1 /*
2  * Copyright (C) 1999-2013, Broadcom Corporation
3  *
4  * Permission to use, copy, modify, and/or distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  *
16  * Fundamental types and constants relating to 802.11
17  *
18  * $Id: 802.11.h 386067 2013-02-19 15:24:20Z $
19  */
20 
21 #ifndef _802_11_H_
22 #define _802_11_H_
23 
24 #ifndef _TYPEDEFS_H_
25 #include <typedefs.h>
26 #endif
27 
28 #ifndef _NET_ETHERNET_H_
29 #include <proto/ethernet.h>
30 #endif
31 
32 #include <proto/wpa.h>
33 
34 /* This marks the start of a packed structure section. */
35 #include <packed_section_start.h>
36 
37 
38 #define DOT11_TU_TO_US			1024	/* 802.11 Time Unit is 1024 microseconds */
39 
40 /* Generic 802.11 frame constants */
41 #define DOT11_A3_HDR_LEN		24	/* d11 header length with A3 */
42 #define DOT11_A4_HDR_LEN		30	/* d11 header length with A4 */
43 #define DOT11_MAC_HDR_LEN		DOT11_A3_HDR_LEN	/* MAC header length */
44 #define DOT11_FCS_LEN			4	/* d11 FCS length */
45 #define DOT11_ICV_LEN			4	/* d11 ICV length */
46 #define DOT11_ICV_AES_LEN		8	/* d11 ICV/AES length */
47 #define DOT11_QOS_LEN			2	/* d11 QoS length */
48 #define DOT11_HTC_LEN			4	/* d11 HT Control field length */
49 
50 #define DOT11_KEY_INDEX_SHIFT		6	/* d11 key index shift */
51 #define DOT11_IV_LEN			4	/* d11 IV length */
52 #define DOT11_IV_TKIP_LEN		8	/* d11 IV TKIP length */
53 #define DOT11_IV_AES_OCB_LEN		4	/* d11 IV/AES/OCB length */
54 #define DOT11_IV_AES_CCM_LEN		8	/* d11 IV/AES/CCM length */
55 #define DOT11_IV_MAX_LEN		8	/* maximum iv len for any encryption */
56 
57 /* Includes MIC */
58 #define DOT11_MAX_MPDU_BODY_LEN		2304	/* max MPDU body length */
59 /* A4 header + QoS + CCMP + PDU + ICV + FCS = 2352 */
60 #define DOT11_MAX_MPDU_LEN		(DOT11_A4_HDR_LEN + \
61 					 DOT11_QOS_LEN + \
62 					 DOT11_IV_AES_CCM_LEN + \
63 					 DOT11_MAX_MPDU_BODY_LEN + \
64 					 DOT11_ICV_LEN + \
65 					 DOT11_FCS_LEN)	/* d11 max MPDU length */
66 
67 #define DOT11_MAX_SSID_LEN		32	/* d11 max ssid length */
68 
69 /* dot11RTSThreshold */
70 #define DOT11_DEFAULT_RTS_LEN		2347	/* d11 default RTS length */
71 #define DOT11_MAX_RTS_LEN		2347	/* d11 max RTS length */
72 
73 /* dot11FragmentationThreshold */
74 #define DOT11_MIN_FRAG_LEN		256	/* d11 min fragmentation length */
75 #define DOT11_MAX_FRAG_LEN		2346	/* Max frag is also limited by aMPDUMaxLength
76 						* of the attached PHY
77 						*/
78 #define DOT11_DEFAULT_FRAG_LEN		2346	/* d11 default fragmentation length */
79 
80 /* dot11BeaconPeriod */
81 #define DOT11_MIN_BEACON_PERIOD		1	/* d11 min beacon period */
82 #define DOT11_MAX_BEACON_PERIOD		0xFFFF	/* d11 max beacon period */
83 
84 /* dot11DTIMPeriod */
85 #define DOT11_MIN_DTIM_PERIOD		1	/* d11 min DTIM period */
86 #define DOT11_MAX_DTIM_PERIOD		0xFF	/* d11 max DTIM period */
87 
88 /* 802.2 LLC/SNAP header used by 802.11 per 802.1H */
89 #define DOT11_LLC_SNAP_HDR_LEN		8	/* d11 LLC/SNAP header length */
90 #define DOT11_OUI_LEN			3	/* d11 OUI length */
91 BWL_PRE_PACKED_STRUCT struct dot11_llc_snap_header {
92 	uint8	dsap;				/* always 0xAA */
93 	uint8	ssap;				/* always 0xAA */
94 	uint8	ctl;				/* always 0x03 */
95 	uint8	oui[DOT11_OUI_LEN];		/* RFC1042: 0x00 0x00 0x00
96 						 * Bridge-Tunnel: 0x00 0x00 0xF8
97 						 */
98 	uint16	type;				/* ethertype */
99 } BWL_POST_PACKED_STRUCT;
100 
101 /* RFC1042 header used by 802.11 per 802.1H */
102 #define RFC1042_HDR_LEN	(ETHER_HDR_LEN + DOT11_LLC_SNAP_HDR_LEN)	/* RCF1042 header length */
103 
104 /* Generic 802.11 MAC header */
105 /*
106  * N.B.: This struct reflects the full 4 address 802.11 MAC header.
107  *		 The fields are defined such that the shorter 1, 2, and 3
108  *		 address headers just use the first k fields.
109  */
110 BWL_PRE_PACKED_STRUCT struct dot11_header {
111 	uint16			fc;		/* frame control */
112 	uint16			durid;		/* duration/ID */
113 	struct ether_addr	a1;		/* address 1 */
114 	struct ether_addr	a2;		/* address 2 */
115 	struct ether_addr	a3;		/* address 3 */
116 	uint16			seq;		/* sequence control */
117 	struct ether_addr	a4;		/* address 4 */
118 } BWL_POST_PACKED_STRUCT;
119 
120 /* Control frames */
121 
122 BWL_PRE_PACKED_STRUCT struct dot11_rts_frame {
123 	uint16			fc;		/* frame control */
124 	uint16			durid;		/* duration/ID */
125 	struct ether_addr	ra;		/* receiver address */
126 	struct ether_addr	ta;		/* transmitter address */
127 } BWL_POST_PACKED_STRUCT;
128 #define	DOT11_RTS_LEN		16		/* d11 RTS frame length */
129 
130 BWL_PRE_PACKED_STRUCT struct dot11_cts_frame {
131 	uint16			fc;		/* frame control */
132 	uint16			durid;		/* duration/ID */
133 	struct ether_addr	ra;		/* receiver address */
134 } BWL_POST_PACKED_STRUCT;
135 #define	DOT11_CTS_LEN		10		/* d11 CTS frame length */
136 
137 BWL_PRE_PACKED_STRUCT struct dot11_ack_frame {
138 	uint16			fc;		/* frame control */
139 	uint16			durid;		/* duration/ID */
140 	struct ether_addr	ra;		/* receiver address */
141 } BWL_POST_PACKED_STRUCT;
142 #define	DOT11_ACK_LEN		10		/* d11 ACK frame length */
143 
144 BWL_PRE_PACKED_STRUCT struct dot11_ps_poll_frame {
145 	uint16			fc;		/* frame control */
146 	uint16			durid;		/* AID */
147 	struct ether_addr	bssid;		/* receiver address, STA in AP */
148 	struct ether_addr	ta;		/* transmitter address */
149 } BWL_POST_PACKED_STRUCT;
150 #define	DOT11_PS_POLL_LEN	16		/* d11 PS poll frame length */
151 
152 BWL_PRE_PACKED_STRUCT struct dot11_cf_end_frame {
153 	uint16			fc;		/* frame control */
154 	uint16			durid;		/* duration/ID */
155 	struct ether_addr	ra;		/* receiver address */
156 	struct ether_addr	bssid;		/* transmitter address, STA in AP */
157 } BWL_POST_PACKED_STRUCT;
158 #define	DOT11_CS_END_LEN	16		/* d11 CF-END frame length */
159 
160 /* RWL wifi protocol: The Vendor Specific Action frame is defined for vendor-specific signaling
161 *  category+OUI+vendor specific content ( this can be variable)
162 */
163 BWL_PRE_PACKED_STRUCT struct dot11_action_wifi_vendor_specific {
164 	uint8	category;
165 	uint8	OUI[3];
166 	uint8	type;
167 	uint8	subtype;
168 	uint8	data[1040];
169 } BWL_POST_PACKED_STRUCT;
170 typedef struct dot11_action_wifi_vendor_specific dot11_action_wifi_vendor_specific_t;
171 
172 /* generic vender specific action frame with variable length */
173 BWL_PRE_PACKED_STRUCT struct dot11_action_vs_frmhdr {
174 	uint8	category;
175 	uint8	OUI[3];
176 	uint8	type;
177 	uint8	subtype;
178 	uint8	data[1];
179 } BWL_POST_PACKED_STRUCT;
180 typedef struct dot11_action_vs_frmhdr dot11_action_vs_frmhdr_t;
181 #define DOT11_ACTION_VS_HDR_LEN	6
182 
183 #define BCM_ACTION_OUI_BYTE0	0x00
184 #define BCM_ACTION_OUI_BYTE1	0x90
185 #define BCM_ACTION_OUI_BYTE2	0x4c
186 
187 /* BA/BAR Control parameters */
188 #define DOT11_BA_CTL_POLICY_NORMAL	0x0000	/* normal ack */
189 #define DOT11_BA_CTL_POLICY_NOACK	0x0001	/* no ack */
190 #define DOT11_BA_CTL_POLICY_MASK	0x0001	/* ack policy mask */
191 
192 #define DOT11_BA_CTL_MTID		0x0002	/* multi tid BA */
193 #define DOT11_BA_CTL_COMPRESSED		0x0004	/* compressed bitmap */
194 
195 #define DOT11_BA_CTL_NUMMSDU_MASK	0x0FC0	/* num msdu in bitmap mask */
196 #define DOT11_BA_CTL_NUMMSDU_SHIFT	6	/* num msdu in bitmap shift */
197 
198 #define DOT11_BA_CTL_TID_MASK		0xF000	/* tid mask */
199 #define DOT11_BA_CTL_TID_SHIFT		12	/* tid shift */
200 
201 /* control frame header (BA/BAR) */
202 BWL_PRE_PACKED_STRUCT struct dot11_ctl_header {
203 	uint16			fc;		/* frame control */
204 	uint16			durid;		/* duration/ID */
205 	struct ether_addr	ra;		/* receiver address */
206 	struct ether_addr	ta;		/* transmitter address */
207 } BWL_POST_PACKED_STRUCT;
208 #define DOT11_CTL_HDR_LEN	16		/* control frame hdr len */
209 
210 /* BAR frame payload */
211 BWL_PRE_PACKED_STRUCT struct dot11_bar {
212 	uint16			bar_control;	/* BAR Control */
213 	uint16			seqnum;		/* Starting Sequence control */
214 } BWL_POST_PACKED_STRUCT;
215 #define DOT11_BAR_LEN		4		/* BAR frame payload length */
216 
217 #define DOT11_BA_BITMAP_LEN	128		/* bitmap length */
218 #define DOT11_BA_CMP_BITMAP_LEN	8		/* compressed bitmap length */
219 /* BA frame payload */
220 BWL_PRE_PACKED_STRUCT struct dot11_ba {
221 	uint16			ba_control;	/* BA Control */
222 	uint16			seqnum;		/* Starting Sequence control */
223 	uint8			bitmap[DOT11_BA_BITMAP_LEN];	/* Block Ack Bitmap */
224 } BWL_POST_PACKED_STRUCT;
225 #define DOT11_BA_LEN		4		/* BA frame payload len (wo bitmap) */
226 
227 /* Management frame header */
228 BWL_PRE_PACKED_STRUCT struct dot11_management_header {
229 	uint16			fc;		/* frame control */
230 	uint16			durid;		/* duration/ID */
231 	struct ether_addr	da;		/* receiver address */
232 	struct ether_addr	sa;		/* transmitter address */
233 	struct ether_addr	bssid;		/* BSS ID */
234 	uint16			seq;		/* sequence control */
235 } BWL_POST_PACKED_STRUCT;
236 #define	DOT11_MGMT_HDR_LEN	24		/* d11 management header length */
237 
238 /* Management frame payloads */
239 
240 BWL_PRE_PACKED_STRUCT struct dot11_bcn_prb {
241 	uint32			timestamp[2];
242 	uint16			beacon_interval;
243 	uint16			capability;
244 } BWL_POST_PACKED_STRUCT;
245 #define	DOT11_BCN_PRB_LEN	12		/* 802.11 beacon/probe frame fixed length */
246 #define	DOT11_BCN_PRB_FIXED_LEN	12		/* 802.11 beacon/probe frame fixed length */
247 
248 BWL_PRE_PACKED_STRUCT struct dot11_auth {
249 	uint16			alg;		/* algorithm */
250 	uint16			seq;		/* sequence control */
251 	uint16			status;		/* status code */
252 } BWL_POST_PACKED_STRUCT;
253 #define DOT11_AUTH_FIXED_LEN	6		/* length of auth frame without challenge IE */
254 
255 BWL_PRE_PACKED_STRUCT struct dot11_assoc_req {
256 	uint16			capability;	/* capability information */
257 	uint16			listen;		/* listen interval */
258 } BWL_POST_PACKED_STRUCT;
259 #define DOT11_ASSOC_REQ_FIXED_LEN	4	/* length of assoc frame without info elts */
260 
261 BWL_PRE_PACKED_STRUCT struct dot11_reassoc_req {
262 	uint16			capability;	/* capability information */
263 	uint16			listen;		/* listen interval */
264 	struct ether_addr	ap;		/* Current AP address */
265 } BWL_POST_PACKED_STRUCT;
266 #define DOT11_REASSOC_REQ_FIXED_LEN	10	/* length of assoc frame without info elts */
267 
268 BWL_PRE_PACKED_STRUCT struct dot11_assoc_resp {
269 	uint16			capability;	/* capability information */
270 	uint16			status;		/* status code */
271 	uint16			aid;		/* association ID */
272 } BWL_POST_PACKED_STRUCT;
273 #define DOT11_ASSOC_RESP_FIXED_LEN	6	/* length of assoc resp frame without info elts */
274 
275 BWL_PRE_PACKED_STRUCT struct dot11_action_measure {
276 	uint8	category;
277 	uint8	action;
278 	uint8	token;
279 	uint8	data[1];
280 } BWL_POST_PACKED_STRUCT;
281 #define DOT11_ACTION_MEASURE_LEN	3	/* d11 action measurement header length */
282 
283 BWL_PRE_PACKED_STRUCT struct dot11_action_ht_ch_width {
284 	uint8	category;
285 	uint8	action;
286 	uint8	ch_width;
287 } BWL_POST_PACKED_STRUCT;
288 
289 BWL_PRE_PACKED_STRUCT struct dot11_action_ht_mimops {
290 	uint8	category;
291 	uint8	action;
292 	uint8	control;
293 } BWL_POST_PACKED_STRUCT;
294 
295 BWL_PRE_PACKED_STRUCT struct dot11_action_sa_query {
296 	uint8	category;
297 	uint8	action;
298 	uint16	id;
299 } BWL_POST_PACKED_STRUCT;
300 
301 BWL_PRE_PACKED_STRUCT struct dot11_action_vht_oper_mode {
302 	uint8	category;
303 	uint8	action;
304 	uint8	mode;
305 } BWL_POST_PACKED_STRUCT;
306 
307 #define SM_PWRSAVE_ENABLE	1
308 #define SM_PWRSAVE_MODE		2
309 
310 /* ************* 802.11h related definitions. ************* */
311 BWL_PRE_PACKED_STRUCT struct dot11_power_cnst {
312 	uint8 id;
313 	uint8 len;
314 	uint8 power;
315 } BWL_POST_PACKED_STRUCT;
316 typedef struct dot11_power_cnst dot11_power_cnst_t;
317 
318 BWL_PRE_PACKED_STRUCT struct dot11_power_cap {
319 	uint8 min;
320 	uint8 max;
321 } BWL_POST_PACKED_STRUCT;
322 typedef struct dot11_power_cap dot11_power_cap_t;
323 
324 BWL_PRE_PACKED_STRUCT struct dot11_tpc_rep {
325 	uint8 id;
326 	uint8 len;
327 	uint8 tx_pwr;
328 	uint8 margin;
329 } BWL_POST_PACKED_STRUCT;
330 typedef struct dot11_tpc_rep dot11_tpc_rep_t;
331 #define DOT11_MNG_IE_TPC_REPORT_LEN	2 	/* length of IE data, not including 2 byte header */
332 
333 BWL_PRE_PACKED_STRUCT struct dot11_supp_channels {
334 	uint8 id;
335 	uint8 len;
336 	uint8 first_channel;
337 	uint8 num_channels;
338 } BWL_POST_PACKED_STRUCT;
339 typedef struct dot11_supp_channels dot11_supp_channels_t;
340 
341 /* Extension Channel Offset IE: 802.11n-D1.0 spec. added sideband
342  * offset for 40MHz operation.  The possible 3 values are:
343  * 1 = above control channel
344  * 3 = below control channel
345  * 0 = no extension channel
346  */
347 BWL_PRE_PACKED_STRUCT struct dot11_extch {
348 	uint8	id;		/* IE ID, 62, DOT11_MNG_EXT_CHANNEL_OFFSET */
349 	uint8	len;		/* IE length */
350 	uint8	extch;
351 } BWL_POST_PACKED_STRUCT;
352 typedef struct dot11_extch dot11_extch_ie_t;
353 
354 BWL_PRE_PACKED_STRUCT struct dot11_brcm_extch {
355 	uint8	id;		/* IE ID, 221, DOT11_MNG_PROPR_ID */
356 	uint8	len;		/* IE length */
357 	uint8	oui[3];		/* Proprietary OUI, BRCM_PROP_OUI */
358 	uint8	type;           /* type inidicates what follows */
359 	uint8	extch;
360 } BWL_POST_PACKED_STRUCT;
361 typedef struct dot11_brcm_extch dot11_brcm_extch_ie_t;
362 
363 #define BRCM_EXTCH_IE_LEN	5
364 #define BRCM_EXTCH_IE_TYPE	53	/* 802.11n ID not yet assigned */
365 #define DOT11_EXTCH_IE_LEN	1
366 #define DOT11_EXT_CH_MASK	0x03	/* extension channel mask */
367 #define DOT11_EXT_CH_UPPER	0x01	/* ext. ch. on upper sb */
368 #define DOT11_EXT_CH_LOWER	0x03	/* ext. ch. on lower sb */
369 #define DOT11_EXT_CH_NONE	0x00	/* no extension ch.  */
370 
371 BWL_PRE_PACKED_STRUCT struct dot11_action_frmhdr {
372 	uint8	category;
373 	uint8	action;
374 	uint8	data[1];
375 } BWL_POST_PACKED_STRUCT;
376 #define DOT11_ACTION_FRMHDR_LEN	2
377 
378 /* CSA IE data structure */
379 BWL_PRE_PACKED_STRUCT struct dot11_channel_switch {
380 	uint8 id;	/* id DOT11_MNG_CHANNEL_SWITCH_ID */
381 	uint8 len;	/* length of IE */
382 	uint8 mode;	/* mode 0 or 1 */
383 	uint8 channel;	/* channel switch to */
384 	uint8 count;	/* number of beacons before switching */
385 } BWL_POST_PACKED_STRUCT;
386 typedef struct dot11_channel_switch dot11_chan_switch_ie_t;
387 
388 #define DOT11_SWITCH_IE_LEN	3	/* length of IE data, not including 2 byte header */
389 /* CSA mode - 802.11h-2003 $7.3.2.20 */
390 #define DOT11_CSA_MODE_ADVISORY		0	/* no DOT11_CSA_MODE_NO_TX restriction imposed */
391 #define DOT11_CSA_MODE_NO_TX		1	/* no transmission upon receiving CSA frame. */
392 
393 BWL_PRE_PACKED_STRUCT struct dot11_action_switch_channel {
394 	uint8	category;
395 	uint8	action;
396 	dot11_chan_switch_ie_t chan_switch_ie;	/* for switch IE */
397 	dot11_brcm_extch_ie_t extch_ie;		/* extension channel offset */
398 } BWL_POST_PACKED_STRUCT;
399 
400 BWL_PRE_PACKED_STRUCT struct dot11_csa_body {
401 	uint8 mode;	/* mode 0 or 1 */
402 	uint8 reg;	/* regulatory class */
403 	uint8 channel;	/* channel switch to */
404 	uint8 count;	/* number of beacons before switching */
405 } BWL_POST_PACKED_STRUCT;
406 
407 /* 11n Extended Channel Switch IE data structure */
408 BWL_PRE_PACKED_STRUCT struct dot11_ext_csa {
409 	uint8 id;	/* id DOT11_MNG_EXT_CHANNEL_SWITCH_ID */
410 	uint8 len;	/* length of IE */
411 	struct dot11_csa_body b;	/* body of the ie */
412 } BWL_POST_PACKED_STRUCT;
413 typedef struct dot11_ext_csa dot11_ext_csa_ie_t;
414 #define DOT11_EXT_CSA_IE_LEN	4	/* length of extended channel switch IE body */
415 
416 BWL_PRE_PACKED_STRUCT struct dot11_action_ext_csa {
417 	uint8	category;
418 	uint8	action;
419 	dot11_ext_csa_ie_t chan_switch_ie;	/* for switch IE */
420 } BWL_POST_PACKED_STRUCT;
421 
422 BWL_PRE_PACKED_STRUCT struct dot11y_action_ext_csa {
423 	uint8	category;
424 	uint8	action;
425 	struct dot11_csa_body b;	/* body of the ie */
426 } BWL_POST_PACKED_STRUCT;
427 
428 /*  Wide Bandwidth Channel Switch IE data structure */
429 BWL_PRE_PACKED_STRUCT struct dot11_wide_bw_channel_switch {
430 	uint8 id;				/* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
431 	uint8 len;				/* length of IE */
432 	uint8 channel_width;			/* new channel width */
433 	uint8 center_frequency_segment_0;	/* center frequency segment 0 */
434 	uint8 center_frequency_segment_1;	/* center frequency segment 1 */
435 } BWL_POST_PACKED_STRUCT;
436 typedef struct dot11_wide_bw_channel_switch dot11_wide_bw_chan_switch_ie_t;
437 
438 #define DOT11_WIDE_BW_SWITCH_IE_LEN     3       /* length of IE data, not including 2 byte header */
439 
440 /* Channel Switch Wrapper IE data structure */
441 BWL_PRE_PACKED_STRUCT struct dot11_channel_switch_wrapper {
442 	uint8 id;				/* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
443 	uint8 len;				/* length of IE */
444 	dot11_wide_bw_chan_switch_ie_t wb_chan_switch_ie;
445 } BWL_POST_PACKED_STRUCT;
446 typedef struct dot11_channel_switch_wrapper dot11_chan_switch_wrapper_ie_t;
447 
448 /* VHT Transmit Power Envelope IE data structure */
449 BWL_PRE_PACKED_STRUCT struct dot11_vht_transmit_power_envelope {
450 	uint8 id;				/* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
451 	uint8 len;				/* length of IE */
452 	uint8 transmit_power_info;
453 	uint8 local_max_transmit_power_20;
454 } BWL_POST_PACKED_STRUCT;
455 typedef struct dot11_vht_transmit_power_envelope dot11_vht_transmit_power_envelope_ie_t;
456 
457 
458 BWL_PRE_PACKED_STRUCT struct dot11_obss_coex {
459 	uint8	id;
460 	uint8	len;
461 	uint8	info;
462 } BWL_POST_PACKED_STRUCT;
463 typedef struct dot11_obss_coex dot11_obss_coex_t;
464 #define DOT11_OBSS_COEXINFO_LEN	1	/* length of OBSS Coexistence INFO IE */
465 
466 #define	DOT11_OBSS_COEX_INFO_REQ		0x01
467 #define	DOT11_OBSS_COEX_40MHZ_INTOLERANT	0x02
468 #define	DOT11_OBSS_COEX_20MHZ_WIDTH_REQ	0x04
469 
470 BWL_PRE_PACKED_STRUCT struct dot11_obss_chanlist {
471 	uint8	id;
472 	uint8	len;
473 	uint8	regclass;
474 	uint8	chanlist[1];
475 } BWL_POST_PACKED_STRUCT;
476 typedef struct dot11_obss_chanlist dot11_obss_chanlist_t;
477 #define DOT11_OBSS_CHANLIST_FIXED_LEN	1	/* fixed length of regclass */
478 
479 BWL_PRE_PACKED_STRUCT struct dot11_extcap_ie {
480 	uint8 id;
481 	uint8 len;
482 	uint8 cap[1];
483 } BWL_POST_PACKED_STRUCT;
484 typedef struct dot11_extcap_ie dot11_extcap_ie_t;
485 
486 #define DOT11_EXTCAP_LEN_MAX	8
487 
488 #define DOT11_EXTCAP_LEN_COEX	1
489 #define DOT11_EXTCAP_LEN_BT	3
490 #define DOT11_EXTCAP_LEN_IW	4
491 #define DOT11_EXTCAP_LEN_SI	6
492 
493 #define DOT11_EXTCAP_LEN_TDLS	5
494 #define DOT11_11AC_EXTCAP_LEN_TDLS	8
495 
496 #define DOT11_EXTCAP_LEN_FMS			2
497 #define DOT11_EXTCAP_LEN_PROXY_ARP		2
498 #define DOT11_EXTCAP_LEN_TFS			3
499 #define DOT11_EXTCAP_LEN_WNM_SLEEP		3
500 #define DOT11_EXTCAP_LEN_TIMBC			3
501 #define DOT11_EXTCAP_LEN_BSSTRANS		3
502 #define DOT11_EXTCAP_LEN_DMS			4
503 #define DOT11_EXTCAP_LEN_WNM_NOTIFICATION	6
504 #define DOT11_EXTCAP_LEN_TDLS_WBW		8
505 #define DOT11_EXTCAP_LEN_OPMODE_NOTIFICATION	8
506 
507 BWL_PRE_PACKED_STRUCT struct dot11_extcap {
508 	uint8 extcap[DOT11_EXTCAP_LEN_MAX];
509 } BWL_POST_PACKED_STRUCT;
510 typedef struct dot11_extcap dot11_extcap_t;
511 
512 /* TDLS Capabilities */
513 #define DOT11_TDLS_CAP_TDLS			37		/* TDLS support */
514 #define DOT11_TDLS_CAP_PU_BUFFER_STA	28		/* TDLS Peer U-APSD buffer STA support */
515 #define DOT11_TDLS_CAP_PEER_PSM		20		/* TDLS Peer PSM support */
516 #define DOT11_TDLS_CAP_CH_SW			30		/* TDLS Channel switch */
517 #define DOT11_TDLS_CAP_PROH			38		/* TDLS prohibited */
518 #define DOT11_TDLS_CAP_CH_SW_PROH		39		/* TDLS Channel switch prohibited */
519 #define DOT11_TDLS_CAP_TDLS_WIDER_BW	61	/* TDLS Wider Band-Width */
520 
521 #define TDLS_CAP_MAX_BIT		39		/* TDLS max bit defined in ext cap */
522 
523 /* 802.11h/802.11k Measurement Request/Report IEs */
524 /* Measurement Type field */
525 #define DOT11_MEASURE_TYPE_BASIC 	0	/* d11 measurement basic type */
526 #define DOT11_MEASURE_TYPE_CCA 		1	/* d11 measurement CCA type */
527 #define DOT11_MEASURE_TYPE_RPI		2	/* d11 measurement RPI type */
528 #define DOT11_MEASURE_TYPE_CHLOAD		3	/* d11 measurement Channel Load type */
529 #define DOT11_MEASURE_TYPE_NOISE		4	/* d11 measurement Noise Histogram type */
530 #define DOT11_MEASURE_TYPE_BEACON		5	/* d11 measurement Beacon type */
531 #define DOT11_MEASURE_TYPE_FRAME	6	/* d11 measurement Frame type */
