xref: /freebsd/sys/net80211/ieee80211.h (revision 2ab7cbdc346e2a174a7bee4ce44c4f78b1ca093b)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2001 Atsushi Onoe
5  * Copyright (c) 2002-2009 Sam Leffler, Errno Consulting
6  * All rights reserved.
7  * Copyright (c) 2020-2025 The FreeBSD Foundation
8  *
9  * Portions of this software were developed by Björn Zeeb
10  * under sponsorship from the FreeBSD Foundation.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 #ifndef _NET80211_IEEE80211_H_
33 #define _NET80211_IEEE80211_H_
34 
35 #include <sys/types.h>
36 
37 #ifndef _KERNEL
38 #include <stdbool.h>
39 #endif
40 
41 /*
42  * 802.11 protocol definitions.
43  */
44 
45 #define	IEEE80211_ADDR_LEN	6		/* size of 802.11 address */
46 /* is 802.11 address multicast/broadcast? */
47 #define	IEEE80211_IS_MULTICAST(_a)	(*(_a) & 0x01)
48 
49 #ifdef _KERNEL
50 extern const uint8_t ieee80211broadcastaddr[];
51 #endif
52 
53 typedef uint16_t ieee80211_seq;
54 
55 /* IEEE 802.11 PLCP header */
56 struct ieee80211_plcp_hdr {
57 	uint16_t	i_sfd;
58 	uint8_t		i_signal;
59 	uint8_t		i_service;
60 	uint16_t	i_length;
61 	uint16_t	i_crc;
62 } __packed;
63 
64 #define IEEE80211_PLCP_SFD      0xF3A0
65 #define IEEE80211_PLCP_SERVICE  0x00
66 #define IEEE80211_PLCP_SERVICE_LOCKED	0x04
67 #define IEEE80211_PLCL_SERVICE_PBCC	0x08
68 #define IEEE80211_PLCP_SERVICE_LENEXT5	0x20
69 #define IEEE80211_PLCP_SERVICE_LENEXT6	0x40
70 #define IEEE80211_PLCP_SERVICE_LENEXT7	0x80
71 
72 /*
73  * generic definitions for IEEE 802.11 frames
74  */
75 struct ieee80211_frame {
76 	uint8_t		i_fc[2];
77 	uint8_t		i_dur[2];
78 	uint8_t		i_addr1[IEEE80211_ADDR_LEN];
79 	uint8_t		i_addr2[IEEE80211_ADDR_LEN];
80 	uint8_t		i_addr3[IEEE80211_ADDR_LEN];
81 	uint8_t		i_seq[2];
82 	/* possibly followed by addr4[IEEE80211_ADDR_LEN]; */
83 	/* see below */
84 } __packed;
85 
86 struct ieee80211_qosframe {
87 	uint8_t		i_fc[2];
88 	uint8_t		i_dur[2];
89 	uint8_t		i_addr1[IEEE80211_ADDR_LEN];
90 	uint8_t		i_addr2[IEEE80211_ADDR_LEN];
91 	uint8_t		i_addr3[IEEE80211_ADDR_LEN];
92 	uint8_t		i_seq[2];
93 	uint8_t		i_qos[2];
94 	/* possibly followed by addr4[IEEE80211_ADDR_LEN]; */
95 	/* see below */
96 } __packed;
97 
98 struct ieee80211_qoscntl {
99 	uint8_t		i_qos[2];
100 };
101 
102 struct ieee80211_frame_addr4 {
103 	uint8_t		i_fc[2];
104 	uint8_t		i_dur[2];
105 	uint8_t		i_addr1[IEEE80211_ADDR_LEN];
106 	uint8_t		i_addr2[IEEE80211_ADDR_LEN];
107 	uint8_t		i_addr3[IEEE80211_ADDR_LEN];
108 	uint8_t		i_seq[2];
109 	uint8_t		i_addr4[IEEE80211_ADDR_LEN];
110 } __packed;
111 
112 struct ieee80211_qosframe_addr4 {
113 	uint8_t		i_fc[2];
114 	uint8_t		i_dur[2];
115 	uint8_t		i_addr1[IEEE80211_ADDR_LEN];
116 	uint8_t		i_addr2[IEEE80211_ADDR_LEN];
117 	uint8_t		i_addr3[IEEE80211_ADDR_LEN];
118 	uint8_t		i_seq[2];
119 	uint8_t		i_addr4[IEEE80211_ADDR_LEN];
120 	uint8_t		i_qos[2];
121 } __packed;
122 
123 #define	IEEE80211_FC0_VERSION_MASK		0x03
124 #define	IEEE80211_FC0_VERSION_SHIFT		0
125 #define	IEEE80211_FC0_VERSION_0			0x00
126 #define	IEEE80211_FC0_TYPE_MASK			0x0c
127 #define	IEEE80211_FC0_TYPE_SHIFT		2
128 #define	IEEE80211_FC0_TYPE_MGT			0x00	/* Management */
129 #define	IEEE80211_FC0_TYPE_CTL			0x04	/* Control */
130 #define	IEEE80211_FC0_TYPE_DATA			0x08	/* Data */
131 #define	IEEE80211_FC0_TYPE_EXT			0x0c	/* Extension */
132 
133 #define	IEEE80211_FC0_SUBTYPE_MASK		0xf0
134 #define	IEEE80211_FC0_SUBTYPE_SHIFT		4
135 /* 802.11-2020 Table 9-1-Valid type and subtype combinations */
136 /* For type 00 Management (IEEE80211_FC0_TYPE_MGT) */
137 #define	IEEE80211_FC0_SUBTYPE_ASSOC_REQ		0x00	/* Association Request */
138 #define	IEEE80211_FC0_SUBTYPE_ASSOC_RESP	0x10	/* Association Response */
139 #define	IEEE80211_FC0_SUBTYPE_REASSOC_REQ	0x20	/* Reassociation Request */
140 #define	IEEE80211_FC0_SUBTYPE_REASSOC_RESP	0x30	/* Reassociation Response */
141 #define	IEEE80211_FC0_SUBTYPE_PROBE_REQ		0x40	/* Probe Request */
142 #define	IEEE80211_FC0_SUBTYPE_PROBE_RESP	0x50	/* Probe Response */
143 #define	IEEE80211_FC0_SUBTYPE_TIMING_ADV	0x60	/* Timing Advertisement */
144 /* 0111 Reserved				0x70 */
145 #define	IEEE80211_FC0_SUBTYPE_BEACON		0x80	/* Beacon */
146 #define	IEEE80211_FC0_SUBTYPE_ATIM		0x90	/* ATIM */
147 #define	IEEE80211_FC0_SUBTYPE_DISASSOC		0xa0	/* Disassociation */
148 #define	IEEE80211_FC0_SUBTYPE_AUTH		0xb0	/* Authentication */
149 #define	IEEE80211_FC0_SUBTYPE_DEAUTH		0xc0	/* Deauthentication */
150 #define	IEEE80211_FC0_SUBTYPE_ACTION		0xd0	/* Action */
151 #define	IEEE80211_FC0_SUBTYPE_ACTION_NOACK	0xe0	/* Action No Ack */
152 /* 1111 Reserved				0xf0 */
153 /* For type 01 Control (IEEE80211_FC0_TYPE_CTL) */
154 /* 0000-0001 Reserved				0x00-0x10 */
155 #define	IEEE80211_FC0_SUBTYPE_TRIGGER		0x20	/* Trigger, 80211ax-2021 */
156 #define	IEEE80211_FC0_SUBTYPE_TACK		0x30	/* TACK */
157 #define	IEEE80211_FC0_SUBTYPE_BF_REPORT_POLL	0x40	/* Beamforming Report Poll */
158 #define	IEEE80211_FC0_SUBTYPE_VHT_HE_NDP	0x50	/* VHT/HE NDP Announcement, 80211ac/ax-2013/2021 */
159 #define	IEEE80211_FC0_SUBTYPE_CTL_EXT		0x60	/* Control Frame Extension */
160 #define	IEEE80211_FC0_SUBTYPE_CONTROL_WRAP	0x70	/* Control Wrapper */
161 #define	IEEE80211_FC0_SUBTYPE_BAR		0x80	/* Block Ack Request (BlockAckReq) */
162 #define	IEEE80211_FC0_SUBTYPE_BA		0x90	/* Block Ack (BlockAck) */
163 #define	IEEE80211_FC0_SUBTYPE_PS_POLL		0xa0	/* PS-Poll */
164 #define	IEEE80211_FC0_SUBTYPE_RTS		0xb0	/* RTS */
165 #define	IEEE80211_FC0_SUBTYPE_CTS		0xc0	/* CTS */
166 #define	IEEE80211_FC0_SUBTYPE_ACK		0xd0	/* Ack */
167 #define	IEEE80211_FC0_SUBTYPE_CF_END		0xe0	/* CF-End */
168 #define	IEEE80211_FC0_SUBTYPE_CF_END_ACK	0xf0	/* 1111 Reserved - what was CF_END_ACK? */
169 /* For type 10 Data (IEEE80211_FC0_TYPE_DATA) */
170 #define	IEEE80211_FC0_SUBTYPE_DATA		0x00	/* Data */
171 /* 0001-0011 Reserved				0x10-0x30 */	/* Were: CF_ACK, CF_POLL, CF_ACPL */
172 #define	IEEE80211_FC0_SUBTYPE_NODATA		0x40	/* Null */
173 /* 0101-0111 Reserved				0x50-0x70 */	/* Were: CFACK, CFPOLL, CF_ACK_CF_ACK */
174 #define	IEEE80211_FC0_SUBTYPE_QOS_MASK_ANY	0x80	/* QoS mask - matching any subtypes 8..15 */
175 #define	IEEE80211_FC0_SUBTYPE_QOS_DATA		0x80	/* QoS Data */
176 #define	IEEE80211_FC0_SUBTYPE_QOS_DATA_CFACK	0x90	/* QoS Data +CF-Ack */
177 #define	IEEE80211_FC0_SUBTYPE_QOS_DATA_CFPOLL	0xa0	/* QoS Data +CF-Poll */
178 #define	IEEE80211_FC0_SUBTYPE_QOS_DATA_CFACKPOLL 0xb0	/* QoS Data +CF-Ack +CF-Poll */
179 #define	IEEE80211_FC0_SUBTYPE_QOS_NULL		0xc0	/* QoS Null */
180 /* 1101 Reserved				0xd0 */
181 #define	IEEE80211_FC0_SUBTYPE_QOS_CFPOLL	0xe0	/* QoS CF-Poll */
182 #define	IEEE80211_FC0_SUBTYPE_QOS_CFACKPOLL	0xf0	/* QoS CF-Ack +CF-Poll */
183 /* For type 11 Extension (IEEE80211_FC0_TYPE_EXT) */
184 #define	IEEE80211_FC0_SUBTYPE_DMG_BEACON	0x00	/* DMG Beacon */
185 #define	IEEE80211_FC0_SUBTYPE_S1G_BEACON	0x10	/* S1G Beacon */
186 /* 0010-1111 Reserved				0x20-0xff */
187 
188 /* 802.11-2020 Table 9-2-Control Frame Extension */
189 /* Reusing B11..B8, part of FC1 */
190 #define	IEEE80211_CTL_EXT_SECTOR_ACK		0x00	/* Sector Ack, 80211ay-2021 */
191 #define	IEEE80211_CTL_EXT_BA_SCHED		0x01	/* Block Ack Schedule, 80211ay-2021 */
192 #define	IEEE80211_CTL_EXT_POLL			0x02	/* Poll */
193 #define	IEEE80211_CTL_EXT_SPR			0x03	/* SPR */
194 #define	IEEE80211_CTL_EXT_GRANT			0x04	/* Grant */
195 #define	IEEE80211_CTL_EXT_DMG_CTS		0x05	/* DMG CTS */
196 #define	IEEE80211_CTL_EXT_DMG_DTS		0x06	/* DMG DTS */
197 #define	IEEE80211_CTL_EXT_GRANT_ACK		0x07	/* Grant Ack */
198 #define	IEEE80211_CTL_EXT_SSW			0x08	/* SSW */
199 #define	IEEE80211_CTL_EXT_SSW_FBACK		0x09	/* SSW-Feedback */
200 #define	IEEE80211_CTL_EXT_SSW_ACK		0x0a	/* SSW-Ack */
201 #define	IEEE80211_CTL_EXT_TDD_BF		0x0b	/* TDD Beamforming, 80211ay-2021 */
202 /* 1100-1111 Reserved				0xc-0xf */
203 
204 /* Check the version field */
205 #define	IEEE80211_IS_FC0_CHECK_VER(wh, v)			\
206 	(((wh)->i_fc[0] & IEEE80211_FC0_VERSION_MASK) == (v))
207 
208 /* Check the version and type field */
209 #define	IEEE80211_IS_FC0_CHECK_VER_TYPE(wh, v, t)			\
210 	(((((wh)->i_fc[0] & IEEE80211_FC0_VERSION_MASK) == (v))) &&	\
211 	  (((wh)->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == (t)))
212 
213 /* Check the version, type and subtype field */
214 #define	IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh, v, t, st)		\
215 	(((((wh)->i_fc[0] & IEEE80211_FC0_VERSION_MASK) == (v))) &&	\
216 	  (((wh)->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == (t)) &&		\
217 	  (((wh)->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == (st)))
218 
219 #define	IEEE80211_IS_MGMT(wh)						\
220 	(IEEE80211_IS_FC0_CHECK_VER_TYPE(wh, IEEE80211_FC0_VERSION_0,	\
221 	 IEEE80211_FC0_TYPE_MGT))
222 #define	IEEE80211_IS_CTL(wh)					\
223 	(IEEE80211_IS_FC0_CHECK_VER_TYPE(wh, IEEE80211_FC0_VERSION_0,	\
224 	 IEEE80211_FC0_TYPE_CTL))
225 #define	IEEE80211_IS_DATA(wh)					\
226 	(IEEE80211_IS_FC0_CHECK_VER_TYPE(wh, IEEE80211_FC0_VERSION_0,	\
227 	 IEEE80211_FC0_TYPE_DATA))
228 #define	IEEE80211_IS_EXT(wh)					\
229 	(IEEE80211_IS_FC0_CHECK_VER_TYPE(wh, IEEE80211_FC0_VERSION_0,	\
230 	 IEEE80211_FC0_TYPE_EXT))
231 
232 /* Management frame types */
233 
234 #define	IEEE80211_IS_MGMT_BEACON(wh)			\
235 	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
236 	 IEEE80211_FC0_VERSION_0,			\
237 	 IEEE80211_FC0_TYPE_MGT,			\
238 	 IEEE80211_FC0_SUBTYPE_BEACON))
239 
240 #define	IEEE80211_IS_MGMT_PROBE_RESP(wh)		\
241 	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
242 	 IEEE80211_FC0_VERSION_0,			\
243 	 IEEE80211_FC0_TYPE_MGT,			\
244 	 IEEE80211_FC0_SUBTYPE_PROBE_RESP))
245 
246 #define	IEEE80211_IS_MGMT_ACTION(wh)		\
247 	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
248 	 IEEE80211_FC0_VERSION_0,			\
249 	 IEEE80211_FC0_TYPE_MGT,			\
250 	 IEEE80211_FC0_SUBTYPE_ACTION))
251 
252 /* Control frame types */
253 
254 #define	IEEE80211_IS_CTL_PS_POLL(wh)			\
255 	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
256 	 IEEE80211_FC0_VERSION_0,			\
257 	 IEEE80211_FC0_TYPE_CTL,			\
258 	 IEEE80211_FC0_SUBTYPE_PS_POLL))
259 
260 #define	IEEE80211_IS_CTL_BAR(wh)			\
261 	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
262 	 IEEE80211_FC0_VERSION_0,			\
263 	 IEEE80211_FC0_TYPE_CTL,			\
264 	 IEEE80211_FC0_SUBTYPE_BAR))
265 
266 /* Data frame types */
267 
268 /*
269  * Return true if the frame is any of the QOS frame types, not just
270  * data frames.  Matching on the IEEE80211_FC0_SUBTYPE_QOS_ANY bit
271  * being set also matches on subtypes 8..15.
272  */
273 #define	IEEE80211_IS_QOS_ANY(wh)					\
274 	((IEEE80211_IS_FC0_CHECK_VER_TYPE(wh, IEEE80211_FC0_VERSION_0,	\
275 	 IEEE80211_FC0_TYPE_DATA)) &&					\
276 	 ((wh)->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS_MASK_ANY))
277 
278 /*
279  * Return true if this frame is QOS data, and only QOS data.
280  */
281 #define	IEEE80211_IS_QOSDATA(wh)			\
282 	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
283 	 IEEE80211_FC0_VERSION_0,			\
284 	 IEEE80211_FC0_TYPE_DATA,			\
285 	 IEEE80211_FC0_SUBTYPE_QOS_DATA))
286 
287 /*
288  * Return true if this frame is a QoS NULL data frame.
