sync internal

2025-05-31 22:51:00 +00:00 · 2020-12-14 13:32:15 +01:00 · 2020-12-14 13:32:15 +01:00 · 5deb8d18f6
commit 5deb8d18f6
parent eefaa7a576
12 changed files with 307 additions and 25 deletions
--- a/README.md
+++ b/README.md
@ -26,7 +26,7 @@ Openwifi code has dual licenses. AGPLv3 is the opensource license. For non-opens
  - 2MHz for 802.11ah in sub-GHz
  - 10MHz for 802.11p/vehicle in 5.9GHz
 - CSI (Channel State Information, freq offset, equalizer to computer) [[CSI notes](doc/app_notes/csi.md)]
- IQ capture (real-time AGC, RSSI, IQ sample to computer) [[IQ notes](doc/app_notes/iq.md)]
+- IQ capture (real-time AGC, RSSI, IQ sample to computer) [[IQ notes](doc/app_notes/iq.md)][[IQ notes for dual antenna](doc/app_notes/iq_2ant.md)]
 - On roadmap: **802.11ax**

 **Performance (AP: openwifi at channel 44, client: TL-WDN4200 N900 USB Dongle):**
--- a/doc/app_notes/README.md
+++ b/doc/app_notes/README.md
@ -5,3 +5,4 @@ Application notes collect many small topics about using openwifi in different sc
 - [Communication between two SDR boards under ad-hoc mode](ad-hoc-two-sdr.md)
 - [From CSI (Channel State Information) to CSI (Chip State Information)](csi.md)
 - [Capture IQ sample, AGC gain, RSSI with many types of trigger condition](iq.md)
+- [Capture dual antenna IQ for multi-purpose (capture collision)](iq_2ant.md)
--- a/doc/app_notes/iq.md
+++ b/doc/app_notes/iq.md
@ -25,7 +25,7 @@ We implement the **IQ sample capture** with interesting extensions: many **trigg
  loop 128 side info count 99
  ...
  ```
-  If the second number (61, 99, ...) is not zero and keeps increasing, that means the IQ sample is going to the computer smoothly.
+  If the second number (side info count 61, 99, ...) keeps increasing, that means the trigger condition is met from time to time and the IQ sample is going to the computer smoothly.
  
 - Open another terminal on the computer, and run:
  ```
@ -47,10 +47,10 @@ We implement the **IQ sample capture** with interesting extensions: many **trigg
  For each element, the actual size is 64bit.
  - timestamp: 64bit TSF timer value when the capture is triggered.
  - IQ
-    - The first two 16bit are used for I/Q sample
+    - The first two 16bit are used for I/Q sample from the antenna currently used
    - The 3rd 16bit is AD9361 AGC gain (bit7 -- lock/unlock; bit6~0 -- gain value)
    - The 4th 16bit is RSSI (half dB, uncalibrated). Please check xpu.v and sdr.c to understand how the raw RSSI value is finally calibrated and reported to Linux mac80211.
-  
+    
  The python and Matlab scripts are recommended for you to understand the IQ packet format precisely.

 ## Config the IQ capture and interval
@ -67,7 +67,7 @@ We implement the **IQ sample capture** with interesting extensions: many **trigg
  ```
  ./side_ch_ctl wh8dY
  ```
-  The parameter **Y** specifies the trigger condition. Valid range 0 ~ 15, which is explained in this table.
+  The parameter **Y** specifies the trigger condition. Valid range 0 ~ 31, which is explained in this table.
  
  value|meaning
  -----|-------
@ -87,6 +87,22 @@ We implement the **IQ sample capture** with interesting extensions: many **trigg
  13|AD9361 AGC from unlock to lock
  14|AD9361 AGC gain goes above the threshold
  15|AD9361 AGC gain goes below the threshold
+  16|phy_tx_started signal from openofdm tx core
+  17|phy_tx_done signal from openofdm tx core
+  18|positive edge of tx_bb_is_ongoing from xpu core
+  19|negative edge of tx_bb_is_ongoing from xpu core
+  20|positive edge of tx_rf_is_ongoing from xpu core
+  21|negative edge of tx_rf_is_ongoing from xpu core
+  22|phy_tx_started and this tx packet needs ACK
+  23|phy_tx_done and this tx packet needs ACK
+  24|positive edge of tx_bb_is_ongoing and this tx packet needs ACK
+  25|negative edge of tx_bb_is_ongoing and this tx packet needs ACK
+  26|positive edge of tx_rf_is_ongoing and this tx packet needs ACK
+  27|negative edge of tx_rf_is_ongoing and this tx packet needs ACK
+  28|tx_bb_is_ongoing and I/Q amplitude from the other antenna is above rssi_or_iq_th
+  29|tx_rf_is_ongoing and I/Q amplitude from the other antenna is above rssi_or_iq_th
+  30|demod_is_ongoing from openofdm_rx and phy_tx_start is issued
+  31|demod_is_ongoing from openofdm_rx and tx_bb_is_ongoing from xpu core is valid
  
