xref: /freebsd/sys/net80211/ieee80211.h (revision 116102101a566ec8924b397c1523d362008fb35c)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2001 Atsushi Onoe
5  * Copyright (c) 2002-2009 Sam Leffler, Errno Consulting
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28 #ifndef _NET80211_IEEE80211_H_
29 #define _NET80211_IEEE80211_H_
30 
31 /*
32  * 802.11 protocol definitions.
33  */
34 
35 #define	IEEE80211_ADDR_LEN	6		/* size of 802.11 address */
36 /* is 802.11 address multicast/broadcast? */
37 #define	IEEE80211_IS_MULTICAST(_a)	(*(_a) & 0x01)
38 
39 #ifdef _KERNEL
40 extern const uint8_t ieee80211broadcastaddr[];
41 #endif
42 
43 typedef uint16_t ieee80211_seq;
44 
45 /* IEEE 802.11 PLCP header */
46 struct ieee80211_plcp_hdr {
47 	uint16_t	i_sfd;
48 	uint8_t		i_signal;
49 	uint8_t		i_service;
50 	uint16_t	i_length;
51 	uint16_t	i_crc;
52 } __packed;
53 
54 #define IEEE80211_PLCP_SFD      0xF3A0
55 #define IEEE80211_PLCP_SERVICE  0x00
56 #define IEEE80211_PLCP_SERVICE_LOCKED	0x04
57 #define IEEE80211_PLCL_SERVICE_PBCC	0x08
58 #define IEEE80211_PLCP_SERVICE_LENEXT5	0x20
59 #define IEEE80211_PLCP_SERVICE_LENEXT6	0x40
60 #define IEEE80211_PLCP_SERVICE_LENEXT7	0x80
61 
62 /*
63  * generic definitions for IEEE 802.11 frames
64  */
65 struct ieee80211_frame {
66 	uint8_t		i_fc[2];
67 	uint8_t		i_dur[2];
68 	uint8_t		i_addr1[IEEE80211_ADDR_LEN];
69 	uint8_t		i_addr2[IEEE80211_ADDR_LEN];
70 	uint8_t		i_addr3[IEEE80211_ADDR_LEN];
71 	uint8_t		i_seq[2];
72 	/* possibly followed by addr4[IEEE80211_ADDR_LEN]; */
73 	/* see below */
74 } __packed;
75 
76 struct ieee80211_qosframe {
77 	uint8_t		i_fc[2];
78 	uint8_t		i_dur[2];
79 	uint8_t		i_addr1[IEEE80211_ADDR_LEN];
80 	uint8_t		i_addr2[IEEE80211_ADDR_LEN];
81 	uint8_t		i_addr3[IEEE80211_ADDR_LEN];
82 	uint8_t		i_seq[2];
83 	uint8_t		i_qos[2];
84 	/* possibly followed by addr4[IEEE80211_ADDR_LEN]; */
85 	/* see below */
86 } __packed;
87 
88 struct ieee80211_qoscntl {
89 	uint8_t		i_qos[2];
90 };
91 
92 struct ieee80211_frame_addr4 {
93 	uint8_t		i_fc[2];
94 	uint8_t		i_dur[2];
95 	uint8_t		i_addr1[IEEE80211_ADDR_LEN];
96 	uint8_t		i_addr2[IEEE80211_ADDR_LEN];
97 	uint8_t		i_addr3[IEEE80211_ADDR_LEN];
98 	uint8_t		i_seq[2];
99 	uint8_t		i_addr4[IEEE80211_ADDR_LEN];
100 } __packed;
101 
102 struct ieee80211_qosframe_addr4 {
103 	uint8_t		i_fc[2];
104 	uint8_t		i_dur[2];
105 	uint8_t		i_addr1[IEEE80211_ADDR_LEN];
106 	uint8_t		i_addr2[IEEE80211_ADDR_LEN];
107 	uint8_t		i_addr3[IEEE80211_ADDR_LEN];
108 	uint8_t		i_seq[2];
109 	uint8_t		i_addr4[IEEE80211_ADDR_LEN];
110 	uint8_t		i_qos[2];
111 } __packed;
112 
113 #define	IEEE80211_FC0_VERSION_MASK		0x03
114 #define	IEEE80211_FC0_VERSION_SHIFT		0
115 #define	IEEE80211_FC0_VERSION_0			0x00
116 #define	IEEE80211_FC0_TYPE_MASK			0x0c
117 #define	IEEE80211_FC0_TYPE_SHIFT		2
118 #define	IEEE80211_FC0_TYPE_MGT			0x00	/* Management */
119 #define	IEEE80211_FC0_TYPE_CTL			0x04	/* Control */
120 #define	IEEE80211_FC0_TYPE_DATA			0x08	/* Data */
121 #define	IEEE80211_FC0_TYPE_EXT			0x0c	/* Extension */
122 
123 #define	IEEE80211_FC0_SUBTYPE_MASK		0xf0
124 #define	IEEE80211_FC0_SUBTYPE_SHIFT		4
125 /* 802.11-2020 Table 9-1-Valid type and subtype combinations */
126 /* For type 00 Management (IEEE80211_FC0_TYPE_MGT) */
127 #define	IEEE80211_FC0_SUBTYPE_ASSOC_REQ		0x00	/* Association Request */
128 #define	IEEE80211_FC0_SUBTYPE_ASSOC_RESP	0x10	/* Association Response */
129 #define	IEEE80211_FC0_SUBTYPE_REASSOC_REQ	0x20	/* Reassociation Request */
130 #define	IEEE80211_FC0_SUBTYPE_REASSOC_RESP	0x30	/* Reassociation Response */
131 #define	IEEE80211_FC0_SUBTYPE_PROBE_REQ		0x40	/* Probe Request */
132 #define	IEEE80211_FC0_SUBTYPE_PROBE_RESP	0x50	/* Probe Response */
133 #define	IEEE80211_FC0_SUBTYPE_TIMING_ADV	0x60	/* Timing Advertisement */
134 /* 0111 Reserved				0x70 */
135 #define	IEEE80211_FC0_SUBTYPE_BEACON		0x80	/* Beacon */
136 #define	IEEE80211_FC0_SUBTYPE_ATIM		0x90	/* ATIM */
137 #define	IEEE80211_FC0_SUBTYPE_DISASSOC		0xa0	/* Disassociation */
138 #define	IEEE80211_FC0_SUBTYPE_AUTH		0xb0	/* Authentication */
139 #define	IEEE80211_FC0_SUBTYPE_DEAUTH		0xc0	/* Deauthentication */
140 #define	IEEE80211_FC0_SUBTYPE_ACTION		0xd0	/* Action */
141 #define	IEEE80211_FC0_SUBTYPE_ACTION_NOACK	0xe0	/* Action No Ack */
142 /* 1111 Reserved				0xf0 */
143 /* For type 01 Control (IEEE80211_FC0_TYPE_CTL) */
144 /* 0000-0001 Reserved				0x00-0x10 */
145 #define	IEEE80211_FC0_SUBTYPE_TRIGGER		0x20	/* Trigger, 80211ax-2021 */
146 #define	IEEE80211_FC0_SUBTYPE_TACK		0x30	/* TACK */
147 #define	IEEE80211_FC0_SUBTYPE_BF_REPORT_POLL	0x40	/* Beamforming Report Poll */
148 #define	IEEE80211_FC0_SUBTYPE_VHT_HE_NDP	0x50	/* VHT/HE NDP Announcement, 80211ac/ax-2013/2021 */
149 #define	IEEE80211_FC0_SUBTYPE_CTL_EXT		0x60	/* Control Frame Extension */
150 #define	IEEE80211_FC0_SUBTYPE_CONTROL_WRAP	0x70	/* Control Wrapper */
151 #define	IEEE80211_FC0_SUBTYPE_BAR		0x80	/* Block Ack Request (BlockAckReq) */
152 #define	IEEE80211_FC0_SUBTYPE_BA		0x90	/* Block Ack (BlockAck) */
153 #define	IEEE80211_FC0_SUBTYPE_PS_POLL		0xa0	/* PS-Poll */
154 #define	IEEE80211_FC0_SUBTYPE_RTS		0xb0	/* RTS */
155 #define	IEEE80211_FC0_SUBTYPE_CTS		0xc0	/* CTS */
156 #define	IEEE80211_FC0_SUBTYPE_ACK		0xd0	/* Ack */
157 #define	IEEE80211_FC0_SUBTYPE_CF_END		0xe0	/* CF-End */
158 #define	IEEE80211_FC0_SUBTYPE_CF_END_ACK	0xf0	/* 1111 Reserved - what was CF_END_ACK? */
159 /* For type 10 Data (IEEE80211_FC0_TYPE_DATA) */
160 #define	IEEE80211_FC0_SUBTYPE_DATA		0x00	/* Data */
161 /* 0001-0011 Reserved				0x10-0x30 */	/* Were: CF_ACK, CF_POLL, CF_ACPL */
162 #define	IEEE80211_FC0_SUBTYPE_NODATA		0x40	/* Null */
163 /* 0101-0111 Reserved				0x50-0x70 */	/* Were: CFACK, CFPOLL, CF_ACK_CF_ACK */
164 #define	IEEE80211_FC0_SUBTYPE_QOS_MASK_ANY	0x80	/* QoS mask - matching any subtypes 8..15 */
165 #define	IEEE80211_FC0_SUBTYPE_QOS_DATA		0x80	/* QoS Data */
166 #define	IEEE80211_FC0_SUBTYPE_QOS_DATA_CFACK	0x90	/* QoS Data +CF-Ack */
167 #define	IEEE80211_FC0_SUBTYPE_QOS_DATA_CFPOLL	0xa0	/* QoS Data +CF-Poll */
168 #define	IEEE80211_FC0_SUBTYPE_QOS_DATA_CFACKPOLL 0xb0	/* QoS Data +CF-Ack +CF-Poll */
169 #define	IEEE80211_FC0_SUBTYPE_QOS_NULL		0xc0	/* QoS Null */
170 /* 1101 Reserved				0xd0 */
171 #define	IEEE80211_FC0_SUBTYPE_QOS_CFPOLL	0xe0	/* QoS CF-Poll */
172 #define	IEEE80211_FC0_SUBTYPE_QOS_CFACKPOLL	0xf0	/* QoS CF-Ack +CF-Poll */
173 /* For type 11 Extension (IEEE80211_FC0_TYPE_EXT) */
174 #define	IEEE80211_FC0_SUBTYPE_DMG_BEACON	0x00	/* DMG Beacon */
175 #define	IEEE80211_FC0_SUBTYPE_S1G_BEACON	0x10	/* S1G Beacon */
176 /* 0010-1111 Reserved				0x20-0xff */
177 
178 /* 802.11-2020 Table 9-2-Control Frame Extension */
179 /* Reusing B11..B8, part of FC1 */
180 #define	IEEE80211_CTL_EXT_SECTOR_ACK		0x00	/* Sector Ack, 80211ay-2021 */
181 #define	IEEE80211_CTL_EXT_BA_SCHED		0x01	/* Block Ack Schedule, 80211ay-2021 */
182 #define	IEEE80211_CTL_EXT_POLL			0x02	/* Poll */
183 #define	IEEE80211_CTL_EXT_SPR			0x03	/* SPR */
184 #define	IEEE80211_CTL_EXT_GRANT			0x04	/* Grant */
185 #define	IEEE80211_CTL_EXT_DMG_CTS		0x05	/* DMG CTS */
186 #define	IEEE80211_CTL_EXT_DMG_DTS		0x06	/* DMG DTS */
187 #define	IEEE80211_CTL_EXT_GRANT_ACK		0x07	/* Grant Ack */
188 #define	IEEE80211_CTL_EXT_SSW			0x08	/* SSW */
189 #define	IEEE80211_CTL_EXT_SSW_FBACK		0x09	/* SSW-Feedback */
190 #define	IEEE80211_CTL_EXT_SSW_ACK		0x0a	/* SSW-Ack */
191 #define	IEEE80211_CTL_EXT_TDD_BF		0x0b	/* TDD Beamforming, 80211ay-2021 */
192 /* 1100-1111 Reserved				0xc-0xf */
193 
194 /* Check the version field */
195 #define	IEEE80211_IS_FC0_CHECK_VER(wh, v)			\
196 	(((wh)->i_fc[0] & IEEE80211_FC0_VERSION_MASK) == (v))
197 
198 /* Check the version and type field */
199 #define	IEEE80211_IS_FC0_CHECK_VER_TYPE(wh, v, t)			\
200 	(((((wh)->i_fc[0] & IEEE80211_FC0_VERSION_MASK) == (v))) &&	\
201 	  (((wh)->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == (t)))
202 
203 /* Check the version, type and subtype field */
204 #define	IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh, v, t, st)		\
205 	(((((wh)->i_fc[0] & IEEE80211_FC0_VERSION_MASK) == (v))) &&	\
206 	  (((wh)->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == (t)) &&		\
207 	  (((wh)->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == (st)))
208 
209 #define	IEEE80211_IS_MGMT(wh)						\
210 	(IEEE80211_IS_FC0_CHECK_VER_TYPE(wh, IEEE80211_FC0_VERSION_0,	\
211 	 IEEE80211_FC0_TYPE_MGT))
212 #define	IEEE80211_IS_CTL(wh)					\
213 	(IEEE80211_IS_FC0_CHECK_VER_TYPE(wh, IEEE80211_FC0_VERSION_0,	\
214 	 IEEE80211_FC0_TYPE_CTL))
215 #define	IEEE80211_IS_DATA(wh)					\
216 	(IEEE80211_IS_FC0_CHECK_VER_TYPE(wh, IEEE80211_FC0_VERSION_0,	\
217 	 IEEE80211_FC0_TYPE_DATA))
218 #define	IEEE80211_IS_EXT(wh)					\
219 	(IEEE80211_IS_FC0_CHECK_VER_TYPE(wh, IEEE80211_FC0_VERSION_0,	\
220 	 IEEE80211_FC0_TYPE_EXT))
221 
222 /* Management frame types */
223 
224 #define	IEEE80211_IS_MGMT_BEACON(wh)			\
225 	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
226 	 IEEE80211_FC0_VERSION_0,			\
227 	 IEEE80211_FC0_TYPE_MGT,			\
228 	 IEEE80211_FC0_SUBTYPE_BEACON))
229 
230 #define	IEEE80211_IS_MGMT_PROBE_RESP(wh)		\
231 	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
232 	 IEEE80211_FC0_VERSION_0,			\
233 	 IEEE80211_FC0_TYPE_MGT,			\
234 	 IEEE80211_FC0_SUBTYPE_PROBE_RESP))
235 
236 #define	IEEE80211_IS_MGMT_ACTION(wh)		\
237 	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
238 	 IEEE80211_FC0_VERSION_0,			\
239 	 IEEE80211_FC0_TYPE_MGT,			\
240 	 IEEE80211_FC0_SUBTYPE_ACTION))
241 
242 /* Control frame types */
243 
244 #define	IEEE80211_IS_CTL_PS_POLL(wh)			\
245 	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
246 	 IEEE80211_FC0_VERSION_0,			\
247 	 IEEE80211_FC0_TYPE_CTL,			\
248 	 IEEE80211_FC0_SUBTYPE_PS_POLL))
249 
250 #define	IEEE80211_IS_CTL_BAR(wh)			\
251 	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
252 	 IEEE80211_FC0_VERSION_0,			\
253 	 IEEE80211_FC0_TYPE_CTL,			\
254 	 IEEE80211_FC0_SUBTYPE_BAR))
255 
256 /* Data frame types */
257 
258 /*
259  * Return true if the frame is any of the QOS frame types, not just
260  * data frames.  Matching on the IEEE80211_FC0_SUBTYPE_QOS_ANY bit
261  * being set also matches on subtypes 8..15.
