• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Fundamental types and constants relating to 802.11
3  *
4  * Copyright (C) 1999-2019, Broadcom.
5  *
6  *      Unless you and Broadcom execute a separate written software license
7  * agreement governing use of this software, this software is licensed to you
8  * under the terms of the GNU General Public License version 2 (the "GPL"),
9  * available at http://www.broadcom.com/licenses/GPLv2.php, with the
10  * following added to such license:
11  *
12  *      As a special exception, the copyright holders of this software give you
13  * permission to link this software with independent modules, and to copy and
14  * distribute the resulting executable under terms of your choice, provided that
15  * you also meet, for each linked independent module, the terms and conditions
16  * of the license of that module.  An independent module is a module which is
17  * not derived from this software.  The special exception does not apply to any
18  * modifications of the software.
19  *
20  *      Notwithstanding the above, under no circumstances may you combine this
21  * software in any way with any other Broadcom software provided under a license
22  * other than the GPL, without Broadcom's express prior written consent.
23  *
24  *
25  * <<Broadcom-WL-IPTag/Open:>>
26  *
27  * $Id: 802.11.h 814166 2019-04-10 06:14:49Z $
28  */
29 
30 #ifndef _802_11_H_
31 #define _802_11_H_
32 
33 #ifndef _TYPEDEFS_H_
34 #include <typedefs.h>
35 #endif // endif
36 
37 #ifndef _NET_ETHERNET_H_
38 #include <ethernet.h>
39 #endif // endif
40 
41 #include <wpa.h>
42 
43 /* This marks the start of a packed structure section. */
44 #include <packed_section_start.h>
45 
46 #define DOT11_TU_TO_US 1024 /* 802.11 Time Unit is 1024 microseconds */
47 
48 /* Generic 802.11 frame constants */
49 #define DOT11_A3_HDR_LEN 24                /* d11 header length with A3 */
50 #define DOT11_A4_HDR_LEN 30                /* d11 header length with A4 */
51 #define DOT11_MAC_HDR_LEN DOT11_A3_HDR_LEN /* MAC header length */
52 #define DOT11_FCS_LEN 4u                   /* d11 FCS length */
53 #define DOT11_ICV_LEN 4                    /* d11 ICV length */
54 #define DOT11_ICV_AES_LEN 8                /* d11 ICV/AES length */
55 #define DOT11_MAX_ICV_AES_LEN 16           /* d11 MAX ICV/AES length */
56 #define DOT11_QOS_LEN 2                    /* d11 QoS length */
57 #define DOT11_HTC_LEN 4                    /* d11 HT Control field length */
58 
59 #define DOT11_KEY_INDEX_SHIFT 6 /* d11 key index shift */
60 #define DOT11_IV_LEN 4          /* d11 IV length */
61 #define DOT11_IV_TKIP_LEN 8     /* d11 IV TKIP length */
62 #define DOT11_IV_AES_OCB_LEN 4  /* d11 IV/AES/OCB length */
63 #define DOT11_IV_AES_CCM_LEN 8  /* d11 IV/AES/CCM length */
64 #define DOT11_IV_MAX_LEN 8      /* maximum iv len for any encryption */
65 
66 /* Includes MIC */
67 #define DOT11_MAX_MPDU_BODY_LEN 2304 /* max MPDU body length */
68 /* A4 header + QoS + CCMP + PDU + ICV + FCS = 2352 */
69 #define DOT11_MAX_MPDU_LEN                                                     \
70     (DOT11_A4_HDR_LEN + DOT11_QOS_LEN + DOT11_IV_AES_CCM_LEN +                 \
71      DOT11_MAX_MPDU_BODY_LEN + DOT11_ICV_LEN +                                 \
72      DOT11_FCS_LEN) /* d11 max MPDU length */
73 
74 #define DOT11_MAX_SSID_LEN 32 /* d11 max ssid length */
75 
76 /* dot11RTSThreshold */
77 #define DOT11_DEFAULT_RTS_LEN 2347 /* d11 default RTS length */
78 #define DOT11_MAX_RTS_LEN 2347     /* d11 max RTS length */
79 
80 /* dot11FragmentationThreshold */
81 #define DOT11_MIN_FRAG_LEN 256 /* d11 min fragmentation length */
82 #define DOT11_MAX_FRAG_LEN                                                     \
83     2346 /* Max frag is also limited by aMPDUMaxLength                         \
84           * of the attached PHY                                                \
85           */
86 #define DOT11_DEFAULT_FRAG_LEN 2346 /* d11 default fragmentation length */
87 
88 /* dot11BeaconPeriod */
89 #define DOT11_MIN_BEACON_PERIOD 1      /* d11 min beacon period */
90 #define DOT11_MAX_BEACON_PERIOD 0xFFFF /* d11 max beacon period */
91 
92 /* dot11DTIMPeriod */
93 #define DOT11_MIN_DTIM_PERIOD 1    /* d11 min DTIM period */
94 #define DOT11_MAX_DTIM_PERIOD 0xFF /* d11 max DTIM period */
95 
96 /** 802.2 LLC/SNAP header used by 802.11 per 802.1H */
97 #define DOT11_LLC_SNAP_HDR_LEN 8 /* d11 LLC/SNAP header length */
98 /* minimum LLC header length; DSAP, SSAP, 8 bit Control (unnumbered) */
99 #define DOT11_LLC_HDR_LEN_MIN 3
100 #define DOT11_OUI_LEN 3 /* d11 OUI length */
101 BWL_PRE_PACKED_STRUCT struct dot11_llc_snap_header {
102     uint8 dsap;               /* always 0xAA */
103     uint8 ssap;               /* always 0xAA */
104     uint8 ctl;                /* always 0x03 */
105     uint8 oui[DOT11_OUI_LEN]; /* RFC1042: 0x00 0x00 0x00
106                                * Bridge-Tunnel: 0x00 0x00 0xF8
107                                */
108     uint16 type;              /* ethertype */
109 } BWL_POST_PACKED_STRUCT;
110 
111 /* RFC1042 header used by 802.11 per 802.1H */
112 #define RFC1042_HDR_LEN                                                        \
113     (ETHER_HDR_LEN + DOT11_LLC_SNAP_HDR_LEN) /* RCF1042 header length */
114 
115 /* Generic 802.11 MAC header */
116 /**
117  * N.B.: This struct reflects the full 4 address 802.11 MAC header.
118  *		 The fields are defined such that the shorter 1, 2, and 3
119  *		 address headers just use the first k fields.
120  */
121 BWL_PRE_PACKED_STRUCT struct dot11_header {
122     uint16 fc;            /* frame control */
123     uint16 durid;         /* duration/ID */
124     struct ether_addr a1; /* address 1 */
125     struct ether_addr a2; /* address 2 */
126     struct ether_addr a3; /* address 3 */
127     uint16 seq;           /* sequence control */
128     struct ether_addr a4; /* address 4 */
129 } BWL_POST_PACKED_STRUCT;
130 
131 /* Control frames */
132 
133 BWL_PRE_PACKED_STRUCT struct dot11_rts_frame {
134     uint16 fc;            /* frame control */
135     uint16 durid;         /* duration/ID */
136     struct ether_addr ra; /* receiver address */
137     struct ether_addr ta; /* transmitter address */
138 } BWL_POST_PACKED_STRUCT;
139 #define DOT11_RTS_LEN 16 /* d11 RTS frame length */
140 
141 BWL_PRE_PACKED_STRUCT struct dot11_cts_frame {
142     uint16 fc;            /* frame control */
143     uint16 durid;         /* duration/ID */
144     struct ether_addr ra; /* receiver address */
145 } BWL_POST_PACKED_STRUCT;
146 #define DOT11_CTS_LEN 10u /* d11 CTS frame length */
147 
148 BWL_PRE_PACKED_STRUCT struct dot11_ack_frame {
149     uint16 fc;            /* frame control */
150     uint16 durid;         /* duration/ID */
151     struct ether_addr ra; /* receiver address */
152 } BWL_POST_PACKED_STRUCT;
153 #define DOT11_ACK_LEN 10 /* d11 ACK frame length */
154 
155 BWL_PRE_PACKED_STRUCT struct dot11_ps_poll_frame {
156     uint16 fc;               /* frame control */
157     uint16 durid;            /* AID */
158     struct ether_addr bssid; /* receiver address, STA in AP */
159     struct ether_addr ta;    /* transmitter address */
160 } BWL_POST_PACKED_STRUCT;
161 #define DOT11_PS_POLL_LEN 16 /* d11 PS poll frame length */
162 
163 BWL_PRE_PACKED_STRUCT struct dot11_cf_end_frame {
164     uint16 fc;               /* frame control */
165     uint16 durid;            /* duration/ID */
166     struct ether_addr ra;    /* receiver address */
167     struct ether_addr bssid; /* transmitter address, STA in AP */
168 } BWL_POST_PACKED_STRUCT;
169 #define DOT11_CS_END_LEN 16 /* d11 CF-END frame length */
170 
171 /**
172  * RWL wifi protocol: The Vendor Specific Action frame is defined for
173  * vendor-specific signaling category+OUI+vendor specific content ( this can be
174  * variable)
175  */
176 BWL_PRE_PACKED_STRUCT struct dot11_action_wifi_vendor_specific {
177     uint8 category;
178     uint8 OUI[3];
179     uint8 type;
180     uint8 subtype;
181     uint8 data[1040];
182 } BWL_POST_PACKED_STRUCT;
183 typedef struct dot11_action_wifi_vendor_specific
184     dot11_action_wifi_vendor_specific_t;
185 
186 /** generic vendor specific action frame with variable length */
187 BWL_PRE_PACKED_STRUCT struct dot11_action_vs_frmhdr {
188     uint8 category;
189     uint8 OUI[3];
190     uint8 type;
191     uint8 subtype;
192     uint8 data[1];
193 } BWL_POST_PACKED_STRUCT;
194 typedef struct dot11_action_vs_frmhdr dot11_action_vs_frmhdr_t;
195 
196 #define DOT11_ACTION_VS_HDR_LEN 6
197 
198 #define BCM_ACTION_OUI_BYTE0 0x00
199 #define BCM_ACTION_OUI_BYTE1 0x90
200 #define BCM_ACTION_OUI_BYTE2 0x4c
201 
202 /* BA/BAR Control parameters */
203 #define DOT11_BA_CTL_POLICY_NORMAL 0x0000 /* normal ack */
204 #define DOT11_BA_CTL_POLICY_NOACK 0x0001  /* no ack */
205 #define DOT11_BA_CTL_POLICY_MASK 0x0001   /* ack policy mask */
206 
207 #define DOT11_BA_CTL_MTID 0x0002       /* multi tid BA */
208 #define DOT11_BA_CTL_COMPRESSED 0x0004 /* compressed bitmap */
209 
210 #define DOT11_BA_CTL_NUMMSDU_MASK 0x0FC0 /* num msdu in bitmap mask */
211 #define DOT11_BA_CTL_NUMMSDU_SHIFT 6     /* num msdu in bitmap shift */
212 
213 #define DOT11_BA_CTL_TID_MASK 0xF000 /* tid mask */
214 #define DOT11_BA_CTL_TID_SHIFT 12    /* tid shift */
215 
216 /** control frame header (BA/BAR) */
217 BWL_PRE_PACKED_STRUCT struct dot11_ctl_header {
218     uint16 fc;            /* frame control */
219     uint16 durid;         /* duration/ID */
220     struct ether_addr ra; /* receiver address */
221     struct ether_addr ta; /* transmitter address */
222 } BWL_POST_PACKED_STRUCT;
223 #define DOT11_CTL_HDR_LEN 16 /* control frame hdr len */
224 
225 /** BAR frame payload */
226 BWL_PRE_PACKED_STRUCT struct dot11_bar {
227     uint16 bar_control; /* BAR Control */
228     uint16 seqnum;      /* Starting Sequence control */
229 } BWL_POST_PACKED_STRUCT;
230 #define DOT11_BAR_LEN 4 /* BAR frame payload length */
231 
232 #define DOT11_BA_BITMAP_LEN 128   /* bitmap length */
233 #define DOT11_BA_CMP_BITMAP_LEN 8 /* compressed bitmap length */
234 /** BA frame payload */
235 BWL_PRE_PACKED_STRUCT struct dot11_ba {
236     uint16 ba_control;                 /* BA Control */
237     uint16 seqnum;                     /* Starting Sequence control */
238     uint8 bitmap[DOT11_BA_BITMAP_LEN]; /* Block Ack Bitmap */
239 } BWL_POST_PACKED_STRUCT;
240 #define DOT11_BA_LEN 4 /* BA frame payload len (wo bitmap) */
241 
242 /** Management frame header */
243 BWL_PRE_PACKED_STRUCT struct dot11_management_header {
244     uint16 fc;               /* frame control */
245     uint16 durid;            /* duration/ID */
246     struct ether_addr da;    /* receiver address */
247     struct ether_addr sa;    /* transmitter address */
248     struct ether_addr bssid; /* BSS ID */
249     uint16 seq;              /* sequence control */
250 } BWL_POST_PACKED_STRUCT;
251 typedef struct dot11_management_header dot11_management_header_t;
252 #define DOT11_MGMT_HDR_LEN 24 /* d11 management header length */
253 
254 /* Management frame payloads */
255 
256 BWL_PRE_PACKED_STRUCT struct dot11_bcn_prb {
257     uint32 timestamp[2];
258     uint16 beacon_interval;
259     uint16 capability;
260 } BWL_POST_PACKED_STRUCT;
261 #define DOT11_BCN_PRB_LEN 12        /* 802.11 beacon/probe frame fixed length */
262 #define DOT11_BCN_PRB_FIXED_LEN 12u /* 802.11 beacon/probe frame fixed length  \
263                                      */
264 
265 BWL_PRE_PACKED_STRUCT struct dot11_auth {
266     uint16 alg;    /* algorithm */
267     uint16 seq;    /* sequence control */
268     uint16 status; /* status code */
269 } BWL_POST_PACKED_STRUCT;
270 #define DOT11_AUTH_FIXED_LEN 6 /* length of auth frame without challenge IE */
271 #define DOT11_AUTH_SEQ_STATUS_LEN                                              \
272     4 /* length of auth frame without challenge IE and                         \
273        * without algorithm                                                     \
274        */
275 
276 BWL_PRE_PACKED_STRUCT struct dot11_assoc_req {
277     uint16 capability; /* capability information */
278     uint16 listen;     /* listen interval */
279 } BWL_POST_PACKED_STRUCT;
280 #define DOT11_ASSOC_REQ_FIXED_LEN                                              \
281     4 /* length of assoc frame without info elts */
282 
283 BWL_PRE_PACKED_STRUCT struct dot11_reassoc_req {
284     uint16 capability;    /* capability information */
285     uint16 listen;        /* listen interval */
286     struct ether_addr ap; /* Current AP address */
287 } BWL_POST_PACKED_STRUCT;
288 #define DOT11_REASSOC_REQ_FIXED_LEN                                            \
289     10 /* length of assoc frame without info elts */
290 
291 BWL_PRE_PACKED_STRUCT struct dot11_assoc_resp {
292     uint16 capability; /* capability information */
293     uint16 status;     /* status code */
294     uint16 aid;        /* association ID */
295 } BWL_POST_PACKED_STRUCT;
296 #define DOT11_ASSOC_RESP_FIXED_LEN                                             \
297     6 /* length of assoc resp frame without info elts */
298 
299 BWL_PRE_PACKED_STRUCT struct dot11_action_measure {
300     uint8 category;
301     uint8 action;
302     uint8 token;
303     uint8 data[1];
304 } BWL_POST_PACKED_STRUCT;
305 #define DOT11_ACTION_MEASURE_LEN 3 /* d11 action measurement header length */
306 
307 BWL_PRE_PACKED_STRUCT struct dot11_action_ht_ch_width {
308     uint8 category;
309     uint8 action;
310     uint8 ch_width;
311 } BWL_POST_PACKED_STRUCT;
312 
313 BWL_PRE_PACKED_STRUCT struct dot11_action_ht_mimops {
314     uint8 category;
315     uint8 action;
316     uint8 control;
317 } BWL_POST_PACKED_STRUCT;
318 
319 BWL_PRE_PACKED_STRUCT struct dot11_action_sa_query {
320     uint8 category;
321     uint8 action;
322     uint16 id;
323 } BWL_POST_PACKED_STRUCT;
324 
325 BWL_PRE_PACKED_STRUCT struct dot11_action_vht_oper_mode {
326     uint8 category;
327     uint8 action;
328     uint8 mode;
329 } BWL_POST_PACKED_STRUCT;
330 
331 /* These lengths assume 64 MU groups, as specified in 802.11ac-2013 */
332 #define DOT11_ACTION_GID_MEMBERSHIP_LEN 8 /* bytes */
333 #define DOT11_ACTION_GID_USER_POS_LEN 16  /* bytes */
334 BWL_PRE_PACKED_STRUCT struct dot11_action_group_id {
335     uint8 category;
336     uint8 action;
337     uint8 membership_status[DOT11_ACTION_GID_MEMBERSHIP_LEN];
338     uint8 user_position[DOT11_ACTION_GID_USER_POS_LEN];
339 } BWL_POST_PACKED_STRUCT;
340 
341 #define SM_PWRSAVE_ENABLE 1
342 #define SM_PWRSAVE_MODE 2
343 
344 /* ************* 802.11h related definitions. ************* */
345 BWL_PRE_PACKED_STRUCT struct dot11_power_cnst {
346     uint8 id;
347     uint8 len;
348     uint8 power;
349 } BWL_POST_PACKED_STRUCT;
350 typedef struct dot11_power_cnst dot11_power_cnst_t;
351 
352 BWL_PRE_PACKED_STRUCT struct dot11_power_cap {
353     int8 min;
354     int8 max;
355 } BWL_POST_PACKED_STRUCT;
356 typedef struct dot11_power_cap dot11_power_cap_t;
357 
358 BWL_PRE_PACKED_STRUCT struct dot11_tpc_rep {
359     uint8 id;
360     uint8 len;
361     uint8 tx_pwr;
362     uint8 margin;
363 } BWL_POST_PACKED_STRUCT;
364 typedef struct dot11_tpc_rep dot11_tpc_rep_t;
365 #define DOT11_MNG_IE_TPC_REPORT_SIZE (sizeof(dot11_tpc_rep_t))
366 #define DOT11_MNG_IE_TPC_REPORT_LEN                                            \
367     2 /* length of IE data, not including 2 byte header */
368 
369 BWL_PRE_PACKED_STRUCT struct dot11_supp_channels {
370     uint8 id;
371     uint8 len;
372     uint8 first_channel;
373     uint8 num_channels;
374 } BWL_POST_PACKED_STRUCT;
375 typedef struct dot11_supp_channels dot11_supp_channels_t;
376 
377 /**
378  * Extension Channel Offset IE: 802.11n-D1.0 spec. added sideband
379  * offset for 40MHz operation.  The possible 3 values are:
380  * 1 = above control channel
381  * 3 = below control channel
382  * 0 = no extension channel
383  */
384 BWL_PRE_PACKED_STRUCT struct dot11_extch {
385     uint8 id;  /* IE ID, 62, DOT11_MNG_EXT_CHANNEL_OFFSET */
386     uint8 len; /* IE length */
387     uint8 extch;
388 } BWL_POST_PACKED_STRUCT;
389 typedef struct dot11_extch dot11_extch_ie_t;
390 
391 BWL_PRE_PACKED_STRUCT struct dot11_brcm_extch {
392     uint8 id;  /* IE ID, 221, DOT11_MNG_PROPR_ID */
393     uint8 len; /* IE length */
394     uint8 oui[3];
395     uint8 type; /* type indicates what follows */
396     uint8 extch;
397 } BWL_POST_PACKED_STRUCT;
398 typedef struct dot11_brcm_extch dot11_brcm_extch_ie_t;
399 
400 #define BRCM_EXTCH_IE_LEN 5
401 #define BRCM_EXTCH_IE_TYPE 53 /* 802.11n ID not yet assigned */
402 #define DOT11_EXTCH_IE_LEN 1
403 #define DOT11_EXT_CH_MASK 0x03  /* extension channel mask */
404 #define DOT11_EXT_CH_UPPER 0x01 /* ext. ch. on upper sb */
405 #define DOT11_EXT_CH_LOWER 0x03 /* ext. ch. on lower sb */
406 #define DOT11_EXT_CH_NONE 0x00  /* no extension ch.  */
407 
408 BWL_PRE_PACKED_STRUCT struct dot11_action_frmhdr {
409     uint8 category;
410     uint8 action;
411     uint8 data[1];
412 } BWL_POST_PACKED_STRUCT;
413 typedef struct dot11_action_frmhdr dot11_action_frmhdr_t;
414 
415 /* Action Field length */
416 #define DOT11_ACTION_CATEGORY_LEN 1u
417 #define DOT11_ACTION_ACTION_LEN 1u
418 #define DOT11_ACTION_DIALOG_TOKEN_LEN 1u
419 #define DOT11_ACTION_CAPABILITY_LEN 2u
420 #define DOT11_ACTION_STATUS_CODE_LEN 2u
421 #define DOT11_ACTION_REASON_CODE_LEN 2u
422 #define DOT11_ACTION_TARGET_CH_LEN 1u
423 #define DOT11_ACTION_OPER_CLASS_LEN 1u
424 
425 #define DOT11_ACTION_FRMHDR_LEN 2
426 
427 /** CSA IE data structure */
428 BWL_PRE_PACKED_STRUCT struct dot11_channel_switch {
429     uint8 id;      /* id DOT11_MNG_CHANNEL_SWITCH_ID */
430     uint8 len;     /* length of IE */
431     uint8 mode;    /* mode 0 or 1 */
432     uint8 channel; /* channel switch to */
433     uint8 count;   /* number of beacons before switching */
434 } BWL_POST_PACKED_STRUCT;
435 typedef struct dot11_channel_switch dot11_chan_switch_ie_t;
436 
437 #define DOT11_SWITCH_IE_LEN                                                    \
438     3 /* length of IE data, not including 2 byte header */
439 /* CSA mode - 802.11h-2003 $7.3.2.20 */
440 #define DOT11_CSA_MODE_ADVISORY                                                \
441     0                          /* no DOT11_CSA_MODE_NO_TX restriction imposed */
442 #define DOT11_CSA_MODE_NO_TX 1 /* no transmission upon receiving CSA frame. */
443 
444 BWL_PRE_PACKED_STRUCT struct dot11_action_switch_channel {
445     uint8 category;
446     uint8 action;
447     dot11_chan_switch_ie_t chan_switch_ie; /* for switch IE */
448     dot11_brcm_extch_ie_t extch_ie;        /* extension channel offset */
449 } BWL_POST_PACKED_STRUCT;
450 
451 BWL_PRE_PACKED_STRUCT struct dot11_csa_body {
452     uint8 mode;    /* mode 0 or 1 */
453     uint8 reg;     /* regulatory class */
454     uint8 channel; /* channel switch to */
455     uint8 count;   /* number of beacons before switching */
456 } BWL_POST_PACKED_STRUCT;
457 
458 /** 11n Extended Channel Switch IE data structure */
459 BWL_PRE_PACKED_STRUCT struct dot11_ext_csa {
460     uint8 id;                /* id DOT11_MNG_EXT_CSA_ID */
461     uint8 len;               /* length of IE */
462     struct dot11_csa_body b; /* body of the ie */
463 } BWL_POST_PACKED_STRUCT;
464 typedef struct dot11_ext_csa dot11_ext_csa_ie_t;
465 #define DOT11_EXT_CSA_IE_LEN 4 /* length of extended channel switch IE body */
466 
467 BWL_PRE_PACKED_STRUCT struct dot11_action_ext_csa {
468     uint8 category;
469     uint8 action;
470     dot11_ext_csa_ie_t chan_switch_ie; /* for switch IE */
471 } BWL_POST_PACKED_STRUCT;
472 
473 BWL_PRE_PACKED_STRUCT struct dot11y_action_ext_csa {
474     uint8 category;
475     uint8 action;
476     struct dot11_csa_body b; /* body of the ie */
477 } BWL_POST_PACKED_STRUCT;
478 
479 /**  Wide Bandwidth Channel Switch IE data structure */
480 BWL_PRE_PACKED_STRUCT struct dot11_wide_bw_channel_switch {
481     uint8 id;            /* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
482     uint8 len;           /* length of IE */
483     uint8 channel_width; /* new channel width */
484     uint8 center_frequency_segment_0; /* center frequency segment 0 */
485     uint8 center_frequency_segment_1; /* center frequency segment 1 */
486 } BWL_POST_PACKED_STRUCT;
487 typedef struct dot11_wide_bw_channel_switch dot11_wide_bw_chan_switch_ie_t;
488 
489 #define DOT11_WIDE_BW_SWITCH_IE_LEN                                            \
490     3 /* length of IE data, not including 2 byte header */
491 
492 /** Channel Switch Wrapper IE data structure */
493 BWL_PRE_PACKED_STRUCT struct dot11_channel_switch_wrapper {
494     uint8 id;  /* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
495     uint8 len; /* length of IE */
496     dot11_wide_bw_chan_switch_ie_t wb_chan_switch_ie;
497 } BWL_POST_PACKED_STRUCT;
498 typedef struct dot11_channel_switch_wrapper dot11_chan_switch_wrapper_ie_t;
499 
500 typedef enum wide_bw_chan_width {
501     WIDE_BW_CHAN_WIDTH_20 = 0,
502     WIDE_BW_CHAN_WIDTH_40 = 1,
503     WIDE_BW_CHAN_WIDTH_80 = 2,
504     WIDE_BW_CHAN_WIDTH_160 = 3,
505     WIDE_BW_CHAN_WIDTH_80_80 = 4
506 } wide_bw_chan_width_t;
507 
508 /**  Wide Bandwidth Channel IE data structure */
509 BWL_PRE_PACKED_STRUCT struct dot11_wide_bw_channel {
510     uint8 id;                         /* id DOT11_MNG_WIDE_BW_CHANNEL_ID */
511     uint8 len;                        /* length of IE */
512     uint8 channel_width;              /* channel width */
513     uint8 center_frequency_segment_0; /* center frequency segment 0 */
514     uint8 center_frequency_segment_1; /* center frequency segment 1 */
515 } BWL_POST_PACKED_STRUCT;
516 typedef struct dot11_wide_bw_channel dot11_wide_bw_chan_ie_t;
517 
518 #define DOT11_WIDE_BW_IE_LEN                                                   \
519     3 /* length of IE data, not including 2 byte header */
520 /** VHT Transmit Power Envelope IE data structure */
521 BWL_PRE_PACKED_STRUCT struct dot11_vht_transmit_power_envelope {
522     uint8 id;  /* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
523     uint8 len; /* length of IE */
524     uint8 transmit_power_info;
525     uint8 local_max_transmit_power_20;
526 } BWL_POST_PACKED_STRUCT;
527 typedef struct dot11_vht_transmit_power_envelope
528     dot11_vht_transmit_power_envelope_ie_t;
529 
530 /* vht transmit power envelope IE length depends on channel width */
531 #define DOT11_VHT_TRANSMIT_PWR_ENVELOPE_IE_LEN_40MHZ 1
532 #define DOT11_VHT_TRANSMIT_PWR_ENVELOPE_IE_LEN_80MHZ 2
533 #define DOT11_VHT_TRANSMIT_PWR_ENVELOPE_IE_LEN_160MHZ 3
534 
535 BWL_PRE_PACKED_STRUCT struct dot11_obss_coex {
536     uint8 id;
537     uint8 len;
538     uint8 info;
539 } BWL_POST_PACKED_STRUCT;
540 typedef struct dot11_obss_coex dot11_obss_coex_t;
541 #define DOT11_OBSS_COEXINFO_LEN 1 /* length of OBSS Coexistence INFO IE */
542 
543 #define DOT11_OBSS_COEX_INFO_REQ 0x01
544 #define DOT11_OBSS_COEX_40MHZ_INTOLERANT 0x02
545 #define DOT11_OBSS_COEX_20MHZ_WIDTH_REQ 0x04
546 
547 BWL_PRE_PACKED_STRUCT struct dot11_obss_chanlist {
548     uint8 id;
549     uint8 len;
550     uint8 regclass;
551     uint8 chanlist[1];
552 } BWL_POST_PACKED_STRUCT;
553 typedef struct dot11_obss_chanlist dot11_obss_chanlist_t;
554 #define DOT11_OBSS_CHANLIST_FIXED_LEN 1 /* fixed length of regclass */
555 
556 BWL_PRE_PACKED_STRUCT struct dot11_extcap_ie {
557     uint8 id;
558     uint8 len;
559     uint8 cap[1];
560 } BWL_POST_PACKED_STRUCT;
561 typedef struct dot11_extcap_ie dot11_extcap_ie_t;
562 
563 #define DOT11_EXTCAP_LEN_COEX 1
564 #define DOT11_EXTCAP_LEN_BT 3
565 #define DOT11_EXTCAP_LEN_IW 4
566 #define DOT11_EXTCAP_LEN_SI 6
567 
568 #define DOT11_EXTCAP_LEN_TDLS 5
569 #define DOT11_11AC_EXTCAP_LEN_TDLS 8
570 
571 #define DOT11_EXTCAP_LEN_FMS 2
572 #define DOT11_EXTCAP_LEN_PROXY_ARP 2
573 #define DOT11_EXTCAP_LEN_TFS 3
574 #define DOT11_EXTCAP_LEN_WNM_SLEEP 3
575 #define DOT11_EXTCAP_LEN_TIMBC 3
576 #define DOT11_EXTCAP_LEN_BSSTRANS 3
577 #define DOT11_EXTCAP_LEN_DMS 4
578 #define DOT11_EXTCAP_LEN_WNM_NOTIFICATION 6
579 #define DOT11_EXTCAP_LEN_TDLS_WBW 8
580 #define DOT11_EXTCAP_LEN_OPMODE_NOTIFICATION 8
581 #define DOT11_EXTCAP_LEN_TWT 10u
582 
583 /* TDLS Capabilities */
584 #define DOT11_TDLS_CAP_TDLS 37 /* TDLS support */
585 #define DOT11_TDLS_CAP_PU_BUFFER_STA                                           \
586     28                               /* TDLS Peer U-APSD buffer STA support */
587 #define DOT11_TDLS_CAP_PEER_PSM 20   /* TDLS Peer PSM support */
588 #define DOT11_TDLS_CAP_CH_SW 30      /* TDLS Channel switch */
589 #define DOT11_TDLS_CAP_PROH 38       /* TDLS prohibited */
590 #define DOT11_TDLS_CAP_CH_SW_PROH 39 /* TDLS Channel switch prohibited */
591 #define DOT11_TDLS_CAP_TDLS_WIDER_BW 61 /* TDLS Wider Band-Width */
592 
593 #define TDLS_CAP_MAX_BIT 39 /* TDLS max bit defined in ext cap */
594 
595 /* 802.11h/802.11k Measurement Request/Report IEs */
596 /* Measurement Type field */
597 #define DOT11_MEASURE_TYPE_BASIC 0    /* d11 measurement basic type */
598 #define DOT11_MEASURE_TYPE_CCA 1      /* d11 measurement CCA type */
599 #define DOT11_MEASURE_TYPE_RPI 2      /* d11 measurement RPI type */
600 #define DOT11_MEASURE_TYPE_CHLOAD 3   /* d11 measurement Channel Load type */
601 #define DOT11_MEASURE_TYPE_NOISE 4    /* d11 measurement Noise Histogram type */
602 #define DOT11_MEASURE_TYPE_BEACON 5   /* d11 measurement Beacon type */
603 #define DOT11_MEASURE_TYPE_FRAME 6    /* d11 measurement Frame type */
604 #define DOT11_MEASURE_TYPE_STAT 7     /* d11 measurement STA Statistics type */
605 #define DOT11_MEASURE_TYPE_LCI 8      /* d11 measurement LCI type */
606 #define DOT11_MEASURE_TYPE_TXSTREAM 9 /* d11 measurement TX Stream type */
607 #define DOT11_MEASURE_TYPE_MCDIAGS                                             \
608     10 /* d11 measurement multicast diagnostics */
609 #define DOT11_MEASURE_TYPE_CIVICLOC 11 /* d11 measurement location civic */
610 #define DOT11_MEASURE_TYPE_LOC_ID 12   /* d11 measurement location identifier */
611 #define DOT11_MEASURE_TYPE_DIRCHANQ 13 /* d11 measurement dir channel quality  \
612                                         */
613 #define DOT11_MEASURE_TYPE_DIRMEAS 14  /* d11 measurement directional */
614 #define DOT11_MEASURE_TYPE_DIRSTATS 15 /* d11 measurement directional stats */
615 #define DOT11_MEASURE_TYPE_FTMRANGE 16 /* d11 measurement Fine Timing */
616 #define DOT11_MEASURE_TYPE_PAUSE 255   /* d11 measurement pause type */
617 
618 /* Measurement Request Modes */
619 #define DOT11_MEASURE_MODE_PARALLEL (1 << 0) /* d11 measurement parallel */
620 #define DOT11_MEASURE_MODE_ENABLE (1 << 1)   /* d11 measurement enable */
621 #define DOT11_MEASURE_MODE_REQUEST (1 << 2)  /* d11 measurement request */
622 #define DOT11_MEASURE_MODE_REPORT (1 << 3)   /* d11 measurement report */
623 #define DOT11_MEASURE_MODE_DUR (1 << 4)      /* d11 measurement dur mandatory */
624 /* Measurement Report Modes */
625 #define DOT11_MEASURE_MODE_LATE (1 << 0)      /* d11 measurement late */
626 #define DOT11_MEASURE_MODE_INCAPABLE (1 << 1) /* d11 measurement incapable */
627 #define DOT11_MEASURE_MODE_REFUSED (1 << 2)   /* d11 measurement refuse */
628 /* Basic Measurement Map bits */
629 #define DOT11_MEASURE_BASIC_MAP_BSS                                            \
630     ((uint8)(1 << 0)) /* d11 measurement basic map BSS */
631 #define DOT11_MEASURE_BASIC_MAP_OFDM                                           \
632     ((uint8)(1 << 1)) /* d11 measurement map OFDM */
633 #define DOT11_MEASURE_BASIC_MAP_UKNOWN                                         \
634     ((uint8)(1 << 2)) /* d11 measurement map unknown */
635 #define DOT11_MEASURE_BASIC_MAP_RADAR                                          \
636     ((uint8)(1 << 3)) /* d11 measurement map radar */
637 #define DOT11_MEASURE_BASIC_MAP_UNMEAS                                         \
638     ((uint8)(1 << 4)) /* d11 measurement map unmeasuremnt */
639 
640 BWL_PRE_PACKED_STRUCT struct dot11_meas_req {
641     uint8 id;
642     uint8 len;
643     uint8 token;
644     uint8 mode;
645     uint8 type;
646     uint8 channel;
647     uint8 start_time[8];
648     uint16 duration;
649 } BWL_POST_PACKED_STRUCT;
650 typedef struct dot11_meas_req dot11_meas_req_t;
651 #define DOT11_MNG_IE_MREQ_LEN 14 /* d11 measurement request IE length */
652 /* length of Measure Request IE data not including variable len */
653 #define DOT11_MNG_IE_MREQ_FIXED_LEN                                            \
654     3 /* d11 measurement request IE fixed length */
655 
656 BWL_PRE_PACKED_STRUCT struct dot11_meas_req_loc {
657     uint8 id;
658     uint8 len;
659     uint8 token;
660     uint8 mode;
661     uint8 type;
662     BWL_PRE_PACKED_STRUCT union {
663         BWL_PRE_PACKED_STRUCT struct {
664             uint8 subject;
665             uint8 data[1];
666         } BWL_POST_PACKED_STRUCT lci;
667         BWL_PRE_PACKED_STRUCT struct {
668             uint8 subject;
669             uint8 type; /* type of civic location */
670             uint8 siu;  /* service interval units */
671             uint16 si;  /* service interval */
672             uint8 data[1];
673         } BWL_POST_PACKED_STRUCT civic;
674         BWL_PRE_PACKED_STRUCT struct {
675             uint8 subject;
676             uint8 siu; /* service interval units */
677             uint16 si; /* service interval */
678             uint8 data[1];
679         } BWL_POST_PACKED_STRUCT locid;
680         BWL_PRE_PACKED_STRUCT struct {
681             uint16 max_init_delay; /* maximum random initial delay */
682             uint8 min_ap_count;
683             uint8 data[1];
684         } BWL_POST_PACKED_STRUCT ftm_range;
685     } BWL_POST_PACKED_STRUCT req;
686 } BWL_POST_PACKED_STRUCT;
687 typedef struct dot11_meas_req_loc dot11_meas_req_loc_t;
688 #define DOT11_MNG_IE_MREQ_MIN_LEN 4       /* d11 measurement report IE length */
689 #define DOT11_MNG_IE_MREQ_LCI_FIXED_LEN 4 /* d11 measurement report IE length  \
690                                            */
691 #define DOT11_MNG_IE_MREQ_CIVIC_FIXED_LEN                                      \
692     8 /* d11 measurement report IE length */
693 #define DOT11_MNG_IE_MREQ_FRNG_FIXED_LEN                                       \
694     6 /* d11 measurement report IE length */
695 
696 BWL_PRE_PACKED_STRUCT struct dot11_lci_subelement {
697     uint8 subelement;
698     uint8 length;
699     uint8 lci_data[1];
700 } BWL_POST_PACKED_STRUCT;
701 typedef struct dot11_lci_subelement dot11_lci_subelement_t;
702 
703 BWL_PRE_PACKED_STRUCT struct dot11_colocated_bssid_list_se {
704     uint8 sub_id;
705     uint8 length;
706     uint8 max_bssid_ind;        /* MaxBSSID Indicator */
707     struct ether_addr bssid[1]; /* variable */
708 } BWL_POST_PACKED_STRUCT;
709 typedef struct dot11_colocated_bssid_list_se dot11_colocated_bssid_list_se_t;
710 #define DOT11_LCI_COLOCATED_BSSID_LIST_FIXED_LEN 3
711 #define DOT11_LCI_COLOCATED_BSSID_SUBELEM_ID 7
712 
713 BWL_PRE_PACKED_STRUCT struct dot11_civic_subelement {
714     uint8 type; /* type of civic location */
715     uint8 subelement;
716     uint8 length;
717     uint8 civic_data[1];
