• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Fundamental types and constants relating to 802.11
3  *
4  * Copyright (C) 1999-2017, Broadcom Corporation
5  *
6  *      Unless you and Broadcom execute a separate written software license
7  * agreement governing use of this software, this software is licensed to you
8  * under the terms of the GNU General Public License version 2 (the "GPL"),
9  * available at http://www.broadcom.com/licenses/GPLv2.php, with the
10  * following added to such license:
11  *
12  *      As a special exception, the copyright holders of this software give you
13  * permission to link this software with independent modules, and to copy and
14  * distribute the resulting executable under terms of your choice, provided that
15  * you also meet, for each linked independent module, the terms and conditions of
16  * the license of that module.  An independent module is a module which is not
17  * derived from this software.  The special exception does not apply to any
18  * modifications of the software.
19  *
20  *      Notwithstanding the above, under no circumstances may you combine this
21  * software in any way with any other Broadcom software provided under a license
22  * other than the GPL, without Broadcom's express prior written consent.
23  *
24  *
25  * <<Broadcom-WL-IPTag/Open:>>
26  *
27  * $Id: 802.11.h 700693 2017-05-20 20:29:07Z $
28  */
29 
30 #ifndef _802_11_H_
31 #define _802_11_H_
32 
33 #ifndef _TYPEDEFS_H_
34 #include <typedefs.h>
35 #endif
36 
37 #ifndef _NET_ETHERNET_H_
38 #include <ethernet.h>
39 #endif
40 
41 #include <wpa.h>
42 
43 /* This marks the start of a packed structure section. */
44 #include <packed_section_start.h>
45 
46 
47 #define DOT11_TU_TO_US            1024    /* 802.11 Time Unit is 1024 microseconds */
48 
49 /* Generic 802.11 frame constants */
50 #define DOT11_A3_HDR_LEN        24    /* d11 header length with A3 */
51 #define DOT11_A4_HDR_LEN        30    /* d11 header length with A4 */
52 #define DOT11_MAC_HDR_LEN        DOT11_A3_HDR_LEN    /* MAC header length */
53 #define DOT11_FCS_LEN            4    /* d11 FCS length */
54 #define DOT11_ICV_LEN            4    /* d11 ICV length */
55 #define DOT11_ICV_AES_LEN        8    /* d11 ICV/AES length */
56 #define DOT11_QOS_LEN            2    /* d11 QoS length */
57 #define DOT11_HTC_LEN            4    /* d11 HT Control field length */
58 
59 #define DOT11_KEY_INDEX_SHIFT        6    /* d11 key index shift */
60 #define DOT11_IV_LEN            4    /* d11 IV length */
61 #define DOT11_IV_TKIP_LEN        8    /* d11 IV TKIP length */
62 #define DOT11_IV_AES_OCB_LEN        4    /* d11 IV/AES/OCB length */
63 #define DOT11_IV_AES_CCM_LEN        8    /* d11 IV/AES/CCM length */
64 #define DOT11_IV_MAX_LEN        8    /* maximum iv len for any encryption */
65 
66 /* Includes MIC */
67 #define DOT11_MAX_MPDU_BODY_LEN        2304    /* max MPDU body length */
68 /* A4 header + QoS + CCMP + PDU + ICV + FCS = 2352 */
69 #define DOT11_MAX_MPDU_LEN        (DOT11_A4_HDR_LEN + \
70                      DOT11_QOS_LEN + \
71                      DOT11_IV_AES_CCM_LEN + \
72                      DOT11_MAX_MPDU_BODY_LEN + \
73                      DOT11_ICV_LEN + \
74                      DOT11_FCS_LEN)    /* d11 max MPDU length */
75 
76 #define DOT11_MAX_SSID_LEN        32    /* d11 max ssid length */
77 
78 /* dot11RTSThreshold */
79 #define DOT11_DEFAULT_RTS_LEN        2347    /* d11 default RTS length */
80 #define DOT11_MAX_RTS_LEN        2347    /* d11 max RTS length */
81 
82 /* dot11FragmentationThreshold */
83 #define DOT11_MIN_FRAG_LEN        256    /* d11 min fragmentation length */
84 #define DOT11_MAX_FRAG_LEN        2346    /* Max frag is also limited by aMPDUMaxLength
85                         * of the attached PHY
86                         */
87 #define DOT11_DEFAULT_FRAG_LEN        2346    /* d11 default fragmentation length */
88 
89 /* dot11BeaconPeriod */
90 #define DOT11_MIN_BEACON_PERIOD        1    /* d11 min beacon period */
91 #define DOT11_MAX_BEACON_PERIOD        0xFFFF    /* d11 max beacon period */
92 
93 /* dot11DTIMPeriod */
94 #define DOT11_MIN_DTIM_PERIOD        1    /* d11 min DTIM period */
95 #define DOT11_MAX_DTIM_PERIOD        0xFF    /* d11 max DTIM period */
96 
97 /** 802.2 LLC/SNAP header used by 802.11 per 802.1H */
98 #define DOT11_LLC_SNAP_HDR_LEN        8    /* d11 LLC/SNAP header length */
99 /* minimum LLC header length; DSAP, SSAP, 8 bit Control (unnumbered) */
100 #define DOT11_LLC_HDR_LEN_MIN        3
101 #define DOT11_OUI_LEN            3    /* d11 OUI length */
102 BWL_PRE_PACKED_STRUCT struct dot11_llc_snap_header {
103     uint8    dsap;                /* always 0xAA */
104     uint8    ssap;                /* always 0xAA */
105     uint8    ctl;                /* always 0x03 */
106     uint8    oui[DOT11_OUI_LEN];        /* RFC1042: 0x00 0x00 0x00
107                          * Bridge-Tunnel: 0x00 0x00 0xF8
108                          */
109     uint16    type;                /* ethertype */
110 } BWL_POST_PACKED_STRUCT;
111 
112 /* RFC1042 header used by 802.11 per 802.1H */
113 #define RFC1042_HDR_LEN    (ETHER_HDR_LEN + DOT11_LLC_SNAP_HDR_LEN)    /* RCF1042 header length */
114 
115 /* Generic 802.11 MAC header */
116 /**
117  * N.B.: This struct reflects the full 4 address 802.11 MAC header.
118  *         The fields are defined such that the shorter 1, 2, and 3
119  *         address headers just use the first k fields.
120  */
121 BWL_PRE_PACKED_STRUCT struct dot11_header {
122     uint16            fc;        /* frame control */
123     uint16            durid;        /* duration/ID */
124     struct ether_addr    a1;        /* address 1 */
125     struct ether_addr    a2;        /* address 2 */
126     struct ether_addr    a3;        /* address 3 */
127     uint16            seq;        /* sequence control */
128     struct ether_addr    a4;        /* address 4 */
129 } BWL_POST_PACKED_STRUCT;
130 
131 /* Control frames */
132 
133 BWL_PRE_PACKED_STRUCT struct dot11_rts_frame {
134     uint16            fc;        /* frame control */
135     uint16            durid;        /* duration/ID */
136     struct ether_addr    ra;        /* receiver address */
137     struct ether_addr    ta;        /* transmitter address */
138 } BWL_POST_PACKED_STRUCT;
139 #define    DOT11_RTS_LEN        16        /* d11 RTS frame length */
140 
141 BWL_PRE_PACKED_STRUCT struct dot11_cts_frame {
142     uint16            fc;        /* frame control */
143     uint16            durid;        /* duration/ID */
144     struct ether_addr    ra;        /* receiver address */
145 } BWL_POST_PACKED_STRUCT;
146 #define    DOT11_CTS_LEN        10        /* d11 CTS frame length */
147 
148 BWL_PRE_PACKED_STRUCT struct dot11_ack_frame {
149     uint16            fc;        /* frame control */
150     uint16            durid;        /* duration/ID */
151     struct ether_addr    ra;        /* receiver address */
152 } BWL_POST_PACKED_STRUCT;
153 #define    DOT11_ACK_LEN        10        /* d11 ACK frame length */
154 
155 BWL_PRE_PACKED_STRUCT struct dot11_ps_poll_frame {
156     uint16            fc;        /* frame control */
157     uint16            durid;        /* AID */
158     struct ether_addr    bssid;        /* receiver address, STA in AP */
159     struct ether_addr    ta;        /* transmitter address */
160 } BWL_POST_PACKED_STRUCT;
161 #define    DOT11_PS_POLL_LEN    16        /* d11 PS poll frame length */
162 
163 BWL_PRE_PACKED_STRUCT struct dot11_cf_end_frame {
164     uint16            fc;        /* frame control */
165     uint16            durid;        /* duration/ID */
166     struct ether_addr    ra;        /* receiver address */
167     struct ether_addr    bssid;        /* transmitter address, STA in AP */
168 } BWL_POST_PACKED_STRUCT;
169 #define    DOT11_CS_END_LEN    16        /* d11 CF-END frame length */
170 
171 /**
172  * RWL wifi protocol: The Vendor Specific Action frame is defined for vendor-specific signaling
173  *  category+OUI+vendor specific content ( this can be variable)
174  */
175 BWL_PRE_PACKED_STRUCT struct dot11_action_wifi_vendor_specific {
176     uint8    category;
177     uint8    OUI[3];
178     uint8    type;
179     uint8    subtype;
180     uint8    data[1040];
181 } BWL_POST_PACKED_STRUCT;
182 typedef struct dot11_action_wifi_vendor_specific dot11_action_wifi_vendor_specific_t;
183 
184 /** generic vendor specific action frame with variable length */
185 BWL_PRE_PACKED_STRUCT struct dot11_action_vs_frmhdr {
186     uint8    category;
187     uint8    OUI[3];
188     uint8    type;
189     uint8    subtype;
190     uint8    data[1];
191 } BWL_POST_PACKED_STRUCT;
192 typedef struct dot11_action_vs_frmhdr dot11_action_vs_frmhdr_t;
193 
194 #define DOT11_ACTION_VS_HDR_LEN    6
195 
196 #define BCM_ACTION_OUI_BYTE0    0x00
197 #define BCM_ACTION_OUI_BYTE1    0x90
198 #define BCM_ACTION_OUI_BYTE2    0x4c
199 
200 /* BA/BAR Control parameters */
201 #define DOT11_BA_CTL_POLICY_NORMAL    0x0000    /* normal ack */
202 #define DOT11_BA_CTL_POLICY_NOACK    0x0001    /* no ack */
203 #define DOT11_BA_CTL_POLICY_MASK    0x0001    /* ack policy mask */
204 
205 #define DOT11_BA_CTL_MTID        0x0002    /* multi tid BA */
206 #define DOT11_BA_CTL_COMPRESSED        0x0004    /* compressed bitmap */
207 
208 #define DOT11_BA_CTL_NUMMSDU_MASK    0x0FC0    /* num msdu in bitmap mask */
209 #define DOT11_BA_CTL_NUMMSDU_SHIFT    6    /* num msdu in bitmap shift */
210 
211 #define DOT11_BA_CTL_TID_MASK        0xF000    /* tid mask */
212 #define DOT11_BA_CTL_TID_SHIFT        12    /* tid shift */
213 
214 /** control frame header (BA/BAR) */
215 BWL_PRE_PACKED_STRUCT struct dot11_ctl_header {
216     uint16            fc;        /* frame control */
217     uint16            durid;        /* duration/ID */
218     struct ether_addr    ra;        /* receiver address */
219     struct ether_addr    ta;        /* transmitter address */
220 } BWL_POST_PACKED_STRUCT;
221 #define DOT11_CTL_HDR_LEN    16        /* control frame hdr len */
222 
223 /** BAR frame payload */
224 BWL_PRE_PACKED_STRUCT struct dot11_bar {
225     uint16            bar_control;    /* BAR Control */
226     uint16            seqnum;        /* Starting Sequence control */
227 } BWL_POST_PACKED_STRUCT;
228 #define DOT11_BAR_LEN        4        /* BAR frame payload length */
229 
230 #define DOT11_BA_BITMAP_LEN    128        /* bitmap length */
231 #define DOT11_BA_CMP_BITMAP_LEN    8        /* compressed bitmap length */
232 /** BA frame payload */
233 BWL_PRE_PACKED_STRUCT struct dot11_ba {
234     uint16            ba_control;    /* BA Control */
235     uint16            seqnum;        /* Starting Sequence control */
236     uint8            bitmap[DOT11_BA_BITMAP_LEN];    /* Block Ack Bitmap */
237 } BWL_POST_PACKED_STRUCT;
238 #define DOT11_BA_LEN        4        /* BA frame payload len (wo bitmap) */
239 
240 /** Management frame header */
241 BWL_PRE_PACKED_STRUCT struct dot11_management_header {
242     uint16            fc;        /* frame control */
243     uint16            durid;        /* duration/ID */
244     struct ether_addr    da;        /* receiver address */
245     struct ether_addr    sa;        /* transmitter address */
246     struct ether_addr    bssid;        /* BSS ID */
247     uint16            seq;        /* sequence control */
248 } BWL_POST_PACKED_STRUCT;
249 typedef struct dot11_management_header dot11_management_header_t;
250 #define    DOT11_MGMT_HDR_LEN    24        /* d11 management header length */
251 
252 /* Management frame payloads */
253 
254 BWL_PRE_PACKED_STRUCT struct dot11_bcn_prb {
255     uint32            timestamp[2];
256     uint16            beacon_interval;
257     uint16            capability;
258 } BWL_POST_PACKED_STRUCT;
259 #define    DOT11_BCN_PRB_LEN    12        /* 802.11 beacon/probe frame fixed length */
260 #define    DOT11_BCN_PRB_FIXED_LEN    12        /* 802.11 beacon/probe frame fixed length */
261 
262 BWL_PRE_PACKED_STRUCT struct dot11_auth {
263     uint16            alg;        /* algorithm */
264     uint16            seq;        /* sequence control */
265     uint16            status;        /* status code */
266 } BWL_POST_PACKED_STRUCT;
267 #define DOT11_AUTH_FIXED_LEN        6    /* length of auth frame without challenge IE */
268 #define DOT11_AUTH_SEQ_STATUS_LEN    4    /* length of auth frame without challenge IE and
269                          * without algorithm
270                          */
271 
272 BWL_PRE_PACKED_STRUCT struct dot11_assoc_req {
273     uint16            capability;    /* capability information */
274     uint16            listen;        /* listen interval */
275 } BWL_POST_PACKED_STRUCT;
276 #define DOT11_ASSOC_REQ_FIXED_LEN    4    /* length of assoc frame without info elts */
277 
278 BWL_PRE_PACKED_STRUCT struct dot11_reassoc_req {
279     uint16            capability;    /* capability information */
280     uint16            listen;        /* listen interval */
281     struct ether_addr    ap;        /* Current AP address */
282 } BWL_POST_PACKED_STRUCT;
283 #define DOT11_REASSOC_REQ_FIXED_LEN    10    /* length of assoc frame without info elts */
284 
285 BWL_PRE_PACKED_STRUCT struct dot11_assoc_resp {
286     uint16            capability;    /* capability information */
287     uint16            status;        /* status code */
288     uint16            aid;        /* association ID */
289 } BWL_POST_PACKED_STRUCT;
290 #define DOT11_ASSOC_RESP_FIXED_LEN    6    /* length of assoc resp frame without info elts */
291 
292 BWL_PRE_PACKED_STRUCT struct dot11_action_measure {
293     uint8    category;
294     uint8    action;
295     uint8    token;
296     uint8    data[1];
297 } BWL_POST_PACKED_STRUCT;
298 #define DOT11_ACTION_MEASURE_LEN    3    /* d11 action measurement header length */
299 
300 BWL_PRE_PACKED_STRUCT struct dot11_action_ht_ch_width {
301     uint8    category;
302     uint8    action;
303     uint8    ch_width;
304 } BWL_POST_PACKED_STRUCT;
305 
306 BWL_PRE_PACKED_STRUCT struct dot11_action_ht_mimops {
307     uint8    category;
308     uint8    action;
309     uint8    control;
310 } BWL_POST_PACKED_STRUCT;
311 
312 BWL_PRE_PACKED_STRUCT struct dot11_action_sa_query {
313     uint8    category;
314     uint8    action;
315     uint16    id;
316 } BWL_POST_PACKED_STRUCT;
317 
318 BWL_PRE_PACKED_STRUCT struct dot11_action_vht_oper_mode {
319     uint8    category;
320     uint8    action;
321     uint8    mode;
322 } BWL_POST_PACKED_STRUCT;
323 
324 /* These lengths assume 64 MU groups, as specified in 802.11ac-2013 */
325 #define DOT11_ACTION_GID_MEMBERSHIP_LEN  8    /* bytes */
326 #define DOT11_ACTION_GID_USER_POS_LEN   16    /* bytes */
327 BWL_PRE_PACKED_STRUCT struct dot11_action_group_id {
328     uint8   category;
329     uint8   action;
330     uint8   membership_status[DOT11_ACTION_GID_MEMBERSHIP_LEN];
331     uint8   user_position[DOT11_ACTION_GID_USER_POS_LEN];
332 } BWL_POST_PACKED_STRUCT;
333 
334 #define SM_PWRSAVE_ENABLE    1
335 #define SM_PWRSAVE_MODE        2
336 
337 /* ************* 802.11h related definitions. ************* */
338 BWL_PRE_PACKED_STRUCT struct dot11_power_cnst {
339     uint8 id;
340     uint8 len;
341     uint8 power;
342 } BWL_POST_PACKED_STRUCT;
343 typedef struct dot11_power_cnst dot11_power_cnst_t;
344 
345 BWL_PRE_PACKED_STRUCT struct dot11_power_cap {
346     int8 min;
347     int8 max;
348 } BWL_POST_PACKED_STRUCT;
349 typedef struct dot11_power_cap dot11_power_cap_t;
350 
351 BWL_PRE_PACKED_STRUCT struct dot11_tpc_rep {
352     uint8 id;
353     uint8 len;
354     uint8 tx_pwr;
355     uint8 margin;
356 } BWL_POST_PACKED_STRUCT;
357 typedef struct dot11_tpc_rep dot11_tpc_rep_t;
358 #define DOT11_MNG_IE_TPC_REPORT_LEN    2     /* length of IE data, not including 2 byte header */
359 
360 BWL_PRE_PACKED_STRUCT struct dot11_supp_channels {
361     uint8 id;
362     uint8 len;
363     uint8 first_channel;
364     uint8 num_channels;
365 } BWL_POST_PACKED_STRUCT;
366 typedef struct dot11_supp_channels dot11_supp_channels_t;
367 
368 /**
369  * Extension Channel Offset IE: 802.11n-D1.0 spec. added sideband
370  * offset for 40MHz operation.  The possible 3 values are:
371  * 1 = above control channel
372  * 3 = below control channel
373  * 0 = no extension channel
374  */
375 BWL_PRE_PACKED_STRUCT struct dot11_extch {
376     uint8    id;        /* IE ID, 62, DOT11_MNG_EXT_CHANNEL_OFFSET */
377     uint8    len;        /* IE length */
378     uint8    extch;
379 } BWL_POST_PACKED_STRUCT;
380 typedef struct dot11_extch dot11_extch_ie_t;
381 
382 BWL_PRE_PACKED_STRUCT struct dot11_brcm_extch {
383     uint8    id;        /* IE ID, 221, DOT11_MNG_PROPR_ID */
384     uint8    len;        /* IE length */
385     uint8    oui[3];
386     uint8    type;           /* type indicates what follows */
387     uint8    extch;
388 } BWL_POST_PACKED_STRUCT;
389 typedef struct dot11_brcm_extch dot11_brcm_extch_ie_t;
390 
391 #define BRCM_EXTCH_IE_LEN    5
392 #define BRCM_EXTCH_IE_TYPE    53    /* 802.11n ID not yet assigned */
393 #define DOT11_EXTCH_IE_LEN    1
394 #define DOT11_EXT_CH_MASK    0x03    /* extension channel mask */
395 #define DOT11_EXT_CH_UPPER    0x01    /* ext. ch. on upper sb */
396 #define DOT11_EXT_CH_LOWER    0x03    /* ext. ch. on lower sb */
397 #define DOT11_EXT_CH_NONE    0x00    /* no extension ch.  */
398 
399 BWL_PRE_PACKED_STRUCT struct dot11_action_frmhdr {
400     uint8    category;
401     uint8    action;
402     uint8    data[1];
403 } BWL_POST_PACKED_STRUCT;
404 typedef struct dot11_action_frmhdr dot11_action_frmhdr_t;
405 
406 /* Action Field length */
407 #define DOT11_ACTION_CATEGORY_LEN    1
408 #define DOT11_ACTION_ACTION_LEN        1
409 #define DOT11_ACTION_DIALOG_TOKEN_LEN    1
410 #define DOT11_ACTION_CAPABILITY_LEN    2
411 #define DOT11_ACTION_STATUS_CODE_LEN    2
412 #define DOT11_ACTION_REASON_CODE_LEN    2
413 #define DOT11_ACTION_TARGET_CH_LEN    1
414 #define DOT11_ACTION_OPER_CLASS_LEN    1
415 
416 #define DOT11_ACTION_FRMHDR_LEN    2
417 
418 /** CSA IE data structure */
419 BWL_PRE_PACKED_STRUCT struct dot11_channel_switch {
420     uint8 id;    /* id DOT11_MNG_CHANNEL_SWITCH_ID */
421     uint8 len;    /* length of IE */
422     uint8 mode;    /* mode 0 or 1 */
423     uint8 channel;    /* channel switch to */
424     uint8 count;    /* number of beacons before switching */
425 } BWL_POST_PACKED_STRUCT;
426 typedef struct dot11_channel_switch dot11_chan_switch_ie_t;
427 
428 #define DOT11_SWITCH_IE_LEN    3    /* length of IE data, not including 2 byte header */
429 /* CSA mode - 802.11h-2003 $7.3.2.20 */
430 #define DOT11_CSA_MODE_ADVISORY        0    /* no DOT11_CSA_MODE_NO_TX restriction imposed */
431 #define DOT11_CSA_MODE_NO_TX        1    /* no transmission upon receiving CSA frame. */
432 
433 BWL_PRE_PACKED_STRUCT struct dot11_action_switch_channel {
434     uint8    category;
435     uint8    action;
436     dot11_chan_switch_ie_t chan_switch_ie;    /* for switch IE */
437     dot11_brcm_extch_ie_t extch_ie;        /* extension channel offset */
438 } BWL_POST_PACKED_STRUCT;
439 
440 BWL_PRE_PACKED_STRUCT struct dot11_csa_body {
441     uint8 mode;    /* mode 0 or 1 */
442     uint8 reg;    /* regulatory class */
443     uint8 channel;    /* channel switch to */
444     uint8 count;    /* number of beacons before switching */
445 } BWL_POST_PACKED_STRUCT;
446 
447 /** 11n Extended Channel Switch IE data structure */
448 BWL_PRE_PACKED_STRUCT struct dot11_ext_csa {
449     uint8 id;    /* id DOT11_MNG_EXT_CSA_ID */
450     uint8 len;    /* length of IE */
451     struct dot11_csa_body b;    /* body of the ie */
452 } BWL_POST_PACKED_STRUCT;
453 typedef struct dot11_ext_csa dot11_ext_csa_ie_t;
454 #define DOT11_EXT_CSA_IE_LEN    4    /* length of extended channel switch IE body */
455 
456 BWL_PRE_PACKED_STRUCT struct dot11_action_ext_csa {
457     uint8    category;
458     uint8    action;
459     dot11_ext_csa_ie_t chan_switch_ie;    /* for switch IE */
460 } BWL_POST_PACKED_STRUCT;
461 
462 BWL_PRE_PACKED_STRUCT struct dot11y_action_ext_csa {
463     uint8    category;
464     uint8    action;
465     struct dot11_csa_body b;    /* body of the ie */
466 } BWL_POST_PACKED_STRUCT;
467 
468 /**  Wide Bandwidth Channel Switch IE data structure */
469 BWL_PRE_PACKED_STRUCT struct dot11_wide_bw_channel_switch {
470     uint8 id;                /* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
471     uint8 len;                /* length of IE */
472     uint8 channel_width;            /* new channel width */
473     uint8 center_frequency_segment_0;    /* center frequency segment 0 */
474     uint8 center_frequency_segment_1;    /* center frequency segment 1 */
475 } BWL_POST_PACKED_STRUCT;
476 typedef struct dot11_wide_bw_channel_switch dot11_wide_bw_chan_switch_ie_t;
477 
478 #define DOT11_WIDE_BW_SWITCH_IE_LEN     3       /* length of IE data, not including 2 byte header */
479 
480 /** Channel Switch Wrapper IE data structure */
481 BWL_PRE_PACKED_STRUCT struct dot11_channel_switch_wrapper {
482     uint8 id;                /* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
483     uint8 len;                /* length of IE */
484     dot11_wide_bw_chan_switch_ie_t wb_chan_switch_ie;
485 } BWL_POST_PACKED_STRUCT;
486 typedef struct dot11_channel_switch_wrapper dot11_chan_switch_wrapper_ie_t;
487 
488 typedef enum wide_bw_chan_width {
489     WIDE_BW_CHAN_WIDTH_20    = 0,
490     WIDE_BW_CHAN_WIDTH_40    = 1,
491     WIDE_BW_CHAN_WIDTH_80    = 2,
492     WIDE_BW_CHAN_WIDTH_160    = 3,
493     WIDE_BW_CHAN_WIDTH_80_80    = 4
494 } wide_bw_chan_width_t;
495 
496 /**  Wide Bandwidth Channel IE data structure */
497 BWL_PRE_PACKED_STRUCT struct dot11_wide_bw_channel {
498     uint8 id;                /* id DOT11_MNG_WIDE_BW_CHANNEL_ID */
499     uint8 len;                /* length of IE */
500     uint8 channel_width;            /* channel width */
501     uint8 center_frequency_segment_0;    /* center frequency segment 0 */
502     uint8 center_frequency_segment_1;    /* center frequency segment 1 */
503 } BWL_POST_PACKED_STRUCT;
504 typedef struct dot11_wide_bw_channel dot11_wide_bw_chan_ie_t;
505 
506 #define DOT11_WIDE_BW_IE_LEN     3       /* length of IE data, not including 2 byte header */
507 /** VHT Transmit Power Envelope IE data structure */
508 BWL_PRE_PACKED_STRUCT struct dot11_vht_transmit_power_envelope {
509     uint8 id;                /* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
510     uint8 len;                /* length of IE */
511     uint8 transmit_power_info;
512     uint8 local_max_transmit_power_20;
513 } BWL_POST_PACKED_STRUCT;
514 typedef struct dot11_vht_transmit_power_envelope dot11_vht_transmit_power_envelope_ie_t;
515 
516 /* vht transmit power envelope IE length depends on channel width */
517 #define DOT11_VHT_TRANSMIT_PWR_ENVELOPE_IE_LEN_40MHZ    1
518 #define DOT11_VHT_TRANSMIT_PWR_ENVELOPE_IE_LEN_80MHZ    2
519 #define DOT11_VHT_TRANSMIT_PWR_ENVELOPE_IE_LEN_160MHZ    3
520 
521 BWL_PRE_PACKED_STRUCT struct dot11_obss_coex {
522     uint8    id;
523     uint8    len;
524     uint8    info;
525 } BWL_POST_PACKED_STRUCT;
526 typedef struct dot11_obss_coex dot11_obss_coex_t;
527 #define DOT11_OBSS_COEXINFO_LEN    1    /* length of OBSS Coexistence INFO IE */
528 
529 #define    DOT11_OBSS_COEX_INFO_REQ        0x01
530 #define    DOT11_OBSS_COEX_40MHZ_INTOLERANT    0x02
531 #define    DOT11_OBSS_COEX_20MHZ_WIDTH_REQ    0x04
532 
533 BWL_PRE_PACKED_STRUCT struct dot11_obss_chanlist {
534     uint8    id;
535     uint8    len;
536     uint8    regclass;
537     uint8    chanlist[1];
538 } BWL_POST_PACKED_STRUCT;
539 typedef struct dot11_obss_chanlist dot11_obss_chanlist_t;
540 #define DOT11_OBSS_CHANLIST_FIXED_LEN    1    /* fixed length of regclass */
541 
542 BWL_PRE_PACKED_STRUCT struct dot11_extcap_ie {
543     uint8 id;
544     uint8 len;
545     uint8 cap[1];
546 } BWL_POST_PACKED_STRUCT;
547 typedef struct dot11_extcap_ie dot11_extcap_ie_t;
548 
549 #define DOT11_EXTCAP_LEN_COEX    1
550 #define DOT11_EXTCAP_LEN_BT    3
551 #define DOT11_EXTCAP_LEN_IW    4
552 #define DOT11_EXTCAP_LEN_SI    6
553 
554 #define DOT11_EXTCAP_LEN_TDLS    5
555 #define DOT11_11AC_EXTCAP_LEN_TDLS    8
556 
557 #define DOT11_EXTCAP_LEN_FMS            2
558 #define DOT11_EXTCAP_LEN_PROXY_ARP        2
559 #define DOT11_EXTCAP_LEN_TFS            3
560 #define DOT11_EXTCAP_LEN_WNM_SLEEP        3
561 #define DOT11_EXTCAP_LEN_TIMBC            3
562 #define DOT11_EXTCAP_LEN_BSSTRANS        3
563 #define DOT11_EXTCAP_LEN_DMS            4
564 #define DOT11_EXTCAP_LEN_WNM_NOTIFICATION    6
565 #define DOT11_EXTCAP_LEN_TDLS_WBW        8
566 #define DOT11_EXTCAP_LEN_OPMODE_NOTIFICATION    8
567 
568 /* TDLS Capabilities */
569 #define DOT11_TDLS_CAP_TDLS            37        /* TDLS support */
570 #define DOT11_TDLS_CAP_PU_BUFFER_STA    28        /* TDLS Peer U-APSD buffer STA support */
571 #define DOT11_TDLS_CAP_PEER_PSM        20        /* TDLS Peer PSM support */
572 #define DOT11_TDLS_CAP_CH_SW            30        /* TDLS Channel switch */
573 #define DOT11_TDLS_CAP_PROH            38        /* TDLS prohibited */
574 #define DOT11_TDLS_CAP_CH_SW_PROH        39        /* TDLS Channel switch prohibited */
575 #define DOT11_TDLS_CAP_TDLS_WIDER_BW    61    /* TDLS Wider Band-Width */
576 
577 #define TDLS_CAP_MAX_BIT        39        /* TDLS max bit defined in ext cap */
578 
579 /* 802.11h/802.11k Measurement Request/Report IEs */
580 /* Measurement Type field */
581 #define DOT11_MEASURE_TYPE_BASIC     0   /* d11 measurement basic type */
582 #define DOT11_MEASURE_TYPE_CCA         1   /* d11 measurement CCA type */
583 #define DOT11_MEASURE_TYPE_RPI        2   /* d11 measurement RPI type */
584 #define DOT11_MEASURE_TYPE_CHLOAD    3   /* d11 measurement Channel Load type */
585 #define DOT11_MEASURE_TYPE_NOISE    4   /* d11 measurement Noise Histogram type */
586 #define DOT11_MEASURE_TYPE_BEACON    5   /* d11 measurement Beacon type */
587 #define DOT11_MEASURE_TYPE_FRAME    6   /* d11 measurement Frame type */
588 #define DOT11_MEASURE_TYPE_STAT        7   /* d11 measurement STA Statistics type */
589 #define DOT11_MEASURE_TYPE_LCI        8   /* d11 measurement LCI type */
590 #define DOT11_MEASURE_TYPE_TXSTREAM    9   /* d11 measurement TX Stream type */
591 #define DOT11_MEASURE_TYPE_MCDIAGS    10  /* d11 measurement multicast diagnostics */
592 #define DOT11_MEASURE_TYPE_CIVICLOC    11  /* d11 measurement location civic */
593 #define DOT11_MEASURE_TYPE_LOC_ID    12  /* d11 measurement location identifier */
594 #define DOT11_MEASURE_TYPE_DIRCHANQ    13  /* d11 measurement dir channel quality */
595 #define DOT11_MEASURE_TYPE_DIRMEAS    14  /* d11 measurement directional */
596 #define DOT11_MEASURE_TYPE_DIRSTATS    15  /* d11 measurement directional stats */
597 #define DOT11_MEASURE_TYPE_FTMRANGE    16  /* d11 measurement Fine Timing */
598 #define DOT11_MEASURE_TYPE_PAUSE    255    /* d11 measurement pause type */
599 
600 /* Measurement Request Modes */
601 #define DOT11_MEASURE_MODE_PARALLEL     (1<<0)    /* d11 measurement parallel */
602 #define DOT11_MEASURE_MODE_ENABLE     (1<<1)    /* d11 measurement enable */
603 #define DOT11_MEASURE_MODE_REQUEST    (1<<2)    /* d11 measurement request */
604 #define DOT11_MEASURE_MODE_REPORT     (1<<3)    /* d11 measurement report */
605 #define DOT11_MEASURE_MODE_DUR     (1<<4)    /* d11 measurement dur mandatory */
606 /* Measurement Report Modes */
607 #define DOT11_MEASURE_MODE_LATE     (1<<0)    /* d11 measurement late */
608 #define DOT11_MEASURE_MODE_INCAPABLE    (1<<1)    /* d11 measurement incapable */
609 #define DOT11_MEASURE_MODE_REFUSED    (1<<2)    /* d11 measurement refuse */
610 /* Basic Measurement Map bits */
611 #define DOT11_MEASURE_BASIC_MAP_BSS    ((uint8)(1<<0))    /* d11 measurement basic map BSS */
612 #define DOT11_MEASURE_BASIC_MAP_OFDM    ((uint8)(1<<1))    /* d11 measurement map OFDM */
613 #define DOT11_MEASURE_BASIC_MAP_UKNOWN    ((uint8)(1<<2))    /* d11 measurement map unknown */
614 #define DOT11_MEASURE_BASIC_MAP_RADAR    ((uint8)(1<<3))    /* d11 measurement map radar */
615 #define DOT11_MEASURE_BASIC_MAP_UNMEAS    ((uint8)(1<<4))    /* d11 measurement map unmeasuremnt */
616 
617 BWL_PRE_PACKED_STRUCT struct dot11_meas_req {
618     uint8 id;
619     uint8 len;
620     uint8 token;
621     uint8 mode;
622     uint8 type;
623     uint8 channel;
624     uint8 start_time[8];
625     uint16 duration;
626 } BWL_POST_PACKED_STRUCT;
627 typedef struct dot11_meas_req dot11_meas_req_t;
628 #define DOT11_MNG_IE_MREQ_LEN 14    /* d11 measurement request IE length */
629 /* length of Measure Request IE data not including variable len */
630 #define DOT11_MNG_IE_MREQ_FIXED_LEN 3    /* d11 measurement request IE fixed length */
631 
632 BWL_PRE_PACKED_STRUCT struct dot11_meas_req_loc {
633     uint8 id;
634     uint8 len;
635     uint8 token;
636     uint8 mode;
637     uint8 type;
638     BWL_PRE_PACKED_STRUCT union
639     {
640         BWL_PRE_PACKED_STRUCT struct {
641             uint8 subject;
642             uint8 data[1];
643         } BWL_POST_PACKED_STRUCT lci;
644         BWL_PRE_PACKED_STRUCT struct {
645             uint8 subject;
646             uint8 type;  /* type of civic location */
647             uint8 siu;   /* service interval units */
648             uint16 si; /* service interval */
649             uint8 data[1];
650         } BWL_POST_PACKED_STRUCT civic;
651         BWL_PRE_PACKED_STRUCT struct {
652             uint8 subject;
653             uint8 siu;   /* service interval units */
654             uint16 si; /* service interval */
655             uint8 data[1];
656         } BWL_POST_PACKED_STRUCT locid;
657         BWL_PRE_PACKED_STRUCT struct {
658             uint16 max_init_delay;        /* maximum random initial delay */
659             uint8 min_ap_count;
660             uint8 data[1];
661         } BWL_POST_PACKED_STRUCT ftm_range;
662     } BWL_POST_PACKED_STRUCT req;
663 } BWL_POST_PACKED_STRUCT;
664 typedef struct dot11_meas_req_loc dot11_meas_req_loc_t;
665 #define DOT11_MNG_IE_MREQ_MIN_LEN           4    /* d11 measurement report IE length */
666 #define DOT11_MNG_IE_MREQ_LCI_FIXED_LEN     4    /* d11 measurement report IE length */
667 #define DOT11_MNG_IE_MREQ_CIVIC_FIXED_LEN   8    /* d11 measurement report IE length */
668 #define DOT11_MNG_IE_MREQ_FRNG_FIXED_LEN    6    /* d11 measurement report IE length */
669 
670 BWL_PRE_PACKED_STRUCT struct dot11_lci_subelement {
671     uint8 subelement;
672     uint8 length;
673     uint8 lci_data[1];
674 } BWL_POST_PACKED_STRUCT;
675 typedef struct dot11_lci_subelement dot11_lci_subelement_t;
676 
677 BWL_PRE_PACKED_STRUCT struct dot11_colocated_bssid_list_se {
678     uint8 sub_id;
679     uint8 length;
680     uint8 max_bssid_ind; /* MaxBSSID Indicator */
681     struct ether_addr bssid[1]; /* variable */
682 } BWL_POST_PACKED_STRUCT;
683 typedef struct dot11_colocated_bssid_list_se dot11_colocated_bssid_list_se_t;
684 #define DOT11_LCI_COLOCATED_BSSID_LIST_FIXED_LEN     3
685 #define DOT11_LCI_COLOCATED_BSSID_SUBELEM_ID         7
686 
687 BWL_PRE_PACKED_STRUCT struct dot11_civic_subelement {
688     uint8 type;  /* type of civic location */
689     uint8 subelement;
690     uint8 length;
691     uint8 civic_data[1];
692 } BWL_POST_PACKED_STRUCT;
693 typedef struct dot11_civic_subelement dot11_civic_subelement_t;
694 
695 BWL_PRE_PACKED_STRUCT struct dot11_meas_rep {
696     uint8 id;
697     uint8 len;
698     uint8 token;
699     uint8 mode;
700     uint8 type;
701     BWL_PRE_PACKED_STRUCT union
702     {
703         BWL_PRE_PACKED_STRUCT struct {
704             uint8 channel;
705             uint8 start_time[8];
706             uint16 duration;
707             uint8 map;
708         } BWL_POST_PACKED_STRUCT basic;
709         BWL_PRE_PACKED_STRUCT struct {
710             uint8 subelement;
711             uint8 length;
712             uint8 data[1];
713         } BWL_POST_PACKED_STRUCT lci;
714         BWL_PRE_PACKED_STRUCT struct {
715             uint8 type;  /* type of civic location */
716             uint8 subelement;
717             uint8 length;
718             uint8 data[1];
719         } BWL_POST_PACKED_STRUCT civic;
720         BWL_PRE_PACKED_STRUCT struct {
721             uint8 exp_tsf[8];
722             uint8 subelement;
723             uint8 length;
724             uint8 data[1];
725         } BWL_POST_PACKED_STRUCT locid;
726         BWL_PRE_PACKED_STRUCT struct {
727             uint8 entry_count;
728             uint8 data[1];
729         } BWL_POST_PACKED_STRUCT ftm_range;
730         uint8 data[1];
731     } BWL_POST_PACKED_STRUCT rep;
732 } BWL_POST_PACKED_STRUCT;
733 typedef struct dot11_meas_rep dot11_meas_rep_t;
734 #define DOT11_MNG_IE_MREP_MIN_LEN           5    /* d11 measurement report IE length */
735 #define DOT11_MNG_IE_MREP_LCI_FIXED_LEN     5    /* d11 measurement report IE length */
736 #define DOT11_MNG_IE_MREP_CIVIC_FIXED_LEN   6    /* d11 measurement report IE length */
737 #define DOT11_MNG_IE_MREP_LOCID_FIXED_LEN   13    /* d11 measurement report IE length */
738 #define DOT11_MNG_IE_MREP_BASIC_FIXED_LEN   15    /* d11 measurement report IE length */
739 #define DOT11_MNG_IE_MREP_FRNG_FIXED_LEN    4
740 
741 /* length of Measure Report IE data not including variable len */
742 #define DOT11_MNG_IE_MREP_FIXED_LEN    3    /* d11 measurement response IE fixed length */
743 
744 BWL_PRE_PACKED_STRUCT struct dot11_meas_rep_basic {
745     uint8 channel;
746     uint8 start_time[8];
747     uint16 duration;
748     uint8 map;
749 } BWL_POST_PACKED_STRUCT;
