xref: /freebsd/sys/compat/linuxkpi/common/src/linux_80211.c (revision 75aadc902298005c47d2b931c483452027ceae69)
1 /*-
2  * Copyright (c) 2020-2026 The FreeBSD Foundation
3  * Copyright (c) 2020-2025 Bjoern A. Zeeb
4  *
5  * This software was developed by Björn Zeeb under sponsorship from
6  * the FreeBSD Foundation.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 /*
31  * Public functions are called linuxkpi_*().
32  * Internal (static) functions are called lkpi_*().
33  *
34  * The internal structures holding metadata over public structures are also
35  * called lkpi_xxx (usually with a member at the end called xxx).
36  * Note: we do not replicate the structure names but the general variable names
37  * for these (e.g., struct hw -> struct lkpi_hw, struct sta -> struct lkpi_sta).
38  * There are macros to access one from the other.
39  * We call the internal versions lxxx (e.g., hw -> lhw, sta -> lsta).
40  */
41 
42 /*
43  * TODO:
44  * - lots :)
45  * - HW_CRYPTO: we need a "keystore" and an ordered list for suspend/resume.
46  */
47 
48 #include <sys/param.h>
49 #include <sys/types.h>
50 #include <sys/kernel.h>
51 #include <sys/errno.h>
52 #include <sys/malloc.h>
53 #include <sys/module.h>
54 #include <sys/mutex.h>
55 #include <sys/sbuf.h>
56 #include <sys/socket.h>
57 #include <sys/sysctl.h>
58 #include <sys/queue.h>
59 #include <sys/taskqueue.h>
60 #include <sys/libkern.h>
61 
62 #include <net/if.h>
63 #include <net/if_var.h>
64 #include <net/if_media.h>
65 #include <net/ethernet.h>
66 
67 #include <net80211/ieee80211_var.h>
68 #include <net80211/ieee80211_proto.h>
69 #include <net80211/ieee80211_ratectl.h>
70 #include <net80211/ieee80211_radiotap.h>
71 #include <net80211/ieee80211_vht.h>
72 
73 #define	LINUXKPI_NET80211
74 #include <net/mac80211.h>
75 
76 #include <linux/workqueue.h>
77 #include <linux/rculist.h>
78 #include "linux_80211.h"
79 
80 /* #define	LKPI_80211_USE_SCANLIST */
81 /* #define	LKPI_80211_BGSCAN */
82 #define	LKPI_80211_WME
83 #define	LKPI_80211_HW_CRYPTO
84 #define	LKPI_80211_HT
85 #define	LKPI_80211_VHT
86 
87 #if defined(LKPI_80211_VHT) && !defined(LKPI_80211_HT)
88 #define	LKPI_80211_HT
89 #endif
90 #if defined(LKPI_80211_HT) && !defined(LKPI_80211_HW_CRYPTO)
91 #define	LKPI_80211_HW_CRYPTO
92 #endif
93 
94 static MALLOC_DEFINE(M_LKPI80211, "lkpi80211", "LinuxKPI 80211 compat");
95 
96 /* XXX-BZ really want this and others in queue.h */
97 #define	TAILQ_ELEM_INIT(elm, field) do {				\
98 	(elm)->field.tqe_next = NULL;					\
99 	(elm)->field.tqe_prev = NULL;					\
100 } while (0)
101 
102 /* -------------------------------------------------------------------------- */
103 
104 SYSCTL_DECL(_compat_linuxkpi);
105 SYSCTL_NODE(_compat_linuxkpi, OID_AUTO, 80211, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
106     "LinuxKPI 802.11 compatibility layer");
107 
108 static int lkpi_suspend_type = 1;
109 SYSCTL_INT(_compat_linuxkpi_80211, OID_AUTO, suspend_type, CTLFLAG_RW,
110     &lkpi_suspend_type, 0,
111     "LinuxKPI 802.11 suspend type bitmask (0=off, 1=net80211, 2=wowlan");
112 
113 static bool lkpi_order_scanlist = false;
114 SYSCTL_BOOL(_compat_linuxkpi_80211, OID_AUTO, order_scanlist, CTLFLAG_RW,
115     &lkpi_order_scanlist, 0, "Enable LinuxKPI 802.11 scan list shuffeling");
116 
117 #if defined(LKPI_80211_HW_CRYPTO)
118 static bool lkpi_hwcrypto = false;
119 SYSCTL_BOOL(_compat_linuxkpi_80211, OID_AUTO, hw_crypto, CTLFLAG_RDTUN,
120     &lkpi_hwcrypto, 0, "Enable LinuxKPI 802.11 hardware crypto offload");
121 
122 static bool lkpi_hwcrypto_tkip = false;
123 SYSCTL_BOOL(_compat_linuxkpi_80211, OID_AUTO, tkip, CTLFLAG_RDTUN,
124     &lkpi_hwcrypto_tkip, 0, "Enable LinuxKPI 802.11 TKIP crypto offload");
125 #endif
126 
127 /* Keep public for as long as header files are using it too. */
128 int linuxkpi_debug_80211;
129 
130 #ifdef LINUXKPI_DEBUG_80211
131 SYSCTL_INT(_compat_linuxkpi_80211, OID_AUTO, debug, CTLFLAG_RWTUN,
132     &linuxkpi_debug_80211, 0, "LinuxKPI 802.11 debug level");
133 
134 #define	UNIMPLEMENTED		if (linuxkpi_debug_80211 & D80211_TODO)		\
135     printf("XXX-TODO %s:%d: UNIMPLEMENTED\n", __func__, __LINE__)
136 #define	TRACEOK(_fmt, ...)	if (linuxkpi_debug_80211 & D80211_TRACEOK)	\
137     printf("%s:%d: TRACEPOINT " _fmt "\n", __func__, __LINE__, ##__VA_ARGS__)
138 #else
139 #define	UNIMPLEMENTED		do { } while (0)
140 #define	TRACEOK(...)		do { } while (0)
141 #endif
142 
143 /* #define	PREP_TX_INFO_DURATION	(IEEE80211_TRANS_WAIT * 1000) */
144 #ifndef PREP_TX_INFO_DURATION
145 #define	PREP_TX_INFO_DURATION	0 /* Let the driver do its thing. */
146 #endif
147 
148 /* This is DSAP | SSAP | CTRL | ProtoID/OrgCode{3}. */
149 const uint8_t rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
150 
151 /* IEEE 802.11-05/0257r1 */
152 const uint8_t bridge_tunnel_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
153 
154 /* IEEE 802.11e Table 20i-UP-to-AC mappings. */
155 static const uint8_t ieee80211e_up_to_ac[] = {
156 	IEEE80211_AC_BE,
157 	IEEE80211_AC_BK,
158 	IEEE80211_AC_BK,
159 	IEEE80211_AC_BE,
160 	IEEE80211_AC_VI,
161 	IEEE80211_AC_VI,
162 	IEEE80211_AC_VO,
163 	IEEE80211_AC_VO,
164 #if 0
165 	IEEE80211_AC_VO, /* We treat MGMT as TID 8, which is set as AC_VO */
166 #endif
167 };
168 
169 const struct cfg80211_ops linuxkpi_mac80211cfgops = {
170 	/*
171 	 * XXX TODO need a "glue layer" to link cfg80211 ops to
172 	 * mac80211 and to the driver or net80211.
173 	 * Can we pass some on 1:1? Need to compare the (*f)().
174 	 */
175 };
176 
177 #if 0
178 static struct lkpi_sta *lkpi_find_lsta_by_ni(struct lkpi_vif *,
179     struct ieee80211_node *);
180 #endif
181 static void lkpi_sw_scan_task(void *, int);
182 static void lkpi_80211_txq_tx_one(struct lkpi_sta *, struct mbuf *);
183 static void lkpi_80211_txq_task(void *, int);
184 static void lkpi_80211_lhw_rxq_task(void *, int);
185 static void lkpi_ieee80211_free_skb_mbuf(void *);
186 #ifdef LKPI_80211_WME
187 static int lkpi_wme_update(struct lkpi_hw *, struct ieee80211vap *, bool);
188 #endif
189 static int lkpi_80211_update_chandef(struct ieee80211_hw *,
190     struct ieee80211_chanctx_conf *);
191 static void lkpi_ieee80211_wake_queues_locked(struct ieee80211_hw *);
192 
193 static const char *
194 lkpi_rate_info_bw_to_str(enum rate_info_bw bw)
195 {
196 
197 	switch (bw) {
198 
199         case RATE_INFO_BW_20:
200 		return ("20");
201 		break;
202         case RATE_INFO_BW_5:
203 		return ("5");
204 		break;
205         case RATE_INFO_BW_10:
206 		return ("10");
207 		break;
208         case RATE_INFO_BW_40:
209 		return ("40");
210 		break;
211         case RATE_INFO_BW_80:
212 		return ("80");
213 		break;
214         case RATE_INFO_BW_160:
215 		return ("160");
216 		break;
217         case RATE_INFO_BW_HE_RU:
218 		IMPROVE("nl80211_he_ru_alloc");
219 		return ("HE_RU");
220 		break;
221         case RATE_INFO_BW_320:
222 		return ("320");
223 		break;
224         case RATE_INFO_BW_EHT_RU:
225 		IMPROVE("nl80211_eht_ru_alloc");
226 		return ("EHT_RU");
227 		break;
228 	default:
229 		return ("?");
230 		break;
231 	}
232 }
233 
234 static void
235 lkpi_nl80211_sta_info_to_str(struct sbuf *s, const char *prefix,
236     const uint64_t flags)
237 {
238 	int bit, i;
239 
240 	sbuf_printf(s, "%s %#010jx", prefix, flags);
241 
242 	i = 0;
243 	for (bit = 0; bit < BITS_PER_TYPE(flags); bit++) {
244 
245 		if ((flags & BIT_ULL(bit)) == 0)
246 			continue;
247 
248 #define	EXPAND_CASE(_flag)						\
249 	case NL80211_STA_INFO_ ## _flag:				\
250 		sbuf_printf(s, "%c%s", (i == 0) ? '<' : ',', #_flag);	\
251 		i++;							\
252 		break;
253 
254 		switch (bit) {
255 		EXPAND_CASE(BEACON_RX)
256 		EXPAND_CASE(BEACON_SIGNAL_AVG)
257 		EXPAND_CASE(BSS_PARAM)
258 		EXPAND_CASE(CHAIN_SIGNAL)
259 		EXPAND_CASE(CHAIN_SIGNAL_AVG)
260 		EXPAND_CASE(CONNECTED_TIME)
261 		EXPAND_CASE(INACTIVE_TIME)
262 		EXPAND_CASE(SIGNAL)
263 		EXPAND_CASE(SIGNAL_AVG)
264 		EXPAND_CASE(STA_FLAGS)
265 		EXPAND_CASE(RX_BITRATE)
266 		EXPAND_CASE(RX_PACKETS)
267 		EXPAND_CASE(RX_BYTES)
268 		EXPAND_CASE(RX_DROP_MISC)
269 		EXPAND_CASE(TX_BITRATE)
270 		EXPAND_CASE(TX_PACKETS)
271 		EXPAND_CASE(TX_BYTES)
272 		EXPAND_CASE(TX_BYTES64)
273 		EXPAND_CASE(RX_BYTES64)
274 		EXPAND_CASE(TX_FAILED)
275 		EXPAND_CASE(TX_RETRIES)
276 		EXPAND_CASE(RX_DURATION)
277 		EXPAND_CASE(TX_DURATION)
278 		EXPAND_CASE(ACK_SIGNAL)
279 		EXPAND_CASE(ACK_SIGNAL_AVG)
280 		default:
281 			sbuf_printf(s, "%c?%d", (i == 0) ? '<' : ',', bit);
282 			break;
283 		}
284 	}
285 #undef	EXPAND_CASE
286 	if (i > 0)
287 		sbuf_printf(s, ">");
288 	sbuf_printf(s, "\n");
289 }
290 
291 static void
292 lkpi_80211_dump_lvif_stas(struct lkpi_vif *lvif, struct sbuf *s, bool dump_queues)
293 {
294 	struct lkpi_hw *lhw;
295 	struct ieee80211_hw *hw;
296 	struct ieee80211vap *vap;
297 	struct ieee80211_vif *vif;
298 	struct lkpi_sta *lsta;
299 	struct ieee80211_sta *sta;
300 	struct station_info sinfo;
301 	int error;
302 	uint8_t tid;
303 
304 	vif = LVIF_TO_VIF(lvif);
305 	vap = LVIF_TO_VAP(lvif);
306 	lhw = vap->iv_ic->ic_softc;
307 	hw = LHW_TO_HW(lhw);
308 
309 	wiphy_lock(hw->wiphy);
310 	list_for_each_entry(lsta, &lvif->lsta_list, lsta_list) {
311 		sta = LSTA_TO_STA(lsta);
312 
313 		sbuf_putc(s, '\n');
314 		sbuf_printf(s, "lsta %p sta %p added_to_drv %d\n", lsta, sta, lsta->added_to_drv);
315 
316 		memset(&sinfo, 0, sizeof(sinfo));
317 		error = lkpi_80211_mo_sta_statistics(hw, vif, sta, &sinfo);
318 		if (error == EEXIST)	/* Not added to driver. */
319 			continue;
320 		if (error == ENOTSUPP) {
321 			sbuf_printf(s, " sta_statistics not supported\n");
322 			continue;
323 		}
324 		if (error != 0) {
325 			sbuf_printf(s, " sta_statistics failed: %d\n", error);
326 			continue;
327 		}
328 
329 		/* If no RX_BITRATE is reported, try to fill it in from the lsta sinfo. */
330 		if ((sinfo.filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) == 0 &&
331 		    (lsta->sinfo.filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) != 0) {
332 			memcpy(&sinfo.rxrate, &lsta->sinfo.rxrate, sizeof(sinfo.rxrate));
333 			sinfo.filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
334 		}
335 		/* If no CHAIN_SIGNAL is reported,  try to fill it in from the lsta sinfo. */
336 		if ((sinfo.filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) == 0 &&
337 		    (lsta->sinfo.filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) != 0) {
338 			sinfo.chains = lsta->sinfo.chains;
339 			memcpy(sinfo.chain_signal, lsta->sinfo.chain_signal,
340 			    sizeof(sinfo.chain_signal));
341 			sinfo.filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
342 		}
343 
344 		lkpi_nl80211_sta_info_to_str(s, " nl80211_sta_info (valid fields)", sinfo.filled);
345 		sbuf_printf(s, " connected_time %u inactive_time %u\n",
346 		    sinfo.connected_time, sinfo.inactive_time);
347 		sbuf_printf(s, " rx_bytes %ju rx_packets %u rx_dropped_misc %u\n",
348 		    (uintmax_t)sinfo.rx_bytes, sinfo.rx_packets, sinfo.rx_dropped_misc);
349 		sbuf_printf(s, " rx_duration %ju rx_beacon %u rx_beacon_signal_avg %d\n",
350 		    (uintmax_t)sinfo.rx_duration, sinfo.rx_beacon, (int8_t)sinfo.rx_beacon_signal_avg);
351 
352 		sbuf_printf(s, " tx_bytes %ju tx_packets %u tx_failed %u\n",
353 		    (uintmax_t)sinfo.tx_bytes, sinfo.tx_packets, sinfo.tx_failed);
354 		sbuf_printf(s, " tx_duration %ju tx_retries %u\n",
355 		    (uintmax_t)sinfo.tx_duration, sinfo.tx_retries);
356 
357 		sbuf_printf(s, " signal %d signal_avg %d ack_signal %d avg_ack_signal %d\n",
358 		    sinfo.signal, sinfo.signal_avg, sinfo.ack_signal, sinfo.avg_ack_signal);
359 		sbuf_printf(s, " generation %d assoc_req_ies_len %zu chains %#04x\n",
360 		    sinfo.generation, sinfo.assoc_req_ies_len, sinfo.chains);
361 
362 		for (int i = 0; i < nitems(sinfo.chain_signal) && i < IEEE80211_MAX_CHAINS; i++) {
363 			if (!(sinfo.chains & BIT(i)))
364 				continue;
365 			sbuf_printf(s, "  chain[%d] signal %d signal_avg %d\n",
366 			    i, (int8_t)sinfo.chain_signal[i], (int8_t)sinfo.chain_signal_avg[i]);
367 		}
368 
369 		/* assoc_req_ies, bss_param, sta_flags */
370 
371 		sbuf_printf(s, " rxrate: flags %b bw %u(%s) legacy %u kbit/s mcs %u nss %u\n",
372 		    sinfo.rxrate.flags, CFG80211_RATE_INFO_FLAGS_BITS,
373 		    sinfo.rxrate.bw, lkpi_rate_info_bw_to_str(sinfo.rxrate.bw),
374 		    sinfo.rxrate.legacy * 100,
375 		    sinfo.rxrate.mcs, sinfo.rxrate.nss);
376 		sbuf_printf(s, "         he_dcm %u he_gi %u he_ru_alloc %u eht_gi %u\n",
377 		    sinfo.rxrate.he_dcm, sinfo.rxrate.he_gi, sinfo.rxrate.he_ru_alloc,
378 		    sinfo.rxrate.eht_gi);
379 		sbuf_printf(s, " txrate: flags %b bw %u(%s) legacy %u kbit/s mcs %u nss %u\n",
380 		    sinfo.txrate.flags, CFG80211_RATE_INFO_FLAGS_BITS,
381 		    sinfo.txrate.bw, lkpi_rate_info_bw_to_str(sinfo.txrate.bw),
382 		    sinfo.txrate.legacy * 100,
383 		    sinfo.txrate.mcs, sinfo.txrate.nss);
384 		sbuf_printf(s, "         he_dcm %u he_gi %u he_ru_alloc %u eht_gi %u\n",
385 		    sinfo.txrate.he_dcm, sinfo.txrate.he_gi, sinfo.txrate.he_ru_alloc,
386 		    sinfo.txrate.eht_gi);
387 
388 		if (!dump_queues)
389 			continue;
390 
391 		/* Dump queue information. */
392 		sbuf_printf(s, " Queue information:\n");
393 		sbuf_printf(s, "  frms direct tx %ju\n", lsta->frms_tx);
394 		for (tid = 0; tid <= IEEE80211_NUM_TIDS; tid++) {
395 			struct lkpi_txq *ltxq;
396 
397 			if (sta->txq[tid] == NULL) {
398 				sbuf_printf(s, "  tid %-2u NOQ\n", tid);
399 				continue;
400 			}
401 
402 			ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
403 #ifdef __notyet__
404 			sbuf_printf(s, "  tid %-2u flags: %b "
405 			    "txq_generation %u skbq len %d\n",
406 			    tid, ltxq->flags, LKPI_TXQ_FLAGS_BITS,
407 			    ltxq->txq_generation,
408 			    skb_queue_len_lockless(&ltxq->skbq));
409 #else
410 			sbuf_printf(s, "  tid %-2u "
411 			    "txq_generation %u skbq len %d\n",
412 			    tid,
413 			    ltxq->txq_generation,
414 			    skb_queue_len_lockless(&ltxq->skbq));
415 #endif
416 			sbuf_printf(s, "         frms_enqueued %ju frms_dequeued %ju "
417 			    "frms_tx %ju\n",
418 			    ltxq->frms_enqueued, ltxq->frms_dequeued, ltxq->frms_tx);
419 		}
420 	}
421 	wiphy_unlock(hw->wiphy);
422 }
423 
424 static int
425 lkpi_80211_dump_stas(SYSCTL_HANDLER_ARGS)
426 {
427 	struct lkpi_vif *lvif;
428 	struct sbuf s;
429 
430 	if (req->newptr)
431 		return (EPERM);
432 
433 	lvif = (struct lkpi_vif *)arg1;
434 
435 	sbuf_new_for_sysctl(&s, NULL, 1024, req);
436 
437 	lkpi_80211_dump_lvif_stas(lvif, &s, false);
438 
439 	sbuf_finish(&s);
440 	sbuf_delete(&s);
441 
442 	return (0);
443 }
444 
445 static int
446 lkpi_80211_dump_sta_queues(SYSCTL_HANDLER_ARGS)
447 {
448 	struct lkpi_vif *lvif;
449 	struct sbuf s;
450 
451 	if (req->newptr)
452 		return (EPERM);
453 
454 	lvif = (struct lkpi_vif *)arg1;
455 
456 	sbuf_new_for_sysctl(&s, NULL, 1024, req);
457 
458 	lkpi_80211_dump_lvif_stas(lvif, &s, true);
459 
460 	sbuf_finish(&s);
461 	sbuf_delete(&s);
462 
463 	return (0);
464 }
465 
466 static enum ieee80211_sta_rx_bandwidth
467 lkpi_cw_to_rx_bw(enum nl80211_chan_width cw)
468 {
469 	switch (cw) {
470 	case NL80211_CHAN_WIDTH_320:
471 		return (IEEE80211_STA_RX_BW_320);
472 	case NL80211_CHAN_WIDTH_160:
473 	case NL80211_CHAN_WIDTH_80P80:
474 		return (IEEE80211_STA_RX_BW_160);
475 	case NL80211_CHAN_WIDTH_80:
476 		return (IEEE80211_STA_RX_BW_80);
477 	case NL80211_CHAN_WIDTH_40:
478 		return (IEEE80211_STA_RX_BW_40);
479 	case NL80211_CHAN_WIDTH_20:
480 	case NL80211_CHAN_WIDTH_20_NOHT:
481 		return (IEEE80211_STA_RX_BW_20);
482 	case NL80211_CHAN_WIDTH_5:
483 	case NL80211_CHAN_WIDTH_10:
484 		/* Unsupported input. */
485 		return (IEEE80211_STA_RX_BW_20);
486 	}
487 }
488 
489 static enum nl80211_chan_width
490 lkpi_rx_bw_to_cw(enum ieee80211_sta_rx_bandwidth rx_bw)
491 {
492 	switch (rx_bw) {
493 	case IEEE80211_STA_RX_BW_20:
494 		return (NL80211_CHAN_WIDTH_20);	/* _NOHT */
495 	case IEEE80211_STA_RX_BW_40:
496 		return (NL80211_CHAN_WIDTH_40);
497 	case IEEE80211_STA_RX_BW_80:
498 		return (NL80211_CHAN_WIDTH_80);
499 	case IEEE80211_STA_RX_BW_160:
500 		return (NL80211_CHAN_WIDTH_160); /* 80P80 */
501 	case IEEE80211_STA_RX_BW_320:
502 		return (NL80211_CHAN_WIDTH_320);
503 	}
504 }
505 
506 static enum ieee80211_bss_changed
507 lkpi_sta_supp_rates(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
508     struct ieee80211_node *ni,
509     enum ieee80211_rate_control_changed_flags *rc_changed)
510 {
511 	struct lkpi_vif *lvif;
512 	struct lkpi_sta *lsta;
513 	struct ieee80211_sta *sta;
514 	enum ieee80211_bss_changed bss_changed;
515 	struct ieee80211_supported_band *supband;
516 	uint32_t supp_rates, basic_rates;
517 	int band, i, n;
518 
519 	bss_changed = 0;
520 
521 	band = vif->bss_conf.chanreq.oper.chan->band;
522 	supband = hw->wiphy->bands[band];
523 	if (supband == NULL)
524 		return (bss_changed);
525 
526 	lvif = VIF_TO_LVIF(vif);
527 	lsta = ni->ni_drv_data;
528 	sta = LSTA_TO_STA(lsta);
529 
530 	supp_rates = 0;
531 	basic_rates = 0;
532 
533 	for (n = 0; n < ni->ni_rates.rs_nrates; n++) {
534 		uint8_t supp_rate;
535 		uint16_t bitr;
536 		bool basic;
537 
538 		/* Note: net80211 rates are in 0.5Mbit/s, e.g., 108 is 54Mbit/s. */
539 		supp_rate = ni->ni_rates.rs_rates[n] & (~IEEE80211_RATE_BASIC);
540 		basic = (ni->ni_rates.rs_rates[n] & IEEE80211_RATE_BASIC) != 0;
541 
542 		for (i = 0; i < supband->n_bitrates; i++) {
543 			/* Band bitrates are * 10 so, e.g., 55 is 5.5Mbit/s. */
544 			/* To match net80211 rates we need to do a DIV5. */
545 			bitr = howmany(supband->bitrates[i].bitrate, 5);
546 			if (supp_rate == bitr) {
547 				supp_rates |= BIT(i);
548 				if (basic)
549 					basic_rates |= BIT(i);
550 			}
551 			/*
552 			 * We are not checking if we are doing 11b or 11g and
553 			 * if the rate is fine for each.
554 			 */
555 		}
556 		TRACE_RATES("supp_rate %u basic %d supp_rates %#010x basic_rates %#010x",
557 		    supp_rate, basic, supp_rates, basic_rates);
558 	}
559 	if (basic_rates != 0 &&
560 	    vif->bss_conf.basic_rates != basic_rates) {
561 		TRACE_RATES("vif bss_conf basic_rates %#010x update to %#010x",
562 		    vif->bss_conf.basic_rates, basic_rates);
563 		vif->bss_conf.basic_rates = basic_rates;
564 		bss_changed |= BSS_CHANGED_BASIC_RATES;
565 	}
566 	/* Guard against net80211 not having any rates set when we get here. */
567 	if (supp_rates == 0)
568 		supp_rates = vif->bss_conf.basic_rates;
569 	if (sta->deflink.supp_rates[band] != supp_rates) {
570 		TRACE_RATES("band %d supp_rates %#010x update to %#010x",
571 		    band, sta->deflink.supp_rates[band], supp_rates);
572 		sta->deflink.supp_rates[band] = supp_rates;
573 		if (rc_changed != NULL)
574 			*rc_changed |= IEEE80211_RC_SUPP_RATES_CHANGED;
575 	}
576 
577 	/*
578 	 * br_mask got initialized in lkpi_ic_vap_create().
579 	 * Do a basic rates check against it for the current band if we are
580 	 * in a state to have all the above information.
581 	 */
582 	TRACE_RATES("band %d br_mask legacy %#010x & basic_rates %#010x != 0?",
583 	    band, lvif->br_mask.control[band].legacy, vif->bss_conf.basic_rates);
584 	if (band == vif->bss_conf.chanreq.oper.chan->band &&
585 	    (lvif->br_mask.control[band].legacy & vif->bss_conf.basic_rates) == 0) {
586 		/* In our setup this should never happen. */
587 		printf("%s: WARNING: no acceptable basic rate %#010x & %#010x\n",
588 		     __func__, lvif->br_mask.control[band].legacy, vif->bss_conf.basic_rates);
589 	}
590 
591 	/*
592 	 * XXX-BZ we should track changes here as well and call or let the
593 	 * caller call lkpi_80211_mo_set_bitrate_mask() if needed.
594 	 * Note: the call in lkpi_sta_scan_to_auth() still have to
595 	 * happen unconditionally for the initial setting.
596 	 */
597 #if defined(LKPI_80211_HT)
598 	if (supband->ht_cap.ht_supported) {
599 		memcpy(lvif->br_mask.control[band].ht_mcs,
600 		    supband->ht_cap.mcs.rx_mask,
601 		    sizeof(lvif->br_mask.control[band].ht_mcs));
602 #if defined(LINUXKPI_DEBUG_80211)
603 		for (int i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
604 			TRACE_RATES("band %d ht_mcs[%d] %#010x",
605 			    band, i, lvif->br_mask.control[band].ht_mcs[i]);
606 		}
607 #endif
608 	}
609 #endif /* LKPI_80211_HT */
610 #if defined(LKPI_80211_VHT)
611 	if (supband->vht_cap.vht_supported) {
612 		uint16_t mcs_map, val;
613 		uint8_t nss;
614 
615 		mcs_map = supband->vht_cap.vht_mcs.tx_mcs_map;
616 		for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
617 			TRACE_RATES("band %d nss %d vht_mcs.tx_mcs_map %#06x mcs_map %#06x & 0x3 = %#06x",
618 			    band, nss, supband->vht_cap.vht_mcs.tx_mcs_map, mcs_map, mcs_map & 0x3);
619 			switch (mcs_map & 0x3) {
620 			case IEEE80211_VHT_MCS_SUPPORT_0_7:
621 				val = 0x00ff;
622 				break;
623 			case IEEE80211_VHT_MCS_SUPPORT_0_8:
624 				val = 0x01ff;
625 				break;
626 			case IEEE80211_VHT_MCS_SUPPORT_0_9:
627 				val = 0x03ff;
628 				break;
629 			case IEEE80211_VHT_MCS_NOT_SUPPORTED:
630 				val = 0;
631 				break;
632 			}
633 			lvif->br_mask.control[band].vht_mcs[nss] = val;
634 			TRACE_RATES("band %d nss %d vht_mcs %#06x",
635 			    band, nss, lvif->br_mask.control[band].vht_mcs[nss]);
636 			mcs_map >>= 2;
637 		}
638 	}
639 #endif /* LKPI_80211_VHT */
640 
641 	return (bss_changed);
642 }
643 
644 static void
645 lkpi_sync_chanctx_cw_from_rx_bw(struct ieee80211_hw *hw,
646     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
647 {
648 	struct lkpi_hw *lhw;
649 	struct ieee80211_chanctx_conf *chanctx_conf;
650 	enum ieee80211_sta_rx_bandwidth old_bw;
651 	uint32_t changed;
652 
653 	lockdep_assert_wiphy(hw->wiphy);
654 
655 	chanctx_conf = rcu_dereference_protected(vif->bss_conf.chanctx_conf,
656 	    lockdep_is_held(&hw->wiphy->mtx));
657 	if (chanctx_conf == NULL)
658 		return;
659 
660 	old_bw = lkpi_cw_to_rx_bw(chanctx_conf->def.width);
661 	TRACE_RATES("old_bw %d sta->deflink.bandwidth %d hw->conf.chandef.width %d",
662 	    old_bw, sta->deflink.bandwidth, lkpi_cw_to_rx_bw(hw->conf.chandef.width));
663 
664 	lhw = HW_TO_LHW(hw);
665 	if (old_bw == sta->deflink.bandwidth &&
666 	    (!lhw->emulate_chanctx || old_bw == lkpi_cw_to_rx_bw(hw->conf.chandef.width)))
667 		return;
668 
669 	chanctx_conf->def.width = lkpi_rx_bw_to_cw(sta->deflink.bandwidth);
670 	if (chanctx_conf->def.width == NL80211_CHAN_WIDTH_20 &&
671 	    !sta->deflink.ht_cap.ht_supported)
672 		chanctx_conf->def.width = NL80211_CHAN_WIDTH_20_NOHT;
673 
674 	chanctx_conf->min_def = chanctx_conf->def;
675 
676 	vif->bss_conf.chanreq.oper.width = chanctx_conf->def.width;
677 
678 	TRACE_RATES("chanctx_conf %p def.width %d sta->deflink.bandwidth %d "
679 	    "ht_supported %d vht_supported %d",
680 	    chanctx_conf, chanctx_conf->def.width, sta->deflink.bandwidth,
681 	    sta->deflink.ht_cap.ht_supported, sta->deflink.vht_cap.vht_supported);
682 
683 	changed = IEEE80211_CHANCTX_CHANGE_MIN_WIDTH;
684 	changed |= IEEE80211_CHANCTX_CHANGE_WIDTH;
685 	lkpi_80211_mo_change_chanctx(hw, chanctx_conf, changed);
686 }
687 
688 #if defined(LKPI_80211_HT)
689 static void
690 lkpi_sta_sync_ht_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
691     struct ieee80211_sta *sta, struct ieee80211_node *ni)
692 {
693 	struct ieee80211vap *vap;
694 	uint8_t *ie;
695 	struct ieee80211_ht_cap *htcap;
696 	struct ieee80211_sta_ht_cap *ht_cap, *sta_ht_cap;
697 	enum nl80211_band band;
698 	int i, rx_nss;
699 
700 	if ((ni->ni_flags & IEEE80211_NODE_HT) == 0) {
701 		sta->deflink.ht_cap.ht_supported = false;
702 		TRACE_RATES("HT ht_supported %d", sta->deflink.ht_cap.ht_supported);
703 		return;
704 	}
705 
706 	sta->deflink.ht_cap.ht_supported = true;
707 
708 	/* htcap->ampdu_params_info */
709 	vap = ni->ni_vap;
710 	sta->deflink.ht_cap.ampdu_density = _IEEE80211_MASKSHIFT(ni->ni_htparam, IEEE80211_HTCAP_MPDUDENSITY);
711 	if (sta->deflink.ht_cap.ampdu_density > vap->iv_ampdu_density)
712 		sta->deflink.ht_cap.ampdu_density = vap->iv_ampdu_density;
713 	sta->deflink.ht_cap.ampdu_factor = _IEEE80211_MASKSHIFT(ni->ni_htparam, IEEE80211_HTCAP_MAXRXAMPDU);
714 	if (sta->deflink.ht_cap.ampdu_factor > vap->iv_ampdu_rxmax)
715 		sta->deflink.ht_cap.ampdu_factor = vap->iv_ampdu_rxmax;
716 
717 	ie = ni->ni_ies.htcap_ie;
718 	KASSERT(ie != NULL, ("%s: HT but no htcap_ie on ni %p\n", __func__, ni));
719 	if (ie[0] == IEEE80211_ELEMID_VENDOR)
720 		ie += 4;
721 	ie += 2;
722 	htcap = (struct ieee80211_ht_cap *)ie;
723 	sta->deflink.ht_cap.cap = htcap->cap_info;
724 	sta->deflink.ht_cap.mcs = htcap->mcs;
725 
726 	/*
727 	 * 802.11n-2009 20.6 Parameters for HT MCSs gives the mandatory/
728 	 * optional MCS for Nss=1..4.  We need to check the first four
729 	 * MCS sets from the Rx MCS Bitmask; then there is MCS 32 and
730 	 * MCS33.. is UEQM.
731 	 */
732 	band = vif->bss_conf.chanctx_conf->def.chan->band;
733 	ht_cap = &hw->wiphy->bands[band]->ht_cap;
734 	sta_ht_cap = &sta->deflink.ht_cap;
735 	rx_nss = 0;
736 	for (i = 0; i < 4; i++) {
737 		TRACE_RATES("HT rx_mask[%d] sta %#04x & hw %#04x", i,
738 		    sta_ht_cap->mcs.rx_mask[i], ht_cap->mcs.rx_mask[i]);
739 		sta_ht_cap->mcs.rx_mask[i] =
740 			sta_ht_cap->mcs.rx_mask[i] & ht_cap->mcs.rx_mask[i];
741 		/* XXX-BZ masking unequal modulation? */
742 
743 		if (sta_ht_cap->mcs.rx_mask[i] != 0)
744 			rx_nss++;
745 	}
746 	if (rx_nss > 0) {
747 		TRACE_RATES("HT rx_nss = max(%d, %d)", rx_nss, sta->deflink.rx_nss);
748 		sta->deflink.rx_nss = MAX(rx_nss, sta->deflink.rx_nss);
749 	} else {
750 		sta->deflink.ht_cap.ht_supported = false;
751 		TRACE_RATES("HT ht_supported %d", sta->deflink.ht_cap.ht_supported);
752 		return;
753 	}
754 
755 	if ((sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) != 0 &&
756 	    IEEE80211_IS_CHAN_HT40(ni->ni_chan))
757 		sta->deflink.bandwidth = IEEE80211_STA_RX_BW_40;
758 	else
759 		sta->deflink.bandwidth = IEEE80211_STA_RX_BW_20;
760 
761 	IMPROVE("sta->wme");
762 
763 	if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_MAX_AMSDU)
764 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_7935;
765 	else
766 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_3839;
767 	sta->deflink.agg.max_rc_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_BA;
768 #ifdef __handled_by_driver__	/* iwlwifi only? actually unused? */
769 	for (i = 0; i < nitems(sta.deflink.agg.max_tid_amsdu_len); i++) {
770 		sta->deflink.agg.max_tid_amsdu_len[j] = ;
771 	}
772 #endif
773 	TRACE_RATES("HT ht_supported %d", sta->deflink.ht_cap.ht_supported);
774 }
775 #endif
776 
777 #if defined(LKPI_80211_VHT)
778 static void
779 lkpi_sta_sync_vht_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
780     struct ieee80211_sta *sta, struct ieee80211_node *ni)
781 {
782 	struct ieee80211_sta_vht_cap *vht_cap, *sta_vht_cap;;
783 	enum ieee80211_sta_rx_bandwidth bw;
784 	enum nl80211_band band;
785 	uint32_t width;
786 	int rx_nss;
787 	uint16_t rx_map, tx_map;
788 
789 	if ((ni->ni_flags & IEEE80211_NODE_VHT) == 0 ||
790 	    !IEEE80211_IS_CHAN_VHT_5GHZ(ni->ni_chan)) {
791 		sta->deflink.vht_cap.vht_supported = false;
792 		TRACE_RATES("VHT vht_supported %d", sta->deflink.vht_cap.vht_supported);
793 		return;
794 	}
795 
796 	sta->deflink.vht_cap.vht_supported = true;
797 
798 	sta->deflink.vht_cap.cap = ni->ni_vhtcap;
799 	sta->deflink.vht_cap.vht_mcs = ni->ni_vht_mcsinfo;
800 
801 	/*
802 	 * If VHT20/40 are selected do not update the bandwidth
803 	 * from HT but stya on VHT.
804 	 */
805 	if (ni->ni_vht_chanwidth == IEEE80211_VHT_CHANWIDTH_USE_HT)
806 		goto skip_bw;
807 
808 	bw = sta->deflink.bandwidth;
809 	width = (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK);
810 	switch (width) {
811 	/* Deprecated. */
812 	case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ:
813 	case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ:
814 		bw = IEEE80211_STA_RX_BW_160;
815 		break;
816 	default:
817 		/* Check if we do support 160Mhz somehow after all. */
818 		if ((sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_EXT_NSS_BW_MASK) != 0)
819 			bw = IEEE80211_STA_RX_BW_160;
820 		else
821 			bw = IEEE80211_STA_RX_BW_80;
822 	}
823 	/*
824 	 * While we can set what is possibly supported we also need to be
825 	 * on a channel which supports that bandwidth; e.g., we can support
826 	 * VHT160 but the AP only does VHT80.
827 	 * Further ni_chan will also have filtered out what we disabled
828 	 * by configuration.
829 	 * Once net80211 channel selection is fixed for 802.11-2020 and
830 	 * VHT160 we can possibly spare ourselves the above.
831 	 */
832 	if (bw == IEEE80211_STA_RX_BW_160 &&
833 	    !IEEE80211_IS_CHAN_VHT160(ni->ni_chan) &&
834 	    !IEEE80211_IS_CHAN_VHT80P80(ni->ni_chan))
835 		bw = IEEE80211_STA_RX_BW_80;
836 	if (bw == IEEE80211_STA_RX_BW_80 &&
837 	    !IEEE80211_IS_CHAN_VHT80(ni->ni_chan))
838 		bw = sta->deflink.bandwidth;
839 	sta->deflink.bandwidth = bw;
840 skip_bw:
841 
842 	band = vif->bss_conf.chanctx_conf->def.chan->band;
843 	vht_cap = &hw->wiphy->bands[band]->vht_cap;
844 	sta_vht_cap = &sta->deflink.vht_cap;
845 
846 	rx_nss = 0;
847 	rx_map = tx_map = 0;
848 	for (int i = 7; i >= 0; i--) {
849 		uint8_t card, sta;
850 
851 		card = (vht_cap->vht_mcs.rx_mcs_map >> (2 * i)) & 0x3;
852 		sta  = (sta_vht_cap->vht_mcs.rx_mcs_map >> (2 * i)) & 0x3;
853 		if (sta != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
854 			if (card == IEEE80211_VHT_MCS_NOT_SUPPORTED)
855 				sta = IEEE80211_VHT_MCS_NOT_SUPPORTED;
856 			else {
857 				sta = MIN(sta, card);
858 				if (rx_nss == 0)
859 					rx_nss = i + 1;
860 			}
861 		}
862 		rx_map |= (sta << (2 * i));
863 
864 		card = (vht_cap->vht_mcs.tx_mcs_map >> (2 * i)) & 0x3;
865 		sta  = (sta_vht_cap->vht_mcs.tx_mcs_map >> (2 * i)) & 0x3;
866 		if (sta != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
867 			if (card == IEEE80211_VHT_MCS_NOT_SUPPORTED)
868 				sta = IEEE80211_VHT_MCS_NOT_SUPPORTED;
869 			else
870 				sta = MIN(sta, card);
871 		}
872 		tx_map |= (sta << (2 * i));
873 	}
874 	TRACE_RATES("VHT rx_mcs_map %#010x->%#010x, tx_mcs_map %#010x->%#010x, rx_nss = %d",
875 	    sta_vht_cap->vht_mcs.rx_mcs_map, rx_map,
876 	    sta_vht_cap->vht_mcs.tx_mcs_map, tx_map, rx_nss);
877 	sta_vht_cap->vht_mcs.rx_mcs_map = rx_map;
878 	sta_vht_cap->vht_mcs.tx_mcs_map = tx_map;
879 	if (rx_nss > 0) {
880 		TRACE_RATES("VHT rx_nss = max(%d, %d)", rx_nss, sta->deflink.rx_nss);
881 		sta->deflink.rx_nss = MAX(rx_nss, sta->deflink.rx_nss);
882 	} else {
883 		sta->deflink.vht_cap.vht_supported = false;
884 		TRACE_RATES("VHT vht_supported %d", sta->deflink.vht_cap.vht_supported);
885 		return;
886 	}
887 
888 	switch (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MAX_MPDU_MASK) {
889 	case IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454:
890 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_VHT_11454;
891 		break;
892 	case IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991:
893 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_VHT_7991;
894 		break;
895 	case IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895:
896 	default:
897 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_VHT_3895;
898 		break;
899 	}
900 
901 	TRACE_RATES("VHT vht_supported %d", sta->deflink.vht_cap.vht_supported);
902 }
903 #endif
904 
905 static enum ieee80211_bss_changed
906 lkpi_sta_sync_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
907     struct ieee80211_sta *sta, struct ieee80211_node *ni, bool updchnctx)
908 {
909 	enum ieee80211_bss_changed bss_changed;
910 	enum ieee80211_rate_control_changed_flags rc_changed;
911 	enum ieee80211_sta_rx_bandwidth bandwidth;
912 	uint8_t rx_nss;
913 
914 	if (updchnctx)
915 		lockdep_assert_wiphy(hw->wiphy);
916 
917 	bss_changed = 0;
918 	rc_changed = 0;
919 
920 	bandwidth = sta->deflink.bandwidth;
921 	rx_nss = sta->deflink.rx_nss;
922 
923 	TRACE_RATES("updchnctx %d bandwidth %d rx_nss %u",
924 	    updchnctx, bandwidth, rx_nss);
925 
926 	/*
927 	 * Ensure rx_nss is at least 1 as otherwise drivers run into
928 	 * unexpected problems.
929 	 */
930 	sta->deflink.rx_nss = 1;
931 
932 #if defined(LKPI_80211_HT)
933 	lkpi_sta_sync_ht_from_ni(hw, vif, sta, ni);
934 #endif
935 #if defined(LKPI_80211_VHT)
936 	lkpi_sta_sync_vht_from_ni(hw, vif, sta, ni);
937 #endif
938 
939 	/*
940 	 * We are also called from node allocation which net80211
941 	 * can do even on `ifconfig down`; in that case the chanctx
942 	 * may still be valid and we get a discrepancy between
943 	 * sta and chanctx.  Thus do not try to update the chanctx
944 	 * when called from lkpi_lsta_alloc().
945 	 */
946 	if (updchnctx)
947 		lkpi_sync_chanctx_cw_from_rx_bw(hw, vif, sta);
948 
949 	bss_changed |= lkpi_sta_supp_rates(hw, vif, ni, &rc_changed);
950 
951 	if (sta->deflink.bandwidth != bandwidth)
952 		rc_changed |= IEEE80211_RC_BW_CHANGED;
953 	if (sta->deflink.rx_nss != rx_nss)
954 		rc_changed |= IEEE80211_RC_NSS_CHANGED;
955 
956 	TRACE_RATES("updchnctx %d rc_change %#010x bss_changed %#010jx "
957 	    "bandwidth %d rx_nss %u",
958 	    updchnctx, rc_changed, (uintmax_t)bss_changed,
959 	    sta->deflink.bandwidth, sta->deflink.rx_nss);
960 
961 	if (rc_changed != 0)
962 		lkpi_80211_mo_link_sta_rc_update(hw, vif, &sta->deflink, rc_changed);
963 
964 	return (bss_changed);
965 }
966 
967 #if 0
968 static uint8_t
969 lkpi_get_max_rx_chains(struct ieee80211_node *ni)
970 {
971 	uint8_t chains;
972 #if defined(LKPI_80211_HT) || defined(LKPI_80211_VHT)
973 	struct lkpi_sta *lsta;
974 	struct ieee80211_sta *sta;
975 
976 	lsta = ni->ni_drv_data;
977 	sta = LSTA_TO_STA(lsta);
978 #endif
979 
980 	chains = 1;
981 #if defined(LKPI_80211_HT)
982 	IMPROVE("We should factor counting MCS/NSS out for sync and here");
983 	if (sta->deflink.ht_cap.ht_supported)
984 		chains = MAX(chains, sta->deflink.rx_nss);
985 #endif
986 
987 #if defined(LKPI_80211_VHT)
988 	if (sta->deflink.vht_cap.vht_supported)
989 		chains = MAX(chains, sta->deflink.rx_nss);
990 #endif
991 
992 	return (chains);
993 }
994 #endif
995 
996 static void
997 lkpi_lsta_dump(struct lkpi_sta *lsta, struct ieee80211_node *ni,
998     const char *_f, int _l)
999 {
1000 
1001 #ifdef LINUXKPI_DEBUG_80211
1002 	if ((linuxkpi_debug_80211 & D80211_TRACE_STA) == 0)
1003 		return;
1004 	if (lsta == NULL)
1005 		return;
1006 
1007 	printf("%s:%d lsta %p ni %p sta %p\n",
1008 	    _f, _l, lsta, ni, &lsta->sta);
1009 	if (ni != NULL)
1010 		ieee80211_dump_node(NULL, ni);
1011 	printf("\ttxq_task txq len %d mtx\n", mbufq_len(&lsta->txq));
1012 	printf("\tkc %p state %d added_to_drv %d in_mgd %d\n",
1013 		&lsta->kc[0], lsta->state, lsta->added_to_drv, lsta->in_mgd);
1014 #endif
1015 }
1016 
1017 static void
1018 lkpi_lsta_remove(struct lkpi_sta *lsta, struct lkpi_vif *lvif)
1019 {
1020 
1021 	lockdep_assert_wiphy(lsta->hw->wiphy);
1022 
1023 	KASSERT(!list_empty(&lsta->lsta_list),
1024 	    ("%s: lsta %p ni %p\n", __func__, lsta, lsta->ni));
1025 	list_del_init(&lsta->lsta_list);
1026 }
1027 
1028 static struct lkpi_sta *
1029 lkpi_lsta_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN],
1030     struct ieee80211_hw *hw, struct ieee80211_node *ni)
1031 {
1032 	struct lkpi_sta *lsta;
1033 	struct lkpi_vif *lvif;
1034 	struct ieee80211_vif *vif;
1035 	struct ieee80211_sta *sta;
1036 	int band, i, tid;
1037 
1038 	lsta = malloc(sizeof(*lsta) + hw->sta_data_size, M_LKPI80211,
1039 	    M_NOWAIT | M_ZERO);
1040 	if (lsta == NULL)
1041 		return (NULL);
1042 
1043 	lsta->hw = hw;
1044 	lsta->added_to_drv = false;
1045 	lsta->state = IEEE80211_STA_NOTEXIST;
1046 	/*
1047 	 * Link the ni to the lsta here without taking a reference.
1048 	 * For one we would have to take the reference in node_init()
1049 	 * as ieee80211_alloc_node() will initialise the refcount after us.
1050 	 * For the other a ni and an lsta are 1:1 mapped and always together
1051 	 * from [ic_]node_alloc() to [ic_]node_free() so we are essentally
1052 	 * using the ni references for the lsta as well despite it being
1053 	 * two separate allocations.
