Useful links

http://www.wildpackets.com/resources/compendium/wireless_lan/802_11n
http://www.my80211.com/home/2009/12/5/80211-null-data-frames.html
http://www.digitalthreat.net/2012/01/bypassing-wps-router-security/
4way handshake:
http://etutorials.org/Networking/802.11+security.+wi-fi+protected+access+and+802.11i/Part+II+The+Design+of+Wi-Fi+Security/Chapter+10.+WPA+and+RSN+Key+Hierarchy/Details+of+Key+Derivation+for+WPA/

Aggregation:
https://en.wikipedia.org/wiki/Frame_aggregation
Block ACK:

http://wiki.deliberant.com/faq/autoba-auto-block-ack/

EAP-PEAP:
https://supportforums.cisco.com/blog/154046
802.11e:
http://www.eetimes.com/document.asp?doc_id=1271987
802.11r:
http://www.codealias.info/technotes/the_ieee_802.11r_standard_for_fast_wireless_handoffs
http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/116493-technote-technology-00.html

Legacy power save:
http://processors.wiki.ti.com/index.php/OMAP_Wireless_Connectivity_Power_Save
https://community.arubanetworks.com/t5/Technology-Blog/802-11-TIM-and-DTIM-Information-Elements/ba-p/256997
https://alethea.in/legacy-power-save-mode/

For beginners in C:
http://www.thegeekstuff.com/2010/03/debug-c-program-using-gdb/
(note: info args to know the arguments passed to the function and 
     info locals to print local variables (in the current stack frame)
http://www.geeksforgeeks.org/memory-layout-of-c-program/

Linux
Download kernel source code:
http://kernel.ubuntu.com/~kernel-ppa/mainline/v4.3.3-wily/

Compiling kernel module:
http://www.thegeekstuff.com/2013/06/compile-linux-kernel/

followed by update-grub

To invoke a utility or shell script with a particular priority
http://en.wikipedia.org/wiki/Nice_(Unix)

Useful utilities:
gnome-system-monitor
gnome-www-browser

http://cciew.blogspot.in/2011/02/short-slot-time.html

Beamforming:
http://ruwanindikaprasanna.blogspot.in/2016/01/is-my-80211ac-wifi-ap-beamforming.html

Spatial multiplexing:
https://wifijedi.com/2009/02/01/how-stuff-works-spatial-multiplexing/

Certified Wireless Analysis Professional notes:
http://mrncciew.com/2014/10/04/my-cwap-study-notes/

Linux network drivers:
http://linuxgazette.net/156/jangir.html

Kernel crash:
http://www.dedoimedo.com/computers/crash-analyze.html#mozTocId782257
http://blog.csdn.net/u011839461/article/details/12001437

Spin lock internals- Very nice article:
http://www.linuxinternals.org/blog/2014/05/07/spinlock-implementation-in-linux-kernel/

Top half and Bottom halves:
---------------------------------
https://www.quora.com/What-is-the-advantage-of-new-request_threaded_irq-over-request_irq
Tasklets:
https://www.ibm.com/developerworks/library/l-tasklets/

DMA
https://www.kernel.org/doc/Documentation/DMA-API-HOWTO.txt

Cryptography
http://crypto.stackexchange.com/questions/27131/differences-between-the-terms-pre-master-secret-master-secret-private-key

https://support.ssl.com/Knowledgebase/Article/View/19/0/der-vs-crt-vs-cer-vs-pem-certificates-and-how-to-convert-them

Setting ASUS as AP:
http://askubuntu.com/questions/404881/how-do-i-install-an-asus-usb-ac56-wifi-adapter
http://w1.fi/hostapd/
http://freeradius.org/download.html
SIM800 user manual
https://cdn-shop.adafruit.com/product-files/2637/SIM800+Series_AT+Command+Manual_V1.09.pdf

Code composer studio setup:

http://software-dl.ti.com/ccs/esd/CCSv7/CCS_7_1_0/exports/ccs_setup_7.1.0.00014.exe

[‎3/‎3/‎2017 2:26 PM] Janaki Vallabha Eranna:

http://software-dl.ti.com/ccs/esd/CCSv7/CCS_7_1_0/exports/ccs_setup_7.1.0.00014.exe

How to send SMS from ADB

http://stackoverflow.com/questions/4043490/how-do-i-send-an-sms-from-a-shell

To build web demo for sensortag
-------------------------------------
http://processors.wiki.ti.com/index.php/Contiki_setting_up_sw