750 typedef struct dot11_meas_rep_basic dot11_meas_rep_basic_t;
751 #define DOT11_MEASURE_BASIC_REP_LEN    12    /* d11 measurement basic report length */
752 
753 BWL_PRE_PACKED_STRUCT struct dot11_quiet {
754     uint8 id;
755     uint8 len;
756     uint8 count;    /* TBTTs until beacon interval in quiet starts */
757     uint8 period;    /* Beacon intervals between periodic quiet periods ? */
758     uint16 duration;    /* Length of quiet period, in TU's */
759     uint16 offset;    /* TU's offset from TBTT in Count field */
760 } BWL_POST_PACKED_STRUCT;
761 typedef struct dot11_quiet dot11_quiet_t;
762 
763 BWL_PRE_PACKED_STRUCT struct chan_map_tuple {
764     uint8 channel;
765     uint8 map;
766 } BWL_POST_PACKED_STRUCT;
767 typedef struct chan_map_tuple chan_map_tuple_t;
768 
769 BWL_PRE_PACKED_STRUCT struct dot11_ibss_dfs {
770     uint8 id;
771     uint8 len;
772     uint8 eaddr[ETHER_ADDR_LEN];
773     uint8 interval;
774     chan_map_tuple_t map[1];
775 } BWL_POST_PACKED_STRUCT;
776 typedef struct dot11_ibss_dfs dot11_ibss_dfs_t;
777 
778 /* WME Elements */
779 #define WME_OUI            "\x00\x50\xf2"    /* WME OUI */
780 #define WME_OUI_LEN        3
781 #define WME_OUI_TYPE        2    /* WME type */
782 #define WME_TYPE        2    /* WME type, deprecated */
783 #define WME_SUBTYPE_IE        0    /* Information Element */
784 #define WME_SUBTYPE_PARAM_IE    1    /* Parameter Element */
785 #define WME_SUBTYPE_TSPEC    2    /* Traffic Specification */
786 #define WME_VER            1    /* WME version */
787 
788 /* WME Access Category Indices (ACIs) */
789 #define AC_BE            0    /* Best Effort */
790 #define AC_BK            1    /* Background */
791 #define AC_VI            2    /* Video */
792 #define AC_VO            3    /* Voice */
793 #define AC_COUNT        4    /* number of ACs */
794 
795 typedef uint8 ac_bitmap_t;    /* AC bitmap of (1 << AC_xx) */
796 
797 #define AC_BITMAP_NONE        0x0    /* No ACs */
798 #define AC_BITMAP_ALL        0xf    /* All ACs */
799 #define AC_BITMAP_TST(ab, ac)    (((ab) & (1 << (ac))) != 0)
800 #define AC_BITMAP_SET(ab, ac)    (((ab) |= (1 << (ac))))
801 #define AC_BITMAP_RESET(ab, ac) (((ab) &= ~(1 << (ac))))
802 
803 /* Management PKT Lifetime indices */
804 /* Removing flag checks 'BCMINTERNAL || WLTEST'
805  * while merging MERGE BIS120RC4 to DINGO2
806  */
807 #define MGMT_ALL        0xffff
808 #define MGMT_AUTH_LT    FC_SUBTYPE_AUTH
809 #define MGMT_ASSOC_LT    FC_SUBTYPE_ASSOC_REQ
810 
811 /** WME Information Element (IE) */
812 BWL_PRE_PACKED_STRUCT struct wme_ie {
813     uint8 oui[3];
814     uint8 type;
815     uint8 subtype;
816     uint8 version;
817     uint8 qosinfo;
818 } BWL_POST_PACKED_STRUCT;
819 typedef struct wme_ie wme_ie_t;
820 #define WME_IE_LEN 7    /* WME IE length */
821 
822 BWL_PRE_PACKED_STRUCT struct edcf_acparam {
823     uint8    ACI;
824     uint8    ECW;
825     uint16  TXOP;        /* stored in network order (ls octet first) */
826 } BWL_POST_PACKED_STRUCT;
827 typedef struct edcf_acparam edcf_acparam_t;
828 
829 /** WME Parameter Element (PE) */
830 BWL_PRE_PACKED_STRUCT struct wme_param_ie {
831     uint8 oui[3];
832     uint8 type;
833     uint8 subtype;
834     uint8 version;
835     uint8 qosinfo;
836     uint8 rsvd;
837     edcf_acparam_t acparam[AC_COUNT];
838 } BWL_POST_PACKED_STRUCT;
839 typedef struct wme_param_ie wme_param_ie_t;
840 #define WME_PARAM_IE_LEN            24          /* WME Parameter IE length */
841 
842 /* QoS Info field for IE as sent from AP */
843 #define WME_QI_AP_APSD_MASK         0x80        /* U-APSD Supported mask */
844 #define WME_QI_AP_APSD_SHIFT        7           /* U-APSD Supported shift */
845 #define WME_QI_AP_COUNT_MASK        0x0f        /* Parameter set count mask */
846 #define WME_QI_AP_COUNT_SHIFT       0           /* Parameter set count shift */
847 
848 /* QoS Info field for IE as sent from STA */
849 #define WME_QI_STA_MAXSPLEN_MASK    0x60        /* Max Service Period Length mask */
850 #define WME_QI_STA_MAXSPLEN_SHIFT   5           /* Max Service Period Length shift */
851 #define WME_QI_STA_APSD_ALL_MASK    0xf         /* APSD all AC bits mask */
852 #define WME_QI_STA_APSD_ALL_SHIFT   0           /* APSD all AC bits shift */
853 #define WME_QI_STA_APSD_BE_MASK     0x8         /* APSD AC_BE mask */
854 #define WME_QI_STA_APSD_BE_SHIFT    3           /* APSD AC_BE shift */
855 #define WME_QI_STA_APSD_BK_MASK     0x4         /* APSD AC_BK mask */
856 #define WME_QI_STA_APSD_BK_SHIFT    2           /* APSD AC_BK shift */
857 #define WME_QI_STA_APSD_VI_MASK     0x2         /* APSD AC_VI mask */
858 #define WME_QI_STA_APSD_VI_SHIFT    1           /* APSD AC_VI shift */
859 #define WME_QI_STA_APSD_VO_MASK     0x1         /* APSD AC_VO mask */
860 #define WME_QI_STA_APSD_VO_SHIFT    0           /* APSD AC_VO shift */
861 
862 /* ACI */
863 #define EDCF_AIFSN_MIN               1           /* AIFSN minimum value */
864 #define EDCF_AIFSN_MAX               15          /* AIFSN maximum value */
865 #define EDCF_AIFSN_MASK              0x0f        /* AIFSN mask */
866 #define EDCF_ACM_MASK                0x10        /* ACM mask */
867 #define EDCF_ACI_MASK                0x60        /* ACI mask */
868 #define EDCF_ACI_SHIFT               5           /* ACI shift */
869 #define EDCF_AIFSN_SHIFT             12          /* 4 MSB(0xFFF) in ifs_ctl for AC idx */
870 
871 /* ECW */
872 #define EDCF_ECW_MIN                 0           /* cwmin/cwmax exponent minimum value */
873 #define EDCF_ECW_MAX                 15          /* cwmin/cwmax exponent maximum value */
874 #define EDCF_ECW2CW(exp)             ((1 << (exp)) - 1)
875 #define EDCF_ECWMIN_MASK             0x0f        /* cwmin exponent form mask */
876 #define EDCF_ECWMAX_MASK             0xf0        /* cwmax exponent form mask */
877 #define EDCF_ECWMAX_SHIFT            4           /* cwmax exponent form shift */
878 
879 /* TXOP */
880 #define EDCF_TXOP_MIN                0           /* TXOP minimum value */
881 #define EDCF_TXOP_MAX                65535       /* TXOP maximum value */
882 #define EDCF_TXOP2USEC(txop)         ((txop) << 5)
883 
884 /* Default BE ACI value for non-WME connection STA */
885 #define NON_EDCF_AC_BE_ACI_STA          0x02
886 
887 /* Default EDCF parameters that AP advertises for STA to use; WMM draft Table 12 */
888 #define EDCF_AC_BE_ACI_STA           0x03    /* STA ACI value for best effort AC */
889 #define EDCF_AC_BE_ECW_STA           0xA4    /* STA ECW value for best effort AC */
890 #define EDCF_AC_BE_TXOP_STA          0x0000    /* STA TXOP value for best effort AC */
891 #define EDCF_AC_BK_ACI_STA           0x27    /* STA ACI value for background AC */
892 #define EDCF_AC_BK_ECW_STA           0xA4    /* STA ECW value for background AC */
893 #define EDCF_AC_BK_TXOP_STA          0x0000    /* STA TXOP value for background AC */
894 #define EDCF_AC_VI_ACI_STA           0x42    /* STA ACI value for video AC */
895 #define EDCF_AC_VI_ECW_STA           0x43    /* STA ECW value for video AC */
896 #define EDCF_AC_VI_TXOP_STA          0x005e    /* STA TXOP value for video AC */
897 #define EDCF_AC_VO_ACI_STA           0x62    /* STA ACI value for audio AC */
898 #define EDCF_AC_VO_ECW_STA           0x32    /* STA ECW value for audio AC */
899 #define EDCF_AC_VO_TXOP_STA          0x002f    /* STA TXOP value for audio AC */
900 
901 /* Default EDCF parameters that AP uses; WMM draft Table 14 */
902 #define EDCF_AC_BE_ACI_AP            0x03    /* AP ACI value for best effort AC */
903 #define EDCF_AC_BE_ECW_AP            0x64    /* AP ECW value for best effort AC */
904 #define EDCF_AC_BE_TXOP_AP           0x0000    /* AP TXOP value for best effort AC */
905 #define EDCF_AC_BK_ACI_AP            0x27    /* AP ACI value for background AC */
906 #define EDCF_AC_BK_ECW_AP            0xA4    /* AP ECW value for background AC */
907 #define EDCF_AC_BK_TXOP_AP           0x0000    /* AP TXOP value for background AC */
908 #define EDCF_AC_VI_ACI_AP            0x41    /* AP ACI value for video AC */
909 #define EDCF_AC_VI_ECW_AP            0x43    /* AP ECW value for video AC */
910 #define EDCF_AC_VI_TXOP_AP           0x005e    /* AP TXOP value for video AC */
911 #define EDCF_AC_VO_ACI_AP            0x61    /* AP ACI value for audio AC */
912 #define EDCF_AC_VO_ECW_AP            0x32    /* AP ECW value for audio AC */
913 #define EDCF_AC_VO_TXOP_AP           0x002f    /* AP TXOP value for audio AC */
914 
915 /** EDCA Parameter IE */
916 BWL_PRE_PACKED_STRUCT struct edca_param_ie {
917     uint8 qosinfo;
918     uint8 rsvd;
919     edcf_acparam_t acparam[AC_COUNT];
920 } BWL_POST_PACKED_STRUCT;
921 typedef struct edca_param_ie edca_param_ie_t;
922 #define EDCA_PARAM_IE_LEN            18          /* EDCA Parameter IE length */
923 
924 /** QoS Capability IE */
925 BWL_PRE_PACKED_STRUCT struct qos_cap_ie {
926     uint8 qosinfo;
927 } BWL_POST_PACKED_STRUCT;
928 typedef struct qos_cap_ie qos_cap_ie_t;
929 
930 BWL_PRE_PACKED_STRUCT struct dot11_qbss_load_ie {
931     uint8 id;             /* 11, DOT11_MNG_QBSS_LOAD_ID */
932     uint8 length;
933     uint16 station_count;         /* total number of STAs associated */
934     uint8 channel_utilization;    /* % of time, normalized to 255, QAP sensed medium busy */
935     uint16 aac;             /* available admission capacity */
936 } BWL_POST_PACKED_STRUCT;
937 typedef struct dot11_qbss_load_ie dot11_qbss_load_ie_t;
938 #define BSS_LOAD_IE_SIZE     7    /* BSS load IE size */
939 
940 #define WLC_QBSS_LOAD_CHAN_FREE_MAX    0xff    /* max for channel free score */
941 
942 /* nom_msdu_size */
943 #define FIXED_MSDU_SIZE 0x8000        /* MSDU size is fixed */
944 #define MSDU_SIZE_MASK    0x7fff        /* (Nominal or fixed) MSDU size */
945 
946 /* surplus_bandwidth */
947 /* Represented as 3 bits of integer, binary point, 13 bits fraction */
948 #define    INTEGER_SHIFT    13    /* integer shift */
949 #define FRACTION_MASK    0x1FFF    /* fraction mask */
950 
951 /** Management Notification Frame */
952 BWL_PRE_PACKED_STRUCT struct dot11_management_notification {
953     uint8 category;            /* DOT11_ACTION_NOTIFICATION */
954     uint8 action;
955     uint8 token;
956     uint8 status;
957     uint8 data[1];            /* Elements */
958 } BWL_POST_PACKED_STRUCT;
959 #define DOT11_MGMT_NOTIFICATION_LEN 4    /* Fixed length */
960 
961 /** Timeout Interval IE */
962 BWL_PRE_PACKED_STRUCT struct ti_ie {
963     uint8 ti_type;
964     uint32 ti_val;
965 } BWL_POST_PACKED_STRUCT;
966 typedef struct ti_ie ti_ie_t;
967 #define TI_TYPE_REASSOC_DEADLINE    1
968 #define TI_TYPE_KEY_LIFETIME        2
969 
970 #ifndef CISCO_AIRONET_OUI
971 #define CISCO_AIRONET_OUI    "\x00\x40\x96"    /* Cisco AIRONET OUI */
972 #endif
973 /* QoS FastLane IE. */
974 BWL_PRE_PACKED_STRUCT struct ccx_qfl_ie {
975     uint8    id;        /* 221, DOT11_MNG_VS_ID */
976     uint8    length;        /* 5 */
977     uint8    oui[3];        /* 00:40:96 */
978     uint8    type;        /* 11 */
979     uint8    data;
980 } BWL_POST_PACKED_STRUCT;
981 typedef struct ccx_qfl_ie ccx_qfl_ie_t;
982 #define CCX_QFL_IE_TYPE    11
983 #define CCX_QFL_ENABLE_SHIFT    5
984 #define CCX_QFL_ENALBE (1 << CCX_QFL_ENABLE_SHIFT)
985 
986 /* WME Action Codes */
987 #define WME_ADDTS_REQUEST    0    /* WME ADDTS request */
988 #define WME_ADDTS_RESPONSE    1    /* WME ADDTS response */
989 #define WME_DELTS_REQUEST    2    /* WME DELTS request */
990 
991 /* WME Setup Response Status Codes */
992 #define WME_ADMISSION_ACCEPTED        0    /* WME admission accepted */
993 #define WME_INVALID_PARAMETERS        1    /* WME invalide parameters */
994 #define WME_ADMISSION_REFUSED        3    /* WME admission refused */
995 
996 /* Macro to take a pointer to a beacon or probe response
997  * body and return the char* pointer to the SSID info element
998  */
999 #define BCN_PRB_SSID(body) ((char*)(body) + DOT11_BCN_PRB_LEN)
1000 
1001 /* Authentication frame payload constants */
1002 #define DOT11_OPEN_SYSTEM    0    /* d11 open authentication */
1003 #define DOT11_SHARED_KEY    1    /* d11 shared authentication */
1004 #define DOT11_FAST_BSS        2    /* d11 fast bss authentication */
1005 #define DOT11_SAE        3    /* d11 simultaneous authentication of equals */
1006 #define DOT11_FILS_SKEY_PFS    4    /* d11 fils shared key authentication w/o pfs */
1007 #define DOT11_FILS_SKEY        5    /* d11 fils shared key authentication w/ pfs */
1008 #define DOT11_FILS_PKEY        6    /* d11 fils public key authentication */
1009 #define DOT11_CHALLENGE_LEN    128    /* d11 challenge text length */
1010 
1011 /* Frame control macros */
1012 #define FC_PVER_MASK        0x3    /* PVER mask */
1013 #define FC_PVER_SHIFT        0    /* PVER shift */
1014 #define FC_TYPE_MASK        0xC    /* type mask */
1015 #define FC_TYPE_SHIFT        2    /* type shift */
1016 #define FC_SUBTYPE_MASK        0xF0    /* subtype mask */
1017 #define FC_SUBTYPE_SHIFT    4    /* subtype shift */
1018 #define FC_TODS            0x100    /* to DS */
1019 #define FC_TODS_SHIFT        8    /* to DS shift */
1020 #define FC_FROMDS        0x200    /* from DS */
1021 #define FC_FROMDS_SHIFT        9    /* from DS shift */
1022 #define FC_MOREFRAG        0x400    /* more frag. */
1023 #define FC_MOREFRAG_SHIFT    10    /* more frag. shift */
1024 #define FC_RETRY        0x800    /* retry */
1025 #define FC_RETRY_SHIFT        11    /* retry shift */
1026 #define FC_PM            0x1000    /* PM */
1027 #define FC_PM_SHIFT        12    /* PM shift */
1028 #define FC_MOREDATA        0x2000    /* more data */
1029 #define FC_MOREDATA_SHIFT    13    /* more data shift */
1030 #define FC_WEP            0x4000    /* WEP */
1031 #define FC_WEP_SHIFT        14    /* WEP shift */
1032 #define FC_ORDER        0x8000    /* order */
1033 #define FC_ORDER_SHIFT        15    /* order shift */
1034 
1035 /* sequence control macros */
1036 #define SEQNUM_SHIFT        4    /* seq. number shift */
1037 #define SEQNUM_MAX        0x1000    /* max seqnum + 1 */
1038 #define FRAGNUM_MASK        0xF    /* frag. number mask */
1039 
1040 /* Frame Control type/subtype defs */
1041 
1042 /* FC Types */
1043 #define FC_TYPE_MNG        0    /* management type */
1044 #define FC_TYPE_CTL        1    /* control type */
1045 #define FC_TYPE_DATA        2    /* data type */
1046 
1047 /* Management Subtypes */
1048 #define FC_SUBTYPE_ASSOC_REQ        0    /* assoc. request */
1049 #define FC_SUBTYPE_ASSOC_RESP        1    /* assoc. response */
1050 #define FC_SUBTYPE_REASSOC_REQ        2    /* reassoc. request */
1051 #define FC_SUBTYPE_REASSOC_RESP        3    /* reassoc. response */
1052 #define FC_SUBTYPE_PROBE_REQ        4    /* probe request */
1053 #define FC_SUBTYPE_PROBE_RESP        5    /* probe response */
1054 #define FC_SUBTYPE_BEACON        8    /* beacon */
1055 #define FC_SUBTYPE_ATIM            9    /* ATIM */
1056 #define FC_SUBTYPE_DISASSOC        10    /* disassoc. */
1057 #define FC_SUBTYPE_AUTH            11    /* authentication */
1058 #define FC_SUBTYPE_DEAUTH        12    /* de-authentication */
1059 #define FC_SUBTYPE_ACTION        13    /* action */
1060 #define FC_SUBTYPE_ACTION_NOACK        14    /* action no-ack */
1061 
1062 /* Control Subtypes */
1063 #define FC_SUBTYPE_CTL_WRAPPER        7    /* Control Wrapper */
1064 #define FC_SUBTYPE_BLOCKACK_REQ        8    /* Block Ack Req */
1065 #define FC_SUBTYPE_BLOCKACK        9    /* Block Ack */
1066 #define FC_SUBTYPE_PS_POLL        10    /* PS poll */
1067 #define FC_SUBTYPE_RTS            11    /* RTS */
1068 #define FC_SUBTYPE_CTS            12    /* CTS */
1069 #define FC_SUBTYPE_ACK            13    /* ACK */
1070 #define FC_SUBTYPE_CF_END        14    /* CF-END */
1071 #define FC_SUBTYPE_CF_END_ACK        15    /* CF-END ACK */
1072 
1073 /* Data Subtypes */
1074 #define FC_SUBTYPE_DATA            0    /* Data */
1075 #define FC_SUBTYPE_DATA_CF_ACK        1    /* Data + CF-ACK */
1076 #define FC_SUBTYPE_DATA_CF_POLL        2    /* Data + CF-Poll */
1077 #define FC_SUBTYPE_DATA_CF_ACK_POLL    3    /* Data + CF-Ack + CF-Poll */
1078 #define FC_SUBTYPE_NULL            4    /* Null */
1079 #define FC_SUBTYPE_CF_ACK        5    /* CF-Ack */
1080 #define FC_SUBTYPE_CF_POLL        6    /* CF-Poll */
1081 #define FC_SUBTYPE_CF_ACK_POLL        7    /* CF-Ack + CF-Poll */
1082 #define FC_SUBTYPE_QOS_DATA        8    /* QoS Data */
1083 #define FC_SUBTYPE_QOS_DATA_CF_ACK    9    /* QoS Data + CF-Ack */
1084 #define FC_SUBTYPE_QOS_DATA_CF_POLL    10    /* QoS Data + CF-Poll */
1085 #define FC_SUBTYPE_QOS_DATA_CF_ACK_POLL    11    /* QoS Data + CF-Ack + CF-Poll */
1086 #define FC_SUBTYPE_QOS_NULL        12    /* QoS Null */
1087 #define FC_SUBTYPE_QOS_CF_POLL        14    /* QoS CF-Poll */
1088 #define FC_SUBTYPE_QOS_CF_ACK_POLL    15    /* QoS CF-Ack + CF-Poll */
1089 
1090 /* Data Subtype Groups */
1091 #define FC_SUBTYPE_ANY_QOS(s)        (((s) & 8) != 0)
1092 #define FC_SUBTYPE_ANY_NULL(s)        (((s) & 4) != 0)
1093 #define FC_SUBTYPE_ANY_CF_POLL(s)    (((s) & 2) != 0)
1094 #define FC_SUBTYPE_ANY_CF_ACK(s)    (((s) & 1) != 0)
1095 #define FC_SUBTYPE_ANY_PSPOLL(s)    (((s) & 10) != 0)
1096 
1097 /* Type/Subtype Combos */
1098 #define FC_KIND_MASK        (FC_TYPE_MASK | FC_SUBTYPE_MASK)    /* FC kind mask */
1099 
1100 #define FC_KIND(t, s)    (((t) << FC_TYPE_SHIFT) | ((s) << FC_SUBTYPE_SHIFT))    /* FC kind */
1101 
1102 #define FC_SUBTYPE(fc)    (((fc) & FC_SUBTYPE_MASK) >> FC_SUBTYPE_SHIFT)    /* Subtype from FC */
1103 #define FC_TYPE(fc)    (((fc) & FC_TYPE_MASK) >> FC_TYPE_SHIFT)    /* Type from FC */
1104 
1105 #define FC_ASSOC_REQ    FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_REQ)    /* assoc. request */
1106 #define FC_ASSOC_RESP    FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_RESP)    /* assoc. response */
1107 #define FC_REASSOC_REQ    FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_REQ)    /* reassoc. request */
1108 #define FC_REASSOC_RESP    FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_RESP)    /* reassoc. response */
1109 #define FC_PROBE_REQ    FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_REQ)    /* probe request */
1110 #define FC_PROBE_RESP    FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_RESP)    /* probe response */
1111 #define FC_BEACON    FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_BEACON)        /* beacon */
1112 #define FC_ATIM        FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ATIM)        /* ATIM */
1113 #define FC_DISASSOC    FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DISASSOC)    /* disassoc */
1114 #define FC_AUTH        FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_AUTH)        /* authentication */
1115 #define FC_DEAUTH    FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DEAUTH)        /* deauthentication */
1116 #define FC_ACTION    FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ACTION)        /* action */
1117 #define FC_ACTION_NOACK    FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ACTION_NOACK)    /* action no-ack */
1118 
1119 #define FC_CTL_WRAPPER    FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CTL_WRAPPER)    /* Control Wrapper */
1120 #define FC_BLOCKACK_REQ    FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_BLOCKACK_REQ)    /* Block Ack Req */
1121 #define FC_BLOCKACK    FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_BLOCKACK)    /* Block Ack */
1122 #define FC_PS_POLL    FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_PS_POLL)    /* PS poll */
1123 #define FC_RTS        FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_RTS)        /* RTS */
1124 #define FC_CTS        FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CTS)        /* CTS */
1125 #define FC_ACK        FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_ACK)        /* ACK */
1126 #define FC_CF_END    FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END)        /* CF-END */
1127 #define FC_CF_END_ACK    FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END_ACK)    /* CF-END ACK */
1128 
1129 #define FC_DATA        FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA)        /* data */
1130 #define FC_NULL_DATA    FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_NULL)        /* null data */
1131 #define FC_DATA_CF_ACK    FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA_CF_ACK)    /* data CF ACK */
1132 #define FC_QOS_DATA    FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_QOS_DATA)    /* QoS data */
1133 #define FC_QOS_NULL    FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_QOS_NULL)    /* QoS null */
1134 
1135 /* QoS Control Field */
1136 
1137 /* 802.1D Priority */
1138 #define QOS_PRIO_SHIFT        0    /* QoS priority shift */
1139 #define QOS_PRIO_MASK        0x0007    /* QoS priority mask */
1140 #define QOS_PRIO(qos)        (((qos) & QOS_PRIO_MASK) >> QOS_PRIO_SHIFT)    /* QoS priority */
1141 
1142 /* Traffic Identifier */
1143 #define QOS_TID_SHIFT        0    /* QoS TID shift */
1144 #define QOS_TID_MASK        0x000f    /* QoS TID mask */
1145 #define QOS_TID(qos)        (((qos) & QOS_TID_MASK) >> QOS_TID_SHIFT)    /* QoS TID */
1146 
1147 /* End of Service Period (U-APSD) */
1148 #define QOS_EOSP_SHIFT        4    /* QoS End of Service Period shift */
1149 #define QOS_EOSP_MASK        0x0010    /* QoS End of Service Period mask */
1150 #define QOS_EOSP(qos)        (((qos) & QOS_EOSP_MASK) >> QOS_EOSP_SHIFT)    /* Qos EOSP */
1151 
1152 /* Ack Policy */
1153 #define QOS_ACK_NORMAL_ACK    0    /* Normal Ack */
1154 #define QOS_ACK_NO_ACK        1    /* No Ack (eg mcast) */
1155 #define QOS_ACK_NO_EXP_ACK    2    /* No Explicit Ack */
1156 #define QOS_ACK_BLOCK_ACK    3    /* Block Ack */
1157 #define QOS_ACK_SHIFT        5    /* QoS ACK shift */
1158 #define QOS_ACK_MASK        0x0060    /* QoS ACK mask */
1159 #define QOS_ACK(qos)        (((qos) & QOS_ACK_MASK) >> QOS_ACK_SHIFT)    /* QoS ACK */
1160 
1161 /* A-MSDU flag */
1162 #define QOS_AMSDU_SHIFT        7    /* AMSDU shift */
1163 #define QOS_AMSDU_MASK        0x0080    /* AMSDU mask */
1164 
1165 /* Management Frames */
1166 
1167 /* Management Frame Constants */
1168 
1169 /* Fixed fields */
1170 #define DOT11_MNG_AUTH_ALGO_LEN        2    /* d11 management auth. algo. length */
1171 #define DOT11_MNG_AUTH_SEQ_LEN        2    /* d11 management auth. seq. length */
1172 #define DOT11_MNG_BEACON_INT_LEN    2    /* d11 management beacon interval length */
1173 #define DOT11_MNG_CAP_LEN        2    /* d11 management cap. length */
1174 #define DOT11_MNG_AP_ADDR_LEN        6    /* d11 management AP address length */
1175 #define DOT11_MNG_LISTEN_INT_LEN    2    /* d11 management listen interval length */
1176 #define DOT11_MNG_REASON_LEN        2    /* d11 management reason length */
1177 #define DOT11_MNG_AID_LEN        2    /* d11 management AID length */
1178 #define DOT11_MNG_STATUS_LEN        2    /* d11 management status length */
1179 #define DOT11_MNG_TIMESTAMP_LEN        8    /* d11 management timestamp length */
1180 
1181 /* DUR/ID field in assoc resp is 0xc000 | AID */
1182 #define DOT11_AID_MASK            0x3fff    /* d11 AID mask */
1183 
1184 /* Reason Codes */
1185 #define DOT11_RC_RESERVED        0    /* d11 RC reserved */
1186 #define DOT11_RC_UNSPECIFIED        1    /* Unspecified reason */
1187 #define DOT11_RC_AUTH_INVAL        2    /* Previous authentication no longer valid */
1188 #define DOT11_RC_DEAUTH_LEAVING        3    /* Deauthenticated because sending station
1189                          * is leaving (or has left) IBSS or ESS
1190                          */
1191 #define DOT11_RC_INACTIVITY        4    /* Disassociated due to inactivity */
1192 #define DOT11_RC_BUSY            5    /* Disassociated because AP is unable to handle
1193                          * all currently associated stations
1194                          */
1195 #define DOT11_RC_INVAL_CLASS_2        6    /* Class 2 frame received from
1196                          * nonauthenticated station
1197                          */
1198 #define DOT11_RC_INVAL_CLASS_3        7    /* Class 3 frame received from
1199                          *  nonassociated station
1200                          */
1201 #define DOT11_RC_DISASSOC_LEAVING    8    /* Disassociated because sending station is
1202                          * leaving (or has left) BSS
1203                          */
1204 #define DOT11_RC_NOT_AUTH        9    /* Station requesting (re)association is not
1205                          * authenticated with responding station
1206                          */
1207 #define DOT11_RC_BAD_PC            10    /* Unacceptable power capability element */
1208 #define DOT11_RC_BAD_CHANNELS        11    /* Unacceptable supported channels element */
1209 
1210 /* 12 is unused by STA but could be used by AP/GO */
1211 #define DOT11_RC_DISASSOC_BTM        12    /* Disassociated due to BSS Transition Magmt */
1212 
1213 
1214 /* 32-39 are QSTA specific reasons added in 11e */
1215 #define DOT11_RC_UNSPECIFIED_QOS    32    /* unspecified QoS-related reason */
1216 #define DOT11_RC_INSUFFCIENT_BW        33    /* QAP lacks sufficient bandwidth */
1217 #define DOT11_RC_EXCESSIVE_FRAMES    34    /* excessive number of frames need ack */
1218 #define DOT11_RC_TX_OUTSIDE_TXOP    35    /* transmitting outside the limits of txop */
1219 #define DOT11_RC_LEAVING_QBSS        36    /* QSTA is leaving the QBSS (or restting) */
1220 #define DOT11_RC_BAD_MECHANISM        37    /* does not want to use the mechanism */
1221 #define DOT11_RC_SETUP_NEEDED        38    /* mechanism needs a setup */
1222 #define DOT11_RC_TIMEOUT        39    /* timeout */
1223 
1224 #define DOT11_RC_MESH_PEERING_CANCELLED        52
1225 #define DOT11_RC_MESH_MAX_PEERS            53
1226 #define DOT11_RC_MESH_CONFIG_POLICY_VIOLN    54
1227 #define DOT11_RC_MESH_CLOSE_RECVD        55
1228 #define DOT11_RC_MESH_MAX_RETRIES        56
1229 #define DOT11_RC_MESH_CONFIRM_TIMEOUT        57
1230 #define DOT11_RC_MESH_INVALID_GTK        58
1231 #define DOT11_RC_MESH_INCONSISTENT_PARAMS    59
1232 
1233 #define DOT11_RC_MESH_INVALID_SEC_CAP        60
1234 #define DOT11_RC_MESH_PATHERR_NOPROXYINFO    61
1235 #define DOT11_RC_MESH_PATHERR_NOFWINFO        62
1236 #define DOT11_RC_MESH_PATHERR_DSTUNREACH    63
1237 #define DOT11_RC_MESH_MBSSMAC_EXISTS        64
1238 #define DOT11_RC_MESH_CHANSWITCH_REGREQ        65
1239 #define DOT11_RC_MESH_CHANSWITCH_UNSPEC        66
1240 
1241 #define DOT11_RC_MAX            66    /* Reason codes > 66 are reserved */
1242 
1243 #define DOT11_RC_TDLS_PEER_UNREACH    25
1244 #define DOT11_RC_TDLS_DOWN_UNSPECIFIED    26
1245 
1246 /* Status Codes */
1247 #define DOT11_SC_SUCCESS        0    /* Successful */
1248 #define DOT11_SC_FAILURE        1    /* Unspecified failure */
1249 #define DOT11_SC_TDLS_WAKEUP_SCH_ALT 2    /* TDLS wakeup schedule rejected but alternative  */
1250                     /* schedule provided */
1251 #define DOT11_SC_TDLS_WAKEUP_SCH_REJ 3    /* TDLS wakeup schedule rejected */
1252 #define DOT11_SC_TDLS_SEC_DISABLED    5    /* TDLS Security disabled */
1253 #define DOT11_SC_LIFETIME_REJ        6    /* Unacceptable lifetime */
1254 #define DOT11_SC_NOT_SAME_BSS        7    /* Not in same BSS */
1255 #define DOT11_SC_CAP_MISMATCH        10    /* Cannot support all requested
1256                          * capabilities in the Capability
1257                          * Information field
1258                          */
1259 #define DOT11_SC_REASSOC_FAIL        11    /* Reassociation denied due to inability
1260                          * to confirm that association exists
1261                          */
1262 #define DOT11_SC_ASSOC_FAIL        12    /* Association denied due to reason
1263                          * outside the scope of this standard
1264                          */
1265 #define DOT11_SC_AUTH_MISMATCH        13    /* Responding station does not support
1266                          * the specified authentication
1267                          * algorithm
1268                          */
1269 #define DOT11_SC_AUTH_SEQ        14    /* Received an Authentication frame
1270                          * with authentication transaction
1271                          * sequence number out of expected
1272                          * sequence
1273                          */
1274 #define DOT11_SC_AUTH_CHALLENGE_FAIL    15    /* Authentication rejected because of
1275                          * challenge failure
1276                          */
1277 #define DOT11_SC_AUTH_TIMEOUT        16    /* Authentication rejected due to timeout
1278                          * waiting for next frame in sequence
1279                          */
1280 #define DOT11_SC_ASSOC_BUSY_FAIL    17    /* Association denied because AP is
1281                          * unable to handle additional
1282                          * associated stations
1283                          */
1284 #define DOT11_SC_ASSOC_RATE_MISMATCH    18    /* Association denied due to requesting
1285                          * station not supporting all of the
1286                          * data rates in the BSSBasicRateSet
1287                          * parameter
1288                          */
1289 #define DOT11_SC_ASSOC_SHORT_REQUIRED    19    /* Association denied due to requesting
1290                          * station not supporting the Short
1291                          * Preamble option
1292                          */
1293 #define DOT11_SC_ASSOC_PBCC_REQUIRED    20    /* Association denied due to requesting
1294                          * station not supporting the PBCC
1295                          * Modulation option
1296                          */
1297 #define DOT11_SC_ASSOC_AGILITY_REQUIRED    21    /* Association denied due to requesting
1298                          * station not supporting the Channel
1299                          * Agility option
1300                          */
1301 #define DOT11_SC_ASSOC_SPECTRUM_REQUIRED    22    /* Association denied because Spectrum
1302                              * Management capability is required.
1303                              */
1304 #define DOT11_SC_ASSOC_BAD_POWER_CAP    23    /* Association denied because the info
1305                          * in the Power Cap element is
1306                          * unacceptable.
1307                          */
1308 #define DOT11_SC_ASSOC_BAD_SUP_CHANNELS    24    /* Association denied because the info
1309                          * in the Supported Channel element is
1310                          * unacceptable
1311                          */
1312 #define DOT11_SC_ASSOC_SHORTSLOT_REQUIRED    25    /* Association denied due to requesting
1313                              * station not supporting the Short Slot
1314                              * Time option
1315                              */
1316 #define DOT11_SC_ASSOC_DSSSOFDM_REQUIRED 26    /* Association denied because requesting station
1317                          * does not support the DSSS-OFDM option
1318                          */
1319 #define DOT11_SC_ASSOC_HT_REQUIRED    27    /* Association denied because the requesting
1320                          * station does not support HT features
1321                          */
1322 #define DOT11_SC_ASSOC_R0KH_UNREACHABLE    28    /* Association denied due to AP
1323                          * being unable to reach the R0 Key Holder
1324                          */
1325 #define DOT11_SC_ASSOC_TRY_LATER    30    /* Association denied temporarily, try again later
1326                          */
1327 #define DOT11_SC_ASSOC_MFP_VIOLATION    31    /* Association denied due to Robust Management
1328                          * frame policy violation
1329                          */
1330 
1331 #define    DOT11_SC_DECLINED        37    /* request declined */
1332 #define    DOT11_SC_INVALID_PARAMS        38    /* One or more params have invalid values */
1333 #define DOT11_SC_INVALID_PAIRWISE_CIPHER    42 /* invalid pairwise cipher */
1334 #define    DOT11_SC_INVALID_AKMP        43    /* Association denied due to invalid AKMP */
1335 #define DOT11_SC_INVALID_RSNIE_CAP    45    /* invalid RSN IE capabilities */
1336 #define DOT11_SC_DLS_NOT_ALLOWED    48    /* DLS is not allowed in the BSS by policy */
1337 #define    DOT11_SC_INVALID_PMKID        53    /* Association denied due to invalid PMKID */
1338 #define    DOT11_SC_INVALID_MDID        54    /* Association denied due to invalid MDID */
1339 #define    DOT11_SC_INVALID_FTIE        55    /* Association denied due to invalid FTIE */
1340 
1341 #define DOT11_SC_ADV_PROTO_NOT_SUPPORTED    59    /* ad proto not supported */
1342 #define DOT11_SC_NO_OUTSTAND_REQ            60    /* no outstanding req */
1343 #define DOT11_SC_RSP_NOT_RX_FROM_SERVER        61    /* no response from server */
1344 #define DOT11_SC_TIMEOUT                    62    /* timeout */
1345 #define DOT11_SC_QUERY_RSP_TOO_LARGE        63    /* query rsp too large */
1346 #define DOT11_SC_SERVER_UNREACHABLE            65    /* server unreachable */
1347 
1348 #define DOT11_SC_UNEXP_MSG            70    /* Unexpected message */
1349 #define DOT11_SC_INVALID_SNONCE        71    /* Invalid SNonce */
1350 #define DOT11_SC_INVALID_RSNIE        72    /* Invalid contents of RSNIE */
1351 
1352 #define DOT11_SC_ANTICLOG_TOCKEN_REQUIRED    76    /* Anti-clogging tocken required */
1353 #define DOT11_SC_INVALID_FINITE_CYCLIC_GRP    77    /* Invalid contents of RSNIE */
1354 
1355 #define DOT11_SC_ASSOC_VHT_REQUIRED    104    /* Association denied because the requesting
1356                          * station does not support VHT features.