1054 	 */
1055 	lsta->ni = ni;
1056 	/* The back-pointer "drv_data" to net80211_node let's us get lsta. */
1057 	ni->ni_drv_data = lsta;
1058 
1059 	lvif = VAP_TO_LVIF(vap);
1060 	vif = LVIF_TO_VIF(lvif);
1061 	sta = LSTA_TO_STA(lsta);
1062 
1063 	IEEE80211_ADDR_COPY(sta->addr, mac);
1064 
1065 	/* TXQ */
1066 	for (tid = 0; tid < nitems(sta->txq); tid++) {
1067 		struct lkpi_txq *ltxq;
1068 
1069 		/* We are not limiting ourselves to hw.queues here. */
1070 		ltxq = malloc(sizeof(*ltxq) + hw->txq_data_size,
1071 		    M_LKPI80211, M_NOWAIT | M_ZERO);
1072 		if (ltxq == NULL)
1073 			goto cleanup;
1074 		/* iwlwifi//mvm/sta.c::tid_to_mac80211_ac[] */
1075 		if (tid == IEEE80211_NUM_TIDS) {
1076 			if (!ieee80211_hw_check(hw, STA_MMPDU_TXQ)) {
1077 				free(ltxq, M_LKPI80211);
1078 				continue;
1079 			}
1080 			IMPROVE("AP/if we support non-STA here too");
1081 			ltxq->txq.ac = IEEE80211_AC_VO;
1082 		} else {
1083 			ltxq->txq.ac = ieee80211e_up_to_ac[tid & 7];
1084 		}
1085 		ltxq->flags = 0;
1086 		ltxq->txq.vif = vif;
1087 		ltxq->txq.tid = tid;
1088 		ltxq->txq.sta = sta;
1089 		TAILQ_ELEM_INIT(ltxq, txq_entry);
1090 		skb_queue_head_init(&ltxq->skbq);
1091 		LKPI_80211_LTXQ_LOCK_INIT(ltxq);
1092 		sta->txq[tid] = &ltxq->txq;
1093 	}
1094 
1095 	/* Deflink information. */
1096 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
1097 		struct ieee80211_supported_band *supband;
1098 		uint32_t rate_mandatory;;
1099 
1100 		supband = hw->wiphy->bands[band];
1101 		if (supband == NULL)
1102 			continue;
1103 
1104 		switch (band) {
1105 		case NL80211_BAND_2GHZ:
1106 			/* We have to assume 11g support here. */
1107 			rate_mandatory = IEEE80211_RATE_MANDATORY_G |
1108 			    IEEE80211_RATE_MANDATORY_B;
1109 			break;
1110 		case NL80211_BAND_5GHZ:
1111 			rate_mandatory = IEEE80211_RATE_MANDATORY_A;
1112 			break;
1113 		default:
1114 			continue;
1115 		}
1116 
1117 		for (i = 0; i < supband->n_bitrates; i++) {
1118 			if ((supband->bitrates[i].flags & rate_mandatory) != 0)
1119 				sta->deflink.supp_rates[band] |= BIT(i);
1120 		}
1121 	}
1122 
1123 	sta->deflink.smps_mode = IEEE80211_SMPS_OFF;
1124 	sta->deflink.bandwidth = IEEE80211_STA_RX_BW_20;
1125 	sta->deflink.agg.max_rc_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_BA;
1126 	sta->deflink.rx_nss = 1;
1127 	sta->deflink.sta = sta;
1128 
1129 	(void)lkpi_sta_sync_from_ni(hw, vif, sta, ni, false);
1130 
1131 	IMPROVE("he, eht, bw_320, ... smps_mode, ..");
1132 
1133 	/* Link configuration. */
1134 	IEEE80211_ADDR_COPY(sta->deflink.addr, sta->addr);
1135 	sta->link[0] = &sta->deflink;
1136 	for (i = 1; i < nitems(sta->link); i++) {
1137 		IMPROVE("more links; only link[0] = deflink currently.");
1138 	}
1139 	IMPROVE("11be");
1140 	sta->mlo = false;
1141 
1142 	/* Deferred TX path. */
1143 	LKPI_80211_LSTA_TXQ_LOCK_INIT(lsta);
1144 	TASK_INIT(&lsta->txq_task, 0, lkpi_80211_txq_task, lsta);
1145 	mbufq_init(&lsta->txq, 32 * NAPI_POLL_WEIGHT);
1146 	lsta->txq_ready = true;
1147 
1148 	return (lsta);
1149 
1150 cleanup:
1151 	for (; tid >= 0; tid--) {
1152 		struct lkpi_txq *ltxq;
1153 
1154 		ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
1155 		LKPI_80211_LTXQ_LOCK_DESTROY(ltxq);
1156 		free(sta->txq[tid], M_LKPI80211);
1157 	}
1158 	free(lsta, M_LKPI80211);
1159 	return (NULL);
1160 }
1161 
1162 static void
1163 lkpi_lsta_free(struct lkpi_sta *lsta, struct ieee80211_node *ni)
1164 {
1165 	struct mbuf *m;
1166 
1167 	if (lsta->added_to_drv)
1168 		panic("%s: Trying to free an lsta still known to firmware: "
1169 		    "lsta %p ni %p added_to_drv %d\n",
1170 		    __func__, lsta, ni, lsta->added_to_drv);
1171 
1172 	/* XXX-BZ free resources, ... */
1173 	IMPROVE();
1174 
1175 	/* Drain sta->txq[] */
1176 
1177 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
1178 	lsta->txq_ready = false;
1179 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
1180 
1181 	/* Drain taskq, won't be restarted until added_to_drv is set again. */
1182 	while (taskqueue_cancel(taskqueue_thread, &lsta->txq_task, NULL) != 0)
1183 		taskqueue_drain(taskqueue_thread, &lsta->txq_task);
1184 
1185 	/* Flush mbufq (make sure to release ni refs!). */
1186 	m = mbufq_dequeue(&lsta->txq);
1187 	while (m != NULL) {
1188 		struct ieee80211_node *nim;
1189 
1190 		nim = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1191 		if (nim != NULL)
1192 			ieee80211_free_node(nim);
1193 		m_freem(m);
1194 		m = mbufq_dequeue(&lsta->txq);
1195 	}
1196 	KASSERT(mbufq_empty(&lsta->txq), ("%s: lsta %p has txq len %d != 0\n",
1197 	    __func__, lsta, mbufq_len(&lsta->txq)));
1198 	LKPI_80211_LSTA_TXQ_LOCK_DESTROY(lsta);
1199 
1200 	/* Remove lsta from vif; that is done by the state machine.  Should assert it? */
1201 
1202 	IMPROVE("Make sure everything is cleaned up.");
1203 
1204 	/* Free lsta. */
1205 	lsta->ni = NULL;
1206 	ni->ni_drv_data = NULL;
1207 	free(lsta, M_LKPI80211);
1208 }
1209 
1210 
1211 static enum nl80211_band
1212 lkpi_net80211_chan_to_nl80211_band(struct ieee80211_channel *c)
1213 {
1214 
1215 	if (IEEE80211_IS_CHAN_2GHZ(c))
1216 		return (NL80211_BAND_2GHZ);
1217 	else if (IEEE80211_IS_CHAN_5GHZ(c))
1218 		return (NL80211_BAND_5GHZ);
1219 #ifdef __notyet__
1220 	else if ()
1221 		return (NL80211_BAND_6GHZ);
1222 	else if ()
1223 		return (NL80211_BAND_60GHZ);
1224 	else if (IEEE80211_IS_CHAN_GSM(c))
1225 		return (NL80211_BAND_XXX);
1226 #endif
1227 	else
1228 		panic("%s: unsupported band. c %p flags %#x\n",
1229 		    __func__, c, c->ic_flags);
1230 }
1231 
1232 static uint32_t
1233 lkpi_nl80211_band_to_net80211_band(enum nl80211_band band)
1234 {
1235 
1236 	/* XXX-BZ this is just silly; net80211 is too convoluted. */
1237 	/* IEEE80211_CHAN_A / _G / .. doesn't really work either. */
1238 	switch (band) {
1239 	case NL80211_BAND_2GHZ:
1240 		return (IEEE80211_CHAN_2GHZ);
1241 		break;
1242 	case NL80211_BAND_5GHZ:
1243 		return (IEEE80211_CHAN_5GHZ);
1244 		break;
1245 	case NL80211_BAND_60GHZ:
1246 		break;
1247 	case NL80211_BAND_6GHZ:
1248 		break;
1249 	default:
1250 		panic("%s: unsupported band %u\n", __func__, band);
1251 		break;
1252 	}
1253 
1254 	IMPROVE();
1255 	return (0x00);
1256 }
1257 
1258 #ifdef LINUXKPI_DEBUG_80211
1259 static const char *
1260 lkpi_nl80211_band_name(enum nl80211_band band)
1261 {
1262 	switch (band) {
1263 	case NL80211_BAND_2GHZ:
1264 		return "2Ghz";
1265 		break;
1266 	case NL80211_BAND_5GHZ:
1267 		return "5Ghz";
1268 		break;
1269 	case NL80211_BAND_60GHZ:
1270 		return "60Ghz";
1271 		break;
1272 	case NL80211_BAND_6GHZ:
1273 		return "6Ghz";
1274 		break;
1275 	default:
1276 		panic("%s: unsupported band %u\n", __func__, band);
1277 		break;
1278 	}
1279 }
1280 #endif
1281 
1282 #if 0
1283 static enum ieee80211_ac_numbers
1284 lkpi_ac_net_to_l80211(int ac)
1285 {
1286 
1287 	switch (ac) {
1288 	case WME_AC_VO:
1289 		return (IEEE80211_AC_VO);
1290 	case WME_AC_VI:
1291 		return (IEEE80211_AC_VI);
1292 	case WME_AC_BE:
1293 		return (IEEE80211_AC_BE);
1294 	case WME_AC_BK:
1295 		return (IEEE80211_AC_BK);
1296 	default:
1297 		printf("%s: invalid WME_AC_* input: ac = %d\n", __func__, ac);
1298 		return (IEEE80211_AC_BE);
1299 	}
1300 }
1301 #endif
1302 
1303 static enum nl80211_iftype
1304 lkpi_opmode_to_vif_type(enum ieee80211_opmode opmode)
1305 {
1306 
1307 	switch (opmode) {
1308 	case IEEE80211_M_IBSS:
1309 		return (NL80211_IFTYPE_ADHOC);
1310 		break;
1311 	case IEEE80211_M_STA:
1312 		return (NL80211_IFTYPE_STATION);
1313 		break;
1314 	case IEEE80211_M_WDS:
1315 		return (NL80211_IFTYPE_WDS);
1316 		break;
1317 	case IEEE80211_M_HOSTAP:
1318 		return (NL80211_IFTYPE_AP);
1319 		break;
1320 	case IEEE80211_M_MONITOR:
1321 		return (NL80211_IFTYPE_MONITOR);
1322 		break;
1323 	case IEEE80211_M_MBSS:
1324 		return (NL80211_IFTYPE_MESH_POINT);
1325 		break;
1326 	case IEEE80211_M_AHDEMO:
1327 		/* FALLTHROUGH */
1328 	default:
1329 		printf("ERROR: %s: unsupported opmode %d\n", __func__, opmode);
1330 		/* FALLTHROUGH */
1331 	}
1332 	return (NL80211_IFTYPE_UNSPECIFIED);
1333 }
1334 
1335 #ifdef LKPI_80211_HW_CRYPTO
1336 static const char *
1337 lkpi_cipher_suite_to_name(uint32_t wlan_cipher_suite)
1338 {
1339 	switch (wlan_cipher_suite) {
1340 	case WLAN_CIPHER_SUITE_WEP40:
1341 		return ("WEP40");
1342 	case WLAN_CIPHER_SUITE_WEP104:
1343 		return ("WEP104");
1344 	case WLAN_CIPHER_SUITE_TKIP:
1345 		return ("TKIP");
1346 	case WLAN_CIPHER_SUITE_CCMP:
1347 		return ("CCMP");
1348 	case WLAN_CIPHER_SUITE_CCMP_256:
1349 		return ("CCMP_256");
1350 	case WLAN_CIPHER_SUITE_GCMP:
1351 		return ("GCMP");
1352 	case WLAN_CIPHER_SUITE_GCMP_256:
1353 		return ("GCMP_256");
1354 	case WLAN_CIPHER_SUITE_AES_CMAC:
1355 		return ("AES_CMAC");
1356 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1357 		return ("BIP_CMAC_256");
1358 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1359 		return ("BIP_GMAC_128");
1360 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1361 		return ("BIP_GMAC_256");
1362 	default:
1363 		return ("??");
1364 	}
1365 }
1366 
1367 static uint32_t
1368 lkpi_l80211_to_net80211_cyphers(struct ieee80211com *ic,
1369     uint32_t wlan_cipher_suite)
1370 {
1371 	switch (wlan_cipher_suite) {
1372 	case WLAN_CIPHER_SUITE_WEP40:
1373 		return (IEEE80211_CRYPTO_WEP);
1374 	case WLAN_CIPHER_SUITE_WEP104:
1375 		return (IEEE80211_CRYPTO_WEP);
1376 	case WLAN_CIPHER_SUITE_TKIP:
1377 		return (IEEE80211_CRYPTO_TKIP);
1378 	case WLAN_CIPHER_SUITE_CCMP:
1379 		return (IEEE80211_CRYPTO_AES_CCM);
1380 	case WLAN_CIPHER_SUITE_CCMP_256:
1381 		return (IEEE80211_CRYPTO_AES_CCM_256);
1382 	case WLAN_CIPHER_SUITE_GCMP:
1383 		return (IEEE80211_CRYPTO_AES_GCM_128);
1384 	case WLAN_CIPHER_SUITE_GCMP_256:
1385 		return (IEEE80211_CRYPTO_AES_GCM_256);
1386 	case WLAN_CIPHER_SUITE_AES_CMAC:
1387 		return (IEEE80211_CRYPTO_BIP_CMAC_128);
1388 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1389 		return (IEEE80211_CRYPTO_BIP_CMAC_256);
1390 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1391 		return (IEEE80211_CRYPTO_BIP_GMAC_128);
1392 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1393 		return (IEEE80211_CRYPTO_BIP_GMAC_256);
1394 	default:
1395 		ic_printf(ic, "%s: unknown WLAN Cipher Suite %#08x | %u (%s)\n",
1396 		    __func__,
1397 		    wlan_cipher_suite >> 8, wlan_cipher_suite & 0xff,
1398 		    lkpi_cipher_suite_to_name(wlan_cipher_suite));
1399 		return (0);
1400 	}
1401 }
1402 
1403 static uint32_t
1404 lkpi_net80211_to_l80211_cipher_suite(uint32_t cipher, uint8_t keylen)
1405 {
1406 
1407 	switch (cipher) {
1408 	case IEEE80211_CIPHER_WEP:
1409 		if (keylen == (40/NBBY))
1410 			return (WLAN_CIPHER_SUITE_WEP40);
1411 		else if (keylen == (104/NBBY))
1412 			return (WLAN_CIPHER_SUITE_WEP104);
1413 		else {
1414 			printf("%s: WEP with unsupported keylen %d\n",
1415 			    __func__, keylen * NBBY);
1416 			return (0);
1417 		}
1418 		break;
1419 	case IEEE80211_CIPHER_TKIP:
1420 		return (WLAN_CIPHER_SUITE_TKIP);
1421 	case IEEE80211_CIPHER_AES_CCM:
1422 		return (WLAN_CIPHER_SUITE_CCMP);
1423 	case IEEE80211_CIPHER_AES_CCM_256:
1424 		return (WLAN_CIPHER_SUITE_CCMP_256);
1425 	case IEEE80211_CIPHER_AES_GCM_128:
1426 		return (WLAN_CIPHER_SUITE_GCMP);
1427 	case IEEE80211_CIPHER_AES_GCM_256:
1428 		return (WLAN_CIPHER_SUITE_GCMP_256);
1429 	case IEEE80211_CIPHER_BIP_CMAC_128:
1430 		return (WLAN_CIPHER_SUITE_AES_CMAC);
1431 	case IEEE80211_CIPHER_BIP_CMAC_256:
1432 		return (WLAN_CIPHER_SUITE_BIP_CMAC_256);
1433 	case IEEE80211_CIPHER_BIP_GMAC_128:
1434 		return (WLAN_CIPHER_SUITE_BIP_GMAC_128);
1435 	case IEEE80211_CIPHER_BIP_GMAC_256:
1436 		return (WLAN_CIPHER_SUITE_BIP_GMAC_256);
1437 
1438 	case IEEE80211_CIPHER_AES_OCB:
1439 	case IEEE80211_CIPHER_TKIPMIC:
1440 		/*
1441 		 * TKIP w/ hw MIC support
1442 		 * (gone wrong; should really be a crypto flag in net80211).
1443 		 */
1444 	case IEEE80211_CIPHER_CKIP:
1445 	case IEEE80211_CIPHER_NONE:
1446 		printf("%s: unsupported cipher %#010x\n", __func__, cipher);
1447 		break;
1448 	default:
1449 		printf("%s: unknown cipher %#010x\n", __func__, cipher);
1450 	};
1451 	return (0);
1452 }
1453 #endif
1454 
1455 #ifdef __notyet__
1456 static enum ieee80211_sta_state
1457 lkpi_net80211_state_to_sta_state(enum ieee80211_state state)
1458 {
1459 
1460 	/*
1461 	 * XXX-BZ The net80211 states are "try to ..", the lkpi8011 states are
1462 	 * "done".  Also ASSOC/AUTHORIZED are both "RUN" then?
1463 	 */
1464 	switch (state) {
1465 	case IEEE80211_S_INIT:
1466 		return (IEEE80211_STA_NOTEXIST);
1467 	case IEEE80211_S_SCAN:
1468 		return (IEEE80211_STA_NONE);
1469 	case IEEE80211_S_AUTH:
1470 		return (IEEE80211_STA_AUTH);
1471 	case IEEE80211_S_ASSOC:
1472 		return (IEEE80211_STA_ASSOC);
1473 	case IEEE80211_S_RUN:
1474 		return (IEEE80211_STA_AUTHORIZED);
1475 	case IEEE80211_S_CAC:
1476 	case IEEE80211_S_CSA:
1477 	case IEEE80211_S_SLEEP:
1478 	default:
1479 		UNIMPLEMENTED;
1480 	};
1481 
1482 	return (IEEE80211_STA_NOTEXIST);
1483 }
1484 #endif
1485 
1486 static struct linuxkpi_ieee80211_channel *
1487 lkpi_find_lkpi80211_chan(struct lkpi_hw *lhw,
1488     struct ieee80211_channel *c)
1489 {
1490 	struct ieee80211_hw *hw;
1491 	struct linuxkpi_ieee80211_channel *channels;
1492 	enum nl80211_band band;
1493 	int i, nchans;
1494 
1495 	hw = LHW_TO_HW(lhw);
1496 	band = lkpi_net80211_chan_to_nl80211_band(c);
1497 	if (hw->wiphy->bands[band] == NULL)
1498 		return (NULL);
1499 
1500 	nchans = hw->wiphy->bands[band]->n_channels;
1501 	if (nchans <= 0)
1502 		return (NULL);
1503 
1504 	channels = hw->wiphy->bands[band]->channels;
1505 	for (i = 0; i < nchans; i++) {
1506 		if (channels[i].center_freq == c->ic_freq)
1507 			return (&channels[i]);
1508 	}
1509 
1510 	return (NULL);
1511 }
1512 
1513 #if 0
1514 static struct linuxkpi_ieee80211_channel *
1515 lkpi_get_lkpi80211_chan(struct ieee80211com *ic, struct ieee80211_node *ni)
1516 {
1517 	struct linuxkpi_ieee80211_channel *chan;
1518 	struct ieee80211_channel *c;
1519 	struct lkpi_hw *lhw;
1520 
1521 	chan = NULL;
1522 	if (ni != NULL && ni->ni_chan != IEEE80211_CHAN_ANYC)
1523 		c = ni->ni_chan;
1524 	else if (ic->ic_bsschan != IEEE80211_CHAN_ANYC)
1525 		c = ic->ic_bsschan;
1526 	else if (ic->ic_curchan != IEEE80211_CHAN_ANYC)
1527 		c = ic->ic_curchan;
1528 	else
1529 		c = NULL;
1530 
1531 	if (c != NULL && c != IEEE80211_CHAN_ANYC) {
1532 		lhw = ic->ic_softc;
1533 		chan = lkpi_find_lkpi80211_chan(lhw, c);
1534 	}
1535 
1536 	return (chan);
1537 }
1538 #endif
1539 
1540 struct linuxkpi_ieee80211_channel *
1541 linuxkpi_ieee80211_get_channel(struct wiphy *wiphy, uint32_t freq)
1542 {
1543 	enum nl80211_band band;
1544 
1545 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
1546 		struct ieee80211_supported_band *supband;
1547 		struct linuxkpi_ieee80211_channel *channels;
1548 		int i;
1549 
1550 		supband = wiphy->bands[band];
1551 		if (supband == NULL || supband->n_channels == 0)
1552 			continue;
1553 
1554 		channels = supband->channels;
1555 		for (i = 0; i < supband->n_channels; i++) {
1556 			if (channels[i].center_freq == freq)
1557 				return (&channels[i]);
1558 		}
1559 	}
1560 
1561 	return (NULL);
1562 }
1563 
1564 #ifdef LKPI_80211_HW_CRYPTO
1565 static int
1566 lkpi_sta_del_keys(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1567     struct lkpi_sta *lsta)
1568 {
1569 	int error;
1570 
1571 	if (!lkpi_hwcrypto)
1572 		return (0);
1573 
1574 	lockdep_assert_wiphy(hw->wiphy);
1575 
1576 	if (vif->cfg.assoc && lsta->state == IEEE80211_STA_AUTHORIZED) {
1577 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1578 			ic_printf(lsta->ni->ni_ic,
1579 			    "%d %lu %s: vif still assoc; not deleting keys\n",
1580 			    curthread->td_tid, jiffies, __func__);
1581 		return (0);
1582 	}
1583 
1584 	ieee80211_ref_node(lsta->ni);
1585 
1586 	error = 0;
1587 	for (ieee80211_keyix keyix = 0; keyix < nitems(lsta->kc); keyix++) {
1588 		struct ieee80211_key_conf *kc;
1589 		int err;
1590 
1591 		if (lsta->kc[keyix] == NULL)
1592 			continue;
1593 		kc = lsta->kc[keyix];
1594 
1595 #ifdef LINUXKPI_DEBUG_80211
1596 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1597 			ic_printf(lsta->ni->ni_ic, "%d %lu %s: running set_key cmd %d(%s) for "
1598 			    "sta %6D: keyidx %u hw_key_idx %u flags %b\n",
1599 			    curthread->td_tid, jiffies, __func__,
1600 			    DISABLE_KEY, "DISABLE", lsta->sta.addr, ":",
1601 			    kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1602 #endif
1603 
1604 		err = lkpi_80211_mo_set_key(hw, DISABLE_KEY, vif,
1605 		    LSTA_TO_STA(lsta), kc);
1606 		if (err != 0) {
1607 			ic_printf(lsta->ni->ni_ic, "%d %lu %s: set_key cmd %d(%s) for "
1608 			    "sta %6D failed: %d\n", curthread->td_tid, jiffies, __func__,
1609 			    DISABLE_KEY, "DISABLE", lsta->sta.addr, ":", err);
1610 			error++;
1611 
1612 			/*
1613 			 * If we free the key here we will never be able to get it
1614 			 * removed from the driver/fw which will likely make us
1615 			 * crash (firmware).
1616 			 */
1617 			continue;
1618 		}
1619 #ifdef LINUXKPI_DEBUG_80211
1620 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1621 			ic_printf(lsta->ni->ni_ic, "%d %lu %s: set_key cmd %d(%s) for "
1622 			    "sta %6D succeeded: keyidx %u hw_key_idx %u flags %b\n",
1623 			    curthread->td_tid, jiffies, __func__,
1624 			    DISABLE_KEY, "DISABLE", lsta->sta.addr, ":",
1625 			    kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1626 #endif
1627 
1628 		lsta->kc[keyix] = NULL;
1629 		free(kc, M_LKPI80211);
1630 	}
1631 	ieee80211_free_node(lsta->ni);
1632 	return (error);
1633 }
1634 
1635 /* XXX-BZ one day we should replace this iterating over VIFs, or node list? */
1636 /* See also lkpi_sta_del_keys() these days. */
1637 static int
1638 lkpi_iv_key_delete(struct ieee80211vap *vap, const struct ieee80211_key *k)
1639 {
1640 	struct ieee80211com *ic;
1641 	struct lkpi_hw *lhw;
1642 	struct ieee80211_hw *hw;
1643 	struct lkpi_vif *lvif;
1644 	struct lkpi_sta *lsta;
1645 	struct ieee80211_vif *vif;
1646 	struct ieee80211_sta *sta;
1647 	struct ieee80211_node *ni;
1648 	struct ieee80211_key_conf *kc;
1649 	int error;
1650 
1651 	ic = vap->iv_ic;
1652 	lhw = ic->ic_softc;
1653 	hw = LHW_TO_HW(lhw);
1654 	lvif = VAP_TO_LVIF(vap);
1655 	vif = LVIF_TO_VIF(lvif);
1656 
1657 	/*
1658 	 * Make sure we do not make it here without going through
1659 	 * lkpi_iv_key_update_begin() first.
1660 	 */
1661 	lockdep_assert_wiphy(hw->wiphy);
1662 
1663 	ni = ieee80211_ref_node(vap->iv_bss);
1664 	lsta = ni->ni_drv_data;
1665 	if (lsta == NULL) {
1666 		ic_printf(ic, "%s: ni %p (%6D) with lsta NULL\n",
1667 		    __func__, ni, ni->ni_bssid, ":");
1668 		ieee80211_free_node(ni);
1669 		return (0);
1670 	}
1671 
1672 	/*
1673 	 * While we are assoc we may still send packets.  We cannot delete the
1674 	 * keys as otherwise packets could go out unencrypted.  Some firmware
1675 	 * does not like this and will fire an assert.
1676 	 * net80211 needs to drive this better but given we want the disassoc
1677 	 * frame out and have to unlock we are open to a race currently.
1678 	 * This check should prevent problems.
1679 	 * How to test: run 800Mbit/s UDP traffic and during that restart your
1680 	 * supplicant.  You want to survive that.
1681 	 */
1682 	if (vif->cfg.assoc && lsta->state == IEEE80211_STA_AUTHORIZED) {
1683 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1684 			ic_printf(ic, "%d %lu %s: vif still assoc; not deleting keys\n",
1685 			    curthread->td_tid, jiffies, __func__);
1686 		ieee80211_free_node(ni);
1687 		return (0);
1688 	}
1689 
1690 	if (IEEE80211_KEY_UNDEFINED(k)) {
1691 		ic_printf(ic, "%s: vap %p key %p is undefined: %p %u\n",
1692 		    __func__, vap, k, k->wk_cipher, k->wk_keyix);
1693 		ieee80211_free_node(ni);
1694 		return (0);
1695 	}
1696 
1697 	if (vap->iv_bss == NULL) {
1698 		ic_printf(ic, "%s: iv_bss %p for vap %p is NULL\n",
1699 		    __func__, vap->iv_bss, vap);
1700 		ieee80211_free_node(ni);
1701 		return (0);
1702 	}
1703 	sta = LSTA_TO_STA(lsta);
1704 
1705 	if (lsta->kc[k->wk_keyix] == NULL) {
1706 #ifdef LINUXKPI_DEBUG_80211
1707 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1708 			ic_printf(ic, "%d %lu %s: sta %6D and no key information, "
1709 			    "keyidx %u wk_macaddr %6D; returning success\n",
1710 			    curthread->td_tid, jiffies, __func__, sta->addr, ":",
1711 			    k->wk_keyix, k->wk_macaddr, ":");
1712 #endif
1713 		ieee80211_free_node(ni);
1714 		return (1);
1715 	}
1716 	kc = lsta->kc[k->wk_keyix];
1717 
1718 #ifdef LINUXKPI_DEBUG_80211
1719 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1720 		ic_printf(ic, "%d %lu %s: running set_key cmd %d(%s) for sta %6D: "
1721 		    "keyidx %u hw_key_idx %u flags %b\n",
1722 		    curthread->td_tid, jiffies, __func__,
1723 		    DISABLE_KEY, "DISABLE", sta->addr, ":",
1724 		    kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1725 #endif
1726 
1727 	error = lkpi_80211_mo_set_key(hw, DISABLE_KEY, vif, sta, kc);
1728 	if (error != 0) {
1729 		ic_printf(ic, "%d %lu %s: set_key cmd %d(%s) for sta %6D failed: %d\n",
1730 		    curthread->td_tid, jiffies, __func__,
1731 		    DISABLE_KEY, "DISABLE", sta->addr, ":", error);
1732 		error = 0;
1733 		goto out;
1734 	}
1735 
1736 #ifdef LINUXKPI_DEBUG_80211
1737 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1738 		ic_printf(ic, "%d %lu %s: set_key cmd %d(%s) for sta %6D succeeded: "
1739 		    "keyidx %u hw_key_idx %u flags %b\n",
1740 		    curthread->td_tid, jiffies, __func__,
1741 		    DISABLE_KEY, "DISABLE", sta->addr, ":",
1742 		    kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1743 #endif
1744 	lsta->kc[k->wk_keyix] = NULL;
1745 	free(kc, M_LKPI80211);
1746 	error = 1;
1747 out:
1748 	ieee80211_free_node(ni);
1749 	return (error);
1750 }
1751 
1752 static int
1753 lkpi_iv_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k)
1754 {
1755 	struct ieee80211com *ic;
1756 	struct lkpi_hw *lhw;
1757 	struct ieee80211_hw *hw;
1758 	struct lkpi_vif *lvif;
1759 	struct lkpi_sta *lsta;
1760 	struct ieee80211_vif *vif;
1761 	struct ieee80211_sta *sta;
1762 	struct ieee80211_node *ni;
1763 	struct ieee80211_key_conf *kc;
1764 	struct ieee80211_key *wk;
1765 	uint32_t lcipher;
1766 	uint16_t exp_flags;
1767 	uint8_t keylen;
1768 	int error;
1769 
1770 	ic = vap->iv_ic;
1771 	lhw = ic->ic_softc;
1772 	hw = LHW_TO_HW(lhw);
1773 
1774 	/*
1775 	 * Make sure we do not make it here without going through
1776 	 * lkpi_iv_key_update_begin() first.
1777 	 */
1778 	lockdep_assert_wiphy(hw->wiphy);
1779 
1780 	if (IEEE80211_KEY_UNDEFINED(k)) {
1781 		ic_printf(ic, "%s: vap %p key %p is undefined: %p %u\n",
1782 		    __func__, vap, k, k->wk_cipher, k->wk_keyix);
1783 		return (0);
1784 	}
1785 
1786 	if (vap->iv_bss == NULL) {
1787 		ic_printf(ic, "%s: iv_bss %p for vap %p is NULL\n",
1788 		    __func__, vap->iv_bss, vap);
1789 		return (0);
1790 	}
1791 	ni = ieee80211_ref_node(vap->iv_bss);
1792 	lsta = ni->ni_drv_data;
1793 	if (lsta == NULL) {
1794 		ic_printf(ic, "%s: ni %p (%6D) with lsta NULL\n",
1795 		    __func__, ni, ni->ni_bssid, ":");
1796 		ieee80211_free_node(ni);
1797 		return (0);
1798 	}
1799 	sta = LSTA_TO_STA(lsta);
1800 
1801 	keylen = ieee80211_crypto_get_key_len(k);
1802 	lcipher = lkpi_net80211_to_l80211_cipher_suite(
1803 	    k->wk_cipher->ic_cipher, ieee80211_crypto_get_key_len(k));
1804 	switch (lcipher) {
1805 	case WLAN_CIPHER_SUITE_TKIP:
1806 		keylen += ieee80211_crypto_get_key_txmic_len(k);
1807 		keylen += ieee80211_crypto_get_key_rxmic_len(k);
1808 		break;
1809 	case WLAN_CIPHER_SUITE_CCMP:
1810 	case WLAN_CIPHER_SUITE_GCMP:
1811 		break;
1812 	default:
1813 		ic_printf(ic, "%s: CIPHER SUITE %#x (%s) not supported\n",
1814 		    __func__, lcipher, lkpi_cipher_suite_to_name(lcipher));
1815 		IMPROVE();
1816 		ieee80211_free_node(ni);
1817 		return (0);
1818 	}
1819 
1820 	if (lsta->kc[k->wk_keyix] != NULL) {
1821 		IMPROVE("Still in firmware? Del first. Can we assert this cannot happen?");
1822 		ic_printf(ic, "%s: sta %6D found with key information\n",
1823 		    __func__, sta->addr, ":");
1824 		kc = lsta->kc[k->wk_keyix];
1825 		lsta->kc[k->wk_keyix] = NULL;
1826 		free(kc, M_LKPI80211);
1827 		kc = NULL;	/* safeguard */
1828 	}
1829 
1830 	kc = malloc(sizeof(*kc) + keylen, M_LKPI80211, M_WAITOK | M_ZERO);
1831 	kc->_k = k;		/* Save the pointer to net80211. */
1832 	kc->cipher = lcipher;
1833 	kc->keyidx = k->wk_keyix;
1834 #if 0
1835 	kc->hw_key_idx = /* set by hw and needs to be passed for TX */;
1836 #endif
1837 	atomic64_set(&kc->tx_pn, k->wk_keytsc);
1838 	kc->keylen = ieee80211_crypto_get_key_len(k);
1839 	memcpy(kc->key, ieee80211_crypto_get_key_data(k),
1840 	    ieee80211_crypto_get_key_len(k));
1841 
1842 	if (k->wk_flags & (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV))
1843 		kc->flags |= IEEE80211_KEY_FLAG_PAIRWISE;
1844 	if (k->wk_flags & IEEE80211_KEY_GROUP)
1845 		kc->flags &= ~IEEE80211_KEY_FLAG_PAIRWISE;
1846 
1847 	kc->iv_len = k->wk_cipher->ic_header;
1848 	kc->icv_len = k->wk_cipher->ic_trailer;
1849 
1850 	switch (kc->cipher) {
1851 	case WLAN_CIPHER_SUITE_TKIP:
1852 		memcpy(kc->key + NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY,
1853 		    ieee80211_crypto_get_key_txmic_data(k),
1854 		    ieee80211_crypto_get_key_txmic_len(k));
1855 		memcpy(kc->key + NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY,
1856 		    ieee80211_crypto_get_key_rxmic_data(k),
1857 		    ieee80211_crypto_get_key_rxmic_len(k));
1858 		break;
1859 	case WLAN_CIPHER_SUITE_CCMP:
1860 	case WLAN_CIPHER_SUITE_GCMP:
1861 		break;
1862 	default:
1863 		/* currently UNREACH */
1864 		IMPROVE();
1865 		break;
1866 	};
1867 	lsta->kc[k->wk_keyix] = kc;
1868 
1869 #ifdef LINUXKPI_DEBUG_80211
1870 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1871 		ic_printf(ic, "%d %lu %s: running set_key cmd %d(%s) for sta %6D: "
1872 		    "kc %p keyidx %u hw_key_idx %u keylen %u flags %b\n",
1873 		    curthread->td_tid, jiffies, __func__,
1874 		    SET_KEY, "SET", sta->addr, ":", kc, kc->keyidx, kc->hw_key_idx,
1875 		    kc->keylen, kc->flags, IEEE80211_KEY_FLAG_BITS);
1876 #endif
1877 
1878 	lvif = VAP_TO_LVIF(vap);
1879 	vif = LVIF_TO_VIF(lvif);
1880 	error = lkpi_80211_mo_set_key(hw, SET_KEY, vif, sta, kc);
1881 	if (error != 0) {
1882 		ic_printf(ic, "%d %lu %s: set_key cmd %d(%s) for sta %6D failed: %d\n",
1883 		    curthread->td_tid, jiffies, __func__,
1884 		    SET_KEY, "SET", sta->addr, ":", error);
1885 		lsta->kc[k->wk_keyix] = NULL;
1886 		free(kc, M_LKPI80211);
1887 		ieee80211_free_node(ni);
1888 		return (0);
1889 	}
1890 
1891 #ifdef LINUXKPI_DEBUG_80211
1892 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1893 		ic_printf(ic, "%d %lu %s: set_key cmd %d(%s) for sta %6D succeeded: "
1894 		    "kc %p keyidx %u hw_key_idx %u flags %b\n",
1895 		    curthread->td_tid, jiffies, __func__,
1896 		    SET_KEY, "SET", sta->addr, ":",
1897 		    kc, kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1898 #endif
1899 
1900 	/*
1901 	 * Getting here means we support HW crypto offload.
1902 	 * Some drivers do not set the wiphy [n_]cipher_suites and thus we
1903 	 * never populate ic_cryptocaps. which means SWCRYPT will be set and we
1904 	 * should disable this now (before possibly setting other SW flags
1905 	 * again for when we need partial SW support).
1906 	 */
1907 	wk = __DECONST(struct ieee80211_key *, k);
1908 	wk->wk_flags &= ~IEEE80211_KEY_SWCRYPT;
1909 
1910 	exp_flags = 0;
1911 	switch (kc->cipher) {
1912 	case WLAN_CIPHER_SUITE_TKIP:
1913 		exp_flags = (IEEE80211_KEY_FLAG_PAIRWISE |
1914 			IEEE80211_KEY_FLAG_PUT_IV_SPACE |
1915 			IEEE80211_KEY_FLAG_GENERATE_MMIC |
1916 			IEEE80211_KEY_FLAG_PUT_MIC_SPACE);
1917 #define	TKIP_INVAL_COMBINATION						\
1918      (IEEE80211_KEY_FLAG_PUT_MIC_SPACE|IEEE80211_KEY_FLAG_GENERATE_MMIC)
1919 		if ((kc->flags & TKIP_INVAL_COMBINATION) == TKIP_INVAL_COMBINATION) {
1920 			ic_printf(ic, "%s: SET_KEY for %s returned invalid "
1921 			    "combination %b\n", __func__,
1922 			    lkpi_cipher_suite_to_name(kc->cipher),
1923 			    kc->flags, IEEE80211_KEY_FLAG_BITS);
1924 		}
1925 #undef	TKIP_INVAL_COMBINATION
1926 #ifdef __notyet__
1927 		/* Do flags surgery; special see linuxkpi_ieee80211_ifattach(). */
1928 		if ((kc->flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) != 0) {
1929 			wk->wk_flags &= ~(IEEE80211_KEY_NOMICMGT|IEEE80211_KEY_NOMIC);
1930 			wk->wk_flags |= IEEE80211_KEY_SWMIC;
1931 			ic->ic_cryptocaps &= ~IEEE80211_CRYPTO_TKIPMIC
1932 		}
1933 #endif
1934 		break;
1935 	case WLAN_CIPHER_SUITE_CCMP:
1936 	case WLAN_CIPHER_SUITE_GCMP:
1937 		exp_flags = (IEEE80211_KEY_FLAG_PAIRWISE |
1938 		    IEEE80211_KEY_FLAG_PUT_IV_SPACE |
1939 		    IEEE80211_KEY_FLAG_GENERATE_IV |
1940 		    IEEE80211_KEY_FLAG_GENERATE_IV_MGMT |	/* Only needs IV geeration for MGMT frames. */
1941 		    IEEE80211_KEY_FLAG_SW_MGMT_TX);		/* MFP in software */
1942 		break;
1943 	}
1944 	if ((kc->flags & ~exp_flags) != 0)
1945 		ic_printf(ic, "%s: SET_KEY for %s returned unexpected key flags: "
1946 		    " %#06x & ~%#06x = %b\n", __func__,
1947 		    lkpi_cipher_suite_to_name(kc->cipher), kc->flags, exp_flags,
1948 		    (kc->flags & ~exp_flags), IEEE80211_KEY_FLAG_BITS);
1949 
1950 #ifdef __notyet__
1951 	/* Do flags surgery. */
1952 	if ((kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) == 0)
1953 		wk->wk_flags |= IEEE80211_KEY_NOIVMGT;
1954 	if ((kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV) == 0)
1955 		wk->wk_flags |= IEEE80211_KEY_NOIV;
1956 #endif
1957 
1958 	ieee80211_free_node(ni);
1959 	return (1);
1960 }
1961 
1962 static void
1963 lkpi_iv_key_update_begin(struct ieee80211vap *vap)
1964 {
1965 	struct ieee80211_node_table *nt;
1966 	struct ieee80211com *ic;
1967 	struct lkpi_hw *lhw;
1968 	struct ieee80211_hw *hw;
1969 	struct lkpi_vif *lvif;
1970 	struct ieee80211_node *ni;
1971 	bool icislocked, ntislocked;
1972 
1973 	ic = vap->iv_ic;
1974 	lhw = ic->ic_softc;
1975 	hw = LHW_TO_HW(lhw);
1976 	lvif = VAP_TO_LVIF(vap);
1977 	nt = &ic->ic_sta;
1978 
1979 	icislocked = IEEE80211_IS_LOCKED(ic);
1980 	ntislocked = IEEE80211_NODE_IS_LOCKED(nt);
1981 
1982 #ifdef LINUXKPI_DEBUG_80211
1983 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1984 		ic_printf(ic, "%d %lu %s: vap %p ic %p %slocked nt %p %slocked "
1985 		    "lvif ic_unlocked %d nt_unlocked %d\n",
1986 		    curthread->td_tid, jiffies, __func__, vap,
1987 		    ic, icislocked ? "" : "un", nt, ntislocked ? "" : "un",
1988 		    lvif->ic_unlocked, lvif->nt_unlocked);
1989 #endif
1990 
1991 	/*
1992 	 * This is inconsistent net80211 locking to be fixed one day.
1993 	 */
1994 	/* Try to make sure the node does not go away while possibly unlocked. */
1995 	ni = NULL;
1996 	if (icislocked || ntislocked) {
1997 		if (vap->iv_bss != NULL)
1998 			ni = ieee80211_ref_node(vap->iv_bss);
1999 	}
2000 
2001 	if (icislocked)
2002 		IEEE80211_UNLOCK(ic);
2003 	if (ntislocked)
2004 		IEEE80211_NODE_UNLOCK(nt);
2005 
2006 	wiphy_lock(hw->wiphy);
2007 
2008 	KASSERT(lvif->key_update_iv_bss == NULL, ("%s: key_update_iv_bss not NULL %p",
2009 	    __func__, lvif->key_update_iv_bss));
2010 	lvif->key_update_iv_bss = ni;
2011 
2012 	/*
2013 	 * ic/nt_unlocked could be a bool given we are under the lock and there
2014 	 * must only be a single thread.
2015 	 * In case anything in the future disturbs the order the refcnt will
2016 	 * help us catching problems a lot easier.
2017 	 */
2018 	if (icislocked)
2019 		refcount_acquire(&lvif->ic_unlocked);
2020 	if (ntislocked)
2021 		refcount_acquire(&lvif->nt_unlocked);
2022 
2023 	/*
2024 	 * Stop the queues while doing key updates.
2025 	 */
2026 	ieee80211_stop_queues(hw);
2027 }
2028 
2029 static void
2030 lkpi_iv_key_update_end(struct ieee80211vap *vap)
2031 {
2032 	struct ieee80211_node_table *nt;
2033 	struct ieee80211com *ic;
2034 	struct lkpi_hw *lhw;
2035 	struct ieee80211_hw *hw;
2036 	struct lkpi_vif *lvif;
2037 	bool icislocked, ntislocked;
2038 
2039 	ic = vap->iv_ic;
2040 	lhw = ic->ic_softc;
2041 	hw = LHW_TO_HW(lhw);
2042 	lvif = VAP_TO_LVIF(vap);
2043 	nt = &ic->ic_sta;
2044 
2045 	/*
2046 	 * Re-enabled the queues after the key update.
2047 	 */
2048 	lkpi_ieee80211_wake_queues_locked(hw);
2049 
2050 	icislocked = IEEE80211_IS_LOCKED(ic);
2051 	MPASS(!icislocked);
2052 	ntislocked = IEEE80211_NODE_IS_LOCKED(nt);
2053 	MPASS(!ntislocked);
2054 
2055 #ifdef LINUXKPI_DEBUG_80211
2056 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
2057 		ic_printf(ic, "%d %lu %s: vap %p ic %p %slocked nt %p %slocked "
2058 		    "lvif ic_unlocked %d nt_unlocked %d\n",
2059 		    curthread->td_tid, jiffies, __func__, vap,
2060 		    ic, icislocked ? "" : "un", nt, ntislocked ? "" : "un",
2061 		    lvif->ic_unlocked, lvif->nt_unlocked);
2062 #endif
2063 
2064 	/*
2065 	 * Check under lock; see comment in lkpi_iv_key_update_begin().
2066 	 * In case the refcnt gets out of sync locking in net80211 will
2067 	 * quickly barf as well (trying to unlock a lock not held).
2068 	 */
2069 	icislocked = refcount_release_if_last(&lvif->ic_unlocked);
2070 	ntislocked = refcount_release_if_last(&lvif->nt_unlocked);
2071 
2072 	if (lvif->key_update_iv_bss != NULL) {
2073 		ieee80211_free_node(lvif->key_update_iv_bss);
2074 		lvif->key_update_iv_bss = NULL;
2075 	}
2076 
2077 	wiphy_unlock(hw->wiphy);
2078 
2079 	/*
2080 	 * This is inconsistent net80211 locking to be fixed one day.
2081 	 * ic before nt to avoid a LOR.
2082 	 */
2083 	if (icislocked)
2084 		IEEE80211_LOCK(ic);
2085 	if (ntislocked)
2086 		IEEE80211_NODE_LOCK(nt);
2087 }
2088 #endif
2089 
2090 static void
2091 lkpi_cleanup_mcast_list_locked(struct lkpi_hw *lhw)
2092 {
2093 	struct list_head *le, *next;
2094 	struct netdev_hw_addr *addr;
2095 
2096 	if (lhw->mc_list.count != 0) {
2097 		list_for_each_safe(le, next, &lhw->mc_list.addr_list) {
2098 			addr = list_entry(le, struct netdev_hw_addr, addr_list);
2099 			list_del(le);
2100 			lhw->mc_list.count--;
2101 			free(addr, M_LKPI80211);
2102 		}
2103 	}
2104 	KASSERT(lhw->mc_list.count == 0, ("%s: mc_list %p count %d != 0\n",
2105 	    __func__, &lhw->mc_list, lhw->mc_list.count));
2106 }
2107 
2108 static u_int
2109 lkpi_ic_update_mcast_copy(void *arg, struct sockaddr_dl *sdl, u_int cnt)
2110 {
2111 	struct netdev_hw_addr_list *mc_list;
2112 	struct netdev_hw_addr *addr;
2113 
2114 	KASSERT(arg != NULL && sdl != NULL, ("%s: arg %p sdl %p cnt %u\n",
2115 	    __func__, arg, sdl, cnt));
2116 
2117 	mc_list = arg;
2118 	/* If it is on the list already skip it. */
2119 	netdev_hw_addr_list_for_each(addr, mc_list) {
2120 		if (!memcmp(addr->addr, LLADDR(sdl), sdl->sdl_alen))
2121 			return (0);
2122 	}
2123 
2124 	addr = malloc(sizeof(*addr), M_LKPI80211, M_NOWAIT | M_ZERO);
2125 	if (addr == NULL)
2126 		return (0);
2127 
2128 	INIT_LIST_HEAD(&addr->addr_list);
2129 	memcpy(addr->addr, LLADDR(sdl), sdl->sdl_alen);
2130 	/* XXX this should be a netdev function? */
2131 	list_add(&addr->addr_list, &mc_list->addr_list);
2132 	mc_list->count++;
2133 
2134 #ifdef LINUXKPI_DEBUG_80211
2135 	if (linuxkpi_debug_80211 & D80211_TRACE)
2136 		printf("%s:%d: mc_list count %d: added %6D\n",
2137 		    __func__, __LINE__, mc_list->count, addr->addr, ":");
2138 #endif
2139 
2140 	return (1);
2141 }
2142 
2143 static void
2144 lkpi_update_mcast_filter_locked(struct ieee80211com *ic)
2145 {
2146 	struct lkpi_hw *lhw;
2147 	struct ieee80211_hw *hw;
2148 	u64 mc;
2149 	unsigned int changed_flags, flags;
2150 	bool scanning;
2151 
2152 	lhw = ic->ic_softc;
2153 	hw = LHW_TO_HW(lhw);
2154 
2155 	lockdep_assert_wiphy(hw->wiphy);
2156 
2157 	LKPI_80211_LHW_SCAN_LOCK(lhw);
2158 	scanning = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
2159 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
2160 
2161 	LKPI_80211_LHW_MC_LOCK(lhw);
2162 
2163 	flags = 0;
2164 	if (scanning)
2165 		flags |= FIF_BCN_PRBRESP_PROMISC;
2166 	/* The latter condition may not be as expected but seems wise. */
2167 	if (lhw->mc_all_multi || lhw->ops->prepare_multicast == NULL)
2168 		flags |= FIF_ALLMULTI;
2169 
2170 	mc = lkpi_80211_mo_prepare_multicast(hw, &lhw->mc_list);
2171 
2172 	changed_flags = (lhw->mc_flags ^ flags) & FIF_FLAGS_MASK;
2173 	lkpi_80211_mo_configure_filter(hw, changed_flags, &flags, mc);
2174 	lhw->mc_flags = flags;
2175 
2176 #ifdef LINUXKPI_DEBUG_80211
2177 	if (linuxkpi_debug_80211 & D80211_TRACE)
2178 		printf("%s: changed_flags %#06x count %d mc_flags %#010x\n",
2179 		    __func__, changed_flags, lhw->mc_list.count, lhw->mc_flags);
2180 #endif
2181 
2182 	LKPI_80211_LHW_MC_UNLOCK(lhw);
2183 }
2184 
2185 static void
2186 lkpi_update_mcast_filter(struct ieee80211com *ic)
2187 {
2188 	struct lkpi_hw *lhw;
2189 	struct ieee80211_hw *hw;
2190 
2191 	lhw = ic->ic_softc;
2192 	hw = LHW_TO_HW(lhw);
2193 
2194 	wiphy_lock(hw->wiphy);
2195 	lkpi_update_mcast_filter_locked(ic);
2196 	wiphy_unlock(hw->wiphy);
2197 }
2198 
2199 static enum ieee80211_bss_changed
2200 lkpi_update_dtim_tsf(struct ieee80211_vif *vif, struct ieee80211_node *ni,
2201     struct ieee80211vap *vap, const char *_f, int _l)
2202 {
2203 	enum ieee80211_bss_changed bss_changed;
2204 
2205 	bss_changed = 0;
2206 
2207 #ifdef LINUXKPI_DEBUG_80211
2208 	if (linuxkpi_debug_80211 & D80211_TRACE)
2209 		printf("%s:%d [%s:%d] assoc %d aid %d beacon_int %u "
2210 		    "dtim_period %u sync_dtim_count %u sync_tsf %ju "
2211 		    "sync_device_ts %u bss_changed %#010jx\n",
2212 			__func__, __LINE__, _f, _l,
2213 			vif->cfg.assoc, vif->cfg.aid,
2214 			vif->bss_conf.beacon_int, vif->bss_conf.dtim_period,
2215 			vif->bss_conf.sync_dtim_count,
2216 			(uintmax_t)vif->bss_conf.sync_tsf,
2217 			vif->bss_conf.sync_device_ts,
2218 			(uintmax_t)bss_changed);
2219 #endif
2220 
2221 	if (vif->bss_conf.beacon_int != ni->ni_intval) {
2222 		vif->bss_conf.beacon_int = ni->ni_intval;
2223 		/* iwlwifi FW bug workaround; iwl_mvm_mac_sta_state. */
2224 		if (vif->bss_conf.beacon_int < 16)
2225 			vif->bss_conf.beacon_int = 16;
2226 		bss_changed |= BSS_CHANGED_BEACON_INT;
2227 	}
2228 
2229 	/*
2230 	 * lkpi_iv_sta_recv_mgmt() will directly call into this function.
2231 	 * iwlwifi(4) in iwl_mvm_bss_info_changed_station_common() will
2232 	 * stop seesion protection the moment it sees
2233 	 * BSS_CHANGED_BEACON_INFO (with the expectations that it was
2234 	 * "a beacon from the associated AP"). It will also update
2235 	 * the beacon filter in that case.  This is the only place
2236 	 * we set the BSS_CHANGED_BEACON_INFO on the non-teardown
2237 	 * path so make sure we only do run this check once we are
2238 	 * assoc. (*iv_recv_mgmt)() will be called before we enter
2239 	 * here so the ni will be updated with information from the
2240 	 * beacon via net80211::sta_recv_mgmt().  We also need to
2241 	 * make sure we do not do it on every beacon we still may
2242 	 * get so only do if something changed.  vif->bss_conf.dtim_period
2243 	 * should be 0 as we start up (we also reset it on teardown).
2244 	 *
2245 	 * If we are assoc we need to make sure dtim_period is non-0.
2246 	 * 0 is a reserved value and drivers assume they can DIV by it.
2247 	 * In theory this means we need to wait for the first beacon
2248 	 * before we finalize the vif being assoc.  In practise that
2249 	 * is harder until net80211 learns how to.  Work around like
2250 	 * this for the moment.
2251 	 */
2252 	if (vif->cfg.assoc) {
2253 		if (vif->bss_conf.dtim_period != ni->ni_dtim_period &&
2254 	            ni->ni_dtim_period > 0) {
2255 			vif->bss_conf.dtim_period = ni->ni_dtim_period;
2256 			bss_changed |= BSS_CHANGED_BEACON_INFO;
2257 		} else if (vif->bss_conf.dtim_period == 0) {
2258 			vif->bss_conf.dtim_period = 1;
2259 			bss_changed |= BSS_CHANGED_BEACON_INFO;
2260 		}
2261 	}
2262 
2263 	vif->bss_conf.sync_dtim_count = ni->ni_dtim_count;
2264 	vif->bss_conf.sync_tsf = le64toh(ni->ni_tstamp.tsf);
2265 	/* vif->bss_conf.sync_device_ts = set in linuxkpi_ieee80211_rx. */
2266 
2267 #ifdef LINUXKPI_DEBUG_80211
2268 	if (linuxkpi_debug_80211 & D80211_TRACE)
2269 		printf("%s:%d [%s:%d] assoc %d aid %d beacon_int %u "
2270 		    "dtim_period %u sync_dtim_count %u sync_tsf %ju "
2271 		    "sync_device_ts %u bss_changed %#010jx\n",
2272 			__func__, __LINE__, _f, _l,
2273 			vif->cfg.assoc, vif->cfg.aid,
2274 			vif->bss_conf.beacon_int, vif->bss_conf.dtim_period,
2275 			vif->bss_conf.sync_dtim_count,
2276 			(uintmax_t)vif->bss_conf.sync_tsf,
2277 			vif->bss_conf.sync_device_ts,
2278 			(uintmax_t)bss_changed);
2279 #endif
2280 
2281 	return (bss_changed);
2282 }
2283 
2284 static void
2285 lkpi_stop_hw_scan(struct lkpi_hw *lhw, struct ieee80211_vif *vif)
2286 {
2287 	struct ieee80211_hw *hw;
2288 	int error;
2289 	bool cancel;
2290 
2291 	TRACE_SCAN(lhw->ic, "scan_flags %b", lhw->scan_flags, LKPI_LHW_SCAN_BITS);
2292 
2293 	LKPI_80211_LHW_SCAN_LOCK(lhw);
2294 	cancel = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
2295 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
2296 	if (!cancel)
2297 		return;
2298 
2299 	hw = LHW_TO_HW(lhw);
2300 
2301 	IEEE80211_UNLOCK(lhw->ic);
2302 	wiphy_lock(hw->wiphy);
2303 	/* Need to cancel the scan. */
2304 	lkpi_80211_mo_cancel_hw_scan(hw, vif);
2305 	wiphy_unlock(hw->wiphy);
2306 
2307 	/* Need to make sure we see ieee80211_scan_completed. */
2308 	LKPI_80211_LHW_SCAN_LOCK(lhw);
2309 	if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0)
2310 		error = msleep(lhw, &lhw->scan_mtx, 0, "lhwscanstop", hz/2);
2311 	cancel = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
2312 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
2313 
2314 	IEEE80211_LOCK(lhw->ic);
2315 
2316 	if (cancel)
2317 		ic_printf(lhw->ic, "%s: failed to cancel scan: %d (%p, %p)\n",
2318 		    __func__, error, lhw, vif);
2319 }
2320 
2321 static void
2322 lkpi_hw_conf_idle(struct ieee80211_hw *hw, bool new)
2323 {
2324 	struct lkpi_hw *lhw;
2325 	int error;
2326 	bool old;
2327 
2328 	lockdep_assert_wiphy(hw->wiphy);
2329 
2330 	old = hw->conf.flags & IEEE80211_CONF_IDLE;
2331 	if (old == new)
2332 		return;
2333 
2334 	hw->conf.flags ^= IEEE80211_CONF_IDLE;
2335 	error = lkpi_80211_mo_config(hw, IEEE80211_CONF_CHANGE_IDLE);
2336 	if (error != 0 && error != EOPNOTSUPP) {
2337 		lhw = HW_TO_LHW(hw);
2338 		ic_printf(lhw->ic, "ERROR: %s: config %#0x returned %d\n",
2339 		    __func__, IEEE80211_CONF_CHANGE_IDLE, error);
2340 	}
2341 }
2342 
2343 static enum ieee80211_bss_changed
2344 lkpi_disassoc(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
2345     struct lkpi_hw *lhw)
2346 {
2347 	struct ieee80211_hw *hw;
2348 	struct lkpi_vif *lvif;
2349 	enum ieee80211_bss_changed changed;
2350 
2351 	hw = LHW_TO_HW(lhw);
2352 	lockdep_assert_wiphy(hw->wiphy);
2353 
2354 	changed = 0;
2355 	sta->aid = 0;
2356 	if (vif->cfg.assoc) {
2357 
2358 		vif->cfg.assoc = false;
2359 		vif->cfg.aid = 0;
2360 		changed |= BSS_CHANGED_ASSOC;
2361 		IMPROVE();
2362 
2363 		lkpi_update_mcast_filter_locked(lhw->ic);
2364 
2365 		/*
2366 		 * Executing the bss_info_changed(BSS_CHANGED_ASSOC) with
2367 		 * assoc = false right away here will remove the sta from
2368 		 * firmware for iwlwifi.
2369 		 * We no longer do this but only return the BSS_CHNAGED value.
2370 		 * The caller is responsible for removing the sta gong to
2371 		 * IEEE80211_STA_NOTEXIST and then executing the
2372 		 * bss_info_changed() update.
2373 		 * See DOWN4 for more detailed comment.
2374 		 */
2375 
2376 		lvif = VIF_TO_LVIF(vif);
2377 		lvif->beacons = 0;
2378 	}
2379 
2380 	return (changed);
2381 }
2382 
2383 static void
2384 lkpi_wake_tx_queues(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
2385     bool dequeue_seen, bool no_emptyq)
2386 {
2387 	struct lkpi_txq *ltxq;
2388 	int tid;
2389 	bool ltxq_empty;
2390 
2391 	/* Wake up all queues to know they are allocated in the driver. */
2392 	for (tid = 0; tid < nitems(sta->txq); tid++) {
2393 
2394 		if (tid == IEEE80211_NUM_TIDS) {
2395 			IMPROVE("station specific?");
2396 			if (!ieee80211_hw_check(hw, STA_MMPDU_TXQ))
2397 				continue;
2398 		} else if (tid >= hw->queues)
2399 			continue;
2400 
2401 		if (sta->txq[tid] == NULL)
2402 			continue;
2403 
2404 		ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
2405 		if (dequeue_seen && (ltxq->flags & LKPI_TXQ_SEEN_DEQUEUE) == 0)
2406 			continue;
2407 
2408 		LKPI_80211_LTXQ_LOCK(ltxq);
2409 		ltxq_empty = skb_queue_empty(&ltxq->skbq);
2410 		LKPI_80211_LTXQ_UNLOCK(ltxq);
2411 		if (no_emptyq && ltxq_empty)
2412 			continue;
2413 
2414 		lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tid], false);
2415 	}
2416 }
2417 
2418 /*
2419  * On the way down from RUN -> ASSOC -> AUTH we may send a DISASSOC or DEAUTH
2420  * packet.  The problem is that the state machine functions tend to hold the
2421  * LHW lock which will prevent lkpi_80211_txq_tx_one() from sending the packet.
2422  * We call this after dropping the ic lock and before acquiring the LHW lock.
2423  * we make sure no further packets are queued and if they are queued the task
2424  * will finish or be cancelled.  At the end if a packet is left we manually
2425  * send it.  scan_to_auth() would re-enable sending if the lsta would be
2426  * re-used.