Main page:
----------
http://processors.wiki.ti.com/index.php/Contiki-6LOWPAN

Download and setup contiki
--------------------------
http://www.contiki-os.org/start.html

Setup tool chain
-----------------
http://processors.wiki.ti.com/index.php/Contiki_setting_up_sw

Setting up edge router
----------------------
http://processors.wiki.ti.com/index.php/Cc26xx_sw_examples

Source code:
------------
https://github.com/contiki-os/contiki

sniffer:
--------
http://processors.wiki.ti.com/index.php/Contiki_sniffer

6lowpan coding documentation
----------------------------
https://github.com/contiki-os/contiki/blob/master/doc/sicslowpan-doc.txt


/home/user/Documents/src/contiki-master/examples/cc26xx

PCI BAR essentials
--------------------
https://docs.oracle.com/cd/E19455-01/805-7378/hwovr-28/index.html
https://github.com/billfarrow/pcimem

11AC resources
==========
STBC
------
http://www.radio-electronics.com/info/antennas/mimo/precoding-codes-alamouti-diversity-space-time.php

MIMO GI
----------
http://rfmw.em.keysight.com/wireless/helpfiles/89600b/webhelp/subsystems/wlan-mimo/Content/mimo_fmt_grdintparams.htm

Where is hard link used?
https://www.lifewire.com/what-are-hard-links-2190041

Deep learning
----------------
https://docs.aws.amazon.com/dlami/latest/devguide/tutorial-conda.html

U-APSD

Unscheduled Automatic Power Save Delivery (U-APSD)

The uplink data frames sent by stations (STA → AP) are used as indications (triggers) to AP that the power saving stations are awake. Here is a nice article on NULL frame which is being sent from STA to AP to inform that it is planning to switch to power save mode: http://www.my80211.com/home/2009/12/5/80211-null-data-frames.html.

AP then sends the buffered data frames (buffered when the stations where in doze mode).

In APSD a station is awake during a Service Period (SP). An unscheduled SP begins when the AP receives a trigger frame from a station and ends when the station receives a QoS Data or QoS Null frame indicating the end of the service period (EOSP).

QOS Info Field when sent from AP(beacon)

AP needs inform to stations whether it supports the 

1.  U-APSD(UN-scheduled) or 
2. Scheduled power save mode 

by setting and resetting U-APSD flag bit in QoS info field. If U-APSD bit is 1, then it supports U-APSD and if U-APSD =0 then it does not supports U-APSD

QOS Info Field when sent from STA ((re)association request frame)

Max SP length (2 bit field) indicates max number of total buffered MSDUs and MMPDUs the WMM AP may deliver to WMM STA during the service period triggered by WMM STA.

  Max SP length

Setting 0 in AC (BE, BK, VI and VO) indicate that the corresponding AC is neither trigger-enabled nor delivery-enabled.

 TIM in the Beacon might not indicate whether frames are buffered at the AP, it requires to periodically send QoS Null frames if no other triggers are sent in order to learn the actual buffer status of the AP.

If U-APSD is configured through ADDTSs each time a new application starts which requires its usage, then the stations can rely on the TIM information of the Beacons to be informed about new traffic at the AP, enter into U-APSD mode through ADDTS when a communication starts and revert back to legacy
power save mode when it ends.

rfkill

Some devices come with a hard switch that lets you kill different types of RF radios: 802.11 / Bluetooth. Some times these buttons may kill more than one RF type. The Linux kernel rfkill subsystem exposes these hardware buttons and lets userspace query its status and set its status through a /dev/rfkill.

 To get the current rfkill status, use rfkill list:

 

Note that an index (3) is assigned  for wireless LAN interface.

To turn off the interface, use the command rfkill block <index> and to turn on the interface again, use rfkill unblock <index>

Part 3: P2P Group Owner Negotiation

Once the two P2P Devices have found each other, they start the Group Owner(GO) Negotiation phase. This is implemented using a three-way handshake, namely GO negotiation.Request/Response/Confirmation,  whereby the two devices agree on which device will act as P2P GO and on the channel where the group will operate, which can be in the 2.4 Ghz or 5 Ghz bands.