289  */
290 #define	IEEE80211_IS_QOS_NULL(wh)			\
291 	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
292 	 IEEE80211_FC0_VERSION_0,			\
293 	 IEEE80211_FC0_TYPE_DATA,			\
294 	 IEEE80211_FC0_SUBTYPE_QOS_NULL))
295 
296 
297 #define	IEEE80211_FC1_DIR_MASK			0x03
298 #define	IEEE80211_FC1_DIR_NODS			0x00	/* STA->STA */
299 #define	IEEE80211_FC1_DIR_TODS			0x01	/* STA->AP  */
300 #define	IEEE80211_FC1_DIR_FROMDS		0x02	/* AP ->STA */
301 #define	IEEE80211_FC1_DIR_DSTODS		0x03	/* AP ->AP  */
302 
303 #define	IEEE80211_IS_DSTODS(wh) \
304 	(((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
305 
306 #define	IEEE80211_FC1_MORE_FRAG			0x04
307 #define	IEEE80211_FC1_RETRY			0x08
308 #define	IEEE80211_FC1_PWR_MGT			0x10
309 #define	IEEE80211_FC1_MORE_DATA			0x20
310 #define	IEEE80211_FC1_PROTECTED			0x40
311 #define	IEEE80211_FC1_ORDER			0x80
312 
313 #define	IEEE80211_IS_PROTECTED(wh) \
314 	((wh)->i_fc[1] & IEEE80211_FC1_PROTECTED)
315 
316 #define IEEE80211_HAS_SEQ(type, subtype) \
317 	((type) != IEEE80211_FC0_TYPE_CTL && \
318 	!((type) == IEEE80211_FC0_TYPE_DATA && \
319 	 ((subtype) & IEEE80211_FC0_SUBTYPE_QOS_NULL) == \
320 		      IEEE80211_FC0_SUBTYPE_QOS_NULL))
321 #define	IEEE80211_SEQ_FRAG_MASK			0x000f
322 #define	IEEE80211_SEQ_FRAG_SHIFT		0
323 #define	IEEE80211_SEQ_SEQ_MASK			0xfff0
324 #define	IEEE80211_SEQ_SEQ_SHIFT			4
325 #define	IEEE80211_SEQ_RANGE			4096
326 
327 #define	IEEE80211_SEQ_ADD(seq, incr) \
328 	(((seq) + (incr)) & (IEEE80211_SEQ_RANGE-1))
329 #define	IEEE80211_SEQ_INC(seq)	IEEE80211_SEQ_ADD(seq,1)
330 #define	IEEE80211_SEQ_SUB(a, b) \
331 	(((a) + IEEE80211_SEQ_RANGE - (b)) & (IEEE80211_SEQ_RANGE-1))
332 
333 #define	IEEE80211_SEQ_BA_RANGE			2048	/* 2^11 */
334 #define	IEEE80211_SEQ_BA_BEFORE(a, b) \
335 	(IEEE80211_SEQ_SUB(b, a+1) < IEEE80211_SEQ_BA_RANGE-1)
336 
337 #define	IEEE80211_NWID_LEN			32
338 #define	IEEE80211_MESHID_LEN			32
339 
340 #define	IEEE80211_QOS_CTL_LEN			2
341 
342 #define	IEEE80211_QOS_TXOP			0x00ff
343 /* bit 8 is reserved */
344 #define	IEEE80211_QOS_AMSDU			0x80
345 #define	IEEE80211_QOS_AMSDU_S			7
346 #define	IEEE80211_QOS_ACKPOLICY			0x60
347 #define	IEEE80211_QOS_ACKPOLICY_S		5
348 #define	IEEE80211_QOS_ACKPOLICY_NOACK		0x20	/* No ACK required */
349 #define	IEEE80211_QOS_ACKPOLICY_BA		0x60	/* Block ACK */
350 #define	IEEE80211_QOS_EOSP			0x10	/* EndOfService Period*/
351 #define	IEEE80211_QOS_EOSP_S			4
352 #define	IEEE80211_QOS_TID			0x0f
353 /* qos[1] byte used for all frames sent by mesh STAs in a mesh BSS */
354 #define IEEE80211_QOS_MC			0x01	/* Mesh control */
355 /* Mesh power save level*/
356 #define IEEE80211_QOS_MESH_PSL			0x02
357 /* Mesh Receiver Service Period Initiated */
358 #define IEEE80211_QOS_RSPI			0x04
359 /* bits 11 to 15 reserved */
360 
361 /* does frame have QoS sequence control data */
362 #define	IEEE80211_QOS_HAS_SEQ(wh) \
363 	(((wh)->i_fc[0] & \
364 	  (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_QOS_DATA)) == \
365 	  (IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_QOS_DATA))
366 
367 /*
368  * WME/802.11e information element.
369  */
370 struct ieee80211_wme_info {
371 	uint8_t		wme_id;		/* IEEE80211_ELEMID_VENDOR */
372 	uint8_t		wme_len;	/* length in bytes */
373 	uint8_t		wme_oui[3];	/* 0x00, 0x50, 0xf2 */
374 	uint8_t		wme_type;	/* OUI type */
375 	uint8_t		wme_subtype;	/* OUI subtype */
376 	uint8_t		wme_version;	/* spec revision */
377 	uint8_t		wme_info;	/* QoS info */
378 } __packed;
379 
380 /*
381  * WME/802.11e Tspec Element
382  */
383 struct ieee80211_wme_tspec {
384 	uint8_t		ts_id;
385 	uint8_t		ts_len;
386 	uint8_t		ts_oui[3];
387 	uint8_t		ts_oui_type;
388 	uint8_t		ts_oui_subtype;
389 	uint8_t		ts_version;
390 	uint8_t		ts_tsinfo[3];
391 	uint8_t		ts_nom_msdu[2];
392 	uint8_t		ts_max_msdu[2];
393 	uint8_t		ts_min_svc[4];
394 	uint8_t		ts_max_svc[4];
395 	uint8_t		ts_inactv_intv[4];
396 	uint8_t		ts_susp_intv[4];
397 	uint8_t		ts_start_svc[4];
398 	uint8_t		ts_min_rate[4];
399 	uint8_t		ts_mean_rate[4];
400 	uint8_t		ts_max_burst[4];
401 	uint8_t		ts_min_phy[4];
402 	uint8_t		ts_peak_rate[4];
403 	uint8_t		ts_delay[4];
404 	uint8_t		ts_surplus[2];
405 	uint8_t		ts_medium_time[2];
406 } __packed;
407 
408 /*
409  * WME AC parameter field
410  */
411 struct ieee80211_wme_acparams {
412 	uint8_t		acp_aci_aifsn;
413 	uint8_t		acp_logcwminmax;
414 	uint16_t	acp_txop;
415 } __packed;
416 
417 #define WME_NUM_AC		4	/* 4 AC categories */
418 #define	WME_NUM_TID		16	/* 16 tids */
419 
420 #define WME_PARAM_ACI		0x60	/* Mask for ACI field */
421 #define WME_PARAM_ACI_S		5	/* Shift for ACI field */
422 #define WME_PARAM_ACM		0x10	/* Mask for ACM bit */
423 #define WME_PARAM_ACM_S		4	/* Shift for ACM bit */
424 #define WME_PARAM_AIFSN		0x0f	/* Mask for aifsn field */
425 #define WME_PARAM_AIFSN_S	0	/* Shift for aifsn field */
426 #define WME_PARAM_LOGCWMIN	0x0f	/* Mask for CwMin field (in log) */
427 #define WME_PARAM_LOGCWMIN_S	0	/* Shift for CwMin field */
428 #define WME_PARAM_LOGCWMAX	0xf0	/* Mask for CwMax field (in log) */
429 #define WME_PARAM_LOGCWMAX_S	4	/* Shift for CwMax field */
430 
431 #define WME_AC_TO_TID(_ac) (       \
432 	((_ac) == WME_AC_VO) ? 6 : \
433 	((_ac) == WME_AC_VI) ? 5 : \
434 	((_ac) == WME_AC_BK) ? 1 : \
435 	0)
436 
437 #define TID_TO_WME_AC(_tid) (      \
438 	((_tid) == 0 || (_tid) == 3) ? WME_AC_BE : \
439 	((_tid) < 3) ? WME_AC_BK : \
440 	((_tid) < 6) ? WME_AC_VI : \
441 	WME_AC_VO)
442 
443 /*
444  * WME Parameter Element
445  */
446 struct ieee80211_wme_param {
447 	uint8_t		param_id;
448 	uint8_t		param_len;
449 	uint8_t		param_oui[3];
450 	uint8_t		param_oui_type;
451 	uint8_t		param_oui_subtype;
452 	uint8_t		param_version;
453 	uint8_t		param_qosInfo;
454 #define	WME_QOSINFO_COUNT	0x0f	/* Mask for param count field */
455 	uint8_t		param_reserved;
456 	struct ieee80211_wme_acparams	params_acParams[WME_NUM_AC];
457 } __packed;
458 
459 /*
460  * WME U-APSD qos info field defines
461  */
462 #define	WME_CAPINFO_UAPSD_EN                    0x00000080
463 #define	WME_CAPINFO_UAPSD_VO                    0x00000001
464 #define	WME_CAPINFO_UAPSD_VI                    0x00000002
465 #define	WME_CAPINFO_UAPSD_BK                    0x00000004
466 #define	WME_CAPINFO_UAPSD_BE                    0x00000008
467 #define	WME_CAPINFO_UAPSD_ACFLAGS_SHIFT         0
468 #define	WME_CAPINFO_UAPSD_ACFLAGS_MASK          0xF
469 #define	WME_CAPINFO_UAPSD_MAXSP_SHIFT           5
470 #define	WME_CAPINFO_UAPSD_MAXSP_MASK            0x3
471 #define	WME_CAPINFO_IE_OFFSET                   8
472 #define	WME_UAPSD_MAXSP(_qosinfo)				\
473 	    (((_qosinfo) >> WME_CAPINFO_UAPSD_MAXSP_SHIFT) &	\
474 	    WME_CAPINFO_UAPSD_MAXSP_MASK)
475 #define	WME_UAPSD_AC_ENABLED(_ac, _qosinfo)			\
476 	    ((1 << (3 - (_ac))) & (				\
477 	    ((_qosinfo) >> WME_CAPINFO_UAPSD_ACFLAGS_SHIFT) &	\
478 	    WME_CAPINFO_UAPSD_ACFLAGS_MASK))
479 
480 /*
481  * Management Notification Frame
482  */
483 struct ieee80211_mnf {
484 	uint8_t		mnf_category;
485 	uint8_t		mnf_action;
486 	uint8_t		mnf_dialog;
487 	uint8_t		mnf_status;
488 } __packed;
489 #define	MNF_SETUP_REQ	0
490 #define	MNF_SETUP_RESP	1
491 #define	MNF_TEARDOWN	2
492 
493 /*
494  * 802.11n Management Action Frames
495  */
496 /* generic frame format */
497 struct ieee80211_action {
498 	uint8_t		ia_category;
499 	uint8_t		ia_action;
500 } __packed;
501 
502 /* 80211-2020 Table 9-51-Category values */
503 #define	IEEE80211_ACTION_CAT_SM			0	/* 9.6.2 Spectrum Management */
504 #define	IEEE80211_ACTION_CAT_QOS		1	/* 9.6.3 QoS */
505 /* Reserved					2	was IEEE80211_ACTION_CAT_DLS */
506 #define	IEEE80211_ACTION_CAT_BA			3	/* 9.6.4 Block Ack */
507 #define	IEEE80211_ACTION_CAT_PUBLIC		4	/* 9.6.7 Public */
508 #define	IEEE80211_ACTION_CAT_RADIO_MEASUREMENT	5	/* 9.6.6 Radio Measurement */
509 #define	IEEE80211_ACTION_CAT_FAST_BSS_TRANSITION 6	/* 9.6.8 Fast BSS Transition */
510 #define	IEEE80211_ACTION_CAT_HT			7	/* 9.6.11 HT */
511 #define	IEEE80211_ACTION_CAT_SA_QUERY		8	/* 9.6.9 SA Query */
512 #define	IEEE80211_ACTION_CAT_PROTECTED_DUAL_OF_PUBLIC_ACTION 9 /* 9.6.10 Protected Dual of Public Action */
513 #define	IEEE80211_ACTION_CAT_WNM		10	/* 9.6.13 WNM */
514 #define	IEEE80211_ACTION_CAT_UNPROTECTED_WNM	11	/* 9.6.14 Unprotected WNM */
515 #define	IEEE80211_ACTION_CAT_TDLS		12	/* 9.6.12 TDLS */
516 #define	IEEE80211_ACTION_CAT_MESH		13	/* 9.6.16 Mesh */
517 #define	IEEE80211_ACTION_CAT_MULTIHOP		14	/* 9.6.17 Multihop */
518 #define	IEEE80211_ACTION_CAT_SELF_PROT		15	/* 9.6.15 Self-protected */
519 #define	IEEE80211_ACTION_CAT_DMG		16	/* 9.6.19 DMG */
520 /* Reserved					17	(R)Wi-Fi Alliance */
521 #define	IEEE80211_ACTION_CAT_FAST_SESSION_TRANSFER 18	/* 9.6.20 Fast Session Transfer */
522 #define	IEEE80211_ACTION_CAT_ROBUST_AV_STREAMING 19	/* 9.6.18 Robust AV Streaming */
523 #define	IEEE80211_ACTION_CAT_UNPROTECTED_DMG	20	/* 9.6.21 Unprotected DMG */
524 #define	IEEE80211_ACTION_CAT_VHT		21	/* 9.6.22 VHT */
525 #define	IEEE80211_ACTION_CAT_UNPROTECTED_S1G	22	/* 9.6.24 Unprotected S1G */
526 #define	IEEE80211_ACTION_CAT_S1G		23	/* 9.6.25 S1G */
527 #define	IEEE80211_ACTION_CAT_FLOW_CONTROL	24	/* 9.6.26 Flow Control */
528 #define	IEEE80211_ACTION_CAT_CTL_RESP_MCS_NEG	25	/* 9.6.27 Control Response MCS Negotiation */
529 #define	IEEE80211_ACTION_CAT_FILS		26	/* 9.6.23 FILS */
530 #define	IEEE80211_ACTION_CAT_CDMG		27	/* 9.6.28 CDMG */
531 #define	IEEE80211_ACTION_CAT_CMMG		28	/* 9.6.29 CMMG */
532 #define	IEEE80211_ACTION_CAT_GLK		29	/* 9.6.30 GLK */
533 #define	IEEE80211_ACTION_CAT_HE			30	/* 9.6.31 HE, 80211ax-2021 */
534 #define	IEEE80211_ACTION_CAT_PROTECTED_HE	31	/* 9.6.32 Protected HE, 80211ax-2021 */
535 /* Reserved					32-125 */
536 #define	IEEE80211_ACTION_CAT_VENDOR_SPECIFIC_PROTECTED 126 /* 9.6.5 Vendor-specific Protected */
537 #define	IEEE80211_ACTION_CAT_VENDOR		127	/* 9.6.5 Vendor-specific */
538 /* Error					128-255 */
539 
540 
541 /* 80211-2020 Table 9-346-Spectrum Management Action field values */
542 enum ieee80211_action_sm {
543 	IEEE80211_ACTION_SM_SMREQ		= 0,	/* Spectrum Measurement Request */
544 	IEEE80211_ACTION_SM_SMREP		= 1,	/* Spectrum Measurement Report */
545 	IEEE80211_ACTION_SM_TPCREQ		= 2,	/* TPC Request */
546 	IEEE80211_ACTION_SM_TPCREP		= 3,	/* TPC Report */
547 	IEEE80211_ACTION_SM_CSA			= 4,	/* Channel Switch Announcement */
548 	/* Reserved				= 5-255 */
549 };
550 
551 /* 80211-2020 Table 9-363-Radio Measurement Action field values */
552 enum ieee80211_action_radio_measurement {
553 	IEEE80211_ACTION_RADIO_MEASUREMENT_RMREQ	= 0,	/* Radio Measurement Request */
554 	IEEE80211_ACTION_RADIO_MEASUREMENT_RMREP	= 1,	/* Radio Measurement Report */
555 	IEEE80211_ACTION_RADIO_MEASUREMENT_LMREQ	= 2,	/* Link Measurement Request */
556 	IEEE80211_ACTION_RADIO_MEASUREMENT_LMREP	= 3,	/* Link Measurement Report */
557 	IEEE80211_ACTION_RADIO_MEASUREMENT_NRREQ	= 4,	/* Neighbor Report Request */
558 	IEEE80211_ACTION_RADIO_MEASUREMENT_NRRESP	= 5,	/* Neighbor Report Response */
559 	/* Reserved					= 6-255 */
560 };
561 
562 #define	IEEE80211_ACTION_HT_TXCHWIDTH	0	/* recommended xmit chan width*/
563 #define	IEEE80211_ACTION_HT_MIMOPWRSAVE	1	/* MIMO power save */
564 
565 /* HT - recommended transmission channel width */
566 struct ieee80211_action_ht_txchwidth {
567 	struct ieee80211_action	at_header;
568 	uint8_t		at_chwidth;
569 } __packed;
570 
571 #define	IEEE80211_A_HT_TXCHWIDTH_20	0
572 #define	IEEE80211_A_HT_TXCHWIDTH_2040	1
573 
574 /* HT - MIMO Power Save (NB: D2.04) */
575 struct ieee80211_action_ht_mimopowersave {
576 	struct ieee80211_action am_header;
577 	uint8_t		am_control;
578 } __packed;
579 
580 #define	IEEE80211_A_HT_MIMOPWRSAVE_ENA		0x01	/* PS enabled */
581 #define	IEEE80211_A_HT_MIMOPWRSAVE_MODE		0x02
582 #define	IEEE80211_A_HT_MIMOPWRSAVE_MODE_S	1
583 #define	IEEE80211_A_HT_MIMOPWRSAVE_DYNAMIC	0x02	/* Dynamic Mode */
584 #define	IEEE80211_A_HT_MIMOPWRSAVE_STATIC	0x00	/* no SM packets */
585 /* bits 2-7 reserved */
586 
587 /* Block Ack actions */
588 #define IEEE80211_ACTION_BA_ADDBA_REQUEST       0   /* ADDBA request */
589 #define IEEE80211_ACTION_BA_ADDBA_RESPONSE      1   /* ADDBA response */
590 #define IEEE80211_ACTION_BA_DELBA	        2   /* DELBA */
591 
592 /* Block Ack Parameter Set */
593 #define	IEEE80211_BAPS_BUFSIZ	0xffc0		/* buffer size */
594 #define	IEEE80211_BAPS_BUFSIZ_S	6
595 #define	IEEE80211_BAPS_TID	0x003c		/* TID */
596 #define	IEEE80211_BAPS_TID_S	2
597 #define	IEEE80211_BAPS_POLICY	0x0002		/* block ack policy */
598 #define	IEEE80211_BAPS_POLICY_S	1
599 #define	IEEE80211_BAPS_AMSDU	0x0001		/* A-MSDU permitted */
600 #define	IEEE80211_BAPS_AMSDU_S	0
601 
602 #define	IEEE80211_BAPS_POLICY_DELAYED	(0<<IEEE80211_BAPS_POLICY_S)
603 #define	IEEE80211_BAPS_POLICY_IMMEDIATE	(1<<IEEE80211_BAPS_POLICY_S)
604 
605 /* Block Ack Sequence Control */
606 #define	IEEE80211_BASEQ_START	0xfff0		/* starting seqnum */
607 #define	IEEE80211_BASEQ_START_S	4
608 #define	IEEE80211_BASEQ_FRAG	0x000f		/* fragment number */
609 #define	IEEE80211_BASEQ_FRAG_S	0
610 
611 /* Delayed Block Ack Parameter Set */
612 #define	IEEE80211_DELBAPS_TID	0xf000		/* TID */
613 #define	IEEE80211_DELBAPS_TID_S	12
614 #define	IEEE80211_DELBAPS_INIT	0x0800		/* initiator */
615 #define	IEEE80211_DELBAPS_INIT_S 11
616 
617 /* BA - ADDBA request */
618 struct ieee80211_action_ba_addbarequest {
619 	struct ieee80211_action rq_header;
620 	uint8_t		rq_dialogtoken;
621 	uint16_t	rq_baparamset;
622 	uint16_t	rq_batimeout;		/* in TUs */
623 	uint16_t	rq_baseqctl;
624 } __packed;
625 
626 /* BA - ADDBA response */
627 struct ieee80211_action_ba_addbaresponse {
628 	struct ieee80211_action rs_header;
629 	uint8_t		rs_dialogtoken;
630 	uint16_t	rs_statuscode;
631 	uint16_t	rs_baparamset;
632 	uint16_t	rs_batimeout;		/* in TUs */
633 } __packed;
634 
635 /* BA - DELBA */
636 struct ieee80211_action_ba_delba {
637 	struct ieee80211_action dl_header;
638 	uint16_t	dl_baparamset;
639 	uint16_t	dl_reasoncode;
640 } __packed;
641 
642 /* BAR Control */
643 #define	IEEE80211_BAR_TID	0xf000		/* TID */
644 #define	IEEE80211_BAR_TID_S	12
645 #define	IEEE80211_BAR_COMP	0x0004		/* Compressed Bitmap */
646 #define	IEEE80211_BAR_MTID	0x0002		/* Multi-TID */
647 #define	IEEE80211_BAR_NOACK	0x0001		/* No-Ack policy */
648 
649 /* BAR Starting Sequence Control */
650 #define	IEEE80211_BAR_SEQ_START	0xfff0		/* starting seqnum */
651 #define	IEEE80211_BAR_SEQ_START_S	4
652 
653 struct ieee80211_ba_request {
654 	uint16_t	rq_barctl;
655 	uint16_t	rq_barseqctl;
656 } __packed;
657 
658 /*
659  * Control frames.