718 } BWL_POST_PACKED_STRUCT;
719 typedef struct dot11_civic_subelement dot11_civic_subelement_t;
720 
721 BWL_PRE_PACKED_STRUCT struct dot11_meas_rep {
722     uint8 id;
723     uint8 len;
724     uint8 token;
725     uint8 mode;
726     uint8 type;
727     BWL_PRE_PACKED_STRUCT union {
728         BWL_PRE_PACKED_STRUCT struct {
729             uint8 channel;
730             uint8 start_time[8];
731             uint16 duration;
732             uint8 map;
733         } BWL_POST_PACKED_STRUCT basic;
734         BWL_PRE_PACKED_STRUCT struct {
735             uint8 subelement;
736             uint8 length;
737             uint8 data[1];
738         } BWL_POST_PACKED_STRUCT lci;
739         BWL_PRE_PACKED_STRUCT struct {
740             uint8 type; /* type of civic location */
741             uint8 subelement;
742             uint8 length;
743             uint8 data[1];
744         } BWL_POST_PACKED_STRUCT civic;
745         BWL_PRE_PACKED_STRUCT struct {
746             uint8 exp_tsf[8];
747             uint8 subelement;
748             uint8 length;
749             uint8 data[1];
750         } BWL_POST_PACKED_STRUCT locid;
751         BWL_PRE_PACKED_STRUCT struct {
752             uint8 entry_count;
753             uint8 data[1];
754         } BWL_POST_PACKED_STRUCT ftm_range;
755         uint8 data[1];
756     } BWL_POST_PACKED_STRUCT rep;
757 } BWL_POST_PACKED_STRUCT;
758 typedef struct dot11_meas_rep dot11_meas_rep_t;
759 #define DOT11_MNG_IE_MREP_MIN_LEN 5       /* d11 measurement report IE length */
760 #define DOT11_MNG_IE_MREP_LCI_FIXED_LEN 5 /* d11 measurement report IE length  \
761                                            */
762 #define DOT11_MNG_IE_MREP_CIVIC_FIXED_LEN                                      \
763     6 /* d11 measurement report IE length */
764 #define DOT11_MNG_IE_MREP_LOCID_FIXED_LEN                                      \
765     13 /* d11 measurement report IE length */
766 #define DOT11_MNG_IE_MREP_BASIC_FIXED_LEN                                      \
767     15 /* d11 measurement report IE length */
768 #define DOT11_MNG_IE_MREP_FRNG_FIXED_LEN 4
769 
770 /* length of Measure Report IE data not including variable len */
771 #define DOT11_MNG_IE_MREP_FIXED_LEN                                            \
772     3 /* d11 measurement response IE fixed length */
773 
774 BWL_PRE_PACKED_STRUCT struct dot11_meas_rep_basic {
775     uint8 channel;
776     uint8 start_time[8];
777     uint16 duration;
778     uint8 map;
779 } BWL_POST_PACKED_STRUCT;
780 typedef struct dot11_meas_rep_basic dot11_meas_rep_basic_t;
781 #define DOT11_MEASURE_BASIC_REP_LEN 12 /* d11 measurement basic report length  \
782                                         */
783 
784 BWL_PRE_PACKED_STRUCT struct dot11_quiet {
785     uint8 id;
786     uint8 len;
787     uint8 count;     /* TBTTs until beacon interval in quiet starts */
788     uint8 period;    /* Beacon intervals between periodic quiet periods ? */
789     uint16 duration; /* Length of quiet period, in TU's */
790     uint16 offset;   /* TU's offset from TBTT in Count field */
791 } BWL_POST_PACKED_STRUCT;
792 typedef struct dot11_quiet dot11_quiet_t;
793 
794 BWL_PRE_PACKED_STRUCT struct chan_map_tuple {
795     uint8 channel;
796     uint8 map;
797 } BWL_POST_PACKED_STRUCT;
798 typedef struct chan_map_tuple chan_map_tuple_t;
799 
800 BWL_PRE_PACKED_STRUCT struct dot11_ibss_dfs {
801     uint8 id;
802     uint8 len;
803     uint8 eaddr[ETHER_ADDR_LEN];
804     uint8 interval;
805     chan_map_tuple_t map[1];
806 } BWL_POST_PACKED_STRUCT;
807 typedef struct dot11_ibss_dfs dot11_ibss_dfs_t;
808 
809 /* WME Elements */
810 #define WME_OUI "\x00\x50\xf2" /* WME OUI */
811 #define WME_OUI_LEN 3
812 #define WME_OUI_TYPE 2         /* WME type */
813 #define WME_TYPE 2             /* WME type, deprecated */
814 #define WME_SUBTYPE_IE 0       /* Information Element */
815 #define WME_SUBTYPE_PARAM_IE 1 /* Parameter Element */
816 #define WME_SUBTYPE_TSPEC 2    /* Traffic Specification */
817 #define WME_VER 1              /* WME version */
818 
819 /* WME Access Category Indices (ACIs) */
820 #define AC_BE 0    /* Best Effort */
821 #define AC_BK 1    /* Background */
822 #define AC_VI 2    /* Video */
823 #define AC_VO 3    /* Voice */
824 #define AC_COUNT 4 /* number of ACs */
825 
826 typedef uint8 ac_bitmap_t; /* AC bitmap of (1 << AC_xx) */
827 
828 #define AC_BITMAP_NONE 0x0 /* No ACs */
829 #define AC_BITMAP_ALL 0xf  /* All ACs */
830 #define AC_BITMAP_TST(ab, ac) (((ab) & (1 << (ac))) != 0)
831 #define AC_BITMAP_SET(ab, ac) (((ab) |= (1 << (ac))))
832 #define AC_BITMAP_RESET(ab, ac) (((ab) &= ~(1 << (ac))))
833 
834 /* Management PKT Lifetime indices */
835 /* Removing flag checks 'BCMINTERNAL || WLTEST'
836  * while merging MERGE BIS120RC4 to DINGO2
837  */
838 #define MGMT_ALL 0xffff
839 #define MGMT_AUTH_LT FC_SUBTYPE_AUTH
840 #define MGMT_ASSOC_LT FC_SUBTYPE_ASSOC_REQ
841 
842 /** WME Information Element (IE) */
843 BWL_PRE_PACKED_STRUCT struct wme_ie {
844     uint8 oui[3];
845     uint8 type;
846     uint8 subtype;
847     uint8 version;
848     uint8 qosinfo;
849 } BWL_POST_PACKED_STRUCT;
850 typedef struct wme_ie wme_ie_t;
851 #define WME_IE_LEN 7 /* WME IE length */
852 
853 BWL_PRE_PACKED_STRUCT struct edcf_acparam {
854     uint8 ACI;
855     uint8 ECW;
856     uint16 TXOP; /* stored in network order (ls octet first) */
857 } BWL_POST_PACKED_STRUCT;
858 typedef struct edcf_acparam edcf_acparam_t;
859 
860 /** WME Parameter Element (PE) */
861 BWL_PRE_PACKED_STRUCT struct wme_param_ie {
862     uint8 oui[3];
863     uint8 type;
864     uint8 subtype;
865     uint8 version;
866     uint8 qosinfo;
867     uint8 rsvd;
868     edcf_acparam_t acparam[AC_COUNT];
869 } BWL_POST_PACKED_STRUCT;
870 typedef struct wme_param_ie wme_param_ie_t;
871 #define WME_PARAM_IE_LEN 24 /* WME Parameter IE length */
872 
873 /* QoS Info field for IE as sent from AP */
874 #define WME_QI_AP_APSD_MASK 0x80  /* U-APSD Supported mask */
875 #define WME_QI_AP_APSD_SHIFT 7    /* U-APSD Supported shift */
876 #define WME_QI_AP_COUNT_MASK 0x0f /* Parameter set count mask */
877 #define WME_QI_AP_COUNT_SHIFT 0   /* Parameter set count shift */
878 
879 /* QoS Info field for IE as sent from STA */
880 #define WME_QI_STA_MAXSPLEN_MASK 0x60 /* Max Service Period Length mask */
881 #define WME_QI_STA_MAXSPLEN_SHIFT 5   /* Max Service Period Length shift */
882 #define WME_QI_STA_APSD_ALL_MASK 0xf  /* APSD all AC bits mask */
883 #define WME_QI_STA_APSD_ALL_SHIFT 0   /* APSD all AC bits shift */
884 #define WME_QI_STA_APSD_BE_MASK 0x8   /* APSD AC_BE mask */
885 #define WME_QI_STA_APSD_BE_SHIFT 3    /* APSD AC_BE shift */
886 #define WME_QI_STA_APSD_BK_MASK 0x4   /* APSD AC_BK mask */
887 #define WME_QI_STA_APSD_BK_SHIFT 2    /* APSD AC_BK shift */
888 #define WME_QI_STA_APSD_VI_MASK 0x2   /* APSD AC_VI mask */
889 #define WME_QI_STA_APSD_VI_SHIFT 1    /* APSD AC_VI shift */
890 #define WME_QI_STA_APSD_VO_MASK 0x1   /* APSD AC_VO mask */
891 #define WME_QI_STA_APSD_VO_SHIFT 0    /* APSD AC_VO shift */
892 
893 /* ACI */
894 #define EDCF_AIFSN_MIN 1     /* AIFSN minimum value */
895 #define EDCF_AIFSN_MAX 15    /* AIFSN maximum value */
896 #define EDCF_AIFSN_MASK 0x0f /* AIFSN mask */
897 #define EDCF_ACM_MASK 0x10   /* ACM mask */
898 #define EDCF_ACI_MASK 0x60   /* ACI mask */
899 #define EDCF_ACI_SHIFT 5     /* ACI shift */
900 #define EDCF_AIFSN_SHIFT 12  /* 4 MSB(0xFFF) in ifs_ctl for AC idx */
901 
902 /* ECW */
903 #define EDCF_ECW_MIN 0  /* cwmin/cwmax exponent minimum value */
904 #define EDCF_ECW_MAX 15 /* cwmin/cwmax exponent maximum value */
905 #define EDCF_ECW2CW(exp) ((1 << (exp)) - 1)
906 #define EDCF_ECWMIN_MASK 0x0f /* cwmin exponent form mask */
907 #define EDCF_ECWMAX_MASK 0xf0 /* cwmax exponent form mask */
908 #define EDCF_ECWMAX_SHIFT 4   /* cwmax exponent form shift */
909 
910 /* TXOP */
911 #define EDCF_TXOP_MIN 0     /* TXOP minimum value */
912 #define EDCF_TXOP_MAX 65535 /* TXOP maximum value */
913 #define EDCF_TXOP2USEC(txop) ((txop) << 5)
914 
915 /* Default BE ACI value for non-WME connection STA */
916 #define NON_EDCF_AC_BE_ACI_STA 0x02
917 
918 /* Default EDCF parameters that AP advertises for STA to use; WMM draft Table 12
919  */
920 #define EDCF_AC_BE_ACI_STA 0x03    /* STA ACI value for best effort AC */
921 #define EDCF_AC_BE_ECW_STA 0xA4    /* STA ECW value for best effort AC */
922 #define EDCF_AC_BE_TXOP_STA 0x0000 /* STA TXOP value for best effort AC */
923 #define EDCF_AC_BK_ACI_STA 0x27    /* STA ACI value for background AC */
924 #define EDCF_AC_BK_ECW_STA 0xA4    /* STA ECW value for background AC */
925 #define EDCF_AC_BK_TXOP_STA 0x0000 /* STA TXOP value for background AC */
926 #define EDCF_AC_VI_ACI_STA 0x42    /* STA ACI value for video AC */
927 #define EDCF_AC_VI_ECW_STA 0x43    /* STA ECW value for video AC */
928 #define EDCF_AC_VI_TXOP_STA 0x005e /* STA TXOP value for video AC */
929 #define EDCF_AC_VO_ACI_STA 0x62    /* STA ACI value for audio AC */
930 #define EDCF_AC_VO_ECW_STA 0x32    /* STA ECW value for audio AC */
931 #define EDCF_AC_VO_TXOP_STA 0x002f /* STA TXOP value for audio AC */
932 
933 /* Default EDCF parameters that AP uses; WMM draft Table 14 */
934 #define EDCF_AC_BE_ACI_AP 0x03    /* AP ACI value for best effort AC */
935 #define EDCF_AC_BE_ECW_AP 0x64    /* AP ECW value for best effort AC */
936 #define EDCF_AC_BE_TXOP_AP 0x0000 /* AP TXOP value for best effort AC */
937 #define EDCF_AC_BK_ACI_AP 0x27    /* AP ACI value for background AC */
938 #define EDCF_AC_BK_ECW_AP 0xA4    /* AP ECW value for background AC */
939 #define EDCF_AC_BK_TXOP_AP 0x0000 /* AP TXOP value for background AC */
940 #define EDCF_AC_VI_ACI_AP 0x41    /* AP ACI value for video AC */
941 #define EDCF_AC_VI_ECW_AP 0x43    /* AP ECW value for video AC */
942 #define EDCF_AC_VI_TXOP_AP 0x005e /* AP TXOP value for video AC */
943 #define EDCF_AC_VO_ACI_AP 0x61    /* AP ACI value for audio AC */
944 #define EDCF_AC_VO_ECW_AP 0x32    /* AP ECW value for audio AC */
945 #define EDCF_AC_VO_TXOP_AP 0x002f /* AP TXOP value for audio AC */
946 
947 /** EDCA Parameter IE */
948 BWL_PRE_PACKED_STRUCT struct edca_param_ie {
949     uint8 qosinfo;
950     uint8 rsvd;
951     edcf_acparam_t acparam[AC_COUNT];
952 } BWL_POST_PACKED_STRUCT;
953 typedef struct edca_param_ie edca_param_ie_t;
954 #define EDCA_PARAM_IE_LEN 18 /* EDCA Parameter IE length */
955 
956 /** QoS Capability IE */
957 BWL_PRE_PACKED_STRUCT struct qos_cap_ie {
958     uint8 qosinfo;
959 } BWL_POST_PACKED_STRUCT;
960 typedef struct qos_cap_ie qos_cap_ie_t;
961 
962 BWL_PRE_PACKED_STRUCT struct dot11_qbss_load_ie {
963     uint8 id; /* 11, DOT11_MNG_QBSS_LOAD_ID */
964     uint8 length;
965     uint16 station_count;      /* total number of STAs associated */
966     uint8 channel_utilization; /* % of time, normalized to 255, QAP sensed
967                                   medium busy */
968     uint16 aac;                /* available admission capacity */
969 } BWL_POST_PACKED_STRUCT;
970 typedef struct dot11_qbss_load_ie dot11_qbss_load_ie_t;
971 #define BSS_LOAD_IE_SIZE 7 /* BSS load IE size */
972 
973 #define WLC_QBSS_LOAD_CHAN_FREE_MAX 0xff /* max for channel free score */
974 
975 /* Estimated Service Parameters (ESP) IE - 802.11-2016 9.4.2.174 */
976 typedef BWL_PRE_PACKED_STRUCT struct dot11_esp_ie {
977     uint8 id;
978     uint8 length;
979     uint8 id_ext;
980     /* variable len info */
981     uint8 esp_info_lists[];
982 } BWL_POST_PACKED_STRUCT dot11_esp_ie_t;
983 
984 #define DOT11_ESP_IE_HDR_SIZE (OFFSETOF(dot11_esp_ie_t, esp_info_lists))
985 
986 /* ESP Information list - 802.11-2016 9.4.2.174 */
987 typedef BWL_PRE_PACKED_STRUCT struct dot11_esp_ie_info_list {
988     /* acess category, data format, ba win size */
989     uint8 ac_df_baws;
990     /* estimated air time fraction */
991     uint8 eat_frac;
992     /* data PPDU duration target (50us units) */
993     uint8 ppdu_dur;
994 } BWL_POST_PACKED_STRUCT dot11_esp_ie_info_list_t;
995 
996 #define DOT11_ESP_IE_INFO_LIST_SIZE (sizeof(dot11_esp_ie_info_list_t))
997 
998 #define DOT11_ESP_NBR_INFO_LISTS 4u /* max nbr of esp information lists */
999 #define DOT11_ESP_INFO_LIST_AC_BK                                              \
1000     0u /* access category of esp information list AC_BK */
1001 #define DOT11_ESP_INFO_LIST_AC_BE                                              \
1002     1u /* access category of esp information list AC_BE */
1003 #define DOT11_ESP_INFO_LIST_AC_VI                                              \
1004     2u /* access category of esp information list AC_VI */
1005 #define DOT11_ESP_INFO_LIST_AC_VO                                              \
1006     3u /* access category of esp information list AC_VO */
1007 
1008 #define DOT11_ESP_INFO_LIST_DF_MASK 0x18   /* Data Format Mask */
1009 #define DOT11_ESP_INFO_LIST_BAWS_MASK 0xE0 /* BA window size mask */
1010 
1011 /* nom_msdu_size */
1012 #define FIXED_MSDU_SIZE 0x8000 /* MSDU size is fixed */
1013 #define MSDU_SIZE_MASK 0x7fff  /* (Nominal or fixed) MSDU size */
1014 
1015 /* surplus_bandwidth */
1016 /* Represented as 3 bits of integer, binary point, 13 bits fraction */
1017 #define INTEGER_SHIFT 13     /* integer shift */
1018 #define FRACTION_MASK 0x1FFF /* fraction mask */
1019 
1020 /** Management Notification Frame */
1021 BWL_PRE_PACKED_STRUCT struct dot11_management_notification {
1022     uint8 category; /* DOT11_ACTION_NOTIFICATION */
1023     uint8 action;
1024     uint8 token;
1025     uint8 status;
1026     uint8 data[1]; /* Elements */
1027 } BWL_POST_PACKED_STRUCT;
1028 #define DOT11_MGMT_NOTIFICATION_LEN 4 /* Fixed length */
1029 
1030 /** Timeout Interval IE */
1031 BWL_PRE_PACKED_STRUCT struct ti_ie {
1032     uint8 ti_type;
1033     uint32 ti_val;
1034 } BWL_POST_PACKED_STRUCT;
1035 typedef struct ti_ie ti_ie_t;
1036 #define TI_TYPE_REASSOC_DEADLINE 1
1037 #define TI_TYPE_KEY_LIFETIME 2
1038 
1039 #ifndef CISCO_AIRONET_OUI
1040 #define CISCO_AIRONET_OUI "\x00\x40\x96" /* Cisco AIRONET OUI */
1041 #endif                                   // endif
1042 /* QoS FastLane IE. */
1043 BWL_PRE_PACKED_STRUCT struct ccx_qfl_ie {
1044     uint8 id;     /* 221, DOT11_MNG_VS_ID */
1045     uint8 length; /* 5 */
1046     uint8 oui[3]; /* 00:40:96 */
1047     uint8 type;   /* 11 */
1048     uint8 data;
1049 } BWL_POST_PACKED_STRUCT;
1050 typedef struct ccx_qfl_ie ccx_qfl_ie_t;
1051 #define CCX_QFL_IE_TYPE 11
1052 #define CCX_QFL_ENABLE_SHIFT 5
1053 #define CCX_QFL_ENALBE (1 << CCX_QFL_ENABLE_SHIFT)
1054 
1055 /* WME Action Codes */
1056 #define WME_ADDTS_REQUEST 0  /* WME ADDTS request */
1057 #define WME_ADDTS_RESPONSE 1 /* WME ADDTS response */
1058 #define WME_DELTS_REQUEST 2  /* WME DELTS request */
1059 
1060 /* WME Setup Response Status Codes */
1061 #define WME_ADMISSION_ACCEPTED 0 /* WME admission accepted */
1062 #define WME_INVALID_PARAMETERS 1 /* WME invalide parameters */
1063 #define WME_ADMISSION_REFUSED 3  /* WME admission refused */
1064 
1065 /* Macro to take a pointer to a beacon or probe response
1066  * body and return the char* pointer to the SSID info element
1067  */
1068 #define BCN_PRB_SSID(body) ((char *)(body) + DOT11_BCN_PRB_LEN)
1069 
1070 /* Authentication frame payload constants */
1071 #define DOT11_OPEN_SYSTEM 0     /* d11 open authentication */
1072 #define DOT11_SHARED_KEY 1      /* d11 shared authentication */
1073 #define DOT11_FAST_BSS 2        /* d11 fast bss authentication */
1074 #define DOT11_SAE 3             /* d11 simultaneous authentication of equals */
1075 #define DOT11_FILS_SKEY 4       /* d11 fils shared key authentication w/o pfs */
1076 #define DOT11_FILS_SKEY_PFS 5   /* d11 fils shared key authentication w/ pfs */
1077 #define DOT11_FILS_PKEY 6       /* d11 fils public key authentication */
1078 #define DOT11_CHALLENGE_LEN 128 /* d11 challenge text length */
1079 
1080 /* Frame control macros */
1081 #define FC_PVER_MASK 0x3     /* PVER mask */
1082 #define FC_PVER_SHIFT 0      /* PVER shift */
1083 #define FC_TYPE_MASK 0xC     /* type mask */
1084 #define FC_TYPE_SHIFT 2      /* type shift */
1085 #define FC_SUBTYPE_MASK 0xF0 /* subtype mask */
1086 #define FC_SUBTYPE_SHIFT 4   /* subtype shift */
1087 #define FC_TODS 0x100        /* to DS */
1088 #define FC_TODS_SHIFT 8      /* to DS shift */
1089 #define FC_FROMDS 0x200      /* from DS */
1090 #define FC_FROMDS_SHIFT 9    /* from DS shift */
1091 #define FC_MOREFRAG 0x400    /* more frag. */
1092 #define FC_MOREFRAG_SHIFT 10 /* more frag. shift */
1093 #define FC_RETRY 0x800       /* retry */
1094 #define FC_RETRY_SHIFT 11    /* retry shift */
1095 #define FC_PM 0x1000         /* PM */
1096 #define FC_PM_SHIFT 12       /* PM shift */
1097 #define FC_MOREDATA 0x2000   /* more data */
1098 #define FC_MOREDATA_SHIFT 13 /* more data shift */
1099 #define FC_WEP 0x4000        /* WEP */
1100 #define FC_WEP_SHIFT 14      /* WEP shift */
1101 #define FC_ORDER 0x8000      /* order */
1102 #define FC_ORDER_SHIFT 15    /* order shift */
1103 
1104 /* sequence control macros */
1105 #define SEQNUM_SHIFT 4    /* seq. number shift */
1106 #define SEQNUM_MAX 0x1000 /* max seqnum + 1 */
1107 #define FRAGNUM_MASK 0xF  /* frag. number mask */
1108 
1109 /* Frame Control type/subtype defs */
1110 
1111 /* FC Types */
1112 #define FC_TYPE_MNG 0  /* management type */
1113 #define FC_TYPE_CTL 1  /* control type */
1114 #define FC_TYPE_DATA 2 /* data type */
1115 
1116 /* Management Subtypes */
1117 #define FC_SUBTYPE_ASSOC_REQ 0     /* assoc. request */
1118 #define FC_SUBTYPE_ASSOC_RESP 1    /* assoc. response */
1119 #define FC_SUBTYPE_REASSOC_REQ 2   /* reassoc. request */
1120 #define FC_SUBTYPE_REASSOC_RESP 3  /* reassoc. response */
1121 #define FC_SUBTYPE_PROBE_REQ 4     /* probe request */
1122 #define FC_SUBTYPE_PROBE_RESP 5    /* probe response */
1123 #define FC_SUBTYPE_BEACON 8        /* beacon */
1124 #define FC_SUBTYPE_ATIM 9          /* ATIM */
1125 #define FC_SUBTYPE_DISASSOC 10     /* disassoc. */
1126 #define FC_SUBTYPE_AUTH 11         /* authentication */
1127 #define FC_SUBTYPE_DEAUTH 12       /* de-authentication */
1128 #define FC_SUBTYPE_ACTION 13       /* action */
1129 #define FC_SUBTYPE_ACTION_NOACK 14 /* action no-ack */
1130 
1131 /* Control Subtypes */
1132 #define FC_SUBTYPE_TRIGGER 2      /* Trigger frame */
1133 #define FC_SUBTYPE_CTL_WRAPPER 7  /* Control Wrapper */
1134 #define FC_SUBTYPE_BLOCKACK_REQ 8 /* Block Ack Req */
1135 #define FC_SUBTYPE_BLOCKACK 9     /* Block Ack */
1136 #define FC_SUBTYPE_PS_POLL 10     /* PS poll */
1137 #define FC_SUBTYPE_RTS 11         /* RTS */
1138 #define FC_SUBTYPE_CTS 12         /* CTS */
1139 #define FC_SUBTYPE_ACK 13         /* ACK */
1140 #define FC_SUBTYPE_CF_END 14      /* CF-END */
1141 #define FC_SUBTYPE_CF_END_ACK 15  /* CF-END ACK */
1142 
1143 /* Data Subtypes */
1144 #define FC_SUBTYPE_DATA 0                  /* Data */
1145 #define FC_SUBTYPE_DATA_CF_ACK 1           /* Data + CF-ACK */
1146 #define FC_SUBTYPE_DATA_CF_POLL 2          /* Data + CF-Poll */
1147 #define FC_SUBTYPE_DATA_CF_ACK_POLL 3      /* Data + CF-Ack + CF-Poll */
1148 #define FC_SUBTYPE_NULL 4                  /* Null */
1149 #define FC_SUBTYPE_CF_ACK 5                /* CF-Ack */
1150 #define FC_SUBTYPE_CF_POLL 6               /* CF-Poll */
1151 #define FC_SUBTYPE_CF_ACK_POLL 7           /* CF-Ack + CF-Poll */
1152 #define FC_SUBTYPE_QOS_DATA 8              /* QoS Data */
1153 #define FC_SUBTYPE_QOS_DATA_CF_ACK 9       /* QoS Data + CF-Ack */
1154 #define FC_SUBTYPE_QOS_DATA_CF_POLL 10     /* QoS Data + CF-Poll */
1155 #define FC_SUBTYPE_QOS_DATA_CF_ACK_POLL 11 /* QoS Data + CF-Ack + CF-Poll */
1156 #define FC_SUBTYPE_QOS_NULL 12             /* QoS Null */
1157 #define FC_SUBTYPE_QOS_CF_POLL 14          /* QoS CF-Poll */
1158 #define FC_SUBTYPE_QOS_CF_ACK_POLL 15      /* QoS CF-Ack + CF-Poll */
1159 
1160 /* Data Subtype Groups */
1161 #define FC_SUBTYPE_ANY_QOS(s) (((s)&8) != 0)
1162 #define FC_SUBTYPE_ANY_NULL(s) (((s)&4) != 0)
1163 #define FC_SUBTYPE_ANY_CF_POLL(s) (((s)&2) != 0)
1164 #define FC_SUBTYPE_ANY_CF_ACK(s) (((s)&1) != 0)
1165 #define FC_SUBTYPE_ANY_PSPOLL(s) (((s)&10) != 0)
1166 
1167 /* Type/Subtype Combos */
1168 #define FC_KIND_MASK (FC_TYPE_MASK | FC_SUBTYPE_MASK) /* FC kind mask */
1169 
1170 #define FC_KIND(t, s)                                                          \
1171     (((t) << FC_TYPE_SHIFT) | ((s) << FC_SUBTYPE_SHIFT)) /* FC kind */
1172 
1173 #define FC_SUBTYPE(fc)                                                         \
1174     (((fc)&FC_SUBTYPE_MASK) >> FC_SUBTYPE_SHIFT)           /* Subtype from FC */
1175 #define FC_TYPE(fc) (((fc)&FC_TYPE_MASK) >> FC_TYPE_SHIFT) /* Type from FC */
1176 
1177 #define FC_ASSOC_REQ                                                           \
1178     FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_REQ) /* assoc. request */
1179 #define FC_ASSOC_RESP                                                          \
1180     FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_RESP) /* assoc. response */
1181 #define FC_REASSOC_REQ                                                         \
1182     FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_REQ) /* reassoc. request */
1183 #define FC_REASSOC_RESP                                                        \
1184     FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_RESP) /* reassoc. response */
1185 #define FC_PROBE_REQ                                                           \
1186     FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_REQ) /* probe request */
1187 #define FC_PROBE_RESP                                                          \
1188     FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_RESP)           /* probe response */
1189 #define FC_BEACON FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_BEACON) /* beacon */
1190 #define FC_ATIM FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ATIM)     /* ATIM */
1191 #define FC_DISASSOC FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DISASSOC) /* disassoc */
1192 #define FC_AUTH FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_AUTH)     /* authentication */
1193 #define FC_DEAUTH FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DEAUTH) /* deauthentication  \
1194                                                            */
1195 #define FC_ACTION FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ACTION) /* action */
1196 #define FC_ACTION_NOACK                                                        \
1197     FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ACTION_NOACK) /* action no-ack */
1198 
1199 #define FC_CTL_TRIGGER                                                         \
1200     FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_TRIGGER) /* Trigger frame */
1201 #define FC_CTL_WRAPPER                                                         \
1202     FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CTL_WRAPPER) /* Control Wrapper */
1203 #define FC_BLOCKACK_REQ                                                        \
1204     FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_BLOCKACK_REQ) /* Block Ack Req */
1205 #define FC_BLOCKACK FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_BLOCKACK) /* Block Ack */
1206 #define FC_PS_POLL FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_PS_POLL)   /* PS poll */
1207 #define FC_RTS FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_RTS)           /* RTS */
1208 #define FC_CTS FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CTS)           /* CTS */
1209 #define FC_ACK FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_ACK)           /* ACK */
1210 #define FC_CF_END FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END)     /* CF-END */
1211 #define FC_CF_END_ACK                                                          \
1212     FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END_ACK) /* CF-END ACK */
1213 
1214 #define FC_DATA FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA)      /* data */
1215 #define FC_NULL_DATA FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_NULL) /* null data */
1216 #define FC_DATA_CF_ACK                                                         \
1217     FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA_CF_ACK)              /* data CF ACK */
1218 #define FC_QOS_DATA FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_QOS_DATA) /* QoS data */
1219 #define FC_QOS_NULL FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_QOS_NULL) /* QoS null */
1220 
1221 /* QoS Control Field */
1222 
1223 /* 802.1D Priority */
1224 #define QOS_PRIO_SHIFT 0     /* QoS priority shift */
1225 #define QOS_PRIO_MASK 0x0007 /* QoS priority mask */
1226 #define QOS_PRIO(qos)                                                          \
1227     (((qos)&QOS_PRIO_MASK) >> QOS_PRIO_SHIFT) /* QoS priority */
1228 
1229 /* Traffic Identifier */
1230 #define QOS_TID_SHIFT 0                                      /* QoS TID shift */
1231 #define QOS_TID_MASK 0x000f                                  /* QoS TID mask */
1232 #define QOS_TID(qos) (((qos)&QOS_TID_MASK) >> QOS_TID_SHIFT) /* QoS TID */
1233 
1234 /* End of Service Period (U-APSD) */
1235 #define QOS_EOSP_SHIFT 4     /* QoS End of Service Period shift */
1236 #define QOS_EOSP_MASK 0x0010 /* QoS End of Service Period mask */
1237 #define QOS_EOSP(qos) (((qos)&QOS_EOSP_MASK) >> QOS_EOSP_SHIFT) /* Qos EOSP */
1238 
1239 /* Ack Policy */
1240 #define QOS_ACK_NORMAL_ACK 0 /* Normal Ack */
1241 #define QOS_ACK_NO_ACK 1     /* No Ack (eg mcast) */
1242 #define QOS_ACK_NO_EXP_ACK 2 /* No Explicit Ack */
1243 #define QOS_ACK_BLOCK_ACK 3  /* Block Ack */
1244 #define QOS_ACK_SHIFT 5      /* QoS ACK shift */
1245 #define QOS_ACK_MASK 0x0060  /* QoS ACK mask */
1246 #define QOS_ACK(qos) (((qos)&QOS_ACK_MASK) >> QOS_ACK_SHIFT) /* QoS ACK */
1247 
1248 /* A-MSDU flag */
1249 #define QOS_AMSDU_SHIFT 7     /* AMSDU shift */
1250 #define QOS_AMSDU_MASK 0x0080 /* AMSDU mask */
1251 
1252 /* Management Frames */
1253 
1254 /* Management Frame Constants */
1255 
1256 /* Fixed fields */
1257 #define DOT11_MNG_AUTH_ALGO_LEN 2  /* d11 management auth. algo. length */
1258 #define DOT11_MNG_AUTH_SEQ_LEN 2   /* d11 management auth. seq. length */
1259 #define DOT11_MNG_BEACON_INT_LEN 2 /* d11 management beacon interval length */
1260 #define DOT11_MNG_CAP_LEN 2        /* d11 management cap. length */
1261 #define DOT11_MNG_AP_ADDR_LEN 6    /* d11 management AP address length */
1262 #define DOT11_MNG_LISTEN_INT_LEN 2 /* d11 management listen interval length */
1263 #define DOT11_MNG_REASON_LEN 2     /* d11 management reason length */
1264 #define DOT11_MNG_AID_LEN 2        /* d11 management AID length */
1265 #define DOT11_MNG_STATUS_LEN 2     /* d11 management status length */
1266 #define DOT11_MNG_TIMESTAMP_LEN 8  /* d11 management timestamp length */
1267 
1268 /* DUR/ID field in assoc resp is 0xc000 | AID */
1269 #define DOT11_AID_MASK 0x3fff /* d11 AID mask */
1270 
1271 /* Reason Codes */
1272 #define DOT11_RC_RESERVED 0    /* d11 RC reserved */
1273 #define DOT11_RC_UNSPECIFIED 1 /* Unspecified reason */
1274 #define DOT11_RC_AUTH_INVAL 2  /* Previous authentication no longer valid */
1275 #define DOT11_RC_DEAUTH_LEAVING                                                \
1276     3                         /* Deauthenticated because sending station       \
1277                                * is leaving (or has left) IBSS or ESS          \
1278                                */
1279 #define DOT11_RC_INACTIVITY 4 /* Disassociated due to inactivity */
1280 #define DOT11_RC_BUSY                                                          \
1281     5 /* Disassociated because AP is unable to handle                          \
1282        * all currently associated stations                                     \
1283        */
1284 #define DOT11_RC_INVAL_CLASS_2                                                 \
1285     6 /* Class 2 frame received from                                           \
1286        * nonauthenticated station                                              \
1287        */
1288 #define DOT11_RC_INVAL_CLASS_3                                                 \
1289     7 /* Class 3 frame received from                                           \
1290        *  nonassociated station                                                \
1291        */
1292 #define DOT11_RC_DISASSOC_LEAVING                                              \
1293     8 /* Disassociated because sending station is                              \
1294        * leaving (or has left) BSS                                             \
1295        */
1296 #define DOT11_RC_NOT_AUTH                                                      \
1297     9                            /* Station requesting (re)association is not  \
1298                                   * authenticated with responding station      \
1299                                   */
1300 #define DOT11_RC_BAD_PC 10       /* Unacceptable power capability element */
1301 #define DOT11_RC_BAD_CHANNELS 11 /* Unacceptable supported channels element */
1302 
1303 /* 12 is unused by STA but could be used by AP/GO */
1304 #define DOT11_RC_DISASSOC_BTM 12 /* Disassociated due to BSS Transition Magmt  \
1305                                   */
1306 
1307 /* 32-39 are QSTA specific reasons added in 11e */
1308 #define DOT11_RC_UNSPECIFIED_QOS 32  /* unspecified QoS-related reason */
1309 #define DOT11_RC_INSUFFCIENT_BW 33   /* QAP lacks sufficient bandwidth */
1310 #define DOT11_RC_EXCESSIVE_FRAMES 34 /* excessive number of frames need ack */
1311 #define DOT11_RC_TX_OUTSIDE_TXOP                                               \
1312     35                            /* transmitting outside the limits of txop */
1313 #define DOT11_RC_LEAVING_QBSS 36  /* QSTA is leaving the QBSS (or restting) */
1314 #define DOT11_RC_BAD_MECHANISM 37 /* does not want to use the mechanism */
1315 #define DOT11_RC_SETUP_NEEDED 38  /* mechanism needs a setup */
1316 #define DOT11_RC_TIMEOUT 39       /* timeout */
1317 
1318 #define DOT11_RC_MESH_PEERING_CANCELLED 52
1319 #define DOT11_RC_MESH_MAX_PEERS 53
1320 #define DOT11_RC_MESH_CONFIG_POLICY_VIOLN 54
1321 #define DOT11_RC_MESH_CLOSE_RECVD 55
1322 #define DOT11_RC_MESH_MAX_RETRIES 56
1323 #define DOT11_RC_MESH_CONFIRM_TIMEOUT 57
1324 #define DOT11_RC_MESH_INVALID_GTK 58
1325 #define DOT11_RC_MESH_INCONSISTENT_PARAMS 59
1326 
1327 #define DOT11_RC_MESH_INVALID_SEC_CAP 60
1328 #define DOT11_RC_MESH_PATHERR_NOPROXYINFO 61
1329 #define DOT11_RC_MESH_PATHERR_NOFWINFO 62
1330 #define DOT11_RC_MESH_PATHERR_DSTUNREACH 63
1331 #define DOT11_RC_MESH_MBSSMAC_EXISTS 64
1332 #define DOT11_RC_MESH_CHANSWITCH_REGREQ 65
1333 #define DOT11_RC_MESH_CHANSWITCH_UNSPEC 66
1334 
1335 #define DOT11_RC_MAX 66 /* Reason codes > 66 are reserved */
1336 
1337 #define DOT11_RC_TDLS_PEER_UNREACH 25
1338 #define DOT11_RC_TDLS_DOWN_UNSPECIFIED 26
1339 
1340 /* Status Codes */
1341 #define DOT11_SC_SUCCESS 0 /* Successful */
1342 #define DOT11_SC_FAILURE 1 /* Unspecified failure */
1343 #define DOT11_SC_TDLS_WAKEUP_SCH_ALT                                           \