532 #define DOT11_MEASURE_TYPE_STAT		7	/* d11 measurement STA Statistics type */
533 #define DOT11_MEASURE_TYPE_LCI		8	/* d11 measurement LCI type */
534 #define DOT11_MEASURE_TYPE_TXSTREAM		9	/* d11 measurement TX Stream type */
535 #define DOT11_MEASURE_TYPE_PAUSE		255	/* d11 measurement pause type */
536 
537 /* Measurement Request Modes */
538 #define DOT11_MEASURE_MODE_PARALLEL 	(1<<0)	/* d11 measurement parallel */
539 #define DOT11_MEASURE_MODE_ENABLE 	(1<<1)	/* d11 measurement enable */
540 #define DOT11_MEASURE_MODE_REQUEST	(1<<2)	/* d11 measurement request */
541 #define DOT11_MEASURE_MODE_REPORT 	(1<<3)	/* d11 measurement report */
542 #define DOT11_MEASURE_MODE_DUR 	(1<<4)	/* d11 measurement dur mandatory */
543 /* Measurement Report Modes */
544 #define DOT11_MEASURE_MODE_LATE 	(1<<0)	/* d11 measurement late */
545 #define DOT11_MEASURE_MODE_INCAPABLE	(1<<1)	/* d11 measurement incapable */
546 #define DOT11_MEASURE_MODE_REFUSED	(1<<2)	/* d11 measurement refuse */
547 /* Basic Measurement Map bits */
548 #define DOT11_MEASURE_BASIC_MAP_BSS	((uint8)(1<<0))	/* d11 measurement basic map BSS */
549 #define DOT11_MEASURE_BASIC_MAP_OFDM	((uint8)(1<<1))	/* d11 measurement map OFDM */
550 #define DOT11_MEASURE_BASIC_MAP_UKNOWN	((uint8)(1<<2))	/* d11 measurement map unknown */
551 #define DOT11_MEASURE_BASIC_MAP_RADAR	((uint8)(1<<3))	/* d11 measurement map radar */
552 #define DOT11_MEASURE_BASIC_MAP_UNMEAS	((uint8)(1<<4))	/* d11 measurement map unmeasuremnt */
553 
554 BWL_PRE_PACKED_STRUCT struct dot11_meas_req {
555 	uint8 id;
556 	uint8 len;
557 	uint8 token;
558 	uint8 mode;
559 	uint8 type;
560 	uint8 channel;
561 	uint8 start_time[8];
562 	uint16 duration;
563 } BWL_POST_PACKED_STRUCT;
564 typedef struct dot11_meas_req dot11_meas_req_t;
565 #define DOT11_MNG_IE_MREQ_LEN 14	/* d11 measurement request IE length */
566 /* length of Measure Request IE data not including variable len */
567 #define DOT11_MNG_IE_MREQ_FIXED_LEN 3	/* d11 measurement request IE fixed length */
568 
569 BWL_PRE_PACKED_STRUCT struct dot11_meas_rep {
570 	uint8 id;
571 	uint8 len;
572 	uint8 token;
573 	uint8 mode;
574 	uint8 type;
575 	BWL_PRE_PACKED_STRUCT union
576 	{
577 		BWL_PRE_PACKED_STRUCT struct {
578 			uint8 channel;
579 			uint8 start_time[8];
580 			uint16 duration;
581 			uint8 map;
582 		} BWL_POST_PACKED_STRUCT basic;
583 		uint8 data[1];
584 	} BWL_POST_PACKED_STRUCT rep;
585 } BWL_POST_PACKED_STRUCT;
586 typedef struct dot11_meas_rep dot11_meas_rep_t;
587 
588 /* length of Measure Report IE data not including variable len */
589 #define DOT11_MNG_IE_MREP_FIXED_LEN	3	/* d11 measurement response IE fixed length */
590 
591 BWL_PRE_PACKED_STRUCT struct dot11_meas_rep_basic {
592 	uint8 channel;
593 	uint8 start_time[8];
594 	uint16 duration;
595 	uint8 map;
596 } BWL_POST_PACKED_STRUCT;
597 typedef struct dot11_meas_rep_basic dot11_meas_rep_basic_t;
598 #define DOT11_MEASURE_BASIC_REP_LEN	12	/* d11 measurement basic report length */
599 
600 BWL_PRE_PACKED_STRUCT struct dot11_quiet {
601 	uint8 id;
602 	uint8 len;
603 	uint8 count;	/* TBTTs until beacon interval in quiet starts */
604 	uint8 period;	/* Beacon intervals between periodic quiet periods ? */
605 	uint16 duration;	/* Length of quiet period, in TU's */
606 	uint16 offset;	/* TU's offset from TBTT in Count field */
607 } BWL_POST_PACKED_STRUCT;
608 typedef struct dot11_quiet dot11_quiet_t;
609 
610 BWL_PRE_PACKED_STRUCT struct chan_map_tuple {
611 	uint8 channel;
612 	uint8 map;
613 } BWL_POST_PACKED_STRUCT;
614 typedef struct chan_map_tuple chan_map_tuple_t;
615 
616 BWL_PRE_PACKED_STRUCT struct dot11_ibss_dfs {
617 	uint8 id;
618 	uint8 len;
619 	uint8 eaddr[ETHER_ADDR_LEN];
620 	uint8 interval;
621 	chan_map_tuple_t map[1];
622 } BWL_POST_PACKED_STRUCT;
623 typedef struct dot11_ibss_dfs dot11_ibss_dfs_t;
624 
625 /* WME Elements */
626 #define WME_OUI			"\x00\x50\xf2"	/* WME OUI */
627 #define WME_OUI_LEN		3
628 #define WME_OUI_TYPE		2	/* WME type */
629 #define WME_TYPE		2	/* WME type, deprecated */
630 #define WME_SUBTYPE_IE		0	/* Information Element */
631 #define WME_SUBTYPE_PARAM_IE	1	/* Parameter Element */
632 #define WME_SUBTYPE_TSPEC	2	/* Traffic Specification */
633 #define WME_VER			1	/* WME version */
634 
635 /* WME Access Category Indices (ACIs) */
636 #define AC_BE			0	/* Best Effort */
637 #define AC_BK			1	/* Background */
638 #define AC_VI			2	/* Video */
639 #define AC_VO			3	/* Voice */
640 #define AC_COUNT		4	/* number of ACs */
641 
642 typedef uint8 ac_bitmap_t;	/* AC bitmap of (1 << AC_xx) */
643 
644 #define AC_BITMAP_NONE		0x0	/* No ACs */
645 #define AC_BITMAP_ALL		0xf	/* All ACs */
646 #define AC_BITMAP_TST(ab, ac)	(((ab) & (1 << (ac))) != 0)
647 #define AC_BITMAP_SET(ab, ac)	(((ab) |= (1 << (ac))))
648 #define AC_BITMAP_RESET(ab, ac) (((ab) &= ~(1 << (ac))))
649 
650 /* WME Information Element (IE) */
651 BWL_PRE_PACKED_STRUCT struct wme_ie {
652 	uint8 oui[3];
653 	uint8 type;
654 	uint8 subtype;
655 	uint8 version;
656 	uint8 qosinfo;
657 } BWL_POST_PACKED_STRUCT;
658 typedef struct wme_ie wme_ie_t;
659 #define WME_IE_LEN 7	/* WME IE length */
660 
661 BWL_PRE_PACKED_STRUCT struct edcf_acparam {
662 	uint8	ACI;
663 	uint8	ECW;
664 	uint16  TXOP;		/* stored in network order (ls octet first) */
665 } BWL_POST_PACKED_STRUCT;
666 typedef struct edcf_acparam edcf_acparam_t;
667 
668 /* WME Parameter Element (PE) */
669 BWL_PRE_PACKED_STRUCT struct wme_param_ie {
670 	uint8 oui[3];
671 	uint8 type;
672 	uint8 subtype;
673 	uint8 version;
674 	uint8 qosinfo;
675 	uint8 rsvd;
676 	edcf_acparam_t acparam[AC_COUNT];
677 } BWL_POST_PACKED_STRUCT;
678 typedef struct wme_param_ie wme_param_ie_t;
679 #define WME_PARAM_IE_LEN            24          /* WME Parameter IE length */
680 
681 /* QoS Info field for IE as sent from AP */
682 #define WME_QI_AP_APSD_MASK         0x80        /* U-APSD Supported mask */
683 #define WME_QI_AP_APSD_SHIFT        7           /* U-APSD Supported shift */
684 #define WME_QI_AP_COUNT_MASK        0x0f        /* Parameter set count mask */
685 #define WME_QI_AP_COUNT_SHIFT       0           /* Parameter set count shift */
686 
687 /* QoS Info field for IE as sent from STA */
688 #define WME_QI_STA_MAXSPLEN_MASK    0x60        /* Max Service Period Length mask */
689 #define WME_QI_STA_MAXSPLEN_SHIFT   5           /* Max Service Period Length shift */
690 #define WME_QI_STA_APSD_ALL_MASK    0xf         /* APSD all AC bits mask */
691 #define WME_QI_STA_APSD_ALL_SHIFT   0           /* APSD all AC bits shift */
692 #define WME_QI_STA_APSD_BE_MASK     0x8         /* APSD AC_BE mask */
693 #define WME_QI_STA_APSD_BE_SHIFT    3           /* APSD AC_BE shift */
694 #define WME_QI_STA_APSD_BK_MASK     0x4         /* APSD AC_BK mask */
695 #define WME_QI_STA_APSD_BK_SHIFT    2           /* APSD AC_BK shift */
696 #define WME_QI_STA_APSD_VI_MASK     0x2         /* APSD AC_VI mask */
697 #define WME_QI_STA_APSD_VI_SHIFT    1           /* APSD AC_VI shift */
698 #define WME_QI_STA_APSD_VO_MASK     0x1         /* APSD AC_VO mask */
699 #define WME_QI_STA_APSD_VO_SHIFT    0           /* APSD AC_VO shift */
700 
701 /* ACI */
702 #define EDCF_AIFSN_MIN               1           /* AIFSN minimum value */
703 #define EDCF_AIFSN_MAX               15          /* AIFSN maximum value */
704 #define EDCF_AIFSN_MASK              0x0f        /* AIFSN mask */
705 #define EDCF_ACM_MASK                0x10        /* ACM mask */
706 #define EDCF_ACI_MASK                0x60        /* ACI mask */
707 #define EDCF_ACI_SHIFT               5           /* ACI shift */
708 #define EDCF_AIFSN_SHIFT             12          /* 4 MSB(0xFFF) in ifs_ctl for AC idx */
709 
710 /* ECW */
711 #define EDCF_ECW_MIN                 0           /* cwmin/cwmax exponent minimum value */
712 #define EDCF_ECW_MAX                 15          /* cwmin/cwmax exponent maximum value */
713 #define EDCF_ECW2CW(exp)             ((1 << (exp)) - 1)
714 #define EDCF_ECWMIN_MASK             0x0f        /* cwmin exponent form mask */
715 #define EDCF_ECWMAX_MASK             0xf0        /* cwmax exponent form mask */
716 #define EDCF_ECWMAX_SHIFT            4           /* cwmax exponent form shift */
717 
718 /* TXOP */
719 #define EDCF_TXOP_MIN                0           /* TXOP minimum value */
720 #define EDCF_TXOP_MAX                65535       /* TXOP maximum value */
721 #define EDCF_TXOP2USEC(txop)         ((txop) << 5)
722 
723 /* Default BE ACI value for non-WME connection STA */
724 #define NON_EDCF_AC_BE_ACI_STA          0x02
725 
726 /* Default EDCF parameters that AP advertises for STA to use; WMM draft Table 12 */
727 #define EDCF_AC_BE_ACI_STA           0x03	/* STA ACI value for best effort AC */
728 #define EDCF_AC_BE_ECW_STA           0xA4	/* STA ECW value for best effort AC */
729 #define EDCF_AC_BE_TXOP_STA          0x0000	/* STA TXOP value for best effort AC */
730 #define EDCF_AC_BK_ACI_STA           0x27	/* STA ACI value for background AC */
731 #define EDCF_AC_BK_ECW_STA           0xA4	/* STA ECW value for background AC */
732 #define EDCF_AC_BK_TXOP_STA          0x0000	/* STA TXOP value for background AC */
733 #define EDCF_AC_VI_ACI_STA           0x42	/* STA ACI value for video AC */
734 #define EDCF_AC_VI_ECW_STA           0x43	/* STA ECW value for video AC */
735 #define EDCF_AC_VI_TXOP_STA          0x005e	/* STA TXOP value for video AC */
736 #define EDCF_AC_VO_ACI_STA           0x62	/* STA ACI value for audio AC */
737 #define EDCF_AC_VO_ECW_STA           0x32	/* STA ECW value for audio AC */
738 #define EDCF_AC_VO_TXOP_STA          0x002f	/* STA TXOP value for audio AC */
739 
740 /* Default EDCF parameters that AP uses; WMM draft Table 14 */
741 #define EDCF_AC_BE_ACI_AP            0x03	/* AP ACI value for best effort AC */
742 #define EDCF_AC_BE_ECW_AP            0x64	/* AP ECW value for best effort AC */
743 #define EDCF_AC_BE_TXOP_AP           0x0000	/* AP TXOP value for best effort AC */
744 #define EDCF_AC_BK_ACI_AP            0x27	/* AP ACI value for background AC */
745 #define EDCF_AC_BK_ECW_AP            0xA4	/* AP ECW value for background AC */
746 #define EDCF_AC_BK_TXOP_AP           0x0000	/* AP TXOP value for background AC */
747 #define EDCF_AC_VI_ACI_AP            0x41	/* AP ACI value for video AC */
748 #define EDCF_AC_VI_ECW_AP            0x43	/* AP ECW value for video AC */
749 #define EDCF_AC_VI_TXOP_AP           0x005e	/* AP TXOP value for video AC */
750 #define EDCF_AC_VO_ACI_AP            0x61	/* AP ACI value for audio AC */
751 #define EDCF_AC_VO_ECW_AP            0x32	/* AP ECW value for audio AC */
752 #define EDCF_AC_VO_TXOP_AP           0x002f	/* AP TXOP value for audio AC */
753 
754 /* EDCA Parameter IE */
755 BWL_PRE_PACKED_STRUCT struct edca_param_ie {
756 	uint8 qosinfo;
757 	uint8 rsvd;
758 	edcf_acparam_t acparam[AC_COUNT];
759 } BWL_POST_PACKED_STRUCT;
760 typedef struct edca_param_ie edca_param_ie_t;
761 #define EDCA_PARAM_IE_LEN            18          /* EDCA Parameter IE length */
762 
763 /* QoS Capability IE */
764 BWL_PRE_PACKED_STRUCT struct qos_cap_ie {
765 	uint8 qosinfo;
766 } BWL_POST_PACKED_STRUCT;
767 typedef struct qos_cap_ie qos_cap_ie_t;
768 
769 BWL_PRE_PACKED_STRUCT struct dot11_qbss_load_ie {
770 	uint8 id; 			/* 11, DOT11_MNG_QBSS_LOAD_ID */
771 	uint8 length;
772 	uint16 station_count; 		/* total number of STAs associated */
773 	uint8 channel_utilization;	/* % of time, normalized to 255, QAP sensed medium busy */
774 	uint16 aac; 			/* available admission capacity */
775 } BWL_POST_PACKED_STRUCT;
776 typedef struct dot11_qbss_load_ie dot11_qbss_load_ie_t;
777 #define BSS_LOAD_IE_SIZE 	7	/* BSS load IE size */
778 
779 /* nom_msdu_size */
780 #define FIXED_MSDU_SIZE 0x8000		/* MSDU size is fixed */
781 #define MSDU_SIZE_MASK	0x7fff		/* (Nominal or fixed) MSDU size */
782 
783 /* surplus_bandwidth */
784 /* Represented as 3 bits of integer, binary point, 13 bits fraction */
785 #define	INTEGER_SHIFT	13	/* integer shift */
786 #define FRACTION_MASK	0x1FFF	/* fraction mask */
787 
788 /* Management Notification Frame */
789 BWL_PRE_PACKED_STRUCT struct dot11_management_notification {
790 	uint8 category;			/* DOT11_ACTION_NOTIFICATION */
791 	uint8 action;
792 	uint8 token;
793 	uint8 status;
794 	uint8 data[1];			/* Elements */
795 } BWL_POST_PACKED_STRUCT;
796 #define DOT11_MGMT_NOTIFICATION_LEN 4	/* Fixed length */
797 
798 /* Timeout Interval IE */
799 BWL_PRE_PACKED_STRUCT struct ti_ie {
800 	uint8 ti_type;
801 	uint32 ti_val;
802 } BWL_POST_PACKED_STRUCT;
803 typedef struct ti_ie ti_ie_t;
804 #define TI_TYPE_REASSOC_DEADLINE	1
805 #define TI_TYPE_KEY_LIFETIME		2
806 
807 /* WME Action Codes */
808 #define WME_ADDTS_REQUEST	0	/* WME ADDTS request */
809 #define WME_ADDTS_RESPONSE	1	/* WME ADDTS response */
810 #define WME_DELTS_REQUEST	2	/* WME DELTS request */
811 
812 /* WME Setup Response Status Codes */
813 #define WME_ADMISSION_ACCEPTED		0	/* WME admission accepted */
814 #define WME_INVALID_PARAMETERS		1	/* WME invalide parameters */
815 #define WME_ADMISSION_REFUSED		3	/* WME admission refused */
816 
817 /* Macro to take a pointer to a beacon or probe response
818  * body and return the char* pointer to the SSID info element
819  */
820 #define BCN_PRB_SSID(body) ((char*)(body) + DOT11_BCN_PRB_LEN)
821 
822 /* Authentication frame payload constants */
823 #define DOT11_OPEN_SYSTEM	0	/* d11 open authentication */
824 #define DOT11_SHARED_KEY	1	/* d11 shared authentication */
825 #define DOT11_FAST_BSS		2	/* d11 fast bss authentication */
826 #define DOT11_CHALLENGE_LEN	128	/* d11 challenge text length */
827 
828 /* Frame control macros */
829 #define FC_PVER_MASK		0x3	/* PVER mask */
830 #define FC_PVER_SHIFT		0	/* PVER shift */
831 #define FC_TYPE_MASK		0xC	/* type mask */
832 #define FC_TYPE_SHIFT		2	/* type shift */
833 #define FC_SUBTYPE_MASK		0xF0	/* subtype mask */
834 #define FC_SUBTYPE_SHIFT	4	/* subtype shift */
835 #define FC_TODS			0x100	/* to DS */
836 #define FC_TODS_SHIFT		8	/* to DS shift */
837 #define FC_FROMDS		0x200	/* from DS */
838 #define FC_FROMDS_SHIFT		9	/* from DS shift */
839 #define FC_MOREFRAG		0x400	/* more frag. */
840 #define FC_MOREFRAG_SHIFT	10	/* more frag. shift */
841 #define FC_RETRY		0x800	/* retry */
842 #define FC_RETRY_SHIFT		11	/* retry shift */
843 #define FC_PM			0x1000	/* PM */
844 #define FC_PM_SHIFT		12	/* PM shift */
845 #define FC_MOREDATA		0x2000	/* more data */
846 #define FC_MOREDATA_SHIFT	13	/* more data shift */
847 #define FC_WEP			0x4000	/* WEP */
848 #define FC_WEP_SHIFT		14	/* WEP shift */
849 #define FC_ORDER		0x8000	/* order */
850 #define FC_ORDER_SHIFT		15	/* order shift */
851 
852 /* sequence control macros */
853 #define SEQNUM_SHIFT		4	/* seq. number shift */
854 #define SEQNUM_MAX		0x1000	/* max seqnum + 1 */
855 #define FRAGNUM_MASK		0xF	/* frag. number mask */
856 
857 /* Frame Control type/subtype defs */
858 
859 /* FC Types */
860 #define FC_TYPE_MNG		0	/* management type */
861 #define FC_TYPE_CTL		1	/* control type */
862 #define FC_TYPE_DATA		2	/* data type */
863 
864 /* Management Subtypes */
865 #define FC_SUBTYPE_ASSOC_REQ		0	/* assoc. request */
866 #define FC_SUBTYPE_ASSOC_RESP		1	/* assoc. response */
867 #define FC_SUBTYPE_REASSOC_REQ		2	/* reassoc. request */
868 #define FC_SUBTYPE_REASSOC_RESP		3	/* reassoc. response */
869 #define FC_SUBTYPE_PROBE_REQ		4	/* probe request */
870 #define FC_SUBTYPE_PROBE_RESP		5	/* probe response */
871 #define FC_SUBTYPE_BEACON		8	/* beacon */
872 #define FC_SUBTYPE_ATIM			9	/* ATIM */
873 #define FC_SUBTYPE_DISASSOC		10	/* disassoc. */
874 #define FC_SUBTYPE_AUTH			11	/* authentication */
875 #define FC_SUBTYPE_DEAUTH		12	/* de-authentication */
876 #define FC_SUBTYPE_ACTION		13	/* action */
877 #define FC_SUBTYPE_ACTION_NOACK		14	/* action no-ack */
878 
879 /* Control Subtypes */
880 #define FC_SUBTYPE_CTL_WRAPPER		7	/* Control Wrapper */
881 #define FC_SUBTYPE_BLOCKACK_REQ		8	/* Block Ack Req */
882 #define FC_SUBTYPE_BLOCKACK		9	/* Block Ack */
883 #define FC_SUBTYPE_PS_POLL		10	/* PS poll */
884 #define FC_SUBTYPE_RTS			11	/* RTS */
885 #define FC_SUBTYPE_CTS			12	/* CTS */
886 #define FC_SUBTYPE_ACK			13	/* ACK */
887 #define FC_SUBTYPE_CF_END		14	/* CF-END */
888 #define FC_SUBTYPE_CF_END_ACK		15	/* CF-END ACK */
889 
890 /* Data Subtypes */
891 #define FC_SUBTYPE_DATA			0	/* Data */
892 #define FC_SUBTYPE_DATA_CF_ACK		1	/* Data + CF-ACK */
893 #define FC_SUBTYPE_DATA_CF_POLL		2	/* Data + CF-Poll */
894 #define FC_SUBTYPE_DATA_CF_ACK_POLL	3	/* Data + CF-Ack + CF-Poll */
895 #define FC_SUBTYPE_NULL			4	/* Null */
896 #define FC_SUBTYPE_CF_ACK		5	/* CF-Ack */
897 #define FC_SUBTYPE_CF_POLL		6	/* CF-Poll */
898 #define FC_SUBTYPE_CF_ACK_POLL		7	/* CF-Ack + CF-Poll */
899 #define FC_SUBTYPE_QOS_DATA		8	/* QoS Data */
900 #define FC_SUBTYPE_QOS_DATA_CF_ACK	9	/* QoS Data + CF-Ack */
901 #define FC_SUBTYPE_QOS_DATA_CF_POLL	10	/* QoS Data + CF-Poll */
902 #define FC_SUBTYPE_QOS_DATA_CF_ACK_POLL	11	/* QoS Data + CF-Ack + CF-Poll */
903 #define FC_SUBTYPE_QOS_NULL		12	/* QoS Null */
904 #define FC_SUBTYPE_QOS_CF_POLL		14	/* QoS CF-Poll */
905 #define FC_SUBTYPE_QOS_CF_ACK_POLL	15	/* QoS CF-Ack + CF-Poll */
906 
907 /* Data Subtype Groups */
908 #define FC_SUBTYPE_ANY_QOS(s)		(((s) & 8) != 0)
909 #define FC_SUBTYPE_ANY_NULL(s)		(((s) & 4) != 0)
910 #define FC_SUBTYPE_ANY_CF_POLL(s)	(((s) & 2) != 0)
911 #define FC_SUBTYPE_ANY_CF_ACK(s)	(((s) & 1) != 0)
912 #define FC_SUBTYPE_ANY_PSPOLL(s)	(((s) & 10) != 0)
913 
914 /* Type/Subtype Combos */
915 #define FC_KIND_MASK		(FC_TYPE_MASK | FC_SUBTYPE_MASK)	/* FC kind mask */
916 
917 #define FC_KIND(t, s)	(((t) << FC_TYPE_SHIFT) | ((s) << FC_SUBTYPE_SHIFT))	/* FC kind */
918 
919 #define FC_SUBTYPE(fc)	(((fc) & FC_SUBTYPE_MASK) >> FC_SUBTYPE_SHIFT)	/* Subtype from FC */
920 #define FC_TYPE(fc)	(((fc) & FC_TYPE_MASK) >> FC_TYPE_SHIFT)	/* Type from FC */
921 
922 #define FC_ASSOC_REQ	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_REQ)	/* assoc. request */
923 #define FC_ASSOC_RESP	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_RESP)	/* assoc. response */
924 #define FC_REASSOC_REQ	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_REQ)	/* reassoc. request */
925 #define FC_REASSOC_RESP	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_RESP)	/* reassoc. response */
926 #define FC_PROBE_REQ	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_REQ)	/* probe request */
927 #define FC_PROBE_RESP	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_RESP)	/* probe response */
928 #define FC_BEACON	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_BEACON)		/* beacon */
929 #define FC_DISASSOC	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DISASSOC)	/* disassoc */
930 #define FC_AUTH		FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_AUTH)		/* authentication */
931 #define FC_DEAUTH	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DEAUTH)		/* deauthentication */
932 #define FC_ACTION	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ACTION)		/* action */
933 #define FC_ACTION_NOACK	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ACTION_NOACK)	/* action no-ack */
934 
935 #define FC_CTL_WRAPPER	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CTL_WRAPPER)	/* Control Wrapper */
936 #define FC_BLOCKACK_REQ	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_BLOCKACK_REQ)	/* Block Ack Req */
937 #define FC_BLOCKACK	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_BLOCKACK)	/* Block Ack */
938 #define FC_PS_POLL	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_PS_POLL)	/* PS poll */
939 #define FC_RTS		FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_RTS)		/* RTS */
940 #define FC_CTS		FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CTS)		/* CTS */
941 #define FC_ACK		FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_ACK)		/* ACK */
942 #define FC_CF_END	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END)		/* CF-END */
943 #define FC_CF_END_ACK	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END_ACK)	/* CF-END ACK */
944 
945 #define FC_DATA		FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA)		/* data */
946 #define FC_NULL_DATA	FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_NULL)		/* null data */
