\_def \*/  
struct iw\_handler\_def wlan\_handler\_def = \{  
num\_standard:sizeof(wlan\_handler) / sizeof(iw\_handler),  
num\_private:sizeof(wlan\_private\_handler) / sizeof(iw\_handler),  
num\_private\_args:sizeof(wlan\_private\_args) / sizeof(struct iw\_priv\_args),  
standard:(iw\_handler \*) wlan\_handler,  
private:(iw\_handler \*) wlan\_private\_handler,  
private\_args:(struct iw\_priv\_args \*) wlan\_private\_args,  
\#if WIRELESS\_EXT > 20  
get\_wireless\_stats:wlan\_get\_wireless\_stats,  
\#endif  
\};  
在wlan\_add\_card函数中  
dev->wireless\_handlers = (struct iw\_handler\_def \*) &wlan\_handler\_def;

===============在kernel的net中使用wireless extention扩展接口

static iw\_handler get\_handler(struct net\_device \*dev, unsigned int cmd)  
\{  
/\* Don't "optimise" the following variable, it will crash \*/  
unsigned int index; /\* \*MUST\* be unsigned \*/

/\* Check if we have some wireless handlers defined \*/  
if (dev->wireless\_handlers == NULL)  
return NULL;

/\* Try as a standard command \*/  
index = cmd - SIOCIWFIRST;  
if (index < dev->wireless\_handlers->num\_standard)  
return dev->wireless\_handlers->standard\[index\];

/\* Try as a private command \*/  
index = cmd - SIOCIWFIRSTPRIV;  
if (index < dev->wireless\_handlers->num\_private)  
return dev->wireless\_handlers->private\[index\];

/\* Not found \*/  
return NULL;  
\}

=>sock\_ioctl  
=>dev\_ioctl  
\+++/\* Take care of Wireless Extensions \*/  
\+++if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST)  
\+++return wext\_handle\_ioctl(net, &ifr, cmd, arg);  
=>wext\_handle\_ioctl  
=>wireless\_process\_ioctl(struct net \*net, struct ifreq \*ifr, unsigned int cmd)  
=>get\_handler(dev, cmd);如果没有实现该cmd,那么将调用dev->do\_ioctl来处理,

wlan\_reassoc\_timer\_func=>  
wmm\_start\_queue=>  
wlan\_tx\_packet=>  
wlan\_tx\_timeout=>  
wlan\_remove\_card=>  
wlan\_hostcmd\_ioctl=>  
wlan\_auto\_deep\_sleep=>  
wlan\_set\_deep\_sleep=>  
wlan\_prepare\_cmd=>  
wlan\_cmd\_timeout\_func=>  
将调用wake\_up\_interruptible(&priv->MainThread.waitQ);唤醒wlan\_service\_main\_thread主处理线程.

wlan\_hard\_start\_xmit=>wlan\_tx\_packet发送数据包  
dev->tx\_timeout = wlan\_tx\_timeout;  
wlan\_initialize\_timer(&Adapter->MrvDrvCommandTimer, wlan\_cmd\_timeout\_func, priv);

int wlan\_do\_ioctl(struct net\_device \*dev, struct ifreq \*req, int cmd)  
\{  
...  
case WLAN\_WAKEUP\_MT:  
if (wrq->u.data.length > 0)  
Adapter->IntCounter++;  
wake\_up\_interruptible(&priv->MainThread.waitQ);  
break;  
...  
\}

在wlan\_process\_cmdresp()处理完该cmd之后,调用  
wlan\_insert\_cmd\_to\_free\_q=>wlan\_clean\_cmd\_noder,从命令链表上删除已经处理完成的cmd\_node,  
wlan\_clean\_cmd\_noder然后pTempNode->CmdWaitQWoken = TRUE;同时如果该cmd\_node是一个被阻塞等待的,那么唤醒等待的程序.  
wake\_up\_interruptible(&pTempNode->cmdwait\_q);

Available private ioctls :  
set (8BE2) : set 1024 char & get 0  
connStatus (0004) : set 1024 char & get 2047 char  
driverVer (0005) : set 1024 char & get 2047 char  
bainfo (0006) : set 1024 char & get 2047 char  
descinfo (0007) : set 1024 char & get 2047 char  
radio\_off (000A) : set 1024 char & get 2047 char  
radio\_on (000B) : set 1024 char & get 2047 char  
show (0015) : set 1024 char & get 2047 char  
adhocEntry (0016) : set 1024 char & get 2047 char  
bbp (8BE3) : set 2047 char & get 2047 char  
mac (8BE5) : set 1024 char & get 1024 char  
rf (8BF3) : set 2047 char & get 2047 char  
e2p (8BE7) : set 1024 char & get 1024 char  
stat (8BE9) : set 0 & get 2047 char

get\_site\_survey (8BED) : set 0 & get 1024 char 查看网络状态

Connect to stongest open AP

设置命令  
iwpriv ra0 set SSID=""  
iwpriv ra0 set Channel=0  
iwpriv ra0 set NetworkType=Infra  
iwpriv ra0 set AuthMode=SHARED  
iwpriv ra0 set EncrypType=WEP  
iwpriv ra0 set DefaultKeyID=1  
iwpriv ra0 set Key1="whatever"  
iwpriv ra0 set SSID="some\_ssed"  
iwpriv ra0 set WPAPSK="wpa\_key"

...

显示命令

iwpriv ra0 show SSID

iwpriv ra0 show Channel  
iwpriv ra0 show NetworkType

iwpriv ra0 show AuthMode

iwpriv ra0 show EncrypType

iwpriv ra0 show DefaultKeyID  
iwpriv ra0 show Key1  
iwpriv ra0 show WPAPSK

...

./iwpriv ra0 show 无线网卡功能参数  
ra0 show:  
SSID  
WirelessMode  
TxBurst  
TxPreamble  
TxPower  
Channel  
BGProtection  
RTSThreshold  
FragThreshold  
HtBw  
HtMcs  
HtGi  
HtOpMode  
HtExtcha  
HtMpduDensity  
HtBaWinSize  
HtRdg  
HtAmsdu  
HtAutoBa  
CountryRegion  
CountryRegionABand  
CountryCode  
PktAggregate  
WmmCapable  
IEEE80211H  
NetworkType  
WPAPSK  
AutoReconnect  
AuthMode  
EncrypType  
DefaultKeyID  
Key1  
Key2  
Key3  
Key4  
PMK  
轉自：http://hi.baidu.com/fghzone/blog/item/4131382a6a57ff88033bf6f0.html