  To set the RSSI threshold
  ```
@ -112,7 +128,7 @@ We implement the **IQ sample capture** with interesting extensions: many **trigg
  ```
  insmod side_ch.ko iq_len_init=3000
  ```
-  Here 3000 is an example. **ATTENTION:** You need to specify **iq_len_init** explicitly to turn on IQ capture, which will turn off CSI. Insert the side_ch.ko without any parameter will run CSI mode.
+  Here 3000 is an example. **ATTENTION:** You need to specify **iq_len_init** explicitly to turn on IQ capture, which will turn off the default CSI mode. Insert the side_ch.ko without any parameter will run the default CSI mode.
  - When launch the python script, use:
  ```
  python3 iq_capture.py 3000
--- a/doc/app_notes/iq_2ant.md
+++ b/doc/app_notes/iq_2ant.md
@ -0,0 +1,52 @@
+Instead of [**normal IQ sample capture**](iq.md), this app note introduce how to enable the I/Q capture for dual antenna. In this dual antenna mode, the RSSI and AGC status won't be captured as in the normal mode. Instead, they are replaced by the I/Q samples from the other antenna. But you are suggested to read the [**normal IQ sample capture**](iq.md) to understand how do we use the side channel to capture I/Q sample by different trigger conditions.
+
+In this app note, we show how to use the dual antenna I/Q capture to capture the collision.
+
+## Quick start
+  The currently selected antenna (rx0 by default if you do not select explicitly by set_ant.sh) is always used for communication and I/Q capture. Meanwhile, the other antenna (rx1) will be also avaliable for capturing rx I/Q if you are using AD9361 based RF board, such as fmcomms2/3 and adrv9361z7035, by turning on the **dual antenna capture** mode. In this case, you can place the other antenna (rx1) close to the communication peer (for example, the other WiFi node) to capture the potential collision by monitoring rx1 I/Q. The nature of collision is that both sides of a communication link are trying to do transmission at the same time.
+  
+  The collision capture steps:
+  - Change rx1 AGC to manual mode instead of fast_attack in rf_init.sh by:
+  ```
+  echo manual > in_voltage1_gain_control_mode
+  ```
+  - Change rx1 gain to a low level, such as 20, by:
+  ```
+  echo 20 > in_voltage1_hardwaregain
+  ```
+  - Use the new rf_init.sh script to boot up the SDR board, and setup the working scenario.
+  - Setup the side channel:
+  ```
+  insmod side_ch.ko iq_len_init=8187
+  (8187 should be <4096 if smaller FPGA, like z7020, is used)
+  ./side_ch_ctl wh11d2000
+  (Set a smaller pre_trigger_len 2000, because we want to see what happens after the trigger instead of long period stored before the trigger)
+  ```
+  - Put the other antenna (rx1) close to the peer WiFi node, set trigger condition to 23 (baseband tx done)
+  ```
+  ./side_ch_ctl wh8d23
+  ```
+  - Enable the **dual antenna capture** mode
+  ```
+  ./side_ch_ctl wh3h11
+  ```
+  - Run some traffic between the SDR board and the peer WiFi node, and start the user space I/Q capture program
+  ```
+  ./side_ch_ctl g
+  ```
+  If the printed "**side info count**" is increasing, it means the trigger condition is met from time to time.
+  - On remote computer, run
+  ```
+  python3 iq_capture_2ant.py
+  ```
+  Above script will plot the real-time rx0 and rx1 I/Q captured each time trigger condition met. Meanwhile the script also prints the maximum amplitutde of the rx0 and rx1 I/Q samples. Check the 3rd column that is displayed by the script: Those small value printing indicate noise (most probably, because the rx1 gain is very low). The big value printing indicate a packet from rx1 (although rx1 has very low gain, rx1 is very close to the peer WiFi node). Go through the noise and the packet max I/Q amplitude numbers from rx1 printing (the 3rd column), and decide a threshold value that is significantly higher than the noise but less than those big values (packets).
+  - Set trigger condition to 29, which means that rx1 I/Q is found larger than a threshold while SDR is transmitting -- this means a collision condition is captured because rx1 I/Q implies the transmitting from the peer WiFi node. The threshold value is decided in the previous step (2500 is assumed here).
+  ```
+  (Quit side_ch_ctl by Ctrl+C)
+  ./side_ch_ctl wh8d29
+  ./side_ch_ctl wh9d2500
+  ./side_ch_ctl g
+  ```
+  - Now the trigger condition can capture the case where both sides happen to transmit in an overlapped duration. If the  printed "**side info count**" is increasing, it means the collision happens from time to time.
+  - You can also see it via iq_capture_2ant.py or do offline analysis by test_iq_2ant_file_display.m 
+  - Check the **iq1** signal in FPGA ILA/probe (triggered by signal "iq_trigger") for further debug if you want to know what exactly happened when collision is captured.
--- a/driver/hw_def.h
+++ b/driver/hw_def.h
@ -245,6 +245,7 @@ const char *xpu_compatible_str = "sdr,xpu";
 #define XPU_REG_TSF_LOAD_VAL_LOW_ADDR     (2*4)
 #define XPU_REG_TSF_LOAD_VAL_HIGH_ADDR    (3*4)
 #define XPU_REG_BAND_CHANNEL_ADDR         (4*4)
+#define XPU_REG_DIFS_ADVANCE_ADDR         (5*4)
 #define XPU_REG_RSSI_DB_CFG_ADDR          (7*4)
 #define XPU_REG_LBT_TH_ADDR               (8*4)
 #define XPU_REG_CSMA_DEBUG_ADDR           (9*4)
@ -337,6 +338,9 @@ struct xpu_driver_api {
 	void (*XPU_REG_BAND_CHANNEL_write)(u32 value);
 	u32  (*XPU_REG_BAND_CHANNEL_read)(void);