947 #define FC_DATA_CF_ACK	FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA_CF_ACK)	/* data CF ACK */
948 #define FC_QOS_DATA	FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_QOS_DATA)	/* QoS data */
949 #define FC_QOS_NULL	FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_QOS_NULL)	/* QoS null */
950 
951 /* QoS Control Field */
952 
953 /* 802.1D Priority */
954 #define QOS_PRIO_SHIFT		0	/* QoS priority shift */
955 #define QOS_PRIO_MASK		0x0007	/* QoS priority mask */
956 #define QOS_PRIO(qos)		(((qos) & QOS_PRIO_MASK) >> QOS_PRIO_SHIFT)	/* QoS priority */
957 
958 /* Traffic Identifier */
959 #define QOS_TID_SHIFT		0	/* QoS TID shift */
960 #define QOS_TID_MASK		0x000f	/* QoS TID mask */
961 #define QOS_TID(qos)		(((qos) & QOS_TID_MASK) >> QOS_TID_SHIFT)	/* QoS TID */
962 
963 /* End of Service Period (U-APSD) */
964 #define QOS_EOSP_SHIFT		4	/* QoS End of Service Period shift */
965 #define QOS_EOSP_MASK		0x0010	/* QoS End of Service Period mask */
966 #define QOS_EOSP(qos)		(((qos) & QOS_EOSP_MASK) >> QOS_EOSP_SHIFT)	/* Qos EOSP */
967 
968 /* Ack Policy */
969 #define QOS_ACK_NORMAL_ACK	0	/* Normal Ack */
970 #define QOS_ACK_NO_ACK		1	/* No Ack (eg mcast) */
971 #define QOS_ACK_NO_EXP_ACK	2	/* No Explicit Ack */
972 #define QOS_ACK_BLOCK_ACK	3	/* Block Ack */
973 #define QOS_ACK_SHIFT		5	/* QoS ACK shift */
974 #define QOS_ACK_MASK		0x0060	/* QoS ACK mask */
975 #define QOS_ACK(qos)		(((qos) & QOS_ACK_MASK) >> QOS_ACK_SHIFT)	/* QoS ACK */
976 
977 /* A-MSDU flag */
978 #define QOS_AMSDU_SHIFT		7	/* AMSDU shift */
979 #define QOS_AMSDU_MASK		0x0080	/* AMSDU mask */
980 
981 /* Management Frames */
982 
983 /* Management Frame Constants */
984 
985 /* Fixed fields */
986 #define DOT11_MNG_AUTH_ALGO_LEN		2	/* d11 management auth. algo. length */
987 #define DOT11_MNG_AUTH_SEQ_LEN		2	/* d11 management auth. seq. length */
988 #define DOT11_MNG_BEACON_INT_LEN	2	/* d11 management beacon interval length */
989 #define DOT11_MNG_CAP_LEN		2	/* d11 management cap. length */
990 #define DOT11_MNG_AP_ADDR_LEN		6	/* d11 management AP address length */
991 #define DOT11_MNG_LISTEN_INT_LEN	2	/* d11 management listen interval length */
992 #define DOT11_MNG_REASON_LEN		2	/* d11 management reason length */
993 #define DOT11_MNG_AID_LEN		2	/* d11 management AID length */
994 #define DOT11_MNG_STATUS_LEN		2	/* d11 management status length */
995 #define DOT11_MNG_TIMESTAMP_LEN		8	/* d11 management timestamp length */
996 
997 /* DUR/ID field in assoc resp is 0xc000 | AID */
998 #define DOT11_AID_MASK			0x3fff	/* d11 AID mask */
999 
1000 /* Reason Codes */
1001 #define DOT11_RC_RESERVED		0	/* d11 RC reserved */
1002 #define DOT11_RC_UNSPECIFIED		1	/* Unspecified reason */
1003 #define DOT11_RC_AUTH_INVAL		2	/* Previous authentication no longer valid */
1004 #define DOT11_RC_DEAUTH_LEAVING		3	/* Deauthenticated because sending station
1005 						 * is leaving (or has left) IBSS or ESS
1006 						 */
1007 #define DOT11_RC_INACTIVITY		4	/* Disassociated due to inactivity */
1008 #define DOT11_RC_BUSY			5	/* Disassociated because AP is unable to handle
1009 						 * all currently associated stations
1010 						 */
1011 #define DOT11_RC_INVAL_CLASS_2		6	/* Class 2 frame received from
1012 						 * nonauthenticated station
1013 						 */
1014 #define DOT11_RC_INVAL_CLASS_3		7	/* Class 3 frame received from
1015 						 *  nonassociated station
1016 						 */
1017 #define DOT11_RC_DISASSOC_LEAVING	8	/* Disassociated because sending station is
1018 						 * leaving (or has left) BSS
1019 						 */
1020 #define DOT11_RC_NOT_AUTH		9	/* Station requesting (re)association is not
1021 						 * authenticated with responding station
1022 						 */
1023 #define DOT11_RC_BAD_PC			10	/* Unacceptable power capability element */
1024 #define DOT11_RC_BAD_CHANNELS		11	/* Unacceptable supported channels element */
1025 /* 12 is unused */
1026 
1027 /* 32-39 are QSTA specific reasons added in 11e */
1028 #define DOT11_RC_UNSPECIFIED_QOS	32	/* unspecified QoS-related reason */
1029 #define DOT11_RC_INSUFFCIENT_BW		33	/* QAP lacks sufficient bandwidth */
1030 #define DOT11_RC_EXCESSIVE_FRAMES	34	/* excessive number of frames need ack */
1031 #define DOT11_RC_TX_OUTSIDE_TXOP	35	/* transmitting outside the limits of txop */
1032 #define DOT11_RC_LEAVING_QBSS		36	/* QSTA is leaving the QBSS (or restting) */
1033 #define DOT11_RC_BAD_MECHANISM		37	/* does not want to use the mechanism */
1034 #define DOT11_RC_SETUP_NEEDED		38	/* mechanism needs a setup */
1035 #define DOT11_RC_TIMEOUT		39	/* timeout */
1036 
1037 #define DOT11_RC_MAX			23	/* Reason codes > 23 are reserved */
1038 
1039 #define DOT11_RC_TDLS_PEER_UNREACH	25
1040 #define DOT11_RC_TDLS_DOWN_UNSPECIFIED	26
1041 
1042 /* Status Codes */
1043 #define DOT11_SC_SUCCESS		0	/* Successful */
1044 #define DOT11_SC_FAILURE		1	/* Unspecified failure */
1045 #define DOT11_SC_TDLS_WAKEUP_SCH_ALT 2	/* TDLS wakeup schedule rejected but alternative  */
1046 					/* schedule provided */
1047 #define DOT11_SC_TDLS_WAKEUP_SCH_REJ 3	/* TDLS wakeup schedule rejected */
1048 #define DOT11_SC_TDLS_SEC_DISABLED	5	/* TDLS Security disabled */
1049 #define DOT11_SC_LIFETIME_REJ		6	/* Unacceptable lifetime */
1050 #define DOT11_SC_NOT_SAME_BSS		7	/* Not in same BSS */
1051 #define DOT11_SC_CAP_MISMATCH		10	/* Cannot support all requested
1052 						 * capabilities in the Capability
1053 						 * Information field
1054 						 */
1055 #define DOT11_SC_REASSOC_FAIL		11	/* Reassociation denied due to inability
1056 						 * to confirm that association exists
1057 						 */
1058 #define DOT11_SC_ASSOC_FAIL		12	/* Association denied due to reason
1059 						 * outside the scope of this standard
1060 						 */
1061 #define DOT11_SC_AUTH_MISMATCH		13	/* Responding station does not support
1062 						 * the specified authentication
1063 						 * algorithm
1064 						 */
1065 #define DOT11_SC_AUTH_SEQ		14	/* Received an Authentication frame
1066 						 * with authentication transaction
1067 						 * sequence number out of expected
1068 						 * sequence
1069 						 */
1070 #define DOT11_SC_AUTH_CHALLENGE_FAIL	15	/* Authentication rejected because of
1071 						 * challenge failure
1072 						 */
1073 #define DOT11_SC_AUTH_TIMEOUT		16	/* Authentication rejected due to timeout
1074 						 * waiting for next frame in sequence
1075 						 */
1076 #define DOT11_SC_ASSOC_BUSY_FAIL	17	/* Association denied because AP is
1077 						 * unable to handle additional
1078 						 * associated stations
1079 						 */
1080 #define DOT11_SC_ASSOC_RATE_MISMATCH	18	/* Association denied due to requesting
1081 						 * station not supporting all of the
1082 						 * data rates in the BSSBasicRateSet
1083 						 * parameter
1084 						 */
1085 #define DOT11_SC_ASSOC_SHORT_REQUIRED	19	/* Association denied due to requesting
1086 						 * station not supporting the Short
1087 						 * Preamble option
1088 						 */
1089 #define DOT11_SC_ASSOC_PBCC_REQUIRED	20	/* Association denied due to requesting
1090 						 * station not supporting the PBCC
1091 						 * Modulation option
1092 						 */
1093 #define DOT11_SC_ASSOC_AGILITY_REQUIRED	21	/* Association denied due to requesting
1094 						 * station not supporting the Channel
1095 						 * Agility option
1096 						 */
1097 #define DOT11_SC_ASSOC_SPECTRUM_REQUIRED	22	/* Association denied because Spectrum
1098 							 * Management capability is required.
1099 							 */
1100 #define DOT11_SC_ASSOC_BAD_POWER_CAP	23	/* Association denied because the info
1101 						 * in the Power Cap element is
1102 						 * unacceptable.
1103 						 */
1104 #define DOT11_SC_ASSOC_BAD_SUP_CHANNELS	24	/* Association denied because the info
1105 						 * in the Supported Channel element is
1106 						 * unacceptable
1107 						 */
1108 #define DOT11_SC_ASSOC_SHORTSLOT_REQUIRED	25	/* Association denied due to requesting
1109 							 * station not supporting the Short Slot
1110 							 * Time option
1111 							 */
1112 #define DOT11_SC_ASSOC_ERPBCC_REQUIRED	26	/* Association denied due to requesting
1113 						 * station not supporting the ER-PBCC
1114 						 * Modulation option
1115 						 */
1116 #define DOT11_SC_ASSOC_DSSSOFDM_REQUIRED	27	/* Association denied due to requesting
1117 						 * station not supporting the DSS-OFDM
1118 						 * option
1119 						 */
1120 #define DOT11_SC_ASSOC_R0KH_UNREACHABLE	28	/* Association denied due to AP
1121 						 * being unable to reach the R0 Key Holder
1122 						 */
1123 #define DOT11_SC_ASSOC_TRY_LATER	30	/* Association denied temporarily, try again later
1124 						 */
1125 #define DOT11_SC_ASSOC_MFP_VIOLATION	31	/* Association denied due to Robust Management
1126 						 * frame policy violation
1127 						 */
1128 #define DOT11_SC_ASSOC_HT_REQUIRED	32	/* Association denied because the requesting
1129 						 * station does not support HT features
1130 						 */
1131 
1132 #define	DOT11_SC_DECLINED		37	/* request declined */
1133 #define	DOT11_SC_INVALID_PARAMS		38	/* One or more params have invalid values */
1134 #define DOT11_SC_INVALID_PAIRWISE_CIPHER	42 /* invalid pairwise cipher */
1135 #define	DOT11_SC_INVALID_AKMP		43	/* Association denied due to invalid AKMP */
1136 #define DOT11_SC_INVALID_RSNIE_CAP	45	/* invalid RSN IE capabilities */
1137 #define DOT11_SC_DLS_NOT_ALLOWED	48	/* DLS is not allowed in the BSS by policy */
1138 #define	DOT11_SC_INVALID_PMKID		53	/* Association denied due to invalid PMKID */
1139 #define	DOT11_SC_INVALID_MDID		54	/* Association denied due to invalid MDID */
1140 #define	DOT11_SC_INVALID_FTIE		55	/* Association denied due to invalid FTIE */
1141 
1142 #define DOT11_SC_ADV_PROTO_NOT_SUPPORTED	59	/* ad proto not supported */
1143 #define DOT11_SC_NO_OUTSTAND_REQ			60	/* no outstanding req */
1144 #define DOT11_SC_RSP_NOT_RX_FROM_SERVER		61	/* no response from server */
1145 #define DOT11_SC_TIMEOUT					62	/* timeout */
1146 #define DOT11_SC_QUERY_RSP_TOO_LARGE		63	/* query rsp too large */
1147 #define DOT11_SC_SERVER_UNREACHABLE			65	/* server unreachable */
1148 
1149 #define DOT11_SC_UNEXP_MSG			70	/* Unexpected message */
1150 #define DOT11_SC_INVALID_SNONCE		71	/* Invalid SNonce */
1151 #define DOT11_SC_INVALID_RSNIE		72	/* Invalid contents of RSNIE */
1152 #define DOT11_SC_ASSOC_VHT_REQUIRED	104	/* Association denied because the requesting
1153 						 * station does not support VHT features.
1154 						 */
1155 
1156 #define DOT11_SC_TRANSMIT_FAILURE	79	/* transmission failure */
1157 
1158 /* Info Elts, length of INFORMATION portion of Info Elts */
1159 #define DOT11_MNG_DS_PARAM_LEN			1	/* d11 management DS parameter length */
1160 #define DOT11_MNG_IBSS_PARAM_LEN		2	/* d11 management IBSS parameter length */
1161 
1162 /* TIM Info element has 3 bytes fixed info in INFORMATION field,
1163  * followed by 1 to 251 bytes of Partial Virtual Bitmap
1164  */
1165 #define DOT11_MNG_TIM_FIXED_LEN			3	/* d11 management TIM fixed length */
1166 #define DOT11_MNG_TIM_DTIM_COUNT		0	/* d11 management DTIM count */
1167 #define DOT11_MNG_TIM_DTIM_PERIOD		1	/* d11 management DTIM period */
1168 #define DOT11_MNG_TIM_BITMAP_CTL		2	/* d11 management TIM BITMAP control  */
1169 #define DOT11_MNG_TIM_PVB			3	/* d11 management TIM PVB */
1170 
1171 /* TLV defines */
1172 #define TLV_TAG_OFF		0	/* tag offset */
1173 #define TLV_LEN_OFF		1	/* length offset */
1174 #define TLV_HDR_LEN		2	/* header length */
1175 #define TLV_BODY_OFF		2	/* body offset */
1176 
1177 /* Management Frame Information Element IDs */
1178 #define DOT11_MNG_SSID_ID			0	/* d11 management SSID id */
1179 #define DOT11_MNG_RATES_ID			1	/* d11 management rates id */
1180 #define DOT11_MNG_FH_PARMS_ID			2	/* d11 management FH parameter id */
1181 #define DOT11_MNG_DS_PARMS_ID			3	/* d11 management DS parameter id */
1182 #define DOT11_MNG_CF_PARMS_ID			4	/* d11 management CF parameter id */
1183 #define DOT11_MNG_TIM_ID			5	/* d11 management TIM id */
1184 #define DOT11_MNG_IBSS_PARMS_ID			6	/* d11 management IBSS parameter id */
1185 #define DOT11_MNG_COUNTRY_ID			7	/* d11 management country id */
1186 #define DOT11_MNG_HOPPING_PARMS_ID		8	/* d11 management hopping parameter id */
1187 #define DOT11_MNG_HOPPING_TABLE_ID		9	/* d11 management hopping table id */
1188 #define DOT11_MNG_REQUEST_ID			10	/* d11 management request id */
1189 #define DOT11_MNG_QBSS_LOAD_ID 			11	/* d11 management QBSS Load id */
1190 #define DOT11_MNG_EDCA_PARAM_ID			12	/* 11E EDCA Parameter id */
1191 #define DOT11_MNG_TSPEC_ID			13	/* d11 management TSPEC id */
1192 #define DOT11_MNG_TCLAS_ID			14	/* d11 management TCLAS id */
1193 #define DOT11_MNG_CHALLENGE_ID			16	/* d11 management chanllenge id */
1194 #define DOT11_MNG_PWR_CONSTRAINT_ID		32	/* 11H PowerConstraint */
1195 #define DOT11_MNG_PWR_CAP_ID			33	/* 11H PowerCapability */
1196 #define DOT11_MNG_TPC_REQUEST_ID 		34	/* 11H TPC Request */
1197 #define DOT11_MNG_TPC_REPORT_ID			35	/* 11H TPC Report */
1198 #define DOT11_MNG_SUPP_CHANNELS_ID		36	/* 11H Supported Channels */
1199 #define DOT11_MNG_CHANNEL_SWITCH_ID		37	/* 11H ChannelSwitch Announcement */
1200 #define DOT11_MNG_MEASURE_REQUEST_ID		38	/* 11H MeasurementRequest */
1201 #define DOT11_MNG_MEASURE_REPORT_ID		39	/* 11H MeasurementReport */
1202 #define DOT11_MNG_QUIET_ID			40	/* 11H Quiet */
1203 #define DOT11_MNG_IBSS_DFS_ID			41	/* 11H IBSS_DFS */
1204 #define DOT11_MNG_ERP_ID			42	/* d11 management ERP id */
1205 #define DOT11_MNG_TS_DELAY_ID			43	/* d11 management TS Delay id */
1206 #define DOT11_MNG_TCLAS_PROC_ID			44	/* d11 management TCLAS processing id */
1207 #define	DOT11_MNG_HT_CAP			45	/* d11 mgmt HT cap id */
1208 #define DOT11_MNG_QOS_CAP_ID			46	/* 11E QoS Capability id */
1209 #define DOT11_MNG_NONERP_ID			47	/* d11 management NON-ERP id */
1210 #define DOT11_MNG_RSN_ID			48	/* d11 management RSN id */
1211 #define DOT11_MNG_EXT_RATES_ID			50	/* d11 management ext. rates id */
1212 #define DOT11_MNG_AP_CHREP_ID			51	/* 11k AP Channel report id */
1213 #define DOT11_MNG_NEIGHBOR_REP_ID		52	/* 11k & 11v Neighbor report id */
1214 #define DOT11_MNG_RCPI_ID			53	/* 11k RCPI */
1215 #define DOT11_MNG_MDIE_ID			54	/* 11r Mobility domain id */
1216 #define DOT11_MNG_FTIE_ID			55	/* 11r Fast Bss Transition id */
1217 #define DOT11_MNG_FT_TI_ID			56	/* 11r Timeout Interval id */
1218 #define DOT11_MNG_RDE_ID			57	/* 11r RIC Data Element id */
1219 #define	DOT11_MNG_REGCLASS_ID			59	/* d11 management regulatory class id */
1220 #define DOT11_MNG_EXT_CSA_ID			60	/* d11 Extended CSA */
1221 #define	DOT11_MNG_HT_ADD			61	/* d11 mgmt additional HT info */
1222 #define	DOT11_MNG_EXT_CHANNEL_OFFSET		62	/* d11 mgmt ext channel offset */
1223 #define DOT11_MNG_BSS_AVR_ACCESS_DELAY_ID	63	/* 11k bss average access delay */
1224 #define DOT11_MNG_ANTENNA_ID			64	/* 11k antenna id */
1225 #define DOT11_MNG_RSNI_ID			65	/* 11k RSNI id */
1226 #define DOT11_MNG_MEASUREMENT_PILOT_TX_ID	66	/* 11k measurement pilot tx info id */
1227 #define DOT11_MNG_BSS_AVAL_ADMISSION_CAP_ID	67	/* 11k bss aval admission cap id */
1228 #define DOT11_MNG_BSS_AC_ACCESS_DELAY_ID	68	/* 11k bss AC access delay id */
1229 #define DOT11_MNG_WAPI_ID			68	/* d11 management WAPI id */
1230 #define DOT11_MNG_TIME_ADVERTISE_ID	69	/* 11p time advertisement */
1231 #define DOT11_MNG_RRM_CAP_ID		70	/* 11k radio measurement capability */
1232 #define DOT11_MNG_MULTIPLE_BSSID_ID		71	/* 11k multiple BSSID id */
1233 #define	DOT11_MNG_HT_BSS_COEXINFO_ID		72	/* d11 mgmt OBSS Coexistence INFO */
1234 #define	DOT11_MNG_HT_BSS_CHANNEL_REPORT_ID	73	/* d11 mgmt OBSS Intolerant Channel list */
1235 #define	DOT11_MNG_HT_OBSS_ID			74	/* d11 mgmt OBSS HT info */
1236 #define DOT11_MNG_MMIE_ID			76	/* d11 mgmt MIC IE */
1237 #define DOT11_MNG_BSS_MAX_IDLE_PERIOD_ID	90	/* 11v bss max idle id */
1238 #define DOT11_MNG_TFS_REQUEST_ID		91	/* 11v tfs request id */
1239 #define DOT11_MNG_TFS_RESPONSE_ID		92	/* 11v tfs response id */
1240 #define DOT11_MNG_WNM_SLEEP_MODE_ID		93	/* 11v wnm-sleep mode id */
1241 #define DOT11_MNG_TIMBC_REQ_ID			94	/* 11v TIM broadcast request id */
1242 #define DOT11_MNG_TIMBC_RESP_ID			95	/* 11v TIM broadcast response id */
1243 #define DOT11_MNG_CHANNEL_USAGE			97	/* 11v channel usage */
1244 #define DOT11_MNG_TIME_ZONE_ID			98	/* 11v time zone */
1245 #define DOT11_MNG_DMS_REQUEST_ID		99	/* 11v dms request id */
1246 #define DOT11_MNG_DMS_RESPONSE_ID		100	/* 11v dms response id */
1247 #define DOT11_MNG_LINK_IDENTIFIER_ID		101	/* 11z TDLS Link Identifier IE */
1248 #define DOT11_MNG_WAKEUP_SCHEDULE_ID		102	/* 11z TDLS Wakeup Schedule IE */
1249 #define DOT11_MNG_CHANNEL_SWITCH_TIMING_ID	104	/* 11z TDLS Channel Switch Timing IE */
1250 #define DOT11_MNG_PTI_CONTROL_ID		105	/* 11z TDLS PTI Control IE */
1251 #define DOT11_MNG_PU_BUFFER_STATUS_ID	106	/* 11z TDLS PU Buffer Status IE */
1252 #define DOT11_MNG_INTERWORKING_ID		107	/* 11u interworking */
1253 #define DOT11_MNG_ADVERTISEMENT_ID		108	/* 11u advertisement protocol */
1254 #define DOT11_MNG_EXP_BW_REQ_ID			109	/* 11u expedited bandwith request */
1255 #define DOT11_MNG_QOS_MAP_ID			110	/* 11u QoS map set */
1256 #define DOT11_MNG_ROAM_CONSORT_ID		111	/* 11u roaming consortium */
1257 #define DOT11_MNG_EMERGCY_ALERT_ID		112	/* 11u emergency alert identifier */
1258 #define	DOT11_MNG_EXT_CAP_ID			127	/* d11 mgmt ext capability */
1259 #define	DOT11_MNG_VHT_CAP_ID			191	/* d11 mgmt VHT cap id */
1260 #define	DOT11_MNG_VHT_OPERATION_ID		192	/* d11 mgmt VHT op id */
1261 #define DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID		194	/* Wide BW Channel Switch IE */
1262 #define DOT11_MNG_VHT_TRANSMIT_POWER_ENVELOPE_ID	195	/* VHT transmit Power Envelope IE */
1263 #define DOT11_MNG_CHANNEL_SWITCH_WRAPPER_ID		196	/* Channel Switch Wrapper IE */
1264 #define DOT11_MNG_AID_ID					197	/* Association ID  IE */
1265 #define	DOT11_MNG_OPER_MODE_NOTIF_ID	199	/* d11 mgmt VHT oper mode notif */
1266 
1267 
1268 #define DOT11_MNG_WPA_ID			221	/* d11 management WPA id */
1269 #define DOT11_MNG_PROPR_ID			221	/* d11 management proprietary id */
1270 /* should start using this one instead of above two */
1271 #define DOT11_MNG_VS_ID				221	/* d11 management Vendor Specific IE */
1272 
1273 /* Rate Defines */
1274 
1275 /* Valid rates for the Supported Rates and Extended Supported Rates IEs.
1276  * Encoding is the rate in 500kbps units, rouding up for fractional values.
1277  * 802.11-2012, section 6.5.5.2, DATA_RATE parameter enumerates all the values.
1278  * The rate values cover DSSS, HR/DSSS, ERP, and OFDM phy rates.
1279  * The defines below do not cover the rates specific to 10MHz, {3, 4.5, 27},
1280  * and 5MHz, {1.5, 2.25, 3, 4.5, 13.5}, which are not supported by Broadcom devices.
1281  */
1282 
1283 #define DOT11_RATE_1M   2       /* 1  Mbps in 500kbps units */
1284 #define DOT11_RATE_2M   4       /* 2  Mbps in 500kbps units */
1285 #define DOT11_RATE_5M5  11      /* 5.5 Mbps in 500kbps units */
1286 #define DOT11_RATE_11M  22      /* 11 Mbps in 500kbps units */
1287 #define DOT11_RATE_6M   12      /* 6  Mbps in 500kbps units */
1288 #define DOT11_RATE_9M   18      /* 9  Mbps in 500kbps units */
1289 #define DOT11_RATE_12M  24      /* 12 Mbps in 500kbps units */
1290 #define DOT11_RATE_18M  36      /* 18 Mbps in 500kbps units */
1291 #define DOT11_RATE_24M  48      /* 24 Mbps in 500kbps units */
1292 #define DOT11_RATE_36M  72      /* 36 Mbps in 500kbps units */
1293 #define DOT11_RATE_48M  96      /* 48 Mbps in 500kbps units */
1294 #define DOT11_RATE_54M  108     /* 54 Mbps in 500kbps units */
1295 #define DOT11_RATE_MAX  108     /* highest rate (54 Mbps) in 500kbps units */
1296 
1297 /* Supported Rates and Extended Supported Rates IEs
1298  * The supported rates octets are defined a the MSB indicatin a Basic Rate
1299  * and bits 0-6 as the rate value
1300  */
1301 #define DOT11_RATE_BASIC                0x80 /* flag for a Basic Rate */
1302 #define DOT11_RATE_MASK                 0x7F /* mask for numeric part of rate */
1303 
1304 /* BSS Membership Selector parameters
1305  * 802.11-2012 and 802.11ac_D4.0 sec 8.4.2.3
1306  * These selector values are advertised in Supported Rates and Extended Supported Rates IEs
1307  * in the supported rates list with the Basic rate bit set.
