Add CSI fuzzer counter attack paper.

Due to FPGA implementation, there CIR actually is [1, 0, c1, c2], not [1, c1, c2]

CONTRIBUTING.md

@@ -4,6 +4,6 @@ SPDX-FileCopyrightText: 2019 UGent
 SPDX-License-Identifier: AGPL-3.0-or-later
 -->
 
-CLA([Individual](https://users.ugent.be/~xjiao/openwifi-Individual.pdf), [Entity](https://users.ugent.be/~xjiao/openwifi-Entity.pdf)) needs to be signed and sent to Filip.Louagie@UGent.be before you contributing.
+CLA([Individual](https://github.com/open-sdr/openwifi-hw-img/raw/master/doc_repo/openwifi-Individual.pdf), [Entity](https://github.com/open-sdr/openwifi-hw-img/raw/master/doc_repo/openwifi-Entity.pdf)) needs to be signed and sent to Filip.Louagie@UGent.be before you contributing.
 
 CLA is generated by the [Project Harmony](http://www.harmonyagreements.org/index.html).

README.md

@@ -9,9 +9,10 @@ SPDX-License-Identifier: AGPL-3.0-or-later
 
 **openwifi:** Linux mac80211 compatible full-stack IEEE802.11/Wi-Fi design based on SDR (Software Defined Radio).
 
+[[Download img and Quick start](#Download-img-and-Quick-start)] [[**Tips for Windows users**](https://github.com/open-sdr/openwifi/discussions/341)]
+
 This repository includes Linux driver and software. **openwifi-hw** repository has the FPGA design. It is **YOUR RESPONSIBILITY** to follow your **LOCAL SPECTRUM REGULATION** or use **CABLE** to avoid potential interference over the air.
 
-[[Quick start](#Quick-start)]
 [[Project document](doc/README.md)]
 [[Application notes](doc/app_notes/README.md)]
 [[Videos](doc/videos.md)]
@@ -55,6 +56,7 @@ adrv9364z7020|[ADRV9364-Z7020 + ADRV1CRR-BOB](https://www.analog.com/en/design-c
 adrv9361z7035|[ADRV9361-Z7035 + ADRV1CRR-BOB/FMC](https://www.analog.com/en/design-center/evaluation-hardware-and-software/evaluation-boards-kits/ADRV9361-Z7035.html)|Need
 zc702_fmcs2|[Xilinx ZC702 board](https://www.xilinx.com/products/boards-and-kits/ek-z7-zc702-g.html) + [FMCOMMS2/3/4](https://www.analog.com/en/design-center/evaluation-hardware-and-software/evaluation-boards-kits/eval-ad-fmcomms2.html)|**NO** need
 antsdr|[MicroPhase](https://github.com/MicroPhase/) enhanced ADALM-PLUTO [Notes](kernel_boot/boards/antsdr/notes.md)|**NO** need
+e310v2|[MicroPhase](https://github.com/MicroPhase/) new antsdr [Notes](kernel_boot/boards/e310v2/README.md)|**NO** need
 antsdr_e200|[MicroPhase](https://github.com/MicroPhase/) enhanced ADALM-PLUTO (smaller/cheaper) [Notes](kernel_boot/boards/antsdr_e200/README.md)|**NO** need
 sdrpi|[HexSDR](https://github.com/HexSDR/) SDR in Raspberry Pi size [Notes](kernel_boot/boards/sdrpi/notes.md)|**NO** need
 zcu102_fmcs2|[Xilinx ZCU102 board](https://www.xilinx.com/products/boards-and-kits/ek-u1-zcu102-g.html) + [FMCOMMS2/3/4](https://www.analog.com/en/design-center/evaluation-hardware-and-software/evaluation-boards-kits/eval-ad-fmcomms2.html)|Need
@@ -64,7 +66,7 @@ neptunesdr|Low cost Zynq 7020 + AD9361 board|**NO** need
 - board_name is used to identify FPGA design in openwifi-hw/boards/ and FPGA image in openwifi-hw-img/boards
 - Don't have any boards? Or you like JTAG boot instead of SD card? Check our test bed [w-iLab.t](https://doc.ilabt.imec.be/ilabt/wilab/tutorials/openwifi.html) tutorial.
 
-[[Quick start](#Quick-start)]
+[[Download img and Quick start](#Download-img-and-Quick-start)]
 [[Basic operations](#Basic-operations)]
 [[Update FPGA](#Update-FPGA)]
 [[Update Driver](#Update-Driver)]
@@ -77,8 +79,8 @@ neptunesdr|Low cost Zynq 7020 + AD9361 board|**NO** need
 [[Project document](doc/README.md)]
 [[Application notes](doc/app_notes/README.md)]
 
-## Quick start
+## Download img and Quick start
-- Download [openwifi img](https://drive.google.com/file/d/1fb8eJGJAntOciCiGFVLfQs7m7ucRtSWD/view?usp=share_link), unzip and burn it into a SD card (>=16GB). After this operation, the SD card should have two partitions: BOOT and rootfs. To flash the SD card, SD card tool software (such as Startup Disk Creator in Ubuntu) or dd command can be used:
+- Download [openwifi img](https://drive.google.com/file/d/12egFLT9TclmY8m3vCMHmUuSne3qK0SWc/view?usp=sharing), unzip and burn it into a SD card (>=16GB). After this operation, the SD card should have two partitions: BOOT and rootfs. To flash the SD card, SD card tool software (such as Startup Disk Creator in Ubuntu) or dd command can be used:
   ```
   sudo dd bs=512 count=31116288 if=openwifi-xyz.img of=/dev/your_sdcard_dev
   (To have correct count value, better to check the .img file actual situation by "fdisk -l img_filename")
@@ -86,7 +88,7 @@ neptunesdr|Low cost Zynq 7020 + AD9361 board|**NO** need
 - Config the **correct files in the BOOT partition** according to the **board you have** by operation on your computer: 
   - Copy files in **BOOT/openwifi/board_name** to the base directory of BOOT partition.
   - Delete the **rootfs/root/kernel_modules** directory (if exist).
-  - Delete the **rootfs/root/etc/network/interfaces.new** directory (if exist).
+  - Delete the **rootfs/etc/network/interfaces.new** directory (if exist).
 - Insert the SD card to the board. Configure the board in SD booting mode. Connect antennas. Power on. 
 - Login to the board from your PC (PC Ethernet should have IP 192.168.10.1) with password **openwifi**.
   ```
@@ -96,7 +98,7 @@ neptunesdr|Low cost Zynq 7020 + AD9361 board|**NO** need
 - Then, run openwifi AP and the on board webserver
   ```
   raspi-config --expand-rootfs (Only needed when your SD card > 16GB. Run and reboot)
-  ./openwifi/setup_once.sh (Only need to run once for new board)
+  ./openwifi/setup_once.sh (Reboot the board. Only need to run once for new board)
   cd openwifi
   ./wgd.sh
   ./fosdem.sh
@@ -104,7 +106,7 @@ neptunesdr|Low cost Zynq 7020 + AD9361 board|**NO** need
   (Use "./fosdem-11ag.sh" to force 11a/g mode)
   ```
   **NOTE** adrv9361z7035 has ultra low TX power in 5GHz. Move **CLOSER** when you use that board in 5GHz!!!
-- After you see the "openwifi" SSID on your device (Phone/Laptop/etc), connect it. Browser to 192.168.13.1 on your device, you should see the webpage hosted by the webserver on board.
+- After you see the "openwifi" SSID on your device (Phone/Laptop/etc), connect it (If not get 192.168.13.* IP automatically, check [known issue](doc/known_issue/notter.md)). Browser to 192.168.13.1 on your device, you should see the webpage hosted by the webserver on board.
   - Note 1: If your device doesn't support 5GHz (ch44), please change the **hostapd-openwifi.conf** on board and re-run fosdem.sh.
   - Note 2: After ~2 hours, the Viterbi decoder will halt (Xilinx Evaluation License). Just reload FPGA ([method](doc/app_notes/drv_fpga_dynamic_loading.md)) or simply power cycle the board if it happens. (If output of "./sdrctl dev sdr0 get reg rx 20" is always the same, it means the decoder halts)
 - To give the Wi-Fi client internet access, configure routing/NAT **on the PC**:
@@ -138,9 +140,9 @@ The board actually is an Linux/Ubuntu computer which is running **hostapd** to o
 
 ## Update FPGA
 
-(Check [Driver and FPGA dynamic reloading app note](./doc/app_notes/drv_fpga_dynamic_loading.md) for more convenient way of updating FPGA and driver files without rebooting/power-cycle)
+Since the pre-built SD card image might not have the latest bug-fixes/updates, it is recommended to always copy the latest files in the [user_space](./user_space) directory on to the board. Then update the FPGA&Driver according to the Quick start of [this app note](doc/app_notes/radar-self-csi.md#quick-start). Following instructions are doing the same thing with extra info for environment setup.
 
-Since the pre-built SD card image might not have the latest bug-fixes/updates, it is recommended to always copy the latest files in the [user_space](./user_space) directory on to the board. Then update the fpga bitstream and driver (see next section) on to the board.
+(Check [Driver and FPGA dynamic reloading app note](./doc/app_notes/drv_fpga_dynamic_loading.md) for better understanding of updating FPGA and driver files without rebooting/power-cycle)
 
 - Install Vivado 2021.1. Make sure install Vitis as well. You should have this directory: your_Xilinx_install_directory/Vitis (NOT Vitis_HLS!)
   - If the Vitis is not installed, you can add it by running "Xilinx Design Tools --> Add Design Tools for Devices 2021.1" from Xilinx program group/menu in your OS start menu.
@@ -152,29 +154,18 @@ Since the pre-built SD card image might not have the latest bug-fixes/updates, i
   (The directory where you get the open-sdr/openwifi-hw-img repo via git clone)
   export BOARD_NAME=your_board_name
   ```
-- Pick the FPGA bitstream from openwifi-hw-img, and generate BOOT.BIN and transfer it on board via ssh channel:
+- Pick the FPGA bitstream from openwifi-hw-img, generate system_top.bit.bin and transfer it on board via ssh channel:
   ```
   cd openwifi/user_space; ./boot_bin_gen.sh $XILINX_DIR $BOARD_NAME $OPENWIFI_HW_IMG_DIR/boards/$BOARD_NAME/sdk/system_top.xsa
-  cd openwifi/kernel_boot/boards/$BOARD_NAME/output_boot_bin; scp ./BOOT.BIN root@192.168.10.122:
+  scp ./system_top.bit.bin root@192.168.10.122:openwifi/
   ```
-- On board: Put the BOOT.BIN into the BOOT partition.
+- Now the system_top.bit.bin is onboard in /root/openwifi/ directory. When wgd.sh runs onboard from that directory, it will discover the FPGA img file system_top.bit.bin and load it before loading driver .ko files.
-  ```
-  mount /dev/mmcblk0p1 /mnt
-  cp ~/BOOT.BIN /mnt
-  cd /mnt
-  sync
-  cd ~
-  umount /mnt
-  ```
-  **Power cycle** the board to load new FPGA bitstream.
-  
-  To avoid above manual operation, after BOOT.BIN is generated you can run **transfer_kernel_image_module_to_board.sh** from openwifi/user_space directory and then run **populate_kernel_image_module_reboot.sh** on board to have new FPGA and kernel image (check **prepare_kernel.sh** in the next section) taken effect.
 
 ## Update Driver
 
-(Check [Driver and FPGA dynamic reloading app note](./doc/app_notes/drv_fpga_dynamic_loading.md) for more convenient way of updating FPGA and driver files without rebooting/power-cycle)
+Since the pre-built SD card image might not have the latest bug-fixes/updates, it is recommended to always copy the latest files in the [user_space](./user_space) directory on to the board. Then update the FPGA&Driver according to the Quick start of [this app note](doc/app_notes/radar-self-csi.md#quick-start). Following instructions are doing the same thing with extra info for environment setup.
 
-Since the pre-built SD card image might not have the latest bug-fixes/updates, it is recommended to always copy the latest files in the [user_space](./user_space) directory on to the board. Then update the fpga bitstream (see previous section) and driver on to the board.
+(Check [Driver and FPGA dynamic reloading app note](./doc/app_notes/drv_fpga_dynamic_loading.md) for better understanding of updating FPGA and driver files without rebooting/power-cycle)
 
 - Prepare Analog Devices Linux kernel source code (only need to run once):
   ```

doc/README.md

@@ -14,6 +14,7 @@ Above figure shows software and hardware/FPGA modules that compose the openwifi
 - [sdrctl command](#sdrctl-command)
 - [Rx packet flow and filtering config](#Rx-packet-flow-and-filtering-config)
 - [Tx packet flow and config](#Tx-packet-flow-and-config)
+- [Understand the timestamp of WiFi packet](#Understand-the-timestamp-of-WiFi-packet)
 - [Regulation and channel config](#Regulation-and-channel-config)
 - [Analog and digital frequency design](#Analog-and-digital-frequency-design)
 - [Debug methods](#Debug-methods)
@@ -220,9 +221,9 @@ reg_idx|meaning|comment
 29|BSSID address high 16bit for BSSID filtering|auto set by xpu_api->XPU_REG_BSSID_FILTER_HIGH_write in openwifi_bss_info_changed of sdr.c
 30|MAC address low  32bit|auto set by XPU_REG_MAC_ADDR_write in sdr.c
 31|MAC address high 16bit|auto set by XPU_REG_MAC_ADDR_write in sdr.c
-37|addr2 of rx packet read back|bit31-0 are from bit47-16 of addr2 field in the received packet
 58|TSF runtime value low  32bit|read only
 59|TSF runtime value high 32bit|read only
+62|addr2 of rx packet read back|bit31-0 are from bit47-16 of addr2 field in the received packet
 63|git revision when build the FPGA|returned register value means git revision in hex format
 
 ## Rx packet flow and filtering config
@@ -266,6 +267,18 @@ Each time when FPGA sends a packet, an interrupt will be raised to Linux reporti
     - packet sending result: packet is sent successfully (FPGA receives ACK for this packet) or not. How many retransmissions have been done (in case FPGA doesn't receive ACK in time, FPGA will do retransmission according to CSMA/CA low MAC state)
   - send above information to upper layer (Linux mac80211 subsystem) via ieee80211_tx_status_irqsafe()
 
+## Understand the timestamp of WiFi packet
+
+The TSF timestamp shown in the usual wireshark snapshot is reported by openwifi Linux driver towards Linux mac80211 framework.
+![](https://user-images.githubusercontent.com/5212105/270659135-44a048ae-773f-48a7-bf3f-76ffc3ee399a.jpg)
+
+This TSF timestamp is attached to the DMA of the received packet in FPGA by reading the TSF timier (defined by 802.11 standard and implemented in FPGA) value while PHY header is received: [FPGA code snip](https://github.com/open-sdr/openwifi-hw/blob/14b1e840591f470ee945844cd3bb51a95d7da09f/ip/rx_intf/src/rx_intf_pl_to_m_axis.v#L201).
+
+Then openwifi driver report this timestamp value (together with the corresponding packet) to Linux via:
+https://github.com/open-sdr/openwifi/blob/0ce2e6b86ade2f6164a373b2e98d075eb7eecd9e/driver/sdr.c#L530
+
+To match the openwifi side channel collected data (CSI, IQ sample, etc.) to the TSF timestamp of the packet, please check: https://github.com/open-sdr/openwifi/discussions/344
+
 ## Regulation and channel config
 
 SDR is a powerful tool for research. It is the user's responsibility to align with local spectrum regulation when doing OTA (Over The Air) test, or do the test via cable (conducted test), or in a chamber to avoid any potential interference.

doc/app_notes/README.md

@@ -21,4 +21,5 @@ Application notes collect many small topics about using openwifi in different sc
 - [Access counter/statistics in driver](driver_stat.md)
 - [Frequent/usual trick on controlling Gain/Att/Frequency/CCA/LBT/CSMA/CW/Sensitivity/etc](frequent_trick.md)
 - [Driver and FPGA dynamic reloading](drv_fpga_dynamic_loading.md)
-- [owfuzz: a WiFi protocol fuzzing tool using openwifi.](https://github.com/alipay/WiFi-Protocol-Fuzzing-Tool) [[**Vulnerabilities**]](https://github.com/E7mer/Owfuzz)
+- [owfuzz: a WiFi protocol fuzzing tool using openwifi.](https://github.com/alipay/WiFi-Protocol-Fuzzing-Tool) [[**Vulnerabilities**]](https://github.com/alipay/Owfuzz#discovered-vulnerabilities)
+- [Build FPGA with High-Level Synthesis modules](hls.md)

doc/app_notes/csi.md

@@ -7,6 +7,8 @@ SPDX-License-Identifier: AGPL-3.0-or-later
 
 We extend the **CSI** (Channel State Information) to **CSI** (Chip State Information)!
 
+(This app note shows general CSI collection. To use self-Tx CSI in full duplex mode as **RADAR**, please refer to [WiFi CSI radar via self CSI capturing](radar-self-csi.md))
+
 ## Quick start
 - Power on the SDR board.
 - Connect a computer to the SDR board via Ethernet cable. The computer should have static IP 192.168.10.1. Open a terminal on the computer, and then in the terminal:
@@ -128,6 +130,8 @@ We extend the **CSI** (Channel State Information) to **CSI** (Chip State Informa
   The openwifi CSI feature could run with not only monitor mode but also other modes, such as AP-Client or ad-hoc mode. After the communication functionality is fully up in those modes, you can start CSI feature from "**insmod side_ch.ko**" and "**./side_ch_ctl g**" on board as described in the previous sections to extract CSI to your computer.
 
 ## Map the CSI information to the WiFi packet
+  Please check this discussion: https://github.com/open-sdr/openwifi/discussions/344
+  
   If you want to relate the CSI information to the WiFi packet, you need to capture WiFi packets (tcpdump/wireshark/etc) while capturing CSI. Then you can match the timestamp (TSF timer value) between WiFi packet and CSI information, because this is the unique same identity of a Wifi packet and related CSI information.
   
   Please learn the python and Matlab script to extract CSI information per packet according to your requirement.

doc/app_notes/csi_fuzzer.md

@@ -4,7 +4,8 @@ SPDX-FileCopyrightText: 2021 UGent
 SPDX-License-Identifier: AGPL-3.0-or-later
 -->
 
-[ACM WiSec 2021. Openwifi CSI fuzzer for authorized sensing and covert channels](https://dl.acm.org/doi/pdf/10.1145/3448300.3468255)
+- [ACM WiSec 2021. Openwifi CSI fuzzer for authorized sensing and covert channels](https://dl.acm.org/doi/pdf/10.1145/3448300.3468255)
+- [Privacy Protection in WiFi Sensing via CSI Fuzzing](https://ieeexplore.ieee.org/abstract/document/10818006)
 
 CSI (Channel State Information) of WiFi systems is available in some WiFi chips and can be used for sensing the environment (keystrokes, people, object) passively and secretly.
 

doc/app_notes/frequent_trick.md

@@ -20,22 +20,26 @@ Some usual/frequent control trick over the openwifi FPGA. You need to do these c
 In normal operation, different threshold is set to FPGA according to the different calibration of different frequency/channel by driver automatically. Show the current LBT threshold in FPGA:
 ```
 ./set_lbt_th.sh
+dmesg
 ```
-"reg  val: 00000086" means the current threshold is 134 (86 in Hex). Its unit is rssi_half_db. Check rssi_half_db_to_rssi_dbm()/rssi_dbm_to_rssi_half_db() in sdr.c to see the relation to rssi dBm.
+It shows: "sdr,sdr FPGA LBT threshold 166(-62dBm). The last_auto_fpga_lbt_th 166(-62dBm). rssi corr 145". Check rssi_half_db_to_rssi_dbm()/rssi_dbm_to_rssi_half_db() in sdr.c to see the relation to rssi dBm.
 
 Override a new threshold -NNdBm to FPGA, for example -70dBm:
 ```
 ./set_lbt_th.sh 70
+dmesg
 ```
 Above will disable the automatic CCA threshold setting from the openwifi driver.
 
 Recover the driver automatic control on the threshold:
 ```
 ./set_lbt_th.sh 0
+dmesg
 ```
 Disable the CCA by setting a very strong level as threshold, for example -1dBm:
 ```
 ./set_lbt_th.sh 1
+dmesg
 ```
 After above command, the CCA engine will always believe the channel is idle, because the rx signal strength not likely could exceed -1dBm.
   

doc/app_notes/hls.md

@@ -0,0 +1,38 @@
+<!--
+Author: Thijs Havinga
+SPDX-FileCopyrightText: 2019 UGent
+SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+FCCM2023 Poster: [Thijs Havinga, et al. Accelerating FPGA-Based Wi-Fi Transceiver Design and Prototyping by High-Level Synthesis](https://github.com/open-sdr/openwifi-hw-img/raw/master/doc_repo/Thijs-FCCM2023-poster.jpg)
+
+[Longer/detailed info about the poster](https://arxiv.org/abs/2305.13351)
+
+In order to speed up or ease FPGA development, it is possible to use High-Level Synthesis (HLS) for creating core baseband processing modules of openwifi. We have already programmed the receiver modules channel estimation and equalization in C++ and converted to Verilog using Vitis HLS. In order to use openwifi with these HLS modules, follow the [build instructions](#build-instructions).
+In order to modify these modules within Vitis HLS, follow [the instructions below](#modify-the-code-using-vitis-hls). 
+
+## Build instructions
+
+Follow the [Build FPGA](https://github.com/open-sdr/openwifi-hw#build-fpga) instructions till before generating ip_repo. In order to switch to the HLS-version of openofdm_rx, use the following commands:
+
+```
+cd ip/openofdm_rx
+git checkout dot11zynq_hls
+```
+
+Now continue with the instructions. Before generating the bitstream, update the openofdm_rx IP by making sure it is selected under "IP Status" and click "Upgrade Selected". Afterwards, continue with the instructions to generate the bitstream.
+
+## Modify the code using Vitis HLS
+When in the `openwifi-hw` folder, make sure to run:
+```
+./get_ip_openofdm_rx.sh
+cd ip/openofdm_rx
+git checkout dot11zynq_hls
+```
+Then start Vitis HLS and create a new project. Import either all source files (except those ending on '_test.cpp') in the [ch_gain_cal](https://github.com/open-sdr/openofdm/tree/dot11zynq_hls/hls/ch_gain_cal) or [equalizer](https://github.com/open-sdr/openofdm/tree/dot11zynq_hls/hls/equalizer) folder to modify the channel estimation or equalizer module, respectively. Choose either 'equalizer' or 'ch_gain_cal' as top-level module. Next, select `equalizer_test.cpp` or `ch_gain_cal_test.cpp` as testbench file. In 'Part selection', select the right part corresponding to your board. 
+
+After modifying the code and making sure C simulation and cosimulation is running fine, select 'Export RTL', which will generate a ZIP file with a folder `hdl/verilog` containing the generated Verilog files. Replace the current folder `openwifi-hw/ip/openofdm_rx/hls/equalizer/hdl/verilog/` (or `.../ch_gain_cal/hdl/verilog`) with this folder and change the `openofdm_rx.tcl` file to include the newly generated Verilog files. See [here](https://github.com/open-sdr/openofdm/blob/dot11zynq_hls/openofdm_rx.tcl#L268) for an example. If you modified the top-level function arguments, you will need to interface them accordingly in [dot11.v](https://github.com/open-sdr/openofdm/blob/dot11zynq_hls/verilog/dot11.v).
+
+Now follow the [Build FPGA](https://github.com/open-sdr/openwifi-hw#build-fpga) instructions, starting at the step "Generate ip_repo for the top level FPGA project". It will then use the modified .tcl file to include the correct files for your modified HLS module and build the FPGA using it.
+
+A similar approach can be followed to create other HLS modules, where you would need to execute these steps in the folder of the IP to be modified and integrate the modules in the corresponding top-level Verilog file.

doc/app_notes/iq.md

@@ -166,6 +166,8 @@ We implement the **IQ sample capture** with interesting extensions: many **trigg
   The openwifi IQ capture feature could run with not only monitor mode but also other modes, such as AP-Client or ad-hoc mode. After the communication functionality is fully up in those modes, you can start IQ capture from "**insmod side_ch.ko**" and "**./side_ch_ctl g**" on board as described in the previous sections to extract IQ information to your computer.
 
 ## Map the IQ information to the WiFi packet
+  (See this https://github.com/open-sdr/openwifi/discussions/344 to understand how to map the collected data to the packet via the TSF timestamp)
+  
   If you want to relate the IQ information to the WiFi packet, you need to capture WiFi packets (tcpdump/wireshark/etc) while capturing IQ. Then you can relate the timestamp between WiFi packet and IQ information. Please be noticed that the timestamp in the IQ information is the moment when capture is triggered, which could be different from the timestamp reported in the packet capture program. But since they share the same time base (TSF timer), you can relate them easily by analyzing the WiFi packet and IQ sample sequence.
   