2427  */
2428 static void
2429 lkpi_80211_flush_tx(struct lkpi_hw *lhw, struct lkpi_sta *lsta)
2430 {
2431 	struct ieee80211_hw *hw;
2432 	struct mbufq mq;
2433 	struct mbuf *m;
2434 	int len;
2435 
2436 	/* There is no lockdep_assert_not_held_wiphy(). */
2437 	hw = LHW_TO_HW(lhw);
2438 	lockdep_assert_not_held(&hw->wiphy->mtx);
2439 
2440 	/* Do not accept any new packets until scan_to_auth or lsta_free(). */
2441 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
2442 	lsta->txq_ready = false;
2443 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
2444 
2445 	while (taskqueue_cancel(taskqueue_thread, &lsta->txq_task, NULL) != 0)
2446 		taskqueue_drain(taskqueue_thread, &lsta->txq_task);
2447 
2448 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
2449 	len = mbufq_len(&lsta->txq);
2450 	if (len <= 0) {
2451 		LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
2452 		return;
2453 	}
2454 
2455 	mbufq_init(&mq, IFQ_MAXLEN);
2456 	mbufq_concat(&mq, &lsta->txq);
2457 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
2458 
2459 	m = mbufq_dequeue(&mq);
2460 	while (m != NULL) {
2461 		lkpi_80211_txq_tx_one(lsta, m);
2462 		m = mbufq_dequeue(&mq);
2463 	}
2464 }
2465 
2466 static void
2467 lkpi_init_chandef(struct ieee80211com *ic __unused,
2468     struct cfg80211_chan_def *chandef,
2469     struct linuxkpi_ieee80211_channel *chan, struct ieee80211_channel *c,
2470     bool can_ht)
2471 {
2472 
2473 	cfg80211_chandef_create(chandef, chan,
2474 	    (can_ht) ? NL80211_CHAN_HT20 : NL80211_CHAN_NO_HT);
2475 	chandef->center_freq1 = ieee80211_get_channel_center_freq1(c);
2476 	chandef->center_freq2 = ieee80211_get_channel_center_freq2(c);
2477 
2478 	IMPROVE("Check ht/vht_cap from band not just chan? See lkpi_sta_sync_from_ni...");
2479 #ifdef LKPI_80211_HT
2480 	if (IEEE80211_IS_CHAN_HT(c)) {
2481 		if (IEEE80211_IS_CHAN_HT40(c))
2482 			chandef->width = NL80211_CHAN_WIDTH_40;
2483 		else
2484 			chandef->width = NL80211_CHAN_WIDTH_20;
2485 	}
2486 #endif
2487 #ifdef LKPI_80211_VHT
2488 	if (IEEE80211_IS_CHAN_VHT_5GHZ(c)) {
2489 		if (IEEE80211_IS_CHAN_VHT80P80(c))
2490 			chandef->width = NL80211_CHAN_WIDTH_80P80;
2491 		else if (IEEE80211_IS_CHAN_VHT160(c))
2492 			chandef->width = NL80211_CHAN_WIDTH_160;
2493 		else if (IEEE80211_IS_CHAN_VHT80(c))
2494 			chandef->width = NL80211_CHAN_WIDTH_80;
2495 	}
2496 #endif
2497 
2498 #ifdef LINUXKPI_DEBUG_80211
2499 	if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
2500 		ic_printf(ic, "%s:%d: chandef %p { chan %p { %u }, "
2501 		    "width %d cfreq1 %u cfreq2 %u punctured %u }\n",
2502 		    __func__, __LINE__, chandef,
2503 		    chandef->chan, chandef->chan->center_freq,
2504 		    chandef->width,
2505 		    chandef->center_freq1, chandef->center_freq2,
2506 		    chandef->punctured);
2507 #endif
2508 }
2509 
2510 static uint32_t
2511 lkpi_init_chanctx_conf(struct ieee80211_hw *hw,
2512     struct cfg80211_chan_def *chandef,
2513     struct ieee80211_chanctx_conf *chanctx_conf)
2514 {
2515 	uint32_t changed;
2516 
2517 	lockdep_assert_wiphy(hw->wiphy);
2518 
2519 	changed = 0;
2520 
2521 	chanctx_conf->rx_chains_static = 1;
2522 	chanctx_conf->rx_chains_dynamic = 1;
2523 	changed |= IEEE80211_CHANCTX_CHANGE_RX_CHAINS;
2524 
2525 	if (chanctx_conf->radar_enabled != hw->conf.radar_enabled) {
2526 		chanctx_conf->radar_enabled = hw->conf.radar_enabled;
2527 		changed |= IEEE80211_CHANCTX_CHANGE_RADAR;
2528 	}
2529 
2530 	chanctx_conf->def = *chandef;
2531 	changed |= IEEE80211_CHANCTX_CHANGE_WIDTH;
2532 
2533 	/* One day we should figure this out; is for iwlwifi-only. */
2534 	chanctx_conf->min_def = chanctx_conf->def;
2535 	changed |= IEEE80211_CHANCTX_CHANGE_MIN_WIDTH;
2536 
2537 	/* chanctx_conf->ap = */
2538 
2539 	return (changed);
2540 }
2541 
2542 static struct lkpi_chanctx *
2543 lkpi_alloc_lchanctx(struct ieee80211_hw *hw, struct lkpi_vif *lvif)
2544 {
2545 	struct lkpi_chanctx *lchanctx;
2546 
2547 	lchanctx = malloc(sizeof(*lchanctx) + hw->chanctx_data_size,
2548 	    M_LKPI80211, M_WAITOK | M_ZERO);
2549 	lchanctx->lvif = lvif;
2550 
2551 	return (lchanctx);
2552 }
2553 
2554 static struct lkpi_chanctx *
2555 lkpi_find_lchanctx_reserved(struct ieee80211_hw *hw, struct lkpi_vif *lvif)
2556 {
2557 	struct lkpi_hw *lhw;
2558 	struct lkpi_chanctx *lchanctx;
2559 	bool found;
2560 
2561 	lhw = HW_TO_LHW(hw);
2562 
2563 	found = false;
2564 	rcu_read_lock();
2565 	list_for_each_entry_rcu(lchanctx, &lhw->lchanctx_list_reserved, entry) {
2566 		if (lchanctx->lvif == lvif) {
2567 			found = true;
2568 			break;
2569 		}
2570 	}
2571 	rcu_read_unlock();
2572 
2573 	if (!found) {
2574 		lchanctx = lkpi_alloc_lchanctx(hw, lvif);
2575 		list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list_reserved);
2576 	}
2577 
2578 	return (lchanctx);
2579 }
2580 
2581 static struct ieee80211_chanctx_conf *
2582 lkpi_get_chanctx_conf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2583 {
2584 	struct ieee80211_chanctx_conf *chanctx_conf;
2585 
2586 	chanctx_conf = rcu_dereference_protected(vif->bss_conf.chanctx_conf,
2587 	    lockdep_is_held(&hw->wiphy->mtx));
2588 	if (chanctx_conf == NULL) {
2589 		struct lkpi_chanctx *lchanctx;
2590 		struct lkpi_vif *lvif;
2591 
2592 		lvif = VIF_TO_LVIF(vif);
2593 		lchanctx = lkpi_find_lchanctx_reserved(hw, lvif);
2594 		KASSERT(lchanctx != NULL, ("%s: hw %p, vif %p no lchanctx\n",
2595 		    __func__, hw, vif));
2596 		list_del(&lchanctx->entry);
2597 		chanctx_conf = &lchanctx->chanctx_conf;
2598 	}
2599 	/* else { IMPROVE("diff changes for changed, working on live copy, rcu"); } */
2600 
2601 	return (chanctx_conf);
2602 }
2603 
2604 static int
2605 lkpi_set_chanctx_conf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2606     struct ieee80211_chanctx_conf *chanctx_conf,
2607     uint32_t changed, bool changed_set)
2608 {
2609 	struct lkpi_hw *lhw;
2610 	struct lkpi_chanctx *lchanctx;
2611 	int error;
2612 
2613 	lockdep_assert_wiphy(hw->wiphy);
2614 
2615 	if (vif->bss_conf.chanctx_conf == chanctx_conf) {
2616 		if (!changed_set) {
2617 			IMPROVE("OBSOLETE?");
2618 			changed = IEEE80211_CHANCTX_CHANGE_MIN_WIDTH;
2619 			changed |= IEEE80211_CHANCTX_CHANGE_RADAR;
2620 			changed |= IEEE80211_CHANCTX_CHANGE_RX_CHAINS;
2621 			changed |= IEEE80211_CHANCTX_CHANGE_WIDTH;
2622 		}
2623 		lkpi_80211_mo_change_chanctx(hw, chanctx_conf, changed);
2624 
2625 		return (0);
2626 	}
2627 
2628 	lhw = HW_TO_LHW(hw);
2629 
2630 	/* The device is no longer idle. */
2631 	IMPROVE("Once we do multi-vif, only do for 1st chanctx");
2632 	lkpi_hw_conf_idle(hw, false);
2633 
2634 	error = lkpi_80211_mo_add_chanctx(hw, chanctx_conf);
2635 	if (error != 0 && error != EOPNOTSUPP) {
2636 		ic_printf(lhw->ic, "%s:%d: mo_add_chanctx "
2637 		    "failed: %d\n", __func__, __LINE__, error);
2638 		return (error);
2639 	}
2640 
2641 	vif->bss_conf.chanreq.oper.chan = chanctx_conf->def.chan;
2642 	vif->bss_conf.chanreq.oper.width = chanctx_conf->def.width;
2643 	vif->bss_conf.chanreq.oper.center_freq1 =
2644 	    chanctx_conf->def.center_freq1;
2645 	vif->bss_conf.chanreq.oper.center_freq2 =
2646 	    chanctx_conf->def.center_freq2;
2647 
2648 	lchanctx = CHANCTX_CONF_TO_LCHANCTX(chanctx_conf);
2649 	list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list);
2650 	rcu_assign_pointer(vif->bss_conf.chanctx_conf, chanctx_conf);
2651 
2652 	/* Assign vif chanctx. */
2653 	if (error == 0)
2654 		error = lkpi_80211_mo_assign_vif_chanctx(hw, vif,
2655 		    &vif->bss_conf, chanctx_conf);
2656 	if (error == EOPNOTSUPP)
2657 		error = 0;
2658 	if (error != 0) {
2659 		ic_printf(lhw->ic, "%s:%d: mo_assign_vif_chanctx "
2660 		    "failed: %d\n", __func__, __LINE__, error);
2661 		lkpi_80211_mo_remove_chanctx(hw, chanctx_conf);
2662 		rcu_assign_pointer(vif->bss_conf.chanctx_conf, NULL);
2663 		lchanctx = CHANCTX_CONF_TO_LCHANCTX(chanctx_conf);
2664 		list_del(&lchanctx->entry);
2665 		memset(lchanctx, 0, sizeof(*lchanctx));
2666 		lchanctx->lvif = VIF_TO_LVIF(vif);
2667 		list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list_reserved);
2668 	}
2669 
2670 	return (error);
2671 }
2672 
2673 static void
2674 lkpi_remove_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2675 {
2676 	struct lkpi_hw *lhw;
2677 	struct ieee80211_chanctx_conf *chanctx_conf;
2678 	struct lkpi_chanctx *lchanctx;
2679 
2680 	lockdep_assert_wiphy(hw->wiphy);
2681 
2682 	chanctx_conf = rcu_dereference_protected(vif->bss_conf.chanctx_conf,
2683 	    lockdep_is_held(&hw->wiphy->mtx));
2684 
2685 	if (chanctx_conf == NULL)
2686 		return;
2687 
2688 	/* Remove vif context. */
2689 	lkpi_80211_mo_unassign_vif_chanctx(hw, vif, &vif->bss_conf, chanctx_conf);
2690 
2691 	lkpi_hw_conf_idle(hw, true);
2692 
2693 	/* Remove chan ctx. */
2694 	lkpi_80211_mo_remove_chanctx(hw, chanctx_conf);
2695 
2696 	/* Cleanup. */
2697 	rcu_assign_pointer(vif->bss_conf.chanctx_conf, NULL);
2698 	lchanctx = CHANCTX_CONF_TO_LCHANCTX(chanctx_conf);
2699 	list_del(&lchanctx->entry);
2700 	lhw = HW_TO_LHW(hw);
2701 	memset(lchanctx, 0, sizeof(*lchanctx));
2702 	lchanctx->lvif = VIF_TO_LVIF(vif);
2703 	list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list_reserved);
2704 }
2705 
2706 /* -------------------------------------------------------------------------- */
2707 
2708 /* Any other options belong here? Check more drivers. */
2709 #define	BSS_CHANGED_VIF_CFG_BITS					\
2710     (BSS_CHANGED_SSID | BSS_CHANGED_IDLE | BSS_CHANGED_PS | BSS_CHANGED_ASSOC | \
2711     BSS_CHANGED_ARP_FILTER | BSS_CHANGED_MLD_VALID_LINKS | BSS_CHANGED_MLD_TTLM)
2712 
2713 static void
2714 lkpi_bss_info_change(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2715     enum ieee80211_bss_changed bss_changed)
2716 {
2717 	struct lkpi_vif *lvif;
2718 	enum ieee80211_bss_changed vif_cfg_bits, link_info_bits;
2719 
2720 	if (ieee80211_vif_is_mld(vif)) {
2721 		TODO("This likely needs a subset only; split up into 3 parts.");
2722 	}
2723 
2724 	/* Nothing to do? */
2725 	if (bss_changed == 0)
2726 		return;
2727 
2728 	/*
2729 	 * If the vif is not known to the driver there is nothing to notifiy for.
2730 	 * We MUST NOT check for !lvif_bss_synched here (the reasonable it seems)
2731 	 * as we need to execute the update(s) or we will have follow-up issues.
2732 	 */
2733 	lvif = VIF_TO_LVIF(vif);
2734 	if (!lvif->added_to_drv)
2735 		return;
2736 
2737 	/*
2738 	 * With the advent of MLO bss_conf got split up into vif and link
2739 	 * change notfications, while historically it was one.
2740 	 * We now need to support all possible models.
2741 	 */
2742 	vif_cfg_bits = bss_changed & BSS_CHANGED_VIF_CFG_BITS;
2743 	if (vif_cfg_bits != 0)
2744 		lkpi_80211_mo_vif_cfg_changed(hw, vif, vif_cfg_bits, false);
2745 
2746 	link_info_bits = bss_changed & ~(BSS_CHANGED_VIF_CFG_BITS);
2747 	if (link_info_bits != 0)
2748 		lkpi_80211_mo_link_info_changed(hw, vif, &vif->bss_conf,
2749 		    link_info_bits, 0, false);
2750 
2751 	lkpi_80211_mo_bss_info_changed(hw, vif, &vif->bss_conf, bss_changed);
2752 }
2753 
2754 /* -------------------------------------------------------------------------- */
2755 
2756 static int
2757 lkpi_sta_state_do_nada(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2758 {
2759 	return (0);
2760 }
2761 
2762 /* UP1 */
2763 static int
2764 lkpi_sta_init_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2765 {
2766 	return (lkpi_sta_state_do_nada(vap, nstate, arg));
2767 }
2768 
2769 /* UP2 */
2770 static int
2771 lkpi_sta_scan_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2772 {
2773 	struct linuxkpi_ieee80211_channel *chan;
2774 	struct cfg80211_chan_def chandef;
2775 	struct ieee80211_chanctx_conf *chanctx_conf;
2776 	struct lkpi_hw *lhw;
2777 	struct ieee80211_hw *hw;
2778 	struct lkpi_vif *lvif;
2779 	struct ieee80211_vif *vif;
2780 	struct ieee80211_node *ni;
2781 	struct lkpi_sta *lsta;
2782 	enum ieee80211_bss_changed bss_changed;
2783 	struct ieee80211_prep_tx_info prep_tx_info;
2784 	uint32_t changed;
2785 	int error;
2786 	bool synched, can_ht;
2787 
2788 	/*
2789 	 * In here we use vap->iv_bss until lvif->lvif_bss is set.
2790 	 * For all later (STATE >= AUTH) functions we need to use the lvif
2791 	 * cache which will be tracked even through (*iv_update_bss)().
2792 	 */
2793 
2794 	if (vap->iv_bss == NULL) {
2795 		ic_printf(vap->iv_ic, "%s: no iv_bss for vap %p\n", __func__, vap);
2796 		return (EINVAL);
2797 	}
2798 	/*
2799 	 * Keep the ni alive locally.  In theory (and practice) iv_bss can change
2800 	 * once we unlock here.  This is due to net80211 allowing state changes
2801 	 * and new join1() despite having an active node as well as due to
2802 	 * the fact that the iv_bss can be swapped under the hood in (*iv_update_bss).
2803 	 */
2804 	ni = ieee80211_ref_node(vap->iv_bss);
2805 	if (ni->ni_chan == NULL || ni->ni_chan == IEEE80211_CHAN_ANYC) {
2806 		ic_printf(vap->iv_ic, "%s: no channel set for iv_bss ni %p "
2807 		    "on vap %p\n", __func__, ni, vap);
2808 		ieee80211_free_node(ni);	/* Error handling for the local ni. */
2809 		return (EINVAL);
2810 	}
2811 
2812 	lhw = vap->iv_ic->ic_softc;
2813 	chan = lkpi_find_lkpi80211_chan(lhw, ni->ni_chan);
2814 	if (chan == NULL) {
2815 		ic_printf(vap->iv_ic, "%s: failed to get LKPI channel from "
2816 		    "iv_bss ni %p on vap %p\n", __func__, ni, vap);
2817 		ieee80211_free_node(ni);	/* Error handling for the local ni. */
2818 		return (ESRCH);
2819 	}
2820 
2821 	hw = LHW_TO_HW(lhw);
2822 	lvif = VAP_TO_LVIF(vap);
2823 	vif = LVIF_TO_VIF(lvif);
2824 
2825 	LKPI_80211_LVIF_LOCK(lvif);
2826 	/* XXX-BZ KASSERT later? */
2827 	if (lvif->lvif_bss_synched || lvif->lvif_bss != NULL) {
2828 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2829 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
2830 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2831 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2832 		    lvif->lvif_bss_synched);
2833 		LKPI_80211_LVIF_UNLOCK(lvif);
2834 		ieee80211_free_node(ni);	/* Error handling for the local ni. */
2835 		return (EBUSY);
2836 	}
2837 	LKPI_80211_LVIF_UNLOCK(lvif);
2838 
2839 	IEEE80211_UNLOCK(vap->iv_ic);
2840 	wiphy_lock(hw->wiphy);
2841 
2842 	/* Add chanctx (or if exists, change it). */
2843 	chanctx_conf = lkpi_get_chanctx_conf(hw, vif);
2844 
2845 	KASSERT(ni->ni_chan != NULL && ni->ni_chan != IEEE80211_CHAN_ANYC,
2846 	   ("%s:%d: ni %p ni_chan %p\n", __func__, __LINE__, ni, ni->ni_chan));
2847 
2848 #ifdef LKPI_80211_HT
2849 	can_ht = (vap->iv_ic->ic_flags_ht & IEEE80211_FHT_HT) != 0;
2850 #else
2851 	can_ht = false;
2852 #endif
2853 	lkpi_init_chandef(vap->iv_ic, &chandef, chan, ni->ni_chan, can_ht);
2854 	hw->conf.radar_enabled =
2855 	    ((chan->flags & IEEE80211_CHAN_RADAR) != 0) ? true : false;
2856 	hw->conf.chandef = chandef;
2857 	vif->bss_conf.chanreq.oper = hw->conf.chandef;
2858 #ifdef LINUXKPI_DEBUG_80211
2859 	if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
2860 		ic_printf(vap->iv_ic, "%s:%d: hw->conf.chandef %p = chandef %p = "
2861 		    "vif->bss_conf.chanreq.oper %p\n", __func__, __LINE__,
2862 		    &hw->conf.chandef, &chandef, &vif->bss_conf.chanreq.oper);
2863 #endif
2864 
2865 	changed = lkpi_init_chanctx_conf(hw, &chandef, chanctx_conf);
2866 
2867 	/* Responder ... */
2868 
2869 	/* Set bss info (bss_info_changed). */
2870 	bss_changed = 0;
2871 	IEEE80211_ADDR_COPY(vif->cfg.ap_addr, ni->ni_bssid);
2872 	vif->bss_conf.bssid = ni->ni_bssid;
2873 	bss_changed |= BSS_CHANGED_BSSID;
2874 	vif->bss_conf.txpower = ni->ni_txpower;
2875 	bss_changed |= BSS_CHANGED_TXPOWER;
2876 	vif->cfg.idle = false;
2877 	bss_changed |= BSS_CHANGED_IDLE;
2878 
2879 	lvif->beacons = 0;
2880 	/* Should almost assert it is this. */
2881 	vif->cfg.assoc = false;
2882 	vif->cfg.aid = 0;
2883 
2884 	bss_changed |= lkpi_update_dtim_tsf(vif, ni, vap, __func__, __LINE__);
2885 
2886 	error = lkpi_set_chanctx_conf(hw, vif, chanctx_conf, changed, true);
2887 	if (error != 0)
2888 		goto out;
2889 
2890 	IMPROVE("update radiotap chan fields too");
2891 
2892 	/* RATES */
2893 	IMPROVE("bss info: not all needs to come now and rates are missing");
2894 	bss_changed |= lkpi_sta_supp_rates(hw, vif, ni, NULL);
2895 	if (ieee80211_hw_check(hw, HAS_RATE_CONTROL))
2896 		lkpi_80211_mo_set_bitrate_mask(hw, vif, &lvif->br_mask);
2897 	TODO("cfg80211_tid_config WHERE?");
2898 
2899 	lkpi_bss_info_change(hw, vif, bss_changed);
2900 
2901 	/*
2902 	 * Given ni and lsta are 1:1 from alloc to free we can assert that
2903 	 * ni always has lsta data attach despite net80211 node swapping
2904 	 * under the hoods.
2905 	 */
2906 	KASSERT(ni->ni_drv_data != NULL, ("%s: ni %p ni_drv_data %p\n",
2907 	    __func__, ni, ni->ni_drv_data));
2908 	lsta = ni->ni_drv_data;
2909 
2910 	/* Insert the [l]sta into the list of known stations. */
2911 	list_add_tail(&lsta->lsta_list, &lvif->lsta_list);
2912 
2913 	/* Add (or adjust) sta and change state (from NOTEXIST) to NONE. */
2914 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
2915 	KASSERT(lsta->state == IEEE80211_STA_NOTEXIST, ("%s: lsta %p state not "
2916 	    "NOTEXIST: %#x\n", __func__, lsta, lsta->state));
2917 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NONE);
2918 	if (error != 0) {
2919 		IMPROVE("do we need to undo the chan ctx?");
2920 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NONE) "
2921 		    "failed: %d\n", __func__, __LINE__, error);
2922 		goto out;
2923 	}
2924 #if 0
2925 	lsta->added_to_drv = true;	/* mo manages. */
2926 #endif
2927 
2928 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
2929 
2930 #if 0
2931 	/*
2932 	 * Wakeup all queues now that sta is there so we have as much time to
2933 	 * possibly prepare the queue in the driver to be ready for the 1st
2934 	 * packet;  lkpi_80211_txq_tx_one() still has a workaround as there
2935 	 * is no guarantee or way to check.
2936 	 * XXX-BZ and by now we know that this does not work on all drivers
2937 	 * for all queues.
2938 	 */
2939 	lkpi_wake_tx_queues(hw, LSTA_TO_STA(lsta), false, false);
2940 #endif
2941 
2942 	/* Start mgd_prepare_tx. */
2943 	memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2944 	prep_tx_info.duration = PREP_TX_INFO_DURATION;		/* SAE */
2945 	prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
2946 	prep_tx_info.link_id = 0;
2947 	lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
2948 	lsta->in_mgd = true;
2949 
2950 	/*
2951 	 * What is going to happen next:
2952 	 * - <twiddle> .. we should end up in "auth_to_assoc"
2953 	 * - event_callback
2954 	 * - update sta_state (NONE to AUTH)
2955 	 * - mgd_complete_tx
2956 	 * (ideally we'd do that on a callback for something else ...)
2957 	 */
2958 
2959 	wiphy_unlock(hw->wiphy);
2960 	IEEE80211_LOCK(vap->iv_ic);
2961 
2962 	LKPI_80211_LVIF_LOCK(lvif);
2963 	/* Re-check given (*iv_update_bss) could have happened while we were unlocked. */
2964 	if (lvif->lvif_bss_synched || lvif->lvif_bss != NULL ||
2965 	    lsta->ni != vap->iv_bss)
2966 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2967 		    "lvif_bss->ni %p synched %d, ni %p lsta %p\n", __func__, __LINE__,
2968 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2969 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2970 		    lvif->lvif_bss_synched, ni, lsta);
2971 
2972 	/*
2973 	 * Reference the "ni" for caching the lsta/ni in lvif->lvif_bss.
2974 	 * Given we cache lsta we use lsta->ni instead of ni here (even though
2975 	 * lsta->ni == ni) to be distinct from the rest of the code where we do
2976 	 * assume that ni == vap->iv_bss which it may or may not be.
2977 	 * So do NOT use iv_bss here anymore as that may have diverged from our
2978 	 * function local ni already while ic was unlocked and would lead to
2979 	 * inconsistencies.  Go and see if we lost a race and do not update
2980 	 * lvif_bss_synched in that case.
2981 	 */
2982 	ieee80211_ref_node(lsta->ni);
2983 	lvif->lvif_bss = lsta;
2984 	if (lsta->ni == vap->iv_bss) {
2985 		lvif->lvif_bss_synched = synched = true;
2986 	} else {
2987 		/* Set to un-synched no matter what. */
2988 		lvif->lvif_bss_synched = synched = false;
2989 		/*
2990 		 * We do not error as someone has to take us down.
2991 		 * If we are followed by a 2nd, new net80211::join1() going to
2992 		 * AUTH lkpi_sta_a_to_a() will error, lkpi_sta_auth_to_{scan,init}()
2993 		 * will take the lvif->lvif_bss node down eventually.
2994 		 * What happens with the vap->iv_bss node will entirely be up
2995 		 * to net80211 as we never used the node beyond alloc()/free()
2996 		 * and we do not hold an extra reference for that anymore given
2997 		 * ni : lsta == 1:1.
2998 		 * Problem is if we do not error a MGMT/AUTH frame will be
2999 		 * sent from net80211::sta_newstate(); disable lsta queue below.
3000 		 */
3001 	}
3002 	LKPI_80211_LVIF_UNLOCK(lvif);
3003 	/*
3004 	 * Make sure in case the sta did not change and we re-added it,
3005 	 * that we can tx again but only if the vif/iv_bss are in sync.
3006 	 * Otherwise this should prevent the MGMT/AUTH frame from being
3007 	 * sent triggering a warning in iwlwifi.
3008 	 */
3009 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
3010 	lsta->txq_ready = synched;
3011 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
3012 	goto out_relocked;
3013 
3014 out:
3015 	wiphy_unlock(hw->wiphy);
3016 	IEEE80211_LOCK(vap->iv_ic);
3017 out_relocked:
3018 	/*
3019 	 * Release the reference that kept the ni stable locally
3020 	 * during the work of this function.
3021 	 */
3022 	if (ni != NULL)
3023 		ieee80211_free_node(ni);
3024 	return (error);
3025 }
3026 
3027 /* UP3.1 */
3028 static int
3029 lkpi_sta_auth_to_assoc(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3030 {
3031 	struct lkpi_hw *lhw;
3032 	struct ieee80211_hw *hw;
3033 	struct lkpi_vif *lvif;
3034 	struct ieee80211_vif *vif;
3035 	struct lkpi_sta *lsta;
3036 	struct ieee80211_prep_tx_info prep_tx_info;
3037 	int error;
3038 
3039 	lhw = vap->iv_ic->ic_softc;
3040 	hw = LHW_TO_HW(lhw);
3041 	lvif = VAP_TO_LVIF(vap);
3042 	vif = LVIF_TO_VIF(lvif);
3043 
3044 	IEEE80211_UNLOCK(vap->iv_ic);
3045 	wiphy_lock(hw->wiphy);
3046 
3047 	LKPI_80211_LVIF_LOCK(lvif);
3048 	/* XXX-BZ KASSERT later? */
3049 	if (!lvif->lvif_bss_synched || lvif->lvif_bss == NULL) {
3050 #ifdef LINUXKPI_DEBUG_80211
3051 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3052 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3053 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3054 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3055 		    lvif->lvif_bss_synched);
3056 #endif
3057 		error = ENOTRECOVERABLE;
3058 		LKPI_80211_LVIF_UNLOCK(lvif);
3059 		goto out;
3060 	}
3061 	lsta = lvif->lvif_bss;
3062 	LKPI_80211_LVIF_UNLOCK(lvif);
3063 
3064 	KASSERT(lsta != NULL, ("%s: lsta %p\n", __func__, lsta));
3065 
3066 	/* Finish auth. */
3067 	IMPROVE("event callback");
3068 
3069 	/* Update sta_state (NONE to AUTH). */
3070 	KASSERT(lsta->state == IEEE80211_STA_NONE, ("%s: lsta %p state not "
3071 	    "NONE: %#x\n", __func__, lsta, lsta->state));
3072 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_AUTH);
3073 	if (error != 0) {
3074 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(AUTH) "
3075 		    "failed: %d\n", __func__, __LINE__, error);
3076 		goto out;
3077 	}
3078 
3079 	/* End mgd_complete_tx. */
3080 	if (lsta->in_mgd) {
3081 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3082 		prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
3083 		prep_tx_info.success = true;
3084 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3085 		lsta->in_mgd = false;
3086 	}
3087 
3088 	/* Now start assoc. unless nstate=RUN (auth_to_run). */
3089 
3090 	/* Start mgd_prepare_tx. */
3091 	if (nstate == IEEE80211_S_ASSOC && !lsta->in_mgd) {
3092 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3093 		prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3094 		prep_tx_info.link_id = 0;
3095 		lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
3096 		lsta->in_mgd = true;
3097 	}
3098 
3099 #if 0
3100 	/* We do not yet have a packet to go out. */
3101 	/* Wake tx queue to get packet out. */
3102 	lkpi_wake_tx_queues(hw, LSTA_TO_STA(lsta), false, true);
3103 #endif
3104 
3105 	/*
3106 	 * <twiddle> .. we end up in "assoc_to_run"
3107 	 * - update sta_state (AUTH to ASSOC)
3108 	 * - conf_tx [all]
3109 	 * - bss_info_changed (assoc, aid, ssid, ..)
3110 	 * - change_chanctx (if needed)
3111 	 * - event_callback
3112 	 * - mgd_complete_tx
3113 	 */
3114 
3115 out:
3116 	wiphy_unlock(hw->wiphy);
3117 	IEEE80211_LOCK(vap->iv_ic);
3118 	return (error);
3119 }
3120 
3121 static int lkpi_sta_assoc_to_run(struct ieee80211vap *, enum ieee80211_state, int);
3122 
3123 /* UP3.2 */
3124 static int
3125 lkpi_sta_auth_to_run(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3126 {
3127 	int error;
3128 
3129 	error = lkpi_sta_auth_to_assoc(vap, nstate, arg);
3130 	if (error == 0)
3131 		error = lkpi_sta_assoc_to_run(vap, nstate, arg);
3132 	return (error);
3133 }
3134 
3135 /* UP4 */
3136 static int
3137 lkpi_sta_assoc_to_run(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3138 {
3139 	struct lkpi_hw *lhw;
3140 	struct ieee80211_hw *hw;
3141 	struct lkpi_vif *lvif;
3142 	struct ieee80211_vif *vif;
3143 	struct ieee80211_node *ni;
3144 	struct lkpi_sta *lsta;
3145 	struct ieee80211_sta *sta;
3146 	struct ieee80211_prep_tx_info prep_tx_info;
3147 	enum ieee80211_bss_changed bss_changed;
3148 	int error;
3149 
3150 	lhw = vap->iv_ic->ic_softc;
3151 	hw = LHW_TO_HW(lhw);
3152 	lvif = VAP_TO_LVIF(vap);
3153 	vif = LVIF_TO_VIF(lvif);
3154 
3155 	IEEE80211_UNLOCK(vap->iv_ic);
3156 	wiphy_lock(hw->wiphy);
3157 
3158 	LKPI_80211_LVIF_LOCK(lvif);
3159 	/* XXX-BZ KASSERT later? */
3160 	if (!lvif->lvif_bss_synched || lvif->lvif_bss == NULL) {
3161 #ifdef LINUXKPI_DEBUG_80211
3162 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3163 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3164 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3165 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3166 		    lvif->lvif_bss_synched);
3167 #endif
3168 		LKPI_80211_LVIF_UNLOCK(lvif);
3169 		error = ENOTRECOVERABLE;
3170 		goto out;
3171 	}
3172 	lsta = lvif->lvif_bss;
3173 	LKPI_80211_LVIF_UNLOCK(lvif);
3174 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
3175 	    "lvif %p vap %p\n", __func__,
3176 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
3177 
3178 	ni = lsta->ni;		/* Reference held for lvif_bss. */
3179 
3180 	IMPROVE("ponder some of this moved to ic_newassoc, scan_assoc_success, "
3181 	    "and to lesser extend ieee80211_notify_node_join");
3182 
3183 	/* Finish assoc. */
3184 	/* Update sta_state (AUTH to ASSOC) and set aid. */
3185 	KASSERT(lsta->state == IEEE80211_STA_AUTH, ("%s: lsta %p state not "
3186 	    "AUTH: %#x\n", __func__, lsta, lsta->state));
3187 	sta = LSTA_TO_STA(lsta);
3188 	sta->aid = IEEE80211_NODE_AID(ni);
3189 #ifdef LKPI_80211_WME
3190 	if (vap->iv_flags & IEEE80211_F_WME)
3191 		sta->wme = true;
3192 #endif
3193 	bss_changed = 0;
3194 	/*
3195 	 * This sync needs to happen before the sta_state change to ASSOC.
3196 	 * At least mt7921 (likely all drivers) rely on, e.g., ht_cap, vht_cap,
3197 	 * .. to be set at the point we go to assoc.
3198 	 */
3199 	bss_changed |= lkpi_sta_sync_from_ni(hw, vif, sta, ni, true);
3200 	if (ieee80211_hw_check(hw, HAS_RATE_CONTROL))
3201 		lkpi_80211_mo_set_bitrate_mask(hw, vif, &lvif->br_mask);
3202 
3203 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_ASSOC);
3204 	if (error != 0) {
3205 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(ASSOC) "
3206 		    "failed: %d\n", __func__, __LINE__, error);
3207 		goto out;
3208 	}
3209 
3210 	IMPROVE("wme / conf_tx [all]");
3211 
3212 	/* Update bss info (bss_info_changed) (assoc, aid, ..). */
3213 #ifdef LKPI_80211_WME
3214 	bss_changed |= lkpi_wme_update(lhw, vap, true);
3215 #endif
3216 	if (!vif->cfg.assoc || vif->cfg.aid != IEEE80211_NODE_AID(ni)) {
3217 		lvif->beacons = 0;
3218 		vif->cfg.assoc = true;
3219 		vif->cfg.aid = IEEE80211_NODE_AID(ni);
3220 		bss_changed |= BSS_CHANGED_ASSOC;
3221 	}
3222 	/* We set SSID but this is not BSSID! */
3223 	vif->cfg.ssid_len = ni->ni_esslen;
3224 	memcpy(vif->cfg.ssid, ni->ni_essid, ni->ni_esslen);
3225 	if ((vap->iv_flags & IEEE80211_F_SHPREAMBLE) !=
3226 	    vif->bss_conf.use_short_preamble) {
3227 		vif->bss_conf.use_short_preamble ^= 1;
3228 		/* bss_changed |= BSS_CHANGED_??? */
3229 	}
3230 	if ((vap->iv_flags & IEEE80211_F_SHSLOT) !=
3231 	    vif->bss_conf.use_short_slot) {
3232 		vif->bss_conf.use_short_slot ^= 1;
3233 		/* bss_changed |= BSS_CHANGED_??? */
3234 	}
3235 	if ((ni->ni_flags & IEEE80211_NODE_QOS) !=
3236 	    vif->bss_conf.qos) {
3237 		vif->bss_conf.qos ^= 1;
3238 		bss_changed |= BSS_CHANGED_QOS;
3239 	}
3240 
3241 	bss_changed |= lkpi_update_dtim_tsf(vif, ni, vap, __func__, __LINE__);
3242 	lkpi_bss_info_change(hw, vif, bss_changed);
3243 
3244 	/* - change_chanctx (if needed)
3245 	 * - event_callback
3246 	 */
3247 
3248 	/* End mgd_complete_tx. (we do not have to check ostate == IEEE80211_S_ASSOC). */
3249 	if (lsta->in_mgd) {
3250 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3251 		prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3252 		prep_tx_info.success = true;	/* Needs vif->cfg.assoc set! */
3253 		prep_tx_info.link_id = 0;
3254 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3255 		lsta->in_mgd = false;
3256 	}
3257 
3258 	/*
3259 	 * And then:
3260 	 * - (more packets)?
3261 	 * - set_key
3262 	 * - set_default_unicast_key
3263 	 * - set_key (?)
3264 	 * - ipv6_addr_change (?)
3265 	 */
3266 
3267 	if (!ieee80211_node_is_authorized(ni)) {
3268 		IMPROVE("net80211 does not consider node authorized");
3269 	}
3270 
3271 	bss_changed = 0;
3272 	IMPROVE("Is this the right spot, has net80211 done all updates already?");
3273 
3274 	/* Update thresholds. */
3275 	hw->wiphy->frag_threshold = vap->iv_fragthreshold;
3276 	lkpi_80211_mo_set_frag_threshold(hw, vap->iv_fragthreshold);
3277 	hw->wiphy->rts_threshold = vap->iv_rtsthreshold;
3278 	lkpi_80211_mo_set_rts_threshold(hw, vap->iv_rtsthreshold);
3279 
3280 	/* Update sta_state (ASSOC to AUTHORIZED). */
3281 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3282 	KASSERT(lsta->state == IEEE80211_STA_ASSOC, ("%s: lsta %p state not "
3283 	    "ASSOC: %#x\n", __func__, lsta, lsta->state));
3284 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_AUTHORIZED);
3285 	if (error != 0) {
3286 		IMPROVE("undo some changes?");
3287 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(AUTHORIZED) "
3288 		    "failed: %d\n", __func__, __LINE__, error);
3289 		goto out;
3290 	}
3291 
3292 	/* - drv_config (?)
3293 	 * - bss_info_changed
3294 	 * - set_rekey_data (?)
3295 	 *
3296 	 * And now we should be passing packets.
3297 	 */
3298 	IMPROVE("Need that bssid setting, and the keys");
3299 
3300 	bss_changed |= lkpi_update_dtim_tsf(vif, ni, vap, __func__, __LINE__);
3301 	lkpi_bss_info_change(hw, vif, bss_changed);
3302 
3303 	/* Prepare_multicast && configure_filter. */
3304 	lkpi_update_mcast_filter_locked(vap->iv_ic);
3305 
3306 out:
3307 	wiphy_unlock(hw->wiphy);
3308 	IEEE80211_LOCK(vap->iv_ic);
3309 	return (error);
3310 }
3311 
3312 /*
3313  * DOWN1
3314  * "to assoc" means we are going back to State 2 from State 4[/3].
3315  * This means ni still is authenticated, so we keep sta, chanctx, ..
3316  * We will send a (Re)Assoc Request in case net80211 handles roadming.
3317  * Note: this can be called as part of a DEAUTH going to State 1 as well,
3318  * so for RoC prep_tx_info we need to check nstate (see run_to_{auth,scan,init}).
3319  */
3320 static int
3321 lkpi_sta_run_to_assoc(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3322 {
3323 	struct lkpi_hw *lhw;
3324 	struct ieee80211_hw *hw;
3325 	struct lkpi_vif *lvif;
3326 	struct ieee80211_vif *vif;
3327 	struct ieee80211_node *ni;
3328 	struct lkpi_sta *lsta;
3329 	struct ieee80211_sta *sta;
3330 	struct ieee80211_prep_tx_info prep_tx_info;
3331 #if 0
3332 	enum ieee80211_bss_changed bss_changed;
3333 #endif
3334 	struct ieee80211_rx_ampdu *rap;
3335 	int error;
3336 
3337 	lhw = vap->iv_ic->ic_softc;
3338 	hw = LHW_TO_HW(lhw);
3339 	lvif = VAP_TO_LVIF(vap);
3340 	vif = LVIF_TO_VIF(lvif);
3341 
3342 	IEEE80211_UNLOCK(vap->iv_ic);
3343 	wiphy_lock(hw->wiphy);
3344 
3345 	LKPI_80211_LVIF_LOCK(lvif);
3346 #ifdef LINUXKPI_DEBUG_80211
3347 	/* XXX-BZ KASSERT later; state going down so no action. */
3348 	if (lvif->lvif_bss == NULL)
3349 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3350 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3351 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3352 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3353 		    lvif->lvif_bss_synched);
3354 #endif
3355 	lsta = lvif->lvif_bss;
3356 	LKPI_80211_LVIF_UNLOCK(lvif);
3357 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
3358 	    "lvif %p vap %p\n", __func__,
3359 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
3360 
3361 	ni = lsta->ni;		/* Reference held for lvif_bss. */
3362 	sta = LSTA_TO_STA(lsta);
3363 
3364 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3365 
3366 	/* flush, drop. */
3367 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), true);
3368 
3369 	/* We should make this a KASSERT. */
3370 	if (lsta->in_mgd) {
3371 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p lsta %p in_mgd\n",
3372 		    __func__, __LINE__, lvif, vap, lsta);
3373 	}
3374 	/*
3375 	 * Problem is that we should hook into the tx/rx flow and not
3376 	 * try to re-model the state machine parts.  We may miss a SME
3377 	 * triggered frame this way.
3378 	 */
3379 	memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3380 	if (nstate == IEEE80211_S_ASSOC) {
3381 		if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
3382 			if (arg)
3383 				prep_tx_info.subtype = IEEE80211_STYPE_REASSOC_REQ;
3384 			else
3385 				prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3386 		} else {
3387 			/* wpa_supplicant upon RTM_IEEE80211_LEAVE. */
3388 			prep_tx_info.subtype = IEEE80211_STYPE_DISASSOC;
3389 		}
3390 	} else
3391 		prep_tx_info.subtype = IEEE80211_STYPE_DEAUTH;
3392 	prep_tx_info.was_assoc = true;
3393 	prep_tx_info.link_id = 0;
3394 	lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
3395 	lsta->in_mgd = true;
3396 
3397 	wiphy_unlock(hw->wiphy);
3398 	IEEE80211_LOCK(vap->iv_ic);
3399 
3400 	/* Call iv_newstate first so we get potential (RE-)ASSOC/DEAUTH? packet out. */
3401 	error = lvif->iv_newstate(vap, nstate, arg);
3402 	if (error != 0) {
3403 		ic_printf(vap->iv_ic, "%s:%d: iv_newstate(%p, %d, %d) "
3404 		    "failed: %d\n", __func__, __LINE__, vap, nstate, arg, error);
3405 		goto outni;
3406 	}
3407 
3408 	/* Stop any BA sessions if still active. */
3409 	for (int rapn = 0; rapn < WME_NUM_TID; rapn++) {
3410 		rap = &ni->ni_rx_ampdu[rapn];
3411 
3412 		if ((rap->rxa_flags & IEEE80211_AGGR_RUNNING) == 0)
3413 			continue;
3414 
3415 		vap->iv_ic->ic_ampdu_rx_stop(ni, rap);
3416 	}
3417 
3418 	IEEE80211_UNLOCK(vap->iv_ic);
3419 
3420 	/* Ensure the packets get out. */
3421 	lkpi_80211_flush_tx(lhw, lsta);
3422 
3423 	wiphy_lock(hw->wiphy);
3424 
3425 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3426 
3427 	/* Wake tx queues to get packet(s) out. */
3428 	lkpi_wake_tx_queues(hw, sta, false, true);
3429 
3430 	/* flush, no drop */
3431 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), false);
3432 
3433 	/* End mgd_complete_tx. */
3434 	/* We should make this a KASSERT. */
3435 	if (!lsta->in_mgd) {
3436 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p lsta %p !in_mgd\n",
3437 		    __func__, __LINE__, lvif, vap, lsta);
3438 	}
3439 	lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3440 	lsta->in_mgd = false;
3441 
3442 #if 0
3443 	/* sync_rx_queues */
3444 	lkpi_80211_mo_sync_rx_queues(hw);
3445 
3446 	/* sta_pre_rcu_remove */
3447 	lkpi_80211_mo_sta_pre_rcu_remove(hw, vif, sta);
3448 #endif
3449 
3450 	/* Take the station down. */
3451 
3452 	/* Adjust sta and change state (from AUTHORIZED) to ASSOC. */
3453 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3454 	KASSERT(lsta->state == IEEE80211_STA_AUTHORIZED, ("%s: lsta %p state not "
3455 	    "AUTHORIZED: %#x\n", __func__, lsta, lsta->state));
3456 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_ASSOC);
3457 	if (error != 0) {
3458 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(ASSOC) "
3459 		    "failed: %d\n", __func__, __LINE__, error);
3460 		goto out;
3461 	}
3462 
3463 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3464 
3465 #ifdef LKPI_80211_HW_CRYPTO
3466 	if (lkpi_hwcrypto) {
3467 		error = lkpi_sta_del_keys(hw, vif, lsta);
3468 		if (error != 0) {
3469 			ic_printf(vap->iv_ic, "%s:%d: lkpi_sta_del_keys "
3470 			    "failed: %d\n", __func__, __LINE__, error);
3471 			/*
3472 			 * Either drv/fw will crash or cleanup itself,
3473 			 * otherwise net80211 will delete the keys (at a
3474 			 * less appropriate time).
3475 			 */
3476 			/* goto out; */
3477 		}
3478 	}
3479 #endif
3480 
3481 	/* Update sta_state (ASSOC to AUTH). */
3482 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3483 	KASSERT(lsta->state == IEEE80211_STA_ASSOC, ("%s: lsta %p state not "
3484 	    "ASSOC: %#x\n", __func__, lsta, lsta->state));
3485 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_AUTH);
3486 	if (error != 0) {
3487 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(AUTH) "
3488 		    "failed: %d\n", __func__, __LINE__, error);
3489 		goto out;
3490 	}
3491 
3492 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3493 
3494 #if 0
3495 	/* Update bss info (bss_info_changed) (assoc, aid, ..). */
3496 	/* See comment in DOWN4. */
3497 	lkpi_disassoc(sta, vif, lhw);
3498 #endif
3499 
3500 	error = EALREADY;
3501 out:
3502 	wiphy_unlock(hw->wiphy);
3503 	IEEE80211_LOCK(vap->iv_ic);
3504 outni:
3505 	return (error);
3506 }
3507 
3508 /*
3509  * DOWN2
3510  * We are in state 2 and go back to state 1 and will try to auth again
3511  * (to IEEE80211_S_AUTH in FreeBSD means "try to auth").  This should be
3512  * like scan_to_auth but that we keep the "ni" and with that chanctx/bssid,
3513  * which essentially makes this "a_to_a" in LinuxKPI.
3514  */
3515 static int
3516 lkpi_sta_assoc_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3517 {
3518 	struct lkpi_hw *lhw;
3519 	struct ieee80211_hw *hw;
3520 	struct lkpi_vif *lvif;
3521 	struct ieee80211_vif *vif;
3522 	struct ieee80211_node *ni;
3523 	struct lkpi_sta *lsta;
3524 	struct ieee80211_prep_tx_info prep_tx_info;
3525 	int error;
3526 
3527 	lhw = vap->iv_ic->ic_softc;
3528 	hw = LHW_TO_HW(lhw);
3529 	lvif = VAP_TO_LVIF(vap);
3530 	vif = LVIF_TO_VIF(lvif);
3531 
3532 	IEEE80211_UNLOCK(vap->iv_ic);
3533 	wiphy_lock(hw->wiphy);
3534 
3535 	LKPI_80211_LVIF_LOCK(lvif);
3536 #ifdef LINUXKPI_DEBUG_80211
3537 	/* XXX-BZ KASSERT later; state going down so no action. */
3538 	if (lvif->lvif_bss == NULL)
3539 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3540 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3541 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3542 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3543 		    lvif->lvif_bss_synched);
3544 #endif
3545 	lsta = lvif->lvif_bss;
3546 	LKPI_80211_LVIF_UNLOCK(lvif);
3547 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
3548 	    "lvif %p vap %p\n", __func__,
3549 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
3550 
3551 	ni = lsta->ni;		/* Reference held for lvif_bss. */
3552 
3553 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3554 
3555 	/* End mgd_complete_tx. */
3556 	if (lsta->in_mgd && vap->iv_state == IEEE80211_S_ASSOC) {
3557 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3558 		prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3559 		prep_tx_info.link_id = 0;
3560 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3561 		lsta->in_mgd = false;
3562 	} else if (lsta->in_mgd) {
3563 		ic_printf(vap->iv_ic, "%s:%d: in_mgd %d (%s) -> %d (%s) %d\n",
3564 		    __func__, __LINE__,
3565 		    vap->iv_state, ieee80211_state_name[vap->iv_state],
3566 		    nstate, ieee80211_state_name[nstate], arg);
3567 	}
3568 
3569 	/* Take the station down. */
3570 	/* Update sta_state (AUTH to NONE). */
3571 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3572 	KASSERT(lsta->state == IEEE80211_STA_AUTH, ("%s: lsta %p state not "
3573 	    "AUTH: %#x\n", __func__, lsta, lsta->state));
3574 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NONE);
3575 	if (error != 0) {
3576 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NONE) "
3577 		    "failed: %d\n", __func__, __LINE__, error);
3578 		goto out;
3579 	}
3580 
3581 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3582 
3583 out:
3584 	wiphy_unlock(hw->wiphy);
3585 	IEEE80211_LOCK(vap->iv_ic);
3586 	return (error);
3587 }
3588 
3589 /*
3590  * DOWN3
3591  * We are in state 1.  Either auth timed out (arg != 0) or we have an internal
3592  * state change forcing us to give up trying to authenticate.
3593  * Cleanup and remove chanctx, sta, ...
3594  */
3595 static int
3596 lkpi_sta_auth_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3597 {
3598 	struct lkpi_hw *lhw;
3599 	struct ieee80211_hw *hw;
3600 	struct lkpi_vif *lvif;
3601 	struct ieee80211_vif *vif;
3602 	struct ieee80211_node *ni;
3603 	struct lkpi_sta *lsta;
3604 	struct ieee80211_sta *sta;
3605 	struct ieee80211_prep_tx_info prep_tx_info;
3606 	enum ieee80211_bss_changed bss_changed;
3607 	int error;
3608 
3609 	lhw = vap->iv_ic->ic_softc;
3610 	hw = LHW_TO_HW(lhw);
3611 	lvif = VAP_TO_LVIF(vap);
3612 	vif = LVIF_TO_VIF(lvif);
3613 
3614 	IEEE80211_UNLOCK(vap->iv_ic);
3615 	wiphy_lock(hw->wiphy);
3616 
3617 	LKPI_80211_LVIF_LOCK(lvif);
3618 	/*
3619 	 * XXX-BZ KASSERT later; state going down so no action in theory
3620 	 * but try to avoid a NULL-pointer derref for now and gracefully
3621 	 * fail for non-debug kernels.
3622 	 */
3623 	if (lvif->lvif_bss == NULL) {
3624 		ic_printf(vap->iv_ic, "%s:%d: ERROR: lvif %p vap %p iv_bss %p "
3625 		    "lvif_bss %p lvif_bss->ni %p synched %d; "
3626 		    "expect follow-up problems\n", __func__, __LINE__,
3627 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3628 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3629 		    lvif->lvif_bss_synched);
3630 		LKPI_80211_LVIF_UNLOCK(lvif);
3631 		/*
3632 		 * This will likely lead to a firmware crash (if there
3633 		 * was not one before already) and need a
3634 		 * ieee80211_restart_hw() but still better than a panic
3635 		 * for users as they can at least recover.
3636 		 */
3637 		error = ENOTRECOVERABLE;
3638 		goto out;
3639 	}
3640 	lsta = lvif->lvif_bss;
3641 	LKPI_80211_LVIF_UNLOCK(lvif);
3642 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
3643 	    "lvif %p vap %p\n", __func__,
3644 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
3645 	ni = lsta->ni;			/* Reference held for lvif_bss. */
3646 	sta = LSTA_TO_STA(lsta);
3647 
3648 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3649 
3650 	/* flush, drop. */
3651 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), true);
3652 
3653 	/* Wake tx queues to get packet(s) out. */
3654 	lkpi_wake_tx_queues(hw, sta, false, true);
3655 
3656 	/* flush, no drop */
3657 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), false);
3658 
3659 	/* End mgd_complete_tx. */
3660 	if (lsta->in_mgd) {
3661 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3662 		prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
3663 		prep_tx_info.link_id = 0;
3664 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3665 		lsta->in_mgd = false;
3666 	}
3667 
3668 	/* sync_rx_queues */
3669 	lkpi_80211_mo_sync_rx_queues(hw);
3670 
3671 #ifdef LKPI_80211_HW_CRYPTO
3672 	if (lkpi_hwcrypto) {
3673 		error = lkpi_sta_del_keys(hw, vif, lsta);
3674 		if (error != 0) {
3675 			ic_printf(vap->iv_ic, "%s:%d: lkpi_sta_del_keys "
3676 			    "failed: %d\n", __func__, __LINE__, error);
3677 			/*
3678 			 * Either drv/fw will crash or cleanup itself,
3679 			 * otherwise net80211 will delete the keys (at a
3680 			 * less appropriate time).
3681 			 */
3682 			/* goto out; */
3683 		}
3684 	}
3685 #endif
3686 
3687 	/* sta_pre_rcu_remove */
3688         lkpi_80211_mo_sta_pre_rcu_remove(hw, vif, sta);
3689 
3690 	synchronize_net();
3691 
3692 	/* Take the station down. */
3693 
3694 	bss_changed = 0;
3695 	/*
3696 	 * Start updating bss info (*bss_info_changed) (assoc, aid, ..).
3697 	 *
3698 	 * One would expect this to happen when going off AUTHORIZED but
3699 	 * not so.
3700 	 *
3701 	 * Immediately issuing the (*bss_info_changed) used to also remove the
3702 	 * sta from firmware for iwlwifi; or we have problems with the sta
3703 	 * silently not being removed and then crash upon the next sta add.
3704 	 * Neither seems to be the case or a problem still.
3705 	 *
3706 	 * Contrary for BE200 (iwlwifi/mld) if we do not issue the
3707 	 * (*vif_cfg_change) to tell FW that we are no longer assoc
3708 	 * it will crash now upon sta rm.  So the order now is as we once
3709 	 * expected it:
3710 	 *
3711 	 * 1) lkpi_disassoc(): set vif->cfg.assoc = false and .aid=0
3712 	 * 2) add the remaining BSS_CHANGED changes and call (*bss_info_changed)
3713 	 *    (which may be split up into (*vif_cfg_change) and
3714 	 *    (*link_info_changed) for more modern drivers).
3715 	 * 3) call the last sta_state update -> IEEE80211_STA_NOTEXIST
3716 	 *    (removes the sta given assoc is false) and tidy up our lists.
3717 	 * 4) call unassign_vif_chanctx
3718 	 * 5) call lkpi_hw_conf_idle
3719 	 * 6) call remove_chanctx
3720 	 *
3721 	 * Note: vif->driver_flags & IEEE80211_VIF_REMOVE_AP_AFTER_DISASSOC
3722 	 * might change this.