1308  * Constants below include the basic bit.
1309  */
1310 #define DOT11_BSS_MEMBERSHIP_HT         0xFF  /* Basic 0x80 + 127, HT Required to join */
1311 #define DOT11_BSS_MEMBERSHIP_VHT        0xFE  /* Basic 0x80 + 126, VHT Required to join */
1312 
1313 /* ERP info element bit values */
1314 #define DOT11_MNG_ERP_LEN			1	/* ERP is currently 1 byte long */
1315 #define DOT11_MNG_NONERP_PRESENT		0x01	/* NonERP (802.11b) STAs are present
1316 							 *in the BSS
1317 							 */
1318 #define DOT11_MNG_USE_PROTECTION		0x02	/* Use protection mechanisms for
1319 							 *ERP-OFDM frames
1320 							 */
1321 #define DOT11_MNG_BARKER_PREAMBLE		0x04	/* Short Preambles: 0 == allowed,
1322 							 * 1 == not allowed
1323 							 */
1324 /* TS Delay element offset & size */
1325 #define DOT11_MGN_TS_DELAY_LEN		4	/* length of TS DELAY IE */
1326 #define TS_DELAY_FIELD_SIZE			4	/* TS DELAY field size */
1327 
1328 /* Capability Information Field */
1329 #define DOT11_CAP_ESS				0x0001	/* d11 cap. ESS */
1330 #define DOT11_CAP_IBSS				0x0002	/* d11 cap. IBSS */
1331 #define DOT11_CAP_POLLABLE			0x0004	/* d11 cap. pollable */
1332 #define DOT11_CAP_POLL_RQ			0x0008	/* d11 cap. poll request */
1333 #define DOT11_CAP_PRIVACY			0x0010	/* d11 cap. privacy */
1334 #define DOT11_CAP_SHORT				0x0020	/* d11 cap. short */
1335 #define DOT11_CAP_PBCC				0x0040	/* d11 cap. PBCC */
1336 #define DOT11_CAP_AGILITY			0x0080	/* d11 cap. agility */
1337 #define DOT11_CAP_SPECTRUM			0x0100	/* d11 cap. spectrum */
1338 #define DOT11_CAP_QOS				0x0200	/* d11 cap. qos */
1339 #define DOT11_CAP_SHORTSLOT			0x0400	/* d11 cap. shortslot */
1340 #define DOT11_CAP_APSD				0x0800	/* d11 cap. apsd */
1341 #define DOT11_CAP_RRM				0x1000	/* d11 cap. 11k radio measurement */
1342 #define DOT11_CAP_CCK_OFDM			0x2000	/* d11 cap. CCK/OFDM */
1343 #define DOT11_CAP_DELAY_BA			0x4000	/* d11 cap. delayed block ack */
1344 #define DOT11_CAP_IMMEDIATE_BA			0x8000	/* d11 cap. immediate block ack */
1345 
1346 /* Extended capabilities IE bitfields */
1347 /* 20/40 BSS Coexistence Management support bit position */
1348 #define DOT11_EXT_CAP_OBSS_COEX_MGMT		0
1349 /* scheduled PSMP support bit position */
1350 #define DOT11_EXT_CAP_SPSMP			6
1351 /*  Flexible Multicast Service */
1352 #define DOT11_EXT_CAP_FMS			11
1353 /* proxy ARP service support bit position */
1354 #define DOT11_EXT_CAP_PROXY_ARP			12
1355 /* Traffic Filter Service */
1356 #define DOT11_EXT_CAP_TFS			16
1357 /* WNM-Sleep Mode */
1358 #define DOT11_EXT_CAP_WNM_SLEEP			17
1359 /* TIM Broadcast service */
1360 #define DOT11_EXT_CAP_TIMBC			18
1361 /* BSS Transition Management support bit position */
1362 #define DOT11_EXT_CAP_BSSTRANS_MGMT		19
1363 /* Direct Multicast Service */
1364 #define DOT11_EXT_CAP_DMS			26
1365 /* Interworking support bit position */
1366 #define DOT11_EXT_CAP_IW			31
1367 /* service Interval granularity bit position and mask */
1368 #define DOT11_EXT_CAP_SI			41
1369 #define DOT11_EXT_CAP_SI_MASK			0x0E
1370 /* WNM notification */
1371 #define DOT11_EXT_CAP_WNM_NOTIF			46
1372 /* Operating mode notification - VHT (11ac D3.0 - 8.4.2.29) */
1373 #define DOT11_EXT_CAP_OPER_MODE_NOTIF		62
1374 
1375 /* VHT Operating mode bit fields -  (11ac D3.0 - 8.4.1.50) */
1376 #define DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT 0
1377 #define DOT11_OPER_MODE_CHANNEL_WIDTH_MASK 0x3
1378 #define DOT11_OPER_MODE_RXNSS_SHIFT 4
1379 #define DOT11_OPER_MODE_RXNSS_MASK 0x70
1380 #define DOT11_OPER_MODE_RXNSS_TYPE_SHIFT 7
1381 #define DOT11_OPER_MODE_RXNSS_TYPE_MASK 0x80
1382 
1383 #define DOT11_OPER_MODE(type, nss, chanw) (\
1384 	((type) << DOT11_OPER_MODE_RXNSS_TYPE_SHIFT &\
1385 		 DOT11_OPER_MODE_RXNSS_TYPE_MASK) |\
1386 	(((nss) - 1) << DOT11_OPER_MODE_RXNSS_SHIFT & DOT11_OPER_MODE_RXNSS_MASK) |\
1387 	((chanw) << DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT &\
1388 		 DOT11_OPER_MODE_CHANNEL_WIDTH_MASK))
1389 
1390 #define DOT11_OPER_MODE_CHANNEL_WIDTH(mode) \
1391 	(((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK)\
1392 		>> DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT)
1393 #define DOT11_OPER_MODE_RXNSS(mode) \
1394 	((((mode) & DOT11_OPER_MODE_RXNSS_MASK)		\
1395 		>> DOT11_OPER_MODE_RXNSS_SHIFT) + 1)
1396 #define DOT11_OPER_MODE_RXNSS_TYPE(mode) \
1397 	(((mode) & DOT11_OPER_MODE_RXNSS_TYPE_MASK)\
1398 		>> DOT11_OPER_MODE_RXNSS_TYPE_SHIFT)
1399 
1400 #define DOT11_OPER_MODE_20MHZ 0
1401 #define DOT11_OPER_MODE_40MHZ 1
1402 #define DOT11_OPER_MODE_80MHZ 2
1403 #define DOT11_OPER_MODE_160MHZ 3
1404 #define DOT11_OPER_MODE_8080MHZ 3
1405 
1406 #define DOT11_OPER_MODE_CHANNEL_WIDTH_20MHZ(mode) (\
1407 	((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_20MHZ)
1408 #define DOT11_OPER_MODE_CHANNEL_WIDTH_40MHZ(mode) (\
1409 	((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_40MHZ)
1410 #define DOT11_OPER_MODE_CHANNEL_WIDTH_80MHZ(mode) (\
1411 	((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_80MHZ)
1412 #define DOT11_OPER_MODE_CHANNEL_WIDTH_160MHZ(mode) (\
1413 	((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_160MHZ)
1414 #define DOT11_OPER_MODE_CHANNEL_WIDTH_8080MHZ(mode) (\
1415 	((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_8080MHZ)
1416 
1417 /* Operating mode information element 802.11ac D3.0 - 8.4.2.168 */
1418 BWL_PRE_PACKED_STRUCT struct dot11_oper_mode_notif_ie {
1419 	uint8 mode;
1420 } BWL_POST_PACKED_STRUCT;
1421 typedef struct dot11_oper_mode_notif_ie dot11_oper_mode_notif_ie_t;
1422 
1423 #define DOT11_OPER_MODE_NOTIF_IE_LEN 1
1424 
1425 /* Extended Capability Information Field */
1426 #define DOT11_OBSS_COEX_MNG_SUPPORT	0x01	/* 20/40 BSS Coexistence Management support */
1427 
1428 /*
1429  * Action Frame Constants
1430  */
1431 #define DOT11_ACTION_HDR_LEN		2	/* action frame category + action field */
1432 #define DOT11_ACTION_CAT_OFF		0	/* category offset */
1433 #define DOT11_ACTION_ACT_OFF		1	/* action offset */
1434 
1435 /* Action Category field (sec 8.4.1.11) */
1436 #define DOT11_ACTION_CAT_ERR_MASK	0x80	/* category error mask */
1437 #define DOT11_ACTION_CAT_MASK		0x7F	/* category mask */
1438 #define DOT11_ACTION_CAT_SPECT_MNG	0	/* category spectrum management */
1439 #define DOT11_ACTION_CAT_QOS		1	/* category QoS */
1440 #define DOT11_ACTION_CAT_DLS		2	/* category DLS */
1441 #define DOT11_ACTION_CAT_BLOCKACK	3	/* category block ack */
1442 #define DOT11_ACTION_CAT_PUBLIC		4	/* category public */
1443 #define DOT11_ACTION_CAT_RRM		5	/* category radio measurements */
1444 #define DOT11_ACTION_CAT_FBT	6	/* category fast bss transition */
1445 #define DOT11_ACTION_CAT_HT		7	/* category for HT */
1446 #define	DOT11_ACTION_CAT_SA_QUERY	8	/* security association query */
1447 #define	DOT11_ACTION_CAT_PDPA		9	/* protected dual of public action */
1448 #define DOT11_ACTION_CAT_WNM		10	/* category for WNM */
1449 #define DOT11_ACTION_CAT_UWNM		11	/* category for Unprotected WNM */
1450 #define DOT11_ACTION_NOTIFICATION	17
1451 #define DOT11_ACTION_CAT_VHT		21	/* VHT action */
1452 #define DOT11_ACTION_CAT_VSP		126	/* protected vendor specific */
1453 #define DOT11_ACTION_CAT_VS		127	/* category Vendor Specific */
1454 
1455 /* Spectrum Management Action IDs (sec 7.4.1) */
1456 #define DOT11_SM_ACTION_M_REQ		0	/* d11 action measurement request */
1457 #define DOT11_SM_ACTION_M_REP		1	/* d11 action measurement response */
1458 #define DOT11_SM_ACTION_TPC_REQ		2	/* d11 action TPC request */
1459 #define DOT11_SM_ACTION_TPC_REP		3	/* d11 action TPC response */
1460 #define DOT11_SM_ACTION_CHANNEL_SWITCH	4	/* d11 action channel switch */
1461 #define DOT11_SM_ACTION_EXT_CSA		5	/* d11 extened CSA for 11n */
1462 
1463 /* HT action ids */
1464 #define DOT11_ACTION_ID_HT_CH_WIDTH	0	/* notify channel width action id */
1465 #define DOT11_ACTION_ID_HT_MIMO_PS	1	/* mimo ps action id */
1466 
1467 /* Public action ids */
1468 #define DOT11_PUB_ACTION_BSS_COEX_MNG	0	/* 20/40 Coexistence Management action id */
1469 #define DOT11_PUB_ACTION_CHANNEL_SWITCH	4	/* d11 action channel switch */
1470 
1471 /* Block Ack action types */
1472 #define DOT11_BA_ACTION_ADDBA_REQ	0	/* ADDBA Req action frame type */
1473 #define DOT11_BA_ACTION_ADDBA_RESP	1	/* ADDBA Resp action frame type */
1474 #define DOT11_BA_ACTION_DELBA		2	/* DELBA action frame type */
1475 
1476 /* ADDBA action parameters */
1477 #define DOT11_ADDBA_PARAM_AMSDU_SUP	0x0001	/* AMSDU supported under BA */
1478 #define DOT11_ADDBA_PARAM_POLICY_MASK	0x0002	/* policy mask(ack vs delayed) */
1479 #define DOT11_ADDBA_PARAM_POLICY_SHIFT	1	/* policy shift */
1480 #define DOT11_ADDBA_PARAM_TID_MASK	0x003c	/* tid mask */
1481 #define DOT11_ADDBA_PARAM_TID_SHIFT	2	/* tid shift */
1482 #define DOT11_ADDBA_PARAM_BSIZE_MASK	0xffc0	/* buffer size mask */
1483 #define DOT11_ADDBA_PARAM_BSIZE_SHIFT	6	/* buffer size shift */
1484 
1485 #define DOT11_ADDBA_POLICY_DELAYED	0	/* delayed BA policy */
1486 #define DOT11_ADDBA_POLICY_IMMEDIATE	1	/* immediate BA policy */
1487 
1488 /* Fast Transition action types */
1489 #define DOT11_FT_ACTION_FT_RESERVED		0
1490 #define DOT11_FT_ACTION_FT_REQ			1	/* FBT request - for over-the-DS FBT */
1491 #define DOT11_FT_ACTION_FT_RES			2	/* FBT response - for over-the-DS FBT */
1492 #define DOT11_FT_ACTION_FT_CON			3	/* FBT confirm - for OTDS with RRP */
1493 #define DOT11_FT_ACTION_FT_ACK			4	/* FBT ack */
1494 
1495 /* DLS action types */
1496 #define DOT11_DLS_ACTION_REQ			0	/* DLS Request */
1497 #define DOT11_DLS_ACTION_RESP			1	/* DLS Response */
1498 #define DOT11_DLS_ACTION_TD			2	/* DLS Teardown */
1499 
1500 /* Wireless Network Management (WNM) action types */
1501 #define DOT11_WNM_ACTION_EVENT_REQ		0
1502 #define DOT11_WNM_ACTION_EVENT_REP		1
1503 #define DOT11_WNM_ACTION_DIAG_REQ		2
1504 #define DOT11_WNM_ACTION_DIAG_REP		3
1505 #define DOT11_WNM_ACTION_LOC_CFG_REQ		4
1506 #define DOT11_WNM_ACTION_LOC_RFG_RESP		5
1507 #define DOT11_WNM_ACTION_BSSTRANS_QUERY		6
1508 #define DOT11_WNM_ACTION_BSSTRANS_REQ		7
1509 #define DOT11_WNM_ACTION_BSSTRANS_RESP		8
1510 #define DOT11_WNM_ACTION_FMS_REQ		9
1511 #define DOT11_WNM_ACTION_FMS_RESP		10
1512 #define DOT11_WNM_ACTION_COL_INTRFRNCE_REQ	11
1513 #define DOT11_WNM_ACTION_COL_INTRFRNCE_REP	12
1514 #define DOT11_WNM_ACTION_TFS_REQ		13
1515 #define DOT11_WNM_ACTION_TFS_RESP		14
1516 #define DOT11_WNM_ACTION_TFS_NOTIFY		15
1517 #define DOT11_WNM_ACTION_WNM_SLEEP_REQ		16
1518 #define DOT11_WNM_ACTION_WNM_SLEEP_RESP		17
1519 #define DOT11_WNM_ACTION_TIMBC_REQ		18
1520 #define DOT11_WNM_ACTION_TIMBC_RESP		19
1521 #define DOT11_WNM_ACTION_QOS_TRFC_CAP_UPD	20
1522 #define DOT11_WNM_ACTION_CHAN_USAGE_REQ		21
1523 #define DOT11_WNM_ACTION_CHAN_USAGE_RESP	22
1524 #define DOT11_WNM_ACTION_DMS_REQ		23
1525 #define DOT11_WNM_ACTION_DMS_RESP		24
1526 #define DOT11_WNM_ACTION_TMNG_MEASUR_REQ	25
1527 #define DOT11_WNM_ACTION_NOTFCTN_REQ		26
1528 #define DOT11_WNM_ACTION_NOTFCTN_RESP		27
1529 
1530 /* Unprotected Wireless Network Management (WNM) action types */
1531 #define DOT11_UWNM_ACTION_TIM			0
1532 #define DOT11_UWNM_ACTION_TIMING_MEASUREMENT	1
1533 
1534 #define DOT11_MNG_COUNTRY_ID_LEN 3
1535 
1536 /* VHT category action types - 802.11ac D3.0 - 8.5.23.1 */
1537 #define DOT11_VHT_ACTION_CBF				0	/* Compressed Beamforming */
1538 #define DOT11_VHT_ACTION_GID_MGMT			1	/* Group ID Management */
1539 #define DOT11_VHT_ACTION_OPER_MODE_NOTIF	2	/* Operating mode notif'n */
1540 
1541 /* DLS Request frame header */
1542 BWL_PRE_PACKED_STRUCT struct dot11_dls_req {
1543 	uint8 category;			/* category of action frame (2) */
1544 	uint8 action;				/* DLS action: req (0) */
1545 	struct ether_addr	da;		/* destination address */
1546 	struct ether_addr	sa;		/* source address */
1547 	uint16 cap;				/* capability */
1548 	uint16 timeout;			/* timeout value */
1549 	uint8 data[1];				/* IE:support rate, extend support rate, HT cap */
1550 } BWL_POST_PACKED_STRUCT;
1551 typedef struct dot11_dls_req dot11_dls_req_t;
1552 #define DOT11_DLS_REQ_LEN 18	/* Fixed length */
1553 
1554 /* DLS response frame header */
1555 BWL_PRE_PACKED_STRUCT struct dot11_dls_resp {
1556 	uint8 category;			/* category of action frame (2) */
1557 	uint8 action;				/* DLS action: req (0) */
1558 	uint16 status;				/* status code field */
1559 	struct ether_addr	da;		/* destination address */
1560 	struct ether_addr	sa;		/* source address */
1561 	uint8 data[1];				/* optional: capability, rate ... */
1562 } BWL_POST_PACKED_STRUCT;
1563 typedef struct dot11_dls_resp dot11_dls_resp_t;
1564 #define DOT11_DLS_RESP_LEN 16	/* Fixed length */
1565 
1566 
1567 /* ************* 802.11v related definitions. ************* */
1568 
1569 /* BSS Management Transition Query frame header */
1570 BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_query {
1571 	uint8 category;			/* category of action frame (10) */
1572 	uint8 action;			/* WNM action: trans_query (6) */
1573 	uint8 token;			/* dialog token */
1574 	uint8 reason;			/* transition query reason */
1575 	uint8 data[1];			/* Elements */
1576 } BWL_POST_PACKED_STRUCT;
1577 typedef struct dot11_bsstrans_query dot11_bsstrans_query_t;
1578 #define DOT11_BSSTRANS_QUERY_LEN 4	/* Fixed length */
1579 
1580 /* BSS Management Transition Request frame header */
1581 BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_req {
1582 	uint8 category;			/* category of action frame (10) */
1583 	uint8 action;			/* WNM action: trans_req (7) */
1584 	uint8 token;			/* dialog token */
1585 	uint8 reqmode;			/* transition request mode */
1586 	uint16 disassoc_tmr;		/* disassociation timer */
1587 	uint8 validity_intrvl;		/* validity interval */
1588 	uint8 data[1];			/* optional: BSS term duration, ... */
1589 						/* ...session info URL, candidate list */
1590 } BWL_POST_PACKED_STRUCT;
1591 typedef struct dot11_bsstrans_req dot11_bsstrans_req_t;
1592 #define DOT11_BSSTRANS_REQ_LEN 7	/* Fixed length */
1593 
1594 /* BSS Mgmt Transition Request Mode Field - 802.11v */
1595 #define DOT11_BSSTRANS_REQMODE_PREF_LIST_INCL		0x01
1596 #define DOT11_BSSTRANS_REQMODE_ABRIDGED			0x02
1597 #define DOT11_BSSTRANS_REQMODE_DISASSOC_IMMINENT	0x04
1598 #define DOT11_BSSTRANS_REQMODE_BSS_TERM_INCL		0x08
1599 #define DOT11_BSSTRANS_REQMODE_ESS_DISASSOC_IMNT	0x10
1600 
1601 /* BSS Management transition response frame header */
1602 BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_resp {
1603 	uint8 category;			/* category of action frame (10) */
1604 	uint8 action;			/* WNM action: trans_resp (8) */
1605 	uint8 token;			/* dialog token */
1606 	uint8 status;			/* transition status */
1607 	uint8 term_delay;		/* validity interval */
1608 	uint8 data[1];			/* optional: BSSID target, candidate list */
1609 } BWL_POST_PACKED_STRUCT;
1610 typedef struct dot11_bsstrans_resp dot11_bsstrans_resp_t;
1611 #define DOT11_BSSTRANS_RESP_LEN 5	/* Fixed length */
1612 
1613 /* BSS Mgmt Transition Response Status Field */
1614 #define DOT11_BSSTRANS_RESP_STATUS_ACCEPT			0
1615 #define DOT11_BSSTRANS_RESP_STATUS_REJECT			1
1616 #define DOT11_BSSTRANS_RESP_STATUS_REJ_INSUFF_BCN		2
1617 #define DOT11_BSSTRANS_RESP_STATUS_REJ_INSUFF_CAP		3
1618 #define DOT11_BSSTRANS_RESP_STATUS_REJ_TERM_UNDESIRED		4
1619 #define DOT11_BSSTRANS_RESP_STATUS_REJ_TERM_DELAY_REQ		5
1620 #define DOT11_BSSTRANS_RESP_STATUS_REJ_BSS_LIST_PROVIDED	6
1621 #define DOT11_BSSTRANS_RESP_STATUS_REJ_NO_SUITABLE_BSS		7
1622 #define DOT11_BSSTRANS_RESP_STATUS_REJ_LEAVING_ESS		8
1623 
1624 
1625 /* BSS Max Idle Period information element */
1626 BWL_PRE_PACKED_STRUCT struct dot11_bss_max_idle_period_ie {
1627 	uint8 id;				/* 90, DOT11_MNG_BSS_MAX_IDLE_PERIOD_ID */
1628 	uint8 len;
1629 	uint16 max_idle_period;			/* in unit of 1000 TUs */
1630 	uint8 idle_opt;
1631 } BWL_POST_PACKED_STRUCT;
1632 typedef struct dot11_bss_max_idle_period_ie dot11_bss_max_idle_period_ie_t;
1633 #define DOT11_BSS_MAX_IDLE_PERIOD_IE_LEN	3	/* bss max idle period IE size */
1634 #define DOT11_BSS_MAX_IDLE_PERIOD_OPT_PROTECTED	1	/* BSS max idle option */
1635 
1636 /* TIM Broadcast request information element */
1637 BWL_PRE_PACKED_STRUCT struct dot11_timbc_req_ie {
1638 	uint8 id;				/* 94, DOT11_MNG_TIMBC_REQ_ID */
1639 	uint8 len;
1640 	uint8 interval;				/* in unit of beacon interval */
1641 } BWL_POST_PACKED_STRUCT;
1642 typedef struct dot11_timbc_req_ie dot11_timbc_req_ie_t;
1643 #define DOT11_TIMBC_REQ_IE_LEN		1	/* Fixed length */
1644 
1645 /* TIM Broadcast request frame header */
1646 BWL_PRE_PACKED_STRUCT struct dot11_timbc_req {
1647 	uint8 category;				/* category of action frame (10) */
1648 	uint8 action;				/* WNM action: DOT11_WNM_ACTION_TIMBC_REQ(18) */
1649 	uint8 token;				/* dialog token */
1650 	uint8 data[1];				/* TIM broadcast request element */
1651 } BWL_POST_PACKED_STRUCT;
1652 typedef struct dot11_timbc_req dot11_timbc_req_t;
1653 #define DOT11_TIMBC_REQ_LEN		3	/* Fixed length */
1654 
1655 /* TIM Broadcast response information element */
1656 BWL_PRE_PACKED_STRUCT struct dot11_timbc_resp_ie {
1657 	uint8 id;				/* 95, DOT11_MNG_TIM_BROADCAST_RESP_ID */
1658 	uint8 len;
1659 	uint8 status;				/* status of add request */
1660 	uint8 interval;				/* in unit of beacon interval */
1661 	int32 offset;				/* in unit of ms */
1662 	uint16 high_rate;			/* in unit of 0.5 Mb/s */
1663 	uint16 low_rate;			/* in unit of 0.5 Mb/s */
1664 } BWL_POST_PACKED_STRUCT;
1665 typedef struct dot11_timbc_resp_ie dot11_timbc_resp_ie_t;
1666 #define DOT11_TIMBC_DENY_RESP_IE_LEN	1	/* Deny. Fixed length */
1667 #define DOT11_TIMBC_ACCEPT_RESP_IE_LEN	10	/* Accept. Fixed length */
1668 
1669 #define DOT11_TIMBC_STATUS_ACCEPT		0
1670 #define DOT11_TIMBC_STATUS_ACCEPT_TSTAMP	1
1671 #define DOT11_TIMBC_STATUS_DENY			2
1672 #define DOT11_TIMBC_STATUS_OVERRIDDEN		3
1673 
1674 /* TIM Broadcast request frame header */
1675 BWL_PRE_PACKED_STRUCT struct dot11_timbc_resp {
1676 	uint8 category;			/* category of action frame (10) */
1677 	uint8 action;			/* action: DOT11_WNM_ACTION_TIMBC_RESP(19) */
1678 	uint8 token;			/* dialog token */
1679 	uint8 data[1];			/* TIM broadcast response element */
1680 } BWL_POST_PACKED_STRUCT;
1681 typedef struct dot11_timbc_resp dot11_timbc_resp_t;
1682 #define DOT11_TIMBC_RESP_LEN	3	/* Fixed length */
1683 
1684 /* TIM element */
1685 BWL_PRE_PACKED_STRUCT struct dot11_tim_ie {
1686 	uint8 id;			/* 5, DOT11_MNG_TIM_ID	 */
1687 	uint8 len;			/* 4 - 255 */
1688 	uint8 dtim_count;		/* DTIM decrementing counter */
1689 	uint8 dtim_period;		/* DTIM period */
1690 	uint8 bitmap_control;	/* AID 0 + bitmap offset */
1691 	uint8 pvb[1];		/* Partial Virtual Bitmap, variable length */
1692 } BWL_POST_PACKED_STRUCT;
1693 typedef struct dot11_tim_ie dot11_tim_ie_t;
1694 #define DOT11_TIM_IE_FIXED_LEN	3	/* Fixed length, without id and len */
1695 #define DOT11_TIM_IE_FIXED_TOTAL_LEN	5	/* Fixed length, with id and len */
1696 
1697 /* TIM Broadcast frame header */
1698 BWL_PRE_PACKED_STRUCT struct dot11_timbc {
1699 	uint8 category;			/* category of action frame (11) */
1700 	uint8 action;			/* action: TIM (0) */
1701 	uint8 check_beacon;		/* need to check-beacon */
1702 	uint8 tsf[8];			/* Time Synchronization Function */
1703 	dot11_tim_ie_t tim_ie;		/* TIM element */
1704 } BWL_POST_PACKED_STRUCT;
1705 typedef struct dot11_timbc dot11_timbc_t;
1706 #define DOT11_TIMBC_HDR_LEN	(sizeof(dot11_timbc_t) - sizeof(dot11_tim_ie_t))
1707 #define DOT11_TIMBC_FIXED_LEN	(sizeof(dot11_timbc_t) - 1)	/* Fixed length */
1708 #define DOT11_TIMBC_LEN			11	/* Fixed length */
1709 
1710 /* TCLAS frame classifier type */
1711 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_hdr {
1712 	uint8 type;
1713 	uint8 mask;
1714 	uint8 data[1];
1715 } BWL_POST_PACKED_STRUCT;
