STRUCT IWL_TOF_RANGE_REQ_AP_ENTRY_V9(9)

💖 struct iwl_tof_range_req_ap_entry_v9(9) — the Kernel API Manual, bestie edition 🎀

okay so this is a page straight out of the Kernel API Manual, and it's literally the whole blueprint for one AP entry in a ranging request. it's giving "my struct is the main character" energy, and honestly? deserved. let's get into it 🦋

---

✨ NAME ✨

struct iwl_tof_range_req_ap_entry_v9 — AP configuration parameters 💅

like, all the knobs and dials you need to tell the firmware how to range with one specific AP. no cap.

---

🌸 SYNOPSIS 🌸

struct iwl_tof_range_req_ap_entry_v9 {
    __le32 initiator_ap_flags;
    u8 channel_num;
    u8 format_bw;
    u8 ctrl_ch_position;
    u8 ftmr_max_retries;
    u8 bssid[ETH_ALEN];
    __le16 burst_period;
    u8 samples_per_burst;
    u8 num_of_bursts;
    u8 sta_id;
    u8 cipher;
    u8 hltk[HLTK_11AZ_LEN];
    u8 tk[TK_11AZ_LEN];
    __le16 calib[IWL_TOF_BW_NUM];
    u16 beacon_interval;
    u8 rx_pn[IEEE80211_CCMP_PN_LEN];
    u8 tx_pn[IEEE80211_CCMP_PN_LEN];
    u8 r2i_ndp_params;
    u8 i2r_ndp_params;
    u8 r2i_max_total_ltf;
    u8 i2r_max_total_ltf;
    u8 bss_color;
    u8 band;
    __le16 min_time_between_msr;
};

look at her. iconic. every field exactly where it belongs, not a single byte out of place 👑

---

🫶 Members 🫶

• initiator_ap_flags — the flag situation, ok. peep enum iwl_initiator_ap_flags.
• channel_num — the AP's channel number 📡
• format_bw — it's a enum iwl_location_format_bw, yes bestie, the enum.
• ctrl_ch_position — how the control channel position is coded relative to the center frequency. go look at iwl_mvm_get_ctrl_pos for the deets.
• ftmr_max_retries — max number of retries to send the FTMR when the AP just... doesn't reply 😭 like no answer at all.
• bssid — the AP's BSSID, obviously 💁‍♀️
• burst_period — okay this one's dual-purpose, pay attention:
  • for EDCA based ranging: the recommended value to send to the AP. it's the measurement periodicity, in units of 100ms. it gets ignored if num_of_bursts_exp = 0 🚩
  • for non trigger based NDP ranging: it's the max time between measurements, in units of milliseconds.
• samples_per_burst — the number of FTMs pairs in a single Burst (1-31) ✨
• num_of_bursts — recommended value to send to the AP. it's the 2s exponent of the number of measurement iterations (min 2^0 = 1, max 2^14). math era 🔥
• sta_id — the station id of the AP. only relevant when you're associated to the AP — otherwise set it to IWL_INVALID_STA, fr fr.
• cipher — the pairwise cipher suite for secured measurement. it's an enum iwl_location_cipher 🔐
• hltk — the HLTK to be used for secured 11az measurement
• tk — the TK to be used for secured 11az measurement
• calib — an array of calibration values per FTM rx bandwidth. if IWL_INITIATOR_AP_FLAGS_USE_CALIB is set, the fw will use the calibration value that corresponds to the rx bandwidth of the FTM frame 🎯
• beacon_interval — beacon interval of the AP in TUs. only required if IWL_INITIATOR_AP_FLAGS_TB is set.
• rx_pn — the next expected PN for protected management frames Rx. LE byte order. only valid if IWL_INITIATOR_AP_FLAGS_SECURED is set and sta_id is set to IWL_INVALID_STA.
• tx_pn — the next PN to use for protected management frames Tx. LE byte order. only valid if IWL_INITIATOR_AP_FLAGS_SECURED is set and sta_id is set to IWL_INVALID_STA.
• r2i_ndp_params — parameters for R2I NDP ranging negotiation:
  • bits 0 - 2: max LTF repetitions
  • bits 3 - 5: max number of spatial streams
  • bits 6 - 7: reserved
• i2r_ndp_params — parameters for I2R NDP ranging negotiation:
  • bits 0 - 2: max LTF repetitions
  • bits 3 - 5: max number of spatial streams (supported values are < 2)
  • bits 6 - 7: reserved
• r2i_max_total_ltf — R2I Max Total LTFs for NDP ranging negotiation. one of enum ieee80211_range_params_max_total_ltf.
• i2r_max_total_ltf — I2R Max Total LTFs for NDP ranging negotiation. one of enum ieee80211_range_params_max_total_ltf.
• bss_color — the BSS color of the responder. only valid if IWL_INITIATOR_AP_FLAGS_NON_TB or IWL_INITIATOR_AP_FLAGS_TB is set 🎨
• band — 0 for 5.2 GHz, 1 for 2.4 GHz, 2 for 6GHz. three bands, three numbers, slay.
• min_time_between_msr — for non trigger based NDP ranging, the minimum time between measurements in units of milliseconds ⏱️