3723 	 */
3724 	bss_changed |= lkpi_disassoc(sta, vif, lhw);
3725 
3726 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3727 
3728 	IMPROVE("Any bss_info changes to announce?");
3729 	vif->bss_conf.qos = false;
3730 	bss_changed |= BSS_CHANGED_QOS;
3731 	vif->cfg.ssid_len = 0;
3732 	memset(vif->cfg.ssid, '\0', sizeof(vif->cfg.ssid));
3733 	IEEE80211_ADDR_COPY(vif->cfg.ap_addr, ieee80211broadcastaddr);
3734 	bss_changed |= BSS_CHANGED_BSSID;
3735 	vif->bss_conf.use_short_preamble = false;
3736 	/* XXX BSS_CHANGED_???? */
3737 	vif->bss_conf.dtim_period = 0; /* go back to 0. */
3738 	bss_changed |= BSS_CHANGED_BEACON_INFO;
3739 	lkpi_bss_info_change(hw, vif, bss_changed);
3740 
3741 	/* Adjust sta and change state (from NONE) to NOTEXIST. */
3742 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3743 	KASSERT(lsta->state == IEEE80211_STA_NONE, ("%s: lsta %p state not "
3744 	    "NONE: %#x, nstate %d arg %d\n", __func__, lsta, lsta->state, nstate, arg));
3745 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NOTEXIST);
3746 	if (error != 0) {
3747 		IMPROVE("do we need to undo the chan ctx?");
3748 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NOTEXIST) "
3749 		    "failed: %d\n", __func__, __LINE__, error);
3750 		goto out;
3751 	}
3752 
3753 	lkpi_lsta_remove(lsta, lvif);
3754 
3755 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3756 
3757 	LKPI_80211_LVIF_LOCK(lvif);
3758 	/* Remove ni reference for this cache of lsta. */
3759 	lvif->lvif_bss = NULL;
3760 	lvif->lvif_bss_synched = false;
3761 	LKPI_80211_LVIF_UNLOCK(lvif);
3762 
3763 	/* conf_tx */
3764 
3765 	lkpi_remove_chanctx(hw, vif);
3766 
3767 out:
3768 	wiphy_unlock(hw->wiphy);
3769 	IEEE80211_LOCK(vap->iv_ic);
3770 	if (error == 0) {
3771 		/*
3772 		 * We do this outside the wiphy lock as net80211::node_free() may call
3773 		 * into crypto code to delete keys and we have a recursed on
3774 		 * non-recursive sx panic.  Also only do this if we get here w/o error.
3775 		 *
3776 		 * The very last release the reference on the ni for the ni/lsta on
3777 		 * lvif->lvif_bss.  Upon return from this both ni and lsta are invalid
3778 		 * and potentially freed.
3779 		 */
3780 		ieee80211_free_node(ni);
3781 	}
3782 	return (error);
3783 }
3784 
3785 /* DOWN4 */
3786 static int
3787 lkpi_sta_scan_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3788 {
3789 	/* lkpi_iv_newstate() handles the stop scan case in common code. */
3790 	return (lkpi_sta_state_do_nada(vap, nstate, arg));
3791 }
3792 
3793 /* ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ */
3794 
3795 static int
3796 lkpi_sta_auth_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3797 {
3798 	int error;
3799 
3800 	error = lkpi_sta_auth_to_scan(vap, nstate, arg);
3801 	if (error == 0)
3802 		error = lkpi_sta_scan_to_init(vap, nstate, arg);
3803 	return (error);
3804 }
3805 
3806 /* auth_to_auth, assoc_to_assoc. */
3807 static int
3808 lkpi_sta_a_to_a(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3809 {
3810 	struct lkpi_hw *lhw;
3811 	struct ieee80211_hw *hw;
3812 	struct lkpi_vif *lvif;
3813 	struct ieee80211_vif *vif;
3814 	struct lkpi_sta *lsta;
3815 	struct ieee80211_prep_tx_info prep_tx_info;
3816 	int error;
3817 
3818 	lhw = vap->iv_ic->ic_softc;
3819 	hw = LHW_TO_HW(lhw);
3820 	lvif = VAP_TO_LVIF(vap);
3821 	vif = LVIF_TO_VIF(lvif);
3822 
3823 	IEEE80211_UNLOCK(vap->iv_ic);
3824 	wiphy_lock(hw->wiphy);
3825 
3826 	LKPI_80211_LVIF_LOCK(lvif);
3827 	/* XXX-BZ KASSERT later? */
3828 	if (!lvif->lvif_bss_synched || lvif->lvif_bss == NULL) {
3829 #ifdef LINUXKPI_DEBUG_80211
3830 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3831 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3832 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3833 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3834 		    lvif->lvif_bss_synched);
3835 #endif
3836 		LKPI_80211_LVIF_UNLOCK(lvif);
3837 		error = ENOTRECOVERABLE;
3838 		goto out;
3839 	}
3840 	lsta = lvif->lvif_bss;
3841 	LKPI_80211_LVIF_UNLOCK(lvif);
3842 
3843 	KASSERT(lsta != NULL, ("%s: lsta %p! lvif %p vap %p\n", __func__,
3844 	    lsta, lvif, vap));
3845 
3846 	IMPROVE("event callback?");
3847 
3848 	/* End mgd_complete_tx. */
3849 	if (lsta->in_mgd) {
3850 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3851 		if (vap->iv_state == IEEE80211_S_AUTH)
3852 			prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
3853 		else
3854 			prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3855 		prep_tx_info.link_id = 0;
3856 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3857 		lsta->in_mgd = false;
3858 	}
3859 
3860 	/* Now start auth/assoc. */
3861 
3862 	/* Start mgd_prepare_tx. */
3863 	if (!lsta->in_mgd) {
3864 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3865 		if (nstate == IEEE80211_S_AUTH)
3866 			prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
3867 		else
3868 			prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3869 		prep_tx_info.link_id = 0;
3870 		lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
3871 		lsta->in_mgd = true;
3872 	}
3873 
3874 	error = 0;
3875 out:
3876 	wiphy_unlock(hw->wiphy);
3877 	IEEE80211_LOCK(vap->iv_ic);
3878 
3879 	return (error);
3880 }
3881 
3882 static int
3883 lkpi_sta_assoc_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3884 {
3885 	int error;
3886 
3887 	error = lkpi_sta_assoc_to_auth(vap, nstate, arg);
3888 	if (error != 0 && error != EALREADY)
3889 		return (error);
3890 
3891 	error = lkpi_sta_auth_to_scan(vap, nstate, arg);
3892 	return (error);
3893 }
3894 
3895 static int
3896 lkpi_sta_assoc_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3897 {
3898 	int error;
3899 
3900 	error = lkpi_sta_assoc_to_scan(vap, nstate, arg);
3901 	if (error != 0 && error != EALREADY)
3902 		return (error);
3903 
3904 	error = lkpi_sta_scan_to_init(vap, nstate, arg);	/* do_nada */
3905 	return (error);
3906 }
3907 
3908 static int
3909 lkpi_sta_run_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3910 {
3911 	int error;
3912 
3913 	error = lkpi_sta_run_to_assoc(vap, nstate, arg);
3914 	if (error != 0 && error != EALREADY)
3915 		return (error);
3916 
3917 	error = lkpi_sta_assoc_to_init(vap, nstate, arg);
3918 	return (error);
3919 }
3920 
3921 static int
3922 lkpi_sta_run_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3923 {
3924 	int error;
3925 
3926 	error = lkpi_sta_run_to_assoc(vap, nstate, arg);
3927 	if (error != 0 && error != EALREADY)
3928 		return (error);
3929 
3930 	error = lkpi_sta_assoc_to_scan(vap, nstate, arg);
3931 	return (error);
3932 }
3933 
3934 static int
3935 lkpi_sta_run_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3936 {
3937 	int error;
3938 
3939 	error = lkpi_sta_run_to_assoc(vap, nstate, arg);
3940 	if (error != 0 && error != EALREADY)
3941 		return (error);
3942 
3943 	error = lkpi_sta_assoc_to_auth(vap, nstate, arg);
3944 	return (error);
3945 }
3946 
3947 /* -------------------------------------------------------------------------- */
3948 
3949 /*
3950  * The matches the documented state changes in net80211::sta_newstate().
3951  * XXX (1) without CSA and SLEEP yet, * XXX (2) not all unhandled cases
3952  * there are "invalid" (so there is a room for failure here).
3953  */
3954 struct fsm_state {
3955 	/* INIT, SCAN, AUTH, ASSOC, CAC, RUN, CSA, SLEEP */
3956 	enum ieee80211_state ostate;
3957 	enum ieee80211_state nstate;
3958 	int (*handler)(struct ieee80211vap *, enum ieee80211_state, int);
3959 } sta_state_fsm[] = {
3960 	{ IEEE80211_S_INIT,	IEEE80211_S_INIT, lkpi_sta_state_do_nada },
3961 	{ IEEE80211_S_SCAN,	IEEE80211_S_INIT, lkpi_sta_state_do_nada },	/* DOWN4 scan_to_init */
3962 	{ IEEE80211_S_AUTH,	IEEE80211_S_INIT, lkpi_sta_auth_to_init },	/* not explicitly in sta_newstate() */
3963 	{ IEEE80211_S_ASSOC,	IEEE80211_S_INIT, lkpi_sta_assoc_to_init },	/* Send DEAUTH. */
3964 	{ IEEE80211_S_RUN,	IEEE80211_S_INIT, lkpi_sta_run_to_init },	/* Send DISASSOC. */
3965 
3966 	{ IEEE80211_S_INIT,	IEEE80211_S_SCAN, lkpi_sta_init_to_scan },	/* UP1 */
3967 	{ IEEE80211_S_SCAN,	IEEE80211_S_SCAN, lkpi_sta_state_do_nada },
3968 	{ IEEE80211_S_AUTH,	IEEE80211_S_SCAN, lkpi_sta_auth_to_scan },	/* DOWN3 */
3969 	{ IEEE80211_S_ASSOC,	IEEE80211_S_SCAN, lkpi_sta_assoc_to_scan },
3970 	{ IEEE80211_S_RUN,	IEEE80211_S_SCAN, lkpi_sta_run_to_scan },	/* Beacon miss. */
3971 
3972 	{ IEEE80211_S_INIT,	IEEE80211_S_AUTH, lkpi_sta_scan_to_auth },	/* Send AUTH. */
3973 	{ IEEE80211_S_SCAN,	IEEE80211_S_AUTH, lkpi_sta_scan_to_auth },	/* UP2 Send AUTH. */
3974 	{ IEEE80211_S_AUTH,	IEEE80211_S_AUTH, lkpi_sta_a_to_a },		/* Send ?AUTH. */
3975 	{ IEEE80211_S_ASSOC,	IEEE80211_S_AUTH, lkpi_sta_assoc_to_auth },	/* DOWN2 Send ?AUTH. */
3976 	{ IEEE80211_S_RUN,	IEEE80211_S_AUTH, lkpi_sta_run_to_auth },	/* Send ?AUTH. */
3977 
3978 	{ IEEE80211_S_AUTH,	IEEE80211_S_ASSOC, lkpi_sta_auth_to_assoc },	/* UP3.1 Send ASSOCREQ. */
3979 	{ IEEE80211_S_ASSOC,	IEEE80211_S_ASSOC, lkpi_sta_a_to_a },		/* Send ASSOCREQ. */
3980 	{ IEEE80211_S_RUN,	IEEE80211_S_ASSOC, lkpi_sta_run_to_assoc },	/* DOWN1 Send ASSOCREQ/REASSOCREQ. */
3981 
3982 	{ IEEE80211_S_AUTH,	IEEE80211_S_RUN, lkpi_sta_auth_to_run },	/* UP3.2 */
3983 	{ IEEE80211_S_ASSOC,	IEEE80211_S_RUN, lkpi_sta_assoc_to_run },	/* UP4 */
3984 	{ IEEE80211_S_RUN,	IEEE80211_S_RUN, lkpi_sta_state_do_nada },
3985 
3986 	/* Dummy at the end without handler. */
3987 	{ IEEE80211_S_INIT,	IEEE80211_S_INIT, NULL },
3988 };
3989 
3990 static int
3991 lkpi_iv_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3992 {
3993 	struct ieee80211com *ic;
3994 	struct lkpi_hw *lhw;
3995 	struct lkpi_vif *lvif;
3996 	struct ieee80211_vif *vif;
3997 	struct fsm_state *s;
3998 	enum ieee80211_state ostate;
3999 	int error;
4000 
4001 	ic = vap->iv_ic;
4002 	IEEE80211_LOCK_ASSERT(ic);
4003 	ostate = vap->iv_state;
4004 
4005 #ifdef LINUXKPI_DEBUG_80211
4006 	if (linuxkpi_debug_80211 & D80211_TRACE)
4007 		ic_printf(vap->iv_ic, "%s:%d: vap %p nstate %#x arg %#x\n",
4008 		    __func__, __LINE__, vap, nstate, arg);
4009 #endif
4010 
4011 	if (vap->iv_opmode == IEEE80211_M_STA) {
4012 
4013 		lhw = ic->ic_softc;
4014 		lvif = VAP_TO_LVIF(vap);
4015 		vif = LVIF_TO_VIF(lvif);
4016 
4017 		/* No need to replicate this in most state handlers. */
4018 		if (nstate > IEEE80211_S_SCAN)
4019 			lkpi_stop_hw_scan(lhw, vif);
4020 
4021 		s = sta_state_fsm;
4022 
4023 	} else {
4024 		ic_printf(vap->iv_ic, "%s: only station mode currently supported: "
4025 		    "vap %p iv_opmode %d\n", __func__, vap, vap->iv_opmode);
4026 		return (ENOSYS);
4027 	}
4028 
4029 	error = 0;
4030 	for (; s->handler != NULL; s++) {
4031 		if (ostate == s->ostate && nstate == s->nstate) {
4032 #ifdef LINUXKPI_DEBUG_80211
4033 			if (linuxkpi_debug_80211 & D80211_TRACE)
4034 				ic_printf(vap->iv_ic, "%s: new state %d (%s) ->"
4035 				    " %d (%s): arg %d.\n", __func__,
4036 				    ostate, ieee80211_state_name[ostate],
4037 				    nstate, ieee80211_state_name[nstate], arg);
4038 #endif
4039 			error = s->handler(vap, nstate, arg);
4040 			break;
4041 		}
4042 	}
4043 	IEEE80211_LOCK_ASSERT(vap->iv_ic);
4044 
4045 	if (s->handler == NULL) {
4046 		IMPROVE("turn this into a KASSERT\n");
4047 		ic_printf(vap->iv_ic, "%s: unsupported state transition "
4048 		    "%d (%s) -> %d (%s)\n", __func__,
4049 		    ostate, ieee80211_state_name[ostate],
4050 		    nstate, ieee80211_state_name[nstate]);
4051 		return (ENOSYS);
4052 	}
4053 
4054 	if (error == EALREADY) {
4055 #ifdef LINUXKPI_DEBUG_80211
4056 		if (linuxkpi_debug_80211 & D80211_TRACE)
4057 			ic_printf(vap->iv_ic, "%s: state transition %d (%s) -> "
4058 			    "%d (%s): iv_newstate already handled: %d.\n",
4059 			    __func__, ostate, ieee80211_state_name[ostate],
4060 			    nstate, ieee80211_state_name[nstate], error);
4061 #endif
4062 		return (0);
4063 	}
4064 
4065 	if (error != 0) {
4066 		ic_printf(vap->iv_ic, "%s: error %d during state transition "
4067 		    "%d (%s) -> %d (%s)\n", __func__, error,
4068 		    ostate, ieee80211_state_name[ostate],
4069 		    nstate, ieee80211_state_name[nstate]);
4070 		return (error);
4071 	}
4072 
4073 #ifdef LINUXKPI_DEBUG_80211
4074 	if (linuxkpi_debug_80211 & D80211_TRACE)
4075 		ic_printf(vap->iv_ic, "%s:%d: vap %p nstate %#x arg %#x "
4076 		    "calling net80211 parent\n",
4077 		    __func__, __LINE__, vap, nstate, arg);
4078 #endif
4079 
4080 	return (lvif->iv_newstate(vap, nstate, arg));
4081 }
4082 
4083 /* -------------------------------------------------------------------------- */
4084 
4085 /*
4086  * We overload (*iv_update_bss) as otherwise we have cases in, e.g.,
4087  * net80211::ieee80211_sta_join1() where vap->iv_bss gets replaced by a
4088  * new node without us knowing and thus our ni/lsta are out of sync.
4089  */
4090 static struct ieee80211_node *
4091 lkpi_iv_update_bss(struct ieee80211vap *vap, struct ieee80211_node *ni)
4092 {
4093 	struct lkpi_vif *lvif;
4094 	struct ieee80211_node *rni;
4095 
4096 	IEEE80211_LOCK_ASSERT(vap->iv_ic);
4097 
4098 	lvif = VAP_TO_LVIF(vap);
4099 
4100 	LKPI_80211_LVIF_LOCK(lvif);
4101 	lvif->lvif_bss_synched = false;
4102 	LKPI_80211_LVIF_UNLOCK(lvif);
4103 
4104 	rni = lvif->iv_update_bss(vap, ni);
4105 	return (rni);
4106 }
4107 
4108 #ifdef LKPI_80211_WME
4109 static int
4110 lkpi_wme_update(struct lkpi_hw *lhw, struct ieee80211vap *vap, bool planned)
4111 {
4112 	struct ieee80211com *ic;
4113 	struct ieee80211_hw *hw;
4114 	struct lkpi_vif *lvif;
4115 	struct ieee80211_vif *vif;
4116 	struct chanAccParams chp;
4117 	struct wmeParams wmeparr[WME_NUM_AC];
4118 	struct ieee80211_tx_queue_params txqp;
4119 	enum ieee80211_bss_changed bss_changed;
4120 	int error;
4121 	uint16_t ac;
4122 
4123 	hw = LHW_TO_HW(lhw);
4124 	lockdep_assert_wiphy(hw->wiphy);
4125 
4126 	IMPROVE();
4127 	KASSERT(WME_NUM_AC == IEEE80211_NUM_ACS, ("%s: WME_NUM_AC %d != "
4128 	    "IEEE80211_NUM_ACS %d\n", __func__, WME_NUM_AC, IEEE80211_NUM_ACS));
4129 
4130 	if (vap == NULL)
4131 		return (0);
4132 
4133 	if ((vap->iv_flags & IEEE80211_F_WME) == 0)
4134 		return (0);
4135 
4136 	if (lhw->ops->conf_tx == NULL)
4137 		return (0);
4138 
4139 	if (!planned && (vap->iv_state != IEEE80211_S_RUN)) {
4140 		lhw->update_wme = true;
4141 		return (0);
4142 	}
4143 	lhw->update_wme = false;
4144 
4145 	ic = lhw->ic;
4146 	ieee80211_wme_ic_getparams(ic, &chp);
4147 	IEEE80211_LOCK(ic);
4148 	for (ac = 0; ac < WME_NUM_AC; ac++)
4149 		wmeparr[ac] = chp.cap_wmeParams[ac];
4150 	IEEE80211_UNLOCK(ic);
4151 
4152 	lvif = VAP_TO_LVIF(vap);
4153 	vif = LVIF_TO_VIF(lvif);
4154 
4155 	/* Configure tx queues (conf_tx) & send BSS_CHANGED_QOS. */
4156 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
4157 		struct wmeParams *wmep;
4158 
4159 		wmep = &wmeparr[ac];
4160 		bzero(&txqp, sizeof(txqp));
4161 		txqp.cw_min = wmep->wmep_logcwmin;
4162 		txqp.cw_max = wmep->wmep_logcwmax;
4163 		txqp.txop = wmep->wmep_txopLimit;
4164 		txqp.aifs = wmep->wmep_aifsn;
4165 		error = lkpi_80211_mo_conf_tx(hw, vif, /* link_id */0, ac, &txqp);
4166 		if (error != 0)
4167 			ic_printf(ic, "%s: conf_tx ac %u failed %d\n",
4168 			    __func__, ac, error);
4169 	}
4170 	bss_changed = BSS_CHANGED_QOS;
4171 	if (!planned)
4172 		lkpi_bss_info_change(hw, vif, bss_changed);
4173 
4174 	return (bss_changed);
4175 }
4176 #endif
4177 
4178 static int
4179 lkpi_ic_wme_update(struct ieee80211com *ic)
4180 {
4181 #ifdef LKPI_80211_WME
4182 	struct ieee80211vap *vap;
4183 	struct lkpi_hw *lhw;
4184 	struct ieee80211_hw *hw;
4185 
4186 	IMPROVE("Use the per-VAP callback in net80211.");
4187 	vap = TAILQ_FIRST(&ic->ic_vaps);
4188 	if (vap == NULL)
4189 		return (0);
4190 
4191 	lhw = ic->ic_softc;
4192 	hw = LHW_TO_HW(lhw);
4193 
4194 	wiphy_lock(hw->wiphy);
4195 	lkpi_wme_update(lhw, vap, false);
4196 	wiphy_unlock(hw->wiphy);
4197 #endif
4198 	return (0);	/* unused */
4199 }
4200 
4201 static void
4202 lkpi_iv_sta_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
4203     int subtype, const struct ieee80211_rx_stats *rxs, int rssi, int nf)
4204 {
4205 	struct lkpi_hw *lhw;
4206 	struct ieee80211_hw *hw;
4207 	struct lkpi_vif *lvif;
4208 	struct ieee80211_vif *vif;
4209 	enum ieee80211_bss_changed bss_changed;
4210 
4211 	lvif = VAP_TO_LVIF(ni->ni_vap);
4212 	vif = LVIF_TO_VIF(lvif);
4213 
4214 	lvif->iv_recv_mgmt(ni, m0, subtype, rxs, rssi, nf);
4215 
4216 	switch (subtype) {
4217 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
4218 		break;
4219 	case IEEE80211_FC0_SUBTYPE_BEACON:
4220 		/*
4221 		 * Only count beacons when assoc. SCAN has its own logging.
4222 		 * This is for connection/beacon loss/session protection almost
4223 		 * over debugging when trying to get into a stable RUN state.
4224 		 */
4225 		if (vif->cfg.assoc)
4226 			lvif->beacons++;
4227 		break;
4228 	default:
4229 		return;
4230 	}
4231 
4232 	lhw = ni->ni_ic->ic_softc;
4233 	hw = LHW_TO_HW(lhw);
4234 
4235 	/*
4236 	 * If this direct call to mo_bss_info_changed will not work due to
4237 	 * locking, see if queue_work() is fast enough.
4238 	 */
4239 	bss_changed = lkpi_update_dtim_tsf(vif, ni, ni->ni_vap, __func__, __LINE__);
4240 	lkpi_bss_info_change(hw, vif, bss_changed);
4241 }
4242 
4243 /*
4244  * Change link-layer address on the vif (if the vap is not started/"UP").
4245  * This can happen if a user changes 'ether' using ifconfig.
4246  * The code is based on net80211/ieee80211_freebsd.c::wlan_iflladdr() but
4247  * we do use a per-[l]vif event handler to be sure we exist as we
4248  * cannot assume that from every vap derives a vif and we have a hard
4249  * time checking based on net80211 information.
4250  * Should this ever become a real problem we could add a callback function
4251  * to wlan_iflladdr() to be set optionally but that would be for a
4252  * single-consumer (or needs a list) -- was just too complicated for an
4253  * otherwise perfect mechanism FreeBSD already provides.
4254  */
4255 static void
4256 lkpi_vif_iflladdr(void *arg, struct ifnet *ifp)
4257 {
4258 	struct epoch_tracker et;
4259 	struct ieee80211_vif *vif;
4260 
4261 	NET_EPOCH_ENTER(et);
4262 	/* NB: identify vap's by if_transmit; left as an extra check. */
4263 	if (if_gettransmitfn(ifp) != ieee80211_vap_transmit ||
4264 	    (if_getflags(ifp) & IFF_UP) != 0) {
4265 		NET_EPOCH_EXIT(et);
4266 		return;
4267 	}
4268 
4269 	vif = arg;
4270 	IEEE80211_ADDR_COPY(vif->bss_conf.addr, if_getlladdr(ifp));
4271 	NET_EPOCH_EXIT(et);
4272 }
4273 
4274 static struct ieee80211vap *
4275 lkpi_ic_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ],
4276     int unit, enum ieee80211_opmode opmode, int flags,
4277     const uint8_t bssid[IEEE80211_ADDR_LEN],
4278     const uint8_t mac[IEEE80211_ADDR_LEN])
4279 {
4280 	struct lkpi_hw *lhw;
4281 	struct ieee80211_hw *hw;
4282 	struct lkpi_vif *lvif;
4283 	struct ieee80211vap *vap;
4284 	struct ieee80211_vif *vif;
4285 	struct ieee80211_tx_queue_params txqp;
4286 	enum ieee80211_bss_changed bss_changed;
4287 	enum nl80211_band band;
4288 	struct sysctl_oid *node;
4289 	size_t len;
4290 	int error, i;
4291 	uint16_t ac;
4292 
4293 	if (!TAILQ_EMPTY(&ic->ic_vaps))	/* 1 so far. Add <n> once this works. */
4294 		return (NULL);
4295 
4296 	lhw = ic->ic_softc;
4297 	hw = LHW_TO_HW(lhw);
4298 
4299 	len = sizeof(*lvif);
4300 	len += hw->vif_data_size;	/* vif->drv_priv */
4301 
4302 	lvif = malloc(len, M_80211_VAP, M_WAITOK | M_ZERO);
4303 	mtx_init(&lvif->mtx, "lvif", NULL, MTX_DEF);
4304 	TASK_INIT(&lvif->sw_scan_task, 0, lkpi_sw_scan_task, lvif);
4305 	INIT_LIST_HEAD(&lvif->lsta_list);
4306 	lvif->lvif_bss = NULL;
4307 	refcount_init(&lvif->nt_unlocked, 0);
4308 	lvif->lvif_bss_synched = false;
4309 	vap = LVIF_TO_VAP(lvif);
4310 	vif = LVIF_TO_VIF(lvif);
4311 
4312 	/*
4313 	 * Setup legacy br_mask here.  We will call (*set_bitrate_mask)
4314 	 * elsewhere to announce it to the driver but it is a static
4315 	 * setup.
4316 	 * Also setup basic_rates with just the mandatory rates for the
4317 	 * current band (if avail).
4318 	 */
4319 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
4320 		struct ieee80211_supported_band *supband;
4321 		uint32_t rate_mandatory;;
4322 
4323 		supband = hw->wiphy->bands[band];
4324 		if (supband == NULL || supband->n_bitrates == 0)
4325 			continue;
4326 
4327 		/* Per-band legacy br_mask. */
4328 		lvif->br_mask.control[band].legacy = (1 << supband->n_bitrates) - 1;
4329 
4330 		/* basic_rates for the current band. */
4331 		if (hw->conf.chandef.chan == NULL ||
4332 		    hw->conf.chandef.chan->band != band)
4333 			continue;
4334 
4335 		switch (band) {
4336 		case NL80211_BAND_2GHZ:
4337 			/* We have to assume 11g support here. */
4338 			rate_mandatory = IEEE80211_RATE_MANDATORY_G |
4339 			    IEEE80211_RATE_MANDATORY_B;
4340 			break;
4341 		case NL80211_BAND_5GHZ:
4342 			rate_mandatory = IEEE80211_RATE_MANDATORY_A;
4343 			break;
4344 		default:
4345 			continue;
4346 		}
4347 
4348 		for (i = 0; i < supband->n_bitrates; i++) {
4349 			if ((supband->bitrates[i].flags & rate_mandatory) != 0)
4350 				vif->bss_conf.basic_rates |= BIT(i);
4351 		}
4352 	}
4353 
4354 	memcpy(vif->addr, mac, IEEE80211_ADDR_LEN);
4355 	vif->p2p = false;
4356 	vif->probe_req_reg = false;
4357 	vif->type = lkpi_opmode_to_vif_type(opmode);
4358 	lvif->wdev.iftype = vif->type;
4359 	/* Need to fill in other fields as well. */
4360 	IMPROVE();
4361 
4362 	/* Create a chanctx to be used later. */
4363 	IMPROVE("lkpi_alloc_lchanctx reserved as many as can be");
4364 	(void) lkpi_find_lchanctx_reserved(hw, lvif);
4365 
4366 	/* XXX-BZ hardcoded for now! */
4367 #if 1
4368 	RCU_INIT_POINTER(vif->bss_conf.chanctx_conf, NULL);
4369 	vif->bss_conf.vif = vif;
4370 	/* vap->iv_myaddr is not set until net80211::vap_setup or vap_attach. */
4371 	IEEE80211_ADDR_COPY(vif->bss_conf.addr, mac);
4372 	lvif->lvif_ifllevent = EVENTHANDLER_REGISTER(iflladdr_event,
4373 	    lkpi_vif_iflladdr, vif, EVENTHANDLER_PRI_ANY);
4374 	vif->bss_conf.link_id = 0;	/* Non-MLO operation. */
4375 	vif->bss_conf.chanreq.oper.chan = lhw->dflt_chandef.chan;
4376 	vif->bss_conf.chanreq.oper.width = NL80211_CHAN_WIDTH_20_NOHT;
4377 	vif->bss_conf.use_short_preamble = false;	/* vap->iv_flags IEEE80211_F_SHPREAMBLE */
4378 	vif->bss_conf.use_short_slot = false;		/* vap->iv_flags IEEE80211_F_SHSLOT */
4379 	vif->bss_conf.qos = false;
4380 	vif->bss_conf.use_cts_prot = false;		/* vap->iv_protmode */
4381 	vif->bss_conf.ht_operation_mode = IEEE80211_HT_OP_MODE_PROTECTION_NONE;
4382 	IEEE80211_ADDR_COPY(vif->cfg.ap_addr, ieee80211broadcastaddr);
4383 	vif->cfg.aid = 0;
4384 	vif->cfg.assoc = false;
4385 	vif->cfg.idle = true;
4386 	vif->cfg.ps = false;
4387 	IMPROVE("Check other fields and then figure out whats is left elsewhere of them");
4388 	/*
4389 	 * We need to initialize it to something as the bss_info_changed call
4390 	 * will try to copy from it in iwlwifi and NULL is a panic.
4391 	 * We will set the proper one in scan_to_auth() before being assoc.
4392 	 */
4393 	vif->bss_conf.bssid = ieee80211broadcastaddr;
4394 #endif
4395 #if 0
4396 	vif->bss_conf.dtim_period = 0; /* IEEE80211_DTIM_DEFAULT ; must stay 0. */
4397 	IEEE80211_ADDR_COPY(vif->bss_conf.bssid, bssid);
4398 	vif->bss_conf.beacon_int = ic->ic_bintval;
4399 	/* iwlwifi bug. */
4400 	if (vif->bss_conf.beacon_int < 16)
4401 		vif->bss_conf.beacon_int = 16;
4402 #endif
4403 
4404 	/* Link Config */
4405 	vif->link_conf[0] = &vif->bss_conf;
4406 	for (i = 0; i < nitems(vif->link_conf); i++) {
4407 		IMPROVE("more than 1 link one day");
4408 	}
4409 
4410 	/* Setup queue defaults; driver may override in (*add_interface). */
4411 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
4412 		if (ieee80211_hw_check(hw, QUEUE_CONTROL))
4413 			vif->hw_queue[i] = IEEE80211_INVAL_HW_QUEUE;
4414 		else if (hw->queues >= IEEE80211_NUM_ACS)
4415 			vif->hw_queue[i] = i;
4416 		else
4417 			vif->hw_queue[i] = 0;
4418 
4419 		/* Initialize the queue to running. Stopped? */
4420 		lvif->hw_queue_stopped[i] = false;
4421 	}
4422 	vif->cab_queue = IEEE80211_INVAL_HW_QUEUE;
4423 
4424 	IMPROVE();
4425 
4426 	wiphy_lock(hw->wiphy);
4427 	error = lkpi_80211_mo_start(hw);
4428 	if (error != 0) {
4429 		wiphy_unlock(hw->wiphy);
4430 		ic_printf(ic, "%s: failed to start hw: %d\n", __func__, error);
4431 		mtx_destroy(&lvif->mtx);
4432 		free(lvif, M_80211_VAP);
4433 		return (NULL);
4434 	}
4435 
4436 	error = lkpi_80211_mo_add_interface(hw, vif);
4437 	if (error != 0) {
4438 		IMPROVE();	/* XXX-BZ mo_stop()? */
4439 		wiphy_unlock(hw->wiphy);
4440 		ic_printf(ic, "%s: failed to add interface: %d\n", __func__, error);
4441 		mtx_destroy(&lvif->mtx);
4442 		free(lvif, M_80211_VAP);
4443 		return (NULL);
4444 	}
4445 	wiphy_unlock(hw->wiphy);
4446 
4447 	LKPI_80211_LHW_LVIF_LOCK(lhw);
4448 	TAILQ_INSERT_TAIL(&lhw->lvif_head, lvif, lvif_entry);
4449 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
4450 
4451 	/* Set bss_info. */
4452 	bss_changed = 0;
4453 	lkpi_bss_info_change(hw, vif, bss_changed);
4454 
4455 	/* Configure tx queues (conf_tx), default WME & send BSS_CHANGED_QOS. */
4456 	IMPROVE("Hardcoded values; to fix see 802.11-2016, 9.4.2.29 EDCA Parameter Set element");
4457 	wiphy_lock(hw->wiphy);
4458 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
4459 
4460 		bzero(&txqp, sizeof(txqp));
4461 		txqp.cw_min = 15;
4462 		txqp.cw_max = 1023;
4463 		txqp.txop = 0;
4464 		txqp.aifs = 2;
4465 		error = lkpi_80211_mo_conf_tx(hw, vif, /* link_id */0, ac, &txqp);
4466 		if (error != 0)
4467 			ic_printf(ic, "%s: conf_tx ac %u failed %d\n",
4468 			    __func__, ac, error);
4469 	}
4470 	bss_changed = BSS_CHANGED_QOS;
4471 	lkpi_bss_info_change(hw, vif, bss_changed);
4472 
4473 	/* Force MC init. */
4474 	lkpi_update_mcast_filter_locked(ic);
4475 
4476 	wiphy_unlock(hw->wiphy);
4477 
4478 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
4479 
4480 	/* Now we have a valid vap->iv_ifp.  Any checksum offloading goes below. */
4481 
4482 	IMPROVE();
4483 
4484 	/* Override with LinuxKPI method so we can drive mac80211/cfg80211. */
4485 	lvif->iv_newstate = vap->iv_newstate;
4486 	vap->iv_newstate = lkpi_iv_newstate;
4487 	lvif->iv_update_bss = vap->iv_update_bss;
4488 	vap->iv_update_bss = lkpi_iv_update_bss;
4489 	lvif->iv_recv_mgmt = vap->iv_recv_mgmt;
4490 	vap->iv_recv_mgmt = lkpi_iv_sta_recv_mgmt;
4491 
4492 #ifdef LKPI_80211_HW_CRYPTO
4493 	/* Key management. */
4494 	if (lkpi_hwcrypto && lhw->ops->set_key != NULL) {
4495 		vap->iv_key_set = lkpi_iv_key_set;
4496 		vap->iv_key_delete = lkpi_iv_key_delete;
4497 		vap->iv_key_update_begin = lkpi_iv_key_update_begin;
4498 		vap->iv_key_update_end = lkpi_iv_key_update_end;
4499 	}
4500 #endif
4501 
4502 #ifdef LKPI_80211_HT
4503 	/* Stay with the iv_ampdu_rxmax,limit / iv_ampdu_density defaults until later. */
4504 #endif
4505 
4506 	ieee80211_ratectl_init(vap);
4507 
4508 	/* Complete setup. */
4509 	ieee80211_vap_attach(vap, ieee80211_media_change,
4510 	    ieee80211_media_status, mac);
4511 
4512 #ifdef LKPI_80211_HT
4513 	/*
4514 	 * Modern chipset/fw/drv will do A-MPDU in drv/fw and fail
4515 	 * to do so if they cannot do the crypto too.
4516 	 */
4517 	if (!lkpi_hwcrypto && IEEE80211_CONF_AMPDU_OFFLOAD(ic))
4518 		vap->iv_flags_ht &= ~IEEE80211_FHT_AMPDU_RX;
4519 #endif
4520 
4521 	if (hw->max_listen_interval == 0)
4522 		hw->max_listen_interval = 7 * (ic->ic_lintval / ic->ic_bintval);
4523 	hw->conf.listen_interval = hw->max_listen_interval;
4524 
4525 	/* XXX-BZ do we need to be able to update these? */
4526 	hw->wiphy->frag_threshold = vap->iv_fragthreshold;
4527 	lkpi_80211_mo_set_frag_threshold(hw, vap->iv_fragthreshold);
4528 	hw->wiphy->rts_threshold = vap->iv_rtsthreshold;
4529 	lkpi_80211_mo_set_rts_threshold(hw, vap->iv_rtsthreshold);
4530 	/* any others? */
4531 
4532 	/* Add per-VIF/VAP sysctls. */
4533 	sysctl_ctx_init(&lvif->sysctl_ctx);
4534 
4535 	node = SYSCTL_ADD_NODE(&lvif->sysctl_ctx,
4536 	    SYSCTL_CHILDREN(&sysctl___compat_linuxkpi_80211),
4537 	    OID_AUTO, if_name(vap->iv_ifp),
4538 	    CTLFLAG_RD | CTLFLAG_SKIP | CTLFLAG_MPSAFE, NULL, "VIF Information");
4539 
4540 	SYSCTL_ADD_PROC(&lvif->sysctl_ctx,
4541 	    SYSCTL_CHILDREN(node), OID_AUTO, "dump_stas",
4542 	    CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE, lvif, 0,
4543 	    lkpi_80211_dump_stas, "A", "Dump sta statistics of this vif");
4544 	SYSCTL_ADD_PROC(&lvif->sysctl_ctx,
4545 	    SYSCTL_CHILDREN(node), OID_AUTO, "dump_stas_queues",
4546 	    CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE | CTLFLAG_SKIP, lvif, 0,
4547 	    lkpi_80211_dump_sta_queues, "A",
4548 	    "Dump queue statistics for any sta of this vif");
4549 
4550 	IMPROVE();
4551 
4552 	return (vap);
4553 }
4554 
4555 void
4556 linuxkpi_ieee80211_unregister_hw(struct ieee80211_hw *hw)
4557 {
4558 
4559 	wiphy_unregister(hw->wiphy);
4560 	linuxkpi_ieee80211_ifdetach(hw);
4561 
4562 	IMPROVE();
4563 }
4564 
4565 void
4566 linuxkpi_ieee80211_restart_hw(struct ieee80211_hw *hw)
4567 {
4568 
4569 	TODO();
4570 }
4571 
4572 static void
4573 lkpi_ic_vap_delete(struct ieee80211vap *vap)
4574 {
4575 	struct ieee80211com *ic;
4576 	struct lkpi_hw *lhw;
4577 	struct ieee80211_hw *hw;
4578 	struct lkpi_vif *lvif;
4579 	struct ieee80211_vif *vif;
4580 
4581 	lvif = VAP_TO_LVIF(vap);
4582 	vif = LVIF_TO_VIF(lvif);
4583 	ic = vap->iv_ic;
4584 	lhw = ic->ic_softc;
4585 	hw = LHW_TO_HW(lhw);
4586 
4587 	EVENTHANDLER_DEREGISTER(iflladdr_event, lvif->lvif_ifllevent);
4588 
4589 	/* Clear up per-VIF/VAP sysctls. */
4590 	sysctl_ctx_free(&lvif->sysctl_ctx);
4591 
4592 	ieee80211_draintask(ic, &lvif->sw_scan_task);
4593 
4594 	LKPI_80211_LHW_LVIF_LOCK(lhw);
4595 	TAILQ_REMOVE(&lhw->lvif_head, lvif, lvif_entry);
4596 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
4597 
4598 	ieee80211_ratectl_deinit(vap);
4599 	ieee80211_vap_detach(vap);
4600 
4601 	IMPROVE("clear up other bits in this state");
4602 
4603 	lkpi_80211_mo_remove_interface(hw, vif);
4604 
4605 	/* Single VAP, so we can do this here. */
4606 	lkpi_80211_mo_stop(hw, false);			/* XXX SUSPEND */
4607 
4608 	mtx_destroy(&lvif->mtx);
4609 	free(lvif, M_80211_VAP);
4610 }
4611 
4612 static void
4613 lkpi_ic_update_mcast(struct ieee80211com *ic)
4614 {
4615 	struct ieee80211vap *vap;
4616 	struct lkpi_hw *lhw;
4617 
4618 	lhw = ic->ic_softc;
4619 
4620 	LKPI_80211_LHW_MC_LOCK(lhw);
4621 	/* Cleanup anything on the current list. */
4622 	lkpi_cleanup_mcast_list_locked(lhw);
4623 
4624 	/* Build up the new list (or allmulti). */
4625 	if (ic->ic_allmulti == 0) {
4626 		TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
4627 			if_foreach_llmaddr(vap->iv_ifp,
4628 			    lkpi_ic_update_mcast_copy, &lhw->mc_list);
4629 		lhw->mc_all_multi = false;
4630 	} else {
4631 		lhw->mc_all_multi = true;
4632 	}
4633 	LKPI_80211_LHW_MC_UNLOCK(lhw);
4634 
4635 	lkpi_update_mcast_filter(ic);
4636 	TRACEOK();
4637 }
4638 
4639 static void
4640 lkpi_ic_update_promisc(struct ieee80211com *ic)
4641 {
4642 
4643 	UNIMPLEMENTED;
4644 }
4645 
4646 static void
4647 lkpi_ic_update_chw(struct ieee80211com *ic)
4648 {
4649 
4650 	UNIMPLEMENTED;
4651 }
4652 
4653 /* Start / stop device. */
4654 static void
4655 lkpi_ic_parent(struct ieee80211com *ic)
4656 {
4657 	struct lkpi_hw *lhw;
4658 	struct ieee80211_hw *hw;
4659 #ifdef HW_START_STOP
4660 	int error;
4661 #endif
4662 	bool start_all;
4663 
4664 	IMPROVE();
4665 
4666 	lhw = ic->ic_softc;
4667 	hw = LHW_TO_HW(lhw);
4668 	start_all = false;
4669 
4670 	/* IEEE80211_UNLOCK(ic); */
4671 	wiphy_lock(hw->wiphy);
4672 	if (ic->ic_nrunning > 0) {
4673 #ifdef HW_START_STOP
4674 		error = lkpi_80211_mo_start(hw);
4675 		if (error == 0)
4676 #endif
4677 			start_all = true;
4678 	} else {
4679 #ifdef HW_START_STOP
4680 		lkpi_80211_mo_stop(hw, false);		/* XXX SUSPEND */
4681 #endif
4682 	}
4683 	wiphy_unlock(hw->wiphy);
4684 	/* IEEE80211_LOCK(ic); */
4685 
4686 	if (start_all)
4687 		ieee80211_start_all(ic);
4688 }
4689 
4690 bool
4691 linuxkpi_ieee80211_is_ie_id_in_ie_buf(const u8 ie, const u8 *ie_ids,
4692     size_t ie_ids_len)
4693 {
4694 	int i;
4695 
4696 	for (i = 0; i < ie_ids_len; i++) {
4697 		if (ie == *ie_ids)
4698 			return (true);
4699 	}
4700 
4701 	return (false);
4702 }
4703 
4704 /* Return true if skipped; false if error. */
4705 bool
4706 linuxkpi_ieee80211_ie_advance(size_t *xp, const u8 *ies, size_t ies_len)
4707 {
4708 	size_t x;
4709 	uint8_t l;
4710 
4711 	x = *xp;
4712 
4713 	KASSERT(x < ies_len, ("%s: x %zu ies_len %zu ies %p\n",
4714 	    __func__, x, ies_len, ies));
4715 	l = ies[x + 1];
4716 	x += 2 + l;
4717 
4718 	if (x > ies_len)
4719 		return (false);
4720 
4721 	*xp = x;
4722 	return (true);
4723 }
4724 
4725 static uint8_t *
4726 lkpi_scan_ies_add(uint8_t *p, struct ieee80211_scan_ies *scan_ies,
4727     uint32_t band_mask, struct ieee80211vap *vap, struct ieee80211_hw *hw)
4728 {
4729 	struct ieee80211_supported_band *supband;
4730 	struct linuxkpi_ieee80211_channel *channels;
4731 	struct ieee80211com *ic;
4732 	const struct ieee80211_channel *chan;
4733 	const struct ieee80211_rateset *rs;
4734 	uint8_t *pb;
4735 	int band, i;
4736 
4737 	ic = vap->iv_ic;
4738 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
4739 		if ((band_mask & (1 << band)) == 0)
4740 			continue;
4741 
4742 		supband = hw->wiphy->bands[band];
4743 		/*
4744 		 * This should not happen;
4745 		 * band_mask is a bitmask of valid bands to scan on.
4746 		 */
4747 		if (supband == NULL || supband->n_channels == 0)
4748 			continue;
4749 
4750 		/* Find a first channel to get the mode and rates from. */
4751 		channels = supband->channels;
4752 		chan = NULL;
4753 		for (i = 0; i < supband->n_channels; i++) {
4754 			uint32_t flags;
4755 
4756 			if (channels[i].flags & IEEE80211_CHAN_DISABLED)
4757 				continue;
4758 
4759 			flags = 0;
4760 			switch (band) {
4761 			case NL80211_BAND_2GHZ:
4762 				flags |= IEEE80211_CHAN_G;
4763 				break;
4764 			case NL80211_BAND_5GHZ:
4765 				flags |= IEEE80211_CHAN_A;
4766 				break;
4767 			default:
4768 				panic("%s:%d: unupported band %d\n",
4769 				    __func__, __LINE__, band);
4770 			}
4771 
4772 			chan = ieee80211_find_channel(ic,
4773 			    channels[i].center_freq, flags);
4774 			if (chan != NULL)
4775 				break;
4776 		}
4777 
4778 		/* This really should not happen. */
4779 		if (chan == NULL)
4780 			continue;
4781 
4782 		pb = p;
4783 		rs = ieee80211_get_suprates(ic, chan);	/* calls chan2mode */
4784 		p = ieee80211_add_rates(p, rs);
4785 		p = ieee80211_add_xrates(p, rs);
4786 
4787 #if defined(LKPI_80211_HT)
4788 		if ((vap->iv_flags_ht & IEEE80211_FHT_HT) != 0) {
4789 			struct ieee80211_channel *c;
4790 
4791 			c = ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
4792 			    vap->iv_flags_ht);
4793 			p = ieee80211_add_htcap_ch(p, vap, c);
4794 		}
4795 #endif
4796 #if defined(LKPI_80211_VHT)
4797 		if (band == NL80211_BAND_5GHZ &&
4798 		    (vap->iv_vht_flags & IEEE80211_FVHT_VHT) != 0) {
4799 			struct ieee80211_channel *c;
4800 
4801 			c = ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
4802 			    vap->iv_flags_ht);
4803 			c = ieee80211_vht_adjust_channel(ic, c,
4804 			    vap->iv_vht_flags);
4805 			p = ieee80211_add_vhtcap_ch(p, vap, c);
4806 		}
4807 #endif
4808 
4809 		scan_ies->ies[band] = pb;
4810 		scan_ies->len[band] = p - pb;
4811 	}
4812 
4813 	/* Add common_ies */
4814 	pb = p;
4815 	if ((vap->iv_flags & IEEE80211_F_WPA1) != 0 &&
4816 	    vap->iv_wpa_ie != NULL) {
4817 		memcpy(p, vap->iv_wpa_ie, 2 + vap->iv_wpa_ie[1]);
4818 		p += 2 + vap->iv_wpa_ie[1];
4819 	}
4820 	if (vap->iv_appie_probereq != NULL) {
4821 		memcpy(p, vap->iv_appie_probereq->ie_data,
4822 		    vap->iv_appie_probereq->ie_len);
4823 		p += vap->iv_appie_probereq->ie_len;
4824 	}
4825 	scan_ies->common_ies = pb;
4826 	scan_ies->common_ie_len = p - pb;
4827 
4828 	return (p);
4829 }
4830 
4831 static void
4832 lkpi_enable_hw_scan(struct lkpi_hw *lhw)
4833 {
4834 
4835 	if (lhw->ops->hw_scan) {
4836 		/*
4837 		 * Advertise full-offload scanning.
4838 		 *
4839 		 * Not limiting to SINGLE_SCAN_ON_ALL_BANDS here as otherwise
4840 		 * we essentially disable hw_scan for all drivers not setting
4841 		 * the flag.
4842 		 */
4843 		lhw->ic->ic_flags_ext |= IEEE80211_FEXT_SCAN_OFFLOAD;
4844 		lhw->scan_flags |= LKPI_LHW_SCAN_HW;
4845 	}
4846 }
4847 
4848 #ifndef LKPI_80211_USE_SCANLIST
4849 static const uint32_t chan_pri[] = {
4850 	5180, 5500, 5745,
4851 	5260, 5580, 5660, 5825,
4852 	5220, 5300, 5540, 5620, 5700, 5785, 5865,
4853 	2437, 2412, 2422, 2462, 2472, 2432, 2452
4854 };
4855 
4856 static int
4857 lkpi_scan_chan_list_idx(const struct linuxkpi_ieee80211_channel *lc)
4858 {
4859 	int i;
4860 
4861 	for (i = 0; i < nitems(chan_pri); i++) {
4862 		if (lc->center_freq == chan_pri[i])
4863 			return (i);
4864 	}
4865 
4866 	return (-1);
4867 }
4868 
4869 static int
4870 lkpi_scan_chan_list_comp(const  struct linuxkpi_ieee80211_channel *lc1,
4871     const  struct linuxkpi_ieee80211_channel *lc2)
4872 {
4873 	int idx1, idx2;
4874 
4875 	/* Find index in list. */
4876 	idx1 = lkpi_scan_chan_list_idx(lc1);
4877 	idx2 = lkpi_scan_chan_list_idx(lc2);
4878 
4879 	if (idx1 == -1 && idx2 != -1)
4880 		return (1);
4881 	if (idx1 != -1 && idx2 == -1)
4882 		return (-1);
4883 
4884 	/* Neither on the list, use center_freq. */
4885 	if (idx1 == -1 && idx2 == -1)
4886 		return (lc1->center_freq - lc2->center_freq);
4887 
4888 	/* Whichever is first in the list. */
4889 	return (idx1 - idx2);
4890 }
4891 
4892 static void
4893 lkpi_scan_chan_list_resort(struct linuxkpi_ieee80211_channel **cpp, size_t nchan)
4894 {
4895 	struct linuxkpi_ieee80211_channel *lc, *nc;
4896 	size_t i, j;
4897 	int rc;
4898 
4899 	for (i = (nchan - 1); i > 0; i--) {
4900 		for (j = i; j > 0 ; j--) {
4901 			lc = *(cpp + j);
4902 			nc = *(cpp + j - 1);
4903 			rc = lkpi_scan_chan_list_comp(lc, nc);
4904 			if (rc < 0) {
4905 				*(cpp + j) = nc;
4906 				*(cpp + j - 1) = lc;
4907 			}
4908 		}
4909 	}
4910 }
4911 
4912 static bool
4913 lkpi_scan_chan(struct linuxkpi_ieee80211_channel *c,
4914     struct ieee80211com *ic, bool log)
4915 {
4916 
4917 	if ((c->flags & IEEE80211_CHAN_DISABLED) != 0) {
4918 		if (log)
4919 			TRACE_SCAN(ic, "Skipping disabled chan "
4920 			    "on band %s [%#x/%u/%#x]",
4921 			    lkpi_nl80211_band_name(c->band), c->hw_value,
4922 			    c->center_freq, c->flags);
4923 		return (false);
4924 	}
4925 	if (isclr(ic->ic_chan_active, ieee80211_mhz2ieee(c->center_freq,
4926 	    lkpi_nl80211_band_to_net80211_band(c->band)))) {
4927 		if (log)
4928 			TRACE_SCAN(ic, "Skipping !active chan "
4929 			    "on band %s [%#x/%u/%#x]",
4930 			    lkpi_nl80211_band_name(c->band), c->hw_value,
4931 			    c->center_freq, c->flags);
4932 		return (false);
4933 	}
4934 	return (true);
4935 }
4936 #endif
4937 
4938 static void
4939 lkpi_ic_scan_start(struct ieee80211com *ic)
4940 {
4941 	struct lkpi_hw *lhw;
4942 	struct ieee80211_hw *hw;
4943 	struct lkpi_vif *lvif;
4944 	struct ieee80211_vif *vif;
4945 	struct ieee80211_scan_state *ss;
4946 	struct ieee80211vap *vap;
4947 	int error;
4948 	bool is_hw_scan;
4949 
4950 	lhw = ic->ic_softc;
4951 	ss = ic->ic_scan;
4952 	vap = ss->ss_vap;
4953 	TRACE_SCAN(ic, "scan_flags %b", lhw->scan_flags, LKPI_LHW_SCAN_BITS);
4954 
4955 	LKPI_80211_LHW_SCAN_LOCK(lhw);
4956 	if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0) {
4957 		/* A scan is still running. */
4958 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4959 		TRACE_SCAN(ic, "Trying to start new scan while still running; "
4960 		    "cancelling new net80211 scan; scan_flags %b",
4961 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS);
4962 		ieee80211_cancel_scan(vap);
4963 		return;
4964 	}
4965 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
4966 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4967 
4968 #if 0
4969 	if (vap->iv_state != IEEE80211_S_SCAN) {
4970 		TODO("We need to be able to scan if not in S_SCAN");
4971 		TRACE_SCAN(ic, "scan_flags %b iv_state %d",
4972 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS, vap->iv_state);
4973 		ieee80211_cancel_scan(vap);
4974 		return;
4975 	}
4976 #endif
4977 
4978 	hw = LHW_TO_HW(lhw);
4979 	if (!is_hw_scan) {
4980 		/* If hw_scan is cleared clear FEXT_SCAN_OFFLOAD too. */
4981 		vap->iv_flags_ext &= ~IEEE80211_FEXT_SCAN_OFFLOAD;
4982 
4983 		lvif = VAP_TO_LVIF(vap);
4984 		vif = LVIF_TO_VIF(lvif);
4985 
4986 		if (vap->iv_state == IEEE80211_S_SCAN) {
4987 			wiphy_lock(hw->wiphy);
4988 			lkpi_hw_conf_idle(hw, false);
4989 			wiphy_unlock(hw->wiphy);
4990 		}
4991 
4992 		LKPI_80211_LHW_SCAN_LOCK(lhw);
4993 		lhw->scan_flags |= LKPI_LHW_SCAN_RUNNING;
4994 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4995 
4996 		lkpi_update_mcast_filter(ic);
4997 
4998 		TRACE_SCAN(vap->iv_ic, "Starting SW_SCAN: scan_flags %b",
4999 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS);
5000 		lkpi_80211_mo_sw_scan_start(hw, vif, vif->addr);
5001 		/* net80211::scan_start() handled PS for us. */
5002 		IMPROVE();
5003 		/* XXX Also means it is too late to flush queues?