262  */
263 #define	IEEE80211_IS_QOS_ANY(wh)					\
264 	((IEEE80211_IS_FC0_CHECK_VER_TYPE(wh, IEEE80211_FC0_VERSION_0,	\
265 	 IEEE80211_FC0_TYPE_DATA)) &&					\
266 	 ((wh)->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS_MASK_ANY))
267 
268 /*
269  * Return true if this frame is QOS data, and only QOS data.
270  */
271 #define	IEEE80211_IS_QOSDATA(wh)			\
272 	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
273 	 IEEE80211_FC0_VERSION_0,			\
274 	 IEEE80211_FC0_TYPE_DATA,			\
275 	 IEEE80211_FC0_SUBTYPE_QOS_DATA))
276 
277 /*
278  * Return true if this frame is a QoS NULL data frame.
279  */
280 #define	IEEE80211_IS_QOS_NULL(wh)			\
281 	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
282 	 IEEE80211_FC0_VERSION_0,			\
283 	 IEEE80211_FC0_TYPE_DATA,			\
284 	 IEEE80211_FC0_SUBTYPE_QOS_NULL))
285 
286 
287 #define	IEEE80211_FC1_DIR_MASK			0x03
288 #define	IEEE80211_FC1_DIR_NODS			0x00	/* STA->STA */
289 #define	IEEE80211_FC1_DIR_TODS			0x01	/* STA->AP  */
290 #define	IEEE80211_FC1_DIR_FROMDS		0x02	/* AP ->STA */
291 #define	IEEE80211_FC1_DIR_DSTODS		0x03	/* AP ->AP  */
292 
293 #define	IEEE80211_IS_DSTODS(wh) \
294 	(((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
295 
296 #define	IEEE80211_FC1_MORE_FRAG			0x04
297 #define	IEEE80211_FC1_RETRY			0x08
298 #define	IEEE80211_FC1_PWR_MGT			0x10
299 #define	IEEE80211_FC1_MORE_DATA			0x20
300 #define	IEEE80211_FC1_PROTECTED			0x40
301 #define	IEEE80211_FC1_ORDER			0x80
302 
303 #define	IEEE80211_IS_PROTECTED(wh) \
304 	((wh)->i_fc[1] & IEEE80211_FC1_PROTECTED)
305 
306 #define IEEE80211_HAS_SEQ(type, subtype) \
307 	((type) != IEEE80211_FC0_TYPE_CTL && \
308 	!((type) == IEEE80211_FC0_TYPE_DATA && \
309 	 ((subtype) & IEEE80211_FC0_SUBTYPE_QOS_NULL) == \
310 		      IEEE80211_FC0_SUBTYPE_QOS_NULL))
311 #define	IEEE80211_SEQ_FRAG_MASK			0x000f
312 #define	IEEE80211_SEQ_FRAG_SHIFT		0
313 #define	IEEE80211_SEQ_SEQ_MASK			0xfff0
314 #define	IEEE80211_SEQ_SEQ_SHIFT			4
315 #define	IEEE80211_SEQ_RANGE			4096
316 
317 #define	IEEE80211_SEQ_ADD(seq, incr) \
318 	(((seq) + (incr)) & (IEEE80211_SEQ_RANGE-1))
319 #define	IEEE80211_SEQ_INC(seq)	IEEE80211_SEQ_ADD(seq,1)
320 #define	IEEE80211_SEQ_SUB(a, b) \
321 	(((a) + IEEE80211_SEQ_RANGE - (b)) & (IEEE80211_SEQ_RANGE-1))
322 
323 #define	IEEE80211_SEQ_BA_RANGE			2048	/* 2^11 */
324 #define	IEEE80211_SEQ_BA_BEFORE(a, b) \
325 	(IEEE80211_SEQ_SUB(b, a+1) < IEEE80211_SEQ_BA_RANGE-1)
326 
327 #define	IEEE80211_NWID_LEN			32
328 #define	IEEE80211_MESHID_LEN			32
329 
330 #define	IEEE80211_QOS_CTL_LEN			2
331 
332 #define	IEEE80211_QOS_TXOP			0x00ff
333 /* bit 8 is reserved */
334 #define	IEEE80211_QOS_AMSDU			0x80
335 #define	IEEE80211_QOS_AMSDU_S			7
336 #define	IEEE80211_QOS_ACKPOLICY			0x60
337 #define	IEEE80211_QOS_ACKPOLICY_S		5
338 #define	IEEE80211_QOS_ACKPOLICY_NOACK		0x20	/* No ACK required */
339 #define	IEEE80211_QOS_ACKPOLICY_BA		0x60	/* Block ACK */
340 #define	IEEE80211_QOS_EOSP			0x10	/* EndOfService Period*/
341 #define	IEEE80211_QOS_EOSP_S			4
342 #define	IEEE80211_QOS_TID			0x0f
343 /* qos[1] byte used for all frames sent by mesh STAs in a mesh BSS */
344 #define IEEE80211_QOS_MC			0x01	/* Mesh control */
345 /* Mesh power save level*/
346 #define IEEE80211_QOS_MESH_PSL			0x02
347 /* Mesh Receiver Service Period Initiated */
348 #define IEEE80211_QOS_RSPI			0x04
349 /* bits 11 to 15 reserved */
350 
351 /* does frame have QoS sequence control data */
352 #define	IEEE80211_QOS_HAS_SEQ(wh) \
353 	(((wh)->i_fc[0] & \
354 	  (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_QOS_DATA)) == \
355 	  (IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_QOS_DATA))
356 
357 /*
358  * WME/802.11e information element.
359  */
360 struct ieee80211_wme_info {
361 	uint8_t		wme_id;		/* IEEE80211_ELEMID_VENDOR */
362 	uint8_t		wme_len;	/* length in bytes */
363 	uint8_t		wme_oui[3];	/* 0x00, 0x50, 0xf2 */
364 	uint8_t		wme_type;	/* OUI type */
365 	uint8_t		wme_subtype;	/* OUI subtype */
366 	uint8_t		wme_version;	/* spec revision */
367 	uint8_t		wme_info;	/* QoS info */
368 } __packed;
369 
370 /*
371  * WME/802.11e Tspec Element
372  */
373 struct ieee80211_wme_tspec {
374 	uint8_t		ts_id;
375 	uint8_t		ts_len;
376 	uint8_t		ts_oui[3];
377 	uint8_t		ts_oui_type;
378 	uint8_t		ts_oui_subtype;
379 	uint8_t		ts_version;
380 	uint8_t		ts_tsinfo[3];
381 	uint8_t		ts_nom_msdu[2];
382 	uint8_t		ts_max_msdu[2];
383 	uint8_t		ts_min_svc[4];
384 	uint8_t		ts_max_svc[4];
385 	uint8_t		ts_inactv_intv[4];
386 	uint8_t		ts_susp_intv[4];
387 	uint8_t		ts_start_svc[4];
388 	uint8_t		ts_min_rate[4];
389 	uint8_t		ts_mean_rate[4];
390 	uint8_t		ts_max_burst[4];
391 	uint8_t		ts_min_phy[4];
392 	uint8_t		ts_peak_rate[4];
393 	uint8_t		ts_delay[4];
394 	uint8_t		ts_surplus[2];
395 	uint8_t		ts_medium_time[2];
396 } __packed;
397 
398 /*
399  * WME AC parameter field
400  */
401 struct ieee80211_wme_acparams {
402 	uint8_t		acp_aci_aifsn;
403 	uint8_t		acp_logcwminmax;
404 	uint16_t	acp_txop;
405 } __packed;
406 
407 #define WME_NUM_AC		4	/* 4 AC categories */
408 #define	WME_NUM_TID		16	/* 16 tids */
409 
410 #define WME_PARAM_ACI		0x60	/* Mask for ACI field */
411 #define WME_PARAM_ACI_S		5	/* Shift for ACI field */
412 #define WME_PARAM_ACM		0x10	/* Mask for ACM bit */
413 #define WME_PARAM_ACM_S		4	/* Shift for ACM bit */
414 #define WME_PARAM_AIFSN		0x0f	/* Mask for aifsn field */
415 #define WME_PARAM_AIFSN_S	0	/* Shift for aifsn field */
416 #define WME_PARAM_LOGCWMIN	0x0f	/* Mask for CwMin field (in log) */
417 #define WME_PARAM_LOGCWMIN_S	0	/* Shift for CwMin field */
418 #define WME_PARAM_LOGCWMAX	0xf0	/* Mask for CwMax field (in log) */
419 #define WME_PARAM_LOGCWMAX_S	4	/* Shift for CwMax field */
420 
421 #define WME_AC_TO_TID(_ac) (       \
422 	((_ac) == WME_AC_VO) ? 6 : \
423 	((_ac) == WME_AC_VI) ? 5 : \
424 	((_ac) == WME_AC_BK) ? 1 : \
425 	0)
426 
427 #define TID_TO_WME_AC(_tid) (      \
428 	((_tid) == 0 || (_tid) == 3) ? WME_AC_BE : \
429 	((_tid) < 3) ? WME_AC_BK : \
430 	((_tid) < 6) ? WME_AC_VI : \
431 	WME_AC_VO)
432 
433 /*
434  * WME Parameter Element
435  */
436 struct ieee80211_wme_param {
437 	uint8_t		param_id;
438 	uint8_t		param_len;
439 	uint8_t		param_oui[3];
440 	uint8_t		param_oui_type;
441 	uint8_t		param_oui_subtype;
442 	uint8_t		param_version;
443 	uint8_t		param_qosInfo;
444 #define	WME_QOSINFO_COUNT	0x0f	/* Mask for param count field */
445 	uint8_t		param_reserved;
446 	struct ieee80211_wme_acparams	params_acParams[WME_NUM_AC];
447 } __packed;
448 
449 /*
450  * WME U-APSD qos info field defines
451  */
452 #define	WME_CAPINFO_UAPSD_EN                    0x00000080
453 #define	WME_CAPINFO_UAPSD_VO                    0x00000001
454 #define	WME_CAPINFO_UAPSD_VI                    0x00000002
455 #define	WME_CAPINFO_UAPSD_BK                    0x00000004
456 #define	WME_CAPINFO_UAPSD_BE                    0x00000008
457 #define	WME_CAPINFO_UAPSD_ACFLAGS_SHIFT         0
458 #define	WME_CAPINFO_UAPSD_ACFLAGS_MASK          0xF
459 #define	WME_CAPINFO_UAPSD_MAXSP_SHIFT           5
460 #define	WME_CAPINFO_UAPSD_MAXSP_MASK            0x3
461 #define	WME_CAPINFO_IE_OFFSET                   8
462 #define	WME_UAPSD_MAXSP(_qosinfo)				\
463 	    (((_qosinfo) >> WME_CAPINFO_UAPSD_MAXSP_SHIFT) &	\
464 	    WME_CAPINFO_UAPSD_MAXSP_MASK)
465 #define	WME_UAPSD_AC_ENABLED(_ac, _qosinfo)			\
466 	    ((1 << (3 - (_ac))) & (				\
467 	    ((_qosinfo) >> WME_CAPINFO_UAPSD_ACFLAGS_SHIFT) &	\
468 	    WME_CAPINFO_UAPSD_ACFLAGS_MASK))
469 
470 /*
471  * Management Notification Frame
472  */
473 struct ieee80211_mnf {