---

🦋 SEE ALSO 🦋

literally the whole friend group, gathered in the kernel file ./drivers/net/wireless/intel/iwlwifi/fw/api/location.h:

• enum iwl_location_subcmd_ids(9)
• enum iwl_location_frame_format(9)
• enum iwl_location_bw(9)
• enum iwl_location_format_bw(9)
• struct iwl_tof_config_cmd(9)
• enum iwl_tof_bandwidth(9)
• enum iwl_tof_responder_cmd_valid_field(9)
• enum iwl_tof_responder_cfg_flags(9)
• struct iwl_tof_responder_config_cmd_v6(9)
• struct iwl_tof_responder_config_cmd_v7(9)
• struct iwl_tof_responder_config_cmd_v8(9)
• struct iwl_tof_responder_config_cmd_v9(9)
• struct iwl_tof_responder_config_cmd(9)
• struct iwl_tof_responder_dyn_config_cmd_v2(9)
• enum iwl_responder_dyn_cfg_valid_flags(9)
• struct iwl_tof_responder_dyn_config_cmd(9)
• struct iwl_tof_range_req_ext_cmd(9)
• enum iwl_tof_location_query(9)
• enum iwl_initiator_ap_flags(9)
• struct iwl_tof_range_req_ap_entry_v3(9)
• struct iwl_tof_range_req_ap_entry_v4(9)
• enum iwl_location_cipher(9)
• struct iwl_tof_range_req_ap_entry_v6(9)
• struct iwl_tof_range_req_ap_entry_v7(9)
• struct iwl_tof_range_req_ap_entry_v8(9)
• struct iwl_tof_range_req_ap_entry(9)
• enum iwl_tof_response_mode(9)
• enum iwl_tof_initiator_flags(9)
• struct iwl_tof_range_req_cmd_v5(9)
• struct iwl_tof_range_req_cmd_v7(9)
• struct iwl_tof_range_req_cmd_v8(9)
• struct iwl_tof_range_req_cmd_v9(9)
• struct iwl_tof_range_req_cmd_v11(9)
• struct iwl_tof_range_req_cmd_v12(9)
• struct iwl_tof_range_req_cmd_v13(9)
• struct iwl_tof_range_req_cmd(9)
• enum iwl_tof_entry_status(9)
• struct iwl_tof_range_rsp_ap_entry_ntfy_v3(9)
• struct iwl_tof_range_rsp_ap_entry_ntfy_v4(9)
• struct iwl_tof_range_rsp_ap_entry_ntfy_v5(9)
• struct iwl_tof_range_rsp_ap_entry_ntfy_v7(9)
• struct iwl_tof_range_rsp_ap_entry_ntfy(9)
• enum iwl_tof_response_status(9)
• struct iwl_tof_range_rsp_ntfy_v5(9)
• struct iwl_tof_range_rsp_ntfy_v6(9)
• struct iwl_tof_range_rsp_ntfy_v7(9)
• struct iwl_tof_range_rsp_ntfy_v9(9)
• struct iwl_tof_range_rsp_ntfy(9)
• struct iwl_tof_mcsi_notif(9)
• struct iwl_tof_range_abort_cmd(9)
• struct iwl_ftm_responder_stats(9)

that's the whole squad, all accounted for 🫶

---

heads up bestie: half these fields are only valid when a specific flag is set (IWL_INITIATOR_AP_FLAGS_SECURED, IWL_INITIATOR_AP_FLAGS_TB, IWL_INITIATOR_AP_FLAGS_USE_CALIB, IWL_INITIATOR_AP_FLAGS_NON_TB). read the conditions before you go filling things in, i'm begging 🙈

---

and that's a wrap on this one, babe ✨ source path ./drivers/net/wireless/intel/i... (yes it's truncated like that, that's just how it is), dated October 2026, and the manpage name is struct iwl_t..._ap_entry_v9(9) — structural, truncated, still gorgeous 💜 go range some APs fr fr 💅