1344     2 /* TDLS wakeup schedule rejected but alternative  */
1345       /* schedule provided */
1346 #define DOT11_SC_TDLS_WAKEUP_SCH_REJ 3 /* TDLS wakeup schedule rejected */
1347 #define DOT11_SC_TDLS_SEC_DISABLED 5   /* TDLS Security disabled */
1348 #define DOT11_SC_LIFETIME_REJ 6        /* Unacceptable lifetime */
1349 #define DOT11_SC_NOT_SAME_BSS 7        /* Not in same BSS */
1350 #define DOT11_SC_CAP_MISMATCH                                                  \
1351     10 /* Cannot support all requested                                         \
1352         * capabilities in the Capability                                       \
1353         * Information field                                                    \
1354         */
1355 #define DOT11_SC_REASSOC_FAIL                                                  \
1356     11 /* Reassociation denied due to inability                                \
1357         * to confirm that association exists                                   \
1358         */
1359 #define DOT11_SC_ASSOC_FAIL                                                    \
1360     12 /* Association denied due to reason                                     \
1361         * outside the scope of this standard                                   \
1362         */
1363 #define DOT11_SC_AUTH_MISMATCH                                                 \
1364     13 /* Responding station does not support                                  \
1365         * the specified authentication                                         \
1366         * algorithm                                                            \
1367         */
1368 #define DOT11_SC_AUTH_SEQ                                                      \
1369     14 /* Received an Authentication frame                                     \
1370         * with authentication transaction                                      \
1371         * sequence number out of expected                                      \
1372         * sequence                                                             \
1373         */
1374 #define DOT11_SC_AUTH_CHALLENGE_FAIL                                           \
1375     15 /* Authentication rejected because of                                   \
1376         * challenge failure                                                    \
1377         */
1378 #define DOT11_SC_AUTH_TIMEOUT                                                  \
1379     16 /* Authentication rejected due to timeout                               \
1380         * waiting for next frame in sequence                                   \
1381         */
1382 #define DOT11_SC_ASSOC_BUSY_FAIL                                               \
1383     17 /* Association denied because AP is                                     \
1384         * unable to handle additional                                          \
1385         * associated stations                                                  \
1386         */
1387 #define DOT11_SC_ASSOC_RATE_MISMATCH                                           \
1388     18 /* Association denied due to requesting                                 \
1389         * station not supporting all of the                                    \
1390         * data rates in the BSSBasicRateSet                                    \
1391         * parameter                                                            \
1392         */
1393 #define DOT11_SC_ASSOC_SHORT_REQUIRED                                          \
1394     19 /* Association denied due to requesting                                 \
1395         * station not supporting the Short                                     \
1396         * Preamble option                                                      \
1397         */
1398 #define DOT11_SC_ASSOC_PBCC_REQUIRED                                           \
1399     20 /* Association denied due to requesting                                 \
1400         * station not supporting the PBCC                                      \
1401         * Modulation option                                                    \
1402         */
1403 #define DOT11_SC_ASSOC_AGILITY_REQUIRED                                        \
1404     21 /* Association denied due to requesting                                 \
1405         * station not supporting the Channel                                   \
1406         * Agility option                                                       \
1407         */
1408 #define DOT11_SC_ASSOC_SPECTRUM_REQUIRED                                       \
1409     22 /* Association denied because Spectrum                                  \
1410         * Management capability is required.                                   \
1411         */
1412 #define DOT11_SC_ASSOC_BAD_POWER_CAP                                           \
1413     23 /* Association denied because the info                                  \
1414         * in the Power Cap element is                                          \
1415         * unacceptable.                                                        \
1416         */
1417 #define DOT11_SC_ASSOC_BAD_SUP_CHANNELS                                        \
1418     24 /* Association denied because the info                                  \
1419         * in the Supported Channel element is                                  \
1420         * unacceptable                                                         \
1421         */
1422 #define DOT11_SC_ASSOC_SHORTSLOT_REQUIRED                                      \
1423     25 /* Association denied due to requesting                                 \
1424         * station not supporting the Short Slot                                \
1425         * Time option                                                          \
1426         */
1427 #define DOT11_SC_ASSOC_DSSSOFDM_REQUIRED                                       \
1428     26 /* Association denied because requesting station                        \
1429         * does not support the DSSS-OFDM option                                \
1430         */
1431 #define DOT11_SC_ASSOC_HT_REQUIRED                                             \
1432     27 /* Association denied because the requesting                            \
1433         * station does not support HT features                                 \
1434         */
1435 #define DOT11_SC_ASSOC_R0KH_UNREACHABLE                                        \
1436     28 /* Association denied due to AP                                         \
1437         * being unable to reach the R0 Key Holder                              \
1438         */
1439 #define DOT11_SC_ASSOC_TRY_LATER                                               \
1440     30 /* Association denied temporarily, try again later                      \
1441         */
1442 #define DOT11_SC_ASSOC_MFP_VIOLATION                                           \
1443     31 /* Association denied due to Robust Management                          \
1444         * frame policy violation                                               \
1445         */
1446 
1447 #define DOT11_SC_DECLINED 37       /* request declined */
1448 #define DOT11_SC_INVALID_PARAMS 38 /* One or more params have invalid values   \
1449                                     */
1450 #define DOT11_SC_INVALID_PAIRWISE_CIPHER 42 /* invalid pairwise cipher */
1451 #define DOT11_SC_INVALID_AKMP 43 /* Association denied due to invalid AKMP */
1452 #define DOT11_SC_INVALID_RSNIE_CAP 45 /* invalid RSN IE capabilities */
1453 #define DOT11_SC_DLS_NOT_ALLOWED                                               \
1454     48                            /* DLS is not allowed in the BSS by policy */
1455 #define DOT11_SC_INVALID_PMKID 53 /* Association denied due to invalid PMKID   \
1456                                    */
1457 #define DOT11_SC_INVALID_MDID 54  /* Association denied due to invalid MDID */
1458 #define DOT11_SC_INVALID_FTIE 55  /* Association denied due to invalid FTIE */
1459 
1460 #define DOT11_SC_ADV_PROTO_NOT_SUPPORTED 59 /* ad proto not supported */
1461 #define DOT11_SC_NO_OUTSTAND_REQ 60         /* no outstanding req */
1462 #define DOT11_SC_RSP_NOT_RX_FROM_SERVER 61  /* no response from server */
1463 #define DOT11_SC_TIMEOUT 62                 /* timeout */
1464 #define DOT11_SC_QUERY_RSP_TOO_LARGE 63     /* query rsp too large */
1465 #define DOT11_SC_SERVER_UNREACHABLE 65      /* server unreachable */
1466 
1467 #define DOT11_SC_UNEXP_MSG 70      /* Unexpected message */
1468 #define DOT11_SC_INVALID_SNONCE 71 /* Invalid SNonce */
1469 #define DOT11_SC_INVALID_RSNIE 72  /* Invalid contents of RSNIE */
1470 
1471 #define DOT11_SC_ANTICLOG_TOCKEN_REQUIRED 76  /* Anti-clogging tocken required \
1472                                                */
1473 #define DOT11_SC_INVALID_FINITE_CYCLIC_GRP 77 /* Invalid contents of RSNIE */
1474 
1475 #define DOT11_SC_ASSOC_VHT_REQUIRED                                            \
1476     104 /* Association denied because the requesting                           \
1477          * station does not support VHT features.                              \
1478          */
1479 
1480 #define DOT11_SC_TRANSMIT_FAILURE 79 /* transmission failure */
1481 
1482 /* Info Elts, length of INFORMATION portion of Info Elts */
1483 #define DOT11_MNG_DS_PARAM_LEN 1   /* d11 management DS parameter length */
1484 #define DOT11_MNG_IBSS_PARAM_LEN 2 /* d11 management IBSS parameter length */
1485 
1486 /* TIM Info element has 3 bytes fixed info in INFORMATION field,
1487  * followed by 1 to 251 bytes of Partial Virtual Bitmap
1488  */
1489 #define DOT11_MNG_TIM_FIXED_LEN 3   /* d11 management TIM fixed length */
1490 #define DOT11_MNG_TIM_DTIM_COUNT 0  /* d11 management DTIM count */
1491 #define DOT11_MNG_TIM_DTIM_PERIOD 1 /* d11 management DTIM period */
1492 #define DOT11_MNG_TIM_BITMAP_CTL 2  /* d11 management TIM BITMAP control  */
1493 #define DOT11_MNG_TIM_PVB 3         /* d11 management TIM PVB */
1494 
1495 /* TLV defines */
1496 #define TLV_TAG_OFF 0        /* tag offset */
1497 #define TLV_LEN_OFF 1        /* length offset */
1498 #define TLV_HDR_LEN 2        /* header length */
1499 #define TLV_BODY_OFF 2       /* body offset */
1500 #define TLV_BODY_LEN_MAX 255 /* max body length */
1501 
1502 /* Management Frame Information Element IDs */
1503 #define DOT11_MNG_SSID_ID 0            /* d11 management SSID id */
1504 #define DOT11_MNG_RATES_ID 1           /* d11 management rates id */
1505 #define DOT11_MNG_FH_PARMS_ID 2        /* d11 management FH parameter id */
1506 #define DOT11_MNG_DS_PARMS_ID 3        /* d11 management DS parameter id */
1507 #define DOT11_MNG_CF_PARMS_ID 4        /* d11 management CF parameter id */
1508 #define DOT11_MNG_TIM_ID 5             /* d11 management TIM id */
1509 #define DOT11_MNG_IBSS_PARMS_ID 6      /* d11 management IBSS parameter id */
1510 #define DOT11_MNG_COUNTRY_ID 7         /* d11 management country id */
1511 #define DOT11_MNG_HOPPING_PARMS_ID 8   /* d11 management hopping parameter id */
1512 #define DOT11_MNG_HOPPING_TABLE_ID 9   /* d11 management hopping table id */
1513 #define DOT11_MNG_FTM_SYNC_INFO_ID 9   /* 11mc D4.3 */
1514 #define DOT11_MNG_REQUEST_ID 10        /* d11 management request id */
1515 #define DOT11_MNG_QBSS_LOAD_ID 11      /* d11 management QBSS Load id */
1516 #define DOT11_MNG_EDCA_PARAM_ID 12     /* 11E EDCA Parameter id */
1517 #define DOT11_MNG_TSPEC_ID 13          /* d11 management TSPEC id */
1518 #define DOT11_MNG_TCLAS_ID 14          /* d11 management TCLAS id */
1519 #define DOT11_MNG_CHALLENGE_ID 16      /* d11 management chanllenge id */
1520 #define DOT11_MNG_PWR_CONSTRAINT_ID 32 /* 11H PowerConstraint */
1521 #define DOT11_MNG_PWR_CAP_ID 33        /* 11H PowerCapability */
1522 #define DOT11_MNG_TPC_REQUEST_ID 34    /* 11H TPC Request */
1523 #define DOT11_MNG_TPC_REPORT_ID 35     /* 11H TPC Report */
1524 #define DOT11_MNG_SUPP_CHANNELS_ID 36  /* 11H Supported Channels */
1525 #define DOT11_MNG_CHANNEL_SWITCH_ID 37 /* 11H ChannelSwitch Announcement */
1526 #define DOT11_MNG_MEASURE_REQUEST_ID 38 /* 11H MeasurementRequest */
1527 #define DOT11_MNG_MEASURE_REPORT_ID 39  /* 11H MeasurementReport */
1528 #define DOT11_MNG_QUIET_ID 40           /* 11H Quiet */
1529 #define DOT11_MNG_IBSS_DFS_ID 41        /* 11H IBSS_DFS */
1530 #define DOT11_MNG_ERP_ID 42             /* d11 management ERP id */
1531 #define DOT11_MNG_TS_DELAY_ID 43        /* d11 management TS Delay id */
1532 #define DOT11_MNG_TCLAS_PROC_ID 44      /* d11 management TCLAS processing id */
1533 #define DOT11_MNG_HT_CAP 45             /* d11 mgmt HT cap id */
1534 #define DOT11_MNG_QOS_CAP_ID 46         /* 11E QoS Capability id */
1535 #define DOT11_MNG_NONERP_ID 47          /* d11 management NON-ERP id */
1536 #define DOT11_MNG_RSN_ID 48             /* d11 management RSN id */
1537 #define DOT11_MNG_EXT_RATES_ID 50       /* d11 management ext. rates id */
1538 #define DOT11_MNG_AP_CHREP_ID 51        /* 11k AP Channel report id */
1539 #define DOT11_MNG_NEIGHBOR_REP_ID 52    /* 11k & 11v Neighbor report id */
1540 #define DOT11_MNG_RCPI_ID 53            /* 11k RCPI */
1541 #define DOT11_MNG_MDIE_ID 54            /* 11r Mobility domain id */
1542 #define DOT11_MNG_FTIE_ID 55            /* 11r Fast Bss Transition id */
1543 #define DOT11_MNG_FT_TI_ID 56           /* 11r Timeout Interval id */
1544 #define DOT11_MNG_RDE_ID 57             /* 11r RIC Data Element id */
1545 #define DOT11_MNG_REGCLASS_ID 59        /* d11 management regulatory class id */
1546 #define DOT11_MNG_EXT_CSA_ID 60         /* d11 Extended CSA */
1547 #define DOT11_MNG_HT_ADD 61             /* d11 mgmt additional HT info */
1548 #define DOT11_MNG_EXT_CHANNEL_OFFSET 62 /* d11 mgmt ext channel offset */
1549 #define DOT11_MNG_BSS_AVR_ACCESS_DELAY_ID 63 /* 11k bss average access delay   \
1550                                               */
1551 #define DOT11_MNG_ANTENNA_ID 64              /* 11k antenna id */
1552 #define DOT11_MNG_RSNI_ID 65                 /* 11k RSNI id */
1553 #define DOT11_MNG_MEASUREMENT_PILOT_TX_ID                                      \
1554     66 /* 11k measurement pilot tx info id */
1555 #define DOT11_MNG_BSS_AVAL_ADMISSION_CAP_ID                                    \
1556     67                                      /* 11k bss aval admission cap id */
1557 #define DOT11_MNG_BSS_AC_ACCESS_DELAY_ID 68 /* 11k bss AC access delay id */
1558 #define DOT11_MNG_WAPI_ID 68                /* d11 management WAPI id */
1559 #define DOT11_MNG_TIME_ADVERTISE_ID 69      /* 11p time advertisement */
1560 #define DOT11_MNG_RRM_CAP_ID 70         /* 11k radio measurement capability */
1561 #define DOT11_MNG_MULTIPLE_BSSID_ID 71  /* 11k multiple BSSID id */
1562 #define DOT11_MNG_HT_BSS_COEXINFO_ID 72 /* d11 mgmt OBSS Coexistence INFO */
1563 #define DOT11_MNG_HT_BSS_CHANNEL_REPORT_ID                                     \
1564     73                          /* d11 mgmt OBSS Intolerant Channel list */
1565 #define DOT11_MNG_HT_OBSS_ID 74 /* d11 mgmt OBSS HT info */
1566 #define DOT11_MNG_MMIE_ID 76    /* d11 mgmt MIC IE */
1567 #define DOT11_MNG_NONTRANS_BSSID_CAP_ID                                        \
1568     83 /* 11k nontransmitted BSSID capability */
1569 #define DOT11_MNG_MULTIPLE_BSSIDINDEX_ID 85 /* 11k multiple BSSID index */
1570 #define DOT11_MNG_FMS_DESCR_ID 86           /* 11v FMS descriptor */
1571 #define DOT11_MNG_FMS_REQ_ID 87             /* 11v FMS request id */
1572 #define DOT11_MNG_FMS_RESP_ID 88            /* 11v FMS response id */
1573 #define DOT11_MNG_BSS_MAX_IDLE_PERIOD_ID 90 /* 11v bss max idle id */
1574 #define DOT11_MNG_TFS_REQUEST_ID 91         /* 11v tfs request id */
1575 #define DOT11_MNG_TFS_RESPONSE_ID 92        /* 11v tfs response id */
1576 #define DOT11_MNG_WNM_SLEEP_MODE_ID 93      /* 11v wnm-sleep mode id */
1577 #define DOT11_MNG_TIMBC_REQ_ID 94           /* 11v TIM broadcast request id */
1578 #define DOT11_MNG_TIMBC_RESP_ID 95          /* 11v TIM broadcast response id */
1579 #define DOT11_MNG_CHANNEL_USAGE 97          /* 11v channel usage */
1580 #define DOT11_MNG_TIME_ZONE_ID 98           /* 11v time zone */
1581 #define DOT11_MNG_DMS_REQUEST_ID 99         /* 11v dms request id */
1582 #define DOT11_MNG_DMS_RESPONSE_ID 100       /* 11v dms response id */
1583 #define DOT11_MNG_LINK_IDENTIFIER_ID 101    /* 11z TDLS Link Identifier IE */
1584 #define DOT11_MNG_WAKEUP_SCHEDULE_ID 102    /* 11z TDLS Wakeup Schedule IE */
1585 #define DOT11_MNG_CHANNEL_SWITCH_TIMING_ID                                     \
1586     104                              /* 11z TDLS Channel Switch Timing IE */
1587 #define DOT11_MNG_PTI_CONTROL_ID 105 /* 11z TDLS PTI Control IE */
1588 #define DOT11_MNG_PU_BUFFER_STATUS_ID 106 /* 11z TDLS PU Buffer Status IE */
1589 #define DOT11_MNG_INTERWORKING_ID 107     /* 11u interworking */
1590 #define DOT11_MNG_ADVERTISEMENT_ID 108    /* 11u advertisement protocol */
1591 #define DOT11_MNG_EXP_BW_REQ_ID 109       /* 11u expedited bandwith request */
1592 #define DOT11_MNG_QOS_MAP_ID 110          /* 11u QoS map set */
1593 #define DOT11_MNG_ROAM_CONSORT_ID 111     /* 11u roaming consortium */
1594 #define DOT11_MNG_EMERGCY_ALERT_ID 112    /* 11u emergency alert identifier */
1595 #define DOT11_MNG_MESH_CONFIG 113         /* Mesh Configuration */
1596 #define DOT11_MNG_MESH_ID 114             /* Mesh ID */
1597 #define DOT11_MNG_MESH_PEER_MGMT_ID 117   /* Mesh PEER MGMT IE */
1598 #define DOT11_MNG_EXT_CAP_ID 127          /* d11 mgmt ext capability */
1599 #define DOT11_MNG_EXT_PREQ_ID 130         /* Mesh PREQ IE */
1600 #define DOT11_MNG_EXT_PREP_ID 131         /* Mesh PREP IE */
1601 #define DOT11_MNG_EXT_PERR_ID 132         /* Mesh PERR IE */
1602 #define DOT11_MNG_VHT_CAP_ID 191          /* d11 mgmt VHT cap id */
1603 #define DOT11_MNG_VHT_OPERATION_ID 192    /* d11 mgmt VHT op id */
1604 #define DOT11_MNG_EXT_BSSLOAD_ID 193 /* d11 mgmt VHT extended bss load id */
1605 #define DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID 194 /* Wide BW Channel Switch IE   \
1606                                                  */
1607 #define DOT11_MNG_VHT_TRANSMIT_POWER_ENVELOPE_ID                               \
1608     195 /* VHT transmit Power Envelope IE */
1609 #define DOT11_MNG_CHANNEL_SWITCH_WRAPPER_ID 196 /* Channel Switch Wrapper IE   \
1610                                                  */
1611 #define DOT11_MNG_AID_ID 197                    /* Association ID  IE */
1612 #define DOT11_MNG_OPER_MODE_NOTIF_ID 199 /* d11 mgmt VHT oper mode notif */
1613 #define DOT11_MNG_RNR_ID 201
1614 #define DOT11_MNG_FTM_PARAMS_ID 206
1615 #define DOT11_MNG_TWT_ID 216 /* 11ah D5.0 */
1616 #define DOT11_MNG_WPA_ID 221 /* d11 management WPA id */
1617 #define DOT11_MNG_PROPR_ID 221
1618 /* should start using this one instead of above two */
1619 #define DOT11_MNG_VS_ID 221       /* d11 management Vendor Specific IE */
1620 #define DOT11_MNG_MESH_CSP_ID 222 /* d11 Mesh Channel Switch Parameter */
1621 #define DOT11_MNG_FILS_IND_ID 240 /* 11ai FILS Indication element */
1622 #define DOT11_MNG_FRAGMENT_ID 242 /* IE's fragment ID */
1623 #define DOT11_MNG_RSNXE_ID 244    /* RSN Extension Element (RSNXE) ID */
1624 
1625 /* The follwing ID extensions should be defined >= 255
1626  * i.e. the values should include 255 (DOT11_MNG_ID_EXT_ID + ID Extension).
1627  */
1628 #define DOT11_MNG_ID_EXT_ID 255     /* Element ID Extension 11mc D4.3 */
1629 #define EXT_MNG_OWE_DH_PARAM_ID 32u /* OWE DH Param ID - RFC 8110 */
1630 #define DOT11_MNG_OWE_DH_PARAM_ID                                              \
1631     (DOT11_MNG_ID_EXT_ID + EXT_MNG_OWE_DH_PARAM_ID)
1632 #define EXT_MNG_HE_CAP_ID 35u /* HE Capabilities, 11ax */
1633 #define DOT11_MNG_HE_CAP_ID (DOT11_MNG_ID_EXT_ID + EXT_MNG_HE_CAP_ID)
1634 #define EXT_MNG_HE_OP_ID 36u /* HE Operation IE, 11ax */
1635 #define DOT11_MNG_HE_OP_ID (DOT11_MNG_ID_EXT_ID + EXT_MNG_HE_OP_ID)
1636 #define EXT_MNG_UORA_ID 37u /* UORA Parameter Set */
1637 #define DOT11_MNG_UORA_ID (DOT11_MNG_ID_EXT_ID + EXT_MNG_UORA_ID)
1638 #define EXT_MNG_MU_EDCA_ID 38u /* MU EDCA Parameter Set */
1639 #define DOT11_MNG_MU_EDCA_ID (DOT11_MNG_ID_EXT_ID + EXT_MNG_MU_EDCA_ID)
1640 #define EXT_MNG_SRPS_ID 39u /* Spatial Reuse Parameter Set */
1641 #define DOT11_MNG_SRPS_ID (DOT11_MNG_ID_EXT_ID + EXT_MNG_SRPS_ID)
1642 #define EXT_MNG_BSSCOLOR_CHANGE_ID 42u /* BSS Color Change Announcement */
1643 #define DOT11_MNG_BSSCOLOR_CHANGE_ID                                           \
1644     (DOT11_MNG_ID_EXT_ID + EXT_MNG_BSSCOLOR_CHANGE_ID)
1645 
1646 /* FILS and OCE ext ids */
1647 #define FILS_EXTID_MNG_REQ_PARAMS 2u /* FILS Request Parameters element */
1648 #define DOT11_MNG_FILS_REQ_PARAMS                                              \
1649     (DOT11_MNG_ID_EXT_ID + FILS_EXTID_MNG_REQ_PARAMS)
1650 #define FILS_EXTID_MNG_KEY_CONFIRMATION_ID                                     \
1651     3u /* FILS Key Confirmation element */
1652 #define DOT11_MNG_FILS_KEY_CONFIRMATION                                        \
1653     (DOT11_MNG_ID_EXT_ID + FILS_EXTID_MNG_KEY_CONFIRMATION_ID)
1654 #define FILS_EXTID_MNG_SESSION_ID 4u /* FILS Session element */
1655 #define DOT11_MNG_FILS_SESSION (DOT11_MNG_ID_EXT_ID + FILS_EXTID_MNG_SESSION_ID)
1656 #define FILS_EXTID_MNG_HLP_CONTAINER_ID 5u /* FILS HLP Container element */
1657 #define DOT11_MNG_FILS_HLP_CONTAINER                                           \
1658     (DOT11_MNG_ID_EXT_ID + FILS_EXTID_MNG_HLP_CONTAINER_ID)
1659 #define FILS_EXTID_MNG_KEY_DELIVERY_ID 7u /* FILS Key Delivery element */
1660 #define DOT11_MNG_FILS_KEY_DELIVERY                                            \
1661     (DOT11_MNG_ID_EXT_ID + FILS_EXTID_MNG_KEY_DELIVERY_ID)
1662 #define FILS_EXTID_MNG_WRAPPED_DATA_ID 8u /* FILS Wrapped Data element */
1663 #define DOT11_MNG_FILS_WRAPPED_DATA                                            \
1664     (DOT11_MNG_ID_EXT_ID + FILS_EXTID_MNG_WRAPPED_DATA_ID)
1665 #define OCE_EXTID_MNG_ESP_ID 11u /* Estimated Service Parameters element */
1666 #define DOT11_MNG_ESP (DOT11_MNG_ID_EXT_ID + OCE_EXTID_MNG_ESP_ID)
1667 #define FILS_EXTID_MNG_NONCE_ID 13u /* FILS Nonce element */
1668 #define DOT11_MNG_FILS_NONCE (DOT11_MNG_ID_EXT_ID + FILS_EXTID_MNG_NONCE_ID)
1669 
1670 /* deprecated definitions, do not use, to be deleted later */
1671 #define FILS_HLP_CONTAINER_EXT_ID FILS_EXTID_MNG_HLP_CONTAINER_ID
1672 #define DOT11_ESP_EXT_ID OCE_EXTID_MNG_ESP_ID
1673 #define FILS_REQ_PARAMS_EXT_ID FILS_EXTID_MNG_REQ_PARAMS
1674 #define EXT_MNG_RAPS_ID 37u /* OFDMA Random Access Parameter Set */
1675 #define DOT11_MNG_RAPS_ID (DOT11_MNG_ID_EXT_ID + EXT_MNG_RAPS_ID)
1676 /* End of deprecated definitions */
1677 
1678 #define DOT11_MNG_IE_ID_EXT_MATCH(_ie, _id)                                    \
1679     (((_ie)->id == DOT11_MNG_ID_EXT_ID) && ((_ie)->len > 0) &&                 \
1680      ((_id) == ((uint8 *)(_ie) + TLV_HDR_LEN)[0]))
1681 
1682 #define DOT11_MNG_IE_ID_EXT_INIT(_ie, _id, _len)                               \
1683     do {                                                                       \
1684         (_ie)->id = DOT11_MNG_ID_EXT_ID;                                       \
1685         (_ie)->len = _len;                                                     \
1686         (_ie)->id_ext = _id;                                                   \
1687     } while (0)
1688 
1689 /* Rate Defines */
1690 
1691 /* Valid rates for the Supported Rates and Extended Supported Rates IEs.
1692  * Encoding is the rate in 500kbps units, rouding up for fractional values.
1693  * 802.11-2012, section 6.5.5.2, DATA_RATE parameter enumerates all the values.
1694  * The rate values cover DSSS, HR/DSSS, ERP, and OFDM phy rates.
1695  * The defines below do not cover the rates specific to 10MHz, {3, 4.5, 27},
1696  * and 5MHz, {1.5, 2.25, 3, 4.5, 13.5}, which are not supported by Broadcom
1697  * devices.
1698  */
1699 
1700 #define DOT11_RATE_1M 2    /* 1  Mbps in 500kbps units */
1701 #define DOT11_RATE_2M 4    /* 2  Mbps in 500kbps units */
1702 #define DOT11_RATE_5M5 11  /* 5.5 Mbps in 500kbps units */
1703 #define DOT11_RATE_11M 22  /* 11 Mbps in 500kbps units */
1704 #define DOT11_RATE_6M 12   /* 6  Mbps in 500kbps units */
1705 #define DOT11_RATE_9M 18   /* 9  Mbps in 500kbps units */
1706 #define DOT11_RATE_12M 24  /* 12 Mbps in 500kbps units */
1707 #define DOT11_RATE_18M 36  /* 18 Mbps in 500kbps units */
1708 #define DOT11_RATE_24M 48  /* 24 Mbps in 500kbps units */
1709 #define DOT11_RATE_36M 72  /* 36 Mbps in 500kbps units */
1710 #define DOT11_RATE_48M 96  /* 48 Mbps in 500kbps units */
1711 #define DOT11_RATE_54M 108 /* 54 Mbps in 500kbps units */
1712 #define DOT11_RATE_MAX 108 /* highest rate (54 Mbps) in 500kbps units */
1713 
1714 /* Supported Rates and Extended Supported Rates IEs
1715  * The supported rates octets are defined a the MSB indicatin a Basic Rate
1716  * and bits 0-6 as the rate value
1717  */
1718 #define DOT11_RATE_BASIC 0x80 /* flag for a Basic Rate */
1719 #define DOT11_RATE_MASK 0x7F  /* mask for numeric part of rate */
1720 
1721 /* BSS Membership Selector parameters
1722  * 802.11-2016 (and 802.11ax-D1.1), Sec 9.4.2.3
1723  * These selector values are advertised in Supported Rates and Extended
1724  * Supported Rates IEs in the supported rates list with the Basic rate bit set.
1725  * Constants below include the basic bit.
1726  */
1727 #define DOT11_BSS_MEMBERSHIP_HT 0xFF /* Basic 0x80 + 127, HT Required to join  \
1728                                       */
1729 #define DOT11_BSS_MEMBERSHIP_VHT                                               \
1730     0xFE /* Basic 0x80 + 126, VHT Required to join */
1731 #define DOT11_BSS_MEMBERSHIP_HE 0xFD /* Basic 0x80 + 125, HE Required to join  \
1732                                       */
1733 
1734 /* ERP info element bit values */
1735 #define DOT11_MNG_ERP_LEN 1 /* ERP is currently 1 byte long */
1736 #define DOT11_MNG_NONERP_PRESENT                                               \
1737     0x01 /* NonERP (802.11b) STAs are present                                  \
1738           *in the BSS                                                          \
1739           */
1740 #define DOT11_MNG_USE_PROTECTION                                               \
1741     0x02 /* Use protection mechanisms for                                      \
1742           *ERP-OFDM frames                                                     \
1743           */
1744 #define DOT11_MNG_BARKER_PREAMBLE                                              \
1745     0x04 /* Short Preambles: 0 == allowed,                                     \
1746           * 1 == not allowed                                                   \
1747           */
1748 /* TS Delay element offset & size */
1749 #define DOT11_MGN_TS_DELAY_LEN 4 /* length of TS DELAY IE */
1750 #define TS_DELAY_FIELD_SIZE 4    /* TS DELAY field size */
1751 
1752 /* Capability Information Field */
1753 #define DOT11_CAP_ESS 0x0001          /* d11 cap. ESS */
1754 #define DOT11_CAP_IBSS 0x0002         /* d11 cap. IBSS */
1755 #define DOT11_CAP_POLLABLE 0x0004     /* d11 cap. pollable */
1756 #define DOT11_CAP_POLL_RQ 0x0008      /* d11 cap. poll request */
1757 #define DOT11_CAP_PRIVACY 0x0010      /* d11 cap. privacy */
1758 #define DOT11_CAP_SHORT 0x0020        /* d11 cap. short */
1759 #define DOT11_CAP_PBCC 0x0040         /* d11 cap. PBCC */
1760 #define DOT11_CAP_AGILITY 0x0080      /* d11 cap. agility */
1761 #define DOT11_CAP_SPECTRUM 0x0100     /* d11 cap. spectrum */
1762 #define DOT11_CAP_QOS 0x0200          /* d11 cap. qos */
1763 #define DOT11_CAP_SHORTSLOT 0x0400    /* d11 cap. shortslot */
1764 #define DOT11_CAP_APSD 0x0800         /* d11 cap. apsd */
1765 #define DOT11_CAP_RRM 0x1000          /* d11 cap. 11k radio measurement */
1766 #define DOT11_CAP_CCK_OFDM 0x2000     /* d11 cap. CCK/OFDM */
1767 #define DOT11_CAP_DELAY_BA 0x4000     /* d11 cap. delayed block ack */
1768 #define DOT11_CAP_IMMEDIATE_BA 0x8000 /* d11 cap. immediate block ack */
1769 
1770 /* Extended capabilities IE bitfields */
1771 /* 20/40 BSS Coexistence Management support bit position */
1772 #define DOT11_EXT_CAP_OBSS_COEX_MGMT 0
1773 /* Extended Channel Switching support bit position */
1774 #define DOT11_EXT_CAP_EXT_CHAN_SWITCHING 2
1775 /* scheduled PSMP support bit position */
1776 #define DOT11_EXT_CAP_SPSMP 6
1777 /*  Flexible Multicast Service */
1778 #define DOT11_EXT_CAP_FMS 11
1779 /* proxy ARP service support bit position */
1780 #define DOT11_EXT_CAP_PROXY_ARP 12
1781 /* Civic Location */
1782 #define DOT11_EXT_CAP_CIVIC_LOC 14
1783 /* Geospatial Location */
1784 #define DOT11_EXT_CAP_LCI 15
1785 /* Traffic Filter Service */
1786 #define DOT11_EXT_CAP_TFS 16
1787 /* WNM-Sleep Mode */
1788 #define DOT11_EXT_CAP_WNM_SLEEP 17
1789 /* TIM Broadcast service */
1790 #define DOT11_EXT_CAP_TIMBC 18
1791 /* BSS Transition Management support bit position */
1792 #define DOT11_EXT_CAP_BSSTRANS_MGMT 19
1793 /* Multiple BSSID support position */
1794 #define DOT11_EXT_CAP_MULTIBSSID 22
1795 /* Direct Multicast Service */
1796 #define DOT11_EXT_CAP_DMS 26
1797 /* Interworking support bit position */
1798 #define DOT11_EXT_CAP_IW 31
1799 /* QoS map support bit position */
1800 #define DOT11_EXT_CAP_QOS_MAP 32
1801 /* service Interval granularity bit position and mask */
1802 #define DOT11_EXT_CAP_SI 41
1803 #define DOT11_EXT_CAP_SI_MASK 0x0E
1804 /* Location Identifier service */
1805 #define DOT11_EXT_CAP_IDENT_LOC 44
1806 /* WNM notification */
1807 #define DOT11_EXT_CAP_WNM_NOTIF 46
1808 /* Operating mode notification - VHT (11ac D3.0 - 8.4.2.29) */
1809 #define DOT11_EXT_CAP_OPER_MODE_NOTIF 62
1810 /* Fine timing measurement - D3.0 */
1811 #define DOT11_EXT_CAP_FTM_RESPONDER 70
1812 #define DOT11_EXT_CAP_FTM_INITIATOR 71 /* tentative 11mcd3.0 */
1813 #define DOT11_EXT_CAP_FILS 72          /* FILS Capability */
1814 /* TWT support */
1815 #define DOT11_EXT_CAP_TWT_REQUESTER 77
1816 #define DOT11_EXT_CAP_TWT_RESPONDER 78
1817 #define DOT11_EXT_CAP_OBSS_NB_RU_OFDMA 79
1818 #define DOT11_EXT_CAP_EMBSS_ADVERTISE 80
1819 /* Update DOT11_EXT_CAP_MAX_IDX to reflect the highest offset.
1820  * Note: DOT11_EXT_CAP_MAX_IDX must only be used in attach path.
1821  *       It will cause ROM invalidation otherwise.
1822  */
1823 #define DOT11_EXT_CAP_MAX_IDX 80
1824 
1825 #define DOT11_EXT_CAP_MAX_BIT_IDX 95 /* !!!update this please!!! */
1826 
1827 /* extended capability */
1828 #ifndef DOT11_EXTCAP_LEN_MAX
1829 #define DOT11_EXTCAP_LEN_MAX ((DOT11_EXT_CAP_MAX_BIT_IDX + 8) >> 3)
1830 #endif // endif
1831 BWL_PRE_PACKED_STRUCT struct dot11_extcap {
1832     uint8 extcap[DOT11_EXTCAP_LEN_MAX];
1833 } BWL_POST_PACKED_STRUCT;
1834 typedef struct dot11_extcap dot11_extcap_t;
1835 
1836 /* VHT Operating mode bit fields -  (11ac D8.0/802.11-2016 - 9.4.1.53) */
1837 #define DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT 0
1838 #define DOT11_OPER_MODE_CHANNEL_WIDTH_MASK 0x3
1839 #define DOT11_OPER_MODE_160_8080_BW_SHIFT 2
1840 #define DOT11_OPER_MODE_160_8080_BW_MASK 0x04
1841 #define DOT11_OPER_MODE_NOLDPC_SHIFT 3
1842 #define DOT11_OPER_MODE_NOLDPC_MASK 0x08