+	void (*XPU_REG_DIFS_ADVANCE_write)(u32 value);
+	u32  (*XPU_REG_DIFS_ADVANCE_read)(void);
+
 	u32  (*XPU_REG_TRX_STATUS_read)(void);
 	u32  (*XPU_REG_TX_RESULT_read)(void);

--- a/driver/sdr.c
+++ b/driver/sdr.c
@ -148,7 +148,9 @@ static void ad9361_rf_set_channel(struct ieee80211_hw *dev,
 		} else {
 			priv->rssi_correction = 148;
 		}
-		xpu_api->XPU_REG_LBT_TH_write((priv->rssi_correction-62)<<1);
+
+		// xpu_api->XPU_REG_LBT_TH_write((priv->rssi_correction-62)<<1);
+		xpu_api->XPU_REG_LBT_TH_write((priv->rssi_correction-68)<<1); // make the threshold lower to avoid ping pang around the signal tail after some rx packet

 		if (actual_rx_lo < 2500) {
 			//priv->slot_time = 20; //20 is default slot time in ERP(OFDM)/11g 2.4G; short one is 9.
@ -987,8 +989,7 @@ static int openwifi_start(struct ieee80211_hw *dev)
 	// rssi_half_db_th = 87<<1; // -62dBm // will settup in runtime in _rf_set_channel
 	// xpu_api->XPU_REG_LBT_TH_write(rssi_half_db_th); // set IQ rssi th step .5dB to xxx and enable it

-	// // xpu_api->XPU_REG_CSMA_CFG_write(3); // cw_min
-	// xpu_api->XPU_REG_CSMA_CFG_write(3);
+	// xpu_api->XPU_REG_CSMA_CFG_write(3); // cw_min -- already set in xpu.c