   Please learn the python and Matlab script to extract IQ information per capture according to your requirement.

doc/app_notes/packet-iq-self-loopback-test.md

@@ -42,6 +42,7 @@ This makes the IQ sample, WiFi packet and CSI self loopback test possible. Readi
   ./sdrctl dev sdr0 set reg xpu 1 1
   # Set the loopback mode to over-the-air
   ./side_ch_ctl wh5h0
+  (./side_ch_ctl wh5h4 for FPGA internal loopback)
   # Relay the FPGA IQ capture to the host computer that will show the captured IQ later on)
   ./side_ch_ctl g0
   ```
@@ -146,8 +147,8 @@ Open another ssh session on board, then:
 cd openwifi
 ./sdrctl dev sdr0 set reg rx_intf 3 256
 (Above command let the FPGA Tx IQ come to receiver directly. Set 256 back to 0 to let receiver back connect to AD9361 RF frontend)
-./sdrctl dev sdr0 set reg rx 5 0
+./sdrctl dev sdr0 set reg rx 5 768
-(Disable the receiver FFT window shift. By default it is 1 -- good for multipath, overfitting for direct loopback)
+(Disable the receiver FFT window shift. By default it is 1 (768+1) -- good for multipath, overfitting for direct loopback)
 ./inject_80211/inject_80211 -m n -r 7 -n 99999 -s 1400 -d 1000000 sdr0
 (Transmit 802.11n MCS7 1400Byte packet every second)
 ```

doc/app_notes/perf_counter.md

@@ -61,4 +61,4 @@ register idx|meaning               |note
 
 Note: addr2 (source/sender's MAC address) target setting uses only 32bit. For address 6c:fd:b9:4c:b1:c1, you set b94cb1c1
 
-Note: read register 37 of xpu for some addr2 captured by the receiver
+Note: read register 62 of xpu for some addr2 captured by the receiver

doc/app_notes/radar-self-csi.md

@@ -6,6 +6,9 @@ SPDX-License-Identifier: AGPL-3.0-or-later
 
 One super power of the openwifi platform is "**Full Duplex**" which means that openwifi baseband can receive its own TX signal. Just like a radar! This brings a unique capability of "**joint radar and communication**" to openwifi. For instance, put two directional antennas to openwifi TX and RX, and the **CSI** (Channel State Information) of the self-TX signal will refect the change of the target object.
  ![](./openwifi-radar.jpg)
+ ![](./sensing.png)
+
+(See this https://github.com/open-sdr/openwifi/discussions/344 to understand how to map the collected data to the packet via the TSF timestamp)
 
 ## Quick start
 - Power on the SDR board.
@@ -13,42 +16,57 @@ One super power of the openwifi platform is "**Full Duplex**" which means that o
   ```
   ssh root@192.168.10.122
   (password: openwifi)
-  cd openwifi
+  ```
-  ./fosdem.sh
+- On computer, build the latest driver and FPGA package after clone/update openwifi and openwifi-hw-img repository:
-  (After the AP started by above command, you can connect a WiFi client to this openwifi AP)
+  ```
-  (Or setup other scenario according to your requirement)
+  export XILINX_DIR=your_Xilinx_install_directory
-  ifconfig
+  (Example: export XILINX_DIR=/opt/Xilinx. The Xilinx directory should include sth like: Downloads, Vitis, etc.)
-  (Write down the openwifi AP MAC address. For example 66:55:44:33:22:5a)
+  export OPENWIFI_HW_IMG_DIR=your_openwifi-hw-img_directory
-  insmod side_ch.ko num_eq_init=0
+  (The directory where you get the open-sdr/openwifi-hw-img repo via git clone)
+  export BOARD_NAME=your_board_name
+  (Check the BOARD_NAME definitions in README)
+
+  cd openwifi/user_space
+  ./drv_and_fpga_package_gen.sh $OPENWIFI_HW_IMG_DIR $XILINX_DIR $BOARD_NAME
+  scp drv_and_fpga.tar.gz root@192.168.10.122:openwifi/
+  scp ./side_ch_ctl_src/side_ch_ctl.c root@192.168.10.122:openwifi/
+  scp ./inject_80211/* root@192.168.10.122:openwifi/inject_80211/
+  ```
+- On SDR board (/root/openwifi directory):
+  ```
+  cd /root/openwifi/
+  ./wgd.sh drv_and_fpga.tar.gz
+  ./monitor_ch.sh sdr0 1
+  insmod ./drv_and_fpga/side_ch.ko
+  gcc -o side_ch_ctl side_ch_ctl.c
   ./side_ch_ctl wh1h4001
   ./side_ch_ctl wh7h4433225a
-  (Above two commands ensure receiving CSI only from XX:XX:44:33:22:5a. In this case, it is the openwifi self-TX)
+  (Above two commands ensure receiving CSI only from XX:XX:44:33:22:5a, which will be set by our own packet injector later)
   ./sdrctl dev sdr0 set reg xpu 1 1
   (Above unmute the baseband self-receiving to receive openwifi own TX signal/packet)
   ./side_ch_ctl g0
   ```
-  You should see on board outputs like:
+- Open another ssh session on SDR board:
   ```
-  loop 64 side info count 4
+  cd /root/openwifi/inject_80211
-  loop 128 side info count 5
+  make
-  ...
+  ./inject_80211 -m g -r 4 -t d -e 0 -b 5a -n 99999999 -s 20 -d 1000 sdr0
-  ```
-  If the second number (4, 5, ...) keeps increasing, that means the CSI is going to the computer smoothly.
 