1357                          */
1358 
1359 #define DOT11_SC_TRANSMIT_FAILURE    79    /* transmission failure */
1360 
1361 /* Info Elts, length of INFORMATION portion of Info Elts */
1362 #define DOT11_MNG_DS_PARAM_LEN            1    /* d11 management DS parameter length */
1363 #define DOT11_MNG_IBSS_PARAM_LEN        2    /* d11 management IBSS parameter length */
1364 
1365 /* TIM Info element has 3 bytes fixed info in INFORMATION field,
1366  * followed by 1 to 251 bytes of Partial Virtual Bitmap
1367  */
1368 #define DOT11_MNG_TIM_FIXED_LEN            3    /* d11 management TIM fixed length */
1369 #define DOT11_MNG_TIM_DTIM_COUNT        0    /* d11 management DTIM count */
1370 #define DOT11_MNG_TIM_DTIM_PERIOD        1    /* d11 management DTIM period */
1371 #define DOT11_MNG_TIM_BITMAP_CTL        2    /* d11 management TIM BITMAP control  */
1372 #define DOT11_MNG_TIM_PVB            3    /* d11 management TIM PVB */
1373 
1374 /* TLV defines */
1375 #define TLV_TAG_OFF        0    /* tag offset */
1376 #define TLV_LEN_OFF        1    /* length offset */
1377 #define TLV_HDR_LEN        2    /* header length */
1378 #define TLV_BODY_OFF        2    /* body offset */
1379 #define TLV_BODY_LEN_MAX    255    /* max body length */
1380 
1381 /* Management Frame Information Element IDs */
1382 #define DOT11_MNG_SSID_ID            0    /* d11 management SSID id */
1383 #define DOT11_MNG_RATES_ID            1    /* d11 management rates id */
1384 #define DOT11_MNG_FH_PARMS_ID            2    /* d11 management FH parameter id */
1385 #define DOT11_MNG_DS_PARMS_ID            3    /* d11 management DS parameter id */
1386 #define DOT11_MNG_CF_PARMS_ID            4    /* d11 management CF parameter id */
1387 #define DOT11_MNG_TIM_ID            5    /* d11 management TIM id */
1388 #define DOT11_MNG_IBSS_PARMS_ID            6    /* d11 management IBSS parameter id */
1389 #define DOT11_MNG_COUNTRY_ID            7    /* d11 management country id */
1390 #define DOT11_MNG_HOPPING_PARMS_ID        8    /* d11 management hopping parameter id */
1391 #define DOT11_MNG_HOPPING_TABLE_ID        9    /* d11 management hopping table id */
1392 #define DOT11_MNG_FTM_SYNC_INFO_ID        9    /* 11mc D4.3 */
1393 #define DOT11_MNG_REQUEST_ID            10    /* d11 management request id */
1394 #define DOT11_MNG_QBSS_LOAD_ID             11    /* d11 management QBSS Load id */
1395 #define DOT11_MNG_EDCA_PARAM_ID            12    /* 11E EDCA Parameter id */
1396 #define DOT11_MNG_TSPEC_ID            13    /* d11 management TSPEC id */
1397 #define DOT11_MNG_TCLAS_ID            14    /* d11 management TCLAS id */
1398 #define DOT11_MNG_CHALLENGE_ID            16    /* d11 management chanllenge id */
1399 #define DOT11_MNG_PWR_CONSTRAINT_ID        32    /* 11H PowerConstraint */
1400 #define DOT11_MNG_PWR_CAP_ID            33    /* 11H PowerCapability */
1401 #define DOT11_MNG_TPC_REQUEST_ID         34    /* 11H TPC Request */
1402 #define DOT11_MNG_TPC_REPORT_ID            35    /* 11H TPC Report */
1403 #define DOT11_MNG_SUPP_CHANNELS_ID        36    /* 11H Supported Channels */
1404 #define DOT11_MNG_CHANNEL_SWITCH_ID        37    /* 11H ChannelSwitch Announcement */
1405 #define DOT11_MNG_MEASURE_REQUEST_ID        38    /* 11H MeasurementRequest */
1406 #define DOT11_MNG_MEASURE_REPORT_ID        39    /* 11H MeasurementReport */
1407 #define DOT11_MNG_QUIET_ID            40    /* 11H Quiet */
1408 #define DOT11_MNG_IBSS_DFS_ID            41    /* 11H IBSS_DFS */
1409 #define DOT11_MNG_ERP_ID            42    /* d11 management ERP id */
1410 #define DOT11_MNG_TS_DELAY_ID            43    /* d11 management TS Delay id */
1411 #define DOT11_MNG_TCLAS_PROC_ID            44    /* d11 management TCLAS processing id */
1412 #define    DOT11_MNG_HT_CAP            45    /* d11 mgmt HT cap id */
1413 #define DOT11_MNG_QOS_CAP_ID            46    /* 11E QoS Capability id */
1414 #define DOT11_MNG_NONERP_ID            47    /* d11 management NON-ERP id */
1415 #define DOT11_MNG_RSN_ID            48    /* d11 management RSN id */
1416 #define DOT11_MNG_EXT_RATES_ID            50    /* d11 management ext. rates id */
1417 #define DOT11_MNG_AP_CHREP_ID            51    /* 11k AP Channel report id */
1418 #define DOT11_MNG_NEIGHBOR_REP_ID        52    /* 11k & 11v Neighbor report id */
1419 #define DOT11_MNG_RCPI_ID            53    /* 11k RCPI */
1420 #define DOT11_MNG_MDIE_ID            54    /* 11r Mobility domain id */
1421 #define DOT11_MNG_FTIE_ID            55    /* 11r Fast Bss Transition id */
1422 #define DOT11_MNG_FT_TI_ID            56    /* 11r Timeout Interval id */
1423 #define DOT11_MNG_RDE_ID            57    /* 11r RIC Data Element id */
1424 #define    DOT11_MNG_REGCLASS_ID            59    /* d11 management regulatory class id */
1425 #define DOT11_MNG_EXT_CSA_ID            60    /* d11 Extended CSA */
1426 #define    DOT11_MNG_HT_ADD            61    /* d11 mgmt additional HT info */
1427 #define    DOT11_MNG_EXT_CHANNEL_OFFSET        62    /* d11 mgmt ext channel offset */
1428 #define DOT11_MNG_BSS_AVR_ACCESS_DELAY_ID    63    /* 11k bss average access delay */
1429 #define DOT11_MNG_ANTENNA_ID            64    /* 11k antenna id */
1430 #define DOT11_MNG_RSNI_ID            65    /* 11k RSNI id */
1431 #define DOT11_MNG_MEASUREMENT_PILOT_TX_ID    66    /* 11k measurement pilot tx info id */
1432 #define DOT11_MNG_BSS_AVAL_ADMISSION_CAP_ID    67    /* 11k bss aval admission cap id */
1433 #define DOT11_MNG_BSS_AC_ACCESS_DELAY_ID    68    /* 11k bss AC access delay id */
1434 #define DOT11_MNG_WAPI_ID            68    /* d11 management WAPI id */
1435 #define DOT11_MNG_TIME_ADVERTISE_ID    69    /* 11p time advertisement */
1436 #define DOT11_MNG_RRM_CAP_ID        70    /* 11k radio measurement capability */
1437 #define DOT11_MNG_MULTIPLE_BSSID_ID        71    /* 11k multiple BSSID id */
1438 #define    DOT11_MNG_HT_BSS_COEXINFO_ID        72    /* d11 mgmt OBSS Coexistence INFO */
1439 #define    DOT11_MNG_HT_BSS_CHANNEL_REPORT_ID    73    /* d11 mgmt OBSS Intolerant Channel list */
1440 #define    DOT11_MNG_HT_OBSS_ID            74    /* d11 mgmt OBSS HT info */
1441 #define DOT11_MNG_MMIE_ID            76    /* d11 mgmt MIC IE */
1442 #define DOT11_MNG_FMS_DESCR_ID            86    /* 11v FMS descriptor */
1443 #define DOT11_MNG_FMS_REQ_ID            87    /* 11v FMS request id */
1444 #define DOT11_MNG_FMS_RESP_ID            88    /* 11v FMS response id */
1445 #define DOT11_MNG_BSS_MAX_IDLE_PERIOD_ID    90    /* 11v bss max idle id */
1446 #define DOT11_MNG_TFS_REQUEST_ID        91    /* 11v tfs request id */
1447 #define DOT11_MNG_TFS_RESPONSE_ID        92    /* 11v tfs response id */
1448 #define DOT11_MNG_WNM_SLEEP_MODE_ID        93    /* 11v wnm-sleep mode id */
1449 #define DOT11_MNG_TIMBC_REQ_ID            94    /* 11v TIM broadcast request id */
1450 #define DOT11_MNG_TIMBC_RESP_ID            95    /* 11v TIM broadcast response id */
1451 #define DOT11_MNG_CHANNEL_USAGE            97    /* 11v channel usage */
1452 #define DOT11_MNG_TIME_ZONE_ID            98    /* 11v time zone */
1453 #define DOT11_MNG_DMS_REQUEST_ID        99    /* 11v dms request id */
1454 #define DOT11_MNG_DMS_RESPONSE_ID        100    /* 11v dms response id */
1455 #define DOT11_MNG_LINK_IDENTIFIER_ID        101    /* 11z TDLS Link Identifier IE */
1456 #define DOT11_MNG_WAKEUP_SCHEDULE_ID        102    /* 11z TDLS Wakeup Schedule IE */
1457 #define DOT11_MNG_CHANNEL_SWITCH_TIMING_ID    104    /* 11z TDLS Channel Switch Timing IE */
1458 #define DOT11_MNG_PTI_CONTROL_ID        105    /* 11z TDLS PTI Control IE */
1459 #define DOT11_MNG_PU_BUFFER_STATUS_ID        106    /* 11z TDLS PU Buffer Status IE */
1460 #define DOT11_MNG_INTERWORKING_ID        107    /* 11u interworking */
1461 #define DOT11_MNG_ADVERTISEMENT_ID        108    /* 11u advertisement protocol */
1462 #define DOT11_MNG_EXP_BW_REQ_ID            109    /* 11u expedited bandwith request */
1463 #define DOT11_MNG_QOS_MAP_ID            110    /* 11u QoS map set */
1464 #define DOT11_MNG_ROAM_CONSORT_ID        111    /* 11u roaming consortium */
1465 #define DOT11_MNG_EMERGCY_ALERT_ID        112    /* 11u emergency alert identifier */
1466 #define DOT11_MNG_MESH_CONFIG            113    /* Mesh Configuration */
1467 #define DOT11_MNG_MESH_ID            114    /* Mesh ID */
1468 #define DOT11_MNG_MESH_PEER_MGMT_ID        117    /* Mesh PEER MGMT IE */
1469 #define DOT11_MNG_EXT_CAP_ID            127    /* d11 mgmt ext capability */
1470 #define DOT11_MNG_EXT_PREQ_ID            130    /* Mesh PREQ IE */
1471 #define DOT11_MNG_EXT_PREP_ID            131    /* Mesh PREP IE */
1472 #define DOT11_MNG_EXT_PERR_ID            132    /* Mesh PERR IE */
1473 #define    DOT11_MNG_VHT_CAP_ID            191    /* d11 mgmt VHT cap id */
1474 #define    DOT11_MNG_VHT_OPERATION_ID        192    /* d11 mgmt VHT op id */
1475 #define    DOT11_MNG_EXT_BSSLOAD_ID        193    /* d11 mgmt VHT extended bss load id */
1476 #define DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID    194    /* Wide BW Channel Switch IE */
1477 #define DOT11_MNG_VHT_TRANSMIT_POWER_ENVELOPE_ID 195    /* VHT transmit Power Envelope IE */
1478 #define DOT11_MNG_CHANNEL_SWITCH_WRAPPER_ID    196    /* Channel Switch Wrapper IE */
1479 #define DOT11_MNG_AID_ID            197    /* Association ID  IE */
1480 #define    DOT11_MNG_OPER_MODE_NOTIF_ID        199    /* d11 mgmt VHT oper mode notif */
1481 #define DOT11_MNG_RNR_ID            201
1482 #define DOT11_MNG_HE_CAP_ID            202
1483 #define DOT11_MNG_HE_OP_ID            203
1484 #define DOT11_MNG_FTM_PARAMS_ID            206
1485 #define DOT11_MNG_TWT_ID            216    /* 11ah D5.0 */
1486 #define DOT11_MNG_WPA_ID            221    /* d11 management WPA id */
1487 #define DOT11_MNG_PROPR_ID            221
1488 /* should start using this one instead of above two */
1489 #define DOT11_MNG_VS_ID                221    /* d11 management Vendor Specific IE */
1490 #define DOT11_MNG_MESH_CSP_ID            222    /* d11 Mesh Channel Switch Parameter */
1491 #define DOT11_MNG_FILS_IND_ID            240    /* 11ai FILS Indication element */
1492 
1493 /* The follwing ID extensions should be defined >= 255
1494  * i.e. the values should include 255 (DOT11_MNG_ID_EXT_ID + ID Extension).
1495  */
1496 #define DOT11_MNG_ID_EXT_ID            255    /* Element ID Extension 11mc D4.3 */
1497 #define DOT11_MNG_RAPS_ID    (DOT11_MNG_ID_EXT_ID+11)  /* OFDMA Random Access Parameter Set */
1498 
1499 /* FILS ext ids */
1500 #define FILS_REQ_PARAMS_EXT_ID        2
1501 #define DOT11_MNG_FILS_REQ_PARAMS    (DOT11_MNG_ID_EXT_ID + FILS_REQ_PARAMS_EXT_ID)
1502 #define FILS_SESSION_EXT_ID        4
1503 #define DOT11_MNG_FILS_SESSION        (DOT11_MNG_ID_EXT_ID + FILS_SESSION_EXT_ID)
1504 #define FILS_HLP_CONTAINER_EXT_ID        5
1505 #define DOT11_MNG_FILS_HLP_CONTAINER        (DOT11_MNG_ID_EXT_ID + FILS_HLP_CONTAINER_EXT_ID)
1506 #define FILS_WRAPPED_DATA_EXT_ID    8
1507 #define DOT11_MNG_FILS_WRAPPED_DATA    (DOT11_MNG_ID_EXT_ID + FILS_WRAPPED_DATA_EXT_ID)
1508 #define FILS_NONCE_EXT_ID        13
1509 #define DOT11_MNG_FILS_NONCE        (DOT11_MNG_ID_EXT_ID + FILS_NONCE_EXT_ID)
1510 
1511 #define DOT11_MNG_IE_ID_EXT_MATCH(_ie, _id) (\
1512     ((_ie)->id == DOT11_MNG_ID_EXT_ID) && \
1513     ((_ie)->len > 0) && \
1514     ((_id) == ((uint8 *)(_ie) + TLV_HDR_LEN)[0]))
1515 
1516 #define DOT11_MNG_IE_ID_EXT_INIT(_ie, _id, _len) do {\
1517         (_ie)->id = DOT11_MNG_ID_EXT_ID; \
1518         (_ie)->len = _len; \
1519         (_ie)->id_ext = _id; \
1520     } while (0)
1521 
1522 /* Rate Defines */
1523 
1524 /* Valid rates for the Supported Rates and Extended Supported Rates IEs.
1525  * Encoding is the rate in 500kbps units, rouding up for fractional values.
1526  * 802.11-2012, section 6.5.5.2, DATA_RATE parameter enumerates all the values.
1527  * The rate values cover DSSS, HR/DSSS, ERP, and OFDM phy rates.
1528  * The defines below do not cover the rates specific to 10MHz, {3, 4.5, 27},
1529  * and 5MHz, {1.5, 2.25, 3, 4.5, 13.5}, which are not supported by Broadcom devices.
1530  */
1531 
1532 #define DOT11_RATE_1M   2       /* 1  Mbps in 500kbps units */
1533 #define DOT11_RATE_2M   4       /* 2  Mbps in 500kbps units */
1534 #define DOT11_RATE_5M5  11      /* 5.5 Mbps in 500kbps units */
1535 #define DOT11_RATE_11M  22      /* 11 Mbps in 500kbps units */
1536 #define DOT11_RATE_6M   12      /* 6  Mbps in 500kbps units */
1537 #define DOT11_RATE_9M   18      /* 9  Mbps in 500kbps units */
1538 #define DOT11_RATE_12M  24      /* 12 Mbps in 500kbps units */
1539 #define DOT11_RATE_18M  36      /* 18 Mbps in 500kbps units */
1540 #define DOT11_RATE_24M  48      /* 24 Mbps in 500kbps units */
1541 #define DOT11_RATE_36M  72      /* 36 Mbps in 500kbps units */
1542 #define DOT11_RATE_48M  96      /* 48 Mbps in 500kbps units */
1543 #define DOT11_RATE_54M  108     /* 54 Mbps in 500kbps units */
1544 #define DOT11_RATE_MAX  108     /* highest rate (54 Mbps) in 500kbps units */
1545 
1546 /* Supported Rates and Extended Supported Rates IEs
1547  * The supported rates octets are defined a the MSB indicatin a Basic Rate
1548  * and bits 0-6 as the rate value
1549  */
1550 #define DOT11_RATE_BASIC                0x80 /* flag for a Basic Rate */
1551 #define DOT11_RATE_MASK                 0x7F /* mask for numeric part of rate */
1552 
1553 /* BSS Membership Selector parameters
1554  * 802.11-2016 (and 802.11ax-D1.1), Sec 9.4.2.3
1555  * These selector values are advertised in Supported Rates and Extended Supported Rates IEs
1556  * in the supported rates list with the Basic rate bit set.
1557  * Constants below include the basic bit.
1558  */
1559 #define DOT11_BSS_MEMBERSHIP_HT         0xFF  /* Basic 0x80 + 127, HT Required to join */
1560 #define DOT11_BSS_MEMBERSHIP_VHT        0xFE  /* Basic 0x80 + 126, VHT Required to join */
1561 #define DOT11_BSS_MEMBERSHIP_HE         0xFD  /* Basic 0x80 + 125, HE Required to join */
1562 
1563 /* ERP info element bit values */
1564 #define DOT11_MNG_ERP_LEN            1    /* ERP is currently 1 byte long */
1565 #define DOT11_MNG_NONERP_PRESENT        0x01    /* NonERP (802.11b) STAs are present
1566                              *in the BSS
1567                              */
1568 #define DOT11_MNG_USE_PROTECTION        0x02    /* Use protection mechanisms for
1569                              *ERP-OFDM frames
1570                              */
1571 #define DOT11_MNG_BARKER_PREAMBLE        0x04    /* Short Preambles: 0 == allowed,
1572                              * 1 == not allowed
1573                              */
1574 /* TS Delay element offset & size */
1575 #define DOT11_MGN_TS_DELAY_LEN        4    /* length of TS DELAY IE */
1576 #define TS_DELAY_FIELD_SIZE            4    /* TS DELAY field size */
1577 
1578 /* Capability Information Field */
1579 #define DOT11_CAP_ESS                0x0001    /* d11 cap. ESS */
1580 #define DOT11_CAP_IBSS                0x0002    /* d11 cap. IBSS */
1581 #define DOT11_CAP_POLLABLE            0x0004    /* d11 cap. pollable */
1582 #define DOT11_CAP_POLL_RQ            0x0008    /* d11 cap. poll request */
1583 #define DOT11_CAP_PRIVACY            0x0010    /* d11 cap. privacy */
1584 #define DOT11_CAP_SHORT                0x0020    /* d11 cap. short */
1585 #define DOT11_CAP_PBCC                0x0040    /* d11 cap. PBCC */
1586 #define DOT11_CAP_AGILITY            0x0080    /* d11 cap. agility */
1587 #define DOT11_CAP_SPECTRUM            0x0100    /* d11 cap. spectrum */
1588 #define DOT11_CAP_QOS                0x0200    /* d11 cap. qos */
1589 #define DOT11_CAP_SHORTSLOT            0x0400    /* d11 cap. shortslot */
1590 #define DOT11_CAP_APSD                0x0800    /* d11 cap. apsd */
1591 #define DOT11_CAP_RRM                0x1000    /* d11 cap. 11k radio measurement */
1592 #define DOT11_CAP_CCK_OFDM            0x2000    /* d11 cap. CCK/OFDM */
1593 #define DOT11_CAP_DELAY_BA            0x4000    /* d11 cap. delayed block ack */
1594 #define DOT11_CAP_IMMEDIATE_BA            0x8000    /* d11 cap. immediate block ack */
1595 
1596 /* Extended capabilities IE bitfields */
1597 /* 20/40 BSS Coexistence Management support bit position */
1598 #define DOT11_EXT_CAP_OBSS_COEX_MGMT        0
1599 /* Extended Channel Switching support bit position */
1600 #define DOT11_EXT_CAP_EXT_CHAN_SWITCHING    2
1601 /* scheduled PSMP support bit position */
1602 #define DOT11_EXT_CAP_SPSMP            6
1603 /*  Flexible Multicast Service */
1604 #define DOT11_EXT_CAP_FMS            11
1605 /* proxy ARP service support bit position */
1606 #define DOT11_EXT_CAP_PROXY_ARP            12
1607 /* Civic Location */
1608 #define DOT11_EXT_CAP_CIVIC_LOC            14
1609 /* Geospatial Location */
1610 #define DOT11_EXT_CAP_LCI            15
1611 /* Traffic Filter Service */
1612 #define DOT11_EXT_CAP_TFS            16
1613 /* WNM-Sleep Mode */
1614 #define DOT11_EXT_CAP_WNM_SLEEP            17
1615 /* TIM Broadcast service */
1616 #define DOT11_EXT_CAP_TIMBC            18
1617 /* BSS Transition Management support bit position */
1618 #define DOT11_EXT_CAP_BSSTRANS_MGMT        19
1619 /* Direct Multicast Service */
1620 #define DOT11_EXT_CAP_DMS            26
1621 /* Interworking support bit position */
1622 #define DOT11_EXT_CAP_IW            31
1623 /* QoS map support bit position */
1624 #define DOT11_EXT_CAP_QOS_MAP        32
1625 /* service Interval granularity bit position and mask */
1626 #define DOT11_EXT_CAP_SI            41
1627 #define DOT11_EXT_CAP_SI_MASK            0x0E
1628 /* Location Identifier service */
1629 #define DOT11_EXT_CAP_IDENT_LOC            44
1630 /* WNM notification */
1631 #define DOT11_EXT_CAP_WNM_NOTIF            46
1632 /* Operating mode notification - VHT (11ac D3.0 - 8.4.2.29) */
1633 #define DOT11_EXT_CAP_OPER_MODE_NOTIF        62
1634 /* Fine timing measurement - D3.0 */
1635 #define DOT11_EXT_CAP_FTM_RESPONDER        70
1636 #define DOT11_EXT_CAP_FTM_INITIATOR        71 /* tentative 11mcd3.0 */
1637 /* TWT support */
1638 #define DOT11_EXT_CAP_TWT_REQUESTER        75
1639 #define DOT11_EXT_CAP_TWT_RESPONDER        76
1640 /* TODO: Update DOT11_EXT_CAP_MAX_IDX to reflect the highest offset.
1641  * Note: DOT11_EXT_CAP_MAX_IDX must only be used in attach path.
1642  *       It will cause ROM invalidation otherwise.
1643  */
1644 #define DOT11_EXT_CAP_MAX_IDX    76
1645 
1646 #ifdef WL_FTM
1647 #define DOT11_EXT_CAP_MAX_BIT_IDX        95    /* !!!update this please!!! */
1648 #else
1649 #define DOT11_EXT_CAP_MAX_BIT_IDX        62    /* !!!update this please!!! */
1650 #endif
1651 /* extended capability */
1652 #ifndef DOT11_EXTCAP_LEN_MAX
1653 #define DOT11_EXTCAP_LEN_MAX ((DOT11_EXT_CAP_MAX_BIT_IDX + 8) >> 3)
1654 #endif
1655 BWL_PRE_PACKED_STRUCT struct dot11_extcap {
1656     uint8 extcap[DOT11_EXTCAP_LEN_MAX];
1657 } BWL_POST_PACKED_STRUCT;
1658 typedef struct dot11_extcap dot11_extcap_t;
1659 
1660 /* VHT Operating mode bit fields -  (11ac D8.0/802.11-2016 - 9.4.1.53) */
1661 #define DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT 0
1662 #define DOT11_OPER_MODE_CHANNEL_WIDTH_MASK 0x3
1663 #define DOT11_OPER_MODE_160_8080_BW_SHIFT 2
1664 #define DOT11_OPER_MODE_160_8080_BW_MASK 0x04
1665 #define DOT11_OPER_MODE_NOLDPC_SHIFT 3
1666 #define DOT11_OPER_MODE_NOLDPC_MASK 0x08
1667 #define DOT11_OPER_MODE_RXNSS_SHIFT 4
1668 #define DOT11_OPER_MODE_RXNSS_MASK 0x70
1669 #define DOT11_OPER_MODE_RXNSS_TYPE_SHIFT 7
1670 #define DOT11_OPER_MODE_RXNSS_TYPE_MASK 0x80
1671 
1672 #define DOT11_OPER_MODE(type, nss, chanw) (\
1673     ((type) << DOT11_OPER_MODE_RXNSS_TYPE_SHIFT &\
1674          DOT11_OPER_MODE_RXNSS_TYPE_MASK) |\
1675     (((nss) - 1) << DOT11_OPER_MODE_RXNSS_SHIFT & DOT11_OPER_MODE_RXNSS_MASK) |\
1676     ((chanw) << DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT &\
1677          DOT11_OPER_MODE_CHANNEL_WIDTH_MASK))
1678 
1679 #define DOT11_D8_OPER_MODE(type, nss, ldpc, bw160_8080, chanw) (\
1680     ((type) << DOT11_OPER_MODE_RXNSS_TYPE_SHIFT &\
1681          DOT11_OPER_MODE_RXNSS_TYPE_MASK) |\
1682     (((nss) - 1) << DOT11_OPER_MODE_RXNSS_SHIFT & DOT11_OPER_MODE_RXNSS_MASK) |\
1683     ((ldpc) << DOT11_OPER_MODE_NOLDPC_SHIFT & DOT11_OPER_MODE_NOLDPC_MASK) |\
1684     ((bw160_8080) << DOT11_OPER_MODE_160_8080_BW_SHIFT &\
1685          DOT11_OPER_MODE_160_8080_BW_MASK) |\
1686     ((chanw) << DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT &\
1687          DOT11_OPER_MODE_CHANNEL_WIDTH_MASK))
1688 
1689 #define DOT11_OPER_MODE_CHANNEL_WIDTH(mode) \
1690     (((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK)\
1691         >> DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT)
1692 #define DOT11_OPER_MODE_160_8080(mode) \
1693     (((mode) & DOT11_OPER_MODE_160_8080_BW_MASK)\
1694         >> DOT11_OPER_MODE_160_8080_BW_SHIFT)
1695 #define DOT11_OPER_MODE_RXNSS(mode) \
1696     ((((mode) & DOT11_OPER_MODE_RXNSS_MASK)        \
1697         >> DOT11_OPER_MODE_RXNSS_SHIFT) + 1)
1698 #define DOT11_OPER_MODE_RXNSS_TYPE(mode) \
1699     (((mode) & DOT11_OPER_MODE_RXNSS_TYPE_MASK)\
1700         >> DOT11_OPER_MODE_RXNSS_TYPE_SHIFT)
1701 
1702 #define DOT11_OPER_MODE_20MHZ 0
1703 #define DOT11_OPER_MODE_40MHZ 1
1704 #define DOT11_OPER_MODE_80MHZ 2
1705 #define DOT11_OPER_MODE_160MHZ 3
1706 #define DOT11_OPER_MODE_8080MHZ 3
1707 #define DOT11_OPER_MODE_1608080MHZ 1
1708 
1709 #define DOT11_OPER_MODE_CHANNEL_WIDTH_20MHZ(mode) (\
1710     ((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_20MHZ)
1711 #define DOT11_OPER_MODE_CHANNEL_WIDTH_40MHZ(mode) (\
1712     ((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_40MHZ)
1713 #define DOT11_OPER_MODE_CHANNEL_WIDTH_80MHZ(mode) (\
1714     ((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_80MHZ)
1715 #define DOT11_OPER_MODE_CHANNEL_WIDTH_160MHZ(mode) (\
1716     ((mode) & DOT11_OPER_MODE_160_8080_BW_MASK))
1717 #define DOT11_OPER_MODE_CHANNEL_WIDTH_8080MHZ(mode) (\
1718     ((mode) & DOT11_OPER_MODE_160_8080_BW_MASK))
1719 
1720 /* Operating mode information element 802.11ac D3.0 - 8.4.2.168 */
1721 BWL_PRE_PACKED_STRUCT struct dot11_oper_mode_notif_ie {
1722     uint8 mode;
1723 } BWL_POST_PACKED_STRUCT;
1724 typedef struct dot11_oper_mode_notif_ie dot11_oper_mode_notif_ie_t;
1725 
1726 #define DOT11_OPER_MODE_NOTIF_IE_LEN 1
1727 
1728 /* Extended Capability Information Field */
1729 #define DOT11_OBSS_COEX_MNG_SUPPORT    0x01    /* 20/40 BSS Coexistence Management support */
1730 
1731 /*
1732  * Action Frame Constants
1733  */
1734 #define DOT11_ACTION_HDR_LEN        2    /* action frame category + action field */
1735 #define DOT11_ACTION_CAT_OFF        0    /* category offset */
1736 #define DOT11_ACTION_ACT_OFF        1    /* action offset */
1737 
1738 /* Action Category field (sec 8.4.1.11) */
1739 #define DOT11_ACTION_CAT_ERR_MASK    0x80    /* category error mask */
1740 #define DOT11_ACTION_CAT_MASK        0x7F    /* category mask */
1741 #define DOT11_ACTION_CAT_SPECT_MNG    0    /* category spectrum management */
1742 #define DOT11_ACTION_CAT_QOS        1    /* category QoS */
1743 #define DOT11_ACTION_CAT_DLS        2    /* category DLS */
1744 #define DOT11_ACTION_CAT_BLOCKACK    3    /* category block ack */
1745 #define DOT11_ACTION_CAT_PUBLIC        4    /* category public */
1746 #define DOT11_ACTION_CAT_RRM        5    /* category radio measurements */
1747 #define DOT11_ACTION_CAT_FBT    6    /* category fast bss transition */
1748 #define DOT11_ACTION_CAT_HT        7    /* category for HT */
1749 #define    DOT11_ACTION_CAT_SA_QUERY    8    /* security association query */
1750 #define    DOT11_ACTION_CAT_PDPA        9    /* protected dual of public action */
1751 #define DOT11_ACTION_CAT_WNM        10    /* category for WNM */
1752 #define DOT11_ACTION_CAT_UWNM        11    /* category for Unprotected WNM */
1753 #define DOT11_ACTION_CAT_MESH        13    /* category for Mesh */
1754 #define DOT11_ACTION_CAT_SELFPROT    15    /* category for Mesh, self protected */
1755 #define DOT11_ACTION_NOTIFICATION    17
1756 #define DOT11_ACTION_CAT_VHT        21    /* VHT action */
1757 #define DOT11_ACTION_CAT_S1G        22    /* S1G action */
1758 #define DOT11_ACTION_CAT_HE        27    /* HE action frame */
1759 #define DOT11_ACTION_CAT_FILS        26    /* FILS action frame */
1760 #define DOT11_ACTION_CAT_VSP        126    /* protected vendor specific */
1761 #define DOT11_ACTION_CAT_VS        127    /* category Vendor Specific */
1762 
1763 /* Spectrum Management Action IDs (sec 7.4.1) */
1764 #define DOT11_SM_ACTION_M_REQ        0    /* d11 action measurement request */
1765 #define DOT11_SM_ACTION_M_REP        1    /* d11 action measurement response */
1766 #define DOT11_SM_ACTION_TPC_REQ        2    /* d11 action TPC request */
1767 #define DOT11_SM_ACTION_TPC_REP        3    /* d11 action TPC response */
1768 #define DOT11_SM_ACTION_CHANNEL_SWITCH    4    /* d11 action channel switch */
1769 #define DOT11_SM_ACTION_EXT_CSA        5    /* d11 extened CSA for 11n */
1770 
1771 /* QoS action ids */
1772 #define DOT11_QOS_ACTION_ADDTS_REQ    0    /* d11 action ADDTS request */
1773 #define DOT11_QOS_ACTION_ADDTS_RESP    1    /* d11 action ADDTS response */
1774 #define DOT11_QOS_ACTION_DELTS        2    /* d11 action DELTS */
1775 #define DOT11_QOS_ACTION_SCHEDULE    3    /* d11 action schedule */
1776 #define DOT11_QOS_ACTION_QOS_MAP    4    /* d11 action QOS map */
1777 
1778 /* HT action ids */
1779 #define DOT11_ACTION_ID_HT_CH_WIDTH    0    /* notify channel width action id */
1780 #define DOT11_ACTION_ID_HT_MIMO_PS    1    /* mimo ps action id */
1781 
1782 /* Public action ids */
1783 #define DOT11_PUB_ACTION_BSS_COEX_MNG    0    /* 20/40 Coexistence Management action id */
1784 #define DOT11_PUB_ACTION_CHANNEL_SWITCH    4    /* d11 action channel switch */
1785 #define DOT11_PUB_ACTION_VENDOR_SPEC    9    /* Vendor specific */
1786 #define DOT11_PUB_ACTION_GAS_CB_REQ    12    /* GAS Comeback Request */
1787 #define DOT11_PUB_ACTION_FTM_REQ    32        /* FTM request */
1788 #define DOT11_PUB_ACTION_FTM        33        /* FTM measurement */
1789 
1790 /* Block Ack action types */
1791 #define DOT11_BA_ACTION_ADDBA_REQ    0    /* ADDBA Req action frame type */
1792 #define DOT11_BA_ACTION_ADDBA_RESP    1    /* ADDBA Resp action frame type */
1793 #define DOT11_BA_ACTION_DELBA        2    /* DELBA action frame type */
1794 
1795 /* ADDBA action parameters */
1796 #define DOT11_ADDBA_PARAM_AMSDU_SUP    0x0001    /* AMSDU supported under BA */
1797 #define DOT11_ADDBA_PARAM_POLICY_MASK    0x0002    /* policy mask(ack vs delayed) */
1798 #define DOT11_ADDBA_PARAM_POLICY_SHIFT    1    /* policy shift */
1799 #define DOT11_ADDBA_PARAM_TID_MASK    0x003c    /* tid mask */
1800 #define DOT11_ADDBA_PARAM_TID_SHIFT    2    /* tid shift */
1801 #define DOT11_ADDBA_PARAM_BSIZE_MASK    0xffc0    /* buffer size mask */
1802 #define DOT11_ADDBA_PARAM_BSIZE_SHIFT    6    /* buffer size shift */
1803 
1804 #define DOT11_ADDBA_POLICY_DELAYED    0    /* delayed BA policy */
1805 #define DOT11_ADDBA_POLICY_IMMEDIATE    1    /* immediate BA policy */
1806 
1807 /* Fast Transition action types */
1808 #define DOT11_FT_ACTION_FT_RESERVED        0
1809 #define DOT11_FT_ACTION_FT_REQ            1    /* FBT request - for over-the-DS FBT */
1810 #define DOT11_FT_ACTION_FT_RES            2    /* FBT response - for over-the-DS FBT */
1811 #define DOT11_FT_ACTION_FT_CON            3    /* FBT confirm - for OTDS with RRP */
1812 #define DOT11_FT_ACTION_FT_ACK            4    /* FBT ack */
1813 
1814 /* DLS action types */
1815 #define DOT11_DLS_ACTION_REQ            0    /* DLS Request */
1816 #define DOT11_DLS_ACTION_RESP            1    /* DLS Response */
1817 #define DOT11_DLS_ACTION_TD            2    /* DLS Teardown */
1818 
1819 /* Wireless Network Management (WNM) action types */
1820 #define DOT11_WNM_ACTION_EVENT_REQ        0
1821 #define DOT11_WNM_ACTION_EVENT_REP        1
1822 #define DOT11_WNM_ACTION_DIAG_REQ        2
1823 #define DOT11_WNM_ACTION_DIAG_REP        3
1824 #define DOT11_WNM_ACTION_LOC_CFG_REQ        4
1825 #define DOT11_WNM_ACTION_LOC_RFG_RESP        5
1826 #define DOT11_WNM_ACTION_BSSTRANS_QUERY        6
1827 #define DOT11_WNM_ACTION_BSSTRANS_REQ        7
1828 #define DOT11_WNM_ACTION_BSSTRANS_RESP        8
1829 #define DOT11_WNM_ACTION_FMS_REQ        9
1830 #define DOT11_WNM_ACTION_FMS_RESP        10
1831 #define DOT11_WNM_ACTION_COL_INTRFRNCE_REQ    11
1832 #define DOT11_WNM_ACTION_COL_INTRFRNCE_REP    12
1833 #define DOT11_WNM_ACTION_TFS_REQ        13
1834 #define DOT11_WNM_ACTION_TFS_RESP        14
1835 #define DOT11_WNM_ACTION_TFS_NOTIFY_REQ        15
1836 #define DOT11_WNM_ACTION_WNM_SLEEP_REQ        16