474 	uint8_t		mnf_category;
475 	uint8_t		mnf_action;
476 	uint8_t		mnf_dialog;
477 	uint8_t		mnf_status;
478 } __packed;
479 #define	MNF_SETUP_REQ	0
480 #define	MNF_SETUP_RESP	1
481 #define	MNF_TEARDOWN	2
482 
483 /*
484  * 802.11n Management Action Frames
485  */
486 /* generic frame format */
487 struct ieee80211_action {
488 	uint8_t		ia_category;
489 	uint8_t		ia_action;
490 } __packed;
491 
492 /* 80211-2020 Table 9-51-Category values */
493 #define	IEEE80211_ACTION_CAT_SM			0	/* 9.6.2 Spectrum Management */
494 #define	IEEE80211_ACTION_CAT_QOS		1	/* 9.6.3 QoS */
495 /* Reserved					2	was IEEE80211_ACTION_CAT_DLS */
496 #define	IEEE80211_ACTION_CAT_BA			3	/* 9.6.4 Block Ack */
497 #define	IEEE80211_ACTION_CAT_PUBLIC		4	/* 9.6.7 Public */
498 #define	IEEE80211_ACTION_CAT_RADIO_MEASUREMENT	5	/* 9.6.6 Radio Measurement */
499 #define	IEEE80211_ACTION_CAT_FAST_BSS_TRANSITION 6	/* 9.6.8 Fast BSS Transition */
500 #define	IEEE80211_ACTION_CAT_HT			7	/* 9.6.11 HT */
501 #define	IEEE80211_ACTION_CAT_SA_QUERY		8	/* 9.6.9 SA Query */
502 #define	IEEE80211_ACTION_CAT_PROTECTED_DUAL_OF_PUBLIC_ACTION 9 /* 9.6.10 Protected Dual of Public Action */
503 #define	IEEE80211_ACTION_CAT_WNM		10	/* 9.6.13 WNM */
504 #define	IEEE80211_ACTION_CAT_UNPROTECTED_WNM	11	/* 9.6.14 Unprotected WNM */
505 #define	IEEE80211_ACTION_CAT_TDLS		12	/* 9.6.12 TDLS */
506 #define	IEEE80211_ACTION_CAT_MESH		13	/* 9.6.16 Mesh */
507 #define	IEEE80211_ACTION_CAT_MULTIHOP		14	/* 9.6.17 Multihop */
508 #define	IEEE80211_ACTION_CAT_SELF_PROT		15	/* 9.6.15 Self-protected */
509 #define	IEEE80211_ACTION_CAT_DMG		16	/* 9.6.19 DMG */
510 /* Reserved					17	(R)Wi-Fi Alliance */
511 #define	IEEE80211_ACTION_CAT_FAST_SESSION_TRANSFER 18	/* 9.6.20 Fast Session Transfer */
512 #define	IEEE80211_ACTION_CAT_ROBUST_AV_STREAMING 19	/* 9.6.18 Robust AV Streaming */
513 #define	IEEE80211_ACTION_CAT_UNPROTECTED_DMG	20	/* 9.6.21 Unprotected DMG */
514 #define	IEEE80211_ACTION_CAT_VHT		21	/* 9.6.22 VHT */
515 #define	IEEE80211_ACTION_CAT_UNPROTECTED_S1G	22	/* 9.6.24 Unprotected S1G */
516 #define	IEEE80211_ACTION_CAT_S1G		23	/* 9.6.25 S1G */
517 #define	IEEE80211_ACTION_CAT_FLOW_CONTROL	24	/* 9.6.26 Flow Control */
518 #define	IEEE80211_ACTION_CAT_CTL_RESP_MCS_NEG	25	/* 9.6.27 Control Response MCS Negotiation */
519 #define	IEEE80211_ACTION_CAT_FILS		26	/* 9.6.23 FILS */
520 #define	IEEE80211_ACTION_CAT_CDMG		27	/* 9.6.28 CDMG */
521 #define	IEEE80211_ACTION_CAT_CMMG		28	/* 9.6.29 CMMG */
522 #define	IEEE80211_ACTION_CAT_GLK		29	/* 9.6.30 GLK */
523 #define	IEEE80211_ACTION_CAT_HE			30	/* 9.6.31 HE, 80211ax-2021 */
524 #define	IEEE80211_ACTION_CAT_PROTECTED_HE	31	/* 9.6.32 Protected HE, 80211ax-2021 */
525 /* Reserved					32-125 */
526 #define	IEEE80211_ACTION_CAT_VENDOR_SPECIFIC_PROTECTED 126 /* 9.6.5 Vendor-specific Protected */
527 #define	IEEE80211_ACTION_CAT_VENDOR		127	/* 9.6.5 Vendor-specific */
528 /* Error					128-255 */
529 
530 
531 /* 80211-2020 Table 9-346-Spectrum Management Action field values */
532 enum ieee80211_action_sm {
533 	IEEE80211_ACTION_SM_SMREQ		= 0,	/* Spectrum Measurement Request */
534 	IEEE80211_ACTION_SM_SMREP		= 1,	/* Spectrum Measurement Report */
535 	IEEE80211_ACTION_SM_TPCREQ		= 2,	/* TPC Request */
536 	IEEE80211_ACTION_SM_TPCREP		= 3,	/* TPC Report */
537 	IEEE80211_ACTION_SM_CSA			= 4,	/* Channel Switch Announcement */
538 	/* Reserved				= 5-255 */
539 };
540 
541 /* 80211-2020 Table 9-363-Radio Measurement Action field values */
542 enum ieee80211_action_radio_measurement {
543 	IEEE80211_ACTION_RADIO_MEASUREMENT_RMREQ	= 0,	/* Radio Measurement Request */
544 	IEEE80211_ACTION_RADIO_MEASUREMENT_RMREP	= 1,	/* Radio Measurement Report */
545 	IEEE80211_ACTION_RADIO_MEASUREMENT_LMREQ	= 2,	/* Link Measurement Request */
546 	IEEE80211_ACTION_RADIO_MEASUREMENT_LMREP	= 3,	/* Link Measurement Report */
547 	IEEE80211_ACTION_RADIO_MEASUREMENT_NRREQ	= 4,	/* Neighbor Report Request */
548 	IEEE80211_ACTION_RADIO_MEASUREMENT_NRRESP	= 5,	/* Neighbor Report Response */
549 	/* Reserved					= 6-255 */
550 };
551 
552 #define	IEEE80211_ACTION_HT_TXCHWIDTH	0	/* recommended xmit chan width*/
553 #define	IEEE80211_ACTION_HT_MIMOPWRSAVE	1	/* MIMO power save */
554 
555 /* HT - recommended transmission channel width */
556 struct ieee80211_action_ht_txchwidth {
557 	struct ieee80211_action	at_header;
558 	uint8_t		at_chwidth;
559 } __packed;
560 
561 #define	IEEE80211_A_HT_TXCHWIDTH_20	0
562 #define	IEEE80211_A_HT_TXCHWIDTH_2040	1
563 
564 /* HT - MIMO Power Save (NB: D2.04) */
565 struct ieee80211_action_ht_mimopowersave {
566 	struct ieee80211_action am_header;
567 	uint8_t		am_control;
568 } __packed;
569 
570 #define	IEEE80211_A_HT_MIMOPWRSAVE_ENA		0x01	/* PS enabled */
571 #define	IEEE80211_A_HT_MIMOPWRSAVE_MODE		0x02
572 #define	IEEE80211_A_HT_MIMOPWRSAVE_MODE_S	1
573 #define	IEEE80211_A_HT_MIMOPWRSAVE_DYNAMIC	0x02	/* Dynamic Mode */
574 #define	IEEE80211_A_HT_MIMOPWRSAVE_STATIC	0x00	/* no SM packets */
575 /* bits 2-7 reserved */
576 
577 /* Block Ack actions */
578 #define IEEE80211_ACTION_BA_ADDBA_REQUEST       0   /* ADDBA request */
579 #define IEEE80211_ACTION_BA_ADDBA_RESPONSE      1   /* ADDBA response */
580 #define IEEE80211_ACTION_BA_DELBA	        2   /* DELBA */
581 
582 /* Block Ack Parameter Set */
583 #define	IEEE80211_BAPS_BUFSIZ	0xffc0		/* buffer size */
584 #define	IEEE80211_BAPS_BUFSIZ_S	6
585 #define	IEEE80211_BAPS_TID	0x003c		/* TID */
586 #define	IEEE80211_BAPS_TID_S	2
587 #define	IEEE80211_BAPS_POLICY	0x0002		/* block ack policy */
588 #define	IEEE80211_BAPS_POLICY_S	1
589 #define	IEEE80211_BAPS_AMSDU	0x0001		/* A-MSDU permitted */
590 #define	IEEE80211_BAPS_AMSDU_S	0
591 
592 #define	IEEE80211_BAPS_POLICY_DELAYED	(0<<IEEE80211_BAPS_POLICY_S)
593 #define	IEEE80211_BAPS_POLICY_IMMEDIATE	(1<<IEEE80211_BAPS_POLICY_S)
594 
595 /* Block Ack Sequence Control */
596 #define	IEEE80211_BASEQ_START	0xfff0		/* starting seqnum */
597 #define	IEEE80211_BASEQ_START_S	4
598 #define	IEEE80211_BASEQ_FRAG	0x000f		/* fragment number */
599 #define	IEEE80211_BASEQ_FRAG_S	0
600 
601 /* Delayed Block Ack Parameter Set */
602 #define	IEEE80211_DELBAPS_TID	0xf000		/* TID */
603 #define	IEEE80211_DELBAPS_TID_S	12
604 #define	IEEE80211_DELBAPS_INIT	0x0800		/* initiator */
605 #define	IEEE80211_DELBAPS_INIT_S 11
606 
607 /* BA - ADDBA request */
608 struct ieee80211_action_ba_addbarequest {
609 	struct ieee80211_action rq_header;
610 	uint8_t		rq_dialogtoken;
611 	uint16_t	rq_baparamset;
612 	uint16_t	rq_batimeout;		/* in TUs */
613 	uint16_t	rq_baseqctl;
614 } __packed;
615 
616 /* BA - ADDBA response */
617 struct ieee80211_action_ba_addbaresponse {
618 	struct ieee80211_action rs_header;
619 	uint8_t		rs_dialogtoken;
620 	uint16_t	rs_statuscode;
621 	uint16_t	rs_baparamset;
622 	uint16_t	rs_batimeout;		/* in TUs */
623 } __packed;
624 
625 /* BA - DELBA */
626 struct ieee80211_action_ba_delba {
627 	struct ieee80211_action dl_header;
628 	uint16_t	dl_baparamset;
629 	uint16_t	dl_reasoncode;
630 } __packed;
631 
632 /* BAR Control */
633 #define	IEEE80211_BAR_TID	0xf000		/* TID */
634 #define	IEEE80211_BAR_TID_S	12
635 #define	IEEE80211_BAR_COMP	0x0004		/* Compressed Bitmap */
636 #define	IEEE80211_BAR_MTID	0x0002		/* Multi-TID */
637 #define	IEEE80211_BAR_NOACK	0x0001		/* No-Ack policy */
638 
639 /* BAR Starting Sequence Control */
640 #define	IEEE80211_BAR_SEQ_START	0xfff0		/* starting seqnum */
641 #define	IEEE80211_BAR_SEQ_START_S	4
642 
643 struct ieee80211_ba_request {
644 	uint16_t	rq_barctl;
645 	uint16_t	rq_barseqctl;
646 } __packed;
647 
648 /*
649  * Control frames.