1843 #define DOT11_OPER_MODE_RXNSS_SHIFT 4
1844 #define DOT11_OPER_MODE_RXNSS_MASK 0x70
1845 #define DOT11_OPER_MODE_RXNSS_TYPE_SHIFT 7
1846 #define DOT11_OPER_MODE_RXNSS_TYPE_MASK 0x80
1847 
1848 #define DOT11_OPER_MODE(type, nss, chanw)                                      \
1849     (((type) << DOT11_OPER_MODE_RXNSS_TYPE_SHIFT &                             \
1850       DOT11_OPER_MODE_RXNSS_TYPE_MASK) |                                       \
1851      (((nss)-1) << DOT11_OPER_MODE_RXNSS_SHIFT & DOT11_OPER_MODE_RXNSS_MASK) | \
1852      ((chanw) << DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT &                         \
1853       DOT11_OPER_MODE_CHANNEL_WIDTH_MASK))
1854 
1855 #define DOT11_D8_OPER_MODE(type, nss, ldpc, bw160_8080, chanw)                 \
1856     (((type) << DOT11_OPER_MODE_RXNSS_TYPE_SHIFT &                             \
1857       DOT11_OPER_MODE_RXNSS_TYPE_MASK) |                                       \
1858      (((nss)-1) << DOT11_OPER_MODE_RXNSS_SHIFT & DOT11_OPER_MODE_RXNSS_MASK) | \
1859      ((ldpc) << DOT11_OPER_MODE_NOLDPC_SHIFT & DOT11_OPER_MODE_NOLDPC_MASK) |  \
1860      ((bw160_8080) << DOT11_OPER_MODE_160_8080_BW_SHIFT &                      \
1861       DOT11_OPER_MODE_160_8080_BW_MASK) |                                      \
1862      ((chanw) << DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT &                         \
1863       DOT11_OPER_MODE_CHANNEL_WIDTH_MASK))
1864 
1865 #define DOT11_OPER_MODE_CHANNEL_WIDTH(mode)                                    \
1866     (((mode)&DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) >>                            \
1867      DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT)
1868 #define DOT11_OPER_MODE_160_8080(mode)                                         \
1869     (((mode)&DOT11_OPER_MODE_160_8080_BW_MASK) >>                              \
1870      DOT11_OPER_MODE_160_8080_BW_SHIFT)
1871 #define DOT11_OPER_MODE_RXNSS(mode)                                            \
1872     ((((mode)&DOT11_OPER_MODE_RXNSS_MASK) >> DOT11_OPER_MODE_RXNSS_SHIFT) + 1)
1873 #define DOT11_OPER_MODE_RXNSS_TYPE(mode)                                       \
1874     (((mode)&DOT11_OPER_MODE_RXNSS_TYPE_MASK) >>                               \
1875      DOT11_OPER_MODE_RXNSS_TYPE_SHIFT)
1876 
1877 #define DOT11_OPER_MODE_20MHZ 0
1878 #define DOT11_OPER_MODE_40MHZ 1
1879 #define DOT11_OPER_MODE_80MHZ 2
1880 #define DOT11_OPER_MODE_160MHZ 3
1881 #define DOT11_OPER_MODE_8080MHZ 3
1882 #define DOT11_OPER_MODE_1608080MHZ 1
1883 
1884 #define DOT11_OPER_MODE_CHANNEL_WIDTH_20MHZ(mode)                              \
1885     (((mode)&DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_20MHZ)
1886 #define DOT11_OPER_MODE_CHANNEL_WIDTH_40MHZ(mode)                              \
1887     (((mode)&DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_40MHZ)
1888 #define DOT11_OPER_MODE_CHANNEL_WIDTH_80MHZ(mode)                              \
1889     (((mode)&DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_80MHZ)
1890 #define DOT11_OPER_MODE_CHANNEL_WIDTH_160MHZ(mode)                             \
1891     (((mode)&DOT11_OPER_MODE_160_8080_BW_MASK))
1892 #define DOT11_OPER_MODE_CHANNEL_WIDTH_8080MHZ(mode)                            \
1893     (((mode)&DOT11_OPER_MODE_160_8080_BW_MASK))
1894 
1895 /* Operating mode information element 802.11ac D3.0 - 8.4.2.168 */
1896 BWL_PRE_PACKED_STRUCT struct dot11_oper_mode_notif_ie {
1897     uint8 mode;
1898 } BWL_POST_PACKED_STRUCT;
1899 typedef struct dot11_oper_mode_notif_ie dot11_oper_mode_notif_ie_t;
1900 
1901 #define DOT11_OPER_MODE_NOTIF_IE_LEN 1
1902 
1903 /* Extended Capability Information Field */
1904 #define DOT11_OBSS_COEX_MNG_SUPPORT                                            \
1905     0x01 /* 20/40 BSS Coexistence Management support */
1906 
1907 /*
1908  * Action Frame Constants
1909  */
1910 #define DOT11_ACTION_HDR_LEN 2 /* action frame category + action field */
1911 #define DOT11_ACTION_CAT_OFF 0 /* category offset */
1912 #define DOT11_ACTION_ACT_OFF 1 /* action offset */
1913 
1914 /* Action Category field (sec 8.4.1.11) */
1915 #define DOT11_ACTION_CAT_ERR_MASK 0x80 /* category error mask */
1916 #define DOT11_ACTION_CAT_MASK 0x7F     /* category mask */
1917 #define DOT11_ACTION_CAT_SPECT_MNG 0   /* category spectrum management */
1918 #define DOT11_ACTION_CAT_QOS 1         /* category QoS */
1919 #define DOT11_ACTION_CAT_DLS 2         /* category DLS */
1920 #define DOT11_ACTION_CAT_BLOCKACK 3    /* category block ack */
1921 #define DOT11_ACTION_CAT_PUBLIC 4      /* category public */
1922 #define DOT11_ACTION_CAT_RRM 5         /* category radio measurements */
1923 #define DOT11_ACTION_CAT_FBT 6         /* category fast bss transition */
1924 #define DOT11_ACTION_CAT_HT 7          /* category for HT */
1925 #define DOT11_ACTION_CAT_SA_QUERY 8    /* security association query */
1926 #define DOT11_ACTION_CAT_PDPA 9        /* protected dual of public action */
1927 #define DOT11_ACTION_CAT_WNM 10        /* category for WNM */
1928 #define DOT11_ACTION_CAT_UWNM 11       /* category for Unprotected WNM */
1929 #define DOT11_ACTION_CAT_MESH 13       /* category for Mesh */
1930 #define DOT11_ACTION_CAT_SELFPROT 15   /* category for Mesh, self protected */
1931 #define DOT11_ACTION_NOTIFICATION 17
1932 #define DOT11_ACTION_CAT_VHT 21  /* VHT action */
1933 #define DOT11_ACTION_CAT_S1G 22  /* S1G action */
1934 #define DOT11_ACTION_CAT_HE 27   /* HE action frame */
1935 #define DOT11_ACTION_CAT_FILS 26 /* FILS action frame */
1936 #define DOT11_ACTION_CAT_VSP 126 /* protected vendor specific */
1937 #define DOT11_ACTION_CAT_VS 127  /* category Vendor Specific */
1938 
1939 /* Spectrum Management Action IDs (sec 7.4.1) */
1940 #define DOT11_SM_ACTION_M_REQ 0          /* d11 action measurement request */
1941 #define DOT11_SM_ACTION_M_REP 1          /* d11 action measurement response */
1942 #define DOT11_SM_ACTION_TPC_REQ 2        /* d11 action TPC request */
1943 #define DOT11_SM_ACTION_TPC_REP 3        /* d11 action TPC response */
1944 #define DOT11_SM_ACTION_CHANNEL_SWITCH 4 /* d11 action channel switch */
1945 #define DOT11_SM_ACTION_EXT_CSA 5        /* d11 extened CSA for 11n */
1946 
1947 /* QoS action ids */
1948 #define DOT11_QOS_ACTION_ADDTS_REQ 0  /* d11 action ADDTS request */
1949 #define DOT11_QOS_ACTION_ADDTS_RESP 1 /* d11 action ADDTS response */
1950 #define DOT11_QOS_ACTION_DELTS 2      /* d11 action DELTS */
1951 #define DOT11_QOS_ACTION_SCHEDULE 3   /* d11 action schedule */
1952 #define DOT11_QOS_ACTION_QOS_MAP 4    /* d11 action QOS map */
1953 
1954 /* HT action ids */
1955 #define DOT11_ACTION_ID_HT_CH_WIDTH 0 /* notify channel width action id */
1956 #define DOT11_ACTION_ID_HT_MIMO_PS 1  /* mimo ps action id */
1957 
1958 /* Public action ids */
1959 #define DOT11_PUB_ACTION_BSS_COEX_MNG                                          \
1960     0 /* 20/40 Coexistence Management action id */
1961 #define DOT11_PUB_ACTION_CHANNEL_SWITCH 4 /* d11 action channel switch */
1962 #define DOT11_PUB_ACTION_VENDOR_SPEC 9    /* Vendor specific */
1963 #define DOT11_PUB_ACTION_GAS_CB_REQ 12    /* GAS Comeback Request */
1964 #define DOT11_PUB_ACTION_FTM_REQ 32       /* FTM request */
1965 #define DOT11_PUB_ACTION_FTM 33           /* FTM measurement */
1966 #define DOT11_PUB_ACTION_FTM_REQ_TRIGGER_START                                 \
1967     1u                                           /* FTM request start trigger */
1968 #define DOT11_PUB_ACTION_FTM_REQ_TRIGGER_STOP 0u /* FTM request stop trigger   \
1969                                                   */
1970 
1971 /* Block Ack action types */
1972 #define DOT11_BA_ACTION_ADDBA_REQ 0  /* ADDBA Req action frame type */
1973 #define DOT11_BA_ACTION_ADDBA_RESP 1 /* ADDBA Resp action frame type */
1974 #define DOT11_BA_ACTION_DELBA 2      /* DELBA action frame type */
1975 
1976 /* ADDBA action parameters */
1977 #define DOT11_ADDBA_PARAM_AMSDU_SUP 0x0001   /* AMSDU supported under BA */
1978 #define DOT11_ADDBA_PARAM_POLICY_MASK 0x0002 /* policy mask(ack vs delayed) */
1979 #define DOT11_ADDBA_PARAM_POLICY_SHIFT 1     /* policy shift */
1980 #define DOT11_ADDBA_PARAM_TID_MASK 0x003c    /* tid mask */
1981 #define DOT11_ADDBA_PARAM_TID_SHIFT 2        /* tid shift */
1982 #define DOT11_ADDBA_PARAM_BSIZE_MASK 0xffc0  /* buffer size mask */
1983 #define DOT11_ADDBA_PARAM_BSIZE_SHIFT 6      /* buffer size shift */
1984 
1985 #define DOT11_ADDBA_POLICY_DELAYED 0   /* delayed BA policy */
1986 #define DOT11_ADDBA_POLICY_IMMEDIATE 1 /* immediate BA policy */
1987 
1988 /* Fast Transition action types */
1989 #define DOT11_FT_ACTION_FT_RESERVED 0
1990 #define DOT11_FT_ACTION_FT_REQ 1 /* FBT request - for over-the-DS FBT */
1991 #define DOT11_FT_ACTION_FT_RES 2 /* FBT response - for over-the-DS FBT */
1992 #define DOT11_FT_ACTION_FT_CON 3 /* FBT confirm - for OTDS with RRP */
1993 #define DOT11_FT_ACTION_FT_ACK 4 /* FBT ack */
1994 
1995 /* DLS action types */
1996 #define DOT11_DLS_ACTION_REQ 0  /* DLS Request */
1997 #define DOT11_DLS_ACTION_RESP 1 /* DLS Response */
1998 #define DOT11_DLS_ACTION_TD 2   /* DLS Teardown */
1999 
2000 /* Wireless Network Management (WNM) action types */
2001 #define DOT11_WNM_ACTION_EVENT_REQ 0
2002 #define DOT11_WNM_ACTION_EVENT_REP 1
2003 #define DOT11_WNM_ACTION_DIAG_REQ 2
2004 #define DOT11_WNM_ACTION_DIAG_REP 3
2005 #define DOT11_WNM_ACTION_LOC_CFG_REQ 4
2006 #define DOT11_WNM_ACTION_LOC_RFG_RESP 5
2007 #define DOT11_WNM_ACTION_BSSTRANS_QUERY 6
2008 #define DOT11_WNM_ACTION_BSSTRANS_REQ 7
2009 #define DOT11_WNM_ACTION_BSSTRANS_RESP 8
2010 #define DOT11_WNM_ACTION_FMS_REQ 9
2011 #define DOT11_WNM_ACTION_FMS_RESP 10
2012 #define DOT11_WNM_ACTION_COL_INTRFRNCE_REQ 11
2013 #define DOT11_WNM_ACTION_COL_INTRFRNCE_REP 12
2014 #define DOT11_WNM_ACTION_TFS_REQ 13
2015 #define DOT11_WNM_ACTION_TFS_RESP 14
2016 #define DOT11_WNM_ACTION_TFS_NOTIFY_REQ 15
2017 #define DOT11_WNM_ACTION_WNM_SLEEP_REQ 16
2018 #define DOT11_WNM_ACTION_WNM_SLEEP_RESP 17
2019 #define DOT11_WNM_ACTION_TIMBC_REQ 18
2020 #define DOT11_WNM_ACTION_TIMBC_RESP 19
2021 #define DOT11_WNM_ACTION_QOS_TRFC_CAP_UPD 20
2022 #define DOT11_WNM_ACTION_CHAN_USAGE_REQ 21
2023 #define DOT11_WNM_ACTION_CHAN_USAGE_RESP 22
2024 #define DOT11_WNM_ACTION_DMS_REQ 23
2025 #define DOT11_WNM_ACTION_DMS_RESP 24
2026 #define DOT11_WNM_ACTION_TMNG_MEASUR_REQ 25
2027 #define DOT11_WNM_ACTION_NOTFCTN_REQ 26
2028 #define DOT11_WNM_ACTION_NOTFCTN_RESP 27
2029 #define DOT11_WNM_ACTION_TFS_NOTIFY_RESP 28
2030 
2031 /* Unprotected Wireless Network Management (WNM) action types */
2032 #define DOT11_UWNM_ACTION_TIM 0
2033 #define DOT11_UWNM_ACTION_TIMING_MEASUREMENT 1
2034 
2035 #define DOT11_MNG_COUNTRY_ID_LEN 3
2036 
2037 /* VHT category action types - 802.11ac D3.0 - 8.5.23.1 */
2038 #define DOT11_VHT_ACTION_CBF 0             /* Compressed Beamforming */
2039 #define DOT11_VHT_ACTION_GID_MGMT 1        /* Group ID Management */
2040 #define DOT11_VHT_ACTION_OPER_MODE_NOTIF 2 /* Operating mode notif'n */
2041 
2042 /* FILS category action types - 802.11ai D11.0 - 9.6.8.1 */
2043 #define DOT11_FILS_ACTION_DISCOVERY 34 /* FILS Discovery */
2044 
2045 /** DLS Request frame header */
2046 BWL_PRE_PACKED_STRUCT struct dot11_dls_req {
2047     uint8 category;       /* category of action frame (2) */
2048     uint8 action;         /* DLS action: req (0) */
2049     struct ether_addr da; /* destination address */
2050     struct ether_addr sa; /* source address */
2051     uint16 cap;           /* capability */
2052     uint16 timeout;       /* timeout value */
2053     uint8 data[1];        /* IE:support rate, extend support rate, HT cap */
2054 } BWL_POST_PACKED_STRUCT;
2055 typedef struct dot11_dls_req dot11_dls_req_t;
2056 #define DOT11_DLS_REQ_LEN 18 /* Fixed length */
2057 
2058 /** DLS response frame header */
2059 BWL_PRE_PACKED_STRUCT struct dot11_dls_resp {
2060     uint8 category;       /* category of action frame (2) */
2061     uint8 action;         /* DLS action: req (0) */
2062     uint16 status;        /* status code field */
2063     struct ether_addr da; /* destination address */
2064     struct ether_addr sa; /* source address */
2065     uint8 data[1];        /* optional: capability, rate ... */
2066 } BWL_POST_PACKED_STRUCT;
2067 typedef struct dot11_dls_resp dot11_dls_resp_t;
2068 #define DOT11_DLS_RESP_LEN 16 /* Fixed length */
2069 
2070 /* ************* 802.11v related definitions. ************* */
2071 
2072 /** BSS Management Transition Query frame header */
2073 BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_query {
2074     uint8 category; /* category of action frame (10) */
2075     uint8 action;   /* WNM action: trans_query (6) */
2076     uint8 token;    /* dialog token */
2077     uint8 reason;   /* transition query reason */
2078     uint8 data[1];  /* Elements */
2079 } BWL_POST_PACKED_STRUCT;
2080 typedef struct dot11_bsstrans_query dot11_bsstrans_query_t;
2081 #define DOT11_BSSTRANS_QUERY_LEN 4 /* Fixed length */
2082 
2083 /* BTM transition reason */
2084 #define DOT11_BSSTRANS_REASON_UNSPECIFIED 0
2085 #define DOT11_BSSTRANS_REASON_EXC_FRAME_LOSS 1
2086 #define DOT11_BSSTRANS_REASON_EXC_TRAFFIC_DELAY 2
2087 #define DOT11_BSSTRANS_REASON_INSUFF_QOS_CAPACITY 3
2088 #define DOT11_BSSTRANS_REASON_FIRST_ASSOC 4
2089 #define DOT11_BSSTRANS_REASON_LOAD_BALANCING 5
2090 #define DOT11_BSSTRANS_REASON_BETTER_AP_FOUND 6
2091 #define DOT11_BSSTRANS_REASON_DEAUTH_RX 7
2092 #define DOT11_BSSTRANS_REASON_8021X_EAP_AUTH_FAIL 8
2093 #define DOT11_BSSTRANS_REASON_4WAY_HANDSHK_FAIL 9
2094 #define DOT11_BSSTRANS_REASON_MANY_REPLAYCNT_FAIL 10
2095 #define DOT11_BSSTRANS_REASON_MANY_DATAMIC_FAIL 11
2096 #define DOT11_BSSTRANS_REASON_EXCEED_MAX_RETRANS 12
2097 #define DOT11_BSSTRANS_REASON_MANY_BCAST_DISASSOC_RX 13
2098 #define DOT11_BSSTRANS_REASON_MANY_BCAST_DEAUTH_RX 14
2099 #define DOT11_BSSTRANS_REASON_PREV_TRANSITION_FAIL 15
2100 #define DOT11_BSSTRANS_REASON_LOW_RSSI 16
2101 #define DOT11_BSSTRANS_REASON_ROAM_FROM_NON_80211 17
2102 #define DOT11_BSSTRANS_REASON_RX_BTM_REQ 18
2103 #define DOT11_BSSTRANS_REASON_PREF_LIST_INCLUDED 19
2104 #define DOT11_BSSTRANS_REASON_LEAVING_ESS 20
2105 
2106 /** BSS Management Transition Request frame header */
2107 BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_req {
2108     uint8 category;        /* category of action frame (10) */
2109     uint8 action;          /* WNM action: trans_req (7) */
2110     uint8 token;           /* dialog token */
2111     uint8 reqmode;         /* transition request mode */
2112     uint16 disassoc_tmr;   /* disassociation timer */
2113     uint8 validity_intrvl; /* validity interval */
2114     uint8 data[1];         /* optional: BSS term duration, ... */
2115                            /* ...session info URL, candidate list */
2116 } BWL_POST_PACKED_STRUCT;
2117 typedef struct dot11_bsstrans_req dot11_bsstrans_req_t;
2118 #define DOT11_BSSTRANS_REQ_LEN 7        /* Fixed length */
2119 #define DOT11_BSSTRANS_REQ_FIXED_LEN 7u /* Fixed length */
2120 
2121 /* BSS Mgmt Transition Request Mode Field - 802.11v */
2122 #define DOT11_BSSTRANS_REQMODE_PREF_LIST_INCL 0x01
2123 #define DOT11_BSSTRANS_REQMODE_ABRIDGED 0x02
2124 #define DOT11_BSSTRANS_REQMODE_DISASSOC_IMMINENT 0x04
2125 #define DOT11_BSSTRANS_REQMODE_BSS_TERM_INCL 0x08
2126 #define DOT11_BSSTRANS_REQMODE_ESS_DISASSOC_IMNT 0x10
2127 
2128 /** BSS Management transition response frame header */
2129 BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_resp {
2130     uint8 category;   /* category of action frame (10) */
2131     uint8 action;     /* WNM action: trans_resp (8) */
2132     uint8 token;      /* dialog token */
2133     uint8 status;     /* transition status */
2134     uint8 term_delay; /* validity interval */
2135     uint8 data[1];    /* optional: BSSID target, candidate list */
2136 } BWL_POST_PACKED_STRUCT;
2137 typedef struct dot11_bsstrans_resp dot11_bsstrans_resp_t;
2138 #define DOT11_BSSTRANS_RESP_LEN 5 /* Fixed length */
2139 
2140 /* BSS Mgmt Transition Response Status Field */
2141 #define DOT11_BSSTRANS_RESP_STATUS_ACCEPT 0
2142 #define DOT11_BSSTRANS_RESP_STATUS_REJECT 1
2143 #define DOT11_BSSTRANS_RESP_STATUS_REJ_INSUFF_BCN 2
2144 #define DOT11_BSSTRANS_RESP_STATUS_REJ_INSUFF_CAP 3
2145 #define DOT11_BSSTRANS_RESP_STATUS_REJ_TERM_UNDESIRED 4
2146 #define DOT11_BSSTRANS_RESP_STATUS_REJ_TERM_DELAY_REQ 5
2147 #define DOT11_BSSTRANS_RESP_STATUS_REJ_BSS_LIST_PROVIDED 6
2148 #define DOT11_BSSTRANS_RESP_STATUS_REJ_NO_SUITABLE_BSS 7
2149 #define DOT11_BSSTRANS_RESP_STATUS_REJ_LEAVING_ESS 8
2150 
2151 /** BSS Max Idle Period element */
2152 BWL_PRE_PACKED_STRUCT struct dot11_bss_max_idle_period_ie {
2153     uint8 id; /* 90, DOT11_MNG_BSS_MAX_IDLE_PERIOD_ID */
2154     uint8 len;
2155     uint16 max_idle_period; /* in unit of 1000 TUs */
2156     uint8 idle_opt;
2157 } BWL_POST_PACKED_STRUCT;
2158 typedef struct dot11_bss_max_idle_period_ie dot11_bss_max_idle_period_ie_t;
2159 #define DOT11_BSS_MAX_IDLE_PERIOD_IE_LEN 3 /* bss max idle period IE size */
2160 #define DOT11_BSS_MAX_IDLE_PERIOD_OPT_PROTECTED 1 /* BSS max idle option */
2161 
2162 /** TIM Broadcast request element */
2163 BWL_PRE_PACKED_STRUCT struct dot11_timbc_req_ie {
2164     uint8 id; /* 94, DOT11_MNG_TIMBC_REQ_ID */
2165     uint8 len;
2166     uint8 interval; /* in unit of beacon interval */
2167 } BWL_POST_PACKED_STRUCT;
2168 typedef struct dot11_timbc_req_ie dot11_timbc_req_ie_t;
2169 #define DOT11_TIMBC_REQ_IE_LEN 1 /* Fixed length */
2170 
2171 /** TIM Broadcast request frame header */
2172 BWL_PRE_PACKED_STRUCT struct dot11_timbc_req {
2173     uint8 category; /* category of action frame (10) */
2174     uint8 action;   /* WNM action: DOT11_WNM_ACTION_TIMBC_REQ(18) */
2175     uint8 token;    /* dialog token */
2176     uint8 data[1];  /* TIM broadcast request element */
2177 } BWL_POST_PACKED_STRUCT;
2178 typedef struct dot11_timbc_req dot11_timbc_req_t;
2179 #define DOT11_TIMBC_REQ_LEN 3 /* Fixed length */
2180 
2181 /** TIM Broadcast response element */
2182 BWL_PRE_PACKED_STRUCT struct dot11_timbc_resp_ie {
2183     uint8 id; /* 95, DOT11_MNG_TIM_BROADCAST_RESP_ID */
2184     uint8 len;
2185     uint8 status;     /* status of add request */
2186     uint8 interval;   /* in unit of beacon interval */
2187     int32 offset;     /* in unit of ms */
2188     uint16 high_rate; /* in unit of 0.5 Mb/s */
2189     uint16 low_rate;  /* in unit of 0.5 Mb/s */
2190 } BWL_POST_PACKED_STRUCT;
2191 typedef struct dot11_timbc_resp_ie dot11_timbc_resp_ie_t;
2192 #define DOT11_TIMBC_DENY_RESP_IE_LEN 1    /* Deny. Fixed length */
2193 #define DOT11_TIMBC_ACCEPT_RESP_IE_LEN 10 /* Accept. Fixed length */
2194 
2195 #define DOT11_TIMBC_STATUS_ACCEPT 0
2196 #define DOT11_TIMBC_STATUS_ACCEPT_TSTAMP 1
2197 #define DOT11_TIMBC_STATUS_DENY 2
2198 #define DOT11_TIMBC_STATUS_OVERRIDDEN 3
2199 #define DOT11_TIMBC_STATUS_RESERVED 4
2200 
2201 /** TIM Broadcast request frame header */
2202 BWL_PRE_PACKED_STRUCT struct dot11_timbc_resp {
2203     uint8 category; /* category of action frame (10) */
2204     uint8 action;   /* action: DOT11_WNM_ACTION_TIMBC_RESP(19) */
2205     uint8 token;    /* dialog token */
2206     uint8 data[1];  /* TIM broadcast response element */
2207 } BWL_POST_PACKED_STRUCT;
2208 typedef struct dot11_timbc_resp dot11_timbc_resp_t;
2209 #define DOT11_TIMBC_RESP_LEN 3 /* Fixed length */
2210 
2211 /** TIM element */
2212 BWL_PRE_PACKED_STRUCT struct dot11_tim_ie {
2213     uint8 id;             /* 5, DOT11_MNG_TIM_ID	 */
2214     uint8 len;            /* 4 - 255 */
2215     uint8 dtim_count;     /* DTIM decrementing counter */
2216     uint8 dtim_period;    /* DTIM period */
2217     uint8 bitmap_control; /* AID 0 + bitmap offset */
2218     uint8 pvb[1];         /* Partial Virtual Bitmap, variable length */
2219 } BWL_POST_PACKED_STRUCT;
2220 typedef struct dot11_tim_ie dot11_tim_ie_t;
2221 #define DOT11_TIM_IE_FIXED_LEN 3       /* Fixed length, without id and len */
2222 #define DOT11_TIM_IE_FIXED_TOTAL_LEN 5 /* Fixed length, with id and len */
2223 
2224 /** TIM Broadcast frame header */
2225 BWL_PRE_PACKED_STRUCT struct dot11_timbc {
2226     uint8 category;        /* category of action frame (11) */
2227     uint8 action;          /* action: TIM (0) */
2228     uint8 check_beacon;    /* need to check-beacon */
2229     uint8 tsf[8];          /* Time Synchronization Function */
2230     dot11_tim_ie_t tim_ie; /* TIM element */
2231 } BWL_POST_PACKED_STRUCT;
2232 typedef struct dot11_timbc dot11_timbc_t;
2233 #define DOT11_TIMBC_HDR_LEN (sizeof(dot11_timbc_t) - sizeof(dot11_tim_ie_t))
2234 #define DOT11_TIMBC_FIXED_LEN (sizeof(dot11_timbc_t) - 1) /* Fixed length */
2235 #define DOT11_TIMBC_LEN 11                                /* Fixed length */
2236 
2237 /** TCLAS frame classifier type */
2238 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_hdr {
2239     uint8 type;
2240     uint8 mask;
2241     uint8 data[1];
2242 } BWL_POST_PACKED_STRUCT;
2243 typedef struct dot11_tclas_fc_hdr dot11_tclas_fc_hdr_t;
2244 #define DOT11_TCLAS_FC_HDR_LEN 2 /* Fixed length */
2245 
2246 #define DOT11_TCLAS_MASK_0 0x1
2247 #define DOT11_TCLAS_MASK_1 0x2
2248 #define DOT11_TCLAS_MASK_2 0x4
2249 #define DOT11_TCLAS_MASK_3 0x8
2250 #define DOT11_TCLAS_MASK_4 0x10
2251 #define DOT11_TCLAS_MASK_5 0x20
2252 #define DOT11_TCLAS_MASK_6 0x40
2253 #define DOT11_TCLAS_MASK_7 0x80
2254 
2255 #define DOT11_TCLAS_FC_0_ETH 0
2256 #define DOT11_TCLAS_FC_1_IP 1
2257 #define DOT11_TCLAS_FC_2_8021Q 2
2258 #define DOT11_TCLAS_FC_3_OFFSET 3
2259 #define DOT11_TCLAS_FC_4_IP_HIGHER 4
2260 #define DOT11_TCLAS_FC_5_8021D 5
2261 
2262 /** TCLAS frame classifier type 0 parameters for Ethernet */
2263 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_0_eth {
2264     uint8 type;
2265     uint8 mask;
2266     uint8 sa[ETHER_ADDR_LEN];
2267     uint8 da[ETHER_ADDR_LEN];
2268     uint16 eth_type;
2269 } BWL_POST_PACKED_STRUCT;
2270 typedef struct dot11_tclas_fc_0_eth dot11_tclas_fc_0_eth_t;
2271 #define DOT11_TCLAS_FC_0_ETH_LEN 16
2272 
2273 /** TCLAS frame classifier type 1 parameters for IPV4 */
2274 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_1_ipv4 {
2275     uint8 type;
2276     uint8 mask;
2277     uint8 version;
2278     uint32 src_ip;
2279     uint32 dst_ip;
2280     uint16 src_port;
2281     uint16 dst_port;
2282     uint8 dscp;
2283     uint8 protocol;
2284     uint8 reserved;
2285 } BWL_POST_PACKED_STRUCT;
2286 typedef struct dot11_tclas_fc_1_ipv4 dot11_tclas_fc_1_ipv4_t;
2287 #define DOT11_TCLAS_FC_1_IPV4_LEN 18
2288 
2289 /** TCLAS frame classifier type 2 parameters for 802.1Q */
2290 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_2_8021q {
2291     uint8 type;
2292     uint8 mask;
2293     uint16 tci;
2294 } BWL_POST_PACKED_STRUCT;
2295 typedef struct dot11_tclas_fc_2_8021q dot11_tclas_fc_2_8021q_t;
2296 #define DOT11_TCLAS_FC_2_8021Q_LEN 4
2297 
2298 /** TCLAS frame classifier type 3 parameters for filter offset */
2299 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_3_filter {
2300     uint8 type;
2301     uint8 mask;
2302     uint16 offset;
2303     uint8 data[1];
2304 } BWL_POST_PACKED_STRUCT;
2305 typedef struct dot11_tclas_fc_3_filter dot11_tclas_fc_3_filter_t;
2306 #define DOT11_TCLAS_FC_3_FILTER_LEN 4
2307 
2308 /** TCLAS frame classifier type 4 parameters for IPV4 is the same as TCLAS type
2309  * 1 */
2310 typedef struct dot11_tclas_fc_1_ipv4 dot11_tclas_fc_4_ipv4_t;
2311 #define DOT11_TCLAS_FC_4_IPV4_LEN DOT11_TCLAS_FC_1_IPV4_LEN
2312 
2313 /** TCLAS frame classifier type 4 parameters for IPV6 */
2314 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_4_ipv6 {
2315     uint8 type;
2316     uint8 mask;
2317     uint8 version;
2318     uint8 saddr[16];
2319     uint8 daddr[16];
2320     uint16 src_port;
2321     uint16 dst_port;
2322     uint8 dscp;
2323     uint8 nexthdr;
2324     uint8 flow_lbl[3];
2325 } BWL_POST_PACKED_STRUCT;
2326 typedef struct dot11_tclas_fc_4_ipv6 dot11_tclas_fc_4_ipv6_t;
2327 #define DOT11_TCLAS_FC_4_IPV6_LEN 44
2328 
2329 /** TCLAS frame classifier type 5 parameters for 802.1D */
2330 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_5_8021d {
2331     uint8 type;
2332     uint8 mask;
2333     uint8 pcp;
2334     uint8 cfi;
2335     uint16 vid;
2336 } BWL_POST_PACKED_STRUCT;
2337 typedef struct dot11_tclas_fc_5_8021d dot11_tclas_fc_5_8021d_t;
2338 #define DOT11_TCLAS_FC_5_8021D_LEN 6
2339 
2340 /** TCLAS frame classifier type parameters */
2341 BWL_PRE_PACKED_STRUCT union dot11_tclas_fc {
2342     uint8 data[1];
2343     dot11_tclas_fc_hdr_t hdr;
2344     dot11_tclas_fc_0_eth_t t0_eth;
2345     dot11_tclas_fc_1_ipv4_t t1_ipv4;
2346     dot11_tclas_fc_2_8021q_t t2_8021q;
2347     dot11_tclas_fc_3_filter_t t3_filter;
2348     dot11_tclas_fc_4_ipv4_t t4_ipv4;
2349     dot11_tclas_fc_4_ipv6_t t4_ipv6;
2350     dot11_tclas_fc_5_8021d_t t5_8021d;
2351 } BWL_POST_PACKED_STRUCT;
2352 typedef union dot11_tclas_fc dot11_tclas_fc_t;
2353 
2354 #define DOT11_TCLAS_FC_MIN_LEN 4 /* Classifier Type 2 has the min size */
2355 #define DOT11_TCLAS_FC_MAX_LEN 254
2356 
2357 /** TCLAS element */
2358 BWL_PRE_PACKED_STRUCT struct dot11_tclas_ie {
2359     uint8 id; /* 14, DOT11_MNG_TCLAS_ID */
2360     uint8 len;
2361     uint8 user_priority;
2362     dot11_tclas_fc_t fc;
2363 } BWL_POST_PACKED_STRUCT;
2364 typedef struct dot11_tclas_ie dot11_tclas_ie_t;
2365 #define DOT11_TCLAS_IE_LEN 3u /* Fixed length, include id and len */
2366 
2367 /** TCLAS processing element */
2368 BWL_PRE_PACKED_STRUCT struct dot11_tclas_proc_ie {
2369     uint8 id; /* 44, DOT11_MNG_TCLAS_PROC_ID */
2370     uint8 len;
2371     uint8 process;
2372 } BWL_POST_PACKED_STRUCT;
2373 typedef struct dot11_tclas_proc_ie dot11_tclas_proc_ie_t;
2374 #define DOT11_TCLAS_PROC_IE_LEN 3 /* Fixed length, include id and len */
2375 
2376 #define DOT11_TCLAS_PROC_LEN 1u /* Proc ie length is always 1 byte */
2377 
2378 #define DOT11_TCLAS_PROC_MATCHALL 0 /* All high level element need to match */
2379 #define DOT11_TCLAS_PROC_MATCHONE 1 /* One high level element need to match */
2380 #define DOT11_TCLAS_PROC_NONMATCH 2 /* Non match to any high level element */
2381 
2382 /* TSPEC element defined in 802.11 std section 8.4.2.32 - Not supported */
2383 #define DOT11_TSPEC_IE_LEN 57 /* Fixed length */
2384 
2385 /** TFS request element */
2386 BWL_PRE_PACKED_STRUCT struct dot11_tfs_req_ie {
2387     uint8 id; /* 91, DOT11_MNG_TFS_REQUEST_ID */
2388     uint8 len;
2389     uint8 tfs_id;
2390     uint8 actcode;
2391     uint8 data[1];
2392 } BWL_POST_PACKED_STRUCT;
2393 typedef struct dot11_tfs_req_ie dot11_tfs_req_ie_t;
2394 #define DOT11_TFS_REQ_IE_LEN 2 /* Fixed length, without id and len */
2395 
2396 /** TFS request action codes (bitfield) */
2397 #define DOT11_TFS_ACTCODE_DELETE 1
2398 #define DOT11_TFS_ACTCODE_NOTIFY 2
2399 
2400 /** TFS request subelement IDs */
2401 #define DOT11_TFS_REQ_TFS_SE_ID 1
2402 #define DOT11_TFS_REQ_VENDOR_SE_ID 221
2403 
2404 /** TFS subelement */
2405 BWL_PRE_PACKED_STRUCT struct dot11_tfs_se {
2406     uint8 sub_id;
2407     uint8 len;
2408     uint8 data[1]; /* TCLAS element(s) + optional TCLAS proc */
2409 } BWL_POST_PACKED_STRUCT;
2410 typedef struct dot11_tfs_se dot11_tfs_se_t;
2411 
2412 /** TFS response element */
2413 BWL_PRE_PACKED_STRUCT struct dot11_tfs_resp_ie {
2414     uint8 id; /* 92, DOT11_MNG_TFS_RESPONSE_ID */
2415     uint8 len;
2416     uint8 tfs_id;
2417     uint8 data[1];
2418 } BWL_POST_PACKED_STRUCT;
2419 typedef struct dot11_tfs_resp_ie dot11_tfs_resp_ie_t;
2420 #define DOT11_TFS_RESP_IE_LEN 1u /* Fixed length, without id and len */
2421 
2422 /** TFS response subelement IDs (same subelments, but different IDs than in TFS
2423  * request */
2424 #define DOT11_TFS_RESP_TFS_STATUS_SE_ID 1
2425 #define DOT11_TFS_RESP_TFS_SE_ID 2
2426 #define DOT11_TFS_RESP_VENDOR_SE_ID 221
2427 
2428 /** TFS status subelement */
2429 BWL_PRE_PACKED_STRUCT struct dot11_tfs_status_se {
2430     uint8 sub_id; /* 92, DOT11_MNG_TFS_RESPONSE_ID */
2431     uint8 len;
2432     uint8 resp_st;
2433     uint8 data[1]; /* Potential dot11_tfs_se_t included */
2434 } BWL_POST_PACKED_STRUCT;
2435 typedef struct dot11_tfs_status_se dot11_tfs_status_se_t;
2436 #define DOT11_TFS_STATUS_SE_LEN 1 /* Fixed length, without id and len */
2437 
2438 /* Following Definition should be merged to FMS_TFS macro below */
2439 /* TFS Response status code. Identical to FMS Element status, without N/A  */
2440 #define DOT11_TFS_STATUS_ACCEPT 0
2441 #define DOT11_TFS_STATUS_DENY_FORMAT 1
2442 #define DOT11_TFS_STATUS_DENY_RESOURCE 2
2443 #define DOT11_TFS_STATUS_DENY_POLICY 4
2444 #define DOT11_TFS_STATUS_DENY_UNSPECIFIED 5
2445 #define DOT11_TFS_STATUS_ALTPREF_POLICY 7
2446 #define DOT11_TFS_STATUS_ALTPREF_TCLAS_UNSUPP 14
2447 
2448 /* FMS Element Status and TFS Response Status Definition */
2449 #define DOT11_FMS_TFS_STATUS_ACCEPT 0
2450 #define DOT11_FMS_TFS_STATUS_DENY_FORMAT 1
2451 #define DOT11_FMS_TFS_STATUS_DENY_RESOURCE 2
2452 #define DOT11_FMS_TFS_STATUS_DENY_MULTIPLE_DI 3
2453 #define DOT11_FMS_TFS_STATUS_DENY_POLICY 4
2454 #define DOT11_FMS_TFS_STATUS_DENY_UNSPECIFIED 5
2455 #define DOT11_FMS_TFS_STATUS_ALT_DIFF_DI 6
2456 #define DOT11_FMS_TFS_STATUS_ALT_POLICY 7
2457 #define DOT11_FMS_TFS_STATUS_ALT_CHANGE_DI 8
2458 #define DOT11_FMS_TFS_STATUS_ALT_MCRATE 9
2459 #define DOT11_FMS_TFS_STATUS_TERM_POLICY 10
2460 #define DOT11_FMS_TFS_STATUS_TERM_RESOURCE 11
2461 #define DOT11_FMS_TFS_STATUS_TERM_HIGHER_PRIO 12
2462 #define DOT11_FMS_TFS_STATUS_ALT_CHANGE_MDI 13
2463 #define DOT11_FMS_TFS_STATUS_ALT_TCLAS_UNSUPP 14
2464 
2465 /** TFS Management Request frame header */
2466 BWL_PRE_PACKED_STRUCT struct dot11_tfs_req {
2467     uint8 category; /* category of action frame (10) */
2468     uint8 action;   /* WNM action: TFS request (13) */
2469     uint8 token;    /* dialog token */
2470     uint8 data[1];  /* Elements */
2471 } BWL_POST_PACKED_STRUCT;
2472 typedef struct dot11_tfs_req dot11_tfs_req_t;
2473 #define DOT11_TFS_REQ_LEN 3 /* Fixed length */
2474 
2475 /** TFS Management Response frame header */
2476 BWL_PRE_PACKED_STRUCT struct dot11_tfs_resp {
2477     uint8 category; /* category of action frame (10) */
2478     uint8 action;   /* WNM action: TFS request (14) */
2479     uint8 token;    /* dialog token */
2480     uint8 data[1];  /* Elements */
2481 } BWL_POST_PACKED_STRUCT;
2482 typedef struct dot11_tfs_resp dot11_tfs_resp_t;
2483 #define DOT11_TFS_RESP_LEN 3 /* Fixed length */
2484 
2485 /** TFS Management Notify frame request header */
2486 BWL_PRE_PACKED_STRUCT struct dot11_tfs_notify_req {
2487     uint8 category;   /* category of action frame (10) */
2488     uint8 action;     /* WNM action: TFS notify request (15) */
2489     uint8 tfs_id_cnt; /* TFS IDs count */
2490     uint8 tfs_id[1];  /* Array of TFS IDs */
2491 } BWL_POST_PACKED_STRUCT;
2492 typedef struct dot11_tfs_notify_req dot11_tfs_notify_req_t;
2493 #define DOT11_TFS_NOTIFY_REQ_LEN 3 /* Fixed length */
2494 
2495 /** TFS Management Notify frame response header */
2496 BWL_PRE_PACKED_STRUCT struct dot11_tfs_notify_resp {
2497     uint8 category;   /* category of action frame (10) */
2498     uint8 action;     /* WNM action: TFS notify response (28) */