1716 typedef struct dot11_tclas_fc_hdr dot11_tclas_fc_hdr_t;
1717 #define DOT11_TCLAS_FC_HDR_LEN		2	/* Fixed length */
1718 
1719 #define DOT11_TCLAS_MASK_0		0x1
1720 #define DOT11_TCLAS_MASK_1		0x2
1721 #define DOT11_TCLAS_MASK_2		0x4
1722 #define DOT11_TCLAS_MASK_3		0x8
1723 #define DOT11_TCLAS_MASK_4		0x10
1724 #define DOT11_TCLAS_MASK_5		0x20
1725 #define DOT11_TCLAS_MASK_6		0x40
1726 #define DOT11_TCLAS_MASK_7		0x80
1727 
1728 #define DOT11_TCLAS_FC_0_ETH		0
1729 #define DOT11_TCLAS_FC_1_IP		1
1730 #define DOT11_TCLAS_FC_2_8021Q		2
1731 #define DOT11_TCLAS_FC_3_OFFSET		3
1732 #define DOT11_TCLAS_FC_4_IP_HIGHER	4
1733 #define DOT11_TCLAS_FC_5_8021D		5
1734 
1735 /* TCLAS frame classifier type 0 parameters for Ethernet */
1736 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_0_eth {
1737 	uint8 type;
1738 	uint8 mask;
1739 	uint8 sa[ETHER_ADDR_LEN];
1740 	uint8 da[ETHER_ADDR_LEN];
1741 	uint16 eth_type;
1742 } BWL_POST_PACKED_STRUCT;
1743 typedef struct dot11_tclas_fc_0_eth dot11_tclas_fc_0_eth_t;
1744 #define DOT11_TCLAS_FC_0_ETH_LEN	16
1745 
1746 /* TCLAS frame classifier type 1 parameters for IPV4 */
1747 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_1_ipv4 {
1748 	uint8 type;
1749 	uint8 mask;
1750 	uint8 version;
1751 	uint32 src_ip;
1752 	uint32 dst_ip;
1753 	uint16 src_port;
1754 	uint16 dst_port;
1755 	uint8 dscp;
1756 	uint8 protocol;
1757 	uint8 reserved;
1758 } BWL_POST_PACKED_STRUCT;
1759 typedef struct dot11_tclas_fc_1_ipv4 dot11_tclas_fc_1_ipv4_t;
1760 #define DOT11_TCLAS_FC_1_IPV4_LEN	18
1761 
1762 /* TCLAS frame classifier type 2 parameters for 802.1Q */
1763 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_2_8021q {
1764 	uint8 type;
1765 	uint8 mask;
1766 	uint16 tci;
1767 } BWL_POST_PACKED_STRUCT;
1768 typedef struct dot11_tclas_fc_2_8021q dot11_tclas_fc_2_8021q_t;
1769 #define DOT11_TCLAS_FC_2_8021Q_LEN	4
1770 
1771 /* TCLAS frame classifier type 3 parameters for filter offset */
1772 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_3_filter {
1773 	uint8 type;
1774 	uint8 mask;
1775 	uint16 offset;
1776 	uint8 data[1];
1777 } BWL_POST_PACKED_STRUCT;
1778 typedef struct dot11_tclas_fc_3_filter dot11_tclas_fc_3_filter_t;
1779 #define DOT11_TCLAS_FC_3_FILTER_LEN	4
1780 
1781 /* TCLAS frame classifier type 4 parameters for IPV4 is the same as TCLAS type 1 */
1782 typedef struct dot11_tclas_fc_1_ipv4 dot11_tclas_fc_4_ipv4_t;
1783 #define DOT11_TCLAS_FC_4_IPV4_LEN	DOT11_TCLAS_FC_1_IPV4_LEN
1784 
1785 /* TCLAS frame classifier type 4 parameters for IPV6 */
1786 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_4_ipv6 {
1787 	uint8 type;
1788 	uint8 mask;
1789 	uint8 version;
1790 	uint8 saddr[16];
1791 	uint8 daddr[16];
1792 	uint16 src_port;
1793 	uint16 dst_port;
1794 	uint8 dscp;
1795 	uint8 nexthdr;
1796 	uint8 flow_lbl[3];
1797 } BWL_POST_PACKED_STRUCT;
1798 typedef struct dot11_tclas_fc_4_ipv6 dot11_tclas_fc_4_ipv6_t;
1799 #define DOT11_TCLAS_FC_4_IPV6_LEN	44
1800 
1801 /* TCLAS frame classifier type 5 parameters for 802.1D */
1802 BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_5_8021d {
1803 	uint8 type;
1804 	uint8 mask;
1805 	uint8 pcp;
1806 	uint8 cfi;
1807 	uint16 vid;
1808 } BWL_POST_PACKED_STRUCT;
1809 typedef struct dot11_tclas_fc_5_8021d dot11_tclas_fc_5_8021d_t;
1810 #define DOT11_TCLAS_FC_5_8021D_LEN	6
1811 
1812 /* TCLAS frame classifier type parameters */
1813 BWL_PRE_PACKED_STRUCT union dot11_tclas_fc {
1814 	uint8 data[1];
1815 	dot11_tclas_fc_hdr_t hdr;
1816 	dot11_tclas_fc_0_eth_t t0_eth;
1817 	dot11_tclas_fc_1_ipv4_t	t1_ipv4;
1818 	dot11_tclas_fc_2_8021q_t t2_8021q;
1819 	dot11_tclas_fc_3_filter_t t3_filter;
1820 	dot11_tclas_fc_4_ipv4_t	t4_ipv4;
1821 	dot11_tclas_fc_4_ipv6_t	t4_ipv6;
1822 	dot11_tclas_fc_5_8021d_t t5_8021d;
1823 } BWL_POST_PACKED_STRUCT;
1824 typedef union dot11_tclas_fc dot11_tclas_fc_t;
1825 
1826 #define DOT11_TCLAS_FC_MIN_LEN		4
1827 #define DOT11_TCLAS_FC_MAX_LEN		254
1828 
1829 /* TCLAS information element */
1830 BWL_PRE_PACKED_STRUCT struct dot11_tclas_ie {
1831 	uint8 id;				/* 14, DOT11_MNG_TCLAS_ID */
1832 	uint8 len;
1833 	uint8 user_priority;
1834 	dot11_tclas_fc_t fc;
1835 } BWL_POST_PACKED_STRUCT;
1836 typedef struct dot11_tclas_ie dot11_tclas_ie_t;
1837 #define DOT11_TCLAS_IE_LEN		3	/* Fixed length, include id and len */
1838 
1839 /* TCLAS processing information element */
1840 BWL_PRE_PACKED_STRUCT struct dot11_tclas_proc_ie {
1841 	uint8 id;				/* 44, DOT11_MNG_TCLAS_PROC_ID */
1842 	uint8 len;
1843 	uint8 process;
1844 } BWL_POST_PACKED_STRUCT;
1845 typedef struct dot11_tclas_proc_ie dot11_tclas_proc_ie_t;
1846 #define DOT11_TCLAS_PROC_IE_LEN		3	/* Fixed length, include id and len */
1847 
1848 #define DOT11_TCLAS_PROC_MATCHALL	0	/* All high level element need to match */
1849 #define DOT11_TCLAS_PROC_MATCHONE	1	/* One high level element need to match */
1850 #define DOT11_TCLAS_PROC_NONMATCH	2	/* Non match to any high level element */
1851 
1852 
1853 /* TSPEC element defined in 802.11 std section 8.4.2.32 - Not supported */
1854 #define DOT11_TSPEC_IE_LEN		57	/* Fixed length */
1855 
1856 /* TFS request information element */
1857 BWL_PRE_PACKED_STRUCT struct dot11_tfs_req_ie {
1858 	uint8 id;				/* 91, DOT11_MNG_TFS_REQUEST_ID */
1859 	uint8 len;
1860 	uint8 tfs_id;
1861 	uint8 tfs_actcode;
1862 	uint8 data[1];
1863 } BWL_POST_PACKED_STRUCT;
1864 typedef struct dot11_tfs_req_ie dot11_tfs_req_ie_t;
1865 #define DOT11_TFS_REQ_IE_LEN		4	/* Fixed length, include id and len */
1866 
1867 #define DOT11_TFS_ACTCODE_DELETE	1
1868 #define DOT11_TFS_ACTCODE_MODIFY	2
1869 
1870 /* TFS request subelement */
1871 BWL_PRE_PACKED_STRUCT struct dot11_tfs_req_se {
1872 	uint8 sub_id;
1873 	uint8 length;
1874 	uint8 data[1];
1875 } BWL_POST_PACKED_STRUCT;
1876 typedef struct dot11_tfs_req_se dot11_tfs_req_se_t;
1877 
1878 BWL_PRE_PACKED_STRUCT struct dot11_tfs_se {
1879 	uint8 sub_id;
1880 	uint8 len;
1881 	uint8 data[1];
1882 } BWL_POST_PACKED_STRUCT;
1883 typedef struct dot11_tfs_se dot11_tfs_se_t;
1884 #define DOT11_TFS_REQ_SUBELEM_LEN	2	/* Fixed length, include id and len */
1885 
1886 #define DOT11_TFS_SUBELEM_ID_TFS	1
1887 #define DOT11_TFS_SUBELEM_ID_VENDOR	221
1888 
1889 /* TFS response information element */
1890 BWL_PRE_PACKED_STRUCT struct dot11_tfs_resp_ie {
1891 	uint8 id;				/* 92, DOT11_MNG_TFS_RESPONSE_ID */
1892 	uint8 len;
1893 	uint8 data[1];
1894 } BWL_POST_PACKED_STRUCT;
1895 typedef struct dot11_tfs_resp_ie dot11_tfs_resp_ie_t;
1896 #define DOT11_TFS_RESP_IE_LEN		2	/* Fixed length, include id and len */
1897 
1898 /* TFS status subelement */
1899 BWL_PRE_PACKED_STRUCT struct dot11_tfs_status_se {
1900 	uint8 id;				/* 92, DOT11_MNG_TFS_RESPONSE_ID */
1901 	uint8 len;
1902 	uint8 resp_st;
1903 	uint8 tfs_id;
1904 } BWL_POST_PACKED_STRUCT;
1905 typedef struct dot11_tfs_status_se dot11_tfs_status_se_t;
1906 
1907 #define DOT11_TFS_STATUS_SE_LEN		4	/* TFS Status Subelement length */
1908 #define DOT11_TFS_STATUS_SE_DATA_LEN	2	/* TFS status Subelement Data length */
1909 
1910 #define DOT11_TFS_STATUS_SE_ID_TFS_ST	1
1911 #define DOT11_TFS_STATUS_SE_ID_TFS	2
1912 #define DOT11_TFS_STATUS_SE_ID_VENDOR	221
1913 
1914 #define DOT11_TFS_RESP_ST_ACCEPT	0
1915 #define DOT11_TFS_RESP_ST_DENY_FORMAT	1
1916 #define DOT11_TFS_RESP_ST_DENY_RESOURCE	2
1917 #define DOT11_TFS_RESP_ST_DENY_POLICY	4
1918 #define DOT11_TFS_RESP_ST_PREFERRED_AP_INCAP	14
1919 
1920 
1921 /* TFS Management Request frame header */
1922 BWL_PRE_PACKED_STRUCT struct dot11_tfs_req {
1923 	uint8 category;				/* category of action frame (10) */
1924 	uint8 action;				/* WNM action: tfs request (13) */
1925 	uint8 token;				/* dialog token */
1926 	uint8 data[1];				/* Elements */
1927 } BWL_POST_PACKED_STRUCT;
1928 typedef struct dot11_tfs_req dot11_tfs_req_t;
1929 #define DOT11_TFS_REQ_LEN		3	/* Fixed length */
1930 
1931 /* TFS Management Response frame header */
1932 BWL_PRE_PACKED_STRUCT struct dot11_tfs_resp {
1933 	uint8 category;				/* category of action frame (10) */
1934 	uint8 action;				/* WNM action: tfs request (14) */
1935 	uint8 token;				/* dialog token */
1936 	uint8 data[1];				/* Elements */
1937 } BWL_POST_PACKED_STRUCT;
1938 typedef struct dot11_tfs_resp dot11_tfs_resp_t;
1939 #define DOT11_TFS_RESP_LEN		3	/* Fixed length */
1940 
1941 /* TFS Management Notify frame header */
1942 BWL_PRE_PACKED_STRUCT struct dot11_tfs_notify {
1943 	uint8 category;				/* category of action frame (10) */
1944 	uint8 action;				/* WNM action: tfs request (15) */
1945 	uint8 num_tfs_id;			/* number of TFS IDs */
1946 	uint8 data[1];				/* Elements */
1947 } BWL_POST_PACKED_STRUCT;
1948 typedef struct dot11_tfs_notify dot11_tfs_notify_t;
1949 #define DOT11_TFS_NOTIFY_LEN		3	/* Fixed length */
1950 
1951 #define DOT11_TFS_NOTIFY_ACT_DEL	1
1952 #define DOT11_TFS_NOTIFY_ACT_NOTIFY	2
1953 
1954 /* WNM-Sleep Management Request frame header */
1955 BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_req {
1956 	uint8 category;				/* category of action frame (10) */
1957 	uint8 action;				/* WNM action: wnm-sleep request (16) */
1958 	uint8 token;				/* dialog token */
1959 	uint8 data[1];				/* Elements */
1960 } BWL_POST_PACKED_STRUCT;
1961 typedef struct dot11_wnm_sleep_req dot11_wnm_sleep_req_t;
1962 #define DOT11_WNM_SLEEP_REQ_LEN		3	/* Fixed length */
1963 
1964 /* WNM-Sleep Management Response frame header */
1965 BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_resp {
1966 	uint8 category;				/* category of action frame (10) */
1967 	uint8 action;				/* WNM action: wnm-sleep request (17) */
1968 	uint8 token;				/* dialog token */
1969 	uint16 key_len;				/* key data length */
1970 	uint8 data[1];				/* Elements */
1971 } BWL_POST_PACKED_STRUCT;
1972 typedef struct dot11_wnm_sleep_resp dot11_wnm_sleep_resp_t;
1973 #define DOT11_WNM_SLEEP_RESP_LEN	5	/* Fixed length */
1974 
1975 #define DOT11_WNM_SLEEP_SUBELEM_ID_GTK	0
1976 #define DOT11_WNM_SLEEP_SUBELEM_ID_IGTK	1
1977 
1978 BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_subelem_gtk {
1979 	uint8 sub_id;
1980 	uint8 len;
1981 	uint16 key_info;
1982 	uint8 key_length;
1983 	uint8 rsc[8];
1984 	uint8 key[1];
1985 } BWL_POST_PACKED_STRUCT;
1986 typedef struct dot11_wnm_sleep_subelem_gtk dot11_wnm_sleep_subelem_gtk_t;
1987 #define DOT11_WNM_SLEEP_SUBELEM_GTK_FIXED_LEN	11	/* without sub_id, len, and key */
1988 #define DOT11_WNM_SLEEP_SUBELEM_GTK_MAX_LEN	43	/* without sub_id and len */
1989 
1990 BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_subelem_igtk {
1991 	uint8 sub_id;
1992 	uint8 len;
1993 	uint16 key_id;
1994 	uint8 pn[6];
1995 	uint8 key[16];
1996 } BWL_POST_PACKED_STRUCT;
1997 typedef struct dot11_wnm_sleep_subelem_igtk dot11_wnm_sleep_subelem_igtk_t;
1998 #define DOT11_WNM_SLEEP_SUBELEM_IGTK_LEN 24	/* Fixed length */
1999 
2000 BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_ie {
2001 	uint8 id;				/* 93, DOT11_MNG_WNM_SLEEP_MODE_ID */
2002 	uint8 len;
2003 	uint8 act_type;
2004 	uint8 resp_status;
2005 	uint16 interval;
2006 } BWL_POST_PACKED_STRUCT;
2007 typedef struct dot11_wnm_sleep_ie dot11_wnm_sleep_ie_t;
2008 #define DOT11_WNM_SLEEP_IE_LEN		4	/* Fixed length */
2009 
2010 #define DOT11_WNM_SLEEP_ACT_TYPE_ENTER	0
2011 #define DOT11_WNM_SLEEP_ACT_TYPE_EXIT	1
2012 
2013 #define DOT11_WNM_SLEEP_RESP_ACCEPT	0
2014 #define DOT11_WNM_SLEEP_RESP_UPDATE	1
2015 #define DOT11_WNM_SLEEP_RESP_DENY	2
2016 #define DOT11_WNM_SLEEP_RESP_DENY_TEMP	3
2017 #define DOT11_WNM_SLEEP_RESP_DENY_KEY	4
2018 #define DOT11_WNM_SLEEP_RESP_DENY_INUSE	5
2019 #define DOT11_WNM_SLEEP_RESP_LAST	6
2020 
2021 /* DMS Management Request frame header */
2022 BWL_PRE_PACKED_STRUCT struct dot11_dms_req {
2023 	uint8 category;				/* category of action frame (10) */
2024 	uint8 action;				/* WNM action: dms request (23) */
2025 	uint8 token;				/* dialog token */
2026 	uint8 data[1];				/* Elements */
2027 } BWL_POST_PACKED_STRUCT;
2028 typedef struct dot11_dms_req dot11_dms_req_t;
2029 #define DOT11_DMS_REQ_LEN		3	/* Fixed length */
2030 
2031 /* DMS Management Response frame header */
2032 BWL_PRE_PACKED_STRUCT struct dot11_dms_resp {
2033 	uint8 category;				/* category of action frame (10) */
2034 	uint8 action;				/* WNM action: dms request (24) */
2035 	uint8 token;				/* dialog token */
2036 	uint8 data[1];				/* Elements */
2037 } BWL_POST_PACKED_STRUCT;
2038 typedef struct dot11_dms_resp dot11_dms_resp_t;
2039 #define DOT11_DMS_RESP_LEN		3	/* Fixed length */
2040 
2041 /* DMS request information element */
2042 BWL_PRE_PACKED_STRUCT struct dot11_dms_req_ie {
2043 	uint8 id;				/* 99, DOT11_MNG_DMS_REQUEST_ID */
2044 	uint8 len;
2045 	uint8 data[1];
2046 } BWL_POST_PACKED_STRUCT;
2047 typedef struct dot11_dms_req_ie dot11_dms_req_ie_t;
2048 #define DOT11_DMS_REQ_IE_LEN		2	/* Fixed length */
2049 
2050 /* DMS response information element */
2051 BWL_PRE_PACKED_STRUCT struct dot11_dms_resp_ie {
2052 	uint8 id;				/* 100, DOT11_MNG_DMS_RESPONSE_ID */
2053 	uint8 len;
2054 	uint8 data[1];
2055 } BWL_POST_PACKED_STRUCT;
2056 typedef struct dot11_dms_resp_ie dot11_dms_resp_ie_t;
2057 #define DOT11_DMS_RESP_IE_LEN		2	/* Fixed length */
2058 
2059 /* DMS request descriptor */
2060 BWL_PRE_PACKED_STRUCT struct dot11_dms_req_desc {
2061 	uint8 dms_id;
2062 	uint8 len;
2063 	uint8 type;
2064 	uint8 data[1];
2065 } BWL_POST_PACKED_STRUCT;
2066 typedef struct dot11_dms_req_desc dot11_dms_req_desc_t;
2067 #define DOT11_DMS_REQ_DESC_LEN		3	/* Fixed length */
2068 
2069 #define DOT11_DMS_REQ_TYPE_ADD		0
2070 #define DOT11_DMS_REQ_TYPE_REMOVE	1
2071 #define DOT11_DMS_REQ_TYPE_CHANGE	2
2072 
2073 /* DMS response status */
2074 BWL_PRE_PACKED_STRUCT struct dot11_dms_resp_st {
2075 	uint8 dms_id;
2076 	uint8 len;
2077 	uint8 type;
2078 	uint16 lsc;
2079 	uint8 data[1];
2080 } BWL_POST_PACKED_STRUCT;
2081 typedef struct dot11_dms_resp_st dot11_dms_resp_st_t;
2082 #define DOT11_DMS_RESP_STATUS_LEN	5	/* Fixed length */
2083 
2084 #define DOT11_DMS_RESP_TYPE_ACCEPT	0
2085 #define DOT11_DMS_RESP_TYPE_DENY	1
2086 #define DOT11_DMS_RESP_TYPE_TERM	2
2087 
2088 #define DOT11_DMS_RESP_LSC_UNSUPPORTED	0xFFFF
2089 
2090 BWL_PRE_PACKED_STRUCT struct dot11_addba_req {
2091 	uint8 category;				/* category of action frame (3) */
2092 	uint8 action;				/* action: addba req */
2093 	uint8 token;				/* identifier */
2094 	uint16 addba_param_set;		/* parameter set */
2095 	uint16 timeout;				/* timeout in seconds */
2096 	uint16 start_seqnum;		/* starting sequence number */
2097 } BWL_POST_PACKED_STRUCT;
2098 typedef struct dot11_addba_req dot11_addba_req_t;
2099 #define DOT11_ADDBA_REQ_LEN		9	/* length of addba req frame */
2100 
2101 BWL_PRE_PACKED_STRUCT struct dot11_addba_resp {
2102 	uint8 category;				/* category of action frame (3) */
2103 	uint8 action;				/* action: addba resp */
2104 	uint8 token;				/* identifier */
2105 	uint16 status;				/* status of add request */
2106 	uint16 addba_param_set;			/* negotiated parameter set */
2107 	uint16 timeout;				/* negotiated timeout in seconds */
2108 } BWL_POST_PACKED_STRUCT;
2109 typedef struct dot11_addba_resp dot11_addba_resp_t;
2110 #define DOT11_ADDBA_RESP_LEN		9	/* length of addba resp frame */
2111 
2112 /* DELBA action parameters */
2113 #define DOT11_DELBA_PARAM_INIT_MASK	0x0800	/* initiator mask */
2114 #define DOT11_DELBA_PARAM_INIT_SHIFT	11	/* initiator shift */
2115 #define DOT11_DELBA_PARAM_TID_MASK	0xf000	/* tid mask */
2116 #define DOT11_DELBA_PARAM_TID_SHIFT	12	/* tid shift */
2117 
2118 BWL_PRE_PACKED_STRUCT struct dot11_delba {
2119 	uint8 category;				/* category of action frame (3) */
2120 	uint8 action;				/* action: addba req */
2121 	uint16 delba_param_set;			/* paarmeter set */
2122 	uint16 reason;				/* reason for dellba */
2123 } BWL_POST_PACKED_STRUCT;
2124 typedef struct dot11_delba dot11_delba_t;
2125 #define DOT11_DELBA_LEN			6	/* length of delba frame */
2126 
2127 /* SA Query action field value */
2128 #define SA_QUERY_REQUEST		0
2129 #define SA_QUERY_RESPONSE		1
2130 
2131 /* ************* 802.11r related definitions. ************* */
2132 
2133 /* Over-the-DS Fast Transition Request frame header */
2134 BWL_PRE_PACKED_STRUCT struct dot11_ft_req {
2135 	uint8 category;			/* category of action frame (6) */
2136 	uint8 action;			/* action: ft req */
2137 	uint8 sta_addr[ETHER_ADDR_LEN];
2138 	uint8 tgt_ap_addr[ETHER_ADDR_LEN];
2139 	uint8 data[1];			/* Elements */
2140 } BWL_POST_PACKED_STRUCT;
2141 typedef struct dot11_ft_req dot11_ft_req_t;
2142 #define DOT11_FT_REQ_FIXED_LEN 14
2143 
2144 /* Over-the-DS Fast Transition Response frame header */
2145 BWL_PRE_PACKED_STRUCT struct dot11_ft_res {
2146 	uint8 category;			/* category of action frame (6) */
2147 	uint8 action;			/* action: ft resp */
2148 	uint8 sta_addr[ETHER_ADDR_LEN];
2149 	uint8 tgt_ap_addr[ETHER_ADDR_LEN];
2150 	uint16 status;			/* status code */
2151 	uint8 data[1];			/* Elements */
2152 } BWL_POST_PACKED_STRUCT;
2153 typedef struct dot11_ft_res dot11_ft_res_t;
2154 #define DOT11_FT_RES_FIXED_LEN 16
2155 
2156 /* RDE RIC Data Element. */
2157 BWL_PRE_PACKED_STRUCT struct dot11_rde_ie {
2158 	uint8 id;			/* 11r, DOT11_MNG_RDE_ID */
2159 	uint8 length;
2160 	uint8 rde_id;			/* RDE identifier. */
2161 	uint8 rd_count;			/* Resource Descriptor Count. */
2162 	uint16 status;			/* Status Code. */
2163 } BWL_POST_PACKED_STRUCT;
2164 typedef struct dot11_rde_ie dot11_rde_ie_t;
2165 
2166 /* 11r - Size of the RDE (RIC Data Element) IE, including TLV header. */
2167 #define DOT11_MNG_RDE_IE_LEN sizeof(dot11_rde_ie_t)
2168 
2169 
2170 /* ************* 802.11k related definitions. ************* */
2171 
2172 /* Radio measurements enabled capability ie */
2173 
2174 #define DOT11_RRM_CAP_LEN		5	/* length of rrm cap bitmap */
2175 #define RCPI_IE_LEN 1
2176 #define RSNI_IE_LEN 1
2177 BWL_PRE_PACKED_STRUCT struct dot11_rrm_cap_ie {
2178 	uint8 cap[DOT11_RRM_CAP_LEN];
2179 } BWL_POST_PACKED_STRUCT;
2180 typedef struct dot11_rrm_cap_ie dot11_rrm_cap_ie_t;
2181 
2182 /* Bitmap definitions for cap ie */
2183 #define DOT11_RRM_CAP_LINK			0
2184 #define DOT11_RRM_CAP_NEIGHBOR_REPORT	1
2185 #define DOT11_RRM_CAP_PARALLEL		2
2186 #define DOT11_RRM_CAP_REPEATED		3
2187 #define DOT11_RRM_CAP_BCN_PASSIVE	4
2188 #define DOT11_RRM_CAP_BCN_ACTIVE	5
2189 #define DOT11_RRM_CAP_BCN_TABLE		6
2190 #define DOT11_RRM_CAP_BCN_REP_COND	7
2191 #define DOT11_RRM_CAP_AP_CHANREP	16
2192 
2193 
2194 /* Operating Class (formerly "Regulatory Class") definitions */
2195 #define DOT11_OP_CLASS_NONE			255
2196 
2197 BWL_PRE_PACKED_STRUCT struct do11_ap_chrep {
2198 	uint8 id;
2199 	uint8 len;
2200 	uint8 reg;
2201 	uint8 chanlist[1];
2202 } BWL_POST_PACKED_STRUCT;
2203 typedef struct do11_ap_chrep dot11_ap_chrep_t;
2204 
2205 /* Radio Measurements action ids */
2206 #define DOT11_RM_ACTION_RM_REQ		0	/* Radio measurement request */
2207 #define DOT11_RM_ACTION_RM_REP		1	/* Radio measurement report */
2208 #define DOT11_RM_ACTION_LM_REQ		2	/* Link measurement request */
2209 #define DOT11_RM_ACTION_LM_REP		3	/* Link measurement report */
2210 #define DOT11_RM_ACTION_NR_REQ		4	/* Neighbor report request */
2211 #define DOT11_RM_ACTION_NR_REP		5	/* Neighbor report response */
2212 
2213 /* Generic radio measurement action frame header */
2214 BWL_PRE_PACKED_STRUCT struct dot11_rm_action {
2215 	uint8 category;				/* category of action frame (5) */
2216 	uint8 action;				/* radio measurement action */
2217 	uint8 token;				/* dialog token */
2218 	uint8 data[1];
2219 } BWL_POST_PACKED_STRUCT;
2220 typedef struct dot11_rm_action dot11_rm_action_t;
2221 #define DOT11_RM_ACTION_LEN 3
2222 
2223 BWL_PRE_PACKED_STRUCT struct dot11_rmreq {
2224 	uint8 category;				/* category of action frame (5) */
2225 	uint8 action;				/* radio measurement action */
2226 	uint8 token;				/* dialog token */
2227 	uint16 reps;				/* no. of repetitions */
2228 	uint8 data[1];
2229 } BWL_POST_PACKED_STRUCT;
2230 typedef struct dot11_rmreq dot11_rmreq_t;
2231 #define DOT11_RMREQ_LEN	5
2232 
2233 BWL_PRE_PACKED_STRUCT struct dot11_rm_ie {
2234 	uint8 id;
2235 	uint8 len;
2236 	uint8 token;
2237 	uint8 mode;
2238 	uint8 type;
2239 } BWL_POST_PACKED_STRUCT;
2240 typedef struct dot11_rm_ie dot11_rm_ie_t;
2241 #define DOT11_RM_IE_LEN	5
2242 
2243 /* Definitions for "mode" bits in rm req */
2244 #define DOT11_RMREQ_MODE_PARALLEL	1
2245 #define DOT11_RMREQ_MODE_ENABLE		2
2246 #define DOT11_RMREQ_MODE_REQUEST	4
2247 #define DOT11_RMREQ_MODE_REPORT		8
2248 #define DOT11_RMREQ_MODE_DURMAND	0x10	/* Duration Mandatory */
2249 
2250 /* Definitions for "mode" bits in rm rep */
2251 #define DOT11_RMREP_MODE_LATE		1
2252 #define DOT11_RMREP_MODE_INCAPABLE	2
2253 #define DOT11_RMREP_MODE_REFUSED	4
2254 
2255 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_bcn {
2256 	uint8 id;
2257 	uint8 len;
2258 	uint8 token;
2259 	uint8 mode;
2260 	uint8 type;
2261 	uint8 reg;
2262 	uint8 channel;
2263 	uint16 interval;
2264 	uint16 duration;
2265 	uint8 bcn_mode;
2266 	struct ether_addr	bssid;
2267 } BWL_POST_PACKED_STRUCT;
2268 typedef struct dot11_rmreq_bcn dot11_rmreq_bcn_t;
2269 #define DOT11_RMREQ_BCN_LEN	18
2270 
2271 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_bcn {
2272 	uint8 reg;
2273 	uint8 channel;
2274 	uint32 starttime[2];
2275 	uint16 duration;
2276 	uint8 frame_info;
2277 	uint8 rcpi;
2278 	uint8 rsni;
2279 	struct ether_addr	bssid;
2280 	uint8 antenna_id;
2281 	uint32 parent_tsf;
2282 } BWL_POST_PACKED_STRUCT;
2283 typedef struct dot11_rmrep_bcn dot11_rmrep_bcn_t;
2284 #define DOT11_RMREP_BCN_LEN	26
2285 
2286 /* Beacon request measurement mode */
2287 #define DOT11_RMREQ_BCN_PASSIVE	0
2288 #define DOT11_RMREQ_BCN_ACTIVE	1
2289 #define DOT11_RMREQ_BCN_TABLE	2
2290 
2291 /* Sub-element IDs for Beacon Request */
2292 #define DOT11_RMREQ_BCN_SSID_ID 0
2293 #define DOT11_RMREQ_BCN_REPINFO_ID  1
2294 #define DOT11_RMREQ_BCN_REPDET_ID   2
2295 #define DOT11_RMREQ_BCN_REQUEST_ID  10
2296 #define DOT11_RMREQ_BCN_APCHREP_ID  DOT11_MNG_AP_CHREP_ID
2297 
2298 /* Reporting Detail element definition */
2299 #define DOT11_RMREQ_BCN_REPDET_FIXED	0	/* Fixed length fields only */
2300 #define DOT11_RMREQ_BCN_REPDET_REQUEST	1	/* + requested information elems */
2301 #define DOT11_RMREQ_BCN_REPDET_ALL	2	/* All fields */
2302 
2303 /* Sub-element IDs for Beacon Report */
2304 #define DOT11_RMREP_BCN_FRM_BODY	1
2305 
2306 /* Sub-element IDs for Frame Report */
2307 #define DOT11_RMREP_FRAME_COUNT_REPORT 1
2308 
2309 /* Channel load request */
2310 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_chanload {
2311 	uint8 id;
2312 	uint8 len;
2313 	uint8 token;
2314 	uint8 mode;
2315 	uint8 type;
2316 	uint8 reg;
2317 	uint8 channel;
2318 	uint16 interval;
2319 	uint16 duration;
2320 } BWL_POST_PACKED_STRUCT;
2321 typedef struct dot11_rmreq_chanload dot11_rmreq_chanload_t;
2322 #define DOT11_RMREQ_CHANLOAD_LEN	11
2323 
2324 /* Channel load report */
2325 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_chanload {
2326 	uint8 reg;
2327 	uint8 channel;
2328 	uint32 starttime[2];
2329 	uint16 duration;
2330 	uint8 channel_load;
2331 } BWL_POST_PACKED_STRUCT;
2332 typedef struct dot11_rmrep_chanload dot11_rmrep_chanload_t;
2333 #define DOT11_RMREP_CHANLOAD_LEN	13
2334 
2335 /* Noise histogram request */
2336 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_noise {
2337 	uint8 id;
2338 	uint8 len;
2339 	uint8 token;
2340 	uint8 mode;
2341 	uint8 type;
2342 	uint8 reg;
2343 	uint8 channel;
2344 	uint16 interval;
2345 	uint16 duration;
2346 } BWL_POST_PACKED_STRUCT;
2347 typedef struct dot11_rmreq_noise dot11_rmreq_noise_t;
2348 #define DOT11_RMREQ_NOISE_LEN 11
2349 
2350 /* Noise histogram report */
2351 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_noise {
2352 	uint8 reg;
2353 	uint8 channel;
2354 	uint32 starttime[2];
2355 	uint16 duration;
2356 	uint8 antid;
2357 	uint8 anpi;
2358 	uint8 ipi0_dens;
2359 	uint8 ipi1_dens;
2360 	uint8 ipi2_dens;
2361 	uint8 ipi3_dens;
2362 	uint8 ipi4_dens;
2363 	uint8 ipi5_dens;
2364 	uint8 ipi6_dens;
2365 	uint8 ipi7_dens;
2366 	uint8 ipi8_dens;
2367 	uint8 ipi9_dens;
2368 	uint8 ipi10_dens;
2369 } BWL_POST_PACKED_STRUCT;
2370 typedef struct dot11_rmrep_noise dot11_rmrep_noise_t;
2371 #define DOT11_RMREP_NOISE_LEN 25
2372 
2373 /* Frame request */
2374 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_frame {
2375 	uint8 id;
2376 	uint8 len;
2377 	uint8 token;
2378 	uint8 mode;
2379 	uint8 type;
2380 	uint8 reg;
2381 	uint8 channel;
2382 	uint16 interval;
2383 	uint16 duration;
2384 	uint8 req_type;
2385 	struct ether_addr	ta;
2386 } BWL_POST_PACKED_STRUCT;
2387 typedef struct dot11_rmreq_frame dot11_rmreq_frame_t;
2388 #define DOT11_RMREQ_FRAME_LEN 18
2389 
2390 /* Frame report */
2391 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_frame {
2392 	uint8 reg;
2393 	uint8 channel;
2394 	uint32 starttime[2];
2395 	uint16 duration;
2396 } BWL_POST_PACKED_STRUCT;
2397 typedef struct dot11_rmrep_frame dot11_rmrep_frame_t;
2398 #define DOT11_RMREP_FRAME_LEN 12
2399 
2400 /* Frame report entry */
2401 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_frmentry {
2402 	struct ether_addr	ta;
2403 	struct ether_addr	bssid;
2404 	uint8 phy_type;
2405 	uint8 avg_rcpi;
2406 	uint8 last_rsni;
2407 	uint8 last_rcpi;
2408 	uint8 ant_id;
2409 	uint16 frame_cnt;
2410 } BWL_POST_PACKED_STRUCT;
2411 typedef struct dot11_rmrep_frmentry dot11_rmrep_frmentry_t;
2412 #define DOT11_RMREP_FRMENTRY_LEN 19
2413 
2414 /* STA statistics request */
2415 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_stat {
2416 	uint8 id;
2417 	uint8 len;
2418 	uint8 token;
2419 	uint8 mode;
2420 	uint8 type;
2421 	struct ether_addr	peer;
2422 	uint16 interval;
2423 	uint16 duration;
2424 	uint8 group_id;
2425 } BWL_POST_PACKED_STRUCT;
2426 typedef struct dot11_rmreq_stat dot11_rmreq_stat_t;
2427 #define DOT11_RMREQ_STAT_LEN 16
2428 
2429 /* STA statistics report */
2430 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_stat {
2431 	uint16 duration;
2432 	uint8 group_id;
2433 } BWL_POST_PACKED_STRUCT;
2434 typedef struct dot11_rmrep_stat dot11_rmrep_stat_t;
2435 
2436 /* Transmit stream/category measurement request */
2437 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_tx_stream {
2438 	uint8 id;
2439 	uint8 len;
2440 	uint8 token;
2441 	uint8 mode;
2442 	uint8 type;
2443 	uint16 interval;
2444 	uint16 duration;
2445 	struct ether_addr	peer;
2446 	uint8 traffic_id;
2447 	uint8 bin0_range;
2448 } BWL_POST_PACKED_STRUCT;
2449 typedef struct dot11_rmreq_tx_stream dot11_rmreq_tx_stream_t;
2450 
2451 /* Transmit stream/category measurement report */
2452 BWL_PRE_PACKED_STRUCT struct dot11_rmrep_tx_stream {
2453 	uint32 starttime[2];
2454 	uint16 duration;
2455 	struct ether_addr	peer;
2456 	uint8 traffic_id;
2457 	uint8 reason;
2458 	uint32 txmsdu_cnt;
2459 	uint32 msdu_discarded_cnt;
2460 	uint32 msdufailed_cnt;
2461 	uint32 msduretry_cnt;
2462 	uint32 cfpolls_lost_cnt;
2463 	uint32 avrqueue_delay;
2464 	uint32 avrtx_delay;
2465 	uint8 bin0_range;
2466 	uint32 bin0;
2467 	uint32 bin1;
2468 	uint32 bin2;
2469 	uint32 bin3;
2470 	uint32 bin4;
2471 	uint32 bin5;
2472 } BWL_POST_PACKED_STRUCT;
2473 typedef struct dot11_rmrep_tx_stream dot11_rmrep_tx_stream_t;
2474 
2475 /* Measurement pause request */
2476 BWL_PRE_PACKED_STRUCT struct dot11_rmreq_pause_time {
2477 	uint8 id;
2478 	uint8 len;
2479 	uint8 token;
2480 	uint8 mode;
2481 	uint8 type;
2482 	uint16 pause_time;
2483 } BWL_POST_PACKED_STRUCT;
2484 typedef struct dot11_rmreq_pause_time dot11_rmreq_pause_time_t;
2485 
2486 
2487 /* Neighbor Report subelements ID (11k & 11v) */
2488 #define DOT11_NGBR_TSF_INFO_SE_ID	1
2489 #define DOT11_NGBR_CCS_SE_ID		2
2490 #define DOT11_NGBR_BSSTRANS_PREF_SE_ID	3
2491 #define DOT11_NGBR_BSS_TERM_DUR_SE_ID	4
2492 #define DOT11_NGBR_BEARING_SE_ID	5
2493 
2494 /* Neighbor Report, BSS Transition Candidate Preference subelement */
2495 BWL_PRE_PACKED_STRUCT struct dot11_ngbr_bsstrans_pref_se {
2496 	uint8 sub_id;
2497 	uint8 len;
2498 	uint8 preference;
2499 } BWL_POST_PACKED_STRUCT;
2500 typedef struct dot11_ngbr_bsstrans_pref_se dot11_ngbr_bsstrans_pref_se_t;
2501 #define DOT11_NGBR_BSSTRANS_PREF_SE_LEN	1
2502 
2503 /* Neighbor Report, BSS Termination Duration subelement */
2504 BWL_PRE_PACKED_STRUCT struct dot11_ngbr_bss_term_dur_se {
2505 	uint8 sub_id;
2506 	uint8 len;
2507 	uint8 tsf[8];
2508 	uint16 duration;
2509 } BWL_POST_PACKED_STRUCT;
2510 typedef struct dot11_ngbr_bss_term_dur_se dot11_ngbr_bss_term_dur_se_t;
2511 #define DOT11_NGBR_BSS_TERM_DUR_SE_LEN	10
2512 
2513 /* Neighbor Report BSSID Information Field */
2514 #define DOT11_NGBR_BI_REACHABILTY_UNKN	0x0002
2515 #define DOT11_NGBR_BI_REACHABILTY	0x0003
2516 #define DOT11_NGBR_BI_SEC		0x0004
2517 #define DOT11_NGBR_BI_KEY_SCOPE		0x0008
2518 #define DOT11_NGBR_BI_CAP		0x03f0
2519 #define DOT11_NGBR_BI_CAP_SPEC_MGMT	0x0010
2520 #define DOT11_NGBR_BI_CAP_QOS		0x0020
2521 #define DOT11_NGBR_BI_CAP_APSD		0x0040
2522 #define DOT11_NGBR_BI_CAP_RDIO_MSMT	0x0080
2523 #define DOT11_NGBR_BI_CAP_DEL_BA	0x0100
2524 #define DOT11_NGBR_BI_CAP_IMM_BA	0x0200
2525 #define DOT11_NGBR_BI_MOBILITY		0x0400
2526 #define DOT11_NGBR_BI_HT		0x0800
2527 
2528 /* Neighbor Report element (11k & 11v) */
2529 BWL_PRE_PACKED_STRUCT struct dot11_neighbor_rep_ie {
2530 	uint8 id;
2531 	uint8 len;
2532 	struct ether_addr bssid;
2533 	uint32 bssid_info;
2534 	uint8 reg;		/* Operating class */
2535 	uint8 channel;
2536 	uint8 phytype;
2537 	uint8 data[1]; 		/* Variable size subelements */
2538 } BWL_POST_PACKED_STRUCT;
2539 typedef struct dot11_neighbor_rep_ie dot11_neighbor_rep_ie_t;
2540 #define DOT11_NEIGHBOR_REP_IE_FIXED_LEN	13
2541 
2542 
2543 /* MLME Enumerations */
2544 #define DOT11_BSSTYPE_INFRASTRUCTURE		0	/* d11 infrastructure */
2545 #define DOT11_BSSTYPE_INDEPENDENT		1	/* d11 independent */
2546 #define DOT11_BSSTYPE_ANY			2	/* d11 any BSS type */
2547 #define DOT11_SCANTYPE_ACTIVE			0	/* d11 scan active */
2548 #define DOT11_SCANTYPE_PASSIVE			1	/* d11 scan passive */
2549 
2550 /* Link Measurement */
2551 BWL_PRE_PACKED_STRUCT struct dot11_lmreq {
2552 	uint8 category;				/* category of action frame (5) */
2553 	uint8 action;				/* radio measurement action */
2554 	uint8 token;				/* dialog token */
2555 	uint8 txpwr;				/* Transmit Power Used */
2556 	uint8 maxtxpwr;				/* Max Transmit Power */
2557 } BWL_POST_PACKED_STRUCT;
2558 typedef struct dot11_lmreq dot11_lmreq_t;
2559 #define DOT11_LMREQ_LEN	5
2560 
2561 BWL_PRE_PACKED_STRUCT struct dot11_lmrep {
2562 	uint8 category;				/* category of action frame (5) */
2563 	uint8 action;				/* radio measurement action */
2564 	uint8 token;				/* dialog token */
2565 	dot11_tpc_rep_t tpc;			/* TPC element */
2566 	uint8 rxant;				/* Receive Antenna ID */
2567 	uint8 txant;				/* Transmit Antenna ID */
2568 	uint8 rcpi;				/* RCPI */
2569 	uint8 rsni;				/* RSNI */
2570 } BWL_POST_PACKED_STRUCT;
2571 typedef struct dot11_lmrep dot11_lmrep_t;
2572 #define DOT11_LMREP_LEN	11
2573 
2574 /* 802.11 BRCM "Compromise" Pre N constants */
2575 #define PREN_PREAMBLE		24	/* green field preamble time */
2576 #define PREN_MM_EXT		12	/* extra mixed mode preamble time */
2577 #define PREN_PREAMBLE_EXT	4	/* extra preamble (multiply by unique_streams-1) */
2578 
2579 /* 802.11N PHY constants */
2580 #define RIFS_11N_TIME		2	/* NPHY RIFS time */
2581 
2582 /* 802.11 HT PLCP format 802.11n-2009, sec 20.3.9.4.3
2583  * HT-SIG is composed of two 24 bit parts, HT-SIG1 and HT-SIG2
2584  */
2585 /* HT-SIG1 */
2586 #define HT_SIG1_MCS_MASK        0x00007F
2587 #define HT_SIG1_CBW             0x000080
2588 #define HT_SIG1_HT_LENGTH       0xFFFF00
2589 
2590 /* HT-SIG2 */
2591 #define HT_SIG2_SMOOTHING       0x000001
2592 #define HT_SIG2_NOT_SOUNDING    0x000002
2593 #define HT_SIG2_RESERVED        0x000004
2594 #define HT_SIG2_AGGREGATION     0x000008
2595 #define HT_SIG2_STBC_MASK       0x000030
2596 #define HT_SIG2_STBC_SHIFT      4
2597 #define HT_SIG2_FEC_CODING      0x000040
2598 #define HT_SIG2_SHORT_GI        0x000080
2599 #define HT_SIG2_ESS_MASK        0x000300
2600 #define HT_SIG2_ESS_SHIFT       8
2601 #define HT_SIG2_CRC             0x03FC00
2602 #define HT_SIG2_TAIL            0x1C0000
2603 
2604 /* HT Timing-related parameters (802.11-2012, sec 20.3.6) */
2605 #define HT_T_LEG_PREAMBLE      16
2606 #define HT_T_L_SIG              4
2607 #define HT_T_SIG                8
2608 #define HT_T_LTF1               4
2609 #define HT_T_GF_LTF1            8
2610 #define HT_T_LTFs               4
2611 #define HT_T_STF                4
2612 #define HT_T_GF_STF             8
2613 #define HT_T_SYML               4
2614 
2615 #define HT_N_SERVICE           16       /* bits in SERVICE field */
2616 #define HT_N_TAIL               6       /* tail bits per BCC encoder */
2617 
2618 /* 802.11 A PHY constants */
2619 #define APHY_SLOT_TIME          9       /* APHY slot time */
2620 #define APHY_SIFS_TIME          16      /* APHY SIFS time */
2621 #define APHY_DIFS_TIME          (APHY_SIFS_TIME + (2 * APHY_SLOT_TIME))  /* APHY DIFS time */
2622 #define APHY_PREAMBLE_TIME      16      /* APHY preamble time */
2623 #define APHY_SIGNAL_TIME        4       /* APHY signal time */
2624 #define APHY_SYMBOL_TIME        4       /* APHY symbol time */
2625 #define APHY_SERVICE_NBITS      16      /* APHY service nbits */
2626 #define APHY_TAIL_NBITS         6       /* APHY tail nbits */
2627 #define APHY_CWMIN              15      /* APHY cwmin */
2628 
2629 /* 802.11 B PHY constants */
2630 #define BPHY_SLOT_TIME          20      /* BPHY slot time */
2631 #define BPHY_SIFS_TIME          10      /* BPHY SIFS time */
2632 #define BPHY_DIFS_TIME          50      /* BPHY DIFS time */
2633 #define BPHY_PLCP_TIME          192     /* BPHY PLCP time */
2634 #define BPHY_PLCP_SHORT_TIME    96      /* BPHY PLCP short time */
2635 #define BPHY_CWMIN              31      /* BPHY cwmin */
2636 
2637 /* 802.11 G constants */
2638 #define DOT11_OFDM_SIGNAL_EXTENSION	6	/* d11 OFDM signal extension */
2639 
2640 #define PHY_CWMAX		1023	/* PHY cwmax */
2641 
2642 #define	DOT11_MAXNUMFRAGS	16	/* max # fragments per MSDU */
2643 
2644 /* 802.11 VHT constants */
2645 
2646 typedef int vht_group_id_t;
2647 
2648 /* for VHT-A1 */
2649 /* SIG-A1 reserved bits */
2650 #define VHT_SIGA1_CONST_MASK            0x800004
2651 
2652 #define VHT_SIGA1_BW_MASK               0x000003
2653 #define VHT_SIGA1_20MHZ_VAL             0x000000
2654 #define VHT_SIGA1_40MHZ_VAL             0x000001
2655 #define VHT_SIGA1_80MHZ_VAL             0x000002
2656 #define VHT_SIGA1_160MHZ_VAL            0x000003
2657 
2658 #define VHT_SIGA1_STBC                  0x000008
2659 
2660 #define VHT_SIGA1_GID_MASK              0x0003f0
2661 #define VHT_SIGA1_GID_SHIFT             4
2662 #define VHT_SIGA1_GID_TO_AP             0x00
2663 #define VHT_SIGA1_GID_NOT_TO_AP         0x3f
2664 #define VHT_SIGA1_GID_MAX_GID           0x3f
2665 
2666 #define VHT_SIGA1_NSTS_SHIFT_MASK_USER0 0x001C00
2667 #define VHT_SIGA1_NSTS_SHIFT            10
2668 
2669 #define VHT_SIGA1_PARTIAL_AID_MASK      0x3fe000
2670 #define VHT_SIGA1_PARTIAL_AID_SHIFT     13
2671 
2672 #define VHT_SIGA1_TXOP_PS_NOT_ALLOWED   0x400000
2673 
2674 /* for VHT-A2 */
2675 #define VHT_SIGA2_GI_NONE               0x000000
2676 #define VHT_SIGA2_GI_SHORT              0x000001
2677 #define VHT_SIGA2_GI_W_MOD10            0x000002
2678 #define VHT_SIGA2_CODING_LDPC           0x000004
2679 #define VHT_SIGA2_LDPC_EXTRA_OFDM_SYM   0x000008
2680 #define VHT_SIGA2_BEAMFORM_ENABLE       0x000100
2681 #define VHT_SIGA2_MCS_SHIFT             4
2682 
2683 #define VHT_SIGA2_B9_RESERVED           0x000200
2684 #define VHT_SIGA2_TAIL_MASK             0xfc0000
2685 #define VHT_SIGA2_TAIL_VALUE            0x000000
2686 
2687 /* VHT Timing-related parameters (802.11ac D4.0, sec 22.3.6) */
2688 #define VHT_T_LEG_PREAMBLE      16
2689 #define VHT_T_L_SIG              4
2690 #define VHT_T_SIG_A              8
2691 #define VHT_T_LTF                4
2692 #define VHT_T_STF                4
2693 #define VHT_T_SIG_B              4
2694 #define VHT_T_SYML               4
2695 
2696 #define VHT_N_SERVICE           16	/* bits in SERVICE field */
2697 #define VHT_N_TAIL               6	/* tail bits per BCC encoder */
2698 
2699 
2700 /* dot11Counters Table - 802.11 spec., Annex D */
2701 typedef struct d11cnt {
2702 	uint32		txfrag;		/* dot11TransmittedFragmentCount */
2703 	uint32		txmulti;	/* dot11MulticastTransmittedFrameCount */
2704 	uint32		txfail;		/* dot11FailedCount */
2705 	uint32		txretry;	/* dot11RetryCount */
2706 	uint32		txretrie;	/* dot11MultipleRetryCount */
2707 	uint32		rxdup;		/* dot11FrameduplicateCount */
2708 	uint32		txrts;		/* dot11RTSSuccessCount */
2709 	uint32		txnocts;	/* dot11RTSFailureCount */
2710 	uint32		txnoack;	/* dot11ACKFailureCount */
2711 	uint32		rxfrag;		/* dot11ReceivedFragmentCount */
2712 	uint32		rxmulti;	/* dot11MulticastReceivedFrameCount */
2713 	uint32		rxcrc;		/* dot11FCSErrorCount */
2714 	uint32		txfrmsnt;	/* dot11TransmittedFrameCount */
2715 	uint32		rxundec;	/* dot11WEPUndecryptableCount */
2716 } d11cnt_t;
2717 
2718 /* OUI for BRCM proprietary IE */
2719 #define BRCM_PROP_OUI		"\x00\x90\x4C"	/* Broadcom proprietary OUI */
2720 
2721 
2722 /* brcm syscap_ie cap */
2723 #define BRCM_SYSCAP_WET_TUNNEL	0x0100	/* Device with WET_TUNNEL support */
2724 
2725 /* BRCM OUI: Used in the proprietary(221) IE in all broadcom devices */
2726 #define BRCM_OUI		"\x00\x10\x18"	/* Broadcom OUI */
2727 
2728 /* BRCM info element */
2729 BWL_PRE_PACKED_STRUCT struct brcm_ie {
2730 	uint8	id;		/* IE ID, 221, DOT11_MNG_PROPR_ID */
2731 	uint8	len;		/* IE length */
2732 	uint8	oui[3];		/* Proprietary OUI, BRCM_OUI */
2733 	uint8	ver;		/* type/ver of this IE */
2734 	uint8	assoc;		/* # of assoc STAs */
2735 	uint8	flags;		/* misc flags */
2736 	uint8	flags1;		/* misc flags */
2737 	uint16	amsdu_mtu_pref;	/* preferred A-MSDU MTU */
2738 } BWL_POST_PACKED_STRUCT;
2739 typedef	struct brcm_ie brcm_ie_t;
2740 #define BRCM_IE_LEN		11	/* BRCM IE length */
2741 #define BRCM_IE_VER		2	/* BRCM IE version */
2742 #define BRCM_IE_LEGACY_AES_VER	1	/* BRCM IE legacy AES version */
2743 
2744 /* brcm_ie flags */
2745 #define	BRF_LZWDS		0x4	/* lazy wds enabled */
2746 #define	BRF_BLOCKACK		0x8	/* BlockACK capable */
2747 
2748 /* brcm_ie flags1 */
2749 #define	BRF1_AMSDU		0x1	/* A-MSDU capable */
2750 #define BRF1_WMEPS		0x4	/* AP is capable of handling WME + PS w/o APSD */
2751 #define BRF1_PSOFIX		0x8	/* AP has fixed PS mode out-of-order packets */
2752 #define	BRF1_RX_LARGE_AGG	0x10	/* device can rx large aggregates */
2753 #define BRF1_RFAWARE_DCS	0x20    /* RFAWARE dynamic channel selection (DCS) */
2754 #define BRF1_SOFTAP		0x40    /* Configure as Broadcom SOFTAP */
2755 #define BRF1_DWDS		0x80    /* DWDS capable */
2756 
2757 /* Vendor IE structure */
2758 BWL_PRE_PACKED_STRUCT struct vndr_ie {
2759 	uchar id;
2760 	uchar len;
2761 	uchar oui [3];
2762 	uchar data [1]; 	/* Variable size data */
2763 } BWL_POST_PACKED_STRUCT;
2764 typedef struct vndr_ie vndr_ie_t;
2765 
2766 #define VNDR_IE_HDR_LEN		2	/* id + len field */
2767 #define VNDR_IE_MIN_LEN		3	/* size of the oui field */
2768 #define VNDR_IE_FIXED_LEN	(VNDR_IE_HDR_LEN + VNDR_IE_MIN_LEN)
2769 
2770 #define VNDR_IE_MAX_LEN		255	/* vendor IE max length, without ID and len */
2771 
2772 /* BRCM PROP DEVICE PRIMARY MAC ADDRESS IE */
2773 BWL_PRE_PACKED_STRUCT struct member_of_brcm_prop_ie {
2774 	uchar id;
2775 	uchar len;
2776 	uchar oui[3];
2777 	uint8	type;           /* type inidicates what follows */
2778 	struct ether_addr ea;   /* Device Primary MAC Adrress */
2779 } BWL_POST_PACKED_STRUCT;
2780 typedef struct member_of_brcm_prop_ie member_of_brcm_prop_ie_t;
2781 
2782 #define MEMBER_OF_BRCM_PROP_IE_LEN		10	/* IE max length */
2783 #define MEMBER_OF_BRCM_PROP_IE_TYPE		54
2784 
2785 /* BRCM Reliable Multicast IE */
2786 BWL_PRE_PACKED_STRUCT struct relmcast_brcm_prop_ie {
2787 	uchar id;
2788 	uchar len;
2789 	uchar oui[3];
2790 	uint8 type;           /* type inidicates what follows */
2791 	struct ether_addr ea;   /* The ack sender's MAC Adrress */
2792 	struct ether_addr mcast_ea;  /* The multicast MAC address */
2793 	uint8 updtmo; /* time interval(second) for client to send null packet to report its rssi */
2794 } BWL_POST_PACKED_STRUCT;
2795 typedef struct relmcast_brcm_prop_ie relmcast_brcm_prop_ie_t;
2796 
2797 #define RELMCAST_BRCM_PROP_IE_LEN	(sizeof(relmcast_brcm_prop_ie_t)-2)	/* IE length */
2798 #define RELMCAST_BRCM_PROP_IE_TYPE	55
2799 
2800 /* ************* HT definitions. ************* */
2801 #define MCSSET_LEN	16	/* 16-bits per 8-bit set to give 128-bits bitmap of MCS Index */
2802 #define MAX_MCS_NUM	(128)	/* max mcs number = 128 */
2803 
2804 BWL_PRE_PACKED_STRUCT struct ht_cap_ie {
2805 	uint16	cap;
2806 	uint8	params;
2807 	uint8	supp_mcs[MCSSET_LEN];
2808 	uint16	ext_htcap;
2809 	uint32	txbf_cap;
2810 	uint8	as_cap;
2811 } BWL_POST_PACKED_STRUCT;
2812 typedef struct ht_cap_ie ht_cap_ie_t;
2813 
2814 BWL_PRE_PACKED_STRUCT struct dot11_ht_cap_ie {
2815 	uint8	id;
2816 	uint8	len;
2817 	ht_cap_ie_t ht_cap;
2818 } BWL_POST_PACKED_STRUCT;
2819 typedef struct dot11_ht_cap_ie dot11_ht_cap_ie_t;
2820 
2821 /* CAP IE: HT 1.0 spec. simply stole a 802.11 IE, we use our prop. IE until this is resolved */
2822 /* the capability IE is primarily used to convey this nodes abilities */
2823 BWL_PRE_PACKED_STRUCT struct ht_prop_cap_ie {
2824 	uint8	id;		/* IE ID, 221, DOT11_MNG_PROPR_ID */
2825 	uint8	len;		/* IE length */
2826 	uint8	oui[3];		/* Proprietary OUI, BRCM_PROP_OUI */
2827 	uint8	type;           /* type inidicates what follows */
2828 	ht_cap_ie_t cap_ie;
2829 } BWL_POST_PACKED_STRUCT;
2830 typedef struct ht_prop_cap_ie ht_prop_cap_ie_t;
2831 
2832 #define HT_PROP_IE_OVERHEAD	4	/* overhead bytes for prop oui ie */
2833 #define HT_CAP_IE_LEN		26	/* HT capability len (based on .11n d2.0) */
2834 #define HT_CAP_IE_TYPE		51
2835 
2836 #define HT_CAP_LDPC_CODING	0x0001	/* Support for rx of LDPC coded pkts */
2837 #define HT_CAP_40MHZ		0x0002  /* FALSE:20Mhz, TRUE:20/40MHZ supported */
2838 #define HT_CAP_MIMO_PS_MASK	0x000C  /* Mimo PS mask */
2839 #define HT_CAP_MIMO_PS_SHIFT	0x0002	/* Mimo PS shift */
2840 #define HT_CAP_MIMO_PS_OFF	0x0003	/* Mimo PS, no restriction */
2841 #define HT_CAP_MIMO_PS_RTS	0x0001	/* Mimo PS, send RTS/CTS around MIMO frames */
2842 #define HT_CAP_MIMO_PS_ON	0x0000	/* Mimo PS, MIMO disallowed */
2843 #define HT_CAP_GF		0x0010	/* Greenfield preamble support */
2844 #define HT_CAP_SHORT_GI_20	0x0020	/* 20MHZ short guard interval support */
2845 #define HT_CAP_SHORT_GI_40	0x0040	/* 40Mhz short guard interval support */
2846 #define HT_CAP_TX_STBC		0x0080	/* Tx STBC support */
2847 #define HT_CAP_RX_STBC_MASK	0x0300	/* Rx STBC mask */
2848 #define HT_CAP_RX_STBC_SHIFT	8	/* Rx STBC shift */
2849 #define HT_CAP_DELAYED_BA	0x0400	/* delayed BA support */
2850 #define HT_CAP_MAX_AMSDU	0x0800	/* Max AMSDU size in bytes , 0=3839, 1=7935 */
2851 
2852 #define HT_CAP_DSSS_CCK	0x1000	/* DSSS/CCK supported by the BSS */
2853 #define HT_CAP_PSMP		0x2000	/* Power Save Multi Poll support */
2854 #define HT_CAP_40MHZ_INTOLERANT 0x4000	/* 40MHz Intolerant */
2855 #define HT_CAP_LSIG_TXOP	0x8000	/* L-SIG TXOP protection support */
2856 
2857 #define HT_CAP_RX_STBC_NO		0x0	/* no rx STBC support */
2858 #define HT_CAP_RX_STBC_ONE_STREAM	0x1	/* rx STBC support of 1 spatial stream */
2859 #define HT_CAP_RX_STBC_TWO_STREAM	0x2	/* rx STBC support of 1-2 spatial streams */
2860 #define HT_CAP_RX_STBC_THREE_STREAM	0x3	/* rx STBC support of 1-3 spatial streams */
2861 
2862 
2863 #define HT_CAP_TXBF_CAP_IMPLICIT_TXBF_RX	0x1
2864 #define HT_CAP_TXBF_CAP_NDP_TX			0x8
2865 #define HT_CAP_TXBF_CAP_NDP_RX			0x10
2866 #define HT_CAP_TXBF_CAP_EXPLICIT_CSI		0x100
2867 #define HT_CAP_TXBF_CAP_EXPLICIT_NC_STEERING	0x200
2868 #define HT_CAP_TXBF_CAP_EXPLICIT_C_STEERING	0x400
2869 #define HT_CAP_TXBF_CAP_EXPLICIT_CSI_FB_MASK	0x1800
2870 #define HT_CAP_TXBF_CAP_EXPLICIT_CSI_FB_SHIFT	11
2871 #define HT_CAP_TXBF_CAP_EXPLICIT_NC_FB_MASK	0x6000
2872 #define HT_CAP_TXBF_CAP_EXPLICIT_NC_FB_SHIFT	13
2873 #define HT_CAP_TXBF_CAP_EXPLICIT_C_FB_MASK	0x18000
2874 #define HT_CAP_TXBF_CAP_EXPLICIT_C_FB_SHIFT	15
2875 #define HT_CAP_TXBF_CAP_CSI_BFR_ANT_SHIFT	19
2876 #define HT_CAP_TXBF_CAP_NC_BFR_ANT_SHIFT	21
2877 #define HT_CAP_TXBF_CAP_C_BFR_ANT_SHIFT		23
2878 #define HT_CAP_TXBF_CAP_C_BFR_ANT_MASK		0x1800000
2879 
2880 #define HT_CAP_TXBF_CAP_CHAN_ESTIM_SHIFT	27
2881 #define HT_CAP_TXBF_CAP_CHAN_ESTIM_MASK		0x18000000
2882 
2883 #define HT_CAP_TXBF_FB_TYPE_NONE 	0
2884 #define HT_CAP_TXBF_FB_TYPE_DELAYED 	1
2885 #define HT_CAP_TXBF_FB_TYPE_IMMEDIATE 	2
2886 #define HT_CAP_TXBF_FB_TYPE_BOTH 	3
2887 
2888 #define HT_CAP_TX_BF_CAP_EXPLICIT_CSI_FB_MASK	0x400
2889 #define HT_CAP_TX_BF_CAP_EXPLICIT_CSI_FB_SHIFT	10
2890 #define HT_CAP_TX_BF_CAP_EXPLICIT_COMPRESSED_FB_MASK 0x18000
2891 #define HT_CAP_TX_BF_CAP_EXPLICIT_COMPRESSED_FB_SHIFT 15
2892 
2893 #define VHT_MAX_MPDU		11454	/* max mpdu size for now (bytes) */
2894 #define VHT_MPDU_MSDU_DELTA	56		/* Difference in spec - vht mpdu, amsdu len */
2895 /* Max AMSDU len - per spec */
2896 #define VHT_MAX_AMSDU		(VHT_MAX_MPDU - VHT_MPDU_MSDU_DELTA)
2897 
2898 #define HT_MAX_AMSDU		7935	/* max amsdu size (bytes) per the HT spec */
2899 #define HT_MIN_AMSDU		3835	/* min amsdu size (bytes) per the HT spec */
2900 
2901 #define HT_PARAMS_RX_FACTOR_MASK	0x03	/* ampdu rcv factor mask */
2902 #define HT_PARAMS_DENSITY_MASK		0x1C	/* ampdu density mask */
2903 #define HT_PARAMS_DENSITY_SHIFT	2	/* ampdu density shift */
2904 
2905 /* HT/AMPDU specific define */
2906 #define AMPDU_MAX_MPDU_DENSITY  7       /* max mpdu density; in 1/4 usec units */
2907 #define AMPDU_DENSITY_NONE      0       /* No density requirement */
2908 #define AMPDU_DENSITY_1over4_US 1       /* 1/4 us density */
2909 #define AMPDU_DENSITY_1over2_US 2       /* 1/2 us density */
2910 #define AMPDU_DENSITY_1_US      3       /*   1 us density */
2911 #define AMPDU_DENSITY_2_US      4       /*   2 us density */
2912 #define AMPDU_DENSITY_4_US      5       /*   4 us density */
2913 #define AMPDU_DENSITY_8_US      6       /*   8 us density */
2914 #define AMPDU_DENSITY_16_US     7       /*  16 us density */
2915 #define AMPDU_RX_FACTOR_8K      0       /* max rcv ampdu len (8kb) */
2916 #define AMPDU_RX_FACTOR_16K     1       /* max rcv ampdu len (16kb) */
2917 #define AMPDU_RX_FACTOR_32K     2       /* max rcv ampdu len (32kb) */
2918 #define AMPDU_RX_FACTOR_64K     3       /* max rcv ampdu len (64kb) */
2919 #define AMPDU_RX_FACTOR_BASE    8*1024  /* ampdu factor base for rx len */
2920 
2921 #define AMPDU_DELIMITER_LEN	4	/* length of ampdu delimiter */
2922 #define AMPDU_DELIMITER_LEN_MAX	63	/* max length of ampdu delimiter(enforced in HW) */
2923 
2924 #define HT_CAP_EXT_PCO			0x0001
2925 #define HT_CAP_EXT_PCO_TTIME_MASK	0x0006
2926 #define HT_CAP_EXT_PCO_TTIME_SHIFT	1
2927 #define HT_CAP_EXT_MCS_FEEDBACK_MASK	0x0300
2928 #define HT_CAP_EXT_MCS_FEEDBACK_SHIFT	8
2929 #define HT_CAP_EXT_HTC			0x0400
2930 #define HT_CAP_EXT_RD_RESP		0x0800
2931 
2932 BWL_PRE_PACKED_STRUCT struct ht_add_ie {
2933 	uint8	ctl_ch;			/* control channel number */
2934 	uint8	byte1;			/* ext ch,rec. ch. width, RIFS support */
2935 	uint16	opmode;			/* operation mode */
2936 	uint16	misc_bits;		/* misc bits */
2937 	uint8	basic_mcs[MCSSET_LEN];  /* required MCS set */
2938 } BWL_POST_PACKED_STRUCT;
2939 typedef struct ht_add_ie ht_add_ie_t;
2940 
2941 /* ADD IE: HT 1.0 spec. simply stole a 802.11 IE, we use our prop. IE until this is resolved */
2942 /* the additional IE is primarily used to convey the current BSS configuration */
2943 BWL_PRE_PACKED_STRUCT struct ht_prop_add_ie {
2944 	uint8	id;		/* IE ID, 221, DOT11_MNG_PROPR_ID */
2945 	uint8	len;		/* IE length */
2946 	uint8	oui[3];		/* Proprietary OUI, BRCM_PROP_OUI */
2947 	uint8	type;		/* indicates what follows */
2948 	ht_add_ie_t add_ie;
2949 } BWL_POST_PACKED_STRUCT;
2950 typedef struct ht_prop_add_ie ht_prop_add_ie_t;
2951 
2952 #define HT_ADD_IE_LEN	22
2953 #define HT_ADD_IE_TYPE	52
2954 
2955 /* byte1 defn's */
2956 #define HT_BW_ANY		0x04	/* set, STA can use 20 or 40MHz */
2957 #define HT_RIFS_PERMITTED     	0x08	/* RIFS allowed */
2958 
2959 /* opmode defn's */
2960 #define HT_OPMODE_MASK	        0x0003	/* protection mode mask */
2961 #define HT_OPMODE_SHIFT		0	/* protection mode shift */
2962 #define HT_OPMODE_PURE		0x0000	/* protection mode PURE */
2963 #define HT_OPMODE_OPTIONAL	0x0001	/* protection mode optional */
2964 #define HT_OPMODE_HT20IN40	0x0002	/* protection mode 20MHz HT in 40MHz BSS */
2965 #define HT_OPMODE_MIXED	0x0003	/* protection mode Mixed Mode */
2966 #define HT_OPMODE_NONGF	0x0004	/* protection mode non-GF */
2967 #define DOT11N_TXBURST		0x0008	/* Tx burst limit */
2968 #define DOT11N_OBSS_NONHT	0x0010	/* OBSS Non-HT STA present */
2969 
2970 /* misc_bites defn's */
2971 #define HT_BASIC_STBC_MCS	0x007f	/* basic STBC MCS */
2972 #define HT_DUAL_STBC_PROT	0x0080	/* Dual STBC Protection */
2973 #define HT_SECOND_BCN		0x0100	/* Secondary beacon support */
2974 #define HT_LSIG_TXOP		0x0200	/* L-SIG TXOP Protection full support */
2975 #define HT_PCO_ACTIVE		0x0400	/* PCO active */
2976 #define HT_PCO_PHASE		0x0800	/* PCO phase */
2977 #define HT_DUALCTS_PROTECTION	0x0080	/* DUAL CTS protection needed */
2978 
2979 /* Tx Burst Limits */
2980 #define DOT11N_2G_TXBURST_LIMIT	6160	/* 2G band Tx burst limit per 802.11n Draft 1.10 (usec) */
2981 #define DOT11N_5G_TXBURST_LIMIT	3080	/* 5G band Tx burst limit per 802.11n Draft 1.10 (usec) */
2982 
2983 /* Macros for opmode */
2984 #define GET_HT_OPMODE(add_ie)		((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
2985 					>> HT_OPMODE_SHIFT)
2986 #define HT_MIXEDMODE_PRESENT(add_ie)	((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
2987 					== HT_OPMODE_MIXED)	/* mixed mode present */
2988 #define HT_HT20_PRESENT(add_ie)	((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
2989 					== HT_OPMODE_HT20IN40)	/* 20MHz HT present */
2990 #define HT_OPTIONAL_PRESENT(add_ie)	((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
2991 					== HT_OPMODE_OPTIONAL)	/* Optional protection present */
2992 #define HT_USE_PROTECTION(add_ie)	(HT_HT20_PRESENT((add_ie)) || \
2993 					HT_MIXEDMODE_PRESENT((add_ie))) /* use protection */
2994 #define HT_NONGF_PRESENT(add_ie)	((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_NONGF) \
2995 					== HT_OPMODE_NONGF)	/* non-GF present */
2996 #define DOT11N_TXBURST_PRESENT(add_ie)	((ltoh16_ua(&add_ie->opmode) & DOT11N_TXBURST) \
2997 					== DOT11N_TXBURST)	/* Tx Burst present */
2998 #define DOT11N_OBSS_NONHT_PRESENT(add_ie)	((ltoh16_ua(&add_ie->opmode) & DOT11N_OBSS_NONHT) \
2999 					== DOT11N_OBSS_NONHT)	/* OBSS Non-HT present */
3000 
3001 BWL_PRE_PACKED_STRUCT struct obss_params {
3002 	uint16	passive_dwell;
3003 	uint16	active_dwell;
3004 	uint16	bss_widthscan_interval;
3005 	uint16	passive_total;
3006 	uint16	active_total;
3007 	uint16	chanwidth_transition_dly;
3008 	uint16	activity_threshold;
3009 } BWL_POST_PACKED_STRUCT;
3010 typedef struct obss_params obss_params_t;
3011 
3012 BWL_PRE_PACKED_STRUCT struct dot11_obss_ie {
3013 	uint8	id;
3014 	uint8	len;
3015 	obss_params_t obss_params;
3016 } BWL_POST_PACKED_STRUCT;
3017 typedef struct dot11_obss_ie dot11_obss_ie_t;
3018 #define DOT11_OBSS_SCAN_IE_LEN	sizeof(obss_params_t)	/* HT OBSS len (based on 802.11n d3.0) */
3019 
3020 /* HT control field */
3021 #define HT_CTRL_LA_TRQ		0x00000002	/* sounding request */
3022 #define HT_CTRL_LA_MAI		0x0000003C	/* MCS request or antenna selection indication */
3023 #define HT_CTRL_LA_MAI_SHIFT	2
3024 #define HT_CTRL_LA_MAI_MRQ	0x00000004	/* MCS request */
3025 #define HT_CTRL_LA_MAI_MSI	0x00000038	/* MCS request sequence identifier */
3026 #define HT_CTRL_LA_MFSI		0x000001C0	/* MFB sequence identifier */
3027 #define HT_CTRL_LA_MFSI_SHIFT	6
3028 #define HT_CTRL_LA_MFB_ASELC	0x0000FE00	/* MCS feedback, antenna selection command/data */
3029 #define HT_CTRL_LA_MFB_ASELC_SH	9
3030 #define HT_CTRL_LA_ASELC_CMD	0x00000C00	/* ASEL command */
3031 #define HT_CTRL_LA_ASELC_DATA	0x0000F000	/* ASEL data */
3032 #define HT_CTRL_CAL_POS		0x00030000	/* Calibration position */
3033 #define HT_CTRL_CAL_SEQ		0x000C0000	/* Calibration sequence */
3034 #define HT_CTRL_CSI_STEERING	0x00C00000	/* CSI/Steering */
3035 #define HT_CTRL_CSI_STEER_SHIFT	22
3036 #define HT_CTRL_CSI_STEER_NFB	0		/* no fedback required */
3037 #define HT_CTRL_CSI_STEER_CSI	1		/* CSI, H matrix */
3038 #define HT_CTRL_CSI_STEER_NCOM	2		/* non-compressed beamforming */
3039 #define HT_CTRL_CSI_STEER_COM	3		/* compressed beamforming */
3040 #define HT_CTRL_NDP_ANNOUNCE	0x01000000	/* NDP announcement */
3041 #define HT_CTRL_AC_CONSTRAINT	0x40000000	/* AC Constraint */
3042 #define HT_CTRL_RDG_MOREPPDU	0x80000000	/* RDG/More PPDU */
3043 
3044 #define HT_OPMODE_OPTIONAL	0x0001	/* protection mode optional */
3045 #define HT_OPMODE_HT20IN40	0x0002	/* protection mode 20MHz HT in 40MHz BSS */
3046 #define HT_OPMODE_MIXED	0x0003	/* protection mode Mixed Mode */
3047 #define HT_OPMODE_NONGF	0x0004	/* protection mode non-GF */
3048 #define DOT11N_TXBURST		0x0008	/* Tx burst limit */
3049 #define DOT11N_OBSS_NONHT	0x0010	/* OBSS Non-HT STA present */
3050 
3051 /* ************* VHT definitions. ************* */
3052 
3053 /*
3054  * VHT Capabilites IE (sec 8.4.2.160)
3055  */
3056 
3057 BWL_PRE_PACKED_STRUCT struct vht_cap_ie {
3058 	uint32  vht_cap_info;
3059 	/* supported MCS set - 64 bit field */
3060 	uint16	rx_mcs_map;
3061 	uint16  rx_max_rate;
3062 	uint16  tx_mcs_map;
3063 	uint16	tx_max_rate;
3064 } BWL_POST_PACKED_STRUCT;
3065 typedef struct vht_cap_ie vht_cap_ie_t;
3066 
3067 /* 4B cap_info + 8B supp_mcs */
3068 #define VHT_CAP_IE_LEN 12
3069 
3070 /* VHT Capabilities Info field - 32bit - in VHT Cap IE */
3071 #define VHT_CAP_INFO_MAX_MPDU_LEN_MASK          0x00000003
3072 #define VHT_CAP_INFO_SUPP_CHAN_WIDTH_MASK       0x0000000c
3073 #define VHT_CAP_INFO_LDPC                       0x00000010
3074 #define VHT_CAP_INFO_SGI_80MHZ                  0x00000020
3075 #define VHT_CAP_INFO_SGI_160MHZ                 0x00000040
3076 #define VHT_CAP_INFO_TX_STBC                    0x00000080
3077 #define VHT_CAP_INFO_RX_STBC_MASK               0x00000700
3078 #define VHT_CAP_INFO_RX_STBC_SHIFT              8
3079 #define VHT_CAP_INFO_SU_BEAMFMR                 0x00000800
3080 #define VHT_CAP_INFO_SU_BEAMFMEE                0x00001000
3081 #define VHT_CAP_INFO_NUM_BMFMR_ANT_MASK         0x0000e000
3082 #define VHT_CAP_INFO_NUM_BMFMR_ANT_SHIFT        13
3083 #define VHT_CAP_INFO_NUM_SOUNDING_DIM_MASK      0x00070000
3084 #define VHT_CAP_INFO_NUM_SOUNDING_DIM_SHIFT     16
3085 #define VHT_CAP_INFO_MU_BEAMFMR                 0x00080000
3086 #define VHT_CAP_INFO_MU_BEAMFMEE                0x00100000
3087 #define VHT_CAP_INFO_TXOPPS                     0x00200000
3088 #define VHT_CAP_INFO_HTCVHT                     0x00400000
3089 #define VHT_CAP_INFO_AMPDU_MAXLEN_EXP_MASK      0x03800000
3090 #define VHT_CAP_INFO_AMPDU_MAXLEN_EXP_SHIFT     23
3091 #define VHT_CAP_INFO_LINK_ADAPT_CAP_MASK        0x0c000000
3092 #define VHT_CAP_INFO_LINK_ADAPT_CAP_SHIFT       26
3093 
3094 /* VHT Supported MCS Set - 64-bit - in VHT Cap IE */
3095 #define VHT_CAP_SUPP_MCS_RX_HIGHEST_RATE_MASK   0x1fff
3096 #define VHT_CAP_SUPP_MCS_RX_HIGHEST_RATE_SHIFT  0
3097 
3098 #define VHT_CAP_SUPP_MCS_TX_HIGHEST_RATE_MASK   0x1fff
3099 #define VHT_CAP_SUPP_MCS_TX_HIGHEST_RATE_SHIFT  0
3100 
3101 #define VHT_CAP_MCS_MAP_0_7                     0
3102 #define VHT_CAP_MCS_MAP_0_8                     1
3103 #define VHT_CAP_MCS_MAP_0_9                     2
3104 #define VHT_CAP_MCS_MAP_NONE                    3
3105 #define VHT_CAP_MCS_MAP_S                       2 /* num bits for 1-stream */
3106 #define VHT_CAP_MCS_MAP_M                       0x3 /* mask for 1-stream */
3107 /* assumes VHT_CAP_MCS_MAP_NONE is 3 and 2 bits are used for encoding */
3108 #define VHT_CAP_MCS_MAP_NONE_ALL                0xffff
3109 /* mcsmap with MCS0-9 for Nss = 3 */
3110 #define VHT_CAP_MCS_MAP_0_9_NSS3 \
3111 	        ((VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(1)) | \
3112 	         (VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(2)) | \
3113 	         (VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(3)))
3114 
3115 #define VHT_CAP_MCS_MAP_NSS_MAX                 8
3116 
3117 /* get mcsmap with given mcs for given nss streams */
3118 #define VHT_CAP_MCS_MAP_CREATE(mcsmap, nss, mcs) \
3119 	do { \
3120 		int i; \
3121 		for (i = 1; i <= nss; i++) { \
3122 			VHT_MCS_MAP_SET_MCS_PER_SS(i, mcs, mcsmap); \
3123 		} \
3124 	} while (0)
3125 
3126 /* Map the mcs code to mcs bit map */
3127 #define VHT_MCS_CODE_TO_MCS_MAP(mcs_code) \
3128 	((mcs_code == VHT_CAP_MCS_MAP_0_7) ? 0xff : \
3129 	 (mcs_code == VHT_CAP_MCS_MAP_0_8) ? 0x1ff : \
3130 	 (mcs_code == VHT_CAP_MCS_MAP_0_9) ? 0x3ff : 0)
3131 
3132 /* Map the mcs bit map to mcs code */
3133 #define VHT_MCS_MAP_TO_MCS_CODE(mcs_map) \
3134 	((mcs_map == 0xff)  ? VHT_CAP_MCS_MAP_0_7 : \
3135 	 (mcs_map == 0x1ff) ? VHT_CAP_MCS_MAP_0_8 : \
3136 	 (mcs_map == 0x3ff) ? VHT_CAP_MCS_MAP_0_9 : VHT_CAP_MCS_MAP_NONE)
3137 
3138 /* VHT Capabilities Supported Channel Width */
3139 typedef enum vht_cap_chan_width {
3140 	VHT_CAP_CHAN_WIDTH_SUPPORT_MANDATORY = 0x00,
3141 	VHT_CAP_CHAN_WIDTH_SUPPORT_160       = 0x04,
3142 	VHT_CAP_CHAN_WIDTH_SUPPORT_160_8080  = 0x08
3143 } vht_cap_chan_width_t;
3144 
3145 /* VHT Capabilities Supported max MPDU LEN (sec 8.4.2.160.2) */
3146 typedef enum vht_cap_max_mpdu_len {
3147 	VHT_CAP_MPDU_MAX_4K     = 0x00,
3148 	VHT_CAP_MPDU_MAX_8K     = 0x01,
3149 	VHT_CAP_MPDU_MAX_11K    = 0x02
3150 } vht_cap_max_mpdu_len_t;
3151 
3152 /* Maximum MPDU Length byte counts for the VHT Capabilities advertised limits */
3153 #define VHT_MPDU_LIMIT_4K        3895
3154 #define VHT_MPDU_LIMIT_8K        7991
3155 #define VHT_MPDU_LIMIT_11K      11454
3156 
3157 
3158 /*
3159  * VHT Operation IE (sec 8.4.2.161)
3160  */
3161 
3162 BWL_PRE_PACKED_STRUCT struct vht_op_ie {
3163 	uint8	chan_width;
3164 	uint8	chan1;
3165 	uint8	chan2;
3166 	uint16	supp_mcs;  /*  same def as above in vht cap */
3167 } BWL_POST_PACKED_STRUCT;
3168 typedef struct vht_op_ie vht_op_ie_t;
3169 
3170 /* 3B VHT Op info + 2B Basic MCS */
3171 #define VHT_OP_IE_LEN 5
3172 
3173 typedef enum vht_op_chan_width {
3174 	VHT_OP_CHAN_WIDTH_20_40	= 0,
3175 	VHT_OP_CHAN_WIDTH_80	= 1,
3176 	VHT_OP_CHAN_WIDTH_160	= 2,
3177 	VHT_OP_CHAN_WIDTH_80_80	= 3
3178 } vht_op_chan_width_t;
3179 
3180 /* AID length */
3181 #define AID_IE_LEN		2
3182 /*
3183  * BRCM vht features IE header
3184  * The header if the fixed part of the IE
3185  * On the 5GHz band this is the entire IE,
3186  * on 2.4GHz the VHT IEs as defined in the 802.11ac
3187  * specification follows
3188  *
3189  *
3190  * VHT features rates  bitmap.
