cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

dfs.c (10344B)


      1/*
      2 * Copyright (c) 2008-2011 Atheros Communications Inc.
      3 * Copyright (c) 2011 Neratec Solutions AG
      4 *
      5 * Permission to use, copy, modify, and/or distribute this software for any
      6 * purpose with or without fee is hereby granted, provided that the above
      7 * copyright notice and this permission notice appear in all copies.
      8 *
      9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
     10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
     11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
     12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
     13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
     14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
     15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
     16 */
     17
     18#include "hw.h"
     19#include "hw-ops.h"
     20#include "ath9k.h"
     21#include "dfs.h"
     22#include "dfs_debug.h"
     23
     24/* internal struct to pass radar data */
     25struct ath_radar_data {
     26	u8 pulse_bw_info;
     27	u8 rssi;
     28	u8 ext_rssi;
     29	u8 pulse_length_ext;
     30	u8 pulse_length_pri;
     31};
     32
     33/**** begin: CHIRP ************************************************************/
     34
     35/* min and max gradients for defined FCC chirping pulses, given by
     36 * - 20MHz chirp width over a pulse width of  50us
     37 * -  5MHz chirp width over a pulse width of 100us
     38 */
     39static const int BIN_DELTA_MIN		= 1;
     40static const int BIN_DELTA_MAX		= 10;
     41
     42/* we need at least 3 deltas / 4 samples for a reliable chirp detection */
     43#define NUM_DIFFS 3
     44#define FFT_NUM_SAMPLES		(NUM_DIFFS + 1)
     45
     46/* Threshold for difference of delta peaks */
     47static const int MAX_DIFF		= 2;
     48
     49/* width range to be checked for chirping */
     50static const int MIN_CHIRP_PULSE_WIDTH	= 20;
     51static const int MAX_CHIRP_PULSE_WIDTH	= 110;
     52
     53struct ath9k_dfs_fft_20 {
     54	u8 bin[28];
     55	u8 lower_bins[3];
     56} __packed;
     57struct ath9k_dfs_fft_40 {
     58	u8 bin[64];
     59	u8 lower_bins[3];
     60	u8 upper_bins[3];
     61} __packed;
     62
     63static inline int fft_max_index(u8 *bins)
     64{
     65	return (bins[2] & 0xfc) >> 2;
     66}
     67static inline int fft_max_magnitude(u8 *bins)
     68{
     69	return (bins[0] & 0xc0) >> 6 | bins[1] << 2 | (bins[2] & 0x03) << 10;
     70}
     71static inline u8 fft_bitmap_weight(u8 *bins)
     72{
     73	return bins[0] & 0x3f;
     74}
     75
     76static int ath9k_get_max_index_ht40(struct ath9k_dfs_fft_40 *fft,
     77				    bool is_ctl, bool is_ext)
     78{
     79	const int DFS_UPPER_BIN_OFFSET = 64;
     80	/* if detected radar on both channels, select the significant one */
     81	if (is_ctl && is_ext) {
     82		/* first check wether channels have 'strong' bins */
     83		is_ctl = fft_bitmap_weight(fft->lower_bins) != 0;
     84		is_ext = fft_bitmap_weight(fft->upper_bins) != 0;
     85
     86		/* if still unclear, take higher magnitude */
     87		if (is_ctl && is_ext) {
     88			int mag_lower = fft_max_magnitude(fft->lower_bins);
     89			int mag_upper = fft_max_magnitude(fft->upper_bins);
     90			if (mag_upper > mag_lower)
     91				is_ctl = false;
     92			else
     93				is_ext = false;
     94		}
     95	}
     96	if (is_ctl)
     97		return fft_max_index(fft->lower_bins);
     98	return fft_max_index(fft->upper_bins) + DFS_UPPER_BIN_OFFSET;
     99}
    100static bool ath9k_check_chirping(struct ath_softc *sc, u8 *data,
    101				 int datalen, bool is_ctl, bool is_ext)
    102{
    103	int i;
    104	int max_bin[FFT_NUM_SAMPLES];
    105	struct ath_hw *ah = sc->sc_ah;