660  */
661 struct ieee80211_frame_min {
662 	uint8_t		i_fc[2];
663 	uint8_t		i_dur[2];
664 	uint8_t		i_addr1[IEEE80211_ADDR_LEN];
665 	uint8_t		i_addr2[IEEE80211_ADDR_LEN];
666 	/* FCS */
667 } __packed;
668 
669 struct ieee80211_frame_rts {
670 	uint8_t		i_fc[2];
671 	uint8_t		i_dur[2];
672 	uint8_t		i_ra[IEEE80211_ADDR_LEN];
673 	uint8_t		i_ta[IEEE80211_ADDR_LEN];
674 	/* FCS */
675 } __packed;
676 
677 struct ieee80211_frame_cts {
678 	uint8_t		i_fc[2];
679 	uint8_t		i_dur[2];
680 	uint8_t		i_ra[IEEE80211_ADDR_LEN];
681 	/* FCS */
682 } __packed;
683 
684 struct ieee80211_frame_ack {
685 	uint8_t		i_fc[2];
686 	uint8_t		i_dur[2];
687 	uint8_t		i_ra[IEEE80211_ADDR_LEN];
688 	/* FCS */
689 } __packed;
690 
691 struct ieee80211_frame_pspoll {
692 	uint8_t		i_fc[2];
693 	uint8_t		i_aid[2];
694 	uint8_t		i_bssid[IEEE80211_ADDR_LEN];
695 	uint8_t		i_ta[IEEE80211_ADDR_LEN];
696 	/* FCS */
697 } __packed;
698 
699 struct ieee80211_frame_cfend {		/* NB: also CF-End+CF-Ack */
700 	uint8_t		i_fc[2];
701 	uint8_t		i_dur[2];	/* should be zero */
702 	uint8_t		i_ra[IEEE80211_ADDR_LEN];
703 	uint8_t		i_bssid[IEEE80211_ADDR_LEN];
704 	/* FCS */
705 } __packed;
706 
707 struct ieee80211_frame_bar {
708 	uint8_t		i_fc[2];
709 	uint8_t		i_dur[2];
710 	uint8_t		i_ra[IEEE80211_ADDR_LEN];
711 	uint8_t		i_ta[IEEE80211_ADDR_LEN];
712 	uint16_t	i_ctl;
713 	uint16_t	i_seq;
714 	/* FCS */
715 } __packed;
716 
717 /*
718  * BEACON management packets
719  *
720  *	octet timestamp[8]
721  *	octet beacon interval[2]
722  *	octet capability information[2]
723  *	information element
724  *		octet elemid
725  *		octet length
726  *		octet information[length]
727  */
728 
729 #define	IEEE80211_BEACON_INTERVAL(beacon) \
730 	((beacon)[8] | ((beacon)[9] << 8))
731 #define	IEEE80211_BEACON_CAPABILITY(beacon) \
732 	((beacon)[10] | ((beacon)[11] << 8))
733 
734 #define	IEEE80211_CAPINFO_ESS			0x0001
735 #define	IEEE80211_CAPINFO_IBSS			0x0002
736 #define	IEEE80211_CAPINFO_CF_POLLABLE		0x0004
737 #define	IEEE80211_CAPINFO_CF_POLLREQ		0x0008
738 #define	IEEE80211_CAPINFO_PRIVACY		0x0010
739 #define	IEEE80211_CAPINFO_SHORT_PREAMBLE	0x0020
740 #define	IEEE80211_CAPINFO_PBCC			0x0040
741 #define	IEEE80211_CAPINFO_CHNL_AGILITY		0x0080
742 #define	IEEE80211_CAPINFO_SPECTRUM_MGMT		0x0100
743 /* bit 9 is reserved */
744 #define	IEEE80211_CAPINFO_SHORT_SLOTTIME	0x0400
745 #define	IEEE80211_CAPINFO_RSN			0x0800
746 /* bit 12 is reserved */
747 #define	IEEE80211_CAPINFO_DSSSOFDM		0x2000
748 /* bits 14-15 are reserved */
749 
750 #define	IEEE80211_CAPINFO_BITS \
751 	"\20\1ESS\2IBSS\3CF_POLLABLE\4CF_POLLREQ\5PRIVACY\6SHORT_PREAMBLE" \
752 	"\7PBCC\10CHNL_AGILITY\11SPECTRUM_MGMT\13SHORT_SLOTTIME\14RSN" \
753 	"\16DSSOFDM"
754 
755 /*
756  * 802.11i/WPA information element (maximally sized).
757  */
758 struct ieee80211_ie_wpa {
759 	uint8_t		wpa_id;		/* IEEE80211_ELEMID_VENDOR */
760 	uint8_t		wpa_len;	/* length in bytes */
761 	uint8_t		wpa_oui[3];	/* 0x00, 0x50, 0xf2 */
762 	uint8_t		wpa_type;	/* OUI type */
763 	uint16_t	wpa_version;	/* spec revision */
764 	uint32_t	wpa_mcipher[1];	/* multicast/group key cipher */
765 	uint16_t	wpa_uciphercnt;	/* # pairwise key ciphers */
766 	uint32_t	wpa_uciphers[8];/* ciphers */
767 	uint16_t	wpa_authselcnt;	/* authentication selector cnt*/
768 	uint32_t	wpa_authsels[8];/* selectors */
769 	uint16_t	wpa_caps;	/* 802.11i capabilities */
770 	uint16_t	wpa_pmkidcnt;	/* 802.11i pmkid count */
771 	uint16_t	wpa_pmkids[8];	/* 802.11i pmkids */
772 } __packed;
773 
774 /*
775  * 802.11n HT Capability IE
776  * NB: these reflect D1.10
777  */
778 struct ieee80211_ie_htcap {
779 	uint8_t		hc_id;			/* element ID */
780 	uint8_t		hc_len;			/* length in bytes */
781 	uint16_t	hc_cap;			/* HT caps (see below) */
782 	uint8_t		hc_param;		/* HT params (see below) */
783 	uint8_t 	hc_mcsset[16]; 		/* supported MCS set */
784 	uint16_t	hc_extcap;		/* extended HT capabilities */
785 	uint32_t	hc_txbf;		/* txbf capabilities */
786 	uint8_t		hc_antenna;		/* antenna capabilities */
787 } __packed;
788 
789 /* HT capability flags (ht_cap) */
790 #define	IEEE80211_HTCAP_LDPC		0x0001	/* LDPC rx supported */
791 #define	IEEE80211_HTCAP_CHWIDTH40	0x0002	/* 20/40 supported */
792 #define	IEEE80211_HTCAP_SMPS		0x000c	/* SM Power Save mode */
793 #define	IEEE80211_HTCAP_SMPS_OFF	0x000c	/* disabled */
794 #define	IEEE80211_HTCAP_SMPS_DYNAMIC	0x0004	/* send RTS first */
795 /* NB: SMPS value 2 is reserved */
796 #define	IEEE80211_HTCAP_SMPS_ENA	0x0000	/* enabled (static mode) */
797 #define	IEEE80211_HTCAP_GREENFIELD	0x0010	/* Greenfield supported */
798 #define	IEEE80211_HTCAP_SHORTGI20	0x0020	/* Short GI in 20MHz */
799 #define	IEEE80211_HTCAP_SHORTGI40	0x0040	/* Short GI in 40MHz */
800 #define	IEEE80211_HTCAP_TXSTBC		0x0080	/* STBC tx ok */
801 #define	IEEE80211_HTCAP_RXSTBC		0x0300  /* STBC rx support */
802 #define	IEEE80211_HTCAP_RXSTBC_S	8
803 #define	IEEE80211_HTCAP_RXSTBC_1STREAM	0x0100  /* 1 spatial stream */
804 #define	IEEE80211_HTCAP_RXSTBC_2STREAM	0x0200  /* 1-2 spatial streams*/
805 #define	IEEE80211_HTCAP_RXSTBC_3STREAM	0x0300  /* 1-3 spatial streams*/
806 #define	IEEE80211_HTCAP_DELBA		0x0400	/* HT DELBA supported */
807 #define	IEEE80211_HTCAP_MAXAMSDU	0x0800	/* max A-MSDU length */
808 #define	IEEE80211_HTCAP_MAXAMSDU_7935	0x0800	/* 7935 octets */
809 #define	IEEE80211_HTCAP_MAXAMSDU_3839	0x0000	/* 3839 octets */
810 #define	IEEE80211_HTCAP_DSSSCCK40	0x1000  /* DSSS/CCK in 40MHz */
811 #define	IEEE80211_HTCAP_PSMP		0x2000  /* PSMP supported */
812 #define	IEEE80211_HTCAP_40INTOLERANT	0x4000  /* 40MHz intolerant */
813 #define	IEEE80211_HTCAP_LSIGTXOPPROT	0x8000  /* L-SIG TXOP prot */
814 
815 #define	IEEE80211_HTCAP_BITS \
816 	"\20\1LDPC\2CHWIDTH40\5GREENFIELD\6SHORTGI20\7SHORTGI40\10TXSTBC" \
817 	"\13DELBA\14AMSDU(7935)\15DSSSCCK40\16PSMP\1740INTOLERANT" \
818 	"\20LSIGTXOPPROT"
819 
820 /* HT parameters (hc_param) */
821 #define	IEEE80211_HTCAP_MAXRXAMPDU	0x03	/* max rx A-MPDU factor */
822 #define	IEEE80211_HTCAP_MAXRXAMPDU_S	0
823 #define	IEEE80211_HTCAP_MAXRXAMPDU_8K	0
824 #define	IEEE80211_HTCAP_MAXRXAMPDU_16K	1
825 #define	IEEE80211_HTCAP_MAXRXAMPDU_32K	2
826 #define	IEEE80211_HTCAP_MAXRXAMPDU_64K	3
827 #define	IEEE80211_HTCAP_MPDUDENSITY	0x1c	/* min MPDU start spacing */
828 #define	IEEE80211_HTCAP_MPDUDENSITY_S	2
829 #define	IEEE80211_HTCAP_MPDUDENSITY_NA	0	/* no time restriction */
830 #define	IEEE80211_HTCAP_MPDUDENSITY_025	1	/* 1/4 us */
831 #define	IEEE80211_HTCAP_MPDUDENSITY_05	2	/* 1/2 us */
832 #define	IEEE80211_HTCAP_MPDUDENSITY_1	3	/* 1 us */
833 #define	IEEE80211_HTCAP_MPDUDENSITY_2	4	/* 2 us */
834 #define	IEEE80211_HTCAP_MPDUDENSITY_4	5	/* 4 us */
835 #define	IEEE80211_HTCAP_MPDUDENSITY_8	6	/* 8 us */
836 #define	IEEE80211_HTCAP_MPDUDENSITY_16	7	/* 16 us */
837 
838 /* HT extended capabilities (hc_extcap) */
839 #define	IEEE80211_HTCAP_PCO		0x0001	/* PCO capable */
840 #define	IEEE80211_HTCAP_PCOTRANS	0x0006	/* PCO transition time */
841 #define	IEEE80211_HTCAP_PCOTRANS_S	1
842 #define	IEEE80211_HTCAP_PCOTRANS_04	0x0002	/* 400 us */
843 #define	IEEE80211_HTCAP_PCOTRANS_15	0x0004	/* 1.5 ms */
844 #define	IEEE80211_HTCAP_PCOTRANS_5	0x0006	/* 5 ms */
845 /* bits 3-7 reserved */
846 #define	IEEE80211_HTCAP_MCSFBACK	0x0300	/* MCS feedback */
847 #define	IEEE80211_HTCAP_MCSFBACK_S	8
848 #define	IEEE80211_HTCAP_MCSFBACK_NONE	0x0000	/* nothing provided */
849 #define	IEEE80211_HTCAP_MCSFBACK_UNSOL	0x0200	/* unsolicited feedback */
850 #define	IEEE80211_HTCAP_MCSFBACK_MRQ	0x0300	/* " "+respond to MRQ */
851 #define	IEEE80211_HTCAP_HTC		0x0400	/* +HTC support */
852 #define	IEEE80211_HTCAP_RDR		0x0800	/* reverse direction responder*/
853 /* bits 12-15 reserved */
854 
855 /*
856  * 802.11n HT Information IE
857  */
858 struct ieee80211_ie_htinfo {
859 	uint8_t		hi_id;			/* element ID */
860 	uint8_t		hi_len;			/* length in bytes */
861 	uint8_t		hi_ctrlchannel;		/* primary channel */
862 	uint8_t		hi_byte1;		/* ht ie byte 1 */
863 	uint8_t		hi_byte2;		/* ht ie byte 2 */
864 	uint8_t		hi_byte3;		/* ht ie byte 3 */
865 	uint16_t	hi_byte45;		/* ht ie bytes 4+5 */
866 	uint8_t 	hi_basicmcsset[16]; 	/* basic MCS set */
867 } __packed;
868 
869 /* byte1 */
870 #define	IEEE80211_HTINFO_2NDCHAN	0x03	/* secondary/ext chan offset */
871 #define	IEEE80211_HTINFO_2NDCHAN_S	0
872 #define	IEEE80211_HTINFO_2NDCHAN_NONE	0x00	/* no secondary/ext channel */
873 #define	IEEE80211_HTINFO_2NDCHAN_ABOVE	0x01	/* above private channel */
874 /* NB: 2 is reserved */
875 #define	IEEE80211_HTINFO_2NDCHAN_BELOW	0x03	/* below primary channel */
876 #define	IEEE80211_HTINFO_TXWIDTH	0x04	/* tx channel width */
877 #define	IEEE80211_HTINFO_TXWIDTH_20	0x00	/* 20MHz width */
878 #define	IEEE80211_HTINFO_TXWIDTH_2040	0x04	/* any supported width */
879 #define	IEEE80211_HTINFO_RIFSMODE	0x08	/* Reduced IFS (RIFS) use */
880 #define	IEEE80211_HTINFO_RIFSMODE_PROH	0x00	/* RIFS use prohibited */
881 #define	IEEE80211_HTINFO_RIFSMODE_PERM	0x08	/* RIFS use permitted */
882 #define	IEEE80211_HTINFO_PMSPONLY	0x10	/* PSMP required to associate */
883 #define	IEEE80211_HTINFO_SIGRAN		0xe0	/* shortest Service Interval */
884 #define	IEEE80211_HTINFO_SIGRAN_S	5
885 #define	IEEE80211_HTINFO_SIGRAN_5	0x00	/* 5 ms */
886 /* XXX add rest */
887 
888 /* bytes 2+3 */
889 #define	IEEE80211_HTINFO_OPMODE		0x03	/* operating mode */
890 #define	IEEE80211_HTINFO_OPMODE_S	0
891 #define	IEEE80211_HTINFO_OPMODE_PURE	0x00	/* no protection */
892 #define	IEEE80211_HTINFO_OPMODE_PROTOPT	0x01	/* protection optional */
893 #define	IEEE80211_HTINFO_OPMODE_HT20PR	0x02	/* protection for HT20 sta's */
894 #define	IEEE80211_HTINFO_OPMODE_MIXED	0x03	/* protection for legacy sta's*/
895 #define	IEEE80211_HTINFO_NONGF_PRESENT	0x04	/* non-GF sta's present */
896 #define	IEEE80211_HTINFO_TXBL		0x08	/* transmit burst limit */
897 #define	IEEE80211_HTINFO_NONHT_PRESENT	0x10	/* non-HT sta's present */
898 /* bits 5-15 reserved */
899 
900 /* bytes 4+5 */
901 #define	IEEE80211_HTINFO_2NDARYBEACON	0x01
902 #define	IEEE80211_HTINFO_LSIGTXOPPROT	0x02
903 #define	IEEE80211_HTINFO_PCO_ACTIVE	0x04
904 #define	IEEE80211_HTINFO_40MHZPHASE	0x08
905 
906 /* byte5 */
907 #define	IEEE80211_HTINFO_BASIC_STBCMCS	0x7f
908 #define	IEEE80211_HTINFO_BASIC_STBCMCS_S 0
909 #define	IEEE80211_HTINFO_DUALPROTECTED	0x80
910 
911 /*
912  * 802.11ac definitions - 802.11ac-2013 .