2499     uint8 tfs_id_cnt; /* TFS IDs count */
2500     uint8 tfs_id[1];  /* Array of TFS IDs */
2501 } BWL_POST_PACKED_STRUCT;
2502 typedef struct dot11_tfs_notify_resp dot11_tfs_notify_resp_t;
2503 #define DOT11_TFS_NOTIFY_RESP_LEN 3 /* Fixed length */
2504 
2505 /** WNM-Sleep Management Request frame header */
2506 BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_req {
2507     uint8 category; /* category of action frame (10) */
2508     uint8 action;   /* WNM action: wnm-sleep request (16) */
2509     uint8 token;    /* dialog token */
2510     uint8 data[1];  /* Elements */
2511 } BWL_POST_PACKED_STRUCT;
2512 typedef struct dot11_wnm_sleep_req dot11_wnm_sleep_req_t;
2513 #define DOT11_WNM_SLEEP_REQ_LEN 3 /* Fixed length */
2514 
2515 /** WNM-Sleep Management Response frame header */
2516 BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_resp {
2517     uint8 category; /* category of action frame (10) */
2518     uint8 action;   /* WNM action: wnm-sleep request (17) */
2519     uint8 token;    /* dialog token */
2520     uint16 key_len; /* key data length */
2521     uint8 data[1];  /* Elements */
2522 } BWL_POST_PACKED_STRUCT;
2523 typedef struct dot11_wnm_sleep_resp dot11_wnm_sleep_resp_t;
2524 #define DOT11_WNM_SLEEP_RESP_LEN 5 /* Fixed length */
2525 
2526 #define DOT11_WNM_SLEEP_SUBELEM_ID_GTK 0
2527 #define DOT11_WNM_SLEEP_SUBELEM_ID_IGTK 1
2528 
2529 BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_subelem_gtk {
2530     uint8 sub_id;
2531     uint8 len;
2532     uint16 key_info;
2533     uint8 key_length;
2534     uint8 rsc[8];
2535     uint8 key[1];
2536 } BWL_POST_PACKED_STRUCT;
2537 typedef struct dot11_wnm_sleep_subelem_gtk dot11_wnm_sleep_subelem_gtk_t;
2538 #define DOT11_WNM_SLEEP_SUBELEM_GTK_FIXED_LEN                                  \
2539     11 /* without sub_id, len, and key */
2540 #define DOT11_WNM_SLEEP_SUBELEM_GTK_MAX_LEN 43 /* without sub_id and len */
2541 
2542 BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_subelem_igtk {
2543     uint8 sub_id;
2544     uint8 len;
2545     uint16 key_id;
2546     uint8 pn[6];
2547     uint8 key[16];
2548 } BWL_POST_PACKED_STRUCT;
2549 typedef struct dot11_wnm_sleep_subelem_igtk dot11_wnm_sleep_subelem_igtk_t;
2550 #define DOT11_WNM_SLEEP_SUBELEM_IGTK_LEN 24 /* Fixed length */
2551 
2552 BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_ie {
2553     uint8 id; /* 93, DOT11_MNG_WNM_SLEEP_MODE_ID */
2554     uint8 len;
2555     uint8 act_type;
2556     uint8 resp_status;
2557     uint16 interval;
2558 } BWL_POST_PACKED_STRUCT;
2559 typedef struct dot11_wnm_sleep_ie dot11_wnm_sleep_ie_t;
2560 #define DOT11_WNM_SLEEP_IE_LEN 4 /* Fixed length */
2561 
2562 #define DOT11_WNM_SLEEP_ACT_TYPE_ENTER 0
2563 #define DOT11_WNM_SLEEP_ACT_TYPE_EXIT 1
2564 
2565 #define DOT11_WNM_SLEEP_RESP_ACCEPT 0
2566 #define DOT11_WNM_SLEEP_RESP_UPDATE 1
2567 #define DOT11_WNM_SLEEP_RESP_DENY 2
2568 #define DOT11_WNM_SLEEP_RESP_DENY_TEMP 3
2569 #define DOT11_WNM_SLEEP_RESP_DENY_KEY 4
2570 #define DOT11_WNM_SLEEP_RESP_DENY_INUSE 5
2571 #define DOT11_WNM_SLEEP_RESP_LAST 6
2572 
2573 /** DMS Management Request frame header */
2574 BWL_PRE_PACKED_STRUCT struct dot11_dms_req {
2575     uint8 category; /* category of action frame (10) */
2576     uint8 action;   /* WNM action: dms request (23) */
2577     uint8 token;    /* dialog token */
2578     uint8 data[1];  /* Elements */
2579 } BWL_POST_PACKED_STRUCT;
2580 typedef struct dot11_dms_req dot11_dms_req_t;
2581 #define DOT11_DMS_REQ_LEN 3 /* Fixed length */
2582 
2583 /** DMS Management Response frame header */
2584 BWL_PRE_PACKED_STRUCT struct dot11_dms_resp {
2585     uint8 category; /* category of action frame (10) */
2586     uint8 action;   /* WNM action: dms request (24) */
2587     uint8 token;    /* dialog token */
2588     uint8 data[1];  /* Elements */
2589 } BWL_POST_PACKED_STRUCT;
2590 typedef struct dot11_dms_resp dot11_dms_resp_t;
2591 #define DOT11_DMS_RESP_LEN 3 /* Fixed length */
2592 
2593 /** DMS request element */
2594 BWL_PRE_PACKED_STRUCT struct dot11_dms_req_ie {
2595     uint8 id; /* 99, DOT11_MNG_DMS_REQUEST_ID */
2596     uint8 len;
2597     uint8 data[1];
2598 } BWL_POST_PACKED_STRUCT;
2599 typedef struct dot11_dms_req_ie dot11_dms_req_ie_t;
2600 #define DOT11_DMS_REQ_IE_LEN 2 /* Fixed length */
2601 
2602 /** DMS response element */
2603 BWL_PRE_PACKED_STRUCT struct dot11_dms_resp_ie {
2604     uint8 id; /* 100, DOT11_MNG_DMS_RESPONSE_ID */
2605     uint8 len;
2606     uint8 data[1];
2607 } BWL_POST_PACKED_STRUCT;
2608 typedef struct dot11_dms_resp_ie dot11_dms_resp_ie_t;
2609 #define DOT11_DMS_RESP_IE_LEN 2 /* Fixed length */
2610 
2611 /** DMS request descriptor */
2612 BWL_PRE_PACKED_STRUCT struct dot11_dms_req_desc {
2613     uint8 dms_id;
2614     uint8 len;
2615     uint8 type;
2616     uint8 data[1];
2617 } BWL_POST_PACKED_STRUCT;
2618 typedef struct dot11_dms_req_desc dot11_dms_req_desc_t;
2619 #define DOT11_DMS_REQ_DESC_LEN 3 /* Fixed length */
2620 
2621 #define DOT11_DMS_REQ_TYPE_ADD 0
2622 #define DOT11_DMS_REQ_TYPE_REMOVE 1
2623 #define DOT11_DMS_REQ_TYPE_CHANGE 2
2624 
2625 /** DMS response status */
2626 BWL_PRE_PACKED_STRUCT struct dot11_dms_resp_st {
2627     uint8 dms_id;
2628     uint8 len;
2629     uint8 type;
2630     uint16 lsc;
2631     uint8 data[1];
2632 } BWL_POST_PACKED_STRUCT;
2633 typedef struct dot11_dms_resp_st dot11_dms_resp_st_t;
2634 #define DOT11_DMS_RESP_STATUS_LEN 5 /* Fixed length */
2635 
2636 #define DOT11_DMS_RESP_TYPE_ACCEPT 0
2637 #define DOT11_DMS_RESP_TYPE_DENY 1
2638 #define DOT11_DMS_RESP_TYPE_TERM 2
2639 
2640 #define DOT11_DMS_RESP_LSC_UNSUPPORTED 0xFFFF
2641 
2642 /** WNM-Notification Request frame header */
2643 BWL_PRE_PACKED_STRUCT struct dot11_wnm_notif_req {
2644     uint8 category; /* category of action frame (10) */
2645     uint8 action;   /* WNM action: Notification request (26) */
2646     uint8 token;    /* dialog token */
2647     uint8 type;     /* type */
2648     uint8 data[1];  /* Sub-elements */
2649 } BWL_POST_PACKED_STRUCT;
2650 typedef struct dot11_wnm_notif_req dot11_wnm_notif_req_t;
2651 #define DOT11_WNM_NOTIF_REQ_LEN 4 /* Fixed length */
2652 
2653 /** FMS Management Request frame header */
2654 BWL_PRE_PACKED_STRUCT struct dot11_fms_req {
2655     uint8 category; /* category of action frame (10) */
2656     uint8 action;   /* WNM action: fms request (9) */
2657     uint8 token;    /* dialog token */
2658     uint8 data[1];  /* Elements */
2659 } BWL_POST_PACKED_STRUCT;
2660 typedef struct dot11_fms_req dot11_fms_req_t;
2661 #define DOT11_FMS_REQ_LEN 3 /* Fixed length */
2662 
2663 /** FMS Management Response frame header */
2664 BWL_PRE_PACKED_STRUCT struct dot11_fms_resp {
2665     uint8 category; /* category of action frame (10) */
2666     uint8 action;   /* WNM action: fms request (10) */
2667     uint8 token;    /* dialog token */
2668     uint8 data[1];  /* Elements */
2669 } BWL_POST_PACKED_STRUCT;
2670 typedef struct dot11_fms_resp dot11_fms_resp_t;
2671 #define DOT11_FMS_RESP_LEN 3 /* Fixed length */
2672 
2673 /** FMS Descriptor element */
2674 BWL_PRE_PACKED_STRUCT struct dot11_fms_desc {
2675     uint8 id;
2676     uint8 len;
2677     uint8 num_fms_cnt;
2678     uint8 data[1];
2679 } BWL_POST_PACKED_STRUCT;
2680 typedef struct dot11_fms_desc dot11_fms_desc_t;
2681 #define DOT11_FMS_DESC_LEN 1 /* Fixed length */
2682 
2683 #define DOT11_FMS_CNTR_MAX 0x8
2684 #define DOT11_FMS_CNTR_ID_MASK 0x7
2685 #define DOT11_FMS_CNTR_ID_SHIFT 0x0
2686 #define DOT11_FMS_CNTR_COUNT_MASK 0xf1
2687 #define DOT11_FMS_CNTR_SHIFT 0x3
2688 
2689 /** FMS request element */
2690 BWL_PRE_PACKED_STRUCT struct dot11_fms_req_ie {
2691     uint8 id;
2692     uint8 len;
2693     uint8 fms_token; /* token used to identify fms stream set */
2694     uint8 data[1];
2695 } BWL_POST_PACKED_STRUCT;
2696 typedef struct dot11_fms_req_ie dot11_fms_req_ie_t;
2697 #define DOT11_FMS_REQ_IE_FIX_LEN 1 /* Fixed length */
2698 
2699 BWL_PRE_PACKED_STRUCT struct dot11_rate_id_field {
2700     uint8 mask;
2701     uint8 mcs_idx;
2702     uint16 rate;
2703 } BWL_POST_PACKED_STRUCT;
2704 typedef struct dot11_rate_id_field dot11_rate_id_field_t;
2705 #define DOT11_RATE_ID_FIELD_MCS_SEL_MASK 0x7
2706 #define DOT11_RATE_ID_FIELD_MCS_SEL_OFFSET 0
2707 #define DOT11_RATE_ID_FIELD_RATETYPE_MASK 0x18
2708 #define DOT11_RATE_ID_FIELD_RATETYPE_OFFSET 3
2709 #define DOT11_RATE_ID_FIELD_LEN sizeof(dot11_rate_id_field_t)
2710 
2711 /** FMS request subelements */
2712 BWL_PRE_PACKED_STRUCT struct dot11_fms_se {
2713     uint8 sub_id;
2714     uint8 len;
2715     uint8 interval;
2716     uint8 max_interval;
2717     dot11_rate_id_field_t rate;
2718     uint8 data[1];
2719 } BWL_POST_PACKED_STRUCT;
2720 typedef struct dot11_fms_se dot11_fms_se_t;
2721 #define DOT11_FMS_REQ_SE_LEN 6 /* Fixed length */
2722 
2723 #define DOT11_FMS_REQ_SE_ID_FMS 1  /* FMS subelement */
2724 #define DOT11_FMS_REQ_SE_ID_VS 221 /* Vendor Specific subelement */
2725 
2726 /** FMS response element */
2727 BWL_PRE_PACKED_STRUCT struct dot11_fms_resp_ie {
2728     uint8 id;
2729     uint8 len;
2730     uint8 fms_token;
2731     uint8 data[1];
2732 } BWL_POST_PACKED_STRUCT;
2733 typedef struct dot11_fms_resp_ie dot11_fms_resp_ie_t;
2734 #define DOT11_FMS_RESP_IE_FIX_LEN 1 /* Fixed length */
2735 
2736 /* FMS status subelements */
2737 #define DOT11_FMS_STATUS_SE_ID_FMS 1   /* FMS Status */
2738 #define DOT11_FMS_STATUS_SE_ID_TCLAS 2 /* TCLAS Status */
2739 #define DOT11_FMS_STATUS_SE_ID_VS 221  /* Vendor Specific subelement */
2740 
2741 /** FMS status subelement */
2742 BWL_PRE_PACKED_STRUCT struct dot11_fms_status_se {
2743     uint8 sub_id;
2744     uint8 len;
2745     uint8 status;
2746     uint8 interval;
2747     uint8 max_interval;
2748     uint8 fmsid;
2749     uint8 counter;
2750     dot11_rate_id_field_t rate;
2751     uint8 mcast_addr[ETHER_ADDR_LEN];
2752 } BWL_POST_PACKED_STRUCT;
2753 typedef struct dot11_fms_status_se dot11_fms_status_se_t;
2754 #define DOT11_FMS_STATUS_SE_LEN 15 /* Fixed length */
2755 
2756 /** TCLAS status subelement */
2757 BWL_PRE_PACKED_STRUCT struct dot11_tclas_status_se {
2758     uint8 sub_id;
2759     uint8 len;
2760     uint8 fmsid;
2761     uint8 data[1];
2762 } BWL_POST_PACKED_STRUCT;
2763 typedef struct dot11_tclas_status_se dot11_tclas_status_se_t;
2764 #define DOT11_TCLAS_STATUS_SE_LEN 1 /* Fixed length */
2765 
2766 BWL_PRE_PACKED_STRUCT struct dot11_addba_req {
2767     uint8 category;         /* category of action frame (3) */
2768     uint8 action;           /* action: addba req */
2769     uint8 token;            /* identifier */
2770     uint16 addba_param_set; /* parameter set */
2771     uint16 timeout;         /* timeout in seconds */
2772     uint16 start_seqnum;    /* starting sequence number */
2773 } BWL_POST_PACKED_STRUCT;
2774 typedef struct dot11_addba_req dot11_addba_req_t;
2775 #define DOT11_ADDBA_REQ_LEN 9 /* length of addba req frame */
2776 
2777 BWL_PRE_PACKED_STRUCT struct dot11_addba_resp {
2778     uint8 category;         /* category of action frame (3) */
2779     uint8 action;           /* action: addba resp */
2780     uint8 token;            /* identifier */
2781     uint16 status;          /* status of add request */
2782     uint16 addba_param_set; /* negotiated parameter set */
2783     uint16 timeout;         /* negotiated timeout in seconds */
2784 } BWL_POST_PACKED_STRUCT;
2785 typedef struct dot11_addba_resp dot11_addba_resp_t;
2786 #define DOT11_ADDBA_RESP_LEN 9 /* length of addba resp frame */
2787 
2788 /* DELBA action parameters */
2789 #define DOT11_DELBA_PARAM_INIT_MASK 0x0800 /* initiator mask */
2790 #define DOT11_DELBA_PARAM_INIT_SHIFT 11    /* initiator shift */
2791 #define DOT11_DELBA_PARAM_TID_MASK 0xf000  /* tid mask */
2792 #define DOT11_DELBA_PARAM_TID_SHIFT 12     /* tid shift */
2793 
2794 BWL_PRE_PACKED_STRUCT struct dot11_delba {
2795     uint8 category;         /* category of action frame (3) */
2796     uint8 action;           /* action: addba req */
2797     uint16 delba_param_set; /* paarmeter set */
2798     uint16 reason;          /* reason for dellba */
2799 } BWL_POST_PACKED_STRUCT;
2800 typedef struct dot11_delba dot11_delba_t;
2801 #define DOT11_DELBA_LEN 6 /* length of delba frame */
2802 
2803 /* SA Query action field value */
2804 #define SA_QUERY_REQUEST 0
2805 #define SA_QUERY_RESPONSE 1
2806 
2807 /* ************* 802.11r related definitions. ************* */
2808 
2809 /** Over-the-DS Fast Transition Request frame header */
2810 BWL_PRE_PACKED_STRUCT struct dot11_ft_req {
2811     uint8 category; /* category of action frame (6) */
2812     uint8 action;   /* action: ft req */
2813     uint8 sta_addr[ETHER_ADDR_LEN];
2814     uint8 tgt_ap_addr[ETHER_ADDR_LEN];
2815     uint8 data[1]; /* Elements */
2816 } BWL_POST_PACKED_STRUCT;
2817 typedef struct dot11_ft_req dot11_ft_req_t;
2818 #define DOT11_FT_REQ_FIXED_LEN 14
2819 
2820 /** Over-the-DS Fast Transition Response frame header */
2821 BWL_PRE_PACKED_STRUCT struct dot11_ft_res {
2822     uint8 category; /* category of action frame (6) */
2823     uint8 action;   /* action: ft resp */
2824     uint8 sta_addr[ETHER_ADDR_LEN];
2825     uint8 tgt_ap_addr[ETHER_ADDR_LEN];
2826     uint16 status; /* status code */
2827     uint8 data[1]; /* Elements */
2828 } BWL_POST_PACKED_STRUCT;
2829 typedef struct dot11_ft_res dot11_ft_res_t;
2830 #define DOT11_FT_RES_FIXED_LEN 16
2831 
2832 /** RDE RIC Data Element. */
2833 BWL_PRE_PACKED_STRUCT struct dot11_rde_ie {
2834     uint8 id; /* 11r, DOT11_MNG_RDE_ID */
2835     uint8 length;
2836     uint8 rde_id;   /* RDE identifier. */
2837     uint8 rd_count; /* Resource Descriptor Count. */
2838     uint16 status;  /* Status Code. */
2839 } BWL_POST_PACKED_STRUCT;
2840 typedef struct dot11_rde_ie dot11_rde_ie_t;
2841 
2842 /* 11r - Size of the RDE (RIC Data Element) IE, including TLV header. */
2843 #define DOT11_MNG_RDE_IE_LEN sizeof(dot11_rde_ie_t)
2844 
2845 /* ************* 802.11k related definitions. ************* */
2846 
2847 /* Radio measurements enabled capability ie */
2848 #define DOT11_RRM_CAP_LEN 5 /* length of rrm cap bitmap */
2849 #define RCPI_IE_LEN 1
2850 #define RSNI_IE_LEN 1
2851 BWL_PRE_PACKED_STRUCT struct dot11_rrm_cap_ie {
2852     uint8 cap[DOT11_RRM_CAP_LEN];
2853 } BWL_POST_PACKED_STRUCT;
2854 typedef struct dot11_rrm_cap_ie dot11_rrm_cap_ie_t;
2855 
2856 /* Bitmap definitions for cap ie */
2857 #define DOT11_RRM_CAP_LINK 0
2858 #define DOT11_RRM_CAP_NEIGHBOR_REPORT 1
2859 #define DOT11_RRM_CAP_PARALLEL 2
2860 #define DOT11_RRM_CAP_REPEATED 3
2861 #define DOT11_RRM_CAP_BCN_PASSIVE 4
2862 #define DOT11_RRM_CAP_BCN_ACTIVE 5
2863 #define DOT11_RRM_CAP_BCN_TABLE 6
2864 #define DOT11_RRM_CAP_BCN_REP_COND 7
2865 #define DOT11_RRM_CAP_FM 8
2866 #define DOT11_RRM_CAP_CLM 9
2867 #define DOT11_RRM_CAP_NHM 10
2868 #define DOT11_RRM_CAP_SM 11
2869 #define DOT11_RRM_CAP_LCIM 12
2870 #define DOT11_RRM_CAP_LCIA 13
2871 #define DOT11_RRM_CAP_TSCM 14
2872 #define DOT11_RRM_CAP_TTSCM 15
2873 #define DOT11_RRM_CAP_AP_CHANREP 16
2874 #define DOT11_RRM_CAP_RMMIB 17
2875 /* bit18-bit23, not used for RRM_IOVAR */
2876 #define DOT11_RRM_CAP_MPC0 24
2877 #define DOT11_RRM_CAP_MPC1 25
2878 #define DOT11_RRM_CAP_MPC2 26
2879 #define DOT11_RRM_CAP_MPTI 27
2880 #define DOT11_RRM_CAP_NBRTSFO 28
2881 #define DOT11_RRM_CAP_RCPI 29
2882 #define DOT11_RRM_CAP_RSNI 30
2883 #define DOT11_RRM_CAP_BSSAAD 31
2884 #define DOT11_RRM_CAP_BSSAAC 32
2885 #define DOT11_RRM_CAP_AI 33
2886 #define DOT11_RRM_CAP_FTM_RANGE 34
2887 #define DOT11_RRM_CAP_CIVIC_LOC 35
2888 #define DOT11_RRM_CAP_IDENT_LOC 36
2889 #define DOT11_RRM_CAP_LAST 36
2890 
2891 #ifdef WL11K_ALL_MEAS
2892 #define DOT11_RRM_CAP_LINK_ENAB (1 << DOT11_RRM_CAP_LINK)
2893 #define DOT11_RRM_CAP_FM_ENAB (1 << (DOT11_RRM_CAP_FM - 8))
2894 #define DOT11_RRM_CAP_CLM_ENAB (1 << (DOT11_RRM_CAP_CLM - 8))
2895 #define DOT11_RRM_CAP_NHM_ENAB (1 << (DOT11_RRM_CAP_NHM - 8))
2896 #define DOT11_RRM_CAP_SM_ENAB (1 << (DOT11_RRM_CAP_SM - 8))
2897 #define DOT11_RRM_CAP_LCIM_ENAB (1 << (DOT11_RRM_CAP_LCIM - 8))
2898 #define DOT11_RRM_CAP_TSCM_ENAB (1 << (DOT11_RRM_CAP_TSCM - 8))
2899 #ifdef WL11K_AP
2900 #define DOT11_RRM_CAP_MPC0_ENAB (1 << (DOT11_RRM_CAP_MPC0 - 24))
2901 #define DOT11_RRM_CAP_MPC1_ENAB (1 << (DOT11_RRM_CAP_MPC1 - 24))
2902 #define DOT11_RRM_CAP_MPC2_ENAB (1 << (DOT11_RRM_CAP_MPC2 - 24))
2903 #define DOT11_RRM_CAP_MPTI_ENAB (1 << (DOT11_RRM_CAP_MPTI - 24))
2904 #else
2905 #define DOT11_RRM_CAP_MPC0_ENAB 0
2906 #define DOT11_RRM_CAP_MPC1_ENAB 0
2907 #define DOT11_RRM_CAP_MPC2_ENAB 0
2908 #define DOT11_RRM_CAP_MPTI_ENAB 0
2909 #endif /* WL11K_AP */
2910 #define DOT11_RRM_CAP_CIVIC_LOC_ENAB (1 << (DOT11_RRM_CAP_CIVIC_LOC - 32))
2911 #define DOT11_RRM_CAP_IDENT_LOC_ENAB (1 << (DOT11_RRM_CAP_IDENT_LOC - 32))
2912 #else
2913 #define DOT11_RRM_CAP_LINK_ENAB 0
2914 #define DOT11_RRM_CAP_FM_ENAB 0
2915 #define DOT11_RRM_CAP_CLM_ENAB 0
2916 #define DOT11_RRM_CAP_NHM_ENAB 0
2917 #define DOT11_RRM_CAP_SM_ENAB 0
2918 #define DOT11_RRM_CAP_LCIM_ENAB 0
2919 #define DOT11_RRM_CAP_TSCM_ENAB 0
2920 #define DOT11_RRM_CAP_MPC0_ENAB 0
2921 #define DOT11_RRM_CAP_MPC1_ENAB 0
2922 #define DOT11_RRM_CAP_MPC2_ENAB 0
2923 #define DOT11_RRM_CAP_MPTI_ENAB 0
2924 #define DOT11_RRM_CAP_CIVIC_LOC_ENAB 0
2925 #define DOT11_RRM_CAP_IDENT_LOC_ENAB 0
2926 #endif /* WL11K_ALL_MEAS */
2927 #ifdef WL11K_NBR_MEAS
2928 #define DOT11_RRM_CAP_NEIGHBOR_REPORT_ENAB (1 << DOT11_RRM_CAP_NEIGHBOR_REPORT)
2929 #else
2930 #define DOT11_RRM_CAP_NEIGHBOR_REPORT_ENAB 0
2931 #endif /* WL11K_NBR_MEAS */
2932 #ifdef WL11K_BCN_MEAS
2933 #define DOT11_RRM_CAP_BCN_PASSIVE_ENAB (1 << DOT11_RRM_CAP_BCN_PASSIVE)
2934 #define DOT11_RRM_CAP_BCN_ACTIVE_ENAB (1 << DOT11_RRM_CAP_BCN_ACTIVE)
2935 #else
2936 #define DOT11_RRM_CAP_BCN_PASSIVE_ENAB 0
2937 #define DOT11_RRM_CAP_BCN_ACTIVE_ENAB 0
2938 #endif /* WL11K_BCN_MEAS */
2939 #define DOT11_RRM_CAP_MPA_MASK 0x7
2940 /* Operating Class (formerly "Regulatory Class") definitions */
2941 #define DOT11_OP_CLASS_NONE 255
2942 
2943 BWL_PRE_PACKED_STRUCT struct do11_ap_chrep {
2944     uint8 id;
2945     uint8 len;
2946     uint8 reg;
2947     uint8 chanlist[1];
2948 } BWL_POST_PACKED_STRUCT;
2949 typedef struct do11_ap_chrep dot11_ap_chrep_t;
2950 
2951 /* Radio Measurements action ids */
2952 #define DOT11_RM_ACTION_RM_REQ 0 /* Radio measurement request */
2953 #define DOT11_RM_ACTION_RM_REP 1 /* Radio measurement report */
2954 #define DOT11_RM_ACTION_LM_REQ 2 /* Link measurement request */
2955 #define DOT11_RM_ACTION_LM_REP 3 /* Link measurement report */
2956 #define DOT11_RM_ACTION_NR_REQ 4 /* Neighbor report request */
2957 #define DOT11_RM_ACTION_NR_REP 5 /* Neighbor report response */
2958 #define DOT11_PUB_ACTION_MP 7    /* Measurement Pilot public action id */
2959 
2960 /** Generic radio measurement action frame header */
2961 BWL_PRE_PACKED_STRUCT struct dot11_rm_action {
2962     uint8 category; /* category of action frame (5) */
2963     uint8 action;   /* radio measurement action */
2964     uint8 token;    /* dialog token */
2965     uint8 data[1];
2966 } BWL_POST_PACKED_STRUCT;
2967 typedef struct dot11_rm_action dot11_rm_action_t;
2968 #define DOT11_RM_ACTION_LEN 3
2969 
2970 BWL_PRE_PACKED_STRUCT struct dot11_rmreq {
2971     uint8 category; /* category of action frame (5) */
2972     uint8 action;   /* radio measurement action */
2973     uint8 token;    /* dialog token */
2974     uint16 reps;    /* no. of repetitions */
2975     uint8 data[1];
2976 } BWL_POST_PACKED_STRUCT;
2977 typedef struct dot11_rmreq dot11_rmreq_t;
2978 #define DOT11_RMREQ_LEN 5
2979 
2980 BWL_PRE_PACKED_STRUCT struct dot11_rm_ie {
2981     uint8 id;
2982     uint8 len;
2983     uint8 token;
2984     uint8 mode;
2985     uint8 type;
2986 } BWL_POST_PACKED_STRUCT;
2987 typedef struct dot11_rm_ie dot11_rm_ie_t;
2988 #define DOT11_RM_IE_LEN 5
2989 
2990 /* Definitions for "mode" bits in rm req */
2991 #define DOT11_RMREQ_MODE_PARALLEL 1
2992 #define DOT11_RMREQ_MODE_ENABLE 2
2993 #define DOT11_RMREQ_MODE_REQUEST 4
2994 #define DOT11_RMREQ_MODE_REPORT 8
2995 #define DOT11_RMREQ_MODE_DURMAND 0x10 /* Duration Mandatory */
2996 
2997 /* Definitions for "mode" bits in rm rep */
2998 #define DOT11_RMREP_MODE_LATE 1
2999 #define DOT11_RMREP_MODE_INCAPABLE 2
3000 #define DOT11_RMREP_MODE_REFUSED 4
3001 
3002 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_bcn {
3003     uint8 id;
3004     uint8 len;
3005     uint8 token;
3006     uint8 mode;
3007     uint8 type;
3008     uint8 reg;
3009     uint8 channel;
3010     uint16 interval;
3011     uint16 duration;
3012     uint8 bcn_mode;
3013     struct ether_addr bssid;
3014 } BWL_POST_PACKED_STRUCT;
3015 typedef struct dot11_rmreq_bcn dot11_rmreq_bcn_t;
3016 #define DOT11_RMREQ_BCN_LEN 18u
3017 
3018 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_bcn {
3019     uint8 reg;
3020     uint8 channel;
3021     uint32 starttime[2];
3022     uint16 duration;
3023     uint8 frame_info;
3024     uint8 rcpi;
3025     uint8 rsni;
3026     struct ether_addr bssid;
3027     uint8 antenna_id;
3028     uint32 parent_tsf;
3029 } BWL_POST_PACKED_STRUCT;
3030 typedef struct dot11_rmrep_bcn dot11_rmrep_bcn_t;
3031 #define DOT11_RMREP_BCN_LEN 26
3032 
3033 /* Beacon request measurement mode */
3034 #define DOT11_RMREQ_BCN_PASSIVE 0
3035 #define DOT11_RMREQ_BCN_ACTIVE 1
3036 #define DOT11_RMREQ_BCN_TABLE 2
3037 
3038 /* Sub-element IDs for Beacon Request */
3039 #define DOT11_RMREQ_BCN_SSID_ID 0
3040 #define DOT11_RMREQ_BCN_REPINFO_ID 1
3041 #define DOT11_RMREQ_BCN_REPDET_ID 2
3042 #define DOT11_RMREQ_BCN_REQUEST_ID 10
3043 #define DOT11_RMREQ_BCN_APCHREP_ID DOT11_MNG_AP_CHREP_ID
3044 #define DOT11_RMREQ_BCN_LAST_RPT_IND_REQ_ID 164
3045 
3046 /* Reporting Detail element definition */
3047 #define DOT11_RMREQ_BCN_REPDET_FIXED 0   /* Fixed length fields only */
3048 #define DOT11_RMREQ_BCN_REPDET_REQUEST 1 /* + requested information elems */
3049 #define DOT11_RMREQ_BCN_REPDET_ALL 2     /* All fields */
3050 
3051 /* Reporting Information (reporting condition) element definition */
3052 #define DOT11_RMREQ_BCN_REPINFO_LEN 2 /* Beacon Reporting Information length   \
3053                                        */
3054 #define DOT11_RMREQ_BCN_REPCOND_DEFAULT                                        \
3055     0 /* Report to be issued after each measurement */
3056 
3057 /* Last Beacon Report Indication Request definition */
3058 #define DOT11_RMREQ_BCN_LAST_RPT_IND_REQ_ENAB 1
3059 
3060 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_last_bcn_rpt_ind_req {
3061     uint8 id;   /* DOT11_RMREQ_BCN_LAST_RPT_IND_REQ_ID */
3062     uint8 len;  /* length of remaining fields */
3063     uint8 data; /* data = 1 means last bcn rpt ind requested */
3064 } BWL_POST_PACKED_STRUCT;
3065 typedef struct dot11_rmrep_last_bcn_rpt_ind_req
3066     dot11_rmrep_last_bcn_rpt_ind_req_t;
3067 
3068 /* Sub-element IDs for Beacon Report */
3069 #define DOT11_RMREP_BCN_FRM_BODY 1
3070 #define DOT11_RMREP_BCN_FRM_BODY_FRAG_ID 2
3071 #define DOT11_RMREP_BCN_LAST_RPT_IND 164
3072 #define DOT11_RMREP_BCN_FRM_BODY_LEN_MAX 224 /* 802.11k-2008 7.3.2.22.6 */
3073 
3074 /* Refer IEEE P802.11-REVmd/D1.0 9.4.2.21.7 Beacon report */
3075 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_bcn_frm_body_fragmt_id {
3076     uint8 id;  /* DOT11_RMREP_BCN_FRM_BODY_FRAG_ID */
3077     uint8 len; /* length of remaining fields */
3078     /* More fragments(B15), fragment Id(B8-B14), Bcn rpt instance ID (B0 - B7)
3079      */
3080     uint16 frag_info_rpt_id;
3081 } BWL_POST_PACKED_STRUCT;
3082 
3083 typedef struct dot11_rmrep_bcn_frm_body_fragmt_id
3084     dot11_rmrep_bcn_frm_body_fragmt_id_t;
3085 
3086 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_bcn_frm_body_frag_id {
3087     uint8 id;         /* DOT11_RMREP_BCN_FRM_BODY_FRAG_ID */
3088     uint8 len;        /* length of remaining fields */
3089     uint8 bcn_rpt_id; /* Bcn rpt instance ID */
3090     uint8 frag_info;  /* fragment Id(7 bits) | More fragments(1 bit) */
3091 } BWL_POST_PACKED_STRUCT;
3092 
3093 typedef struct dot11_rmrep_bcn_frm_body_frag_id
3094     dot11_rmrep_bcn_frm_body_frag_id_t;
3095 #define DOT11_RMREP_BCNRPT_FRAG_ID_DATA_LEN 2u
3096 #define DOT11_RMREP_BCNRPT_FRAG_ID_SE_LEN                                      \
3097     sizeof(dot11_rmrep_bcn_frm_body_frag_id_t)
3098 #define DOT11_RMREP_BCNRPT_FRAG_ID_NUM_SHIFT 1u
3099 #define DOT11_RMREP_BCNRPT_FRAGMT_ID_SE_LEN                                    \
3100     sizeof(dot11_rmrep_bcn_frm_body_fragmt_id_t)
3101 #define DOT11_RMREP_BCNRPT_BCN_RPT_ID_MASK 0x00FFu
3102 #define DOT11_RMREP_BCNRPT_FRAGMT_ID_NUM_SHIFT 8u
3103 #define DOT11_RMREP_BCNRPT_FRAGMT_ID_NUM_MASK 0x7F00u
3104 #define DOT11_RMREP_BCNRPT_MORE_FRAG_SHIFT 15u
3105 #define DOT11_RMREP_BCNRPT_MORE_FRAG_MASK 0x8000u
3106 
3107 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_last_bcn_rpt_ind {
3108     uint8 id;   /* DOT11_RMREP_BCN_LAST_RPT_IND */
3109     uint8 len;  /* length of remaining fields */
3110     uint8 data; /* data = 1 is last bcn rpt */
3111 } BWL_POST_PACKED_STRUCT;
3112 
3113 typedef struct dot11_rmrep_last_bcn_rpt_ind dot11_rmrep_last_bcn_rpt_ind_t;
3114 #define DOT11_RMREP_LAST_BCN_RPT_IND_DATA_LEN 1
3115 #define DOT11_RMREP_LAST_BCN_RPT_IND_SE_LEN                                    \
3116     sizeof(dot11_rmrep_last_bcn_rpt_ind_t)
3117 
3118 /* Sub-element IDs for Frame Report */
3119 #define DOT11_RMREP_FRAME_COUNT_REPORT 1
3120 
3121 /* Channel load request */
3122 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_chanload {
3123     uint8 id;
3124     uint8 len;
3125     uint8 token;
3126     uint8 mode;
3127     uint8 type;
3128     uint8 reg;
3129     uint8 channel;
3130     uint16 interval;
3131     uint16 duration;
3132 } BWL_POST_PACKED_STRUCT;
3133 typedef struct dot11_rmreq_chanload dot11_rmreq_chanload_t;
3134 #define DOT11_RMREQ_CHANLOAD_LEN 11
3135 
3136 /** Channel load report */
3137 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_chanload {
3138     uint8 reg;
3139     uint8 channel;
3140     uint32 starttime[2];
3141     uint16 duration;
3142     uint8 channel_load;
3143 } BWL_POST_PACKED_STRUCT;
3144 typedef struct dot11_rmrep_chanload dot11_rmrep_chanload_t;
3145 #define DOT11_RMREP_CHANLOAD_LEN 13
3146 
3147 /** Noise histogram request */
3148 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_noise {
3149     uint8 id;
3150     uint8 len;
3151     uint8 token;
3152     uint8 mode;
3153     uint8 type;
3154     uint8 reg;
3155     uint8 channel;
3156     uint16 interval;
3157     uint16 duration;
3158 } BWL_POST_PACKED_STRUCT;
3159 typedef struct dot11_rmreq_noise dot11_rmreq_noise_t;
3160 #define DOT11_RMREQ_NOISE_LEN 11
3161 
3162 /** Noise histogram report */
3163 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_noise {
3164     uint8 reg;
3165     uint8 channel;
3166     uint32 starttime[2];
3167     uint16 duration;
3168     uint8 antid;
3169     uint8 anpi;
3170     uint8 ipi0_dens;
3171     uint8 ipi1_dens;
3172     uint8 ipi2_dens;
3173     uint8 ipi3_dens;
3174     uint8 ipi4_dens;
3175     uint8 ipi5_dens;
3176     uint8 ipi6_dens;
3177     uint8 ipi7_dens;
3178     uint8 ipi8_dens;
3179     uint8 ipi9_dens;
3180     uint8 ipi10_dens;
3181 } BWL_POST_PACKED_STRUCT;
3182 typedef struct dot11_rmrep_noise dot11_rmrep_noise_t;
3183 #define DOT11_RMREP_NOISE_LEN 25
3184 
3185 /** Frame request */
3186 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_frame {
3187     uint8 id;
3188     uint8 len;
3189     uint8 token;
3190     uint8 mode;
3191     uint8 type;
3192     uint8 reg;
3193     uint8 channel;
3194     uint16 interval;
3195     uint16 duration;
3196     uint8 req_type;
3197     struct ether_addr ta;
3198 } BWL_POST_PACKED_STRUCT;
3199 typedef struct dot11_rmreq_frame dot11_rmreq_frame_t;
3200 #define DOT11_RMREQ_FRAME_LEN 18
3201 
3202 /** Frame report */
3203 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_frame {
3204     uint8 reg;
3205     uint8 channel;
3206     uint32 starttime[2];
3207     uint16 duration;
3208 } BWL_POST_PACKED_STRUCT;
3209 typedef struct dot11_rmrep_frame dot11_rmrep_frame_t;
3210 #define DOT11_RMREP_FRAME_LEN 12
3211 
3212 /** Frame report entry */
3213 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_frmentry {
3214     struct ether_addr ta;
3215     struct ether_addr bssid;
3216     uint8 phy_type;
3217     uint8 avg_rcpi;
3218     uint8 last_rsni;
3219     uint8 last_rcpi;
3220     uint8 ant_id;
3221     uint16 frame_cnt;
3222 } BWL_POST_PACKED_STRUCT;
3223 typedef struct dot11_rmrep_frmentry dot11_rmrep_frmentry_t;
3224 #define DOT11_RMREP_FRMENTRY_LEN 19
3225 
3226 /** STA statistics request */
3227 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_stat {
3228     uint8 id;
3229     uint8 len;
3230     uint8 token;
3231     uint8 mode;
3232     uint8 type;
3233     struct ether_addr peer;
3234     uint16 interval;
3235     uint16 duration;
3236     uint8 group_id;
3237 } BWL_POST_PACKED_STRUCT;
3238 typedef struct dot11_rmreq_stat dot11_rmreq_stat_t;
3239 #define DOT11_RMREQ_STAT_LEN 16
3240 
3241 /** STA statistics report */
3242 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_stat {
3243     uint16 duration;
3244     uint8 group_id;
3245 } BWL_POST_PACKED_STRUCT;
3246 typedef struct dot11_rmrep_stat dot11_rmrep_stat_t;
3247 
3248 /* Statistics Group Report: Group IDs */
3249 enum {
3250     DOT11_RRM_STATS_GRP_ID_0 = 0,
3251     DOT11_RRM_STATS_GRP_ID_1,
3252     DOT11_RRM_STATS_GRP_ID_2,
3253     DOT11_RRM_STATS_GRP_ID_3,
3254     DOT11_RRM_STATS_GRP_ID_4,
3255     DOT11_RRM_STATS_GRP_ID_5,
3256     DOT11_RRM_STATS_GRP_ID_6,
3257     DOT11_RRM_STATS_GRP_ID_7,
3258     DOT11_RRM_STATS_GRP_ID_8,
3259     DOT11_RRM_STATS_GRP_ID_9,
3260     DOT11_RRM_STATS_GRP_ID_10,
3261     DOT11_RRM_STATS_GRP_ID_11,
3262     DOT11_RRM_STATS_GRP_ID_12,
3263     DOT11_RRM_STATS_GRP_ID_13,
3264     DOT11_RRM_STATS_GRP_ID_14,
3265     DOT11_RRM_STATS_GRP_ID_15,
3266     DOT11_RRM_STATS_GRP_ID_16
3267 };
3268 
3269 /* Statistics Group Report: Group Data length  */
3270 #define DOT11_RRM_STATS_RPT_LEN_GRP_ID_0 28
3271 typedef struct rrm_stat_group_0 {
3272     uint32 txfrag;
3273     uint32 txmulti;
3274     uint32 txfail;
3275     uint32 rxframe;
3276     uint32 rxmulti;
3277     uint32 rxbadfcs;
3278     uint32 txframe;
3279 } rrm_stat_group_0_t;
3280 
3281 #define DOT11_RRM_STATS_RPT_LEN_GRP_ID_1 24
3282 typedef struct rrm_stat_group_1 {
3283     uint32 txretry;
3284     uint32 txretries;
3285     uint32 rxdup;
3286     uint32 txrts;
3287     uint32 rtsfail;
3288     uint32 ackfail;
3289 } rrm_stat_group_1_t;
3290 
3291 /* group 2-9 use same qos data structure (tid 0-7), total 52 bytes */
3292 #define DOT11_RRM_STATS_RPT_LEN_GRP_ID_2_9 52
3293 typedef struct rrm_stat_group_qos {
3294     uint32 txfrag;
3295     uint32 txfail;
3296     uint32 txretry;
3297     uint32 txretries;
3298     uint32 rxdup;
3299     uint32 txrts;
3300     uint32 rtsfail;
3301     uint32 ackfail;
3302     uint32 rxfrag;
3303     uint32 txframe;
3304     uint32 txdrop;
3305     uint32 rxmpdu;
3306     uint32 rxretries;
3307 } rrm_stat_group_qos_t;
3308 
3309 /* dot11BSSAverageAccessDelay Group (only available at an AP): 8 byte */
3310 #define DOT11_RRM_STATS_RPT_LEN_GRP_ID_10 8