1837 #define DOT11_WNM_ACTION_WNM_SLEEP_RESP        17
1838 #define DOT11_WNM_ACTION_TIMBC_REQ        18
1839 #define DOT11_WNM_ACTION_TIMBC_RESP        19
1840 #define DOT11_WNM_ACTION_QOS_TRFC_CAP_UPD    20
1841 #define DOT11_WNM_ACTION_CHAN_USAGE_REQ        21
1842 #define DOT11_WNM_ACTION_CHAN_USAGE_RESP    22
1843 #define DOT11_WNM_ACTION_DMS_REQ        23
1844 #define DOT11_WNM_ACTION_DMS_RESP        24
1845 #define DOT11_WNM_ACTION_TMNG_MEASUR_REQ    25
1846 #define DOT11_WNM_ACTION_NOTFCTN_REQ        26
1847 #define DOT11_WNM_ACTION_NOTFCTN_RESP        27
1848 #define DOT11_WNM_ACTION_TFS_NOTIFY_RESP    28
1849 
1850 /* Unprotected Wireless Network Management (WNM) action types */
1851 #define DOT11_UWNM_ACTION_TIM            0
1852 #define DOT11_UWNM_ACTION_TIMING_MEASUREMENT    1
1853 
1854 #define DOT11_MNG_COUNTRY_ID_LEN 3
1855 
1856 /* VHT category action types - 802.11ac D3.0 - 8.5.23.1 */
1857 #define DOT11_VHT_ACTION_CBF                0    /* Compressed Beamforming */
1858 #define DOT11_VHT_ACTION_GID_MGMT            1    /* Group ID Management */
1859 #define DOT11_VHT_ACTION_OPER_MODE_NOTIF    2    /* Operating mode notif'n */
1860 
1861 /* FILS category action types - 802.11ai D11.0 - 9.6.8.1 */
1862 #define DOT11_FILS_ACTION_DISCOVERY        34    /* FILS Discovery */
1863 
1864 /** DLS Request frame header */
1865 BWL_PRE_PACKED_STRUCT struct dot11_dls_req {
1866     uint8 category;            /* category of action frame (2) */
1867     uint8 action;                /* DLS action: req (0) */
1868     struct ether_addr    da;        /* destination address */
1869     struct ether_addr    sa;        /* source address */
1870     uint16 cap;                /* capability */
1871     uint16 timeout;            /* timeout value */
1872     uint8 data[1];                /* IE:support rate, extend support rate, HT cap */
1873 } BWL_POST_PACKED_STRUCT;
1874 typedef struct dot11_dls_req dot11_dls_req_t;
1875 #define DOT11_DLS_REQ_LEN 18    /* Fixed length */
1876 
1877 /** DLS response frame header */
1878 BWL_PRE_PACKED_STRUCT struct dot11_dls_resp {
1879     uint8 category;            /* category of action frame (2) */
1880     uint8 action;                /* DLS action: req (0) */
1881     uint16 status;                /* status code field */
1882     struct ether_addr    da;        /* destination address */
1883     struct ether_addr    sa;        /* source address */
1884     uint8 data[1];                /* optional: capability, rate ... */
1885 } BWL_POST_PACKED_STRUCT;
1886 typedef struct dot11_dls_resp dot11_dls_resp_t;
1887 #define DOT11_DLS_RESP_LEN 16    /* Fixed length */
1888 
1889 
1890 /* ************* 802.11v related definitions. ************* */
1891 
1892 /** BSS Management Transition Query frame header */
1893 BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_query {
1894     uint8 category;            /* category of action frame (10) */
1895     uint8 action;            /* WNM action: trans_query (6) */
1896     uint8 token;            /* dialog token */
1897     uint8 reason;            /* transition query reason */
1898     uint8 data[1];            /* Elements */
1899 } BWL_POST_PACKED_STRUCT;
1900 typedef struct dot11_bsstrans_query dot11_bsstrans_query_t;
1901 #define DOT11_BSSTRANS_QUERY_LEN 4    /* Fixed length */
1902 
1903 /* BTM transition reason */
1904 #define DOT11_BSSTRANS_REASON_UNSPECIFIED        0
1905 #define DOT11_BSSTRANS_REASON_EXC_FRAME_LOSS        1
1906 #define DOT11_BSSTRANS_REASON_EXC_TRAFFIC_DELAY        2
1907 #define DOT11_BSSTRANS_REASON_INSUFF_QOS_CAPACITY    3
1908 #define DOT11_BSSTRANS_REASON_FIRST_ASSOC        4
1909 #define DOT11_BSSTRANS_REASON_LOAD_BALANCING        5
1910 #define DOT11_BSSTRANS_REASON_BETTER_AP_FOUND        6
1911 #define DOT11_BSSTRANS_REASON_DEAUTH_RX            7
1912 #define DOT11_BSSTRANS_REASON_8021X_EAP_AUTH_FAIL    8
1913 #define DOT11_BSSTRANS_REASON_4WAY_HANDSHK_FAIL        9
1914 #define DOT11_BSSTRANS_REASON_MANY_REPLAYCNT_FAIL    10
1915 #define DOT11_BSSTRANS_REASON_MANY_DATAMIC_FAIL        11
1916 #define DOT11_BSSTRANS_REASON_EXCEED_MAX_RETRANS    12
1917 #define DOT11_BSSTRANS_REASON_MANY_BCAST_DISASSOC_RX    13
1918 #define DOT11_BSSTRANS_REASON_MANY_BCAST_DEAUTH_RX    14
1919 #define DOT11_BSSTRANS_REASON_PREV_TRANSITION_FAIL    15
1920 #define DOT11_BSSTRANS_REASON_LOW_RSSI            16
1921 #define DOT11_BSSTRANS_REASON_ROAM_FROM_NON_80211    17
1922 #define DOT11_BSSTRANS_REASON_RX_BTM_REQ        18
1923 #define DOT11_BSSTRANS_REASON_PREF_LIST_INCLUDED    19
1924 #define DOT11_BSSTRANS_REASON_LEAVING_ESS        20
1925 
1926 /** BSS Management Transition Request frame header */
1927 BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_req {
1928     uint8 category;            /* category of action frame (10) */
1929     uint8 action;            /* WNM action: trans_req (7) */
1930     uint8 token;            /* dialog token */
1931     uint8 reqmode;            /* transition request mode */
1932     uint16 disassoc_tmr;        /* disassociation timer */
1933     uint8 validity_intrvl;        /* validity interval */
1934     uint8 data[1];            /* optional: BSS term duration, ... */
1935                         /* ...session info URL, candidate list */
1936 } BWL_POST_PACKED_STRUCT;
1937 typedef struct dot11_bsstrans_req dot11_bsstrans_req_t;
1938 #define DOT11_BSSTRANS_REQ_LEN 7    /* Fixed length */
1939 
1940 /* BSS Mgmt Transition Request Mode Field - 802.11v */
1941 #define DOT11_BSSTRANS_REQMODE_PREF_LIST_INCL        0x01
1942 #define DOT11_BSSTRANS_REQMODE_ABRIDGED            0x02
1943 #define DOT11_BSSTRANS_REQMODE_DISASSOC_IMMINENT    0x04
1944 #define DOT11_BSSTRANS_REQMODE_BSS_TERM_INCL        0x08
1945 #define DOT11_BSSTRANS_REQMODE_ESS_DISASSOC_IMNT    0x10
1946 
1947 /** BSS Management transition response frame header */
1948 BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_resp {
1949     uint8 category;            /* category of action frame (10) */
1950     uint8 action;            /* WNM action: trans_resp (8) */
1951     uint8 token;            /* dialog token */
1952     uint8 status;            /* transition status */
1953     uint8 term_delay;        /* validity interval */
1954     uint8 data[1];            /* optional: BSSID target, candidate list */
1955 } BWL_POST_PACKED_STRUCT;
1956 typedef struct dot11_bsstrans_resp dot11_bsstrans_resp_t;
1957 #define DOT11_BSSTRANS_RESP_LEN 5    /* Fixed length */
1958 
1959 /* BSS Mgmt Transition Response Status Field */
1960 #define DOT11_BSSTRANS_RESP_STATUS_ACCEPT            0
1961 #define DOT11_BSSTRANS_RESP_STATUS_REJECT            1
1962 #define DOT11_BSSTRANS_RESP_STATUS_REJ_INSUFF_BCN        2
1963 #define DOT11_BSSTRANS_RESP_STATUS_REJ_INSUFF_CAP        3
1964 #define DOT11_BSSTRANS_RESP_STATUS_REJ_TERM_UNDESIRED        4
1965 #define DOT11_BSSTRANS_RESP_STATUS_REJ_TERM_DELAY_REQ        5
1966 #define DOT11_BSSTRANS_RESP_STATUS_REJ_BSS_LIST_PROVIDED    6
1967 #define DOT11_BSSTRANS_RESP_STATUS_REJ_NO_SUITABLE_BSS        7
1968 #define DOT11_BSSTRANS_RESP_STATUS_REJ_LEAVING_ESS        8
1969 
1970 
1971 /** BSS Max Idle Period element */
1972 BWL_PRE_PACKED_STRUCT struct dot11_bss_max_idle_period_ie {
1973     uint8 id;                /* 90, DOT11_MNG_BSS_MAX_IDLE_PERIOD_ID */
1974     uint8 len;
1975     uint16 max_idle_period;            /* in unit of 1000 TUs */
1976     uint8 idle_opt;
1977 } BWL_POST_PACKED_STRUCT;
1978 typedef struct dot11_bss_max_idle_period_ie dot11_bss_max_idle_period_ie_t;
1979 #define DOT11_BSS_MAX_IDLE_PERIOD_IE_LEN    3    /* bss max idle period IE size */
1980 #define DOT11_BSS_MAX_IDLE_PERIOD_OPT_PROTECTED    1    /* BSS max idle option */
1981 
1982 /** TIM Broadcast request element */
1983 BWL_PRE_PACKED_STRUCT struct dot11_timbc_req_ie {
1984     uint8 id;                /* 94, DOT11_MNG_TIMBC_REQ_ID */
1985     uint8 len;
1986     uint8 interval;                /* in unit of beacon interval */
1987 } BWL_POST_PACKED_STRUCT;
1988 typedef struct dot11_timbc_req_ie dot11_timbc_req_ie_t;
1989 #define DOT11_TIMBC_REQ_IE_LEN        1    /* Fixed length */
1990 
1991 /** TIM Broadcast request frame header */
1992 BWL_PRE_PACKED_STRUCT struct dot11_timbc_req {
1993     uint8 category;                /* category of action frame (10) */
1994     uint8 action;                /* WNM action: DOT11_WNM_ACTION_TIMBC_REQ(18) */
1995     uint8 token;                /* dialog token */
1996     uint8 data[1];                /* TIM broadcast request element */
1997 } BWL_POST_PACKED_STRUCT;
1998 typedef struct dot11_timbc_req dot11_timbc_req_t;
1999 #define DOT11_TIMBC_REQ_LEN        3    /* Fixed length */
2000 
2001 /** TIM Broadcast response element */
2002 BWL_PRE_PACKED_STRUCT struct dot11_timbc_resp_ie {
2003     uint8 id;                /* 95, DOT11_MNG_TIM_BROADCAST_RESP_ID */
2004     uint8 len;
2005     uint8 status;                /* status of add request */
2006     uint8 interval;                /* in unit of beacon interval */
2007     int32 offset;                /* in unit of ms */
2008     uint16 high_rate;            /* in unit of 0.5 Mb/s */
2009     uint16 low_rate;            /* in unit of 0.5 Mb/s */
2010 } BWL_POST_PACKED_STRUCT;
2011 typedef struct dot11_timbc_resp_ie dot11_timbc_resp_ie_t;
2012 #define DOT11_TIMBC_DENY_RESP_IE_LEN    1    /* Deny. Fixed length */
2013 #define DOT11_TIMBC_ACCEPT_RESP_IE_LEN    10    /* Accept. Fixed length */
2014 
2015 #define DOT11_TIMBC_STATUS_ACCEPT        0
2016 #define DOT11_TIMBC_STATUS_ACCEPT_TSTAMP    1
2017 #define DOT11_TIMBC_STATUS_DENY            2
2018 #define DOT11_TIMBC_STATUS_OVERRIDDEN        3
2019 #define DOT11_TIMBC_STATUS_RESERVED        4
2020 
2021 /** TIM Broadcast request frame header */
2022 BWL_PRE_PACKED_STRUCT struct dot11_timbc_resp {
2023     uint8 category;            /* category of action frame (10) */
2024     uint8 action;            /* action: DOT11_WNM_ACTION_TIMBC_RESP(19) */
2025     uint8 token;            /* dialog token */
2026     uint8 data[1];            /* TIM broadcast response element */
2027 } BWL_POST_PACKED_STRUCT;
2028 typedef struct dot11_timbc_resp dot11_timbc_resp_t;
2029 #define DOT11_TIMBC_RESP_LEN    3    /* Fixed length */
2030 
2031 /** TIM element */
2032 BWL_PRE_PACKED_STRUCT struct dot11_tim_ie {
2033     uint8 id;            /* 5, DOT11_MNG_TIM_ID     */
2034     uint8 len;            /* 4 - 255 */
2035     uint8 dtim_count;        /* DTIM decrementing counter */
2036     uint8 dtim_period;        /* DTIM period */
2037     uint8 bitmap_control;        /* AID 0 + bitmap offset */
2038     uint8 pvb[1];            /* Partial Virtual Bitmap, variable length */
2039 } BWL_POST_PACKED_STRUCT;
2040 typedef struct dot11_tim_ie dot11_tim_ie_t;
2041 #define DOT11_TIM_IE_FIXED_LEN    3    /* Fixed length, without id and len */
2042 #define DOT11_TIM_IE_FIXED_TOTAL_LEN    5    /* Fixed length, with id and len */
2043 
2044 /** TIM Broadcast frame header */
2045 BWL_PRE_PACKED_STRUCT struct dot11_timbc {
2046     uint8 category;            /* category of action frame (11) */
2047     uint8 action;            /* action: TIM (0) */
2048     uint8 check_beacon;        /* need to check-beacon */
2049     uint8 tsf[8];            /* Time Synchronization Function */
2050     dot11_tim_ie_t tim_ie;        /* TIM element */
2051 } BWL_POST_PACKED_STRUCT;
2052 typedef struct dot11_timbc dot11_timbc_t;
2053 #define DOT11_TIMBC_HDR_LEN    (sizeof(dot11_timbc_t) - sizeof(dot11_tim_ie_t))
2054 #define DOT11_TIMBC_FIXED_LEN    (sizeof(dot11_timbc_t) - 1)    /* Fixed length */
2055 #define DOT11_TIMBC_LEN            11    /* Fixed length */
2056 
2057 /** TCLAS frame classifier type */
2058 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_hdr {
2059     uint8 type;
2060     uint8 mask;
2061     uint8 data[1];
2062 } BWL_POST_PACKED_STRUCT;
2063 typedef struct dot11_tclas_fc_hdr dot11_tclas_fc_hdr_t;
2064 #define DOT11_TCLAS_FC_HDR_LEN        2    /* Fixed length */
2065 
2066 #define DOT11_TCLAS_MASK_0        0x1
2067 #define DOT11_TCLAS_MASK_1        0x2
2068 #define DOT11_TCLAS_MASK_2        0x4
2069 #define DOT11_TCLAS_MASK_3        0x8
2070 #define DOT11_TCLAS_MASK_4        0x10
2071 #define DOT11_TCLAS_MASK_5        0x20
2072 #define DOT11_TCLAS_MASK_6        0x40
2073 #define DOT11_TCLAS_MASK_7        0x80
2074 
2075 #define DOT11_TCLAS_FC_0_ETH        0
2076 #define DOT11_TCLAS_FC_1_IP        1
2077 #define DOT11_TCLAS_FC_2_8021Q        2
2078 #define DOT11_TCLAS_FC_3_OFFSET        3
2079 #define DOT11_TCLAS_FC_4_IP_HIGHER    4
2080 #define DOT11_TCLAS_FC_5_8021D        5
2081 
2082 /** TCLAS frame classifier type 0 parameters for Ethernet */
2083 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_0_eth {
2084     uint8 type;
2085     uint8 mask;
2086     uint8 sa[ETHER_ADDR_LEN];
2087     uint8 da[ETHER_ADDR_LEN];
2088     uint16 eth_type;
2089 } BWL_POST_PACKED_STRUCT;
2090 typedef struct dot11_tclas_fc_0_eth dot11_tclas_fc_0_eth_t;
2091 #define DOT11_TCLAS_FC_0_ETH_LEN    16
2092 
2093 /** TCLAS frame classifier type 1 parameters for IPV4 */
2094 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_1_ipv4 {
2095     uint8 type;
2096     uint8 mask;
2097     uint8 version;
2098     uint32 src_ip;
2099     uint32 dst_ip;
2100     uint16 src_port;
2101     uint16 dst_port;
2102     uint8 dscp;
2103     uint8 protocol;
2104     uint8 reserved;
2105 } BWL_POST_PACKED_STRUCT;
2106 typedef struct dot11_tclas_fc_1_ipv4 dot11_tclas_fc_1_ipv4_t;
2107 #define DOT11_TCLAS_FC_1_IPV4_LEN    18
2108 
2109 /** TCLAS frame classifier type 2 parameters for 802.1Q */
2110 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_2_8021q {
2111     uint8 type;
2112     uint8 mask;
2113     uint16 tci;
2114 } BWL_POST_PACKED_STRUCT;
2115 typedef struct dot11_tclas_fc_2_8021q dot11_tclas_fc_2_8021q_t;
2116 #define DOT11_TCLAS_FC_2_8021Q_LEN    4
2117 
2118 /** TCLAS frame classifier type 3 parameters for filter offset */
2119 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_3_filter {
2120     uint8 type;
2121     uint8 mask;
2122     uint16 offset;
2123     uint8 data[1];
2124 } BWL_POST_PACKED_STRUCT;
2125 typedef struct dot11_tclas_fc_3_filter dot11_tclas_fc_3_filter_t;
2126 #define DOT11_TCLAS_FC_3_FILTER_LEN    4
2127 
2128 /** TCLAS frame classifier type 4 parameters for IPV4 is the same as TCLAS type 1 */
2129 typedef struct dot11_tclas_fc_1_ipv4 dot11_tclas_fc_4_ipv4_t;
2130 #define DOT11_TCLAS_FC_4_IPV4_LEN    DOT11_TCLAS_FC_1_IPV4_LEN
2131 
2132 /** TCLAS frame classifier type 4 parameters for IPV6 */
2133 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_4_ipv6 {
2134     uint8 type;
2135     uint8 mask;
2136     uint8 version;
2137     uint8 saddr[16];
2138     uint8 daddr[16];
2139     uint16 src_port;
2140     uint16 dst_port;
2141     uint8 dscp;
2142     uint8 nexthdr;
2143     uint8 flow_lbl[3];
2144 } BWL_POST_PACKED_STRUCT;
2145 typedef struct dot11_tclas_fc_4_ipv6 dot11_tclas_fc_4_ipv6_t;
2146 #define DOT11_TCLAS_FC_4_IPV6_LEN    44
2147 
2148 /** TCLAS frame classifier type 5 parameters for 802.1D */
2149 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_5_8021d {
2150     uint8 type;
2151     uint8 mask;
2152     uint8 pcp;
2153     uint8 cfi;
2154     uint16 vid;
2155 } BWL_POST_PACKED_STRUCT;
2156 typedef struct dot11_tclas_fc_5_8021d dot11_tclas_fc_5_8021d_t;
2157 #define DOT11_TCLAS_FC_5_8021D_LEN    6
2158 
2159 /** TCLAS frame classifier type parameters */
2160 BWL_PRE_PACKED_STRUCT union dot11_tclas_fc {
2161     uint8 data[1];
2162     dot11_tclas_fc_hdr_t hdr;
2163     dot11_tclas_fc_0_eth_t t0_eth;
2164     dot11_tclas_fc_1_ipv4_t    t1_ipv4;
2165     dot11_tclas_fc_2_8021q_t t2_8021q;
2166     dot11_tclas_fc_3_filter_t t3_filter;
2167     dot11_tclas_fc_4_ipv4_t    t4_ipv4;
2168     dot11_tclas_fc_4_ipv6_t    t4_ipv6;
2169     dot11_tclas_fc_5_8021d_t t5_8021d;
2170 } BWL_POST_PACKED_STRUCT;
2171 typedef union dot11_tclas_fc dot11_tclas_fc_t;
2172 
2173 #define DOT11_TCLAS_FC_MIN_LEN        4    /* Classifier Type 2 has the min size */
2174 #define DOT11_TCLAS_FC_MAX_LEN        254
2175 
2176 /** TCLAS element */
2177 BWL_PRE_PACKED_STRUCT struct dot11_tclas_ie {
2178     uint8 id;                /* 14, DOT11_MNG_TCLAS_ID */
2179     uint8 len;
2180     uint8 user_priority;
2181     dot11_tclas_fc_t fc;
2182 } BWL_POST_PACKED_STRUCT;
2183 typedef struct dot11_tclas_ie dot11_tclas_ie_t;
2184 #define DOT11_TCLAS_IE_LEN        3    /* Fixed length, include id and len */
2185 
2186 /** TCLAS processing element */
2187 BWL_PRE_PACKED_STRUCT struct dot11_tclas_proc_ie {
2188     uint8 id;                /* 44, DOT11_MNG_TCLAS_PROC_ID */
2189     uint8 len;
2190     uint8 process;
2191 } BWL_POST_PACKED_STRUCT;
2192 typedef struct dot11_tclas_proc_ie dot11_tclas_proc_ie_t;
2193 #define DOT11_TCLAS_PROC_IE_LEN        3    /* Fixed length, include id and len */
2194 
2195 #define DOT11_TCLAS_PROC_MATCHALL    0    /* All high level element need to match */
2196 #define DOT11_TCLAS_PROC_MATCHONE    1    /* One high level element need to match */
2197 #define DOT11_TCLAS_PROC_NONMATCH    2    /* Non match to any high level element */
2198 
2199 
2200 /* TSPEC element defined in 802.11 std section 8.4.2.32 - Not supported */
2201 #define DOT11_TSPEC_IE_LEN        57    /* Fixed length */
2202 
2203 /** TFS request element */
2204 BWL_PRE_PACKED_STRUCT struct dot11_tfs_req_ie {
2205     uint8 id;                /* 91, DOT11_MNG_TFS_REQUEST_ID */
2206     uint8 len;
2207     uint8 tfs_id;
2208     uint8 actcode;
2209     uint8 data[1];
2210 } BWL_POST_PACKED_STRUCT;
2211 typedef struct dot11_tfs_req_ie dot11_tfs_req_ie_t;
2212 #define DOT11_TFS_REQ_IE_LEN        2    /* Fixed length, without id and len */
2213 
2214 /** TFS request action codes (bitfield) */
2215 #define DOT11_TFS_ACTCODE_DELETE    1
2216 #define DOT11_TFS_ACTCODE_NOTIFY    2
2217 
2218 /** TFS request subelement IDs */
2219 #define DOT11_TFS_REQ_TFS_SE_ID        1
2220 #define DOT11_TFS_REQ_VENDOR_SE_ID    221
2221 
2222 /** TFS subelement */
2223 BWL_PRE_PACKED_STRUCT struct dot11_tfs_se {
2224     uint8 sub_id;
2225     uint8 len;
2226     uint8 data[1];                /* TCLAS element(s) + optional TCLAS proc */
2227 } BWL_POST_PACKED_STRUCT;
2228 typedef struct dot11_tfs_se dot11_tfs_se_t;
2229 
2230 
2231 /** TFS response element */
2232 BWL_PRE_PACKED_STRUCT struct dot11_tfs_resp_ie {
2233     uint8 id;                /* 92, DOT11_MNG_TFS_RESPONSE_ID */
2234     uint8 len;
2235     uint8 tfs_id;
2236     uint8 data[1];
2237 } BWL_POST_PACKED_STRUCT;
2238 typedef struct dot11_tfs_resp_ie dot11_tfs_resp_ie_t;
2239 #define DOT11_TFS_RESP_IE_LEN        1    /* Fixed length, without id and len */
2240 
2241 /** TFS response subelement IDs (same subelments, but different IDs than in TFS request */
2242 #define DOT11_TFS_RESP_TFS_STATUS_SE_ID        1
2243 #define DOT11_TFS_RESP_TFS_SE_ID        2
2244 #define DOT11_TFS_RESP_VENDOR_SE_ID        221
2245 
2246 /** TFS status subelement */
2247 BWL_PRE_PACKED_STRUCT struct dot11_tfs_status_se {
2248     uint8 sub_id;                /* 92, DOT11_MNG_TFS_RESPONSE_ID */
2249     uint8 len;
2250     uint8 resp_st;
2251     uint8 data[1];                /* Potential dot11_tfs_se_t included */
2252 } BWL_POST_PACKED_STRUCT;
2253 typedef struct dot11_tfs_status_se dot11_tfs_status_se_t;
2254 #define DOT11_TFS_STATUS_SE_LEN            1    /* Fixed length, without id and len */
2255 
2256 /* Following Definition should be merged to FMS_TFS macro below */
2257 /* TFS Response status code. Identical to FMS Element status, without N/A  */
2258 #define DOT11_TFS_STATUS_ACCEPT            0
2259 #define DOT11_TFS_STATUS_DENY_FORMAT        1
2260 #define DOT11_TFS_STATUS_DENY_RESOURCE        2
2261 #define DOT11_TFS_STATUS_DENY_POLICY        4
2262 #define DOT11_TFS_STATUS_DENY_UNSPECIFIED    5
2263 #define DOT11_TFS_STATUS_ALTPREF_POLICY        7
2264 #define DOT11_TFS_STATUS_ALTPREF_TCLAS_UNSUPP    14
2265 
2266 /* FMS Element Status and TFS Response Status Definition */
2267 #define DOT11_FMS_TFS_STATUS_ACCEPT        0
2268 #define DOT11_FMS_TFS_STATUS_DENY_FORMAT    1
2269 #define DOT11_FMS_TFS_STATUS_DENY_RESOURCE    2
2270 #define DOT11_FMS_TFS_STATUS_DENY_MULTIPLE_DI    3
2271 #define DOT11_FMS_TFS_STATUS_DENY_POLICY    4
2272 #define DOT11_FMS_TFS_STATUS_DENY_UNSPECIFIED    5
2273 #define DOT11_FMS_TFS_STATUS_ALT_DIFF_DI    6
2274 #define DOT11_FMS_TFS_STATUS_ALT_POLICY        7
2275 #define DOT11_FMS_TFS_STATUS_ALT_CHANGE_DI    8
2276 #define DOT11_FMS_TFS_STATUS_ALT_MCRATE        9
2277 #define DOT11_FMS_TFS_STATUS_TERM_POLICY    10
2278 #define DOT11_FMS_TFS_STATUS_TERM_RESOURCE    11
2279 #define DOT11_FMS_TFS_STATUS_TERM_HIGHER_PRIO    12
2280 #define DOT11_FMS_TFS_STATUS_ALT_CHANGE_MDI    13
2281 #define DOT11_FMS_TFS_STATUS_ALT_TCLAS_UNSUPP    14
2282 
2283 /** TFS Management Request frame header */
2284 BWL_PRE_PACKED_STRUCT struct dot11_tfs_req {
2285     uint8 category;                /* category of action frame (10) */
2286     uint8 action;                /* WNM action: TFS request (13) */
2287     uint8 token;                /* dialog token */
2288     uint8 data[1];                /* Elements */
2289 } BWL_POST_PACKED_STRUCT;
2290 typedef struct dot11_tfs_req dot11_tfs_req_t;
2291 #define DOT11_TFS_REQ_LEN        3    /* Fixed length */
2292 
2293 /** TFS Management Response frame header */
2294 BWL_PRE_PACKED_STRUCT struct dot11_tfs_resp {
2295     uint8 category;                /* category of action frame (10) */
2296     uint8 action;                /* WNM action: TFS request (14) */
2297     uint8 token;                /* dialog token */
2298     uint8 data[1];                /* Elements */
2299 } BWL_POST_PACKED_STRUCT;
2300 typedef struct dot11_tfs_resp dot11_tfs_resp_t;
2301 #define DOT11_TFS_RESP_LEN        3    /* Fixed length */
2302 
2303 /** TFS Management Notify frame request header */
2304 BWL_PRE_PACKED_STRUCT struct dot11_tfs_notify_req {
2305     uint8 category;                /* category of action frame (10) */
2306     uint8 action;                /* WNM action: TFS notify request (15) */
2307     uint8 tfs_id_cnt;            /* TFS IDs count */
2308     uint8 tfs_id[1];            /* Array of TFS IDs */
2309 } BWL_POST_PACKED_STRUCT;
2310 typedef struct dot11_tfs_notify_req dot11_tfs_notify_req_t;
2311 #define DOT11_TFS_NOTIFY_REQ_LEN    3    /* Fixed length */
2312 
2313 /** TFS Management Notify frame response header */
2314 BWL_PRE_PACKED_STRUCT struct dot11_tfs_notify_resp {
2315     uint8 category;                /* category of action frame (10) */
2316     uint8 action;                /* WNM action: TFS notify response (28) */
2317     uint8 tfs_id_cnt;            /* TFS IDs count */
2318     uint8 tfs_id[1];            /* Array of TFS IDs */
2319 } BWL_POST_PACKED_STRUCT;
2320 typedef struct dot11_tfs_notify_resp dot11_tfs_notify_resp_t;
2321 #define DOT11_TFS_NOTIFY_RESP_LEN    3    /* Fixed length */
2322 
2323 
2324 /** WNM-Sleep Management Request frame header */
2325 BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_req {
2326     uint8 category;                /* category of action frame (10) */
2327     uint8 action;                /* WNM action: wnm-sleep request (16) */
2328     uint8 token;                /* dialog token */
2329     uint8 data[1];                /* Elements */
2330 } BWL_POST_PACKED_STRUCT;
2331 typedef struct dot11_wnm_sleep_req dot11_wnm_sleep_req_t;
2332 #define DOT11_WNM_SLEEP_REQ_LEN        3    /* Fixed length */
2333 
2334 /** WNM-Sleep Management Response frame header */
2335 BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_resp {
2336     uint8 category;                /* category of action frame (10) */
2337     uint8 action;                /* WNM action: wnm-sleep request (17) */
2338     uint8 token;                /* dialog token */
2339     uint16 key_len;                /* key data length */
2340     uint8 data[1];                /* Elements */
2341 } BWL_POST_PACKED_STRUCT;
2342 typedef struct dot11_wnm_sleep_resp dot11_wnm_sleep_resp_t;
2343 #define DOT11_WNM_SLEEP_RESP_LEN    5    /* Fixed length */
2344 
2345 #define DOT11_WNM_SLEEP_SUBELEM_ID_GTK    0
2346 #define DOT11_WNM_SLEEP_SUBELEM_ID_IGTK    1
2347 
2348 BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_subelem_gtk {
2349     uint8 sub_id;
2350     uint8 len;
2351     uint16 key_info;
2352     uint8 key_length;
2353     uint8 rsc[8];
2354     uint8 key[1];
2355 } BWL_POST_PACKED_STRUCT;
2356 typedef struct dot11_wnm_sleep_subelem_gtk dot11_wnm_sleep_subelem_gtk_t;
2357 #define DOT11_WNM_SLEEP_SUBELEM_GTK_FIXED_LEN    11    /* without sub_id, len, and key */
2358 #define DOT11_WNM_SLEEP_SUBELEM_GTK_MAX_LEN    43    /* without sub_id and len */
2359 
2360 BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_subelem_igtk {
2361     uint8 sub_id;
2362     uint8 len;
2363     uint16 key_id;
2364     uint8 pn[6];
2365     uint8 key[16];
2366 } BWL_POST_PACKED_STRUCT;
2367 typedef struct dot11_wnm_sleep_subelem_igtk dot11_wnm_sleep_subelem_igtk_t;
2368 #define DOT11_WNM_SLEEP_SUBELEM_IGTK_LEN 24    /* Fixed length */
2369 
2370 BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_ie {
2371     uint8 id;                /* 93, DOT11_MNG_WNM_SLEEP_MODE_ID */
2372     uint8 len;
2373     uint8 act_type;
2374     uint8 resp_status;
2375     uint16 interval;
2376 } BWL_POST_PACKED_STRUCT;
2377 typedef struct dot11_wnm_sleep_ie dot11_wnm_sleep_ie_t;
2378 #define DOT11_WNM_SLEEP_IE_LEN        4    /* Fixed length */
2379 
2380 #define DOT11_WNM_SLEEP_ACT_TYPE_ENTER    0
2381 #define DOT11_WNM_SLEEP_ACT_TYPE_EXIT    1
2382 
2383 #define DOT11_WNM_SLEEP_RESP_ACCEPT    0
2384 #define DOT11_WNM_SLEEP_RESP_UPDATE    1
2385 #define DOT11_WNM_SLEEP_RESP_DENY    2
2386 #define DOT11_WNM_SLEEP_RESP_DENY_TEMP    3
2387 #define DOT11_WNM_SLEEP_RESP_DENY_KEY    4
2388 #define DOT11_WNM_SLEEP_RESP_DENY_INUSE    5
2389 #define DOT11_WNM_SLEEP_RESP_LAST    6
2390 
2391 /** DMS Management Request frame header */
2392 BWL_PRE_PACKED_STRUCT struct dot11_dms_req {
2393     uint8 category;                /* category of action frame (10) */
2394     uint8 action;                /* WNM action: dms request (23) */
2395     uint8 token;                /* dialog token */
2396     uint8 data[1];                /* Elements */
2397 } BWL_POST_PACKED_STRUCT;
2398 typedef struct dot11_dms_req dot11_dms_req_t;
2399 #define DOT11_DMS_REQ_LEN        3    /* Fixed length */
2400 
2401 /** DMS Management Response frame header */
2402 BWL_PRE_PACKED_STRUCT struct dot11_dms_resp {
2403     uint8 category;                /* category of action frame (10) */
2404     uint8 action;                /* WNM action: dms request (24) */
2405     uint8 token;                /* dialog token */
2406     uint8 data[1];                /* Elements */
2407 } BWL_POST_PACKED_STRUCT;
2408 typedef struct dot11_dms_resp dot11_dms_resp_t;
2409 #define DOT11_DMS_RESP_LEN        3    /* Fixed length */
2410 
2411 /** DMS request element */
2412 BWL_PRE_PACKED_STRUCT struct dot11_dms_req_ie {
2413     uint8 id;                /* 99, DOT11_MNG_DMS_REQUEST_ID */
2414     uint8 len;
2415     uint8 data[1];
2416 } BWL_POST_PACKED_STRUCT;
2417 typedef struct dot11_dms_req_ie dot11_dms_req_ie_t;
2418 #define DOT11_DMS_REQ_IE_LEN        2    /* Fixed length */
2419 
2420 /** DMS response element */
2421 BWL_PRE_PACKED_STRUCT struct dot11_dms_resp_ie {
2422     uint8 id;                /* 100, DOT11_MNG_DMS_RESPONSE_ID */
2423     uint8 len;
2424     uint8 data[1];
2425 } BWL_POST_PACKED_STRUCT;
2426 typedef struct dot11_dms_resp_ie dot11_dms_resp_ie_t;
2427 #define DOT11_DMS_RESP_IE_LEN        2    /* Fixed length */
2428 
2429 /** DMS request descriptor */
2430 BWL_PRE_PACKED_STRUCT struct dot11_dms_req_desc {
2431     uint8 dms_id;
2432     uint8 len;
2433     uint8 type;
2434     uint8 data[1];
2435 } BWL_POST_PACKED_STRUCT;
2436 typedef struct dot11_dms_req_desc dot11_dms_req_desc_t;
2437 #define DOT11_DMS_REQ_DESC_LEN        3    /* Fixed length */
2438 
2439 #define DOT11_DMS_REQ_TYPE_ADD        0
2440 #define DOT11_DMS_REQ_TYPE_REMOVE    1
2441 #define DOT11_DMS_REQ_TYPE_CHANGE    2
2442 
2443 /** DMS response status */
2444 BWL_PRE_PACKED_STRUCT struct dot11_dms_resp_st {
2445     uint8 dms_id;
2446     uint8 len;
2447     uint8 type;
2448     uint16 lsc;
2449     uint8 data[1];
2450 } BWL_POST_PACKED_STRUCT;
2451 typedef struct dot11_dms_resp_st dot11_dms_resp_st_t;
2452 #define DOT11_DMS_RESP_STATUS_LEN    5    /* Fixed length */
2453 
2454 #define DOT11_DMS_RESP_TYPE_ACCEPT    0
2455 #define DOT11_DMS_RESP_TYPE_DENY    1
2456 #define DOT11_DMS_RESP_TYPE_TERM    2
2457 
2458 #define DOT11_DMS_RESP_LSC_UNSUPPORTED    0xFFFF
2459 
2460 /** WNM-Notification Request frame header */