650  */
651 struct ieee80211_frame_min {
652 	uint8_t		i_fc[2];
653 	uint8_t		i_dur[2];
654 	uint8_t		i_addr1[IEEE80211_ADDR_LEN];
655 	uint8_t		i_addr2[IEEE80211_ADDR_LEN];
656 	/* FCS */
657 } __packed;
658 
659 struct ieee80211_frame_rts {
660 	uint8_t		i_fc[2];
661 	uint8_t		i_dur[2];
662 	uint8_t		i_ra[IEEE80211_ADDR_LEN];
663 	uint8_t		i_ta[IEEE80211_ADDR_LEN];
664 	/* FCS */
665 } __packed;
666 
667 struct ieee80211_frame_cts {
668 	uint8_t		i_fc[2];
669 	uint8_t		i_dur[2];
670 	uint8_t		i_ra[IEEE80211_ADDR_LEN];
671 	/* FCS */
672 } __packed;
673 
674 struct ieee80211_frame_ack {
675 	uint8_t		i_fc[2];
676 	uint8_t		i_dur[2];
677 	uint8_t		i_ra[IEEE80211_ADDR_LEN];
678 	/* FCS */
679 } __packed;
680 
681 struct ieee80211_frame_pspoll {
682 	uint8_t		i_fc[2];
683 	uint8_t		i_aid[2];
684 	uint8_t		i_bssid[IEEE80211_ADDR_LEN];
685 	uint8_t		i_ta[IEEE80211_ADDR_LEN];
686 	/* FCS */
687 } __packed;
688 
689 struct ieee80211_frame_cfend {		/* NB: also CF-End+CF-Ack */
690 	uint8_t		i_fc[2];
691 	uint8_t		i_dur[2];	/* should be zero */
692 	uint8_t		i_ra[IEEE80211_ADDR_LEN];
693 	uint8_t		i_bssid[IEEE80211_ADDR_LEN];
694 	/* FCS */
695 } __packed;
696 
697 struct ieee80211_frame_bar {
698 	uint8_t		i_fc[2];
699 	uint8_t		i_dur[2];
700 	uint8_t		i_ra[IEEE80211_ADDR_LEN];
701 	uint8_t		i_ta[IEEE80211_ADDR_LEN];
702 	uint16_t	i_ctl;
703 	uint16_t	i_seq;
704 	/* FCS */
705 } __packed;
706 
707 /*
708  * BEACON management packets
709  *
710  *	octet timestamp[8]
711  *	octet beacon interval[2]
712  *	octet capability information[2]
713  *	information element
714  *		octet elemid
715  *		octet length
716  *		octet information[length]
717  */
718 
719 #define	IEEE80211_BEACON_INTERVAL(beacon) \
720 	((beacon)[8] | ((beacon)[9] << 8))
721 #define	IEEE80211_BEACON_CAPABILITY(beacon) \
722 	((beacon)[10] | ((beacon)[11] << 8))
723 
724 #define	IEEE80211_CAPINFO_ESS			0x0001
725 #define	IEEE80211_CAPINFO_IBSS			0x0002
726 #define	IEEE80211_CAPINFO_CF_POLLABLE		0x0004
727 #define	IEEE80211_CAPINFO_CF_POLLREQ		0x0008
728 #define	IEEE80211_CAPINFO_PRIVACY		0x0010
729 #define	IEEE80211_CAPINFO_SHORT_PREAMBLE	0x0020
730 #define	IEEE80211_CAPINFO_PBCC			0x0040
731 #define	IEEE80211_CAPINFO_CHNL_AGILITY		0x0080
732 #define	IEEE80211_CAPINFO_SPECTRUM_MGMT		0x0100
733 /* bit 9 is reserved */
734 #define	IEEE80211_CAPINFO_SHORT_SLOTTIME	0x0400
735 #define	IEEE80211_CAPINFO_RSN			0x0800
736 /* bit 12 is reserved */
737 #define	IEEE80211_CAPINFO_DSSSOFDM		0x2000
738 /* bits 14-15 are reserved */
739 
740 #define	IEEE80211_CAPINFO_BITS \
741 	"\20\1ESS\2IBSS\3CF_POLLABLE\4CF_POLLREQ\5PRIVACY\6SHORT_PREAMBLE" \
742 	"\7PBCC\10CHNL_AGILITY\11SPECTRUM_MGMT\13SHORT_SLOTTIME\14RSN" \
743 	"\16DSSOFDM"
744 
745 /*
746  * 802.11i/WPA information element (maximally sized).
747  */
748 struct ieee80211_ie_wpa {
749 	uint8_t		wpa_id;		/* IEEE80211_ELEMID_VENDOR */
750 	uint8_t		wpa_len;	/* length in bytes */
751 	uint8_t		wpa_oui[3];	/* 0x00, 0x50, 0xf2 */
752 	uint8_t		wpa_type;	/* OUI type */
753 	uint16_t	wpa_version;	/* spec revision */
754 	uint32_t	wpa_mcipher[1];	/* multicast/group key cipher */
755 	uint16_t	wpa_uciphercnt;	/* # pairwise key ciphers */
756 	uint32_t	wpa_uciphers[8];/* ciphers */
757 	uint16_t	wpa_authselcnt;	/* authentication selector cnt*/
758 	uint32_t	wpa_authsels[8];/* selectors */
759 	uint16_t	wpa_caps;	/* 802.11i capabilities */
760 	uint16_t	wpa_pmkidcnt;	/* 802.11i pmkid count */
761 	uint16_t	wpa_pmkids[8];	/* 802.11i pmkids */
762 } __packed;
763 
764 /*
765  * 802.11n HT Capability IE
766  * NB: these reflect D1.10
767  */
768 struct ieee80211_ie_htcap {
769 	uint8_t		hc_id;			/* element ID */
770 	uint8_t		hc_len;			/* length in bytes */
771 	uint16_t	hc_cap;			/* HT caps (see below) */
772 	uint8_t		hc_param;		/* HT params (see below) */
773 	uint8_t 	hc_mcsset[16]; 		/* supported MCS set */
774 	uint16_t	hc_extcap;		/* extended HT capabilities */
775 	uint32_t	hc_txbf;		/* txbf capabilities */
776 	uint8_t		hc_antenna;		/* antenna capabilities */
777 } __packed;
778 
779 /* HT capability flags (ht_cap) */
780 #define	IEEE80211_HTCAP_LDPC		0x0001	/* LDPC rx supported */
781 #define	IEEE80211_HTCAP_CHWIDTH40	0x0002	/* 20/40 supported */
782 #define	IEEE80211_HTCAP_SMPS		0x000c	/* SM Power Save mode */
783 #define	IEEE80211_HTCAP_SMPS_OFF	0x000c	/* disabled */
784 #define	IEEE80211_HTCAP_SMPS_DYNAMIC	0x0004	/* send RTS first */
785 /* NB: SMPS value 2 is reserved */
786 #define	IEEE80211_HTCAP_SMPS_ENA	0x0000	/* enabled (static mode) */
787 #define	IEEE80211_HTCAP_GREENFIELD	0x0010	/* Greenfield supported */
788 #define	IEEE80211_HTCAP_SHORTGI20	0x0020	/* Short GI in 20MHz */
789 #define	IEEE80211_HTCAP_SHORTGI40	0x0040	/* Short GI in 40MHz */
790 #define	IEEE80211_HTCAP_TXSTBC		0x0080	/* STBC tx ok */
791 #define	IEEE80211_HTCAP_RXSTBC		0x0300  /* STBC rx support */
792 #define	IEEE80211_HTCAP_RXSTBC_S	8
793 #define	IEEE80211_HTCAP_RXSTBC_1STREAM	0x0100  /* 1 spatial stream */
794 #define	IEEE80211_HTCAP_RXSTBC_2STREAM	0x0200  /* 1-2 spatial streams*/
795 #define	IEEE80211_HTCAP_RXSTBC_3STREAM	0x0300  /* 1-3 spatial streams*/
796 #define	IEEE80211_HTCAP_DELBA		0x0400	/* HT DELBA supported */
797 #define	IEEE80211_HTCAP_MAXAMSDU	0x0800	/* max A-MSDU length */
798 #define	IEEE80211_HTCAP_MAXAMSDU_7935	0x0800	/* 7935 octets */
799 #define	IEEE80211_HTCAP_MAXAMSDU_3839	0x0000	/* 3839 octets */
800 #define	IEEE80211_HTCAP_DSSSCCK40	0x1000  /* DSSS/CCK in 40MHz */
801 #define	IEEE80211_HTCAP_PSMP		0x2000  /* PSMP supported */
802 #define	IEEE80211_HTCAP_40INTOLERANT	0x4000  /* 40MHz intolerant */
803 #define	IEEE80211_HTCAP_LSIGTXOPPROT	0x8000  /* L-SIG TXOP prot */
804 
805 #define	IEEE80211_HTCAP_BITS \
806 	"\20\1LDPC\2CHWIDTH40\5GREENFIELD\6SHORTGI20\7SHORTGI40\10TXSTBC" \
807 	"\13DELBA\14AMSDU(7935)\15DSSSCCK40\16PSMP\1740INTOLERANT" \
808 	"\20LSIGTXOPPROT"
809 
810 /* HT parameters (hc_param) */
811 #define	IEEE80211_HTCAP_MAXRXAMPDU	0x03	/* max rx A-MPDU factor */
812 #define	IEEE80211_HTCAP_MAXRXAMPDU_S	0
813 #define	IEEE80211_HTCAP_MAXRXAMPDU_8K	0
814 #define	IEEE80211_HTCAP_MAXRXAMPDU_16K	1
815 #define	IEEE80211_HTCAP_MAXRXAMPDU_32K	2
816 #define	IEEE80211_HTCAP_MAXRXAMPDU_64K	3
817 #define	IEEE80211_HTCAP_MPDUDENSITY	0x1c	/* min MPDU start spacing */
818 #define	IEEE80211_HTCAP_MPDUDENSITY_S	2
819 #define	IEEE80211_HTCAP_MPDUDENSITY_NA	0	/* no time restriction */
820 #define	IEEE80211_HTCAP_MPDUDENSITY_025	1	/* 1/4 us */
821 #define	IEEE80211_HTCAP_MPDUDENSITY_05	2	/* 1/2 us */
822 #define	IEEE80211_HTCAP_MPDUDENSITY_1	3	/* 1 us */
823 #define	IEEE80211_HTCAP_MPDUDENSITY_2	4	/* 2 us */
824 #define	IEEE80211_HTCAP_MPDUDENSITY_4	5	/* 4 us */
825 #define	IEEE80211_HTCAP_MPDUDENSITY_8	6	/* 8 us */
826 #define	IEEE80211_HTCAP_MPDUDENSITY_16	7	/* 16 us */
827 
828 /* HT extended capabilities (hc_extcap) */
829 #define	IEEE80211_HTCAP_PCO		0x0001	/* PCO capable */
830 #define	IEEE80211_HTCAP_PCOTRANS	0x0006	/* PCO transition time */
831 #define	IEEE80211_HTCAP_PCOTRANS_S	1
832 #define	IEEE80211_HTCAP_PCOTRANS_04	0x0002	/* 400 us */
833 #define	IEEE80211_HTCAP_PCOTRANS_15	0x0004	/* 1.5 ms */
834 #define	IEEE80211_HTCAP_PCOTRANS_5	0x0006	/* 5 ms */
835 /* bits 3-7 reserved */
836 #define	IEEE80211_HTCAP_MCSFBACK	0x0300	/* MCS feedback */
837 #define	IEEE80211_HTCAP_MCSFBACK_S	8
838 #define	IEEE80211_HTCAP_MCSFBACK_NONE	0x0000	/* nothing provided */
839 #define	IEEE80211_HTCAP_MCSFBACK_UNSOL	0x0200	/* unsolicited feedback */
840 #define	IEEE80211_HTCAP_MCSFBACK_MRQ	0x0300	/* " "+respond to MRQ */
841 #define	IEEE80211_HTCAP_HTC		0x0400	/* +HTC support */
842 #define	IEEE80211_HTCAP_RDR		0x0800	/* reverse direction responder*/
843 /* bits 12-15 reserved */
844 
845 /*
846  * 802.11n HT Information IE
847  */
848 struct ieee80211_ie_htinfo {
849 	uint8_t		hi_id;			/* element ID */
850 	uint8_t		hi_len;			/* length in bytes */
851 	uint8_t		hi_ctrlchannel;		/* primary channel */
852 	uint8_t		hi_byte1;		/* ht ie byte 1 */
853 	uint8_t		hi_byte2;		/* ht ie byte 2 */
854 	uint8_t		hi_byte3;		/* ht ie byte 3 */
855 	uint16_t	hi_byte45;		/* ht ie bytes 4+5 */
856 	uint8_t 	hi_basicmcsset[16]; 	/* basic MCS set */
857 } __packed;
858 
859 /* byte1 */
860 #define	IEEE80211_HTINFO_2NDCHAN	0x03	/* secondary/ext chan offset */
861 #define	IEEE80211_HTINFO_2NDCHAN_S	0
862 #define	IEEE80211_HTINFO_2NDCHAN_NONE	0x00	/* no secondary/ext channel */
863 #define	IEEE80211_HTINFO_2NDCHAN_ABOVE	0x01	/* above private channel */
864 /* NB: 2 is reserved */
865 #define	IEEE80211_HTINFO_2NDCHAN_BELOW	0x03	/* below primary channel */
866 #define	IEEE80211_HTINFO_TXWIDTH	0x04	/* tx channel width */
867 #define	IEEE80211_HTINFO_TXWIDTH_20	0x00	/* 20MHz width */
868 #define	IEEE80211_HTINFO_TXWIDTH_2040	0x04	/* any supported width */
869 #define	IEEE80211_HTINFO_RIFSMODE	0x08	/* Reduced IFS (RIFS) use */
870 #define	IEEE80211_HTINFO_RIFSMODE_PROH	0x00	/* RIFS use prohibited */
871 #define	IEEE80211_HTINFO_RIFSMODE_PERM	0x08	/* RIFS use permitted */
872 #define	IEEE80211_HTINFO_PMSPONLY	0x10	/* PSMP required to associate */
873 #define	IEEE80211_HTINFO_SIGRAN		0xe0	/* shortest Service Interval */
874 #define	IEEE80211_HTINFO_SIGRAN_S	5
875 #define	IEEE80211_HTINFO_SIGRAN_5	0x00	/* 5 ms */
876 /* XXX add rest */
877 
878 /* bytes 2+3 */
879 #define	IEEE80211_HTINFO_OPMODE		0x03	/* operating mode */
880 #define	IEEE80211_HTINFO_OPMODE_S	0
881 #define	IEEE80211_HTINFO_OPMODE_PURE	0x00	/* no protection */
882 #define	IEEE80211_HTINFO_OPMODE_PROTOPT	0x01	/* protection optional */
883 #define	IEEE80211_HTINFO_OPMODE_HT20PR	0x02	/* protection for HT20 sta's */
884 #define	IEEE80211_HTINFO_OPMODE_MIXED	0x03	/* protection for legacy sta's*/
885 #define	IEEE80211_HTINFO_NONGF_PRESENT	0x04	/* non-GF sta's present */
886 #define	IEEE80211_HTINFO_TXBL		0x08	/* transmit burst limit */
887 #define	IEEE80211_HTINFO_NONHT_PRESENT	0x10	/* non-HT sta's present */
888 /* bits 5-15 reserved */
889 
890 /* bytes 4+5 */
891 #define	IEEE80211_HTINFO_2NDARYBEACON	0x01
892 #define	IEEE80211_HTINFO_LSIGTXOPPROT	0x02
893 #define	IEEE80211_HTINFO_PCO_ACTIVE	0x04
894 #define	IEEE80211_HTINFO_40MHZPHASE	0x08
895 
896 /* byte5 */
897 #define	IEEE80211_HTINFO_BASIC_STBCMCS	0x7f
898 #define	IEEE80211_HTINFO_BASIC_STBCMCS_S 0
899 #define	IEEE80211_HTINFO_DUALPROTECTED	0x80
900 
901 /*
902  * 802.11ac definitions - 802.11ac-2013 .