 	//xpu_api->XPU_REG_SEND_ACK_WAIT_TOP_write( ((40)<<16)|0 );//high 16bit 5GHz; low 16 bit 2.4GHz (Attention, current tx core has around 1.19us starting delay that makes the ack fall behind 10us SIFS in 2.4GHz! Need to improve TX in 2.4GHz!)
 	//xpu_api->XPU_REG_SEND_ACK_WAIT_TOP_write( ((51)<<16)|0 );//now our tx send out I/Q immediately
@ -999,8 +1000,8 @@ static int openwifi_start(struct ieee80211_hw *dev)

 	tx_intf_api->TX_INTF_REG_CTS_TOSELF_WAIT_SIFS_TOP_write( ((16*10)<<16)|(10*10) );//high 16bit 5GHz; low 16 bit 2.4GHz. counter speed 10MHz is assumed
 	
-	//xpu_api->XPU_REG_BB_RF_DELAY_write(51); // fine tuned value at 0.005us. old: dac-->ant port: 0.6us, 57 taps fir at 40MHz: 1.425us; round trip: 2*(0.6+1.425)=4.05us; 4.05*10=41
-	xpu_api->XPU_REG_BB_RF_DELAY_write(49);//add .5us for slightly longer fir
+	// //xpu_api->XPU_REG_BB_RF_DELAY_write(51); // fine tuned value at 0.005us. old: dac-->ant port: 0.6us, 57 taps fir at 40MHz: 1.425us; round trip: 2*(0.6+1.425)=4.05us; 4.05*10=41
+	// xpu_api->XPU_REG_BB_RF_DELAY_write(47);//add .5us for slightly longer fir -- already in xpu.c
 	xpu_api->XPU_REG_MAC_ADDR_write(priv->mac_addr);

 	// setup time schedule of 4 slices
@ -1401,7 +1402,7 @@ static void openwifi_configure_filter(struct ieee80211_hw *dev,
 	u32 filter_flag;

 	(*total_flags) &= SDR_SUPPORTED_FILTERS;
-//	(*total_flags) |= FIF_ALLMULTI; //because we always pass all multicast (no matter it is for us or not) to upper layer
+	(*total_flags) |= FIF_ALLMULTI; //because we need to pass all multicast (no matter it is for us or not) to upper layer

 	filter_flag = (*total_flags);

--- a/driver/xpu/xpu.c
+++ b/driver/xpu/xpu.c
@ -132,6 +132,14 @@ static inline u32 XPU_REG_BAND_CHANNEL_read(void){
 	return reg_read(XPU_REG_BAND_CHANNEL_ADDR);
 }

+static inline void XPU_REG_DIFS_ADVANCE_write(u32 Data) {
+	reg_write(XPU_REG_DIFS_ADVANCE_ADDR, Data);
+}
+
+static inline u32 XPU_REG_DIFS_ADVANCE_read(void){
+	return reg_read(XPU_REG_DIFS_ADVANCE_ADDR);
+}
+
 static inline u32 XPU_REG_TRX_STATUS_read(void){
 	return reg_read(XPU_REG_TRX_STATUS_ADDR);
 }
@ -331,7 +339,8 @@ static inline u32 hw_init(enum xpu_mode mode){

 	//xpu_api->XPU_REG_MAX_NUM_RETRANS_write(3); // if this > 0, it will override mac80211 set value, and set static retransmission limit
 	
-	xpu_api->XPU_REG_BB_RF_DELAY_write(49);
+	// xpu_api->XPU_REG_BB_RF_DELAY_write((1<<8)|47);
+	xpu_api->XPU_REG_BB_RF_DELAY_write((10<<8)|40); // extended rf is ongoing for perfect muting. (10<<8)|40 is verified good for zcu102/zed

 	// setup time schedule of 4 slices
 	// slice 0
@ -391,14 +400,16 @@ static inline u32 hw_init(enum xpu_mode mode){
 	//xpu_api->XPU_REG_CSMA_DEBUG_write((1<<31)|(20<<24)|(4<<19)|(3<<14)|(10<<7)|(5));
 	xpu_api->XPU_REG_CSMA_DEBUG_write(0);
 	
-	//xpu_api->XPU_REG_CSMA_CFG_write(3); //normal CSMA
-	xpu_api->XPU_REG_CSMA_CFG_write(0xe0000000); //high priority
+	xpu_api->XPU_REG_CSMA_CFG_write(3); //normal CSMA
+	// xpu_api->XPU_REG_CSMA_CFG_write(0xe0000000); //high priority

 	xpu_api->XPU_REG_SEND_ACK_WAIT_TOP_write( ((51)<<16)|0 );//now our tx send out I/Q immediately

 	xpu_api->XPU_REG_RECV_ACK_COUNT_TOP0_write( (((45+2+2)*10 + 15)<<16) | 10 );//2.4GHz. extra 300 clocks are needed when rx core fall into fake ht detection phase (rx mcs 6M)
 	xpu_api->XPU_REG_RECV_ACK_COUNT_TOP1_write( (((51+2+2)*10 + 15)<<16) | 10 );//5GHz. extra 300 clocks are needed when rx core fall into fake ht detection phase (rx mcs 6M)