2461 BWL_PRE_PACKED_STRUCT struct dot11_wnm_notif_req {
2462     uint8 category;                /* category of action frame (10) */
2463     uint8 action;                /* WNM action: Notification request (26) */
2464     uint8 token;                /* dialog token */
2465     uint8 type;                   /* type */
2466     uint8 data[1];                /* Sub-elements */
2467 } BWL_POST_PACKED_STRUCT;
2468 typedef struct dot11_wnm_notif_req dot11_wnm_notif_req_t;
2469 #define DOT11_WNM_NOTIF_REQ_LEN        4    /* Fixed length */
2470 
2471 /** FMS Management Request frame header */
2472 BWL_PRE_PACKED_STRUCT struct dot11_fms_req {
2473     uint8 category;                /* category of action frame (10) */
2474     uint8 action;                /* WNM action: fms request (9) */
2475     uint8 token;                /* dialog token */
2476     uint8 data[1];                /* Elements */
2477 } BWL_POST_PACKED_STRUCT;
2478 typedef struct dot11_fms_req dot11_fms_req_t;
2479 #define DOT11_FMS_REQ_LEN        3    /* Fixed length */
2480 
2481 /** FMS Management Response frame header */
2482 BWL_PRE_PACKED_STRUCT struct dot11_fms_resp {
2483     uint8 category;                /* category of action frame (10) */
2484     uint8 action;                /* WNM action: fms request (10) */
2485     uint8 token;                /* dialog token */
2486     uint8 data[1];                /* Elements */
2487 } BWL_POST_PACKED_STRUCT;
2488 typedef struct dot11_fms_resp dot11_fms_resp_t;
2489 #define DOT11_FMS_RESP_LEN        3    /* Fixed length */
2490 
2491 /** FMS Descriptor element */
2492 BWL_PRE_PACKED_STRUCT struct dot11_fms_desc {
2493     uint8 id;
2494     uint8 len;
2495     uint8 num_fms_cnt;
2496     uint8 data[1];
2497 } BWL_POST_PACKED_STRUCT;
2498 typedef struct dot11_fms_desc dot11_fms_desc_t;
2499 #define DOT11_FMS_DESC_LEN        1    /* Fixed length */
2500 
2501 #define DOT11_FMS_CNTR_MAX        0x8
2502 #define DOT11_FMS_CNTR_ID_MASK        0x7
2503 #define DOT11_FMS_CNTR_ID_SHIFT        0x0
2504 #define DOT11_FMS_CNTR_COUNT_MASK    0xf1
2505 #define DOT11_FMS_CNTR_SHIFT        0x3
2506 
2507 /** FMS request element */
2508 BWL_PRE_PACKED_STRUCT struct dot11_fms_req_ie {
2509     uint8 id;
2510     uint8 len;
2511     uint8 fms_token;            /* token used to identify fms stream set */
2512     uint8 data[1];
2513 } BWL_POST_PACKED_STRUCT;
2514 typedef struct dot11_fms_req_ie dot11_fms_req_ie_t;
2515 #define DOT11_FMS_REQ_IE_FIX_LEN        1    /* Fixed length */
2516 
2517 BWL_PRE_PACKED_STRUCT struct dot11_rate_id_field {
2518     uint8 mask;
2519     uint8 mcs_idx;
2520     uint16 rate;
2521 } BWL_POST_PACKED_STRUCT;
2522 typedef struct dot11_rate_id_field dot11_rate_id_field_t;
2523 #define DOT11_RATE_ID_FIELD_MCS_SEL_MASK    0x7
2524 #define DOT11_RATE_ID_FIELD_MCS_SEL_OFFSET    0
2525 #define DOT11_RATE_ID_FIELD_RATETYPE_MASK    0x18
2526 #define DOT11_RATE_ID_FIELD_RATETYPE_OFFSET    3
2527 #define DOT11_RATE_ID_FIELD_LEN        sizeof(dot11_rate_id_field_t)
2528 
2529 /** FMS request subelements */
2530 BWL_PRE_PACKED_STRUCT struct dot11_fms_se {
2531     uint8 sub_id;
2532     uint8 len;
2533     uint8 interval;
2534     uint8 max_interval;
2535     dot11_rate_id_field_t rate;
2536     uint8 data[1];
2537 } BWL_POST_PACKED_STRUCT;
2538 typedef struct dot11_fms_se dot11_fms_se_t;
2539 #define DOT11_FMS_REQ_SE_LEN        6    /* Fixed length */
2540 
2541 #define DOT11_FMS_REQ_SE_ID_FMS        1    /* FMS subelement */
2542 #define DOT11_FMS_REQ_SE_ID_VS        221    /* Vendor Specific subelement */
2543 
2544 /** FMS response element */
2545 BWL_PRE_PACKED_STRUCT struct dot11_fms_resp_ie {
2546     uint8 id;
2547     uint8 len;
2548     uint8 fms_token;
2549     uint8 data[1];
2550 } BWL_POST_PACKED_STRUCT;
2551 typedef struct dot11_fms_resp_ie dot11_fms_resp_ie_t;
2552 #define DOT11_FMS_RESP_IE_FIX_LEN        1    /* Fixed length */
2553 
2554 /* FMS status subelements */
2555 #define DOT11_FMS_STATUS_SE_ID_FMS    1    /* FMS Status */
2556 #define DOT11_FMS_STATUS_SE_ID_TCLAS    2    /* TCLAS Status */
2557 #define DOT11_FMS_STATUS_SE_ID_VS    221    /* Vendor Specific subelement */
2558 
2559 /** FMS status subelement */
2560 BWL_PRE_PACKED_STRUCT struct dot11_fms_status_se {
2561     uint8 sub_id;
2562     uint8 len;
2563     uint8 status;
2564     uint8 interval;
2565     uint8 max_interval;
2566     uint8 fmsid;
2567     uint8 counter;
2568     dot11_rate_id_field_t rate;
2569     uint8 mcast_addr[ETHER_ADDR_LEN];
2570 } BWL_POST_PACKED_STRUCT;
2571 typedef struct dot11_fms_status_se dot11_fms_status_se_t;
2572 #define DOT11_FMS_STATUS_SE_LEN        15    /* Fixed length */
2573 
2574 /** TCLAS status subelement */
2575 BWL_PRE_PACKED_STRUCT struct dot11_tclas_status_se {
2576     uint8 sub_id;
2577     uint8 len;
2578     uint8 fmsid;
2579     uint8 data[1];
2580 } BWL_POST_PACKED_STRUCT;
2581 typedef struct dot11_tclas_status_se dot11_tclas_status_se_t;
2582 #define DOT11_TCLAS_STATUS_SE_LEN        1    /* Fixed length */
2583 
2584 BWL_PRE_PACKED_STRUCT struct dot11_addba_req {
2585     uint8 category;                /* category of action frame (3) */
2586     uint8 action;                /* action: addba req */
2587     uint8 token;                /* identifier */
2588     uint16 addba_param_set;        /* parameter set */
2589     uint16 timeout;                /* timeout in seconds */
2590     uint16 start_seqnum;        /* starting sequence number */
2591 } BWL_POST_PACKED_STRUCT;
2592 typedef struct dot11_addba_req dot11_addba_req_t;
2593 #define DOT11_ADDBA_REQ_LEN        9    /* length of addba req frame */
2594 
2595 BWL_PRE_PACKED_STRUCT struct dot11_addba_resp {
2596     uint8 category;                /* category of action frame (3) */
2597     uint8 action;                /* action: addba resp */
2598     uint8 token;                /* identifier */
2599     uint16 status;                /* status of add request */
2600     uint16 addba_param_set;            /* negotiated parameter set */
2601     uint16 timeout;                /* negotiated timeout in seconds */
2602 } BWL_POST_PACKED_STRUCT;
2603 typedef struct dot11_addba_resp dot11_addba_resp_t;
2604 #define DOT11_ADDBA_RESP_LEN        9    /* length of addba resp frame */
2605 
2606 /* DELBA action parameters */
2607 #define DOT11_DELBA_PARAM_INIT_MASK    0x0800    /* initiator mask */
2608 #define DOT11_DELBA_PARAM_INIT_SHIFT    11    /* initiator shift */
2609 #define DOT11_DELBA_PARAM_TID_MASK    0xf000    /* tid mask */
2610 #define DOT11_DELBA_PARAM_TID_SHIFT    12    /* tid shift */
2611 
2612 BWL_PRE_PACKED_STRUCT struct dot11_delba {
2613     uint8 category;                /* category of action frame (3) */
2614     uint8 action;                /* action: addba req */
2615     uint16 delba_param_set;            /* paarmeter set */
2616     uint16 reason;                /* reason for dellba */
2617 } BWL_POST_PACKED_STRUCT;
2618 typedef struct dot11_delba dot11_delba_t;
2619 #define DOT11_DELBA_LEN            6    /* length of delba frame */
2620 
2621 /* SA Query action field value */
2622 #define SA_QUERY_REQUEST        0
2623 #define SA_QUERY_RESPONSE        1
2624 
2625 /* ************* 802.11r related definitions. ************* */
2626 
2627 /** Over-the-DS Fast Transition Request frame header */
2628 BWL_PRE_PACKED_STRUCT struct dot11_ft_req {
2629     uint8 category;            /* category of action frame (6) */
2630     uint8 action;            /* action: ft req */
2631     uint8 sta_addr[ETHER_ADDR_LEN];
2632     uint8 tgt_ap_addr[ETHER_ADDR_LEN];
2633     uint8 data[1];            /* Elements */
2634 } BWL_POST_PACKED_STRUCT;
2635 typedef struct dot11_ft_req dot11_ft_req_t;
2636 #define DOT11_FT_REQ_FIXED_LEN 14
2637 
2638 /** Over-the-DS Fast Transition Response frame header */
2639 BWL_PRE_PACKED_STRUCT struct dot11_ft_res {
2640     uint8 category;            /* category of action frame (6) */
2641     uint8 action;            /* action: ft resp */
2642     uint8 sta_addr[ETHER_ADDR_LEN];
2643     uint8 tgt_ap_addr[ETHER_ADDR_LEN];
2644     uint16 status;            /* status code */
2645     uint8 data[1];            /* Elements */
2646 } BWL_POST_PACKED_STRUCT;
2647 typedef struct dot11_ft_res dot11_ft_res_t;
2648 #define DOT11_FT_RES_FIXED_LEN 16
2649 
2650 /** RDE RIC Data Element. */
2651 BWL_PRE_PACKED_STRUCT struct dot11_rde_ie {
2652     uint8 id;            /* 11r, DOT11_MNG_RDE_ID */
2653     uint8 length;
2654     uint8 rde_id;            /* RDE identifier. */
2655     uint8 rd_count;            /* Resource Descriptor Count. */
2656     uint16 status;            /* Status Code. */
2657 } BWL_POST_PACKED_STRUCT;
2658 typedef struct dot11_rde_ie dot11_rde_ie_t;
2659 
2660 /* 11r - Size of the RDE (RIC Data Element) IE, including TLV header. */
2661 #define DOT11_MNG_RDE_IE_LEN sizeof(dot11_rde_ie_t)
2662 
2663 
2664 /* ************* 802.11k related definitions. ************* */
2665 
2666 /* Radio measurements enabled capability ie */
2667 #define DOT11_RRM_CAP_LEN        5    /* length of rrm cap bitmap */
2668 #define RCPI_IE_LEN 1
2669 #define RSNI_IE_LEN 1
2670 BWL_PRE_PACKED_STRUCT struct dot11_rrm_cap_ie {
2671     uint8 cap[DOT11_RRM_CAP_LEN];
2672 } BWL_POST_PACKED_STRUCT;
2673 typedef struct dot11_rrm_cap_ie dot11_rrm_cap_ie_t;
2674 
2675 /* Bitmap definitions for cap ie */
2676 #define DOT11_RRM_CAP_LINK        0
2677 #define DOT11_RRM_CAP_NEIGHBOR_REPORT    1
2678 #define DOT11_RRM_CAP_PARALLEL        2
2679 #define DOT11_RRM_CAP_REPEATED        3
2680 #define DOT11_RRM_CAP_BCN_PASSIVE    4
2681 #define DOT11_RRM_CAP_BCN_ACTIVE    5
2682 #define DOT11_RRM_CAP_BCN_TABLE        6
2683 #define DOT11_RRM_CAP_BCN_REP_COND    7
2684 #define DOT11_RRM_CAP_FM        8
2685 #define DOT11_RRM_CAP_CLM        9
2686 #define DOT11_RRM_CAP_NHM        10
2687 #define DOT11_RRM_CAP_SM        11
2688 #define DOT11_RRM_CAP_LCIM        12
2689 #define DOT11_RRM_CAP_LCIA        13
2690 #define DOT11_RRM_CAP_TSCM        14
2691 #define DOT11_RRM_CAP_TTSCM        15
2692 #define DOT11_RRM_CAP_AP_CHANREP    16
2693 #define DOT11_RRM_CAP_RMMIB        17
2694 /* bit18-bit23, not used for RRM_IOVAR */
2695 #define DOT11_RRM_CAP_MPC0        24
2696 #define DOT11_RRM_CAP_MPC1        25
2697 #define DOT11_RRM_CAP_MPC2        26
2698 #define DOT11_RRM_CAP_MPTI        27
2699 #define DOT11_RRM_CAP_NBRTSFO        28
2700 #define DOT11_RRM_CAP_RCPI        29
2701 #define DOT11_RRM_CAP_RSNI        30
2702 #define DOT11_RRM_CAP_BSSAAD        31
2703 #define DOT11_RRM_CAP_BSSAAC        32
2704 #define DOT11_RRM_CAP_AI        33
2705 #define DOT11_RRM_CAP_FTM_RANGE        34
2706 #define DOT11_RRM_CAP_CIVIC_LOC        35
2707 #define DOT11_RRM_CAP_IDENT_LOC        36
2708 #define DOT11_RRM_CAP_LAST        36
2709 
2710 #ifdef WL11K_ALL_MEAS
2711 #define DOT11_RRM_CAP_LINK_ENAB            (1 << DOT11_RRM_CAP_LINK)
2712 #define DOT11_RRM_CAP_FM_ENAB            (1 << (DOT11_RRM_CAP_FM - 8))
2713 #define DOT11_RRM_CAP_CLM_ENAB            (1 << (DOT11_RRM_CAP_CLM - 8))
2714 #define DOT11_RRM_CAP_NHM_ENAB            (1 << (DOT11_RRM_CAP_NHM - 8))
2715 #define DOT11_RRM_CAP_SM_ENAB            (1 << (DOT11_RRM_CAP_SM - 8))
2716 #define DOT11_RRM_CAP_LCIM_ENAB            (1 << (DOT11_RRM_CAP_LCIM - 8))
2717 #define DOT11_RRM_CAP_TSCM_ENAB            (1 << (DOT11_RRM_CAP_TSCM - 8))
2718 #ifdef WL11K_AP
2719 #define DOT11_RRM_CAP_MPC0_ENAB            (1 << (DOT11_RRM_CAP_MPC0 - 24))
2720 #define DOT11_RRM_CAP_MPC1_ENAB            (1 << (DOT11_RRM_CAP_MPC1 - 24))
2721 #define DOT11_RRM_CAP_MPC2_ENAB            (1 << (DOT11_RRM_CAP_MPC2 - 24))
2722 #define DOT11_RRM_CAP_MPTI_ENAB            (1 << (DOT11_RRM_CAP_MPTI - 24))
2723 #else
2724 #define DOT11_RRM_CAP_MPC0_ENAB            0
2725 #define DOT11_RRM_CAP_MPC1_ENAB            0
2726 #define DOT11_RRM_CAP_MPC2_ENAB            0
2727 #define DOT11_RRM_CAP_MPTI_ENAB            0
2728 #endif /* WL11K_AP */
2729 #define DOT11_RRM_CAP_CIVIC_LOC_ENAB        (1 << (DOT11_RRM_CAP_CIVIC_LOC - 32))
2730 #define DOT11_RRM_CAP_IDENT_LOC_ENAB        (1 << (DOT11_RRM_CAP_IDENT_LOC - 32))
2731 #else
2732 #define DOT11_RRM_CAP_LINK_ENAB            0
2733 #define DOT11_RRM_CAP_FM_ENAB            0
2734 #define DOT11_RRM_CAP_CLM_ENAB            0
2735 #define DOT11_RRM_CAP_NHM_ENAB            0
2736 #define DOT11_RRM_CAP_SM_ENAB            0
2737 #define DOT11_RRM_CAP_LCIM_ENAB            0
2738 #define DOT11_RRM_CAP_TSCM_ENAB            0
2739 #define DOT11_RRM_CAP_MPC0_ENAB            0
2740 #define DOT11_RRM_CAP_MPC1_ENAB            0
2741 #define DOT11_RRM_CAP_MPC2_ENAB            0
2742 #define DOT11_RRM_CAP_MPTI_ENAB            0
2743 #define DOT11_RRM_CAP_CIVIC_LOC_ENAB        0
2744 #define DOT11_RRM_CAP_IDENT_LOC_ENAB        0
2745 #endif /* WL11K_ALL_MEAS */
2746 #ifdef WL11K_NBR_MEAS
2747 #define DOT11_RRM_CAP_NEIGHBOR_REPORT_ENAB    (1 << DOT11_RRM_CAP_NEIGHBOR_REPORT)
2748 #else
2749 #define DOT11_RRM_CAP_NEIGHBOR_REPORT_ENAB    0
2750 #endif /* WL11K_NBR_MEAS */
2751 #ifdef WL11K_BCN_MEAS
2752 #define DOT11_RRM_CAP_BCN_PASSIVE_ENAB        (1 << DOT11_RRM_CAP_BCN_PASSIVE)
2753 #define DOT11_RRM_CAP_BCN_ACTIVE_ENAB        (1 << DOT11_RRM_CAP_BCN_ACTIVE)
2754 #else
2755 #define DOT11_RRM_CAP_BCN_PASSIVE_ENAB        0
2756 #define DOT11_RRM_CAP_BCN_ACTIVE_ENAB        0
2757 #endif /* WL11K_BCN_MEAS */
2758 #define DOT11_RRM_CAP_MPA_MASK        0x7
2759 /* Operating Class (formerly "Regulatory Class") definitions */
2760 #define DOT11_OP_CLASS_NONE            255
2761 
2762 BWL_PRE_PACKED_STRUCT struct do11_ap_chrep {
2763     uint8 id;
2764     uint8 len;
2765     uint8 reg;
2766     uint8 chanlist[1];
2767 } BWL_POST_PACKED_STRUCT;
2768 typedef struct do11_ap_chrep dot11_ap_chrep_t;
2769 
2770 /* Radio Measurements action ids */
2771 #define DOT11_RM_ACTION_RM_REQ        0    /* Radio measurement request */
2772 #define DOT11_RM_ACTION_RM_REP        1    /* Radio measurement report */
2773 #define DOT11_RM_ACTION_LM_REQ        2    /* Link measurement request */
2774 #define DOT11_RM_ACTION_LM_REP        3    /* Link measurement report */
2775 #define DOT11_RM_ACTION_NR_REQ        4    /* Neighbor report request */
2776 #define DOT11_RM_ACTION_NR_REP        5    /* Neighbor report response */
2777 #define DOT11_PUB_ACTION_MP        7    /* Measurement Pilot public action id */
2778 
2779 /** Generic radio measurement action frame header */
2780 BWL_PRE_PACKED_STRUCT struct dot11_rm_action {
2781     uint8 category;                /* category of action frame (5) */
2782     uint8 action;                /* radio measurement action */
2783     uint8 token;                /* dialog token */
2784     uint8 data[1];
2785 } BWL_POST_PACKED_STRUCT;
2786 typedef struct dot11_rm_action dot11_rm_action_t;
2787 #define DOT11_RM_ACTION_LEN 3
2788 
2789 BWL_PRE_PACKED_STRUCT struct dot11_rmreq {
2790     uint8 category;                /* category of action frame (5) */
2791     uint8 action;                /* radio measurement action */
2792     uint8 token;                /* dialog token */
2793     uint16 reps;                /* no. of repetitions */
2794     uint8 data[1];
2795 } BWL_POST_PACKED_STRUCT;
2796 typedef struct dot11_rmreq dot11_rmreq_t;
2797 #define DOT11_RMREQ_LEN    5
2798 
2799 BWL_PRE_PACKED_STRUCT struct dot11_rm_ie {
2800     uint8 id;
2801     uint8 len;
2802     uint8 token;
2803     uint8 mode;
2804     uint8 type;
2805 } BWL_POST_PACKED_STRUCT;
2806 typedef struct dot11_rm_ie dot11_rm_ie_t;
2807 #define DOT11_RM_IE_LEN    5
2808 
2809 /* Definitions for "mode" bits in rm req */
2810 #define DOT11_RMREQ_MODE_PARALLEL    1
2811 #define DOT11_RMREQ_MODE_ENABLE        2
2812 #define DOT11_RMREQ_MODE_REQUEST    4
2813 #define DOT11_RMREQ_MODE_REPORT        8
2814 #define DOT11_RMREQ_MODE_DURMAND    0x10    /* Duration Mandatory */
2815 
2816 /* Definitions for "mode" bits in rm rep */
2817 #define DOT11_RMREP_MODE_LATE        1
2818 #define DOT11_RMREP_MODE_INCAPABLE    2
2819 #define DOT11_RMREP_MODE_REFUSED    4
2820 
2821 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_bcn {
2822     uint8 id;
2823     uint8 len;
2824     uint8 token;
2825     uint8 mode;
2826     uint8 type;
2827     uint8 reg;
2828     uint8 channel;
2829     uint16 interval;
2830     uint16 duration;
2831     uint8 bcn_mode;
2832     struct ether_addr    bssid;
2833 } BWL_POST_PACKED_STRUCT;
2834 typedef struct dot11_rmreq_bcn dot11_rmreq_bcn_t;
2835 #define DOT11_RMREQ_BCN_LEN    18
2836 
2837 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_bcn {
2838     uint8 reg;
2839     uint8 channel;
2840     uint32 starttime[2];
2841     uint16 duration;
2842     uint8 frame_info;
2843     uint8 rcpi;
2844     uint8 rsni;
2845     struct ether_addr    bssid;
2846     uint8 antenna_id;
2847     uint32 parent_tsf;
2848 } BWL_POST_PACKED_STRUCT;
2849 typedef struct dot11_rmrep_bcn dot11_rmrep_bcn_t;
2850 #define DOT11_RMREP_BCN_LEN    26
2851 
2852 /* Beacon request measurement mode */
2853 #define DOT11_RMREQ_BCN_PASSIVE    0
2854 #define DOT11_RMREQ_BCN_ACTIVE    1
2855 #define DOT11_RMREQ_BCN_TABLE    2
2856 
2857 /* Sub-element IDs for Beacon Request */
2858 #define DOT11_RMREQ_BCN_SSID_ID 0
2859 #define DOT11_RMREQ_BCN_REPINFO_ID  1
2860 #define DOT11_RMREQ_BCN_REPDET_ID   2
2861 #define DOT11_RMREQ_BCN_REQUEST_ID  10
2862 #define DOT11_RMREQ_BCN_APCHREP_ID  DOT11_MNG_AP_CHREP_ID
2863 
2864 /* Reporting Detail element definition */
2865 #define DOT11_RMREQ_BCN_REPDET_FIXED    0    /* Fixed length fields only */
2866 #define DOT11_RMREQ_BCN_REPDET_REQUEST    1    /* + requested information elems */
2867 #define DOT11_RMREQ_BCN_REPDET_ALL    2    /* All fields */
2868 
2869 /* Reporting Information (reporting condition) element definition */
2870 #define DOT11_RMREQ_BCN_REPINFO_LEN    2    /* Beacon Reporting Information length */
2871 #define DOT11_RMREQ_BCN_REPCOND_DEFAULT    0    /* Report to be issued after each measurement */
2872 
2873 /* Sub-element IDs for Beacon Report */
2874 #define DOT11_RMREP_BCN_FRM_BODY    1
2875 #define DOT11_RMREP_BCN_FRM_BODY_LEN_MAX    224 /* 802.11k-2008 7.3.2.22.6 */
2876 
2877 /* Sub-element IDs for Frame Report */
2878 #define DOT11_RMREP_FRAME_COUNT_REPORT 1
2879 
2880 /* Channel load request */
2881 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_chanload {
2882     uint8 id;
2883     uint8 len;
2884     uint8 token;
2885     uint8 mode;
2886     uint8 type;
2887     uint8 reg;
2888     uint8 channel;
2889     uint16 interval;
2890     uint16 duration;
2891 } BWL_POST_PACKED_STRUCT;
2892 typedef struct dot11_rmreq_chanload dot11_rmreq_chanload_t;
2893 #define DOT11_RMREQ_CHANLOAD_LEN    11
2894 
2895 /** Channel load report */
2896 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_chanload {
2897     uint8 reg;
2898     uint8 channel;
2899     uint32 starttime[2];
2900     uint16 duration;
2901     uint8 channel_load;
2902 } BWL_POST_PACKED_STRUCT;
2903 typedef struct dot11_rmrep_chanload dot11_rmrep_chanload_t;
2904 #define DOT11_RMREP_CHANLOAD_LEN    13
2905 
2906 /** Noise histogram request */
2907 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_noise {
2908     uint8 id;
2909     uint8 len;
2910     uint8 token;
2911     uint8 mode;
2912     uint8 type;
2913     uint8 reg;
2914     uint8 channel;
2915     uint16 interval;
2916     uint16 duration;
2917 } BWL_POST_PACKED_STRUCT;
2918 typedef struct dot11_rmreq_noise dot11_rmreq_noise_t;
2919 #define DOT11_RMREQ_NOISE_LEN 11
2920 
2921 /** Noise histogram report */
2922 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_noise {
2923     uint8 reg;
2924     uint8 channel;
2925     uint32 starttime[2];
2926     uint16 duration;
2927     uint8 antid;
2928     uint8 anpi;
2929     uint8 ipi0_dens;
2930     uint8 ipi1_dens;
2931     uint8 ipi2_dens;
2932     uint8 ipi3_dens;
2933     uint8 ipi4_dens;
2934     uint8 ipi5_dens;
2935     uint8 ipi6_dens;
2936     uint8 ipi7_dens;
2937     uint8 ipi8_dens;
2938     uint8 ipi9_dens;
2939     uint8 ipi10_dens;
2940 } BWL_POST_PACKED_STRUCT;
2941 typedef struct dot11_rmrep_noise dot11_rmrep_noise_t;
2942 #define DOT11_RMREP_NOISE_LEN 25
2943 
2944 /** Frame request */
2945 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_frame {
2946     uint8 id;
2947     uint8 len;
2948     uint8 token;
2949     uint8 mode;
2950     uint8 type;
2951     uint8 reg;
2952     uint8 channel;
2953     uint16 interval;
2954     uint16 duration;
2955     uint8 req_type;
2956     struct ether_addr    ta;
2957 } BWL_POST_PACKED_STRUCT;
2958 typedef struct dot11_rmreq_frame dot11_rmreq_frame_t;
2959 #define DOT11_RMREQ_FRAME_LEN 18
2960 
2961 /** Frame report */
2962 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_frame {
2963     uint8 reg;
2964     uint8 channel;
2965     uint32 starttime[2];
2966     uint16 duration;
2967 } BWL_POST_PACKED_STRUCT;
2968 typedef struct dot11_rmrep_frame dot11_rmrep_frame_t;
2969 #define DOT11_RMREP_FRAME_LEN 12
2970 
2971 /** Frame report entry */
2972 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_frmentry {
2973     struct ether_addr    ta;
2974     struct ether_addr    bssid;
2975     uint8 phy_type;
2976     uint8 avg_rcpi;
2977     uint8 last_rsni;
2978     uint8 last_rcpi;
2979     uint8 ant_id;
2980     uint16 frame_cnt;
2981 } BWL_POST_PACKED_STRUCT;
2982 typedef struct dot11_rmrep_frmentry dot11_rmrep_frmentry_t;
2983 #define DOT11_RMREP_FRMENTRY_LEN 19
2984 
2985 /** STA statistics request */
2986 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_stat {
2987     uint8 id;
2988     uint8 len;
2989     uint8 token;
2990     uint8 mode;
2991     uint8 type;
2992     struct ether_addr    peer;
2993     uint16 interval;
2994     uint16 duration;
2995     uint8 group_id;
2996 } BWL_POST_PACKED_STRUCT;
2997 typedef struct dot11_rmreq_stat dot11_rmreq_stat_t;
2998 #define DOT11_RMREQ_STAT_LEN 16
2999 
3000 /** STA statistics report */
3001 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_stat {
3002     uint16 duration;
3003     uint8 group_id;
3004 } BWL_POST_PACKED_STRUCT;
3005 typedef struct dot11_rmrep_stat dot11_rmrep_stat_t;
3006 
3007 /* Statistics Group Report: Group IDs */
3008 enum {
3009     DOT11_RRM_STATS_GRP_ID_0 = 0,
3010     DOT11_RRM_STATS_GRP_ID_1,
3011     DOT11_RRM_STATS_GRP_ID_2,
3012     DOT11_RRM_STATS_GRP_ID_3,
3013     DOT11_RRM_STATS_GRP_ID_4,
3014     DOT11_RRM_STATS_GRP_ID_5,
3015     DOT11_RRM_STATS_GRP_ID_6,
3016     DOT11_RRM_STATS_GRP_ID_7,
3017     DOT11_RRM_STATS_GRP_ID_8,
3018     DOT11_RRM_STATS_GRP_ID_9,
3019     DOT11_RRM_STATS_GRP_ID_10,
3020     DOT11_RRM_STATS_GRP_ID_11,
3021     DOT11_RRM_STATS_GRP_ID_12,
3022     DOT11_RRM_STATS_GRP_ID_13,
3023     DOT11_RRM_STATS_GRP_ID_14,
3024     DOT11_RRM_STATS_GRP_ID_15,
3025     DOT11_RRM_STATS_GRP_ID_16
3026 };
3027 
3028 /* Statistics Group Report: Group Data length  */
3029 #define DOT11_RRM_STATS_RPT_LEN_GRP_ID_0    28
3030 typedef struct rrm_stat_group_0 {
3031     uint32    txfrag;
3032     uint32    txmulti;
3033     uint32    txfail;
3034     uint32    rxframe;
3035     uint32    rxmulti;
3036     uint32    rxbadfcs;
3037     uint32    txframe;
3038 } rrm_stat_group_0_t;
3039 
3040 #define DOT11_RRM_STATS_RPT_LEN_GRP_ID_1    24
3041 typedef struct rrm_stat_group_1 {
3042     uint32    txretry;
3043     uint32    txretries;
3044     uint32    rxdup;
3045     uint32    txrts;
3046     uint32    rtsfail;
3047     uint32    ackfail;
3048 } rrm_stat_group_1_t;
3049 
3050 /* group 2-9 use same qos data structure (tid 0-7), total 52 bytes */
3051 #define DOT11_RRM_STATS_RPT_LEN_GRP_ID_2_9    52
3052 typedef struct rrm_stat_group_qos {
3053     uint32    txfrag;
3054     uint32    txfail;
3055     uint32    txretry;
3056     uint32    txretries;
3057     uint32    rxdup;
3058     uint32    txrts;
3059     uint32    rtsfail;
3060     uint32    ackfail;
3061     uint32    rxfrag;
3062     uint32    txframe;
3063     uint32    txdrop;
3064     uint32    rxmpdu;
3065     uint32    rxretries;
3066 } rrm_stat_group_qos_t;
3067 
3068 /* dot11BSSAverageAccessDelay Group (only available at an AP): 8 byte */
3069 #define DOT11_RRM_STATS_RPT_LEN_GRP_ID_10    8
3070 typedef BWL_PRE_PACKED_STRUCT struct rrm_stat_group_10 {
3071     uint8    apavgdelay;
3072     uint8    avgdelaybe;
3073     uint8    avgdelaybg;
3074     uint8    avgdelayvi;
3075     uint8    avgdelayvo;
3076     uint16    stacount;
3077     uint8    chanutil;
3078 } BWL_POST_PACKED_STRUCT rrm_stat_group_10_t;
3079 
3080 /* AMSDU, 40 bytes */
3081 #define DOT11_RRM_STATS_RPT_LEN_GRP_ID_11    40
3082 typedef struct rrm_stat_group_11 {
3083     uint32    txamsdu;
3084     uint32    amsdufail;
3085     uint32    amsduretry;
3086     uint32    amsduretries;
3087     uint32    txamsdubyte_h;
3088     uint32    txamsdubyte_l;
3089     uint32    amsduackfail;
3090     uint32    rxamsdu;
3091     uint32    rxamsdubyte_h;
3092     uint32    rxamsdubyte_l;
3093 } rrm_stat_group_11_t;
3094 
3095 /* AMPDU, 36 bytes */
3096 #define DOT11_RRM_STATS_RPT_LEN_GRP_ID_12    36
3097 typedef struct rrm_stat_group_12 {
3098     uint32    txampdu;
3099     uint32    txmpdu;
3100     uint32    txampdubyte_h;
3101     uint32    txampdubyte_l;
3102     uint32    rxampdu;
3103     uint32    rxmpdu;
3104     uint32    rxampdubyte_h;
3105     uint32    rxampdubyte_l;
3106     uint32    ampducrcfail;
3107 } rrm_stat_group_12_t;
3108 
3109 /* BACK etc, 36 bytes */
3110 #define DOT11_RRM_STATS_RPT_LEN_GRP_ID_13    36
3111 typedef struct rrm_stat_group_13 {
3112     uint32    rximpbarfail;
3113     uint32    rxexpbarfail;
3114     uint32    chanwidthsw;
3115     uint32    txframe20mhz;
3116     uint32    txframe40mhz;
3117     uint32    rxframe20mhz;
3118     uint32    rxframe40mhz;
3119     uint32    psmpgrantdur;
3120     uint32    psmpuseddur;
3121 } rrm_stat_group_13_t;
3122 
3123 /* RD Dual CTS etc, 36 bytes */
3124 #define DOT11_RRM_STATS_RPT_LEN_GRP_ID_14    36
3125 typedef struct rrm_stat_group_14 {
3126     uint32    grantrdgused;
3127     uint32    grantrdgunused;
3128     uint32    txframeingrantrdg;
3129     uint32    txbyteingrantrdg_h;
3130     uint32    txbyteingrantrdg_l;
3131     uint32    dualcts;
3132     uint32    dualctsfail;
3133     uint32    rtslsi;
3134     uint32    rtslsifail;
3135 } rrm_stat_group_14_t;
3136 
3137 /* bf and STBC etc, 20 bytes */
3138 #define DOT11_RRM_STATS_RPT_LEN_GRP_ID_15    20
3139 typedef struct rrm_stat_group_15 {
3140     uint32    bfframe;
3141     uint32    stbccts;
3142     uint32    stbcctsfail;
3143     uint32    nonstbccts;
3144     uint32    nonstbcctsfail;
3145 } rrm_stat_group_15_t;
3146 
3147 /* RSNA, 28 bytes */
3148 #define DOT11_RRM_STATS_RPT_LEN_GRP_ID_16    28
3149 typedef struct rrm_stat_group_16 {
3150     uint32    rsnacmacicverr;
3151     uint32    rsnacmacreplay;
3152     uint32    rsnarobustmgmtccmpreplay;
3153     uint32    rsnatkipicverr;
3154     uint32    rsnatkipicvreplay;
3155     uint32    rsnaccmpdecrypterr;
3156     uint32    rsnaccmpreplay;
3157 } rrm_stat_group_16_t;
3158 
3159 /* Transmit stream/category measurement request */
3160 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_tx_stream {
3161     uint8 id;
3162     uint8 len;
3163     uint8 token;
3164     uint8 mode;
3165     uint8 type;
3166     uint16 interval;
3167     uint16 duration;
3168     struct ether_addr    peer;
3169     uint8 traffic_id;
3170     uint8 bin0_range;
3171 } BWL_POST_PACKED_STRUCT;
3172 typedef struct dot11_rmreq_tx_stream dot11_rmreq_tx_stream_t;
3173 #define DOT11_RMREQ_TXSTREAM_LEN    17
3174 
3175 /** Transmit stream/category measurement report */
3176 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_tx_stream {
3177     uint32 starttime[2];
3178     uint16 duration;
3179     struct ether_addr    peer;
3180     uint8 traffic_id;
3181     uint8 reason;
3182     uint32 txmsdu_cnt;
3183     uint32 msdu_discarded_cnt;
3184     uint32 msdufailed_cnt;
3185     uint32 msduretry_cnt;
3186     uint32 cfpolls_lost_cnt;
3187     uint32 avrqueue_delay;
3188     uint32 avrtx_delay;
3189     uint8 bin0_range;
3190     uint32 bin0;
3191     uint32 bin1;
3192     uint32 bin2;
3193     uint32 bin3;
3194     uint32 bin4;
3195     uint32 bin5;
3196 } BWL_POST_PACKED_STRUCT;
3197 typedef struct dot11_rmrep_tx_stream dot11_rmrep_tx_stream_t;
3198 #define DOT11_RMREP_TXSTREAM_LEN    71
3199 
3200 typedef struct rrm_tscm {
3201     uint32 msdu_tx;
3202     uint32 msdu_exp;
3203     uint32 msdu_fail;
3204     uint32 msdu_retries;
3205     uint32 cfpolls_lost;
3206     uint32 queue_delay;
3207     uint32 tx_delay_sum;
3208     uint32 tx_delay_cnt;
3209     uint32 bin0_range_us;
3210     uint32 bin0;
3211     uint32 bin1;
3212     uint32 bin2;
3213     uint32 bin3;
3214     uint32 bin4;
3215     uint32 bin5;
3216 } rrm_tscm_t;