913  */
914 
915 /*
916  * Maximum length of A-MPDU that the STA can RX in VHT.
917  * Length = 2 ^ (13 + max_ampdu_length_exp) - 1 (octets)
918  */
919 #define	IEEE80211_VHTCAP_MAX_AMPDU_8K		0
920 #define	IEEE80211_VHTCAP_MAX_AMPDU_16K		1
921 #define	IEEE80211_VHTCAP_MAX_AMPDU_32K		2
922 #define	IEEE80211_VHTCAP_MAX_AMPDU_64K		3
923 #define	IEEE80211_VHTCAP_MAX_AMPDU_128K		4
924 #define	IEEE80211_VHTCAP_MAX_AMPDU_256K		5
925 #define	IEEE80211_VHTCAP_MAX_AMPDU_512K		6
926 #define	IEEE80211_VHTCAP_MAX_AMPDU_1024K	7
927 
928 /*
929  * VHT MCS information.
930  * + rx_highest/tx_highest: optional; maximum long GI VHT PPDU
931  *    data rate.  1Mbit/sec units.
932  * + rx_mcs_map/tx_mcs_map: bitmap of per-stream supported MCS;
933  *    2 bits each.
934  */
935 
936 /* 802.11ac-2013, 8.4.2.160.3 Supported VHT-MCS and NSS Set field */
937 enum ieee80211_vht_mcs_support {
938 	IEEE80211_VHT_MCS_SUPPORT_0_7		= 0,	/* MCS0-7 */
939 	IEEE80211_VHT_MCS_SUPPORT_0_8		= 1,	/* MCS0-8 */
940 	IEEE80211_VHT_MCS_SUPPORT_0_9		= 2,	/* MCS0-9 */
941 	IEEE80211_VHT_MCS_NOT_SUPPORTED		= 3	/* not supported */
942 };
943 
944 /* 802.11ac-2013, 8.4.2.160.3 Supported VHT-MCS and NSS Set field */
945 struct ieee80211_vht_mcs_info {
946 	uint16_t rx_mcs_map;
947 	uint16_t rx_highest;
948 	uint16_t tx_mcs_map;
949 	uint16_t tx_highest;
950 } __packed;
951 
952 /* 802.11ac-2013, 8.4.2.160.1 VHT Capabilities element structure */
953 struct ieee80211_vht_cap {
954 	uint32_t			vht_cap_info;
955 	struct ieee80211_vht_mcs_info	supp_mcs;
956 } __packed;
957 
958 /*
959  * 802.11ac-2013, Table 8-183x-VHT Operation Information subfields.
960  * 802.11-2020, Table 9-274-VHT Operation Information subfields (for deprecations)
961  */
962 enum ieee80211_vht_chanwidth {
963 	IEEE80211_VHT_CHANWIDTH_USE_HT		= 0,	/* 20 MHz or 40 MHz */
964 	IEEE80211_VHT_CHANWIDTH_80MHZ		= 1,	/* 80MHz */
965 	IEEE80211_VHT_CHANWIDTH_160MHZ		= 2,	/* 160MHz (deprecated) */
966 	IEEE80211_VHT_CHANWIDTH_80P80MHZ	= 3,	/* 80+80MHz (deprecated) */
967 	/* 4..255 reserved. */
968 };
969 
970 /* The name conflicts with the same structure in wpa.  Only ifconfig needs this. */
971 #if defined(_KERNEL) || defined(WANT_NET80211)
972 /* 802.11ac-2013 8.4.2.161 VHT Operation element */
973 struct ieee80211_vht_operation {
974 	uint8_t			chan_width;		/* enum ieee80211_vht_chanwidth */
975 	uint8_t			center_freq_seq0_idx;	/* 20/40/80/160 - VHT chan1 */
976 	uint8_t			center_freq_seq1_idx;	/* 80+80 - VHT chan2 */
977 	uint16_t		basic_mcs_set;		/* Basic VHT-MCS and NSS Set */
978 } __packed;
979 #endif
980 
981 /* 802.11ac VHT Capabilities */
982 #define	IEEE80211_VHTCAP_MAX_MPDU_LENGTH_3895	0x00000000
983 #define	IEEE80211_VHTCAP_MAX_MPDU_LENGTH_7991	0x00000001
984 #define	IEEE80211_VHTCAP_MAX_MPDU_LENGTH_11454	0x00000002
985 #define	IEEE80211_VHTCAP_MAX_MPDU_MASK		0x00000003
986 #define	IEEE80211_VHTCAP_MAX_MPDU_MASK_S	0
987 
988 #define	IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_MASK	0x0000000C
989 #define	IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_MASK_S	2
990 #define	IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_NO160		0
991 #define	IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_160MHZ		1
992 #define	IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_160_80P80MHZ	2
993 #define	IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_RESERVED	3
994 
995 #define	IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_IS_160MHZ(_vhtcaps)		\
996     (_IEEE80211_MASKSHIFT(_vhtcaps, IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_MASK) >= \
997             IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_160MHZ)
998 #define	IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_IS_160_80P80MHZ(_vhtcaps)	\
999     (_IEEE80211_MASKSHIFT(_vhtcaps, IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_MASK) == \
1000             IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_160_80P80MHZ)
1001 
1002 #define	IEEE80211_VHTCAP_RXLDPC		0x00000010
1003 #define	IEEE80211_VHTCAP_RXLDPC_S	4
1004 
1005 #define	IEEE80211_VHTCAP_SHORT_GI_80		0x00000020
1006 #define	IEEE80211_VHTCAP_SHORT_GI_80_S		5
1007 
1008 #define	IEEE80211_VHTCAP_SHORT_GI_160		0x00000040
1009 #define	IEEE80211_VHTCAP_SHORT_GI_160_S		6
1010 
1011 #define	IEEE80211_VHTCAP_TXSTBC		0x00000080
1012 #define	IEEE80211_VHTCAP_TXSTBC_S	7
1013 
1014 #define	IEEE80211_VHTCAP_RXSTBC_1		0x00000100
1015 #define	IEEE80211_VHTCAP_RXSTBC_2		0x00000200
1016 #define	IEEE80211_VHTCAP_RXSTBC_3		0x00000300
1017 #define	IEEE80211_VHTCAP_RXSTBC_4		0x00000400
1018 #define	IEEE80211_VHTCAP_RXSTBC_MASK		0x00000700
1019 #define	IEEE80211_VHTCAP_RXSTBC_MASK_S		8
1020 
1021 #define	IEEE80211_VHTCAP_SU_BEAMFORMER_CAPABLE	0x00000800
1022 #define	IEEE80211_VHTCAP_SU_BEAMFORMER_CAPABLE_S	11
1023 
1024 #define	IEEE80211_VHTCAP_SU_BEAMFORMEE_CAPABLE	0x00001000
1025 #define	IEEE80211_VHTCAP_SU_BEAMFORMEE_CAPABLE_S	12
1026 
1027 #define	IEEE80211_VHTCAP_BEAMFORMEE_STS_SHIFT	13
1028 #define	IEEE80211_VHTCAP_BEAMFORMEE_STS_MASK \
1029 	    (7 << IEEE80211_VHTCAP_BEAMFORMEE_STS_SHIFT)
1030 #define	IEEE80211_VHTCAP_BEAMFORMEE_STS_MASK_S	13
1031 
1032 #define	IEEE80211_VHTCAP_SOUNDING_DIMENSIONS_SHIFT	16
1033 #define	IEEE80211_VHTCAP_SOUNDING_DIMENSIONS_MASK \
1034 	    (7 << IEEE80211_VHTCAP_SOUNDING_DIMENSIONS_SHIFT)
1035 #define	IEEE80211_VHTCAP_SOUNDING_DIMENSIONS_MASK_S	16
1036 
1037 #define	IEEE80211_VHTCAP_MU_BEAMFORMER_CAPABLE	0x00080000
1038 #define	IEEE80211_VHTCAP_MU_BEAMFORMER_CAPABLE_S	19
1039 #define	IEEE80211_VHTCAP_MU_BEAMFORMEE_CAPABLE	0x00100000
1040 #define	IEEE80211_VHTCAP_MU_BEAMFORMEE_CAPABLE_S	20
1041 #define	IEEE80211_VHTCAP_VHT_TXOP_PS		0x00200000
1042 #define	IEEE80211_VHTCAP_VHT_TXOP_PS_S		21
1043 #define	IEEE80211_VHTCAP_HTC_VHT		0x00400000
1044 #define	IEEE80211_VHTCAP_HTC_VHT_S		22
1045 
1046 #define	IEEE80211_VHTCAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT	23
1047 #define	IEEE80211_VHTCAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK \
1048 	    (7 << IEEE80211_VHTCAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT)
1049 #define	IEEE80211_VHTCAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK_S	23
1050 
1051 #define	IEEE80211_VHTCAP_VHT_LINK_ADAPTATION_VHT_MASK	0x0c000000
1052 #define	IEEE80211_VHTCAP_VHT_LINK_ADAPTATION_VHT_UNSOL_MFB	0x08000000
1053 #define	IEEE80211_VHTCAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB	0x0c000000
1054 #define	IEEE80211_VHTCAP_VHT_LINK_ADAPTATION_VHT_MASK_S	26
1055 
1056 #define	IEEE80211_VHTCAP_RX_ANTENNA_PATTERN	0x10000000
1057 #define	IEEE80211_VHTCAP_RX_ANTENNA_PATTERN_S	28
1058 #define	IEEE80211_VHTCAP_TX_ANTENNA_PATTERN	0x20000000
1059 #define	IEEE80211_VHTCAP_TX_ANTENNA_PATTERN_S	29
1060 
1061 /* 802.11-2016, 9.4.2.158.2 VHT Capabilities Information field. */
1062 #define	IEEE80211_VHTCAP_EXT_NSS_BW		0xc0000000
1063 #define	IEEE80211_VHTCAP_EXT_NSS_BW_S		30
1064 
1065 /*
1066  * XXX TODO: add the rest of the bits
1067  */
1068 #define	IEEE80211_VHTCAP_BITS \
1069 	"\20\1MPDU7991\2MPDU11454\3CHAN160\4CHAN160+80P80\5RXLDPC\6SHORTGI80" \
1070 	"\7SHORTGI160\10RXSTBC1\11RXSTBC2\12RXSTBC3\13RXSTBC4\14BFERCAP" \
1071 	"\15BFEECAP\27VHT\37RXANTPTN\40TXANTPTN"
1072 
1073 /*
1074  * VHT Transmit Power Envelope element - 802.11ac-2013 8.4.2.164
1075  *
1076  * This defines the maximum transmit power for various bandwidths.
1077  */
1078 /*
1079  * Count is how many elements follow and what they're for:
1080  *
1081  * 0 - 20 MHz
1082  * 1 - 20+40 MHz
1083  * 2 - 20+40+80 MHz
1084  * 3 - 20+40+80+(160, 80+80) MHz
1085  */
1086 #define	IEEE80211_VHT_TXPWRENV_INFO_COUNT_SHIFT	0
1087 #define	IEEE80211_VHT_TXPWRENV_INFO_COUNT_MASK	0x07
1088 
1089 /*
1090  * Unit is the tx power representation.  It should be EIRP for now;
1091  * other values are reserved.
1092  */
1093 #define	IEEE80211_VHT_TXPWRENV_UNIT_MASK	0x38
1094 #define	IEEE80211_VHT_TXPWRENV_UNIT_SHIFT	3
1095 
1096 /* This value is within the unit mask/shift above */
1097 #define	IEEE80211_VHT_TXPWRENV_UNIT_EIRP	0
1098 
1099 struct ieee80211_ie_vht_txpwrenv {
1100 	uint8_t ie;
1101 	uint8_t len;
1102 	uint8_t tx_info;
1103 	int8_t tx_elem[0];	/* TX power elements, 1/2 dB, signed */
1104 };
1105 
1106 /* VHT action codes */
1107 #define	WLAN_ACTION_VHT_COMPRESSED_BF		0
1108 #define	WLAN_ACTION_VHT_GROUPID_MGMT		1
1109 #define	WLAN_ACTION_VHT_OPMODE_NOTIF		2
1110 
1111 #if defined(_KERNEL) || defined(WANT_NET80211)
1112 /*
1113  * HE
1114  */
1115 
1116 /*
1117  * 802.11ax-2021, 9.4.2.248.2 HE MAC Capabilities Information field.