+	xpu_api->XPU_REG_DIFS_ADVANCE_write(2); //us
+
 	printk("%s hw_init err %d\n", xpu_compatible_str, err);
 	return(err);
 }
@ -458,6 +469,9 @@ static int dev_probe(struct platform_device *pdev)
 	xpu_api->XPU_REG_BAND_CHANNEL_write=XPU_REG_BAND_CHANNEL_write;
 	xpu_api->XPU_REG_BAND_CHANNEL_read=XPU_REG_BAND_CHANNEL_read;

+	xpu_api->XPU_REG_DIFS_ADVANCE_write=XPU_REG_DIFS_ADVANCE_write;
+	xpu_api->XPU_REG_DIFS_ADVANCE_read=XPU_REG_DIFS_ADVANCE_read;
+
 	xpu_api->XPU_REG_TRX_STATUS_read=XPU_REG_TRX_STATUS_read;
 	xpu_api->XPU_REG_TX_RESULT_read=XPU_REG_TX_RESULT_read;

--- a/kernel_boot/kernel_config
+++ b/kernel_boot/kernel_config
@ -670,7 +670,9 @@ CONFIG_IP_PNP_RARP=y
 CONFIG_NET_IPIP=m
 # CONFIG_NET_IPGRE_DEMUX is not set
 CONFIG_NET_IP_TUNNEL=m
-# CONFIG_IP_MROUTE is not set
+CONFIG_IP_MROUTE=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
 CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 # CONFIG_NET_UDP_TUNNEL is not set
@ -710,7 +712,33 @@ CONFIG_DEFAULT_CUBIC=y
 # CONFIG_DEFAULT_RENO is not set
 CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_TCP_MD5SIG is not set
-# CONFIG_IPV6 is not set
+CONFIG_IPV6=m
+# CONFIG_IPV6_ROUTER_PREF is not set
+# CONFIG_IPV6_OPTIMISTIC_DAD is not set
+# CONFIG_INET6_AH is not set
+# CONFIG_INET6_ESP is not set
+# CONFIG_INET6_IPCOMP is not set
+# CONFIG_IPV6_MIP6 is not set
+# CONFIG_IPV6_ILA is not set
+# CONFIG_INET6_XFRM_TUNNEL is not set
+# CONFIG_INET6_TUNNEL is not set
+CONFIG_INET6_XFRM_MODE_TRANSPORT=m
+CONFIG_INET6_XFRM_MODE_TUNNEL=m
+CONFIG_INET6_XFRM_MODE_BEET=m
+# CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set
+# CONFIG_IPV6_VTI is not set
+CONFIG_IPV6_SIT=m
+# CONFIG_IPV6_SIT_6RD is not set
+CONFIG_IPV6_NDISC_NODETYPE=y
+# CONFIG_IPV6_TUNNEL is not set
+# CONFIG_IPV6_FOU is not set
+# CONFIG_IPV6_FOU_TUNNEL is not set
+# CONFIG_IPV6_MULTIPLE_TABLES is not set
+CONFIG_IPV6_MROUTE=y
+CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IPV6_PIMSM_V2=y
+# CONFIG_IPV6_SEG6_LWTUNNEL is not set
+# CONFIG_IPV6_SEG6_HMAC is not set
 # CONFIG_NETWORK_SECMARK is not set
 CONFIG_NET_PTP_CLASSIFY=y
 # CONFIG_NETWORK_PHY_TIMESTAMPING is not set
@ -741,7 +769,7 @@ CONFIG_NF_CT_PROTO_SCTP=y
 CONFIG_NF_CT_PROTO_UDPLITE=y
 CONFIG_NF_CONNTRACK_AMANDA=y
 CONFIG_NF_CONNTRACK_FTP=y
-CONFIG_NF_CONNTRACK_H323=y
+CONFIG_NF_CONNTRACK_H323=m
 CONFIG_NF_CONNTRACK_IRC=y
 CONFIG_NF_CONNTRACK_BROADCAST=y
 CONFIG_NF_CONNTRACK_NETBIOS_NS=y
@ -767,6 +795,7 @@ CONFIG_NF_NAT_TFTP=y
 CONFIG_NF_NAT_REDIRECT=y
 CONFIG_NETFILTER_SYNPROXY=y
 CONFIG_NF_TABLES=y
+# CONFIG_NF_TABLES_INET is not set
 CONFIG_NF_TABLES_NETDEV=y
 CONFIG_NFT_EXTHDR=y
 CONFIG_NFT_META=y
@ -821,10 +850,10 @@ CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y
 CONFIG_NETFILTER_XT_TARGET_NOTRACK=y
 CONFIG_NETFILTER_XT_TARGET_RATEEST=y
 CONFIG_NETFILTER_XT_TARGET_REDIRECT=y
-CONFIG_NETFILTER_XT_TARGET_TEE=y
-CONFIG_NETFILTER_XT_TARGET_TPROXY=y
+CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
 CONFIG_NETFILTER_XT_TARGET_TRACE=y
-CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
 CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=y