    106	struct ath_common *common = ath9k_hw_common(ah);
    107	int prev_delta;
    108
    109	if (IS_CHAN_HT40(ah->curchan)) {
    110		struct ath9k_dfs_fft_40 *fft = (struct ath9k_dfs_fft_40 *) data;
    111		int num_fft_packets = datalen / sizeof(*fft);
    112		if (num_fft_packets == 0)
    113			return false;
    114
    115		ath_dbg(common, DFS, "HT40: datalen=%d, num_fft_packets=%d\n",
    116			datalen, num_fft_packets);
    117		if (num_fft_packets < FFT_NUM_SAMPLES) {
    118			ath_dbg(common, DFS, "not enough packets for chirp\n");
    119			return false;
    120		}
    121		/* HW sometimes adds 2 garbage bytes in front of FFT samples */
    122		if ((datalen % sizeof(*fft)) == 2) {
    123			fft = (struct ath9k_dfs_fft_40 *) (data + 2);
    124			ath_dbg(common, DFS, "fixing datalen by 2\n");
    125		}
    126		if (IS_CHAN_HT40MINUS(ah->curchan))
    127			swap(is_ctl, is_ext);
    128
    129		for (i = 0; i < FFT_NUM_SAMPLES; i++)
    130			max_bin[i] = ath9k_get_max_index_ht40(fft + i, is_ctl,
    131							      is_ext);
    132	} else {
    133		struct ath9k_dfs_fft_20 *fft = (struct ath9k_dfs_fft_20 *) data;
    134		int num_fft_packets = datalen / sizeof(*fft);
    135		if (num_fft_packets == 0)
    136			return false;
    137		ath_dbg(common, DFS, "HT20: datalen=%d, num_fft_packets=%d\n",
    138			datalen, num_fft_packets);
    139		if (num_fft_packets < FFT_NUM_SAMPLES) {
    140			ath_dbg(common, DFS, "not enough packets for chirp\n");
    141			return false;
    142		}
    143		/* in ht20, this is a 6-bit signed number => shift it to 0 */
    144		for (i = 0; i < FFT_NUM_SAMPLES; i++)
    145			max_bin[i] = fft_max_index(fft[i].lower_bins) ^ 0x20;
    146	}
    147	ath_dbg(common, DFS, "bin_max = [%d, %d, %d, %d]\n",
    148		max_bin[0], max_bin[1], max_bin[2], max_bin[3]);
    149
    150	/* Check for chirp attributes within specs
    151	 * a) delta of adjacent max_bins is within range
    152	 * b) delta of adjacent deltas are within tolerance
    153	 */
    154	prev_delta = 0;
    155	for (i = 0; i < NUM_DIFFS; i++) {
    156		int ddelta = -1;
    157		int delta = max_bin[i + 1] - max_bin[i];
    158
    159		/* ensure gradient is within valid range */
    160		if (abs(delta) < BIN_DELTA_MIN || abs(delta) > BIN_DELTA_MAX) {
    161			ath_dbg(common, DFS, "CHIRP: invalid delta %d "
    162				"in sample %d\n", delta, i);
    163			return false;
    164		}
    165		if (i == 0)
    166			goto done;
    167		ddelta = delta - prev_delta;
    168		if (abs(ddelta) > MAX_DIFF) {
    169			ath_dbg(common, DFS, "CHIRP: ddelta %d too high\n",
    170				ddelta);
    171			return false;
    172		}
    173done:
    174		ath_dbg(common, DFS, "CHIRP - %d: delta=%d, ddelta=%d\n",
    175			i, delta, ddelta);
    176		prev_delta = delta;
    177	}
    178	return true;
    179}
    180/**** end: CHIRP **************************************************************/
    181
    182/* convert pulse duration to usecs, considering clock mode */
    183static u32 dur_to_usecs(struct ath_hw *ah, u32 dur)
    184{
    185	const u32 AR93X_NSECS_PER_DUR = 800;
    186	const u32 AR93X_NSECS_PER_DUR_FAST = (8000 / 11);
    187	u32 nsecs;
    188
    189	if (IS_CHAN_A_FAST_CLOCK(ah, ah->curchan))
    190		nsecs = dur * AR93X_NSECS_PER_DUR_FAST;
    191	else
    192		nsecs = dur * AR93X_NSECS_PER_DUR;
    193
    194	return (nsecs + 500) / 1000;
    195}
    196
    197#define PRI_CH_RADAR_FOUND 0x01
    198#define EXT_CH_RADAR_FOUND 0x02
    199static bool
    200ath9k_postprocess_radar_event(struct ath_softc *sc,
    201			      struct ath_radar_data *ard,
    202			      struct pulse_event *pe)
    203{
    204	u8 rssi;
    205	u16 dur;
    206
    207	/*
    208	 * Only the last 2 bits of the BW info are relevant, they indicate
    209	 * which channel the radar was detected in.