1118  */
1119 /* B0..B7 */
1120 #define	IEEE80211_HE_MAC_CAP0_HTC_HE			(1<<0)
1121 #define	IEEE80211_HE_MAC_CAP0_TWT_REQ			(1<<1)
1122 #define	IEEE80211_HE_MAC_CAP0_TWT_RES			(1<<2)
1123 
1124 /* B8..B15 */
1125 #define	IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US	(1<<3)
1126 #define	IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_MASK	(1<<3 | 1<<2)
1127 #define	IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8	(1<<6 | 1<<5 | 1<<4)
1128 #define	IEEE80211_HE_MAC_CAP1_LINK_ADAPTATION		(1<<7)
1129 /* Note: B15|B16 are split between octets %!$@??? */
1130 
1131 /* B16..B23 */
1132 #define	IEEE80211_HE_MAC_CAP2_LINK_ADAPTATION		(1<<0)
1133 #define	IEEE80211_HE_MAC_CAP2_ALL_ACK			(1<<1)
1134 #define	IEEE80211_HE_MAC_CAP2_TRS			(1<<2)
1135 #define	IEEE80211_HE_MAC_CAP2_BSR			(1<<3)
1136 #define	IEEE80211_HE_MAC_CAP2_BCAST_TWT			(1<<4)
1137 #define	IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP		(1<<5)
1138 #define	IEEE80211_HE_MAC_CAP2_MU_CASCADING		(1<<6)
1139 #define	IEEE80211_HE_MAC_CAP2_ACK_EN			(1<<7)
1140 
1141 /* B24..B31 */
1142 #define	IEEE80211_HE_MAC_CAP3_OMI_CONTROL		(1<<1)
1143 #define	IEEE80211_HE_MAC_CAP3_OFDMA_RA			(1<<2)
1144 #define	IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_1	(1<<3)
1145 #define	IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_2	(1<<4)
1146 #define	IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3	(1<<4 | 1<<3)
1147 #define	IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK	(1<<4 | 1<<3)
1148 #define	IEEE80211_HE_MAC_CAP3_FLEX_TWT_SCHED		(1<<6)
1149 #define	IEEE80211_HE_MAC_CAP3_RX_CTRL_FRAME_TO_MULTIBSS	(1<<7)
1150 
1151 /* B32..B39 */
1152 #define	IEEE80211_HE_MAC_CAP4_BSRP_BQRP_A_MPDU_AGG	(1<<0)
1153 #define	IEEE80211_HE_MAC_CAP4_BQR			(1<<2)
1154 #define	IEEE80211_HE_MAC_CAP4_OPS			(1<<5)
1155 #define	IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU		(1<<6)
1156 #define	IEEE80211_HE_MAC_CAP4_MULTI_TID_AGG_TX_QOS_B39	(1<<7)
1157 /* Note: B39|B40|B41 are split between octets %!$@??? */
1158 
1159 /* B40..B47 */
1160 #define	IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B40	(1<<0)
1161 #define	IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B41	(1<<1)
1162 #define	IEEE80211_HE_MAC_CAP5_SUBCHAN_SELECTIVE_TRANSMISSION	(1<<2)
1163 #define	IEEE80211_HE_MAC_CAP5_UL_2x996_TONE_RU		(1<<3)
1164 #define	IEEE80211_HE_MAC_CAP5_OM_CTRL_UL_MU_DATA_DIS_RX	(1<<4)
1165 #define	IEEE80211_HE_MAC_CAP5_HE_DYNAMIC_SM_PS		(1<<5)
1166 #define	IEEE80211_HE_MAC_CAP5_PUNCTURED_SOUNDING	(1<<6)
1167 #define	IEEE80211_HE_MAC_CAP5_HT_VHT_TRIG_FRAME_RX	(1<<7)
1168 
1169 /*
1170  * 802.11ax-2021, 9.4.2.248.3 HE PHY Capabilities Information field.
1171  */
1172 /* B0..B7 */
1173 #define	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G		(1<<1)
1174 #define	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G	(1<<2)
1175 #define	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G		(1<<3)
1176 #define	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G	(1<<4)
1177 #define	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_MASK_ALL		(1<<4 | 1<<3 | 1<<2 | 1<<1)
1178 #define	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G	(1<<5)
1179 #define	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G	(1<<6)
1180 #define	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_MASK			(1<<6 | 1<<5 | 1<<4 | 1<<3 | 1<<2 | 1<<1)
1181 
1182 /* B8..B15 */
1183 #define	IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK	(1<<3 | 1<<2 | 1<<1 | 1<<0)
1184 #define	IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A		(1<<4)
1185 #define	IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD	(1<<5)
1186 #define	IEEE80211_HE_PHY_CAP1_HE_LTF_AND_GI_FOR_HE_PPDUS_0_8US	(1<<6)
1187 #define	IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS	(1<<7)
1188 /* Note: B15|B16 are split between octets %!$@??? */
1189 
1190 /* B16..B23 */
1191 #define	IEEE80211_HE_PHY_CAP2_MIDAMBLE_RX_TX_MAX_NSTS	(1<<0)
1192 #define	IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US	(1<<1)
1193 #define	IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ	(1<<2)
1194 #define	IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ	(1<<3)
1195 #define	IEEE80211_HE_PHY_CAP2_DOPPLER_TX		(1<<4)
1196 #define	IEEE80211_HE_PHY_CAP2_DOPPLER_RX		(1<<5)
1197 #define	IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO	(1<<6)
1198 #define	IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO	(1<<7)
1199 
1200 /* B24..B31 */
1201 #define	IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_NO_DCM	0x00
1202 #define	IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_BPSK	(1<<0)
1203 #define	IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_QPSK	(1<<1)
1204 #define	IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_16_QAM	(1<<1 | 1<<0)
1205 #define	IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_MASK	(1<<1 | 1<<0)
1206 #define	IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_1		0x00
1207 #define	IEEE80211_HE_PHY_CAP3_DCM_MAX_TX_NSS_2		(1<<2)
1208 #define	IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_NO_DCM	0x00
1209 #define	IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_BPSK	(1<<3)
1210 #define	IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_QPSK	(1<<4)
1211 #define	IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_16_QAM	(1<<4 | 1<<3)
1212 #define	IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_MASK	(1<<4 | 1<<3)
1213 #define	IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_1		0x00
1214 #define	IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_2		(1<<5)
1215 #define	IEEE80211_HE_PHY_CAP3_RX_PARTIAL_BW_SU_IN_20MHZ_MU	(1<<6)
1216 #define	IEEE80211_HE_PHY_CAP3_SU_BEAMFORMER		(1<<7)
1217 
1218 /* B32..B39 */
1219 #define	IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE			(1<<0)
1220 #define	IEEE80211_HE_PHY_CAP4_MU_BEAMFORMER			(1<<1)
1221 #define	IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_4	(1<<3 | 1<<2)
1222 #define	IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_5	(1<<4)
1223 #define	IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_8	(1<<4 | 1<<3 | 1<<2)
1224 #define	IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK	(1<<4 | 1<<3 | 1<<2)
1225 #define	IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_4	(1<<6 | 1<<5)
1226 #define	IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_5	(1<<7)
1227 #define	IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_8	(1<<7 | 1<<6 | 1<<5)
1228 #define	IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK	(1<<7 | 1<<6 | 1<<5)
1229 
1230 /* B40..B47 */
1231 #define	IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_2	(1<<0)
1232 #define	IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK	(1<<2 | 1<<1 | 1<<0)
1233 #define	IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_2	(1<<3)
1234 #define	IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK	(1<<5 | 1<<4 | 1<<3)
1235 #define	IEEE80211_HE_PHY_CAP5_NG16_SU_FEEDBACK			(1<<6)
1236 #define	IEEE80211_HE_PHY_CAP5_NG16_MU_FEEDBACK			(1<<7)
1237 
1238 /* B48..B55 */
1239 #define	IEEE80211_HE_PHY_CAP6_CODEBOOK_SIZE_42_SU	(1<<0)
1240 #define	IEEE80211_HE_PHY_CAP6_CODEBOOK_SIZE_75_MU	(1<<1)
1241 #define	IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB	(1<<2)
1242 #define	IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB	(1<<3)
1243 #define	IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB		(1<<4)
1244 #define	IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE	(1<<5)
1245 #define	IEEE80211_HE_PHY_CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO	(1<<6)
1246 #define	IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT	(1<<7)
1247 
1248 /* B56..B63 */
1249 #define	IEEE80211_HE_PHY_CAP7_PSR_BASED_SR			(1<<0)
1250 #define	IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP		(1<<1)
1251 #define	IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI	(1<<2)
1252 #define	IEEE80211_HE_PHY_CAP7_MAX_NC_1				(1<<3)
1253 #define	IEEE80211_HE_PHY_CAP7_MAX_NC_2				(1<<4)
1254 #define	IEEE80211_HE_PHY_CAP7_MAX_NC_MASK			(1<<5 | 1<<4 | 1<<3)
1255 #define	IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ		(1<<6)
1256 #define	IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ		(1<<7)
1257 
1258 /* B64..B71 */
1259 #define	IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI	(1<<0)
1260 #define	IEEE80211_HE_PHY_CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G	(1<<1)
1261 #define	IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU		(1<<2)
1262 #define	IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU		(1<<3)
1263 #define	IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI	(1<<4)
1264 #define	IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242			0x00
1265 #define	IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_484			(1<<6)
1266 #define	IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_996			(1<<7)
1267 #define	IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_2x996			(1<<7 | 1<<6)
1268 #define	IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_MASK			(1<<7 | 1<<6)
1269 
1270 /* B72..B79 */
1271 #define	IEEE80211_HE_PHY_CAP9_LONGER_THAN_16_SIGB_OFDM_SYM	(1<<0)
1272 #define	IEEE80211_HE_PHY_CAP9_NON_TRIGGERED_CQI_FEEDBACK	(1<<1)
1273 #define	IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU	(1<<2)
1274 #define	IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU	(1<<3)
1275 #define	IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_COMP_SIGB	(1<<4)
1276 #define	IEEE80211_HE_PHY_CAP9_RX_FULL_BW_SU_USING_MU_WITH_NON_COMP_SIGB	(1<<5)
1277 #define	IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_0US		0x00
1278 #define	IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_8US		1
1279 #define	IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_16US		2
1280 #define	IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_RESERVED	3
1281 #define	IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_POS		6
1282 #define	IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_MASK		(1<<7 | 1<<6)
1283 
1284 /* B80..B87 */
1285 #define	IEEE80211_HE_PHY_CAP10_HE_MU_M1RU_MAX_LTF		(1<<0)
1286 
1287 /*
1288  * 802.11ax-2021,
1289  * 9.4.2.248.2 HE MAC Capabilities Information field.
1290  * 9.4.2.248.3 HE PHY Capabilities Information field.
1291  */
1292 struct ieee80211_he_cap_elem {
1293 	uint8_t					mac_cap_info[6];
1294 	uint8_t					phy_cap_info[11];
1295 } __packed;
1296 
1297 /* 802.11ax-2021, 9.4.2.248.4 Supported HE-MCS And NSS Set field. */
1298 enum ieee80211_he_mcs_support {
1299 	IEEE80211_HE_MCS_SUPPORT_0_7	= 0,	/* HE-MCS 0-7 for n NSS */
1300 	IEEE80211_HE_MCS_SUPPORT_0_9	= 1,	/* HE-MCS 0-9 for n NSS */
1301 	IEEE80211_HE_MCS_SUPPORT_0_11	= 2,	/* HE-MCS 0-11 for n NSS */
1302 	IEEE80211_HE_MCS_NOT_SUPPORTED	= 3	/* n NSS not supported. */
1303 };
1304 
1305 struct ieee80211_he_mcs_nss_supp {
1306 	uint16_t				rx_mcs_80;
1307 	uint16_t				tx_mcs_80;
1308 	uint16_t				rx_mcs_160;
1309 	uint16_t				tx_mcs_160;
1310 	uint16_t				rx_mcs_80p80;
1311 	uint16_t				tx_mcs_80p80;
1312 } __packed;
1313 
1314 #define	IEEE80211_HE_CAP_PPE_THRES_MAX		25
1315 
1316 /* XXX this should only be internal. */
1317 struct net80211_he_cap {
1318 	bool					has_he;
1319 	struct ieee80211_he_cap_elem		he_cap_elem;
1320 	struct ieee80211_he_mcs_nss_supp	he_mcs_nss_supp;
1321 	uint8_t					ppe_thres[IEEE80211_HE_CAP_PPE_THRES_MAX];
1322 };
1323 
1324 /* 802.11ax-2021, 9.4.2.249 HE Operation element. */
1325 #define	IEEE80211_HE_OPERATION_ER_SU_DISABLE		(1<<16)
1326 #define	IEEE80211_HE_OPERATION_BSS_COLOR_OFFSET		24
1327 #define	IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED	(1<<31)
1328 
1329 struct ieee80211_he_operation {
1330 	uint32_t				he_oper_params;	/* (3) params | (1) bss color info */
1331 	uint16_t				he_mcs_nss_set;
1332 	uint8_t					optional[0];
1333 } __packed;
1334 
1335 /* 802.11ax-2021, 9.4.2.251 MU EDCA Parameter Set element. */
1336 struct ieee80211_he_mu_edca_param_ac_rec {
1337 	uint8_t					aifsn;
1338 	uint8_t					ecw_min_max;
1339 	uint8_t					mu_edca_timer;
1340 } __packed;
1341 
1342 struct ieee80211_mu_edca_param_set {
1343 	uint8_t					mu_qos_info;
1344 	union {
1345 		struct {
1346 			struct ieee80211_he_mu_edca_param_ac_rec ac_be;
1347 			struct ieee80211_he_mu_edca_param_ac_rec ac_bk;
1348 			struct ieee80211_he_mu_edca_param_ac_rec ac_vi;
1349 			struct ieee80211_he_mu_edca_param_ac_rec ac_vo;
1350 		};
1351 		struct ieee80211_he_mu_edca_param_ac_rec param_ac_recs[4];
1352 	};
1353 } __packed;
1354 
1355 /* 802.11ax-2021, 9.4.2.252 Spatial Reuse Parameter Set element */
1356 /* Figure 9-788r-SR Control field format */
1357 #define	IEEE80211_HE_SPR_NON_SRG_OBSS_PD_SR_DISALLOWED	(1<<1)
1358 #define	IEEE80211_HE_SPR_NON_SRG_OFFSET_PRESENT		(1<<2)
1359 #define	IEEE80211_HE_SPR_SRG_INFORMATION_PRESENT	(1<<3)
1360 #define	IEEE80211_HE_SPR_HESIGA_SR_VAL15_ALLOWED	(1<<4)
1361 
1362 /* 802.11ax-2021, 9.4.2.263 HE 6 GHz Band Capabilities element */
1363 /* Figure 9-788aj-Capabilities Information field format */
1364 #define	IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START		(1<<2 | 1<<1 | 1<<0)
1365 #define	IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP		(1<<5 | 1<<4 | 1<<3)
1366 #define	IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN		(1<<7 | 1<<6)
1367 #define	IEEE80211_HE_6GHZ_CAP_SM_PS			(1<<10 | 1<<9)
1368 #define	IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS		(1<<12)
1369 #define	IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS		(1<<13)
1370 
1371 struct ieee80211_he_6ghz_capa {
1372 	uint16_t capa;
1373 };
1374 #endif	/* _KERNEL || WANT_NET80211 */
1375 
1376 /*
1377  * Management information element payloads.
1378  *
1379  * 802.11-2020 Table 9-92 (Element IDs).