In order to agree on the device that will act as P2P GO, P2P devices send a numerical parameter, the GO Intent value, within the three-way hand-shake, and the device declaring the highest value becomes the P2P GO. To prevent conflicts when two devices declare the same GO Intent, a tie-breaker bit is included in the GO Negotiation Request, which is randomly set every time a GO Negotiation Request is sent.

P2P GO Negotiation Request from device 1:

 

If operating channel is not available, it will use another channel from the Channel List.Configuration time is Time needed by the device to get configured an function as a GO in units of 10 milliseconds.

 WPS IE in GO negotiation request:

GO negotiation response from device 2:

WPS IE in GO negotiation response:

                

When using PIN based WSC, the selected PIN (from the display of either the

P2P Client or P2P Group Owner) is indicated using Device Password ID
attribute. For example for devices using pushbutton authentication,

A P2P Device may decline Group Owner Negotiation if the Device Password ID

in the GO Negotiation Response is incompatible with the Provisioning
information it shall use to execute Provisioning.

P2P GO Negotiation confirmation from device 1:

Group Owner determination is depicted below.

Once the devices have discovered each other and agreed on the respective roles, the next phase is the establishment of a secure communication using Wi-Fi Protected Setup.

QoS packets

WiFi MultiMedia (WMM)

Wireless Multimedia Extensions (WME), also known as Wi-Fi Multimedia (WMM), is a Wi-Fi Allianceinteroperability certification, based on the IEEE 802.11e standard. WMM not only prioritize traffic on the basis of the type of traffic (voice, video, best effort data, or background data) , but also taking into account network load and channel conditions.

With WMM-Admission Control, the access point (AP) in a Wi-Fi network admits only the traffic streams it can support based on the available network resources.  Users can confidently use voice applications knowing the quality of traffic stream will be consistently high and will provide the reliability needed to host real-time applications in Wi-Fi networks.

 When the network resources are not sufficient to provide this level of performance, the new traffic stream is not admitted, allowing the client device to seek association with an alternative AP that has sufficient network resources to support the traffic stream, and preserving the quality of already admitted traffic streams.


WMM replaces the traditional Wi-Fi DCF distributed coordination function for traditional CSMA/CA wireless frame transmission with EDCF.

QoS:

QoS modifies the media access rule such that Data having a higher priority is given preferential access to the medium. EDCA contention access is an extension of the legacy CSMA/CA DCF mechanism to include priorities. 

The contention window and backoff times are adjusted to change the probability of gaining medium access to favor higher priority classes. A total of eight user priority levels are available. Each priority is mapped to an Access Category (AC), which corresponds to one of four transmit queue.

A station that wins an EDCA contention is granted a TXOP—the right to use the medium for a period of time. The duration of this TXOP is specified per access category, and is contained in the TXOP limit field of the access category (AC) parameter record in the EDCA parameter set(e.g. in beacon frame as shown below). A QoS STA can use a TXOP to transmit multiple frames within an access category.

WMM/WME IE in beacon

 AC parameters format:

AP advertises ACM bit in Beacon to indicate if admission control
is mandatory for any Access Category.

Case 1: ACM bit not set

AC Index (ACI)is chosen as per the following table.

The AIFSN (arbitration interframe space number) subfield indicates the number of slots after a SIFS duration a non-AP STA should defer before either invoking a backoff or starting a transmission. The minimum value for the AIFSN subfield is 2.

ECWmin/ ECWmax is the minimum/maximum value of contention window which is expressed in exponent.

As in 802.11-2007 spec, table 7.37, CWmin = (aCWmin+1)/4 – 1 and CWmax = (aCWmin+1)/2 – 1

aCWMin is PHY dependent. For example, for OFDM PHY, aCWmin = 15.
So, CWmin = 3 and CWmax = 7.

ECWmin = 2

ECWmax = 3

The Queue Size subfield is an 8-bit field that indicates the amount of buffered traffic for a given TC or TS at the non-AP STA sending this frame.

TXOP grants a particular STA the right to use the medium at a defined point in time, for a defined maximum duration. The allowed duration of TXOPs are communicated globally in the beacon for stations using EDCA.Non-AP STAs should make sure that TXOPs should not exceed TXOP limit. 

Case 2: ACM bit is set

When ACM bit is set, STA sends ADDTS Request Action Frame to AP that includes a TSPEC. Before a client can send traffic of a certain priority type, it must have requested to do so via the TSpec mechanism. For example, a WLAN client device wanting to use the voice AC must first make a request for use of that AC.