    210	 */
    211	ard->pulse_bw_info &= 0x03;
    212
    213	switch (ard->pulse_bw_info) {
    214	case PRI_CH_RADAR_FOUND:
    215		/* radar in ctrl channel */
    216		dur = ard->pulse_length_pri;
    217		DFS_STAT_INC(sc, pri_phy_errors);
    218		/*
    219		 * cannot use ctrl channel RSSI
    220		 * if extension channel is stronger
    221		 */
    222		rssi = (ard->ext_rssi >= (ard->rssi + 3)) ? 0 : ard->rssi;
    223		break;
    224	case EXT_CH_RADAR_FOUND:
    225		/* radar in extension channel */
    226		dur = ard->pulse_length_ext;
    227		DFS_STAT_INC(sc, ext_phy_errors);
    228		/*
    229		 * cannot use extension channel RSSI
    230		 * if control channel is stronger
    231		 */
    232		rssi = (ard->rssi >= (ard->ext_rssi + 12)) ? 0 : ard->ext_rssi;
    233		break;
    234	case (PRI_CH_RADAR_FOUND | EXT_CH_RADAR_FOUND):
    235		/*
    236		 * Conducted testing, when pulse is on DC, both pri and ext
    237		 * durations are reported to be same
    238		 *
    239		 * Radiated testing, when pulse is on DC, different pri and
    240		 * ext durations are reported, so take the larger of the two
    241		 */
    242		if (ard->pulse_length_ext >= ard->pulse_length_pri)
    243			dur = ard->pulse_length_ext;
    244		else
    245			dur = ard->pulse_length_pri;
    246		DFS_STAT_INC(sc, dc_phy_errors);
    247
    248		/* when both are present use stronger one */
    249		rssi = (ard->rssi < ard->ext_rssi) ? ard->ext_rssi : ard->rssi;
    250		break;
    251	default:
    252		/*
    253		 * Bogus bandwidth info was received in descriptor,
    254		 * so ignore this PHY error
    255		 */
    256		DFS_STAT_INC(sc, bwinfo_discards);
    257		return false;
    258	}
    259
    260	if (rssi == 0) {
    261		DFS_STAT_INC(sc, rssi_discards);
    262		return false;
    263	}
    264
    265	/* convert duration to usecs */
    266	pe->width = dur_to_usecs(sc->sc_ah, dur);
    267	pe->rssi = rssi;
    268
    269	DFS_STAT_INC(sc, pulses_detected);
    270	return true;
    271}
    272
    273static void
    274ath9k_dfs_process_radar_pulse(struct ath_softc *sc, struct pulse_event *pe)
    275{
    276	struct dfs_pattern_detector *pd = sc->dfs_detector;
    277	DFS_STAT_INC(sc, pulses_processed);
    278	if (pd == NULL)
    279		return;
    280	if (!pd->add_pulse(pd, pe, NULL))
    281		return;
    282	DFS_STAT_INC(sc, radar_detected);
    283	ieee80211_radar_detected(sc->hw);
    284}
    285
    286/*
    287 * DFS: check PHY-error for radar pulse and feed the detector
    288 */