1380  * 802.11ax-2021
1381  */
1382 
1383 enum {
1384 	IEEE80211_ELEMID_SSID		= 0,
1385 	IEEE80211_ELEMID_RATES		= 1,
1386 	/* 2 Reserved */
1387 	IEEE80211_ELEMID_FHPARMS	= 2,	/* remove? */
1388 	IEEE80211_ELEMID_DSPARMS	= 3,
1389 	/* 4 Reserved */
1390 	IEEE80211_ELEMID_CFPARMS	= 4,	/* remove? */
1391 	IEEE80211_ELEMID_TIM		= 5,
1392 	IEEE80211_ELEMID_IBSSPARMS	= 6,
1393 	IEEE80211_ELEMID_COUNTRY	= 7,
1394 	/* 8, 9 reserved */
1395 	IEEE80211_ELEMID_REQUEST	= 10,
1396 	IEEE80211_ELEMID_BSSLOAD	= 11,
1397 	IEEE80211_ELEMID_EDCA_PARAM_SET	= 12,
1398 	IEEE80211_ELEMID_TSPEC		= 13,
1399 	IEEE80211_ELEMID_TCLAS		= 14,
1400 	IEEE80211_ELEMID_SCHEDULE	= 15,
1401 	IEEE80211_ELEMID_CHALLENGE	= 16,
1402 	/* 17-31 reserved for challenge text extension */
1403 	IEEE80211_ELEMID_PWRCNSTR	= 32,
1404 	IEEE80211_ELEMID_PWRCAP		= 33,
1405 	IEEE80211_ELEMID_TPCREQ		= 34,
1406 	IEEE80211_ELEMID_TPCREP		= 35,
1407 	IEEE80211_ELEMID_SUPPCHAN	= 36,
1408 	IEEE80211_ELEMID_CSA		= 37,
1409 	IEEE80211_ELEMID_MEASREQ	= 38,
1410 	IEEE80211_ELEMID_MEASREP	= 39,
1411 	IEEE80211_ELEMID_QUIET		= 40,
1412 	IEEE80211_ELEMID_IBSSDFS	= 41,
1413 	IEEE80211_ELEMID_ERP		= 42,
1414 	IEEE80211_ELEMID_TS_DELAY	= 43,
1415 	IEEE80211_ELEMID_TCLAS_PROCES	= 44,
1416 	IEEE80211_ELEMID_HTCAP		= 45,
1417 	IEEE80211_ELEMID_QOS		= 46,
1418 	/* 47 reserved */
1419 	IEEE80211_ELEMID_RESERVED_47	= 47,
1420 	IEEE80211_ELEMID_RSN		= 48,
1421 	/* 49 reserved */
1422 	IEEE80211_ELEMID_XRATES		= 50,
1423 	IEEE80211_ELEMID_APCHANREP	= 51,
1424 	IEEE80211_ELEMID_NEIGHBOR_REP	= 52,
1425 	IEEE80211_ELEMID_RCPI		= 53,
1426 	IEEE80211_ELEMID_MOBILITY_DOMAIN = 54,	/* MDE */
1427 	IEEE80211_ELEMID_FAST_BSS_TRANS	= 55,	/* FTE */
1428 	IEEE80211_ELEMID_TIMEOUT_INTVL	= 56,
1429 	IEEE80211_ELEMID_RIC_DATA	= 57,	/* RDE */
1430 	IEEE80211_ELEMID_DSE_REG_LOC	= 58,
1431 	IEEE80211_ELEMID_SUP_OP_CLASS	= 59,
1432 	IEEE80211_ELEMID_EXT_CSA	= 60,
1433 	IEEE80211_ELEMID_HTINFO		= 61,	/* HTOPER */
1434 	IEEE80211_ELEMID_SECCHAN_OFFSET	= 62,
1435 	IEEE80211_ELEMID_BSS_AVG_ACC_DELAY = 63,
1436 	IEEE80211_ELEMID_ANTENNA	= 64,
1437 	IEEE80211_ELEMID_RSNI		= 65,
1438 	IEEE80211_ELEMID_MEAS_PILOT_TRANS = 66,
1439 	IEEE80211_ELEMID_BSS_AVAIL_AD_CAP = 67,
1440 	IEEE80211_ELEMID_BSS_AC_ACC_DELAY = 68,
1441 	IEEE80211_ELEMID_TIME_ADV	= 69,
1442 	IEEE80211_ELEMID_RRM_ENACAPS	= 70,	/* RM_ENCAPS */
1443 	IEEE80211_ELEMID_MULTIBSSID	= 71,
1444 	IEEE80211_ELEMID_COEX_2040	= 72,
1445 	IEEE80211_ELEMID_2040_INTOL_CHAN_REPORT	= 73,
1446 	IEEE80211_ELEMID_OVERLAP_BSS_SCAN_PARAM = 74,
1447 	IEEE80211_ELEMID_RIC_DESC	= 75,
1448 	IEEE80211_ELEMID_MGMT_MIC	= 76,
1449 	/* 77 reserved */
1450 	IEEE80211_ELEMID_EVENT_REQ	= 78,
1451 	IEEE80211_ELEMID_EVENT_REP	= 79,
1452 	IEEE80211_ELEMID_DIAGNOSTIC_REQ	= 80,
1453 	IEEE80211_ELEMID_DIAGNOSTIC_REP	= 81,
1454 	IEEE80211_ELEMID_LOCATION_PARAM	= 82,
1455 	IEEE80211_ELEMID_NONTRANS_BSSID_CAP = 83,
1456 	IEEE80211_ELEMID_SSID_LIST	= 84,
1457 	IEEE80211_ELEMID_MULTI_BSSID_IDX = 85,
1458 	IEEE80211_ELEMID_FMS_DESC	= 86,
1459 	IEEE80211_ELEMID_FMS_REQ	= 87,
1460 	IEEE80211_ELEMID_FMS_RESP	= 88,
1461 	IEEE80211_ELEMID_QOS_TRAFFIC_CAP = 89,
1462 	IEEE80211_ELEMID_BSS_MAX_IDLE_P	= 90,
1463 	IEEE80211_ELEMID_TSF_REQ	= 91,
1464 	IEEE80211_ELEMID_TSF_RESP	= 92,
1465 	IEEE80211_ELEMID_WNM_SLEEP_MODE	= 93,
1466 	IEEE80211_ELEMID_TIM_BCAST_REQ	= 94,
1467 	IEEE80211_ELEMID_TIM_BCAST_RESP	= 95,
1468 	IEEE80211_ELEMID_COL_INTERF_REP = 96,
1469 	IEEE80211_ELEMID_CHAN_USAGE	= 97,
1470 	IEEE80211_ELEMID_TIME_ZONE	= 98,
1471 	IEEE80211_ELEMID_DMS_REQ	= 99,
1472 	IEEE80211_ELEMID_DMS_RESP	= 100,
1473 	IEEE80211_ELEMID_LINK_ID	= 101,
1474 	IEEE80211_ELEMID_WAKEUP_SCHED	= 102,
1475 	/* 103 reserved */
1476 	IEEE80211_ELEMID_CHAN_SW_TIMING	= 104,
1477 	IEEE80211_ELEMID_PTI_CONTROL	= 105,
1478 	IEEE80211_ELEMID_TPU_BUF_STATUS	= 106,
1479 	IEEE80211_ELEMID_INTERWORKING	= 107,
1480 	IEEE80211_ELEMID_ADV_PROTO	= 108,
1481 	IEEE80211_ELEMID_EXP_BW_REQ	= 109,
1482 	IEEE80211_ELEMID_QOS_MAP	= 110,
1483 	IEEE80211_ELEMID_ROAM_CONSORT	= 111,
1484 	IEEE80211_ELEMID_EMERG_ALERT_ID	= 112,
1485 
1486 	/*
1487 	 * 802.11s IEs
1488 	 * NB: On vanilla Linux still IEEE80211_ELEMID_MESHPEER = 55,
1489 	 * but they defined a new with id 117 called PEER_MGMT.
1490 	 * NB: complies with open80211
1491 	 */
1492 	IEEE80211_ELEMID_MESHCONF	= 113,
1493 	IEEE80211_ELEMID_MESHID		= 114,
1494 	IEEE80211_ELEMID_MESHLINK	= 115,
1495 	IEEE80211_ELEMID_MESHCNGST	= 116,
1496 	IEEE80211_ELEMID_MESHPEER	= 117,
1497 	IEEE80211_ELEMID_MESHCSA	= 118,
1498 	IEEE80211_ELEMID_MESHTIM	= 39, /* XXX: remove */
1499 	IEEE80211_ELEMID_MESHAWAKEW	= 119,
1500 	IEEE80211_ELEMID_MESHBEACONT	= 120,
1501 	/* 121-124 MMCAOP not implemented yet */
1502 	IEEE80211_ELEMID_MESHGANN	= 125,
1503 	IEEE80211_ELEMID_MESHRANN	= 126,
1504 	/* 127 Extended Capabilities */
1505 	IEEE80211_ELEMID_EXTCAP		= 127,
1506 	/* 128-129 reserved */
1507 	IEEE80211_ELEMID_MESHPREQ	= 130,
1508 	IEEE80211_ELEMID_MESHPREP	= 131,
1509 	IEEE80211_ELEMID_MESHPERR	= 132,
1510 	/* 133-136 reserved */
1511 	IEEE80211_ELEMID_MESHPXU	= 137,
1512 	IEEE80211_ELEMID_MESHPXUC	= 138,
1513 	IEEE80211_ELEMID_MESHAH		= 60, /* XXX: remove */
1514 	/* XXX 139 */
1515 
1516 	IEEE80211_ELEMID_MIC		= 140,
1517 	IEEE80211_ELEMID_DEST_URI	= 141,
1518 	IEEE80211_ELEMID_U_APSD_COEX	= 142,
1519 	IEEE80211_ELEMID_DMG_WAKEUP_SCHED = 143,
1520 	IEEE80211_ELEMID_EXT_SCHED	= 144,
1521 	IEEE80211_ELEMID_STA_AVAIL	= 145,
1522 	IEEE80211_ELEMID_DMG_TSPEC	= 146,
1523 	IEEE80211_ELEMID_NEXT_DMG_ATI	= 147,
1524 	IEEE80211_ELEMID_DMG_CAP	= 148,
1525 	/* 149-150 reserved. */
1526 	IEEE80211_ELEMID_TPC		= 150, /* XXX: remove */
1527 	IEEE80211_ELEMID_DMG_OPER	= 151,
1528 	IEEE80211_ELEMID_DMG_BSS_PARAM_CHANGE = 152,
1529 	IEEE80211_ELEMID_DMG_BEAM_REF	= 153,
1530 	IEEE80211_ELEMID_CHAN_MEAS_FEEDB = 154,
1531 	/* 155-156 reserved. */
1532 	IEEE80211_ELEMID_CCKM		= 156, /* XXX: remove? */
1533 	IEEE80211_ELEMID_AWAKE_WIN	= 157,
1534 	IEEE80211_ELEMID_MULTI_BAND	= 158,
1535 	IEEE80211_ELEMID_ADDBA_EXT	= 159,
1536 	IEEE80211_ELEMID_NEXTPCP_LIST	= 160,
1537 	IEEE80211_ELEMID_PCP_HANDOVER	= 161,
1538 	IEEE80211_ELEMID_DMG_LINK_MARGIN = 162,
1539 	IEEE80211_ELEMID_SW_STREAM	= 163,
1540 	IEEE80211_ELEMID_SESS_TRANS	= 164,
1541 	/* 165 reserved. */
1542 	IEEE80211_ELEMID_CLUSTER_REP	= 166,
1543 	IEEE80211_ELEMID_RELAY_CAP	= 167,
1544 	IEEE80211_ELEMID_RELAY_TRANS_PARAM_SET = 168,
1545 	IEEE80211_ELEMID_BEAMLINK_MAINT	= 169,
1546 	IEEE80211_ELEMID_MULTI_MAC_SUBL	= 170,
1547 	IEEE80211_ELEMID_U_PID		= 171,
1548 	IEEE80211_ELEMID_DMG_LINK_ADAP_ACK = 172,
1549 	/* 173 reserved. */
1550 	IEEE80211_ELEMID_MCCAOP_ADV_OV	= 174,
1551 	IEEE80211_ELEMID_QUIET_PERIOD_REQ = 175,
1552 	/* 176 reserved. */
1553 	IEEE80211_ELEMID_QUIET_PERIOD_RESP = 177,
1554 	/* 178-180 reserved. */
1555 	IEEE80211_ELEMID_QMF_POLICY	= 181,
1556 	IEEE80211_ELEMID_ECAPC_POLICY	= 182,
1557 	IEEE80211_ELEMID_CLUSTER_TIME_OFFSET = 183,
1558 	IEEE80211_ELEMID_INTRA_ACC_CAT_PRIO = 184,
1559 	IEEE80211_ELEMID_SCS_DESCR	= 185,
1560 	IEEE80211_ELEMID_QLOAD_REPORT	= 186,
1561 	IEEE80211_ELEMID_HCCA_TXOP_UP_CNT = 187,
1562 	IEEE80211_ELEMID_HL_STREAM_ID	= 188,
1563 	IEEE80211_ELEMID_GCR_GROUP_ADDR	= 189,
1564 	IEEE80211_ELEMID_ANTENNA_SECTOR_ID_PAT = 190,
1565 	IEEE80211_ELEMID_VHT_CAP	= 191,
1566 	IEEE80211_ELEMID_VHT_OPMODE	= 192,
1567 	IEEE80211_ELEMID_EXTENDED_BSS_LOAD = 193,
1568 	IEEE80211_ELEMID_WIDE_BW_CHAN_SW = 194,
1569 	IEEE80211_ELEMID_VHT_PWR_ENV	= 195,	/* TX_PWR_ENV */
1570 	IEEE80211_ELEMID_CHANNEL_SWITCH_WRAPPER = 196,
1571 	IEEE80211_ELEMID_AID		= 197,
1572 	IEEE80211_ELEMID_QUIET_CHANNEL	= 198,
1573 	IEEE80211_ELEMID_OPMODE_NOTIF	= 199,
1574 	IEEE80211_ELEMID_UPSIM		= 200,
1575 	IEEE80211_ELEMID_RED_NEIGH_REP	= 201,
1576 	IEEE80211_ELEMID_TVHT_OP	= 202,
1577 	/* 203 reserved. */
1578 	IEEE80211_ELEMID_DEVICE_LOC	= 204,
1579 	IEEE80211_ELEMID_WHITE_SPACE_MAP = 205,
1580 	IEEE80211_ELEMID_FINE_TIME_MEAS_PARAM = 206,
1581 	IEEE80211_ELEMID_SIG_OPEN_LOOP_LINK_MARGIN_IDX	= 207,
1582 	IEEE80211_ELEMID_RPS		= 208,
1583 	IEEE80211_ELEMID_PAGE_SLICE	= 209,
1584 	IEEE80211_ELEMID_AID_REQ	= 210,
1585 	IEEE80211_ELEMID_AID_RESP	= 211,
1586 	IEEE80211_ELEMID_SIG_SECTOR_OP	= 212,
1587 	IEEE80211_ELEMID_SIG_BEACON_COMPAT = 213,
1588 	IEEE80211_ELEMID_SHORT_BEACON_INTVL = 214,
1589 	IEEE80211_ELEMID_CHANGE_SEQ	= 215,
1590 	IEEE80211_ELEMID_TWT		= 216,
1591 	IEEE80211_ELEMID_SIG_CAPS	= 217,
1592 	/* 218-219 reserved. */
1593 	IEEE80211_ELEMID_SUBCHAN_SELECT_TRANS = 220,
1594 	IEEE80211_ELEMID_VENDOR		= 221,	/* vendor private */
1595 	IEEE80211_ELEMID_AUTH_CONTROL	= 222,
1596 	IEEE80211_ELEMID_TSF_TIMER_ACC	= 223,
1597 	IEEE80211_ELEMID_S1G_RELAY	= 224,
1598 	IEEE80211_ELEMID_REACHABLE_ADDR	= 225,
1599 	IEEE80211_ELEMID_SIG_RELAY_DISC	= 226,
1600 	/* 227 reserved. */
1601 	IEEE80211_ELEMID_AID_ANNOUNCEMENT = 228,
1602 	IEEE80211_ELEMID_PV1_PROBE_RESP_OPT = 229,
1603 	IEEE80211_ELEMID_EL_OP		= 230,
1604 	IEEE80211_ELEMID_SECTORIZED_GRP_ID_LIST	= 231,
1605 	IEEE80211_ELEMID_SIG_OP		= 232,
1606 	IEEE80211_ELEMID_HDR_COMPRESSION = 233,
1607 	IEEE80211_ELEMID_SST_OP		= 234,
1608 	IEEE80211_ELEMID_MAD		= 235,
1609 	IEEE80211_ELEMID_SIG_RELAY_ACT	= 236,
1610 	IEEE80211_ELEMID_CAG_NUMBER	= 237,
1611 	/* 238 reserved. */
1612 	IEEE80211_ELEMID_AP_CSN		= 239,
1613 	IEEE80211_ELEMID_FILS_INDICATION = 240,
1614 	IEEE80211_ELEMID_DILS		= 241,
1615 	IEEE80211_ELEMID_FRAGMENT	= 242,
1616 	/* 243 reserved. */
1617 	IEEE80211_ELEMID_RSN_EXT	= 244,
1618 	/* 245-254 reserved. */
1619 	IEEE80211_ELEMID_EXTFIELD	= 255
1620 };
1621 
1622 enum ieee80211_elemid_ext {
1623 	IEEE80211_ELEMID_EXT_ASSOC_DELAY_INFO		= 1,
1624 	IEEE80211_ELEMID_EXT_FILS_REQ_PARAMS		= 2,
1625 	IEEE80211_ELEMID_EXT_FILS_KEY_CONFIRM		= 3,
1626 	IEEE80211_ELEMID_EXT_FILS_SESSION		= 4,
1627 	IEEE80211_ELEMID_EXT_FILS_HLP_CONTAINER		= 5,
1628 	IEEE80211_ELEMID_EXT_FILS_IP_ADDR_ASSIGNMENT	= 6,
1629 	IEEE80211_ELEMID_EXT_KEY_DELIVERY		= 7,
1630 	IEEE80211_ELEMID_EXT_FILS_WRAPPED_DATA		= 8,
1631 	IEEE80211_ELEMID_EXT_FTM_SYNC_INFO		= 9,
1632 	IEEE80211_ELEMID_EXT_EXT_REQ			= 10,
1633 	IEEE80211_ELEMID_EXT_EST_SERVICE_PARAM_INBOUND	= 11,
1634 	IEEE80211_ELEMID_EXT_FILS_PUBLIC_KEY		= 12,
1635 	IEEE80211_ELEMID_EXT_FILS_NONCE			= 13,
1636 	IEEE80211_ELEMID_EXT_FUTURE_CHAN_GUIDANCE	= 14,
1637 	IEEE80211_ELEMID_EXT_SERVICE_HINT		= 15,
1638 	IEEE80211_ELEMID_EXT_SERVICE_HASH		= 16,
1639 	IEEE80211_ELEMID_EXT_CDMG_CAPA			= 17,
1640 	IEEE80211_ELEMID_EXT_DYN_BW_CTRL		= 18,
1641 	IEEE80211_ELEMID_EXT_CDMG_EXT_SCHEDULE		= 19,
1642 	IEEE80211_ELEMID_EXT_SSW_REPORT			= 20,
1643 	IEEE80211_ELEMID_EXT_CLUSTER_PROBE		= 21,
1644 	IEEE80211_ELEMID_EXT_EXT_CLUSTER_REPORT		= 22,
1645 	IEEE80211_ELEMID_EXT_CLUSTER_SW_ANNOUNCEMENT	= 23,
1646 	IEEE80211_ELEMID_EXT_ENHANCED_BEAM_TRACKING	= 24,
1647 	IEEE80211_ELEMID_EXT_SPSH_REPORT		= 25,
1648 	IEEE80211_ELEMID_EXT_CLUSTER_INTERF_ASSESS	= 26,
1649 	IEEE80211_ELEMID_EXT_CMMG_CAPA			= 27,
1650 	IEEE80211_ELEMID_EXT_CMMG_OPER			= 28,
1651 	IEEE80211_ELEMID_EXT_CMMG_OPMODE_NOTIF		= 29,
1652 	IEEE80211_ELEMID_EXT_CMMG_LINK_MARGIN		= 30,
1653 	IEEE80211_ELEMID_EXT_CMMG_LINK_ADAP_ACK		= 31,
1654 	/* 32 reserved. */
1655 	IEEE80211_ELEMID_EXT_PASSWORD_ID		= 33,
1656 	IEEE80211_ELEMID_EXT_GLK_GCR_PARAM_SET		= 34,
1657 	IEEE80211_ELEMID_EXT_HE_CAPA			= 35,
1658 	IEEE80211_ELEMID_EXT_HE_OPER			= 36,
1659 	IEEE80211_ELEMID_EXT_UORA_PARAM_SET		= 37,
1660 	IEEE80211_ELEMID_EXT_MU_EDCA_PARAM_SET		= 38,
1661 	IEEE80211_ELEMID_EXT_SPATIAL_REUSE_PARAM_SET	= 39,
1662 	IEEE80211_ELEMID_EXT_GAS_EXTENSION		= 40,
1663 	IEEE80211_ELEMID_EXT_NDP_FEEDB_REPORT_PARAM	= 41,
1664 	IEEE80211_ELEMID_EXT_BSS_COLOR_CHG_ANNOUNCE	= 42,