903  */
904 
905 /*
906  * Maximum length of A-MPDU that the STA can RX in VHT.
907  * Length = 2 ^ (13 + max_ampdu_length_exp) - 1 (octets)
908  */
909 #define	IEEE80211_VHTCAP_MAX_AMPDU_8K		0
910 #define	IEEE80211_VHTCAP_MAX_AMPDU_16K		1
911 #define	IEEE80211_VHTCAP_MAX_AMPDU_32K		2
912 #define	IEEE80211_VHTCAP_MAX_AMPDU_64K		3
913 #define	IEEE80211_VHTCAP_MAX_AMPDU_128K		4
914 #define	IEEE80211_VHTCAP_MAX_AMPDU_256K		5
915 #define	IEEE80211_VHTCAP_MAX_AMPDU_512K		6
916 #define	IEEE80211_VHTCAP_MAX_AMPDU_1024K	7
917 
918 /*
919  * VHT MCS information.
920  * + rx_highest/tx_highest: optional; maximum long GI VHT PPDU
921  *    data rate.  1Mbit/sec units.
922  * + rx_mcs_map/tx_mcs_map: bitmap of per-stream supported MCS;
923  *    2 bits each.
924  */
925 
926 /* 802.11ac-2013, 8.4.2.160.3 Supported VHT-MCS and NSS Set field */
927 enum ieee80211_vht_mcs_support {
928 	IEEE80211_VHT_MCS_SUPPORT_0_7		= 0,	/* MCS0-7 */
929 	IEEE80211_VHT_MCS_SUPPORT_0_8		= 1,	/* MCS0-8 */
930 	IEEE80211_VHT_MCS_SUPPORT_0_9		= 2,	/* MCS0-9 */
931 	IEEE80211_VHT_MCS_NOT_SUPPORTED		= 3	/* not supported */
932 };
933 
934 /* 802.11ac-2013, 8.4.2.160.3 Supported VHT-MCS and NSS Set field */
935 struct ieee80211_vht_mcs_info {
936 	uint16_t rx_mcs_map;
937 	uint16_t rx_highest;
938 	uint16_t tx_mcs_map;
939 	uint16_t tx_highest;
940 } __packed;
941 
942 /* 802.11ac-2013, 8.4.2.160.1 VHT Capabilities element structure */
943 struct ieee80211_vht_cap {
944 	uint32_t			vht_cap_info;
945 	struct ieee80211_vht_mcs_info	supp_mcs;
946 } __packed;
947 
948 /* 802.11ac-2013, Table 8-183x-VHT Operation Information subfields */
949 enum ieee80211_vht_chanwidth {
950 	IEEE80211_VHT_CHANWIDTH_USE_HT		= 0,	/* 20 MHz or 40 MHz */
951 	IEEE80211_VHT_CHANWIDTH_80MHZ		= 1,	/* 80MHz */
952 	IEEE80211_VHT_CHANWIDTH_160MHZ		= 2,	/* 160MHz */
953 	IEEE80211_VHT_CHANWIDTH_80P80MHZ	= 3,	/* 80+80MHz */
954 	/* 4..255 reserved. */
955 };
956 
957 /* The name conflicts with the same structure in wpa.  Only ifconfig needs this. */
958 #if defined(_KERNEL) || defined(WANT_NET80211)
959 /* 802.11ac-2013 8.4.2.161 VHT Operation element */
960 struct ieee80211_vht_operation {
961 	uint8_t			chan_width;		/* enum ieee80211_vht_chanwidth */
962 	uint8_t			center_freq_seq0_idx;	/* 20/40/80/160 - VHT chan1 */
963 	uint8_t			center_freq_seq1_idx;	/* 80+80 - VHT chan2 */
964 	uint16_t		basic_mcs_set;		/* Basic VHT-MCS and NSS Set */
965 } __packed;
966 #endif
967 
968 /* 802.11ac VHT Capabilities */
969 #define	IEEE80211_VHTCAP_MAX_MPDU_LENGTH_3895	0x00000000
970 #define	IEEE80211_VHTCAP_MAX_MPDU_LENGTH_7991	0x00000001
971 #define	IEEE80211_VHTCAP_MAX_MPDU_LENGTH_11454	0x00000002
972 #define	IEEE80211_VHTCAP_MAX_MPDU_MASK		0x00000003
973 #define	IEEE80211_VHTCAP_MAX_MPDU_MASK_S	0
974 
975 #define	IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_MASK	0x0000000C
976 #define	IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_MASK_S	2
977 #define	IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_NO160		0
978 #define	IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_160MHZ		1
979 #define	IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_160_80P80MHZ	2
980 #define	IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_RESERVED	3
981 
982 #define	IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_IS_160MHZ(_vhtcaps)		\
983     (_IEEE80211_MASKSHIFT(_vhtcaps, IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_MASK) >= \
984             IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_160MHZ)
985 #define	IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_IS_160_80P80MHZ(_vhtcaps)	\
986     (_IEEE80211_MASKSHIFT(_vhtcaps, IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_MASK) == \
987             IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_160_80P80MHZ)
988 
989 #define	IEEE80211_VHTCAP_RXLDPC		0x00000010
990 #define	IEEE80211_VHTCAP_RXLDPC_S	4
991 
992 #define	IEEE80211_VHTCAP_SHORT_GI_80		0x00000020
993 #define	IEEE80211_VHTCAP_SHORT_GI_80_S		5
994 
995 #define	IEEE80211_VHTCAP_SHORT_GI_160		0x00000040
996 #define	IEEE80211_VHTCAP_SHORT_GI_160_S		6
997 
998 #define	IEEE80211_VHTCAP_TXSTBC		0x00000080
999 #define	IEEE80211_VHTCAP_TXSTBC_S	7
1000 
1001 #define	IEEE80211_VHTCAP_RXSTBC_1		0x00000100
1002 #define	IEEE80211_VHTCAP_RXSTBC_2		0x00000200
1003 #define	IEEE80211_VHTCAP_RXSTBC_3		0x00000300
1004 #define	IEEE80211_VHTCAP_RXSTBC_4		0x00000400
1005 #define	IEEE80211_VHTCAP_RXSTBC_MASK		0x00000700
1006 #define	IEEE80211_VHTCAP_RXSTBC_MASK_S		8
1007 
1008 #define	IEEE80211_VHTCAP_SU_BEAMFORMER_CAPABLE	0x00000800
1009 #define	IEEE80211_VHTCAP_SU_BEAMFORMER_CAPABLE_S	11
1010 
1011 #define	IEEE80211_VHTCAP_SU_BEAMFORMEE_CAPABLE	0x00001000
1012 #define	IEEE80211_VHTCAP_SU_BEAMFORMEE_CAPABLE_S	12
1013 
1014 #define	IEEE80211_VHTCAP_BEAMFORMEE_STS_SHIFT	13
1015 #define	IEEE80211_VHTCAP_BEAMFORMEE_STS_MASK \
1016 	    (7 << IEEE80211_VHTCAP_BEAMFORMEE_STS_SHIFT)
1017 #define	IEEE80211_VHTCAP_BEAMFORMEE_STS_MASK_S	13
1018 
1019 #define	IEEE80211_VHTCAP_SOUNDING_DIMENSIONS_SHIFT	16
1020 #define	IEEE80211_VHTCAP_SOUNDING_DIMENSIONS_MASK \
1021 	    (7 << IEEE80211_VHTCAP_SOUNDING_DIMENSIONS_SHIFT)
1022 #define	IEEE80211_VHTCAP_SOUNDING_DIMENSIONS_MASK_S	16
1023 
1024 #define	IEEE80211_VHTCAP_MU_BEAMFORMER_CAPABLE	0x00080000
1025 #define	IEEE80211_VHTCAP_MU_BEAMFORMER_CAPABLE_S	19
1026 #define	IEEE80211_VHTCAP_MU_BEAMFORMEE_CAPABLE	0x00100000
1027 #define	IEEE80211_VHTCAP_MU_BEAMFORMEE_CAPABLE_S	20
1028 #define	IEEE80211_VHTCAP_VHT_TXOP_PS		0x00200000
1029 #define	IEEE80211_VHTCAP_VHT_TXOP_PS_S		21
1030 #define	IEEE80211_VHTCAP_HTC_VHT		0x00400000
1031 #define	IEEE80211_VHTCAP_HTC_VHT_S		22
1032 
1033 #define	IEEE80211_VHTCAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT	23
1034 #define	IEEE80211_VHTCAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK \
1035 	    (7 << IEEE80211_VHTCAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT)
1036 #define	IEEE80211_VHTCAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK_S	23
1037 
1038 #define	IEEE80211_VHTCAP_VHT_LINK_ADAPTATION_VHT_MASK	0x0c000000
1039 #define	IEEE80211_VHTCAP_VHT_LINK_ADAPTATION_VHT_UNSOL_MFB	0x08000000
1040 #define	IEEE80211_VHTCAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB	0x0c000000
1041 #define	IEEE80211_VHTCAP_VHT_LINK_ADAPTATION_VHT_MASK_S	26
1042 
1043 #define	IEEE80211_VHTCAP_RX_ANTENNA_PATTERN	0x10000000
1044 #define	IEEE80211_VHTCAP_RX_ANTENNA_PATTERN_S	28
1045 #define	IEEE80211_VHTCAP_TX_ANTENNA_PATTERN	0x20000000
1046 #define	IEEE80211_VHTCAP_TX_ANTENNA_PATTERN_S	29
1047 
1048 /*
1049  * XXX TODO: add the rest of the bits
1050  */
1051 #define	IEEE80211_VHTCAP_BITS \
1052 	"\20\1MPDU7991\2MPDU11454\3CHAN160\4CHAN8080\5RXLDPC\6SHORTGI80" \
1053 	"\7SHORTGI160\10RXSTBC1\11RXSTBC2\12RXSTBC3\13RXSTBC4\14BFERCAP" \
1054 	"\15BFEECAP\27VHT\37RXANTPTN\40TXANTPTN"
1055 
1056 /*
1057  * VHT Transmit Power Envelope element - 802.11ac-2013 8.4.2.164
1058  *
1059  * This defines the maximum transmit power for various bandwidths.