5004 		 * need to check iv_sta_ps or overload? */
5005 		/* XXX want to adjust ss end time/ maxdwell? */
5006 
5007 	} else {
5008 		struct ieee80211_scan_request *hw_req;
5009 		struct linuxkpi_ieee80211_channel *lc, **cpp;
5010 		struct cfg80211_ssid *ssids;
5011 		struct cfg80211_scan_6ghz_params *s6gp;
5012 		size_t chan_len, nchan, ssids_len, s6ghzlen;
5013 		int band, i, ssid_count, common_ie_len;
5014 #ifndef LKPI_80211_USE_SCANLIST
5015 		int n;
5016 #endif
5017 		uint32_t band_mask;
5018 		uint8_t *ie, *ieend;
5019 		bool running;
5020 
5021 		ssid_count = min(ss->ss_nssid, hw->wiphy->max_scan_ssids);
5022 		ssids_len = ssid_count * sizeof(*ssids);
5023 		s6ghzlen = 0 * (sizeof(*s6gp));			/* XXX-BZ */
5024 
5025 		band_mask = 0;
5026 		nchan = 0;
5027 		if (ieee80211_hw_check(hw, SINGLE_SCAN_ON_ALL_BANDS)) {
5028 #ifdef LKPI_80211_USE_SCANLIST
5029 		/* Avoid net80211 scan lists until it has proper scan offload support. */
5030 			for (i = ss->ss_next; i < ss->ss_last; i++) {
5031 				nchan++;
5032 				band = lkpi_net80211_chan_to_nl80211_band(
5033 				    ss->ss_chans[ss->ss_next + i]);
5034 				band_mask |= (1 << band);
5035 			}
5036 #else
5037 			/* Instead we scan for all channels all the time. */
5038 			for (band = 0; band < NUM_NL80211_BANDS; band++) {
5039 				switch (band) {
5040 				case NL80211_BAND_2GHZ:
5041 				case NL80211_BAND_5GHZ:
5042 					break;
5043 				default:
5044 					continue;
5045 				}
5046 				if (hw->wiphy->bands[band] != NULL) {
5047 					struct linuxkpi_ieee80211_channel *channels;
5048 					int n;
5049 
5050 					band_mask |= (1 << band);
5051 
5052 					channels = hw->wiphy->bands[band]->channels;
5053 					n = hw->wiphy->bands[band]->n_channels;
5054 					for (i = 0; i < n; i++) {
5055 						if (lkpi_scan_chan(&channels[i], ic, true))
5056 							nchan++;
5057 					}
5058 				}
5059 			}
5060 #endif
5061 		} else {
5062 			IMPROVE("individual band scans not yet supported, only scanning first band");
5063 			/* In theory net80211 should drive this. */
5064 			/* Probably we need to add local logic for now;
5065 			 * need to deal with scan_complete
5066 			 * and cancel_scan and keep local state.
5067 			 * Also cut the nchan down above.
5068 			 */
5069 			/* XXX-BZ ath10k does not set this but still does it? &$%^ */
5070 		}
5071 
5072 		chan_len = nchan * (sizeof(lc) + sizeof(*lc));
5073 
5074 		common_ie_len = 0;
5075 		if ((vap->iv_flags & IEEE80211_F_WPA1) != 0 &&
5076 		    vap->iv_wpa_ie != NULL)
5077 			common_ie_len += vap->iv_wpa_ie[1];
5078 		if (vap->iv_appie_probereq != NULL)
5079 			common_ie_len += vap->iv_appie_probereq->ie_len;
5080 
5081 		/* We would love to check this at an earlier stage... */
5082 		if (common_ie_len >  hw->wiphy->max_scan_ie_len) {
5083 			ic_printf(ic, "WARNING: %s: common_ie_len %d > "
5084 			    "wiphy->max_scan_ie_len %d\n", __func__,
5085 			    common_ie_len, hw->wiphy->max_scan_ie_len);
5086 		}
5087 
5088 		hw_req = malloc(sizeof(*hw_req) + ssids_len +
5089 		    s6ghzlen + chan_len + lhw->supbands * lhw->scan_ie_len +
5090 		    common_ie_len, M_LKPI80211, M_WAITOK | M_ZERO);
5091 
5092 		hw_req->req.flags = 0;			/* XXX ??? */
5093 		/* hw_req->req.wdev */
5094 		hw_req->req.wiphy = hw->wiphy;
5095 		hw_req->req.no_cck = false;		/* XXX */
5096 
5097 		/*
5098 		 * In general setting duration[_mandatory] seems to pessimise
5099 		 * default scanning behaviour.  We only use it for BGSCANnig
5100 		 * to keep the dwell times small.
5101 		 * Setting duration_mandatory makes this the maximum dwell
5102 		 * time (otherwise may be shorter).  Duration is in TU.
5103 		 */
5104 		if ((ic->ic_flags_ext & IEEE80211_FEXT_BGSCAN) != 0) {
5105 			unsigned long dwell;
5106 
5107 			if ((ic->ic_caps & IEEE80211_C_BGSCAN) == 0 ||
5108 			    (vap->iv_flags & IEEE80211_F_BGSCAN) == 0)
5109 				ic_printf(ic, "BGSCAN despite off: %b, %b, %b\n",
5110 				    ic->ic_flags_ext, IEEE80211_FEXT_BITS,
5111 				    vap->iv_flags, IEEE80211_F_BITS,
5112 				    ic->ic_caps, IEEE80211_C_BITS);
5113 
5114 			dwell = ss->ss_mindwell;
5115 			if (dwell == 0)
5116 				dwell = msecs_to_ticks(20);
5117 
5118 			hw_req->req.duration_mandatory = true;
5119 			hw_req->req.duration = TICKS_2_USEC(dwell) / 1024;
5120 		}
5121 
5122 #ifdef __notyet__
5123 		hw_req->req.flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
5124 		memcpy(hw_req->req.mac_addr, xxx, IEEE80211_ADDR_LEN);
5125 		memset(hw_req->req.mac_addr_mask, 0xxx, IEEE80211_ADDR_LEN);
5126 #endif
5127 		eth_broadcast_addr(hw_req->req.bssid);
5128 
5129 		hw_req->req.n_channels = nchan;
5130 		cpp = (struct linuxkpi_ieee80211_channel **)(hw_req + 1);
5131 		lc = (struct linuxkpi_ieee80211_channel *)(cpp + nchan);
5132 #ifdef LKPI_80211_USE_SCANLIST
5133 		for (i = 0; i < nchan; i++) {
5134 			*(cpp + i) =
5135 			    (struct linuxkpi_ieee80211_channel *)(lc + i);
5136 		}
5137 		/* Avoid net80211 scan lists until it has proper scan offload support. */
5138 		for (i = 0; i < nchan; i++) {
5139 			struct ieee80211_channel *c;
5140 
5141 			c = ss->ss_chans[ss->ss_next + i];
5142 			lc->center_freq = c->ic_freq;	/* XXX */
5143 			/* lc->flags */
5144 			lc->band = lkpi_net80211_chan_to_nl80211_band(c);
5145 			lc->max_power = c->ic_maxpower;
5146 			/* lc-> ... */
5147 			lc++;
5148 		}
5149 #else
5150 		/* Add bands in reverse order for scanning. */
5151 		n = 0;
5152 		for (band = NUM_NL80211_BANDS - 1; band >= 0; band--) {
5153 			struct ieee80211_supported_band *supband;
5154 			struct linuxkpi_ieee80211_channel *channels;
5155 
5156 			/* Band disabled for scanning? */
5157 			if ((band_mask & (1 << band)) == 0)
5158 				continue;
5159 
5160 			/* Nothing to scan in band? */
5161 			supband = hw->wiphy->bands[band];
5162 			if (supband == NULL || supband->n_channels == 0)
5163 				continue;
5164 
5165 			channels = supband->channels;
5166 			for (i = 0; i < supband->n_channels; i++) {
5167 				if (lkpi_scan_chan(&channels[i], ic, false))
5168 					*(cpp + n++) = &channels[i];
5169 			}
5170 		}
5171 		if (lkpi_order_scanlist)
5172 			lkpi_scan_chan_list_resort(cpp, nchan);
5173 
5174 		if ((linuxkpi_debug_80211 & D80211_SCAN) != 0) {
5175 			printf("%s:%d: %s SCAN Channel List (nchan=%zu): ",
5176 			    __func__, __LINE__, ic->ic_name, nchan);
5177 			for (i = 0; i < nchan; i++) {
5178 				struct linuxkpi_ieee80211_channel *xc;
5179 
5180 				xc = *(cpp + i);
5181 				printf(" %d(%d)",
5182 				    ieee80211_mhz2ieee(xc->center_freq,
5183 				        lkpi_nl80211_band_to_net80211_band(
5184 					xc->band)),
5185 				    xc->center_freq);
5186 			}
5187 			printf("\n");
5188 		}
5189 #endif
5190 
5191 		hw_req->req.n_ssids = ssid_count;
5192 		if (hw_req->req.n_ssids > 0) {
5193 			ssids = (struct cfg80211_ssid *)lc;
5194 			hw_req->req.ssids = ssids;
5195 			for (i = 0; i < ssid_count; i++) {
5196 				ssids->ssid_len = ss->ss_ssid[i].len;
5197 				memcpy(ssids->ssid, ss->ss_ssid[i].ssid,
5198 				    ss->ss_ssid[i].len);
5199 				ssids++;
5200 			}
5201 			s6gp = (struct cfg80211_scan_6ghz_params *)ssids;
5202 		} else {
5203 			s6gp = (struct cfg80211_scan_6ghz_params *)lc;
5204 		}
5205 
5206 		/* 6GHz one day. */
5207 		hw_req->req.n_6ghz_params = 0;
5208 		hw_req->req.scan_6ghz_params = NULL;
5209 		hw_req->req.scan_6ghz = false;	/* Weird boolean; not what you think. */
5210 		/* s6gp->... */
5211 
5212 		ie = ieend = (uint8_t *)s6gp;
5213 		/* Copy per-band IEs, copy common IEs */
5214 		ieend = lkpi_scan_ies_add(ie, &hw_req->ies, band_mask, vap, hw);
5215 		hw_req->req.ie = ie;
5216 		hw_req->req.ie_len = ieend - ie;
5217 		hw_req->req.scan_start = jiffies;
5218 
5219 		lvif = VAP_TO_LVIF(vap);
5220 		vif = LVIF_TO_VIF(lvif);
5221 
5222 		LKPI_80211_LHW_SCAN_LOCK(lhw);
5223 		/* Re-check under lock. */
5224 		running = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
5225 		if (!running) {
5226 			KASSERT(lhw->hw_req == NULL, ("%s: ic %p lhw %p hw_req %p "
5227 			    "!= NULL\n", __func__, ic, lhw, lhw->hw_req));
5228 
5229 			lhw->scan_flags |= LKPI_LHW_SCAN_RUNNING;
5230 			lhw->hw_req = hw_req;
5231 		}
5232 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5233 		if (running) {
5234 			free(hw_req, M_LKPI80211);
5235 			TRACE_SCAN(ic, "Trying to start new scan while still "
5236 			    "running (2); cancelling new net80211 scan; "
5237 			    "scan_flags %b",
5238 			    lhw->scan_flags, LKPI_LHW_SCAN_BITS);
5239 			ieee80211_cancel_scan(vap);
5240 			return;
5241 		}
5242 
5243 		wiphy_lock(hw->wiphy);
5244 		lkpi_update_mcast_filter_locked(ic);
5245 		TRACE_SCAN(ic, "Starting HW_SCAN: scan_flags %b, "
5246 		    "ie_len %d, n_ssids %d, n_chan %d, common_ie_len %d [%d, %d]",
5247 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS, hw_req->req.ie_len,
5248 		    hw_req->req.n_ssids, hw_req->req.n_channels,
5249 		    hw_req->ies.common_ie_len,
5250 		    hw_req->ies.len[NL80211_BAND_2GHZ],
5251 		    hw_req->ies.len[NL80211_BAND_5GHZ]);
5252 
5253 		error = lkpi_80211_mo_hw_scan(hw, vif, hw_req);
5254 		wiphy_unlock(hw->wiphy);
5255 		if (error != 0) {
5256 			bool scan_done;
5257 			int e;
5258 
5259 			TRACE_SCAN(ic, "hw_scan failed; scan_flags %b, error %d",
5260 			    lhw->scan_flags, LKPI_LHW_SCAN_BITS, error);
5261 			ieee80211_cancel_scan(vap);
5262 
5263 			/*
5264 			 * ieee80211_scan_completed must be called in either
5265 			 * case of error or none.  So let the free happen there
5266 			 * and only there.
5267 			 * That would be fine in theory but in practice drivers
5268 			 * behave differently:
5269 			 * ath10k does not return hw_scan until after scan_complete
5270 			 *        and can then still return an error.
5271 			 * rtw88 can return 1 or -EBUSY without scan_complete
5272 			 * iwlwifi can return various errors before scan starts
5273 			 * ...
5274 			 * So we cannot rely on that behaviour and have to check
5275 			 * and balance between both code paths.
5276 			 */
5277 			e = 0;
5278 			scan_done = true;
5279 			LKPI_80211_LHW_SCAN_LOCK(lhw);
5280 			if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0) {
5281 
5282 				free(lhw->hw_req, M_LKPI80211);
5283 				lhw->hw_req = NULL;
5284 				/*
5285 				 * The ieee80211_cancel_scan() above runs in a
5286 				 * taskq and it may take ages for the previous
5287 				 * scan to clear;  starting a new one right away
5288 				 * we run into the problem that the old one is
5289 				 * still active.
5290 				 */
5291 				e = msleep(lhw, &lhw->scan_mtx, 0, "lhwscanstop", hz);
5292 				scan_done = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
5293 
5294 				/*
5295 				 * Now we can clear running if no one else did.
5296 				 */
5297 				lhw->scan_flags &= ~LKPI_LHW_SCAN_RUNNING;
5298 			}
5299 			LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5300 			lkpi_update_mcast_filter(ic);
5301 			if (!scan_done) {
5302 				ic_printf(ic, "ERROR: %s: timeout/error to wait "
5303 				    "for ieee80211_cancel_scan: %d\n", __func__, e);
5304 				return;
5305 			}
5306 
5307 			/*
5308 			 * XXX-SIGH magic number.
5309 			 * rtw88 has a magic "return 1" if offloading scan is
5310 			 * not possible.  Fall back to sw scan in that case.
5311 			 */
5312 			if (error == 1) {
5313 				/*
5314 				 * We need to put this into some defered context
5315 				 * the net80211 scan may not be done yet
5316 				 * (ic_flags & IEEE80211_F_SCAN) and we cannot
5317 				 * wait here; if we do scan_curchan_task always
5318 				 * runs after our timeout to finalize the scan.
5319 				 */
5320 				ieee80211_runtask(ic, &lvif->sw_scan_task);
5321 				return;
5322 			}
5323 
5324 			ic_printf(ic, "ERROR: %s: hw_scan returned %d\n",
5325 			    __func__, error);
5326 		}
5327 	}
5328 }
5329 
5330 static void
5331 lkpi_sw_scan_task(void *arg, int pending __unused)
5332 {
5333 	struct lkpi_hw *lhw;
5334 	struct lkpi_vif *lvif;
5335 	struct ieee80211vap *vap;
5336 	struct ieee80211_scan_state *ss;
5337 
5338 	lvif = arg;
5339 	vap = LVIF_TO_VAP(lvif);
5340 	lhw = vap->iv_ic->ic_softc;
5341 	ss = vap->iv_ic->ic_scan;
5342 
5343 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5344 	/*
5345 	 * We will re-enable this at scan_end calling lkpi_enable_hw_scan().
5346 	 * IEEE80211_FEXT_SCAN_OFFLOAD will be cleared by lkpi_ic_scan_start.
5347 	 */
5348 	lhw->scan_flags &= ~LKPI_LHW_SCAN_HW;
5349 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5350 
5351 	TRACE_SCAN(vap->iv_ic, "Triggering SW_SCAN: pending %d, scan_flags %b",
5352 	    pending, lhw->scan_flags, LKPI_LHW_SCAN_BITS);
5353 
5354 	/*
5355 	 * This will call ic_scan_start() and we will get into the right path
5356 	 * unless other scans started in between.
5357 	 */
5358 	ieee80211_start_scan(vap,
5359 	    IEEE80211_SCAN_ONCE,
5360 	    msecs_to_ticks(10000), /* 10000 ms (=~ 50 chan * 200 ms) */
5361 	    ss->ss_mindwell ? ss->ss_mindwell : msecs_to_ticks(20),
5362 	    ss->ss_maxdwell ? ss->ss_maxdwell : msecs_to_ticks(200),
5363 	    vap->iv_des_nssid, vap->iv_des_ssid);
5364 }
5365 
5366 static void
5367 lkpi_ic_scan_end(struct ieee80211com *ic)
5368 {
5369 	struct lkpi_hw *lhw;
5370 	bool is_hw_scan;
5371 
5372 	lhw = ic->ic_softc;
5373 	TRACE_SCAN(ic, "scan_flags %b", lhw->scan_flags, LKPI_LHW_SCAN_BITS);
5374 
5375 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5376 	if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) == 0) {
5377 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5378 		return;
5379 	}
5380 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
5381 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5382 
5383 	if (!is_hw_scan) {
5384 		struct ieee80211_scan_state *ss;
5385 		struct ieee80211vap *vap;
5386 		struct ieee80211_hw *hw;
5387 		struct lkpi_vif *lvif;
5388 		struct ieee80211_vif *vif;
5389 
5390 		ss = ic->ic_scan;
5391 		vap = ss->ss_vap;
5392 		hw = LHW_TO_HW(lhw);
5393 		lvif = VAP_TO_LVIF(vap);
5394 		vif = LVIF_TO_VIF(lvif);
5395 
5396 		lkpi_80211_mo_sw_scan_complete(hw, vif);
5397 
5398 		/* Send PS to stop buffering if n80211 does not for us? */
5399 
5400 		if (vap->iv_state == IEEE80211_S_SCAN) {
5401 			wiphy_lock(hw->wiphy);
5402 			lkpi_hw_conf_idle(hw, true);
5403 			wiphy_unlock(hw->wiphy);
5404 		}
5405 	}
5406 
5407 	/*
5408 	 * In case we disabled the hw_scan in lkpi_ic_scan_start() and
5409 	 * switched to swscan, re-enable hw_scan if available.
5410 	 */
5411 	lkpi_enable_hw_scan(lhw);
5412 
5413 	/* Clear the scanning chandef. */
5414 	memset(&lhw->scan_chandef, 0, sizeof(lhw->scan_chandef));
5415 
5416 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5417 	wakeup(lhw);
5418 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5419 }
5420 
5421 static void
5422 lkpi_ic_scan_curchan(struct ieee80211_scan_state *ss,
5423     unsigned long maxdwell)
5424 {
5425 	struct lkpi_hw *lhw;
5426 	bool is_hw_scan;
5427 
5428 	lhw = ss->ss_ic->ic_softc;
5429 	TRACE_SCAN(ss->ss_ic, "scan_flags %b chan %d maxdwell %lu",
5430 	    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
5431 	    ss->ss_ic->ic_curchan->ic_ieee, maxdwell);
5432 
5433 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5434 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
5435 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5436 	if (!is_hw_scan)
5437 		lhw->ic_scan_curchan(ss, maxdwell);
5438 }
5439 
5440 static void
5441 lkpi_ic_scan_mindwell(struct ieee80211_scan_state *ss)
5442 {
5443 	struct lkpi_hw *lhw;
5444 	bool is_hw_scan;
5445 
5446 	lhw = ss->ss_ic->ic_softc;
5447 	TRACE_SCAN(ss->ss_ic, "scan_flags %b chan %d mindwell %lu",
5448 	    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
5449 	    ss->ss_ic->ic_curchan->ic_ieee, ss->ss_mindwell);
5450 
5451 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5452 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
5453 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5454 	if (!is_hw_scan)
5455 		lhw->ic_scan_mindwell(ss);
5456 }
5457 
5458 struct lkpi_ic_set_channel_iter_arg {
5459 	struct linuxkpi_ieee80211_channel *chan;
5460 	struct ieee80211_chanctx_conf *chanctx_conf;
5461 };
5462 
5463 static void
5464 lkpi_ic_set_channel_chanctx_iterf(struct ieee80211_hw *hw,
5465     struct ieee80211_chanctx_conf *chanctx_conf, void *arg)
5466 {
5467 	struct lkpi_ic_set_channel_iter_arg *chanctx_iter_arg;
5468 
5469 	chanctx_iter_arg = arg;
5470 	if (chanctx_iter_arg->chanctx_conf != NULL)
5471 		return;
5472 
5473 	if (chanctx_iter_arg->chan == chanctx_conf->def.chan)
5474 		chanctx_iter_arg->chanctx_conf = chanctx_conf;
5475 }
5476 
5477 static void
5478 lkpi_ic_set_channel(struct ieee80211com *ic)
5479 {
5480 	struct lkpi_hw *lhw;
5481 	struct ieee80211_hw *hw;
5482 	struct ieee80211_channel *c;
5483 	struct linuxkpi_ieee80211_channel *chan;
5484 	struct ieee80211_chanctx_conf *chanctx_conf;
5485 	uint32_t changed;
5486 	int error;
5487 	bool hw_scan, scan_running;
5488 
5489 	IEEE80211_UNLOCK_ASSERT(ic);
5490 
5491 	lhw = ic->ic_softc;
5492 
5493 	c = ic->ic_curchan;
5494 	if (c == NULL || c == IEEE80211_CHAN_ANYC) {
5495 		ic_printf(ic, "%s: Unset channel: c %p, ignoring update\n",
5496 		    __func__, c);
5497 		return;
5498 	}
5499 
5500 	chan = lkpi_find_lkpi80211_chan(lhw, c);
5501 	if (chan == NULL) {
5502 		ic_printf(ic, "%s: No channel found for c %p(%d) chan %p\n",
5503 		    __func__, c, c->ic_ieee, chan);
5504 		return;
5505 	}
5506 
5507 	/*
5508 	 * All net80211 callers call ieee80211_radiotap_chan_change().
5509 	 * That means we have nothing to do ourselves.
5510 	 */
5511 
5512 	/* If we have a hw_scan running do not switch channels. */
5513 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5514 	scan_running = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
5515 	hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
5516 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5517 	if (scan_running && hw_scan) {
5518 		TRACE_SCAN(ic, "scan_flags %b chan %d nothing to do.",
5519 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
5520 		    c->ic_ieee);
5521 		/* Let us hope we set tx power levels elsewhere. */
5522 		return;
5523 	}
5524 
5525 	hw = LHW_TO_HW(lhw);
5526 	wiphy_lock(hw->wiphy);
5527 	if (scan_running) {
5528 		struct ieee80211vap *vap;
5529 		struct lkpi_vif *lvif;
5530 		struct ieee80211_vif *vif;
5531 
5532 		/*
5533 		 * For now and for scanning just pick the first VIF.
5534 		 * net80211 will need to grow DBDC/link_id support
5535 		 * for us to find the vif/chanctx otherwise.
5536 		 */
5537 		vap = TAILQ_FIRST(&ic->ic_vaps);
5538 		lvif = VAP_TO_LVIF(vap);
5539 		vif = LVIF_TO_VIF(lvif);
5540 
5541 		/* We always set the chandef to no-HT for scanning. */
5542 		cfg80211_chandef_create(&lhw->scan_chandef, chan,
5543 		    NL80211_CHAN_NO_HT);
5544 #ifdef LINUXKPI_DEBUG_80211
5545 		if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
5546 			ic_printf(ic, "%s:%d: initialized lhw->scan_chandef\n",
5547 			    __func__, __LINE__);
5548 #endif
5549 
5550 		/*
5551 		 * This works for as long as we do not do BGSCANs; otherwise
5552 		 * it'll have to be offchan work.
5553 		 */
5554 		chanctx_conf = lkpi_get_chanctx_conf(hw, vif);
5555 		changed = lkpi_init_chanctx_conf(hw, &lhw->scan_chandef, chanctx_conf);
5556 		error = lkpi_set_chanctx_conf(hw, vif, chanctx_conf, changed, true);
5557 
5558 		TRACE_SCAN(ic, "scan_flags %b chan %d ???, error %d",
5559 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
5560 		    c->ic_ieee, error);
5561 
5562 		IMPROVE("max power for scanning; TODO in lkpi_80211_update_chandef");
5563 
5564 	} else if (lhw->emulate_chanctx) {
5565 		/*
5566 		 * We do not set the channel here for normal chanctx operation.
5567 		 * That's just a setup to fail. scan_to_auth will setup all the
5568 		 * other neccessary options for this to work.
5569 		 */
5570 		struct lkpi_ic_set_channel_iter_arg chanctx_iter_arg = {
5571 			.chan		= chan,
5572 			.chanctx_conf	= NULL,
5573 		};
5574 		struct cfg80211_chan_def chandef;
5575 
5576 		lkpi_init_chandef(ic, &chandef, chan, c, false);
5577 
5578 		ieee80211_iter_chan_contexts_mtx(hw,
5579 		    lkpi_ic_set_channel_chanctx_iterf, &chanctx_iter_arg);
5580 
5581 		if (chanctx_iter_arg.chanctx_conf == NULL) {
5582 			/* No chanctx found for this channel. */
5583 			struct ieee80211vap *vap;
5584 			struct lkpi_vif *lvif;
5585 			struct ieee80211_vif *vif;
5586 
5587 			/*
5588 			 * For now just pick the first VIF.
5589 			 * net80211 will need to grow DBDC/link_id support
5590 			 * for us to find the vif/chanctx otherwise.
5591 			 */
5592 			vap = TAILQ_FIRST(&ic->ic_vaps);
5593 			lvif = VAP_TO_LVIF(vap);
5594 			vif = LVIF_TO_VIF(lvif);
5595 
5596 #ifdef LINUXKPI_DEBUG_80211
5597 			if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
5598 				ic_printf(ic, "%s:%d: using on stack chandef\n",
5599 				    __func__, __LINE__);
5600 #endif
5601 			chanctx_conf = lkpi_get_chanctx_conf(hw, vif);
5602 			changed = lkpi_init_chanctx_conf(hw, &chandef, chanctx_conf);
5603 			IMPROVE("update HT, VHT, bw, ...");
5604 			error = lkpi_set_chanctx_conf(hw, vif, chanctx_conf, changed, true);
5605 
5606 		} else {
5607 			/*
5608 			 * We know we are on the same channel.
5609 			 * Do we really have to reset everything?
5610 			 */
5611 			IMPROVE("update HT, VHT, bw, ...");
5612 
5613 #ifdef LINUXKPI_DEBUG_80211
5614 			if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
5615 				ic_printf(ic, "%s:%d: using on stack chandef\n",
5616 				    __func__, __LINE__);
5617 #endif
5618 
5619 			chanctx_conf = chanctx_iter_arg.chanctx_conf;
5620 			changed = lkpi_init_chanctx_conf(hw, &chandef, chanctx_conf);
5621 			lkpi_80211_mo_change_chanctx(hw, chanctx_conf, changed);
5622 		}
5623 	}
5624 
5625 	/* Currently PS is hard coded off! Not sure it belongs here. */
5626 	IMPROVE("PS");
5627 	if (ieee80211_hw_check(hw, SUPPORTS_PS) &&
5628 	    (hw->conf.flags & IEEE80211_CONF_PS) != 0) {
5629 		hw->conf.flags &= ~IEEE80211_CONF_PS;
5630 		error = lkpi_80211_mo_config(hw, IEEE80211_CONF_CHANGE_PS);
5631 		if (error != 0 && error != EOPNOTSUPP)
5632 			ic_printf(ic, "ERROR: %s: config %#0x returned "
5633 			    "%d\n", __func__, IEEE80211_CONF_CHANGE_PS,
5634 			    error);
5635 	}
5636 
5637 	wiphy_unlock(hw->wiphy);
5638 }
5639 
5640 static struct ieee80211_node *
5641 lkpi_ic_node_alloc(struct ieee80211vap *vap,
5642     const uint8_t mac[IEEE80211_ADDR_LEN])
5643 {
5644 	struct ieee80211com *ic;
5645 	struct lkpi_hw *lhw;
5646 	struct ieee80211_node *ni;
5647 	struct ieee80211_hw *hw;
5648 	struct lkpi_sta *lsta;
5649 
5650 	ic = vap->iv_ic;
5651 	lhw = ic->ic_softc;
5652 
5653 	/* We keep allocations de-coupled so we can deal with the two worlds. */
5654 	if (lhw->ic_node_alloc == NULL)
5655 		return (NULL);
5656 
5657 	ni = lhw->ic_node_alloc(vap, mac);
5658 	if (ni == NULL)
5659 		return (NULL);
5660 
5661 	hw = LHW_TO_HW(lhw);
5662 	lsta = lkpi_lsta_alloc(vap, mac, hw, ni);
5663 	if (lsta == NULL) {
5664 		if (lhw->ic_node_free != NULL)
5665 			lhw->ic_node_free(ni);
5666 		return (NULL);
5667 	}
5668 
5669 	return (ni);
5670 }
5671 
5672 static int
5673 lkpi_ic_node_init(struct ieee80211_node *ni)
5674 {
5675 	struct ieee80211com *ic;
5676 	struct lkpi_hw *lhw;
5677 	int error;
5678 
5679 	ic = ni->ni_ic;
5680 	lhw = ic->ic_softc;
5681 
5682 	if (lhw->ic_node_init != NULL) {
5683 		error = lhw->ic_node_init(ni);
5684 		if (error != 0)
5685 			return (error);
5686 	}
5687 
5688 	/* XXX-BZ Sync other state over. */
5689 	IMPROVE();
5690 
5691 	return (0);
5692 }
5693 
5694 static void
5695 lkpi_ic_node_cleanup(struct ieee80211_node *ni)
5696 {
5697 	struct ieee80211com *ic;
5698 	struct lkpi_hw *lhw;
5699 
5700 	ic = ni->ni_ic;
5701 	lhw = ic->ic_softc;
5702 
5703 	/* XXX-BZ remove from driver, ... */
5704 	IMPROVE();
5705 
5706 	if (lhw->ic_node_cleanup != NULL)
5707 		lhw->ic_node_cleanup(ni);
5708 }
5709 
5710 static void
5711 lkpi_ic_node_free(struct ieee80211_node *ni)
5712 {
5713 	struct ieee80211com *ic;
5714 	struct lkpi_hw *lhw;
5715 	struct lkpi_sta *lsta;
5716 
5717 	ic = ni->ni_ic;
5718 	lhw = ic->ic_softc;
5719 	lsta = ni->ni_drv_data;
5720 
5721 	/* KASSERT lsta is not NULL here. Print ni/ni__refcnt. */
5722 
5723 	/*
5724 	 * Pass in the original ni just in case of error we could check that
5725 	 * it is the same as lsta->ni.
5726 	 */
5727 	lkpi_lsta_free(lsta, ni);
5728 
5729 	if (lhw->ic_node_free != NULL)
5730 		lhw->ic_node_free(ni);
5731 }
5732 
5733 /*
5734  * lkpi_xmit() called from both the (*ic_raw_xmit) as well as the (*ic_transmit)
5735  * call path.
5736  * Unfortunately they have slightly different invariants.  See
5737  * ieee80211_raw_output() and ieee80211_parent_xmitpkt().
5738  * Both take care of the ni reference in case of error, and otherwise during
5739  * the callback after transmit.
5740  * The difference is that in case of error (*ic_raw_xmit) needs us to release
5741  * the mbuf, while (*ic_transmit) will free the mbuf itself.
5742  */
5743 static int
5744 lkpi_xmit(struct ieee80211_node *ni, struct mbuf *m,
5745     const struct ieee80211_bpf_params *params __unused,
5746     bool freem)
5747 {
5748 	struct lkpi_sta *lsta;
5749 	int error;
5750 
5751 	lsta = ni->ni_drv_data;
5752 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
5753 #if 0
5754 	if (!lsta->added_to_drv || !lsta->txq_ready) {
5755 #else
5756 	/*
5757 	 * Backout this part of 886653492945f which breaks rtw88 or
5758 	 * in general drivers without (*sta_state)() but only the
5759 	 * legacy fallback to (*sta_add)().
5760 	 */
5761 	if (!lsta->txq_ready) {
5762 #endif
5763 		LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
5764 		if (freem)
5765 			m_freem(m);
5766 		return (ENETDOWN);
5767 	}
5768 
5769 	/* Queue the packet and enqueue the task to handle it. */
5770 	error = mbufq_enqueue(&lsta->txq, m);
5771 	if (error != 0) {
5772 		LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
5773 		if (freem)
5774 			m_freem(m);
5775 #ifdef LINUXKPI_DEBUG_80211
5776 		if (linuxkpi_debug_80211 & D80211_TRACE_TX)
5777 			ic_printf(ni->ni_ic, "%s: mbufq_enqueue failed: %d\n",
5778 			    __func__, error);
5779 #endif
5780 		return (ENETDOWN);
5781 	}
5782 	taskqueue_enqueue(taskqueue_thread, &lsta->txq_task);
5783 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
5784 
5785 #ifdef LINUXKPI_DEBUG_80211
5786 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
5787 		printf("%s:%d lsta %p ni %p %6D mbuf_qlen %d\n",
5788 		    __func__, __LINE__, lsta, ni, ni->ni_macaddr, ":",
5789 		    mbufq_len(&lsta->txq));
5790 #endif
5791 
5792 	return (0);
5793 }
5794 
5795 static int
5796 lkpi_ic_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
5797         const struct ieee80211_bpf_params *params __unused)
5798 {
5799 	return (lkpi_xmit(ni, m, NULL, true));
5800 }
5801 
5802 #ifdef LKPI_80211_HW_CRYPTO
5803 /*
5804  * This is a bit of a hack given we know we are operating on a
5805  * single frame and we know that hardware will deal with it.
5806  * But otherwise the enmic bit and the encrypt bit need to be
5807  * decoupled.
5808  */
5809 static int
5810 lkpi_hw_crypto_prepare_tkip(struct ieee80211_key *k,
5811     struct ieee80211_key_conf *kc, struct sk_buff *skb)
5812 {
5813 	struct ieee80211_hdr *hdr;
5814 	uint32_t hlen, hdrlen;
5815 	uint8_t *p;
5816 
5817 	/*
5818 	 * TKIP only happens on data.
5819 	 */
5820 	hdr = (void *)skb->data;
5821 	if (!ieee80211_is_data_present(hdr->frame_control))
5822 		return (0);
5823 
5824 	/*
5825 	 * "enmic" (though we do not do that).
5826 	 */
5827 	/* any conditions to not apply this? */
5828 	if (skb_tailroom(skb) < ieee80211_crypto_get_key_txmic_len(k))
5829 		return (ENOBUFS);
5830 
5831 	p = skb_put(skb, ieee80211_crypto_get_key_txmic_len(k));
5832 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_MIC_SPACE) != 0)
5833 		goto encrypt;
5834 
5835 	/*
5836 	 * (*enmic) which we hopefully do not have to do with hw accel.
5837 	 * That means if we make it here we have a problem.
5838 	 */
5839 	TODO("(*enmic)");
5840 	return (ENXIO);
5841 
5842 encrypt:
5843 	/*
5844 	 * "encrypt" (though we do not do that).
5845 	 */
5846 	/*
5847 	 * Check if we have anything to do as requested by driver
5848 	 * or if we are done?
5849 	 */
5850 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) == 0 &&
5851 	    (kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV) == 0)
5852 			return (0);
5853 
5854 	hlen = k->wk_cipher->ic_header;
5855 	if (skb_headroom(skb) < hlen)
5856 		return (ENOBUFS);
5857 
5858 	hdr = (void *)skb->data;
5859 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
5860 	p = skb_push(skb, hlen);
5861 	memmove(p, p + hlen, hdrlen);
5862 
5863 	/* If driver request space only we are done. */
5864 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) != 0)
5865 		return (0);
5866 
5867 	p += hdrlen;
5868 	k->wk_cipher->ic_setiv(k, p);
5869 
5870 	/* If we make it hear we do sw encryption. */
5871 	TODO("sw encrypt");
5872 	return (ENXIO);
5873 }
5874 
5875 static int
5876 lkpi_hw_crypto_prepare_ccmp(struct ieee80211_key *k,
5877     struct ieee80211_key_conf *kc, struct sk_buff *skb)
5878 {
5879 	struct ieee80211_hdr *hdr;
5880 	uint32_t hlen, hdrlen;
5881 	uint8_t *p;
5882 
5883 	hdr = (void *)skb->data;
5884 
5885 	/*
5886 	 * Check if we have anythig to do as requested by driver
5887 	 * or if we are done?
5888 	 */
5889 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) == 0 &&
5890 	    (kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV) == 0 &&
5891 	    /* MFP */
5892 	    !((kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) != 0 &&
5893 		ieee80211_is_mgmt(hdr->frame_control)))
5894 			return (0);
5895 
5896 	hlen = k->wk_cipher->ic_header;
5897 	if (skb_headroom(skb) < hlen)
5898 		return (ENOBUFS);
5899 
5900 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
5901 	p = skb_push(skb, hlen);
5902 	memmove(p, p + hlen, hdrlen);
5903 
5904 	/* If driver request space only we are done. */
5905 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) != 0)
5906 		return (0);
5907 
5908 	p += hdrlen;
5909 	k->wk_cipher->ic_setiv(k, p);
5910 
5911 	return (0);
5912 }
5913 
5914 static int
5915 lkpi_hw_crypto_prepare(struct lkpi_sta *lsta, struct ieee80211_key *k,
5916     struct sk_buff *skb)
5917 {
5918 	struct ieee80211_tx_info *info;
5919 	struct ieee80211_key_conf *kc;
5920 
5921 	KASSERT(lsta != NULL, ("%s: lsta is NULL", __func__));
5922 	KASSERT(k != NULL, ("%s: key is NULL", __func__));
5923 	KASSERT(skb != NULL, ("%s: skb is NULL", __func__));
5924 
5925 	kc = lsta->kc[k->wk_keyix];
5926 
5927 	info = IEEE80211_SKB_CB(skb);
5928 	info->control.hw_key = kc;
5929 
5930 	/* MUST NOT happen. KASSERT? */
5931 	if (kc == NULL) {
5932 		ic_printf(lsta->ni->ni_ic, "%s: lsta %p k %p skb %p, "
5933 		    "kc is NULL on hw crypto offload\n", __func__, lsta, k, skb);
5934 		return (ENXIO);
5935 	}
5936 
5937 	switch (kc->cipher) {
5938 	case WLAN_CIPHER_SUITE_TKIP:
5939 		return (lkpi_hw_crypto_prepare_tkip(k, kc, skb));
5940 	case WLAN_CIPHER_SUITE_CCMP:
5941 		return (lkpi_hw_crypto_prepare_ccmp(k, kc, skb));
5942 	case WLAN_CIPHER_SUITE_GCMP:
5943 		return (lkpi_hw_crypto_prepare_ccmp(k, kc, skb));
5944 	case WLAN_CIPHER_SUITE_WEP40:
5945 	case WLAN_CIPHER_SUITE_WEP104:
5946 	case WLAN_CIPHER_SUITE_CCMP_256:
5947 	case WLAN_CIPHER_SUITE_GCMP_256:
5948 	case WLAN_CIPHER_SUITE_AES_CMAC:
5949 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
5950 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
5951 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
5952 	default:
5953 		ic_printf(lsta->ni->ni_ic, "%s: lsta %p k %p kc %p skb %p, "
5954 		    "unsupported cipher suite %u (%s)\n", __func__, lsta, k, kc,
5955 		    skb, kc->cipher, lkpi_cipher_suite_to_name(kc->cipher));
5956 		return (EOPNOTSUPP);
5957 	}
5958 }
5959 
5960 static uint8_t
5961 lkpi_hw_crypto_tailroom(struct lkpi_sta *lsta, struct ieee80211_key *k)
5962 {
5963 	struct ieee80211_key_conf *kc;
5964 
5965 	kc = lsta->kc[k->wk_keyix];
5966 	if (kc == NULL)
5967 		return (0);
5968 
5969 	IMPROVE("which other flags need tailroom?");
5970 	if (kc->flags & (IEEE80211_KEY_FLAG_PUT_MIC_SPACE))
5971 		return (32);	/* Large enough to hold everything and pow2. */
5972 
5973 	return (0);
5974 }
5975 #endif
5976 
5977 static void
5978 lkpi_80211_txq_tx_one(struct lkpi_sta *lsta, struct mbuf *m)
5979 {
5980 	struct ieee80211_node *ni;
5981 	struct ieee80211_frame *wh;
5982 	struct ieee80211_key *k;
5983 	struct sk_buff *skb;
5984 	struct ieee80211com *ic;
5985 	struct lkpi_hw *lhw;
5986 	struct ieee80211_hw *hw;
5987 	struct lkpi_vif *lvif;
5988 	struct ieee80211_vif *vif;
5989 	struct ieee80211_channel *c;
5990 	struct ieee80211_tx_control control;
5991 	struct ieee80211_tx_info *info;
5992 	struct ieee80211_sta *sta;
5993 	struct ieee80211_hdr *hdr;
5994 	struct lkpi_txq *ltxq;
5995 	void *buf;
5996 	ieee80211_keyix keyix;
5997 	uint8_t ac, tid, tailroom;
5998 
5999 	M_ASSERTPKTHDR(m);
6000 #ifdef LINUXKPI_DEBUG_80211
6001 	if (linuxkpi_debug_80211 & D80211_TRACE_TX_DUMP)
6002 		hexdump(mtod(m, const void *), m->m_len, "RAW TX (plain) ", 0);
6003 #endif
6004 
6005 	ni = lsta->ni;
6006 	ieee80211_output_seqno_assign(ni, -1, m);
6007 
6008 	k = NULL;
6009 	keyix = IEEE80211_KEYIX_NONE;
6010 	wh = mtod(m, struct ieee80211_frame *);
6011 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
6012 
6013 #ifdef LKPI_80211_HW_CRYPTO
6014 		if (lkpi_hwcrypto) {
6015 			k = ieee80211_crypto_get_txkey(ni, m);
6016 			if (k != NULL && lsta->kc[k->wk_keyix] != NULL)
6017 				keyix = k->wk_keyix;
6018 		}
6019 #endif
6020 
6021 		/* Encrypt the frame if need be. */
6022 		if (keyix == IEEE80211_KEYIX_NONE) {
6023 			/* Retrieve key for TX && do software encryption. */
6024 			k = ieee80211_crypto_encap(ni, m);
6025 			if (k == NULL) {
6026 				ieee80211_free_node(ni);
6027 				m_freem(m);
6028 				return;
6029 			}
6030 		}
6031 	}
6032 
6033 	ic = ni->ni_ic;
6034 	lhw = ic->ic_softc;
6035 	hw = LHW_TO_HW(lhw);
6036 	c = ni->ni_chan;
6037 
6038 	if (ieee80211_radiotap_active_vap(ni->ni_vap)) {
6039 		struct lkpi_radiotap_tx_hdr *rtap;
6040 
6041 		rtap = &lhw->rtap_tx;
6042 		rtap->wt_flags = 0;
6043 		if (k != NULL)
6044 			rtap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6045 		if (m->m_flags & M_FRAG)
6046 			rtap->wt_flags |= IEEE80211_RADIOTAP_F_FRAG;
6047 		IMPROVE();
6048 		rtap->wt_rate = 0;
6049 		if (c != NULL && c != IEEE80211_CHAN_ANYC) {
6050 			rtap->wt_chan_freq = htole16(c->ic_freq);
6051 			rtap->wt_chan_flags = htole16(c->ic_flags);
6052 		}
6053 
6054 		ieee80211_radiotap_tx(ni->ni_vap, m);
6055 	}
6056 
6057 #ifdef LKPI_80211_HW_CRYPTO
6058 	if (lkpi_hwcrypto && keyix != IEEE80211_KEYIX_NONE)
6059 		tailroom = lkpi_hw_crypto_tailroom(lsta, k);
6060 	else
6061 #endif
6062 		tailroom = 0;
6063 
6064 	/*
6065 	 * net80211 should handle hw->extra_tx_headroom.
6066 	 * Though for as long as we are copying we don't mind.
6067 	 * XXX-BZ rtw88 asks for too much headroom for ipv6+tcp:
6068 	 * https://lists.freebsd.org/archives/freebsd-transport/2022-February/000012.html
6069 	 */
6070 	skb = dev_alloc_skb(hw->extra_tx_headroom + tailroom + m->m_pkthdr.len);
6071 	if (skb == NULL) {
6072 		static uint8_t skb_alloc_failures = 0;
6073 
6074 		if (skb_alloc_failures++ == 0) {
6075 			int tid;
6076 
6077 			sta = LSTA_TO_STA(lsta);
6078 			ic_printf(ic, "ERROR %s: skb alloc failed %d + %d, lsta %p sta %p ni %p\n",
6079 			    __func__, hw->extra_tx_headroom, m->m_pkthdr.len, lsta, sta, ni);
6080 			for (tid = 0; tid < nitems(sta->txq); tid++) {
6081 				if (sta->txq[tid] == NULL)
6082 					continue;
6083 				ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
6084 				ic_printf(ic, "  tid %d ltxq %p flags %b skb_queue_len %u\n",
6085 				    tid, ltxq, ltxq->flags, LKPI_TXQ_FLAGS_BITS, skb_queue_len(&ltxq->skbq));
6086 			}
6087 		}
6088 		ieee80211_free_node(ni);
6089 		m_freem(m);
6090 		return;
6091 	}
6092 	skb_reserve(skb, hw->extra_tx_headroom);
6093 
6094 	/* XXX-BZ we need a SKB version understanding mbuf. */
6095 	/* Save the mbuf for ieee80211_tx_complete(). */
6096 	skb->m_free_func = lkpi_ieee80211_free_skb_mbuf;
6097 	skb->m = m;
6098 #if 0
6099 	skb_put_data(skb, m->m_data, m->m_pkthdr.len);
6100 #else
6101 	buf = skb_put(skb, m->m_pkthdr.len);
6102 	m_copydata(m, 0, m->m_pkthdr.len, buf);
6103 #endif
6104 	/* Save the ni. */
6105 	m->m_pkthdr.PH_loc.ptr = ni;
6106 
6107 	lvif = VAP_TO_LVIF(ni->ni_vap);
6108 	vif = LVIF_TO_VIF(lvif);
6109 
6110 	hdr = (void *)skb->data;
6111 	tid = linuxkpi_ieee80211_get_tid(hdr, true);
6112 	if (tid == IEEE80211_NONQOS_TID) { /* == IEEE80211_NUM_TIDS */
6113 		if (!ieee80211_is_data(hdr->frame_control)) {
6114 			/* MGMT and CTRL frames go on TID 7/VO. */
6115 			skb->priority = 7;
6116 			ac = IEEE80211_AC_VO;
6117 		} else {
6118 			/* Other non-QOS traffic goes to BE. */
6119 			/* Contrary to net80211 we MUST NOT promote M_EAPOL. */
6120 			skb->priority = 0;
6121 			ac = IEEE80211_AC_BE;
6122 		}
6123 	} else {
6124 		skb->priority = tid & IEEE80211_QOS_CTL_TID_MASK;
6125 		ac = ieee80211e_up_to_ac[tid & 7];
6126 	}
6127 	skb_set_queue_mapping(skb, ac);
6128 
6129 	info = IEEE80211_SKB_CB(skb);
6130 	info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
6131 	/* Slight delay; probably only happens on scanning so fine? */
6132 	if (c == NULL || c == IEEE80211_CHAN_ANYC)
6133 		c = ic->ic_curchan;
6134 	info->band = lkpi_net80211_chan_to_nl80211_band(c);
6135 	info->hw_queue = vif->hw_queue[ac];
6136 	if ((m->m_flags & M_EAPOL) != 0) {
6137 		info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
6138 		info->flags |= IEEE80211_TX_CTL_USE_MINRATE;	/* mt76 */
6139 		TRACE_RATES("M_EAPOL -> TX_CTL_USE_MINRATE");
6140 	}
6141 	info->control.vif = vif;
6142 
6143 	/* IMPROVE("MLO"); */
6144 	info->control.flags |=
6145 	    u32_encode_bits(IEEE80211_LINK_UNSPECIFIED, IEEE80211_TX_CTRL_MLO_LINK);
6146 
6147 	if (tid != IEEE80211_NONQOS_TID) {
6148 		struct ieee80211_tx_ampdu *tap;
6149 
6150 		tap = &ni->ni_tx_ampdu[tid];
6151 		if (ieee80211_is_data_qos(hdr->frame_control) &&
6152 		    !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
6153 		    !is_multicast_ether_addr(hdr->addr1) &&
6154 		    IEEE80211_AMPDU_RUNNING(tap))
6155 			info->flags |= IEEE80211_TX_CTL_AMPDU;
6156 	}
6157 
6158 	/* XXX-BZ info->control.rates for non-HW rate control and injected packets. */
6159 #ifdef __notyet__
6160 #ifdef LKPI_80211_HT
6161 	info->control.rts_cts_rate_idx=
6162 	info->control.use_rts= /* RTS */
6163 	info->control.use_cts_prot= /* RTS/CTS*/
6164 #endif
6165 #endif
6166 
6167 	sta = LSTA_TO_STA(lsta);
6168 #ifdef LKPI_80211_HW_CRYPTO
6169 	if (lkpi_hwcrypto && keyix != IEEE80211_KEYIX_NONE) {
6170 		int error;
6171 
6172 		error = lkpi_hw_crypto_prepare(lsta, k, skb);
6173 		if (error != 0) {
6174 			/*
6175 			 * We only have to free the skb which will free the
6176 			 * mbuf and release the reference on the ni.
6177 			 */
6178 			dev_kfree_skb(skb);
6179 			return;
6180 		}
6181 		/* Reset header as data might have moved. */
6182 		hdr = (void *)skb->data;
6183 	}
6184 #endif
6185 
6186 	IMPROVE();
6187 
6188 	ltxq = NULL;
6189 	if (!ieee80211_is_data_present(hdr->frame_control)) {
6190 		if (vif->type == NL80211_IFTYPE_STATION &&
6191 		    lsta->added_to_drv &&
6192 		    sta->txq[IEEE80211_NUM_TIDS] != NULL)
6193 			ltxq = TXQ_TO_LTXQ(sta->txq[IEEE80211_NUM_TIDS]);
6194 	} else if (lsta->added_to_drv &&
6195 	    sta->txq[skb->priority] != NULL) {
6196 		ltxq = TXQ_TO_LTXQ(sta->txq[skb->priority]);
6197 	}
6198 	if (ltxq == NULL)
6199 		goto ops_tx;
6200 
6201 	KASSERT(ltxq != NULL, ("%s: lsta %p sta %p m %p skb %p "
6202 	    "ltxq %p != NULL\n", __func__, lsta, sta, m, skb, ltxq));
6203 
6204 	LKPI_80211_LTXQ_LOCK(ltxq);
6205 	skb_queue_tail(&ltxq->skbq, skb);
6206 	ltxq->frms_enqueued++;
6207 #ifdef LINUXKPI_DEBUG_80211
6208 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
6209 		printf("%s:%d mo_wake_tx_queue :: %d %lu lsta %p sta %p "
6210 		    "ni %p %6D skb %p lxtq %p { qlen %u, ac %d tid %u } "
6211 		    "WAKE_TX_Q ac %d prio %u qmap %u\n",
6212 		    __func__, __LINE__,
6213 		    curthread->td_tid, jiffies,
6214 		    lsta, sta, ni, ni->ni_macaddr, ":", skb, ltxq,
6215 		    skb_queue_len(&ltxq->skbq), ltxq->txq.ac,
6216 		    ltxq->txq.tid, ac, skb->priority, skb->qmap);
6217 #endif
6218 	LKPI_80211_LTXQ_UNLOCK(ltxq);
6219 	wiphy_lock(hw->wiphy);
6220 	lkpi_80211_mo_wake_tx_queue(hw, &ltxq->txq, true);
6221 	wiphy_unlock(hw->wiphy);
6222 	return;
6223 
6224 ops_tx:
6225 #ifdef LINUXKPI_DEBUG_80211
6226 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
6227 		printf("%s:%d mo_tx :: lsta %p sta %p ni %p %6D skb %p "
6228 		    "TX ac %d prio %u qmap %u\n",
6229 		    __func__, __LINE__, lsta, sta, ni, ni->ni_macaddr, ":",
6230 		    skb, ac, skb->priority, skb->qmap);
6231 #endif
6232 	memset(&control, 0, sizeof(control));
6233 	control.sta = sta;
6234 	wiphy_lock(hw->wiphy);
6235 	lkpi_80211_mo_tx(hw, &control, skb);
6236 	lsta->frms_tx++;
6237 	wiphy_unlock(hw->wiphy);
6238 }
6239 
6240 static void
6241 lkpi_80211_txq_task(void *ctx, int pending)
6242 {
6243 	struct lkpi_sta *lsta;
6244 	struct mbufq mq;
6245 	struct mbuf *m;
6246 	bool shall_tx;
6247 
6248 	lsta = ctx;
6249 
6250 #ifdef LINUXKPI_DEBUG_80211
6251 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
6252 		printf("%s:%d lsta %p ni %p %6D pending %d mbuf_qlen %d\n",
6253 		    __func__, __LINE__, lsta, lsta->ni, lsta->ni->ni_macaddr, ":",
6254 		    pending, mbufq_len(&lsta->txq));
6255 #endif
6256 
6257 	mbufq_init(&mq, IFQ_MAXLEN);
6258 
6259 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
6260 	/*
6261 	 * Do not re-check lsta->txq_ready here; we may have a pending
6262 	 * disassoc/deauth frame still.  On the contrary if txq_ready is
6263 	 * false we do not have a valid sta anymore in the firmware so no
6264 	 * point to try to TX.
6265 	 * We also use txq_ready as a semaphore and will drain the txq manually
6266 	 * if needed on our way towards SCAN/INIT in the state machine.
6267 	 */
6268 #if 0
6269 	shall_tx = lsta->added_to_drv && lsta->txq_ready;
6270 #else
6271 	/*
6272 	 * Backout this part of 886653492945f which breaks rtw88 or
6273 	 * in general drivers without (*sta_state)() but only the
6274 	 * legacy fallback to (*sta_add)().
6275 	 */
6276 	shall_tx = lsta->txq_ready;
6277 #endif
6278 	if (__predict_true(shall_tx))
6279 		mbufq_concat(&mq, &lsta->txq);
6280 	/*
6281 	 * else a state change will push the packets out manually or
6282 	 * lkpi_lsta_free() will drain the lsta->txq and free the mbufs.
6283 	 */
6284 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
6285 
6286 	m = mbufq_dequeue(&mq);
6287 	while (m != NULL) {
6288 		lkpi_80211_txq_tx_one(lsta, m);
6289 		m = mbufq_dequeue(&mq);
6290 	}
6291 }
6292 
6293 static int
6294 lkpi_ic_transmit(struct ieee80211com *ic, struct mbuf *m)
6295 {
6296 
6297 	/* XXX TODO */
6298 	IMPROVE();
6299 
6300 	/* Quick and dirty cheating hack. */
6301 	struct ieee80211_node *ni;
6302 
6303 	ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
6304 	return (lkpi_xmit(ni, m, NULL, false));
6305 }
6306 
6307 #ifdef LKPI_80211_HT
6308 static int
6309 lkpi_ic_recv_action(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
6310     const uint8_t *frm, const uint8_t *efrm)
6311 {
6312 	struct ieee80211com *ic;
6313 	struct lkpi_hw *lhw;
6314 
6315 	ic = ni->ni_ic;
6316 	lhw = ic->ic_softc;
6317 
6318 	TRACEOK("recv_action called");
6319 
6320 	return (lhw->ic_recv_action(ni, wh, frm, efrm));
6321 }
6322 
6323 static int
6324 lkpi_ic_send_action(struct ieee80211_node *ni, int category, int action, void *sa)
6325 {
6326 	struct ieee80211com *ic;
6327 	struct lkpi_hw *lhw;
6328 
6329 	ic = ni->ni_ic;
6330 	lhw = ic->ic_softc;
6331 
6332 	TRACEOK("send_action with action %d called", action);
6333 
6334 	return (lhw->ic_send_action(ni, category, action, sa));
6335 }
6336 
6337 
6338 static int
6339 lkpi_ic_ampdu_enable(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
6340 {
6341 	struct ieee80211com *ic;
6342 	struct lkpi_hw *lhw;
6343 
6344 	ic = ni->ni_ic;
6345 	lhw = ic->ic_softc;
6346 
6347 	TRACEOK("ieee80211_ampdu_enable called");
6348 
6349 	return (lhw->ic_ampdu_enable(ni, tap));
6350 }
6351 
6352 /*
6353  * (*ic_addba_request)() is called by ieee80211_ampdu_request() before
6354  * calling send_action(CAT_BA, BA_ADDBA_REQUEST).
6355  *
6356  * NB: returns 0 on ERROR!
6357  */
6358 static int
6359 lkpi_ic_addba_request(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
6360     int dialogtoken, int baparamset, int batimeout)
6361 {
6362 	struct ieee80211com *ic;
6363 	struct lkpi_hw *lhw;
6364 	struct ieee80211_hw *hw;
6365 	struct ieee80211vap *vap;
6366 	struct lkpi_vif *lvif;
6367 	struct ieee80211_vif *vif;
6368 	struct lkpi_sta *lsta;
6369 	struct ieee80211_sta *sta;
6370 	struct ieee80211_ampdu_params params = { };
6371 	int error;
6372 
6373 	ic = ni->ni_ic;
6374 	lhw = ic->ic_softc;
6375 	hw = LHW_TO_HW(lhw);
6376 	vap = ni->ni_vap;
6377 	lvif = VAP_TO_LVIF(vap);
6378 	vif = LVIF_TO_VIF(lvif);
6379 	lsta = ni->ni_drv_data;
6380 	sta = LSTA_TO_STA(lsta);
6381 
6382 	TRACEOK("ADDBA REQ tid %u", tap->txa_tid);
6383 
6384 	if (!lsta->added_to_drv) {
6385 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
6386 		    __func__, lsta, ni, sta);
6387 		return (0);
6388 	}
6389 
6390 	params.sta = sta;
6391 	params.action = IEEE80211_AMPDU_TX_START;
6392 	/* Keep 0 here! */
6393 	params.buf_size = 0;
6394 	params.timeout = 0;
6395 	params.ssn = tap->txa_start & (IEEE80211_SEQ_RANGE-1);
6396 	params.tid = tap->txa_tid;
6397 	params.amsdu = false;
6398 
6399 	/* We get called from if_transmit all the way up unlocked in net80211. */
6400 	IEEE80211_UNLOCK_ASSERT(ic);
6401 	wiphy_lock(hw->wiphy);
6402 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6403 	wiphy_unlock(hw->wiphy);
6404 	if (error == IEEE80211_AMPDU_TX_START_IMMEDIATE) {
6405 		ic_printf(ic, "%s: mo_ampdu_action returned AMPDU_TX_START_IMMEDIATE. "
6406 		    "ni %p tap %p\n", __func__, ni, tap);
6407 	} else if (error != 0) {
6408 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p tap %p\n",
6409 		    __func__, error, ni, tap);
6410 		return (0);
6411 	}
6412 
6413 	if (sta->txq[tap->txa_tid] != NULL) {
6414 		struct lkpi_txq *ltxq;
6415 
6416 		ltxq = TXQ_TO_LTXQ(sta->txq[tap->txa_tid]);
6417 		TRACEOK("ADDBA REQ ltxq tid %u flags %b qlen %d", tap->txa_tid,
6418 		    ltxq->flags, LKPI_TXQ_FLAGS_BITS, skb_queue_len(&ltxq->skbq));
6419 		ltxq->flags |= LKPI_TXQ_STOPPED_BA;
6420 	}
6421 
6422 	return (lhw->ic_addba_request(ni, tap, dialogtoken, baparamset, batimeout));
6423 }
6424 
6425 /*
6426  * (*ic_addba_response)() is called from ht_recv_action_ba_addba_response()
6427  * and calls the default ieee80211_addba_response() which always returns 1.
6428  *
6429  * NB: No error checking in net80211!
6430  * Staying with 0 is an error.
6431  */
6432 static int
6433 lkpi_ic_addba_response(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
6434     int status, int baparamset, int batimeout)
6435 {
6436 	struct ieee80211com *ic;
6437 	struct lkpi_hw *lhw;
6438 	struct ieee80211_hw *hw;
6439 	struct ieee80211vap *vap;
6440 	struct lkpi_vif *lvif;
6441 	struct ieee80211_vif *vif;
6442 	struct lkpi_sta *lsta;
6443 	struct ieee80211_sta *sta;
6444 	struct ieee80211_ampdu_params params = { };
6445 	int error;
6446 
6447 	ic = ni->ni_ic;
6448 	lhw = ic->ic_softc;
6449 	hw = LHW_TO_HW(lhw);
6450 	vap = ni->ni_vap;
6451 	lvif = VAP_TO_LVIF(vap);
6452 	vif = LVIF_TO_VIF(lvif);
6453 	lsta = ni->ni_drv_data;
6454 	sta = LSTA_TO_STA(lsta);
6455 
6456 	TRACEOK("ADDBA RESP status %d (0 == SUCCESS) tid %u", status, tap->txa_tid);
6457 
6458 	if (!lsta->added_to_drv) {
6459 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
6460 		    __func__, lsta, ni, sta);
6461 		return (0);
6462 	}
6463 
6464 	if (status == IEEE80211_STATUS_SUCCESS) {
6465 		params.sta = sta;
6466 		params.action = IEEE80211_AMPDU_TX_OPERATIONAL;
6467 		params.buf_size = tap->txa_wnd;
6468 		params.timeout = 0;
6469 		params.ssn = 0;
6470 		params.tid = tap->txa_tid;
6471 		if ((tap->txa_flags & IEEE80211_AGGR_AMSDU) != 0)
6472 			params.amsdu = true;
6473 		else
6474 			params.amsdu = false;
6475 	} else {
6476 		/* We need to free the allocated resources. */
6477 		params.sta = sta;
6478 		switch (status) {
6479 			/* params.action = FLUSH, FLUSH_CONT */
6480 		default:
6481 			params.action = IEEE80211_AMPDU_TX_STOP_CONT;
6482 			break;
6483 		}
6484 		params.buf_size = 0;
6485 		params.timeout = 0;
6486 		params.ssn = 0;
6487 		params.tid = tap->txa_tid;
6488 		params.amsdu = false;
6489 	}
6490 
6491 	/* We are called all they way up from ieee80211_input* without lock. */
6492 	wiphy_lock(hw->wiphy);
6493 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6494 	wiphy_unlock(hw->wiphy);
6495 	if (error != 0) {
6496 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p tap %p\n",
6497 		    __func__, error, ni, tap);
6498 		return (0);
6499 	}
6500 
6501 	if (sta->txq[tap->txa_tid] != NULL) {
6502 		struct lkpi_txq *ltxq;
6503 
6504 		ltxq = TXQ_TO_LTXQ(sta->txq[tap->txa_tid]);
6505 		TRACEOK("ADDBA RESP ltxq tid %u flags %b qlen %d", tap->txa_tid,
6506 		    ltxq->flags, LKPI_TXQ_FLAGS_BITS, skb_queue_len(&ltxq->skbq));
6507 		ltxq->flags &= ~LKPI_TXQ_STOPPED_BA;
6508 
6509 		lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tap->txa_tid], true);
6510 	}
6511 
6512 	IMPROVE_HT("who unleashes the TXQ? and when?, do we need to ni->ni_txseqs[tid] = tap->txa_start & 0xfff;");
6513 
6514 	return (lhw->ic_addba_response(ni, tap, status, baparamset, batimeout));
6515 }
6516 
6517 /*
6518  * (*ic_addba_stop)() is called from ampdu_tx_stop(), ht_recv_action_ba_delba(),
6519  * and ieee80211_ampdu_stop() and calls the default ieee80211_addba_stop().
6520  */
6521 static void
6522 lkpi_ic_addba_stop(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
6523 {
6524 	struct ieee80211com *ic;
6525 	struct lkpi_hw *lhw;
6526 	struct ieee80211_hw *hw;
6527 	struct ieee80211vap *vap;
6528 	struct lkpi_vif *lvif;
6529 	struct ieee80211_vif *vif;
6530 	struct lkpi_sta *lsta;
6531 	struct ieee80211_sta *sta;
6532 	struct ieee80211_ampdu_params params = { };
6533 	int error;
6534 
6535 	ic = ni->ni_ic;
6536 	lhw = ic->ic_softc;
6537 	hw = LHW_TO_HW(lhw);
6538 	vap = ni->ni_vap;
6539 	lvif = VAP_TO_LVIF(vap);
6540 	vif = LVIF_TO_VIF(lvif);
6541 	lsta = ni->ni_drv_data;
6542 	sta = LSTA_TO_STA(lsta);
6543 
6544 	if (!lsta->added_to_drv) {
6545 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
6546 		    __func__, lsta, ni, sta);
6547 		goto n80211;
6548 	}
6549 
6550 	/* We need to free the allocated resources. */
6551 	params.sta = sta;
6552 	IMPROVE("net80211 does not provide a reason to us");
6553 	params.action = IEEE80211_AMPDU_TX_STOP_CONT; /* params.action = FLUSH, FLUSH_CONT */
6554 	params.buf_size = 0;
6555 	params.timeout = 0;
6556 	params.ssn = 0;
6557 	params.tid = tap->txa_tid;
6558 	params.amsdu = false;
6559 
6560 	IEEE80211_UNLOCK(ic);
6561 	wiphy_lock(hw->wiphy);
6562 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6563 	wiphy_unlock(hw->wiphy);
6564 	IEEE80211_LOCK(ic);
6565 	if (error != 0) {
6566 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p tap %p\n",
6567 		    __func__, error, ni, tap);
6568 		goto n80211;
6569 	}
6570 
6571 	IMPROVE_HT("anyting else?");
6572 
6573 n80211:
6574 	lhw->ic_addba_stop(ni, tap);
6575 }
6576 
6577 static void
6578 lkpi_ic_addba_response_timeout(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
6579 {
6580 	struct ieee80211com *ic;
6581 	struct lkpi_hw *lhw;
6582 	struct lkpi_sta *lsta;
6583 	struct ieee80211_sta *sta;
6584 
6585 	ic = ni->ni_ic;
6586 	lhw = ic->ic_softc;
6587 	lsta = ni->ni_drv_data;
6588 	sta = LSTA_TO_STA(lsta);
6589 
6590 	TRACEOK("ADDBA RESP TIMEO tid %u", tap->txa_tid);
6591 
6592 	IMPROVE_HT();
6593 
6594 	if (!lsta->added_to_drv) {
6595 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
6596 		    __func__, lsta, ni, sta);
6597 		goto n80211;
6598 	}
6599 
6600 	/* We need to re-enable the txq and get packets out. */
6601 	if (sta->txq[tap->txa_tid] != NULL) {
6602 		struct lkpi_txq *ltxq;
6603 		struct ieee80211_hw *hw;
6604 
6605 		ltxq = TXQ_TO_LTXQ(sta->txq[tap->txa_tid]);
6606 		TRACEOK("ADDBA RESP TIMEO ltxq tid %u flags %b qlen %d",
6607 		    tap->txa_tid, ltxq->flags, LKPI_TXQ_FLAGS_BITS,
6608 		    skb_queue_len(&ltxq->skbq));
6609 		ltxq->flags &= ~LKPI_TXQ_STOPPED_BA;
6610 
6611 		hw = LHW_TO_HW(lhw);
6612 		lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tap->txa_tid], true);
6613 	}
6614 
6615 n80211:
6616 	lhw->ic_addba_response_timeout(ni, tap);
6617 }
6618 
6619 static void
6620 lkpi_ic_bar_response(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
6621     int status)
6622 {
6623 	struct ieee80211com *ic;
6624 	struct lkpi_hw *lhw;
6625 
6626 	ic = ni->ni_ic;
6627 	lhw = ic->ic_softc;
6628 
6629 	IMPROVE_HT();
6630 
6631 	lhw->ic_bar_response(ni, tap, status);
6632 }
6633 
6634 static int
6635 lkpi_ic_ampdu_rx_start(struct ieee80211_node *ni, struct ieee80211_rx_ampdu *rap,
6636     int baparamset, int batimeout, int baseqctl)
6637 {
6638 	struct ieee80211com *ic;
6639 	struct lkpi_hw *lhw;
6640 	struct ieee80211_hw *hw;
6641 	struct ieee80211vap *vap;
6642 	struct lkpi_vif *lvif;
6643 	struct ieee80211_vif *vif;
6644 	struct lkpi_sta *lsta;
6645 	struct ieee80211_sta *sta;
6646 	struct ieee80211_ampdu_params params = { };
6647 	int error;
6648 
6649 	ic = ni->ni_ic;
6650 	lhw = ic->ic_softc;
6651 	hw = LHW_TO_HW(lhw);
6652 	vap = ni->ni_vap;
6653 	lvif = VAP_TO_LVIF(vap);
6654 	vif = LVIF_TO_VIF(lvif);
6655 	lsta = ni->ni_drv_data;
6656 	sta = LSTA_TO_STA(lsta);
6657 
6658 	IEEE80211_UNLOCK_ASSERT(ic);
6659 
6660 	if (!lsta->added_to_drv) {
6661 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p not added to firmware\n",
6662 		    __func__, lsta, ni, vap, sta);
6663 		return (-ENXIO);
6664 	}
6665 
6666 	if (lsta->state != IEEE80211_STA_AUTHORIZED) {
6667 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p state %d not AUTHORIZED\n",
6668 		    __func__, lsta, ni, vap, sta, lsta->state);
6669 		return (-ENXIO);
6670 	}
6671 
6672 	params.sta = sta;
6673 	params.action = IEEE80211_AMPDU_RX_START;
6674 	params.buf_size = _IEEE80211_MASKSHIFT(le16toh(baparamset), IEEE80211_BAPS_BUFSIZ);
6675 	if (params.buf_size == 0)
6676 		params.buf_size = IEEE80211_MAX_AMPDU_BUF_HT;
6677 	else
6678 		params.buf_size = min(params.buf_size, IEEE80211_MAX_AMPDU_BUF_HT);
6679 	if (hw->max_rx_aggregation_subframes > 0 &&
6680 	    params.buf_size > hw->max_rx_aggregation_subframes)
6681 		params.buf_size = hw->max_rx_aggregation_subframes;
6682 	params.timeout = le16toh(batimeout);
6683 	params.ssn = _IEEE80211_MASKSHIFT(le16toh(baseqctl), IEEE80211_BASEQ_START);
6684 	params.tid = _IEEE80211_MASKSHIFT(le16toh(baparamset), IEEE80211_BAPS_TID);
6685 
6686 	/* Based on net80211::ampdu_rx_start(). */
6687 	if ((vap->iv_htcaps & IEEE80211_HTC_RX_AMSDU_AMPDU) &&
6688 	    (_IEEE80211_MASKSHIFT(baparamset, IEEE80211_BAPS_AMSDU)))
6689 		params.amsdu = true;
6690 	else
6691 		params.amsdu = false;
6692 
6693 	wiphy_lock(hw->wiphy);
6694 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6695 	wiphy_unlock(hw->wiphy);
6696 	if (error != 0) {
6697 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p rap %p\n",
6698 		    __func__, error, ni, rap);
6699 		return (error);
6700 	}
6701 
6702 	if (!ieee80211_hw_check(hw, SUPPORTS_REORDERING_BUFFER)) {
6703 		IMPROVE("%s: TODO: SUPPORTS_REORDERING_BUFFER not set; check net80211\n", __func__);
6704 	}
6705 
6706 	IMPROVE_HT("net80211 is missing the error check on return and assumes success");
6707 
6708 	error = lhw->ic_ampdu_rx_start(ni, rap, baparamset, batimeout, baseqctl);
6709 	return (error);
6710 }
6711 
6712 static void
6713 lkpi_ic_ampdu_rx_stop(struct ieee80211_node *ni, struct ieee80211_rx_ampdu *rap)
6714 {
6715 	struct ieee80211com *ic;
6716 	struct lkpi_hw *lhw;
6717 	struct ieee80211_hw *hw;
6718 	struct ieee80211vap *vap;
6719 	struct lkpi_vif *lvif;
6720 	struct ieee80211_vif *vif;
6721 	struct lkpi_sta *lsta;
6722 	struct ieee80211_sta *sta;
6723 	struct ieee80211_ampdu_params params = { };
6724 	int error;
6725 	uint8_t tid;
6726 	bool ic_locked;
6727 
6728 	ic = ni->ni_ic;
6729 	lhw = ic->ic_softc;
6730 
6731 	/*
6732 	 * We should not (cannot) call into mac80211 ops with AMPDU_RX_STOP if
6733 	 * we did not START.  Some drivers pass it down to firmware which will
6734 	 * simply barf and net80211 calls ieee80211_ht_node_cleanup() from
6735 	 * ieee80211_ht_node_init() amongst others which will iterate over all
6736 	 * tid and call ic_ampdu_rx_stop() unconditionally.
6737 	 * XXX net80211 should probably be more "gentle" in these cases and
6738 	 * track some state itself.
6739 	 */
6740 	if ((rap->rxa_flags & IEEE80211_AGGR_RUNNING) == 0)
6741 		goto net80211_only;
6742 
6743 	hw = LHW_TO_HW(lhw);
6744 	vap = ni->ni_vap;
6745 	lvif = VAP_TO_LVIF(vap);
6746 	vif = LVIF_TO_VIF(lvif);
6747 	lsta = ni->ni_drv_data;
6748 	if (lsta == NULL) {
6749 		ic_printf(ic, "%s: lsta %p ni %p vap %p, lsta is NULL\n",
6750 		    __func__, lsta, ni, vap);
6751 		goto net80211_only;
6752 	}
6753 	sta = LSTA_TO_STA(lsta);
6754 
6755 	if (!lsta->added_to_drv) {
6756 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p not added to firmware\n",
6757 		    __func__, lsta, ni, vap, sta);
6758 		goto net80211_only;
6759 	}
6760 
6761 	if (lsta->state != IEEE80211_STA_AUTHORIZED) {
6762 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p state %d not AUTHORIZED\n",
6763 		    __func__, lsta, ni, vap, sta, lsta->state);
6764 		goto net80211_only;
6765 	}
6766 
6767 	IMPROVE_HT("This really should be passed from ht_recv_action_ba_delba.");
6768 	for (tid = 0; tid < WME_NUM_TID; tid++) {
6769 		if (&ni->ni_rx_ampdu[tid] == rap)
6770 			break;
6771 	}
6772 	if (tid == WME_NUM_TID) {
6773 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p TID not found\n",
6774 		    __func__, lsta, ni, vap, sta);
6775 		goto net80211_only;
6776 	}
6777 
6778 	params.sta = sta;
6779 	params.action = IEEE80211_AMPDU_RX_STOP;
6780 	params.buf_size = 0;
6781 	params.timeout = 0;
6782 	params.ssn = 0;
6783 	params.tid = tid;
6784 	params.amsdu = false;
6785 
6786 	ic_locked = IEEE80211_IS_LOCKED(ic);
6787 	if (ic_locked)
6788 		IEEE80211_UNLOCK(ic);
6789 	wiphy_lock(hw->wiphy);
6790 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6791 	wiphy_unlock(hw->wiphy);
6792 	if (ic_locked)
6793 		IEEE80211_LOCK(ic);
6794 	if (error != 0)
6795 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p rap %p\n",
6796 		    __func__, error, ni, rap);
6797 
6798 net80211_only:
6799 	lhw->ic_ampdu_rx_stop(ni, rap);
6800 }
6801 #endif
6802 
6803 int
6804 linuxkpi_ieee80211_start_tx_ba_session(struct ieee80211_sta *sta, uint8_t tid,
6805     int timeout)
6806 {
6807 	struct lkpi_sta *lsta;
6808 	struct ieee80211_hw *hw;
6809 	struct lkpi_hw *lhw;
6810 	struct ieee80211_tx_ampdu *tap;
6811 	int worked;
6812 
6813 	lsta = STA_TO_LSTA(sta);
6814 
6815 	/* If tid is out of range, fail gracefully. */
6816 	/* XXX-BZ are we limited to 8? */
6817 	if (tid >= IEEE80211_NUM_TIDS) {
6818 		net80211_vap_printf(lsta->ni->ni_vap, "%s: tid %u out of range "
6819 		    ">= %u\n", __func__, tid, IEEE80211_NUM_TIDS);
6820 		return (-EINVAL);
6821 	}
6822 
6823 	hw = lsta->hw;
6824 	lhw = HW_TO_LHW(hw);
6825 
6826 	/* No ampdu_action support, just error. */
6827 	if (lhw->ops->ampdu_action == NULL) {
6828 		net80211_vap_printf(lsta->ni->ni_vap, "%s: (*ampdu_action) "
6829 		    "not supported\n", __func__);
6830 		return (-ENOTSUPP);
6831 	}
6832 
6833 	/* Does HW allow us to set this up? */
6834 	if (!ieee80211_hw_check(hw, AMPDU_AGGREGATION)) {
6835 		net80211_vap_printf(lsta->ni->ni_vap, "%s: !AMPDU_AGGREGATION\n",
6836 		    __func__);
6837 		return (-ENOTSUPP);
6838 	}
6839 	if (ieee80211_hw_check(hw, TX_AMPDU_SETUP_IN_HW)) {
6840 		net80211_vap_printf(lsta->ni->ni_vap, "%s: TX_AMPDU_SETUP_IN_HW\n",
6841 		    __func__);
6842 		return (-EPERM);
6843 	}
6844 
6845 	/* We need at least HT or higher support enabled. */
6846 	if (!sta->deflink.ht_cap.ht_supported &&
6847 	    !sta->deflink.vht_cap.vht_supported &&
6848 	    !sta->deflink.he_cap.has_he &&
6849 	    !sta->deflink.eht_cap.has_eht) {
6850 		net80211_vap_printf(lsta->ni->ni_vap, "%s: HT or later not "
6851 		    "supported\n", __func__);
6852 		return (-ENOTSUPP);
6853 	}
6854 
6855 #ifdef __notyet__
6856 	/*
6857 	 * We need some rate limiting/disabling in case we try too hard and
6858 	 * get NACKed over and over.
6859 	 * XXX-BZ This check should likely go to addba_req along with a counter.
6860 	 */
6861 	if (lsta->block_ba)
6862 		return (-EACCESS);
6863 #endif
6864 
6865 	/* XXX-BZ locking? */
6866 
6867 	/* Do we have a running session already? */
6868 	tap = &lsta->ni->ni_tx_ampdu[tid];
6869 	if (IEEE80211_AMPDU_REQUESTED(tap)) {
6870 		net80211_vap_printf(lsta->ni->ni_vap, "%s: "
6871 		    "AMPDU requested/running\n", __func__);
6872 		return (-EINPROGRESS);
6873 	}
6874 
6875 	/* Tell net80211 to setup an aggr sessions. */
6876 	/* XXX-BZ we have no way to carry the timeout forward easily. */
6877 	worked = ieee80211_ampdu_tx_request_ext(lsta->ni, tid);
6878 	TRACEOK("ieee80211_ampdu_tx_request_ext %d", worked);
6879 
6880 	if (worked != 1) {
6881 		net80211_vap_printf(lsta->ni->ni_vap, "%s: "
6882 		    "ieee80211_ampdu_tx_request_ext returned %d != 1\n",
6883 		    __func__, worked);
6884 		return (-EINVAL);
6885 	}
6886 
6887 	/*
6888 	 * How do we make sure the EAPOL handshake has completed?
6889 	 * Let ieee80211_output do it.
6890 	 */
6891 	if (1) {
6892 		/* Immediately trigger the setup and output of the action frame. */
6893 		worked = ieee80211_ampdu_request(lsta->ni, tap);
6894 		if (worked != 1) {
6895 			net80211_vap_printf(lsta->ni->ni_vap, "%s: "
6896 			    "ieee80211_ampdu_request returned %d != 1\n",
6897 			    __func__, worked);
6898 			return (-EAGAIN);
6899 		}
6900 	}
6901 
6902 	return (0);
6903 }
6904 
6905 static void
6906 lkpi_ic_getradiocaps_ht(struct ieee80211com *ic, struct ieee80211_hw *hw,
6907     uint8_t *bands, int *chan_flags, enum nl80211_band band)
6908 {
6909 #ifdef LKPI_80211_HT
6910 	struct ieee80211_sta_ht_cap *ht_cap;
6911 
6912 	ht_cap = &hw->wiphy->bands[band]->ht_cap;
6913 	if (!ht_cap->ht_supported)
6914 		return;
6915 
6916 	switch (band) {
6917 	case NL80211_BAND_2GHZ:
6918 		setbit(bands, IEEE80211_MODE_11NG);
6919 		break;
6920 	case NL80211_BAND_5GHZ:
6921 		setbit(bands, IEEE80211_MODE_11NA);
6922 		break;
6923 	default:
6924 		IMPROVE("Unsupported band %d", band);
6925 		return;
6926 	}
6927 
6928 	ic->ic_htcaps = IEEE80211_HTC_HT;	/* HT operation */
6929 
6930 	/*
6931 	 * Rather than manually checking each flag and
6932 	 * translating IEEE80211_HT_CAP_ to IEEE80211_HTCAP_,
6933 	 * simply copy the 16bits.
6934 	 */
6935 	ic->ic_htcaps |= ht_cap->cap;
6936 
6937 	/* Then deal with the other flags. */
6938 	if (ieee80211_hw_check(hw, AMPDU_AGGREGATION))
6939 		ic->ic_htcaps |= IEEE80211_HTC_AMPDU;
6940 #ifdef __notyet__
6941 	if (ieee80211_hw_check(hw, TX_AMSDU))
6942 		ic->ic_htcaps |= IEEE80211_HTC_AMSDU;
6943 	if (ieee80211_hw_check(hw, SUPPORTS_AMSDU_IN_AMPDU))
6944 		ic->ic_htcaps |= (IEEE80211_HTC_RX_AMSDU_AMPDU |
6945 		    IEEE80211_HTC_TX_AMSDU_AMPDU);
6946 #endif
6947 
6948 	IMPROVE("PS, ampdu_*, ht_cap.mcs.tx_params, ...");
6949 
6950 	/* Only add HT40 channels if supported. */
6951 	if ((ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40) != 0 &&
6952 	    chan_flags != NULL)
6953 		*chan_flags |= NET80211_CBW_FLAG_HT40;
6954 #endif
6955 }
6956 
6957 static void
6958 lkpi_ic_getradiocaps(struct ieee80211com *ic, int maxchan,
6959     int *n, struct ieee80211_channel *c)
6960 {
6961 	struct lkpi_hw *lhw;
6962 	struct ieee80211_hw *hw;
6963 	struct linuxkpi_ieee80211_channel *channels;
6964 	uint8_t bands[IEEE80211_MODE_BYTES];
6965 	int chan_flags, error, i, nchans;
6966 
6967 	/* Channels */
6968 	lhw = ic->ic_softc;
6969 	hw = LHW_TO_HW(lhw);
6970 
6971 	/* NL80211_BAND_2GHZ */
6972 	nchans = 0;
6973 	if (hw->wiphy->bands[NL80211_BAND_2GHZ] != NULL)
6974 		nchans = hw->wiphy->bands[NL80211_BAND_2GHZ]->n_channels;
6975 	if (nchans > 0) {
6976 		struct ieee80211_supported_band *supband;
6977 
6978 		memset(bands, 0, sizeof(bands));
6979 		chan_flags = 0;
6980 		setbit(bands, IEEE80211_MODE_11B);
6981 
6982 		/* Check for 11g (simplified). */
6983 		supband = hw->wiphy->bands[NL80211_BAND_2GHZ];
6984 		for (i = 0; i < supband->n_bitrates; i++) {
6985 			if ((supband->bitrates[i].flags &
6986 			    IEEE80211_RATE_MANDATORY_G) != 0) {
6987 				setbit(bands, IEEE80211_MODE_11G);
6988 				break;
6989 			}
6990 		}
6991 
6992 		IMPROVE("the bitrates may have flags?");
6993 
6994 		lkpi_ic_getradiocaps_ht(ic, hw, bands, &chan_flags,
6995 		    NL80211_BAND_2GHZ);
6996 
6997 		channels = supband->channels;
6998 		for (i = 0; i < nchans && *n < maxchan; i++) {
6999 			uint32_t nflags = 0;
7000 			int cflags = chan_flags;
7001 
7002 			if (channels[i].flags & IEEE80211_CHAN_DISABLED) {
7003 				ic_printf(ic, "%s: Skipping disabled chan "
7004 				    "[%u/%u/%#x]\n", __func__,
7005 				    channels[i].hw_value,
7006 				    channels[i].center_freq, channels[i].flags);
7007 				continue;
7008 			}
7009 			if (channels[i].flags & IEEE80211_CHAN_NO_IR)
7010 				nflags |= (IEEE80211_CHAN_NOADHOC|IEEE80211_CHAN_PASSIVE);
7011 			if (channels[i].flags & IEEE80211_CHAN_RADAR)
7012 				nflags |= IEEE80211_CHAN_DFS;
7013 			if (channels[i].flags & IEEE80211_CHAN_NO_160MHZ)
7014 				cflags &= ~(NET80211_CBW_FLAG_VHT160|NET80211_CBW_FLAG_VHT80P80);
7015 			if (channels[i].flags & IEEE80211_CHAN_NO_80MHZ)
7016 				cflags &= ~NET80211_CBW_FLAG_VHT80;
7017 			/* XXX how to map the remaining enum ieee80211_channel_flags? */
7018 			if (channels[i].flags & IEEE80211_CHAN_NO_HT40)
7019 				cflags &= ~NET80211_CBW_FLAG_HT40;
7020 
7021 			error = ieee80211_add_channel_cbw(c, maxchan, n,
7022 			    ieee80211_mhz2ieee(channels[i].center_freq,
7023 				lkpi_nl80211_band_to_net80211_band(channels[i].band)),
7024 			    channels[i].center_freq, channels[i].max_power,
7025 			    nflags, bands, cflags);
7026 			/* net80211::ENOBUFS: *n >= maxchans */
7027 			if (error != 0 && error != ENOBUFS)
7028 				ic_printf(ic, "%s: Adding chan %u/%u/%#x/%#x/%#x/%#x "
7029 				    "returned error %d\n",
7030 				    __func__, channels[i].hw_value,
7031 				    channels[i].center_freq, channels[i].flags,
7032 				    nflags, chan_flags, cflags, error);
7033 			if (error != 0)
7034 				break;
7035 		}
7036 	}
7037 
7038 	/* NL80211_BAND_5GHZ */
7039 	nchans = 0;
7040 	if (hw->wiphy->bands[NL80211_BAND_5GHZ] != NULL)
7041 		nchans = hw->wiphy->bands[NL80211_BAND_5GHZ]->n_channels;
7042 	if (nchans > 0) {
7043 		memset(bands, 0, sizeof(bands));
7044 		chan_flags = 0;
7045 		setbit(bands, IEEE80211_MODE_11A);
7046 
7047 		lkpi_ic_getradiocaps_ht(ic, hw, bands, &chan_flags,
7048 		    NL80211_BAND_5GHZ);
7049 
7050 #ifdef LKPI_80211_VHT
7051 		if (hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.vht_supported) {
7052 
7053 			ic->ic_flags_ext |= IEEE80211_FEXT_VHT;
7054 			ic->ic_vht_cap.vht_cap_info =
7055 			    hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.cap;
7056 			ic->ic_vht_cap.supp_mcs =
7057 			    hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.vht_mcs;
7058 
7059 			setbit(bands, IEEE80211_MODE_VHT_5GHZ);
7060 			chan_flags |= NET80211_CBW_FLAG_VHT80;
7061 			if (IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_IS_160MHZ(
7062 			    ic->ic_vht_cap.vht_cap_info))
7063 				chan_flags |= NET80211_CBW_FLAG_VHT160;
7064 			if (IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_IS_160_80P80MHZ(
7065 			    ic->ic_vht_cap.vht_cap_info))
7066 				chan_flags |= NET80211_CBW_FLAG_VHT80P80;
7067 		}
7068 #endif
7069 
7070 		channels = hw->wiphy->bands[NL80211_BAND_5GHZ]->channels;
7071 		for (i = 0; i < nchans && *n < maxchan; i++) {
7072 			uint32_t nflags = 0;
7073 			int cflags = chan_flags;
7074 
7075 			if (channels[i].flags & IEEE80211_CHAN_DISABLED) {
7076 				ic_printf(ic, "%s: Skipping disabled chan "
7077 				    "[%u/%u/%#x]\n", __func__,
7078 				    channels[i].hw_value,
7079 				    channels[i].center_freq, channels[i].flags);
7080 				continue;
7081 			}
7082 			if (channels[i].flags & IEEE80211_CHAN_NO_IR)
7083 				nflags |= (IEEE80211_CHAN_NOADHOC|IEEE80211_CHAN_PASSIVE);
7084 			if (channels[i].flags & IEEE80211_CHAN_RADAR)
7085 				nflags |= IEEE80211_CHAN_DFS;
7086 			if (channels[i].flags & IEEE80211_CHAN_NO_160MHZ)
7087 				cflags &= ~(NET80211_CBW_FLAG_VHT160|NET80211_CBW_FLAG_VHT80P80);
7088 			if (channels[i].flags & IEEE80211_CHAN_NO_80MHZ)
7089 				cflags &= ~NET80211_CBW_FLAG_VHT80;
7090 			/* XXX hwo to map the remaining enum ieee80211_channel_flags? */
7091 			if (channels[i].flags & IEEE80211_CHAN_NO_HT40)
7092 				cflags &= ~NET80211_CBW_FLAG_HT40;
7093 
7094 			error = ieee80211_add_channel_cbw(c, maxchan, n,
7095 			    ieee80211_mhz2ieee(channels[i].center_freq,
7096 				lkpi_nl80211_band_to_net80211_band(channels[i].band)),
7097 			    channels[i].center_freq, channels[i].max_power,
7098 			    nflags, bands, cflags);
7099 			/* net80211::ENOBUFS: *n >= maxchans */
7100 			if (error != 0 && error != ENOBUFS)
7101 				ic_printf(ic, "%s: Adding chan %u/%u/%#x/%#x/%#x/%#x "
7102 				    "returned error %d\n",
7103 				    __func__, channels[i].hw_value,
7104 				    channels[i].center_freq, channels[i].flags,
7105 				    nflags, chan_flags, cflags, error);
7106 			if (error != 0)
7107 				break;
7108 		}
7109 	}
7110 }
7111 
7112 static void *
7113 lkpi_ieee80211_ifalloc(void)
7114 {
7115 	struct ieee80211com *ic;
7116 
7117 	ic = malloc(sizeof(*ic), M_LKPI80211, M_WAITOK | M_ZERO);
7118 
7119 	/* Setting these happens later when we have device information. */
7120 	ic->ic_softc = NULL;
7121 	ic->ic_name = "linuxkpi";
7122 
7123 	return (ic);
7124 }
7125 
7126 struct ieee80211_hw *
7127 linuxkpi_ieee80211_alloc_hw(size_t priv_len, const struct ieee80211_ops *ops)
7128 {
7129 	struct ieee80211_hw *hw;
7130 	struct lkpi_hw *lhw;
7131 	struct wiphy *wiphy;
7132 	int ac;
7133 	bool emuchanctx;
7134 
7135 	/*
7136 	 * Do certain checks before starting to allocate resources.
7137 	 * Store results in temporary variables.
7138 	 */
7139 
7140 	/* ac1d519c01ca introduced emulating chanctx changes. */
7141 	emuchanctx = false;
7142 	if (ops->add_chanctx == ieee80211_emulate_add_chanctx &&
7143 	    ops->change_chanctx == ieee80211_emulate_change_chanctx &&
7144 	    ops->remove_chanctx == ieee80211_emulate_remove_chanctx) {
7145 		/*
7146 		 * If we emulate the chanctx ops, we must not have
7147 		 * assign_vif_chanctx and unassign_vif_chanctx.
7148 		 */
7149 		if (ops->assign_vif_chanctx != NULL ||
7150 		    ops->unassign_vif_chanctx != NULL) {
7151 			/* Fail gracefully. */
7152 			printf("%s: emulate_chanctx but "
7153 			    "assign_vif_chanctx %p != NULL || "
7154 			    "unassign_vif_chanctx %p != NULL\n", __func__,
7155 			    ops->assign_vif_chanctx, ops->unassign_vif_chanctx);
7156 			return (NULL);
7157 		}
7158 		emuchanctx = true;
7159 	}
7160 	if (!emuchanctx && (ops->add_chanctx == ieee80211_emulate_add_chanctx ||
7161 	    ops->change_chanctx == ieee80211_emulate_change_chanctx ||
7162 	    ops->remove_chanctx == ieee80211_emulate_remove_chanctx)) {
7163 		printf("%s: not emulating chanctx changes but emulating "
7164 		    "function set: %d/%d/%d\n", __func__,
7165 		    ops->add_chanctx == ieee80211_emulate_add_chanctx,
7166 		    ops->change_chanctx == ieee80211_emulate_change_chanctx,
7167 		    ops->remove_chanctx == ieee80211_emulate_remove_chanctx);
7168 		return (NULL);
7169 	}
7170 	if (!emuchanctx && (ops->add_chanctx == NULL || ops->change_chanctx == NULL ||
7171 	    ops->remove_chanctx == NULL || ops->assign_vif_chanctx == NULL ||
7172 	    ops->unassign_vif_chanctx == NULL)) {
7173 		printf("%s: not all functions set for chanctx operations "
7174 		    "(emulating chanctx %d): %p/%p/%p %p/%p\n",
7175 		    __func__, emuchanctx,
7176 		    ops->add_chanctx, ops->change_chanctx, ops->remove_chanctx,
7177 		    ops->assign_vif_chanctx, ops->unassign_vif_chanctx);
7178 		return (NULL);
7179 	}
7180 
7181 	/* Get us and the driver data also allocated. */
7182 	wiphy = wiphy_new(&linuxkpi_mac80211cfgops, sizeof(*lhw) + priv_len);
7183 	if (wiphy == NULL)
7184 		return (NULL);
7185 
7186 	lhw = wiphy_priv(wiphy);
7187 	lhw->ops = ops;
7188 
7189 	LKPI_80211_LHW_SCAN_LOCK_INIT(lhw);
7190 	LKPI_80211_LHW_TXQ_LOCK_INIT(lhw);
7191 	spin_lock_init(&lhw->txq_lock);
7192 	sx_init_flags(&lhw->lvif_sx, "lhw-lvif", SX_RECURSE | SX_DUPOK);
7193 	LKPI_80211_LHW_MC_LOCK_INIT(lhw);
7194 	TAILQ_INIT(&lhw->lvif_head);
7195 	__hw_addr_init(&lhw->mc_list);
7196 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
7197 		spin_lock_init(&lhw->txq_scheduled_lock[ac]);
7198 		lhw->txq_generation[ac] = 1;
7199 		TAILQ_INIT(&lhw->txq_scheduled[ac]);
7200 	}
7201 
7202 	/* Chanctx_conf */
7203 	INIT_LIST_HEAD(&lhw->lchanctx_list);
7204 	INIT_LIST_HEAD(&lhw->lchanctx_list_reserved);
7205 	lhw->emulate_chanctx = emuchanctx;
7206 
7207 	/* Deferred RX path. */
7208 	LKPI_80211_LHW_RXQ_LOCK_INIT(lhw);
7209 	TASK_INIT(&lhw->rxq_task, 0, lkpi_80211_lhw_rxq_task, lhw);
7210 	mbufq_init(&lhw->rxq, 32 * NAPI_POLL_WEIGHT);
7211 	lhw->rxq_stopped = false;
7212 
7213 	/*
7214 	 * XXX-BZ TODO make sure there is a "_null" function to all ops
7215 	 * not initialized.
7216 	 */
7217 	hw = LHW_TO_HW(lhw);
7218 	hw->wiphy = wiphy;
7219 	hw->conf.flags |= IEEE80211_CONF_IDLE;
7220 	hw->priv = (void *)(lhw + 1);
7221 
7222 	/* BSD Specific. */
7223 	lhw->ic = lkpi_ieee80211_ifalloc();
7224 
7225 	if (lhw->emulate_chanctx)
7226 		ic_printf(lhw->ic, "Using chanctx emulation.\n");
7227 	IMPROVE();
7228 
7229 	return (hw);
7230 }
7231 
7232 void
7233 linuxkpi_ieee80211_iffree(struct ieee80211_hw *hw)
7234 {
7235 	struct lkpi_hw *lhw;
7236 	struct mbuf *m;
7237 	int ac;
7238 
7239 	lhw = HW_TO_LHW(hw);
7240 	free(lhw->ic, M_LKPI80211);
7241 	lhw->ic = NULL;
7242 
7243 	/*
7244 	 * Drain the deferred RX path.
7245 	 */
7246 	LKPI_80211_LHW_RXQ_LOCK(lhw);
7247 	lhw->rxq_stopped = true;
7248 	LKPI_80211_LHW_RXQ_UNLOCK(lhw);
7249 
7250 	/* Drain taskq, won't be restarted due to rxq_stopped being set. */
7251 	while (taskqueue_cancel(taskqueue_thread, &lhw->rxq_task, NULL) != 0)
7252 		taskqueue_drain(taskqueue_thread, &lhw->rxq_task);
7253 
7254 	/* Flush mbufq (make sure to release ni refs!). */
7255 	m = mbufq_dequeue(&lhw->rxq);
7256 	while (m != NULL) {
7257 #ifdef LKPI_80211_USE_MTAG
7258 		struct m_tag *mtag;
7259 
7260 		mtag = m_tag_locate(m, MTAG_ABI_LKPI80211, LKPI80211_TAG_RXNI, NULL);
7261 		if (mtag != NULL) {
7262 			struct lkpi_80211_tag_rxni *rxni;
7263 
7264 			rxni = (struct lkpi_80211_tag_rxni *)(mtag + 1);
7265 			ieee80211_free_node(rxni->ni);
7266 		}
7267 #else
7268 		if (m->m_pkthdr.PH_loc.ptr != NULL) {
7269 			struct ieee80211_node *ni;
7270 
7271 			ni = m->m_pkthdr.PH_loc.ptr;
7272 			ieee80211_free_node(ni);
7273 		}
7274 #endif
7275 		m_freem(m);
7276 		m = mbufq_dequeue(&lhw->rxq);
7277 	}
7278 	KASSERT(mbufq_empty(&lhw->rxq), ("%s: lhw %p has rxq len %d != 0\n",
7279 	    __func__, lhw, mbufq_len(&lhw->rxq)));
7280 	LKPI_80211_LHW_RXQ_LOCK_DESTROY(lhw);
7281 
7282 	wiphy_lock(hw->wiphy);
7283 	/* Chanctx_conf. */
7284 	if (!list_empty_careful(&lhw->lchanctx_list)) {
7285 		struct lkpi_chanctx *lchanctx, *next;
7286 		struct ieee80211_chanctx_conf *chanctx_conf;
7287 
7288 		list_for_each_entry_safe(lchanctx, next, &lhw->lchanctx_list, entry) {
7289 			if (lchanctx->added_to_drv) {
7290 				/* In reality we should panic? */
7291 				chanctx_conf = &lchanctx->chanctx_conf;
7292 				lkpi_80211_mo_remove_chanctx(hw, chanctx_conf);
7293 			}
7294 			list_del(&lchanctx->entry);
7295 			/* No need to reset the lchanctx here as we will free it below. */
7296 			list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list_reserved);
7297 		}
7298 	}
7299 	if (!list_empty_careful(&lhw->lchanctx_list_reserved)) {
7300 		struct lkpi_chanctx *lchanctx, *next;
7301 
7302 		list_for_each_entry_safe(lchanctx, next, &lhw->lchanctx_list_reserved, entry) {
7303 			list_del(&lchanctx->entry);
7304 			if (lchanctx->added_to_drv)
7305 				panic("%s: lchanctx %p on reserved list still added_to_drv\n",
7306 				    __func__, lchanctx);
7307 			free(lchanctx, M_LKPI80211);
7308 		}
7309 	}
7310 	wiphy_unlock(hw->wiphy);
7311 
7312 	LKPI_80211_LHW_MC_LOCK(lhw);
7313 	lkpi_cleanup_mcast_list_locked(lhw);
7314 	LKPI_80211_LHW_MC_UNLOCK(lhw);
7315 
7316 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
7317 		spin_lock_destroy(&lhw->txq_scheduled_lock[ac]);
7318 
7319 	/* Cleanup more of lhw here or in wiphy_free()? */
7320 	spin_lock_destroy(&lhw->txq_lock);
7321 	LKPI_80211_LHW_TXQ_LOCK_DESTROY(lhw);
7322 	LKPI_80211_LHW_SCAN_LOCK_DESTROY(lhw);
7323 	sx_destroy(&lhw->lvif_sx);
7324 	LKPI_80211_LHW_MC_LOCK_DESTROY(lhw)
7325 	IMPROVE();
7326 }
7327 
7328 void
7329 linuxkpi_set_ieee80211_dev(struct ieee80211_hw *hw)
7330 {
7331 	struct lkpi_hw *lhw;
7332 	struct ieee80211com *ic;
7333 	struct device *dev;
7334 
7335 	lhw = HW_TO_LHW(hw);
7336 	ic = lhw->ic;
7337 
7338 	/* Save the backpointer from net80211 to LinuxKPI. */
7339 	ic->ic_softc = lhw;
7340 
7341 	/*
7342 	 * Set a proper name before ieee80211_ifattach() if dev is set.
7343 	 * ath1xk also unset the dev so we need to check.
7344 	 * Also we will (ab)use this opportunity to register the
7345 	 * power management sub-children if thay exist (for suspend/resume).
7346 	 */
7347 	dev = wiphy_dev(hw->wiphy);
7348 	if (dev != NULL) {
7349 		ic->ic_name = dev_name(dev);
7350 		if (dev->bsddev != NULL) {
7351 			bus_identify_children(dev->bsddev);
7352 			bus_enumerate_hinted_children(dev->bsddev);
7353 			bus_topo_lock();
7354 			bus_attach_children(dev->bsddev);
7355 			bus_topo_unlock();
7356 		}
7357 	} else {
7358 		TODO("adjust arguments to still have the old dev or go through "
7359 		    "the hoops of getting the bsddev from hw and detach; "
7360 		    "or do in XXX; check ath1kx drivers");
7361 	}
7362 
7363 	/* XXX-BZ do we also need to set wiphy name? */
7364 }
7365 
7366 struct ieee80211_hw *
7367 linuxkpi_wiphy_to_ieee80211_hw(struct wiphy *wiphy)
7368 {
7369 	struct lkpi_hw *lhw;
7370 
7371 	lhw = wiphy_priv(wiphy);
7372 	return (LHW_TO_HW(lhw));
7373 }
7374 
7375 static void
7376 lkpi_radiotap_attach(struct lkpi_hw *lhw)
7377 {
7378 	struct ieee80211com *ic;
7379 
7380 	ic = lhw->ic;
7381 	ieee80211_radiotap_attach(ic,
7382 	    &lhw->rtap_tx.wt_ihdr, sizeof(lhw->rtap_tx),
7383 	    LKPI_RTAP_TX_FLAGS_PRESENT,
7384 	    &lhw->rtap_rx.wr_ihdr, sizeof(lhw->rtap_rx),
7385 	    LKPI_RTAP_RX_FLAGS_PRESENT);
7386 }
7387 
7388 int
7389 linuxkpi_ieee80211_ifattach(struct ieee80211_hw *hw)
7390 {
7391 	struct ieee80211com *ic;
7392 	struct lkpi_hw *lhw;
7393 	int band, i;
7394 
7395 	lhw = HW_TO_LHW(hw);
7396 	ic = lhw->ic;
7397 
7398 	/* We do it this late as wiphy->dev should be set for the name. */
7399 	lhw->workq = alloc_ordered_workqueue(wiphy_name(hw->wiphy), 0);
7400 	if (lhw->workq == NULL)
7401 		return (-EAGAIN);
7402 
7403 	/* XXX-BZ figure this out how they count his... */
7404 	if (!is_zero_ether_addr(hw->wiphy->perm_addr)) {
7405 		IEEE80211_ADDR_COPY(ic->ic_macaddr,
7406 		    hw->wiphy->perm_addr);
7407 	} else if (hw->wiphy->n_addresses > 0) {
7408 		/* We take the first one. */
7409 		IEEE80211_ADDR_COPY(ic->ic_macaddr,
7410 		    hw->wiphy->addresses[0].addr);
7411 	} else {
7412 		ic_printf(ic, "%s: warning, no hardware address!\n", __func__);
7413 	}
7414 
7415 #ifdef __not_yet__
7416 	/* See comment in lkpi_80211_txq_tx_one(). */
7417 	ic->ic_headroom = hw->extra_tx_headroom;
7418 #endif
7419 
7420 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
7421 	ic->ic_opmode = IEEE80211_M_STA;
7422 
7423 	/* Set device capabilities. */
7424 	/* XXX-BZ we need to get these from linux80211/drivers and convert. */
7425 	ic->ic_caps =
7426 	    IEEE80211_C_STA |
7427 	    IEEE80211_C_MONITOR |
7428 	    IEEE80211_C_WPA |		/* WPA/RSN */
7429 #ifdef LKPI_80211_WME
7430 	    IEEE80211_C_WME |
7431 #endif
7432 #if 0
7433 	    IEEE80211_C_PMGT |
7434 #endif
7435 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
7436 	    IEEE80211_C_SHPREAMBLE	/* short preamble supported */
7437 	    ;
7438 
7439 #ifdef LKPI_80211_BGSCAN
7440 	if (lhw->ops->hw_scan)
7441 		ic->ic_caps |= IEEE80211_C_BGSCAN;
7442 #endif
7443 
7444 	lkpi_enable_hw_scan(lhw);
7445 
7446 	/* Does the driver/firmware handle rate countrol? */
7447 	/* Currently only older iwlwifi mvm devices are in this category. */
7448 	if (bootverbose && !ieee80211_hw_check(hw, HAS_RATE_CONTROL))
7449 		ic_printf(ic, "NOTE: rate control not supported by LinuxKPI; "
7450 		    "expect low rates only\n");
7451 
7452 	/* Does HW support Fragmentation offload? */
7453 	if (ieee80211_hw_check(hw, SUPPORTS_TX_FRAG))
7454 		ic->ic_flags_ext |= IEEE80211_FEXT_FRAG_OFFLOAD;
7455 
7456 	/* Does HW support full AMPDU[-TX] offload? */
7457 	if (ieee80211_hw_check(hw, AMPDU_AGGREGATION))
7458 		ic->ic_flags_ext |= IEEE80211_FEXT_AMPDU_OFFLOAD;
7459 #ifdef __notyet__
7460 	if (ieee80211_hw_check(hw, TX_AMSDU))
7461 	if (ieee80211_hw_check(hw, SUPPORTS_AMSDU_IN_AMPDU))
7462 #endif
7463 
7464 	/*
7465 	 * The wiphy variables report bitmasks of avail antennas.
7466 	 * (*get_antenna) get the current bitmask sets which can be
7467 	 * altered by (*set_antenna) for some drivers.
7468 	 * XXX-BZ will the count alone do us much good long-term in net80211?
7469 	 */
7470 	if (hw->wiphy->available_antennas_rx ||
7471 	    hw->wiphy->available_antennas_tx) {
7472 		uint32_t rxs, txs;
7473 
7474 		if (lkpi_80211_mo_get_antenna(hw, &txs, &rxs) == 0) {
7475 			ic->ic_rxstream = bitcount32(rxs);
7476 			ic->ic_txstream = bitcount32(txs);
7477 		}
7478 	}
7479 
7480 	ic->ic_cryptocaps = 0;
7481 #ifdef LKPI_80211_HW_CRYPTO
7482 	if (lkpi_hwcrypto && hw->wiphy->n_cipher_suites > 0) {
7483 		uint32_t hwciphers;
7484 
7485 		hwciphers = 0;
7486 		for (i = 0; i < hw->wiphy->n_cipher_suites; i++) {
7487 			uint32_t cs;
7488 
7489 			cs = lkpi_l80211_to_net80211_cyphers(
7490 			    ic, hw->wiphy->cipher_suites[i]);
7491 			if (cs == IEEE80211_CRYPTO_TKIP) {
7492 				/*
7493 				 * We do set this here.  We will only find out
7494 				 * when doing a SET_KEY operation depending on
7495 				 * what the driver returns.
7496 				 * net80211::ieee80211_crypto_newkey()
7497 				 * checks this so we will have to do flags
7498 				 * surgery later.
7499 				 */
7500 				cs |= IEEE80211_CRYPTO_TKIPMIC;
7501 			}
7502 			hwciphers |= cs;
7503 		}
7504 		/*
7505 		 * (20250415) nothing anywhere in the path checks we actually
7506 		 * support all these in net80211.
7507 		 * net80211 supports _256 variants but the ioctl does not.
7508 		 */
7509 		IMPROVE("as net80211 grows more support, enable them");
7510 		hwciphers &= (IEEE80211_CRYPTO_WEP |
7511 		    IEEE80211_CRYPTO_TKIP | IEEE80211_CRYPTO_TKIPMIC |
7512 		    IEEE80211_CRYPTO_AES_CCM | IEEE80211_CRYPTO_AES_GCM_128);
7513 		/*
7514 		 * We only support CCMP here, so further filter.
7515 		 * Also permit TKIP if turned on.
7516 		 */
7517 		hwciphers &= (IEEE80211_CRYPTO_AES_CCM |
7518 		    IEEE80211_CRYPTO_AES_GCM_128 |
7519 		    (lkpi_hwcrypto_tkip ? (IEEE80211_CRYPTO_TKIP |
7520 		    IEEE80211_CRYPTO_TKIPMIC) : 0));
7521 		ieee80211_set_hardware_ciphers(ic, hwciphers);
7522 	}
7523 #endif
7524 
7525 	lkpi_ic_getradiocaps(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
7526 	    ic->ic_channels);
7527 
7528 	ieee80211_ifattach(ic);
7529 
7530 	ic->ic_update_mcast = lkpi_ic_update_mcast;
7531 	ic->ic_update_promisc = lkpi_ic_update_promisc;
7532 	ic->ic_update_chw = lkpi_ic_update_chw;
7533 	ic->ic_parent = lkpi_ic_parent;
7534 	ic->ic_scan_start = lkpi_ic_scan_start;
7535 	ic->ic_scan_end = lkpi_ic_scan_end;
7536 	ic->ic_set_channel = lkpi_ic_set_channel;
7537 	ic->ic_transmit = lkpi_ic_transmit;
7538 	ic->ic_raw_xmit = lkpi_ic_raw_xmit;
7539 	ic->ic_vap_create = lkpi_ic_vap_create;
7540 	ic->ic_vap_delete = lkpi_ic_vap_delete;
7541 	ic->ic_getradiocaps = lkpi_ic_getradiocaps;
7542 	ic->ic_wme.wme_update = lkpi_ic_wme_update;
7543 
7544 	lhw->ic_scan_curchan = ic->ic_scan_curchan;
7545 	ic->ic_scan_curchan = lkpi_ic_scan_curchan;
7546 	lhw->ic_scan_mindwell = ic->ic_scan_mindwell;
7547 	ic->ic_scan_mindwell = lkpi_ic_scan_mindwell;
7548 
7549 	lhw->ic_node_alloc = ic->ic_node_alloc;
7550 	ic->ic_node_alloc = lkpi_ic_node_alloc;
7551 	lhw->ic_node_init = ic->ic_node_init;
7552 	ic->ic_node_init = lkpi_ic_node_init;
7553 	lhw->ic_node_cleanup = ic->ic_node_cleanup;
7554 	ic->ic_node_cleanup = lkpi_ic_node_cleanup;
7555 	lhw->ic_node_free = ic->ic_node_free;
7556 	ic->ic_node_free = lkpi_ic_node_free;
7557 
7558 #ifdef LKPI_80211_HT
7559 	/*
7560 	 * Only attach if the driver/firmware supports (*ampdu_action)().