3217 enum {
3218     DOT11_FTM_LOCATION_SUBJ_LOCAL = 0,         /* Where am I? */
3219     DOT11_FTM_LOCATION_SUBJ_REMOTE = 1,        /* Where are you? */
3220     DOT11_FTM_LOCATION_SUBJ_THIRDPARTY = 2   /* Where is he/she? */
3221 };
3222 
3223 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_ftm_lci {
3224     uint8 id;
3225     uint8 len;
3226     uint8 token;
3227     uint8 mode;
3228     uint8 type;
3229     uint8 subj;
3230 
3231     /* Following 3 fields are unused. Keep for ROM compatibility. */
3232     uint8 lat_res;
3233     uint8 lon_res;
3234     uint8 alt_res;
3235 
3236     /* optional sub-elements */
3237 } BWL_POST_PACKED_STRUCT;
3238 typedef struct dot11_rmreq_ftm_lci dot11_rmreq_ftm_lci_t;
3239 #define DOT11_RMREQ_LCI_LEN    9
3240 
3241 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_ftm_lci {
3242     uint8 id;
3243     uint8 len;
3244     uint8 token;
3245     uint8 mode;
3246     uint8 type;
3247     uint8 lci_sub_id;
3248     uint8 lci_sub_len;
3249     /* optional LCI field */
3250     /* optional sub-elements */
3251 } BWL_POST_PACKED_STRUCT;
3252 typedef struct dot11_rmrep_ftm_lci dot11_rmrep_ftm_lci_t;
3253 
3254 #define DOT11_FTM_LCI_SUBELEM_ID         0
3255 #define DOT11_FTM_LCI_SUBELEM_LEN         2
3256 #define DOT11_FTM_LCI_FIELD_LEN         16
3257 #define DOT11_FTM_LCI_UNKNOWN_LEN         2
3258 
3259 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_ftm_civic {
3260     uint8 id;
3261     uint8 len;
3262     uint8 token;
3263     uint8 mode;
3264     uint8 type;
3265     uint8 subj;
3266     uint8 civloc_type;
3267     uint8 siu;    /* service interval units */
3268     uint16 si;  /* service interval */
3269     /* optional sub-elements */
3270 } BWL_POST_PACKED_STRUCT;
3271 typedef struct dot11_rmreq_ftm_civic dot11_rmreq_ftm_civic_t;
3272 #define DOT11_RMREQ_CIVIC_LEN    10
3273 
3274 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_ftm_civic {
3275     uint8 id;
3276     uint8 len;
3277     uint8 token;
3278     uint8 mode;
3279     uint8 type;
3280     uint8 civloc_type;
3281     uint8 civloc_sub_id;
3282     uint8 civloc_sub_len;
3283     /* optional location civic field */
3284     /* optional sub-elements */
3285 } BWL_POST_PACKED_STRUCT;
3286 typedef struct dot11_rmrep_ftm_civic dot11_rmrep_ftm_civic_t;
3287 
3288 #define DOT11_FTM_CIVIC_LOC_TYPE_RFC4776    0
3289 #define DOT11_FTM_CIVIC_SUBELEM_ID             0
3290 #define DOT11_FTM_CIVIC_SUBELEM_LEN         2
3291 #define DOT11_FTM_CIVIC_LOC_SI_NONE            0
3292 #define DOT11_FTM_CIVIC_TYPE_LEN            1
3293 #define DOT11_FTM_CIVIC_UNKNOWN_LEN         3
3294 
3295 /* Location Identifier measurement request */
3296 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_locid {
3297     uint8 id;
3298     uint8 len;
3299     uint8 token;
3300     uint8 mode;
3301     uint8 type;
3302     uint8 subj;
3303     uint8 siu;
3304     uint16 si;
3305 } BWL_POST_PACKED_STRUCT;
3306 typedef struct dot11_rmreq_locid dot11_rmreq_locid_t;
3307 #define DOT11_RMREQ_LOCID_LEN    9
3308 
3309 /* Location Identifier measurement report */
3310 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_locid {
3311     uint8 id;
3312     uint8 len;
3313     uint8 token;
3314     uint8 mode;
3315     uint8 type;
3316     uint8 exp_tsf[8];
3317     uint8 locid_sub_id;
3318     uint8 locid_sub_len;
3319     /* optional location identifier field */
3320     /* optional sub-elements */
3321 } BWL_POST_PACKED_STRUCT;
3322 typedef struct dot11_rmrep_locid dot11_rmrep_locid_t;
3323 #define DOT11_LOCID_UNKNOWN_LEN        10
3324 #define DOT11_LOCID_SUBELEM_ID        0
3325 
3326 BWL_PRE_PACKED_STRUCT struct dot11_ftm_range_subel {
3327     uint8 id;
3328     uint8 len;
3329     uint16 max_age;
3330 } BWL_POST_PACKED_STRUCT;
3331 typedef struct dot11_ftm_range_subel dot11_ftm_range_subel_t;
3332 #define DOT11_FTM_RANGE_SUBELEM_ID      4
3333 #define DOT11_FTM_RANGE_SUBELEM_LEN     2
3334 
3335 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_ftm_range {
3336     uint8 id;
3337     uint8 len;
3338     uint8 token;
3339     uint8 mode;
3340     uint8 type;
3341     uint16 max_init_delay;        /* maximum random initial delay */
3342     uint8 min_ap_count;
3343     uint8 data[1];
3344     /* neighbor report sub-elements */
3345     /* optional sub-elements */
3346 } BWL_POST_PACKED_STRUCT;
3347 typedef struct dot11_rmreq_ftm_range dot11_rmreq_ftm_range_t;
3348 #define DOT11_RMREQ_FTM_RANGE_LEN 8
3349 
3350 #define DOT11_FTM_RANGE_LEN        3
3351 BWL_PRE_PACKED_STRUCT struct dot11_ftm_range_entry {
3352     uint32 start_tsf;        /* 4 lsb of tsf */
3353     struct ether_addr bssid;
3354     uint8 range[DOT11_FTM_RANGE_LEN];
3355     uint8 max_err[DOT11_FTM_RANGE_LEN];
3356     uint8  rsvd;
3357 } BWL_POST_PACKED_STRUCT;
3358 typedef struct dot11_ftm_range_entry dot11_ftm_range_entry_t;
3359 #define DOT11_FTM_RANGE_ENTRY_MAX_COUNT   15
3360 
3361 enum {
3362     DOT11_FTM_RANGE_ERROR_AP_INCAPABLE = 2,
3363     DOT11_FTM_RANGE_ERROR_AP_FAILED = 3,
3364     DOT11_FTM_RANGE_ERROR_TX_FAILED = 8,
3365     DOT11_FTM_RANGE_ERROR_MAX
3366 };
3367 
3368 BWL_PRE_PACKED_STRUCT struct dot11_ftm_range_error_entry {
3369     uint32 start_tsf;        /* 4 lsb of tsf */
3370     struct ether_addr bssid;
3371     uint8  code;
3372 } BWL_POST_PACKED_STRUCT;
3373 typedef struct dot11_ftm_range_error_entry dot11_ftm_range_error_entry_t;
3374 #define DOT11_FTM_RANGE_ERROR_ENTRY_MAX_COUNT   11
3375 
3376 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_ftm_range {
3377     uint8 id;
3378     uint8 len;
3379     uint8 token;
3380     uint8 mode;
3381     uint8 type;
3382     uint8 entry_count;
3383     uint8 data[2]; /* includes pad */
3384 } BWL_POST_PACKED_STRUCT;
3385 typedef struct dot11_rmrep_ftm_range dot11_rmrep_ftm_range_t;
3386 
3387 #define DOT11_FTM_RANGE_REP_MIN_LEN     6       /* No extra byte for error_count */
3388 #define DOT11_FTM_RANGE_ENTRY_CNT_MAX   15
3389 #define DOT11_FTM_RANGE_ERROR_CNT_MAX   11
3390 #define DOT11_FTM_RANGE_REP_FIXED_LEN   1       /* No extra byte for error_count */
3391 /** Measurement pause request */
3392 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_pause_time {
3393     uint8 id;
3394     uint8 len;
3395     uint8 token;
3396     uint8 mode;
3397     uint8 type;
3398     uint16 pause_time;
3399 } BWL_POST_PACKED_STRUCT;
3400 typedef struct dot11_rmreq_pause_time dot11_rmreq_pause_time_t;
3401 #define DOT11_RMREQ_PAUSE_LEN    7
3402 
3403 
3404 /* Neighbor Report subelements ID (11k & 11v) */
3405 #define DOT11_NGBR_TSF_INFO_SE_ID    1
3406 #define DOT11_NGBR_CCS_SE_ID        2
3407 #define DOT11_NGBR_BSSTRANS_PREF_SE_ID    3
3408 #define DOT11_NGBR_BSS_TERM_DUR_SE_ID    4
3409 #define DOT11_NGBR_BEARING_SE_ID    5
3410 #define DOT11_NGBR_WIDE_BW_CHAN_SE_ID    6
3411 
3412 /** Neighbor Report, BSS Transition Candidate Preference subelement */
3413 BWL_PRE_PACKED_STRUCT struct dot11_ngbr_bsstrans_pref_se {
3414     uint8 sub_id;
3415     uint8 len;
3416     uint8 preference;
3417 } BWL_POST_PACKED_STRUCT;
3418 typedef struct dot11_ngbr_bsstrans_pref_se dot11_ngbr_bsstrans_pref_se_t;
3419 #define DOT11_NGBR_BSSTRANS_PREF_SE_LEN        1
3420 #define DOT11_NGBR_BSSTRANS_PREF_SE_IE_LEN    3
3421 #define DOT11_NGBR_BSSTRANS_PREF_SE_HIGHEST    0xff
3422 
3423 /** Neighbor Report, BSS Termination Duration subelement */
3424 BWL_PRE_PACKED_STRUCT struct dot11_ngbr_bss_term_dur_se {
3425     uint8 sub_id;
3426     uint8 len;
3427     uint8 tsf[8];
3428     uint16 duration;
3429 } BWL_POST_PACKED_STRUCT;
3430 typedef struct dot11_ngbr_bss_term_dur_se dot11_ngbr_bss_term_dur_se_t;
3431 #define DOT11_NGBR_BSS_TERM_DUR_SE_LEN    10
3432 
3433 /* Neighbor Report BSSID Information Field */
3434 #define DOT11_NGBR_BI_REACHABILTY_UNKN    0x0002
3435 #define DOT11_NGBR_BI_REACHABILTY    0x0003
3436 #define DOT11_NGBR_BI_SEC        0x0004
3437 #define DOT11_NGBR_BI_KEY_SCOPE        0x0008
3438 #define DOT11_NGBR_BI_CAP        0x03f0
3439 #define DOT11_NGBR_BI_CAP_SPEC_MGMT    0x0010
3440 #define DOT11_NGBR_BI_CAP_QOS        0x0020
3441 #define DOT11_NGBR_BI_CAP_APSD        0x0040
3442 #define DOT11_NGBR_BI_CAP_RDIO_MSMT    0x0080
3443 #define DOT11_NGBR_BI_CAP_DEL_BA    0x0100
3444 #define DOT11_NGBR_BI_CAP_IMM_BA    0x0200
3445 #define DOT11_NGBR_BI_MOBILITY        0x0400
3446 #define DOT11_NGBR_BI_HT        0x0800
3447 #define DOT11_NGBR_BI_VHT        0x1000
3448 #define DOT11_NGBR_BI_FTM        0x2000
3449 
3450 /** Neighbor Report element (11k & 11v) */
3451 BWL_PRE_PACKED_STRUCT struct dot11_neighbor_rep_ie {
3452     uint8 id;
3453     uint8 len;
3454     struct ether_addr bssid;
3455     uint32 bssid_info;
3456     uint8 reg;        /* Operating class */
3457     uint8 channel;
3458     uint8 phytype;
3459     uint8 data[1];         /* Variable size subelements */
3460 } BWL_POST_PACKED_STRUCT;
3461 typedef struct dot11_neighbor_rep_ie dot11_neighbor_rep_ie_t;
3462 #define DOT11_NEIGHBOR_REP_IE_FIXED_LEN    13
3463 
3464 
3465 /* MLME Enumerations */
3466 #define DOT11_BSSTYPE_INFRASTRUCTURE        0    /* d11 infrastructure */
3467 #define DOT11_BSSTYPE_INDEPENDENT        1    /* d11 independent */
3468 #define DOT11_BSSTYPE_ANY            2    /* d11 any BSS type */
3469 #define DOT11_BSSTYPE_MESH            3    /* d11 Mesh */
3470 #define DOT11_SCANTYPE_ACTIVE            0    /* d11 scan active */
3471 #define DOT11_SCANTYPE_PASSIVE            1    /* d11 scan passive */
3472 
3473 /** Link Measurement */
3474 BWL_PRE_PACKED_STRUCT struct dot11_lmreq {
3475     uint8 category;                /* category of action frame (5) */
3476     uint8 action;                /* radio measurement action */
3477     uint8 token;                /* dialog token */
3478     uint8 txpwr;                /* Transmit Power Used */
3479     uint8 maxtxpwr;                /* Max Transmit Power */
3480 } BWL_POST_PACKED_STRUCT;
3481 typedef struct dot11_lmreq dot11_lmreq_t;
3482 #define DOT11_LMREQ_LEN    5
3483 
3484 BWL_PRE_PACKED_STRUCT struct dot11_lmrep {
3485     uint8 category;                /* category of action frame (5) */
3486     uint8 action;                /* radio measurement action */
3487     uint8 token;                /* dialog token */
3488     dot11_tpc_rep_t tpc;            /* TPC element */
3489     uint8 rxant;                /* Receive Antenna ID */
3490     uint8 txant;                /* Transmit Antenna ID */
3491     uint8 rcpi;                /* RCPI */
3492     uint8 rsni;                /* RSNI */
3493 } BWL_POST_PACKED_STRUCT;
3494 typedef struct dot11_lmrep dot11_lmrep_t;
3495 #define DOT11_LMREP_LEN    11
3496 
3497 #define DOT11_MP_CAP_SPECTRUM            0x01    /* d11 cap. spectrum */
3498 #define DOT11_MP_CAP_SHORTSLOT            0x02    /* d11 cap. shortslot */
3499 /* Measurement Pilot */
3500 BWL_PRE_PACKED_STRUCT struct dot11_mprep {
3501     uint8 cap_info;                /* Condensed capability Info. */
3502     uint8 country[2];                /* Condensed country string */
3503     uint8 opclass;                /* Op. Class */
3504     uint8 channel;                /* Channel */
3505     uint8 mp_interval;            /* Measurement Pilot Interval */
3506 } BWL_POST_PACKED_STRUCT;
3507 typedef struct dot11_mprep dot11_mprep_t;
3508 #define DOT11_MPREP_LEN    6
3509 
3510 /* 802.11 BRCM "Compromise" Pre N constants */
3511 #define PREN_PREAMBLE        24    /* green field preamble time */
3512 #define PREN_MM_EXT        12    /* extra mixed mode preamble time */
3513 #define PREN_PREAMBLE_EXT    4    /* extra preamble (multiply by unique_streams-1) */
3514 
3515 /* 802.11N PHY constants */
3516 #define RIFS_11N_TIME        2    /* NPHY RIFS time */
3517 
3518 /* 802.11 HT PLCP format 802.11n-2009, sec 20.3.9.4.3
3519  * HT-SIG is composed of two 24 bit parts, HT-SIG1 and HT-SIG2
3520  */
3521 /* HT-SIG1 */
3522 #define HT_SIG1_MCS_MASK        0x00007F
3523 #define HT_SIG1_CBW             0x000080
3524 #define HT_SIG1_HT_LENGTH       0xFFFF00
3525 
3526 /* HT-SIG2 */
3527 #define HT_SIG2_SMOOTHING       0x000001
3528 #define HT_SIG2_NOT_SOUNDING    0x000002
3529 #define HT_SIG2_RESERVED        0x000004
3530 #define HT_SIG2_AGGREGATION     0x000008
3531 #define HT_SIG2_STBC_MASK       0x000030
3532 #define HT_SIG2_STBC_SHIFT      4
3533 #define HT_SIG2_FEC_CODING      0x000040
3534 #define HT_SIG2_SHORT_GI        0x000080
3535 #define HT_SIG2_ESS_MASK        0x000300
3536 #define HT_SIG2_ESS_SHIFT       8
3537 #define HT_SIG2_CRC             0x03FC00
3538 #define HT_SIG2_TAIL            0x1C0000
3539 
3540 /* HT Timing-related parameters (802.11-2012, sec 20.3.6) */
3541 #define HT_T_LEG_PREAMBLE      16
3542 #define HT_T_L_SIG              4
3543 #define HT_T_SIG                8
3544 #define HT_T_LTF1               4
3545 #define HT_T_GF_LTF1            8
3546 #define HT_T_LTFs               4
3547 #define HT_T_STF                4
3548 #define HT_T_GF_STF             8
3549 #define HT_T_SYML               4
3550 
3551 #define HT_N_SERVICE           16       /* bits in SERVICE field */
3552 #define HT_N_TAIL               6       /* tail bits per BCC encoder */
3553 
3554 /* 802.11 A PHY constants */
3555 #define APHY_SLOT_TIME          9       /* APHY slot time */
3556 #define APHY_SIFS_TIME          16      /* APHY SIFS time */
3557 #define APHY_DIFS_TIME          (APHY_SIFS_TIME + (2 * APHY_SLOT_TIME))  /* APHY DIFS time */
3558 #define APHY_PREAMBLE_TIME      16      /* APHY preamble time */
3559 #define APHY_SIGNAL_TIME        4       /* APHY signal time */
3560 #define APHY_SYMBOL_TIME        4       /* APHY symbol time */
3561 #define APHY_SERVICE_NBITS      16      /* APHY service nbits */
3562 #define APHY_TAIL_NBITS         6       /* APHY tail nbits */
3563 #define APHY_CWMIN              15      /* APHY cwmin */
3564 #define APHY_PHYHDR_DUR        20    /* APHY PHY Header Duration */
3565 
3566 /* 802.11 B PHY constants */
3567 #define BPHY_SLOT_TIME          20      /* BPHY slot time */
3568 #define BPHY_SIFS_TIME          10      /* BPHY SIFS time */
3569 #define BPHY_DIFS_TIME          50      /* BPHY DIFS time */
3570 #define BPHY_PLCP_TIME          192     /* BPHY PLCP time */
3571 #define BPHY_PLCP_SHORT_TIME    96      /* BPHY PLCP short time */
3572 #define BPHY_CWMIN              31      /* BPHY cwmin */
3573 #define BPHY_SHORT_PHYHDR_DUR    96    /* BPHY Short PHY Header Duration */
3574 #define BPHY_LONG_PHYHDR_DUR    192    /* BPHY Long PHY Header Duration */
3575 
3576 /* 802.11 G constants */
3577 #define DOT11_OFDM_SIGNAL_EXTENSION    6    /* d11 OFDM signal extension */
3578 
3579 #define PHY_CWMAX        1023    /* PHY cwmax */
3580 
3581 #define    DOT11_MAXNUMFRAGS    16    /* max # fragments per MSDU */
3582 
3583 /* 802.11 VHT constants */
3584 
3585 typedef int vht_group_id_t;
3586 
3587 /* for VHT-A1 */
3588 /* SIG-A1 reserved bits */
3589 #define VHT_SIGA1_CONST_MASK            0x800004
3590 
3591 #define VHT_SIGA1_BW_MASK               0x000003
3592 #define VHT_SIGA1_20MHZ_VAL             0x000000
3593 #define VHT_SIGA1_40MHZ_VAL             0x000001
3594 #define VHT_SIGA1_80MHZ_VAL             0x000002
3595 #define VHT_SIGA1_160MHZ_VAL            0x000003
3596 
3597 #define VHT_SIGA1_STBC                  0x000008
3598 
3599 #define VHT_SIGA1_GID_MASK              0x0003f0
3600 #define VHT_SIGA1_GID_SHIFT             4
3601 #define VHT_SIGA1_GID_TO_AP             0x00
3602 #define VHT_SIGA1_GID_NOT_TO_AP         0x3f
3603 #define VHT_SIGA1_GID_MAX_GID           0x3f
3604 
3605 #define VHT_SIGA1_NSTS_SHIFT_MASK_USER0 0x001C00
3606 #define VHT_SIGA1_NSTS_SHIFT            10
3607 #define VHT_SIGA1_MAX_USERPOS           3
3608 
3609 #define VHT_SIGA1_PARTIAL_AID_MASK      0x3fe000
3610 #define VHT_SIGA1_PARTIAL_AID_SHIFT     13
3611 
3612 #define VHT_SIGA1_TXOP_PS_NOT_ALLOWED   0x400000
3613 
3614 /* for VHT-A2 */
3615 #define VHT_SIGA2_GI_NONE               0x000000
3616 #define VHT_SIGA2_GI_SHORT              0x000001
3617 #define VHT_SIGA2_GI_W_MOD10            0x000002
3618 #define VHT_SIGA2_CODING_LDPC           0x000004
3619 #define VHT_SIGA2_LDPC_EXTRA_OFDM_SYM   0x000008
3620 #define VHT_SIGA2_BEAMFORM_ENABLE       0x000100
3621 #define VHT_SIGA2_MCS_SHIFT             4
3622 
3623 #define VHT_SIGA2_B9_RESERVED           0x000200
3624 #define VHT_SIGA2_TAIL_MASK             0xfc0000
3625 #define VHT_SIGA2_TAIL_VALUE            0x000000
3626 
3627 /* VHT Timing-related parameters (802.11ac D4.0, sec 22.3.6) */
3628 #define VHT_T_LEG_PREAMBLE      16
3629 #define VHT_T_L_SIG              4
3630 #define VHT_T_SIG_A              8
3631 #define VHT_T_LTF                4
3632 #define VHT_T_STF                4
3633 #define VHT_T_SIG_B              4
3634 #define VHT_T_SYML               4
3635 
3636 #define VHT_N_SERVICE           16    /* bits in SERVICE field */
3637 #define VHT_N_TAIL               6    /* tail bits per BCC encoder */
3638 
3639 /** dot11Counters Table - 802.11 spec., Annex D */
3640 typedef struct d11cnt {
3641     uint32        txfrag;        /* dot11TransmittedFragmentCount */
3642     uint32        txmulti;    /* dot11MulticastTransmittedFrameCount */
3643     uint32        txfail;        /* dot11FailedCount */
3644     uint32        txretry;    /* dot11RetryCount */
3645     uint32        txretrie;    /* dot11MultipleRetryCount */
3646     uint32        rxdup;        /* dot11FrameduplicateCount */
3647     uint32        txrts;        /* dot11RTSSuccessCount */
3648     uint32        txnocts;    /* dot11RTSFailureCount */
3649     uint32        txnoack;    /* dot11ACKFailureCount */
3650     uint32        rxfrag;        /* dot11ReceivedFragmentCount */
3651     uint32        rxmulti;    /* dot11MulticastReceivedFrameCount */
3652     uint32        rxcrc;        /* dot11FCSErrorCount */
3653     uint32        txfrmsnt;    /* dot11TransmittedFrameCount */
3654     uint32        rxundec;    /* dot11WEPUndecryptableCount */
3655 } d11cnt_t;
3656 
3657 #define BRCM_PROP_OUI        "\x00\x90\x4C"
3658 
3659 #define BRCM_FTM_IE_TYPE            14
3660 
3661 /* Action frame type for RWL */
3662 #define RWL_WIFI_DEFAULT        0
3663 #define RWL_WIFI_FIND_MY_PEER        9 /* Used while finding server */
3664 #define RWL_WIFI_FOUND_PEER        10 /* Server response to the client  */
3665 #define RWL_ACTION_WIFI_FRAG_TYPE    85 /* Fragment indicator for receiver */
3666 
3667 #define PROXD_AF_TYPE            11 /* Wifi proximity action frame type */
3668 #define BRCM_RELMACST_AF_TYPE            12 /* RMC action frame type */
3669 
3670 /* Action frame type for FTM Initiator Report */
3671 #define BRCM_FTM_VS_AF_TYPE    14
3672 enum {
3673     BRCM_FTM_VS_INITIATOR_RPT_SUBTYPE = 1,    /* FTM Initiator Report */
3674     BRCM_FTM_VS_COLLECT_SUBTYPE = 2,    /* FTM Collect debug protocol */
3675 };
3676 
3677 /* brcm syscap_ie cap */
3678 #define BRCM_SYSCAP_WET_TUNNEL    0x0100    /* Device with WET_TUNNEL support */
3679 
3680 #define BRCM_OUI        "\x00\x10\x18"    /* Broadcom OUI */
3681 
3682 /** BRCM info element */
3683 BWL_PRE_PACKED_STRUCT struct brcm_ie {
3684     uint8    id;        /* IE ID, 221, DOT11_MNG_PROPR_ID */
3685     uint8    len;        /* IE length */
3686     uint8    oui[3];
3687     uint8    ver;        /* type/ver of this IE */
3688     uint8    assoc;        /* # of assoc STAs */
3689     uint8    flags;        /* misc flags */
3690     uint8    flags1;        /* misc flags */
3691     uint16    amsdu_mtu_pref;    /* preferred A-MSDU MTU */
3692 } BWL_POST_PACKED_STRUCT;
3693 typedef    struct brcm_ie brcm_ie_t;
3694 #define BRCM_IE_LEN        11    /* BRCM IE length */
3695 #define BRCM_IE_VER        2    /* BRCM IE version */
3696 #define BRCM_IE_LEGACY_AES_VER    1    /* BRCM IE legacy AES version */
3697 
3698 /* brcm_ie flags */
3699 #define    BRF_ABCAP        0x1    /* afterburner is obsolete,  defined for backward compat */
3700 #define    BRF_ABRQRD        0x2    /* afterburner is obsolete,  defined for backward compat */
3701 #define    BRF_LZWDS        0x4    /* lazy wds enabled */
3702 #define    BRF_BLOCKACK        0x8    /* BlockACK capable */
3703 #define BRF_ABCOUNTER_MASK    0xf0    /* afterburner is obsolete,  defined for backward compat */
3704 #define BRF_PROP_11N_MCS    0x10    /* re-use afterburner bit */
3705 #define BRF_MEDIA_CLIENT    0x20    /* re-use afterburner bit to indicate media client device */
3706 
3707 #define GET_BRF_PROP_11N_MCS(brcm_ie) \
3708     (!((brcm_ie)->flags & BRF_ABCAP) && ((brcm_ie)->flags & BRF_PROP_11N_MCS))
3709 
3710 /* brcm_ie flags1 */
3711 #define    BRF1_AMSDU        0x1    /* A-MSDU capable */
3712 #define    BRF1_WNM        0x2    /* WNM capable */
3713 #define BRF1_WMEPS        0x4    /* AP is capable of handling WME + PS w/o APSD */
3714 #define BRF1_PSOFIX        0x8    /* AP has fixed PS mode out-of-order packets */
3715 #define    BRF1_RX_LARGE_AGG    0x10    /* device can rx large aggregates */
3716 #define BRF1_RFAWARE_DCS    0x20    /* RFAWARE dynamic channel selection (DCS) */
3717 #define BRF1_SOFTAP        0x40    /* Configure as Broadcom SOFTAP */
3718 #define BRF1_DWDS        0x80    /* DWDS capable */
3719 
3720 /** Vendor IE structure */
3721 BWL_PRE_PACKED_STRUCT struct vndr_ie {
3722     uchar id;
3723     uchar len;
3724     uchar oui [3];
3725     uchar data [1];     /* Variable size data */
3726 } BWL_POST_PACKED_STRUCT;
3727 typedef struct vndr_ie vndr_ie_t;
3728 
3729 #define VNDR_IE_HDR_LEN        2    /* id + len field */
3730 #define VNDR_IE_MIN_LEN        3    /* size of the oui field */
3731 #define VNDR_IE_FIXED_LEN    (VNDR_IE_HDR_LEN + VNDR_IE_MIN_LEN)
3732 
3733 #define VNDR_IE_MAX_LEN        255    /* vendor IE max length, without ID and len */
3734 
3735 /** BRCM PROP DEVICE PRIMARY MAC ADDRESS IE */
3736 BWL_PRE_PACKED_STRUCT struct member_of_brcm_prop_ie {
3737     uchar id;
3738     uchar len;
3739     uchar oui[3];
3740     uint8    type;           /* type indicates what follows */
3741     struct ether_addr ea;   /* Device Primary MAC Adrress */
3742 } BWL_POST_PACKED_STRUCT;
3743 typedef struct member_of_brcm_prop_ie member_of_brcm_prop_ie_t;
3744 
3745 #define MEMBER_OF_BRCM_PROP_IE_LEN        10    /* IE max length */
3746 #define MEMBER_OF_BRCM_PROP_IE_HDRLEN            (sizeof(member_of_brcm_prop_ie_t))
3747 #define MEMBER_OF_BRCM_PROP_IE_TYPE        54
3748 
3749 /** BRCM Reliable Multicast IE */
3750 BWL_PRE_PACKED_STRUCT struct relmcast_brcm_prop_ie {
3751     uint8 id;
3752     uint8 len;
3753     uint8 oui[3];
3754     uint8 type;           /* type indicates what follows */
3755     struct ether_addr ea;   /* The ack sender's MAC Adrress */
3756     struct ether_addr mcast_ea;  /* The multicast MAC address */
3757     uint8 updtmo; /* time interval(second) for client to send null packet to report its rssi */
3758 } BWL_POST_PACKED_STRUCT;
3759 typedef struct relmcast_brcm_prop_ie relmcast_brcm_prop_ie_t;
3760 
3761 /* IE length */
3762 /* BRCM_PROP_IE_LEN = sizeof(relmcast_brcm_prop_ie_t)-((sizeof (id) + sizeof (len)))? */
3763 #define RELMCAST_BRCM_PROP_IE_LEN    (sizeof(relmcast_brcm_prop_ie_t)-(2*sizeof(uint8)))
3764 
3765 #define RELMCAST_BRCM_PROP_IE_TYPE    55
3766 
3767 /* BRCM BTC IE */
3768 BWL_PRE_PACKED_STRUCT struct btc_brcm_prop_ie {
3769     uint8 id;
3770     uint8 len;
3771     uint8 oui[3];
3772     uint8 type;           /* type inidicates what follows */
3773     uint32 info;
3774 } BWL_POST_PACKED_STRUCT;
3775 typedef struct btc_brcm_prop_ie btc_brcm_prop_ie_t;
3776 
3777 #define BTC_INFO_BRCM_PROP_IE_TYPE    90
3778 #define BRCM_BTC_INFO_TYPE_LEN    (sizeof(btc_brcm_prop_ie_t) - (2 * sizeof(uint8)))
3779 
3780 /* ************* HT definitions. ************* */
3781 #define MCSSET_LEN    16    /* 16-bits per 8-bit set to give 128-bits bitmap of MCS Index */
3782 #define MAX_MCS_NUM    (128)    /* max mcs number = 128 */
3783 
3784 BWL_PRE_PACKED_STRUCT struct ht_cap_ie {
3785     uint16    cap;
3786     uint8    params;
3787     uint8    supp_mcs[MCSSET_LEN];
3788     uint16    ext_htcap;
3789     uint32    txbf_cap;
3790     uint8    as_cap;
3791 } BWL_POST_PACKED_STRUCT;
3792 typedef struct ht_cap_ie ht_cap_ie_t;
3793 
3794 BWL_PRE_PACKED_STRUCT struct dot11_ht_cap_ie {
3795     uint8    id;
3796     uint8    len;
3797     ht_cap_ie_t ht_cap;
3798 } BWL_POST_PACKED_STRUCT;
3799 typedef struct dot11_ht_cap_ie dot11_ht_cap_ie_t;
3800 
3801 /* CAP IE: HT 1.0 spec. simply stole a 802.11 IE, we use our prop. IE until this is resolved */
3802 /* the capability IE is primarily used to convey this nodes abilities */
3803 BWL_PRE_PACKED_STRUCT struct ht_prop_cap_ie {
3804     uint8    id;        /* IE ID, 221, DOT11_MNG_PROPR_ID */
3805     uint8    len;        /* IE length */
3806     uint8    oui[3];
3807     uint8    type;           /* type indicates what follows */
3808     ht_cap_ie_t cap_ie;
3809 } BWL_POST_PACKED_STRUCT;
3810 typedef struct ht_prop_cap_ie ht_prop_cap_ie_t;
3811 
3812 #define HT_PROP_IE_OVERHEAD    4    /* overhead bytes for prop oui ie */
3813 #define HT_CAP_IE_LEN        26    /* HT capability len (based on .11n d2.0) */
3814 #define HT_CAP_IE_TYPE        51
3815 
3816 #define HT_CAP_LDPC_CODING    0x0001    /* Support for rx of LDPC coded pkts */
3817 #define HT_CAP_40MHZ        0x0002  /* FALSE:20Mhz, TRUE:20/40MHZ supported */
3818 #define HT_CAP_MIMO_PS_MASK    0x000C  /* Mimo PS mask */
3819 #define HT_CAP_MIMO_PS_SHIFT    0x0002    /* Mimo PS shift */
3820 #define HT_CAP_MIMO_PS_OFF    0x0003    /* Mimo PS, no restriction */
3821 #define HT_CAP_MIMO_PS_RTS    0x0001    /* Mimo PS, send RTS/CTS around MIMO frames */
3822 #define HT_CAP_MIMO_PS_ON    0x0000    /* Mimo PS, MIMO disallowed */
3823 #define HT_CAP_GF        0x0010    /* Greenfield preamble support */
3824 #define HT_CAP_SHORT_GI_20    0x0020    /* 20MHZ short guard interval support */
3825 #define HT_CAP_SHORT_GI_40    0x0040    /* 40Mhz short guard interval support */
3826 #define HT_CAP_TX_STBC        0x0080    /* Tx STBC support */
3827 #define HT_CAP_RX_STBC_MASK    0x0300    /* Rx STBC mask */
3828 #define HT_CAP_RX_STBC_SHIFT    8    /* Rx STBC shift */
3829 #define HT_CAP_DELAYED_BA    0x0400    /* delayed BA support */
3830 #define HT_CAP_MAX_AMSDU    0x0800    /* Max AMSDU size in bytes , 0=3839, 1=7935 */
3831 
3832 #define HT_CAP_DSSS_CCK    0x1000    /* DSSS/CCK supported by the BSS */
3833 #define HT_CAP_PSMP        0x2000    /* Power Save Multi Poll support */
3834 #define HT_CAP_40MHZ_INTOLERANT 0x4000    /* 40MHz Intolerant */
3835 #define HT_CAP_LSIG_TXOP    0x8000    /* L-SIG TXOP protection support */
3836 
3837 #define HT_CAP_RX_STBC_NO        0x0    /* no rx STBC support */
3838 #define HT_CAP_RX_STBC_ONE_STREAM    0x1    /* rx STBC support of 1 spatial stream */
3839 #define HT_CAP_RX_STBC_TWO_STREAM    0x2    /* rx STBC support of 1-2 spatial streams */
3840 #define HT_CAP_RX_STBC_THREE_STREAM    0x3    /* rx STBC support of 1-3 spatial streams */
3841 
3842 
3843 #define HT_CAP_TXBF_CAP_IMPLICIT_TXBF_RX    0x1
3844 #define HT_CAP_TXBF_CAP_NDP_RX            0x8
3845 #define HT_CAP_TXBF_CAP_NDP_TX            0x10
3846 #define HT_CAP_TXBF_CAP_EXPLICIT_CSI        0x100
3847 #define HT_CAP_TXBF_CAP_EXPLICIT_NC_STEERING    0x200
3848 #define HT_CAP_TXBF_CAP_EXPLICIT_C_STEERING    0x400
3849 #define HT_CAP_TXBF_CAP_EXPLICIT_CSI_FB_MASK    0x1800
3850 #define HT_CAP_TXBF_CAP_EXPLICIT_CSI_FB_SHIFT    11
3851 #define HT_CAP_TXBF_CAP_EXPLICIT_NC_FB_MASK    0x6000
3852 #define HT_CAP_TXBF_CAP_EXPLICIT_NC_FB_SHIFT    13
3853 #define HT_CAP_TXBF_CAP_EXPLICIT_C_FB_MASK    0x18000
3854 #define HT_CAP_TXBF_CAP_EXPLICIT_C_FB_SHIFT    15
3855 #define HT_CAP_TXBF_CAP_CSI_BFR_ANT_SHIFT    19
3856 #define HT_CAP_TXBF_CAP_NC_BFR_ANT_SHIFT    21
3857 #define HT_CAP_TXBF_CAP_C_BFR_ANT_SHIFT        23
3858 #define HT_CAP_TXBF_CAP_C_BFR_ANT_MASK        0x1800000
3859 
3860 #define HT_CAP_TXBF_CAP_CHAN_ESTIM_SHIFT    27
3861 #define HT_CAP_TXBF_CAP_CHAN_ESTIM_MASK        0x18000000
3862 
3863 #define HT_CAP_TXBF_FB_TYPE_NONE     0
3864 #define HT_CAP_TXBF_FB_TYPE_DELAYED     1
3865 #define HT_CAP_TXBF_FB_TYPE_IMMEDIATE     2
3866 #define HT_CAP_TXBF_FB_TYPE_BOTH     3
3867 
3868 #define HT_CAP_TX_BF_CAP_EXPLICIT_CSI_FB_MASK    0x400
3869 #define HT_CAP_TX_BF_CAP_EXPLICIT_CSI_FB_SHIFT    10
3870 #define HT_CAP_TX_BF_CAP_EXPLICIT_COMPRESSED_FB_MASK 0x18000
3871 #define HT_CAP_TX_BF_CAP_EXPLICIT_COMPRESSED_FB_SHIFT 15
3872 
3873 #define HT_CAP_MCS_FLAGS_SUPP_BYTE 12 /* byte offset in HT Cap Supported MCS for various flags */
3874 #define HT_CAP_MCS_RX_8TO15_BYTE_OFFSET                1
3875 #define HT_CAP_MCS_FLAGS_TX_RX_UNEQUAL              0x02
3876 #define HT_CAP_MCS_FLAGS_MAX_SPATIAL_STREAM_MASK    0x0C
3877 
3878 #define VHT_MAX_MPDU        11454    /* max mpdu size for now (bytes) */