1060  */
1061 /*
1062  * Count is how many elements follow and what they're for:
1063  *
1064  * 0 - 20 MHz
1065  * 1 - 20+40 MHz
1066  * 2 - 20+40+80 MHz
1067  * 3 - 20+40+80+(160, 80+80) MHz
1068  */
1069 #define	IEEE80211_VHT_TXPWRENV_INFO_COUNT_SHIFT	0
1070 #define	IEEE80211_VHT_TXPWRENV_INFO_COUNT_MASK	0x07
1071 
1072 /*
1073  * Unit is the tx power representation.  It should be EIRP for now;
1074  * other values are reserved.
1075  */
1076 #define	IEEE80211_VHT_TXPWRENV_UNIT_MASK	0x38
1077 #define	IEEE80211_VHT_TXPWRENV_UNIT_SHIFT	3
1078 
1079 /* This value is within the unit mask/shift above */
1080 #define	IEEE80211_VHT_TXPWRENV_UNIT_EIRP	0
1081 
1082 struct ieee80211_ie_vht_txpwrenv {
1083 	uint8_t ie;
1084 	uint8_t len;
1085 	uint8_t tx_info;
1086 	int8_t tx_elem[0];	/* TX power elements, 1/2 dB, signed */
1087 };
1088 
1089 /* VHT action codes */
1090 #define	WLAN_ACTION_VHT_COMPRESSED_BF		0
1091 #define	WLAN_ACTION_VHT_GROUPID_MGMT		1
1092 #define	WLAN_ACTION_VHT_OPMODE_NOTIF		2
1093 
1094 /*
1095  * Management information element payloads.
1096  *
1097  * 802.11-2016 Table 9-77 (Element IDs).
1098  */
1099 
1100 enum {
1101 	IEEE80211_ELEMID_SSID		= 0,
1102 	IEEE80211_ELEMID_RATES		= 1,
1103 	IEEE80211_ELEMID_FHPARMS	= 2,
1104 	IEEE80211_ELEMID_DSPARMS	= 3,
1105 	IEEE80211_ELEMID_CFPARMS	= 4,
1106 	IEEE80211_ELEMID_TIM		= 5,
1107 	IEEE80211_ELEMID_IBSSPARMS	= 6,
1108 	IEEE80211_ELEMID_COUNTRY	= 7,
1109 	IEEE80211_ELEMID_BSSLOAD	= 11,
1110 	IEEE80211_ELEMID_TSPEC		= 13,
1111 	IEEE80211_ELEMID_TCLAS		= 14,
1112 	IEEE80211_ELEMID_CHALLENGE	= 16,
1113 	/* 17-31 reserved for challenge text extension */
1114 	IEEE80211_ELEMID_PWRCNSTR	= 32,
1115 	IEEE80211_ELEMID_PWRCAP		= 33,
1116 	IEEE80211_ELEMID_TPCREQ		= 34,
1117 	IEEE80211_ELEMID_TPCREP		= 35,
1118 	IEEE80211_ELEMID_SUPPCHAN	= 36,
1119 	IEEE80211_ELEMID_CSA		= 37,
1120 	IEEE80211_ELEMID_MEASREQ	= 38,
1121 	IEEE80211_ELEMID_MEASREP	= 39,
1122 	IEEE80211_ELEMID_QUIET		= 40,
1123 	IEEE80211_ELEMID_IBSSDFS	= 41,
1124 	IEEE80211_ELEMID_ERP		= 42,
1125 	IEEE80211_ELEMID_HTCAP		= 45,
1126 	IEEE80211_ELEMID_QOS		= 46,
1127 	IEEE80211_ELEMID_RESERVED_47	= 47,
1128 	IEEE80211_ELEMID_RSN		= 48,
1129 	IEEE80211_ELEMID_XRATES		= 50,
1130 	IEEE80211_ELEMID_APCHANREP	= 51,
1131 	IEEE80211_ELEMID_MOBILITY_DOMAIN	= 54,
1132 	IEEE80211_ELEMID_HTINFO		= 61,
1133 	IEEE80211_ELEMID_SECCHAN_OFFSET	= 62,
1134 	IEEE80211_ELEMID_RRM_ENACAPS	= 70,
1135 	IEEE80211_ELEMID_MULTIBSSID	= 71,
1136 	IEEE80211_ELEMID_COEX_2040	= 72,
1137 	IEEE80211_ELEMID_INTOL_CHN_REPORT	= 73,
1138 	IEEE80211_ELEMID_OVERLAP_BSS_SCAN_PARAM = 74,
1139 	IEEE80211_ELEMID_MMIC		= 76,
1140 	IEEE80211_ELEMID_TSF_REQ	= 91,
1141 	IEEE80211_ELEMID_TSF_RESP	= 92,
1142 	IEEE80211_ELEMID_WNM_SLEEP_MODE	= 93,
1143 	IEEE80211_ELEMID_TIM_BCAST_REQ	= 94,
1144 	IEEE80211_ELEMID_TIM_BCAST_RESP	= 95,
1145 	IEEE80211_ELEMID_TPC		= 150,
1146 	IEEE80211_ELEMID_CCKM		= 156,
1147 	IEEE80211_ELEMID_VENDOR		= 221,	/* vendor private */
1148 
1149 	/*
1150 	 * 802.11s IEs
1151 	 * NB: On vanilla Linux still IEEE80211_ELEMID_MESHPEER = 55,
1152 	 * but they defined a new with id 117 called PEER_MGMT.
1153 	 * NB: complies with open80211
1154 	 */
1155 	IEEE80211_ELEMID_MESHCONF	= 113,
1156 	IEEE80211_ELEMID_MESHID		= 114,
1157 	IEEE80211_ELEMID_MESHLINK	= 115,
1158 	IEEE80211_ELEMID_MESHCNGST	= 116,
1159 	IEEE80211_ELEMID_MESHPEER	= 117,
1160 	IEEE80211_ELEMID_MESHCSA	= 118,
1161 	IEEE80211_ELEMID_MESHTIM	= 39, /* XXX: remove */
1162 	IEEE80211_ELEMID_MESHAWAKEW	= 119,
1163 	IEEE80211_ELEMID_MESHBEACONT	= 120,
1164 	/* 121-124 MMCAOP not implemented yet */
1165 	IEEE80211_ELEMID_MESHGANN	= 125,
1166 	IEEE80211_ELEMID_MESHRANN	= 126,
1167 	/* 127 Extended Capabilities */
1168 	IEEE80211_ELEMID_EXTCAP		= 127,
1169 	/* 128-129 reserved */
1170 	IEEE80211_ELEMID_MESHPREQ	= 130,
1171 	IEEE80211_ELEMID_MESHPREP	= 131,
1172 	IEEE80211_ELEMID_MESHPERR	= 132,
1173 	/* 133-136 reserved */
1174 	IEEE80211_ELEMID_MESHPXU	= 137,
1175 	IEEE80211_ELEMID_MESHPXUC	= 138,
1176 	IEEE80211_ELEMID_MESHAH		= 60, /* XXX: remove */
1177 
1178 	/* 802.11ac-2013, Table 8-54-Element IDs */
1179 	IEEE80211_ELEMID_VHT_CAP	= 191,
1180 	IEEE80211_ELEMID_VHT_OPMODE	= 192,
1181 	IEEE80211_ELEMID_EXTENDED_BSS_LOAD = 193,
1182 	IEEE80211_ELEMID_WIDE_BW_CHANNEL_SWITCH = 194,
1183 	IEEE80211_ELEMID_VHT_PWR_ENV	= 195,
1184 	IEEE80211_ELEMID_CHANNEL_SWITCH_WRAPPER = 196,
1185 	IEEE80211_ELEMID_AID		= 197,
1186 	IEEE80211_ELEMID_QUIET_CHANNEL	= 198,
1187 	IEEE80211_ELEMID_OPMODE_NOTIF	= 199,
1188 };
1189 
1190 struct ieee80211_tim_ie {
1191 	uint8_t		tim_ie;			/* IEEE80211_ELEMID_TIM */
1192 	uint8_t		tim_len;
1193 	uint8_t		tim_count;		/* DTIM count */
1194 	uint8_t		tim_period;		/* DTIM period */
1195 	uint8_t		tim_bitctl;		/* bitmap control */
1196 	uint8_t		tim_bitmap[1];		/* variable-length bitmap */
1197 } __packed;
1198 
1199 struct ieee80211_country_ie {
1200 	uint8_t		ie;			/* IEEE80211_ELEMID_COUNTRY */
1201 	uint8_t		len;
1202 	uint8_t		cc[3];			/* ISO CC+(I)ndoor/(O)utdoor */
1203 	struct {
1204 		uint8_t schan;			/* starting channel */
1205 		uint8_t nchan;			/* number channels */
1206 		uint8_t maxtxpwr;		/* tx power cap */
1207 	} __packed band[1];			/* sub bands (NB: var size) */
1208 } __packed;
1209 
1210 #define	IEEE80211_COUNTRY_MAX_BANDS	84	/* max possible bands */
1211 #define	IEEE80211_COUNTRY_MAX_SIZE \
1212 	(sizeof(struct ieee80211_country_ie) + 3*(IEEE80211_COUNTRY_MAX_BANDS-1))
1213 
1214 struct ieee80211_bss_load_ie {
1215 	uint8_t		ie;
1216 	uint8_t		len;
1217 	uint16_t	sta_count;	/* station count */
1218 	uint8_t		chan_load;	/* channel utilization */
1219 	uint8_t		aac;		/* available admission capacity */
1220 } __packed;
1221 
1222 struct ieee80211_ap_chan_report_ie {
1223 	uint8_t		ie;
1224 	uint8_t		len;
1225 	uint8_t		i_class; /* operating class */
1226 	/* Annex E, E.1 Country information and operating classes */
1227 	uint8_t		chan_list[0];
1228 } __packed;
1229 
1230 #define IEEE80211_EXTCAP_CMS			(1ULL <<  0) /* 20/40 BSS coexistence management support */
1231 #define IEEE80211_EXTCAP_RSVD_1			(1ULL <<  1)
1232 #define IEEE80211_EXTCAP_ECS			(1ULL <<  2) /* extended channel switching */
1233 #define IEEE80211_EXTCAP_RSVD_3			(1ULL <<  3)
1234 #define IEEE80211_EXTCAP_PSMP_CAP		(1ULL <<  4) /* PSMP capability */
1235 #define IEEE80211_EXTCAP_RSVD_5			(1ULL <<  5)
1236 #define IEEE80211_EXTCAP_S_PSMP_SUPP		(1ULL <<  6)
1237 #define IEEE80211_EXTCAP_EVENT			(1ULL <<  7)
1238 #define IEEE80211_EXTCAP_DIAGNOSTICS		(1ULL <<  8)
1239 #define IEEE80211_EXTCAP_MCAST_DIAG		(1ULL <<  9)
1240 #define IEEE80211_EXTCAP_LOC_TRACKING		(1ULL << 10)
1241 #define IEEE80211_EXTCAP_FMS			(1ULL << 11)
1242 #define IEEE80211_EXTCAP_PROXY_ARP		(1ULL << 12)
1243 #define IEEE80211_EXTCAP_CIR			(1ULL << 13) /* collocated interference reporting */
1244 #define IEEE80211_EXTCAP_CIVIC_LOC		(1ULL << 14)
1245 #define IEEE80211_EXTCAP_GEOSPATIAL_LOC		(1ULL << 15)
1246 #define IEEE80211_EXTCAP_TFS			(1ULL << 16)
1247 #define IEEE80211_EXTCAP_WNM_SLEEPMODE		(1ULL << 17)
1248 #define IEEE80211_EXTCAP_TIM_BROADCAST		(1ULL << 18)
1249 #define IEEE80211_EXTCAP_BSS_TRANSITION		(1ULL << 19)
1250 #define IEEE80211_EXTCAP_QOS_TRAF_CAP		(1ULL << 20)
1251 #define IEEE80211_EXTCAP_AC_STA_COUNT		(1ULL << 21)
1252 #define IEEE80211_EXTCAP_M_BSSID		(1ULL << 22) /* multiple BSSID field */
1253 #define IEEE80211_EXTCAP_TIMING_MEAS		(1ULL << 23)
1254 #define IEEE80211_EXTCAP_CHAN_USAGE		(1ULL << 24)
1255 #define IEEE80211_EXTCAP_SSID_LIST		(1ULL << 25)
1256 #define IEEE80211_EXTCAP_DMS			(1ULL << 26)
1257 #define IEEE80211_EXTCAP_UTC_TSF_OFFSET		(1ULL << 27)
1258 #define IEEE80211_EXTCAP_TLDS_BUF_STA_SUPP	(1ULL << 28) /* TDLS peer U-APSP buffer STA support */
1259 #define IEEE80211_EXTCAP_TLDS_PPSM_SUPP		(1ULL << 29) /* TDLS peer PSM support */
1260 #define IEEE80211_EXTCAP_TLDS_CH_SW		(1ULL << 30) /* TDLS channel switching */
1261 #define IEEE80211_EXTCAP_INTERWORKING		(1ULL << 31)
1262 #define IEEE80211_EXTCAP_QOSMAP			(1ULL << 32)
1263 #define IEEE80211_EXTCAP_EBR			(1ULL << 33)
1264 #define IEEE80211_EXTCAP_SSPN_IF		(1ULL << 34)
1265 #define IEEE80211_EXTCAP_RSVD_35		(1ULL << 35)
1266 #define IEEE80211_EXTCAP_MSGCF_CAP		(1ULL << 36)
1267 #define IEEE80211_EXTCAP_TLDS_SUPP		(1ULL << 37)
1268 #define IEEE80211_EXTCAP_TLDS_PROHIB		(1ULL << 38)
1269 #define IEEE80211_EXTCAP_TLDS_CH_SW_PROHIB	(1ULL << 39) /* TDLS channel switching prohibited */
1270 #define IEEE80211_EXTCAP_RUF			(1ULL << 40) /* reject unadmitted frame */
1271 /* service interval granularity */
1272 #define IEEE80211_EXTCAP_SIG \
1273 				((1ULL << 41) | (1ULL << 42) | (1ULL << 43))
1274 #define IEEE80211_EXTCAP_ID_LOC			(1ULL << 44)
1275 #define IEEE80211_EXTCAP_U_APSD_COEX		(1ULL << 45)
1276 #define IEEE80211_EXTCAP_WNM_NOTIFICATION	(1ULL << 46)
1277 #define IEEE80211_EXTCAP_RSVD_47		(1ULL << 47)
1278 #define IEEE80211_EXTCAP_SSID			(1ULL << 48) /* UTF-8 SSID */
1279 /* bits 49-n are reserved */
1280 
1281 struct ieee80211_extcap_ie {
1282 	uint8_t		ie;
1283 	uint8_t		len;
1284 } __packed;
1285 
1286 /*
1287  * 802.11h Quiet Time Element.