3311 typedef BWL_PRE_PACKED_STRUCT struct rrm_stat_group_10 {
3312     uint8 apavgdelay;
3313     uint8 avgdelaybe;
3314     uint8 avgdelaybg;
3315     uint8 avgdelayvi;
3316     uint8 avgdelayvo;
3317     uint16 stacount;
3318     uint8 chanutil;
3319 } BWL_POST_PACKED_STRUCT rrm_stat_group_10_t;
3320 
3321 /* AMSDU, 40 bytes */
3322 #define DOT11_RRM_STATS_RPT_LEN_GRP_ID_11 40
3323 typedef struct rrm_stat_group_11 {
3324     uint32 txamsdu;
3325     uint32 amsdufail;
3326     uint32 amsduretry;
3327     uint32 amsduretries;
3328     uint32 txamsdubyte_h;
3329     uint32 txamsdubyte_l;
3330     uint32 amsduackfail;
3331     uint32 rxamsdu;
3332     uint32 rxamsdubyte_h;
3333     uint32 rxamsdubyte_l;
3334 } rrm_stat_group_11_t;
3335 
3336 /* AMPDU, 36 bytes */
3337 #define DOT11_RRM_STATS_RPT_LEN_GRP_ID_12 36
3338 typedef struct rrm_stat_group_12 {
3339     uint32 txampdu;
3340     uint32 txmpdu;
3341     uint32 txampdubyte_h;
3342     uint32 txampdubyte_l;
3343     uint32 rxampdu;
3344     uint32 rxmpdu;
3345     uint32 rxampdubyte_h;
3346     uint32 rxampdubyte_l;
3347     uint32 ampducrcfail;
3348 } rrm_stat_group_12_t;
3349 
3350 /* BACK etc, 36 bytes */
3351 #define DOT11_RRM_STATS_RPT_LEN_GRP_ID_13 36
3352 typedef struct rrm_stat_group_13 {
3353     uint32 rximpbarfail;
3354     uint32 rxexpbarfail;
3355     uint32 chanwidthsw;
3356     uint32 txframe20mhz;
3357     uint32 txframe40mhz;
3358     uint32 rxframe20mhz;
3359     uint32 rxframe40mhz;
3360     uint32 psmpgrantdur;
3361     uint32 psmpuseddur;
3362 } rrm_stat_group_13_t;
3363 
3364 /* RD Dual CTS etc, 36 bytes */
3365 #define DOT11_RRM_STATS_RPT_LEN_GRP_ID_14 36
3366 typedef struct rrm_stat_group_14 {
3367     uint32 grantrdgused;
3368     uint32 grantrdgunused;
3369     uint32 txframeingrantrdg;
3370     uint32 txbyteingrantrdg_h;
3371     uint32 txbyteingrantrdg_l;
3372     uint32 dualcts;
3373     uint32 dualctsfail;
3374     uint32 rtslsi;
3375     uint32 rtslsifail;
3376 } rrm_stat_group_14_t;
3377 
3378 /* bf and STBC etc, 20 bytes */
3379 #define DOT11_RRM_STATS_RPT_LEN_GRP_ID_15 20
3380 typedef struct rrm_stat_group_15 {
3381     uint32 bfframe;
3382     uint32 stbccts;
3383     uint32 stbcctsfail;
3384     uint32 nonstbccts;
3385     uint32 nonstbcctsfail;
3386 } rrm_stat_group_15_t;
3387 
3388 /* RSNA, 28 bytes */
3389 #define DOT11_RRM_STATS_RPT_LEN_GRP_ID_16 28
3390 typedef struct rrm_stat_group_16 {
3391     uint32 rsnacmacicverr;
3392     uint32 rsnacmacreplay;
3393     uint32 rsnarobustmgmtccmpreplay;
3394     uint32 rsnatkipicverr;
3395     uint32 rsnatkipicvreplay;
3396     uint32 rsnaccmpdecrypterr;
3397     uint32 rsnaccmpreplay;
3398 } rrm_stat_group_16_t;
3399 
3400 /* Transmit stream/category measurement request */
3401 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_tx_stream {
3402     uint8 id;
3403     uint8 len;
3404     uint8 token;
3405     uint8 mode;
3406     uint8 type;
3407     uint16 interval;
3408     uint16 duration;
3409     struct ether_addr peer;
3410     uint8 traffic_id;
3411     uint8 bin0_range;
3412 } BWL_POST_PACKED_STRUCT;
3413 typedef struct dot11_rmreq_tx_stream dot11_rmreq_tx_stream_t;
3414 #define DOT11_RMREQ_TXSTREAM_LEN 17
3415 
3416 /** Transmit stream/category measurement report */
3417 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_tx_stream {
3418     uint32 starttime[2];
3419     uint16 duration;
3420     struct ether_addr peer;
3421     uint8 traffic_id;
3422     uint8 reason;
3423     uint32 txmsdu_cnt;
3424     uint32 msdu_discarded_cnt;
3425     uint32 msdufailed_cnt;
3426     uint32 msduretry_cnt;
3427     uint32 cfpolls_lost_cnt;
3428     uint32 avrqueue_delay;
3429     uint32 avrtx_delay;
3430     uint8 bin0_range;
3431     uint32 bin0;
3432     uint32 bin1;
3433     uint32 bin2;
3434     uint32 bin3;
3435     uint32 bin4;
3436     uint32 bin5;
3437 } BWL_POST_PACKED_STRUCT;
3438 typedef struct dot11_rmrep_tx_stream dot11_rmrep_tx_stream_t;
3439 #define DOT11_RMREP_TXSTREAM_LEN 71
3440 
3441 typedef struct rrm_tscm {
3442     uint32 msdu_tx;
3443     uint32 msdu_exp;
3444     uint32 msdu_fail;
3445     uint32 msdu_retries;
3446     uint32 cfpolls_lost;
3447     uint32 queue_delay;
3448     uint32 tx_delay_sum;
3449     uint32 tx_delay_cnt;
3450     uint32 bin0_range_us;
3451     uint32 bin0;
3452     uint32 bin1;
3453     uint32 bin2;
3454     uint32 bin3;
3455     uint32 bin4;
3456     uint32 bin5;
3457 } rrm_tscm_t;
3458 enum {
3459     DOT11_FTM_LOCATION_SUBJ_LOCAL = 0,     /* Where am I? */
3460     DOT11_FTM_LOCATION_SUBJ_REMOTE = 1,    /* Where are you? */
3461     DOT11_FTM_LOCATION_SUBJ_THIRDPARTY = 2 /* Where is he/she? */
3462 };
3463 
3464 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_ftm_lci {
3465     uint8 id;
3466     uint8 len;
3467     uint8 token;
3468     uint8 mode;
3469     uint8 type;
3470     uint8 subj;
3471 
3472     /* Following 3 fields are unused. Keep for ROM compatibility. */
3473     uint8 lat_res;
3474     uint8 lon_res;
3475     uint8 alt_res;
3476 
3477     /* optional sub-elements */
3478 } BWL_POST_PACKED_STRUCT;
3479 typedef struct dot11_rmreq_ftm_lci dot11_rmreq_ftm_lci_t;
3480 #define DOT11_RMREQ_LCI_LEN 9
3481 
3482 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_ftm_lci {
3483     uint8 id;
3484     uint8 len;
3485     uint8 token;
3486     uint8 mode;
3487     uint8 type;
3488     uint8 lci_sub_id;
3489     uint8 lci_sub_len;
3490     /* optional LCI field */
3491     /* optional sub-elements */
3492 } BWL_POST_PACKED_STRUCT;
3493 typedef struct dot11_rmrep_ftm_lci dot11_rmrep_ftm_lci_t;
3494 
3495 #define DOT11_FTM_LCI_SUBELEM_ID 0
3496 #define DOT11_FTM_LCI_SUBELEM_LEN 2
3497 #define DOT11_FTM_LCI_FIELD_LEN 16
3498 #define DOT11_FTM_LCI_UNKNOWN_LEN 2
3499 
3500 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_ftm_civic {
3501     uint8 id;
3502     uint8 len;
3503     uint8 token;
3504     uint8 mode;
3505     uint8 type;
3506     uint8 subj;
3507     uint8 civloc_type;
3508     uint8 siu; /* service interval units */
3509     uint16 si; /* service interval */
3510                /* optional sub-elements */
3511 } BWL_POST_PACKED_STRUCT;
3512 typedef struct dot11_rmreq_ftm_civic dot11_rmreq_ftm_civic_t;
3513 #define DOT11_RMREQ_CIVIC_LEN 10
3514 
3515 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_ftm_civic {
3516     uint8 id;
3517     uint8 len;
3518     uint8 token;
3519     uint8 mode;
3520     uint8 type;
3521     uint8 civloc_type;
3522     uint8 civloc_sub_id;
3523     uint8 civloc_sub_len;
3524     /* optional location civic field */
3525     /* optional sub-elements */
3526 } BWL_POST_PACKED_STRUCT;
3527 typedef struct dot11_rmrep_ftm_civic dot11_rmrep_ftm_civic_t;
3528 
3529 #define DOT11_FTM_CIVIC_LOC_TYPE_RFC4776 0
3530 #define DOT11_FTM_CIVIC_SUBELEM_ID 0
3531 #define DOT11_FTM_CIVIC_SUBELEM_LEN 2
3532 #define DOT11_FTM_CIVIC_LOC_SI_NONE 0
3533 #define DOT11_FTM_CIVIC_TYPE_LEN 1
3534 #define DOT11_FTM_CIVIC_UNKNOWN_LEN 3
3535 
3536 /* Location Identifier measurement request */
3537 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_locid {
3538     uint8 id;
3539     uint8 len;
3540     uint8 token;
3541     uint8 mode;
3542     uint8 type;
3543     uint8 subj;
3544     uint8 siu;
3545     uint16 si;
3546 } BWL_POST_PACKED_STRUCT;
3547 typedef struct dot11_rmreq_locid dot11_rmreq_locid_t;
3548 #define DOT11_RMREQ_LOCID_LEN 9
3549 
3550 /* Location Identifier measurement report */
3551 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_locid {
3552     uint8 id;
3553     uint8 len;
3554     uint8 token;
3555     uint8 mode;
3556     uint8 type;
3557     uint8 exp_tsf[8];
3558     uint8 locid_sub_id;
3559     uint8 locid_sub_len;
3560     /* optional location identifier field */
3561     /* optional sub-elements */
3562 } BWL_POST_PACKED_STRUCT;
3563 typedef struct dot11_rmrep_locid dot11_rmrep_locid_t;
3564 #define DOT11_LOCID_UNKNOWN_LEN 10
3565 #define DOT11_LOCID_SUBELEM_ID 0
3566 
3567 BWL_PRE_PACKED_STRUCT struct dot11_ftm_range_subel {
3568     uint8 id;
3569     uint8 len;
3570     uint16 max_age;
3571 } BWL_POST_PACKED_STRUCT;
3572 typedef struct dot11_ftm_range_subel dot11_ftm_range_subel_t;
3573 #define DOT11_FTM_RANGE_SUBELEM_ID 4
3574 #define DOT11_FTM_RANGE_SUBELEM_LEN 2
3575 
3576 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_ftm_range {
3577     uint8 id;
3578     uint8 len;
3579     uint8 token;
3580     uint8 mode;
3581     uint8 type;
3582     uint16 max_init_delay; /* maximum random initial delay */
3583     uint8 min_ap_count;
3584     uint8 data[1];
3585     /* neighbor report sub-elements */
3586     /* optional sub-elements */
3587 } BWL_POST_PACKED_STRUCT;
3588 typedef struct dot11_rmreq_ftm_range dot11_rmreq_ftm_range_t;
3589 #define DOT11_RMREQ_FTM_RANGE_LEN 8
3590 
3591 #define DOT11_FTM_RANGE_LEN 3
3592 BWL_PRE_PACKED_STRUCT struct dot11_ftm_range_entry {
3593     uint32 start_tsf; /* 4 lsb of tsf */
3594     struct ether_addr bssid;
3595     uint8 range[DOT11_FTM_RANGE_LEN];
3596     uint8 max_err[DOT11_FTM_RANGE_LEN];
3597     uint8 rsvd;
3598 } BWL_POST_PACKED_STRUCT;
3599 typedef struct dot11_ftm_range_entry dot11_ftm_range_entry_t;
3600 #define DOT11_FTM_RANGE_ENTRY_MAX_COUNT 15
3601 
3602 enum {
3603     DOT11_FTM_RANGE_ERROR_AP_INCAPABLE = 2,
3604     DOT11_FTM_RANGE_ERROR_AP_FAILED = 3,
3605     DOT11_FTM_RANGE_ERROR_TX_FAILED = 8,
3606     DOT11_FTM_RANGE_ERROR_MAX
3607 };
3608 
3609 BWL_PRE_PACKED_STRUCT struct dot11_ftm_range_error_entry {
3610     uint32 start_tsf; /* 4 lsb of tsf */
3611     struct ether_addr bssid;
3612     uint8 code;
3613 } BWL_POST_PACKED_STRUCT;
3614 typedef struct dot11_ftm_range_error_entry dot11_ftm_range_error_entry_t;
3615 #define DOT11_FTM_RANGE_ERROR_ENTRY_MAX_COUNT 11
3616 
3617 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_ftm_range {
3618     uint8 id;
3619     uint8 len;
3620     uint8 token;
3621     uint8 mode;
3622     uint8 type;
3623     uint8 entry_count;
3624     uint8 data[2]; /* includes pad */
3625 } BWL_POST_PACKED_STRUCT;
3626 typedef struct dot11_rmrep_ftm_range dot11_rmrep_ftm_range_t;
3627 
3628 #define DOT11_FTM_RANGE_REP_MIN_LEN 6 /* No extra byte for error_count */
3629 #define DOT11_FTM_RANGE_ENTRY_CNT_MAX 15
3630 #define DOT11_FTM_RANGE_ERROR_CNT_MAX 11
3631 #define DOT11_FTM_RANGE_REP_FIXED_LEN 1 /* No extra byte for error_count */
3632 /** Measurement pause request */
3633 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_pause_time {
3634     uint8 id;
3635     uint8 len;
3636     uint8 token;
3637     uint8 mode;
3638     uint8 type;
3639     uint16 pause_time;
3640 } BWL_POST_PACKED_STRUCT;
3641 typedef struct dot11_rmreq_pause_time dot11_rmreq_pause_time_t;
3642 #define DOT11_RMREQ_PAUSE_LEN 7
3643 
3644 /* Neighbor Report subelements ID (11k & 11v) */
3645 #define DOT11_NGBR_TSF_INFO_SE_ID 1
3646 #define DOT11_NGBR_CCS_SE_ID 2
3647 #define DOT11_NGBR_BSSTRANS_PREF_SE_ID 3
3648 #define DOT11_NGBR_BSS_TERM_DUR_SE_ID 4
3649 #define DOT11_NGBR_BEARING_SE_ID 5
3650 #define DOT11_NGBR_WIDE_BW_CHAN_SE_ID 6
3651 
3652 /** Neighbor Report, BSS Transition Candidate Preference subelement */
3653 BWL_PRE_PACKED_STRUCT struct dot11_ngbr_bsstrans_pref_se {
3654     uint8 sub_id;
3655     uint8 len;
3656     uint8 preference;
3657 } BWL_POST_PACKED_STRUCT;
3658 typedef struct dot11_ngbr_bsstrans_pref_se dot11_ngbr_bsstrans_pref_se_t;
3659 #define DOT11_NGBR_BSSTRANS_PREF_SE_LEN 1
3660 #define DOT11_NGBR_BSSTRANS_PREF_SE_IE_LEN 3
3661 #define DOT11_NGBR_BSSTRANS_PREF_SE_HIGHEST 0xff
3662 
3663 /** Neighbor Report, BSS Termination Duration subelement */
3664 BWL_PRE_PACKED_STRUCT struct dot11_ngbr_bss_term_dur_se {
3665     uint8 sub_id;
3666     uint8 len;
3667     uint8 tsf[8];
3668     uint16 duration;
3669 } BWL_POST_PACKED_STRUCT;
3670 typedef struct dot11_ngbr_bss_term_dur_se dot11_ngbr_bss_term_dur_se_t;
3671 #define DOT11_NGBR_BSS_TERM_DUR_SE_LEN 10
3672 
3673 /* Neighbor Report BSSID Information Field */
3674 #define DOT11_NGBR_BI_REACHABILTY_UNKN 0x0002
3675 #define DOT11_NGBR_BI_REACHABILTY 0x0003
3676 #define DOT11_NGBR_BI_SEC 0x0004
3677 #define DOT11_NGBR_BI_KEY_SCOPE 0x0008
3678 #define DOT11_NGBR_BI_CAP 0x03f0
3679 #define DOT11_NGBR_BI_CAP_SPEC_MGMT 0x0010
3680 #define DOT11_NGBR_BI_CAP_QOS 0x0020
3681 #define DOT11_NGBR_BI_CAP_APSD 0x0040
3682 #define DOT11_NGBR_BI_CAP_RDIO_MSMT 0x0080
3683 #define DOT11_NGBR_BI_CAP_DEL_BA 0x0100
3684 #define DOT11_NGBR_BI_CAP_IMM_BA 0x0200
3685 #define DOT11_NGBR_BI_MOBILITY 0x0400
3686 #define DOT11_NGBR_BI_HT 0x0800
3687 #define DOT11_NGBR_BI_VHT 0x1000
3688 #define DOT11_NGBR_BI_FTM 0x2000
3689 
3690 /** Neighbor Report element (11k & 11v) */
3691 BWL_PRE_PACKED_STRUCT struct dot11_neighbor_rep_ie {
3692     uint8 id;
3693     uint8 len;
3694     struct ether_addr bssid;
3695     uint32 bssid_info;
3696     uint8 reg; /* Operating class */
3697     uint8 channel;
3698     uint8 phytype;
3699     uint8 data[1]; /* Variable size subelements */
3700 } BWL_POST_PACKED_STRUCT;
3701 typedef struct dot11_neighbor_rep_ie dot11_neighbor_rep_ie_t;
3702 #define DOT11_NEIGHBOR_REP_IE_FIXED_LEN 13u
3703 
3704 /* MLME Enumerations */
3705 #define DOT11_BSSTYPE_INFRASTRUCTURE 0 /* d11 infrastructure */
3706 #define DOT11_BSSTYPE_INDEPENDENT 1    /* d11 independent */
3707 #define DOT11_BSSTYPE_ANY 2            /* d11 any BSS type */
3708 #define DOT11_BSSTYPE_MESH 3           /* d11 Mesh */
3709 #define DOT11_SCANTYPE_ACTIVE 0        /* d11 scan active */
3710 #define DOT11_SCANTYPE_PASSIVE 1       /* d11 scan passive */
3711 
3712 /** Link Measurement */
3713 BWL_PRE_PACKED_STRUCT struct dot11_lmreq {
3714     uint8 category; /* category of action frame (5) */
3715     uint8 action;   /* radio measurement action */
3716     uint8 token;    /* dialog token */
3717     uint8 txpwr;    /* Transmit Power Used */
3718     uint8 maxtxpwr; /* Max Transmit Power */
3719 } BWL_POST_PACKED_STRUCT;
3720 typedef struct dot11_lmreq dot11_lmreq_t;
3721 #define DOT11_LMREQ_LEN 5
3722 
3723 BWL_PRE_PACKED_STRUCT struct dot11_lmrep {
3724     uint8 category;      /* category of action frame (5) */
3725     uint8 action;        /* radio measurement action */
3726     uint8 token;         /* dialog token */
3727     dot11_tpc_rep_t tpc; /* TPC element */
3728     uint8 rxant;         /* Receive Antenna ID */
3729     uint8 txant;         /* Transmit Antenna ID */
3730     uint8 rcpi;          /* RCPI */
3731     uint8 rsni;          /* RSNI */
3732 } BWL_POST_PACKED_STRUCT;
3733 typedef struct dot11_lmrep dot11_lmrep_t;
3734 #define DOT11_LMREP_LEN 11
3735 
3736 #define DOT11_MP_CAP_SPECTRUM 0x01  /* d11 cap. spectrum */
3737 #define DOT11_MP_CAP_SHORTSLOT 0x02 /* d11 cap. shortslot */
3738 /* Measurement Pilot */
3739 BWL_PRE_PACKED_STRUCT struct dot11_mprep {
3740     uint8 cap_info;    /* Condensed capability Info. */
3741     uint8 country[2];  /* Condensed country string */
3742     uint8 opclass;     /* Op. Class */
3743     uint8 channel;     /* Channel */
3744     uint8 mp_interval; /* Measurement Pilot Interval */
3745 } BWL_POST_PACKED_STRUCT;
3746 typedef struct dot11_mprep dot11_mprep_t;
3747 #define DOT11_MPREP_LEN 6
3748 
3749 /* 802.11 BRCM "Compromise" Pre N constants */
3750 #define PREN_PREAMBLE 24    /* green field preamble time */
3751 #define PREN_MM_EXT 12      /* extra mixed mode preamble time */
3752 #define PREN_PREAMBLE_EXT 4 /* extra preamble (multiply by unique_streams-1)   \
3753                              */
3754 
3755 /* 802.11N PHY constants */
3756 #define RIFS_11N_TIME 2 /* NPHY RIFS time */
3757 
3758 /* 802.11 HT PLCP format 802.11n-2009, sec 20.3.9.4.3
3759  * HT-SIG is composed of two 24 bit parts, HT-SIG1 and HT-SIG2
3760  */
3761 /* HT-SIG1 */
3762 #define HT_SIG1_MCS_MASK 0x00007F
3763 #define HT_SIG1_CBW 0x000080
3764 #define HT_SIG1_HT_LENGTH 0xFFFF00
3765 
3766 /* HT-SIG2 */
3767 #define HT_SIG2_SMOOTHING 0x000001
3768 #define HT_SIG2_NOT_SOUNDING 0x000002
3769 #define HT_SIG2_RESERVED 0x000004
3770 #define HT_SIG2_AGGREGATION 0x000008
3771 #define HT_SIG2_STBC_MASK 0x000030
3772 #define HT_SIG2_STBC_SHIFT 4
3773 #define HT_SIG2_FEC_CODING 0x000040
3774 #define HT_SIG2_SHORT_GI 0x000080
3775 #define HT_SIG2_ESS_MASK 0x000300
3776 #define HT_SIG2_ESS_SHIFT 8
3777 #define HT_SIG2_CRC 0x03FC00
3778 #define HT_SIG2_TAIL 0x1C0000
3779 
3780 /* HT Timing-related parameters (802.11-2012, sec 20.3.6) */
3781 #define HT_T_LEG_PREAMBLE 16
3782 #define HT_T_L_SIG 4
3783 #define HT_T_SIG 8
3784 #define HT_T_LTF1 4
3785 #define HT_T_GF_LTF1 8
3786 #define HT_T_LTFs 4
3787 #define HT_T_STF 4
3788 #define HT_T_GF_STF 8
3789 #define HT_T_SYML 4
3790 
3791 #define HT_N_SERVICE 16 /* bits in SERVICE field */
3792 #define HT_N_TAIL 6     /* tail bits per BCC encoder */
3793 
3794 /* 802.11 A PHY constants */
3795 #define APHY_SLOT_TIME 9  /* APHY slot time */
3796 #define APHY_SIFS_TIME 16 /* APHY SIFS time */
3797 #define APHY_DIFS_TIME                                                         \
3798     (APHY_SIFS_TIME + (2 * APHY_SLOT_TIME)) /* APHY DIFS time */
3799 #define APHY_PREAMBLE_TIME 16               /* APHY preamble time */
3800 #define APHY_SIGNAL_TIME 4                  /* APHY signal time */
3801 #define APHY_SYMBOL_TIME 4                  /* APHY symbol time */
3802 #define APHY_SERVICE_NBITS 16               /* APHY service nbits */
3803 #define APHY_TAIL_NBITS 6                   /* APHY tail nbits */
3804 #define APHY_CWMIN 15                       /* APHY cwmin */
3805 #define APHY_PHYHDR_DUR 20                  /* APHY PHY Header Duration */
3806 
3807 /* 802.11 B PHY constants */
3808 #define BPHY_SLOT_TIME 20        /* BPHY slot time */
3809 #define BPHY_SIFS_TIME 10        /* BPHY SIFS time */
3810 #define BPHY_DIFS_TIME 50        /* BPHY DIFS time */
3811 #define BPHY_PLCP_TIME 192       /* BPHY PLCP time */
3812 #define BPHY_PLCP_SHORT_TIME 96  /* BPHY PLCP short time */
3813 #define BPHY_CWMIN 31            /* BPHY cwmin */
3814 #define BPHY_SHORT_PHYHDR_DUR 96 /* BPHY Short PHY Header Duration */
3815 #define BPHY_LONG_PHYHDR_DUR 192 /* BPHY Long PHY Header Duration */
3816 
3817 /* 802.11 G constants */
3818 #define DOT11_OFDM_SIGNAL_EXTENSION 6 /* d11 OFDM signal extension */
3819 
3820 #define PHY_CWMAX 1023 /* PHY cwmax */
3821 
3822 #define DOT11_MAXNUMFRAGS 16 /* max # fragments per MSDU */
3823 
3824 /* 802.11 VHT constants */
3825 
3826 typedef int vht_group_id_t;
3827 
3828 /* for VHT-A1 */
3829 /* SIG-A1 reserved bits */
3830 #define VHT_SIGA1_CONST_MASK 0x800004
3831 
3832 #define VHT_SIGA1_BW_MASK 0x000003
3833 #define VHT_SIGA1_20MHZ_VAL 0x000000
3834 #define VHT_SIGA1_40MHZ_VAL 0x000001
3835 #define VHT_SIGA1_80MHZ_VAL 0x000002
3836 #define VHT_SIGA1_160MHZ_VAL 0x000003
3837 
3838 #define VHT_SIGA1_STBC 0x000008
3839 
3840 #define VHT_SIGA1_GID_MASK 0x0003f0
3841 #define VHT_SIGA1_GID_SHIFT 4
3842 #define VHT_SIGA1_GID_TO_AP 0x00
3843 #define VHT_SIGA1_GID_NOT_TO_AP 0x3f
3844 #define VHT_SIGA1_GID_MAX_GID 0x3f
3845 
3846 #define VHT_SIGA1_NSTS_SHIFT_MASK_USER0 0x001C00
3847 #define VHT_SIGA1_NSTS_SHIFT 10
3848 #define VHT_SIGA1_MAX_USERPOS 3
3849 
3850 #define VHT_SIGA1_PARTIAL_AID_MASK 0x3fe000
3851 #define VHT_SIGA1_PARTIAL_AID_SHIFT 13
3852 
3853 #define VHT_SIGA1_TXOP_PS_NOT_ALLOWED 0x400000
3854 
3855 /* for VHT-A2 */
3856 #define VHT_SIGA2_GI_NONE 0x000000
3857 #define VHT_SIGA2_GI_SHORT 0x000001
3858 #define VHT_SIGA2_GI_W_MOD10 0x000002
3859 #define VHT_SIGA2_CODING_LDPC 0x000004
3860 #define VHT_SIGA2_LDPC_EXTRA_OFDM_SYM 0x000008
3861 #define VHT_SIGA2_BEAMFORM_ENABLE 0x000100
3862 #define VHT_SIGA2_MCS_SHIFT 4
3863 
3864 #define VHT_SIGA2_B9_RESERVED 0x000200
3865 #define VHT_SIGA2_TAIL_MASK 0xfc0000
3866 #define VHT_SIGA2_TAIL_VALUE 0x000000
3867 
3868 /* VHT Timing-related parameters (802.11ac D4.0, sec 22.3.6) */
3869 #define VHT_T_LEG_PREAMBLE 16
3870 #define VHT_T_L_SIG 4
3871 #define VHT_T_SIG_A 8
3872 #define VHT_T_LTF 4
3873 #define VHT_T_STF 4
3874 #define VHT_T_SIG_B 4
3875 #define VHT_T_SYML 4
3876 
3877 #define VHT_N_SERVICE 16 /* bits in SERVICE field */
3878 #define VHT_N_TAIL 6     /* tail bits per BCC encoder */
3879 
3880 /** dot11Counters Table - 802.11 spec., Annex D */
3881 typedef struct d11cnt {
3882     uint32 txfrag;   /* dot11TransmittedFragmentCount */
3883     uint32 txmulti;  /* dot11MulticastTransmittedFrameCount */
3884     uint32 txfail;   /* dot11FailedCount */
3885     uint32 txretry;  /* dot11RetryCount */
3886     uint32 txretrie; /* dot11MultipleRetryCount */
3887     uint32 rxdup;    /* dot11FrameduplicateCount */
3888     uint32 txrts;    /* dot11RTSSuccessCount */
3889     uint32 txnocts;  /* dot11RTSFailureCount */
3890     uint32 txnoack;  /* dot11ACKFailureCount */
3891     uint32 rxfrag;   /* dot11ReceivedFragmentCount */
3892     uint32 rxmulti;  /* dot11MulticastReceivedFrameCount */
3893     uint32 rxcrc;    /* dot11FCSErrorCount */
3894     uint32 txfrmsnt; /* dot11TransmittedFrameCount */
3895     uint32 rxundec;  /* dot11WEPUndecryptableCount */
3896 } d11cnt_t;
3897 
3898 #define BRCM_PROP_OUI "\x00\x90\x4C"
3899 
3900 #define BRCM_FTM_IE_TYPE 14
3901 
3902 /* Action frame type for RWL */
3903 #define RWL_WIFI_DEFAULT 0
3904 #define RWL_WIFI_FIND_MY_PEER 9      /* Used while finding server */
3905 #define RWL_WIFI_FOUND_PEER 10       /* Server response to the client  */
3906 #define RWL_ACTION_WIFI_FRAG_TYPE 85 /* Fragment indicator for receiver */
3907 
3908 #define PROXD_AF_TYPE 11         /* Wifi proximity action frame type */
3909 #define BRCM_RELMACST_AF_TYPE 12 /* RMC action frame type */
3910 
3911 /* Action frame type for FTM Initiator Report */
3912 #define BRCM_FTM_VS_AF_TYPE 14
3913 enum {
3914     BRCM_FTM_VS_INITIATOR_RPT_SUBTYPE = 1, /* FTM Initiator Report */
3915     BRCM_FTM_VS_COLLECT_SUBTYPE = 2,       /* FTM Collect debug protocol */
3916 };
3917 
3918 /*
3919  * This BRCM_PROP_OUI types is intended for use in events to embed additional
3920  * data, and would not be expected to appear on the air -- but having an IE
3921  * format allows IE frame data with extra data in events in that allows for
3922  * more flexible parsing.
3923  */
3924 #define BRCM_EVT_WL_BSS_INFO 64
3925 
3926 /**
3927  * Following is the generic structure for brcm_prop_ie (uses BRCM_PROP_OUI).
3928  * DPT uses this format with type set to DPT_IE_TYPE
3929  */
3930 BWL_PRE_PACKED_STRUCT struct brcm_prop_ie_s {
3931     uint8 id;  /* IE ID, 221, DOT11_MNG_PROPR_ID */
3932     uint8 len; /* IE length */
3933     uint8 oui[3];
3934     uint8 type; /* type of this IE */
3935     uint16 cap; /* DPT capabilities */
3936 } BWL_POST_PACKED_STRUCT;
3937 typedef struct brcm_prop_ie_s brcm_prop_ie_t;
3938 
3939 #define BRCM_PROP_IE_LEN 6 /* len of fixed part of brcm_prop ie */
3940 
3941 #define DPT_IE_TYPE 2
3942 
3943 #define BRCM_SYSCAP_IE_TYPE 3
3944 #define WET_TUNNEL_IE_TYPE 3
3945 
3946 /* brcm syscap_ie cap */
3947 #define BRCM_SYSCAP_WET_TUNNEL 0x0100 /* Device with WET_TUNNEL support */
3948 
3949 #define BRCM_OUI "\x00\x10\x18" /* Broadcom OUI */
3950 
3951 /** BRCM info element */
3952 BWL_PRE_PACKED_STRUCT struct brcm_ie {
3953     uint8 id;  /* IE ID, 221, DOT11_MNG_PROPR_ID */
3954     uint8 len; /* IE length */
3955     uint8 oui[3];
3956     uint8 ver;             /* type/ver of this IE */
3957     uint8 assoc;           /* # of assoc STAs */
3958     uint8 flags;           /* misc flags */
3959     uint8 flags1;          /* misc flags */
3960     uint16 amsdu_mtu_pref; /* preferred A-MSDU MTU */
3961 } BWL_POST_PACKED_STRUCT;
3962 typedef struct brcm_ie brcm_ie_t;
3963 #define BRCM_IE_LEN 11           /* BRCM IE length */
3964 #define BRCM_IE_VER 2            /* BRCM IE version */
3965 #define BRCM_IE_LEGACY_AES_VER 1 /* BRCM IE legacy AES version */
3966 
3967 /* brcm_ie flags */
3968 #define BRF_ABCAP                                                              \
3969     0x1 /* afterburner is obsolete,  defined for backward compat */
3970 #define BRF_ABRQRD                                                             \
3971     0x2 /* afterburner is obsolete,  defined for backward compat */
3972 #define BRF_LZWDS 0x4    /* lazy wds enabled */
3973 #define BRF_BLOCKACK 0x8 /* BlockACK capable */
3974 #define BRF_ABCOUNTER_MASK                                                     \
3975     0xf0 /* afterburner is obsolete,  defined for backward compat */
3976 #define BRF_PROP_11N_MCS 0x10 /* re-use afterburner bit */
3977 #define BRF_MEDIA_CLIENT                                                       \
3978     0x20 /* re-use afterburner bit to indicate media client device */
3979 
3980 #define GET_BRF_PROP_11N_MCS(brcm_ie)                                          \
3981     (!((brcm_ie)->flags & BRF_ABCAP) && ((brcm_ie)->flags & BRF_PROP_11N_MCS))
3982 
3983 /* brcm_ie flags1 */
3984 #define BRF1_AMSDU 0x1         /* A-MSDU capable */
3985 #define BRF1_WNM 0x2           /* WNM capable */
3986 #define BRF1_WMEPS 0x4         /* AP is capable of handling WME + PS w/o APSD */
3987 #define BRF1_PSOFIX 0x8        /* AP has fixed PS mode out-of-order packets */
3988 #define BRF1_RX_LARGE_AGG 0x10 /* device can rx large aggregates */
3989 #define BRF1_RFAWARE_DCS 0x20  /* RFAWARE dynamic channel selection (DCS) */
3990 #define BRF1_SOFTAP 0x40       /* Configure as Broadcom SOFTAP */
3991 #define BRF1_DWDS 0x80         /* DWDS capable */
3992 
3993 /** Vendor IE structure */
3994 BWL_PRE_PACKED_STRUCT struct vndr_ie {
3995     uchar id;
3996     uchar len;
3997     uchar oui[3];
3998     uchar data[1]; /* Variable size data */
3999 } BWL_POST_PACKED_STRUCT;
4000 typedef struct vndr_ie vndr_ie_t;
4001 
4002 #define VNDR_IE_HDR_LEN 2u /* id + len field */
4003 #define VNDR_IE_MIN_LEN 3u /* size of the oui field */
4004 #define VNDR_IE_FIXED_LEN (VNDR_IE_HDR_LEN + VNDR_IE_MIN_LEN)
4005 
4006 #define VNDR_IE_MAX_LEN 255u /* vendor IE max length, without ID and len */
4007 
4008 /** BRCM PROP DEVICE PRIMARY MAC ADDRESS IE */
4009 BWL_PRE_PACKED_STRUCT struct member_of_brcm_prop_ie {
4010     uchar id;
4011     uchar len;
4012     uchar oui[3];
4013     uint8 type;           /* type indicates what follows */
4014     struct ether_addr ea; /* Device Primary MAC Adrress */
4015 } BWL_POST_PACKED_STRUCT;
4016 typedef struct member_of_brcm_prop_ie member_of_brcm_prop_ie_t;
4017 
4018 #define MEMBER_OF_BRCM_PROP_IE_LEN 10 /* IE max length */
4019 #define MEMBER_OF_BRCM_PROP_IE_HDRLEN (sizeof(member_of_brcm_prop_ie_t))
4020 #define MEMBER_OF_BRCM_PROP_IE_TYPE 54
4021 
4022 /** BRCM Reliable Multicast IE */
4023 BWL_PRE_PACKED_STRUCT struct relmcast_brcm_prop_ie {
4024     uint8 id;
4025     uint8 len;
4026     uint8 oui[3];
4027     uint8 type;                 /* type indicates what follows */
4028     struct ether_addr ea;       /* The ack sender's MAC Adrress */
4029     struct ether_addr mcast_ea; /* The multicast MAC address */
4030     uint8 updtmo; /* time interval(second) for client to send null packet to
4031                      report its rssi */
4032 } BWL_POST_PACKED_STRUCT;
4033 typedef struct relmcast_brcm_prop_ie relmcast_brcm_prop_ie_t;
4034 
4035 /* IE length */
4036 /* BRCM_PROP_IE_LEN = sizeof(relmcast_brcm_prop_ie_t)-((sizeof (id) + sizeof
4037  * (len)))? */
4038 #define RELMCAST_BRCM_PROP_IE_LEN                                              \
4039     (sizeof(relmcast_brcm_prop_ie_t) - (2 * sizeof(uint8)))
4040 
4041 #define RELMCAST_BRCM_PROP_IE_TYPE 55
4042 
4043 /* BRCM BTC IE */
4044 BWL_PRE_PACKED_STRUCT struct btc_brcm_prop_ie {
4045     uint8 id;
4046     uint8 len;
4047     uint8 oui[3];
4048     uint8 type; /* type inidicates what follows */
4049     uint32 info;
4050 } BWL_POST_PACKED_STRUCT;
4051 typedef struct btc_brcm_prop_ie btc_brcm_prop_ie_t;
4052 
4053 #define BTC_INFO_BRCM_PROP_IE_TYPE 90
4054 #define BRCM_BTC_INFO_TYPE_LEN                                                 \
4055     (sizeof(btc_brcm_prop_ie_t) - (2 * sizeof(uint8)))
4056 
4057 /* ************* HT definitions. ************* */
4058 #define MCSSET_LEN                                                             \
4059     16 /* 16-bits per 8-bit set to give 128-bits bitmap of MCS Index */
4060 #define MAX_MCS_NUM (128)  /* max mcs number = 128 */
4061 #define BASIC_HT_MCS 0xFFu /* HT MCS supported rates */
4062 
4063 BWL_PRE_PACKED_STRUCT struct ht_cap_ie {
4064     uint16 cap;
4065     uint8 params;
4066     uint8 supp_mcs[MCSSET_LEN];
4067     uint16 ext_htcap;
4068     uint32 txbf_cap;
4069     uint8 as_cap;
4070 } BWL_POST_PACKED_STRUCT;
4071 typedef struct ht_cap_ie ht_cap_ie_t;
4072 
4073 BWL_PRE_PACKED_STRUCT struct dot11_ht_cap_ie {
4074     uint8 id;
4075     uint8 len;
4076     ht_cap_ie_t ht_cap;
4077 } BWL_POST_PACKED_STRUCT;
4078 typedef struct dot11_ht_cap_ie dot11_ht_cap_ie_t;
4079 
4080 /* CAP IE: HT 1.0 spec. simply stole a 802.11 IE, we use our prop. IE until this
4081  * is resolved */
4082 /* the capability IE is primarily used to convey this nodes abilities */
4083 BWL_PRE_PACKED_STRUCT struct ht_prop_cap_ie {
4084     uint8 id;  /* IE ID, 221, DOT11_MNG_PROPR_ID */
4085     uint8 len; /* IE length */
4086     uint8 oui[3];
4087     uint8 type; /* type indicates what follows */
4088     ht_cap_ie_t cap_ie;
4089 } BWL_POST_PACKED_STRUCT;
4090 typedef struct ht_prop_cap_ie ht_prop_cap_ie_t;
4091 
4092 #define HT_PROP_IE_OVERHEAD 4 /* overhead bytes for prop oui ie */
4093 #define HT_CAP_IE_LEN 26      /* HT capability len (based on .11n d2.0) */
4094 #define HT_CAP_IE_TYPE 51
4095 
4096 #define HT_CAP_LDPC_CODING 0x0001   /* Support for rx of LDPC coded pkts */
4097 #define HT_CAP_40MHZ 0x0002         /* FALSE:20Mhz, TRUE:20/40MHZ supported */
4098 #define HT_CAP_MIMO_PS_MASK 0x000C  /* Mimo PS mask */
4099 #define HT_CAP_MIMO_PS_SHIFT 0x0002 /* Mimo PS shift */
4100 #define HT_CAP_MIMO_PS_OFF 0x0003   /* Mimo PS, no restriction */
4101 #define HT_CAP_MIMO_PS_RTS 0x0001  /* Mimo PS, send RTS/CTS around MIMO frames \
4102                                     */
4103 #define HT_CAP_MIMO_PS_ON 0x0000   /* Mimo PS, MIMO disallowed */
4104 #define HT_CAP_GF 0x0010           /* Greenfield preamble support */
4105 #define HT_CAP_SHORT_GI_20 0x0020  /* 20MHZ short guard interval support */
4106 #define HT_CAP_SHORT_GI_40 0x0040  /* 40Mhz short guard interval support */
4107 #define HT_CAP_TX_STBC 0x0080      /* Tx STBC support */
4108 #define HT_CAP_RX_STBC_MASK 0x0300 /* Rx STBC mask */
4109 #define HT_CAP_RX_STBC_SHIFT 8     /* Rx STBC shift */
4110 #define HT_CAP_DELAYED_BA 0x0400   /* delayed BA support */
4111 #define HT_CAP_MAX_AMSDU 0x0800 /* Max AMSDU size in bytes , 0=3839, 1=7935 */
4112 
4113 #define HT_CAP_DSSS_CCK 0x1000         /* DSSS/CCK supported by the BSS */
4114 #define HT_CAP_PSMP 0x2000             /* Power Save Multi Poll support */
4115 #define HT_CAP_40MHZ_INTOLERANT 0x4000 /* 40MHz Intolerant */
4116 #define HT_CAP_LSIG_TXOP 0x8000        /* L-SIG TXOP protection support */
4117 
4118 #define HT_CAP_RX_STBC_NO 0x0         /* no rx STBC support */
4119 #define HT_CAP_RX_STBC_ONE_STREAM 0x1 /* rx STBC support of 1 spatial stream   \
4120                                        */
4121 #define HT_CAP_RX_STBC_TWO_STREAM                                              \
4122     0x2 /* rx STBC support of 1-2 spatial streams */