3879 #define VHT_MPDU_MSDU_DELTA    56        /* Difference in spec - vht mpdu, amsdu len */
3880 /* Max AMSDU len - per spec */
3881 #define VHT_MAX_AMSDU        (VHT_MAX_MPDU - VHT_MPDU_MSDU_DELTA)
3882 
3883 #define HT_MAX_AMSDU        7935    /* max amsdu size (bytes) per the HT spec */
3884 #define HT_MIN_AMSDU        3835    /* min amsdu size (bytes) per the HT spec */
3885 
3886 #define HT_PARAMS_RX_FACTOR_MASK    0x03    /* ampdu rcv factor mask */
3887 #define HT_PARAMS_DENSITY_MASK        0x1C    /* ampdu density mask */
3888 #define HT_PARAMS_DENSITY_SHIFT    2    /* ampdu density shift */
3889 
3890 /* HT/AMPDU specific define */
3891 #define AMPDU_MAX_MPDU_DENSITY  7       /* max mpdu density; in 1/4 usec units */
3892 #define AMPDU_DENSITY_NONE      0       /* No density requirement */
3893 #define AMPDU_DENSITY_1over4_US 1       /* 1/4 us density */
3894 #define AMPDU_DENSITY_1over2_US 2       /* 1/2 us density */
3895 #define AMPDU_DENSITY_1_US      3       /*   1 us density */
3896 #define AMPDU_DENSITY_2_US      4       /*   2 us density */
3897 #define AMPDU_DENSITY_4_US      5       /*   4 us density */
3898 #define AMPDU_DENSITY_8_US      6       /*   8 us density */
3899 #define AMPDU_DENSITY_16_US     7       /*  16 us density */
3900 #define AMPDU_RX_FACTOR_8K      0       /* max rcv ampdu len (8kb) */
3901 #define AMPDU_RX_FACTOR_16K     1       /* max rcv ampdu len (16kb) */
3902 #define AMPDU_RX_FACTOR_32K     2       /* max rcv ampdu len (32kb) */
3903 #define AMPDU_RX_FACTOR_64K     3       /* max rcv ampdu len (64kb) */
3904 
3905 /* AMPDU RX factors for VHT rates */
3906 #define AMPDU_RX_FACTOR_128K    4       /* max rcv ampdu len (128kb) */
3907 #define AMPDU_RX_FACTOR_256K    5       /* max rcv ampdu len (256kb) */
3908 #define AMPDU_RX_FACTOR_512K    6       /* max rcv ampdu len (512kb) */
3909 #define AMPDU_RX_FACTOR_1024K   7       /* max rcv ampdu len (1024kb) */
3910 
3911 #define AMPDU_RX_FACTOR_BASE    8*1024  /* ampdu factor base for rx len */
3912 #define AMPDU_RX_FACTOR_BASE_PWR    13    /* ampdu factor base for rx len in power of 2 */
3913 
3914 #define AMPDU_DELIMITER_LEN    4    /* length of ampdu delimiter */
3915 #define AMPDU_DELIMITER_LEN_MAX    63    /* max length of ampdu delimiter(enforced in HW) */
3916 
3917 #define HT_CAP_EXT_PCO            0x0001
3918 #define HT_CAP_EXT_PCO_TTIME_MASK    0x0006
3919 #define HT_CAP_EXT_PCO_TTIME_SHIFT    1
3920 #define HT_CAP_EXT_MCS_FEEDBACK_MASK    0x0300
3921 #define HT_CAP_EXT_MCS_FEEDBACK_SHIFT    8
3922 #define HT_CAP_EXT_HTC            0x0400
3923 #define HT_CAP_EXT_RD_RESP        0x0800
3924 
3925 /** 'ht_add' is called 'HT Operation' information element in the 802.11 standard */
3926 BWL_PRE_PACKED_STRUCT struct ht_add_ie {
3927     uint8    ctl_ch;            /* control channel number */
3928     uint8    byte1;            /* ext ch,rec. ch. width, RIFS support */
3929     uint16    opmode;            /* operation mode */
3930     uint16    misc_bits;        /* misc bits */
3931     uint8    basic_mcs[MCSSET_LEN];  /* required MCS set */
3932 } BWL_POST_PACKED_STRUCT;
3933 typedef struct ht_add_ie ht_add_ie_t;
3934 
3935 /* ADD IE: HT 1.0 spec. simply stole a 802.11 IE, we use our prop. IE until this is resolved */
3936 /* the additional IE is primarily used to convey the current BSS configuration */
3937 BWL_PRE_PACKED_STRUCT struct ht_prop_add_ie {
3938     uint8    id;        /* IE ID, 221, DOT11_MNG_PROPR_ID */
3939     uint8    len;        /* IE length */
3940     uint8    oui[3];
3941     uint8    type;        /* indicates what follows */
3942     ht_add_ie_t add_ie;
3943 } BWL_POST_PACKED_STRUCT;
3944 typedef struct ht_prop_add_ie ht_prop_add_ie_t;
3945 
3946 #define HT_ADD_IE_LEN    22
3947 #define HT_ADD_IE_TYPE    52
3948 
3949 /* byte1 defn's */
3950 #define HT_BW_ANY        0x04    /* set, STA can use 20 or 40MHz */
3951 #define HT_RIFS_PERMITTED         0x08    /* RIFS allowed */
3952 
3953 /* opmode defn's */
3954 #define HT_OPMODE_MASK            0x0003    /* protection mode mask */
3955 #define HT_OPMODE_SHIFT        0    /* protection mode shift */
3956 #define HT_OPMODE_PURE        0x0000    /* protection mode PURE */
3957 #define HT_OPMODE_OPTIONAL    0x0001    /* protection mode optional */
3958 #define HT_OPMODE_HT20IN40    0x0002    /* protection mode 20MHz HT in 40MHz BSS */
3959 #define HT_OPMODE_MIXED    0x0003    /* protection mode Mixed Mode */
3960 #define HT_OPMODE_NONGF    0x0004    /* protection mode non-GF */
3961 #define DOT11N_TXBURST        0x0008    /* Tx burst limit */
3962 #define DOT11N_OBSS_NONHT    0x0010    /* OBSS Non-HT STA present */
3963 #define HT_OPMODE_CCFS2_MASK    0x1fe0    /* Channel Center Frequency Segment 2 mask */
3964 #define HT_OPMODE_CCFS2_SHIFT    5    /* Channel Center Frequency Segment 2 shift */
3965 
3966 /* misc_bites defn's */
3967 #define HT_BASIC_STBC_MCS    0x007f    /* basic STBC MCS */
3968 #define HT_DUAL_STBC_PROT    0x0080    /* Dual STBC Protection */
3969 #define HT_SECOND_BCN        0x0100    /* Secondary beacon support */
3970 #define HT_LSIG_TXOP        0x0200    /* L-SIG TXOP Protection full support */
3971 #define HT_PCO_ACTIVE        0x0400    /* PCO active */
3972 #define HT_PCO_PHASE        0x0800    /* PCO phase */
3973 #define HT_DUALCTS_PROTECTION    0x0080    /* DUAL CTS protection needed */
3974 
3975 /* Tx Burst Limits */
3976 #define DOT11N_2G_TXBURST_LIMIT    6160    /* 2G band Tx burst limit per 802.11n Draft 1.10 (usec) */
3977 #define DOT11N_5G_TXBURST_LIMIT    3080    /* 5G band Tx burst limit per 802.11n Draft 1.10 (usec) */
3978 
3979 /* Macros for opmode */
3980 #define GET_HT_OPMODE(add_ie)        ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
3981                     >> HT_OPMODE_SHIFT)
3982 #define HT_MIXEDMODE_PRESENT(add_ie)    ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
3983                     == HT_OPMODE_MIXED)    /* mixed mode present */
3984 #define HT_HT20_PRESENT(add_ie)    ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
3985                     == HT_OPMODE_HT20IN40)    /* 20MHz HT present */
3986 #define HT_OPTIONAL_PRESENT(add_ie)    ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
3987                     == HT_OPMODE_OPTIONAL)    /* Optional protection present */
3988 #define HT_USE_PROTECTION(add_ie)    (HT_HT20_PRESENT((add_ie)) || \
3989                     HT_MIXEDMODE_PRESENT((add_ie))) /* use protection */
3990 #define HT_NONGF_PRESENT(add_ie)    ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_NONGF) \
3991                     == HT_OPMODE_NONGF)    /* non-GF present */
3992 #define DOT11N_TXBURST_PRESENT(add_ie)    ((ltoh16_ua(&add_ie->opmode) & DOT11N_TXBURST) \
3993                     == DOT11N_TXBURST)    /* Tx Burst present */
3994 #define DOT11N_OBSS_NONHT_PRESENT(add_ie)    ((ltoh16_ua(&add_ie->opmode) & DOT11N_OBSS_NONHT) \
3995                     == DOT11N_OBSS_NONHT)    /* OBSS Non-HT present */
3996 #define HT_OPMODE_CCFS2_GET(add_ie)    ((ltoh16_ua(&(add_ie)->opmode) & HT_OPMODE_CCFS2_MASK) \
3997                     >> HT_OPMODE_CCFS2_SHIFT)    /* get CCFS2 */
3998 #define HT_OPMODE_CCFS2_SET(add_ie, ccfs2)    do { /* set CCFS2 */ \
3999     (add_ie)->opmode &= htol16(~HT_OPMODE_CCFS2_MASK); \
4000     (add_ie)->opmode |= htol16(((ccfs2) << HT_OPMODE_CCFS2_SHIFT) & HT_OPMODE_CCFS2_MASK); \
4001 } while (0)
4002 
4003 /* Macros for HT MCS field access */
4004 #define HT_CAP_MCS_BITMASK(supp_mcs)                 \
4005     ((supp_mcs)[HT_CAP_MCS_RX_8TO15_BYTE_OFFSET])
4006 #define HT_CAP_MCS_TX_RX_UNEQUAL(supp_mcs)          \
4007     ((supp_mcs)[HT_CAP_MCS_FLAGS_SUPP_BYTE] & HT_CAP_MCS_FLAGS_TX_RX_UNEQUAL)
4008 #define HT_CAP_MCS_TX_STREAM_SUPPORT(supp_mcs)          \
4009         ((supp_mcs)[HT_CAP_MCS_FLAGS_SUPP_BYTE] & HT_CAP_MCS_FLAGS_MAX_SPATIAL_STREAM_MASK)
4010 
4011 BWL_PRE_PACKED_STRUCT struct obss_params {
4012     uint16    passive_dwell;
4013     uint16    active_dwell;
4014     uint16    bss_widthscan_interval;
4015     uint16    passive_total;
4016     uint16    active_total;
4017     uint16    chanwidth_transition_dly;
4018     uint16    activity_threshold;
4019 } BWL_POST_PACKED_STRUCT;
4020 typedef struct obss_params obss_params_t;
4021 
4022 BWL_PRE_PACKED_STRUCT struct dot11_obss_ie {
4023     uint8    id;
4024     uint8    len;
4025     obss_params_t obss_params;
4026 } BWL_POST_PACKED_STRUCT;
4027 typedef struct dot11_obss_ie dot11_obss_ie_t;
4028 #define DOT11_OBSS_SCAN_IE_LEN    sizeof(obss_params_t)    /* HT OBSS len (based on 802.11n d3.0) */
4029 
4030 /* HT control field */
4031 #define HT_CTRL_LA_TRQ        0x00000002    /* sounding request */
4032 #define HT_CTRL_LA_MAI        0x0000003C    /* MCS request or antenna selection indication */
4033 #define HT_CTRL_LA_MAI_SHIFT    2
4034 #define HT_CTRL_LA_MAI_MRQ    0x00000004    /* MCS request */
4035 #define HT_CTRL_LA_MAI_MSI    0x00000038    /* MCS request sequence identifier */
4036 #define HT_CTRL_LA_MFSI        0x000001C0    /* MFB sequence identifier */
4037 #define HT_CTRL_LA_MFSI_SHIFT    6
4038 #define HT_CTRL_LA_MFB_ASELC    0x0000FE00    /* MCS feedback, antenna selection command/data */
4039 #define HT_CTRL_LA_MFB_ASELC_SH    9
4040 #define HT_CTRL_LA_ASELC_CMD    0x00000C00    /* ASEL command */
4041 #define HT_CTRL_LA_ASELC_DATA    0x0000F000    /* ASEL data */
4042 #define HT_CTRL_CAL_POS        0x00030000    /* Calibration position */
4043 #define HT_CTRL_CAL_SEQ        0x000C0000    /* Calibration sequence */
4044 #define HT_CTRL_CSI_STEERING    0x00C00000    /* CSI/Steering */
4045 #define HT_CTRL_CSI_STEER_SHIFT    22
4046 #define HT_CTRL_CSI_STEER_NFB    0        /* no fedback required */
4047 #define HT_CTRL_CSI_STEER_CSI    1        /* CSI, H matrix */
4048 #define HT_CTRL_CSI_STEER_NCOM    2        /* non-compressed beamforming */
4049 #define HT_CTRL_CSI_STEER_COM    3        /* compressed beamforming */
4050 #define HT_CTRL_NDP_ANNOUNCE    0x01000000    /* NDP announcement */
4051 #define HT_CTRL_AC_CONSTRAINT    0x40000000    /* AC Constraint */
4052 #define HT_CTRL_RDG_MOREPPDU    0x80000000    /* RDG/More PPDU */
4053 
4054 /* ************* VHT definitions. ************* */
4055 
4056 /**
4057  * VHT Capabilites IE (sec 8.4.2.160)
4058  */
4059 
4060 BWL_PRE_PACKED_STRUCT struct vht_cap_ie {
4061     uint32  vht_cap_info;
4062     /* supported MCS set - 64 bit field */
4063     uint16    rx_mcs_map;
4064     uint16  rx_max_rate;
4065     uint16  tx_mcs_map;
4066     uint16    tx_max_rate;
4067 } BWL_POST_PACKED_STRUCT;
4068 typedef struct vht_cap_ie vht_cap_ie_t;
4069 
4070 /* 4B cap_info + 8B supp_mcs */
4071 #define VHT_CAP_IE_LEN 12
4072 
4073 /* VHT Capabilities Info field - 32bit - in VHT Cap IE */
4074 #define VHT_CAP_INFO_MAX_MPDU_LEN_MASK          0x00000003
4075 #define VHT_CAP_INFO_SUPP_CHAN_WIDTH_MASK       0x0000000c
4076 #define VHT_CAP_INFO_LDPC                       0x00000010
4077 #define VHT_CAP_INFO_SGI_80MHZ                  0x00000020
4078 #define VHT_CAP_INFO_SGI_160MHZ                 0x00000040
4079 #define VHT_CAP_INFO_TX_STBC                    0x00000080
4080 #define VHT_CAP_INFO_RX_STBC_MASK               0x00000700
4081 #define VHT_CAP_INFO_RX_STBC_SHIFT              8
4082 #define VHT_CAP_INFO_SU_BEAMFMR                 0x00000800
4083 #define VHT_CAP_INFO_SU_BEAMFMEE                0x00001000
4084 #define VHT_CAP_INFO_NUM_BMFMR_ANT_MASK         0x0000e000
4085 #define VHT_CAP_INFO_NUM_BMFMR_ANT_SHIFT        13
4086 #define VHT_CAP_INFO_NUM_SOUNDING_DIM_MASK      0x00070000
4087 #define VHT_CAP_INFO_NUM_SOUNDING_DIM_SHIFT     16
4088 #define VHT_CAP_INFO_MU_BEAMFMR                 0x00080000
4089 #define VHT_CAP_INFO_MU_BEAMFMEE                0x00100000
4090 #define VHT_CAP_INFO_TXOPPS                     0x00200000
4091 #define VHT_CAP_INFO_HTCVHT                     0x00400000
4092 #define VHT_CAP_INFO_AMPDU_MAXLEN_EXP_MASK      0x03800000
4093 #define VHT_CAP_INFO_AMPDU_MAXLEN_EXP_SHIFT     23
4094 #define VHT_CAP_INFO_LINK_ADAPT_CAP_MASK        0x0c000000
4095 #define VHT_CAP_INFO_LINK_ADAPT_CAP_SHIFT       26
4096 #define VHT_CAP_INFO_EXT_NSS_BW_SUP_MASK        0xc0000000
4097 #define VHT_CAP_INFO_EXT_NSS_BW_SUP_SHIFT       30
4098 
4099 /* get Extended NSS BW Support passing vht cap info */
4100 #define VHT_CAP_EXT_NSS_BW_SUP(cap_info) \
4101     (((cap_info) & VHT_CAP_INFO_EXT_NSS_BW_SUP_MASK) >> VHT_CAP_INFO_EXT_NSS_BW_SUP_SHIFT)
4102 
4103 /* VHT CAP INFO extended NSS BW support - refer to IEEE 802.11 REVmc D8.0 Figure 9-559 */
4104 #define VHT_CAP_INFO_EXT_NSS_BW_HALF_160    1 /* 160MHz at half NSS CAP */
4105 #define VHT_CAP_INFO_EXT_NSS_BW_HALF_160_80P80    2 /* 160 & 80p80 MHz at half NSS CAP */
4106 
4107 /* VHT Supported MCS Set - 64-bit - in VHT Cap IE */
4108 #define VHT_CAP_SUPP_MCS_RX_HIGHEST_RATE_MASK   0x1fff
4109 #define VHT_CAP_SUPP_MCS_RX_HIGHEST_RATE_SHIFT  0
4110 #define VHT_CAP_SUPP_CHAN_WIDTH_SHIFT        5
4111 
4112 #define VHT_CAP_SUPP_MCS_TX_HIGHEST_RATE_MASK   0x1fff
4113 #define VHT_CAP_SUPP_MCS_TX_HIGHEST_RATE_SHIFT  0
4114 
4115 /* defines for field(s) in vht_cap_ie->rx_max_rate */
4116 #define VHT_CAP_MAX_NSTS_MASK            0xe000
4117 #define VHT_CAP_MAX_NSTS_SHIFT            13
4118 
4119 /* defines for field(s) in vht_cap_ie->tx_max_rate */
4120 #define VHT_CAP_EXT_NSS_BW_CAP            0x2000
4121 
4122 #define VHT_CAP_MCS_MAP_0_7                     0
4123 #define VHT_CAP_MCS_MAP_0_8                     1
4124 #define VHT_CAP_MCS_MAP_0_9                     2
4125 #define VHT_CAP_MCS_MAP_NONE                    3
4126 #define VHT_CAP_MCS_MAP_S                       2 /* num bits for 1-stream */
4127 #define VHT_CAP_MCS_MAP_M                       0x3 /* mask for 1-stream */
4128 /* assumes VHT_CAP_MCS_MAP_NONE is 3 and 2 bits are used for encoding */
4129 #define VHT_CAP_MCS_MAP_NONE_ALL                0xffff
4130 
4131 /* VHT rates bitmap */
4132 #define VHT_CAP_MCS_0_7_RATEMAP        0x00ff
4133 #define VHT_CAP_MCS_0_8_RATEMAP        0x01ff
4134 #define VHT_CAP_MCS_0_9_RATEMAP        0x03ff
4135 #define VHT_CAP_MCS_FULL_RATEMAP     VHT_CAP_MCS_0_9_RATEMAP
4136 
4137 #define VHT_PROP_MCS_MAP_10_11                   0
4138 #define VHT_PROP_MCS_MAP_UNUSED1                 1
4139 #define VHT_PROP_MCS_MAP_UNUSED2                 2
4140 #define VHT_PROP_MCS_MAP_NONE                    3
4141 #define VHT_PROP_MCS_MAP_NONE_ALL                0xffff
4142 
4143 /* VHT prop rates bitmap */
4144 #define VHT_PROP_MCS_10_11_RATEMAP    0x0c00
4145 #define VHT_PROP_MCS_FULL_RATEMAP    VHT_PROP_MCS_10_11_RATEMAP
4146 
4147 #if !defined(VHT_CAP_MCS_MAP_0_9_NSS3)
4148 /* mcsmap with MCS0-9 for Nss = 3 */
4149 #define VHT_CAP_MCS_MAP_0_9_NSS3 \
4150             ((VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(1)) | \
4151              (VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(2)) | \
4152              (VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(3)))
4153 #endif /* !VHT_CAP_MCS_MAP_0_9_NSS3 */
4154 
4155 #define VHT_CAP_MCS_MAP_NSS_MAX                 8
4156 
4157 /* get mcsmap with given mcs for given nss streams */
4158 #define VHT_CAP_MCS_MAP_CREATE(mcsmap, nss, mcs) \
4159     do { \
4160         int i; \
4161         for (i = 1; i <= nss; i++) { \
4162             VHT_MCS_MAP_SET_MCS_PER_SS(i, mcs, mcsmap); \
4163         } \
4164     } while (0)
4165 
4166 /* Map the mcs code to mcs bit map */
4167 #define VHT_MCS_CODE_TO_MCS_MAP(mcs_code) \
4168     ((mcs_code == VHT_CAP_MCS_MAP_0_7) ? VHT_CAP_MCS_0_7_RATEMAP : \
4169      (mcs_code == VHT_CAP_MCS_MAP_0_8) ? VHT_CAP_MCS_0_8_RATEMAP : \
4170      (mcs_code == VHT_CAP_MCS_MAP_0_9) ? VHT_CAP_MCS_0_9_RATEMAP : 0)
4171 
4172 #define VHT_PROP_MCS_CODE_TO_PROP_MCS_MAP(mcs_code) \
4173     ((mcs_code == VHT_PROP_MCS_MAP_10_11) ? VHT_PROP_MCS_10_11_RATEMAP : 0)
4174 
4175 /* Map the mcs bit map to mcs code */
4176 #define VHT_MCS_MAP_TO_MCS_CODE(mcs_map) \
4177     ((mcs_map == VHT_CAP_MCS_0_7_RATEMAP) ? VHT_CAP_MCS_MAP_0_7 : \
4178      (mcs_map == VHT_CAP_MCS_0_8_RATEMAP) ? VHT_CAP_MCS_MAP_0_8 : \
4179      (mcs_map == VHT_CAP_MCS_0_9_RATEMAP) ? VHT_CAP_MCS_MAP_0_9 : VHT_CAP_MCS_MAP_NONE)
4180 
4181 #define VHT_PROP_MCS_MAP_TO_PROP_MCS_CODE(mcs_map) \
4182     (((mcs_map & 0xc00) == 0xc00)  ? VHT_PROP_MCS_MAP_10_11 : VHT_PROP_MCS_MAP_NONE)
4183 
4184 /** VHT Capabilities Supported Channel Width */
4185 typedef enum vht_cap_chan_width {
4186     VHT_CAP_CHAN_WIDTH_SUPPORT_MANDATORY = 0x00,
4187     VHT_CAP_CHAN_WIDTH_SUPPORT_160       = 0x04,
4188     VHT_CAP_CHAN_WIDTH_SUPPORT_160_8080  = 0x08
4189 } vht_cap_chan_width_t;
4190 
4191 /** VHT Capabilities Supported max MPDU LEN (sec 8.4.2.160.2) */
4192 typedef enum vht_cap_max_mpdu_len {
4193     VHT_CAP_MPDU_MAX_4K     = 0x00,
4194     VHT_CAP_MPDU_MAX_8K     = 0x01,
4195     VHT_CAP_MPDU_MAX_11K    = 0x02
4196 } vht_cap_max_mpdu_len_t;
4197 
4198 /* Maximum MPDU Length byte counts for the VHT Capabilities advertised limits */
4199 #define VHT_MPDU_LIMIT_4K        3895
4200 #define VHT_MPDU_LIMIT_8K        7991
4201 #define VHT_MPDU_LIMIT_11K      11454
4202 
4203 
4204 /**
4205  * VHT Operation IE (sec 8.4.2.161)
4206  */
4207 
4208 BWL_PRE_PACKED_STRUCT struct vht_op_ie {
4209     uint8    chan_width;
4210     uint8    chan1;
4211     uint8    chan2;
4212     uint16    supp_mcs;  /*  same def as above in vht cap */
4213 } BWL_POST_PACKED_STRUCT;
4214 typedef struct vht_op_ie vht_op_ie_t;
4215 
4216 /* 3B VHT Op info + 2B Basic MCS */
4217 #define VHT_OP_IE_LEN 5
4218 
4219 typedef enum vht_op_chan_width {
4220     VHT_OP_CHAN_WIDTH_20_40    = 0,
4221     VHT_OP_CHAN_WIDTH_80    = 1,
4222     VHT_OP_CHAN_WIDTH_160    = 2, /* deprecated - IEEE 802.11 REVmc D8.0 Table 11-25 */
4223     VHT_OP_CHAN_WIDTH_80_80    = 3  /* deprecated - IEEE 802.11 REVmc D8.0 Table 11-25 */
4224 } vht_op_chan_width_t;
4225 
4226 /* AID length */
4227 #define AID_IE_LEN        2
4228 /**
4229  * BRCM vht features IE header
4230  * The header if the fixed part of the IE
4231  * On the 5GHz band this is the entire IE,
4232  * on 2.4GHz the VHT IEs as defined in the 802.11ac
4233  * specification follows
4234  *
4235  *
4236  * VHT features rates  bitmap.
4237  * Bit0:        5G MCS 0-9 BW 160MHz
4238  * Bit1:        5G MCS 0-9 support BW 80MHz
4239  * Bit2:        5G MCS 0-9 support BW 20MHz
4240  * Bit3:        2.4G MCS 0-9 support BW 20MHz
4241  * Bits:4-7    Reserved for future use
4242  *
4243  */
4244 #define VHT_FEATURES_IE_TYPE    0x4
4245 BWL_PRE_PACKED_STRUCT struct vht_features_ie_hdr {
4246     uint8 oui[3];
4247     uint8 type;        /* type of this IE = 4 */
4248     uint8 rate_mask;    /* VHT rate mask */
4249 } BWL_POST_PACKED_STRUCT;
4250 typedef struct vht_features_ie_hdr vht_features_ie_hdr_t;
4251 
4252 /* Def for rx & tx basic mcs maps - ea ss num has 2 bits of info */
4253 #define VHT_MCS_MAP_GET_SS_IDX(nss) (((nss)-1) * VHT_CAP_MCS_MAP_S)
4254 #define VHT_MCS_MAP_GET_MCS_PER_SS(nss, mcsMap) \
4255     (((mcsMap) >> VHT_MCS_MAP_GET_SS_IDX(nss)) & VHT_CAP_MCS_MAP_M)
4256 #define VHT_MCS_MAP_SET_MCS_PER_SS(nss, numMcs, mcsMap) \
4257     do { \
4258         (mcsMap) &= (~(VHT_CAP_MCS_MAP_M << VHT_MCS_MAP_GET_SS_IDX(nss))); \
4259         (mcsMap) |= (((numMcs) & VHT_CAP_MCS_MAP_M) << VHT_MCS_MAP_GET_SS_IDX(nss)); \
4260     } while (0)
4261 #define VHT_MCS_SS_SUPPORTED(nss, mcsMap) \
4262     (VHT_MCS_MAP_GET_MCS_PER_SS((nss), (mcsMap)) != VHT_CAP_MCS_MAP_NONE)
4263 
4264 /* Get the max ss supported from the mcs map */
4265 #define VHT_MAX_SS_SUPPORTED(mcsMap) \
4266     VHT_MCS_SS_SUPPORTED(8, mcsMap) ? 8 : \
4267     VHT_MCS_SS_SUPPORTED(7, mcsMap) ? 7 : \
4268     VHT_MCS_SS_SUPPORTED(6, mcsMap) ? 6 : \
4269     VHT_MCS_SS_SUPPORTED(5, mcsMap) ? 5 : \
4270     VHT_MCS_SS_SUPPORTED(4, mcsMap) ? 4 : \
4271     VHT_MCS_SS_SUPPORTED(3, mcsMap) ? 3 : \
4272     VHT_MCS_SS_SUPPORTED(2, mcsMap) ? 2 : \
4273     VHT_MCS_SS_SUPPORTED(1, mcsMap) ? 1 : 0
4274 
4275 /* ************* WPA definitions. ************* */
4276 #define WPA_OUI            "\x00\x50\xF2"    /* WPA OUI */
4277 #define WPA_OUI_LEN        3        /* WPA OUI length */
4278 #define WPA_OUI_TYPE        1
4279 #define WPA_VERSION        1        /* WPA version */
4280 #define WPA2_OUI        "\x00\x0F\xAC"    /* WPA2 OUI */
4281 #define WPA2_OUI_LEN        3        /* WPA2 OUI length */
4282 #define WPA2_VERSION        1        /* WPA2 version */
4283 #define WPA2_VERSION_LEN    2        /* WAP2 version length */
4284 
4285 /* ************* WPS definitions. ************* */
4286 #define WPS_OUI            "\x00\x50\xF2"    /* WPS OUI */
4287 #define WPS_OUI_LEN        3        /* WPS OUI length */
4288 #define WPS_OUI_TYPE        4
4289 
4290 /* ************* WFA definitions. ************* */
4291 #if defined(WL_LEGACY_P2P)
4292 #define MAC_OUI            "\x00\x17\xF2"    /* MACOSX OUI */
4293 #define MAC_OUI_TYPE_P2P    5
4294 #endif
4295 
4296 #ifdef P2P_IE_OVRD
4297 #define WFA_OUI            MAC_OUI
4298 #else
4299 #define WFA_OUI            "\x50\x6F\x9A"    /* WFA OUI */
4300 #endif /* P2P_IE_OVRD */
4301 #define WFA_OUI_LEN        3        /* WFA OUI length */
4302 #ifdef P2P_IE_OVRD
4303 #define WFA_OUI_TYPE_P2P    MAC_OUI_TYPE_P2P
4304 #else
4305 #define WFA_OUI_TYPE_TPC    8
4306 #define WFA_OUI_TYPE_P2P    9
4307 #endif
4308 
4309 #define WFA_OUI_TYPE_TPC    8
4310 #ifdef WLTDLS
4311 #define WFA_OUI_TYPE_TPQ    4    /* WFD Tunneled Probe ReQuest */
4312 #define WFA_OUI_TYPE_TPS    5    /* WFD Tunneled Probe ReSponse */
4313 #define WFA_OUI_TYPE_WFD    10
4314 #endif /* WTDLS */
4315 #define WFA_OUI_TYPE_HS20    0x10
4316 #define WFA_OUI_TYPE_OSEN    0x12
4317 #define WFA_OUI_TYPE_NAN    0x13
4318 #define WFA_OUI_TYPE_MBO    0x16
4319 #define WFA_OUI_TYPE_MBO_OCE    0x16
4320 
4321 /* RSN authenticated key managment suite */
4322 #define RSN_AKM_NONE        0    /* None (IBSS) */
4323 #define RSN_AKM_UNSPECIFIED    1    /* Over 802.1x */
4324 #define RSN_AKM_PSK        2    /* Pre-shared Key */
4325 #define RSN_AKM_FBT_1X        3    /* Fast Bss transition using 802.1X */
4326 #define RSN_AKM_FBT_PSK        4    /* Fast Bss transition using Pre-shared Key */
4327 /* RSN_AKM_MFP_1X and RSN_AKM_MFP_PSK are not used any more
4328  * Just kept here to avoid build issue in BISON/CARIBOU branch
4329  */
4330 #define RSN_AKM_MFP_1X        5    /* SHA256 key derivation, using 802.1X */
4331 #define RSN_AKM_MFP_PSK        6    /* SHA256 key derivation, using Pre-shared Key */
4332 #define RSN_AKM_SHA256_1X    5    /* SHA256 key derivation, using 802.1X */
4333 #define RSN_AKM_SHA256_PSK    6    /* SHA256 key derivation, using Pre-shared Key */
4334 #define RSN_AKM_TPK        7    /* TPK(TDLS Peer Key) handshake */
4335 #define RSN_AKM_FILS_SHA256    14    /* SHA256 key derivation, using FILS */
4336 #define RSN_AKM_FILS_SHA384    15    /* SHA384 key derivation, using FILS */
4337 
4338 /* OSEN authenticated key managment suite */
4339 #define OSEN_AKM_UNSPECIFIED    RSN_AKM_UNSPECIFIED    /* Over 802.1x */
4340 
4341 /* Key related defines */
4342 #define DOT11_MAX_DEFAULT_KEYS    4    /* number of default keys */
4343 #define DOT11_MAX_IGTK_KEYS        2
4344 #define DOT11_MAX_KEY_SIZE    32    /* max size of any key */
4345 #define DOT11_MAX_IV_SIZE    16    /* max size of any IV */
4346 #define DOT11_EXT_IV_FLAG    (1<<5)    /* flag to indicate IV is > 4 bytes */
4347 #define DOT11_WPA_KEY_RSC_LEN   8       /* WPA RSC key len */
4348 
4349 #define WEP1_KEY_SIZE        5    /* max size of any WEP key */
4350 #define WEP1_KEY_HEX_SIZE    10    /* size of WEP key in hex. */
4351 #define WEP128_KEY_SIZE        13    /* max size of any WEP key */
4352 #define WEP128_KEY_HEX_SIZE    26    /* size of WEP key in hex. */
4353 #define TKIP_MIC_SIZE        8    /* size of TKIP MIC */
4354 #define TKIP_EOM_SIZE        7    /* max size of TKIP EOM */
4355 #define TKIP_EOM_FLAG        0x5a    /* TKIP EOM flag byte */
4356 #define TKIP_KEY_SIZE        32    /* size of any TKIP key, includs MIC keys */
4357 #define TKIP_TK_SIZE        16
4358 #define TKIP_MIC_KEY_SIZE    8
4359 #define TKIP_MIC_AUTH_TX    16    /* offset to Authenticator MIC TX key */
4360 #define TKIP_MIC_AUTH_RX    24    /* offset to Authenticator MIC RX key */
4361 #define TKIP_MIC_SUP_RX        TKIP_MIC_AUTH_TX    /* offset to Supplicant MIC RX key */
4362 #define TKIP_MIC_SUP_TX        TKIP_MIC_AUTH_RX    /* offset to Supplicant MIC TX key */
4363 #define AES_KEY_SIZE        16    /* size of AES key */
4364 #define AES_MIC_SIZE        8    /* size of AES MIC */
4365 #define BIP_KEY_SIZE        16    /* size of BIP key */
4366 #define BIP_MIC_SIZE        8   /* sizeof BIP MIC */
4367 
4368 #define AES_GCM_MIC_SIZE    16    /* size of MIC for 128-bit GCM - .11adD9 */
4369 
4370 #define AES256_KEY_SIZE        32    /* size of AES 256 key - .11acD5 */
4371 #define AES256_MIC_SIZE        16    /* size of MIC for 256 bit keys, incl BIP */
4372 
4373 /* WCN */
4374 #define WCN_OUI            "\x00\x50\xf2"    /* WCN OUI */
4375 #define WCN_TYPE        4    /* WCN type */
4376 
4377 #ifdef BCMWAPI_WPI
4378 #define SMS4_KEY_LEN        16
4379 #define SMS4_WPI_CBC_MAC_LEN    16
4380 #endif
4381 
4382 /* 802.11r protocol definitions */
4383 
4384 /** Mobility Domain IE */
4385 BWL_PRE_PACKED_STRUCT struct dot11_mdid_ie {
4386     uint8 id;
4387     uint8 len;
4388     uint16 mdid;        /* Mobility Domain Id */
4389     uint8 cap;
4390 } BWL_POST_PACKED_STRUCT;
4391 typedef struct dot11_mdid_ie dot11_mdid_ie_t;
4392 
4393 #define FBT_MDID_CAP_OVERDS    0x01    /* Fast Bss transition over the DS support */
4394 #define FBT_MDID_CAP_RRP    0x02    /* Resource request protocol support */
4395 
4396 /** Fast Bss Transition IE */
4397 BWL_PRE_PACKED_STRUCT struct dot11_ft_ie {
4398     uint8 id;
4399     uint8 len;
4400     uint16 mic_control;        /* Mic Control */
4401     uint8 mic[16];
4402     uint8 anonce[32];
4403     uint8 snonce[32];
4404 } BWL_POST_PACKED_STRUCT;
4405 typedef struct dot11_ft_ie dot11_ft_ie_t;
4406 
4407 #define TIE_TYPE_RESERVED        0
4408 #define TIE_TYPE_REASSOC_DEADLINE    1
4409 #define TIE_TYPE_KEY_LIEFTIME        2
4410 #define TIE_TYPE_ASSOC_COMEBACK        3
4411 BWL_PRE_PACKED_STRUCT struct dot11_timeout_ie {
4412     uint8 id;
4413     uint8 len;
4414     uint8 type;        /* timeout interval type */
4415     uint32 value;        /* timeout interval value */
4416 } BWL_POST_PACKED_STRUCT;
4417 typedef struct dot11_timeout_ie dot11_timeout_ie_t;
4418 
4419 /** GTK ie */
4420 BWL_PRE_PACKED_STRUCT struct dot11_gtk_ie {
4421     uint8 id;
4422     uint8 len;
4423     uint16 key_info;
4424     uint8 key_len;
4425     uint8 rsc[8];
4426     uint8 data[1];
4427 } BWL_POST_PACKED_STRUCT;
4428 typedef struct dot11_gtk_ie dot11_gtk_ie_t;
4429 
4430 /** Management MIC ie */
4431 BWL_PRE_PACKED_STRUCT struct mmic_ie {
4432     uint8   id;                    /* IE ID: DOT11_MNG_MMIE_ID */
4433     uint8   len;                /* IE length */
4434     uint16  key_id;                /* key id */
4435     uint8   ipn[6];                /* ipn */
4436     uint8   mic[16];            /* mic */
4437 } BWL_POST_PACKED_STRUCT;
4438 typedef struct mmic_ie mmic_ie_t;
4439 
4440 /* 802.11r-2008, 11A.10.3 - RRB frame format */
4441 BWL_PRE_PACKED_STRUCT struct dot11_ft_rrb_frame {
4442     uint8  frame_type; /* 1 for RRB */
4443     uint8  packet_type; /* 0 for Request 1 for Response */
4444     uint16 len;
4445     uint8  cur_ap_addr[ETHER_ADDR_LEN];
4446     uint8  data[1];    /* IEs Received/Sent in FT Action Req/Resp Frame */
4447 } BWL_POST_PACKED_STRUCT;
4448 
4449 typedef struct dot11_ft_rrb_frame dot11_ft_rrb_frame_t;
4450 
4451 #define DOT11_FT_RRB_FIXED_LEN 10
4452 #define DOT11_FT_REMOTE_FRAME_TYPE 1
4453 #define DOT11_FT_PACKET_REQ 0
4454 #define DOT11_FT_PACKET_RESP 1
4455 
4456 #define BSSID_INVALID           "\x00\x00\x00\x00\x00\x00"
4457 #define BSSID_BROADCAST         "\xFF\xFF\xFF\xFF\xFF\xFF"
4458 
4459 #ifdef BCMWAPI_WAI
4460 #define WAPI_IE_MIN_LEN     20    /* WAPI IE min length */
4461 #define WAPI_VERSION        1    /* WAPI version */
4462 #define WAPI_VERSION_LEN    2    /* WAPI version length */
4463 #define WAPI_OUI        "\x00\x14\x72"    /* WAPI OUI */
4464 #define WAPI_OUI_LEN        DOT11_OUI_LEN    /* WAPI OUI length */
4465 #endif /* BCMWAPI_WAI */
4466 
4467 /* ************* WMM Parameter definitions. ************* */
4468 #define WMM_OUI            "\x00\x50\xF2"    /* WNN OUI */
4469 #define WMM_OUI_LEN        3        /* WMM OUI length */
4470 #define WMM_OUI_TYPE    2        /* WMM OUT type */
4471 #define WMM_VERSION        1
4472 #define WMM_VERSION_LEN    1
4473 
4474 /* WMM OUI subtype */
4475 #define WMM_OUI_SUBTYPE_PARAMETER    1