Add Traffic Stream

The Add Traffic Stream (ADDTS) function is how a WLAN client performs an admissions request to an AP.

Association and re-association message

The association message might contain one or more TSpecs and one TSRS IE if the STA wants to establish the traffic stream as part of the association. The re-association message might contain one or more TSPECs and one TSRS IE if an STA roams to another AP. 

The ADDTS contains the TSpec element that describes the traffic request. See figure 1 and figure 2 for examples of an ADDTS request and response. Apart from key data describing the traffic requirements, such as data rates and frame sizes, the TSpec element also tells the AP the minimum physical rate that the client device will use. This allows the calculation of how much time that station can potentially consume in sending and receiving in this TSpec, and therefore allowing the AP to calculate whether it has the resources to meet the TSpec. 

TSpec admission control is used by the WLAN client (target clients are VoIP handsets) when a call is initiated and during a roam request. During a roam, the TSpec request is appended to the re-association request. 

Note that action code is 0 for ADDTS request.

                                             figure-1

Action code is 1 for ADDTS response. Status code 0 specifies that admission is accepted.

                                            figure -2

Following is the sample data packets for voice(with UP = 7) and best effort (UP = 0).

Data frame (voice):

Part 2: P2P states

Run wpa_supplicant and wpa_cli in STA1 in another terminal.Similarly run wpa_supplicant and wpa_cli in STA2 also. (please refer to this link )

To discover other P2P devices, use p2p_find command.

Now, state machine enters scan and find phase. (find phase alternates between listen and search state.)

Scan phase

In scan phase all supported channels are scanned. It can either be an active scan or a passive scan. It sends probe requests in channel 1 to 11 or listens to beacon from channel 1 to 11.

Find phase:

1. Listen state

A P2P device that is not in a P2P group may use listen state to become discoverable.

• In listen state P2P device dwells on listen channel (configured in p2p.conf => p2p_listen_channel=1 to configure listen channel as 1) for at least a contiguous period of 500ms every 5 seconds.
•  Listens for probe requests and shall only respond to probe requests that contain P2P IE.
• If probe request contains WPS IE with device type attribute, it  shall only respond if device type is same as it's primary and secondary device type.

Duration of each listen state shall be a random number 'T' such that,
Max discoverable Interval value > T > Min discoverable Interval value

Following is a P2P IE in probe request frame:

Group Limit field is 0 indicates that additional P2P connections are supported.
1 indicates that no further connections are allowed.

WPS IE in the same probe request:

 

2. Search State:

Alternates between channels 1,6 and 11. Sends probe request in one channel and listens for probe response from the same channel.

Find state is a combination of listen and search states.

Supported rates

Supported Rates Element

This element is included in the following frames sent from AP.

1. Beacon
2. Probe Response
3. Association Response
4. Reassociation Response 

AP mandates that stations joining the BSS support certain rates.  The rates required by the AP are called basic rates. In other words, basic rate contains the rates that all devices in the cell must support.  All management frames, multicast, and broadcast packets are  transmitted using one of the Basic Rates.

The Supported Rates element specifies up to eight rates. The information field is encoded as 1 to 8 octets, where each octet describes a single Supported Rate.

IEEE 802.11 specification provides mapping value for each data rate. For example,

value for few of the rates: 

02 = 1 Mb/s
   03 = 1.5 Mb/s
04 = 2 Mb/s
   05 = 2.5 Mb/s
 06 = 3 Mb/s
    09 = 4.5 Mb/s
   11 = 5.5 Mb/s

                            Figure 1: BSSBasicRateSet parameter encoding

For the basic rate an encoding is used, which sets bit 7 to 1. Following is a part of beacon frame. As per figure 1, value for 1 Mb/s is 02 (0000 0010) . Notice the hex value highlighted in the following packet. it is 82 (1000 0010) for 1 Mb/s.

This is applicable only for the basic rates (rates marked with (B)). You can notice that the other values after 11(B) which is 0x96 begin with 0.Remaining values are supported rates. (Support for these rates is not required to join a BSS, but a station may choose to transmit at any supported rate that the receiving station supports.)

Extended Supported Rates element

For STAs supporting eight or fewer data rates, this element is optional for
inclusion. For STAs supporting more than eight data rates, this element shall
be included in all of the frame types that include the supported rates element.
The information field is encoded as 1 to 255 octets where each octet describes a single supported rate.

From beacon frame: