mjhjmtu

I'm trying to a find a better way to determine what specific firmware changes has been done on the Broadcom/Cypress WiFi chipset running on the Raspberry Pi3. The chip in question is the BCM943430, but the question would really span an entire class of drivers. It would also help resolve driver issues and modifications that are not documented elsewhere. The driver changelogs are extremely minimalistic, to say the least.

For example, in the latest firmware update, the FW Capabilities string can be extracted by:

# strings -a brcmfmac43430-sdio.bin |tail -2

43430a1-roml/sdio-g-p2p-pool-pno-pktfilter-keepalive-aoe-mchan-tdls-proptxstatus-ampduhostreorder-lpc-sr-bcmcps 
Version: 7.45.41.46 (r666254 CY) 
CRC: 970a33e2 Date: Mon 2017-08-07 00:48:36 PDT 
Ucode Ver: 1043.206
FWID 01-ef6eb4d3

In this case, the first part are the capabilities provided by the driver, separated by a dash (-).

ampduhostreorder
aoe
bcmcps
g
keepalive
lpc
mchan
p2p
pktfilter
pno
pool
proptxstatus
sdio
sr
tdls

I suppose these should coincide with what's shown with the iw list command.

# iw list
Wiphy phy0
 max # scan SSIDs: 10
 max scan IEs length: 2048 bytes
 max # sched scan SSIDs: 16
 max # match sets: 16
 max # scan plans: 1
 max scan plan interval: -1
 max scan plan iterations: 0
 Retry short limit: 7
 Retry long limit: 4
 Coverage class: 0 (up to 0m)
 Device supports T-DLS.
 Supported Ciphers:
 * WEP40 (00-0f-ac:1)
 * WEP104 (00-0f-ac:5)
 * TKIP (00-0f-ac:2)
 * CCMP-128 (00-0f-ac:4)
 Available Antennas: TX 0 RX 0
 Supported interface modes:
 * IBSS
 * managed
 * AP
 * P2P-client
 * P2P-GO
 * P2P-device
 Band 1:
 Capabilities: 0x1020
 HT20
 Static SM Power Save
 RX HT20 SGI
 No RX STBC
 Max AMSDU length: 3839 bytes
 DSSS/CCK HT40
 Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
 Minimum RX AMPDU time spacing: 16 usec (0x07)
 HT TX/RX MCS rate indexes supported: 0-7
 Bitrates (non-HT):
 * 1.0 Mbps
 * 2.0 Mbps (short preamble supported)
 * 5.5 Mbps (short preamble supported)
 * 11.0 Mbps (short preamble supported)
 * 6.0 Mbps
 * 9.0 Mbps
 * 12.0 Mbps
 * 18.0 Mbps
 * 24.0 Mbps
 * 36.0 Mbps
 * 48.0 Mbps
 * 54.0 Mbps
 Frequencies:
 * 2412 MHz [1] (20.0 dBm)
 * 2417 MHz [2] (20.0 dBm)
 * 2422 MHz [3] (20.0 dBm)
 * 2427 MHz [4] (20.0 dBm)
 * 2432 MHz [5] (20.0 dBm)
 * 2437 MHz [6] (20.0 dBm)
 * 2442 MHz [7] (20.0 dBm)
 * 2447 MHz [8] (20.0 dBm)
 * 2452 MHz [9] (20.0 dBm)
 * 2457 MHz [10] (20.0 dBm)
 * 2462 MHz [11] (20.0 dBm)
 * 2467 MHz [12] (20.0 dBm)
 * 2472 MHz [13] (20.0 dBm)
 * 2484 MHz [14] (20.0 dBm)
 Supported commands:
 * new_interface
 * set_interface
 * new_key
 * start_ap
 * join_ibss
 * set_pmksa
 * del_pmksa
 * flush_pmksa
 * remain_on_channel
 * frame
 * set_channel
 * tdls_oper
 * start_sched_scan
 * start_p2p_device
 * crit_protocol_start
 * crit_protocol_stop
 * connect
 * disconnect
 Supported TX frame types:
 * managed: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
 * P2P-client: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
 * P2P-GO: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
 * P2P-device: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
 Supported RX frame types:
 * managed: 0x40 0xd0
 * P2P-client: 0x40 0xd0
 * P2P-GO: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0
 * P2P-device: 0x40 0xd0
 software interface modes (can always be added):
 valid interface combinations:
 * # managed <= 1, # P2P-device <= 1, # P2P-client, P2P-GO <= 1,
 total <= 3, #channels <= 1
 * # managed <= 1, # AP <= 1, # P2P-client <= 1, # P2P-device <= 1,
 total <= 4, #channels <= 1
 Device supports scan flush.

or possibly with the iw features command:

# iw features
nl80211 features: 0x1
 * split wiphy dump
pi@xxx:~ $ iw commands
1 (0x1): get_wiphy
2 (0x2): set_wiphy
3 (0x3): new_wiphy
4 (0x4): del_wiphy
5 (0x5): get_interface
6 (0x6): set_interface
7 (0x7): new_interface
8 (0x8): del_interface
9 (0x9): get_key
10 (0xa): set_key
11 (0xb): new_key
12 (0xc): del_key
13 (0xd): get_beacon
14 (0xe): set_beacon
15 (0xf): start_ap
16 (0x10): stop_ap
17 (0x11): get_station
18 (0x12): set_station
19 (0x13): new_station
20 (0x14): del_station
21 (0x15): get_mpath
22 (0x16): set_mpath
23 (0x17): new_mpath
24 (0x18): del_mpath
25 (0x19): set_bss
26 (0x1a): set_reg
27 (0x1b): req_set_reg
28 (0x1c): get_mesh_config
29 (0x1d): set_mesh_config
30 (0x1e): Unknown command (30)
31 (0x1f): get_reg
32 (0x20): get_scan
33 (0x21): trigger_scan
34 (0x22): new_scan_results
35 (0x23): scan_aborted
36 (0x24): reg_change
37 (0x25): authenticate
38 (0x26): associate
39 (0x27): deauthenticate
40 (0x28): disassociate
41 (0x29): michael_mic_failure
42 (0x2a): reg_beacon_hint
43 (0x2b): join_ibss
44 (0x2c): leave_ibss
45 (0x2d): testmode
46 (0x2e): connect
47 (0x2f): roam
48 (0x30): disconnect
49 (0x31): set_wiphy_netns
50 (0x32): get_survey
51 (0x33): new_survey_results
52 (0x34): set_pmksa
53 (0x35): del_pmksa
54 (0x36): flush_pmksa
55 (0x37): remain_on_channel
56 (0x38): cancel_remain_on_channel
57 (0x39): set_tx_bitrate_mask
58 (0x3a): register_frame
59 (0x3b): frame
60 (0x3c): frame_tx_status
61 (0x3d): set_power_save
62 (0x3e): get_power_save
63 (0x3f): set_cqm
64 (0x40): notify_cqm
65 (0x41): set_channel
66 (0x42): set_wds_peer
67 (0x43): frame_wait_cancel
68 (0x44): join_mesh
69 (0x45): leave_mesh
70 (0x46): unprot_deauthenticate
71 (0x47): unprot_disassociate
72 (0x48): new_peer_candidate
73 (0x49): get_wowlan
74 (0x4a): set_wowlan
75 (0x4b): start_sched_scan
76 (0x4c): stop_sched_scan
77 (0x4d): sched_scan_results
78 (0x4e): sched_scan_stopped
79 (0x4f): set_rekey_offload
80 (0x50): pmksa_candidate
81 (0x51): tdls_oper
82 (0x52): tdls_mgmt
83 (0x53): unexpected_frame
84 (0x54): probe_client
85 (0x55): register_beacons
86 (0x56): unexpected_4addr_frame
87 (0x57): set_noack_map
88 (0x58): ch_switch_notify
89 (0x59): start_p2p_device
90 (0x5a): stop_p2p_device
91 (0x5b): conn_failed
92 (0x5c): set_mcast_rate
93 (0x5d): set_mac_acl
94 (0x5e): radar_detect
95 (0x5f): get_protocol_features
96 (0x60): update_ft_ies
97 (0x61): ft_event
98 (0x62): crit_protocol_start
99 (0x63): crit_protocol_stop
100 (0x64): get_coalesce
101 (0x65): set_coalesce
102 (0x66): channel_switch
103 (0x67): vendor
104 (0x68): set_qos_map
105 (0x69): add_tx_ts
106 (0x6a): del_tx_ts
107 (0x6b): get_mpp
108 (0x6c): join_ocb
109 (0x6d): leave_ocb
110 (0x6e): ch_switch_started_notify
111 (0x6f): tdls_channel_switch
112 (0x70): tdls_cancel_channel_switch
113 (0x71): wiphy_reg_change
114 (0x72): abort_scan
115 (0x73): start_nan
116 (0x74): stop_nan
117 (0x75): add_nan_function
118 (0x76): del_nan_function
119 (0x77): change_nan_config
120 (0x78): nan_match

I'm sure there must be some references or documentation somewhere, but I have not been able to find it.

How/where can I find out more what these various wifi driver capabilities mean?