1288  */
1289 struct ieee80211_quiet_ie {
1290 	uint8_t		quiet_ie;		/* IEEE80211_ELEMID_QUIET */
1291 	uint8_t		len;
1292 	uint8_t		tbttcount;		/* quiet start */
1293 	uint8_t		period;			/* beacon intervals between quiets */
1294 	uint16_t	duration;		/* TUs of each quiet*/
1295 	uint16_t	offset;			/* TUs of from TBTT of quiet start */
1296 } __packed;
1297 
1298 /*
1299  * 802.11h Channel Switch Announcement (CSA).
1300  */
1301 struct ieee80211_csa_ie {
1302 	uint8_t		csa_ie;		/* IEEE80211_ELEMID_CHANSWITCHANN */
1303 	uint8_t		csa_len;
1304 	uint8_t		csa_mode;		/* Channel Switch Mode */
1305 	uint8_t		csa_newchan;		/* New Channel Number */
1306 	uint8_t		csa_count;		/* Channel Switch Count */
1307 } __packed;
1308 
1309 /*
1310  * Note the min acceptable CSA count is used to guard against
1311  * malicious CSA injection in station mode.  Defining this value
1312  * as other than 0 violates the 11h spec.
1313  */
1314 #define	IEEE80211_CSA_COUNT_MIN	2
1315 #define	IEEE80211_CSA_COUNT_MAX	255
1316 
1317 /* rate set entries are in .5 Mb/s units, and potentially marked as basic */
1318 #define	IEEE80211_RATE_BASIC		0x80
1319 #define	IEEE80211_RATE_VAL		0x7f
1320 #define	IEEE80211_RV(v)			((v) & IEEE80211_RATE_VAL)
1321 
1322 /* ERP information element flags */
1323 #define	IEEE80211_ERP_NON_ERP_PRESENT	0x01
1324 #define	IEEE80211_ERP_USE_PROTECTION	0x02
1325 #define	IEEE80211_ERP_LONG_PREAMBLE	0x04
1326 
1327 #define	IEEE80211_ERP_BITS \
1328 	"\20\1NON_ERP_PRESENT\2USE_PROTECTION\3LONG_PREAMBLE"
1329 
1330 #define	ATH_OUI			0x7f0300	/* Atheros OUI */
1331 #define	ATH_OUI_TYPE		0x01		/* Atheros protocol ie */
1332 
1333 /* NB: Atheros allocated the OUI for this purpose ~2005 but beware ... */
1334 #define	TDMA_OUI		ATH_OUI
1335 #define	TDMA_OUI_TYPE		0x02		/* TDMA protocol ie */
1336 
1337 #define	BCM_OUI			0x4c9000	/* Broadcom OUI */
1338 #define	BCM_OUI_HTCAP		51		/* pre-draft HTCAP ie */
1339 #define	BCM_OUI_HTINFO		52		/* pre-draft HTINFO ie */
1340 
1341 #define	WPA_OUI			0xf25000
1342 #define	WPA_OUI_TYPE		0x01
1343 #define	WPA_VERSION		1		/* current supported version */
1344 
1345 #define	WPA_CSE_NULL		0x00
1346 #define	WPA_CSE_WEP40		0x01
1347 #define	WPA_CSE_TKIP		0x02
1348 #define	WPA_CSE_CCMP		0x04		/* CCMP 128-bit */
1349 #define	WPA_CSE_WEP104		0x05
1350 
1351 #define	WPA_ASE_NONE		0x00
1352 #define	WPA_ASE_8021X_UNSPEC	0x01
1353 #define	WPA_ASE_8021X_PSK	0x02
1354 
1355 #define	WPS_OUI_TYPE		0x04
1356 
1357 /* 802.11-2016 Table 9-131 - Cipher Suite Selectors */
1358 #define	RSN_OUI			0xac0f00
1359 #define	RSN_VERSION		1		/* current supported version */
1360 
1361 /* RSN cipher suite element */
1362 #define	RSN_CSE_NULL		0
1363 #define	RSN_CSE_WEP40		1
1364 #define	RSN_CSE_TKIP		2
1365 #define	RSN_CSE_WRAP		3		/* Reserved in the 802.11-2016 */
1366 #define	RSN_CSE_CCMP		4		/* CCMP 128 bit */
1367 #define	RSN_CSE_WEP104		5
1368 #define	RSN_CSE_BIP_CMAC_128	6
1369 /* 7 - "Group addressed traffic not allowed" */
1370 #define	RSN_CSE_GCMP_128	8
1371 #define	RSN_CSE_GCMP_256	9
1372 #define	RSN_CSE_CCMP_256	10
1373 #define	RSN_CSE_BIP_GMAC_128	11
1374 #define	RSN_CSE_BIP_GMAC_256	12
1375 #define	RSN_CSE_BIP_CMAC_256	13
1376 
1377 /* 802.11-2016 Table 9-133 - AKM suite selectors */
1378 /* RSN AKM suite element */
1379 #define	RSN_ASE_NONE		0
1380 #define	RSN_ASE_8021X_UNSPEC	1
1381 #define	RSN_ASE_8021X_PSK	2
1382 #define	RSN_ASE_FT_8021X	3		/* SHA-256 */
1383 #define	RSN_ASE_FT_PSK		4		/* SHA-256 */
1384 #define	RSN_ASE_8021X_UNSPEC_SHA256	5
1385 #define	RSN_ASE_8021X_PSK_SHA256	6
1386 #define	RSN_ASE_8021X_TDLS	7		/* SHA-256 */
1387 #define	RSN_ASE_SAE_UNSPEC	8		/* SHA-256 */
1388 #define	RSN_ASE_FT_SAE		9		/* SHA-256 */
1389 #define	RSN_ASE_AP_PEERKEY	10		/* SHA-256 */
1390 #define	RSN_ASE_8021X_SUITE_B_SHA256	11
1391 #define	RSN_ASE_8021X_SUITE_B_SHA384	12
1392 #define	RSN_ASE_FT_8021X_SHA384	13
1393 
1394 /* 802.11-2016 Figure 9-257 - RSN Capabilities (2 byte field) */
1395 #define	RSN_CAP_PREAUTH		0x0001
1396 #define	RSN_CAP_NO_PAIRWISE	0x0002
1397 #define	RSN_CAP_PTKSA_REPLAY_COUNTER	0x000c	/* 2 bit field */
1398 #define	RSN_CAP_GTKSA_REPLAY_COUNTER	0x0030	/* 2 bit field */
1399 #define	RSN_CAP_MFP_REQUIRED	0x0040
1400 #define	RSN_CAP_MFP_CAPABLE	0x0080
1401 #define	RSN_CAP_JOINT_MULTIBAND_RSNA		0x0100
1402 #define	RSN_CAP_PEERKEY_ENABLED	0x0200
1403 #define	RSN_CAP_SPP_AMSDU_CAPABLE	0x0400
1404 #define	RSN_CAP_SPP_AMSDU_REQUIRED	0x0800
1405 #define	RSN_CAP_PBAC_CAPABLE	0x1000
1406 #define	RSN_CAP_EXT_KEYID_CAPABLE	0x0200
1407 
1408 /* 802.11-2016 Table 9-134 PTKSA/GTKSA/STKSA replay counters usage */
1409 #define		RSN_CAP_REPLAY_COUNTER_1_PER	0
1410 #define		RSN_CAP_REPLAY_COUNTER_2_PER	1
1411 #define		RSN_CAP_REPLAY_COUNTER_4_PER	2
1412 #define		RSN_CAP_REPLAY_COUNTER_16_PER	3
1413 
1414 #define	WME_OUI			0xf25000
1415 #define	WME_OUI_TYPE		0x02
1416 #define	WME_INFO_OUI_SUBTYPE	0x00
1417 #define	WME_PARAM_OUI_SUBTYPE	0x01
1418 #define	WME_VERSION		1
1419 
1420 /* WME stream classes */
1421 #define	WME_AC_BE	0		/* best effort */
1422 #define	WME_AC_BK	1		/* background */
1423 #define	WME_AC_VI	2		/* video */
1424 #define	WME_AC_VO	3		/* voice */
1425 
1426 /*
1427  * AUTH management packets
1428  *
1429  *	octet algo[2]
1430  *	octet seq[2]
1431  *	octet status[2]
1432  *	octet chal.id
1433  *	octet chal.length
1434  *	octet chal.text[253]		NB: 1-253 bytes
1435  */
1436 
1437 /* challenge length for shared key auth */
1438 #define IEEE80211_CHALLENGE_LEN		128
1439 
1440 #define	IEEE80211_AUTH_ALG_OPEN		0x0000
1441 #define	IEEE80211_AUTH_ALG_SHARED	0x0001
1442 #define	IEEE80211_AUTH_ALG_LEAP		0x0080
1443 
1444 enum {
1445 	IEEE80211_AUTH_OPEN_REQUEST		= 1,
1446 	IEEE80211_AUTH_OPEN_RESPONSE		= 2,
1447 };
1448 
1449 enum {
1450 	IEEE80211_AUTH_SHARED_REQUEST		= 1,
1451 	IEEE80211_AUTH_SHARED_CHALLENGE		= 2,
1452 	IEEE80211_AUTH_SHARED_RESPONSE		= 3,
1453 	IEEE80211_AUTH_SHARED_PASS		= 4,
1454 };
1455 
1456 /*
1457  * Reason and status codes.
1458  *
1459  * Reason codes are used in management frames to indicate why an
1460  * action took place (e.g. on disassociation).  Status codes are
1461  * used in management frames to indicate the result of an operation.