-- On your computer (NOT ssh onboard!), run:
+  (Above command injects the 802.11a/g packet, for 802.11n packet please use:
+  ./inject_80211 -m n -r 4 -t d -e 8 -b 5a -n 99999999 -s 20 -d 1000 sdr0)
+  ```
+- Now you should see the increasing numbers in the previous ssh terminal of the SDR board.
+- On your computer (NOT ssh session!), run:
   ```
   cd openwifi/user_space/side_ch_ctl_src
-  python3 side_info_display.py 0
+  python3 side_info_display.py 8 waterfall
   ```
-  The python script needs "matplotlib.pyplot" and "numpy" packages installed. Now you should see figures showing run-time **CSI** and **frequency offset**. Meanwhile the python script prints the **timestamp**.
+  The python script needs "matplotlib.pyplot" and "numpy" packages installed. Now you should see figures showing run-time **CSI**, **CSI waterfall**, **Equalizer out** and **frequency offset**. The following photo shows the CSI change in the waterfall plot when I left my seat in front of two directional antennas (Tx/Rx antenna).
-  ![](./csi-screen-shot-radar.jpg)
-  
-  While running, all CSI data is also stored into a file **side_info.txt**. A matlab script **test_side_info_file_display.m** is offered to help you do CSI analysis offline. In this case, run **test_side_info_file_display(0)** in Matlab.
-  ![](./csi-screen-shot-radar-matlab.jpg)
-  
-  The following picture is generated by data processing on the captured openwifi CSI while people move in front of two directional antennas (Tx/Rx antenna).
   ![](./sensing.png)
   
+  While running, all CSI data is also stored into a file **side_info.txt**. A matlab script **test_side_info_file_display.m** is offered to help you do CSI analysis offline. In this case, run **test_side_info_file_display** in Matlab.
+  ![](./csi-screen-shot-radar-matlab.jpg)
+  
 Please learn the python and Matlab script for CSI data structure per packet according to your requirement.
   
 Do read the [normal CSI app note](csi.md) to understand the basic implementation architecture.

doc/cite-openwifi-github-code.md

@@ -1,8 +1,8 @@
 ```
 @electronic{openwifigithub,
-            author = {Jiao, Xianjun and Liu, Wei and Mehari, Michael},
+            author = {Jiao, Xianjun and Liu, Wei and Mehari, Michael and Thijs, Havinga and Muhammad, Aslam},
             title = {open-source IEEE802.11/Wi-Fi baseband chip/FPGA design},
-            url = {https://github.com/open-sdr/openwifi},
+            url = {https://github.com/open-sdr},
-            year = {2019},
+            year = {2023},
 }
 ```

doc/known_issue/notter.md

@@ -1,7 +1,10 @@
 # Known issue
 
 - [Network issue in quick start](#Network-issue-in-quick-start)
+- [EXT4 fs error rootfs issue](#EXT4-fs-error-rootfs-issue)
 - [antsdr e200 UART console](#antsdr-e200-UART-console)
+- [Client can not get IP](#Client-can-not-get-IP)
+- [No space left on device](#No-space-left-on-device)
 
 ## Network issue in quick star
 
@@ -12,6 +15,38 @@ If can't ssh to the board via Ethernet for the 1st time, you might need to delet
 
 If still can't ssh the board via Ethernet, you should use UART console (/dev/ttyUSBx, /dev/ttyCH341USBx, etc.) to monitor what happened during booting.
 
+## EXT4 fs error rootfs issue
+
+Sometimes, the 1st booting after flashing SD card might encounter "EXT4-fs error (device mmcblk0p2): ..." error on neptunesdr, changing SD card flashing tool might solve this issue. Some tool candidates:
+- gnome-disks
+- Startup Disk Creator
+- win32diskimager
+
 ## antsdr e200 UART console
 
 If can't see the UART console in Linux (/dev/ttyUSB0 or /dev/ttyCH341USB0), according to https://github.com/juliagoda/CH341SER, you might need to do `sudo apt remove brltty`
+
+## Client can not get IP
+
+If the client can not get IP from the openwifi AP, just re-run "service isc-dhcp-server restart" on board and do re-connect from the client.
+
+## No space left on device
+It might be due to too many dmesg/log/journal, disk becomes full. 
+```
+systemd-journald[5694]: Failed to open system journal: No space left on device
+```
+You can try following operations.
+```
+systemd-tmpfiles --clean
+sudo systemd-tmpfiles --remove
+rm /var/log/* -rf
+apt --autoremove purge rsyslog
+```
+Add followings into `/etc/systemd/journald.conf`
+```
+SystemMaxUse=64M
+Storage=volatile
+RuntimeMaxUse=64M
+ForwardToConsole=no
+ForwardToWall=no
+```

doc/publications.md

@@ -11,16 +11,27 @@ You can also cite openwifi github code: [LaTex example](cite-openwifi-github-cod
 Publications in category:
 - [Feature Functionality and System](#Feature-Functionality-and-System)
 - [TSN Time Sensitive Network and RT Real Time](#TSN-Time-Sensitive-Network-and-RT-Real-Time)
-- [CSI Channel State Information and Security](#CSI-Channel-State-Information-and-Security)
+- [CSI Sensing and Security](#CSI-Sensing-and-Security)
+- [WiFi and Cellular 5G 6G](#WiFi-and-Cellular-5G-6G)
 
 ## Feature Functionality and System
 - [Xianjun Jiao, et al. openwifi: a free and open-source IEEE802.11 SDR implementation on SoC. VTC2020 spring Antwerp](https://www.orca-project.eu/wp-content/uploads/sites/4/2020/03/openwifi-vtc-antwerp-PID1249076.pdf)
-- [Cedric Den Haese, The initial 802.11n 2*2 MIMO and diversity (CSD/Combining) work. UGent master thesis 2021](https://users.ugent.be/~xjiao/Cedric_Den_Haese_masterproef.pdf)
+- [Cedric Den Haese, The initial 802.11n 2*2 MIMO and diversity (CSD/Combining) work. UGent master thesis 2021](https://github.com/open-sdr/openwifi-hw-img/raw/master/doc_repo/Cedric_Den_Haese_masterproef.pdf)
 - [Paul Zanna, et al. A novel method for utilizing RF information from IEEE 802.11 frames in Software Defined Networks. MethodsX 2021](https://www.sciencedirect.com/science/article/pii/S2215016121003368)
-- [Luca Baldesi, et al. ChARM: NextG Spectrum Sharing Through Data-Driven Real-Time O-RAN Dynamic Control. INFOCOM 2022](https://ece.northeastern.edu/wineslab/papers/BaldesiInfocom22.pdf)
 - [Thijs Havinga, et al. WIP: Achieving Self-Interference-Free Operation on SDR Platform with Critical TDD Turnaround Time. accepted WoWMoM2022 paper](https://arxiv.org/abs/2204.07354)
 - [Yingshuo Xi, Baiming Zhang. High-Throughput Open Source Viterbi Decoder for OpenWiFi. 2022 KU Leuven master thesis](https://github.com/BaimingZhang26213/viterbi_decoder)
 - [Merkebu Girmay, et al. Technology recognition and traffic characterization for wireless technologies in ITS band. Vehicular Communications Volume 39, February 2023, 100563](https://doi.org/10.1016/j.vehcom.2022.100563)
+- [Thijs Havinga, et al. Accelerating FPGA-Based Wi-Fi Transceiver Design and Prototyping by High-Level Synthesis. FCCM2023 Poster](https://github.com/open-sdr/openwifi-hw-img/raw/master/doc_repo/Thijs-FCCM2023-poster.jpg), [[Longer/detailed info about the poster](https://arxiv.org/abs/2305.13351)]
+- [Merkebu Girmay, et al. Intelligent Spectrum Sharing Between LTE and Wi-Fi Networks using Muted MBSFN Subframes. WAMICON 2023](https://ieeexplore.ieee.org/abstract/document/10124903)
+- [Thijs Havinga, et al. Improved TDD operation on Software-Defined Radio platforms towards future wireless standards. Computer Communications, Volume 209, 1 September 2023, Pages 178-187](https://doi.org/10.1016/j.comcom.2023.06.026)
+- [Yuyang Du, et al. The Power of Large Language Models for Wireless Communication System Development: A Case Study on FPGA Platforms. arxiv, Submitted on 14 Jul 2023 (v1), last revised 5 Sep 2023 (this version, v2)](https://arxiv.org/abs/2307.07319)
+- [Muhammad Aslam, et al. A novel hardware efficient design for IEEE 802.11ax compliant OFDMA transceiver](https://www.sciencedirect.com/science/article/pii/S0140366424000926?dgcid=coauthor)
+- [Trio Adiono, et al. FPGA Implementation of SFO for OFDM-based Network Enabled Li-Fi System. IEEE ISCAS 2024](https://ieeexplore.ieee.org/abstract/document/10557957)
+- [Trio Adiono, et al. A Scalable Design of A Full-Stack Real-Time OFDM Baseband Processor for Network-Enabled VLC Systems. IEEE Access 2024](https://ieeexplore.ieee.org/document/10589620)
+- [Roni Fagerholm, FPGA-based DECT-2020 New Radio Packet Detection. Master thesis, Aalto University, 30 September 2024](https://aaltodoc.aalto.fi/server/api/core/bitstreams/a5105c46-f4c6-4034-8024-96ed9e440feb/content)
+- [Hao Zhou, et al. Large Language Model (LLM) for Telecommunications: A Comprehensive Survey on Principles, Key Techniques, and Opportunities. IEEE Communications Surveys & Tutorials 2024](https://ieeexplore.ieee.org/document/10685369)
+- [Thijs Havinga, et al. Wi-Fi 6 Cross-Technology Interference Detection and Mitigation by OFDMA: an Experimental Study. arXiv, Submitted to EuCNC & 6G Summit 2025](https://arxiv.org/abs/2503.05429)
+- [Shyam Krishnan Venkateswaran, et al. Target wake time in IEEE 802.11 WLANs: Survey, challenges, and opportunities. Computer Communications, 2025](https://www.sciencedirect.com/science/article/pii/S0140366425000842)
 
 ## TSN Time Sensitive Network and RT Real Time
 - [Jetmir Haxhibeqiri, et al. Enabling TSN over IEEE 802.11: Low-overhead Time Synchronization for Wi-Fi Clients. ICIT2021](https://biblio.ugent.be/publication/8700714/file/8700715.pdf)
@@ -28,6 +39,7 @@ Publications in category:
 - [Muhammad Aslam, et al. High precision time synchronization on Wi-Fi based multi-hop network. CNERT2021](https://biblio.ugent.be/publication/8709058/file/8709060.pdf)
 - [Ingrid Moerman, et al. Interoperable Time-Sensitive Networking Towards 6G (invited presentation)](https://biblio.ugent.be/publication/8719532/file/8719533.pdf)
 - [Lihao Zhang, et al. A Just-In-Time Networking Framework for Minimizing Request-Response Latency of Wireless Time-Sensitive Applications. Arxiv 2021. Accepted by IEEE IoT journal 2022.](https://arxiv.org/abs/2109.03032)
+- [Jetmir Haxhibeqiri, et al. Enabling TSN over IEEE 802.11: Low-overhead Time Synchronization for Wi-Fi Clients. 22nd IEEE International Conference on Industrial Technology (ICIT) 2021](https://ieeexplore.ieee.org/document/9453686)
 - [Jetmir Haxhibeqiri, et al. Bringing Time-Sensitive Networking to Wireless Professional Private Networks. Wireless Personal Communications 2021](https://link.springer.com/article/10.1007/s11277-021-09056-0)
 - [Muhammad Aslam, et al. Hardware Efficient Clock Synchronization across Wi-Fi and Ethernet Based Network Using PTP. IEEE Transactions on Industrial Informatics 2021](https://ieeexplore.ieee.org/document/9573364)
 - [Zelin Yun, et al. RT-WiFi on Software-Defined Radio: Design and Implementation. accepted RTAS2022 paper and demo](https://arxiv.org/abs/2203.10390)
@@ -37,15 +49,50 @@ Publications in category:
 - [Pablo Avila-Campos, et al. Removing the Wires in Time-Sensitive Networks. 2022 61st FITCE International Congress Future Telecommunications: Infrastructure and Sustainability (FITCE)](https://ieeexplore.ieee.org/abstract/document/9934268)
 - [Pablo Avila-Campos, et al. Periodic Control Traffic Support in a Wireless Time-Sensitive Network. 2022 13th International Conference on Network of the Future (NoF)](https://ieeexplore.ieee.org/document/9942586)
 - [Gilson Miranda, et al. The Quality-Aware and Vertical-Tailored Management of Wireless Time-Sensitive Networks. IEEE Internet of Things Magazine ( Volume: 5, Issue: 4, December 2022)](https://ieeexplore.ieee.org/abstract/document/10012491)
+- [Gilson Miranda, et al. Enabling Time-Sensitive Network Management Over Multi-Domain Wired/Wi-Fi Networks. IEEE Transactions on Network and Service Management, 2023)](https://ieeexplore.ieee.org/document/10121738)
+- [Jetmir Haxhibeqiri, et al. To update or not: Dynamic traffic classification for high priority traffic in wireless TSN. IEEE WFCS2023](http://hdl.handle.net/1854/LU-01GZNGJFAJQRM3NX7FY5VRB4MR)
+- [Pablo Avila-Campos, et al. Residual Service Time Optimization for legacy Wireless-TSN end nodes. 2023 19th International Conference on Wireless and Mobile Computing, Networking and Communications (WiMob). p.466-471](https://ieeexplore.ieee.org/document/10187722)
+- [Dirk Dahlhaus, et al. Towards Functional Safety in Dynamic Distributed Systems. Journal of Mobile Multimedia, Vol. 20 1, 1–24.](https://biblio.ugent.be/publication/01HGD7JAZY0YAQ1T13HQV35JC0/file/01HGD7PD2WRP9QW7J1G964Z6Y7.pdf)
+- [Kouros Zanbour, et al. A Comprehensive Survey of Wireless Time-Sensitive Networking (TSN): Architecture, Technologies, Applications, and Open Issues. arXiv, 2 Dec 2023](https://arxiv.org/abs/2312.01204)
+- [Jetmir Haxhibeqiri, et al. Coordinated Spatial Reuse for WiFi Networks: A Centralized Approach. IEEE 20th International Conference on Factory Communication Systems (WFCS) 2024](https://ieeexplore.ieee.org/document/10540785/)
+- [Jetmir Haxhibeqiri, et al. Coordinated SR and Restricted TWT for Time Sensitive Applications in WiFi 7 Networks. IEEE Communications Magazine 2024](https://ieeexplore.ieee.org/document/10634074/)
+- [Ozgur Ozkaya, et al. Simulating and Validating openwifi W-TSN in ns-3, IEEE 20th International Conference on Factory Communication Systems (WFCS) 2024](https://ieeexplore.ieee.org/document/10540899)
+- [Pablo Avila-Campos, et al. Impactless association methods for wi-fi based time-sensitive networks. Wireless Networks Journal, 2024](https://dl.acm.org/doi/10.1007/s11276-024-03681-w)
+- [Pablo Avila-Campos, et al. Unlocking Mobility for Wi-Fi-based Wireless Time-Sensitive Networks. IEEE Access, 2024](https://ieeexplore.ieee.org/document/10443947)
+- [Analog Devices, AN-2597: An OFDM-Based HDL Reference Modem Using the AD936x RF Transceivers. November, 2024](https://www.analog.com/en/resources/app-notes/an-2597.html)
+- [Tianyu Zhang, et al. A Survey on Industrial Internet of Things (IIoT) Testbeds for Connectivity Research. arXiv 2024](https://arxiv.org/abs/2404.17485)
+- [Louis Adriaens, High-Precision Wireless Synchronization: When Wi-Fi meets UWB. IEEE/SICE International Symposium on System Integration (SII) 2025](https://ieeexplore.ieee.org/document/10870915)
+- [Yongchao Dang, Open Radio Intelligent Controller based Wireless Time Sensitive Networking for Industry 5.0. TechRxiv 2025](https://www.techrxiv.org/doi/full/10.36227/techrxiv.173750009.95972083)
 
-## CSI Channel State Information and Security
+## CSI Sensing and Security
 - [Marco Cominelli, et al. CSI MURDER. ORCA project opencall 2019](https://ans.unibs.it/projects/csi-murder/)
 - [Marco Cominelli, et al. IEEE 802.11 CSI randomization to preserve location privacy: An empirical evaluation in different scenarios. ELSEVIER Computer Networks, 2021](https://www.sciencedirect.com/science/article/abs/pii/S138912862100102X)
 - [Xianjun Jiao, et al. Openwifi CSI fuzzer for authorized sensing and covert channels. ACM WiSec 2021](https://dl.acm.org/doi/pdf/10.1145/3448300.3468255)
 - [Hongjian Cao, et al. OWFuzz: WiFi Protocol Fuzzing Tool Based on OpenWiFi. Blackhat asia 2021](https://www.blackhat.com/asia-21/arsenal/schedule/#owfuzz-wifi-protocol-fuzzing-tool-based-on-openwifi-22569), [[**code**]](https://github.com/alipay/Owfuzz)
-- [Steven Heijse, IEEE 802.11 Physical Layer Fuzzing Using OpenWifi. UGent master thesis 2021](https://users.ugent.be/~xjiao/Steven_Heijse_masterproef.pdf)
+- [Steven Heijse, IEEE 802.11 Physical Layer Fuzzing Using OpenWifi. UGent master thesis 2021](https://github.com/open-sdr/openwifi-hw-img/raw/master/doc_repo/Steven_Heijse_masterproef.pdf)
-- [Jasper Devreker, Developing IEEE 802.11 PHY fuzzing capabilities using the open source Openwifi project. UGent master thesis 2022](https://users.ugent.be/~xjiao/Jasper_Devreker_masterproef.pdf)
+- [Jasper Devreker, Developing IEEE 802.11 PHY fuzzing capabilities using the open source Openwifi project. UGent master thesis 2022](https://github.com/open-sdr/openwifi-hw-img/raw/master/doc_repo/Jasper_Devreker_masterproef.pdf)
-- [Thomas Schuddinck, Cybersecurity: Breaking IEEE 802.11 Devices at the Physical Layer. UGent master thesis 2022](https://users.ugent.be/~xjiao/Thomas_Schuddinck_masterproef.pdf)
+- [Thomas Schuddinck, Cybersecurity: Breaking IEEE 802.11 Devices at the Physical Layer. UGent master thesis 2022](https://github.com/open-sdr/openwifi-hw-img/raw/master/doc_repo/Thomas_Schuddinck_masterproef.pdf)
-- [Seppe Dejonckheere, The design of a CSI sensing authorisation mechanism using the open source Openwifi project. UGnet master thesis 2022](https://users.ugent.be/~xjiao/Seppe_Dejonckheere_masterproef.pdf)
+- [Seppe Dejonckheere, The design of a CSI sensing authorisation mechanism using the open source Openwifi project. UGnet master thesis 2022](https://github.com/open-sdr/openwifi-hw-img/raw/master/doc_repo/Seppe_Dejonckheere_masterproef.pdf)
+- [Marco Cominelli, et al. On the properties of device-free multi-point CSI localization and its obfuscation. ELSEVIER Computer Communications, 2022](https://www.sciencedirect.com/science/article/pii/S014036642200086X)
+- [Renato Lo Cigno, et al. Integrating CSI Sensing in Wireless Networks: Challenges to Privacy and Countermeasures. IEEE Network, 2022](https://ieeexplore.ieee.org/document/9919763)
+- [Renato Lo Cigno, et al. AntiSense: Standard-compliant CSI obfuscation against unauthorized Wi-Fi sensing. ELSEVIER Computer Communications, 2022](https://www.sciencedirect.com/science/article/pii/S0140366421004916)
+- [Mathy Vanhoef, et al. Testing and Improving the Correctness of Wi-Fi Frame Injection. ACM WiSec 2023](https://papers.mathyvanhoef.com/wisec2023-wifi-injection.pdf)
+- [Wen Liu, et al. A New Paradigm for Device-free Indoor Localization: Deep Learning with Error Vector Spectrum in Wi-Fi Systems. PIMRC 2023](https://arxiv.org/pdf/2304.06490.pdf)
+- [Paul Zanna, et al. Preventing Attacks on Wireless Networks Using SDN Controlled OODA Loops and Cyber Kill Chains. Sensors 2022, 22(23), 9481](https://www.mdpi.com/1986552)
+- [Hayoung Seong, et al. Practical Covert Wireless Unidirectional Communication in IEEE 802.11 Environment, IEEE Internet of Things Journal ( Volume: 10, Issue: 2, 15 January 2023)](https://ieeexplore.ieee.org/abstract/document/9881568)
+- [Fan Qi, et al. Deep Learning-based CSI Feedback in Wi-Fi Systems, arxiv, 2024](https://arxiv.org/pdf/2407.05905)
+- [Lorenzo Ghiro, et al. Wi-Fi Localization Obfuscation: An implementation in openwifi. ELSEVIER Computer Communications, 2023](http://www.sciencedirect.com/science/article/pii/S0140366423001111)
+- [Andreas Toftegaard Kristensen, et al. Monostatic Multi-Target Wi-Fi-Based Breathing Rate Sensing Using Openwifi, IEEE Wireless Communications and Networking Conference (WCNC) 2024](https://ieeexplore.ieee.org/document/10570912)
+- [Andreas Toftegaard Kristensen, et al. An SDR-Based Monostatic Wi-Fi System with Analog Self-Interference Cancellation for Sensing, arXiv, 11 DEC 2024](https://arxiv.org/abs/2412.08612) [[**block diagram**](AnSIC-sensing-correction.png)]
+- [Jesus A. Armenta-Garcia, et al. Wireless sensing applications with Wi-Fi Channel State Information, preprocessing techniques, and detection algorithms: A survey. Computer Communications Volume 224, 1 August 2024](https://www.sciencedirect.com/science/article/abs/pii/S0140366424002214?via%3Dihub)
+- [Tianyang Zhang, et al. Privacy Protection in WiFi Sensing via CSI Fuzzing, 2024 IEEE/ACM Symposium on Edge Computing (SEC), 04-07 December 2024](https://ieeexplore.ieee.org/abstract/document/10818006)
+- [Xianjun Jiao, et al. Single-Input-Multiple-Output Wi-Fi Radar for Vital Signal Sensing and Device Tracking, IEEE 5th International Symposium on Joint Communications & Sensing (JC&S) 2025](https://biblio.ugent.be/publication/01JMVPSR8AR08RRW9MC15FPF58)
+- [Renato Lo Cigno, et al. Communication and Sensing: Wireless PHY-Layer Threats to Security and Privacy for IoT Systems and Possible Countermeasures. information, MDPI, 2025](https://www.mdpi.com/2078-2489/16/1/31)
+- [Zhiming Chu, et al. Defeating CSI obfuscation mechanisms: A study on unauthorized Wi-Fi Sensing in wireless sensor network. Computer Networks, Volume 263, May 2025](https://www.sciencedirect.com/science/article/abs/pii/S1389128625001768)
+
+## WiFi and Cellular 5G 6G
+- [Luca Baldesi, et al. ChARM: NextG Spectrum Sharing Through Data-Driven Real-Time O-RAN Dynamic Control. INFOCOM 2022](https://ece.northeastern.edu/wineslab/papers/BaldesiInfocom22.pdf)
+- [Christian Arendt, et al. Empowering the Convergence of Wi-Fi and 5G for Future Private 6G Networks. Accepted by European Wireless 2023; 28th European Wireless Conference 2023](https://cni.etit.tu-dortmund.de/storages/cni-etit/r/Research/Publications/2023/Arendt_2023_EW/2023_openwifi_ew_cr.pdf)
+- [Liangdong Wei, et al. An Experimental Evaluation of ACK-based Passive Bandwidth Estimation Methods in Ad Hoc Networks, 9th International Conference on Computer and Communications (ICCC) 2023](https://ieeexplore.ieee.org/document/10507541)
 
 **Openwifi was born in ORCA project (EU's Horizon2020 programme under agreement number 732174).**

doc/videos.md

@@ -5,7 +5,11 @@
 - FOSDEM2021 presentation [[Flash back](https://twitter.com/jxjputaoshu/status/1358462741703491584?s=20)], [[link for CHN user](https://www.zhihu.com/zvideo/1340748826311974912)]; [[Presentation](https://video.fosdem.org/2021/D.radio/fsr_openwifi_opensource_wifi_chip.webm)], [[link for CHN user](https://www.zhihu.com/zvideo/1345036055104360448)]