7561 	 * Otherwise it is in the hands of net80211.
7562 	 */
7563 	if (lhw->ops->ampdu_action != NULL) {
7564 		lhw->ic_recv_action = ic->ic_recv_action;
7565 		ic->ic_recv_action = lkpi_ic_recv_action;
7566 		lhw->ic_send_action = ic->ic_send_action;
7567 		ic->ic_send_action = lkpi_ic_send_action;
7568 
7569 		lhw->ic_ampdu_enable = ic->ic_ampdu_enable;
7570 		ic->ic_ampdu_enable = lkpi_ic_ampdu_enable;
7571 
7572 		lhw->ic_addba_request = ic->ic_addba_request;
7573 		ic->ic_addba_request = lkpi_ic_addba_request;
7574 		lhw->ic_addba_response = ic->ic_addba_response;
7575 		ic->ic_addba_response = lkpi_ic_addba_response;
7576 		lhw->ic_addba_stop = ic->ic_addba_stop;
7577 		ic->ic_addba_stop = lkpi_ic_addba_stop;
7578 		lhw->ic_addba_response_timeout = ic->ic_addba_response_timeout;
7579 		ic->ic_addba_response_timeout = lkpi_ic_addba_response_timeout;
7580 
7581 		lhw->ic_bar_response = ic->ic_bar_response;
7582 		ic->ic_bar_response = lkpi_ic_bar_response;
7583 
7584 		lhw->ic_ampdu_rx_start = ic->ic_ampdu_rx_start;
7585 		ic->ic_ampdu_rx_start = lkpi_ic_ampdu_rx_start;
7586 		lhw->ic_ampdu_rx_stop = ic->ic_ampdu_rx_stop;
7587 		ic->ic_ampdu_rx_stop = lkpi_ic_ampdu_rx_stop;
7588 	}
7589 #endif
7590 
7591 	lkpi_radiotap_attach(lhw);
7592 
7593 	/*
7594 	 * Assign the first possible channel for now;  seems Realtek drivers
7595 	 * expect one.
7596 	 * Also remember the amount of bands we support and the most rates
7597 	 * in any band so we can scale [(ext) sup rates] IE(s) accordingly.
7598 	 */
7599 	lhw->supbands = lhw->max_rates = 0;
7600 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
7601 		struct ieee80211_supported_band *supband;
7602 		struct linuxkpi_ieee80211_channel *channels;
7603 
7604 		supband = hw->wiphy->bands[band];
7605 		if (supband == NULL || supband->n_channels == 0)
7606 			continue;
7607 
7608 		lhw->supbands++;
7609 		lhw->max_rates = max(lhw->max_rates, supband->n_bitrates);
7610 
7611 		/* If we have a channel, we need to keep counting supbands. */
7612 		if (hw->conf.chandef.chan != NULL)
7613 			continue;
7614 
7615 		channels = supband->channels;
7616 		for (i = 0; i < supband->n_channels; i++) {
7617 
7618 			if (channels[i].flags & IEEE80211_CHAN_DISABLED)
7619 				continue;
7620 
7621 			cfg80211_chandef_create(&hw->conf.chandef, &channels[i],
7622 #ifdef LKPI_80211_HT
7623 			    (ic->ic_flags_ht & IEEE80211_FHT_HT) ? NL80211_CHAN_HT20 :
7624 #endif
7625 			    NL80211_CHAN_NO_HT);
7626 			lhw->dflt_chandef = hw->conf.chandef;
7627 #ifdef LINUXKPI_DEBUG_80211
7628 			if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
7629 				ic_printf(ic, "%s:%d: initialized "
7630 				    "hw->conf.chandef and dflt_chandef to %p\n",
7631 				    __func__, __LINE__, &lhw->dflt_chandef);
7632 #endif
7633 			break;
7634 		}
7635 	}
7636 
7637 	IMPROVE("see net80211::ieee80211_chan_init vs. wiphy->bands[].bitrates possibly in lkpi_ic_getradiocaps?");
7638 
7639 	/* Make sure we do not support more than net80211 is willing to take. */
7640 	if (lhw->max_rates > IEEE80211_RATE_MAXSIZE) {
7641 		ic_printf(ic, "%s: limiting max_rates %d to %d!\n", __func__,
7642 		    lhw->max_rates, IEEE80211_RATE_MAXSIZE);
7643 		lhw->max_rates = IEEE80211_RATE_MAXSIZE;
7644 	}
7645 
7646 	/*
7647 	 * The maximum supported bitrates on any band + size for
7648 	 * DSSS Parameter Set give our per-band IE size.
7649 	 * SSID is the responsibility of the driver and goes on the side.
7650 	 * The user specified bits coming from the vap go into the
7651 	 * "common ies" fields.
7652 	 */
7653 	lhw->scan_ie_len = 2 + IEEE80211_RATE_SIZE;
7654 	if (lhw->max_rates > IEEE80211_RATE_SIZE)
7655 		lhw->scan_ie_len += 2 + (lhw->max_rates - IEEE80211_RATE_SIZE);
7656 
7657 	if (hw->wiphy->features & NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) {
7658 		/*
7659 		 * net80211 does not seem to support the DSSS Parameter Set but
7660 		 * some of the drivers insert it so calculate the extra fixed
7661 		 * space in.
7662 		 */
7663 		lhw->scan_ie_len += 2 + 1;
7664 	}
7665 
7666 #if defined(LKPI_80211_HT)
7667 	if ((ic->ic_htcaps & IEEE80211_HTC_HT) != 0)
7668 		lhw->scan_ie_len += sizeof(struct ieee80211_ie_htcap);
7669 #endif
7670 #if defined(LKPI_80211_VHT)
7671 	if (IEEE80211_CONF_VHT(ic))
7672 		lhw->scan_ie_len += 2 + sizeof(struct ieee80211_vht_cap);
7673 #endif
7674 
7675 	/* Reduce the max_scan_ie_len "left" by the amount we consume already. */
7676 	if (hw->wiphy->max_scan_ie_len > 0) {
7677 		if (lhw->scan_ie_len > hw->wiphy->max_scan_ie_len)
7678 			goto err;
7679 		hw->wiphy->max_scan_ie_len -= lhw->scan_ie_len;
7680 	}
7681 
7682 	if (bootverbose) {
7683 		if (hw->netdev_features != 0)
7684 			ic_printf(ic, "netdev_features %b\n",
7685 			    hw->netdev_features, NETIF_F_BITS);
7686 		ieee80211_announce(ic);
7687 	}
7688 
7689 	return (0);
7690 err:
7691 	IMPROVE("TODO FIXME CLEANUP");
7692 	return (-EAGAIN);
7693 }
7694 
7695 void
7696 linuxkpi_ieee80211_ifdetach(struct ieee80211_hw *hw)
7697 {
7698 	struct lkpi_hw *lhw;
7699 	struct ieee80211com *ic;
7700 
7701 	lhw = HW_TO_LHW(hw);
7702 	ic = lhw->ic;
7703 	ieee80211_ifdetach(ic);
7704 }
7705 
7706 void
7707 linuxkpi_ieee80211_iterate_interfaces(struct ieee80211_hw *hw,
7708     enum ieee80211_iface_iter flags,
7709     void(*iterfunc)(void *, uint8_t *, struct ieee80211_vif *),
7710     void *arg)
7711 {
7712 	struct lkpi_hw *lhw;
7713 	struct lkpi_vif *lvif;
7714 	struct ieee80211_vif *vif;
7715 	bool active, atomic, nin_drv;
7716 
7717 	lhw = HW_TO_LHW(hw);
7718 
7719 	if (flags & ~(IEEE80211_IFACE_ITER_NORMAL|
7720 	    IEEE80211_IFACE_ITER_RESUME_ALL|
7721 	    IEEE80211_IFACE_SKIP_SDATA_NOT_IN_DRIVER|
7722 	    IEEE80211_IFACE_ITER_ACTIVE|IEEE80211_IFACE_ITER__ATOMIC|
7723 	    IEEE80211_IFACE_ITER__MTX)) {
7724 		ic_printf(lhw->ic, "XXX TODO %s flags(%#x) not yet supported.\n",
7725 		    __func__, flags);
7726 	}
7727 
7728 	if ((flags & IEEE80211_IFACE_ITER__MTX) != 0)
7729 		lockdep_assert_wiphy(hw->wiphy);
7730 
7731 	active = (flags & IEEE80211_IFACE_ITER_ACTIVE) != 0;
7732 	atomic = (flags & IEEE80211_IFACE_ITER__ATOMIC) != 0;
7733 	nin_drv = (flags & IEEE80211_IFACE_SKIP_SDATA_NOT_IN_DRIVER) != 0;
7734 
7735 	if (atomic) {
7736 		IMPROVE("LKPI_80211_LHW_LVIF_LOCK atomic assume to be rcu?");
7737 		LKPI_80211_LHW_LVIF_LOCK(lhw);
7738 	}
7739 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
7740 		struct ieee80211vap *vap;
7741 
7742 		vif = LVIF_TO_VIF(lvif);
7743 
7744 		/*
7745 		 * If we want "active" interfaces, we need to distinguish on
7746 		 * whether the driver knows about them or not to be able to
7747 		 * handle the "resume" case correctly.  Skip the ones the
7748 		 * driver does not know about.
7749 		 */
7750 		if (active && !lvif->added_to_drv &&
7751 		    (flags & IEEE80211_IFACE_ITER_RESUME_ALL) != 0)
7752 			continue;
7753 
7754 		/*
7755 		 * If we shall skip interfaces not added to the driver do so
7756 		 * if we haven't yet.
7757 		 */
7758 		if (nin_drv && !lvif->added_to_drv)
7759 			continue;
7760 
7761 		/*
7762 		 * Run the iterator function if we are either not asking
7763 		 * asking for active only or if the VAP is "running".
7764 		 */
7765 		/* XXX-BZ probably should have state in the lvif as well. */
7766 		vap = LVIF_TO_VAP(lvif);
7767 		if (!active || (vap->iv_state != IEEE80211_S_INIT))
7768 			iterfunc(arg, vif->addr, vif);
7769 	}
7770 	if (atomic)
7771 		LKPI_80211_LHW_LVIF_UNLOCK(lhw);
7772 }
7773 
7774 static void
7775 lkpi_ieee80211_iterate_keys(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
7776     ieee80211_keyix keyix, struct lkpi_sta *lsta,
7777     void(*iterfunc)(struct ieee80211_hw *, struct ieee80211_vif *,
7778 	struct ieee80211_sta *, struct ieee80211_key_conf *, void *),
7779     void *arg)
7780 {
7781 #ifdef LINUXKPI_DEBUG_80211
7782 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
7783 		net80211_vap_printf(LVIF_TO_VAP(VIF_TO_LVIF(vif)),
7784 		    "%s:%d: lsta %6D added_to_drv %d kc[keyix %u] %p\n",
7785 		    __func__, __LINE__, LSTA_TO_STA(lsta)->addr, ":",
7786 		    lsta->added_to_drv, keyix, lsta->kc[keyix]);
7787 #endif
7788 
7789 	if (!lsta->added_to_drv)
7790 		return;
7791 
7792 	if (lsta->kc[keyix] == NULL)
7793 		return;
7794 
7795 	iterfunc(hw, vif, LSTA_TO_STA(lsta), lsta->kc[keyix], arg);
7796 }
7797 
7798 void
7799 linuxkpi_ieee80211_iterate_keys(struct ieee80211_hw *hw,
7800     struct ieee80211_vif *vif,
7801     void(*iterfunc)(struct ieee80211_hw *, struct ieee80211_vif *,
7802         struct ieee80211_sta *, struct ieee80211_key_conf *, void *),
7803     void *arg, bool rcu)
7804 {
7805 	struct lkpi_sta *lsta;
7806 	struct lkpi_vif *lvif;
7807 
7808 	lvif = VIF_TO_LVIF(vif);
7809 
7810 	if (rcu) {
7811 		rcu_read_lock_held();		/* XXX-BZ is this correct? */
7812 
7813 		if (vif == NULL) {
7814 			TODO();
7815 		} else {
7816 			list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
7817 				for (ieee80211_keyix keyix = 0; keyix < nitems(lsta->kc);
7818 				    keyix++)
7819 					lkpi_ieee80211_iterate_keys(hw, vif,
7820 					    keyix, lsta, iterfunc, arg);
7821 			}
7822 		}
7823 	} else {
7824 		TODO("Used by suspend/resume; order of keys as installed to "
7825 		"firmware is important; we'll need to rewrite some code for that");
7826 		lockdep_assert_wiphy(hw->wiphy);
7827 
7828 		if (vif == NULL) {
7829 			TODO();
7830 		} else {
7831 			list_for_each_entry(lsta, &lvif->lsta_list, lsta_list) {
7832 				for (ieee80211_keyix keyix = 0; keyix < nitems(lsta->kc);
7833 				    keyix++)
7834 					lkpi_ieee80211_iterate_keys(hw, vif,
7835 					    keyix, lsta, iterfunc, arg);
7836 			}
7837 		}
7838 	}
7839 }
7840 
7841 void
7842 linuxkpi_ieee80211_iterate_chan_contexts(struct ieee80211_hw *hw,
7843     void(*iterfunc)(struct ieee80211_hw *, struct ieee80211_chanctx_conf *,
7844 	void *),
7845     void *arg)
7846 {
7847 	struct lkpi_hw *lhw;
7848 	struct lkpi_chanctx *lchanctx;
7849 
7850 	KASSERT(hw != NULL && iterfunc != NULL,
7851 	    ("%s: hw %p iterfunc %p arg %p\n", __func__, hw, iterfunc, arg));
7852 
7853 	lhw = HW_TO_LHW(hw);
7854 
7855 	rcu_read_lock();
7856 	list_for_each_entry_rcu(lchanctx, &lhw->lchanctx_list, entry) {
7857 		if (!lchanctx->added_to_drv)
7858 			continue;
7859 		iterfunc(hw, &lchanctx->chanctx_conf, arg);
7860 	}
7861 	rcu_read_unlock();
7862 }
7863 
7864 void
7865 linuxkpi_ieee80211_iterate_stations_atomic(struct ieee80211_hw *hw,
7866    void (*iterfunc)(void *, struct ieee80211_sta *), void *arg)
7867 {
7868 	struct lkpi_hw *lhw;
7869 	struct lkpi_vif *lvif;
7870 	struct lkpi_sta *lsta;
7871 	struct ieee80211_sta *sta;
7872 
7873 	KASSERT(hw != NULL && iterfunc != NULL,
7874 	    ("%s: hw %p iterfunc %p arg %p\n", __func__, hw, iterfunc, arg));
7875 
7876 	lhw = HW_TO_LHW(hw);
7877 
7878 	LKPI_80211_LHW_LVIF_LOCK(lhw);
7879 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
7880 
7881 		rcu_read_lock();
7882 		list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
7883 			if (!lsta->added_to_drv)
7884 				continue;
7885 			sta = LSTA_TO_STA(lsta);
7886 			iterfunc(arg, sta);
7887 		}
7888 		rcu_read_unlock();
7889 	}
7890 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
7891 }
7892 
7893 struct linuxkpi_ieee80211_regdomain *
7894 lkpi_get_linuxkpi_ieee80211_regdomain(size_t n)
7895 {
7896 	struct linuxkpi_ieee80211_regdomain *regd;
7897 
7898 	regd = kzalloc(sizeof(*regd) + n * sizeof(struct ieee80211_reg_rule),
7899 	    GFP_KERNEL);
7900 	return (regd);
7901 }
7902 
7903 int
7904 linuxkpi_regulatory_set_wiphy_regd_sync(struct wiphy *wiphy,
7905     struct linuxkpi_ieee80211_regdomain *regd)
7906 {
7907 	struct lkpi_hw *lhw;
7908 	struct ieee80211com *ic;
7909 	struct ieee80211_regdomain *rd;
7910 
7911 	lhw = wiphy_priv(wiphy);
7912 	ic = lhw->ic;
7913 
7914 	rd = &ic->ic_regdomain;
7915 	if (rd->isocc[0] == '\0') {
7916 		rd->isocc[0] = regd->alpha2[0];
7917 		rd->isocc[1] = regd->alpha2[1];
7918 	}
7919 
7920 	TODO();
7921 	/* XXX-BZ finish the rest. */
7922 
7923 	return (0);
7924 }
7925 
7926 void
7927 linuxkpi_ieee80211_scan_completed(struct ieee80211_hw *hw,
7928     struct cfg80211_scan_info *info)
7929 {
7930 	struct lkpi_hw *lhw;
7931 	struct ieee80211com *ic;
7932 	struct ieee80211_scan_state *ss;
7933 
7934 	lhw = wiphy_priv(hw->wiphy);
7935 	ic = lhw->ic;
7936 	ss = ic->ic_scan;
7937 
7938 	TRACE_SCAN(ic, "scan_flags %b info { %ju, %6D, aborted %d }",
7939 	    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
7940 	    (uintmax_t)info->scan_start_tsf, info->tsf_bssid, ":",
7941 	    info->aborted);
7942 
7943 	ieee80211_scan_done(ss->ss_vap);
7944 
7945 	LKPI_80211_LHW_SCAN_LOCK(lhw);
7946 	free(lhw->hw_req, M_LKPI80211);
7947 	lhw->hw_req = NULL;
7948 	lhw->scan_flags &= ~LKPI_LHW_SCAN_RUNNING;
7949 	/* The wakeup(lhw) will be called from lkpi_ic_scan_end(). */
7950 	/* wakeup(lhw); */
7951 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
7952 
7953 	return;
7954 }
7955 
7956 static void
7957 lkpi_80211_lhw_rxq_rx_one(struct lkpi_hw *lhw, struct mbuf *m)
7958 {
7959 	struct ieee80211_node *ni;
7960 #ifdef LKPI_80211_USE_MTAG
7961 	struct m_tag *mtag;
7962 #endif
7963 	int ok;
7964 
7965 	ni = NULL;
7966 #ifdef LKPI_80211_USE_MTAG
7967         mtag = m_tag_locate(m, MTAG_ABI_LKPI80211, LKPI80211_TAG_RXNI, NULL);
7968 	if (mtag != NULL) {
7969 		struct lkpi_80211_tag_rxni *rxni;
7970 
7971 		rxni = (struct lkpi_80211_tag_rxni *)(mtag + 1);
7972 		ni = rxni->ni;
7973 	}
7974 #else
7975 	if (m->m_pkthdr.PH_loc.ptr != NULL) {
7976 		ni = m->m_pkthdr.PH_loc.ptr;
7977 		m->m_pkthdr.PH_loc.ptr = NULL;
7978 	}
7979 #endif
7980 
7981 	if (ni != NULL) {
7982 		ok = ieee80211_input_mimo(ni, m);
7983 		ieee80211_free_node(ni);		/* Release the reference. */
7984 		if (ok < 0)
7985 			m_freem(m);
7986 	} else {
7987 		ok = ieee80211_input_mimo_all(lhw->ic, m);
7988 		/* mbuf got consumed. */
7989 	}
7990 
7991 #ifdef LINUXKPI_DEBUG_80211
7992 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
7993 		printf("TRACE-RX: %s: handled frame type %#0x\n", __func__, ok);
7994 #endif
7995 }
7996 
7997 static void
7998 lkpi_80211_lhw_rxq_task(void *ctx, int pending)
7999 {
8000 	struct lkpi_hw *lhw;
8001 	struct mbufq mq;
8002 	struct mbuf *m;
8003 
8004 	lhw = ctx;
8005 
8006 #ifdef LINUXKPI_DEBUG_80211
8007 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
8008 		printf("TRACE-RX: %s: lhw %p pending %d mbuf_qlen %d\n",
8009 		    __func__, lhw, pending, mbufq_len(&lhw->rxq));
8010 #endif
8011 
8012 	mbufq_init(&mq, IFQ_MAXLEN);
8013 
8014 	LKPI_80211_LHW_RXQ_LOCK(lhw);
8015 	mbufq_concat(&mq, &lhw->rxq);
8016 	LKPI_80211_LHW_RXQ_UNLOCK(lhw);
8017 
8018 	m = mbufq_dequeue(&mq);
8019 	while (m != NULL) {
8020 		lkpi_80211_lhw_rxq_rx_one(lhw, m);
8021 		m = mbufq_dequeue(&mq);
8022 	}
8023 }
8024 
8025 static void
8026 lkpi_convert_rx_status(struct ieee80211_hw *hw, struct lkpi_sta *lsta,
8027     struct ieee80211_rx_status *rx_status,
8028     struct ieee80211_rx_stats *rx_stats,
8029     uint8_t *rssip)
8030 {
8031 	struct ieee80211_supported_band *supband;
8032 	struct rate_info rxrate;
8033 	int i;
8034 	uint8_t rssi;
8035 
8036 	memset(&rxrate, 0, sizeof(rxrate));
8037 	memset(rx_stats, 0, sizeof(*rx_stats));
8038 	rx_stats->r_flags = IEEE80211_R_NF | IEEE80211_R_RSSI;
8039 	/* XXX-BZ correct hardcoded noise floor, survey data? */
8040 	rx_stats->c_nf = -96;
8041 	if (ieee80211_hw_check(hw, SIGNAL_DBM) &&
8042 	    !(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL))
8043 		rssi = rx_status->signal;
8044 	else
8045 		rssi = rx_stats->c_nf;
8046 	/*
8047 	 * net80211 signal strength data are in .5 dBm units relative to
8048 	 * the current noise floor (see comment in ieee80211_node.h).
8049 	 */
8050 	rssi -= rx_stats->c_nf;
8051 	if (rssip != NULL)
8052 		*rssip = rssi;
8053 	rx_stats->c_rssi = rssi * 2;
8054 	rx_stats->r_flags |= IEEE80211_R_BAND;
8055 	rx_stats->c_band =
8056 	    lkpi_nl80211_band_to_net80211_band(rx_status->band);
8057 	rx_stats->r_flags |= IEEE80211_R_FREQ | IEEE80211_R_IEEE;
8058 	rx_stats->c_freq = rx_status->freq;
8059 	rx_stats->c_ieee = ieee80211_mhz2ieee(rx_stats->c_freq, rx_stats->c_band);
8060 
8061 	rx_stats->c_rx_tsf = rx_status->mactime;
8062 
8063 	/* XXX RX_FLAG_MACTIME_IS_RTAP_TS64 ? */
8064 	if ((rx_status->flag & RX_FLAG_MACTIME) ==
8065 	    (RX_FLAG_MACTIME_START|RX_FLAG_MACTIME_END)) {
8066 		rx_stats->r_flags |= IEEE80211_R_TSF64;
8067 		/* XXX RX_FLAG_MACTIME_PLCP_START ? */
8068 		if ((rx_status->flag & RX_FLAG_MACTIME) == RX_FLAG_MACTIME_START)
8069 			rx_stats->r_flags |= IEEE80211_R_TSF_START;
8070 		if ((rx_status->flag & RX_FLAG_MACTIME) == RX_FLAG_MACTIME_END)
8071 			rx_stats->r_flags |= IEEE80211_R_TSF_END;
8072 		/* XXX-BZ if TSF_END will net80211 do the unwind of time? */
8073 	}
8074 
8075 	if (rx_status->chains != 0) {
8076 		int cc;
8077 		int8_t crssi;
8078 
8079 		rx_stats->c_chain = rx_status->chains;
8080 		rx_stats->r_flags |= IEEE80211_R_C_CHAIN;
8081 
8082 		cc = 0;
8083 		for (i = 0; i < nitems(rx_status->chain_signal); i++) {
8084 			if (!(rx_status->chains & BIT(i)))
8085 				continue;
8086 			crssi = rx_status->chain_signal[i];
8087 			crssi -= rx_stats->c_nf;
8088 			rx_stats->c_rssi_ctl[i] = crssi * 2;
8089 			rx_stats->c_rssi_ext[i] = crssi * 2;	/* XXX _ext ??? ATH thing? */
8090 			/* We currently only have the global noise floor value. */
8091 			rx_stats->c_nf_ctl[i] = rx_stats->c_nf;
8092 			rx_stats->c_nf_ext[i] = rx_stats->c_nf;
8093 			cc++;
8094 		}
8095 		if (cc > 0)
8096 			 rx_stats->r_flags |= (IEEE80211_R_C_NF | IEEE80211_R_C_RSSI);
8097 	}
8098 
8099 	/* XXX-NET80211 We are not going to populate c_phytype! */
8100 
8101 	switch (rx_status->encoding) {
8102 	case RX_ENC_LEGACY:
8103 	{
8104 		uint32_t legacy = 0;
8105 
8106 		supband = hw->wiphy->bands[rx_status->band];
8107 		if (supband != NULL)
8108 			legacy = supband->bitrates[rx_status->rate_idx].bitrate;
8109 		rx_stats->c_rate = legacy;
8110 		rxrate.legacy = legacy;
8111 		/* Is there a LinuxKPI way of reporting IEEE80211_RX_F_CCK / _OFDM? */
8112 		break;
8113 	}
8114 	case RX_ENC_HT:
8115 		rx_stats->c_pktflags |= IEEE80211_RX_F_HT;
8116 		rx_stats->c_rate = rx_status->rate_idx;		/* mcs */
8117 		rxrate.flags |= RATE_INFO_FLAGS_MCS;
8118 		rxrate.mcs = rx_status->rate_idx;
8119 		if ((rx_status->enc_flags & RX_ENC_FLAG_SHORT_GI) != 0) {
8120 			rx_stats->c_pktflags |= IEEE80211_RX_F_SHORTGI;
8121 			rxrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
8122 		}
8123 		break;
8124 	case RX_ENC_VHT:
8125 		rx_stats->c_pktflags |= IEEE80211_RX_F_VHT;
8126 		rx_stats->c_rate = rx_status->rate_idx;		/* mcs */
8127 		rx_stats->c_vhtnss = rx_status->nss;
8128 		rxrate.flags |= RATE_INFO_FLAGS_VHT_MCS;
8129 		rxrate.mcs = rx_status->rate_idx;
8130 		rxrate.nss = rx_status->nss;
8131 		if ((rx_status->enc_flags & RX_ENC_FLAG_SHORT_GI) != 0) {
8132 			rx_stats->c_pktflags |= IEEE80211_RX_F_SHORTGI;
8133 			rxrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
8134 		}
8135 		break;
8136 	case RX_ENC_HE:
8137 		rxrate.flags |= RATE_INFO_FLAGS_HE_MCS;
8138 		rxrate.mcs = rx_status->rate_idx;
8139 		rxrate.nss = rx_status->nss;
8140 		/* XXX TODO */
8141 		TODO("net80211 has not matching encoding for %u", rx_status->encoding);
8142 		break;
8143 	case RX_ENC_EHT:
8144 		rxrate.flags |= RATE_INFO_FLAGS_EHT_MCS;
8145 		rxrate.mcs = rx_status->rate_idx;
8146 		rxrate.nss = rx_status->nss;
8147 		/* XXX TODO */
8148 		TODO("net80211 has not matching encoding for %u", rx_status->encoding);
8149 		break;
8150 	}
8151 
8152 	rxrate.bw = rx_status->bw;
8153 	switch (rx_status->bw) {
8154 	case RATE_INFO_BW_20:
8155 		rx_stats->c_width = IEEE80211_RX_FW_20MHZ;
8156 		break;
8157 	case RATE_INFO_BW_40:
8158 		rx_stats->c_width = IEEE80211_RX_FW_40MHZ;
8159 		break;
8160 	case RATE_INFO_BW_80:
8161 		rx_stats->c_width = IEEE80211_RX_FW_80MHZ;
8162 		break;
8163 	case RATE_INFO_BW_160:
8164 		rx_stats->c_width = IEEE80211_RX_FW_160MHZ;
8165 		break;
8166 	case RATE_INFO_BW_320:
8167 	case RATE_INFO_BW_HE_RU:
8168 	case RATE_INFO_BW_EHT_RU:
8169 	case RATE_INFO_BW_5:
8170 	case RATE_INFO_BW_10:
8171 		TODO("net80211 has not matching bandwidth for %u", rx_status->bw);
8172 		break;
8173 	}
8174 
8175 	if ((rx_status->enc_flags & RX_ENC_FLAG_LDPC) != 0)
8176 		rx_stats->c_pktflags |= IEEE80211_RX_F_LDPC;
8177 	if ((rx_status->enc_flags & RX_ENC_FLAG_STBC_MASK) != 0)
8178 		 rx_stats->c_pktflags |= IEEE80211_RX_F_STBC;
8179 
8180 	/*
8181 	 * We only need these for LKPI_80211_HW_CRYPTO in theory but in
8182 	 * case the hardware does something we do not expect always leave
8183 	 * these enabled.  Leaving this commant as documentation for the || 1.
8184 	 */
8185 #if defined(LKPI_80211_HW_CRYPTO) || 1
8186 	if (rx_status->flag & RX_FLAG_DECRYPTED) {
8187 		rx_stats->c_pktflags |= IEEE80211_RX_F_DECRYPTED;
8188 		/* Only valid if decrypted is set. */
8189 		if (rx_status->flag & RX_FLAG_PN_VALIDATED)
8190 			rx_stats->c_pktflags |= IEEE80211_RX_F_PN_VALIDATED;
8191 	}
8192 	if (rx_status->flag & RX_FLAG_IV_STRIPPED)
8193 		rx_stats->c_pktflags |= IEEE80211_RX_F_IV_STRIP;
8194 	if (rx_status->flag & RX_FLAG_ICV_STRIPPED)
8195 		rx_stats->c_pktflags |= IEEE80211_RX_F_ICV_STRIP;
8196 	if (rx_status->flag & RX_FLAG_MIC_STRIPPED)
8197 		rx_stats->c_pktflags |= IEEE80211_RX_F_MIC_STRIP;
8198 	if (rx_status->flag & RX_FLAG_MMIC_STRIPPED)
8199 		rx_stats->c_pktflags |= IEEE80211_RX_F_MMIC_STRIP;
8200 	if (rx_status->flag & RX_FLAG_MMIC_ERROR)
8201 		rx_stats->c_pktflags |= IEEE80211_RX_F_FAIL_MMIC;
8202 	if (rx_status->flag & RX_FLAG_FAILED_FCS_CRC)
8203 		rx_stats->c_pktflags |= IEEE80211_RX_F_FAIL_FCSCRC;
8204 #endif
8205 
8206 	/* Fill in some sinfo bits to fill gaps not reported byt the driver. */
8207 	if (lsta != NULL) {
8208 		memcpy(&lsta->sinfo.rxrate, &rxrate, sizeof(rxrate));
8209 		lsta->sinfo.filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
8210 
8211 		if (rx_status->chains != 0) {
8212 			lsta->sinfo.chains = rx_status->chains;
8213 			memcpy(lsta->sinfo.chain_signal, rx_status->chain_signal,
8214 			    sizeof(lsta->sinfo.chain_signal));
8215 			lsta->sinfo.filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
8216 		}
8217 	}
8218 }
8219 
8220 #ifdef LINUXKPI_DEBUG_80211
8221 static void
8222 lkpi_rx_log_beacon(struct mbuf *m, struct lkpi_hw *lhw,
8223     struct ieee80211_rx_status *rx_status)
8224 {
8225 	struct ieee80211_mgmt *f;
8226 	uint8_t *e;
8227 	char ssid[IEEE80211_NWID_LEN * 4 + 1];
8228 
8229 	memset(ssid, '\0', sizeof(ssid));
8230 
8231 	f = mtod(m, struct ieee80211_mgmt *);
8232 	e = f->u.beacon.variable;
8233 	/*
8234 	 * Usually SSID is right after the fixed part and for debugging we will
8235 	 * be fine should we miss it if it is not.
8236 	 */
8237 	while ((e - (uint8_t *)f) < m->m_len) {
8238 		if (*e == IEEE80211_ELEMID_SSID)
8239 			break;
8240 		e += (2 + *(e + 1));
8241 	}
8242 	if (*e == IEEE80211_ELEMID_SSID) {
8243 		int i, len;
8244 		char *p;
8245 
8246 		p = ssid;
8247 		len = m->m_len - ((e + 2) - (uint8_t *)f);
8248 		if (len > *(e + 1))
8249 			len = *(e + 1);
8250 		e += 2;
8251 		for (i = 0; i < len; i++) {
8252 			/* Printable character? */
8253 			if (*e >= 0x20 && *e < 0x7f) {
8254 				*p++ = *e++;
8255 			} else {
8256 				snprintf(p, 5, "%#04x", *e++);
8257 				p += 4;
8258 			}
8259 		}
8260 		*p = '\0';
8261 	}
8262 
8263 	/* We print skb, skb->data, m as we are seeing 'ghost beacons'. */
8264 	TRACE_SCAN_BEACON(lhw->ic, "Beacon: scan_flags %b, band %s freq %u chan %-4d "
8265 	    "len %d { %#06x %#06x %6D %6D %6D %#06x %ju %u %#06x SSID '%s' }",
8266 	    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
8267 	    lkpi_nl80211_band_name(rx_status->band), rx_status->freq,
8268 	    linuxkpi_ieee80211_frequency_to_channel(rx_status->freq, 0),
8269 	    m->m_pkthdr.len, f->frame_control, f->duration_id,
8270 	    f->da, ":", f->sa, ":", f->bssid, ":", f->seq_ctrl,
8271 	    (uintmax_t)le64_to_cpu(f->u.beacon.timestamp),
8272 	    le16_to_cpu(f->u.beacon.beacon_int),
8273 	    le16_to_cpu(f->u.beacon.capab_info), ssid);
8274 }
8275 #endif
8276 
8277 /* For %list see comment towards the end of the function. */
8278 void
8279 linuxkpi_ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
8280     struct ieee80211_sta *sta, struct napi_struct *napi __unused,
8281     struct list_head *list __unused)
8282 {
8283 	struct lkpi_hw *lhw;
8284 	struct ieee80211com *ic;
8285 	struct mbuf *m;
8286 	struct skb_shared_info *shinfo;
8287 	struct ieee80211_rx_status *rx_status;
8288 	struct ieee80211_rx_stats rx_stats;
8289 	struct ieee80211_node *ni;
8290 	struct ieee80211vap *vap;
8291 	struct ieee80211_hdr *hdr;
8292 	struct lkpi_sta *lsta;
8293 	int i, offset, ok, error;
8294 	uint8_t rssi;
8295 	bool is_beacon;
8296 
8297 	lhw = HW_TO_LHW(hw);
8298 	ic = lhw->ic;
8299 
8300 	if (skb->len < 2) {
8301 		/* Need 80211 stats here. */
8302 		counter_u64_add(ic->ic_ierrors, 1);
8303 		IMPROVE();
8304 		goto err;
8305 	}
8306 
8307 	/*
8308 	 * For now do the data copy; we can later improve things. Might even
8309 	 * have an mbuf backing the skb data then?
8310 	 */
8311 	m = m_get3(skb->len, M_NOWAIT, MT_DATA, M_PKTHDR);
8312 	if (m == NULL) {
8313 		counter_u64_add(ic->ic_ierrors, 1);
8314 		goto err;
8315 	}
8316 	m_copyback(m, 0, skb->tail - skb->data, skb->data);
8317 
8318 	shinfo = skb_shinfo(skb);
8319 	offset = m->m_len;
8320 	for (i = 0; i < shinfo->nr_frags; i++) {
8321 		m_copyback(m, offset, shinfo->frags[i].size,
8322 		    (uint8_t *)linux_page_address(shinfo->frags[i].page) +
8323 		    shinfo->frags[i].offset);
8324 		offset += shinfo->frags[i].size;
8325 	}
8326 
8327 	rx_status = IEEE80211_SKB_RXCB(skb);
8328 
8329 	hdr = (void *)skb->data;
8330 	is_beacon = ieee80211_is_beacon(hdr->frame_control);
8331 
8332 #ifdef LINUXKPI_DEBUG_80211
8333 	/*
8334 	 * We use the mbuf here as otherwise the variable part might
8335 	 * be in skb frags.
8336 	 */
8337 	if (is_beacon && ((linuxkpi_debug_80211 & D80211_SCAN_BEACON) != 0))
8338 		lkpi_rx_log_beacon(m, lhw, rx_status);
8339 
8340 	if (is_beacon && (linuxkpi_debug_80211 & D80211_TRACE_RX_BEACONS) == 0 &&
8341 	   (linuxkpi_debug_80211 & D80211_SCAN_BEACON) == 0)
8342 		goto no_trace_beacons;
8343 
8344 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
8345 		printf("TRACE-RX: %s: skb %p l/d/t-len (%u/%u/%u) "
8346 		    "h %p d %p t %p e %p sh %p (%u) m %p plen %u len %u%s\n",
8347 		    __func__, skb, skb->len, skb->data_len,
8348 		    skb->truesize, skb->head, skb->data, skb->tail, skb->end,
8349 		    shinfo, shinfo->nr_frags,
8350 		    m, m->m_pkthdr.len, m->m_len, is_beacon ? " beacon" : "");
8351 
8352 	if (linuxkpi_debug_80211 & D80211_TRACE_RX_DUMP)
8353 		hexdump(mtod(m, const void *), m->m_len, "RX (raw) ", 0);
8354 
8355 	/* Implement a dump_rxcb() !!! */
8356 	if ((linuxkpi_debug_80211 & D80211_TRACE_RX) != 0 ||
8357 	    (linuxkpi_debug_80211 & D80211_SCAN_BEACON) != 0)
8358 		printf("TRACE-RX: %s: RXCB: %ju %ju %u, %b, %u, %#0x, %#0x, "
8359 		    "%u band %u, %u { %d %d %d %d }, %d, %#x %#x %#x %#x %u %u %u\n",
8360 			__func__,
8361 			(uintmax_t)rx_status->boottime_ns,
8362 			(uintmax_t)rx_status->mactime,
8363 			rx_status->device_timestamp,
8364 			rx_status->flag, IEEE80211_RX_STATUS_FLAGS_BITS,
8365 			rx_status->freq,
8366 			rx_status->bw,
8367 			rx_status->encoding,
8368 			rx_status->ampdu_reference,
8369 			rx_status->band,
8370 			rx_status->chains,
8371 			rx_status->chain_signal[0],
8372 			rx_status->chain_signal[1],
8373 			rx_status->chain_signal[2],
8374 			rx_status->chain_signal[3],
8375 			rx_status->signal,
8376 			rx_status->enc_flags,
8377 			rx_status->he_dcm,
8378 			rx_status->he_gi,
8379 			rx_status->he_ru,
8380 			rx_status->zero_length_psdu_type,
8381 			rx_status->nss,
8382 			rx_status->rate_idx);
8383 no_trace_beacons:
8384 #endif
8385 
8386 	lsta = NULL;
8387 	if (sta != NULL) {
8388 		lsta = STA_TO_LSTA(sta);
8389 		ni = ieee80211_ref_node(lsta->ni);
8390 	} else {
8391 		struct ieee80211_frame_min *wh;
8392 
8393 		wh = mtod(m, struct ieee80211_frame_min *);
8394 		ni = ieee80211_find_rxnode(ic, wh);
8395 		if (ni != NULL)
8396 			lsta = ni->ni_drv_data;
8397 	}
8398 
8399 	rssi = 0;
8400 	lkpi_convert_rx_status(hw, lsta, rx_status, &rx_stats, &rssi);
8401 
8402 	ok = ieee80211_add_rx_params(m, &rx_stats);
8403 	if (ok == 0) {
8404 		m_freem(m);
8405 		counter_u64_add(ic->ic_ierrors, 1);
8406 		goto err;
8407 	}
8408 
8409 	if (ni != NULL)
8410 		vap = ni->ni_vap;
8411 	else
8412 		/*
8413 		 * XXX-BZ can we improve this by looking at the frame hdr
8414 		 * or other meta-data passed up?
8415 		 */
8416 		vap = TAILQ_FIRST(&ic->ic_vaps);
8417 
8418 #ifdef LINUXKPI_DEBUG_80211
8419 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
8420 		printf("TRACE-RX: %s: sta %p lsta %p state %d ni %p vap %p%s\n",
8421 		    __func__, sta, lsta, (lsta != NULL) ? lsta->state : -1,
8422 		    ni, vap, is_beacon ? " beacon" : "");
8423 #endif
8424 
8425 	if (ni != NULL && vap != NULL && is_beacon &&
8426 	    rx_status->device_timestamp > 0 &&
8427 	    m->m_pkthdr.len >= sizeof(struct ieee80211_frame)) {
8428 		struct lkpi_vif *lvif;
8429 		struct ieee80211_vif *vif;
8430 		struct ieee80211_frame *wh;
8431 
8432 		lvif = VAP_TO_LVIF(vap);
8433 		vif = LVIF_TO_VIF(lvif);
8434 
8435 		wh = mtod(m, struct ieee80211_frame *);
8436 		if (!IEEE80211_ADDR_EQ(wh->i_addr2, vif->cfg.ap_addr))
8437 			goto skip_device_ts;
8438 
8439 		IMPROVE("TIMING_BEACON_ONLY?");
8440 		/* mac80211 specific (not net80211) so keep it here. */
8441 		vif->bss_conf.sync_device_ts = rx_status->device_timestamp;
8442 		/*
8443 		 * net80211 should take care of the other information (sync_tsf,
8444 		 * sync_dtim_count) as otherwise we need to parse the beacon.
8445 		 */
8446 skip_device_ts:
8447 		;
8448 	}
8449 
8450 	if (vap != NULL && vap->iv_state > IEEE80211_S_INIT &&
8451 	    ieee80211_radiotap_active_vap(vap)) {
8452 		struct lkpi_radiotap_rx_hdr *rtap;
8453 
8454 		rtap = &lhw->rtap_rx;
8455 		rtap->wr_tsft = rx_status->device_timestamp;
8456 		rtap->wr_flags = 0;
8457 		if (rx_status->enc_flags & RX_ENC_FLAG_SHORTPRE)
8458 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
8459 		if (rx_status->enc_flags & RX_ENC_FLAG_SHORT_GI)
8460 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTGI;
8461 #if 0	/* .. or it does not given we strip it below. */
8462 		if (ieee80211_hw_check(hw, RX_INCLUDES_FCS))
8463 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_FCS;
8464 #endif
8465 		if (rx_status->flag & RX_FLAG_FAILED_FCS_CRC)
8466 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
8467 		rtap->wr_rate = 0;
8468 		IMPROVE();
8469 		/* XXX TODO status->encoding / rate_index / bw */
8470 		rtap->wr_chan_freq = htole16(rx_stats.c_freq);
8471 		if (ic->ic_curchan->ic_ieee == rx_stats.c_ieee)
8472 			rtap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
8473 		rtap->wr_dbm_antsignal = rssi;
8474 		rtap->wr_dbm_antnoise = rx_stats.c_nf;
8475 	}
8476 
8477 	if (ieee80211_hw_check(hw, RX_INCLUDES_FCS))
8478 		m_adj(m, -IEEE80211_CRC_LEN);
8479 
8480 #if 0
8481 	if (list != NULL) {
8482 		/*
8483 		* Normally this would be queued up and delivered by
8484 		* netif_receive_skb_list(), napi_gro_receive(), or the like.
8485 		* See mt76::mac80211.c as only current possible consumer.
8486 		*/
8487 		IMPROVE("we simply pass the packet to net80211 to deal with.");
8488 	}
8489 #endif
8490 
8491 	/* Attach meta-information to the mbuf for the deferred RX path. */
8492 	if (ni != NULL) {
8493 #ifdef LKPI_80211_USE_MTAG
8494 		struct m_tag *mtag;
8495 		struct lkpi_80211_tag_rxni *rxni;
8496 
8497 		mtag = m_tag_alloc(MTAG_ABI_LKPI80211, LKPI80211_TAG_RXNI,
8498 		    sizeof(*rxni), IEEE80211_M_NOWAIT);
8499 		if (mtag == NULL) {
8500 			m_freem(m);
8501 			counter_u64_add(ic->ic_ierrors, 1);
8502 			goto err;
8503 		}
8504 		rxni = (struct lkpi_80211_tag_rxni *)(mtag + 1);
8505 		rxni->ni = ni;		/* We hold a reference. */
8506 		m_tag_prepend(m, mtag);
8507 #else
8508 		m->m_pkthdr.PH_loc.ptr = ni;	/* We hold a reference. */
8509 #endif
8510 	}
8511 
8512 	LKPI_80211_LHW_RXQ_LOCK(lhw);
8513 	if (lhw->rxq_stopped) {
8514 		LKPI_80211_LHW_RXQ_UNLOCK(lhw);
8515 		m_freem(m);
8516 		counter_u64_add(ic->ic_ierrors, 1);
8517 		goto err;
8518 	}
8519 
8520 	error = mbufq_enqueue(&lhw->rxq, m);
8521 	if (error != 0) {
8522 		LKPI_80211_LHW_RXQ_UNLOCK(lhw);
8523 		m_freem(m);
8524 		counter_u64_add(ic->ic_ierrors, 1);
8525 #ifdef LINUXKPI_DEBUG_80211
8526 		if (linuxkpi_debug_80211 & D80211_TRACE_RX)
8527 			ic_printf(ni->ni_ic, "%s: mbufq_enqueue failed: %d\n",
8528 			    __func__, error);
8529 #endif
8530 		goto err;
8531 	}
8532 	taskqueue_enqueue(taskqueue_thread, &lhw->rxq_task);
8533 	LKPI_80211_LHW_RXQ_UNLOCK(lhw);
8534 
8535 	IMPROVE();
8536 
8537 err:
8538 	/* The skb is ours so we can free it :-) */
8539 	kfree_skb(skb);
8540 }
8541 
8542 uint8_t
8543 linuxkpi_ieee80211_get_tid(struct ieee80211_hdr *hdr, bool nonqos_ok)
8544 {
8545 	const struct ieee80211_frame *wh;
8546 	uint8_t tid;
8547 
8548 	/* Linux seems to assume this is a QOS-Data-Frame */
8549 	KASSERT(nonqos_ok || ieee80211_is_data_qos(hdr->frame_control),
8550 	   ("%s: hdr %p fc %#06x not qos_data\n", __func__, hdr,
8551 	   hdr->frame_control));
8552 
8553 	wh = (const struct ieee80211_frame *)hdr;
8554 	tid = ieee80211_gettid(wh);
8555 	KASSERT(nonqos_ok || tid == (tid & IEEE80211_QOS_TID), ("%s: tid %u "
8556 	   "not expected (%u?)\n", __func__, tid, IEEE80211_NONQOS_TID));
8557 
8558 	return (tid);
8559 }
8560 
8561 /* -------------------------------------------------------------------------- */
8562 
8563 static void
8564 lkpi_wiphy_work(struct work_struct *work)
8565 {
8566 	struct lkpi_wiphy *lwiphy;
8567 	struct wiphy *wiphy;
8568 	struct wiphy_work *wk;
8569 
8570 	lwiphy = container_of(work, struct lkpi_wiphy, wwk);
8571 	wiphy = LWIPHY_TO_WIPHY(lwiphy);
8572 
8573 	wiphy_lock(wiphy);
8574 
8575 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8576 	wk = list_first_entry_or_null(&lwiphy->wwk_list, struct wiphy_work, entry);
8577 	/* If there is nothing we do nothing. */
8578 	if (wk == NULL) {
8579 		LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8580 		wiphy_unlock(wiphy);
8581 		return;
8582 	}
8583 	list_del_init(&wk->entry);
8584 
8585 	/* More work to do? */
8586 	if (!list_empty(&lwiphy->wwk_list))
8587 		schedule_work(work);
8588 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8589 
8590 	/* Finally call the (*wiphy_work_fn)() function. */
8591 	wk->fn(wiphy, wk);
8592 
8593 	wiphy_unlock(wiphy);
8594 }
8595 
8596 void
8597 linuxkpi_wiphy_work_queue(struct wiphy *wiphy, struct wiphy_work *wwk)
8598 {
8599 	struct lkpi_wiphy *lwiphy;
8600 
8601 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
8602 
8603 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8604 	/* Do not double-queue. */
8605 	if (list_empty(&wwk->entry))
8606 		list_add_tail(&wwk->entry, &lwiphy->wwk_list);
8607 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8608 
8609 	/*
8610 	 * See how ieee80211_queue_work() work continues in Linux or if things
8611 	 * migrate here over time?
8612 	 * Use a system queue from linux/workqueue.h for now.