 #
@ -900,7 +929,7 @@ CONFIG_NFT_REDIR_IPV4=y
 CONFIG_NF_NAT_SNMP_BASIC=y
 CONFIG_NF_NAT_PROTO_GRE=y
 CONFIG_NF_NAT_PPTP=y
-CONFIG_NF_NAT_H323=y
+CONFIG_NF_NAT_H323=m
 CONFIG_IP_NF_IPTABLES=y
 CONFIG_IP_NF_MATCH_AH=y
 CONFIG_IP_NF_MATCH_ECN=y
@ -921,6 +950,18 @@ CONFIG_IP_NF_RAW=y
 CONFIG_IP_NF_ARPTABLES=y
 CONFIG_IP_NF_ARPFILTER=y
 CONFIG_IP_NF_ARP_MANGLE=y
+
+#
+# IPv6: Netfilter Configuration
+#
+# CONFIG_NF_DEFRAG_IPV6 is not set
+# CONFIG_NF_CONNTRACK_IPV6 is not set
+# CONFIG_NF_SOCKET_IPV6 is not set
+# CONFIG_NF_TABLES_IPV6 is not set
+CONFIG_NF_DUP_IPV6=m
+# CONFIG_NF_REJECT_IPV6 is not set
+CONFIG_NF_LOG_IPV6=m
+# CONFIG_IP6_NF_IPTABLES is not set
 # CONFIG_IP_DCCP is not set
 # CONFIG_IP_SCTP is not set
 # CONFIG_RDS is not set
@ -940,6 +981,7 @@ CONFIG_VLAN_8021Q=m
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
 # CONFIG_PHONET is not set
+# CONFIG_6LOWPAN is not set
 # CONFIG_IEEE802154 is not set
 # CONFIG_NET_SCHED is not set
 # CONFIG_DCB is not set
@ -973,6 +1015,7 @@ CONFIG_NET_FLOW_LIMIT=y
 # CONFIG_AF_RXRPC is not set
 # CONFIG_AF_KCM is not set
 # CONFIG_STREAM_PARSER is not set
+CONFIG_FIB_RULES=y
 CONFIG_WIRELESS=y
 CONFIG_WEXT_CORE=y
 CONFIG_WEXT_PROC=y
--- a/kernel_boot/kernel_config_zynqmp
+++ b/kernel_boot/kernel_config_zynqmp
@ -646,10 +646,12 @@ CONFIG_IP_PNP=y
 CONFIG_IP_PNP_DHCP=y
 CONFIG_IP_PNP_BOOTP=y
 CONFIG_IP_PNP_RARP=y
-# CONFIG_NET_IPIP is not set
+CONFIG_NET_IPIP=y
 # CONFIG_NET_IPGRE_DEMUX is not set
 CONFIG_NET_IP_TUNNEL=y
-# CONFIG_IP_MROUTE is not set
+CONFIG_IP_MROUTE=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
 CONFIG_SYN_COOKIES=y
 # CONFIG_NET_IPVTI is not set
 # CONFIG_NET_UDP_TUNNEL is not set
@ -694,7 +696,9 @@ CONFIG_IPV6_NDISC_NODETYPE=y
 # CONFIG_IPV6_FOU is not set
 # CONFIG_IPV6_FOU_TUNNEL is not set
 # CONFIG_IPV6_MULTIPLE_TABLES is not set
-# CONFIG_IPV6_MROUTE is not set
+CONFIG_IPV6_MROUTE=y
+CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IPV6_PIMSM_V2=y
 # CONFIG_IPV6_SEG6_LWTUNNEL is not set
 # CONFIG_IPV6_SEG6_HMAC is not set
 CONFIG_NETWORK_SECMARK=y
@ -1048,6 +1052,7 @@ CONFIG_BT_WILINK=y
 # CONFIG_AF_RXRPC is not set
 # CONFIG_AF_KCM is not set
 # CONFIG_STREAM_PARSER is not set
+CONFIG_FIB_RULES=y
 CONFIG_WIRELESS=y
 CONFIG_WEXT_CORE=y
 CONFIG_WEXT_PROC=y
--- a/user_space/prepare_kernel.sh
+++ b/user_space/prepare_kernel.sh
@ -54,6 +54,7 @@ git submodule update $LINUX_KERNEL_SRC_DIR_NAME
 cd $OPENWIFI_DIR/$LINUX_KERNEL_SRC_DIR_NAME
 git checkout 2019_R1
 git pull origin 2019_R1
+# git reset --hard 4fea7c5