 - FSF Libreplanet 2021 presentation [[Official](https://media.libreplanet.org/u/libreplanet/m/openwifi-project-the-dawn-of-the-free-libre-wifi-chip/)], [[LinuxReviews](https://linuxreviews.org/Openwifi_project:_The_dawn_of_the_free/libre_WiFi_chip)], [[link for CHN user](https://www.zhihu.com/zvideo/1373649688906883072)]
 - Openwifi industrial real-time high reliable low latency applications (EU Horizon 2020 SHOP4CF project) [[Youtube](https://youtu.be/p7zkkdMvPNc)], [[link for CHN user](https://www.zhihu.com/zvideo/1378413483944538113)]
+- WiFi CSI Radar: Joint communication and sensing [[Youtube](https://youtu.be/PUwpJuHZDhg)], [[link for CHN user](https://www.bilibili.com/video/BV1a94y1W7XL/?share_source=copy_web&vd_source=587e4ed61021396d31fd3a09c077969f)]
 - CSI fuzzer [[Youtube](https://youtu.be/aOPYwT77Qdw)], [[link for CHN user](https://www.zhihu.com/zvideo/1378409348163506177)], and ACM WiSec interview [[Youtube](https://youtu.be/ZOCV78aTaQg)], [[link for CHN user](https://www.bilibili.com/video/BV1Mo4y1C76t?share_source=copy_web)]
 - NGI zero, nlnet online session on future of European open hardware [[Session](https://nlnet.nl/news/2021/20210507-NGI-Zero-workshop-open-hardware.html)], [[Original record](https://archive.org/details/ngiforum-open-hardware-workshop-ngizero)], [[Youtube](https://youtu.be/m9Tw5VuHAfk)], [[link for CHN user](https://www.zhihu.com/zvideo/1379302398096285696)]
 - High Precision Time Synchronization on Wi-Fi based Multi-Hop Network [[Youtube](https://youtu.be/m5ryRArbdC8)], [[link for CHN user](https://www.zhihu.com/zvideo/1418222775224492032)]
 - FOSDEM2022 presentation [[Presentation](https://video.fosdem.org/2022/D.radio/radio_openwifi.webm)], [[link for CHN user](https://www.bilibili.com/video/BV12b4y1j7YK?share_source=copy_web)]
+- [Find the corresponding Wi-Fi packet in wireshark after openwifi CSI/IQ capture](https://github.com/open-sdr/openwifi/discussions/344) [[Youtube](https://youtu.be/iiiINz7XTGA)], [[link for CHN user](https://www.bilibili.com/video/BV13w411Y7GX/?share_source=copy_web&vd_source=587e4ed61021396d31fd3a09c077969f)]
+- CCC GPN22 DanielAW, How a Wifi chip works internally [[link](https://media.ccc.de/v/gpn22-380-how-a-wifi-chip-works-internally)]
+- FSiC2024, An opensource Wi-Fi chip, What, Why and How? [[link](https://wiki.f-si.org/index.php?title=An_opensource_Wi-Fi_chip,_What,_Why_and_How%3F)]

driver/hw_def.h

@@ -237,10 +237,11 @@ enum openofdm_rx_mode {
 // 11a/g BPSK 6m, Rx sensitivity level dmesg report -86dBm
 // priv->rssi_correction = 148; rssi_half_db/2 = 148-86=62; rssi_half_db = 124
 
-#define OPENOFDM_RX_RSSI_DBM_TH_DEFAULT (-95) //the best openwifi reported sensitivity is like -90/-92
+#define OPENOFDM_RX_RSSI_DBM_TH_DEFAULT (-85) //-85 will remove lots of false alarm. the best openwifi reported sensitivity is like -90/-92 (set it manually if conductive test with wifi tester)
 #define OPENOFDM_RX_DC_RUNNING_SUM_TH_INIT 64
 #define OPENOFDM_RX_MIN_PLATEAU_INIT 100
 #define OPENOFDM_RX_FFT_WIN_SHIFT_INIT 1
+#define OPENOFDM_RX_SMALL_EQ_OUT_COUNTER_TH 48
 
 #define OPENWIFI_MAX_SIGNAL_LEN_TH 1700 //Packet longer  than this threshold will result in receiver early termination. It goes to openofdm_rx/xpu/rx_intf
 

driver/openofdm_rx/openofdm_rx.c

@@ -65,7 +65,7 @@ static const struct of_device_id dev_of_ids[] = {
 MODULE_DEVICE_TABLE(of, dev_of_ids);
 
 static struct openofdm_rx_driver_api openofdm_rx_driver_api_inst;
-static struct openofdm_rx_driver_api *openofdm_rx_api = &openofdm_rx_driver_api_inst;
+struct openofdm_rx_driver_api *openofdm_rx_api = &openofdm_rx_driver_api_inst;
 EXPORT_SYMBOL(openofdm_rx_api);
 
 static inline u32 hw_init(enum openofdm_rx_mode mode){
@@ -97,7 +97,7 @@ static inline u32 hw_init(enum openofdm_rx_mode mode){
 	openofdm_rx_api->OPENOFDM_RX_REG_POWER_THRES_write((OPENOFDM_RX_DC_RUNNING_SUM_TH_INIT<<16)|OPENOFDM_RX_POWER_THRES_INIT); // turn on signal watchdog by default
 	openofdm_rx_api->OPENOFDM_RX_REG_MIN_PLATEAU_write(OPENOFDM_RX_MIN_PLATEAU_INIT);
 	openofdm_rx_api->OPENOFDM_RX_REG_SOFT_DECODING_write((OPENWIFI_MAX_SIGNAL_LEN_TH<<16)|(OPENWIFI_MIN_SIGNAL_LEN_TH<<12)|1); //bit1 enable soft decoding; bit15~12 min pkt length threshold; bit31~16 max pkt length threshold
-	openofdm_rx_api->OPENOFDM_RX_REG_FFT_WIN_SHIFT_write(OPENOFDM_RX_FFT_WIN_SHIFT_INIT);
+	openofdm_rx_api->OPENOFDM_RX_REG_FFT_WIN_SHIFT_write((OPENOFDM_RX_SMALL_EQ_OUT_COUNTER_TH<<4)|OPENOFDM_RX_FFT_WIN_SHIFT_INIT);
 
 	//rst
 	for (i=0;i<8;i++)

driver/openofdm_tx/openofdm_tx.c

@@ -56,7 +56,7 @@ static const struct of_device_id dev_of_ids[] = {
 MODULE_DEVICE_TABLE(of, dev_of_ids);
 
 static struct openofdm_tx_driver_api openofdm_tx_driver_api_inst;
-static struct openofdm_tx_driver_api *openofdm_tx_api = &openofdm_tx_driver_api_inst;
+struct openofdm_tx_driver_api *openofdm_tx_api = &openofdm_tx_driver_api_inst;
 EXPORT_SYMBOL(openofdm_tx_api);
 
 static inline u32 hw_init(enum openofdm_tx_mode mode){

driver/rx_intf/rx_intf.c

@@ -165,7 +165,7 @@ static const struct of_device_id dev_of_ids[] = {
 MODULE_DEVICE_TABLE(of, dev_of_ids);
 
 static struct rx_intf_driver_api rx_intf_driver_api_inst;
-static struct rx_intf_driver_api *rx_intf_api = &rx_intf_driver_api_inst;
+struct rx_intf_driver_api *rx_intf_api = &rx_intf_driver_api_inst;
 EXPORT_SYMBOL(rx_intf_api);
 
 static inline u32 hw_init(enum rx_intf_mode mode, u32 num_dma_symbol_to_pl, u32 num_dma_symbol_to_ps){

driver/sdr.c

@@ -112,7 +112,8 @@ static bool openwifi_is_radio_enabled(struct openwifi_priv *priv)
 	else
 		reg = ad9361_get_tx_atten(priv->ad9361_phy, 2);
 
-	if (reg == (AD9361_RADIO_ON_TX_ATT+priv->rf_reg_val[RF_TX_REG_IDX_ATT]))
+	// if (reg == (AD9361_RADIO_ON_TX_ATT+priv->rf_reg_val[RF_TX_REG_IDX_ATT]))
+  if (reg < AD9361_RADIO_OFF_TX_ATT)
 		return true;// 0 off, 1 on
 	return false;
 }
@@ -692,7 +693,7 @@ static irqreturn_t openwifi_tx_interrupt(int irq, void *dev_id)
 				seq_no = ring->bds[ring->bd_rd_idx].seq_no;
 
 				if (seq_no == 0xffff) {// it has been forced cleared by the openwifi_tx (due to out-of-order Tx of different queues to the air?)
-					printk("%s openwifi_tx_interrupt: WARNING wr%d rd%d last_bd_rd_idx%d i%d pkt_cnt%d prio%d fpga q%d hwq len%d bd prio%d len_mpdu%d seq_no%d skb_linked%p dma_mapping_addr%llu\n", sdr_compatible_str,
+					printk("%s openwifi_tx_interrupt: WARNING wr%d rd%d last_bd_rd_idx%d i%d pkt_cnt%d prio%d fpga q%d hwq len%d bd prio%d len_mpdu%d seq_no%d skb_linked%p dma_mapping_addr%u\n", sdr_compatible_str,
 					ring->bd_wr_idx, ring->bd_rd_idx, last_bd_rd_idx, i, pkt_cnt, prio, queue_idx, hw_queue_len, ring->bds[ring->bd_rd_idx].prio, ring->bds[ring->bd_rd_idx].len_mpdu, seq_no, ring->bds[ring->bd_rd_idx].skb_linked, ring->bds[ring->bd_rd_idx].dma_mapping_addr);
 					continue;
 				}
@@ -1011,7 +1012,7 @@ static void openwifi_tx(struct ieee80211_hw *dev,
 			}
 			for (i=0; i<empty_bd_idx; i++) {
 				j = ( (ring->bd_wr_idx+i)&(NUM_TX_BD-1) );
-				printk("%s openwifi_tx: WARNING fake stop queue empty_bd_idx%d i%d lnx prio%d map to q%d stop%d hwq len%d wr%d rd%d bd prio%d len_mpdu%d seq_no%d skb_linked%p dma_mapping_addr%llu\n", sdr_compatible_str,
+				printk("%s openwifi_tx: WARNING fake stop queue empty_bd_idx%d i%d lnx prio%d map to q%d stop%d hwq len%d wr%d rd%d bd prio%d len_mpdu%d seq_no%d skb_linked%p dma_mapping_addr%u\n", sdr_compatible_str,
 				empty_bd_idx, i, prio, drv_ring_idx, ring->stop_flag, hw_queue_len, ring->bd_wr_idx, ring->bd_rd_idx, ring->bds[j].prio, ring->bds[j].len_mpdu, ring->bds[j].seq_no, ring->bds[j].skb_linked, ring->bds[j].dma_mapping_addr);
 				// tell Linux this skb failed
 				skb_new = ring->bds[j].skb_linked;
@@ -1037,7 +1038,7 @@ static void openwifi_tx(struct ieee80211_hw *dev,
 			}
 		} else {
 			j = ring->bd_wr_idx;
-			printk("%s openwifi_tx: WARNING real stop queue lnx prio%d map to q%d stop%d hwq len%d wr%d rd%d bd prio%d len_mpdu%d seq_no%d skb_linked%p dma_mapping_addr%llu\n", sdr_compatible_str,
+			printk("%s openwifi_tx: WARNING real stop queue lnx prio%d map to q%d stop%d hwq len%d wr%d rd%d bd prio%d len_mpdu%d seq_no%d skb_linked%p dma_mapping_addr%u\n", sdr_compatible_str,
 			prio, drv_ring_idx, ring->stop_flag, hw_queue_len, ring->bd_wr_idx, ring->bd_rd_idx, ring->bds[j].prio, ring->bds[j].len_mpdu, ring->bds[j].seq_no, ring->bds[j].skb_linked, ring->bds[j].dma_mapping_addr);
 	
 			ieee80211_stop_queue(dev, prio); // here we should stop those prio related to the queue idx flag set in TX_INTF_REG_S_AXIS_FIFO_NO_ROOM_read

driver/sdr.h

@@ -120,12 +120,10 @@ enum sdrctl_reg_cat {
 #define DMESG_LOG_BROADCAST (1<<2)
 #define DMESG_LOG_NORMAL_QUEUE_STOP (1<<3)
 #define DMESG_LOG_ANY (0xF)
-
 // ------end of dmesg printk control flag------------------
 
 #define MAX_NUM_VIF 4
 
-//#define LEN_PHY_HEADER 16
 #define LEN_PHY_CRC 4
 #define LEN_MPDU_DELIM 4
 

driver/sdrctl_intf.c

@@ -27,7 +27,7 @@ static int openwifi_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *
 		xpu_api->XPU_REG_CSMA_CFG_write(tmp); // unit us
 		return 0;
 	case OPENWIFI_CMD_GET_GAP:
-		skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, nla_total_size(sizeof(u32)));
+		skb = (struct sk_buff *)cfg80211_testmode_alloc_reply_skb(hw->wiphy, nla_total_size(sizeof(u32)));
 		if (!skb)
 			return -ENOMEM;
 		tmp = xpu_api->XPU_REG_CSMA_CFG_read();
@@ -48,7 +48,7 @@ static int openwifi_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *
 		}
 		return 0;
 	case OPENWIFI_CMD_GET_SLICE_IDX:
-		skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, nla_total_size(sizeof(u32)));
+		skb = (struct sk_buff *)cfg80211_testmode_alloc_reply_skb(hw->wiphy, nla_total_size(sizeof(u32)));
 		if (!skb)
 			return -ENOMEM;
 		tmp = priv->slice_idx;
@@ -69,7 +69,7 @@ static int openwifi_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *
 		}
 		return 0;
 	case OPENWIFI_CMD_GET_ADDR:
-		skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, nla_total_size(sizeof(u32)));
+		skb = (struct sk_buff *)cfg80211_testmode_alloc_reply_skb(hw->wiphy, nla_total_size(sizeof(u32)));
 		if (!skb)
 			return -ENOMEM;
 		if (priv->slice_idx>=MAX_NUM_HW_QUEUE) {
@@ -95,7 +95,7 @@ static int openwifi_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *
 		}
 		return 0;
 	case OPENWIFI_CMD_GET_SLICE_TOTAL:
-		skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, nla_total_size(sizeof(u32)));
+		skb = (struct sk_buff *)cfg80211_testmode_alloc_reply_skb(hw->wiphy, nla_total_size(sizeof(u32)));
 		if (!skb)
 			return -ENOMEM;
 		tmp = (xpu_api->XPU_REG_SLICE_COUNT_TOTAL_read());
@@ -117,7 +117,7 @@ static int openwifi_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *
 		}
 		return 0;
 	case OPENWIFI_CMD_GET_SLICE_START:
-		skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, nla_total_size(sizeof(u32)));
+		skb = (struct sk_buff *)cfg80211_testmode_alloc_reply_skb(hw->wiphy, nla_total_size(sizeof(u32)));
 		if (!skb)
 			return -ENOMEM;
 		tmp = (xpu_api->XPU_REG_SLICE_COUNT_START_read());
@@ -139,7 +139,7 @@ static int openwifi_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *
 		}
 		return 0;
 	case OPENWIFI_CMD_GET_SLICE_END:
-		skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, nla_total_size(sizeof(u32)));
+		skb = (struct sk_buff *)cfg80211_testmode_alloc_reply_skb(hw->wiphy, nla_total_size(sizeof(u32)));
 		if (!skb)
 			return -ENOMEM;
 		tmp = (xpu_api->XPU_REG_SLICE_COUNT_END_read());
@@ -206,7 +206,7 @@ static int openwifi_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *
 		printk("%s WARNING Please use command: sdrctl dev sdr0 set reg drv_xpu 0 reg_value! (1~2047, 0 means AUTO)!\n", sdr_compatible_str);
 		return -EOPNOTSUPP;
 	case OPENWIFI_CMD_GET_RSSI_TH:
-		skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, nla_total_size(sizeof(u32)));
+		skb = (struct sk_buff *)cfg80211_testmode_alloc_reply_skb(hw->wiphy, nla_total_size(sizeof(u32)));
 		if (!skb)
 			return -ENOMEM;
 		tmp_int = rssi_half_db_to_rssi_dbm(xpu_api->XPU_REG_LBT_TH_read(), priv->rssi_correction); //rssi_dbm
@@ -340,10 +340,10 @@ static int openwifi_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *
 						tmp_int = (-reg_val); // rssi_dbm
 						tmp = rssi_dbm_to_rssi_half_db(tmp_int, priv->rssi_correction);
 						xpu_api->XPU_REG_LBT_TH_write( tmp );
-						printk("%s override FPGA LBT threshold to %d(%ddBm). The last_auto_fpga_lbt_th %d(%ddBm)\n", sdr_compatible_str, tmp, tmp_int, priv->last_auto_fpga_lbt_th, rssi_half_db_to_rssi_dbm(priv->last_auto_fpga_lbt_th, priv->rssi_correction));
+						printk("%s override FPGA LBT threshold to %d(%ddBm). The last_auto_fpga_lbt_th %d(%ddBm). rssi corr %d (%d/%dMHz)\n", sdr_compatible_str, tmp, tmp_int, priv->last_auto_fpga_lbt_th, rssi_half_db_to_rssi_dbm(priv->last_auto_fpga_lbt_th, priv->rssi_correction), priv->rssi_correction, priv->actual_tx_lo, priv->actual_rx_lo);
 					} else {
 						xpu_api->XPU_REG_LBT_TH_write(priv->last_auto_fpga_lbt_th);
-						printk("%s Restore last_auto_fpga_lbt_th %d(%ddBm) to FPGA. ad9361_rf_set_channel will take control\n", sdr_compatible_str, priv->last_auto_fpga_lbt_th, rssi_half_db_to_rssi_dbm(priv->last_auto_fpga_lbt_th, priv->rssi_correction));
+						printk("%s Restore last_auto_fpga_lbt_th %d(%ddBm) to FPGA. ad9361_rf_set_channel will take control. rssi corr %d (%d/%dMHz)\n", sdr_compatible_str, priv->last_auto_fpga_lbt_th, rssi_half_db_to_rssi_dbm(priv->last_auto_fpga_lbt_th, priv->rssi_correction), priv->rssi_correction, priv->actual_tx_lo, priv->actual_rx_lo);
 					}
 				}
 			} else {
@@ -358,7 +358,7 @@ static int openwifi_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *
 		
 		return 0;
 	case REG_CMD_GET:
-		skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, nla_total_size(sizeof(u32)));
+		skb = (struct sk_buff *)cfg80211_testmode_alloc_reply_skb(hw->wiphy, nla_total_size(sizeof(u32)));
 		if (!skb)
 			return -ENOMEM;
 		reg_addr = nla_get_u32(tb[REG_ATTR_ADDR]);
@@ -412,7 +412,7 @@ static int openwifi_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *
 				if (reg_addr_idx==DRV_XPU_REG_IDX_LBT_TH) {
 					tmp = xpu_api->XPU_REG_LBT_TH_read();//rssi_half_db
 					tmp_int = rssi_half_db_to_rssi_dbm(tmp, priv->rssi_correction); //rssi_dbm
-					printk("%s FPGA LBT threshold %d(%ddBm). The last_auto_fpga_lbt_th %d(%ddBm)\n", sdr_compatible_str, tmp, tmp_int, priv->last_auto_fpga_lbt_th, rssi_half_db_to_rssi_dbm(priv->last_auto_fpga_lbt_th, priv->rssi_correction));
+					printk("%s FPGA LBT threshold %d(%ddBm). The last_auto_fpga_lbt_th %d(%ddBm). rssi corr %d (%d/%dMHz)\n", sdr_compatible_str, tmp, tmp_int, priv->last_auto_fpga_lbt_th, rssi_half_db_to_rssi_dbm(priv->last_auto_fpga_lbt_th, priv->rssi_correction), priv->rssi_correction, priv->actual_tx_lo, priv->actual_rx_lo);
 				}
 				tmp = priv->drv_xpu_reg_val[reg_addr_idx];
 			} else {

driver/side_ch/side_ch.c

@@ -375,9 +375,9 @@ static int get_side_info(int num_eq, int iq_len) {
 		num_dma_symbol_per_trans = HEADER_LEN + CSI_LEN + num_eq*EQUALIZER_LEN;
 	//set number of dma symbols expected to ps
 	num_dma_symbol = SIDE_CH_REG_M_AXIS_DATA_COUNT_read();
-	printk("%s get_side_info m axis data count %d per trans %d\n", side_ch_compatible_str, num_dma_symbol, num_dma_symbol_per_trans);
+	// printk("%s get_side_info m axis data count %d per trans %d\n", side_ch_compatible_str, num_dma_symbol, num_dma_symbol_per_trans);
 	num_dma_symbol = num_dma_symbol_per_trans*(num_dma_symbol/num_dma_symbol_per_trans);
-	printk("%s get_side_info actual num dma symbol %d\n", side_ch_compatible_str, num_dma_symbol);
+	// printk("%s get_side_info actual num dma symbol %d\n", side_ch_compatible_str, num_dma_symbol);
 	if (num_dma_symbol == 0)
 		return(-2);
 
@@ -464,13 +464,13 @@ static void side_ch_nl_recv_msg(struct sk_buff *skb) {
     reg_type = cmd_buf[1];
     reg_idx = cmd_buf[2];
     reg_val = cmd_buf[3];
-	printk("%s recv msg: len %d action_flag %d reg_type %d reg_idx %d reg_val %u\n", side_ch_compatible_str, nlmsg_len(nlh), action_flag, reg_type, reg_idx, reg_val);
+	// printk("%s recv msg: len %d action_flag %d reg_type %d reg_idx %d reg_val %u\n", side_ch_compatible_str, nlmsg_len(nlh), action_flag, reg_type, reg_idx, reg_val);
 
 	pid = nlh->nlmsg_pid; /*pid of sending process */
 
 	if (action_flag==ACTION_SIDE_INFO_GET) {
 		res = get_side_info(num_eq_init, iq_len_init);
-		printk(KERN_INFO "%s recv msg: get_side_info(%d,%d) res %d\n", side_ch_compatible_str, num_eq_init, iq_len_init, res);
+		// printk(KERN_INFO "%s recv msg: get_side_info(%d,%d) res %d\n", side_ch_compatible_str, num_eq_init, iq_len_init, res);
 		if (res>0) {
 			msg_size = res;
 			// printk("%s recv msg: %d %d %d %d %d %d %d %d\n", side_ch_compatible_str, msg[0], msg[1], msg[2], msg[3], msg[4], msg[5], msg[6], msg[7]);

driver/sysfs_intf.c

@@ -990,10 +990,12 @@ static ssize_t csma_cfg0_show(struct device *input_dev, struct device_attribute
 	reg_val = xpu_api->XPU_REG_FORCE_IDLE_MISC_read();
 	priv->stat.csma_cfg0 = reg_val;
 	
-	return sprintf(buf, "nav_disable %d difs_disable %d eifs_disable %d cw_override %d cw override val %d wait_after_decode_top %d\n", 
+	return sprintf(buf, "nav_disable %d difs_disable %d eifs_disable %d eifs_by_rx_fail_disable %d eifs_by_tx_fail_disable %d cw_override %d cw override val %d wait_after_decode_top %d\n", 
 					(reg_val>>31)&1, 
 					(reg_val>>30)&1, 
 					(reg_val>>29)&1, 
+          (reg_val>>27)&1, 
+          (reg_val>>26)&1, 
 					(reg_val>>28)&1, 
 					(reg_val>>16)&0xf, 
 					(reg_val>>0)&0xff);

driver/tx_intf/tx_intf.c

@@ -225,7 +225,7 @@ static const struct of_device_id dev_of_ids[] = {
 MODULE_DEVICE_TABLE(of, dev_of_ids);
 
 static struct tx_intf_driver_api tx_intf_driver_api_inst;
-static struct tx_intf_driver_api *tx_intf_api = &tx_intf_driver_api_inst;
+struct tx_intf_driver_api *tx_intf_api = &tx_intf_driver_api_inst;
 EXPORT_SYMBOL(tx_intf_api);
 
 static inline u32 hw_init(enum tx_intf_mode mode, u32 tx_config, u32 num_dma_symbol_to_ps, enum openwifi_fpga_type fpga_type){
@@ -262,7 +262,7 @@ static inline u32 hw_init(enum tx_intf_mode mode, u32 tx_config, u32 num_dma_sym
 			break;
 
 		case TX_INTF_BW_20MHZ_AT_0MHZ_ANT_BOTH:
-			printk("%s hw_init mode TX_INTF_BW_20MHZ_AT_0MHZ_ANT0\n", tx_intf_compatible_str);
+			printk("%s hw_init mode TX_INTF_BW_20MHZ_AT_0MHZ_ANT_BOTH\n", tx_intf_compatible_str);
 			mixer_cfg = 0x2001F400;
 			ant_sel=0x11;
 			break;
@@ -437,7 +437,7 @@ static int dev_probe(struct platform_device *pdev)
 	if (IS_ERR(base_addr))
 		return PTR_ERR(base_addr);
 
-	printk("%s dev_probe io start 0x%08llx end 0x%08llx name %s flags 0x%08x desc 0x%08x\n", tx_intf_compatible_str,io->start,io->end,io->name,(u32)io->flags,(u32)io->desc);
+	printk("%s dev_probe io start 0x%08x end 0x%08x name %s flags 0x%08x desc 0x%08x\n", tx_intf_compatible_str,io->start,io->end,io->name,(u32)io->flags,(u32)io->desc);
 	printk("%s dev_probe base_addr 0x%p\n", tx_intf_compatible_str,(void*)base_addr);
 	printk("%s dev_probe tx_intf_driver_api_inst 0x%p\n", tx_intf_compatible_str, (void*)(&tx_intf_driver_api_inst) );
 	printk("%s dev_probe             tx_intf_api 0x%p\n", tx_intf_compatible_str, (void*)tx_intf_api);

driver/xpu/xpu.c

@@ -271,7 +271,7 @@ static const struct of_device_id dev_of_ids[] = {
 MODULE_DEVICE_TABLE(of, dev_of_ids);
 
 static struct xpu_driver_api xpu_driver_api_inst;
-static struct xpu_driver_api *xpu_api = &xpu_driver_api_inst;
+struct xpu_driver_api *xpu_api = &xpu_driver_api_inst;
 EXPORT_SYMBOL(xpu_api);
 
 static inline u32 hw_init(enum xpu_mode mode){
@@ -370,7 +370,9 @@ static inline u32 hw_init(enum xpu_mode mode){
 	rssi_half_db_th = 87<<1; // -62dBm
 	xpu_api->XPU_REG_LBT_TH_write(rssi_half_db_th); // set IQ rssi th step .5dB to xxx and enable it
 
-	xpu_api->XPU_REG_FORCE_IDLE_MISC_write(75); //control the duration to force ch_idle after decoding a packet due to imperfection of agc and signals
+  // control the duration to force ch_idle after decoding a packet due to imperfection of agc and signals
+  // (1<<26) to disable eifs_trigger_by_last_tx_fail by default (standard does not ask so)
+	xpu_api->XPU_REG_FORCE_IDLE_MISC_write((1<<26)|75);
 
 	//xpu_api->XPU_REG_CSMA_DEBUG_write((1<<31)|(20<<24)|(4<<19)|(3<<14)|(10<<7)|(5));
 	xpu_api->XPU_REG_CSMA_DEBUG_write(0);

kernel_boot/boards/e310v2/README.md

@@ -0,0 +1,10 @@
+# ANTSDR-E310V2
+
+**AntSDR E310V2** is a powerful and versatile  software-defined radio (SDR) platform. It is a low-cost, easy-to-use  system for developing, testing, and deploying wireless communication  solutions such as LTE, GSM, and Wi-Fi. With its wide range of supported  frequencies and modulation schemes, it’s possible to easily experiment  with various wireless technologies.
+
+![struct](README.assets/struct.png)
+