    289void ath9k_dfs_process_phyerr(struct ath_softc *sc, void *data,
    290			      struct ath_rx_status *rs, u64 mactime)
    291{
    292	struct ath_radar_data ard;
    293	u16 datalen;
    294	char *vdata_end;
    295	struct pulse_event pe;
    296	struct ath_hw *ah = sc->sc_ah;
    297	struct ath_common *common = ath9k_hw_common(ah);
    298
    299	DFS_STAT_INC(sc, pulses_total);
    300	if ((rs->rs_phyerr != ATH9K_PHYERR_RADAR) &&
    301	    (rs->rs_phyerr != ATH9K_PHYERR_FALSE_RADAR_EXT)) {
    302		ath_dbg(common, DFS,
    303			"Error: rs_phyer=0x%x not a radar error\n",
    304			rs->rs_phyerr);
    305		DFS_STAT_INC(sc, pulses_no_dfs);
    306		return;
    307	}
    308
    309	datalen = rs->rs_datalen;
    310	if (datalen == 0) {
    311		DFS_STAT_INC(sc, datalen_discards);
    312		return;
    313	}
    314
    315	ard.rssi = rs->rs_rssi_ctl[0];
    316	ard.ext_rssi = rs->rs_rssi_ext[0];
    317
    318	/*
    319	 * hardware stores this as 8 bit signed value.
    320	 * we will cap it at 0 if it is a negative number
    321	 */
    322	if (ard.rssi & 0x80)
    323		ard.rssi = 0;
    324	if (ard.ext_rssi & 0x80)
    325		ard.ext_rssi = 0;
    326
    327	vdata_end = data + datalen;
    328	ard.pulse_bw_info = vdata_end[-1];
    329	ard.pulse_length_ext = vdata_end[-2];
    330	ard.pulse_length_pri = vdata_end[-3];
    331	pe.freq = ah->curchan->channel;
    332	pe.ts = mactime;
    333	if (!ath9k_postprocess_radar_event(sc, &ard, &pe))
    334		return;
    335
    336	if (pe.width > MIN_CHIRP_PULSE_WIDTH &&
    337	    pe.width < MAX_CHIRP_PULSE_WIDTH) {
    338		bool is_ctl = !!(ard.pulse_bw_info & PRI_CH_RADAR_FOUND);
    339		bool is_ext = !!(ard.pulse_bw_info & EXT_CH_RADAR_FOUND);
    340		int clen = datalen - 3;
    341		pe.chirp = ath9k_check_chirping(sc, data, clen, is_ctl, is_ext);
    342	} else {
    343		pe.chirp = false;
    344	}
    345
    346	ath_dbg(common, DFS,
    347		"ath9k_dfs_process_phyerr: type=%d, freq=%d, ts=%llu, "
    348		"width=%d, rssi=%d, delta_ts=%llu\n",
    349		ard.pulse_bw_info, pe.freq, pe.ts, pe.width, pe.rssi,
    350		pe.ts - sc->dfs_prev_pulse_ts);
    351	sc->dfs_prev_pulse_ts = pe.ts;
    352	if (ard.pulse_bw_info & PRI_CH_RADAR_FOUND)
    353		ath9k_dfs_process_radar_pulse(sc, &pe);
    354	if (IS_CHAN_HT40(ah->curchan) &&
    355	    ard.pulse_bw_info & EXT_CH_RADAR_FOUND) {
    356		pe.freq += IS_CHAN_HT40PLUS(ah->curchan) ? 20 : -20;
    357		ath9k_dfs_process_radar_pulse(sc, &pe);
    358	}
    359}
    360#undef PRI_CH_RADAR_FOUND
    361#undef EXT_CH_RADAR_FOUND