 cp $OPENWIFI_DIR/driver/xilinx_dma/xilinx_dma.c $OPENWIFI_DIR/$LINUX_KERNEL_SRC_DIR_NAME/drivers/dma/xilinx/xilinx_dma.c
 cp $LINUX_KERNEL_CONFIG_FILE ./.config
 source $XILINX_DIR/SDK/2018.3/settings64.sh
--- a/user_space/side_ch_ctl_src/iq_capture_2ant.py
+++ b/user_space/side_ch_ctl_src/iq_capture_2ant.py
@ -0,0 +1,101 @@
+#
+# openwifi side info receive and display program
+# Xianjun jiao. putaoshu@msn.com; xianjun.jiao@imec.be
+#
+import os
+import sys
+import socket
+import numpy as np
+import matplotlib.pyplot as plt
+
+def display_iq(iq0_capture, iq1_capture):
+    fig_iq_capture = plt.figure(0)
+    fig_iq_capture.clf()
+
+    ax_iq0 = fig_iq_capture.add_subplot(211)
+    # ax_iq0.set_xlabel("sample")
+    ax_iq0.set_ylabel("I/Q")
+    ax_iq0.set_title("rx0 I/Q")
+    plt.plot(iq0_capture.real, 'b')
+    plt.plot(iq0_capture.imag, 'r')
+    plt.ylim(-32767, 32767)
+
+    ax_iq1 = fig_iq_capture.add_subplot(212)
+    ax_iq1.set_xlabel("sample")
+    ax_iq1.set_ylabel("I/Q")
+    ax_iq1.set_title("rx1 I/Q")
+    plt.plot(iq1_capture.real, 'b')
+    plt.plot(iq1_capture.imag, 'r')
+    plt.ylim(-32767, 32767)
+    fig_iq_capture.show()
+    plt.pause(0.0001)
+
+def parse_iq(iq, iq_len):
+    # print(len(iq), iq_len)
+    num_dma_symbol_per_trans = 1 + iq_len
+    num_int16_per_trans = num_dma_symbol_per_trans*4 # 64bit per dma symbol
+    num_trans = round(len(iq)/num_int16_per_trans)
+    # print(len(iq), iq.dtype, num_trans)
+    iq = iq.reshape([num_trans, num_int16_per_trans])
+    
+    timestamp = iq[:,0] + pow(2,16)*iq[:,1] + pow(2,32)*iq[:,2] + pow(2,48)*iq[:,3]
+    iq0_capture = iq[:,4::4] + iq[:,5::4]*1j
+    iq1_capture = iq[:,6::4] + iq[:,7::4]*1j
+    # print(num_trans, iq_len, iq0_capture.shape, iq1_capture.shape)
+
+    iq0_capture = iq0_capture.reshape([num_trans*iq_len,])
+    iq1_capture = iq1_capture.reshape([num_trans*iq_len,])
+
+    return timestamp, iq0_capture, iq1_capture
+
+UDP_IP = "192.168.10.1" #Local IP to listen
+UDP_PORT = 4000         #Local port to listen
+
+sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) # UDP
+sock.bind((UDP_IP, UDP_PORT))
+
+# align with side_ch_control.v and all related user space, remote files
+MAX_NUM_DMA_SYMBOL = 8192
+
+if len(sys.argv)<2:
+    print("Assume iq_len = 8187! (Max UDP 65507 bytes; (65507/8)-1 = 8187)")
+    iq_len = 8187
+else:
+    iq_len = int(sys.argv[1])
+    print(iq_len)
+    # print(type(num_eq))
+
+if iq_len>8187:
+    iq_len = 8187
+    print('Limit iq_len to 8187! (Max UDP 65507 bytes; (65507/8)-1 = 8187)')