1665 	IEEE80211_ELEMID_EXT_QUIET_TIMME_PERIOD		= 43,
1666 	IEEE80211_ELEMID_EXT_VENDOR_SPECIFIC_REQ_ELEM	= 44,
1667 	IEEE80211_ELEMID_EXT_ESS_REPORT			= 45,
1668 	IEEE80211_ELEMID_EXT_OPS			= 46,
1669 	IEEE80211_ELEMID_EXT_HE_BSS_LOAD		= 47,
1670 	/* 48-51 reserved. */
1671 	IEEE80211_ELEMID_EXT_MAC_CH_SW_TIME		= 52,
1672 	IEEE80211_ELEMID_EXT_EST_SERVICE_PARAM_OUTBOUND	= 53,
1673 	IEEE80211_ELEMID_EXT_OCI			= 54,
1674 	IEEE80211_ELEMID_EXT_MULTI_BSSID_CONFIG		= 55,
1675 	IEEE80211_ELEMID_EXT_NON_INHERITANCE		= 56,
1676 	IEEE80211_ELEMID_EXT_KNOWN_BSSID		= 57,
1677 	IEEE80211_ELEMID_EXT_SHORT_SSID_LIST		= 58,
1678 	IEEE80211_ELEMID_EXT_HE_6GHZ_BAND_CAPA		= 59,
1679 	IEEE80211_ELEMID_EXT_ULMU_POWER_CAAP		= 60,
1680 	/* 61-87 reserved. */
1681 	IEEE80211_ELEMID_EXT_MSCS_DESCRIPTOR		= 88,
1682 	IEEE80211_ELEMID_EXT_TCLAS_MASK			= 89,
1683 	IEEE80211_ELEMID_EXT_SUPPL_CLASS_2_CAPA		= 90,
1684 	IEEE80211_ELEMID_EXT_OCT_SOURCE			= 91,
1685 	IEEE80211_ELEMID_EXT_REJECTED_GROUPS		= 92,
1686 	IEEE80211_ELEMID_EXT_ANTI_CLOGGING_TAOKEN_CONTAINER = 93,
1687 	/* 94-255 reserved. */
1688 };
1689 
1690 struct ieee80211_tim_ie {
1691 	uint8_t		tim_ie;			/* IEEE80211_ELEMID_TIM */
1692 	uint8_t		tim_len;
1693 	uint8_t		tim_count;		/* DTIM count */
1694 	uint8_t		tim_period;		/* DTIM period */
1695 	uint8_t		tim_bitctl;		/* bitmap control */
1696 	uint8_t		tim_bitmap[1];		/* variable-length bitmap */
1697 } __packed;
1698 
1699 struct ieee80211_country_ie {
1700 	uint8_t		ie;			/* IEEE80211_ELEMID_COUNTRY */
1701 	uint8_t		len;
1702 	uint8_t		cc[3];			/* ISO CC+(I)ndoor/(O)utdoor */
1703 	struct {
1704 		uint8_t schan;			/* starting channel */
1705 		uint8_t nchan;			/* number channels */
1706 		uint8_t maxtxpwr;		/* tx power cap */
1707 	} __packed band[1];			/* sub bands (NB: var size) */
1708 } __packed;
1709 
1710 #define	IEEE80211_COUNTRY_MAX_BANDS	84	/* max possible bands */
1711 #define	IEEE80211_COUNTRY_MAX_SIZE \
1712 	(sizeof(struct ieee80211_country_ie) + 3*(IEEE80211_COUNTRY_MAX_BANDS-1))
1713 
1714 struct ieee80211_bss_load_ie {
1715 	uint8_t		ie;
1716 	uint8_t		len;
1717 	uint16_t	sta_count;	/* station count */
1718 	uint8_t		chan_load;	/* channel utilization */
1719 	uint8_t		aac;		/* available admission capacity */
1720 } __packed;
1721 
1722 struct ieee80211_ap_chan_report_ie {
1723 	uint8_t		ie;
1724 	uint8_t		len;
1725 	uint8_t		i_class; /* operating class */
1726 	/* Annex E, E.1 Country information and operating classes */
1727 	uint8_t		chan_list[0];
1728 } __packed;
1729 
1730 #define IEEE80211_EXTCAP_CMS			(1ULL <<  0) /* 20/40 BSS coexistence management support */
1731 #define IEEE80211_EXTCAP_RSVD_1			(1ULL <<  1)
1732 #define IEEE80211_EXTCAP_ECS			(1ULL <<  2) /* extended channel switching */
1733 #define IEEE80211_EXTCAP_RSVD_3			(1ULL <<  3)
1734 #define IEEE80211_EXTCAP_PSMP_CAP		(1ULL <<  4) /* PSMP capability */
1735 #define IEEE80211_EXTCAP_RSVD_5			(1ULL <<  5)
1736 #define IEEE80211_EXTCAP_S_PSMP_SUPP		(1ULL <<  6)
1737 #define IEEE80211_EXTCAP_EVENT			(1ULL <<  7)
1738 #define IEEE80211_EXTCAP_DIAGNOSTICS		(1ULL <<  8)
1739 #define IEEE80211_EXTCAP_MCAST_DIAG		(1ULL <<  9)
1740 #define IEEE80211_EXTCAP_LOC_TRACKING		(1ULL << 10)
1741 #define IEEE80211_EXTCAP_FMS			(1ULL << 11)
1742 #define IEEE80211_EXTCAP_PROXY_ARP		(1ULL << 12)
1743 #define IEEE80211_EXTCAP_CIR			(1ULL << 13) /* collocated interference reporting */
1744 #define IEEE80211_EXTCAP_CIVIC_LOC		(1ULL << 14)
1745 #define IEEE80211_EXTCAP_GEOSPATIAL_LOC		(1ULL << 15)
1746 #define IEEE80211_EXTCAP_TFS			(1ULL << 16)
1747 #define IEEE80211_EXTCAP_WNM_SLEEPMODE		(1ULL << 17)
1748 #define IEEE80211_EXTCAP_TIM_BROADCAST		(1ULL << 18)
1749 #define IEEE80211_EXTCAP_BSS_TRANSITION		(1ULL << 19)
1750 #define IEEE80211_EXTCAP_QOS_TRAF_CAP		(1ULL << 20)
1751 #define IEEE80211_EXTCAP_AC_STA_COUNT		(1ULL << 21)
1752 #define IEEE80211_EXTCAP_M_BSSID		(1ULL << 22) /* multiple BSSID field */
1753 #define IEEE80211_EXTCAP_TIMING_MEAS		(1ULL << 23)
1754 #define IEEE80211_EXTCAP_CHAN_USAGE		(1ULL << 24)
1755 #define IEEE80211_EXTCAP_SSID_LIST		(1ULL << 25)
1756 #define IEEE80211_EXTCAP_DMS			(1ULL << 26)
1757 #define IEEE80211_EXTCAP_UTC_TSF_OFFSET		(1ULL << 27)
1758 #define IEEE80211_EXTCAP_TLDS_BUF_STA_SUPP	(1ULL << 28) /* TDLS peer U-APSP buffer STA support */
1759 #define IEEE80211_EXTCAP_TLDS_PPSM_SUPP		(1ULL << 29) /* TDLS peer PSM support */
1760 #define IEEE80211_EXTCAP_TLDS_CH_SW		(1ULL << 30) /* TDLS channel switching */
1761 #define IEEE80211_EXTCAP_INTERWORKING		(1ULL << 31)
1762 #define IEEE80211_EXTCAP_QOSMAP			(1ULL << 32)
1763 #define IEEE80211_EXTCAP_EBR			(1ULL << 33)
1764 #define IEEE80211_EXTCAP_SSPN_IF		(1ULL << 34)
1765 #define IEEE80211_EXTCAP_RSVD_35		(1ULL << 35)
1766 #define IEEE80211_EXTCAP_MSGCF_CAP		(1ULL << 36)
1767 #define IEEE80211_EXTCAP_TLDS_SUPP		(1ULL << 37)
1768 #define IEEE80211_EXTCAP_TLDS_PROHIB		(1ULL << 38)
1769 #define IEEE80211_EXTCAP_TLDS_CH_SW_PROHIB	(1ULL << 39) /* TDLS channel switching prohibited */
1770 #define IEEE80211_EXTCAP_RUF			(1ULL << 40) /* reject unadmitted frame */
1771 /* service interval granularity */
1772 #define IEEE80211_EXTCAP_SIG \
1773 				((1ULL << 41) | (1ULL << 42) | (1ULL << 43))
1774 #define IEEE80211_EXTCAP_ID_LOC			(1ULL << 44)
1775 #define IEEE80211_EXTCAP_U_APSD_COEX		(1ULL << 45)
1776 #define IEEE80211_EXTCAP_WNM_NOTIFICATION	(1ULL << 46)
1777 #define IEEE80211_EXTCAP_RSVD_47		(1ULL << 47)
1778 #define IEEE80211_EXTCAP_SSID			(1ULL << 48) /* UTF-8 SSID */
1779 /* bits 49-n are reserved */
1780 
1781 struct ieee80211_extcap_ie {
1782 	uint8_t		ie;
1783 	uint8_t		len;
1784 } __packed;
1785 
1786 /*
1787  * 802.11h Quiet Time Element.
1788  */
1789 struct ieee80211_quiet_ie {
1790 	uint8_t		quiet_ie;		/* IEEE80211_ELEMID_QUIET */
1791 	uint8_t		len;
1792 	uint8_t		tbttcount;		/* quiet start */
1793 	uint8_t		period;			/* beacon intervals between quiets */
1794 	uint16_t	duration;		/* TUs of each quiet*/
1795 	uint16_t	offset;			/* TUs of from TBTT of quiet start */
1796 } __packed;
1797 
1798 /*
1799  * 802.11h Channel Switch Announcement (CSA).
1800  */
1801 struct ieee80211_csa_ie {
1802 	uint8_t		csa_ie;		/* IEEE80211_ELEMID_CHANSWITCHANN */
1803 	uint8_t		csa_len;
1804 	uint8_t		csa_mode;		/* Channel Switch Mode */
1805 	uint8_t		csa_newchan;		/* New Channel Number */
1806 	uint8_t		csa_count;		/* Channel Switch Count */
1807 } __packed;
1808 
1809 /*
1810  * Note the min acceptable CSA count is used to guard against
1811  * malicious CSA injection in station mode.  Defining this value
1812  * as other than 0 violates the 11h spec.
1813  */
1814 #define	IEEE80211_CSA_COUNT_MIN	2
1815 #define	IEEE80211_CSA_COUNT_MAX	255
1816 
1817 /* rate set entries are in .5 Mb/s units, and potentially marked as basic */
1818 #define	IEEE80211_RATE_BASIC		0x80
1819 #define	IEEE80211_RATE_VAL		0x7f
1820 #define	IEEE80211_RV(v)			((v) & IEEE80211_RATE_VAL)
1821 
1822 /* ERP information element flags */
1823 #define	IEEE80211_ERP_NON_ERP_PRESENT	0x01
1824 #define	IEEE80211_ERP_USE_PROTECTION	0x02
1825 #define	IEEE80211_ERP_LONG_PREAMBLE	0x04
1826 
1827 #define	IEEE80211_ERP_BITS \
1828 	"\20\1NON_ERP_PRESENT\2USE_PROTECTION\3LONG_PREAMBLE"
1829 
1830 #define	ATH_OUI			0x7f0300	/* Atheros OUI */
1831 #define	ATH_OUI_TYPE		0x01		/* Atheros protocol ie */
1832 
1833 /* NB: Atheros allocated the OUI for this purpose ~2005 but beware ... */
1834 #define	TDMA_OUI		ATH_OUI
1835 #define	TDMA_OUI_TYPE		0x02		/* TDMA protocol ie */
1836 
1837 #define	BCM_OUI			0x4c9000	/* Broadcom OUI */
1838 #define	BCM_OUI_HTCAP		51		/* pre-draft HTCAP ie */
1839 #define	BCM_OUI_HTINFO		52		/* pre-draft HTINFO ie */
1840 
1841 #define	WPA_OUI			0xf25000
1842 #define	WPA_OUI_TYPE		0x01
1843 #define	WPA_VERSION		1		/* current supported version */
1844 
1845 #define	WPA_CSE_NULL		0x00
1846 #define	WPA_CSE_WEP40		0x01
1847 #define	WPA_CSE_TKIP		0x02
1848 #define	WPA_CSE_CCMP		0x04		/* CCMP 128-bit */
1849 #define	WPA_CSE_WEP104		0x05
1850 
1851 #define	WPA_ASE_NONE		0x00
1852 #define	WPA_ASE_8021X_UNSPEC	0x01
1853 #define	WPA_ASE_8021X_PSK	0x02
1854 
1855 #define	WPS_OUI_TYPE		0x04
1856 
1857 /* 802.11-2016 Table 9-131 - Cipher Suite Selectors */
1858 #define	RSN_OUI			0xac0f00
1859 #define	RSN_VERSION		1		/* current supported version */
1860 
1861 /* RSN cipher suite element */
1862 #define	RSN_CSE_NULL		0
1863 #define	RSN_CSE_WEP40		1
1864 #define	RSN_CSE_TKIP		2
1865 #define	RSN_CSE_WRAP		3		/* Reserved in the 802.11-2016 */
1866 #define	RSN_CSE_CCMP		4		/* CCMP 128 bit */
1867 #define	RSN_CSE_WEP104		5
1868 #define	RSN_CSE_BIP_CMAC_128	6
1869 /* 7 - "Group addressed traffic not allowed" */
1870 #define	RSN_CSE_GCMP_128	8
1871 #define	RSN_CSE_GCMP_256	9
1872 #define	RSN_CSE_CCMP_256	10
1873 #define	RSN_CSE_BIP_GMAC_128	11
1874 #define	RSN_CSE_BIP_GMAC_256	12
1875 #define	RSN_CSE_BIP_CMAC_256	13
1876 
1877 /* 802.11-2016 Table 9-133 - AKM suite selectors */
1878 /* RSN AKM suite element */
1879 #define	RSN_ASE_NONE		0
1880 #define	RSN_ASE_8021X_UNSPEC	1
1881 #define	RSN_ASE_8021X_PSK	2
1882 #define	RSN_ASE_FT_8021X	3		/* SHA-256 */
1883 #define	RSN_ASE_FT_PSK		4		/* SHA-256 */
1884 #define	RSN_ASE_8021X_UNSPEC_SHA256	5
1885 #define	RSN_ASE_8021X_PSK_SHA256	6
1886 #define	RSN_ASE_8021X_TDLS	7		/* SHA-256 */
1887 #define	RSN_ASE_SAE_UNSPEC	8		/* SHA-256 */
1888 #define	RSN_ASE_FT_SAE		9		/* SHA-256 */
1889 #define	RSN_ASE_AP_PEERKEY	10		/* SHA-256 */
1890 #define	RSN_ASE_8021X_SUITE_B_SHA256	11
1891 #define	RSN_ASE_8021X_SUITE_B_SHA384	12
1892 #define	RSN_ASE_FT_8021X_SHA384	13
1893 
1894 /* 802.11-2016 Figure 9-257 - RSN Capabilities (2 byte field) */
1895 #define	RSN_CAP_PREAUTH		0x0001
1896 #define	RSN_CAP_NO_PAIRWISE	0x0002
1897 #define	RSN_CAP_PTKSA_REPLAY_COUNTER	0x000c	/* 2 bit field */
1898 #define	RSN_CAP_GTKSA_REPLAY_COUNTER	0x0030	/* 2 bit field */
1899 #define	RSN_CAP_MFP_REQUIRED	0x0040
1900 #define	RSN_CAP_MFP_CAPABLE	0x0080
1901 #define	RSN_CAP_JOINT_MULTIBAND_RSNA		0x0100
1902 #define	RSN_CAP_PEERKEY_ENABLED	0x0200
1903 #define	RSN_CAP_SPP_AMSDU_CAPABLE	0x0400
1904 #define	RSN_CAP_SPP_AMSDU_REQUIRED	0x0800
1905 #define	RSN_CAP_PBAC_CAPABLE	0x1000
1906 #define	RSN_CAP_EXT_KEYID_CAPABLE	0x0200
1907 
1908 /* 802.11-2016 Table 9-134 PTKSA/GTKSA/STKSA replay counters usage */
1909 #define		RSN_CAP_REPLAY_COUNTER_1_PER	0
1910 #define		RSN_CAP_REPLAY_COUNTER_2_PER	1
1911 #define		RSN_CAP_REPLAY_COUNTER_4_PER	2
1912 #define		RSN_CAP_REPLAY_COUNTER_16_PER	3
1913 
1914 #define	WME_OUI			0xf25000
1915 #define	WME_OUI_TYPE		0x02
1916 #define	WME_INFO_OUI_SUBTYPE	0x00
1917 #define	WME_PARAM_OUI_SUBTYPE	0x01
1918 #define	WME_VERSION		1
1919 
1920 /* WME stream classes */
1921 #define	WME_AC_BE	0		/* best effort */
1922 #define	WME_AC_BK	1		/* background */
1923 #define	WME_AC_VI	2		/* video */
1924 #define	WME_AC_VO	3		/* voice */
1925 
1926 /*
1927  * AUTH management packets
1928  *
1929  *	octet algo[2]
1930  *	octet seq[2]
1931  *	octet status[2]
1932  *	octet chal.id
1933  *	octet chal.length
1934  *	octet chal.text[253]		NB: 1-253 bytes
1935  */
1936 
1937 /* challenge length for shared key auth */
1938 #define IEEE80211_CHALLENGE_LEN		128
1939 
1940 #define	IEEE80211_AUTH_ALG_OPEN		0x0000
1941 #define	IEEE80211_AUTH_ALG_SHARED	0x0001
1942 #define	IEEE80211_AUTH_ALG_LEAP		0x0080
1943 
1944 enum {
1945 	IEEE80211_AUTH_OPEN_REQUEST		= 1,
1946 	IEEE80211_AUTH_OPEN_RESPONSE		= 2,
1947 };
1948 
1949 enum {
1950 	IEEE80211_AUTH_SHARED_REQUEST		= 1,
1951 	IEEE80211_AUTH_SHARED_CHALLENGE		= 2,
1952 	IEEE80211_AUTH_SHARED_RESPONSE		= 3,
1953 	IEEE80211_AUTH_SHARED_PASS		= 4,
1954 };
1955 
1956 /*
1957  * Reason and status codes.
1958  *
1959  * Reason codes are used in management frames to indicate why an
1960  * action took place (e.g. on disassociation).  Status codes are
1961  * used in management frames to indicate the result of an operation.
1962  *
1963  * Unlisted codes are reserved
1964  */
1965 
1966 enum {
1967 	IEEE80211_REASON_UNSPECIFIED		= 1,
1968 	IEEE80211_REASON_AUTH_EXPIRE		= 2,
1969 	IEEE80211_REASON_AUTH_LEAVE		= 3,
1970 	IEEE80211_REASON_ASSOC_EXPIRE		= 4,
1971 	IEEE80211_REASON_ASSOC_TOOMANY		= 5,
1972 	IEEE80211_REASON_NOT_AUTHED		= 6,
1973 	IEEE80211_REASON_NOT_ASSOCED		= 7,
1974 	IEEE80211_REASON_ASSOC_LEAVE		= 8,
1975 	IEEE80211_REASON_ASSOC_NOT_AUTHED	= 9,
1976 	IEEE80211_REASON_DISASSOC_PWRCAP_BAD	= 10,	/* 11h */
1977 	IEEE80211_REASON_DISASSOC_SUPCHAN_BAD	= 11,	/* 11h */
1978 	IEEE80211_REASON_IE_INVALID		= 13,	/* 11i */
1979 	IEEE80211_REASON_MIC_FAILURE		= 14,	/* 11i */
1980 	IEEE80211_REASON_4WAY_HANDSHAKE_TIMEOUT	= 15,	/* 11i */
1981 	IEEE80211_REASON_GROUP_KEY_UPDATE_TIMEOUT = 16,	/* 11i */
1982 	IEEE80211_REASON_IE_IN_4WAY_DIFFERS	= 17,	/* 11i */
1983 	IEEE80211_REASON_GROUP_CIPHER_INVALID	= 18,	/* 11i */
1984 	IEEE80211_REASON_PAIRWISE_CIPHER_INVALID= 19,	/* 11i */
1985 	IEEE80211_REASON_AKMP_INVALID		= 20,	/* 11i */
1986 	IEEE80211_REASON_UNSUPP_RSN_IE_VERSION	= 21,	/* 11i */
1987 	IEEE80211_REASON_INVALID_RSN_IE_CAP	= 22,	/* 11i */
1988 	IEEE80211_REASON_802_1X_AUTH_FAILED	= 23,	/* 11i */
1989 	IEEE80211_REASON_CIPHER_SUITE_REJECTED	= 24,	/* 11i */
1990 	IEEE80211_REASON_UNSPECIFIED_QOS	= 32,	/* 11e */
1991 	IEEE80211_REASON_INSUFFICIENT_BW	= 33,	/* 11e */
1992 	IEEE80211_REASON_TOOMANY_FRAMES		= 34,	/* 11e */
1993 	IEEE80211_REASON_OUTSIDE_TXOP		= 35,	/* 11e */
1994 	IEEE80211_REASON_LEAVING_QBSS		= 36,	/* 11e */
1995 	IEEE80211_REASON_BAD_MECHANISM		= 37,	/* 11e */
1996 	IEEE80211_REASON_SETUP_NEEDED		= 38,	/* 11e */
1997 	IEEE80211_REASON_TIMEOUT		= 39,	/* 11e */
1998 
1999 	IEEE80211_REASON_PEER_LINK_CANCELED	= 52,	/* 11s */
2000 	IEEE80211_REASON_MESH_MAX_PEERS		= 53,	/* 11s */
2001 	IEEE80211_REASON_MESH_CPVIOLATION	= 54,	/* 11s */
2002 	IEEE80211_REASON_MESH_CLOSE_RCVD	= 55,	/* 11s */
2003 	IEEE80211_REASON_MESH_MAX_RETRIES	= 56,	/* 11s */
2004 	IEEE80211_REASON_MESH_CONFIRM_TIMEOUT	= 57,	/* 11s */
2005 	IEEE80211_REASON_MESH_INVALID_GTK	= 58,	/* 11s */
2006 	IEEE80211_REASON_MESH_INCONS_PARAMS	= 59,	/* 11s */
2007 	IEEE80211_REASON_MESH_INVALID_SECURITY	= 60,	/* 11s */
2008 	IEEE80211_REASON_MESH_PERR_NO_PROXY	= 61,	/* 11s */
2009 	IEEE80211_REASON_MESH_PERR_NO_FI	= 62,	/* 11s */
2010 	IEEE80211_REASON_MESH_PERR_DEST_UNREACH	= 63,	/* 11s */
2011 	IEEE80211_REASON_MESH_MAC_ALRDY_EXISTS_MBSS = 64, /* 11s */
2012 	IEEE80211_REASON_MESH_CHAN_SWITCH_REG	= 65,	/* 11s */
2013 	IEEE80211_REASON_MESH_CHAN_SWITCH_UNSPEC = 66,	/* 11s */
2014 
2015 	IEEE80211_STATUS_SUCCESS		= 0,
2016 	IEEE80211_STATUS_UNSPECIFIED		= 1,
2017 	IEEE80211_STATUS_CAPINFO		= 10,
2018 	IEEE80211_STATUS_NOT_ASSOCED		= 11,
2019 	IEEE80211_STATUS_OTHER			= 12,
2020 	IEEE80211_STATUS_ALG			= 13,
2021 	IEEE80211_STATUS_SEQUENCE		= 14,
2022 	IEEE80211_STATUS_CHALLENGE		= 15,
2023 	IEEE80211_STATUS_TIMEOUT		= 16,
2024 	IEEE80211_STATUS_TOOMANY		= 17,
2025 	IEEE80211_STATUS_BASIC_RATE		= 18,
2026 	IEEE80211_STATUS_SP_REQUIRED		= 19,	/* 11b */
2027 	IEEE80211_STATUS_PBCC_REQUIRED		= 20,	/* 11b */
2028 	IEEE80211_STATUS_CA_REQUIRED		= 21,	/* 11b */
2029 	IEEE80211_STATUS_SPECMGMT_REQUIRED	= 22,	/* 11h */
2030 	IEEE80211_STATUS_PWRCAP_REQUIRED	= 23,	/* 11h */
2031 	IEEE80211_STATUS_SUPCHAN_REQUIRED	= 24,	/* 11h */
2032 	IEEE80211_STATUS_SHORTSLOT_REQUIRED	= 25,	/* 11g */
2033 	IEEE80211_STATUS_DSSSOFDM_REQUIRED	= 26,	/* 11g */
2034 	IEEE80211_STATUS_MISSING_HT_CAPS	= 27,	/* 11n D3.0 */
2035 	IEEE80211_STATUS_INVALID_IE		= 40,	/* 11i */
2036 	IEEE80211_STATUS_GROUP_CIPHER_INVALID	= 41,	/* 11i */
2037 	IEEE80211_STATUS_PAIRWISE_CIPHER_INVALID = 42,	/* 11i */
2038 	IEEE80211_STATUS_AKMP_INVALID		= 43,	/* 11i */
2039 	IEEE80211_STATUS_UNSUPP_RSN_IE_VERSION	= 44,	/* 11i */
2040 	IEEE80211_STATUS_INVALID_RSN_IE_CAP	= 45,	/* 11i */
2041 	IEEE80211_STATUS_CIPHER_SUITE_REJECTED	= 46,	/* 11i */
2042 };
2043 
2044 #define	IEEE80211_WEP_KEYLEN		5	/* 40bit */
2045 #define	IEEE80211_WEP_IVLEN		3	/* 24bit */
2046 #define	IEEE80211_WEP_KIDLEN		1	/* 1 octet */
2047 #define	IEEE80211_WEP_CRCLEN		4	/* CRC-32 */
2048 #define	IEEE80211_WEP_TOTLEN		(IEEE80211_WEP_IVLEN + \
2049 					 IEEE80211_WEP_KIDLEN + \
2050 					 IEEE80211_WEP_CRCLEN)
2051 #define	IEEE80211_WEP_NKID		4	/* number of key ids */
2052 
2053 /*
2054  * 802.11i defines an extended IV for use with non-WEP ciphers.
2055  * When the EXTIV bit is set in the key id byte an additional
2056  * 4 bytes immediately follow the IV for TKIP.  For CCMP the
2057  * EXTIV bit is likewise set but the 8 bytes represent the
2058  * CCMP header rather than IV+extended-IV.
2059  */
2060 #define	IEEE80211_WEP_EXTIV		0x20
2061 #define	IEEE80211_WEP_EXTIVLEN		4	/* extended IV length */
2062 #define	IEEE80211_WEP_MICLEN		8	/* trailing MIC */
2063 
2064 #define	IEEE80211_CRC_LEN		4
2065 
2066 /*
2067  * Maximum acceptable MTU is:
2068  *	IEEE80211_MAX_LEN - WEP overhead - CRC -
2069  *		QoS overhead - RSN/WPA overhead
2070  * Min is arbitrarily chosen > IEEE80211_MIN_LEN.  The default
2071  * mtu is Ethernet-compatible; it's set by ether_ifattach.
2072  */
2073 #define	IEEE80211_MTU_MAX		2290
2074 #define	IEEE80211_MTU_MIN		32
2075 
2076 #define	IEEE80211_MAX_LEN		(2300 + IEEE80211_CRC_LEN + \
2077     (IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN + IEEE80211_WEP_CRCLEN))
2078 #define	IEEE80211_ACK_LEN \
2079 	(sizeof(struct ieee80211_frame_ack) + IEEE80211_CRC_LEN)
2080 #define	IEEE80211_MIN_LEN \
2081 	(sizeof(struct ieee80211_frame_min) + IEEE80211_CRC_LEN)
2082 
2083 /*
2084  * The 802.11 spec says at most 2007 stations may be
2085  * associated at once.  For most AP's this is way more
2086  * than is feasible so we use a default of IEEE80211_AID_DEF.
2087  * This number may be overridden by the driver and/or by
2088  * user configuration but may not be less than IEEE80211_AID_MIN
2089  * (see _ieee80211.h for implementation-specific settings).
2090  */
2091 #define	IEEE80211_AID_MAX		2007
2092 
2093 #define	IEEE80211_AID(b)	((b) &~ 0xc000)
2094 
2095 /*
2096  * RTS frame length parameters.  The default is specified in
2097  * the 802.11 spec as 512; we treat it as implementation-dependent
2098  * so it's defined in ieee80211_var.h.  The max may be wrong
2099  * for jumbo frames.
2100  */
2101 #define	IEEE80211_RTS_MIN		1
2102 #define	IEEE80211_RTS_MAX		2346
2103 
2104 /*
2105  * TX fragmentation parameters.  As above for RTS, we treat
2106  * default as implementation-dependent so define it elsewhere.
2107  */
2108 #define	IEEE80211_FRAG_MIN		256
2109 #define	IEEE80211_FRAG_MAX		2346
2110 
2111 /*
2112  * Beacon interval (TU's).  Min+max come from WiFi requirements.
2113  * As above, we treat default as implementation-dependent so
2114  * define it elsewhere.
2115  */
2116 #define	IEEE80211_BINTVAL_MAX	1000	/* max beacon interval (TU's) */
2117 #define	IEEE80211_BINTVAL_MIN	25	/* min beacon interval (TU's) */
2118 
2119 /*
2120  * DTIM period (beacons).  Min+max are not really defined
2121  * by the protocol but we want them publicly visible so
2122  * define them here.
2123  */
2124 #define	IEEE80211_DTIM_MAX	15	/* max DTIM period */
2125 #define	IEEE80211_DTIM_MIN	1	/* min DTIM period */
2126 
2127 /*
2128  * Beacon miss threshold (beacons).  As for DTIM, we define
2129  * them here to be publicly visible.  Note the max may be
2130  * clamped depending on device capabilities.
2131  */
2132 #define	IEEE80211_HWBMISS_MIN 	1
2133 #define	IEEE80211_HWBMISS_MAX 	255
2134 
2135 /*
2136  * 802.11 frame duration definitions.
2137  */
2138 
2139 struct ieee80211_duration {
2140 	uint16_t	d_rts_dur;
2141 	uint16_t	d_data_dur;
2142 	uint16_t	d_plcp_len;
2143 	uint8_t		d_residue;	/* unused octets in time slot */
2144 };
2145 
2146 /* One Time Unit (TU) is 1Kus = 1024 microseconds. */
2147 #define IEEE80211_DUR_TU		1024
2148 
2149 /* IEEE 802.11b durations for DSSS PHY in microseconds */
2150 #define IEEE80211_DUR_DS_LONG_PREAMBLE	144
2151 #define IEEE80211_DUR_DS_SHORT_PREAMBLE	72
2152 
2153 #define IEEE80211_DUR_DS_SLOW_PLCPHDR	48
2154 #define IEEE80211_DUR_DS_FAST_PLCPHDR	24
2155 #define IEEE80211_DUR_DS_SLOW_ACK	112
2156 #define IEEE80211_DUR_DS_FAST_ACK	56
2157 #define IEEE80211_DUR_DS_SLOW_CTS	112
2158 #define IEEE80211_DUR_DS_FAST_CTS	56
2159 
2160 #define IEEE80211_DUR_DS_SLOT		20
2161 #define IEEE80211_DUR_DS_SIFS		10
2162 #define IEEE80211_DUR_DS_PIFS	(IEEE80211_DUR_DS_SIFS + IEEE80211_DUR_DS_SLOT)
2163 #define IEEE80211_DUR_DS_DIFS	(IEEE80211_DUR_DS_SIFS + \
2164 				 2 * IEEE80211_DUR_DS_SLOT)
2165 #define IEEE80211_DUR_DS_EIFS	(IEEE80211_DUR_DS_SIFS + \
2166 				 IEEE80211_DUR_DS_SLOW_ACK + \
2167 				 IEEE80211_DUR_DS_LONG_PREAMBLE + \
2168 				 IEEE80211_DUR_DS_SLOW_PLCPHDR + \
2169 				 IEEE80211_DUR_DIFS)
2170 
2171 #endif /* _NET80211_IEEE80211_H_ */
2172