8613 	 */
8614 	queue_work(system_wq, &lwiphy->wwk);
8615 }
8616 
8617 void
8618 linuxkpi_wiphy_work_cancel(struct wiphy *wiphy, struct wiphy_work *wwk)
8619 {
8620 	struct lkpi_wiphy *lwiphy;
8621 
8622 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
8623 
8624 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8625 	/* Only cancel if queued. */
8626 	if (!list_empty(&wwk->entry))
8627 		list_del_init(&wwk->entry);
8628 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8629 }
8630 
8631 void
8632 linuxkpi_wiphy_work_flush(struct wiphy *wiphy, struct wiphy_work *wwk)
8633 {
8634 	struct lkpi_wiphy *lwiphy;
8635 	struct wiphy_work *wk;
8636 
8637 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
8638 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8639 	/* If wwk is unset, flush everything; called when wiphy is shut down. */
8640 	if (wwk != NULL && list_empty(&wwk->entry)) {
8641 		LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8642 		return;
8643 	}
8644 
8645 	while (!list_empty(&lwiphy->wwk_list)) {
8646 
8647 		wk = list_first_entry(&lwiphy->wwk_list, struct wiphy_work,
8648 		    entry);
8649 		list_del_init(&wk->entry);
8650 		LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8651 		wk->fn(wiphy, wk);
8652 		LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8653 		if (wk == wwk)
8654 			break;
8655 	}
8656 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8657 }
8658 
8659 void
8660 lkpi_wiphy_delayed_work_timer(struct timer_list *tl)
8661 {
8662 	struct wiphy_delayed_work *wdwk;
8663 
8664 	wdwk = timer_container_of(wdwk, tl, timer);
8665 	wiphy_work_queue(wdwk->wiphy, &wdwk->work);
8666 }
8667 
8668 void
8669 linuxkpi_wiphy_delayed_work_queue(struct wiphy *wiphy,
8670     struct wiphy_delayed_work *wdwk, unsigned long delay)
8671 {
8672 	if (delay == 0) {
8673 		/* Run right away. */
8674 		del_timer(&wdwk->timer);
8675 		wiphy_work_queue(wiphy, &wdwk->work);
8676 	} else {
8677 		wdwk->wiphy = wiphy;
8678 		mod_timer(&wdwk->timer, jiffies + delay);
8679 	}
8680 }
8681 
8682 void
8683 linuxkpi_wiphy_delayed_work_cancel(struct wiphy *wiphy,
8684     struct wiphy_delayed_work *wdwk)
8685 {
8686 	del_timer_sync(&wdwk->timer);
8687 	wiphy_work_cancel(wiphy, &wdwk->work);
8688 }
8689 
8690 void
8691 linuxkpi_wiphy_delayed_work_flush(struct wiphy *wiphy,
8692     struct wiphy_delayed_work *wdwk)
8693 {
8694 	lockdep_assert_held(&wiphy->mtx);
8695 
8696 	del_timer_sync(&wdwk->timer);
8697 	wiphy_work_flush(wiphy, &wdwk->work);
8698 }
8699 
8700 /* -------------------------------------------------------------------------- */
8701 
8702 struct wiphy *
8703 linuxkpi_wiphy_new(const struct cfg80211_ops *ops, size_t priv_len)
8704 {
8705 	struct lkpi_wiphy *lwiphy;
8706 	struct wiphy *wiphy;
8707 
8708 	lwiphy = kzalloc(sizeof(*lwiphy) + priv_len, GFP_KERNEL);
8709 	if (lwiphy == NULL)
8710 		return (NULL);
8711 	lwiphy->ops = ops;
8712 
8713 	LKPI_80211_LWIPHY_WORK_LOCK_INIT(lwiphy);
8714 	INIT_LIST_HEAD(&lwiphy->wwk_list);
8715 	INIT_WORK(&lwiphy->wwk, lkpi_wiphy_work);
8716 
8717 	wiphy = LWIPHY_TO_WIPHY(lwiphy);
8718 
8719 	mutex_init(&wiphy->mtx);
8720 	TODO();
8721 
8722 	return (wiphy);
8723 }
8724 
8725 void
8726 linuxkpi_wiphy_free(struct wiphy *wiphy)
8727 {
8728 	struct lkpi_wiphy *lwiphy;
8729 
8730 	if (wiphy == NULL)
8731 		return;
8732 
8733 	linuxkpi_wiphy_work_flush(wiphy, NULL);
8734 	mutex_destroy(&wiphy->mtx);
8735 
8736 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
8737 	LKPI_80211_LWIPHY_WORK_LOCK_DESTROY(lwiphy);
8738 
8739 	kfree(lwiphy);
8740 }
8741 
8742 static void
8743 lkpi_wiphy_band_annotate(struct wiphy *wiphy)
8744 {
8745 	int band;
8746 
8747 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
8748 		struct ieee80211_supported_band *supband;
8749 		int i;
8750 
8751 		supband = wiphy->bands[band];
8752 		if (supband == NULL)
8753 			continue;
8754 
8755 		switch (band) {
8756 		case NL80211_BAND_2GHZ:
8757 		case NL80211_BAND_5GHZ:
8758 			break;
8759 		default:
8760 #ifdef LINUXKPI_DEBUG_80211
8761 			IMPROVE("band %d(%s) not yet supported",
8762 			    band, lkpi_nl80211_band_name(band));
8763 			/* For bands added here, also check lkpi_lsta_alloc(). */
8764 #endif
8765 			continue;
8766 		}
8767 
8768 		/* Band bitrates are times 10; e.g., 55 is 5.5Mbit/s. */
8769 		for (i = 0; i < supband->n_bitrates; i++) {
8770 			switch (band) {
8771 			case NL80211_BAND_2GHZ:
8772 				switch (supband->bitrates[i].bitrate) {
8773 				case 110:
8774 				case 55:
8775 				case 20:
8776 				case 10:
8777 					supband->bitrates[i].flags |=
8778 					    IEEE80211_RATE_MANDATORY_B;
8779 					/* FALLTHROUGH */
8780 				/* 11g only */
8781 				case 240:
8782 				case 120:
8783 				case 60:
8784 					supband->bitrates[i].flags |=
8785 					    IEEE80211_RATE_MANDATORY_G;
8786 					break;
8787 				}
8788 				break;
8789 			case NL80211_BAND_5GHZ:
8790 				switch (supband->bitrates[i].bitrate) {
8791 				case 240:
8792 				case 120:
8793 				case 60:
8794 					supband->bitrates[i].flags |=
8795 					    IEEE80211_RATE_MANDATORY_A;
8796 					break;
8797 				}
8798 				break;
8799 			}
8800 			TRACE_RATES("band %d bitrate[%d/%u] %u flags %#010x",
8801 			    band, i, supband->n_bitrates,
8802 			    supband->bitrates[i].bitrate,
8803 			    supband->bitrates[i].flags);
8804 		}
8805 	}
8806 }
8807 
8808 int
8809 linuxkpi_80211_wiphy_register(struct wiphy *wiphy)
8810 {
8811 	TODO("Lots of checks and initialization");
8812 
8813 	lkpi_wiphy_band_annotate(wiphy);
8814 
8815 	return (0);
8816 }
8817 
8818 static uint32_t
8819 lkpi_cfg80211_calculate_bitrate_ht(struct rate_info *rate)
8820 {
8821 	TODO("cfg80211_calculate_bitrate_ht");
8822 	return (rate->legacy);
8823 }
8824 
8825 static uint32_t
8826 lkpi_cfg80211_calculate_bitrate_vht(struct rate_info *rate)
8827 {
8828 	TODO("cfg80211_calculate_bitrate_vht");
8829 	return (rate->legacy);
8830 }
8831 
8832 uint32_t
8833 linuxkpi_cfg80211_calculate_bitrate(struct rate_info *rate)
8834 {
8835 
8836 	/* Beware: order! */
8837 	if (rate->flags & RATE_INFO_FLAGS_MCS)
8838 		return (lkpi_cfg80211_calculate_bitrate_ht(rate));
8839 
8840 	if (rate->flags & RATE_INFO_FLAGS_VHT_MCS)
8841 		return (lkpi_cfg80211_calculate_bitrate_vht(rate));
8842 
8843 	IMPROVE("HE/EHT/...");
8844 
8845 	return (rate->legacy);
8846 }
8847 
8848 uint32_t
8849 linuxkpi_ieee80211_channel_to_frequency(uint32_t channel,
8850     enum nl80211_band band)
8851 {
8852 
8853 	switch (band) {
8854 	case NL80211_BAND_2GHZ:
8855 		return (ieee80211_ieee2mhz(channel, IEEE80211_CHAN_2GHZ));
8856 		break;
8857 	case NL80211_BAND_5GHZ:
8858 		return (ieee80211_ieee2mhz(channel, IEEE80211_CHAN_5GHZ));
8859 		break;
8860 	default:
8861 		/* XXX abort, retry, error, panic? */
8862 		break;
8863 	}
8864 
8865 	return (0);
8866 }
8867 
8868 uint32_t
8869 linuxkpi_ieee80211_frequency_to_channel(uint32_t freq, uint32_t flags __unused)
8870 {
8871 
8872 	return (ieee80211_mhz2ieee(freq, 0));
8873 }
8874 
8875 #if 0
8876 static struct lkpi_sta *
8877 lkpi_find_lsta_by_ni(struct lkpi_vif *lvif, struct ieee80211_node *ni)
8878 {
8879 	struct lkpi_sta *lsta, *temp;
8880 
8881 	rcu_read_lock();
8882 	list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
8883 		if (lsta->ni == ni) {
8884 			rcu_read_unlock();
8885 			return (lsta);
8886 		}
8887 	}
8888 	rcu_read_unlock();
8889 
8890 	return (NULL);
8891 }
8892 #endif
8893 
8894 struct ieee80211_sta *
8895 linuxkpi_ieee80211_find_sta(struct ieee80211_vif *vif, const u8 *peer)
8896 {
8897 	struct lkpi_vif *lvif;
8898 	struct lkpi_sta *lsta;
8899 	struct ieee80211_sta *sta;
8900 
8901 	lvif = VIF_TO_LVIF(vif);
8902 
8903 	rcu_read_lock();
8904 	list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
8905 		sta = LSTA_TO_STA(lsta);
8906 		if (IEEE80211_ADDR_EQ(sta->addr, peer)) {
8907 			rcu_read_unlock();
8908 			return (sta);
8909 		}
8910 	}
8911 	rcu_read_unlock();
8912 	return (NULL);
8913 }
8914 
8915 struct ieee80211_sta *
8916 linuxkpi_ieee80211_find_sta_by_ifaddr(struct ieee80211_hw *hw,
8917     const uint8_t *addr, const uint8_t *ourvifaddr)
8918 {
8919 	struct lkpi_hw *lhw;
8920 	struct lkpi_vif *lvif;
8921 	struct lkpi_sta *lsta;
8922 	struct ieee80211_vif *vif;
8923 	struct ieee80211_sta *sta;
8924 
8925 	lhw = wiphy_priv(hw->wiphy);
8926 	sta = NULL;
8927 
8928 	LKPI_80211_LHW_LVIF_LOCK(lhw);
8929 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
8930 
8931 		/* XXX-BZ check our address from the vif. */
8932 
8933 		vif = LVIF_TO_VIF(lvif);
8934 		if (ourvifaddr != NULL &&
8935 		    !IEEE80211_ADDR_EQ(vif->addr, ourvifaddr))
8936 			continue;
8937 		sta = linuxkpi_ieee80211_find_sta(vif, addr);
8938 		if (sta != NULL)
8939 			break;
8940 	}
8941 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
8942 
8943 	if (sta != NULL) {
8944 		lsta = STA_TO_LSTA(sta);
8945 		if (!lsta->added_to_drv)
8946 			return (NULL);
8947 	}
8948 
8949 	return (sta);
8950 }
8951 
8952 struct sk_buff *
8953 linuxkpi_ieee80211_tx_dequeue(struct ieee80211_hw *hw,
8954     struct ieee80211_txq *txq)
8955 {
8956 	struct lkpi_txq *ltxq;
8957 	struct lkpi_vif *lvif;
8958 	struct sk_buff *skb;
8959 
8960 	IMPROVE("wiphy_lock? or assert?");
8961 	skb = NULL;
8962 	ltxq = TXQ_TO_LTXQ(txq);
8963 	ltxq->flags |= LKPI_TXQ_SEEN_DEQUEUE;
8964 
8965 	if ((ltxq->flags & (LKPI_TXQ_STOPPED|LKPI_TXQ_STOPPED_BA)) != 0)
8966 		goto stopped;
8967 
8968 	lvif = VIF_TO_LVIF(ltxq->txq.vif);
8969 	if (lvif->hw_queue_stopped[ltxq->txq.ac]) {
8970 		ltxq->flags |= LKPI_TXQ_STOPPED;
8971 		goto stopped;
8972 	}
8973 
8974 	IMPROVE("hw(TX_FRAG_LIST)");
8975 
8976 	LKPI_80211_LTXQ_LOCK(ltxq);
8977 	skb = skb_dequeue(&ltxq->skbq);
8978 	if (skb != NULL)
8979 		ltxq->frms_dequeued++;
8980 	LKPI_80211_LTXQ_UNLOCK(ltxq);
8981 
8982 stopped:
8983 	return (skb);
8984 }
8985 
8986 void
8987 linuxkpi_ieee80211_txq_get_depth(struct ieee80211_txq *txq,
8988     unsigned long *frame_cnt, unsigned long *byte_cnt)
8989 {
8990 	struct lkpi_txq *ltxq;
8991 	struct sk_buff *skb;
8992 	unsigned long fc, bc;
8993 
8994 	ltxq = TXQ_TO_LTXQ(txq);
8995 
8996 	fc = bc = 0;
8997 	LKPI_80211_LTXQ_LOCK(ltxq);
8998 	skb_queue_walk(&ltxq->skbq, skb) {
8999 		fc++;
9000 		bc += skb->len;
9001 	}
9002 	LKPI_80211_LTXQ_UNLOCK(ltxq);
9003 	if (frame_cnt)
9004 		*frame_cnt = fc;
9005 	if (byte_cnt)
9006 		*byte_cnt = bc;
9007 
9008 	/* Validate that this is doing the correct thing. */
9009 	/* Should we keep track on en/dequeue? */
9010 	IMPROVE();
9011 }
9012 
9013 /*
9014  * We are called from ieee80211_free_txskb() or ieee80211_tx_status().
9015  * The latter tries to derive the success status from the info flags
9016  * passed back from the driver.  rawx_mit() saves the ni on the m and the
9017  * m on the skb for us to be able to give feedback to net80211.
9018  */
9019 static void
9020 _lkpi_ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb,
9021     int status)
9022 {
9023 	struct ieee80211_node *ni;
9024 	struct mbuf *m;
9025 
9026 	if (skb == NULL)
9027 		return;
9028 
9029 	m = skb->m;
9030 	skb->m = NULL;
9031 
9032 	if (m != NULL) {
9033 		ni = m->m_pkthdr.PH_loc.ptr;
9034 		/* Status: 0 is ok, != 0 is error. */
9035 		ieee80211_tx_complete(ni, m, status);
9036 		/* ni & mbuf were consumed. */
9037 	}
9038 }
9039 
9040 void
9041 linuxkpi_ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb,
9042     int status)
9043 {
9044 
9045 	_lkpi_ieee80211_free_txskb(hw, skb, status);
9046 	kfree_skb(skb);
9047 }
9048 
9049 void
9050 linuxkpi_ieee80211_tx_status_ext(struct ieee80211_hw *hw,
9051     struct ieee80211_tx_status *txstat)
9052 {
9053 	struct sk_buff *skb;
9054 	struct ieee80211_tx_info *info, _info = { };
9055 	struct ieee80211_ratectl_tx_status txs;
9056 	struct ieee80211_node *ni;
9057 	int status;
9058 
9059 	skb = txstat->skb;
9060 	if (skb != NULL && skb->m != NULL) {
9061 		struct mbuf *m;
9062 
9063 		m = skb->m;
9064 		ni = m->m_pkthdr.PH_loc.ptr;
9065 		memset(&txs, 0, sizeof(txs));
9066 	} else {
9067 		ni = NULL;
9068 	}
9069 
9070 	/*
9071 	 * If we have no info information on tx, set info to an all-zero struct
9072 	 * to make the code (and debug output) simpler.
9073 	 */
9074 	info = txstat->info;
9075 	if (info == NULL)
9076 		info = &_info;
9077 	if (info->flags & IEEE80211_TX_STAT_ACK) {
9078 		status = 0;	/* No error. */
9079 		txs.status = IEEE80211_RATECTL_TX_SUCCESS;
9080 	} else {
9081 		status = 1;
9082 		txs.status = IEEE80211_RATECTL_TX_FAIL_UNSPECIFIED;
9083 	}
9084 
9085 	if (ni != NULL) {
9086 		txs.pktlen = skb->len;
9087 		txs.flags |= IEEE80211_RATECTL_STATUS_PKTLEN;
9088 		if (info->status.rates[0].count > 1) {
9089 			txs.long_retries = info->status.rates[0].count - 1;	/* 1 + retries in drivers. */
9090 			txs.flags |= IEEE80211_RATECTL_STATUS_LONG_RETRY;
9091 		}
9092 #if 0		/* Unused in net80211 currently. */
9093 		/* XXX-BZ convert check .flags for MCS/VHT/.. */
9094 		txs.final_rate = info->status.rates[0].idx;
9095 		txs.flags |= IEEE80211_RATECTL_STATUS_FINAL_RATE;
9096 #endif
9097 		if (info->status.flags & IEEE80211_TX_STATUS_ACK_SIGNAL_VALID) {
9098 			txs.rssi = info->status.ack_signal;		/* XXX-BZ CONVERT? */
9099 			txs.flags |= IEEE80211_RATECTL_STATUS_RSSI;
9100 		}
9101 
9102 		IMPROVE("only update rate if needed but that requires us to get a proper rate from mo_sta_statistics");
9103 		ieee80211_ratectl_tx_complete(ni, &txs);
9104 		ieee80211_ratectl_rate(ni->ni_vap->iv_bss, NULL, 0);
9105 
9106 #ifdef LINUXKPI_DEBUG_80211
9107 		if (linuxkpi_debug_80211 & D80211_TRACE_TX) {
9108 			printf("TX-RATE: %s: long_retries %d\n", __func__,
9109 			    txs.long_retries);
9110 		}
9111 #endif
9112 	}
9113 
9114 #ifdef LINUXKPI_DEBUG_80211
9115 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
9116 		printf("TX-STATUS: %s: hw %p skb %p status %d : flags %b "
9117 		    "band %u hw_queue %u tx_time_est %d : "
9118 		    "rates [ %u %u %#x, %u %u %#x, %u %u %#x, %u %u %#x ] "
9119 		    "ack_signal %u ampdu_ack_len %u ampdu_len %u antenna %u "
9120 		    "tx_time %u flags %b "
9121 		    "status_driver_data [ %p %p ]\n",
9122 		    __func__, hw, skb, status, info->flags, IEEE80211_TX_INFO_FLAGS,
9123 		    info->band, info->hw_queue, info->tx_time_est,
9124 		    info->status.rates[0].idx, info->status.rates[0].count,
9125 		    info->status.rates[0].flags,
9126 		    info->status.rates[1].idx, info->status.rates[1].count,
9127 		    info->status.rates[1].flags,
9128 		    info->status.rates[2].idx, info->status.rates[2].count,
9129 		    info->status.rates[2].flags,
9130 		    info->status.rates[3].idx, info->status.rates[3].count,
9131 		    info->status.rates[3].flags,
9132 		    info->status.ack_signal, info->status.ampdu_ack_len,
9133 		    info->status.ampdu_len, info->status.antenna,
9134 		    info->status.tx_time, info->status.flags, IEEE80211_TX_STATUS_FLAGS,
9135 		    info->status.status_driver_data[0],
9136 		    info->status.status_driver_data[1]);
9137 #endif
9138 
9139 	if (txstat->free_list) {
9140 		_lkpi_ieee80211_free_txskb(hw, skb, status);
9141 		if (skb != NULL)
9142 			list_add_tail(&skb->list, txstat->free_list);
9143 	} else {
9144 		linuxkpi_ieee80211_free_txskb(hw, skb, status);
9145 	}
9146 }
9147 
9148 void
9149 linuxkpi_ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
9150 {
9151 	struct ieee80211_tx_status status;
9152 
9153 	memset(&status, 0, sizeof(status));
9154 	status.info = IEEE80211_SKB_CB(skb);
9155 	status.skb = skb;
9156 	/* sta, n_rates, rates, free_list? */
9157 
9158 	ieee80211_tx_status_ext(hw, &status);
9159 }
9160 
9161 /*
9162  * This is an internal bandaid for the moment for the way we glue
9163  * skbs and mbufs together for TX.  Once we have skbs backed by
9164  * mbufs this should go away.
9165  * This is a public function but kept on the private KPI (lkpi_)
9166  * and is not exposed by a header file.
9167  */
9168 static void
9169 lkpi_ieee80211_free_skb_mbuf(void *p)
9170 {
9171 	struct ieee80211_node *ni;
9172 	struct mbuf *m;
9173 
9174 	if (p == NULL)
9175 		return;
9176 
9177 	m = (struct mbuf *)p;
9178 	M_ASSERTPKTHDR(m);
9179 
9180 	ni = m->m_pkthdr.PH_loc.ptr;
9181 	m->m_pkthdr.PH_loc.ptr = NULL;
9182 	if (ni != NULL)
9183 		ieee80211_free_node(ni);
9184 	m_freem(m);
9185 }
9186 
9187 void
9188 linuxkpi_ieee80211_queue_delayed_work(struct ieee80211_hw *hw,
9189     struct delayed_work *w, int delay)
9190 {
9191 	struct lkpi_hw *lhw;
9192 
9193 	/* Need to make sure hw is in a stable (non-suspended) state. */
9194 	IMPROVE();
9195 
9196 	lhw = HW_TO_LHW(hw);
9197 	queue_delayed_work(lhw->workq, w, delay);
9198 }
9199 
9200 void
9201 linuxkpi_ieee80211_queue_work(struct ieee80211_hw *hw,
9202     struct work_struct *w)
9203 {
9204 	struct lkpi_hw *lhw;
9205 
9206 	/* Need to make sure hw is in a stable (non-suspended) state. */
9207 	IMPROVE();
9208 
9209 	lhw = HW_TO_LHW(hw);
9210 	queue_work(lhw->workq, w);
9211 }
9212 
9213 struct sk_buff *
9214 linuxkpi_ieee80211_probereq_get(struct ieee80211_hw *hw, const uint8_t *addr,
9215     const uint8_t *ssid, size_t ssid_len, size_t tailroom)
9216 {
9217 	struct sk_buff *skb;
9218 	struct ieee80211_frame *wh;
9219 	uint8_t *p;
9220 	size_t len;
9221 
9222 	len = sizeof(*wh);
9223 	len += 2 + ssid_len;
9224 
9225 	skb = dev_alloc_skb(hw->extra_tx_headroom + len + tailroom);
9226 	if (skb == NULL)
9227 		return (NULL);
9228 
9229 	skb_reserve(skb, hw->extra_tx_headroom);
9230 
9231 	wh = skb_put_zero(skb, sizeof(*wh));
9232 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0;
9233 	wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_PROBE_REQ | IEEE80211_FC0_TYPE_MGT;
9234 	IEEE80211_ADDR_COPY(wh->i_addr1, ieee80211broadcastaddr);
9235 	IEEE80211_ADDR_COPY(wh->i_addr2, addr);
9236 	IEEE80211_ADDR_COPY(wh->i_addr3, ieee80211broadcastaddr);
9237 
9238 	p = skb_put(skb, 2 + ssid_len);
9239 	*p++ = IEEE80211_ELEMID_SSID;
9240 	*p++ = ssid_len;
9241 	if (ssid_len > 0)
9242 		memcpy(p, ssid, ssid_len);
9243 
9244 	return (skb);
9245 }
9246 
9247 struct sk_buff *
9248 linuxkpi_ieee80211_pspoll_get(struct ieee80211_hw *hw,
9249     struct ieee80211_vif *vif)
9250 {
9251 	struct lkpi_vif *lvif;
9252 	struct ieee80211vap *vap;
9253 	struct sk_buff *skb;
9254 	struct ieee80211_frame_pspoll *psp;
9255 	uint16_t v;
9256 
9257 	skb = dev_alloc_skb(hw->extra_tx_headroom + sizeof(*psp));
9258 	if (skb == NULL)
9259 		return (NULL);
9260 
9261 	skb_reserve(skb, hw->extra_tx_headroom);
9262 
9263 	lvif = VIF_TO_LVIF(vif);
9264 	vap = LVIF_TO_VAP(lvif);
9265 
9266 	psp = skb_put_zero(skb, sizeof(*psp));
9267 	psp->i_fc[0] = IEEE80211_FC0_VERSION_0;
9268 	psp->i_fc[0] |= IEEE80211_FC0_SUBTYPE_PS_POLL | IEEE80211_FC0_TYPE_CTL;
9269 	v = htole16(vif->cfg.aid | 1<<15 | 1<<16);
9270 	memcpy(&psp->i_aid, &v, sizeof(v));
9271 	IEEE80211_ADDR_COPY(psp->i_bssid, vap->iv_bss->ni_macaddr);
9272 	IEEE80211_ADDR_COPY(psp->i_ta, vif->addr);
9273 
9274 	return (skb);
9275 }
9276 
9277 struct sk_buff *
9278 linuxkpi_ieee80211_nullfunc_get(struct ieee80211_hw *hw,
9279     struct ieee80211_vif *vif, int linkid, bool qos)
9280 {
9281 	struct sk_buff *skb;
9282 	struct ieee80211_frame *nullf;
9283 
9284 	IMPROVE("linkid");
9285 
9286 	skb = dev_alloc_skb(hw->extra_tx_headroom + sizeof(*nullf));
9287 	if (skb == NULL)
9288 		return (NULL);
9289 
9290 	skb_reserve(skb, hw->extra_tx_headroom);
9291 
9292 	nullf = skb_put_zero(skb, sizeof(*nullf));
9293 	nullf->i_fc[0] = IEEE80211_FC0_VERSION_0;
9294 	nullf->i_fc[0] |= IEEE80211_FC0_SUBTYPE_NODATA | IEEE80211_FC0_TYPE_DATA;
9295 	nullf->i_fc[1] = IEEE80211_FC1_DIR_TODS;
9296 
9297 	/* XXX-BZ if link is given, this is different. */
9298 	IEEE80211_ADDR_COPY(nullf->i_addr1, vif->cfg.ap_addr);
9299 	IEEE80211_ADDR_COPY(nullf->i_addr2, vif->addr);
9300 	IEEE80211_ADDR_COPY(nullf->i_addr3, vif->cfg.ap_addr);
9301 
9302 	return (skb);
9303 }
9304 
9305 struct wireless_dev *
9306 linuxkpi_ieee80211_vif_to_wdev(struct ieee80211_vif *vif)
9307 {
9308 	struct lkpi_vif *lvif;
9309 
9310 	lvif = VIF_TO_LVIF(vif);
9311 	return (&lvif->wdev);
9312 }
9313 
9314 void
9315 linuxkpi_ieee80211_connection_loss(struct ieee80211_vif *vif)
9316 {
9317 	struct lkpi_vif *lvif;
9318 	struct ieee80211vap *vap;
9319 	enum ieee80211_state nstate;
9320 	int arg;
9321 
9322 	lvif = VIF_TO_LVIF(vif);
9323 	vap = LVIF_TO_VAP(lvif);
9324 
9325 	/*
9326 	 * Go to init; otherwise we need to elaborately check state and
9327 	 * handle accordingly, e.g., if in RUN we could call iv_bmiss.
9328 	 * Let the statemachine handle all neccessary changes.
9329 	 */
9330 	nstate = IEEE80211_S_INIT;
9331 	arg = 0;	/* Not a valid reason. */
9332 
9333 	ic_printf(vap->iv_ic, "%s: vif %p vap %p state %s (synched %d, assoc %d "
9334 	    "beacons %d dtim_period %d)\n", __func__, vif, vap,
9335 	    ieee80211_state_name[vap->iv_state],
9336 	    lvif->lvif_bss_synched, vif->cfg.assoc, lvif->beacons,
9337 	    vif->bss_conf.dtim_period);
9338 	ieee80211_new_state(vap, nstate, arg);
9339 }
9340 
9341 void
9342 linuxkpi_ieee80211_beacon_loss(struct ieee80211_vif *vif)
9343 {
9344 	struct lkpi_vif *lvif;
9345 	struct ieee80211vap *vap;
9346 
9347 	lvif = VIF_TO_LVIF(vif);
9348 	vap = LVIF_TO_VAP(lvif);
9349 
9350 	ic_printf(vap->iv_ic, "%s: vif %p vap %p state %s (synched %d, assoc %d "
9351 	    "beacons %d dtim_period %d)\n", __func__, vif, vap,
9352 	    ieee80211_state_name[vap->iv_state],
9353 	    lvif->lvif_bss_synched, vif->cfg.assoc, lvif->beacons,
9354 	    vif->bss_conf.dtim_period);
9355 	ieee80211_beacon_miss(vap->iv_ic);
9356 }
9357 
9358 /* -------------------------------------------------------------------------- */
9359 
9360 void
9361 linuxkpi_ieee80211_stop_queue(struct ieee80211_hw *hw, int qnum)
9362 {
9363 	struct lkpi_hw *lhw;
9364 	struct lkpi_vif *lvif;
9365 	struct ieee80211_vif *vif;
9366 	int ac_count, ac;
9367 
9368 	KASSERT(qnum < hw->queues, ("%s: qnum %d >= hw->queues %d, hw %p\n",
9369 	    __func__, qnum, hw->queues, hw));
9370 
9371 	lhw = wiphy_priv(hw->wiphy);
9372 
9373 	/* See lkpi_ic_vap_create(). */
9374 	if (hw->queues >= IEEE80211_NUM_ACS)
9375 		ac_count = IEEE80211_NUM_ACS;
9376 	else
9377 		ac_count = 1;
9378 
9379 	LKPI_80211_LHW_LVIF_LOCK(lhw);
9380 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
9381 
9382 		vif = LVIF_TO_VIF(lvif);
9383 		for (ac = 0; ac < ac_count; ac++) {
9384 			IMPROVE_TXQ("LOCKING");
9385 			if (qnum == vif->hw_queue[ac]) {
9386 #ifdef LINUXKPI_DEBUG_80211
9387 				/*
9388 				 * For now log this to better understand
9389 				 * how this is supposed to work.
9390 				 */
9391 				if (lvif->hw_queue_stopped[ac] &&
9392 				    (linuxkpi_debug_80211 & D80211_IMPROVE_TXQ) != 0)
9393 					ic_printf(lhw->ic, "%s:%d: lhw %p hw %p "
9394 					    "lvif %p vif %p ac %d qnum %d already "
9395 					    "stopped\n", __func__, __LINE__,
9396 					    lhw, hw, lvif, vif, ac, qnum);
9397 #endif
9398 				lvif->hw_queue_stopped[ac] = true;
9399 			}
9400 		}
9401 	}
9402 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
9403 }
9404 
9405 void
9406 linuxkpi_ieee80211_stop_queues(struct ieee80211_hw *hw)
9407 {
9408 	int i;
9409 
9410 	IMPROVE_TXQ("Locking; do we need further info?");
9411 	for (i = 0; i < hw->queues; i++)
9412 		linuxkpi_ieee80211_stop_queue(hw, i);
9413 }
9414 
9415 
9416 static void
9417 lkpi_ieee80211_wake_queues(struct ieee80211_hw *hw, int hwq)
9418 {
9419 	struct lkpi_hw *lhw;
9420 	struct lkpi_vif *lvif;
9421 	struct lkpi_sta *lsta;
9422 	int ac_count, ac, tid;
9423 
9424 	/* See lkpi_ic_vap_create(). */
9425 	if (hw->queues >= IEEE80211_NUM_ACS)
9426 		ac_count = IEEE80211_NUM_ACS;
9427 	else
9428 		ac_count = 1;
9429 
9430 	lhw = wiphy_priv(hw->wiphy);
9431 
9432 	IMPROVE_TXQ("Locking");
9433 	LKPI_80211_LHW_LVIF_LOCK(lhw);
9434 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
9435 		struct ieee80211_vif *vif;
9436 
9437 		vif = LVIF_TO_VIF(lvif);
9438 		for (ac = 0; ac < ac_count; ac++) {
9439 
9440 			if (hwq == vif->hw_queue[ac]) {
9441 
9442 				/* XXX-BZ what about software scan? */
9443 
9444 #ifdef LINUXKPI_DEBUG_80211
9445 				/*
9446 				 * For now log this to better understand
9447 				 * how this is supposed to work.
9448 				 */
9449 				if (!lvif->hw_queue_stopped[ac] &&
9450 				    (linuxkpi_debug_80211 & D80211_IMPROVE_TXQ) != 0)
9451 					ic_printf(lhw->ic, "%s:%d: lhw %p hw %p "
9452 					    "lvif %p vif %p ac %d hw_q not stopped\n",
9453 					    __func__, __LINE__,
9454 					    lhw, hw, lvif, vif, ac);
9455 #endif
9456 				lvif->hw_queue_stopped[ac] = false;
9457 
9458 				rcu_read_lock();
9459 				list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
9460 					struct ieee80211_sta *sta;
9461 
9462 					sta = LSTA_TO_STA(lsta);
9463 					for (tid = 0; tid < nitems(sta->txq); tid++) {
9464 						struct lkpi_txq *ltxq;
9465 
9466 						if (sta->txq[tid] == NULL)
9467 							continue;
9468 
9469 						if (sta->txq[tid]->ac != ac)
9470 							continue;
9471 
9472 						ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
9473 						if ((ltxq->flags & LKPI_TXQ_STOPPED) == 0)
9474 							continue;
9475 
9476 						ltxq->flags &= ~LKPI_TXQ_STOPPED;
9477 
9478 						if (!skb_queue_empty(&ltxq->skbq))
9479 							lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tid], false);
9480 					}
9481 				}
9482 				rcu_read_unlock();
9483 			}
9484 		}
9485 	}
9486 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
9487 }
9488 
9489 static void
9490 lkpi_ieee80211_wake_queues_locked(struct ieee80211_hw *hw)
9491 {
9492 	int i;
9493 
9494 	IMPROVE_TXQ("Is this all/enough here?");
9495 	for (i = 0; i < hw->queues; i++)
9496 		lkpi_ieee80211_wake_queues(hw, i);
9497 }
9498 
9499 void
9500 linuxkpi_ieee80211_wake_queues(struct ieee80211_hw *hw)
9501 {
9502 	struct lkpi_hw *lhw;
9503 	unsigned long flags;
9504 
9505 	lhw = HW_TO_LHW(hw);
9506 
9507 	spin_lock_irqsave(&lhw->txq_lock, flags);
9508 	lkpi_ieee80211_wake_queues_locked(hw);
9509 	spin_unlock_irqrestore(&lhw->txq_lock, flags);
9510 }
9511 
9512 void
9513 linuxkpi_ieee80211_wake_queue(struct ieee80211_hw *hw, int qnum)
9514 {
9515 	struct lkpi_hw *lhw;
9516 	unsigned long flags;
9517 
9518 	KASSERT(qnum < hw->queues, ("%s: qnum %d >= hw->queues %d, hw %p\n",
9519 	    __func__, qnum, hw->queues, hw));
9520 
9521 	lhw = HW_TO_LHW(hw);
9522 
9523 	spin_lock_irqsave(&lhw->txq_lock, flags);
9524 	lkpi_ieee80211_wake_queues(hw, qnum);
9525 	spin_unlock_irqrestore(&lhw->txq_lock, flags);
9526 }
9527 
9528 void
9529 linuxkpi_ieee80211_handle_wake_tx_queue(struct ieee80211_hw *hw,
9530     struct ieee80211_txq *txq)
9531 {
9532 	struct lkpi_hw *lhw;
9533 
9534 	lhw = HW_TO_LHW(hw);
9535 
9536 	LKPI_80211_LHW_TXQ_LOCK(lhw);
9537 	ieee80211_txq_schedule_start(hw, txq->ac);
9538 	do {
9539 		struct lkpi_txq *ltxq;
9540 		struct ieee80211_txq *ntxq;
9541 		struct ieee80211_tx_control control;
9542 		struct sk_buff *skb;
9543 
9544 		ntxq = ieee80211_next_txq(hw, txq->ac);
9545 		if (ntxq == NULL)
9546 			break;
9547 		ltxq = TXQ_TO_LTXQ(ntxq);
9548 
9549 		memset(&control, 0, sizeof(control));
9550 		control.sta = ntxq->sta;
9551 		do {
9552 			skb = linuxkpi_ieee80211_tx_dequeue(hw, ntxq);
9553 			if (skb == NULL)
9554 				break;
9555 			ltxq->frms_tx++;
9556 			lkpi_80211_mo_tx(hw, &control, skb);
9557 		} while(1);
9558 
9559 		ieee80211_return_txq(hw, ntxq, false);
9560 	} while (1);
9561 	ieee80211_txq_schedule_end(hw, txq->ac);
9562 	LKPI_80211_LHW_TXQ_UNLOCK(lhw);
9563 }
9564 
9565 /* -------------------------------------------------------------------------- */
9566 
9567 /* This is just hardware queues. */
9568 /*
9569  * Being called from the driver thus use _bh() locking.
9570  */
9571 void
9572 linuxkpi_ieee80211_txq_schedule_start(struct ieee80211_hw *hw, uint8_t ac)
9573 {
9574 	struct lkpi_hw *lhw;
9575 
9576 	lhw = HW_TO_LHW(hw);
9577 
9578 	if (ac >= IEEE80211_NUM_ACS) {
9579 		ic_printf(lhw->ic, "%s: ac %u out of bounds.\n", __func__, ac);
9580 		return;
9581 	}
9582 
9583 	spin_lock_bh(&lhw->txq_scheduled_lock[ac]);
9584 	IMPROVE("check AIRTIME_FAIRNESS");
9585 	if (++lhw->txq_generation[ac] == 0)
9586 		lhw->txq_generation[ac]++;
9587 	spin_unlock_bh(&lhw->txq_scheduled_lock[ac]);
9588 }
9589 
9590 struct ieee80211_txq *
9591 linuxkpi_ieee80211_next_txq(struct ieee80211_hw *hw, uint8_t ac)
9592 {
9593 	struct lkpi_hw *lhw;
9594 	struct ieee80211_txq *txq;
9595 	struct lkpi_txq *ltxq;
9596 
9597 	lhw = HW_TO_LHW(hw);
9598 	txq = NULL;
9599 
9600 	if (ac >= IEEE80211_NUM_ACS) {
9601 		ic_printf(lhw->ic, "%s: ac %u out of bounds.\n", __func__, ac);
9602 		return (NULL);
9603 	}
9604 
9605 	spin_lock_bh(&lhw->txq_scheduled_lock[ac]);
9606 
9607 	/* Check that we are scheduled. */
9608 	if (lhw->txq_generation[ac] == 0)
9609 		goto out;
9610 
9611 	ltxq = TAILQ_FIRST(&lhw->txq_scheduled[ac]);
9612 	if (ltxq == NULL)
9613 		goto out;
9614 	if (ltxq->txq_generation == lhw->txq_generation[ac])
9615 		goto out;
9616 	if ((ltxq->flags & (LKPI_TXQ_STOPPED|LKPI_TXQ_STOPPED_BA)) != 0)
9617 		goto out;
9618 
9619 	IMPROVE("check AIRTIME_FAIRNESS");
9620 
9621 	TAILQ_REMOVE(&lhw->txq_scheduled[ac], ltxq, txq_entry);
9622 	ltxq->txq_generation = lhw->txq_generation[ac];
9623 	txq = &ltxq->txq;
9624 	TAILQ_ELEM_INIT(ltxq, txq_entry);
9625 
9626 out:
9627 	spin_unlock_bh(&lhw->txq_scheduled_lock[ac]);
9628 
9629 	return (txq);
9630 }
9631 
9632 void linuxkpi_ieee80211_schedule_txq(struct ieee80211_hw *hw,
9633     struct ieee80211_txq *txq, bool withoutpkts)
9634 {
9635 	struct lkpi_hw *lhw;
9636 	struct lkpi_txq *ltxq;
9637 	bool ltxq_empty;
9638 
9639 	ltxq = TXQ_TO_LTXQ(txq);
9640 
9641 	/* Only schedule if work to do or asked to anyway. */
9642 	LKPI_80211_LTXQ_LOCK(ltxq);
9643 	ltxq_empty = skb_queue_empty(&ltxq->skbq);
9644 	LKPI_80211_LTXQ_UNLOCK(ltxq);
9645 	if (!withoutpkts && ltxq_empty)
9646 		goto out;
9647 
9648 	lhw = HW_TO_LHW(hw);
9649 	spin_lock_bh(&lhw->txq_scheduled_lock[txq->ac]);
9650 	/*
9651 	 * Make sure we do not double-schedule. We do this by checking tqe_prev,
9652 	 * the previous entry in our tailq. tqe_prev is always valid if this entry
9653 	 * is queued, tqe_next may be NULL if this is the only element in the list.
9654 	 */
9655 	if (ltxq->txq_entry.tqe_prev != NULL)
9656 		goto unlock;
9657 
9658 	TAILQ_INSERT_TAIL(&lhw->txq_scheduled[txq->ac], ltxq, txq_entry);
9659 unlock:
9660 	spin_unlock_bh(&lhw->txq_scheduled_lock[txq->ac]);
9661 
9662 out:
9663 	return;
9664 }
9665 
9666 /* -------------------------------------------------------------------------- */
9667 
9668 struct lkpi_cfg80211_bss {
9669 	u_int refcnt;
9670 	struct cfg80211_bss bss;
9671 };
9672 
9673 struct lkpi_cfg80211_get_bss_iter_lookup {
9674 	struct wiphy *wiphy;
9675 	struct linuxkpi_ieee80211_channel *chan;
9676 	const uint8_t *bssid;
9677 	const uint8_t *ssid;
9678 	size_t ssid_len;
9679 	enum ieee80211_bss_type bss_type;
9680 	enum ieee80211_privacy privacy;
9681 
9682 	/*
9683 	 * Something to store a copy of the result as the net80211 scan cache
9684 	 * is not refoucnted so a scan entry might go away any time.
9685 	 */
9686 	bool match;
9687 	struct cfg80211_bss *bss;
9688 };
9689 
9690 static void
9691 lkpi_cfg80211_get_bss_iterf(void *arg, const struct ieee80211_scan_entry *se)
9692 {
9693 	struct lkpi_cfg80211_get_bss_iter_lookup *lookup;
9694 	size_t ielen;
9695 
9696 	lookup = arg;
9697 
9698 	/* Do not try to find another match. */
9699 	if (lookup->match)
9700 		return;
9701 
9702 	/* Nothing to store result. */
9703 	if (lookup->bss == NULL)
9704 		return;
9705 
9706 	if (lookup->privacy != IEEE80211_PRIVACY_ANY) {
9707 		/* if (se->se_capinfo & IEEE80211_CAPINFO_PRIVACY) */
9708 		/* We have no idea what to compare to as the drivers only request ANY */
9709 		return;
9710 	}
9711 
9712 	if (lookup->bss_type != IEEE80211_BSS_TYPE_ANY) {
9713 		/* if (se->se_capinfo & (IEEE80211_CAPINFO_IBSS|IEEE80211_CAPINFO_ESS)) */
9714 		/* We have no idea what to compare to as the drivers only request ANY */
9715 		return;
9716 	}
9717 
9718 	if (lookup->chan != NULL) {
9719 		struct linuxkpi_ieee80211_channel *chan;
9720 
9721 		chan = linuxkpi_ieee80211_get_channel(lookup->wiphy,
9722 		    se->se_chan->ic_freq);
9723 		if (chan == NULL || chan != lookup->chan)
9724 			return;
9725 	}
9726 
9727 	if (lookup->bssid && !IEEE80211_ADDR_EQ(lookup->bssid, se->se_bssid))
9728 		return;
9729 
9730 	if (lookup->ssid) {
9731 		if (lookup->ssid_len != se->se_ssid[1] ||
9732 		    se->se_ssid[1] == 0)
9733 			return;
9734 		if (memcmp(lookup->ssid, se->se_ssid+2, lookup->ssid_len) != 0)
9735 			return;
9736 	}
9737 
9738 	ielen = se->se_ies.len;
9739 
9740 	lookup->bss->ies = malloc(sizeof(*lookup->bss->ies) + ielen,
9741 	    M_LKPI80211, M_NOWAIT | M_ZERO);
9742 	if (lookup->bss->ies == NULL)
9743 		return;
9744 
9745 	lookup->bss->ies->data = (uint8_t *)lookup->bss->ies + sizeof(*lookup->bss->ies);
9746 	lookup->bss->ies->len = ielen;
9747 	if (ielen)
9748 		memcpy(lookup->bss->ies->data, se->se_ies.data, ielen);
9749 
9750 	lookup->match = true;
9751 }
9752 
9753 struct cfg80211_bss *
9754 linuxkpi_cfg80211_get_bss(struct wiphy *wiphy, struct linuxkpi_ieee80211_channel *chan,
9755     const uint8_t *bssid, const uint8_t *ssid, size_t ssid_len,
9756     enum ieee80211_bss_type bss_type, enum ieee80211_privacy privacy)
9757 {
9758 	struct lkpi_cfg80211_bss *lbss;
9759 	struct lkpi_cfg80211_get_bss_iter_lookup lookup;
9760 	struct lkpi_hw *lhw;
9761 	struct ieee80211vap *vap;
9762 
9763 	lhw = wiphy_priv(wiphy);
9764 
9765 	/* Let's hope we can alloc. */
9766 	lbss = malloc(sizeof(*lbss), M_LKPI80211, M_NOWAIT | M_ZERO);
9767 	if (lbss == NULL) {
9768 		ic_printf(lhw->ic, "%s: alloc failed.\n", __func__);
9769 		return (NULL);
9770 	}
9771 
9772 	lookup.wiphy = wiphy;
9773 	lookup.chan = chan;
9774 	lookup.bssid = bssid;
9775 	lookup.ssid = ssid;
9776 	lookup.ssid_len = ssid_len;
9777 	lookup.bss_type = bss_type;
9778 	lookup.privacy = privacy;
9779 	lookup.match = false;
9780 	lookup.bss = &lbss->bss;
9781 
9782 	IMPROVE("Iterate over all VAPs comparing perm_addr and addresses?");
9783 	vap = TAILQ_FIRST(&lhw->ic->ic_vaps);
9784 	ieee80211_scan_iterate(vap, lkpi_cfg80211_get_bss_iterf, &lookup);
9785 	if (!lookup.match) {
9786 		free(lbss, M_LKPI80211);
9787 		return (NULL);
9788 	}
9789 
9790 	refcount_init(&lbss->refcnt, 1);
9791 	return (&lbss->bss);
9792 }
9793 
9794 void
9795 linuxkpi_cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *bss)
9796 {
9797 	struct lkpi_cfg80211_bss *lbss;
9798 
9799 	lbss = container_of(bss, struct lkpi_cfg80211_bss, bss);
9800 
9801 	/* Free everything again on refcount ... */
9802 	if (refcount_release(&lbss->refcnt)) {
9803 		free(lbss->bss.ies, M_LKPI80211);
9804 		free(lbss, M_LKPI80211);
9805 	}
9806 }
9807 
9808 void
9809 linuxkpi_cfg80211_bss_flush(struct wiphy *wiphy)
9810 {
9811 	struct lkpi_hw *lhw;
9812 	struct ieee80211com *ic;
9813 	struct ieee80211vap *vap;
9814 
9815 	lhw = wiphy_priv(wiphy);
9816 	ic = lhw->ic;
9817 
9818 	/*
9819 	 * If we haven't called ieee80211_ifattach() yet
9820 	 * or there is no VAP, there are no scans to flush.
9821 	 */
9822 	if (ic == NULL ||
9823 	    (lhw->sc_flags & LKPI_MAC80211_DRV_STARTED) == 0)
9824 		return;
9825 
9826 	/* Should only happen on the current one? Not seen it late enough. */
9827 	IEEE80211_LOCK(ic);
9828 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
9829 		ieee80211_scan_flush(vap);
9830 	IEEE80211_UNLOCK(ic);
9831 }
9832 
9833 /* -------------------------------------------------------------------------- */
9834 
9835 static bool
9836 cfg80211_chan_def_are_same(struct cfg80211_chan_def *cd1,
9837     struct cfg80211_chan_def *cd2)
9838 {
9839 
9840 	if (cd1 == cd2)
9841 		return (true);
9842 
9843 	if (cd1 == NULL || cd2 == NULL)
9844 		return (false);
9845 
9846 	if (cd1->chan != cd2->chan)
9847 		return (false);
9848 
9849 	if (cd1->width != cd2->width)
9850 		return (false);
9851 
9852 	if (cd1->center_freq1 != cd2->center_freq1)
9853 		return (false);
9854 
9855 	if (cd1->center_freq2 != cd2->center_freq2)
9856 		return (false);
9857 
9858 	if (cd1->punctured != cd2->punctured)
9859 		return (false);
9860 
9861 	return (true);
9862 }
9863 
9864 /*
9865  * hw->conf get initialized/set in various places for us:
9866  * - linuxkpi_ieee80211_alloc_hw(): flags
9867  * - linuxkpi_ieee80211_ifattach(): chandef
9868  * - lkpi_ic_vap_create(): listen_interval
9869  * - lkpi_ic_set_channel(): chandef, flags
9870  */
9871 
9872 static int
9873 lkpi_80211_update_chandef(struct ieee80211_hw *hw,
9874     struct ieee80211_chanctx_conf *new)
9875 {
9876 	struct lkpi_hw *lhw;
9877 	struct cfg80211_chan_def *cd;
9878 	uint32_t changed;
9879 	int error;
9880 	bool same;
9881 
9882 	lockdep_assert_wiphy(hw->wiphy);
9883 
9884 	lhw = HW_TO_LHW(hw);
9885 	if (!lhw->emulate_chanctx)
9886 		return (0);
9887 
9888 	if (new == NULL || new->def.chan == NULL) {
9889 		/*
9890 		 * In case of remove "new" is NULL, we need to get us to some
9891 		 * basic channel width but we'd also need to set the channel
9892 		 * accordingly somewhere.
9893 		 * The same is true if we are scanning in which case the
9894 		 * scan_chandef should have a channel set.
9895 		 */
9896 		if (lhw->scan_chandef.chan != NULL) {
9897 #ifdef LINUXKPI_DEBUG_80211
9898 			if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
9899 				ic_printf(lhw->ic, "%s:%d: using scan_chandef %p\n",
9900 				    __func__, __LINE__, &lhw->scan_chandef);
9901 #endif
9902 			cd = &lhw->scan_chandef;
9903 		} else {
9904 #ifdef LINUXKPI_DEBUG_80211
9905 			if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
9906 				ic_printf(lhw->ic, "%s:%d: using dflt_chandef %p\n",
9907 				    __func__, __LINE__, &lhw->dflt_chandef);
9908 #endif
9909 			cd = &lhw->dflt_chandef;
9910 		}
9911 	} else {
9912 #ifdef LINUXKPI_DEBUG_80211
9913 		if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
9914 			ic_printf(lhw->ic, "%s:%d: using chanctx %p chandef %p\n",
9915 			    __func__, __LINE__, new, &new->def);
9916 #endif
9917 		cd = &new->def;
9918 	}
9919 
9920 	changed = 0;
9921 	same = cfg80211_chan_def_are_same(cd, &hw->conf.chandef);
9922 	if (!same) {
9923 		/* Copy; the chan pointer is fine and will stay valid. */
9924 		hw->conf.chandef = *cd;
9925 		changed |= IEEE80211_CONF_CHANGE_CHANNEL;
9926 	}
9927 	IMPROVE("IEEE80211_CONF_CHANGE_PS, IEEE80211_CONF_CHANGE_POWER");
9928 
9929 #ifdef LINUXKPI_DEBUG_80211
9930 	if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
9931 		ic_printf(lhw->ic, "%s:%d: chanctx %p { %u } cd %p { %u } "
9932 		    "hw->conf.chandef %p { %u %d %u %u %u }, "
9933 		    "changed %#04x same %d\n",
9934 		    __func__, __LINE__,
9935 		    new, (new != NULL && new->def.chan != NULL) ?
9936 			new->def.chan->center_freq : 0,
9937 		    cd, cd->chan->center_freq,
9938 		    &hw->conf.chandef, hw->conf.chandef.chan->center_freq,
9939 		    hw->conf.chandef.width,
9940 		    hw->conf.chandef.center_freq1,
9941 		    hw->conf.chandef.center_freq2,
9942 		    hw->conf.chandef.punctured,
9943 		    changed, same);
9944 #endif
9945 
9946 	if (changed == 0)
9947 		return (0);
9948 
9949 	error = lkpi_80211_mo_config(hw, changed);
9950 	return (error);
9951 }
9952 
9953 int
9954 ieee80211_emulate_add_chanctx(struct ieee80211_hw *hw,
9955     struct ieee80211_chanctx_conf *chanctx_conf)
9956 {
9957 	int error;
9958 
9959 	lockdep_assert_wiphy(hw->wiphy);
9960 
9961 #ifdef LINUXKPI_DEBUG_80211
9962 	if ((linuxkpi_debug_80211 & D80211_TRACE) != 0) {
9963 		struct lkpi_hw *lhw;
9964 
9965 		lhw = HW_TO_LHW(hw);
9966 		ic_printf(lhw->ic, "%s:%d: chanctx_conf %p\n",
9967 		    __func__, __LINE__, chanctx_conf);
9968 	}
9969 #endif
9970 
9971 	hw->conf.radar_enabled = chanctx_conf->radar_enabled;
9972 	error = lkpi_80211_update_chandef(hw, chanctx_conf);
9973 	return (error);
9974 }
9975 
9976 void
9977 ieee80211_emulate_remove_chanctx(struct ieee80211_hw *hw,
9978     struct ieee80211_chanctx_conf *chanctx_conf __unused)
9979 {
9980 
9981 	lockdep_assert_wiphy(hw->wiphy);
9982 
9983 #ifdef LINUXKPI_DEBUG_80211
9984 	if ((linuxkpi_debug_80211 & D80211_TRACE) != 0) {
9985 		struct lkpi_hw *lhw;
9986 
9987 		lhw = HW_TO_LHW(hw);
9988 		ic_printf(lhw->ic, "%s:%d: chanctx_conf %p\n",
9989 		    __func__, __LINE__, chanctx_conf);
9990 	}
9991 #endif
9992 
9993 	hw->conf.radar_enabled = false;
9994 	lkpi_80211_update_chandef(hw, NULL);
9995 }
9996 
9997 void
9998 ieee80211_emulate_change_chanctx(struct ieee80211_hw *hw,
9999     struct ieee80211_chanctx_conf *chanctx_conf, uint32_t changed __unused)
10000 {
10001 
10002 	lockdep_assert_wiphy(hw->wiphy);
10003 
10004 #ifdef LINUXKPI_DEBUG_80211
10005 	if ((linuxkpi_debug_80211 & D80211_TRACE) != 0) {
10006 		struct lkpi_hw *lhw;
10007 
10008 		lhw = HW_TO_LHW(hw);
10009 		ic_printf(lhw->ic, "%s:%d: chanctx_conf %p\n",
10010 		    __func__, __LINE__, chanctx_conf);
10011 	}
10012 #endif
10013 
10014 	hw->conf.radar_enabled = chanctx_conf->radar_enabled;
10015 	lkpi_80211_update_chandef(hw, chanctx_conf);
10016 }
10017 
10018 int
10019 ieee80211_emulate_switch_vif_chanctx(struct ieee80211_hw *hw,
10020     struct ieee80211_vif_chanctx_switch *vifs, int n_vifs,
10021     enum ieee80211_chanctx_switch_mode mode __unused)
10022 {
10023 	struct ieee80211_chanctx_conf *chanctx_conf;
10024 	int error;
10025 
10026 	lockdep_assert_wiphy(hw->wiphy);
10027 
10028 	/* Sanity check. */
10029 	if (n_vifs <= 0)
10030 		return (-EINVAL);
10031 	if (vifs == NULL || vifs[0].new_ctx == NULL)
10032 		return (-EINVAL);
10033 
10034 	/*
10035 	 * What to do if n_vifs > 1?
10036 	 * Does that make sense for drivers not supporting chanctx?
10037 	 */
10038 	hw->conf.radar_enabled = vifs[0].new_ctx->radar_enabled;
10039 	chanctx_conf = vifs[0].new_ctx;
10040 	error = lkpi_80211_update_chandef(hw, chanctx_conf);
10041 	return (error);
10042 }
10043 
10044 /* -------------------------------------------------------------------------- */
10045 /* LinuxKPI 802.11 PM. */
10046 int
10047 lkpi_80211_suspend(struct ieee80211com *ic, pm_message_t state)
10048 {
10049 	struct lkpi_hw *lhw;
10050 	struct ieee80211_hw *hw;
10051 	int error;
10052 
10053 	lhw = ic->ic_softc;
10054 	hw = LHW_TO_HW(lhw);
10055 	error = 0;
10056 
10057 	/* Check:
10058 	 * - device_set_wakeup_capable() / device_can_wakeup()
10059 	 * - hw->wiphy->wowlan to be non-NULL, if so contents.
10060 	 * - hw->wiphy->max_sched_scan_ssids (rtw88)
10061 	 */
10062 	if ((lkpi_suspend_type & 0x2) != 0) {
10063 		struct cfg80211_wowlan wowlan;
10064 
10065 		IMPROVE("various options for WoWLAN");
10066 		memset(&wowlan, 0, sizeof(wowlan));
10067 		wiphy_lock(hw->wiphy);
10068 		error = lkpi_80211_mo_suspend(hw, &wowlan);
10069 		wiphy_unlock(hw->wiphy);
10070 		if (error == EOPNOTSUPP)
10071 			error = 0;
10072 	}
10073 	if ((lkpi_suspend_type & 0x1) != 0) {
10074 		struct lkpi_vif *lvif;
10075 
10076 		ieee80211_suspend_all(ic);
10077 
10078 		wiphy_lock(hw->wiphy);
10079 		/*
10080 		 * At the end of this net80211 will run a task to call
10081 		 * (*ic_parent)() which is entirely unhelpful as we do not
10082 		 * know when it will happen.  So deal with it here.
10083 		 */
10084 		TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
10085 			lkpi_80211_mo_remove_interface(hw, LVIF_TO_VIF(lvif));
10086 		}
10087 
10088 		if ((lhw->sc_flags & LKPI_MAC80211_DRV_STARTED) != 0)
10089 			lkpi_80211_mo_stop(hw, true);
10090 		wiphy_unlock(hw->wiphy);
10091 	}
10092 
10093 	if (error < 0)
10094 		error = -error;
10095 
10096 	if (error != 0)
10097 		ic_printf(ic, "%s: SUSPEND FAILED: %d\n", __func__, error);
10098 
10099 	return (error);
10100 }
10101 
10102 int
10103 lkpi_80211_resume(struct ieee80211com *ic)
10104 {
10105 	struct lkpi_hw *lhw;
10106 	struct ieee80211_hw *hw;
10107 	int error;
10108 	bool hw_scan_running;
10109 
10110 	lhw = ic->ic_softc;
10111 	hw = LHW_TO_HW(lhw);
10112 	error = 0;
10113 
10114 	/*
10115 	 * Ongoing HW scans during suspend are a problem on resume.
10116 	 * Be verbose about that.
10117 	 */
10118 	LKPI_80211_LHW_SCAN_LOCK(lhw);
10119 	hw_scan_running = (lhw->scan_flags & (LKPI_LHW_SCAN_RUNNING|LKPI_LHW_SCAN_HW)) != 0;
10120 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
10121 	if (hw_scan_running)
10122 		ic_printf(ic, "%s: WARNING: ongoing hw scan on resume!\n", __func__);
10123 
10124 	if ((lkpi_suspend_type & 0x1) != 0) {
10125 		struct lkpi_vif *lvif;
10126 
10127 		wiphy_lock(hw->wiphy);
10128 		error = lkpi_80211_mo_start(hw);
10129 		if (error != 0 && error != EEXIST) {
10130 			ic_printf(ic, "%s: mo_start failed: %d\n",
10131 			    __func__, error);
10132 			wiphy_unlock(hw->wiphy);
10133 			goto err;
10134 		}
10135 
10136 		TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
10137 			error = lkpi_80211_mo_add_interface(hw, LVIF_TO_VIF(lvif));
10138 			if (error != 0) {
10139 				struct ieee80211vap *vap;
10140 
10141 				vap = LVIF_TO_VAP(lvif);
10142 				ic_printf(ic, "%s: mo_add_interface %s failed: %d\n",
10143 				    __func__, if_name(vap->iv_ifp), error);
10144 				wiphy_unlock(hw->wiphy);
10145 				goto err;
10146 			}
10147 		}
10148 		wiphy_unlock(hw->wiphy);
10149 
10150 		ieee80211_resume_all(ic);
10151 	}
10152 
10153 	if ((lkpi_suspend_type & 0x2) != 0) {
10154 		wiphy_lock(hw->wiphy);
10155 		error = lkpi_80211_mo_resume(hw);
10156 		wiphy_unlock(hw->wiphy);
10157 		if (error == EOPNOTSUPP)
10158 			error = 0;
10159 	}
10160 
10161 err:
10162 	if (error < 0)
10163 		error = -error;
10164 
10165 	return (error);
10166 }
10167 
10168 /* -------------------------------------------------------------------------- */
10169 MODULE_VERSION(linuxkpi_wlan, 1);
10170 MODULE_DEPEND(linuxkpi_wlan, linuxkpi, 1, 1, 1);
10171 MODULE_DEPEND(linuxkpi_wlan, wlan, 1, 1, 1);
10172