+Based on the  original version, we have optimized the RF performance, added a GPS  module, increased an external 10M/PPS input interface, and used a VCXO.  The combination of VCXO and external reference input with DAC can  generate a more accurate and stable clock. In addition, the Ethernet on  the PL makes it possible for E310V2 to be compatible with UHD for higher bandwidth transmission.
+
+ If you are interested in using UHD with E310V2, you can find more information in our [repository](https://github.com/MicroPhase/antsdr_uhd).
+

kernel_boot/boards/zcu102_fmcs2/system.dts

@@ -2574,6 +2574,27 @@
 			dma-names = "axidma0", "axidma1";
 		} ;
 
+		openwifi_ip_axi_bram_ctrl_0: axi_bram_ctrl@b0000000 {
+			clock-names = "s_axi_aclk";
+			clocks = <0x3 0x49>;
+			compatible = "xlnx,axi-bram-ctrl-4.1";
+			reg = <0x0 0xb0000000 0x0 0x80000>;
+			xlnx,bram-addr-width = <0x10>;
+			xlnx,bram-inst-mode = "EXTERNAL";
+			xlnx,ecc = <0x0>;
+			xlnx,ecc-onoff-reset-value = <0x0>;
+			xlnx,ecc-type = <0x0>;
+			xlnx,fault-inject = <0x0>;
+			xlnx,memory-depth = <0x10000>;
+			xlnx,rd-cmd-optimization = <0x1>;
+			xlnx,read-latency = <0x1>;
+			xlnx,s-axi-ctrl-addr-width = <0x20>;
+			xlnx,s-axi-ctrl-data-width = <0x20>;
+			xlnx,s-axi-id-width = <0x10>;
+			xlnx,s-axi-supports-narrow-burst = <0x1>;
+			xlnx,single-port-bram = <0x1>;
+		};
+
 		tx_dma: dma@a0000000 {
 			#dma-cells = <1>;
 			clock-names = "s_axi_lite_aclk", "m_axi_sg_aclk", "m_axi_mm2s_aclk", "m_axi_s2mm_aclk";

user_space/arbitrary_iq_gen/single_carrier_gen.m

@@ -1,4 +1,6 @@
-% xianjun.jiao@imec.be
+% Author: Xianjun Jiao (xianjun.jiao@imec.be; putaoshu@msn.com)
+% SPDX-FileCopyrightText: 2023 UGent
+% SPDX-License-Identifier: AGPL-3.0-or-later
 
 function single_carrier_gen(carrier_freq, num_iq)
 if exist('carrier_freq', 'var')==0 || isempty(carrier_freq)

user_space/boot_bin_gen.sh

@@ -56,8 +56,12 @@ cd $OPENWIFI_DIR/kernel_boot
 
 if [ "$BOARD_NAME" == "zcu102_fmcs2" ] || [ "$BOARD_NAME" == "zcu102_9371" ]; then
   ./build_zynqmp_boot_bin.sh $XSA_FILE boards/$BOARD_NAME/u-boot_xilinx_zynqmp_zcu102_revA.elf boards/$BOARD_NAME/bl31.elf
-elif [ "$BOARD_NAME" == "antsdr" ] || [ "$BOARD_NAME" == "antsdr_e200" ] || [ "$BOARD_NAME" == "sdrpi" ] || [ "$BOARD_NAME" == "neptunesdr" ] || [ "$BOARD_NAME" == "zc706_fmcs2" ] || [ "$BOARD_NAME" == "zc702_fmcs2" ] || [ "$BOARD_NAME" == "zed_fmcs2" ] || [ "$BOARD_NAME" == "adrv9361z7035" ] || [ "$BOARD_NAME" == "adrv9364z7020" ]; then
+  ARCH="zynqmp"
+  ARCH_BIT=64
+elif [ "$BOARD_NAME" == "antsdr" ] || [ "$BOARD_NAME" == "antsdr_e200" ] || [ "$BOARD_NAME" == "e310v2" ] || [ "$BOARD_NAME" == "sdrpi" ] || [ "$BOARD_NAME" == "neptunesdr" ] || [ "$BOARD_NAME" == "zc706_fmcs2" ] || [ "$BOARD_NAME" == "zc702_fmcs2" ] || [ "$BOARD_NAME" == "zed_fmcs2" ] || [ "$BOARD_NAME" == "adrv9361z7035" ] || [ "$BOARD_NAME" == "adrv9364z7020" ]; then
   ./build_boot_bin.sh $XSA_FILE boards/$BOARD_NAME/u-boot.elf
+  ARCH="zynq"
+  ARCH_BIT=32
 else
   echo "\$BOARD_NAME is not correct. Please check!"
   cd $home_dir
@@ -69,3 +73,9 @@ rm -rf boards/$BOARD_NAME/output_boot_bin
 mv output_boot_bin boards/$BOARD_NAME/
 
 cd $home_dir
+
+# generate system_top.bit.bin for FPGA dynamic loading
+unzip -o $XSA_FILE
+rm -rf ./system_top.bit.bin
+bootgen -image system_top.bif -arch $ARCH -process_bitstream bin -w
+ls ./system_top.bit.bin -al

user_space/drv_and_fpga_package_gen.sh

@@ -22,7 +22,7 @@ else
     exit 1
 fi
 
-if [ "$BOARD_NAME" != "neptunesdr" ] && [ "$BOARD_NAME" != "antsdr" ] && [ "$BOARD_NAME" != "antsdr_e200" ] && [ "$BOARD_NAME" != "sdrpi" ] && [ "$BOARD_NAME" != "zc706_fmcs2" ] && [ "$BOARD_NAME" != "zc702_fmcs2" ] && [ "$BOARD_NAME" != "zed_fmcs2" ] && [ "$BOARD_NAME" != "adrv9361z7035" ] && [ "$BOARD_NAME" != "adrv9364z7020" ] && [ "$BOARD_NAME" != "zcu102_fmcs2" ] && [ "$BOARD_NAME" != "zcu102_9371" ]; then
+if [ "$BOARD_NAME" != "neptunesdr" ] && [ "$BOARD_NAME" != "antsdr" ] && [ "$BOARD_NAME" != "antsdr_e200" ] && [ "$BOARD_NAME" != "e310v2" ]  && [ "$BOARD_NAME" != "sdrpi" ] && [ "$BOARD_NAME" != "zc706_fmcs2" ] && [ "$BOARD_NAME" != "zc702_fmcs2" ] && [ "$BOARD_NAME" != "zed_fmcs2" ] && [ "$BOARD_NAME" != "adrv9361z7035" ] && [ "$BOARD_NAME" != "adrv9364z7020" ] && [ "$BOARD_NAME" != "zcu102_fmcs2" ] && [ "$BOARD_NAME" != "zcu102_9371" ]; then
     echo "\$BOARD_NAME is not correct. Please check!"
     exit 1
 else

user_space/eifs_by_last_rx_fail_disable.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+home_dir=$(pwd)
+
+if test -d "/sys/devices/platform/fpga-axi@0/fpga-axi@0:sdr"; then
+  cd /sys/devices/platform/fpga-axi@0/fpga-axi@0:sdr
+else 
+  cd /sys/devices/soc0/fpga-axi\@0/fpga-axi\@0\:sdr
+fi
+
+set -x
+#set
+if [[ -n $1 ]]; then
+  echo "4$1" > csma_cfg0
+fi
+
+# show
+cat csma_cfg0
+set +x
+
+cd $home_dir

user_space/eifs_by_last_tx_fail_disable.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+home_dir=$(pwd)
+
+if test -d "/sys/devices/platform/fpga-axi@0/fpga-axi@0:sdr"; then
+  cd /sys/devices/platform/fpga-axi@0/fpga-axi@0:sdr
+else 
+  cd /sys/devices/soc0/fpga-axi\@0/fpga-axi\@0\:sdr
+fi
+
+set -x
+#set
+if [[ -n $1 ]]; then
+  echo "5$1" > csma_cfg0
+fi
+
+# show
+cat csma_cfg0
+set +x
+
+cd $home_dir

user_space/fast_reg_log/fast_reg_log.c

@@ -0,0 +1,60 @@
+// Author: Xianjun Jiao (xianjun.jiao@imec.be; putaoshu@msn.com)
+// SPDX-FileCopyrightText: 2023 UGent
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+// Use this example together with fast_reg_log_analyzer.m (notter release)
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/mman.h>
+#include <stdint.h>
+
+int main()
+{
+  unsigned int bram_size = 0x10000; // 64KB, aligned with openwifi hw .bd and devicetree
+  off_t bram_pbase = 0x83c40000;    // physical base address, aligned with openwifi hw .bd and devicetree (this example: xpu @ 32bit boards)
+  uint32_t *bram32_vptr;
+  int fd, i, j;
+  uint32_t tsf_reg[524288*2];
+  FILE *fp;
+  // Map the BRAM physical address into user space getting a virtual address for it
+  if ((fd = open("/dev/mem", O_RDONLY | O_SYNC)) != -1) {
+    bram32_vptr = (uint32_t *)mmap(NULL, bram_size, PROT_READ, MAP_SHARED, fd, bram_pbase);
+    
+    fp = fopen ("fast_reg_log.bin", "wb");
+    if (fp == NULL) {
+      printf("fopen fast_reg_log.bin failed! %d\n", (int)fp);
+      close(fd);
+      return(0);
+    }
+
+    for (j=0; j<10; j++) {
+      for (i=0; i<(524288*2); i=i+2) {
+        tsf_reg[i+0] = (*(bram32_vptr+57)); // read xpu register 57: rssi trx agc cca status
+        tsf_reg[i+1] = (*(bram32_vptr+58)); // read xpu register 58: low 32bit of tsf
+      }
+
+      // for (i=0; i<1024; i++) {
+      //   printf("%d %x\n", tsf[i], reg[i]);
+      // }
+      // memcpy(buf, bram64_vptr, bram_size);
+
+      fwrite(tsf_reg, sizeof(uint32_t), 524288*2, fp);
+    }
+
+    fclose(fp);
+    // printf("%016llx\n", buf[65532]);
+    // printf("%016llx\n", buf[65533]);
+    // printf("%016llx\n", buf[65534]);
+    // printf("%016llx\n", buf[65535]);
+    // //for(i=0; i<32; i++) {
+    // //    printf("0x%02x\n", buf[i]);
+    // //}
+
+    close(fd);
+  }
+  return(0);
+}

user_space/fast_reg_log/fast_reg_log_analyzer.m

@@ -0,0 +1,71 @@
+% Author: Xianjun Jiao (xianjun.jiao@imec.be; putaoshu@msn.com)
+% SPDX-FileCopyrightText: 2023 UGent
+% SPDX-License-Identifier: AGPL-3.0-or-later
+
+function fast_reg_log_analyzer(filename_bin, start_idx, end_idx)
+close all;
+
+% if exist('start_idx', 'var')==0 || isempty(start_idx)
+%   start_idx = 1;
+% end
+% 
+% if exist('end_idx', 'var')==0 || isempty(end_idx)
+%   end_idx = 65536;
+% end
+
+filename_csv = [filename_bin(1:(end-3)) 'csv'];
+disp(['Human readable fast reg log will be in ' filename_csv]);
+
+fid = fopen(filename_bin);
+if fid == -1
+    disp('fopen failed!');
+    return;
+end
+
+a = fread(fid, inf, 'uint32');
+fclose(fid);
+% a = bitand(uint32(a), uint32(268435455));
+% plot(a(1:2:end)); hold on;
+% plot(a(2:2:end));
+% legend('1', '2');
+
+a = uint32(a);
+tsf = a(2:2:end);
+% plot(tsf);
+state = a(1:2:end);
+
+% find out overflow idx
+overflow_idx = find(diff([0; double(tsf)])<0, 1, 'first');
+% overflow_idx
+if ~isempty(overflow_idx)
+    tsf(overflow_idx:end) = tsf(overflow_idx:end) + (2^32);
+    disp(num2str(overflow_idx));
+end
+
+rssi_correction = 145;
+rssi_half_db = double(bitand(bitshift(state, 0), uint32((2^11)-1)));
+agc_lock = 1 - double(bitand(bitshift(state, -11), uint32(1)));
+demod_is_ongoing = double(bitand(bitshift(state, -12), uint32(1)));
+tx_is_ongoing = double(bitand(bitshift(state, -13), uint32(1)));
+ch_idle = 1 - double(bitand(bitshift(state, -14), uint32(1)));
+iq_rssi_half_db = double(bitand(bitshift(state, -16), uint32((2^9)-1)));
+agc_gain = double(bitand(bitshift(state, -25), uint32((2^7)-1)));
+
+rssi_dbm = (rssi_half_db./2) - rssi_correction;
+
+figure;
+subplot(2,1,1);
+plot(tsf, -rssi_dbm, 'r+-'); hold on;
+plot(tsf, iq_rssi_half_db, 'bo-');
+plot(tsf, agc_gain, 'ks-');
+legend('rssi dbm', 'iq rssi half db', 'agc gain');
+subplot(2,1,2);
+plot(tsf, agc_lock+0); hold on;
+plot(tsf, demod_is_ongoing+2);
+plot(tsf, tx_is_ongoing+4);
+plot(tsf, ch_idle+6);
+
+legend('agc lock', 'demod is ongoing', 'tx is ongoing', 'ch idle');
+
+a=table(tsf, rssi_half_db, rssi_dbm, iq_rssi_half_db, agc_gain, agc_lock, demod_is_ongoing, tx_is_ongoing, ch_idle);
+writetable(a, filename_csv);

user_space/hostapd-openwifi-11ag.conf

@@ -3,7 +3,7 @@ driver=nl80211
 country_code=BE
 ssid=openwifi
 hw_mode=a
-channel=44
+channel=36
 supported_rates=60 90 120 180 240 360 480 540
 basic_rates=60 90 120 180
 #ieee80211n=1
@@ -11,6 +11,9 @@ basic_rates=60 90 120 180
 #require_ht=1
 #ieee80211d=1
 #ieee80211h=1
-#wpa=2
+#wpa=1
-#wpa_passphrase=myrabbit
+#wpa_passphrase=openwifi
 #wpa_key_mgmt=WPA-PSK
+#wpa_pairwise=TKIP CCMP
+#wpa_ptk_rekey=600
+

user_space/hostapd-openwifi.conf

@@ -3,7 +3,7 @@ driver=nl80211
 country_code=BE
 ssid=openwifi
 hw_mode=a
-channel=44
+channel=36
 supported_rates=60 90 120 180 240 360 480 540
 basic_rates=60 90 120 180
 ieee80211n=1
@@ -11,6 +11,9 @@ ieee80211n=1
 require_ht=1
 #ieee80211d=1
 #ieee80211h=1
-#wpa=2
+#wpa=1
-#wpa_passphrase=myrabbit
+#wpa_passphrase=openwifi
 #wpa_key_mgmt=WPA-PSK
+#wpa_pairwise=TKIP CCMP
+#wpa_ptk_rekey=600
+

user_space/inject_80211/Makefile

@@ -2,11 +2,12 @@
 all: inject_80211 analyze_80211
 
 inject_80211: inject_80211.c
-	gcc  -Wall -Werror inject_80211.c -o inject_80211 -lpcap
+#	gcc  -Wall -Werror inject_80211.c -o inject_80211 -lpcap
+	gcc  -Wall inject_80211.c -o inject_80211 -lpcap
 
 analyze_80211: analyze_80211.c
-	gcc  -Wall -Werror radiotap.c analyze_80211.c -o analyze_80211 -lpcap
+# gcc  -Wall -Werror radiotap.c analyze_80211.c -o analyze_80211 -lpcap
-
+	gcc  -Wall radiotap.c analyze_80211.c -o analyze_80211 -lpcap
 
 clean:
 	rm -f inject_80211 analyze_80211

user_space/inject_80211/analyze_80211.c

@@ -75,7 +75,7 @@ int main(int argc, char **argv)
 		if (packet_size < 0)
 			continue;
 
-		if (ieee80211_radiotap_iterator_init(&rti, (struct ieee80211_radiotap_header *)packet, packet_size) < 0)
+		if (ieee80211_radiotap_iterator_init(&rti, (struct ieee80211_radiotap_header *)packet, packet_size, NULL) < 0)
 			continue;
 
 		while ((n = ieee80211_radiotap_iterator_next(&rti)) == 0)

user_space/inject_80211/ieee80211_radiotap.h

@@ -1,196 +1,55 @@
 /*
- * Copyright (c) 2003, 2004 David Young.  All rights reserved.
+ * Copyright (c) 2017		Intel Deutschland GmbH
+ * Copyright (c) 2018-2019	Intel Corporation
  *
- * Redistribution and use in source and binary forms, with or without
+ * Permission to use, copy, modify, and/or distribute this software for any
- * modification, are permitted provided that the following conditions
+ * purpose with or without fee is hereby granted, provided that the above
- * are met:
+ * copyright notice and this permission notice appear in all copies.
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. The name of David Young may not be used to endorse or promote
- *    products derived from this software without specific prior
- *    written permission.
  *
- * THIS SOFTWARE IS PROVIDED BY DAVID YOUNG ``AS IS'' AND ANY
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL DAVID
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * YOUNG BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
- * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
- * OF SUCH DAMAGE.
  */
+#ifndef __RADIOTAP_H
+#define __RADIOTAP_H
 
-/*
- * Modifications to fit into the linux IEEE 802.11 stack,
- * Mike Kershaw (dragorn@kismetwireless.net)
- */
-
-#ifndef IEEE80211RADIOTAP_H
-#define IEEE80211RADIOTAP_H
-
-#include <linux/if_ether.h>
 #include <linux/kernel.h>
+// #include <asm/unaligned.h>
 
-/* Base version of the radiotap packet header data */
+/**
-#define PKTHDR_RADIOTAP_VERSION		0
+ * struct ieee82011_radiotap_header - base radiotap header
-
-/* A generic radio capture format is desirable. There is one for
- * Linux, but it is neither rigidly defined (there were not even
- * units given for some fields) nor easily extensible.
- *
- * I suggest the following extensible radio capture format. It is
- * based on a bitmap indicating which fields are present.
- *
- * I am trying to describe precisely what the application programmer
- * should expect in the following, and for that reason I tell the
- * units and origin of each measurement (where it applies), or else I
- * use sufficiently weaselly language ("is a monotonically nondecreasing
- * function of...") that I cannot set false expectations for lawyerly
- * readers.
- */
-
-/*
- * The radio capture header precedes the 802.11 header.
- * All data in the header is little endian on all platforms.
  */
 struct ieee80211_radiotap_header {
-	u8 it_version;		/* Version 0. Only increases
+	/**
-				 * for drastic changes,
+	 * @it_version: radiotap version, always 0
-				 * introduction of compatible
-				 * new fields does not count.
 	 */
-	u8 it_pad;
+	uint8_t it_version;
-	__le16 it_len;		/* length of the whole
+
-				 * header in bytes, including
+	/**
-				 * it_version, it_pad,
+	 * @it_pad: padding (or alignment)
-				 * it_len, and data fields.
 	 */
-	__le32 it_present;	/* A bitmap telling which
+	uint8_t it_pad;
-				 * fields are present. Set bit 31
+
-				 * (0x80000000) to extend the
+	/**
-				 * bitmap by another 32 bits.
+	 * @it_len: overall radiotap header length
-				 * Additional extensions are made
-				 * by setting bit 31.
 	 */
+	__le16 it_len;
+
+	/**
+	 * @it_present: (first) present word
+	 */
+	__le32 it_present;
 } __attribute__((packed));
 
-/* Name                                 Data type    Units
+/* version is always 0 */
- * ----                                 ---------    -----
+#define PKTHDR_RADIOTAP_VERSION	0
- *
+
- * IEEE80211_RADIOTAP_TSFT              __le64       microseconds
+/* see the radiotap website for the descriptions */
- *
+enum ieee80211_radiotap_presence {
- *      Value in microseconds of the MAC's 64-bit 802.11 Time
- *      Synchronization Function timer when the first bit of the
- *      MPDU arrived at the MAC. For received frames, only.
- *
- * IEEE80211_RADIOTAP_CHANNEL           2 x __le16   MHz, bitmap
- *
- *      Tx/Rx frequency in MHz, followed by flags (see below).
- *
- * IEEE80211_RADIOTAP_FHSS              __le16       see below
- *
- *      For frequency-hopping radios, the hop set (first byte)
- *      and pattern (second byte).
- *
- * IEEE80211_RADIOTAP_RATE              u8           500kb/s
- *
- *      Tx/Rx data rate
- *
- * IEEE80211_RADIOTAP_DBM_ANTSIGNAL     s8           decibels from
- *                                                   one milliwatt (dBm)
- *
- *      RF signal power at the antenna, decibel difference from
- *      one milliwatt.
- *
- * IEEE80211_RADIOTAP_DBM_ANTNOISE      s8           decibels from
- *                                                   one milliwatt (dBm)
- *
- *      RF noise power at the antenna, decibel difference from one
- *      milliwatt.
- *
- * IEEE80211_RADIOTAP_DB_ANTSIGNAL      u8           decibel (dB)
- *
- *      RF signal power at the antenna, decibel difference from an
- *      arbitrary, fixed reference.
- *
- * IEEE80211_RADIOTAP_DB_ANTNOISE       u8           decibel (dB)
- *
- *      RF noise power at the antenna, decibel difference from an
- *      arbitrary, fixed reference point.
- *
- * IEEE80211_RADIOTAP_LOCK_QUALITY      __le16       unitless
- *
- *      Quality of Barker code lock. Unitless. Monotonically
- *      nondecreasing with "better" lock strength. Called "Signal
- *      Quality" in datasheets.  (Is there a standard way to measure
- *      this?)
- *
- * IEEE80211_RADIOTAP_TX_ATTENUATION    __le16       unitless
- *
- *      Transmit power expressed as unitless distance from max
- *      power set at factory calibration.  0 is max power.
- *      Monotonically nondecreasing with lower power levels.
- *
- * IEEE80211_RADIOTAP_DB_TX_ATTENUATION __le16       decibels (dB)
- *
- *      Transmit power expressed as decibel distance from max power
- *      set at factory calibration.  0 is max power.  Monotonically
- *      nondecreasing with lower power levels.
- *
- * IEEE80211_RADIOTAP_DBM_TX_POWER      s8           decibels from
- *                                                   one milliwatt (dBm)
- *
- *      Transmit power expressed as dBm (decibels from a 1 milliwatt
- *      reference). This is the absolute power level measured at
- *      the antenna port.
- *
- * IEEE80211_RADIOTAP_FLAGS             u8           bitmap
- *
- *      Properties of transmitted and received frames. See flags
- *      defined below.
- *
- * IEEE80211_RADIOTAP_ANTENNA           u8           antenna index
- *
- *      Unitless indication of the Rx/Tx antenna for this packet.
- *      The first antenna is antenna 0.
- *
- * IEEE80211_RADIOTAP_RX_FLAGS          __le16       bitmap
- *
- *     Properties of received frames. See flags defined below.
- *
- * IEEE80211_RADIOTAP_TX_FLAGS          __le16       bitmap
- *
- *     Properties of transmitted frames. See flags defined below.
- *
- * IEEE80211_RADIOTAP_RTS_RETRIES       u8           data
- *
- *     Number of rts retries a transmitted frame used.
- *
- * IEEE80211_RADIOTAP_DATA_RETRIES      u8           data
- *
- *     Number of unicast retries a transmitted frame used.
- *
- * IEEE80211_RADIOTAP_MCS	u8, u8, u8		unitless
- *
- *     Contains a bitmap of known fields/flags, the flags, and
- *     the MCS index.
- *
- * IEEE80211_RADIOTAP_AMPDU_STATUS	u32, u16, u8, u8	unitless
- *
- *	Contains the AMPDU information for the subframe.
- *
- * IEEE80211_RADIOTAP_VHT	u16, u8, u8, u8[4], u8, u8, u16
- *
- *	Contains VHT information about this frame.
- */
-enum ieee80211_radiotap_type {
 	IEEE80211_RADIOTAP_TSFT = 0,
 	IEEE80211_RADIOTAP_FLAGS = 1,
 	IEEE80211_RADIOTAP_RATE = 2,
@@ -209,10 +68,15 @@ enum ieee80211_radiotap_type {
 	IEEE80211_RADIOTAP_TX_FLAGS = 15,
 	IEEE80211_RADIOTAP_RTS_RETRIES = 16,
 	IEEE80211_RADIOTAP_DATA_RETRIES = 17,
-
+	/* 18 is XChannel, but it's not defined yet */
 	IEEE80211_RADIOTAP_MCS = 19,
 	IEEE80211_RADIOTAP_AMPDU_STATUS = 20,
 	IEEE80211_RADIOTAP_VHT = 21,
+	IEEE80211_RADIOTAP_TIMESTAMP = 22,
+	IEEE80211_RADIOTAP_HE = 23,
+	IEEE80211_RADIOTAP_HE_MU = 24,
+	IEEE80211_RADIOTAP_ZERO_LEN_PSDU = 26,
+	IEEE80211_RADIOTAP_LSIG = 27,
 
 	/* valid in every it_present bitmap, even vendor namespaces */
 	IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE = 29,
@@ -220,88 +84,284 @@ enum ieee80211_radiotap_type {
 	IEEE80211_RADIOTAP_EXT = 31
 };
 
-/* Channel flags. */
+/* for IEEE80211_RADIOTAP_FLAGS */
-#define	IEEE80211_CHAN_TURBO	0x0010	/* Turbo channel */
+enum ieee80211_radiotap_flags {
-#define	IEEE80211_CHAN_CCK	0x0020	/* CCK channel */
+	IEEE80211_RADIOTAP_F_CFP = 0x01,
-#define	IEEE80211_CHAN_OFDM	0x0040	/* OFDM channel */
+	IEEE80211_RADIOTAP_F_SHORTPRE = 0x02,
-#define	IEEE80211_CHAN_2GHZ	0x0080	/* 2 GHz spectrum channel. */
+	IEEE80211_RADIOTAP_F_WEP = 0x04,
-#define	IEEE80211_CHAN_5GHZ	0x0100	/* 5 GHz spectrum channel */
+	IEEE80211_RADIOTAP_F_FRAG = 0x08,
-#define	IEEE80211_CHAN_PASSIVE	0x0200	/* Only passive scan allowed */
+	IEEE80211_RADIOTAP_F_FCS = 0x10,
-#define	IEEE80211_CHAN_DYN	0x0400	/* Dynamic CCK-OFDM channel */
+	IEEE80211_RADIOTAP_F_DATAPAD = 0x20,
-#define	IEEE80211_CHAN_GFSK	0x0800	/* GFSK channel (FHSS PHY) */
+	IEEE80211_RADIOTAP_F_BADFCS = 0x40,
+};
 
-/* For IEEE80211_RADIOTAP_FLAGS */
+/* for IEEE80211_RADIOTAP_CHANNEL */
-#define	IEEE80211_RADIOTAP_F_CFP	0x01	/* sent/received
+enum ieee80211_radiotap_channel_flags {
-						 * during CFP
+	IEEE80211_CHAN_CCK = 0x0020,
-						 */
+	IEEE80211_CHAN_OFDM = 0x0040,
-#define	IEEE80211_RADIOTAP_F_SHORTPRE	0x02	/* sent/received
+	IEEE80211_CHAN_2GHZ = 0x0080,
-						 * with short
+	IEEE80211_CHAN_5GHZ = 0x0100,
-						 * preamble
+	IEEE80211_CHAN_DYN = 0x0400,
-						 */
+	IEEE80211_CHAN_HALF = 0x4000,
-#define	IEEE80211_RADIOTAP_F_WEP	0x04	/* sent/received
+	IEEE80211_CHAN_QUARTER = 0x8000,
-						 * with WEP encryption
+};
-						 */
-#define	IEEE80211_RADIOTAP_F_FRAG	0x08	/* sent/received
-						 * with fragmentation
-						 */
-#define	IEEE80211_RADIOTAP_F_FCS	0x10	/* frame includes FCS */
-#define	IEEE80211_RADIOTAP_F_DATAPAD	0x20	/* frame has padding between