3191  * Bit0:		5G MCS 0-9 BW 160MHz
3192  * Bit1:		5G MCS 0-9 support BW 80MHz
3193  * Bit2:		5G MCS 0-9 support BW 20MHz
3194  * Bit3:		2.4G MCS 0-9 support BW 20MHz
3195  * Bits:4-7	Reserved for future use
3196  *
3197  */
3198 #define VHT_FEATURES_IE_TYPE	0x4
3199 BWL_PRE_PACKED_STRUCT struct vht_features_ie_hdr {
3200 	uint8 oui[3];		/* Proprietary OUI, BRCM_PROP_OUI */
3201 	uint8 type;		/* type of this IE = 4 */
3202 	uint8 rate_mask;	/* VHT rate mask */
3203 } BWL_POST_PACKED_STRUCT;
3204 typedef struct vht_features_ie_hdr vht_features_ie_hdr_t;
3205 
3206 /* Def for rx & tx basic mcs maps - ea ss num has 2 bits of info */
3207 #define VHT_MCS_MAP_GET_SS_IDX(nss) (((nss)-1) * VHT_CAP_MCS_MAP_S)
3208 #define VHT_MCS_MAP_GET_MCS_PER_SS(nss, mcsMap) \
3209 	(((mcsMap) >> VHT_MCS_MAP_GET_SS_IDX(nss)) & VHT_CAP_MCS_MAP_M)
3210 #define VHT_MCS_MAP_SET_MCS_PER_SS(nss, numMcs, mcsMap) \
3211 	do { \
3212 	 (mcsMap) &= (~(VHT_CAP_MCS_MAP_M << VHT_MCS_MAP_GET_SS_IDX(nss))); \
3213 	 (mcsMap) |= (((numMcs) & VHT_CAP_MCS_MAP_M) << VHT_MCS_MAP_GET_SS_IDX(nss)); \
3214 	} while (0)
3215 #define VHT_MCS_SS_SUPPORTED(nss, mcsMap) \
3216 		 (VHT_MCS_MAP_GET_MCS_PER_SS((nss), (mcsMap)) != VHT_CAP_MCS_MAP_NONE)
3217 
3218 
3219 /* ************* WPA definitions. ************* */
3220 #define WPA_OUI			"\x00\x50\xF2"	/* WPA OUI */
3221 #define WPA_OUI_LEN		3		/* WPA OUI length */
3222 #define WPA_OUI_TYPE		1
3223 #define WPA_VERSION		1		/* WPA version */
3224 #define WPA2_OUI		"\x00\x0F\xAC"	/* WPA2 OUI */
3225 #define WPA2_OUI_LEN		3		/* WPA2 OUI length */
3226 #define WPA2_VERSION		1		/* WPA2 version */
3227 #define WPA2_VERSION_LEN	2		/* WAP2 version length */
3228 
3229 /* ************* WPS definitions. ************* */
3230 #define WPS_OUI			"\x00\x50\xF2"	/* WPS OUI */
3231 #define WPS_OUI_LEN		3		/* WPS OUI length */
3232 #define WPS_OUI_TYPE		4
3233 
3234 /* ************* WFA definitions. ************* */
3235 
3236 #ifdef P2P_IE_OVRD
3237 #define WFA_OUI			MAC_OUI
3238 #else
3239 #define WFA_OUI			"\x50\x6F\x9A"	/* WFA OUI */
3240 #endif /* P2P_IE_OVRD */
3241 #define WFA_OUI_LEN		3		/* WFA OUI length */
3242 #ifdef P2P_IE_OVRD
3243 #define WFA_OUI_TYPE_P2P	MAC_OUI_TYPE_P2P
3244 #else
3245 #define WFA_OUI_TYPE_TPC	8
3246 #define WFA_OUI_TYPE_P2P	9
3247 #endif
3248 
3249 #define WFA_OUI_TYPE_TPC	8
3250 #ifdef WLTDLS
3251 #define WFA_OUI_TYPE_TPQ	4	/* WFD Tunneled Probe ReQuest */
3252 #define WFA_OUI_TYPE_TPS	5	/* WFD Tunneled Probe ReSponse */
3253 #define WFA_OUI_TYPE_WFD	10
3254 #endif /* WTDLS */
3255 #define WFA_OUI_TYPE_HS20	0x10
3256 
3257 /* RSN authenticated key managment suite */
3258 #define RSN_AKM_NONE		0	/* None (IBSS) */
3259 #define RSN_AKM_UNSPECIFIED	1	/* Over 802.1x */
3260 #define RSN_AKM_PSK		2	/* Pre-shared Key */
3261 #define RSN_AKM_FBT_1X		3	/* Fast Bss transition using 802.1X */
3262 #define RSN_AKM_FBT_PSK		4	/* Fast Bss transition using Pre-shared Key */
3263 #define RSN_AKM_MFP_1X		5	/* SHA256 key derivation, using 802.1X */
3264 #define RSN_AKM_MFP_PSK		6	/* SHA256 key derivation, using Pre-shared Key */
3265 #define RSN_AKM_TPK			7	/* TPK(TDLS Peer Key) handshake */
3266 
3267 /* Key related defines */
3268 #define DOT11_MAX_DEFAULT_KEYS	4	/* number of default keys */
3269 #define DOT11_MAX_KEY_SIZE	32	/* max size of any key */
3270 #define DOT11_MAX_IV_SIZE	16	/* max size of any IV */
3271 #define DOT11_EXT_IV_FLAG	(1<<5)	/* flag to indicate IV is > 4 bytes */
3272 #define DOT11_WPA_KEY_RSC_LEN   8       /* WPA RSC key len */
3273 
3274 #define WEP1_KEY_SIZE		5	/* max size of any WEP key */
3275 #define WEP1_KEY_HEX_SIZE	10	/* size of WEP key in hex. */
3276 #define WEP128_KEY_SIZE		13	/* max size of any WEP key */
3277 #define WEP128_KEY_HEX_SIZE	26	/* size of WEP key in hex. */
3278 #define TKIP_MIC_SIZE		8	/* size of TKIP MIC */
3279 #define TKIP_EOM_SIZE		7	/* max size of TKIP EOM */
3280 #define TKIP_EOM_FLAG		0x5a	/* TKIP EOM flag byte */
3281 #define TKIP_KEY_SIZE		32	/* size of any TKIP key */
3282 #define TKIP_MIC_AUTH_TX	16	/* offset to Authenticator MIC TX key */
3283 #define TKIP_MIC_AUTH_RX	24	/* offset to Authenticator MIC RX key */
3284 #define TKIP_MIC_SUP_RX		TKIP_MIC_AUTH_TX	/* offset to Supplicant MIC RX key */
3285 #define TKIP_MIC_SUP_TX		TKIP_MIC_AUTH_RX	/* offset to Supplicant MIC TX key */
3286 #define AES_KEY_SIZE		16	/* size of AES key */
3287 #define AES_MIC_SIZE		8	/* size of AES MIC */
3288 #define BIP_KEY_SIZE		16	/* size of BIP key */
3289 #define BIP_MIC_SIZE		8   /* sizeof BIP MIC */
3290 
3291 /* WCN */
3292 #define WCN_OUI			"\x00\x50\xf2"	/* WCN OUI */
3293 #define WCN_TYPE		4	/* WCN type */
3294 
3295 
3296 /* 802.11r protocol definitions */
3297 
3298 /* Mobility Domain IE */
3299 BWL_PRE_PACKED_STRUCT struct dot11_mdid_ie {
3300 	uint8 id;
3301 	uint8 len;
3302 	uint16 mdid;		/* Mobility Domain Id */
3303 	uint8 cap;
3304 } BWL_POST_PACKED_STRUCT;
3305 typedef struct dot11_mdid_ie dot11_mdid_ie_t;
3306 
3307 #define FBT_MDID_CAP_OVERDS	0x01	/* Fast Bss transition over the DS support */
3308 #define FBT_MDID_CAP_RRP	0x02	/* Resource request protocol support */
3309 
3310 /* Fast Bss Transition IE */
3311 BWL_PRE_PACKED_STRUCT struct dot11_ft_ie {
3312 	uint8 id;
3313 	uint8 len;
3314 	uint16 mic_control;		/* Mic Control */
3315 	uint8 mic[16];
3316 	uint8 anonce[32];
3317 	uint8 snonce[32];
3318 } BWL_POST_PACKED_STRUCT;
3319 typedef struct dot11_ft_ie dot11_ft_ie_t;
3320 
3321 #define TIE_TYPE_RESERVED		0
3322 #define TIE_TYPE_REASSOC_DEADLINE	1
3323 #define TIE_TYPE_KEY_LIEFTIME		2
3324 #define TIE_TYPE_ASSOC_COMEBACK		3
3325 BWL_PRE_PACKED_STRUCT struct dot11_timeout_ie {
3326 	uint8 id;
3327 	uint8 len;
3328 	uint8 type;		/* timeout interval type */
3329 	uint32 value;		/* timeout interval value */
3330 } BWL_POST_PACKED_STRUCT;
3331 typedef struct dot11_timeout_ie dot11_timeout_ie_t;
3332 
3333 /* GTK ie */
3334 BWL_PRE_PACKED_STRUCT struct dot11_gtk_ie {
3335 	uint8 id;
3336 	uint8 len;
3337 	uint16 key_info;
3338 	uint8 key_len;
3339 	uint8 rsc[8];
3340 	uint8 data[1];
3341 } BWL_POST_PACKED_STRUCT;
3342 typedef struct dot11_gtk_ie dot11_gtk_ie_t;
3343 
3344 /* Management MIC ie */
3345 BWL_PRE_PACKED_STRUCT struct mmic_ie {
3346 	uint8   id;					/* IE ID: 0xDD */
3347 	uint8   len;				/* IE length */
3348 	uint16  key_id;				/* key id */
3349 	uint8   ipn[6];				/* ipn */
3350 	uint8   mic[BIP_MIC_SIZE];	/* mic */
3351 } BWL_POST_PACKED_STRUCT;
3352 typedef struct mmic_ie mmic_ie_t;
3353 
3354 #define BSSID_INVALID           "\x00\x00\x00\x00\x00\x00"
3355 #define BSSID_BROADCAST         "\xFF\xFF\xFF\xFF\xFF\xFF"
3356 
3357 
3358 /* ************* WMM Parameter definitions. ************* */
3359 #define WMM_OUI			"\x00\x50\xF2"	/* WNN OUI */
3360 #define WMM_OUI_LEN		3		/* WMM OUI length */
3361 #define WMM_OUI_TYPE	2		/* WMM OUT type */
3362 #define WMM_VERSION		1
3363 #define WMM_VERSION_LEN	1
3364 
3365 /* WMM OUI subtype */
3366 #define WMM_OUI_SUBTYPE_PARAMETER	1
3367 #define WMM_PARAMETER_IE_LEN		24
3368 
3369 /* Link Identifier Element */
3370 BWL_PRE_PACKED_STRUCT struct link_id_ie {
3371 	uint8 id;
3372 	uint8 len;
3373 	struct ether_addr	bssid;
3374 	struct ether_addr	tdls_init_mac;
3375 	struct ether_addr	tdls_resp_mac;
3376 } BWL_POST_PACKED_STRUCT;
3377 typedef struct link_id_ie link_id_ie_t;
3378 #define TDLS_LINK_ID_IE_LEN		18
3379 
3380 /* Link Wakeup Schedule Element */
3381 BWL_PRE_PACKED_STRUCT struct wakeup_sch_ie {
3382 	uint8 id;
3383 	uint8 len;
3384 	uint32 offset;			/* in ms between TSF0 and start of 1st Awake Window */
3385 	uint32 interval;		/* in ms bwtween the start of 2 Awake Windows */
3386 	uint32 awake_win_slots;	/* in backof slots, duration of Awake Window */
3387 	uint32 max_wake_win;	/* in ms, max duration of Awake Window */
3388 	uint16 idle_cnt;		/* number of consecutive Awake Windows */
3389 } BWL_POST_PACKED_STRUCT;
3390 typedef struct wakeup_sch_ie wakeup_sch_ie_t;
3391 #define TDLS_WAKEUP_SCH_IE_LEN		18
3392 
3393 /* Channel Switch Timing Element */
3394 BWL_PRE_PACKED_STRUCT struct channel_switch_timing_ie {
3395 	uint8 id;
3396 	uint8 len;
3397 	uint16 switch_time;		/* in ms, time to switch channels */
3398 	uint16 switch_timeout;	/* in ms */
3399 } BWL_POST_PACKED_STRUCT;
3400 typedef struct channel_switch_timing_ie channel_switch_timing_ie_t;
3401 #define TDLS_CHANNEL_SWITCH_TIMING_IE_LEN		4
3402 
3403 /* PTI Control Element */
3404 BWL_PRE_PACKED_STRUCT struct pti_control_ie {
3405 	uint8 id;
3406 	uint8 len;
3407 	uint8 tid;
3408 	uint16 seq_control;
3409 } BWL_POST_PACKED_STRUCT;
3410 typedef struct pti_control_ie pti_control_ie_t;
3411 #define TDLS_PTI_CONTROL_IE_LEN		3
3412 
3413 /* PU Buffer Status Element */
3414 BWL_PRE_PACKED_STRUCT struct pu_buffer_status_ie {
3415 	uint8 id;
3416 	uint8 len;
3417 	uint8 status;
3418 } BWL_POST_PACKED_STRUCT;
3419 typedef struct pu_buffer_status_ie pu_buffer_status_ie_t;
3420 #define TDLS_PU_BUFFER_STATUS_IE_LEN	1
3421 #define TDLS_PU_BUFFER_STATUS_AC_BK		1
3422 #define TDLS_PU_BUFFER_STATUS_AC_BE		2
3423 #define TDLS_PU_BUFFER_STATUS_AC_VI		4
3424 #define TDLS_PU_BUFFER_STATUS_AC_VO		8
3425 
3426 /* 802.11u GAS action frames */
3427 #define GAS_REQUEST_ACTION_FRAME				10
3428 #define GAS_RESPONSE_ACTION_FRAME				11
3429 #define GAS_COMEBACK_REQUEST_ACTION_FRAME		12
3430 #define GAS_COMEBACK_RESPONSE_ACTION_FRAME		13
3431 
3432 /* 802.11u interworking access network options */
3433 #define IW_ANT_MASK				0x0f
3434 #define IW_INTERNET_MASK		0x10
3435 #define IW_ASRA_MASK			0x20
3436 #define IW_ESR_MASK				0x40
3437 #define IW_UESA_MASK			0x80
3438 
3439 /* 802.11u interworking access network type */
3440 #define IW_ANT_PRIVATE_NETWORK					0
3441 #define IW_ANT_PRIVATE_NETWORK_WITH_GUEST		1
3442 #define IW_ANT_CHARGEABLE_PUBLIC_NETWORK		2
3443 #define IW_ANT_FREE_PUBLIC_NETWORK				3
3444 #define IW_ANT_PERSONAL_DEVICE_NETWORK			4
3445 #define IW_ANT_EMERGENCY_SERVICES_NETWORK		5
3446 #define IW_ANT_TEST_NETWORK						14
3447 #define IW_ANT_WILDCARD_NETWORK					15
3448 
3449 /* 802.11u advertisement protocol */
3450 #define ADVP_ANQP_PROTOCOL_ID	0
3451 
3452 /* 802.11u advertisement protocol masks */
3453 #define ADVP_QRL_MASK					0x7f
3454 #define ADVP_PAME_BI_MASK				0x80
3455 
3456 /* 802.11u advertisement protocol values */
3457 #define ADVP_QRL_REQUEST				0x00
3458 #define ADVP_QRL_RESPONSE				0x7f
3459 #define ADVP_PAME_BI_DEPENDENT			0x00
3460 #define ADVP_PAME_BI_INDEPENDENT		ADVP_PAME_BI_MASK
3461 
3462 /* 802.11u ANQP information ID */
3463 #define ANQP_ID_QUERY_LIST							256
3464 #define ANQP_ID_CAPABILITY_LIST						257
3465 #define ANQP_ID_VENUE_NAME_INFO						258
3466 #define ANQP_ID_EMERGENCY_CALL_NUMBER_INFO			259
3467 #define ANQP_ID_NETWORK_AUTHENTICATION_TYPE_INFO	260
3468 #define ANQP_ID_ROAMING_CONSORTIUM_LIST				261
3469 #define ANQP_ID_IP_ADDRESS_TYPE_AVAILABILITY_INFO	262
3470 #define ANQP_ID_NAI_REALM_LIST						263
3471 #define ANQP_ID_G3PP_CELLULAR_NETWORK_INFO			264
3472 #define ANQP_ID_AP_GEOSPATIAL_LOCATION				265
3473 #define ANQP_ID_AP_CIVIC_LOCATION					266
3474 #define ANQP_ID_AP_LOCATION_PUBLIC_ID_URI			267
3475 #define ANQP_ID_DOMAIN_NAME_LIST					268
3476 #define ANQP_ID_EMERGENCY_ALERT_ID_URI				269
3477 #define ANQP_ID_EMERGENCY_NAI						271
3478 #define ANQP_ID_VENDOR_SPECIFIC_LIST				56797
3479 
3480 /* 802.11u ANQP OUI */
3481 #define ANQP_OUI_SUBTYPE	9
3482 
3483 /* 802.11u venue name */
3484 #define VENUE_LANGUAGE_CODE_SIZE		3
3485 #define VENUE_NAME_SIZE					255
3486 
3487 /* 802.11u venue groups */
3488 #define VENUE_UNSPECIFIED				0
3489 #define VENUE_ASSEMBLY					1
3490 #define VENUE_BUSINESS					2
3491 #define VENUE_EDUCATIONAL				3
3492 #define VENUE_FACTORY					4
3493 #define VENUE_INSTITUTIONAL				5
3494 #define VENUE_MERCANTILE				6
3495 #define VENUE_RESIDENTIAL				7
3496 #define VENUE_STORAGE					8
3497 #define VENUE_UTILITY					9
3498 #define VENUE_VEHICULAR					10
3499 #define VENUE_OUTDOOR					11
3500 
3501 /* 802.11u network authentication type indicator */
3502 #define NATI_ACCEPTANCE_OF_TERMS_CONDITIONS			0
3503 #define NATI_ONLINE_ENROLLMENT_SUPPORTED			1
3504 #define NATI_HTTP_HTTPS_REDIRECTION					2
3505 #define NATI_DNS_REDIRECTION						3
3506 
3507 /* 802.11u IP address type availability - IPv6 */
3508 #define IPA_IPV6_SHIFT						0
3509 #define IPA_IPV6_MASK						(0x03 << IPA_IPV6_SHIFT)
3510 #define	IPA_IPV6_NOT_AVAILABLE				0x00
3511 #define IPA_IPV6_AVAILABLE					0x01
3512 #define IPA_IPV6_UNKNOWN_AVAILABILITY		0x02
3513 
3514 /* 802.11u IP address type availability - IPv4 */
3515 #define IPA_IPV4_SHIFT						2
3516 #define IPA_IPV4_MASK						(0x3f << IPA_IPV4_SHIFT)
3517 #define	IPA_IPV4_NOT_AVAILABLE				0x00
3518 #define IPA_IPV4_PUBLIC						0x01
3519 #define IPA_IPV4_PORT_RESTRICT				0x02
3520 #define IPA_IPV4_SINGLE_NAT					0x03
3521 #define IPA_IPV4_DOUBLE_NAT					0x04
3522 #define IPA_IPV4_PORT_RESTRICT_SINGLE_NAT	0x05
3523 #define IPA_IPV4_PORT_RESTRICT_DOUBLE_NAT	0x06
3524 #define IPA_IPV4_UNKNOWN_AVAILABILITY		0x07
3525 
3526 /* 802.11u NAI realm encoding */
3527 #define REALM_ENCODING_RFC4282	0
3528 #define REALM_ENCODING_UTF8		1
3529 
3530 /* 802.11u IANA EAP method type numbers */
3531 #define REALM_EAP_TLS					13
3532 #define REALM_EAP_SIM					18
3533 #define REALM_EAP_TTLS					21
3534 #define REALM_EAP_AKA					23
3535 #define REALM_EAP_PSK					47
3536 #define REALM_EAP_AKAP					50
3537 
3538 /* 802.11u authentication ID */
3539 #define REALM_EXPANDED_EAP						1
3540 #define REALM_NON_EAP_INNER_AUTHENTICATION		2
3541 #define REALM_INNER_AUTHENTICATION_EAP			3
3542 #define REALM_EXPANDED_INNER_EAP				4
3543 #define REALM_CREDENTIAL						5
3544 #define REALM_TUNNELED_EAP_CREDENTIAL			6
3545 #define REALM_VENDOR_SPECIFIC_EAP				221
3546 
3547 /* 802.11u non-EAP inner authentication type */
3548 #define REALM_PAP					1
3549 #define REALM_CHAP					2
3550 #define REALM_MSCHAP				3
3551 #define REALM_MSCHAPV2				4
3552 
3553 /* 802.11u credential type */
3554 #define REALM_SIM					1
3555 #define REALM_USIM					2
3556 #define REALM_NFC					3
3557 #define REALM_HARDWARE_TOKEN		4
3558 #define REALM_SOFTOKEN				5
3559 #define REALM_CERTIFICATE			6
3560 #define REALM_USERNAME_PASSWORD		7
3561 #define REALM_SERVER_SIDE			8
3562 
3563 /* 802.11u 3GPP PLMN */
3564 #define G3PP_GUD_VERSION		0
3565 #define G3PP_PLMN_LIST_IE		0
3566 
3567 /* hotspot2.0 indication element (vendor specific) */
3568 BWL_PRE_PACKED_STRUCT struct hs20_ie {
3569 	uint8 oui[3];
3570 	uint8 type;
3571 	uint8 config;
3572 } BWL_POST_PACKED_STRUCT;
3573 typedef struct hs20_ie hs20_ie_t;
3574 #define HS20_IE_LEN 5	/* HS20 IE length */
3575 
3576 /* This marks the end of a packed structure section. */
3577 #include <packed_section_end.h>
3578 
3579 #endif /* _802_11_H_ */
3580