+
+num_dma_symbol_per_trans = 1 + iq_len
+num_byte_per_trans = 8*num_dma_symbol_per_trans
+
+if os.path.exists("iq_2ant.txt"):
+    os.remove("iq_2ant.txt")
+iq_fd=open('iq_2ant.txt','a')
+
+while True:
+    try:
+        data, addr = sock.recvfrom(MAX_NUM_DMA_SYMBOL*8) # buffer size
+        # print(addr)
+        test_residual = len(data)%num_byte_per_trans
+        # print(len(data)/8, num_dma_symbol_per_trans, test_residual)
+        if (test_residual != 0):
+            print("Abnormal length")
+
+        iq = np.frombuffer(data, dtype='int16')
+        np.savetxt(iq_fd, iq)
+
+        timestamp, iq0_capture, iq1_capture = parse_iq(iq, iq_len)
+        print(timestamp, max(iq0_capture.real), max(iq1_capture.real))
+        display_iq(iq0_capture, iq1_capture)
+
+    except KeyboardInterrupt:
+        print('User quit')
+        break
+
+print('close()')
+side_info_fd.close()
+sock.close()
--- a/user_space/side_ch_ctl_src/test_iq_2ant_file_display.m
+++ b/user_space/side_ch_ctl_src/test_iq_2ant_file_display.m
@ -0,0 +1,44 @@
+% Xianjun Jiao. xianjun.jiao@imec.be; putaoshu@msn.com
+
+clear all;
+close all;
+
+% iq_len = 8187; % default for big fpga
+iq_len = 4095; % for small fpga
+
+a = load('iq_2ant.txt');
+len_a = floor(length(a)/4)*4;
+a = a(1:len_a);
+
+b = reshape(a, [4, length(a)/4])';
+num_data_in_each_iq_capture = 1 + iq_len;
+num_iq_capture = floor(size(b,1)/num_data_in_each_iq_capture);
+
+iq0_capture =   zeros(iq_len, num_iq_capture);
+iq1_capture =   zeros(iq_len, num_iq_capture);
+
+for i=1:num_iq_capture
+    sp = (i-1)*num_data_in_each_iq_capture + 1;
+    ep = i*num_data_in_each_iq_capture;
+    timestamp(i) = b(sp,1) + (2^16)*b(sp,2) + (2^32)*b(sp,3) + (2^48)*b(sp,4);
+    iq0_capture(:,i) = b((sp+1):ep,1) + 1i.*b((sp+1):ep,2);
+    iq1_capture(:,i) = b((sp+1):ep,3) + 1i.*b((sp+1):ep,4);
+end
+iq0_capture = iq0_capture(:);
+iq1_capture = iq1_capture(:);
+
+figure; plot(timestamp); title('time stamp (TSF value)'); ylabel('us'); xlabel('packet');  grid on;
+
+figure;
+subplot(2,1,1); 
+plot(real(iq0_capture)); hold on; plot(imag(iq0_capture),'r'); title('rx0 I (blue) Q (red) sample'); xlabel('sample'); ylabel('I/Q'); grid on;
+subplot(2,1,2); 
+plot(real(iq1_capture)); hold on; plot(imag(iq1_capture),'r'); title('rx1 I (blue) Q (red) sample'); xlabel('sample'); ylabel('I/Q'); grid on;
+
+figure;
+a = abs(iq0_capture);
+b = abs(iq1_capture);
+a(a==0) = max(b);
+plot(a); hold on;
+plot(b,'r'); title('rx0 and rx1 abs'); xlabel('sample'); ylabel('abs'); grid on;
+legend('rx0','rx1');