-						 * 802.11 header and payload
-						 * (to 32-bit boundary)
-						 */
-#define IEEE80211_RADIOTAP_F_BADFCS	0x40	/* bad FCS */
 
-/* For IEEE80211_RADIOTAP_RX_FLAGS */
+/* for IEEE80211_RADIOTAP_RX_FLAGS */
-#define IEEE80211_RADIOTAP_F_RX_BADPLCP	0x0002	/* frame has bad PLCP */
+enum ieee80211_radiotap_rx_flags {
+	IEEE80211_RADIOTAP_F_RX_BADPLCP = 0x0002,
+};
 
-/* For IEEE80211_RADIOTAP_TX_FLAGS */
+/* for IEEE80211_RADIOTAP_TX_FLAGS */
-#define IEEE80211_RADIOTAP_F_TX_FAIL	0x0001	/* failed due to excessive
+enum ieee80211_radiotap_tx_flags {
-						 * retries */
+	IEEE80211_RADIOTAP_F_TX_FAIL = 0x0001,
-#define IEEE80211_RADIOTAP_F_TX_CTS	0x0002	/* used cts 'protection' */
+	IEEE80211_RADIOTAP_F_TX_CTS = 0x0002,
-#define IEEE80211_RADIOTAP_F_TX_RTS	0x0004	/* used rts/cts handshake */
+	IEEE80211_RADIOTAP_F_TX_RTS = 0x0004,
-#define IEEE80211_RADIOTAP_F_TX_NOACK	0x0008	/* don't expect an ack */
+	IEEE80211_RADIOTAP_F_TX_NOACK = 0x0008,
+	IEEE80211_RADIOTAP_F_TX_NOSEQNO = 0x0010,
+};
 
+/* for IEEE80211_RADIOTAP_MCS "have" flags */
+enum ieee80211_radiotap_mcs_have {
+	IEEE80211_RADIOTAP_MCS_HAVE_BW = 0x01,
+	IEEE80211_RADIOTAP_MCS_HAVE_MCS = 0x02,
+	IEEE80211_RADIOTAP_MCS_HAVE_GI = 0x04,
+	IEEE80211_RADIOTAP_MCS_HAVE_FMT = 0x08,
+	IEEE80211_RADIOTAP_MCS_HAVE_FEC = 0x10,
+	IEEE80211_RADIOTAP_MCS_HAVE_STBC = 0x20,
+};
 
-/* For IEEE80211_RADIOTAP_MCS */
+enum ieee80211_radiotap_mcs_flags {
-#define IEEE80211_RADIOTAP_MCS_HAVE_BW		0x01
+	IEEE80211_RADIOTAP_MCS_BW_MASK = 0x03,
-#define IEEE80211_RADIOTAP_MCS_HAVE_MCS		0x02
+	IEEE80211_RADIOTAP_MCS_BW_20 = 0,
-#define IEEE80211_RADIOTAP_MCS_HAVE_GI		0x04
+	IEEE80211_RADIOTAP_MCS_BW_40 = 1,
-#define IEEE80211_RADIOTAP_MCS_HAVE_FMT		0x08
+	IEEE80211_RADIOTAP_MCS_BW_20L = 2,
-#define IEEE80211_RADIOTAP_MCS_HAVE_FEC		0x10
+	IEEE80211_RADIOTAP_MCS_BW_20U = 3,
 
-#define IEEE80211_RADIOTAP_MCS_BW_MASK		0x03
+	IEEE80211_RADIOTAP_MCS_SGI = 0x04,
-#define		IEEE80211_RADIOTAP_MCS_BW_20	0
+	IEEE80211_RADIOTAP_MCS_FMT_GF = 0x08,
-#define		IEEE80211_RADIOTAP_MCS_BW_40	1
+	IEEE80211_RADIOTAP_MCS_FEC_LDPC = 0x10,
-#define		IEEE80211_RADIOTAP_MCS_BW_20L	2
+	IEEE80211_RADIOTAP_MCS_STBC_MASK = 0x60,
-#define		IEEE80211_RADIOTAP_MCS_BW_20U	3
+	IEEE80211_RADIOTAP_MCS_STBC_1 = 1,
-#define IEEE80211_RADIOTAP_MCS_SGI		0x04
+	IEEE80211_RADIOTAP_MCS_STBC_2 = 2,
-#define IEEE80211_RADIOTAP_MCS_FMT_GF		0x08
+	IEEE80211_RADIOTAP_MCS_STBC_3 = 3,
-#define IEEE80211_RADIOTAP_MCS_FEC_LDPC		0x10
+	IEEE80211_RADIOTAP_MCS_STBC_SHIFT = 5,
+};
 
-/* For IEEE80211_RADIOTAP_AMPDU_STATUS */
+/* for IEEE80211_RADIOTAP_AMPDU_STATUS */
-#define IEEE80211_RADIOTAP_AMPDU_REPORT_ZEROLEN		0x0001
+enum ieee80211_radiotap_ampdu_flags {
-#define IEEE80211_RADIOTAP_AMPDU_IS_ZEROLEN		0x0002
+	IEEE80211_RADIOTAP_AMPDU_REPORT_ZEROLEN = 0x0001,
-#define IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN		0x0004
+	IEEE80211_RADIOTAP_AMPDU_IS_ZEROLEN = 0x0002,
-#define IEEE80211_RADIOTAP_AMPDU_IS_LAST		0x0008
+	IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN = 0x0004,
-#define IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR		0x0010
+	IEEE80211_RADIOTAP_AMPDU_IS_LAST = 0x0008,
-#define IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN	0x0020
+	IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR = 0x0010,
+	IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN = 0x0020,
+	IEEE80211_RADIOTAP_AMPDU_EOF = 0x0040,
+	IEEE80211_RADIOTAP_AMPDU_EOF_KNOWN = 0x0080,
+};
 
-/* For IEEE80211_RADIOTAP_VHT */
+/* for IEEE80211_RADIOTAP_VHT */
-#define IEEE80211_RADIOTAP_VHT_KNOWN_STBC			0x0001
+enum ieee80211_radiotap_vht_known {
-#define IEEE80211_RADIOTAP_VHT_KNOWN_TXOP_PS_NA			0x0002
+	IEEE80211_RADIOTAP_VHT_KNOWN_STBC = 0x0001,
-#define IEEE80211_RADIOTAP_VHT_KNOWN_GI				0x0004
+	IEEE80211_RADIOTAP_VHT_KNOWN_TXOP_PS_NA = 0x0002,
-#define IEEE80211_RADIOTAP_VHT_KNOWN_SGI_NSYM_DIS		0x0008
+	IEEE80211_RADIOTAP_VHT_KNOWN_GI = 0x0004,
-#define IEEE80211_RADIOTAP_VHT_KNOWN_LDPC_EXTRA_OFDM_SYM	0x0010
+	IEEE80211_RADIOTAP_VHT_KNOWN_SGI_NSYM_DIS = 0x0008,
-#define IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED			0x0020
+	IEEE80211_RADIOTAP_VHT_KNOWN_LDPC_EXTRA_OFDM_SYM = 0x0010,
-#define IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH			0x0040
+	IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED = 0x0020,
-#define IEEE80211_RADIOTAP_VHT_KNOWN_GROUP_ID			0x0080
+	IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH = 0x0040,
-#define IEEE80211_RADIOTAP_VHT_KNOWN_PARTIAL_AID		0x0100
+	IEEE80211_RADIOTAP_VHT_KNOWN_GROUP_ID = 0x0080,
+	IEEE80211_RADIOTAP_VHT_KNOWN_PARTIAL_AID = 0x0100,
+};
 
-#define IEEE80211_RADIOTAP_VHT_FLAG_STBC			0x01
+enum ieee80211_radiotap_vht_flags {
-#define IEEE80211_RADIOTAP_VHT_FLAG_TXOP_PS_NA			0x02
+	IEEE80211_RADIOTAP_VHT_FLAG_STBC = 0x01,
-#define IEEE80211_RADIOTAP_VHT_FLAG_SGI				0x04
+	IEEE80211_RADIOTAP_VHT_FLAG_TXOP_PS_NA = 0x02,
-#define IEEE80211_RADIOTAP_VHT_FLAG_SGI_NSYM_M10_9		0x08
+	IEEE80211_RADIOTAP_VHT_FLAG_SGI = 0x04,
-#define IEEE80211_RADIOTAP_VHT_FLAG_LDPC_EXTRA_OFDM_SYM		0x10
+	IEEE80211_RADIOTAP_VHT_FLAG_SGI_NSYM_M10_9 = 0x08,
-#define IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED			0x20
+	IEEE80211_RADIOTAP_VHT_FLAG_LDPC_EXTRA_OFDM_SYM = 0x10,
+	IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED = 0x20,
+};
 
-#endif				/* IEEE80211_RADIOTAP_H */
+enum ieee80211_radiotap_vht_coding {
+	IEEE80211_RADIOTAP_CODING_LDPC_USER0 = 0x01,
+	IEEE80211_RADIOTAP_CODING_LDPC_USER1 = 0x02,
+	IEEE80211_RADIOTAP_CODING_LDPC_USER2 = 0x04,
+	IEEE80211_RADIOTAP_CODING_LDPC_USER3 = 0x08,
+};
+
+/* for IEEE80211_RADIOTAP_TIMESTAMP */
+enum ieee80211_radiotap_timestamp_unit_spos {
+	IEEE80211_RADIOTAP_TIMESTAMP_UNIT_MASK = 0x000F,
+	IEEE80211_RADIOTAP_TIMESTAMP_UNIT_MS = 0x0000,
+	IEEE80211_RADIOTAP_TIMESTAMP_UNIT_US = 0x0001,
+	IEEE80211_RADIOTAP_TIMESTAMP_UNIT_NS = 0x0003,
+	IEEE80211_RADIOTAP_TIMESTAMP_SPOS_MASK = 0x00F0,
+	IEEE80211_RADIOTAP_TIMESTAMP_SPOS_BEGIN_MDPU = 0x0000,
+	IEEE80211_RADIOTAP_TIMESTAMP_SPOS_PLCP_SIG_ACQ = 0x0010,
+	IEEE80211_RADIOTAP_TIMESTAMP_SPOS_EO_PPDU = 0x0020,
+	IEEE80211_RADIOTAP_TIMESTAMP_SPOS_EO_MPDU = 0x0030,
+	IEEE80211_RADIOTAP_TIMESTAMP_SPOS_UNKNOWN = 0x00F0,
+};
+
+enum ieee80211_radiotap_timestamp_flags {
+	IEEE80211_RADIOTAP_TIMESTAMP_FLAG_64BIT = 0x00,
+	IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT = 0x01,
+	IEEE80211_RADIOTAP_TIMESTAMP_FLAG_ACCURACY = 0x02,
+};
+
+struct ieee80211_radiotap_he {
+	__le16 data1, data2, data3, data4, data5, data6;
+};
+
+enum ieee80211_radiotap_he_bits {
+	IEEE80211_RADIOTAP_HE_DATA1_FORMAT_MASK		= 3,
+	IEEE80211_RADIOTAP_HE_DATA1_FORMAT_SU		= 0,
+	IEEE80211_RADIOTAP_HE_DATA1_FORMAT_EXT_SU	= 1,
+	IEEE80211_RADIOTAP_HE_DATA1_FORMAT_MU		= 2,
+	IEEE80211_RADIOTAP_HE_DATA1_FORMAT_TRIG		= 3,
+
+	IEEE80211_RADIOTAP_HE_DATA1_BSS_COLOR_KNOWN	= 0x0004,
+	IEEE80211_RADIOTAP_HE_DATA1_BEAM_CHANGE_KNOWN	= 0x0008,
+	IEEE80211_RADIOTAP_HE_DATA1_UL_DL_KNOWN		= 0x0010,
+	IEEE80211_RADIOTAP_HE_DATA1_DATA_MCS_KNOWN	= 0x0020,
+	IEEE80211_RADIOTAP_HE_DATA1_DATA_DCM_KNOWN	= 0x0040,
+	IEEE80211_RADIOTAP_HE_DATA1_CODING_KNOWN	= 0x0080,
+	IEEE80211_RADIOTAP_HE_DATA1_LDPC_XSYMSEG_KNOWN	= 0x0100,
+	IEEE80211_RADIOTAP_HE_DATA1_STBC_KNOWN		= 0x0200,
+	IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE_KNOWN	= 0x0400,
+	IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE2_KNOWN	= 0x0800,
+	IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE3_KNOWN	= 0x1000,
+	IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE4_KNOWN	= 0x2000,
+	IEEE80211_RADIOTAP_HE_DATA1_BW_RU_ALLOC_KNOWN	= 0x4000,
+	IEEE80211_RADIOTAP_HE_DATA1_DOPPLER_KNOWN	= 0x8000,
+
+	IEEE80211_RADIOTAP_HE_DATA2_PRISEC_80_KNOWN	= 0x0001,
+	IEEE80211_RADIOTAP_HE_DATA2_GI_KNOWN		= 0x0002,
+	IEEE80211_RADIOTAP_HE_DATA2_NUM_LTF_SYMS_KNOWN	= 0x0004,
+	IEEE80211_RADIOTAP_HE_DATA2_PRE_FEC_PAD_KNOWN	= 0x0008,
+	IEEE80211_RADIOTAP_HE_DATA2_TXBF_KNOWN		= 0x0010,
+	IEEE80211_RADIOTAP_HE_DATA2_PE_DISAMBIG_KNOWN	= 0x0020,
+	IEEE80211_RADIOTAP_HE_DATA2_TXOP_KNOWN		= 0x0040,
+	IEEE80211_RADIOTAP_HE_DATA2_MIDAMBLE_KNOWN	= 0x0080,
+	IEEE80211_RADIOTAP_HE_DATA2_RU_OFFSET		= 0x3f00,
+	IEEE80211_RADIOTAP_HE_DATA2_RU_OFFSET_KNOWN	= 0x4000,
+	IEEE80211_RADIOTAP_HE_DATA2_PRISEC_80_SEC	= 0x8000,
+
+	IEEE80211_RADIOTAP_HE_DATA3_BSS_COLOR		= 0x003f,
+	IEEE80211_RADIOTAP_HE_DATA3_BEAM_CHANGE		= 0x0040,
+	IEEE80211_RADIOTAP_HE_DATA3_UL_DL		= 0x0080,
+	IEEE80211_RADIOTAP_HE_DATA3_DATA_MCS		= 0x0f00,
+	IEEE80211_RADIOTAP_HE_DATA3_DATA_DCM		= 0x1000,
+	IEEE80211_RADIOTAP_HE_DATA3_CODING		= 0x2000,
+	IEEE80211_RADIOTAP_HE_DATA3_LDPC_XSYMSEG	= 0x4000,
+	IEEE80211_RADIOTAP_HE_DATA3_STBC		= 0x8000,
+
+	IEEE80211_RADIOTAP_HE_DATA4_SU_MU_SPTL_REUSE	= 0x000f,
+	IEEE80211_RADIOTAP_HE_DATA4_MU_STA_ID		= 0x7ff0,
+	IEEE80211_RADIOTAP_HE_DATA4_TB_SPTL_REUSE1	= 0x000f,
+	IEEE80211_RADIOTAP_HE_DATA4_TB_SPTL_REUSE2	= 0x00f0,
+	IEEE80211_RADIOTAP_HE_DATA4_TB_SPTL_REUSE3	= 0x0f00,
+	IEEE80211_RADIOTAP_HE_DATA4_TB_SPTL_REUSE4	= 0xf000,
+
+	IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC	= 0x000f,
+		IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_20MHZ	= 0,
+		IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_40MHZ	= 1,
+		IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_80MHZ	= 2,
+		IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_160MHZ	= 3,
+		IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_26T	= 4,
+		IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_52T	= 5,
+		IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_106T	= 6,
+		IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_242T	= 7,
+		IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_484T	= 8,
+		IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_996T	= 9,
+		IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_2x996T	= 10,
+
+	IEEE80211_RADIOTAP_HE_DATA5_GI			= 0x0030,
+		IEEE80211_RADIOTAP_HE_DATA5_GI_0_8			= 0,
+		IEEE80211_RADIOTAP_HE_DATA5_GI_1_6			= 1,
+		IEEE80211_RADIOTAP_HE_DATA5_GI_3_2			= 2,
+
+	IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE		= 0x00c0,
+		IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_UNKNOWN		= 0,
+		IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_1X			= 1,
+		IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_2X			= 2,
+		IEEE80211_RADIOTAP_HE_DATA5_LTF_SIZE_4X			= 3,
+	IEEE80211_RADIOTAP_HE_DATA5_NUM_LTF_SYMS	= 0x0700,
+	IEEE80211_RADIOTAP_HE_DATA5_PRE_FEC_PAD		= 0x3000,
+	IEEE80211_RADIOTAP_HE_DATA5_TXBF		= 0x4000,
+	IEEE80211_RADIOTAP_HE_DATA5_PE_DISAMBIG		= 0x8000,
+
+	IEEE80211_RADIOTAP_HE_DATA6_NSTS		= 0x000f,
+	IEEE80211_RADIOTAP_HE_DATA6_DOPPLER		= 0x0010,
+	IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW_KNOWN	= 0x0020,
+	IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW		= 0x00c0,
+		IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW_20MHZ	= 0,
+		IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW_40MHZ	= 1,
+		IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW_80MHZ	= 2,
+		IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW_160MHZ	= 3,
+	IEEE80211_RADIOTAP_HE_DATA6_TXOP		= 0x7f00,
+	IEEE80211_RADIOTAP_HE_DATA6_MIDAMBLE_PDCTY	= 0x8000,
+};
+
+struct ieee80211_radiotap_he_mu {
+	__le16 flags1, flags2;
+	u8 ru_ch1[4];
+	u8 ru_ch2[4];
+};
+
+enum ieee80211_radiotap_he_mu_bits {
+	IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_MCS		= 0x000f,
+	IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_MCS_KNOWN		= 0x0010,
+	IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_DCM		= 0x0020,
+	IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_DCM_KNOWN		= 0x0040,
+	IEEE80211_RADIOTAP_HE_MU_FLAGS1_CH2_CTR_26T_RU_KNOWN	= 0x0080,
+	IEEE80211_RADIOTAP_HE_MU_FLAGS1_CH1_RU_KNOWN		= 0x0100,
+	IEEE80211_RADIOTAP_HE_MU_FLAGS1_CH2_RU_KNOWN		= 0x0200,
+	IEEE80211_RADIOTAP_HE_MU_FLAGS1_CH1_CTR_26T_RU_KNOWN	= 0x1000,
+	IEEE80211_RADIOTAP_HE_MU_FLAGS1_CH1_CTR_26T_RU		= 0x2000,
+	IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_COMP_KNOWN	= 0x4000,
+	IEEE80211_RADIOTAP_HE_MU_FLAGS1_SIG_B_SYMS_USERS_KNOWN	= 0x8000,
+
+	IEEE80211_RADIOTAP_HE_MU_FLAGS2_BW_FROM_SIG_A_BW	= 0x0003,
+		IEEE80211_RADIOTAP_HE_MU_FLAGS2_BW_FROM_SIG_A_BW_20MHZ	= 0x0000,
+		IEEE80211_RADIOTAP_HE_MU_FLAGS2_BW_FROM_SIG_A_BW_40MHZ	= 0x0001,
+		IEEE80211_RADIOTAP_HE_MU_FLAGS2_BW_FROM_SIG_A_BW_80MHZ	= 0x0002,
+		IEEE80211_RADIOTAP_HE_MU_FLAGS2_BW_FROM_SIG_A_BW_160MHZ	= 0x0003,
+	IEEE80211_RADIOTAP_HE_MU_FLAGS2_BW_FROM_SIG_A_BW_KNOWN	= 0x0004,
+	IEEE80211_RADIOTAP_HE_MU_FLAGS2_SIG_B_COMP		= 0x0008,
+	IEEE80211_RADIOTAP_HE_MU_FLAGS2_SIG_B_SYMS_USERS	= 0x00f0,
+	IEEE80211_RADIOTAP_HE_MU_FLAGS2_PUNC_FROM_SIG_A_BW	= 0x0300,
+	IEEE80211_RADIOTAP_HE_MU_FLAGS2_PUNC_FROM_SIG_A_BW_KNOWN= 0x0400,
+	IEEE80211_RADIOTAP_HE_MU_FLAGS2_CH2_CTR_26T_RU		= 0x0800,
+};
+
+enum ieee80211_radiotap_lsig_data1 {
+	IEEE80211_RADIOTAP_LSIG_DATA1_RATE_KNOWN		= 0x0001,
+	IEEE80211_RADIOTAP_LSIG_DATA1_LENGTH_KNOWN		= 0x0002,
+};
+
+enum ieee80211_radiotap_lsig_data2 {
+	IEEE80211_RADIOTAP_LSIG_DATA2_RATE			= 0x000f,
+	IEEE80211_RADIOTAP_LSIG_DATA2_LENGTH			= 0xfff0,
+};
+
+struct ieee80211_radiotap_lsig {
+	__le16 data1, data2;
+};
+
+enum ieee80211_radiotap_zero_len_psdu_type {
+	IEEE80211_RADIOTAP_ZERO_LEN_PSDU_SOUNDING		= 0,
+	IEEE80211_RADIOTAP_ZERO_LEN_PSDU_NOT_CAPTURED		= 1,
+	IEEE80211_RADIOTAP_ZERO_LEN_PSDU_VENDOR			= 0xff,
+};
+
+// /**
+//  * ieee80211_get_radiotap_len - get radiotap header length
+//  */
+// static inline u16 ieee80211_get_radiotap_len(const char *data)
+// {
+// 	struct ieee80211_radiotap_header *hdr = (void *)data;
+
+// 	return get_unaligned_le16(&hdr->it_len);
+// }
+
+#endif /* __RADIOTAP_H */

user_space/inject_80211/inject_80211.c

@@ -22,7 +22,7 @@
 // 2007-03-15 fixes to getopt_long code by Matteo Croce rootkit85@yahoo.it
 
 #include "inject_80211.h"
-#include "radiotap.h"
+#include "ieee80211_radiotap.h"
 
 #define BUF_SIZE_MAX   (1536)
 #define BUF_SIZE_TOTAL (BUF_SIZE_MAX+1) // +1 in case the sprintf insert the last 0
@@ -63,7 +63,7 @@ static const u8 u8aRadiotapHeader[] =
 /* IEEE80211 header */
 static u8 ieee_hdr_data[] =
 {
-	0x08, 0x02, 0x00, 0x00,             // FC 0x0801. 0--subtype; 8--type&version; 02--toDS0 fromDS1 (data packet from DS to STA)
+	0x08, 0x02, 0x00, 0x00,             // FC 0x0802. 0--subtype; 8--type&version; 02--toDS0 fromDS1 (data packet from DS to STA)
 	0x66, 0x55, 0x44, 0x33, 0x22, 0x11, // BSSID/MAC of AP
 	0x66, 0x55, 0x44, 0x33, 0x22, 0x22, // Source address (STA)
 	0x66, 0x55, 0x44, 0x33, 0x22, 0x33, // Destination address (another STA under the same AP)
@@ -186,6 +186,7 @@ int main(int argc, char *argv[])
 
 			case 'h':
 				usage();
+        break;
 
 			case 'm':
 				hw_mode = optarg[0];

user_space/inject_80211/inject_80211.h

@@ -12,6 +12,7 @@
 #include <pcap.h>
 #include <errno.h>
 
+typedef unsigned long long int u64;
 typedef unsigned int u32;
 typedef unsigned short u16;
 typedef unsigned char u8;

user_space/inject_80211/radiotap.c

@@ -2,16 +2,110 @@
  * Radiotap parser
  *
  * Copyright 2007		Andy Green <andy@warmcat.com>
+ * Copyright 2009		Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Alternatively, this software may be distributed under the terms of BSD
+ * license.
+ *
+ * See COPYING for more details.
  */
 
+#include <linux/kernel.h>
+// #include <linux/export.h>
+// #include <net/cfg80211.h>
+// #include <net/ieee80211_radiotap.h>
+// #include <asm/unaligned.h>
+
 #include "inject_80211.h"
 #include "radiotap.h"
+#include "unaligned.h"
+
+// ----- from kernel, needed by ARRAY_SIZE from kernel.h
+/*
+ * Force a compilation error if condition is true, but also produce a
+ * result (of value 0 and type int), so the expression can be used
+ * e.g. in a structure initializer (or where-ever else comma expressions
+ * aren't permitted).
+ */
+#define BUILD_BUG_ON_ZERO(e) ((int)(sizeof(struct { int:(-!!(e)); })))
+
+/* Are two types/vars the same type (ignoring qualifiers)? */
+#define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
+
+/* &a[0] degrades to a pointer: a different type from an array */
+#define __must_be_array(a)	BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
+
+// ----- ARRAY_SIZE from kernel.h
+/**
+ * ARRAY_SIZE - get the number of elements in array @arr
+ * @arr: array to be sized
+ */
+#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
+
+// ----- radiotap_align_size 
+// ----- ieee80211_radiotap_namespace 
+// ----- ieee80211_radiotap_vendor_namespaces from cfg80211.h ----- //
+struct radiotap_align_size {
+	uint8_t align:4, size:4;
+};
+
+struct ieee80211_radiotap_namespace {
+	const struct radiotap_align_size *align_size;
+	int n_bits;
+	uint32_t oui;
+	uint8_t subns;
+};
+
+struct ieee80211_radiotap_vendor_namespaces {
+	const struct ieee80211_radiotap_namespace *ns;
+	int n_ns;
+};
+// -------------------------------------------------------------------//
+
+/* function prototypes and related defs are in include/net/cfg80211.h */
+
+static const struct radiotap_align_size rtap_namespace_sizes[] = {
+	[IEEE80211_RADIOTAP_TSFT] = { .align = 8, .size = 8, },
+	[IEEE80211_RADIOTAP_FLAGS] = { .align = 1, .size = 1, },
+	[IEEE80211_RADIOTAP_RATE] = { .align = 1, .size = 1, },
+	[IEEE80211_RADIOTAP_CHANNEL] = { .align = 2, .size = 4, },
+	[IEEE80211_RADIOTAP_FHSS] = { .align = 2, .size = 2, },
+	[IEEE80211_RADIOTAP_DBM_ANTSIGNAL] = { .align = 1, .size = 1, },
+	[IEEE80211_RADIOTAP_DBM_ANTNOISE] = { .align = 1, .size = 1, },
+	[IEEE80211_RADIOTAP_LOCK_QUALITY] = { .align = 2, .size = 2, },
+	[IEEE80211_RADIOTAP_TX_ATTENUATION] = { .align = 2, .size = 2, },
+	[IEEE80211_RADIOTAP_DB_TX_ATTENUATION] = { .align = 2, .size = 2, },
+	[IEEE80211_RADIOTAP_DBM_TX_POWER] = { .align = 1, .size = 1, },
+	[IEEE80211_RADIOTAP_ANTENNA] = { .align = 1, .size = 1, },
+	[IEEE80211_RADIOTAP_DB_ANTSIGNAL] = { .align = 1, .size = 1, },
+	[IEEE80211_RADIOTAP_DB_ANTNOISE] = { .align = 1, .size = 1, },
+	[IEEE80211_RADIOTAP_RX_FLAGS] = { .align = 2, .size = 2, },
+	[IEEE80211_RADIOTAP_TX_FLAGS] = { .align = 2, .size = 2, },
+	[IEEE80211_RADIOTAP_RTS_RETRIES] = { .align = 1, .size = 1, },
+	[IEEE80211_RADIOTAP_DATA_RETRIES] = { .align = 1, .size = 1, },
+	[IEEE80211_RADIOTAP_MCS] = { .align = 1, .size = 3, },
+	[IEEE80211_RADIOTAP_AMPDU_STATUS] = { .align = 4, .size = 8, },
+	[IEEE80211_RADIOTAP_VHT] = { .align = 2, .size = 12, },
+	/*
+	 * add more here as they are defined in radiotap.h
+	 */
+};
+
+static const struct ieee80211_radiotap_namespace radiotap_ns = {
+	.n_bits = ARRAY_SIZE(rtap_namespace_sizes),
+	.align_size = rtap_namespace_sizes,
+};
 
 /**
  * ieee80211_radiotap_iterator_init - radiotap parser iterator initialization
  * @iterator: radiotap_iterator to initialize
  * @radiotap_header: radiotap header to parse
  * @max_length: total length we can parse into (eg, whole packet length)
+ * @vns: vendor namespaces to parse
  *
  * Returns: 0 or a negative error code if there is a problem.
  *
@@ -36,36 +130,57 @@
  * iterator->max_length after executing ieee80211_radiotap_iterator_init()
  * successfully.
  *
+ * Alignment Gotcha:
+ * You must take care when dereferencing iterator.this_arg
+ * for multibyte types... the pointer is not aligned.  Use
+ * get_unaligned((type *)iterator.this_arg) to dereference
+ * iterator.this_arg for type "type" safely on all arches.
+ *
  * Example code:
- * See Documentation/networking/radiotap-headers.txt
+ * See Documentation/networking/radiotap-headers.rst
  */
 
 int ieee80211_radiotap_iterator_init(
 	struct ieee80211_radiotap_iterator *iterator,
 	struct ieee80211_radiotap_header *radiotap_header,
-    int max_length)
+	int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns)
 {
+	/* check the radiotap header can actually be present */
+	if (max_length < sizeof(struct ieee80211_radiotap_header))
+		return -EINVAL;
+
 	/* Linux only supports version 0 radiotap format */
 	if (radiotap_header->it_version)
 		return -EINVAL;
 
 	/* sanity check for allowed length and radiotap length field */
-	if (max_length < le16_to_cpu(radiotap_header->it_len))
+	if (max_length < get_unaligned_le16(&radiotap_header->it_len))
 		return -EINVAL;
 
-	iterator->rtheader = radiotap_header;
+	iterator->_rtheader = radiotap_header;
-	iterator->max_length = le16_to_cpu(radiotap_header->it_len);
+	iterator->_max_length = get_unaligned_le16(&radiotap_header->it_len);
-	iterator->arg_index = 0;
+	iterator->_arg_index = 0;
-	iterator->bitmap_shifter = le32_to_cpu(radiotap_header->it_present);
+	// iterator->_bitmap_shifter = get_unaligned_le32(&radiotap_header->it_present);
-	iterator->arg = (u8 *)radiotap_header + sizeof(*radiotap_header);
+  iterator->_bitmap_shifter = (uint32_t)le32_to_cpu(radiotap_header->it_present);
-	iterator->this_arg = 0;
+	iterator->_arg = (uint8_t *)radiotap_header + sizeof(*radiotap_header);
+	iterator->_reset_on_ext = 0;
+	iterator->_next_bitmap = &radiotap_header->it_present;
+	iterator->_next_bitmap++;
+	iterator->_vns = vns;
+	iterator->current_namespace = &radiotap_ns;
+	iterator->is_radiotap_ns = 1;
 
 	/* find payload start allowing for extended bitmap(s) */
 
-	if (unlikely(iterator->bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT))) {