4123 #define HT_CAP_RX_STBC_THREE_STREAM                                            \
4124     0x3 /* rx STBC support of 1-3 spatial streams */
4125 
4126 #define HT_CAP_TXBF_CAP_IMPLICIT_TXBF_RX 0x1
4127 #define HT_CAP_TXBF_CAP_NDP_RX 0x8
4128 #define HT_CAP_TXBF_CAP_NDP_TX 0x10
4129 #define HT_CAP_TXBF_CAP_EXPLICIT_CSI 0x100
4130 #define HT_CAP_TXBF_CAP_EXPLICIT_NC_STEERING 0x200
4131 #define HT_CAP_TXBF_CAP_EXPLICIT_C_STEERING 0x400
4132 #define HT_CAP_TXBF_CAP_EXPLICIT_CSI_FB_MASK 0x1800
4133 #define HT_CAP_TXBF_CAP_EXPLICIT_CSI_FB_SHIFT 11
4134 #define HT_CAP_TXBF_CAP_EXPLICIT_NC_FB_MASK 0x6000
4135 #define HT_CAP_TXBF_CAP_EXPLICIT_NC_FB_SHIFT 13
4136 #define HT_CAP_TXBF_CAP_EXPLICIT_C_FB_MASK 0x18000
4137 #define HT_CAP_TXBF_CAP_EXPLICIT_C_FB_SHIFT 15
4138 #define HT_CAP_TXBF_CAP_CSI_BFR_ANT_SHIFT 19
4139 #define HT_CAP_TXBF_CAP_NC_BFR_ANT_SHIFT 21
4140 #define HT_CAP_TXBF_CAP_C_BFR_ANT_SHIFT 23
4141 #define HT_CAP_TXBF_CAP_C_BFR_ANT_MASK 0x1800000
4142 
4143 #define HT_CAP_TXBF_CAP_CHAN_ESTIM_SHIFT 27
4144 #define HT_CAP_TXBF_CAP_CHAN_ESTIM_MASK 0x18000000
4145 
4146 #define HT_CAP_TXBF_FB_TYPE_NONE 0
4147 #define HT_CAP_TXBF_FB_TYPE_DELAYED 1
4148 #define HT_CAP_TXBF_FB_TYPE_IMMEDIATE 2
4149 #define HT_CAP_TXBF_FB_TYPE_BOTH 3
4150 
4151 #define HT_CAP_TX_BF_CAP_EXPLICIT_CSI_FB_MASK 0x400
4152 #define HT_CAP_TX_BF_CAP_EXPLICIT_CSI_FB_SHIFT 10
4153 #define HT_CAP_TX_BF_CAP_EXPLICIT_COMPRESSED_FB_MASK 0x18000
4154 #define HT_CAP_TX_BF_CAP_EXPLICIT_COMPRESSED_FB_SHIFT 15
4155 
4156 #define HT_CAP_MCS_FLAGS_SUPP_BYTE                                             \
4157     12 /* byte offset in HT Cap Supported MCS for various flags */
4158 #define HT_CAP_MCS_RX_8TO15_BYTE_OFFSET 1
4159 #define HT_CAP_MCS_FLAGS_TX_RX_UNEQUAL 0x02
4160 #define HT_CAP_MCS_FLAGS_MAX_SPATIAL_STREAM_MASK 0x0C
4161 
4162 #define VHT_MAX_MPDU 11454     /* max mpdu size for now (bytes) */
4163 #define VHT_MPDU_MSDU_DELTA 56 /* Difference in spec - vht mpdu, amsdu len */
4164 /* Max AMSDU len - per spec */
4165 #define VHT_MAX_AMSDU (VHT_MAX_MPDU - VHT_MPDU_MSDU_DELTA)
4166 
4167 #define HT_MAX_AMSDU 7935 /* max amsdu size (bytes) per the HT spec */
4168 #define HT_MIN_AMSDU 3835 /* min amsdu size (bytes) per the HT spec */
4169 
4170 #define HT_PARAMS_RX_FACTOR_MASK 0x03 /* ampdu rcv factor mask */
4171 #define HT_PARAMS_DENSITY_MASK 0x1C   /* ampdu density mask */
4172 #define HT_PARAMS_DENSITY_SHIFT 2     /* ampdu density shift */
4173 
4174 /* HT/AMPDU specific define */
4175 #define AMPDU_MAX_MPDU_DENSITY 7  /* max mpdu density; in 1/4 usec units */
4176 #define AMPDU_DENSITY_NONE 0      /* No density requirement */
4177 #define AMPDU_DENSITY_1over4_US 1 /* 1/4 us density */
4178 #define AMPDU_DENSITY_1over2_US 2 /* 1/2 us density */
4179 #define AMPDU_DENSITY_1_US 3      /*   1 us density */
4180 #define AMPDU_DENSITY_2_US 4      /*   2 us density */
4181 #define AMPDU_DENSITY_4_US 5      /*   4 us density */
4182 #define AMPDU_DENSITY_8_US 6      /*   8 us density */
4183 #define AMPDU_DENSITY_16_US 7     /*  16 us density */
4184 #define AMPDU_RX_FACTOR_8K 0      /* max rcv ampdu len (8kb) */
4185 #define AMPDU_RX_FACTOR_16K 1     /* max rcv ampdu len (16kb) */
4186 #define AMPDU_RX_FACTOR_32K 2     /* max rcv ampdu len (32kb) */
4187 #define AMPDU_RX_FACTOR_64K 3     /* max rcv ampdu len (64kb) */
4188 
4189 /* AMPDU RX factors for VHT rates */
4190 #define AMPDU_RX_FACTOR_128K 4  /* max rcv ampdu len (128kb) */
4191 #define AMPDU_RX_FACTOR_256K 5  /* max rcv ampdu len (256kb) */
4192 #define AMPDU_RX_FACTOR_512K 6  /* max rcv ampdu len (512kb) */
4193 #define AMPDU_RX_FACTOR_1024K 7 /* max rcv ampdu len (1024kb) */
4194 
4195 #define AMPDU_RX_FACTOR_BASE 8 * 1024 /* ampdu factor base for rx len */
4196 #define AMPDU_RX_FACTOR_BASE_PWR                                               \
4197     13 /* ampdu factor base for rx len in power of 2 */
4198 
4199 #define AMPDU_DELIMITER_LEN 4u /* length of ampdu delimiter */
4200 #define AMPDU_DELIMITER_LEN_MAX                                                \
4201     63 /* max length of ampdu delimiter(enforced in HW) */
4202 
4203 #define HT_CAP_EXT_PCO 0x0001
4204 #define HT_CAP_EXT_PCO_TTIME_MASK 0x0006
4205 #define HT_CAP_EXT_PCO_TTIME_SHIFT 1
4206 #define HT_CAP_EXT_MCS_FEEDBACK_MASK 0x0300
4207 #define HT_CAP_EXT_MCS_FEEDBACK_SHIFT 8
4208 #define HT_CAP_EXT_HTC 0x0400
4209 #define HT_CAP_EXT_RD_RESP 0x0800
4210 
4211 /** 'ht_add' is called 'HT Operation' information element in the 802.11 standard
4212  */
4213 BWL_PRE_PACKED_STRUCT struct ht_add_ie {
4214     uint8 ctl_ch;                /* control channel number */
4215     uint8 byte1;                 /* ext ch,rec. ch. width, RIFS support */
4216     uint16 opmode;               /* operation mode */
4217     uint16 misc_bits;            /* misc bits */
4218     uint8 basic_mcs[MCSSET_LEN]; /* required MCS set */
4219 } BWL_POST_PACKED_STRUCT;
4220 typedef struct ht_add_ie ht_add_ie_t;
4221 
4222 /* ADD IE: HT 1.0 spec. simply stole a 802.11 IE, we use our prop. IE until this
4223  * is resolved */
4224 /* the additional IE is primarily used to convey the current BSS configuration
4225  */
4226 BWL_PRE_PACKED_STRUCT struct ht_prop_add_ie {
4227     uint8 id;  /* IE ID, 221, DOT11_MNG_PROPR_ID */
4228     uint8 len; /* IE length */
4229     uint8 oui[3];
4230     uint8 type; /* indicates what follows */
4231     ht_add_ie_t add_ie;
4232 } BWL_POST_PACKED_STRUCT;
4233 typedef struct ht_prop_add_ie ht_prop_add_ie_t;
4234 
4235 #define HT_ADD_IE_LEN 22
4236 #define HT_ADD_IE_TYPE 52
4237 
4238 /* byte1 defn's */
4239 #define HT_BW_ANY 0x04         /* set, STA can use 20 or 40MHz */
4240 #define HT_RIFS_PERMITTED 0x08 /* RIFS allowed */
4241 
4242 /* opmode defn's */
4243 #define HT_OPMODE_MASK 0x0003     /* protection mode mask */
4244 #define HT_OPMODE_SHIFT 0         /* protection mode shift */
4245 #define HT_OPMODE_PURE 0x0000     /* protection mode PURE */
4246 #define HT_OPMODE_OPTIONAL 0x0001 /* protection mode optional */
4247 #define HT_OPMODE_HT20IN40 0x0002 /* protection mode 20MHz HT in 40MHz BSS */
4248 #define HT_OPMODE_MIXED 0x0003    /* protection mode Mixed Mode */
4249 #define HT_OPMODE_NONGF 0x0004    /* protection mode non-GF */
4250 #define DOT11N_TXBURST 0x0008     /* Tx burst limit */
4251 #define DOT11N_OBSS_NONHT 0x0010  /* OBSS Non-HT STA present */
4252 #define HT_OPMODE_CCFS2_MASK                                                   \
4253     0x1fe0                      /* Channel Center Frequency Segment 2 mask */
4254 #define HT_OPMODE_CCFS2_SHIFT 5 /* Channel Center Frequency Segment 2 shift */
4255 
4256 /* misc_bites defn's */
4257 #define HT_BASIC_STBC_MCS 0x007f     /* basic STBC MCS */
4258 #define HT_DUAL_STBC_PROT 0x0080     /* Dual STBC Protection */
4259 #define HT_SECOND_BCN 0x0100         /* Secondary beacon support */
4260 #define HT_LSIG_TXOP 0x0200          /* L-SIG TXOP Protection full support */
4261 #define HT_PCO_ACTIVE 0x0400         /* PCO active */
4262 #define HT_PCO_PHASE 0x0800          /* PCO phase */
4263 #define HT_DUALCTS_PROTECTION 0x0080 /* DUAL CTS protection needed */
4264 
4265 /* Tx Burst Limits */
4266 #define DOT11N_2G_TXBURST_LIMIT                                                \
4267     6160 /* 2G band Tx burst limit per 802.11n Draft 1.10 (usec) */
4268 #define DOT11N_5G_TXBURST_LIMIT                                                \
4269     3080 /* 5G band Tx burst limit per 802.11n Draft 1.10 (usec) */
4270 
4271 /* Macros for opmode */
4272 #define GET_HT_OPMODE(add_ie)                                                  \
4273     ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) >> HT_OPMODE_SHIFT)
4274 #define HT_MIXEDMODE_PRESENT(add_ie)                                           \
4275     ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) ==                          \
4276      HT_OPMODE_MIXED) /* mixed mode present */
4277 #define HT_HT20_PRESENT(add_ie)                                                \
4278     ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) ==                          \
4279      HT_OPMODE_HT20IN40) /* 20MHz HT present */
4280 #define HT_OPTIONAL_PRESENT(add_ie)                                            \
4281     ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) ==                          \
4282      HT_OPMODE_OPTIONAL) /* Optional protection present */
4283 #define HT_USE_PROTECTION(add_ie)                                              \
4284     (HT_HT20_PRESENT((add_ie)) ||                                              \
4285      HT_MIXEDMODE_PRESENT((add_ie))) /* use protection */
4286 #define HT_NONGF_PRESENT(add_ie)                                               \
4287     ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_NONGF) ==                         \
4288      HT_OPMODE_NONGF) /* non-GF present */
4289 #define DOT11N_TXBURST_PRESENT(add_ie)                                         \
4290     ((ltoh16_ua(&add_ie->opmode) & DOT11N_TXBURST) ==                          \
4291      DOT11N_TXBURST) /* Tx Burst present */
4292 #define DOT11N_OBSS_NONHT_PRESENT(add_ie)                                      \
4293     ((ltoh16_ua(&add_ie->opmode) & DOT11N_OBSS_NONHT) ==                       \
4294      DOT11N_OBSS_NONHT) /* OBSS Non-HT present */
4295 #define HT_OPMODE_CCFS2_GET(add_ie)                                            \
4296     ((ltoh16_ua(&(add_ie)->opmode) & HT_OPMODE_CCFS2_MASK) >>                  \
4297      HT_OPMODE_CCFS2_SHIFT) /* get CCFS2 */
4298 #define HT_OPMODE_CCFS2_SET(add_ie, ccfs2)                                     \
4299     do { /* set CCFS2 */                                                       \
4300         (add_ie)->opmode &= htol16(~HT_OPMODE_CCFS2_MASK);                     \
4301         (add_ie)->opmode |=                                                    \
4302             htol16(((ccfs2) << HT_OPMODE_CCFS2_SHIFT) & HT_OPMODE_CCFS2_MASK); \
4303     } while (0)
4304 
4305 /* Macros for HT MCS field access */
4306 #define HT_CAP_MCS_BITMASK(supp_mcs)                                           \
4307     ((supp_mcs)[HT_CAP_MCS_RX_8TO15_BYTE_OFFSET])
4308 #define HT_CAP_MCS_TX_RX_UNEQUAL(supp_mcs)                                     \
4309     ((supp_mcs)[HT_CAP_MCS_FLAGS_SUPP_BYTE] & HT_CAP_MCS_FLAGS_TX_RX_UNEQUAL)
4310 #define HT_CAP_MCS_TX_STREAM_SUPPORT(supp_mcs)                                 \
4311     ((supp_mcs)[HT_CAP_MCS_FLAGS_SUPP_BYTE] &                                  \
4312      HT_CAP_MCS_FLAGS_MAX_SPATIAL_STREAM_MASK)
4313 
4314 BWL_PRE_PACKED_STRUCT struct obss_params {
4315     uint16 passive_dwell;
4316     uint16 active_dwell;
4317     uint16 bss_widthscan_interval;
4318     uint16 passive_total;
4319     uint16 active_total;
4320     uint16 chanwidth_transition_dly;
4321     uint16 activity_threshold;
4322 } BWL_POST_PACKED_STRUCT;
4323 typedef struct obss_params obss_params_t;
4324 
4325 BWL_PRE_PACKED_STRUCT struct dot11_obss_ie {
4326     uint8 id;
4327     uint8 len;
4328     obss_params_t obss_params;
4329 } BWL_POST_PACKED_STRUCT;
4330 typedef struct dot11_obss_ie dot11_obss_ie_t;
4331 #define DOT11_OBSS_SCAN_IE_LEN                                                 \
4332     sizeof(obss_params_t) /* HT OBSS len (based on 802.11n d3.0) */
4333 
4334 /* HT control field */
4335 #define HT_CTRL_LA_TRQ 0x00000002 /* sounding request */
4336 #define HT_CTRL_LA_MAI                                                         \
4337     0x0000003C /* MCS request or antenna selection indication */
4338 #define HT_CTRL_LA_MAI_SHIFT 2
4339 #define HT_CTRL_LA_MAI_MRQ 0x00000004 /* MCS request */
4340 #define HT_CTRL_LA_MAI_MSI 0x00000038 /* MCS request sequence identifier */
4341 #define HT_CTRL_LA_MFSI 0x000001C0    /* MFB sequence identifier */
4342 #define HT_CTRL_LA_MFSI_SHIFT 6
4343 #define HT_CTRL_LA_MFB_ASELC                                                   \
4344     0x0000FE00 /* MCS feedback, antenna selection command/data */
4345 #define HT_CTRL_LA_MFB_ASELC_SH 9
4346 #define HT_CTRL_LA_ASELC_CMD 0x00000C00  /* ASEL command */
4347 #define HT_CTRL_LA_ASELC_DATA 0x0000F000 /* ASEL data */
4348 #define HT_CTRL_CAL_POS 0x00030000       /* Calibration position */
4349 #define HT_CTRL_CAL_SEQ 0x000C0000       /* Calibration sequence */
4350 #define HT_CTRL_CSI_STEERING 0x00C00000  /* CSI/Steering */
4351 #define HT_CTRL_CSI_STEER_SHIFT 22
4352 #define HT_CTRL_CSI_STEER_NFB 0          /* no fedback required */
4353 #define HT_CTRL_CSI_STEER_CSI 1          /* CSI, H matrix */
4354 #define HT_CTRL_CSI_STEER_NCOM 2         /* non-compressed beamforming */
4355 #define HT_CTRL_CSI_STEER_COM 3          /* compressed beamforming */
4356 #define HT_CTRL_NDP_ANNOUNCE 0x01000000  /* NDP announcement */
4357 #define HT_CTRL_AC_CONSTRAINT 0x40000000 /* AC Constraint */
4358 #define HT_CTRL_RDG_MOREPPDU 0x80000000  /* RDG/More PPDU */
4359 
4360 /* ************* VHT definitions. ************* */
4361 
4362 /**
4363  * VHT Capabilites IE (sec 8.4.2.160)
4364  */
4365 
4366 BWL_PRE_PACKED_STRUCT struct vht_cap_ie {
4367     uint32 vht_cap_info;
4368     /* supported MCS set - 64 bit field */
4369     uint16 rx_mcs_map;
4370     uint16 rx_max_rate;
4371     uint16 tx_mcs_map;
4372     uint16 tx_max_rate;
4373 } BWL_POST_PACKED_STRUCT;
4374 typedef struct vht_cap_ie vht_cap_ie_t;
4375 
4376 /* 4B cap_info + 8B supp_mcs */
4377 #define VHT_CAP_IE_LEN 12
4378 
4379 /* VHT Capabilities Info field - 32bit - in VHT Cap IE */
4380 #define VHT_CAP_INFO_MAX_MPDU_LEN_MASK 0x00000003
4381 #define VHT_CAP_INFO_SUPP_CHAN_WIDTH_MASK 0x0000000c
4382 #define VHT_CAP_INFO_LDPC 0x00000010
4383 #define VHT_CAP_INFO_SGI_80MHZ 0x00000020
4384 #define VHT_CAP_INFO_SGI_160MHZ 0x00000040
4385 #define VHT_CAP_INFO_TX_STBC 0x00000080
4386 #define VHT_CAP_INFO_RX_STBC_MASK 0x00000700
4387 #define VHT_CAP_INFO_RX_STBC_SHIFT 8
4388 #define VHT_CAP_INFO_SU_BEAMFMR 0x00000800
4389 #define VHT_CAP_INFO_SU_BEAMFMEE 0x00001000
4390 #define VHT_CAP_INFO_NUM_BMFMR_ANT_MASK 0x0000e000
4391 #define VHT_CAP_INFO_NUM_BMFMR_ANT_SHIFT 13
4392 #define VHT_CAP_INFO_NUM_SOUNDING_DIM_MASK 0x00070000
4393 #define VHT_CAP_INFO_NUM_SOUNDING_DIM_SHIFT 16
4394 #define VHT_CAP_INFO_MU_BEAMFMR 0x00080000
4395 #define VHT_CAP_INFO_MU_BEAMFMEE 0x00100000
4396 #define VHT_CAP_INFO_TXOPPS 0x00200000
4397 #define VHT_CAP_INFO_HTCVHT 0x00400000
4398 #define VHT_CAP_INFO_AMPDU_MAXLEN_EXP_MASK 0x03800000
4399 #define VHT_CAP_INFO_AMPDU_MAXLEN_EXP_SHIFT 23
4400 #define VHT_CAP_INFO_LINK_ADAPT_CAP_MASK 0x0c000000
4401 #define VHT_CAP_INFO_LINK_ADAPT_CAP_SHIFT 26
4402 #define VHT_CAP_INFO_EXT_NSS_BW_SUP_MASK 0xc0000000
4403 #define VHT_CAP_INFO_EXT_NSS_BW_SUP_SHIFT 30
4404 
4405 /* get Extended NSS BW Support passing vht cap info */
4406 #define VHT_CAP_EXT_NSS_BW_SUP(cap_info)                                       \
4407     (((cap_info)&VHT_CAP_INFO_EXT_NSS_BW_SUP_MASK) >>                          \
4408      VHT_CAP_INFO_EXT_NSS_BW_SUP_SHIFT)
4409 
4410 /* VHT CAP INFO extended NSS BW support - refer to IEEE 802.11 REVmc D8.0 Figure
4411  * 9-559 */
4412 #define VHT_CAP_INFO_EXT_NSS_BW_HALF_160 1 /* 160MHz at half NSS CAP */
4413 #define VHT_CAP_INFO_EXT_NSS_BW_HALF_160_80P80                                 \
4414     2 /* 160 & 80p80 MHz at half NSS CAP */
4415 
4416 /* VHT Supported MCS Set - 64-bit - in VHT Cap IE */
4417 #define VHT_CAP_SUPP_MCS_RX_HIGHEST_RATE_MASK 0x1fff
4418 #define VHT_CAP_SUPP_MCS_RX_HIGHEST_RATE_SHIFT 0
4419 #define VHT_CAP_SUPP_CHAN_WIDTH_SHIFT 5
4420 
4421 #define VHT_CAP_SUPP_MCS_TX_HIGHEST_RATE_MASK 0x1fff
4422 #define VHT_CAP_SUPP_MCS_TX_HIGHEST_RATE_SHIFT 0
4423 
4424 /* defines for field(s) in vht_cap_ie->rx_max_rate */
4425 #define VHT_CAP_MAX_NSTS_MASK 0xe000
4426 #define VHT_CAP_MAX_NSTS_SHIFT 13
4427 
4428 /* defines for field(s) in vht_cap_ie->tx_max_rate */
4429 #define VHT_CAP_EXT_NSS_BW_CAP 0x2000
4430 
4431 #define VHT_CAP_MCS_MAP_0_7 0
4432 #define VHT_CAP_MCS_MAP_0_8 1
4433 #define VHT_CAP_MCS_MAP_0_9 2
4434 #define VHT_CAP_MCS_MAP_NONE 3
4435 #define VHT_CAP_MCS_MAP_S 2   /* num bits for 1-stream */
4436 #define VHT_CAP_MCS_MAP_M 0x3 /* mask for 1-stream */
4437 /* assumes VHT_CAP_MCS_MAP_NONE is 3 and 2 bits are used for encoding */
4438 #define VHT_CAP_MCS_MAP_NONE_ALL 0xffff
4439 
4440 /* VHT rates bitmap */
4441 #define VHT_CAP_MCS_0_7_RATEMAP 0x00ff
4442 #define VHT_CAP_MCS_0_8_RATEMAP 0x01ff
4443 #define VHT_CAP_MCS_0_9_RATEMAP 0x03ff
4444 #define VHT_CAP_MCS_FULL_RATEMAP VHT_CAP_MCS_0_9_RATEMAP
4445 
4446 #define VHT_PROP_MCS_MAP_10_11 0
4447 #define VHT_PROP_MCS_MAP_UNUSED1 1
4448 #define VHT_PROP_MCS_MAP_UNUSED2 2
4449 #define VHT_PROP_MCS_MAP_NONE 3
4450 #define VHT_PROP_MCS_MAP_NONE_ALL 0xffff
4451 
4452 /* VHT prop rates bitmap */
4453 #define VHT_PROP_MCS_10_11_RATEMAP 0x0c00
4454 #define VHT_PROP_MCS_FULL_RATEMAP VHT_PROP_MCS_10_11_RATEMAP
4455 
4456 #if !defined(VHT_CAP_MCS_MAP_0_9_NSS3)
4457 /* mcsmap with MCS0-9 for Nss = 3 */
4458 #define VHT_CAP_MCS_MAP_0_9_NSS3                                               \
4459     ((VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(1)) |                      \
4460      (VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(2)) |                      \
4461      (VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(3)))
4462 #endif /* !VHT_CAP_MCS_MAP_0_9_NSS3 */
4463 
4464 #define VHT_CAP_MCS_MAP_NSS_MAX 8
4465 
4466 /* get mcsmap with given mcs for given nss streams */
4467 #define VHT_CAP_MCS_MAP_CREATE(mcsmap, nss, mcs)                               \
4468     do {                                                                       \
4469         int i;                                                                 \
4470         for (i = 1; i <= nss; i++) {                                           \
4471             VHT_MCS_MAP_SET_MCS_PER_SS(i, mcs, mcsmap);                        \
4472         }                                                                      \
4473     } while (0)
4474 
4475 /* Map the mcs code to mcs bit map */
4476 #define VHT_MCS_CODE_TO_MCS_MAP(mcs_code)                                      \
4477     ((mcs_code == VHT_CAP_MCS_MAP_0_7)   ? VHT_CAP_MCS_0_7_RATEMAP             \
4478      : (mcs_code == VHT_CAP_MCS_MAP_0_8) ? VHT_CAP_MCS_0_8_RATEMAP             \
4479      : (mcs_code == VHT_CAP_MCS_MAP_0_9) ? VHT_CAP_MCS_0_9_RATEMAP             \
4480                                          : 0)
4481 
4482 #define VHT_PROP_MCS_CODE_TO_PROP_MCS_MAP(mcs_code)                            \
4483     ((mcs_code == VHT_PROP_MCS_MAP_10_11) ? VHT_PROP_MCS_10_11_RATEMAP : 0)
4484 
4485 /* Map the mcs bit map to mcs code */
4486 #define VHT_MCS_MAP_TO_MCS_CODE(mcs_map)                                       \
4487     ((mcs_map == VHT_CAP_MCS_0_7_RATEMAP)   ? VHT_CAP_MCS_MAP_0_7              \
4488      : (mcs_map == VHT_CAP_MCS_0_8_RATEMAP) ? VHT_CAP_MCS_MAP_0_8              \
4489      : (mcs_map == VHT_CAP_MCS_0_9_RATEMAP) ? VHT_CAP_MCS_MAP_0_9              \
4490                                             : VHT_CAP_MCS_MAP_NONE)
4491 
4492 #define VHT_PROP_MCS_MAP_TO_PROP_MCS_CODE(mcs_map)                             \
4493     (((mcs_map & 0xc00) == 0xc00) ? VHT_PROP_MCS_MAP_10_11                     \
4494                                   : VHT_PROP_MCS_MAP_NONE)
4495 
4496 /** VHT Capabilities Supported Channel Width */
4497 typedef enum vht_cap_chan_width {
4498     VHT_CAP_CHAN_WIDTH_SUPPORT_MANDATORY = 0x00,
4499     VHT_CAP_CHAN_WIDTH_SUPPORT_160 = 0x04,
4500     VHT_CAP_CHAN_WIDTH_SUPPORT_160_8080 = 0x08
4501 } vht_cap_chan_width_t;
4502 
4503 /** VHT Capabilities Supported max MPDU LEN (sec 8.4.2.160.2) */
4504 typedef enum vht_cap_max_mpdu_len {
4505     VHT_CAP_MPDU_MAX_4K = 0x00,
4506     VHT_CAP_MPDU_MAX_8K = 0x01,
4507     VHT_CAP_MPDU_MAX_11K = 0x02
4508 } vht_cap_max_mpdu_len_t;
4509 
4510 /* Maximum MPDU Length byte counts for the VHT Capabilities advertised limits */
4511 #define VHT_MPDU_LIMIT_4K 3895
4512 #define VHT_MPDU_LIMIT_8K 7991
4513 #define VHT_MPDU_LIMIT_11K 11454
4514 
4515 /**
4516  * VHT Operation IE (sec 8.4.2.161)
4517  */
4518 
4519 BWL_PRE_PACKED_STRUCT struct vht_op_ie {
4520     uint8 chan_width;
4521     uint8 chan1;
4522     uint8 chan2;
4523     uint16 supp_mcs; /*  same def as above in vht cap */
4524 } BWL_POST_PACKED_STRUCT;
4525 typedef struct vht_op_ie vht_op_ie_t;
4526 
4527 /* 3B VHT Op info + 2B Basic MCS */
4528 #define VHT_OP_IE_LEN 5
4529 
4530 typedef enum vht_op_chan_width {
4531     VHT_OP_CHAN_WIDTH_20_40 = 0,
4532     VHT_OP_CHAN_WIDTH_80 = 1,
4533     VHT_OP_CHAN_WIDTH_160 =
4534         2, /* deprecated - IEEE 802.11 REVmc D8.0 Table 11-25 */
4535     VHT_OP_CHAN_WIDTH_80_80 =
4536         3 /* deprecated - IEEE 802.11 REVmc D8.0 Table 11-25 */
4537 } vht_op_chan_width_t;
4538 
4539 #define VHT_OP_INFO_LEN 3
4540 
4541 /* AID length */
4542 #define AID_IE_LEN 2
4543 /**
4544  * BRCM vht features IE header
4545  * The header if the fixed part of the IE
4546  * On the 5GHz band this is the entire IE,
4547  * on 2.4GHz the VHT IEs as defined in the 802.11ac
4548  * specification follows
4549  *
4550  *
4551  * VHT features rates  bitmap.
4552  * Bit0:		5G MCS 0-9 BW 160MHz
4553  * Bit1:		5G MCS 0-9 support BW 80MHz
4554  * Bit2:		5G MCS 0-9 support BW 20MHz
4555  * Bit3:		2.4G MCS 0-9 support BW 20MHz
4556  * Bits:4-7	Reserved for future use
4557  *
4558  */
4559 #define VHT_FEATURES_IE_TYPE 0x4
4560 BWL_PRE_PACKED_STRUCT struct vht_features_ie_hdr {
4561     uint8 oui[3];
4562     uint8 type;      /* type of this IE = 4 */
4563     uint8 rate_mask; /* VHT rate mask */
4564 } BWL_POST_PACKED_STRUCT;
4565 typedef struct vht_features_ie_hdr vht_features_ie_hdr_t;
4566 
4567 /* Def for rx & tx basic mcs maps - ea ss num has 2 bits of info */
4568 #define VHT_MCS_MAP_GET_SS_IDX(nss) (((nss)-1) * VHT_CAP_MCS_MAP_S)
4569 #define VHT_MCS_MAP_GET_MCS_PER_SS(nss, mcsMap)                                \
4570     (((mcsMap) >> VHT_MCS_MAP_GET_SS_IDX(nss)) & VHT_CAP_MCS_MAP_M)
4571 #define VHT_MCS_MAP_SET_MCS_PER_SS(nss, numMcs, mcsMap)                        \
4572     do {                                                                       \
4573         (mcsMap) &= (~(VHT_CAP_MCS_MAP_M << VHT_MCS_MAP_GET_SS_IDX(nss)));     \
4574         (mcsMap) |=                                                            \
4575             (((numMcs)&VHT_CAP_MCS_MAP_M) << VHT_MCS_MAP_GET_SS_IDX(nss));     \
4576     } while (0)
4577 #define VHT_MCS_SS_SUPPORTED(nss, mcsMap)                                      \
4578     (VHT_MCS_MAP_GET_MCS_PER_SS((nss), (mcsMap)) != VHT_CAP_MCS_MAP_NONE)
4579 
4580 /* Get the max ss supported from the mcs map */
4581 #define VHT_MAX_SS_SUPPORTED(mcsMap)                                           \
4582     VHT_MCS_SS_SUPPORTED(8, mcsMap)   ? 8                                      \
4583     : VHT_MCS_SS_SUPPORTED(7, mcsMap) ? 7                                      \
4584     : VHT_MCS_SS_SUPPORTED(6, mcsMap) ? 6                                      \
4585     : VHT_MCS_SS_SUPPORTED(5, mcsMap) ? 5                                      \
4586     : VHT_MCS_SS_SUPPORTED(4, mcsMap) ? 4                                      \
4587     : VHT_MCS_SS_SUPPORTED(3, mcsMap) ? 3                                      \
4588     : VHT_MCS_SS_SUPPORTED(2, mcsMap) ? 2                                      \
4589     : VHT_MCS_SS_SUPPORTED(1, mcsMap) ? 1                                      \
4590                                       : 0
4591 
4592 #ifdef IBSS_RMC
4593 /* customer's OUI */
4594 #define RMC_PROP_OUI "\x00\x16\x32"
4595 #endif // endif
4596 
4597 /* ************* WPA definitions. ************* */
4598 #define WPA_OUI "\x00\x50\xF2" /* WPA OUI */
4599 #define WPA_OUI_LEN 3          /* WPA OUI length */
4600 #define WPA_OUI_TYPE 1
4601 #define WPA_VERSION 1     /* WPA version */
4602 #define WPA_VERSION_LEN 2 /* WPA version length */
4603 
4604 /* ************* WPA2 definitions. ************* */
4605 #define WPA2_OUI "\x00\x0F\xAC"                 /* WPA2 OUI */
4606 #define WPA2_OUI_LEN 3                          /* WPA2 OUI length */
4607 #define WPA2_VERSION 1                          /* WPA2 version */
4608 #define WPA2_VERSION_LEN 2                      /* WAP2 version length */
4609 #define MAX_RSNE_SUPPORTED_VERSION WPA2_VERSION /* Max supported version */
4610 
4611 /* ************* WPS definitions. ************* */
4612 #define WPS_OUI "\x00\x50\xF2" /* WPS OUI */
4613 #define WPS_OUI_LEN 3          /* WPS OUI length */
4614 #define WPS_OUI_TYPE 4
4615 
4616 /* ************* TPC definitions. ************* */
4617 #define TPC_OUI "\x00\x50\xF2" /* TPC OUI */
4618 #define TPC_OUI_LEN 3          /* TPC OUI length */
4619 #define TPC_OUI_TYPE 8
4620 #define WFA_OUI_TYPE_TPC 8 /* deprecated */
4621 
4622 /* ************* WFA definitions. ************* */
4623 #define WFA_OUI "\x50\x6F\x9A" /* WFA OUI */
4624 #define WFA_OUI_LEN 3          /* WFA OUI length */
4625 #define WFA_OUI_TYPE_P2P 9
4626 
4627 #ifdef WL_LEGACY_P2P
4628 #define APPLE_OUI "\x00\x17\xF2" /* MACOSX OUI */
4629 #define APPLE_OUI_LEN 3
4630 #define APPLE_OUI_TYPE_P2P 5
4631 #endif /* WL_LEGACY_P2P */
4632 
4633 #ifndef WL_LEGACY_P2P
4634 #define P2P_OUI WFA_OUI
4635 #define P2P_OUI_LEN WFA_OUI_LEN
4636 #define P2P_OUI_TYPE WFA_OUI_TYPE_P2P
4637 #else
4638 #define P2P_OUI APPLE_OUI
4639 #define P2P_OUI_LEN APPLE_OUI_LEN
4640 #define P2P_OUI_TYPE APPLE_OUI_TYPE_P2P
4641 #endif /* !WL_LEGACY_P2P */
4642 
4643 #ifdef WLTDLS
4644 #define WFA_OUI_TYPE_TPQ 4 /* WFD Tunneled Probe ReQuest */
4645 #define WFA_OUI_TYPE_TPS 5 /* WFD Tunneled Probe ReSponse */
4646 #define WFA_OUI_TYPE_WFD 10
4647 #endif /* WTDLS */
4648 #define WFA_OUI_TYPE_HS20 0x10
4649 #define WFA_OUI_TYPE_OSEN 0x12
4650 #define WFA_OUI_TYPE_NAN 0x13
4651 #define WFA_OUI_TYPE_MBO 0x16
4652 #define WFA_OUI_TYPE_MBO_OCE 0x16
4653 
4654 /* RSN authenticated key managment suite */
4655 #define RSN_AKM_NONE 0        /* None (IBSS) */
4656 #define RSN_AKM_UNSPECIFIED 1 /* Over 802.1x */
4657 #define RSN_AKM_PSK 2         /* Pre-shared Key */
4658 #define RSN_AKM_FBT_1X 3      /* Fast Bss transition using 802.1X */
4659 #define RSN_AKM_FBT_PSK 4     /* Fast Bss transition using Pre-shared Key */
4660 /* RSN_AKM_MFP_1X and RSN_AKM_MFP_PSK are not used any more
4661  * Just kept here to avoid build issue in BISON/CARIBOU branch
4662  */
4663 #define RSN_AKM_MFP_1X 5     /* SHA256 key derivation, using 802.1X */
4664 #define RSN_AKM_MFP_PSK 6    /* SHA256 key derivation, using Pre-shared Key */
4665 #define RSN_AKM_SHA256_1X 5  /* SHA256 key derivation, using 802.1X */
4666 #define RSN_AKM_SHA256_PSK 6 /* SHA256 key derivation, using Pre-shared Key */
4667 #define RSN_AKM_TPK 7        /* TPK(TDLS Peer Key) handshake */
4668 #define RSN_AKM_SAE_PSK 8    /* AKM for SAE with 4-way handshake */
4669 #define RSN_AKM_SAE_FBT 9    /* AKM for SAE with FBT */
4670 #define RSN_AKM_SUITEB_SHA256_1X 11 /* Suite B SHA256 */
4671 #define RSN_AKM_SUITEB_SHA384_1X 12 /* Suite B-192 SHA384 */
4672 #define RSN_AKM_FBT_SHA384_1X 13    /* FBT SHA384 */
4673 #define RSN_AKM_FILS_SHA256 14      /* SHA256 key derivation, using FILS */
4674 #define RSN_AKM_FILS_SHA384 15      /* SHA384 key derivation, using FILS */
4675 #define RSN_AKM_FBT_SHA256_FILS 16
4676 #define RSN_AKM_FBT_SHA384_FILS 17
4677 #define RSN_AKM_OWE 18 /* RFC 8110  OWE */
4678 #define RSN_AKM_FBT_SHA384_PSK 19
4679 #define RSN_AKM_PSK_SHA384 20
4680 /* OSEN authenticated key managment suite */
4681 #define OSEN_AKM_UNSPECIFIED RSN_AKM_UNSPECIFIED /* Over 802.1x */
4682 
4683 /* Key related defines */
4684 #define DOT11_MAX_DEFAULT_KEYS 4 /* number of default keys */
4685 #define DOT11_MAX_IGTK_KEYS 2
4686 #define DOT11_MAX_KEY_SIZE 32      /* max size of any key */
4687 #define DOT11_MAX_IV_SIZE 16       /* max size of any IV */
4688 #define DOT11_EXT_IV_FLAG (1 << 5) /* flag to indicate IV is > 4 bytes */
4689 #define DOT11_WPA_KEY_RSC_LEN 8    /* WPA RSC key len */
4690 
4691 #define WEP1_KEY_SIZE 5        /* max size of any WEP key */
4692 #define WEP1_KEY_HEX_SIZE 10   /* size of WEP key in hex. */
4693 #define WEP128_KEY_SIZE 13     /* max size of any WEP key */
4694 #define WEP128_KEY_HEX_SIZE 26 /* size of WEP key in hex. */
4695 #define TKIP_MIC_SIZE 8        /* size of TKIP MIC */
4696 #define TKIP_EOM_SIZE 7        /* max size of TKIP EOM */
4697 #define TKIP_EOM_FLAG 0x5a     /* TKIP EOM flag byte */
4698 #define TKIP_KEY_SIZE 32       /* size of any TKIP key, includs MIC keys */
4699 #define TKIP_TK_SIZE 16
4700 #define TKIP_MIC_KEY_SIZE 8
4701 #define TKIP_MIC_AUTH_TX 16 /* offset to Authenticator MIC TX key */
4702 #define TKIP_MIC_AUTH_RX 24 /* offset to Authenticator MIC RX key */
4703 #define TKIP_MIC_SUP_RX TKIP_MIC_AUTH_TX /* offset to Supplicant MIC RX key */
4704 #define TKIP_MIC_SUP_TX TKIP_MIC_AUTH_RX /* offset to Supplicant MIC TX key */
4705 #define AES_KEY_SIZE 16                  /* size of AES key */
4706 #define AES_MIC_SIZE 8                   /* size of AES MIC */
4707 #define BIP_KEY_SIZE 16                  /* size of BIP key */
4708 #define BIP_MIC_SIZE 8                   /* sizeof BIP MIC */
4709 
4710 #define AES_GCM_MIC_SIZE 16 /* size of MIC for 128-bit GCM - .11adD9 */
4711 
4712 #define AES256_KEY_SIZE 32 /* size of AES 256 key - .11acD5 */
4713 #define AES256_MIC_SIZE 16 /* size of MIC for 256 bit keys, incl BIP */
4714 
4715 /* WCN */
4716 #define WCN_OUI "\x00\x50\xf2" /* WCN OUI */
4717 #define WCN_TYPE 4             /* WCN type */
4718 
4719 #ifdef BCMWAPI_WPI
4720 #define SMS4_KEY_LEN 16
4721 #define SMS4_WPI_CBC_MAC_LEN 16
4722 #endif // endif
4723 
4724 /* 802.11r protocol definitions */
4725 
4726 /** Mobility Domain IE */
4727 BWL_PRE_PACKED_STRUCT struct dot11_mdid_ie {
4728     uint8 id;
4729     uint8 len;   /* DOT11_MDID_IE_DATA_LEN (3) */
4730     uint16 mdid; /* Mobility Domain Id */
4731     uint8 cap;
4732 } BWL_POST_PACKED_STRUCT;
4733 typedef struct dot11_mdid_ie dot11_mdid_ie_t;
4734 
4735 /* length of data portion of Mobility Domain IE */
4736 #define DOT11_MDID_IE_DATA_LEN 3
4737 #define DOT11_MDID_LEN 2
4738 #define FBT_MDID_CAP_OVERDS 0x01 /* Fast Bss transition over the DS support */
4739 #define FBT_MDID_CAP_RRP 0x02    /* Resource request protocol support */
4740 
4741 /* Fast Bss Transition IE */
4742 #ifdef FT_IE_VER_V2
4743 typedef BWL_PRE_PACKED_STRUCT struct dot11_ft_ie_v2 {
4744     uint8 id;
4745     uint8 len;
4746     uint16 mic_control;
4747     /* dynamic offset to following mic[], anonce[], snonce[] */
4748 } BWL_POST_PACKED_STRUCT dot11_ft_ie_v2;
4749 typedef struct dot11_ft_ie_v2 dot11_ft_ie_t;
4750 #else
4751 BWL_PRE_PACKED_STRUCT struct dot11_ft_ie {
4752     uint8 id;
4753     uint8 len;          /* At least equal to DOT11_FT_IE_FIXED_LEN (82) */
4754     uint16 mic_control; /* Mic Control */
4755     uint8 mic[16];
4756     uint8 anonce[32];
4757     uint8 snonce[32];
4758     /* Optional sub-elements follow */
4759 } BWL_POST_PACKED_STRUCT;
4760 typedef struct dot11_ft_ie dot11_ft_ie_t;
4761 
4762 /* Fixed length of data portion of Fast BSS Transition IE. There could be
4763  * optional parameters, which if present, could raise the FT IE length to 255.