4476 #define WMM_PARAMETER_IE_LEN        24
4477 
4478 /** Link Identifier Element */
4479 BWL_PRE_PACKED_STRUCT struct link_id_ie {
4480     uint8 id;
4481     uint8 len;
4482     struct ether_addr    bssid;
4483     struct ether_addr    tdls_init_mac;
4484     struct ether_addr    tdls_resp_mac;
4485 } BWL_POST_PACKED_STRUCT;
4486 typedef struct link_id_ie link_id_ie_t;
4487 #define TDLS_LINK_ID_IE_LEN        18
4488 
4489 /** Link Wakeup Schedule Element */
4490 BWL_PRE_PACKED_STRUCT struct wakeup_sch_ie {
4491     uint8 id;
4492     uint8 len;
4493     uint32 offset;            /* in ms between TSF0 and start of 1st Awake Window */
4494     uint32 interval;        /* in ms bwtween the start of 2 Awake Windows */
4495     uint32 awake_win_slots;    /* in backof slots, duration of Awake Window */
4496     uint32 max_wake_win;    /* in ms, max duration of Awake Window */
4497     uint16 idle_cnt;        /* number of consecutive Awake Windows */
4498 } BWL_POST_PACKED_STRUCT;
4499 typedef struct wakeup_sch_ie wakeup_sch_ie_t;
4500 #define TDLS_WAKEUP_SCH_IE_LEN        18
4501 
4502 /** Channel Switch Timing Element */
4503 BWL_PRE_PACKED_STRUCT struct channel_switch_timing_ie {
4504     uint8 id;
4505     uint8 len;
4506     uint16 switch_time;        /* in ms, time to switch channels */
4507     uint16 switch_timeout;    /* in ms */
4508 } BWL_POST_PACKED_STRUCT;
4509 typedef struct channel_switch_timing_ie channel_switch_timing_ie_t;
4510 #define TDLS_CHANNEL_SWITCH_TIMING_IE_LEN        4
4511 
4512 /** PTI Control Element */
4513 BWL_PRE_PACKED_STRUCT struct pti_control_ie {
4514     uint8 id;
4515     uint8 len;
4516     uint8 tid;
4517     uint16 seq_control;
4518 } BWL_POST_PACKED_STRUCT;
4519 typedef struct pti_control_ie pti_control_ie_t;
4520 #define TDLS_PTI_CONTROL_IE_LEN        3
4521 
4522 /** PU Buffer Status Element */
4523 BWL_PRE_PACKED_STRUCT struct pu_buffer_status_ie {
4524     uint8 id;
4525     uint8 len;
4526     uint8 status;
4527 } BWL_POST_PACKED_STRUCT;
4528 typedef struct pu_buffer_status_ie pu_buffer_status_ie_t;
4529 #define TDLS_PU_BUFFER_STATUS_IE_LEN    1
4530 #define TDLS_PU_BUFFER_STATUS_AC_BK        1
4531 #define TDLS_PU_BUFFER_STATUS_AC_BE        2
4532 #define TDLS_PU_BUFFER_STATUS_AC_VI        4
4533 #define TDLS_PU_BUFFER_STATUS_AC_VO        8
4534 
4535 /* TDLS Action Field Values */
4536 #define TDLS_SETUP_REQ                0
4537 #define TDLS_SETUP_RESP                1
4538 #define TDLS_SETUP_CONFIRM            2
4539 #define TDLS_TEARDOWN                3
4540 #define TDLS_PEER_TRAFFIC_IND            4
4541 #define TDLS_CHANNEL_SWITCH_REQ            5
4542 #define TDLS_CHANNEL_SWITCH_RESP        6
4543 #define TDLS_PEER_PSM_REQ            7
4544 #define TDLS_PEER_PSM_RESP            8
4545 #define TDLS_PEER_TRAFFIC_RESP            9
4546 #define TDLS_DISCOVERY_REQ            10
4547 
4548 /* 802.11z TDLS Public Action Frame action field */
4549 #define TDLS_DISCOVERY_RESP            14
4550 
4551 /* 802.11u GAS action frames */
4552 #define GAS_REQUEST_ACTION_FRAME                10
4553 #define GAS_RESPONSE_ACTION_FRAME                11
4554 #define GAS_COMEBACK_REQUEST_ACTION_FRAME        12
4555 #define GAS_COMEBACK_RESPONSE_ACTION_FRAME        13
4556 
4557 /* FTM - fine timing measurement public action frames */
4558 BWL_PRE_PACKED_STRUCT struct dot11_ftm_req {
4559     uint8 category;                /* category of action frame (4) */
4560     uint8 action;                /* public action (32) */
4561     uint8 trigger;                /* trigger/continue? */
4562     /* optional lci, civic loc, ftm params */
4563 } BWL_POST_PACKED_STRUCT;
4564 typedef struct dot11_ftm_req dot11_ftm_req_t;
4565 
4566 BWL_PRE_PACKED_STRUCT struct dot11_ftm {
4567     uint8 category;                /* category of action frame (4) */
4568     uint8 action;                /* public action (33) */
4569     uint8 dialog;                /* dialog token */
4570     uint8 follow_up;            /* follow up dialog token */
4571     uint8 tod[6];                /* t1 - last depart timestamp */
4572     uint8 toa[6];                /* t4 - last ack arrival timestamp */
4573     uint8 tod_err[2];            /* t1 error */
4574     uint8 toa_err[2];            /* t4 error */
4575     /* optional lci report, civic loc report, ftm params */
4576 } BWL_POST_PACKED_STRUCT;
4577 typedef struct dot11_ftm dot11_ftm_t;
4578 
4579 
4580 #define DOT11_FTM_ERR_NOT_CONT_OFFSET 1
4581 #define DOT11_FTM_ERR_NOT_CONT_MASK 0x80
4582 #define DOT11_FTM_ERR_NOT_CONT_SHIFT 7
4583 #define DOT11_FTM_ERR_NOT_CONT(_err) (((_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET] & \
4584     DOT11_FTM_ERR_NOT_CONT_MASK) >> DOT11_FTM_ERR_NOT_CONT_SHIFT)
4585 #define DOT11_FTM_ERR_SET_NOT_CONT(_err, _val) do {\
4586     uint8 _err2 = (_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET]; \
4587     _err2 &= ~DOT11_FTM_ERR_NOT_CONT_MASK; \
4588     _err2 |= ((_val) << DOT11_FTM_ERR_NOT_CONT_SHIFT) & DOT11_FTM_ERR_NOT_CONT_MASK; \
4589     (_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET] = _err2; \
4590 } while (0)
4591 
4592 #define DOT11_FTM_ERR_MAX_ERR_OFFSET 0
4593 #define DOT11_FTM_ERR_MAX_ERR_MASK 0x7fff
4594 #define DOT11_FTM_ERR_MAX_ERR_SHIFT 0
4595 #define DOT11_FTM_ERR_MAX_ERR(_err) (((((_err)[1] & 0x7f) << 8) | (_err)[0]))
4596 #define DOT11_FTM_ERR_SET_MAX_ERR(_err, _val) do {\
4597     uint16 _val2; \
4598     uint16 _not_cont; \
4599     _val2 =  (((_val) & DOT11_FTM_ERR_MAX_ERR_MASK) << DOT11_FTM_ERR_MAX_ERR_SHIFT); \
4600     _val2 = (_val2 > 0x3fff) ? 0 : _val2; /* not expecting > 16ns error */ \
4601     _not_cont = DOT11_FTM_ERR_NOT_CONT(_err); \
4602     (_err)[0] = _val2 & 0xff; \
4603     (_err)[1] = (_val2 >> 8) & 0xff; \
4604     DOT11_FTM_ERR_SET_NOT_CONT(_err, _not_cont); \
4605 } while (0)
4606 
4607 #if defined(DOT11_FTM_ERR_ROM_COMPAT)
4608 /* incorrect defs - here for ROM compatibiity */
4609 #undef DOT11_FTM_ERR_NOT_CONT_OFFSET
4610 #undef DOT11_FTM_ERR_NOT_CONT_MASK
4611 #undef DOT11_FTM_ERR_NOT_CONT_SHIFT
4612 #undef DOT11_FTM_ERR_NOT_CONT
4613 #undef DOT11_FTM_ERR_SET_NOT_CONT
4614 
4615 #define DOT11_FTM_ERR_NOT_CONT_OFFSET 0
4616 #define DOT11_FTM_ERR_NOT_CONT_MASK 0x0001
4617 #define DOT11_FTM_ERR_NOT_CONT_SHIFT 0
4618 #define DOT11_FTM_ERR_NOT_CONT(_err) (((_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET] & \
4619     DOT11_FTM_ERR_NOT_CONT_MASK) >> DOT11_FTM_ERR_NOT_CONT_SHIFT)
4620 #define DOT11_FTM_ERR_SET_NOT_CONT(_err, _val) do {\
4621     uint8 _err2 = (_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET]; \
4622     _err2 &= ~DOT11_FTM_ERR_NOT_CONT_MASK; \
4623     _err2 |= ((_val) << DOT11_FTM_ERR_NOT_CONT_SHIFT) & DOT11_FTM_ERR_NOT_CONT_MASK; \
4624     (_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET] = _err2; \
4625 } while (0)
4626 
4627 #undef DOT11_FTM_ERR_MAX_ERR_OFFSET
4628 #undef DOT11_FTM_ERR_MAX_ERR_MASK
4629 #undef DOT11_FTM_ERR_MAX_ERR_SHIFT
4630 #undef DOT11_FTM_ERR_MAX_ERR
4631 #undef DOT11_FTM_ERR_SET_MAX_ERR
4632 
4633 #define DOT11_FTM_ERR_MAX_ERR_OFFSET 0
4634 #define DOT11_FTM_ERR_MAX_ERR_MASK 0xfff7
4635 #define DOT11_FTM_ERR_MAX_ERR_SHIFT 1
4636 #define DOT11_FTM_ERR_MAX_ERR(_err) ((((_err)[1] << 7) | (_err)[0]) >> 1)
4637 #define DOT11_FTM_ERR_SET_MAX_ERR(_err, _val) do {\
4638     uint16 _val2; \
4639     _val2 =  (((_val) << DOT11_FTM_ERR_MAX_ERR_SHIFT) |\
4640          ((_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET] & DOT11_FTM_ERR_NOT_CONT_MASK)); \
4641     (_err)[0] = _val2 & 0xff; \
4642     (_err)[1] = _val2 >> 8 & 0xff; \
4643 } while (0)
4644 #endif /* DOT11_FTM_ERR_ROM_COMPAT */
4645 
4646 BWL_PRE_PACKED_STRUCT struct dot11_ftm_params {
4647     uint8 id;        /* DOT11_MNG_FTM_PARAM_ID 8.4.2.166 11mcd2.6/2014 - revisit */
4648     uint8 len;
4649     uint8 info[9];
4650 } BWL_POST_PACKED_STRUCT;
4651 typedef struct dot11_ftm_params dot11_ftm_params_t;
4652 #define DOT11_FTM_PARAMS_IE_LEN (sizeof(dot11_ftm_params_t) - 2)
4653 
4654 #define FTM_PARAMS_FIELD(_p, _off, _mask, _shift) (((_p)->info[(_off)] & (_mask)) >> (_shift))
4655 #define FTM_PARAMS_SET_FIELD(_p, _off, _mask, _shift, _val) do {\
4656     uint8 _ptmp = (_p)->info[_off] & ~(_mask); \
4657     (_p)->info[(_off)] = _ptmp | (((_val) << (_shift)) & (_mask)); \
4658 } while (0)
4659 
4660 #define FTM_PARAMS_STATUS_OFFSET 0
4661 #define FTM_PARAMS_STATUS_MASK 0x03
4662 #define FTM_PARAMS_STATUS_SHIFT 0
4663 #define FTM_PARAMS_STATUS(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_STATUS_OFFSET, \
4664     FTM_PARAMS_STATUS_MASK, FTM_PARAMS_STATUS_SHIFT)
4665 #define FTM_PARAMS_SET_STATUS(_p, _status) FTM_PARAMS_SET_FIELD(_p, \
4666     FTM_PARAMS_STATUS_OFFSET, FTM_PARAMS_STATUS_MASK, FTM_PARAMS_STATUS_SHIFT, _status)
4667 
4668 #define FTM_PARAMS_VALUE_OFFSET 0
4669 #define FTM_PARAMS_VALUE_MASK 0x7c
4670 #define FTM_PARAMS_VALUE_SHIFT 2
4671 #define FTM_PARAMS_VALUE(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_VALUE_OFFSET, \
4672     FTM_PARAMS_VALUE_MASK, FTM_PARAMS_VALUE_SHIFT)
4673 #define FTM_PARAMS_SET_VALUE(_p, _value) FTM_PARAMS_SET_FIELD(_p, \
4674     FTM_PARAMS_VALUE_OFFSET, FTM_PARAMS_VALUE_MASK, FTM_PARAMS_VALUE_SHIFT, _value)
4675 #define FTM_PARAMS_MAX_VALUE 32
4676 
4677 #define FTM_PARAMS_NBURSTEXP_OFFSET 1
4678 #define FTM_PARAMS_NBURSTEXP_MASK 0x0f
4679 #define FTM_PARAMS_NBURSTEXP_SHIFT 0
4680 #define FTM_PARAMS_NBURSTEXP(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_NBURSTEXP_OFFSET, \
4681     FTM_PARAMS_NBURSTEXP_MASK, FTM_PARAMS_NBURSTEXP_SHIFT)
4682 #define FTM_PARAMS_SET_NBURSTEXP(_p, _bexp) FTM_PARAMS_SET_FIELD(_p, \
4683     FTM_PARAMS_NBURSTEXP_OFFSET, FTM_PARAMS_NBURSTEXP_MASK, FTM_PARAMS_NBURSTEXP_SHIFT, \
4684     _bexp)
4685 
4686 #define FTM_PARAMS_NBURST(_p) (1 << FTM_PARAMS_NBURSTEXP(_p))
4687 
4688 enum {
4689     FTM_PARAMS_NBURSTEXP_NOPREF = 15
4690 };
4691 
4692 enum {
4693     FTM_PARAMS_BURSTTMO_NOPREF = 15
4694 };
4695 
4696 #define FTM_PARAMS_BURSTTMO_OFFSET 1
4697 #define FTM_PARAMS_BURSTTMO_MASK 0xf0
4698 #define FTM_PARAMS_BURSTTMO_SHIFT 4
4699 #define FTM_PARAMS_BURSTTMO(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_BURSTTMO_OFFSET, \
4700     FTM_PARAMS_BURSTTMO_MASK, FTM_PARAMS_BURSTTMO_SHIFT)
4701 /* set timeout in params using _tmo where timeout = 2^(_tmo) * 250us */
4702 #define FTM_PARAMS_SET_BURSTTMO(_p, _tmo) FTM_PARAMS_SET_FIELD(_p, \
4703     FTM_PARAMS_BURSTTMO_OFFSET, FTM_PARAMS_BURSTTMO_MASK, FTM_PARAMS_BURSTTMO_SHIFT, (_tmo)+2)
4704 
4705 #define FTM_PARAMS_BURSTTMO_USEC(_val) ((1 << ((_val)-2)) * 250)
4706 #define FTM_PARAMS_BURSTTMO_VALID(_val) ((((_val) < 12 && (_val) > 1)) || \
4707     (_val) == FTM_PARAMS_BURSTTMO_NOPREF)
4708 #define FTM_PARAMS_BURSTTMO_MAX_MSEC 128 /* 2^9 * 250us */
4709 #define FTM_PARAMS_BURSTTMO_MAX_USEC 128000 /* 2^9 * 250us */
4710 
4711 #define FTM_PARAMS_MINDELTA_OFFSET 2
4712 #define FTM_PARAMS_MINDELTA_USEC(_p) ((_p)->info[FTM_PARAMS_MINDELTA_OFFSET] * 100)
4713 #define FTM_PARAMS_SET_MINDELTA_USEC(_p, _delta) do { \
4714     (_p)->info[FTM_PARAMS_MINDELTA_OFFSET] = (_delta) / 100; \
4715 } while (0)
4716 
4717 enum {
4718     FTM_PARAMS_MINDELTA_NOPREF = 0
4719 };
4720 
4721 #define FTM_PARAMS_PARTIAL_TSF(_p) ((_p)->info[4] << 8 | (_p)->info[3])
4722 #define FTM_PARAMS_SET_PARTIAL_TSF(_p, _partial_tsf) do { \
4723     (_p)->info[3] = (_partial_tsf) & 0xff; \
4724     (_p)->info[4] = ((_partial_tsf) >> 8) & 0xff; \
4725 } while (0)
4726 
4727 #define FTM_PARAMS_PARTIAL_TSF_MASK 0x0000000003fffc00ULL
4728 #define FTM_PARAMS_PARTIAL_TSF_SHIFT 10
4729 #define FTM_PARAMS_PARTIAL_TSF_BIT_LEN 16
4730 #define FTM_PARAMS_PARTIAL_TSF_MAX 0xffff
4731 
4732 /* FTM can indicate upto 62k TUs forward and 1k TU backward */
4733 #define FTM_PARAMS_TSF_FW_HI (63487 << 10)    /* in micro sec */
4734 #define FTM_PARAMS_TSF_BW_LOW (64512 << 10)    /* in micro sec */
4735 #define FTM_PARAMS_TSF_BW_HI (65535 << 10)    /* in micro sec */
4736 #define FTM_PARAMS_TSF_FW_MAX FTM_PARAMS_TSF_FW_HI
4737 #define FTM_PARAMS_TSF_BW_MAX (FTM_PARAMS_TSF_BW_HI - FTM_PARAMS_TSF_BW_LOW)
4738 
4739 #define FTM_PARAMS_PTSFNOPREF_OFFSET 5
4740 #define FTM_PARAMS_PTSFNOPREF_MASK 0x1
4741 #define FTM_PARAMS_PTSFNOPREF_SHIFT 0
4742 #define FTM_PARAMS_PTSFNOPREF(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_PTSFNOPREF_OFFSET, \
4743     FTM_PARAMS_PTSFNOPREF_MASK, FTM_PARAMS_PTSFNOPREF_SHIFT)
4744 #define FTM_PARAMS_SET_PTSFNOPREF(_p, _nopref) FTM_PARAMS_SET_FIELD(_p, \
4745     FTM_PARAMS_PTSFNOPREF_OFFSET, FTM_PARAMS_PTSFNOPREF_MASK, \
4746     FTM_PARAMS_PTSFNOPREF_SHIFT, _nopref)
4747 
4748 #define FTM_PARAMS_ASAP_OFFSET 5
4749 #define FTM_PARAMS_ASAP_MASK 0x4
4750 #define FTM_PARAMS_ASAP_SHIFT 2
4751 #define FTM_PARAMS_ASAP(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_ASAP_OFFSET, \
4752     FTM_PARAMS_ASAP_MASK, FTM_PARAMS_ASAP_SHIFT)
4753 #define FTM_PARAMS_SET_ASAP(_p, _asap) FTM_PARAMS_SET_FIELD(_p, \
4754     FTM_PARAMS_ASAP_OFFSET, FTM_PARAMS_ASAP_MASK, FTM_PARAMS_ASAP_SHIFT, _asap)
4755 
4756 /* FTM1 - AKA ASAP Capable */
4757 #define FTM_PARAMS_FTM1_OFFSET 5
4758 #define FTM_PARAMS_FTM1_MASK 0x02
4759 #define FTM_PARAMS_FTM1_SHIFT 1
4760 #define FTM_PARAMS_FTM1(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_FTM1_OFFSET, \
4761     FTM_PARAMS_FTM1_MASK, FTM_PARAMS_FTM1_SHIFT)
4762 #define FTM_PARAMS_SET_FTM1(_p, _ftm1) FTM_PARAMS_SET_FIELD(_p, \
4763     FTM_PARAMS_FTM1_OFFSET, FTM_PARAMS_FTM1_MASK, FTM_PARAMS_FTM1_SHIFT, _ftm1)
4764 
4765 #define FTM_PARAMS_FTMS_PER_BURST_OFFSET 5
4766 #define FTM_PARAMS_FTMS_PER_BURST_MASK 0xf8
4767 #define FTM_PARAMS_FTMS_PER_BURST_SHIFT 3
4768 #define FTM_PARAMS_FTMS_PER_BURST(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_FTMS_PER_BURST_OFFSET, \
4769     FTM_PARAMS_FTMS_PER_BURST_MASK, FTM_PARAMS_FTMS_PER_BURST_SHIFT)
4770 #define FTM_PARAMS_SET_FTMS_PER_BURST(_p, _nftms) FTM_PARAMS_SET_FIELD(_p, \
4771     FTM_PARAMS_FTMS_PER_BURST_OFFSET, FTM_PARAMS_FTMS_PER_BURST_MASK, \
4772     FTM_PARAMS_FTMS_PER_BURST_SHIFT, _nftms)
4773 
4774 enum {
4775     FTM_PARAMS_FTMS_PER_BURST_NOPREF = 0
4776 };
4777 
4778 #define FTM_PARAMS_CHAN_INFO_OFFSET 6
4779 #define FTM_PARAMS_CHAN_INFO_MASK 0xfc
4780 #define FTM_PARAMS_CHAN_INFO_SHIFT 2
4781 #define FTM_PARAMS_CHAN_INFO(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_CHAN_INFO_OFFSET, \
4782     FTM_PARAMS_CHAN_INFO_MASK, FTM_PARAMS_CHAN_INFO_SHIFT)
4783 #define FTM_PARAMS_SET_CHAN_INFO(_p, _ci) FTM_PARAMS_SET_FIELD(_p, \
4784     FTM_PARAMS_CHAN_INFO_OFFSET, FTM_PARAMS_CHAN_INFO_MASK, FTM_PARAMS_CHAN_INFO_SHIFT, _ci)
4785 
4786 /* burst period - units of 100ms */
4787 #define FTM_PARAMS_BURST_PERIOD(_p) (((_p)->info[8] << 8) | (_p)->info[7])
4788 #define FTM_PARAMS_SET_BURST_PERIOD(_p, _bp) do {\
4789     (_p)->info[7] = (_bp) & 0xff; \
4790     (_p)->info[8] = ((_bp) >> 8) & 0xff; \
4791 } while (0)
4792 
4793 #define FTM_PARAMS_BURST_PERIOD_MS(_p) (FTM_PARAMS_BURST_PERIOD(_p) * 100)
4794 
4795 enum {
4796     FTM_PARAMS_BURST_PERIOD_NOPREF = 0
4797 };
4798 
4799 /* FTM status values - last updated from 11mcD4.0 */
4800 enum {
4801     FTM_PARAMS_STATUS_RESERVED    = 0,
4802     FTM_PARAMS_STATUS_SUCCESSFUL = 1,
4803     FTM_PARAMS_STATUS_INCAPABLE = 2,
4804     FTM_PARAMS_STATUS_FAILED = 3,
4805     /* Below are obsolte */
4806     FTM_PARAMS_STATUS_OVERRIDDEN = 4,
4807     FTM_PARAMS_STATUS_ASAP_INCAPABLE = 5,
4808     FTM_PARAMS_STATUS_ASAP_FAILED = 6,
4809     /* rest are reserved */
4810 };
4811 
4812 enum {
4813     FTM_PARAMS_CHAN_INFO_NO_PREF         = 0,
4814     FTM_PARAMS_CHAN_INFO_RESERVE1         = 1,
4815     FTM_PARAMS_CHAN_INFO_RESERVE2         = 2,
4816     FTM_PARAMS_CHAN_INFO_RESERVE3         = 3,
4817     FTM_PARAMS_CHAN_INFO_NON_HT_5         = 4,
4818     FTM_PARAMS_CHAN_INFO_RESERVE5        = 5,
4819     FTM_PARAMS_CHAN_INFO_NON_HT_10         = 6,
4820     FTM_PARAMS_CHAN_INFO_RESERVE7        = 7,
4821     FTM_PARAMS_CHAN_INFO_NON_HT_20         = 8, /* excludes 2.4G, and High rate DSSS */
4822     FTM_PARAMS_CHAN_INFO_HT_MF_20         = 9,
4823     FTM_PARAMS_CHAN_INFO_VHT_20         = 10,
4824     FTM_PARAMS_CHAN_INFO_HT_MF_40         = 11,
4825     FTM_PARAMS_CHAN_INFO_VHT_40         = 12,
4826     FTM_PARAMS_CHAN_INFO_VHT_80         = 13,
4827     FTM_PARAMS_CHAN_INFO_VHT_80_80         = 14,
4828     FTM_PARAMS_CHAN_INFO_VHT_160_2_RFLOS     = 15,
4829     FTM_PARAMS_CHAN_INFO_VHT_160        = 16,
4830     /* Reserved from 17 - 30 */
4831     FTM_PARAMS_CHAN_INFO_DMG_2160         = 31,
4832     /* Reserved from 32 - 63 */
4833     FTM_PARAMS_CHAN_INFO_MAX        = 63
4834 };
4835 
4836 /* tag_ID/length/value_buffer tuple */
4837 typedef BWL_PRE_PACKED_STRUCT struct {
4838     uint8    id;
4839     uint8    len;
4840     uint8    data[1];
4841 } BWL_POST_PACKED_STRUCT ftm_vs_tlv_t;
4842 
4843 BWL_PRE_PACKED_STRUCT struct dot11_ftm_vs_ie {
4844     uint8 id;                        /* DOT11_MNG_VS_ID */
4845     uint8 len;                        /* length following */
4846     uint8 oui[3];                    /* BRCM_PROP_OUI (or Customer) */
4847     uint8 sub_type;                    /* BRCM_FTM_IE_TYPE (or Customer) */
4848     uint8 version;
4849     ftm_vs_tlv_t    tlvs[1];
4850 } BWL_POST_PACKED_STRUCT;
4851 typedef struct dot11_ftm_vs_ie dot11_ftm_vs_ie_t;
4852 
4853 /* ftm vs api version */
4854 #define BCM_FTM_VS_PARAMS_VERSION 0x01
4855 
4856 /* ftm vendor specific information tlv types */
4857 enum {
4858     FTM_VS_TLV_NONE = 0,
4859     FTM_VS_TLV_REQ_PARAMS = 1,        /* additional request params (in FTM_REQ) */
4860     FTM_VS_TLV_MEAS_INFO = 2,        /* measurement information (in FTM_MEAS) */
4861     FTM_VS_TLV_SEC_PARAMS = 3,        /* security parameters (in either) */
4862     FTM_VS_TLV_SEQ_PARAMS = 4,        /* toast parameters (FTM_REQ, BRCM proprietary) */
4863     FTM_VS_TLV_MF_BUF = 5,            /* multi frame buffer - may span ftm vs ie's */
4864     FTM_VS_TLV_TIMING_PARAMS = 6            /* timing adjustments */
4865     /* add additional types above */
4866 };
4867 
4868 /* the following definitions are *DEPRECATED* and moved to implemenetion files. They
4869  * are retained here because previous (May 2016) some branches use them
4870  */
4871 #define FTM_TPK_LEN            16
4872 #define FTM_RI_RR_BUF_LEN      32
4873 #define FTM_TPK_RI_RR_LEN      13
4874 #define FTM_TPK_RI_RR_LEN_SECURE_2_0    28
4875 #define FTM_TPK_DIGEST_LEN     32
4876 #define FTM_TPK_BUFFER_LEN     128
4877 #define FTM_TPK_RI_PHY_LEN     7
4878 #define FTM_TPK_RR_PHY_LEN     7
4879 #define FTM_TPK_DATA_BUFFER_LEN 88
4880 #define FTM_TPK_LEN_SECURE_2_0          32
4881 #define FTM_TPK_RI_PHY_LEN_SECURE_2_0  14
4882 #define FTM_TPK_RR_PHY_LEN_SECURE_2_0  14
4883 
4884 
4885 BWL_PRE_PACKED_STRUCT struct dot11_ftm_vs_params {
4886     uint8 id;                       /* DOT11_MNG_VS_ID */
4887     uint8 len;
4888     uint8 oui[3];                   /* Proprietary OUI, BRCM_PROP_OUI */
4889     uint8 bcm_vs_id;
4890     ftm_vs_tlv_t ftm_tpk_ri_rr[1];          /* ftm_TPK_ri_rr place holder */
4891 } BWL_POST_PACKED_STRUCT;
4892 typedef struct dot11_ftm_vs_params dot11_ftm_vs_tpk_ri_rr_params_t;
4893 #define DOT11_FTM_VS_LEN  (sizeof(dot11_ftm_vs_tpk_ri_rr_params_t) - TLV_HDR_LEN)
4894 /* end *DEPRECATED* ftm definitions */
4895 
4896 BWL_PRE_PACKED_STRUCT struct dot11_ftm_sync_info {
4897     uint8 id;        /* Extended - 255 11mc D4.3  */
4898     uint8 len;
4899     uint8 id_ext;
4900     uint8 tsf_sync_info[4];
4901 } BWL_POST_PACKED_STRUCT;
4902 typedef struct dot11_ftm_sync_info dot11_ftm_sync_info_t;
4903 
4904 /* ftm tsf sync info ie len - includes id ext */
4905 #define DOT11_FTM_SYNC_INFO_IE_LEN (sizeof(dot11_ftm_sync_info_t) - TLV_HDR_LEN)
4906 
4907 #define DOT11_FTM_IS_SYNC_INFO_IE(_ie) (\
4908     DOT11_MNG_IE_ID_EXT_MATCH(_ie, DOT11_MNG_FTM_SYNC_INFO) && \
4909     (_ie)->len == DOT11_FTM_SYNC_INFO_IE_LEN)
4910 
4911 /* 802.11u interworking access network options */
4912 #define IW_ANT_MASK                    0x0f
4913 #define IW_INTERNET_MASK                0x10
4914 #define IW_ASRA_MASK                    0x20
4915 #define IW_ESR_MASK                    0x40
4916 #define IW_UESA_MASK                    0x80
4917 
4918 /* 802.11u interworking access network type */
4919 #define IW_ANT_PRIVATE_NETWORK                0
4920 #define IW_ANT_PRIVATE_NETWORK_WITH_GUEST        1
4921 #define IW_ANT_CHARGEABLE_PUBLIC_NETWORK        2
4922 #define IW_ANT_FREE_PUBLIC_NETWORK            3
4923 #define IW_ANT_PERSONAL_DEVICE_NETWORK            4
4924 #define IW_ANT_EMERGENCY_SERVICES_NETWORK        5
4925 #define IW_ANT_TEST_NETWORK                14
4926 #define IW_ANT_WILDCARD_NETWORK                15
4927 
4928 #define IW_ANT_LEN            1
4929 #define IW_VENUE_LEN            2
4930 #define IW_HESSID_LEN            6
4931 #define IW_HESSID_OFF            (IW_ANT_LEN + IW_VENUE_LEN)
4932 #define IW_MAX_LEN            (IW_ANT_LEN + IW_VENUE_LEN + IW_HESSID_LEN)
4933 
4934 /* 802.11u advertisement protocol */
4935 #define ADVP_ANQP_PROTOCOL_ID                0
4936 #define ADVP_MIH_PROTOCOL_ID                1
4937 
4938 /* 802.11u advertisement protocol masks */
4939 #define ADVP_QRL_MASK                    0x7f
4940 #define ADVP_PAME_BI_MASK                0x80
4941 
4942 /* 802.11u advertisement protocol values */
4943 #define ADVP_QRL_REQUEST                0x00
4944 #define ADVP_QRL_RESPONSE                0x7f
4945 #define ADVP_PAME_BI_DEPENDENT                0x00
4946 #define ADVP_PAME_BI_INDEPENDENT            ADVP_PAME_BI_MASK
4947 
4948 /* 802.11u ANQP information ID */
4949 #define ANQP_ID_QUERY_LIST                256
4950 #define ANQP_ID_CAPABILITY_LIST                257
4951 #define ANQP_ID_VENUE_NAME_INFO                258
4952 #define ANQP_ID_EMERGENCY_CALL_NUMBER_INFO        259
4953 #define ANQP_ID_NETWORK_AUTHENTICATION_TYPE_INFO    260
4954 #define ANQP_ID_ROAMING_CONSORTIUM_LIST            261
4955 #define ANQP_ID_IP_ADDRESS_TYPE_AVAILABILITY_INFO    262
4956 #define ANQP_ID_NAI_REALM_LIST                263
4957 #define ANQP_ID_G3PP_CELLULAR_NETWORK_INFO        264
4958 #define ANQP_ID_AP_GEOSPATIAL_LOCATION            265
4959 #define ANQP_ID_AP_CIVIC_LOCATION            266
4960 #define ANQP_ID_AP_LOCATION_PUBLIC_ID_URI        267
4961 #define ANQP_ID_DOMAIN_NAME_LIST            268
4962 #define ANQP_ID_EMERGENCY_ALERT_ID_URI            269
4963 #define ANQP_ID_EMERGENCY_NAI                271
4964 #define ANQP_ID_VENDOR_SPECIFIC_LIST            56797
4965 
4966 /* 802.11u ANQP OUI */
4967 #define ANQP_OUI_SUBTYPE                9
4968 
4969 /* 802.11u venue name */
4970 #define VENUE_LANGUAGE_CODE_SIZE            3
4971 #define VENUE_NAME_SIZE                    255
4972 
4973 /* 802.11u venue groups */
4974 #define VENUE_UNSPECIFIED                0
4975 #define VENUE_ASSEMBLY                    1
4976 #define VENUE_BUSINESS                    2
4977 #define VENUE_EDUCATIONAL                3
4978 #define VENUE_FACTORY                    4
4979 #define VENUE_INSTITUTIONAL                5
4980 #define VENUE_MERCANTILE                6
4981 #define VENUE_RESIDENTIAL                7
4982 #define VENUE_STORAGE                    8
4983 #define VENUE_UTILITY                    9
4984 #define VENUE_VEHICULAR                    10
4985 #define VENUE_OUTDOOR                    11
4986 
4987 /* 802.11u network authentication type indicator */
4988 #define NATI_UNSPECIFIED                -1
4989 #define NATI_ACCEPTANCE_OF_TERMS_CONDITIONS        0
4990 #define NATI_ONLINE_ENROLLMENT_SUPPORTED        1
4991 #define NATI_HTTP_HTTPS_REDIRECTION            2
4992 #define NATI_DNS_REDIRECTION                3
4993 
4994 /* 802.11u IP address type availability - IPv6 */
4995 #define IPA_IPV6_SHIFT                    0
4996 #define IPA_IPV6_MASK                    (0x03 << IPA_IPV6_SHIFT)
4997 #define    IPA_IPV6_NOT_AVAILABLE                0x00
4998 #define IPA_IPV6_AVAILABLE                0x01
4999 #define IPA_IPV6_UNKNOWN_AVAILABILITY            0x02
5000 
5001 /* 802.11u IP address type availability - IPv4 */
5002 #define IPA_IPV4_SHIFT                    2
5003 #define IPA_IPV4_MASK                    (0x3f << IPA_IPV4_SHIFT)
5004 #define    IPA_IPV4_NOT_AVAILABLE                0x00
5005 #define IPA_IPV4_PUBLIC                    0x01
5006 #define IPA_IPV4_PORT_RESTRICT                0x02
5007 #define IPA_IPV4_SINGLE_NAT                0x03
5008 #define IPA_IPV4_DOUBLE_NAT                0x04
5009 #define IPA_IPV4_PORT_RESTRICT_SINGLE_NAT        0x05
5010 #define IPA_IPV4_PORT_RESTRICT_DOUBLE_NAT        0x06
5011 #define IPA_IPV4_UNKNOWN_AVAILABILITY            0x07
5012 
5013 /* 802.11u NAI realm encoding */
5014 #define REALM_ENCODING_RFC4282                0
5015 #define REALM_ENCODING_UTF8                1
5016 
5017 /* 802.11u IANA EAP method type numbers */
5018 #define REALM_EAP_TLS                    13
5019 #define REALM_EAP_LEAP                    17
5020 #define REALM_EAP_SIM                    18
5021 #define REALM_EAP_TTLS                    21
5022 #define REALM_EAP_AKA                    23
5023 #define REALM_EAP_PEAP                    25
5024 #define REALM_EAP_FAST                    43
5025 #define REALM_EAP_PSK                    47
5026 #define REALM_EAP_AKAP                    50
5027 #define REALM_EAP_EXPANDED                254
5028 
5029 /* 802.11u authentication ID */
5030 #define REALM_EXPANDED_EAP                1
5031 #define REALM_NON_EAP_INNER_AUTHENTICATION        2
5032 #define REALM_INNER_AUTHENTICATION_EAP            3
5033 #define REALM_EXPANDED_INNER_EAP            4
5034 #define REALM_CREDENTIAL                5
5035 #define REALM_TUNNELED_EAP_CREDENTIAL            6
5036 #define REALM_VENDOR_SPECIFIC_EAP            221
5037 
5038 /* 802.11u non-EAP inner authentication type */
5039 #define REALM_RESERVED_AUTH                0
5040 #define REALM_PAP                    1
5041 #define REALM_CHAP                    2
5042 #define REALM_MSCHAP                    3
5043 #define REALM_MSCHAPV2                    4
5044 
5045 /* 802.11u credential type */
5046 #define REALM_SIM                    1
5047 #define REALM_USIM                    2
5048 #define REALM_NFC                    3
5049 #define REALM_HARDWARE_TOKEN                4
5050 #define REALM_SOFTOKEN                    5
5051 #define REALM_CERTIFICATE                6
5052 #define REALM_USERNAME_PASSWORD                7
5053 #define REALM_SERVER_SIDE                8
5054 #define REALM_RESERVED_CRED                9
5055 #define REALM_VENDOR_SPECIFIC_CRED            10
5056 
5057 /* 802.11u 3GPP PLMN */
5058 #define G3PP_GUD_VERSION                0
5059 #define G3PP_PLMN_LIST_IE                0
5060 
5061 /* AP Location Public ID Info encoding */
5062 #define PUBLIC_ID_URI_FQDN_SE_ID        0
5063 /* URI/FQDN Descriptor field values */
5064 #define LOCATION_ENCODING_HELD            1
5065 #define LOCATION_ENCODING_SUPL            2
5066 #define URI_FQDN_SIZE                    255
5067 
5068 /** hotspot2.0 indication element (vendor specific) */
5069 BWL_PRE_PACKED_STRUCT struct hs20_ie {
5070     uint8 oui[3];
5071     uint8 type;
5072     uint8 config;
5073 } BWL_POST_PACKED_STRUCT;
5074 typedef struct hs20_ie hs20_ie_t;
5075 #define HS20_IE_LEN 5    /* HS20 IE length */
5076 
5077 /** IEEE 802.11 Annex E */
5078 typedef enum {
5079     DOT11_2GHZ_20MHZ_CLASS_12    = 81,    /* Ch 1-11 */
5080     DOT11_5GHZ_20MHZ_CLASS_1    = 115,    /* Ch 36-48 */
5081     DOT11_5GHZ_20MHZ_CLASS_2_DFS    = 118,    /* Ch 52-64 */
5082     DOT11_5GHZ_20MHZ_CLASS_3    = 124,    /* Ch 149-161 */
5083     DOT11_5GHZ_20MHZ_CLASS_4_DFS    = 121,    /* Ch 100-140 */
5084     DOT11_5GHZ_20MHZ_CLASS_5    = 125,    /* Ch 149-165 */
5085     DOT11_5GHZ_40MHZ_CLASS_22    = 116,    /* Ch 36-44,   lower */
5086     DOT11_5GHZ_40MHZ_CLASS_23_DFS     = 119,    /* Ch 52-60,   lower */
5087     DOT11_5GHZ_40MHZ_CLASS_24_DFS    = 122,    /* Ch 100-132, lower */
5088     DOT11_5GHZ_40MHZ_CLASS_25    = 126,    /* Ch 149-157, lower */
5089     DOT11_5GHZ_40MHZ_CLASS_27    = 117,    /* Ch 40-48,   upper */
5090     DOT11_5GHZ_40MHZ_CLASS_28_DFS    = 120,    /* Ch 56-64,   upper */
5091     DOT11_5GHZ_40MHZ_CLASS_29_DFS    = 123,    /* Ch 104-136, upper */
5092     DOT11_5GHZ_40MHZ_CLASS_30    = 127,    /* Ch 153-161, upper */
5093     DOT11_2GHZ_40MHZ_CLASS_32    = 83,    /* Ch 1-7,     lower */
5094     DOT11_2GHZ_40MHZ_CLASS_33    = 84,    /* Ch 5-11,    upper */
5095 } dot11_op_class_t;
5096 
5097 /* QoS map */
5098 #define QOS_MAP_FIXED_LENGTH    (8 * 2)    /* DSCP ranges fixed with 8 entries */
5099 
5100 #define BCM_AIBSS_IE_TYPE 56
5101 
5102 /* This marks the end of a packed structure section. */
5103 #include <packed_section_end.h>
5104 
5105 #endif /* _802_11_H_ */
5106