+	if (iterator->_bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT)) {
-		while (le32_to_cpu(*((u32 *)iterator->arg)) &
+		if ((unsigned long)iterator->_arg -
+		    (unsigned long)iterator->_rtheader + sizeof(uint32_t) >
+		    (unsigned long)iterator->_max_length)
+			return -EINVAL;
+		// while (get_unaligned_le32(iterator->_arg) &
+      while (le32_to_cpu(*((u32 *)iterator->_arg)) &
 					(1 << IEEE80211_RADIOTAP_EXT)) {
-			iterator->arg += sizeof(u32);
+			iterator->_arg += sizeof(uint32_t);
 
 			/*
 			 * check for insanity where the present bitmaps
@@ -73,12 +188,14 @@ int ieee80211_radiotap_iterator_init(
 			 * stated radiotap header length
 			 */
 
-			if (((ulong)iterator->arg -
+			if ((unsigned long)iterator->_arg -
-			     (ulong)iterator->rtheader) > iterator->max_length)
+			    (unsigned long)iterator->_rtheader +
+			    sizeof(uint32_t) >
+			    (unsigned long)iterator->_max_length)
 				return -EINVAL;
 		}
 
-		iterator->arg += sizeof(u32);
+		iterator->_arg += sizeof(uint32_t);
 
 		/*
 		 * no need to check again for blowing past stated radiotap
@@ -87,10 +204,35 @@ int ieee80211_radiotap_iterator_init(
 		 */
 	}
 
+	iterator->this_arg = iterator->_arg;
+
 	/* we are all initialized happily */
 
 	return 0;
 }
+// EXPORT_SYMBOL(ieee80211_radiotap_iterator_init);
+
+static void find_ns(struct ieee80211_radiotap_iterator *iterator,
+		    uint32_t oui, uint8_t subns)
+{
+	int i;
+
+	iterator->current_namespace = NULL;
+
+	if (!iterator->_vns)
+		return;
+
+	for (i = 0; i < iterator->_vns->n_ns; i++) {
+		if (iterator->_vns->ns[i].oui != oui)
+			continue;
+		if (iterator->_vns->ns[i].subns != subns)
+			continue;
+
+		iterator->current_namespace = &iterator->_vns->ns[i];
+		break;
+	}
+}
+
 
 
 /**
@@ -107,102 +249,111 @@ int ieee80211_radiotap_iterator_init(
  * present fields.  @this_arg can be changed by the caller (eg,
  * incremented to move inside a compound argument like
  * IEEE80211_RADIOTAP_CHANNEL).  The args pointed to are in
- * little-endian format whatever the endianness of your CPU.
+ * little-endian format whatever the endianess of your CPU.
+ *
+ * Alignment Gotcha:
+ * You must take care when dereferencing iterator.this_arg
+ * for multibyte types... the pointer is not aligned.  Use
+ * get_unaligned((type *)iterator.this_arg) to dereference
+ * iterator.this_arg for type "type" safely on all arches.
  */
 
 int ieee80211_radiotap_iterator_next(
 	struct ieee80211_radiotap_iterator *iterator)
 {
-
+	while (1) {
-	/*
-	 * small length lookup table for all radiotap types we heard of
-	 * starting from b0 in the bitmap, so we can walk the payload
-	 * area of the radiotap header
-	 *
-	 * There is a requirement to pad args, so that args
-	 * of a given length must begin at a boundary of that length
-	 * -- but note that compound args are allowed (eg, 2 x u16
-	 * for IEEE80211_RADIOTAP_CHANNEL) so total arg length is not
-	 * a reliable indicator of alignment requirement.
-	 *
-	 * upper nybble: content alignment for arg
-	 * lower nybble: content length for arg
-	 */
-
-	static const u8 rt_sizes[] = {
-		[IEEE80211_RADIOTAP_TSFT] = 0x88,
-		[IEEE80211_RADIOTAP_FLAGS] = 0x11,
-		[IEEE80211_RADIOTAP_RATE] = 0x11,
-		[IEEE80211_RADIOTAP_CHANNEL] = 0x24,
-		[IEEE80211_RADIOTAP_FHSS] = 0x22,
-		[IEEE80211_RADIOTAP_DBM_ANTSIGNAL] = 0x11,
-		[IEEE80211_RADIOTAP_DBM_ANTNOISE] = 0x11,
-		[IEEE80211_RADIOTAP_LOCK_QUALITY] = 0x22,
-		[IEEE80211_RADIOTAP_TX_ATTENUATION] = 0x22,
-		[IEEE80211_RADIOTAP_DB_TX_ATTENUATION] = 0x22,
-		[IEEE80211_RADIOTAP_DBM_TX_POWER] = 0x11,
-		[IEEE80211_RADIOTAP_ANTENNA] = 0x11,
-		[IEEE80211_RADIOTAP_DB_ANTSIGNAL] = 0x11,
-		[IEEE80211_RADIOTAP_DB_ANTNOISE] = 0x11,
-		[IEEE80211_RADIOTAP_RX_FLAGS] = 0x22,
-		[IEEE80211_RADIOTAP_TX_FLAGS] = 0x22,
-		[IEEE80211_RADIOTAP_RTS_RETRIES] = 0x11,
-		[IEEE80211_RADIOTAP_DATA_RETRIES] = 0x11,
-		[IEEE80211_RADIOTAP_MCS] = 0x13,
-		[IEEE80211_RADIOTAP_AMPDU_STATUS] = 0x48
-		/*
-		 * add more here as they are defined in
-		 * include/net/ieee80211_radiotap.h
-		 */
-	};
-
-	/*
-	 * for every radiotap entry we can at
-	 * least skip (by knowing the length)...
-	 */
-
-	while (iterator->arg_index < sizeof(rt_sizes)) {
 		int hit = 0;
-		int pad;
+		int pad, align, size, subns;
+		uint32_t oui;
 
-		if (!(iterator->bitmap_shifter & 1))
+		/* if no more EXT bits, that's it */
+		if ((iterator->_arg_index % 32) == IEEE80211_RADIOTAP_EXT &&
+		    !(iterator->_bitmap_shifter & 1))
+			return -ENOENT;
+
+		if (!(iterator->_bitmap_shifter & 1))
 			goto next_entry; /* arg not present */
 
+		/* get alignment/size of data */
+		switch (iterator->_arg_index % 32) {
+		case IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE:
+		case IEEE80211_RADIOTAP_EXT:
+			align = 1;
+			size = 0;
+			break;
+		case IEEE80211_RADIOTAP_VENDOR_NAMESPACE:
+			align = 2;
+			size = 6;
+			break;
+		default:
+			if (!iterator->current_namespace ||
+			    iterator->_arg_index >= iterator->current_namespace->n_bits) {
+				if (iterator->current_namespace == &radiotap_ns)
+					return -ENOENT;
+				align = 0;
+			} else {
+				align = iterator->current_namespace->align_size[iterator->_arg_index].align;
+				size = iterator->current_namespace->align_size[iterator->_arg_index].size;
+			}
+			if (!align) {
+				/* skip all subsequent data */
+				iterator->_arg = iterator->_next_ns_data;
+				/* give up on this namespace */
+				iterator->current_namespace = NULL;
+				goto next_entry;
+			}
+			break;
+		}
+
 		/*
 		 * arg is present, account for alignment padding
-		 *  8-bit args can be at any alignment
-		 * 16-bit args must start on 16-bit boundary
-		 * 32-bit args must start on 32-bit boundary
-		 * 64-bit args must start on 64-bit boundary
 		 *
-		 * note that total arg size can differ from alignment of
+		 * Note that these alignments are relative to the start
-		 * elements inside arg, so we use upper nybble of length
+		 * of the radiotap header.  There is no guarantee
-		 * table to base alignment on
-		 *
-		 * also note: these alignments are ** relative to the
-		 * start of the radiotap header **.  There is no guarantee
 		 * that the radiotap header itself is aligned on any
 		 * kind of boundary.
+		 *
+		 * The above is why get_unaligned() is used to dereference
+		 * multibyte elements from the radiotap area.
 		 */
 
-		pad = (((ulong)iterator->arg) -
+		pad = ((unsigned long)iterator->_arg -
-			((ulong)iterator->rtheader)) &
+		       (unsigned long)iterator->_rtheader) & (align - 1);
-			((rt_sizes[iterator->arg_index] >> 4) - 1);
 
 		if (pad)
-			iterator->arg +=
+			iterator->_arg += align - pad;
-				(rt_sizes[iterator->arg_index] >> 4) - pad;
+
+		if (iterator->_arg_index % 32 == IEEE80211_RADIOTAP_VENDOR_NAMESPACE) {
+			int vnslen;
+
+			if ((unsigned long)iterator->_arg + size -
+			    (unsigned long)iterator->_rtheader >
+			    (unsigned long)iterator->_max_length)
+				return -EINVAL;
+
+			oui = (*iterator->_arg << 16) |
+				(*(iterator->_arg + 1) << 8) |
+				*(iterator->_arg + 2);
+			subns = *(iterator->_arg + 3);
+
+			find_ns(iterator, oui, subns);
+
+			vnslen = get_unaligned_le16(iterator->_arg + 4);
+			iterator->_next_ns_data = iterator->_arg + size + vnslen;
+			if (!iterator->current_namespace)
+				size += vnslen;
+		}
 
 		/*
 		 * this is what we will return to user, but we need to
 		 * move on first so next call has something fresh to test
 		 */
-		iterator->this_arg_index = iterator->arg_index;
+		iterator->this_arg_index = iterator->_arg_index;
-		iterator->this_arg = iterator->arg;
+		iterator->this_arg = iterator->_arg;
-		hit = 1;
+		iterator->this_arg_size = size;
 
 		/* internally move on the size of this arg */
-		iterator->arg += rt_sizes[iterator->arg_index] & 0x0f;
+		iterator->_arg += size;
 
 		/*
 		 * check for insanity where we are given a bitmap that
@@ -211,34 +362,59 @@ int ieee80211_radiotap_iterator_next(
 		 * max_length on the last arg, never exceeding it.
 		 */
 
-		if (((ulong)iterator->arg - (ulong)iterator->rtheader) >
+		if ((unsigned long)iterator->_arg -
-		    iterator->max_length)
+		    (unsigned long)iterator->_rtheader >
+		    (unsigned long)iterator->_max_length)
 			return -EINVAL;
 
+		/* these special ones are valid in each bitmap word */
+		switch (iterator->_arg_index % 32) {
+		case IEEE80211_RADIOTAP_VENDOR_NAMESPACE:
+			iterator->_reset_on_ext = 1;
+
+			iterator->is_radiotap_ns = 0;
+			/*
+			 * If parser didn't register this vendor
+			 * namespace with us, allow it to show it
+			 * as 'raw. Do do that, set argument index
+			 * to vendor namespace.
+			 */
+			iterator->this_arg_index =
+				IEEE80211_RADIOTAP_VENDOR_NAMESPACE;
+			if (!iterator->current_namespace)
+				hit = 1;
+			goto next_entry;
+		case IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE:
+			iterator->_reset_on_ext = 1;
+			iterator->current_namespace = &radiotap_ns;
+			iterator->is_radiotap_ns = 1;
+			goto next_entry;
+		case IEEE80211_RADIOTAP_EXT:
+			/*
+			 * bit 31 was set, there is more
+			 * -- move to next u32 bitmap
+			 */
+			iterator->_bitmap_shifter =
+				// get_unaligned_le32(iterator->_next_bitmap);
+        le32_to_cpu(*iterator->_next_bitmap);
+			iterator->_next_bitmap++;
+			if (iterator->_reset_on_ext)
+				iterator->_arg_index = 0;
+			else
+				iterator->_arg_index++;
+			iterator->_reset_on_ext = 0;
+			break;
+		default:
+			/* we've got a hit! */
+			hit = 1;
  next_entry:
-		iterator->arg_index++;
+			iterator->_bitmap_shifter >>= 1;
-		if (unlikely((iterator->arg_index & 31) == 0)) {
+			iterator->_arg_index++;
-			/* completed current u32 bitmap */
-			if (iterator->bitmap_shifter & 1) {
-				/* b31 was set, there is more */
-				/* move to next u32 bitmap */
-				iterator->bitmap_shifter =
-				    le32_to_cpu(*iterator->next_bitmap);
-				iterator->next_bitmap++;
-			} else {
-				/* no more bitmaps: end */
-				iterator->arg_index = sizeof(rt_sizes);
-			}
-		} else { /* just try the next bit */
-			iterator->bitmap_shifter >>= 1;
 		}
 
 		/* if we found a valid arg earlier, return it now */
 		if (hit)
 			return 0;
 	}
-
-	/* we don't know how to handle any more args, we're done */
-	return -ENOENT;
 }
-
+// EXPORT_SYMBOL(ieee80211_radiotap_iterator_next);

user_space/inject_80211/radiotap.h

@@ -1,37 +1,59 @@
 #include "ieee80211_radiotap.h"
 
-/* Radiotap header iteration
+// -----ieee80211_radiotap_iterator from cfg80211.h ----- //
- *   implemented in net/wireless/radiotap.c
- *   docs in Documentation/networking/radiotap-headers.txt
- */
 /**
  * struct ieee80211_radiotap_iterator - tracks walk thru present radiotap args
- * @rtheader: pointer to the radiotap header we are walking through
+ * @this_arg_index: index of current arg, valid after each successful call
- * @max_length: length of radiotap header in cpu byte ordering
+ *	to ieee80211_radiotap_iterator_next()
- * @this_arg_index: IEEE80211_RADIOTAP_... index of current arg
+ * @this_arg: pointer to current radiotap arg; it is valid after each
- * @this_arg: pointer to current radiotap arg
+ *	call to ieee80211_radiotap_iterator_next() but also after
- * @arg_index: internal next argument index
+ *	ieee80211_radiotap_iterator_init() where it will point to
- * @arg: internal next argument pointer
+ *	the beginning of the actual data portion
- * @next_bitmap: internal pointer to next present u32
+ * @this_arg_size: length of the current arg, for convenience
- * @bitmap_shifter: internal shifter for curr u32 bitmap, b0 set == arg present
+ * @current_namespace: pointer to the current namespace definition
+ *	(or internally %NULL if the current namespace is unknown)
+ * @is_radiotap_ns: indicates whether the current namespace is the default
+ *	radiotap namespace or not
+ *
+ * @_rtheader: pointer to the radiotap header we are walking through
+ * @_max_length: length of radiotap header in cpu byte ordering
+ * @_arg_index: next argument index
+ * @_arg: next argument pointer
+ * @_next_bitmap: internal pointer to next present u32
+ * @_bitmap_shifter: internal shifter for curr u32 bitmap, b0 set == arg present
+ * @_vns: vendor namespace definitions
+ * @_next_ns_data: beginning of the next namespace's data
+ * @_reset_on_ext: internal; reset the arg index to 0 when going to the
+ *	next bitmap word
+ *
+ * Describes the radiotap parser state. Fields prefixed with an underscore
+ * must not be used by users of the parser, only by the parser internally.
  */
 
 struct ieee80211_radiotap_iterator {
-	struct ieee80211_radiotap_header *rtheader;
+	struct ieee80211_radiotap_header *_rtheader;
-	int max_length;
+	const struct ieee80211_radiotap_vendor_namespaces *_vns;
-	int this_arg_index;
+	const struct ieee80211_radiotap_namespace *current_namespace;
-	u8 *this_arg;
 
-	int arg_index;
+	unsigned char *_arg, *_next_ns_data;
-	u8 *arg;
+	__le32 *_next_bitmap;
-	__le32 *next_bitmap;
+
-	u32 bitmap_shifter;
+	unsigned char *this_arg;
+	int this_arg_index;
+	int this_arg_size;
+
+	int is_radiotap_ns;
+
+	int _max_length;
+	int _arg_index;
+	uint32_t _bitmap_shifter;
+	int _reset_on_ext;
 };
 
 extern int ieee80211_radiotap_iterator_init(
 	struct ieee80211_radiotap_iterator *iterator,
 	struct ieee80211_radiotap_header *radiotap_header,
-   int max_length);
+	int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns);
 
 extern int ieee80211_radiotap_iterator_next(
 	struct ieee80211_radiotap_iterator *iterator);

user_space/inject_80211/unaligned.h

@@ -0,0 +1,106 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ *  Port on Texas Instruments TMS320C6x architecture
+ *
+ *  Copyright (C) 2004, 2009, 2010 Texas Instruments Incorporated
+ *  Author: Aurelien Jacquiot (aurelien.jacquiot@jaluna.com)
+ *  Rewritten for 2.6.3x: Mark Salter <msalter@redhat.com>
+ */
+#ifndef _ASM_C6X_UNALIGNED_H
+#define _ASM_C6X_UNALIGNED_H
+
+// #include <linux/swab.h>
+// #include <linux/unaligned/generic.h>
+
+#include "inject_80211.h"
+
+/*
+ * The C64x+ can do unaligned word and dword accesses in hardware
+ * using special load/store instructions.
+ */
+
+static inline u16 get_unaligned_le16(const void *p)
+{
+	const u8 *_p = p;
+	return _p[0] | _p[1] << 8;
+}
+
+static inline u16 get_unaligned_be16(const void *p)
+{
+	const u8 *_p = p;
+	return _p[0] << 8 | _p[1];
+}
+
+static inline void put_unaligned_le16(u16 val, void *p)
+{
+	u8 *_p = p;
+	_p[0] = val;
+	_p[1] = val >> 8;
+}
+
+static inline void put_unaligned_be16(u16 val, void *p)
+{
+	u8 *_p = p;
+	_p[0] = val >> 8;
+	_p[1] = val;
+}
+
+// static inline u32 get_unaligned32(const void *p)
+// {
+// 	u32 val = (u32) p;
+// 	asm (" ldnw	.d1t1	*%0,%0\n"
+// 	     " nop     4\n"
+// 	     : "+a"(val));
+// 	return val;
+// }
+
+// static inline void put_unaligned32(u32 val, void *p)
+// {
+// 	asm volatile (" stnw	.d2t1	%0,*%1\n"
+// 		      : : "a"(val), "b"(p) : "memory");
+// }
+
+// static inline u64 get_unaligned64(const void *p)
+// {
+// 	u64 val;
+// 	asm volatile (" ldndw	.d1t1	*%1,%0\n"
+// 		      " nop     4\n"
+// 		      : "=a"(val) : "a"(p));
+// 	return val;
+// }
+
+// static inline void put_unaligned64(u64 val, const void *p)
+// {
+// 	asm volatile (" stndw	.d2t1	%0,*%1\n"
+// 		      : : "a"(val), "b"(p) : "memory");
+// }
+
+#ifdef CONFIG_CPU_BIG_ENDIAN
+
+#define get_unaligned_le32(p)	 __swab32(get_unaligned32(p))
+#define get_unaligned_le64(p)	 __swab64(get_unaligned64(p))
+#define get_unaligned_be32(p)	 get_unaligned32(p)
+#define get_unaligned_be64(p)	 get_unaligned64(p)
+#define put_unaligned_le32(v, p) put_unaligned32(__swab32(v), (p))
+#define put_unaligned_le64(v, p) put_unaligned64(__swab64(v), (p))
+#define put_unaligned_be32(v, p) put_unaligned32((v), (p))
+#define put_unaligned_be64(v, p) put_unaligned64((v), (p))
+#define get_unaligned	__get_unaligned_be
+#define put_unaligned	__put_unaligned_be
+
+#else
+
+#define get_unaligned_le32(p)	 get_unaligned32(p)
+#define get_unaligned_le64(p)	 get_unaligned64(p)
+#define get_unaligned_be32(p)	 __swab32(get_unaligned32(p))
+#define get_unaligned_be64(p)	 __swab64(get_unaligned64(p))
+#define put_unaligned_le32(v, p) put_unaligned32((v), (p))
+#define put_unaligned_le64(v, p) put_unaligned64((v), (p))
+#define put_unaligned_be32(v, p) put_unaligned32(__swab32(v), (p))
+#define put_unaligned_be64(v, p) put_unaligned64(__swab64(v), (p))
+#define get_unaligned	__get_unaligned_le
+#define put_unaligned	__put_unaligned_le
+
+#endif
+
+#endif /* _ASM_C6X_UNALIGNED_H */

user_space/populate_kernel_image_module_reboot.sh

@@ -14,15 +14,17 @@ tar -zxvf kernel_modules.tar.gz
 
 if [ ${MACHINE_TYPE} == 'aarch64' ]; then
     IMAGE_FILENAME=Image
+    DTB_FILENAME="system.dtb"
 else
     IMAGE_FILENAME=uImage
+    DTB_FILENAME="devicetree.dtb"
 fi
 
-mv ./kernel_modules/ad9361_drv.ko ./openwifi/ -f
+mv ./kernel_modules/ad9361_drv.ko ./openwifi/ -f || true
-mv ./kernel_modules/adi_axi_hdmi.ko ./openwifi/ -f
+mv ./kernel_modules/adi_axi_hdmi.ko ./openwifi/ -f || true
-mv ./kernel_modules/axidmatest.ko ./openwifi/ -f
+mv ./kernel_modules/axidmatest.ko ./openwifi/ -f || true
-mv ./kernel_modules/lcd.ko ./openwifi/ -f
+mv ./kernel_modules/lcd.ko ./openwifi/ -f || true
-mv ./kernel_modules/xilinx_dma.ko ./openwifi/ -f
+mv ./kernel_modules/xilinx_dma.ko ./openwifi/ -f || true
 
 rm -rf /lib/modules/$(uname -r)
 ln -s /root/kernel_modules /lib/modules/$(uname -r)
@@ -37,6 +39,9 @@ fi
 if test -f "./kernel_modules/BOOT.BIN"; then
     cp ./kernel_modules/BOOT.BIN /mnt/
 fi
+if test -f "./kernel_modules/$DTB_FILENAME"; then
+    cp ./kernel_modules/$DTB_FILENAME /mnt/
+fi
 cd /mnt/
 sync
 cd ~

user_space/sdcard_boot_update.sh

@@ -6,12 +6,12 @@
 
 if [ "$#" -ne 1 ]; then
     echo "You must enter the \$BOARD_NAME as argument"
-    echo "Like: sdrpi antsdr antsdr_e200 adrv9364z7020 adrv9361z7035 zc706_fmcs2 zed_fmcs2 zc702_fmcs2 zcu102_fmcs2 zcu102_9371 neptunesdr"
+    echo "Like: sdrpi antsdr antsdr_e200 e310v2 adrv9364z7020 adrv9361z7035 zc706_fmcs2 zed_fmcs2 zc702_fmcs2 zcu102_fmcs2 zcu102_9371 neptunesdr"
     exit 1
 fi
 BOARD_NAME=$1
 
-if [ "$BOARD_NAME" != "neptunesdr" ] && [ "$BOARD_NAME" != "antsdr" ] && [ "$BOARD_NAME" != "antsdr_e200" ] && [ "$BOARD_NAME" != "sdrpi" ] && [ "$BOARD_NAME" != "zc706_fmcs2" ] && [ "$BOARD_NAME" != "zc702_fmcs2" ] && [ "$BOARD_NAME" != "zed_fmcs2" ] && [ "$BOARD_NAME" != "adrv9361z7035" ] && [ "$BOARD_NAME" != "adrv9364z7020" ] && [ "$BOARD_NAME" != "zcu102_fmcs2" ] && [ "$BOARD_NAME" != "zcu102_9371" ]; then
+if [ "$BOARD_NAME" != "neptunesdr" ] && [ "$BOARD_NAME" != "antsdr" ] && [ "$BOARD_NAME" != "antsdr_e200" ] && [ "$BOARD_NAME" != "e310v2" ] && [ "$BOARD_NAME" != "sdrpi" ] && [ "$BOARD_NAME" != "zc706_fmcs2" ] && [ "$BOARD_NAME" != "zc702_fmcs2" ] && [ "$BOARD_NAME" != "zed_fmcs2" ] && [ "$BOARD_NAME" != "adrv9361z7035" ] && [ "$BOARD_NAME" != "adrv9364z7020" ] && [ "$BOARD_NAME" != "zcu102_fmcs2" ] && [ "$BOARD_NAME" != "zcu102_9371" ]; then
     echo "\$BOARD_NAME is not correct. Please check!"
     exit 1
 else

user_space/set_lbt_th.sh

@@ -13,5 +13,6 @@ if [ $lbt_th -ne 987654321 ]; then
 fi
 
 # show
-./sdrctl dev sdr0 get reg xpu 8 
+# ./sdrctl dev sdr0 get reg xpu 8 
+./sdrctl dev sdr0 get reg drv_xpu 0
 set +x

user_space/setup_once.sh

@@ -25,6 +25,35 @@ else
     # cp ./kernel_modules32/* /lib/modules/$(uname -r)/
 fi
 
+# Decide board name
+DEVICE_TREE_MODEL_STRING=$(cat /proc/device-tree/model)
+if [[ $DEVICE_TREE_MODEL_STRING == *"ADRV9361-Z7035"* ]]; then
+  BOARD_NAME=adrv9361z7035
+elif [[ $DEVICE_TREE_MODEL_STRING == *"ADRV9364-Z7020"* ]]; then
+  BOARD_NAME=adrv9364z7020
+elif [[ $DEVICE_TREE_MODEL_STRING == *"ANTSDR-E310V2"* ]]; then
+  BOARD_NAME=e310v2
+elif [[ $DEVICE_TREE_MODEL_STRING == *"ANTSDR-E310"* ]]; then
+  BOARD_NAME=antsdr
+elif [[ $DEVICE_TREE_MODEL_STRING == *"ANTSDR-E200"* ]]; then
+  BOARD_NAME=antsdr_e200
+elif [[ $DEVICE_TREE_MODEL_STRING == *"neptunesdr"* ]]; then
+  BOARD_NAME=neptunesdr
+elif [[ $DEVICE_TREE_MODEL_STRING == *"sdrpi"* ]]; then
+  BOARD_NAME=sdrpi
+elif [[ $DEVICE_TREE_MODEL_STRING == *"ZC702"* ]]; then
+  BOARD_NAME=zc702_fmcs2
+elif [[ $DEVICE_TREE_MODEL_STRING == *"ZC706"* ]]; then
+  BOARD_NAME=zc706_fmcs2
+elif [[ $DEVICE_TREE_MODEL_STRING == *"ZCU102"* ]]; then
+  BOARD_NAME=zcu102_fmcs2
+elif [[ $DEVICE_TREE_MODEL_STRING == *"ZED"* ]]; then
+  BOARD_NAME=zed_fmcs2
+else
+  echo $DEVICE_TREE_MODEL_STRING " NOT recognized!"
+  exit 1
+fi
+
 mv /root/kernel_modules/ad9361_drv.ko /root/openwifi/ -f || true
 mv /root/kernel_modules/adi_axi_hdmi.ko /root/openwifi/ -f || true
 mv /root/kernel_modules/axidmatest.ko /root/openwifi/ -f || true
@@ -36,6 +65,9 @@ ln -s /root/kernel_modules /lib/modules/$(uname -r)
 sync
 depmod
 
+echo $BOARD_NAME
+cp /root/openwifi_BOOT/$BOARD_NAME/system_top.bit.bin /root/openwifi/ -f || true
+
 cd /root/openwifi/sdrctl_src
 make clean
 make

user_space/side_ch_ctl_src/iq_capture.py

@@ -55,7 +55,7 @@ def parse_iq(iq, iq_len):
     iq = iq.reshape([num_trans, num_int16_per_trans])
     
     timestamp = iq[:,0] + pow(2,16)*iq[:,1] + pow(2,32)*iq[:,2] + pow(2,48)*iq[:,3]