4764  */
4765 #define DOT11_FT_IE_FIXED_LEN 82
4766 #endif /* FT_IE_VER_V2 */
4767 
4768 #ifdef FT_IE_VER_V2
4769 #define DOT11_FT_IE_LEN(mic_len)                                               \
4770     (sizeof(dot11_ft_ie_v2) + mic_len + EAPOL_WPA_KEY_NONCE_LEN * 2)
4771 #define FT_IE_MIC(pos) ((uint8 *)pos + sizeof(dot11_ft_ie_v2))
4772 #define FT_IE_ANONCE(pos, mic_len)                                             \
4773     ((uint8 *)pos + sizeof(dot11_ft_ie_v2) + mic_len)
4774 #define FT_IE_SNONCE(pos, mic_len)                                             \
4775     ((uint8 *)pos + sizeof(dot11_ft_ie_v2) + mic_len + EAPOL_WPA_KEY_NONCE_LEN)
4776 #else
4777 #define DOT11_FT_IE_LEN(mic_len) sizeof(dot11_ft_ie)
4778 #define FT_IE_MIC(pos) ((uint8 *)&pos->mic)
4779 #define FT_IE_ANONCE(pos, mic_len) ((uint8 *)&pos->anonce)
4780 #define FT_IE_SNONCE(pos, mic_len) ((uint8 *)&pos->snonce)
4781 #endif /* FT_IE_VER_V2 */
4782 #define TIE_TYPE_RESERVED 0
4783 #define TIE_TYPE_REASSOC_DEADLINE 1
4784 #define TIE_TYPE_KEY_LIEFTIME 2
4785 #define TIE_TYPE_ASSOC_COMEBACK 3
4786 BWL_PRE_PACKED_STRUCT struct dot11_timeout_ie {
4787     uint8 id;
4788     uint8 len;
4789     uint8 type;   /* timeout interval type */
4790     uint32 value; /* timeout interval value */
4791 } BWL_POST_PACKED_STRUCT;
4792 typedef struct dot11_timeout_ie dot11_timeout_ie_t;
4793 
4794 /** GTK ie */
4795 BWL_PRE_PACKED_STRUCT struct dot11_gtk_ie {
4796     uint8 id;
4797     uint8 len;
4798     uint16 key_info;
4799     uint8 key_len;
4800     uint8 rsc[8];
4801     uint8 data[1];
4802 } BWL_POST_PACKED_STRUCT;
4803 typedef struct dot11_gtk_ie dot11_gtk_ie_t;
4804 
4805 /** Management MIC ie */
4806 BWL_PRE_PACKED_STRUCT struct mmic_ie {
4807     uint8 id;      /* IE ID: DOT11_MNG_MMIE_ID */
4808     uint8 len;     /* IE length */
4809     uint16 key_id; /* key id */
4810     uint8 ipn[6];  /* ipn */
4811     uint8 mic[16]; /* mic */
4812 } BWL_POST_PACKED_STRUCT;
4813 typedef struct mmic_ie mmic_ie_t;
4814 
4815 /* 802.11r-2008, 11A.10.3 - RRB frame format */
4816 BWL_PRE_PACKED_STRUCT struct dot11_ft_rrb_frame {
4817     uint8 frame_type;  /* 1 for RRB */
4818     uint8 packet_type; /* 0 for Request 1 for Response */
4819     uint16 len;
4820     uint8 cur_ap_addr[ETHER_ADDR_LEN];
4821     uint8 data[1]; /* IEs Received/Sent in FT Action Req/Resp Frame */
4822 } BWL_POST_PACKED_STRUCT;
4823 
4824 typedef struct dot11_ft_rrb_frame dot11_ft_rrb_frame_t;
4825 
4826 #define DOT11_FT_RRB_FIXED_LEN 10
4827 #define DOT11_FT_REMOTE_FRAME_TYPE 1
4828 #define DOT11_FT_PACKET_REQ 0
4829 #define DOT11_FT_PACKET_RESP 1
4830 
4831 #define BSSID_INVALID "\x00\x00\x00\x00\x00\x00"
4832 #define BSSID_BROADCAST "\xFF\xFF\xFF\xFF\xFF\xFF"
4833 
4834 #ifdef BCMWAPI_WAI
4835 #define WAPI_IE_MIN_LEN 20         /* WAPI IE min length */
4836 #define WAPI_VERSION 1             /* WAPI version */
4837 #define WAPI_VERSION_LEN 2         /* WAPI version length */
4838 #define WAPI_OUI "\x00\x14\x72"    /* WAPI OUI */
4839 #define WAPI_OUI_LEN DOT11_OUI_LEN /* WAPI OUI length */
4840 #endif                             /* BCMWAPI_WAI */
4841 
4842 /* ************* WMM Parameter definitions. ************* */
4843 #define WMM_OUI "\x00\x50\xF2" /* WNN OUI */
4844 #define WMM_OUI_LEN 3          /* WMM OUI length */
4845 #define WMM_OUI_TYPE 2         /* WMM OUT type */
4846 #define WMM_VERSION 1
4847 #define WMM_VERSION_LEN 1
4848 
4849 /* WMM OUI subtype */
4850 #define WMM_OUI_SUBTYPE_PARAMETER 1
4851 #define WMM_PARAMETER_IE_LEN 24
4852 
4853 /** Link Identifier Element */
4854 BWL_PRE_PACKED_STRUCT struct link_id_ie {
4855     uint8 id;
4856     uint8 len;
4857     struct ether_addr bssid;
4858     struct ether_addr tdls_init_mac;
4859     struct ether_addr tdls_resp_mac;
4860 } BWL_POST_PACKED_STRUCT;
4861 typedef struct link_id_ie link_id_ie_t;
4862 #define TDLS_LINK_ID_IE_LEN 18u
4863 
4864 /** Link Wakeup Schedule Element */
4865 BWL_PRE_PACKED_STRUCT struct wakeup_sch_ie {
4866     uint8 id;
4867     uint8 len;
4868     uint32 offset;   /* in ms between TSF0 and start of 1st Awake Window */
4869     uint32 interval; /* in ms bwtween the start of 2 Awake Windows */
4870     uint32 awake_win_slots; /* in backof slots, duration of Awake Window */
4871     uint32 max_wake_win;    /* in ms, max duration of Awake Window */
4872     uint16 idle_cnt;        /* number of consecutive Awake Windows */
4873 } BWL_POST_PACKED_STRUCT;
4874 typedef struct wakeup_sch_ie wakeup_sch_ie_t;
4875 #define TDLS_WAKEUP_SCH_IE_LEN 18
4876 
4877 /** Channel Switch Timing Element */
4878 BWL_PRE_PACKED_STRUCT struct channel_switch_timing_ie {
4879     uint8 id;
4880     uint8 len;
4881     uint16 switch_time;    /* in ms, time to switch channels */
4882     uint16 switch_timeout; /* in ms */
4883 } BWL_POST_PACKED_STRUCT;
4884 typedef struct channel_switch_timing_ie channel_switch_timing_ie_t;
4885 #define TDLS_CHANNEL_SWITCH_TIMING_IE_LEN 4
4886 
4887 /** PTI Control Element */
4888 BWL_PRE_PACKED_STRUCT struct pti_control_ie {
4889     uint8 id;
4890     uint8 len;
4891     uint8 tid;
4892     uint16 seq_control;
4893 } BWL_POST_PACKED_STRUCT;
4894 typedef struct pti_control_ie pti_control_ie_t;
4895 #define TDLS_PTI_CONTROL_IE_LEN 3
4896 
4897 /** PU Buffer Status Element */
4898 BWL_PRE_PACKED_STRUCT struct pu_buffer_status_ie {
4899     uint8 id;
4900     uint8 len;
4901     uint8 status;
4902 } BWL_POST_PACKED_STRUCT;
4903 typedef struct pu_buffer_status_ie pu_buffer_status_ie_t;
4904 #define TDLS_PU_BUFFER_STATUS_IE_LEN 1
4905 #define TDLS_PU_BUFFER_STATUS_AC_BK 1
4906 #define TDLS_PU_BUFFER_STATUS_AC_BE 2
4907 #define TDLS_PU_BUFFER_STATUS_AC_VI 4
4908 #define TDLS_PU_BUFFER_STATUS_AC_VO 8
4909 
4910 /* TDLS Action Field Values */
4911 #define TDLS_SETUP_REQ 0
4912 #define TDLS_SETUP_RESP 1
4913 #define TDLS_SETUP_CONFIRM 2
4914 #define TDLS_TEARDOWN 3
4915 #define TDLS_PEER_TRAFFIC_IND 4
4916 #define TDLS_CHANNEL_SWITCH_REQ 5
4917 #define TDLS_CHANNEL_SWITCH_RESP 6
4918 #define TDLS_PEER_PSM_REQ 7
4919 #define TDLS_PEER_PSM_RESP 8
4920 #define TDLS_PEER_TRAFFIC_RESP 9
4921 #define TDLS_DISCOVERY_REQ 10
4922 
4923 /* 802.11z TDLS Public Action Frame action field */
4924 #define TDLS_DISCOVERY_RESP 14
4925 
4926 /* 802.11u GAS action frames */
4927 #define GAS_REQUEST_ACTION_FRAME 10
4928 #define GAS_RESPONSE_ACTION_FRAME 11
4929 #define GAS_COMEBACK_REQUEST_ACTION_FRAME 12
4930 #define GAS_COMEBACK_RESPONSE_ACTION_FRAME 13
4931 
4932 /* FTM - fine timing measurement public action frames */
4933 BWL_PRE_PACKED_STRUCT struct dot11_ftm_req {
4934     uint8 category; /* category of action frame (4) */
4935     uint8 action;   /* public action (32) */
4936     uint8 trigger;  /* trigger/continue? */
4937                     /* optional lci, civic loc, ftm params */
4938 } BWL_POST_PACKED_STRUCT;
4939 typedef struct dot11_ftm_req dot11_ftm_req_t;
4940 
4941 BWL_PRE_PACKED_STRUCT struct dot11_ftm {
4942     uint8 category;   /* category of action frame (4) */
4943     uint8 action;     /* public action (33) */
4944     uint8 dialog;     /* dialog token */
4945     uint8 follow_up;  /* follow up dialog token */
4946     uint8 tod[6];     /* t1 - last depart timestamp */
4947     uint8 toa[6];     /* t4 - last ack arrival timestamp */
4948     uint8 tod_err[2]; /* t1 error */
4949     uint8 toa_err[2]; /* t4 error */
4950                       /* optional lci report, civic loc report, ftm params */
4951 } BWL_POST_PACKED_STRUCT;
4952 typedef struct dot11_ftm dot11_ftm_t;
4953 
4954 #define DOT11_FTM_ERR_NOT_CONT_OFFSET 1
4955 #define DOT11_FTM_ERR_NOT_CONT_MASK 0x80
4956 #define DOT11_FTM_ERR_NOT_CONT_SHIFT 7
4957 #define DOT11_FTM_ERR_NOT_CONT(_err)                                           \
4958     (((_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET] & DOT11_FTM_ERR_NOT_CONT_MASK) >>  \
4959      DOT11_FTM_ERR_NOT_CONT_SHIFT)
4960 #define DOT11_FTM_ERR_SET_NOT_CONT(_err, _val)                                 \
4961     do {                                                                       \
4962         uint8 _err2 = (_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET];                   \
4963         _err2 &= ~DOT11_FTM_ERR_NOT_CONT_MASK;                                 \
4964         _err2 |= ((_val) << DOT11_FTM_ERR_NOT_CONT_SHIFT) &                    \
4965                  DOT11_FTM_ERR_NOT_CONT_MASK;                                  \
4966         (_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET] = _err2;                         \
4967     } while (0)
4968 
4969 #define DOT11_FTM_ERR_MAX_ERR_OFFSET 0
4970 #define DOT11_FTM_ERR_MAX_ERR_MASK 0x7fff
4971 #define DOT11_FTM_ERR_MAX_ERR_SHIFT 0
4972 #define DOT11_FTM_ERR_MAX_ERR(_err) (((((_err)[1] & 0x7f) << 8) | (_err)[0]))
4973 #define DOT11_FTM_ERR_SET_MAX_ERR(_err, _val)                                  \
4974     do {                                                                       \
4975         uint16 _val2;                                                          \
4976         uint16 _not_cont;                                                      \
4977         _val2 = (((_val)&DOT11_FTM_ERR_MAX_ERR_MASK)                           \
4978                  << DOT11_FTM_ERR_MAX_ERR_SHIFT);                              \
4979         _val2 = (_val2 > 0x3fff) ? 0 : _val2; /* not expecting > 16ns error */ \
4980         _not_cont = DOT11_FTM_ERR_NOT_CONT(_err);                              \
4981         (_err)[0] = _val2 & 0xff;                                              \
4982         (_err)[1] = (_val2 >> 8) & 0xff;                                       \
4983         DOT11_FTM_ERR_SET_NOT_CONT(_err, _not_cont);                           \
4984     } while (0)
4985 
4986 #if defined(DOT11_FTM_ERR_ROM_COMPAT)
4987 /* incorrect defs - here for ROM compatibiity */
4988 #undef DOT11_FTM_ERR_NOT_CONT_OFFSET
4989 #undef DOT11_FTM_ERR_NOT_CONT_MASK
4990 #undef DOT11_FTM_ERR_NOT_CONT_SHIFT
4991 #undef DOT11_FTM_ERR_NOT_CONT
4992 #undef DOT11_FTM_ERR_SET_NOT_CONT
4993 
4994 #define DOT11_FTM_ERR_NOT_CONT_OFFSET 0
4995 #define DOT11_FTM_ERR_NOT_CONT_MASK 0x0001
4996 #define DOT11_FTM_ERR_NOT_CONT_SHIFT 0
4997 #define DOT11_FTM_ERR_NOT_CONT(_err)                                           \
4998     (((_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET] & DOT11_FTM_ERR_NOT_CONT_MASK) >>  \
4999      DOT11_FTM_ERR_NOT_CONT_SHIFT)
5000 #define DOT11_FTM_ERR_SET_NOT_CONT(_err, _val)                                 \
5001     do {                                                                       \
5002         uint8 _err2 = (_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET];                   \
5003         _err2 &= ~DOT11_FTM_ERR_NOT_CONT_MASK;                                 \
5004         _err2 |= ((_val) << DOT11_FTM_ERR_NOT_CONT_SHIFT) &                    \
5005                  DOT11_FTM_ERR_NOT_CONT_MASK;                                  \
5006         (_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET] = _err2;                         \
5007     } while (0)
5008 
5009 #undef DOT11_FTM_ERR_MAX_ERR_OFFSET
5010 #undef DOT11_FTM_ERR_MAX_ERR_MASK
5011 #undef DOT11_FTM_ERR_MAX_ERR_SHIFT
5012 #undef DOT11_FTM_ERR_MAX_ERR
5013 #undef DOT11_FTM_ERR_SET_MAX_ERR
5014 
5015 #define DOT11_FTM_ERR_MAX_ERR_OFFSET 0
5016 #define DOT11_FTM_ERR_MAX_ERR_MASK 0xfff7
5017 #define DOT11_FTM_ERR_MAX_ERR_SHIFT 1
5018 #define DOT11_FTM_ERR_MAX_ERR(_err) ((((_err)[1] << 7) | (_err)[0]) >> 1)
5019 #define DOT11_FTM_ERR_SET_MAX_ERR(_err, _val)                                  \
5020     do {                                                                       \
5021         uint16 _val2;                                                          \
5022         _val2 = (((_val) << DOT11_FTM_ERR_MAX_ERR_SHIFT) |                     \
5023                  ((_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET] &                      \
5024                   DOT11_FTM_ERR_NOT_CONT_MASK));                               \
5025         (_err)[0] = _val2 & 0xff;                                              \
5026         (_err)[1] = _val2 >> 8 & 0xff;                                         \
5027     } while (0)
5028 #endif /* DOT11_FTM_ERR_ROM_COMPAT */
5029 
5030 BWL_PRE_PACKED_STRUCT struct dot11_ftm_params {
5031     uint8 id; /* DOT11_MNG_FTM_PARAM_ID 8.4.2.166 11mcd2.6/2014 - revisit */
5032     uint8 len;
5033     uint8 info[9];
5034 } BWL_POST_PACKED_STRUCT;
5035 typedef struct dot11_ftm_params dot11_ftm_params_t;
5036 #define DOT11_FTM_PARAMS_IE_LEN (sizeof(dot11_ftm_params_t) - 2)
5037 
5038 #define FTM_PARAMS_FIELD(_p, _off, _mask, _shift)                              \
5039     (((_p)->info[(_off)] & (_mask)) >> (_shift))
5040 #define FTM_PARAMS_SET_FIELD(_p, _off, _mask, _shift, _val)                    \
5041     do {                                                                       \
5042         uint8 _ptmp = (_p)->info[_off] & ~(_mask);                             \
5043         (_p)->info[(_off)] = _ptmp | (((_val) << (_shift)) & (_mask));         \
5044     } while (0)
5045 
5046 #define FTM_PARAMS_STATUS_OFFSET 0
5047 #define FTM_PARAMS_STATUS_MASK 0x03
5048 #define FTM_PARAMS_STATUS_SHIFT 0
5049 #define FTM_PARAMS_STATUS(_p)                                                  \
5050     FTM_PARAMS_FIELD(_p, FTM_PARAMS_STATUS_OFFSET, FTM_PARAMS_STATUS_MASK,     \
5051                      FTM_PARAMS_STATUS_SHIFT)
5052 #define FTM_PARAMS_SET_STATUS(_p, _status)                                     \
5053     FTM_PARAMS_SET_FIELD(_p, FTM_PARAMS_STATUS_OFFSET, FTM_PARAMS_STATUS_MASK, \
5054                          FTM_PARAMS_STATUS_SHIFT, _status)
5055 
5056 #define FTM_PARAMS_VALUE_OFFSET 0
5057 #define FTM_PARAMS_VALUE_MASK 0x7c
5058 #define FTM_PARAMS_VALUE_SHIFT 2
5059 #define FTM_PARAMS_VALUE(_p)                                                   \
5060     FTM_PARAMS_FIELD(_p, FTM_PARAMS_VALUE_OFFSET, FTM_PARAMS_VALUE_MASK,       \
5061                      FTM_PARAMS_VALUE_SHIFT)
5062 #define FTM_PARAMS_SET_VALUE(_p, _value)                                       \
5063     FTM_PARAMS_SET_FIELD(_p, FTM_PARAMS_VALUE_OFFSET, FTM_PARAMS_VALUE_MASK,   \
5064                          FTM_PARAMS_VALUE_SHIFT, _value)
5065 #define FTM_PARAMS_MAX_VALUE 32
5066 
5067 #define FTM_PARAMS_NBURSTEXP_OFFSET 1
5068 #define FTM_PARAMS_NBURSTEXP_MASK 0x0f
5069 #define FTM_PARAMS_NBURSTEXP_SHIFT 0
5070 #define FTM_PARAMS_NBURSTEXP(_p)                                               \
5071     FTM_PARAMS_FIELD(_p, FTM_PARAMS_NBURSTEXP_OFFSET,                          \
5072                      FTM_PARAMS_NBURSTEXP_MASK, FTM_PARAMS_NBURSTEXP_SHIFT)
5073 #define FTM_PARAMS_SET_NBURSTEXP(_p, _bexp)                                    \
5074     FTM_PARAMS_SET_FIELD(_p, FTM_PARAMS_NBURSTEXP_OFFSET,                      \
5075                          FTM_PARAMS_NBURSTEXP_MASK,                            \
5076                          FTM_PARAMS_NBURSTEXP_SHIFT, _bexp)
5077 
5078 #define FTM_PARAMS_NBURST(_p) (1 << FTM_PARAMS_NBURSTEXP(_p))
5079 
5080 enum { FTM_PARAMS_NBURSTEXP_NOPREF = 15 };
5081 
5082 enum { FTM_PARAMS_BURSTTMO_NOPREF = 15 };
5083 
5084 #define FTM_PARAMS_BURSTTMO_OFFSET 1
5085 #define FTM_PARAMS_BURSTTMO_MASK 0xf0
5086 #define FTM_PARAMS_BURSTTMO_SHIFT 4
5087 #define FTM_PARAMS_BURSTTMO(_p)                                                \
5088     FTM_PARAMS_FIELD(_p, FTM_PARAMS_BURSTTMO_OFFSET, FTM_PARAMS_BURSTTMO_MASK, \
5089                      FTM_PARAMS_BURSTTMO_SHIFT)
5090 /* set timeout in params using _tmo where timeout = 2^(_tmo) * 250us */
5091 #define FTM_PARAMS_SET_BURSTTMO(_p, _tmo)                                      \
5092     FTM_PARAMS_SET_FIELD(_p, FTM_PARAMS_BURSTTMO_OFFSET,                       \
5093                          FTM_PARAMS_BURSTTMO_MASK, FTM_PARAMS_BURSTTMO_SHIFT,  \
5094                          (_tmo) + 2)
5095 
5096 #define FTM_PARAMS_BURSTTMO_USEC(_val) ((1 << ((_val)-2)) * 250)
5097 #define FTM_PARAMS_BURSTTMO_VALID(_val)                                        \
5098     ((((_val) < 12 && (_val) > 1)) || (_val) == FTM_PARAMS_BURSTTMO_NOPREF)
5099 #define FTM_PARAMS_BURSTTMO_MAX_MSEC 128    /* 2^9 * 250us */
5100 #define FTM_PARAMS_BURSTTMO_MAX_USEC 128000 /* 2^9 * 250us */
5101 
5102 #define FTM_PARAMS_MINDELTA_OFFSET 2
5103 #define FTM_PARAMS_MINDELTA_USEC(_p)                                           \
5104     ((_p)->info[FTM_PARAMS_MINDELTA_OFFSET] * 100)
5105 #define FTM_PARAMS_SET_MINDELTA_USEC(_p, _delta)                               \
5106     do {                                                                       \
5107         (_p)->info[FTM_PARAMS_MINDELTA_OFFSET] = (_delta) / 100;               \
5108     } while (0)
5109 
5110 enum { FTM_PARAMS_MINDELTA_NOPREF = 0 };
5111 
5112 #define FTM_PARAMS_PARTIAL_TSF(_p) ((_p)->info[4] << 8 | (_p)->info[3])
5113 #define FTM_PARAMS_SET_PARTIAL_TSF(_p, _partial_tsf)                           \
5114     do {                                                                       \
5115         (_p)->info[3] = (_partial_tsf)&0xff;                                   \
5116         (_p)->info[4] = ((_partial_tsf) >> 8) & 0xff;                          \
5117     } while (0)
5118 
5119 #define FTM_PARAMS_PARTIAL_TSF_MASK 0x0000000003fffc00ULL
5120 #define FTM_PARAMS_PARTIAL_TSF_SHIFT 10
5121 #define FTM_PARAMS_PARTIAL_TSF_BIT_LEN 16
5122 #define FTM_PARAMS_PARTIAL_TSF_MAX 0xffff
5123 
5124 /* FTM can indicate upto 62k TUs forward and 1k TU backward */
5125 #define FTM_PARAMS_TSF_FW_HI (63487 << 10)  /* in micro sec */
5126 #define FTM_PARAMS_TSF_BW_LOW (64512 << 10) /* in micro sec */
5127 #define FTM_PARAMS_TSF_BW_HI (65535 << 10)  /* in micro sec */
5128 #define FTM_PARAMS_TSF_FW_MAX FTM_PARAMS_TSF_FW_HI
5129 #define FTM_PARAMS_TSF_BW_MAX (FTM_PARAMS_TSF_BW_HI - FTM_PARAMS_TSF_BW_LOW)
5130 
5131 #define FTM_PARAMS_PTSFNOPREF_OFFSET 5
5132 #define FTM_PARAMS_PTSFNOPREF_MASK 0x1
5133 #define FTM_PARAMS_PTSFNOPREF_SHIFT 0
5134 #define FTM_PARAMS_PTSFNOPREF(_p)                                              \
5135     FTM_PARAMS_FIELD(_p, FTM_PARAMS_PTSFNOPREF_OFFSET,                         \
5136                      FTM_PARAMS_PTSFNOPREF_MASK, FTM_PARAMS_PTSFNOPREF_SHIFT)
5137 #define FTM_PARAMS_SET_PTSFNOPREF(_p, _nopref)                                 \
5138     FTM_PARAMS_SET_FIELD(_p, FTM_PARAMS_PTSFNOPREF_OFFSET,                     \
5139                          FTM_PARAMS_PTSFNOPREF_MASK,                           \
5140                          FTM_PARAMS_PTSFNOPREF_SHIFT, _nopref)
5141 
5142 #define FTM_PARAMS_ASAP_OFFSET 5
5143 #define FTM_PARAMS_ASAP_MASK 0x4
5144 #define FTM_PARAMS_ASAP_SHIFT 2
5145 #define FTM_PARAMS_ASAP(_p)                                                    \
5146     FTM_PARAMS_FIELD(_p, FTM_PARAMS_ASAP_OFFSET, FTM_PARAMS_ASAP_MASK,         \
5147                      FTM_PARAMS_ASAP_SHIFT)
5148 #define FTM_PARAMS_SET_ASAP(_p, _asap)                                         \
5149     FTM_PARAMS_SET_FIELD(_p, FTM_PARAMS_ASAP_OFFSET, FTM_PARAMS_ASAP_MASK,     \
5150                          FTM_PARAMS_ASAP_SHIFT, _asap)
5151 
5152 /* FTM1 - AKA ASAP Capable */
5153 #define FTM_PARAMS_FTM1_OFFSET 5
5154 #define FTM_PARAMS_FTM1_MASK 0x02
5155 #define FTM_PARAMS_FTM1_SHIFT 1
5156 #define FTM_PARAMS_FTM1(_p)                                                    \
5157     FTM_PARAMS_FIELD(_p, FTM_PARAMS_FTM1_OFFSET, FTM_PARAMS_FTM1_MASK,         \
5158                      FTM_PARAMS_FTM1_SHIFT)
5159 #define FTM_PARAMS_SET_FTM1(_p, _ftm1)                                         \
5160     FTM_PARAMS_SET_FIELD(_p, FTM_PARAMS_FTM1_OFFSET, FTM_PARAMS_FTM1_MASK,     \
5161                          FTM_PARAMS_FTM1_SHIFT, _ftm1)
5162 
5163 #define FTM_PARAMS_FTMS_PER_BURST_OFFSET 5
5164 #define FTM_PARAMS_FTMS_PER_BURST_MASK 0xf8
5165 #define FTM_PARAMS_FTMS_PER_BURST_SHIFT 3
5166 #define FTM_PARAMS_FTMS_PER_BURST(_p)                                          \
5167     FTM_PARAMS_FIELD(_p, FTM_PARAMS_FTMS_PER_BURST_OFFSET,                     \
5168                      FTM_PARAMS_FTMS_PER_BURST_MASK,                           \
5169                      FTM_PARAMS_FTMS_PER_BURST_SHIFT)
5170 #define FTM_PARAMS_SET_FTMS_PER_BURST(_p, _nftms)                              \
5171     FTM_PARAMS_SET_FIELD(_p, FTM_PARAMS_FTMS_PER_BURST_OFFSET,                 \
5172                          FTM_PARAMS_FTMS_PER_BURST_MASK,                       \
5173                          FTM_PARAMS_FTMS_PER_BURST_SHIFT, _nftms)
5174 
5175 enum { FTM_PARAMS_FTMS_PER_BURST_NOPREF = 0 };
5176 
5177 #define FTM_PARAMS_CHAN_INFO_OFFSET 6
5178 #define FTM_PARAMS_CHAN_INFO_MASK 0xfc
5179 #define FTM_PARAMS_CHAN_INFO_SHIFT 2
5180 #define FTM_PARAMS_CHAN_INFO(_p)                                               \
5181     FTM_PARAMS_FIELD(_p, FTM_PARAMS_CHAN_INFO_OFFSET,                          \
5182                      FTM_PARAMS_CHAN_INFO_MASK, FTM_PARAMS_CHAN_INFO_SHIFT)
5183 #define FTM_PARAMS_SET_CHAN_INFO(_p, _ci)                                      \
5184     FTM_PARAMS_SET_FIELD(_p, FTM_PARAMS_CHAN_INFO_OFFSET,                      \
5185                          FTM_PARAMS_CHAN_INFO_MASK,                            \
5186                          FTM_PARAMS_CHAN_INFO_SHIFT, _ci)
5187 
5188 /* burst period - units of 100ms */
5189 #define FTM_PARAMS_BURST_PERIOD(_p) (((_p)->info[8] << 8) | (_p)->info[7])
5190 #define FTM_PARAMS_SET_BURST_PERIOD(_p, _bp)                                   \
5191     do {                                                                       \
5192         (_p)->info[7] = (_bp)&0xff;                                            \
5193         (_p)->info[8] = ((_bp) >> 8) & 0xff;                                   \
5194     } while (0)
5195 
5196 #define FTM_PARAMS_BURST_PERIOD_MS(_p) (FTM_PARAMS_BURST_PERIOD(_p) * 100)
5197 
5198 enum { FTM_PARAMS_BURST_PERIOD_NOPREF = 0 };
5199 
5200 /* FTM status values - last updated from 11mcD4.0 */
5201 enum {
5202     FTM_PARAMS_STATUS_RESERVED = 0,
5203     FTM_PARAMS_STATUS_SUCCESSFUL = 1,
5204     FTM_PARAMS_STATUS_INCAPABLE = 2,
5205     FTM_PARAMS_STATUS_FAILED = 3,
5206     /* Below are obsolte */
5207     FTM_PARAMS_STATUS_OVERRIDDEN = 4,
5208     FTM_PARAMS_STATUS_ASAP_INCAPABLE = 5,
5209     FTM_PARAMS_STATUS_ASAP_FAILED = 6,
5210     /* rest are reserved */
5211 };
5212 
5213 enum {
5214     FTM_PARAMS_CHAN_INFO_NO_PREF = 0,
5215     FTM_PARAMS_CHAN_INFO_RESERVE1 = 1,
5216     FTM_PARAMS_CHAN_INFO_RESERVE2 = 2,
5217     FTM_PARAMS_CHAN_INFO_RESERVE3 = 3,
5218     FTM_PARAMS_CHAN_INFO_NON_HT_5 = 4,
5219     FTM_PARAMS_CHAN_INFO_RESERVE5 = 5,
5220     FTM_PARAMS_CHAN_INFO_NON_HT_10 = 6,
5221     FTM_PARAMS_CHAN_INFO_RESERVE7 = 7,
5222     FTM_PARAMS_CHAN_INFO_NON_HT_20 = 8, /* excludes 2.4G, and High rate DSSS */
5223     FTM_PARAMS_CHAN_INFO_HT_MF_20 = 9,
5224     FTM_PARAMS_CHAN_INFO_VHT_20 = 10,
5225     FTM_PARAMS_CHAN_INFO_HT_MF_40 = 11,
5226     FTM_PARAMS_CHAN_INFO_VHT_40 = 12,
5227     FTM_PARAMS_CHAN_INFO_VHT_80 = 13,
5228     FTM_PARAMS_CHAN_INFO_VHT_80_80 = 14,
5229     FTM_PARAMS_CHAN_INFO_VHT_160_2_RFLOS = 15,
5230     FTM_PARAMS_CHAN_INFO_VHT_160 = 16,
5231     /* Reserved from 17 - 30 */
5232     FTM_PARAMS_CHAN_INFO_DMG_2160 = 31,
5233     /* Reserved from 32 - 63 */
5234     FTM_PARAMS_CHAN_INFO_MAX = 63
5235 };
5236 
5237 /* tag_ID/length/value_buffer tuple */
5238 typedef BWL_PRE_PACKED_STRUCT struct {
5239     uint8 id;
5240     uint8 len;
5241     uint8 data[1];
5242 } BWL_POST_PACKED_STRUCT ftm_vs_tlv_t;
5243 
5244 BWL_PRE_PACKED_STRUCT struct dot11_ftm_vs_ie {
5245     uint8 id;       /* DOT11_MNG_VS_ID */
5246     uint8 len;      /* length following */
5247     uint8 oui[3];   /* BRCM_PROP_OUI (or Customer) */
5248     uint8 sub_type; /* BRCM_FTM_IE_TYPE (or Customer) */
5249     uint8 version;
5250     ftm_vs_tlv_t tlvs[1];
5251 } BWL_POST_PACKED_STRUCT;
5252 typedef struct dot11_ftm_vs_ie dot11_ftm_vs_ie_t;
5253 
5254 /* same as payload of dot11_ftm_vs_ie.
5255  * This definition helps in having struct access
5256  * of pay load while building FTM VS IE from other modules(NAN)
5257  */
5258 BWL_PRE_PACKED_STRUCT struct dot11_ftm_vs_ie_pyld {
5259     uint8 sub_type; /* BRCM_FTM_IE_TYPE (or Customer) */
5260     uint8 version;
5261     ftm_vs_tlv_t tlvs[1];
5262 } BWL_POST_PACKED_STRUCT;
5263 typedef struct dot11_ftm_vs_ie_pyld dot11_ftm_vs_ie_pyld_t;
5264 
5265 /* ftm vs api version */
5266 #define BCM_FTM_VS_PARAMS_VERSION 0x01
5267 
5268 /* ftm vendor specific information tlv types */
5269 enum {
5270     FTM_VS_TLV_NONE = 0,
5271     FTM_VS_TLV_REQ_PARAMS = 1, /* additional request params (in FTM_REQ) */
5272     FTM_VS_TLV_MEAS_INFO = 2,  /* measurement information (in FTM_MEAS) */
5273     FTM_VS_TLV_SEC_PARAMS = 3, /* security parameters (in either) */
5274     FTM_VS_TLV_SEQ_PARAMS =
5275         4,                 /* toast parameters (FTM_REQ, BRCM proprietary) */
5276     FTM_VS_TLV_MF_BUF = 5, /* multi frame buffer - may span ftm vs ie's */
5277     FTM_VS_TLV_TIMING_PARAMS = 6, /* timing adjustments */
5278     FTM_VS_TLV_MF_STATS_BUF = 7   /* multi frame statistics buffer */
5279                                   /* add additional types above */
5280 };
5281 
5282 /* the following definitions are *DEPRECATED* and moved to implemenetion files.
5283  * They are retained here because previous (May 2016) some branches use them
5284  */
5285 #define FTM_TPK_LEN 16
5286 #define FTM_RI_RR_BUF_LEN 32
5287 #define FTM_TPK_RI_RR_LEN 13
5288 #define FTM_TPK_RI_RR_LEN_SECURE_2_0 28
5289 #define FTM_TPK_DIGEST_LEN 32
5290 #define FTM_TPK_BUFFER_LEN 128
5291 #define FTM_TPK_RI_PHY_LEN 7
5292 #define FTM_TPK_RR_PHY_LEN 7
5293 #define FTM_TPK_DATA_BUFFER_LEN 88
5294 #define FTM_TPK_LEN_SECURE_2_0 32
5295 #define FTM_TPK_RI_PHY_LEN_SECURE_2_0 14
5296 #define FTM_TPK_RR_PHY_LEN_SECURE_2_0 14
5297 
5298 BWL_PRE_PACKED_STRUCT struct dot11_ftm_vs_params {
5299     uint8 id; /* DOT11_MNG_VS_ID */
5300     uint8 len;
5301     uint8 oui[3]; /* Proprietary OUI, BRCM_PROP_OUI */
5302     uint8 bcm_vs_id;
5303     ftm_vs_tlv_t ftm_tpk_ri_rr[1]; /* ftm_TPK_ri_rr place holder */
5304 } BWL_POST_PACKED_STRUCT;
5305 typedef struct dot11_ftm_vs_params dot11_ftm_vs_tpk_ri_rr_params_t;
5306 #define DOT11_FTM_VS_LEN (sizeof(dot11_ftm_vs_tpk_ri_rr_params_t) - TLV_HDR_LEN)
5307 /* end *DEPRECATED* ftm definitions */
5308 
5309 BWL_PRE_PACKED_STRUCT struct dot11_ftm_sync_info {
5310     uint8 id; /* Extended - 255 11mc D4.3  */
5311     uint8 len;
5312     uint8 id_ext;
5313     uint8 tsf_sync_info[4];
5314 } BWL_POST_PACKED_STRUCT;
5315 typedef struct dot11_ftm_sync_info dot11_ftm_sync_info_t;
5316 
5317 /* ftm tsf sync info ie len - includes id ext */
5318 #define DOT11_FTM_SYNC_INFO_IE_LEN (sizeof(dot11_ftm_sync_info_t) - TLV_HDR_LEN)
5319 
5320 #define DOT11_FTM_IS_SYNC_INFO_IE(_ie)                                         \
5321     (DOT11_MNG_IE_ID_EXT_MATCH(_ie, DOT11_MNG_FTM_SYNC_INFO) &&                \
5322      (_ie)->len == DOT11_FTM_SYNC_INFO_IE_LEN)
5323 
5324 BWL_PRE_PACKED_STRUCT struct dot11_dh_param_ie {
5325     uint8 id; /* OWE */
5326     uint8 len;
5327     uint8 ext_id; /* EXT_MNG_OWE_DH_PARAM_ID */
5328     uint16 group;
5329     uint8 pub_key[0];
5330 } BWL_POST_PACKED_STRUCT;
5331 typedef struct dot11_dh_param_ie dot11_dh_param_ie_t;
5332 
5333 #define DOT11_DH_EXTID_OFFSET (OFFSETOF(dot11_dh_param_ie_t, ext_id))
5334 
5335 #define DOT11_OWE_DH_PARAM_IE(_ie)                                             \
5336     (DOT11_MNG_IE_ID_EXT_MATCH(_ie, EXT_MNG_OWE_DH_PARAM_ID))
5337 
5338 #define DOT11_MNG_OWE_IE_ID_EXT_INIT(_ie, _id, _len)                           \
5339     do {                                                                       \
5340         (_ie)->id = DOT11_MNG_ID_EXT_ID;                                       \
5341         (_ie)->len = _len;                                                     \
5342         (_ie)->ext_id = _id;                                                   \
5343     } while (0)
5344 
5345 /* 802.11u interworking access network options */
5346 #define IW_ANT_MASK 0x0f
5347 #define IW_INTERNET_MASK 0x10
5348 #define IW_ASRA_MASK 0x20
5349 #define IW_ESR_MASK 0x40
5350 #define IW_UESA_MASK 0x80
5351 
5352 /* 802.11u interworking access network type */
5353 #define IW_ANT_PRIVATE_NETWORK 0
5354 #define IW_ANT_PRIVATE_NETWORK_WITH_GUEST 1
5355 #define IW_ANT_CHARGEABLE_PUBLIC_NETWORK 2
5356 #define IW_ANT_FREE_PUBLIC_NETWORK 3
5357 #define IW_ANT_PERSONAL_DEVICE_NETWORK 4
5358 #define IW_ANT_EMERGENCY_SERVICES_NETWORK 5
5359 #define IW_ANT_TEST_NETWORK 14
5360 #define IW_ANT_WILDCARD_NETWORK 15
5361 
5362 #define IW_ANT_LEN 1
5363 #define IW_VENUE_LEN 2
5364 #define IW_HESSID_LEN 6
5365 #define IW_HESSID_OFF (IW_ANT_LEN + IW_VENUE_LEN)
5366 #define IW_MAX_LEN (IW_ANT_LEN + IW_VENUE_LEN + IW_HESSID_LEN)
5367 
5368 /* 802.11u advertisement protocol */
5369 #define ADVP_ANQP_PROTOCOL_ID 0
5370 #define ADVP_MIH_PROTOCOL_ID 1
5371 
5372 /* 802.11u advertisement protocol masks */
5373 #define ADVP_QRL_MASK 0x7f
5374 #define ADVP_PAME_BI_MASK 0x80
5375 
5376 /* 802.11u advertisement protocol values */
5377 #define ADVP_QRL_REQUEST 0x00
5378 #define ADVP_QRL_RESPONSE 0x7f
5379 #define ADVP_PAME_BI_DEPENDENT 0x00
5380 #define ADVP_PAME_BI_INDEPENDENT ADVP_PAME_BI_MASK
5381 
5382 /* 802.11u ANQP information ID */
5383 #define ANQP_ID_QUERY_LIST 256
5384 #define ANQP_ID_CAPABILITY_LIST 257
5385 #define ANQP_ID_VENUE_NAME_INFO 258
5386 #define ANQP_ID_EMERGENCY_CALL_NUMBER_INFO 259
5387 #define ANQP_ID_NETWORK_AUTHENTICATION_TYPE_INFO 260
5388 #define ANQP_ID_ROAMING_CONSORTIUM_LIST 261
5389 #define ANQP_ID_IP_ADDRESS_TYPE_AVAILABILITY_INFO 262
5390 #define ANQP_ID_NAI_REALM_LIST 263
5391 #define ANQP_ID_G3PP_CELLULAR_NETWORK_INFO 264
5392 #define ANQP_ID_AP_GEOSPATIAL_LOCATION 265
5393 #define ANQP_ID_AP_CIVIC_LOCATION 266
5394 #define ANQP_ID_AP_LOCATION_PUBLIC_ID_URI 267
5395 #define ANQP_ID_DOMAIN_NAME_LIST 268
5396 #define ANQP_ID_EMERGENCY_ALERT_ID_URI 269
5397 #define ANQP_ID_EMERGENCY_NAI 271
5398 #define ANQP_ID_NEIGHBOR_REPORT 272
5399 #define ANQP_ID_VENDOR_SPECIFIC_LIST 56797
5400 
5401 /* 802.11u ANQP ID len */
5402 #define ANQP_INFORMATION_ID_LEN 2
5403 
5404 /* 802.11u ANQP OUI */
5405 #define ANQP_OUI_SUBTYPE 9
5406 
5407 /* 802.11u venue name */
5408 #define VENUE_LANGUAGE_CODE_SIZE 3
5409 #define VENUE_NAME_SIZE 255
5410 
5411 /* 802.11u venue groups */
5412 #define VENUE_UNSPECIFIED 0
5413 #define VENUE_ASSEMBLY 1
5414 #define VENUE_BUSINESS 2
5415 #define VENUE_EDUCATIONAL 3
5416 #define VENUE_FACTORY 4
5417 #define VENUE_INSTITUTIONAL 5
5418 #define VENUE_MERCANTILE 6
5419 #define VENUE_RESIDENTIAL 7
5420 #define VENUE_STORAGE 8
5421 #define VENUE_UTILITY 9
5422 #define VENUE_VEHICULAR 10
5423 #define VENUE_OUTDOOR 11
5424 
5425 /* 802.11u network authentication type indicator */
5426 #define NATI_UNSPECIFIED -1
5427 #define NATI_ACCEPTANCE_OF_TERMS_CONDITIONS 0
5428 #define NATI_ONLINE_ENROLLMENT_SUPPORTED 1
5429 #define NATI_HTTP_HTTPS_REDIRECTION 2
5430 #define NATI_DNS_REDIRECTION 3
5431 
5432 /* 802.11u IP address type availability - IPv6 */
5433 #define IPA_IPV6_SHIFT 0
5434 #define IPA_IPV6_MASK (0x03 << IPA_IPV6_SHIFT)
5435 #define IPA_IPV6_NOT_AVAILABLE 0x00
5436 #define IPA_IPV6_AVAILABLE 0x01
5437 #define IPA_IPV6_UNKNOWN_AVAILABILITY 0x02
5438 
5439 /* 802.11u IP address type availability - IPv4 */
5440 #define IPA_IPV4_SHIFT 2
5441 #define IPA_IPV4_MASK (0x3f << IPA_IPV4_SHIFT)
5442 #define IPA_IPV4_NOT_AVAILABLE 0x00
5443 #define IPA_IPV4_PUBLIC 0x01
5444 #define IPA_IPV4_PORT_RESTRICT 0x02
5445 #define IPA_IPV4_SINGLE_NAT 0x03
5446 #define IPA_IPV4_DOUBLE_NAT 0x04
5447 #define IPA_IPV4_PORT_RESTRICT_SINGLE_NAT 0x05
5448 #define IPA_IPV4_PORT_RESTRICT_DOUBLE_NAT 0x06
5449 #define IPA_IPV4_UNKNOWN_AVAILABILITY 0x07
5450 
5451 /* 802.11u NAI realm encoding */
5452 #define REALM_ENCODING_RFC4282 0
5453 #define REALM_ENCODING_UTF8 1
5454 
5455 /* 802.11u IANA EAP method type numbers */
5456 #define REALM_EAP_TLS 13
5457 #define REALM_EAP_LEAP 17
5458 #define REALM_EAP_SIM 18
5459 #define REALM_EAP_TTLS 21
5460 #define REALM_EAP_AKA 23
5461 #define REALM_EAP_PEAP 25
5462 #define REALM_EAP_FAST 43
5463 #define REALM_EAP_PSK 47
5464 #define REALM_EAP_AKAP 50
5465 #define REALM_EAP_EXPANDED 254
5466 
5467 /* 802.11u authentication ID */
5468 #define REALM_EXPANDED_EAP 1
5469 #define REALM_NON_EAP_INNER_AUTHENTICATION 2
5470 #define REALM_INNER_AUTHENTICATION_EAP 3
5471 #define REALM_EXPANDED_INNER_EAP 4
5472 #define REALM_CREDENTIAL 5
5473 #define REALM_TUNNELED_EAP_CREDENTIAL 6
5474 #define REALM_VENDOR_SPECIFIC_EAP 221
5475 
5476 /* 802.11u non-EAP inner authentication type */
5477 #define REALM_RESERVED_AUTH 0
5478 #define REALM_PAP 1
5479 #define REALM_CHAP 2
5480 #define REALM_MSCHAP 3
5481 #define REALM_MSCHAPV2 4
5482 
5483 /* 802.11u credential type */
5484 #define REALM_SIM 1
5485 #define REALM_USIM 2
5486 #define REALM_NFC 3
5487 #define REALM_HARDWARE_TOKEN 4
5488 #define REALM_SOFTOKEN 5
5489 #define REALM_CERTIFICATE 6
5490 #define REALM_USERNAME_PASSWORD 7
5491 #define REALM_SERVER_SIDE 8
5492 #define REALM_RESERVED_CRED 9
5493 #define REALM_VENDOR_SPECIFIC_CRED 10
5494 
5495 /* 802.11u 3GPP PLMN */
5496 #define G3PP_GUD_VERSION 0
5497 #define G3PP_PLMN_LIST_IE 0
5498 
5499 /* AP Location Public ID Info encoding */
5500 #define PUBLIC_ID_URI_FQDN_SE_ID 0
5501 /* URI/FQDN Descriptor field values */
5502 #define LOCATION_ENCODING_HELD 1
5503 #define LOCATION_ENCODING_SUPL 2
5504 #define URI_FQDN_SIZE 255
5505 
5506 /** hotspot2.0 indication element (vendor specific) */
5507 BWL_PRE_PACKED_STRUCT struct hs20_ie {
5508     uint8 oui[3];
5509     uint8 type;
5510     uint8 config;
5511 } BWL_POST_PACKED_STRUCT;
5512 typedef struct hs20_ie hs20_ie_t;
5513 #define HS20_IE_LEN 5 /* HS20 IE length */
5514 
5515 /** IEEE 802.11 Annex E */
5516 typedef enum {
5517     DOT11_2GHZ_20MHZ_CLASS_12 = 81,      /* Ch 1-11 */
5518     DOT11_5GHZ_20MHZ_CLASS_1 = 115,      /* Ch 36-48 */
5519     DOT11_5GHZ_20MHZ_CLASS_2_DFS = 118,  /* Ch 52-64 */
5520     DOT11_5GHZ_20MHZ_CLASS_3 = 124,      /* Ch 149-161 */
5521     DOT11_5GHZ_20MHZ_CLASS_4_DFS = 121,  /* Ch 100-140 */
5522     DOT11_5GHZ_20MHZ_CLASS_5 = 125,      /* Ch 149-165 */
5523     DOT11_5GHZ_40MHZ_CLASS_22 = 116,     /* Ch 36-44,   lower */
5524     DOT11_5GHZ_40MHZ_CLASS_23_DFS = 119, /* Ch 52-60,   lower */
5525     DOT11_5GHZ_40MHZ_CLASS_24_DFS = 122, /* Ch 100-132, lower */
5526     DOT11_5GHZ_40MHZ_CLASS_25 = 126,     /* Ch 149-157, lower */
5527     DOT11_5GHZ_40MHZ_CLASS_27 = 117,     /* Ch 40-48,   upper */
5528     DOT11_5GHZ_40MHZ_CLASS_28_DFS = 120, /* Ch 56-64,   upper */
5529     DOT11_5GHZ_40MHZ_CLASS_29_DFS = 123, /* Ch 104-136, upper */
5530     DOT11_5GHZ_40MHZ_CLASS_30 = 127,     /* Ch 153-161, upper */
5531     DOT11_2GHZ_40MHZ_CLASS_32 = 83,      /* Ch 1-7,     lower */
5532     DOT11_2GHZ_40MHZ_CLASS_33 = 84,      /* Ch 5-11,    upper */
5533 } dot11_op_class_t;
5534 
5535 /* QoS map */
5536 #define QOS_MAP_FIXED_LENGTH (8 * 2) /* DSCP ranges fixed with 8 entries */
5537 
5538 #define BCM_AIBSS_IE_TYPE 56
5539 
5540 #define SSE_OUI "\x00\x00\xF0"
5541 #define VENDOR_ENTERPRISE_STA_OUI_TYPE 0x22
5542 #define MAX_VSIE_DISASSOC (1)
5543 #define DISCO_VSIE_LEN 0x09u
5544 
5545 /* This marks the end of a packed structure section. */
5546 #include <packed_section_end.h>
5547 
5548 #endif /* _802_11_H_ */
5549