1462  *
1463  * Unlisted codes are reserved
1464  */
1465 
1466 enum {
1467 	IEEE80211_REASON_UNSPECIFIED		= 1,
1468 	IEEE80211_REASON_AUTH_EXPIRE		= 2,
1469 	IEEE80211_REASON_AUTH_LEAVE		= 3,
1470 	IEEE80211_REASON_ASSOC_EXPIRE		= 4,
1471 	IEEE80211_REASON_ASSOC_TOOMANY		= 5,
1472 	IEEE80211_REASON_NOT_AUTHED		= 6,
1473 	IEEE80211_REASON_NOT_ASSOCED		= 7,
1474 	IEEE80211_REASON_ASSOC_LEAVE		= 8,
1475 	IEEE80211_REASON_ASSOC_NOT_AUTHED	= 9,
1476 	IEEE80211_REASON_DISASSOC_PWRCAP_BAD	= 10,	/* 11h */
1477 	IEEE80211_REASON_DISASSOC_SUPCHAN_BAD	= 11,	/* 11h */
1478 	IEEE80211_REASON_IE_INVALID		= 13,	/* 11i */
1479 	IEEE80211_REASON_MIC_FAILURE		= 14,	/* 11i */
1480 	IEEE80211_REASON_4WAY_HANDSHAKE_TIMEOUT	= 15,	/* 11i */
1481 	IEEE80211_REASON_GROUP_KEY_UPDATE_TIMEOUT = 16,	/* 11i */
1482 	IEEE80211_REASON_IE_IN_4WAY_DIFFERS	= 17,	/* 11i */
1483 	IEEE80211_REASON_GROUP_CIPHER_INVALID	= 18,	/* 11i */
1484 	IEEE80211_REASON_PAIRWISE_CIPHER_INVALID= 19,	/* 11i */
1485 	IEEE80211_REASON_AKMP_INVALID		= 20,	/* 11i */
1486 	IEEE80211_REASON_UNSUPP_RSN_IE_VERSION	= 21,	/* 11i */
1487 	IEEE80211_REASON_INVALID_RSN_IE_CAP	= 22,	/* 11i */
1488 	IEEE80211_REASON_802_1X_AUTH_FAILED	= 23,	/* 11i */
1489 	IEEE80211_REASON_CIPHER_SUITE_REJECTED	= 24,	/* 11i */
1490 	IEEE80211_REASON_UNSPECIFIED_QOS	= 32,	/* 11e */
1491 	IEEE80211_REASON_INSUFFICIENT_BW	= 33,	/* 11e */
1492 	IEEE80211_REASON_TOOMANY_FRAMES		= 34,	/* 11e */
1493 	IEEE80211_REASON_OUTSIDE_TXOP		= 35,	/* 11e */
1494 	IEEE80211_REASON_LEAVING_QBSS		= 36,	/* 11e */
1495 	IEEE80211_REASON_BAD_MECHANISM		= 37,	/* 11e */
1496 	IEEE80211_REASON_SETUP_NEEDED		= 38,	/* 11e */
1497 	IEEE80211_REASON_TIMEOUT		= 39,	/* 11e */
1498 
1499 	IEEE80211_REASON_PEER_LINK_CANCELED	= 52,	/* 11s */
1500 	IEEE80211_REASON_MESH_MAX_PEERS		= 53,	/* 11s */
1501 	IEEE80211_REASON_MESH_CPVIOLATION	= 54,	/* 11s */
1502 	IEEE80211_REASON_MESH_CLOSE_RCVD	= 55,	/* 11s */
1503 	IEEE80211_REASON_MESH_MAX_RETRIES	= 56,	/* 11s */
1504 	IEEE80211_REASON_MESH_CONFIRM_TIMEOUT	= 57,	/* 11s */
1505 	IEEE80211_REASON_MESH_INVALID_GTK	= 58,	/* 11s */
1506 	IEEE80211_REASON_MESH_INCONS_PARAMS	= 59,	/* 11s */
1507 	IEEE80211_REASON_MESH_INVALID_SECURITY	= 60,	/* 11s */
1508 	IEEE80211_REASON_MESH_PERR_NO_PROXY	= 61,	/* 11s */
1509 	IEEE80211_REASON_MESH_PERR_NO_FI	= 62,	/* 11s */
1510 	IEEE80211_REASON_MESH_PERR_DEST_UNREACH	= 63,	/* 11s */
1511 	IEEE80211_REASON_MESH_MAC_ALRDY_EXISTS_MBSS = 64, /* 11s */
1512 	IEEE80211_REASON_MESH_CHAN_SWITCH_REG	= 65,	/* 11s */
1513 	IEEE80211_REASON_MESH_CHAN_SWITCH_UNSPEC = 66,	/* 11s */
1514 
1515 	IEEE80211_STATUS_SUCCESS		= 0,
1516 	IEEE80211_STATUS_UNSPECIFIED		= 1,
1517 	IEEE80211_STATUS_CAPINFO		= 10,
1518 	IEEE80211_STATUS_NOT_ASSOCED		= 11,
1519 	IEEE80211_STATUS_OTHER			= 12,
1520 	IEEE80211_STATUS_ALG			= 13,
1521 	IEEE80211_STATUS_SEQUENCE		= 14,
1522 	IEEE80211_STATUS_CHALLENGE		= 15,
1523 	IEEE80211_STATUS_TIMEOUT		= 16,
1524 	IEEE80211_STATUS_TOOMANY		= 17,
1525 	IEEE80211_STATUS_BASIC_RATE		= 18,
1526 	IEEE80211_STATUS_SP_REQUIRED		= 19,	/* 11b */
1527 	IEEE80211_STATUS_PBCC_REQUIRED		= 20,	/* 11b */
1528 	IEEE80211_STATUS_CA_REQUIRED		= 21,	/* 11b */
1529 	IEEE80211_STATUS_SPECMGMT_REQUIRED	= 22,	/* 11h */
1530 	IEEE80211_STATUS_PWRCAP_REQUIRED	= 23,	/* 11h */
1531 	IEEE80211_STATUS_SUPCHAN_REQUIRED	= 24,	/* 11h */
1532 	IEEE80211_STATUS_SHORTSLOT_REQUIRED	= 25,	/* 11g */
1533 	IEEE80211_STATUS_DSSSOFDM_REQUIRED	= 26,	/* 11g */
1534 	IEEE80211_STATUS_MISSING_HT_CAPS	= 27,	/* 11n D3.0 */
1535 	IEEE80211_STATUS_INVALID_IE		= 40,	/* 11i */
1536 	IEEE80211_STATUS_GROUP_CIPHER_INVALID	= 41,	/* 11i */
1537 	IEEE80211_STATUS_PAIRWISE_CIPHER_INVALID = 42,	/* 11i */
1538 	IEEE80211_STATUS_AKMP_INVALID		= 43,	/* 11i */
1539 	IEEE80211_STATUS_UNSUPP_RSN_IE_VERSION	= 44,	/* 11i */
1540 	IEEE80211_STATUS_INVALID_RSN_IE_CAP	= 45,	/* 11i */
1541 	IEEE80211_STATUS_CIPHER_SUITE_REJECTED	= 46,	/* 11i */
1542 };
1543 
1544 #define	IEEE80211_WEP_KEYLEN		5	/* 40bit */
1545 #define	IEEE80211_WEP_IVLEN		3	/* 24bit */
1546 #define	IEEE80211_WEP_KIDLEN		1	/* 1 octet */
1547 #define	IEEE80211_WEP_CRCLEN		4	/* CRC-32 */
1548 #define	IEEE80211_WEP_TOTLEN		(IEEE80211_WEP_IVLEN + \
1549 					 IEEE80211_WEP_KIDLEN + \
1550 					 IEEE80211_WEP_CRCLEN)
1551 #define	IEEE80211_WEP_NKID		4	/* number of key ids */
1552 
1553 /*
1554  * 802.11i defines an extended IV for use with non-WEP ciphers.
1555  * When the EXTIV bit is set in the key id byte an additional
1556  * 4 bytes immediately follow the IV for TKIP.  For CCMP the
1557  * EXTIV bit is likewise set but the 8 bytes represent the
1558  * CCMP header rather than IV+extended-IV.
1559  */
1560 #define	IEEE80211_WEP_EXTIV		0x20
1561 #define	IEEE80211_WEP_EXTIVLEN		4	/* extended IV length */
1562 #define	IEEE80211_WEP_MICLEN		8	/* trailing MIC */
1563 
1564 #define	IEEE80211_CRC_LEN		4
1565 
1566 /*
1567  * Maximum acceptable MTU is:
1568  *	IEEE80211_MAX_LEN - WEP overhead - CRC -
1569  *		QoS overhead - RSN/WPA overhead
1570  * Min is arbitrarily chosen > IEEE80211_MIN_LEN.  The default
1571  * mtu is Ethernet-compatible; it's set by ether_ifattach.
1572  */
1573 #define	IEEE80211_MTU_MAX		2290
1574 #define	IEEE80211_MTU_MIN		32
1575 
1576 #define	IEEE80211_MAX_LEN		(2300 + IEEE80211_CRC_LEN + \
1577     (IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN + IEEE80211_WEP_CRCLEN))
1578 #define	IEEE80211_ACK_LEN \
1579 	(sizeof(struct ieee80211_frame_ack) + IEEE80211_CRC_LEN)
1580 #define	IEEE80211_MIN_LEN \
1581 	(sizeof(struct ieee80211_frame_min) + IEEE80211_CRC_LEN)
1582 
1583 /*
1584  * The 802.11 spec says at most 2007 stations may be
1585  * associated at once.  For most AP's this is way more
1586  * than is feasible so we use a default of IEEE80211_AID_DEF.
1587  * This number may be overridden by the driver and/or by
1588  * user configuration but may not be less than IEEE80211_AID_MIN
1589  * (see _ieee80211.h for implementation-specific settings).
1590  */
1591 #define	IEEE80211_AID_MAX		2007
1592 
1593 #define	IEEE80211_AID(b)	((b) &~ 0xc000)
1594 
1595 /*
1596  * RTS frame length parameters.  The default is specified in
1597  * the 802.11 spec as 512; we treat it as implementation-dependent
1598  * so it's defined in ieee80211_var.h.  The max may be wrong
1599  * for jumbo frames.
1600  */
1601 #define	IEEE80211_RTS_MIN		1
1602 #define	IEEE80211_RTS_MAX		2346
1603 
1604 /*
1605  * TX fragmentation parameters.  As above for RTS, we treat
1606  * default as implementation-dependent so define it elsewhere.
1607  */
1608 #define	IEEE80211_FRAG_MIN		256
1609 #define	IEEE80211_FRAG_MAX		2346
1610 
1611 /*
1612  * Beacon interval (TU's).  Min+max come from WiFi requirements.
1613  * As above, we treat default as implementation-dependent so
1614  * define it elsewhere.
1615  */
1616 #define	IEEE80211_BINTVAL_MAX	1000	/* max beacon interval (TU's) */
1617 #define	IEEE80211_BINTVAL_MIN	25	/* min beacon interval (TU's) */
1618 
1619 /*
1620  * DTIM period (beacons).  Min+max are not really defined
1621  * by the protocol but we want them publicly visible so
1622  * define them here.
1623  */
1624 #define	IEEE80211_DTIM_MAX	15	/* max DTIM period */
1625 #define	IEEE80211_DTIM_MIN	1	/* min DTIM period */
1626 
1627 /*
1628  * Beacon miss threshold (beacons).  As for DTIM, we define
1629  * them here to be publicly visible.  Note the max may be
1630  * clamped depending on device capabilities.
1631  */
1632 #define	IEEE80211_HWBMISS_MIN 	1
1633 #define	IEEE80211_HWBMISS_MAX 	255
1634 
1635 /*
1636  * 802.11 frame duration definitions.
1637  */
1638 
1639 struct ieee80211_duration {
1640 	uint16_t	d_rts_dur;
1641 	uint16_t	d_data_dur;
1642 	uint16_t	d_plcp_len;
1643 	uint8_t		d_residue;	/* unused octets in time slot */
1644 };
1645 
1646 /* One Time Unit (TU) is 1Kus = 1024 microseconds. */
1647 #define IEEE80211_DUR_TU		1024
1648 
1649 /* IEEE 802.11b durations for DSSS PHY in microseconds */
1650 #define IEEE80211_DUR_DS_LONG_PREAMBLE	144
1651 #define IEEE80211_DUR_DS_SHORT_PREAMBLE	72
1652 
1653 #define IEEE80211_DUR_DS_SLOW_PLCPHDR	48
1654 #define IEEE80211_DUR_DS_FAST_PLCPHDR	24
1655 #define IEEE80211_DUR_DS_SLOW_ACK	112
1656 #define IEEE80211_DUR_DS_FAST_ACK	56
1657 #define IEEE80211_DUR_DS_SLOW_CTS	112
1658 #define IEEE80211_DUR_DS_FAST_CTS	56
1659 
1660 #define IEEE80211_DUR_DS_SLOT		20
1661 #define IEEE80211_DUR_DS_SIFS		10
1662 #define IEEE80211_DUR_DS_PIFS	(IEEE80211_DUR_DS_SIFS + IEEE80211_DUR_DS_SLOT)
1663 #define IEEE80211_DUR_DS_DIFS	(IEEE80211_DUR_DS_SIFS + \
1664 				 2 * IEEE80211_DUR_DS_SLOT)
1665 #define IEEE80211_DUR_DS_EIFS	(IEEE80211_DUR_DS_SIFS + \
1666 				 IEEE80211_DUR_DS_SLOW_ACK + \
1667 				 IEEE80211_DUR_DS_LONG_PREAMBLE + \
1668 				 IEEE80211_DUR_DS_SLOW_PLCPHDR + \
1669 				 IEEE80211_DUR_DIFS)
1670 
1671 #endif /* _NET80211_IEEE80211_H_ */
1672