-    iq_capture = iq[:,4::4] + iq[:,5::4]*1j
+    iq_capture = np.int16(iq[:,4::4]) + np.int16(iq[:,5::4])*1j
     agc_gain = iq[:,6::4]
     rssi_half_db = iq[:,7::4]
     # print(num_trans, iq_len, iq_capture.shape, agc_gain.shape, rssi_half_db.shape)
@@ -106,7 +106,7 @@ while True:
         if (test_residual != 0):
             print("Abnormal length")
 
-        iq = np.frombuffer(data, dtype='int16')
+        iq = np.frombuffer(data, dtype='uint16')
         np.savetxt(iq_fd, iq)
 
         timestamp, iq_capture, agc_gain, rssi_half_db = parse_iq(iq, iq_len)

user_space/side_ch_ctl_src/iq_capture_2ant.py

@@ -38,8 +38,8 @@ def parse_iq(iq, iq_len):
     iq = iq.reshape([num_trans, num_int16_per_trans])
     
     timestamp = iq[:,0] + pow(2,16)*iq[:,1] + pow(2,32)*iq[:,2] + pow(2,48)*iq[:,3]
-    iq0_capture = iq[:,4::4] + iq[:,5::4]*1j
+    iq0_capture = np.int16(iq[:,4::4]) + np.int16(iq[:,5::4])*1j
-    iq1_capture = iq[:,6::4] + iq[:,7::4]*1j
+    iq1_capture = np.int16(iq[:,6::4]) + np.int16(iq[:,7::4])*1j
     # print(num_trans, iq_len, iq0_capture.shape, iq1_capture.shape)
 
     iq0_capture = iq0_capture.reshape([num_trans*iq_len,])
@@ -87,7 +87,7 @@ while True:
         if (test_residual != 0):
             print("Abnormal length")
 
-        iq = np.frombuffer(data, dtype='int16')
+        iq = np.frombuffer(data, dtype='uint16')
         np.savetxt(iq_fd, iq)
 
         timestamp, iq0_capture, iq1_capture = parse_iq(iq, iq_len)

user_space/side_ch_ctl_src/side_info_display.py

@@ -8,7 +8,7 @@ import socket
 import numpy as np
 import matplotlib.pyplot as plt
 
-def display_side_info(freq_offset, csi, equalizer, CSI_LEN, EQUALIZER_LEN):
+def display_side_info(freq_offset, csi, equalizer, waterfall_flag, CSI_LEN, EQUALIZER_LEN):
     if not hasattr(display_side_info, 'freq_offset_store'):
         display_side_info.freq_offset_store = np.zeros((256,))
 
@@ -50,6 +50,7 @@ def display_side_info(freq_offset, csi, equalizer, CSI_LEN, EQUALIZER_LEN):
     if ( (len(equalizer)==0) or ((len(equalizer)>0)and(good_row_idx>0)) ):
         fig_csi = plt.figure(1)
         fig_csi.clf()
+        # if waterfall_flag == 0:
         ax_abs_csi = fig_csi.add_subplot(211)
         ax_abs_csi.set_xlabel("subcarrier idx")
         ax_abs_csi.set_ylabel("abs")
@@ -61,6 +62,36 @@ def display_side_info(freq_offset, csi, equalizer, CSI_LEN, EQUALIZER_LEN):
         plt.plot(np.angle(csi_for_plot))
         fig_csi.canvas.flush_events()
 
+        # else:
+
+        if waterfall_flag == 1:
+            # print(np.abs(display_side_info.csi_mat_for_waterfall))
+            display_side_info.csi_mat_for_waterfall = np.roll(display_side_info.csi_mat_for_waterfall, 1, axis=0)
+            # print(np.abs(display_side_info.csi_mat_for_waterfall))
+
+            display_side_info.csi_mat_for_waterfall[0,:] = csi[0,:]
+
+            fig_waterfall = plt.figure(3)
+            fig_waterfall.clf()
+
+            ax_abs_csi_waterfall = fig_waterfall.add_subplot(121)
+            ax_abs_csi_waterfall.set_title('CSI amplitude')
+            ax_abs_csi_waterfall.set_xlabel("subcarrier idx")
+            ax_abs_csi_waterfall.set_ylabel("time")
+            # ax_abs_csi_waterfall_shw = ax_abs_csi_waterfall.imshow(np.abs(display_side_info.csi_mat_for_waterfall), vmin=200, vmax=500)
+            ax_abs_csi_waterfall_shw = ax_abs_csi_waterfall.imshow(np.abs(display_side_info.csi_mat_for_waterfall))
+            plt.colorbar(ax_abs_csi_waterfall_shw)
+
+            ax_phase_csi_waterfall = fig_waterfall.add_subplot(122)
+            ax_phase_csi_waterfall.set_title('CSI phase')
+            ax_phase_csi_waterfall.set_xlabel("subcarrier idx")
+            ax_phase_csi_waterfall.set_ylabel("time")
+            # ax_phase_csi_waterfall_shw = ax_phase_csi_waterfall.imshow(np.angle(display_side_info.csi_mat_for_waterfall), vmin=-3.14, vmax=3.14)
+            ax_phase_csi_waterfall_shw = ax_phase_csi_waterfall.imshow(np.angle(display_side_info.csi_mat_for_waterfall))
+            plt.colorbar(ax_phase_csi_waterfall_shw)
+
+            fig_waterfall.canvas.flush_events()
+
     if ( (len(equalizer)>0) and (good_row_idx>0) ):
         fig_equalizer = plt.figure(2)
         fig_equalizer.clf()
@@ -81,7 +112,7 @@ def parse_side_info(side_info, num_eq, CSI_LEN, EQUALIZER_LEN, HEADER_LEN):
     
     timestamp = side_info[:,0] + pow(2,16)*side_info[:,1] + pow(2,32)*side_info[:,2] + pow(2,48)*side_info[:,3]
     
-    freq_offset = (20e6*side_info[:,4]/512)/(2*3.14159265358979323846)
+    freq_offset = (20e6*np.int16(side_info[:,4])/512)/(2*3.14159265358979323846)
 
     csi = np.zeros((num_trans, CSI_LEN), dtype='int16')
     csi = csi + csi*1j
@@ -92,8 +123,8 @@ def parse_side_info(side_info, num_eq, CSI_LEN, EQUALIZER_LEN, HEADER_LEN):
         equalizer = equalizer + equalizer*1j
     
     for i in range(num_trans):
-        tmp_vec_i = side_info[i,8:(num_int16_per_trans-1):4]
+        tmp_vec_i = np.int16(side_info[i,8:(num_int16_per_trans-1):4])
-        tmp_vec_q = side_info[i,9:(num_int16_per_trans-1):4]
+        tmp_vec_q = np.int16(side_info[i,9:(num_int16_per_trans-1):4])
         tmp_vec = tmp_vec_i + tmp_vec_q*1j
         # csi[i,:] = tmp_vec[0:CSI_LEN]
         csi[i,:CSI_LEN_HALF] = tmp_vec[CSI_LEN_HALF:CSI_LEN]
@@ -125,6 +156,12 @@ else:
     print(num_eq)
     # print(type(num_eq))
 
+waterfall_flag = 0
+if len(sys.argv)>2:
+    print("Will plot CSI in waterfall!")
+    display_side_info.csi_mat_for_waterfall = np.zeros((64, CSI_LEN)) + 1j*np.zeros((64, CSI_LEN))
+    waterfall_flag = 1
+
 num_dma_symbol_per_trans = HEADER_LEN + CSI_LEN + num_eq*EQUALIZER_LEN
 num_byte_per_trans = 8*num_dma_symbol_per_trans
 
@@ -138,20 +175,20 @@ while True:
     try:
         data, addr = sock.recvfrom(MAX_NUM_DMA_SYMBOL*8) # buffer size
         # print(addr)
-        print(len(data), num_byte_per_trans)
+        # print(len(data), num_byte_per_trans)
         test_residual = len(data)%num_byte_per_trans
         if (test_residual != 0):
             print("Abnormal length")
 
-        side_info = np.frombuffer(data, dtype='int16')
+        side_info = np.frombuffer(data, dtype='uint16')
         np.savetxt(side_info_fd, side_info)
 
         timestamp, freq_offset, csi, equalizer = parse_side_info(side_info, num_eq, CSI_LEN, EQUALIZER_LEN, HEADER_LEN)
-        print(timestamp)
+        # print(timestamp)
         # print(freq_offset)
         # print(csi[0,0:10])
         # print(equalizer[0,0:10])
-        display_side_info(freq_offset, csi, equalizer, CSI_LEN, EQUALIZER_LEN)
+        display_side_info(freq_offset, csi, equalizer, waterfall_flag, CSI_LEN, EQUALIZER_LEN)
 
     except KeyboardInterrupt:
         print('User quit')

user_space/side_ch_ctl_src/test_iq_2ant_file_display.m

@@ -2,7 +2,8 @@
 
 % clear all;
 % close all;
-function test_iq_2ant_file_display(iq_len, iq_cap_filename)
+function timestamp = test_iq_2ant_file_display(iq_len, iq_cap_filename, idx_to_check)
+close all;
 
 if exist('iq_len', 'var')==0 || isempty(iq_len)
     iq_len = 8187; % default for big fpga
@@ -13,6 +14,10 @@ if exist('iq_cap_filename', 'var')==0 || isempty(iq_cap_filename)
     iq_cap_filename = 'iq_2ant.txt';
 end
 
+if exist('idx_to_check', 'var')==0 || isempty(idx_to_check)
+    idx_to_check = 1;
+end
+
 a = load(iq_cap_filename);
 len_a = floor(length(a)/4)*4;
 a = a(1:len_a);
@@ -25,38 +30,42 @@ iq0_capture =   zeros(iq_len, num_iq_capture);
 iq1_capture =   zeros(iq_len, num_iq_capture);
 timestamp   =   zeros(1, num_iq_capture);
 
+b = uint16(b);
 for i=1:num_iq_capture
     sp = (i-1)*num_data_in_each_iq_capture + 1;
     ep = i*num_data_in_each_iq_capture;
-    timestamp(i) = b(sp,1) + (2^16)*b(sp,2) + (2^32)*b(sp,3) + (2^48)*b(sp,4);
+    timestamp(i) = double(b(sp,1)) + (2^16)*double(b(sp,2)) + (2^32)*double(b(sp,3)) + (2^48)*double(b(sp,4));
-    iq0_capture(:,i) = b((sp+1):ep,1) + 1i.*b((sp+1):ep,2);
+    iq0_capture(:,i) = double(typecast(b((sp+1):ep,1),'int16')) + 1i.*double(typecast(b((sp+1):ep,2),'int16'));
-    iq1_capture(:,i) = b((sp+1):ep,3) + 1i.*b((sp+1):ep,4);
+    iq1_capture(:,i) = double(typecast(b((sp+1):ep,3),'int16')) + 1i.*double(typecast(b((sp+1):ep,4),'int16'));
 end
 
 mat_filename = [iq_cap_filename(1:end-4) '_' num2str(iq_len) '.mat'];
 save(mat_filename, 'iq0_capture', 'iq1_capture');
 
-iq0_capture = iq0_capture(:);
+figure; plot(timestamp,'b+-'); title('time stamp (TSF value)'); ylabel('us'); xlabel('packet');  grid on;
-iq1_capture = iq1_capture(:);
-
-figure; plot(timestamp); title('time stamp (TSF value)'); ylabel('us'); xlabel('packet');  grid on;
 
 figure;
 subplot(2,1,1); 
-plot(real(iq0_capture)); hold on; plot(imag(iq0_capture),'r'); title('rx0 I (blue) Q (red) sample'); xlabel('sample'); ylabel('I/Q'); grid on;
+plot(real(iq0_capture(:))); hold on; plot(imag(iq0_capture(:)),'r'); title('rx0 I (blue) Q (red) sample'); xlabel('sample'); ylabel('I/Q'); grid on;
 subplot(2,1,2); 
-plot(real(iq1_capture)); hold on; plot(imag(iq1_capture),'r'); title('rx1 I (blue) Q (red) sample'); xlabel('sample'); ylabel('I/Q'); grid on;
+plot(real(iq1_capture(:))); hold on; plot(imag(iq1_capture(:)),'r'); title('rx1 I (blue) Q (red) sample'); xlabel('sample'); ylabel('I/Q'); grid on;
 
 figure;
-a = abs(iq0_capture);
+a = abs(iq0_capture(:));
-b = abs(iq1_capture);
+b = abs(iq1_capture(:));
 % a(a==0) = max(b);
 plot(a); hold on;
 plot(b,'r'); title('rx0 and rx1 abs'); xlabel('sample'); ylabel('abs'); grid on;
 legend('rx0','rx1');
 
-save_iq_complex_to_txt(iq0_capture, [mat_filename(1:end-4) '_iq0.txt']);
+save_iq_complex_to_txt(iq0_capture(:), [mat_filename(1:end-4) '_iq0.txt']);
-save_iq_complex_to_txt(iq1_capture, [mat_filename(1:end-4) '_iq1.txt']);
+save_iq_complex_to_txt(iq1_capture(:), [mat_filename(1:end-4) '_iq1.txt']);
+
+figure;
+subplot(2,1,1); 
+plot(real(iq0_capture(:,idx_to_check))); hold on; plot(imag(iq0_capture(:,idx_to_check)),'r'); title(['Capture idx ' num2str(idx_to_check) ' timestamp ' num2str(timestamp(idx_to_check))]); xlabel('sample'); ylabel('amplitude'); legend('I', 'Q'); grid on;
+subplot(2,1,2); 
+plot(real(iq1_capture(:,idx_to_check))); hold on; plot(imag(iq1_capture(:,idx_to_check)),'r'); title(['Capture idx ' num2str(idx_to_check) ' timestamp ' num2str(timestamp(idx_to_check))]); xlabel('sample'); ylabel('amplitude'); legend('I', 'Q'); grid on;
 
 function save_iq_complex_to_txt(iq, filename)
 fid = fopen(filename,'w');

user_space/side_ch_ctl_src/test_iq_file_display.m

@@ -3,15 +3,22 @@
 % clear all;
 % close all;
 
-function test_iq_file_display(varargin)
+function timestamp = test_iq_file_display(iq_len, iq_cap_filename, idx_to_check)
+close all;
 
-if nargin == 0
+if exist('iq_len', 'var')==0 || isempty(iq_len)
     iq_len = 8187;
-else
-    iq_len = varargin{1};
 end
 
-a = load('iq.txt');
+if exist('iq_cap_filename', 'var')==0 || isempty(iq_cap_filename)
+    iq_cap_filename = 'iq.txt';
+end
+
+if exist('idx_to_check', 'var')==0 || isempty(idx_to_check)
+    idx_to_check = 1;
+end
+
+a = load(iq_cap_filename);
 len_a = floor(length(a)/4)*4;
 a = a(1:len_a);
 
@@ -24,32 +31,37 @@ timestamp =    zeros(1, num_iq_capture);
 agc_gain =     zeros(iq_len, num_iq_capture);
 rssi_half_db = zeros(iq_len, num_iq_capture);
 
+b = uint16(b);
 for i=1:num_iq_capture
     sp = (i-1)*num_data_in_each_iq_capture + 1;
     ep = i*num_data_in_each_iq_capture;
-    timestamp(i) = b(sp,1) + (2^16)*b(sp,2) + (2^32)*b(sp,3) + (2^48)*b(sp,4);
+    timestamp(i) = double(b(sp,1)) + (2^16)*double(b(sp,2)) + (2^32)*double(b(sp,3)) + (2^48)*double(b(sp,4));
-    iq_capture(:,i) = b((sp+1):ep,1) + 1i.*b((sp+1):ep,2);
+    iq_capture(:,i) = double(typecast(b((sp+1):ep,1),'int16')) + 1i.*double(typecast(b((sp+1):ep,2),'int16'));
-    agc_gain(:,i) = b((sp+1):ep,3);
+    agc_gain(:,i) = double(b((sp+1):ep,3));
-    rssi_half_db(:,i) = b((sp+1):ep,4);
+    rssi_half_db(:,i) = double(b((sp+1):ep,4));
 end
 save(['iq_' num2str(iq_len) '.mat'], 'iq_capture');
 
-iq_capture = iq_capture(:);
-agc_gain = agc_gain(:);
-rssi_half_db = rssi_half_db(:);
-
 agc_gain_lock = zeros(iq_len*num_iq_capture,1);
-agc_gain_lock(agc_gain>127) = 1;
+agc_gain_lock(agc_gain(:)>127) = 1;
 
-agc_gain_value = agc_gain;
+agc_gain_value = agc_gain(:);
 agc_gain_value(agc_gain_value>127) = agc_gain_value(agc_gain_value>127) - 128;
 
-figure; plot(timestamp); title('time stamp (TSF value)'); ylabel('us'); xlabel('packet');  grid on;
+figure; plot(timestamp,'b+-'); title('time stamp (TSF value)'); ylabel('us'); xlabel('packet');  grid on;
-figure; plot(rssi_half_db); title('RSSI half dB (uncalibrated)'); xlabel('sample'); ylabel('dB'); grid on;
+figure; plot(rssi_half_db(:)); title('RSSI half dB (uncalibrated)'); xlabel('sample'); ylabel('dB'); grid on;
 
 figure;
-plot(real(iq_capture)); hold on; plot(imag(iq_capture),'r'); title('I (blue) Q (red) sample'); xlabel('sample'); ylabel('I/Q'); grid on;
+plot(real(iq_capture(:))); hold on; plot(imag(iq_capture(:)),'r'); title('I (blue) Q (red) sample'); xlabel('sample'); ylabel('I/Q'); grid on;
 
 figure; 
 subplot(2,1,1); plot(agc_gain_lock); title('AGC lock status from AD9361'); xlabel('sample'); ylabel('status'); grid on;
 subplot(2,1,2); plot(agc_gain_value); title('AGC gain from AD9361'); xlabel('sample'); ylabel('gain'); grid on;
+
+figure;
+agc_gain_value = reshape(agc_gain_value, [iq_len, num_iq_capture]);
+agc_gain_lock  = reshape(agc_gain_lock, [iq_len, num_iq_capture]);
+subplot(4,1,1); plot(real(iq_capture(:,idx_to_check))); hold on; plot(imag(iq_capture(:,idx_to_check)),'r'); title(['Capture idx ' num2str(idx_to_check) ' timestamp ' num2str(timestamp(idx_to_check))]); xlabel('sample'); ylabel('amplitude'); legend('I', 'Q'); grid on;
+subplot(4,1,2); plot(rssi_half_db(:,idx_to_check)); title('RSSI half dB (uncalibrated)'); xlabel('sample'); ylabel('dB'); grid on;
+subplot(4,1,3); plot(agc_gain_lock(:,idx_to_check)); title('AGC lock status from AD9361'); xlabel('sample'); ylabel('status'); grid on;
+subplot(4,1,4); plot(agc_gain_value(:,idx_to_check)); title('AGC gain from AD9361'); xlabel('sample'); ylabel('gain'); grid on;

user_space/side_ch_ctl_src/test_side_info_file_display.m

@@ -1,6 +1,6 @@
 % Xianjun Jiao. xianjun.jiao@imec.be; putaoshu@msn.com
 
-function test_side_info_file_display(num_eq, side_info_filename)
+function timestamp = test_side_info_file_display(num_eq, side_info_filename, idx_to_check)
 close all;
 
 if exist('num_eq', 'var')==0 || isempty(num_eq)
@@ -11,6 +11,10 @@ if exist('side_info_filename', 'var')==0 || isempty(side_info_filename)
     side_info_filename = 'side_info.txt';
 end
 
+if exist('idx_to_check', 'var')==0 || isempty(idx_to_check)
+    idx_to_check = 1;
+end
+
 a = load(side_info_filename);
 len_a = floor(length(a)/4)*4;
 a = a(1:len_a);
@@ -20,16 +24,18 @@ num_data_in_each_side_info = 2+56+num_eq*52;
 num_side_info = floor(size(b,1)/num_data_in_each_side_info);
 
 side_info = zeros(num_data_in_each_side_info, num_side_info);
-timestamp = zeros(1, num_side_info);
+timestamp = uint64(zeros(1, num_side_info));
 freq_offset = zeros(1, num_side_info);
 csi = zeros(56, num_side_info);
 equalizer = zeros(num_eq*52, num_side_info);
+
+b = uint16(b);
 for i=1:num_side_info
     sp = (i-1)*num_data_in_each_side_info + 1;
     ep = i*num_data_in_each_side_info;
-    timestamp(i) = b(sp,1) + (2^16)*b(sp,2) + (2^32)*b(sp,3) + (2^48)*b(sp,4);
+    timestamp(i) = uint64(b(sp,1)) + (2^16)*uint64(b(sp,2)) + (2^32)*uint64(b(sp,3)) + (2^48)*uint64(b(sp,4));
-    freq_offset(i) = (20e6*b(sp+1,1)/512)/(2*pi);
+    freq_offset(i) = (20e6*double(typecast(b(sp+1,1),'int16'))/512)/(2*pi);
-    side_info(:,i) = b(sp:ep,1) + 1i.*b(sp:ep,2);
+    side_info(:,i) = double(typecast(b(sp:ep,1),'int16')) + 1i.*double(typecast(b(sp:ep,2),'int16'));
     csi(:,i) = side_info(3:58,i);
     equalizer(:,i) = side_info(59:end,i);
 end
@@ -45,5 +51,9 @@ if ~isempty(equalizer)
     scatterplot(equalizer); grid on;
 end
 
-figure; plot(timestamp); title('time stamp (TSF value)'); ylabel('us'); xlabel('packet');  grid on;
+figure; plot(timestamp,'b+-'); title('time stamp (TSF value)'); ylabel('us'); xlabel('packet');  grid on;
 figure; plot(freq_offset); title('freq offset (Hz)'); ylabel('Hz'); xlabel('packet'); grid on;
+
+figure;
+subplot(2,1,1); plot(abs(csi(:,idx_to_check))); title('CSI'); ylabel('abs'); grid on; title(['Capture idx ' num2str(idx_to_check) ' timestamp ' num2str(timestamp(idx_to_check))]);
+subplot(2,1,2); plot(angle(csi(:,idx_to_check))); ylabel('phase'); xlabel('subcarrier'); grid on;

user_space/transfer_kernel_image_module_to_board.sh

@@ -22,7 +22,7 @@ fi
 DIR_TO_ADI_LINUX_KERNEL=$1
 BOARD_NAME=$2
 
-if [ "$BOARD_NAME" != "antsdr" ] && [ "$BOARD_NAME" != "antsdr_e200" ] && [ "$BOARD_NAME" != "sdrpi" ] && [ "$BOARD_NAME" != "neptunesdr" ] && [ "$BOARD_NAME" != "zc706_fmcs2" ] && [ "$BOARD_NAME" != "zc702_fmcs2" ] && [ "$BOARD_NAME" != "zed_fmcs2" ] && [ "$BOARD_NAME" != "adrv9361z7035" ] && [ "$BOARD_NAME" != "adrv9364z7020" ] && [ "$BOARD_NAME" != "zcu102_fmcs2" ]; then
+if [ "$BOARD_NAME" != "antsdr" ] && [ "$BOARD_NAME" != "antsdr_e200" ] && [ "$BOARD_NAME" != "e310v2" ] && [ "$BOARD_NAME" != "sdrpi" ] && [ "$BOARD_NAME" != "neptunesdr" ] && [ "$BOARD_NAME" != "zc706_fmcs2" ] && [ "$BOARD_NAME" != "zc702_fmcs2" ] && [ "$BOARD_NAME" != "zed_fmcs2" ] && [ "$BOARD_NAME" != "adrv9361z7035" ] && [ "$BOARD_NAME" != "adrv9364z7020" ] && [ "$BOARD_NAME" != "zcu102_fmcs2" ]; then
     echo "\$BOARD_NAME is not correct. Please check!"
     exit 1
 else
@@ -31,8 +31,10 @@ fi
 
 if [ "$BOARD_NAME" == "zcu102_fmcs2" ] || [ "$BOARD_NAME" == "zcu102_9371" ]; then
     LINUX_KERNEL_IMAGE=$DIR_TO_ADI_LINUX_KERNEL/arch/arm64/boot/Image
+    DTB_FILENAME="system.dtb"
 else
     LINUX_KERNEL_IMAGE=$DIR_TO_ADI_LINUX_KERNEL/arch/arm/boot/uImage
+    DTB_FILENAME="devicetree.dtb"
 fi
 
 mkdir -p kernel_modules
@@ -51,6 +53,9 @@ fi
 if test -f "../kernel_boot/boards/$BOARD_NAME/output_boot_bin/BOOT.BIN"; then
     cp ../kernel_boot/boards/$BOARD_NAME/output_boot_bin/BOOT.BIN ./kernel_modules/
 fi
+if test -f "../kernel_boot/boards/$BOARD_NAME/$DTB_FILENAME"; then
+    cp ../kernel_boot/boards/$BOARD_NAME/$DTB_FILENAME ./kernel_modules/
+fi
 tar -zcvf kernel_modules.tar.gz kernel_modules
 
 scp kernel_modules.tar.gz root@192.168.10.122:

user_space/update_sdcard.sh

@@ -16,7 +16,7 @@ fi
 SKIP_KERNEL_BUILD=0
 SKIP_BOOT=0
 SKIP_rootfs=0
-if [ "$#" -eq 4 ]; then
+if [ "$#" -gt 3 ]; then
     SKIP_KERNEL_BUILD=$(( ($4 >> 0) & 1 ))
     SKIP_BOOT=$(( ($4 >> 1) & 1 ))
     SKIP_rootfs=$(( ($4 >> 2) & 1 ))
@@ -26,6 +26,12 @@ if [ "$#" -eq 4 ]; then
     echo SKIP_rootfs $SKIP_rootfs
 fi
 
+BOARD_NAME_ALL="sdrpi antsdr antsdr_e200 e310v2 zc706_fmcs2 zed_fmcs2 zc702_fmcs2 adrv9361z7035 adrv9364z7020 zcu102_fmcs2 neptunesdr"
+if [ "$#" -gt 4 ]; then
+    BOARD_NAME_ALL=$5
+    echo BOARD_NAME_ALL $BOARD_NAME_ALL
+fi
+
 OPENWIFI_HW_IMG_DIR=$1
 XILINX_DIR=$2
 SDCARD_DIR=$3
@@ -95,7 +101,6 @@ fi
 if [ "$SKIP_BOOT" == "0" ]; then
   sudo rm -rf $SDCARD_DIR/BOOT/openwifi/
   sudo mkdir -p $SDCARD_DIR/BOOT/openwifi
-  BOARD_NAME_ALL="sdrpi antsdr antsdr_e200 zc706_fmcs2 zed_fmcs2 zc702_fmcs2 adrv9361z7035 adrv9364z7020 zcu102_fmcs2 neptunesdr"
   for BOARD_NAME_TMP in $BOARD_NAME_ALL
   do
       if [ "$BOARD_NAME_TMP" == "zcu102_fmcs2" ] || [ "$BOARD_NAME_TMP" == "zcu102_9371" ]; then
@@ -114,6 +119,7 @@ if [ "$SKIP_BOOT" == "0" ]; then
       sudo mkdir -p $SDCARD_DIR/BOOT/openwifi/$BOARD_NAME_TMP
       sudo cp $OPENWIFI_DIR/kernel_boot/boards/$BOARD_NAME_TMP/$dtb_filename_tmp $SDCARD_DIR/BOOT/openwifi/$BOARD_NAME_TMP/
       sudo cp $OPENWIFI_DIR/kernel_boot/boards/$BOARD_NAME_TMP/output_boot_bin/BOOT.BIN $SDCARD_DIR/BOOT/openwifi/$BOARD_NAME_TMP/
+      sudo cp ./system_top.bit.bin $SDCARD_DIR/BOOT/openwifi/$BOARD_NAME_TMP/
       sudo true
   done
 
@@ -133,7 +139,11 @@ if [ "$SKIP_rootfs" == "0" ]; then
   cd $saved_dir
   sudo cp $OPENWIFI_DIR/user_space/* $SDCARD_DIR/rootfs/root/openwifi/ -rf
   sudo mv $SDCARD_DIR/rootfs/root/openwifi/system_top.bit.bin $SDCARD_DIR/rootfs/root/openwifi/system_top.bit.bin.bak
-  sudo wget -P $SDCARD_DIR/rootfs/root/openwifi/webserver/ https://users.ugent.be/~xjiao/openwifi-low-aac.mp4
+  sudo wget -P $SDCARD_DIR/rootfs/root/openwifi/webserver/ https://github.com/open-sdr/openwifi-hw-img/raw/master/openwifi-low-aac.mp4
+
+  sudo rm -rf $SDCARD_DIR/rootfs/root/openwifi_BOOT/
+  sudo mkdir -p $SDCARD_DIR/rootfs/root/openwifi_BOOT
+  sudo cp $SDCARD_DIR/BOOT/openwifi/* $SDCARD_DIR/rootfs/root/openwifi_BOOT/ -rf
 
   ARCH_OPTION_ALL="32 64"
   for ARCH_OPTION_TMP in $ARCH_OPTION_ALL
@@ -184,5 +194,5 @@ sync
 
 cd $home_dir
 
-umount $SDCARD_DIR/BOOT/
+sudo umount $SDCARD_DIR/BOOT/
-umount $SDCARD_DIR/rootfs/
+sudo umount $SDCARD_DIR/rootfs/

user_space/wgd.sh

@@ -149,7 +149,7 @@ if [ -f "$TARGET_DIR/system_top.bit.bin" ]; then
   ./load_fpga_img.sh $TARGET_DIR/system_top.bit.bin
 else
   echo $TARGET_DIR/system_top.bit.bin not found. Skip reloading FPGA.
-  ./load_fpga_img.sh fjdo349ujtrueugjhj
+  # ./load_fpga_img.sh fjdo349ujtrueugjhj
 fi
 
 ./rf_init_11n.sh